diff options
author | Dr. Stephen Henson <steve@openssl.org> | 1999-11-27 01:14:04 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 1999-11-27 01:14:04 +0000 |
commit | 9868232ae1c0aaac34e0f96643031d68a5e417d3 (patch) | |
tree | da774d784d8d50dd263846e1a6cabf49fe842918 /crypto/x509 | |
parent | d4cec6a13dfb2c1d1ddf66dff499aaf21bbbf002 (diff) | |
download | openssl-9868232ae1c0aaac34e0f96643031d68a5e417d3.tar.gz |
Initial trust code: allow setting of trust checking functions
in a table. Doesn't do too much yet.
Make the -<digestname> options in 'x509' affect all relevant
options.
Change the name of the 'notrust' options to 'reject' as this
causes less confusion and is a better description of the
effect.
A few constification changes.
Diffstat (limited to 'crypto/x509')
-rw-r--r-- | crypto/x509/Makefile.ssl | 4 | ||||
-rw-r--r-- | crypto/x509/x509.h | 51 | ||||
-rw-r--r-- | crypto/x509/x509_err.c | 1 | ||||
-rw-r--r-- | crypto/x509/x509_req.c | 2 | ||||
-rw-r--r-- | crypto/x509/x_all.c | 6 |
5 files changed, 45 insertions, 19 deletions
diff --git a/crypto/x509/Makefile.ssl b/crypto/x509/Makefile.ssl index f29efbaf9a..db2aa5057d 100644 --- a/crypto/x509/Makefile.ssl +++ b/crypto/x509/Makefile.ssl @@ -27,13 +27,13 @@ LIBSRC= x509_def.c x509_d2.c x509_r2x.c x509_cmp.c \ x509_set.c x509rset.c x509_err.c \ x509name.c x509_v3.c x509_ext.c \ x509type.c x509_lu.c x_all.c x509_txt.c \ - by_file.c by_dir.c + x509_trs.c by_file.c by_dir.c LIBOBJ= x509_def.o x509_d2.o x509_r2x.o x509_cmp.o \ x509_obj.o x509_req.o x509spki.o x509_vfy.o \ x509_set.o x509rset.o x509_err.o \ x509name.o x509_v3.o x509_ext.o \ x509type.o x509_lu.o x_all.o x509_txt.o \ - by_file.o by_dir.o + x509_trs.o by_file.o by_dir.o SRC= $(LIBSRC) diff --git a/crypto/x509/x509.h b/crypto/x509/x509.h index ed08dfb74a..227bbaf1ca 100644 --- a/crypto/x509/x509.h +++ b/crypto/x509/x509.h @@ -236,7 +236,7 @@ typedef struct x509_cinf_st * the end of the certificate itself */ -/* Bit values for trust/notrust */ +/* Bit values for trust/reject */ #define X509_TRUST_BIT_ALL 0 #define X509_TRUST_BIT_SSL_CLIENT 1 @@ -248,9 +248,9 @@ typedef struct x509_cinf_st typedef struct x509_cert_aux_st { ASN1_BIT_STRING *trust; /* trusted uses */ - ASN1_BIT_STRING *notrust; /* rejected uses */ + ASN1_BIT_STRING *reject; /* rejected uses */ STACK_OF(ASN1_OBJECT) *othertrust; /* extra uses */ - STACK_OF(ASN1_OBJECT) *othernotrust; /* extra rejected uses */ + STACK_OF(ASN1_OBJECT) *otherreject; /* extra rejected uses */ ASN1_UTF8STRING *alias; /* "friendly name" */ ASN1_TYPE *other; /* other unspecified info */ } X509_CERT_AUX; @@ -284,16 +284,29 @@ typedef struct x509_trust_st { int trust_flags; int (*check_trust)(struct x509_trust_st *, X509 *, int); char *trust_name; - int trust_bit; - void *usr_data; + int arg1; + void *arg2; } X509_TRUST; -/* X509 trust ids */ +DECLARE_STACK_OF(X509_TRUST) + +/* standard trust ids */ #define X509_TRUST_ANY 1 #define X509_TRUST_SSL_CLIENT 2 #define X509_TRUST_SSL_SERVER 3 #define X509_TRUST_EMAIL 4 +#define X509_TRUST_OBJECT_SIGN 5 + +/* trust_flags values */ +#define X509_TRUST_DYNAMIC 1 +#define X509_TRUST_DYNAMIC_NAME 2 + +/* check_trust return codes */ + +#define X509_TRUST_TRUSTED 1 +#define X509_TRUST_REJECTED 2 +#define X509_TRUST_UNTRUSTED 3 typedef struct X509_revoked_st { @@ -615,8 +628,8 @@ int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md); int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md); int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md); -int X509_digest(X509 *data,EVP_MD *type,unsigned char *md,unsigned int *len); -int X509_NAME_digest(X509_NAME *data,EVP_MD *type, +int X509_digest(X509 *data,const EVP_MD *type,unsigned char *md,unsigned int *len); +int X509_NAME_digest(X509_NAME *data,const EVP_MD *type, unsigned char *md,unsigned int *len); #endif @@ -701,7 +714,7 @@ const char * X509_get_default_cert_dir_env(void ); const char * X509_get_default_cert_file_env(void ); const char * X509_get_default_private_dir(void ); -X509_REQ * X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md); +X509_REQ * X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md); X509 * X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey); void ERR_load_X509_strings(void ); @@ -803,12 +816,12 @@ X509_CERT_AUX * d2i_X509_CERT_AUX(X509_CERT_AUX **a,unsigned char **pp, int X509_alias_set(X509 *x, unsigned char *name, int len); unsigned char * X509_alias_get(X509 *x, int *len); int X509_trust_set_bit(X509 *x, int bit, int value); -int X509_notrust_set_bit(X509 *x, int bit, int value); +int X509_reject_set_bit(X509 *x, int bit, int value); int X509_add_trust_object(X509 *x, ASN1_OBJECT *obj); -int X509_add_notrust_object(X509 *x, ASN1_OBJECT *obj); +int X509_add_reject_object(X509 *x, ASN1_OBJECT *obj); int X509_trust_set_bit_asc(X509 *x, char *str, int value); -int X509_notrust_set_bit_asc(X509 *x, char *str, int value); +int X509_reject_set_bit_asc(X509 *x, char *str, int value); X509_REVOKED * X509_REVOKED_new(void); void X509_REVOKED_free(X509_REVOKED *a); @@ -857,7 +870,7 @@ char * X509_NAME_oneline(X509_NAME *a,char *buf,int size); int ASN1_verify(int (*i2d)(), X509_ALGOR *algor1, ASN1_BIT_STRING *signature,char *data,EVP_PKEY *pkey); -int ASN1_digest(int (*i2d)(),EVP_MD *type,char *data, +int ASN1_digest(int (*i2d)(),const EVP_MD *type,char *data, unsigned char *md,unsigned int *len); int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2, @@ -1040,6 +1053,17 @@ EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8); PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey); PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken); +int X509_check_trust(X509 *x, int id, int flags); +int X509_TRUST_get_count(void); +X509_TRUST * X509_TRUST_iget(int idx); +int X509_TRUST_get_by_id(int id); +int X509_TRUST_add(X509_TRUST *xp); +void X509_TRUST_cleanup(void); +void X509_TRUST_add_standard(void); +int X509_TRUST_get_id(X509_TRUST *xp); +char *X509_TRUST_iget_name(X509_TRUST *xp); +int X509_TRUST_get_trust(X509_TRUST *xp); + /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes * made after this point may be overwritten when the script is next run. @@ -1077,6 +1101,7 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken); #define X509_F_X509_STORE_ADD_CERT 124 #define X509_F_X509_STORE_ADD_CRL 125 #define X509_F_X509_TO_X509_REQ 126 +#define X509_F_X509_TRUST_ADD 133 #define X509_F_X509_VERIFY_CERT 127 /* Reason codes. */ diff --git a/crypto/x509/x509_err.c b/crypto/x509/x509_err.c index 58e13c6c6b..c185bc02f8 100644 --- a/crypto/x509/x509_err.c +++ b/crypto/x509/x509_err.c @@ -94,6 +94,7 @@ static ERR_STRING_DATA X509_str_functs[]= {ERR_PACK(0,X509_F_X509_STORE_ADD_CERT,0), "X509_STORE_add_cert"}, {ERR_PACK(0,X509_F_X509_STORE_ADD_CRL,0), "X509_STORE_add_crl"}, {ERR_PACK(0,X509_F_X509_TO_X509_REQ,0), "X509_to_X509_REQ"}, +{ERR_PACK(0,X509_F_X509_TRUST_ADD,0), "X509_TRUST_ADD"}, {ERR_PACK(0,X509_F_X509_VERIFY_CERT,0), "X509_verify_cert"}, {0,NULL} }; diff --git a/crypto/x509/x509_req.c b/crypto/x509/x509_req.c index b52a59c263..b20305c6ee 100644 --- a/crypto/x509/x509_req.c +++ b/crypto/x509/x509_req.c @@ -66,7 +66,7 @@ #include <openssl/buffer.h> #include <openssl/pem.h> -X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md) +X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md) { X509_REQ *ret; X509_REQ_INFO *ri; diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c index 4973c18eae..e2db82780d 100644 --- a/crypto/x509/x_all.c +++ b/crypto/x509/x_all.c @@ -411,19 +411,19 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne) (char *(*)())d2i_X509_NAME_ENTRY,(char *)ne)); } -int X509_digest(X509 *data, EVP_MD *type, unsigned char *md, +int X509_digest(X509 *data, const EVP_MD *type, unsigned char *md, unsigned int *len) { return(ASN1_digest((int (*)())i2d_X509,type,(char *)data,md,len)); } -int X509_NAME_digest(X509_NAME *data, EVP_MD *type, unsigned char *md, +int X509_NAME_digest(X509_NAME *data, const EVP_MD *type, unsigned char *md, unsigned int *len) { return(ASN1_digest((int (*)())i2d_X509_NAME,type,(char *)data,md,len)); } -int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, EVP_MD *type, +int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, const EVP_MD *type, unsigned char *md, unsigned int *len) { return(ASN1_digest((int (*)())i2d_PKCS7_ISSUER_AND_SERIAL,type, |