[M] Change in openvpn[master]: ssl_openssl: Fix some CRL mixups

Attention is currently required from: MaxF, davidben, flichtenheld.

plaisthos has posted comments on this change by davidben. ( http://gerrit.openvpn.net/c/openvpn/+/1289?usp=email )

Change subject: ssl_openssl: Fix some CRL mixups
......................................................................


Patch Set 12: Code-Review+2

(1 comment)

File src/openvpn/ssl_openssl.c:

http://gerrit.openvpn.net/c/openvpn/+/1289/comment/6820491f_1542525e?usp=email :
PS12, Line 321:     X509_STORE_CTX_set0_crls(ctx, session->opt->ssl_ctx->crls);
> Does this function copy the CRLs into ctx, or a pointer to them? If it's the latter, does this modif […]
set0/get0 in OpenSSL terms mean no copy being made. We are really passing the pointer. 

This is not super avoid but     session->opt->ssl_ctx is a pointer that points to the global tls_root_ctx. Commit 44dd39b3ef actually makes it a real pointer. Before it was as well but in a very weird way that all the pointers in that ssl_ctx would point to a global object but ssl_ctx still being local.

The pointer is technically dangling but since we set that before every access of it (in the callback), the pointer is also always updated.



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1289?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I31ac2a763209114267c35c4a9182a12d8d82f6fe
Gerrit-Change-Number: 1289
Gerrit-PatchSet: 12
Gerrit-Owner: davidben <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: MaxF <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Attention: davidben <[email protected]>
Gerrit-Attention: MaxF <[email protected]>
Gerrit-Comment-Date: Wed, 15 Apr 2026 18:16:05 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: MaxF <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel