From eebf4d462af4e3fa6153b16d82a417e97409ad41 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Fri, 26 Jun 2026 06:03:32 +0000
Subject: x509_vfy: sync get_crl_sk() with BoringSSL and OpenSSL

Among CRLs with the same score prefer the one with the most recent
lastUpdate (RFC 5280 thisUpdate). This pulls in OpenSSL commits
626aa248, e032117d, 8b7c51a0 from 2016, so before the license change.
This uses the annoying ASN1_TIME_diff() API, but there is no better
way, really. Every other ASN1_TIME API will be just as awkward.

This fixes the currently failing x509_crl test cases.

ok kenjiro
---
 src/lib/libcrypto/x509/x509_vfy.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index b8e87e8597..993d057d10 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.152 2026/06/22 19:29:41 tb Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.153 2026/06/26 06:03:32 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1074,12 +1074,24 @@ get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl,
 		reasons = *preasons;
 		crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
 
-		if (crl_score > best_score) {
-			best_crl = crl;
-			best_crl_issuer = crl_issuer;
-			best_score = crl_score;
-			best_reasons = reasons;
+		if (crl_score < best_score || crl_score == 0)
+			continue;
+
+		if (crl_score == best_score && best_crl != NULL) {
+			int day, sec;
+
+			if (!ASN1_TIME_diff(&day, &sec, best_crl->crl->lastUpdate,
+			    crl->crl->lastUpdate))
+				continue;
+
+			if (day <= 0 && sec <= 0)
+				continue;
 		}
+
+		best_crl = crl;
+		best_crl_issuer = crl_issuer;
+		best_score = crl_score;
+		best_reasons = reasons;
 	}
 
 	if (best_crl != NULL) {
-- 
cgit v1.2.3-55-g6feb