[M] Change in openvpn[master]: ssl_openssl: Fix some CRL mixups

Attention is currently required from: MaxF, flichtenheld.

davidben has posted comments on this change by davidben. ( http://gerrit.openvpn.net/c/openvpn/+/1289?usp=email )

Change subject: ssl_openssl: Fix some CRL mixups
......................................................................


Patch Set 12:

(1 comment)

File src/openvpn/ssl_openssl.c:

http://gerrit.openvpn.net/c/openvpn/+/1289/comment/4e11b60a_6a1828e8?usp=email :
PS12, Line 321:     X509_STORE_CTX_set0_crls(ctx, session->opt->ssl_ctx->crls);
> Does this function copy the CRLs into ctx, or a pointer to them?

Pointer to them. set0 functions in OpenSSL generally are a pointer to them.

> If it's the latter, does this modified X509_STORE_CTX continue to exist inside the SSL_CTX after this callback?

Nope. OpenSSL is very inconsistent about the relationship between `FOO` and `FOO_CTX`. `X509_STORE` is shared configuration between certificate verifications, while `X509_STORE_CTX` is a single certificate verification operation. So this object will be freed shortly after this function returns. It's just a vehicle for passing the verification bits to the caller.

> (What I'm getting at is, do we need to worry about dangling pointers if reload_crl is called?)

Should be OK!



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1289?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I31ac2a763209114267c35c4a9182a12d8d82f6fe
Gerrit-Change-Number: 1289
Gerrit-PatchSet: 12
Gerrit-Owner: davidben <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: MaxF <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Attention: MaxF <[email protected]>
Gerrit-Comment-Date: Wed, 15 Apr 2026 17:27:38 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: MaxF <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel