openbsd/src/lib/libcrypto/ts/ts_rsp_verify.c, branch OPENBSD_7_9_BASE

Avoid type confusion in the timestamp response parsing

2026-01-27T14:18:32+00:00

A malformed v2 signing cert can lead to a type confusion, and the result is a read from an invalid memory address or NULL, so a crash. Unlike for OpenSSL, v1 signing certs aren't affected since miod fixed this in '14. Reported by Luigino Camastra, fix by Bob Beck, via OpenSSL, CVE 2025-69420. ok jsing

Replace trivial uses of ASN1_STRING_data()

2025-12-05T14:19:27+00:00

Almost entirely mechanical diff that ensures that for read-only accesses we use the const correct ASN1_STRING_get0_data(). Arguably, in most places the better fix would be to reach into ASN1_STRING but then we have to think and bikeshed... ok beck kenjiro

Use err_local.h rather than err.h in most places

2025-05-10T05:54:39+00:00

ok jsing

Hide symbols in ts

2023-07-07T07:25:21+00:00

ok jsing@

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Start making ts opaque

2022-07-24T08:16:47+00:00

Move the not yet exposed EssCertIDv2 struct internals to ts_local.h and move the ASN.1 function prototypes that we don't want to expose with them. Include ts_local.h where necessary or where it will be needed soon. ok jsing

Handle X509_check_purpose(3) and EVP_get_digestbyobj(3)

2022-07-17T19:40:38+00:00

OK tb

Add initial support for ESSCertIDv2 verification

2022-07-17T17:00:44+00:00

Based on OpenSSL commit f0ef20bf386b5c37ba5a4ce5c1de9a819bbeffb2 "Added support for ESSCertIDv2". This makes TS validation work in the new security/libdigidocpp port. Input OK tb

Avoid direct X509 structure access

2022-07-16T16:42:58+00:00

Cherry-picked from OpenSSL commit a8d8e06b0ac06c421fd11cc1772126dcb98f79ae. This reduces upcoming TS changes. OK jsing tb

Include evp_locl.h where it will be needed once most structs from

2021-12-12T21:30:14+00:00

evp.h will be moved to evp_locl.h in an upcoming bump. ok inoguchi