openbsd/src/lib/libcrypto/x509/x509cset.c, branch OPENBSD_7_9_BASE

Remove unused sequence member from x509_revoked_st

2025-10-10T11:31:13+00:00

To allow binary search for looking up if a cert was revoked in a CRL, the list of revoked serial numbers is sorted in crl_lookup(). On the other hand, to be able to output the DER that was actually signed by the issuer, the original order needs to be remembered. Before the encoding was cached, there was a mechanism that would restore the original order on serialization using the .sequence member. This was done without a lock and was thus racy (hilarity would ensue if one thread performed a CRL lookup while another thread serialized the same CRL). When the racy mechanism was removed in 2004, the only reader of .sequence, X509_REVOKED_seq_cmp(), was also removed, and this piece of dead code was left behind. Garbage collect it. ok kenjiro

Cosmetics, mostly removal of silly parentheses

2024-03-26T23:41:45+00:00

No change in generated assembly

Tweak versions comment for CRLs

2024-03-26T22:45:38+00:00

Reject setting invalid versions for certs, CRLs and CSRs

2024-03-26T11:09:37+00:00

The toolkit aspect bites again. Lots of invalid CRLs and CSRs are produced because people neither read the RFCs nor does the toolkit check anything it is fed. Reviewers apparently also aren't capable of remembering that they have three copy-pasted versions of the same API and that adding a version check to one of the might suggest adding one for the other two. This requires ruby-openssl 20240326p0 to pass ok beck job jsing

libressl _namespace.h: adjust _ALIAS() to require a semicolon

2023-02-16T08:38:17+00:00

LCRYPTO_ALIAS() and LSSL_ALIAS() contained a trailing semicolon. This does not conform to style(9), breaks editors and ctags and (most importantly) my workflow. Fix this by neutering them with asm("") so that -Wpedantic doesn't complain. There's precedent in libc's namespace.h fix suggested by & ok jsing

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Hide public symbols in libcrypto/x509 .c files

2022-11-14T17:48:50+00:00

ok tb@

Move the now internal X.509-related structs into x509_lcl.h.

2021-11-01T20:53:08+00:00

Garbage collect the now unused LIBRESSL_CRYPTO_INTERNAL and LIBRESSL_OPAQUE_X509. Include "x509_lcl.h" where needed and fix a couple of unnecessary reacharounds. ok jsing

Prepare to provide X509_re_X509*_tbs()

2021-10-23T11:56:10+00:00

ok beck jsing

Provide X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate().

2018-02-22T17:01:44+00:00