Commit 7f89714e authored by Bodo Möller's avatar Bodo Möller
Browse files

Support verify_depth from the SSL API without need for user-defined 

callbacks.

Submitted by:
Reviewed by:
PR:
parent 69bb35ed

CHANGES

+7 −0
Original line number Diff line number Diff line
@@ -5,6 +5,13 @@ 


 Changes between 0.9.2b and 0.9.3



  *) Support verify_depth from the SSL API.

     x509_vfy.c had what can be considered an off-by-one-error:

     Its depth (which was not part of the external interface)

     was actually counting the number of certificates in a chain;

     now it really counts the depth.

     [Bodo Moeller]



  *) New function SSL_CTX_set_session_id_context that allows to set a default

     value (so that you don't need SSL_set_session_id_context for each

     connection using the SSL_CTX).

crypto/x509/x509_lu.c

+1 −1
Original line number Diff line number Diff line
@@ -391,7 +391,7 @@ void X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509, 
	ctx->last_untrusted=0;

	ctx->valid=0;

	ctx->chain=NULL;

	ctx->depth=10;

	ctx->depth=9;

	ctx->error=0;

	ctx->current_cert=NULL;

	memset(&(ctx->ex_data),0,sizeof(CRYPTO_EX_DATA));

crypto/x509/x509_vfy.c

+2 −2
Original line number Diff line number Diff line
@@ -143,7 +143,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx) 
	for (;;)

		{

		/* If we have enough, we break */

		if (depth <= num) break;

		if (depth < num) break;



		/* If we are self signed, we break */

		xn=X509_get_issuer_name(x);
@@ -206,7 +206,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx) 
	for (;;)

		{

		/* If we have enough, we break */

		if (depth <= num) break;

		if (depth < num) break;



		/* If we are self signed, we break */

		xn=X509_get_issuer_name(x);

crypto/x509/x509_vfy.h

+4 −2
Original line number Diff line number Diff line
@@ -169,7 +169,7 @@ typedef struct x509_store_st 


	CRYPTO_EX_DATA ex_data;

	int references;

	int depth;		/* how deep to look (still unused) */

	int depth;		/* how deep to look (still unused -- X509_STORE_CTX's depth is used) */

	}  X509_STORE;



#define X509_STORE_set_depth(ctx,d)       ((ctx)->depth=(d))
@@ -191,7 +191,7 @@ struct x509_lookup_st 
/* This is a temporary used when processing cert chains.  Since the

 * gathering of the cert chain can take some time (and have to be

 * 'retried', this needs to be kept and passed around. */

struct x509_store_state_st

struct x509_store_state_st      /* X509_STORE_CTX */

	{

	X509_STORE *ctx;

	int current_method;	/* used when looking up certs */
@@ -214,6 +214,8 @@ struct x509_store_state_st 
	CRYPTO_EX_DATA ex_data;

	};



#define X509_STORE_CTX_set_depth(ctx,d)       ((ctx)->depth=(d))



#define X509_STORE_CTX_set_app_data(ctx,data) \

	X509_STORE_CTX_set_ex_data(ctx,0,data)

#define X509_STORE_CTX_get_app_data(ctx) \

ssl/ssl.h

+6 −0
Original line number Diff line number Diff line
@@ -394,6 +394,7 @@ struct ssl_ctx_st 
/**/	struct cert_st /* CERT */ *default_cert;

/**/	int read_ahead;

/**/	int verify_mode;

/**/	int verify_depth;

/**/	unsigned int sid_ctx_length;

/**/	unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];

/**/	int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx);
@@ -573,6 +574,7 @@ struct ssl_st 
	/* Used in SSL2 and SSL3 */

	int verify_mode;	/* 0 don't care about verify failure.

				 * 1 fail if verify fails */

	int verify_depth;

	int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */

	void (*info_callback)(); /* optional informational callback */
@@ -851,9 +853,11 @@ BIO * SSL_get_wbio(SSL *s); 
int	SSL_set_cipher_list(SSL *s, char *str);

void	SSL_set_read_ahead(SSL *s, int yes);

int	SSL_get_verify_mode(SSL *s);

int	SSL_get_verify_depth(SSL *s);

int	(*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *);

void	SSL_set_verify(SSL *s, int mode,

		       int (*callback)(int ok,X509_STORE_CTX *ctx));

void	SSL_set_verify_depth(SSL *s, int depth);

#ifndef NO_RSA

int	SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);

#endif
@@ -912,9 +916,11 @@ X509 * SSL_get_peer_certificate(SSL *s); 
STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s);



int SSL_CTX_get_verify_mode(SSL_CTX *ctx);

int SSL_CTX_get_verify_depth(SSL_CTX *ctx);

int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *);

void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,

			int (*callback)(int, X509_STORE_CTX *));

void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth);

void SSL_CTX_set_cert_verify_cb(SSL_CTX *ctx, int (*cb)(),char *arg);

#ifndef NO_RSA

int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);