getting ssl.SSLSocket.session brings to memory leak

[vetonyx]

Bug report

Bug description:

Ubuntu 22.04
python 3.12, python3.11

import ssl
import socket
import time
host = '192.168.16.66' # some server we can connect with https as example
port = 443

session = None
context = ssl._create_unverified_context(protocol=ssl.PROTOCOL_TLSv1_2)
with socket.create_connection((host, port)) as sock:
    with context.wrap_socket(sock, server_hostname=host, session = session) as ssock:
        for i in range(300000):
            session = ssock.session

print('Sleeping')
time.sleep(200)

Here is part of script that is used for "ssl reuse" session during connection to server
Running this script brings to memory leak (process memory increased from 322Mb to 2.5Gb).
Memory is not freed on "time.sleep" instruction
Not reproduced on python 3.8

CPython versions tested on:

3.11, 3.12

Operating systems tested on:

Linux

Linked PRs

• gh-116810: fix memory leak in ssl module #123249
• [3.13] gh-116810: fix memory leak in ssl module (GH-123249) #124800
• [3.12] gh-116810: fix memory leak in ssl module (GH-123249) #124801

[stanleyu]

I'm using cherrypy to run a very simple HTTPS web service. It started leaking memory when switched from python3.9 to python3.11. Very likely the same issue.

[jeffvanvoorst]

Specifically, the function PySSL_get_session( ) has a work around for a bug in OpenSSL 1.1.0. However, the move from Python 3.9 to 3.11 removed the macros for OpenSSL versions. Now, the session is duplicated (by _ssl_session_dup( )) and pointer is saved in the session variable. Next SSL_get1_session( ) is used to return a pointer to the session and overwrites the address saved in the session variable. The duplicated session is leaked.