Commit bbb72003 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Fix typo in rsautl. 

Add support for settable verify time in X509_verify_cert().

Document rsautl utility.
parent 4af6e243

CHANGES

+45 −41
Original line number Original line Diff line number Diff line
@@ -4,6 +4,10 @@ 




 Changes between 0.9.5a and 0.9.6  [xx XXX 2000]

 Changes between 0.9.5a and 0.9.6  [xx XXX 2000]





  *) Allow the verify time to be set by an application,

     rather than always using the current time.

     [Steve Henson]

  

  *) Phase 2 verify code reorganisation. The certificate

  *) Phase 2 verify code reorganisation. The certificate

     verify code now looks up an issuer certificate by a

     verify code now looks up an issuer certificate by a

     number of criteria: subject name, authority key id

     number of criteria: subject name, authority key id

apps/rsautl.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -141,7 +141,7 @@ int MAIN(int argc, char **argv) 
		argv++;

		argv++;

	}

	}





	if(need_priv && (key_type == KEY_PRIVKEY)) {

	if(need_priv && (key_type != KEY_PRIVKEY)) {

		BIO_printf(bio_err, "A private key is needed for this operation\n");

		BIO_printf(bio_err, "A private key is needed for this operation\n");

		goto end;

		goto end;

	}

	}

crypto/x509/x509.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -800,7 +800,9 @@ RSA *RSAPrivateKey_dup(RSA *rsa); 




#endif /* !SSLEAY_MACROS */

#endif /* !SSLEAY_MACROS */





int		X509_cmp_time(ASN1_TIME *s, time_t *t);

int		X509_cmp_current_time(ASN1_TIME *s);

int		X509_cmp_current_time(ASN1_TIME *s);

ASN1_TIME *	X509_time_adj(ASN1_TIME *s, long adj, time_t *t);

ASN1_TIME *	X509_gmtime_adj(ASN1_TIME *s, long adj);

ASN1_TIME *	X509_gmtime_adj(ASN1_TIME *s, long adj);





const char *	X509_get_default_cert_area(void );

const char *	X509_get_default_cert_area(void );

crypto/x509/x509_vfy.c

+31 −6
Original line number Original line Diff line number Diff line
@@ -429,6 +429,7 @@ static int internal_verify(X509_STORE_CTX *ctx) 
	int i,ok=0,n;

	int i,ok=0,n;

	X509 *xs,*xi;

	X509 *xs,*xi;

	EVP_PKEY *pkey=NULL;

	EVP_PKEY *pkey=NULL;

	time_t *ptime;

	int (*cb)();

	int (*cb)();





	cb=ctx->verify_cb;

	cb=ctx->verify_cb;
@@ -438,8 +439,9 @@ static int internal_verify(X509_STORE_CTX *ctx) 
	ctx->error_depth=n-1;

	ctx->error_depth=n-1;

	n--;

	n--;

	xi=sk_X509_value(ctx->chain,n);

	xi=sk_X509_value(ctx->chain,n);

	if (X509_NAME_cmp(X509_get_subject_name(xi),

	if(ctx->flags & X509_V_FLAG_USE_CHECK_TIME) ptime = &ctx->check_time;

		X509_get_issuer_name(xi)) == 0)

	else ptime = NULL;

	if (ctx->check_issued(ctx, xi, xi))

		xs=xi;

		xs=xi;

	else

	else

		{

		{
@@ -485,7 +487,7 @@ static int internal_verify(X509_STORE_CTX *ctx) 
			EVP_PKEY_free(pkey);

			EVP_PKEY_free(pkey);

			pkey=NULL;

			pkey=NULL;





			i=X509_cmp_current_time(X509_get_notBefore(xs));

			i=X509_cmp_time(X509_get_notBefore(xs), ptime);

			if (i == 0)

			if (i == 0)

				{

				{

				ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;

				ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
@@ -503,7 +505,7 @@ static int internal_verify(X509_STORE_CTX *ctx) 
			xs->valid=1;

			xs->valid=1;

			}

			}





		i=X509_cmp_current_time(X509_get_notAfter(xs));

		i=X509_cmp_time(X509_get_notAfter(xs), ptime);

		if (i == 0)

		if (i == 0)

			{

			{

			ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;

			ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
@@ -540,6 +542,11 @@ end: 
	}

	}





int X509_cmp_current_time(ASN1_TIME *ctm)

int X509_cmp_current_time(ASN1_TIME *ctm)

{

	return X509_cmp_time(ctm, NULL);

}



int X509_cmp_time(ASN1_TIME *ctm, time_t *cmp_time)

	{

	{

	char *str;

	char *str;

	ASN1_TIME atm;

	ASN1_TIME atm;
@@ -594,7 +601,7 @@ int X509_cmp_current_time(ASN1_TIME *ctm) 
	atm.length=sizeof(buff2);

	atm.length=sizeof(buff2);

	atm.data=(unsigned char *)buff2;

	atm.data=(unsigned char *)buff2;





	X509_gmtime_adj(&atm,-offset*60);

	X509_time_adj(&atm,-offset*60, cmp_time);





	if(ctm->type == V_ASN1_UTCTIME)

	if(ctm->type == V_ASN1_UTCTIME)

		{

		{
@@ -614,10 +621,17 @@ int X509_cmp_current_time(ASN1_TIME *ctm) 
	}

	}





ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj)

ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long adj)

{

	return X509_time_adj(s, adj, NULL);

}



ASN1_TIME *X509_time_adj(ASN1_TIME *s, long adj, time_t *in_tm)

	{

	{

	time_t t;

	time_t t;





	time(&t);

	if(in_tm) t = *in_tm;

	else time(&t);



	t+=adj;

	t+=adj;

	if(!s) return ASN1_TIME_set(s, t);

	if(!s) return ASN1_TIME_set(s, t);

	if(s->type == V_ASN1_UTCTIME) return(ASN1_UTCTIME_set(s,t));

	if(s->type == V_ASN1_UTCTIME) return(ASN1_UTCTIME_set(s,t));
@@ -855,6 +869,17 @@ void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) 
	memset(&ctx->ex_data,0,sizeof(CRYPTO_EX_DATA));

	memset(&ctx->ex_data,0,sizeof(CRYPTO_EX_DATA));

	}

	}





void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, long flags)

	{

		ctx->flags |= flags;

	}



void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, long flags, time_t t)

	{

		ctx->check_time = t;

		ctx->flags |= X509_V_FLAG_USE_CHECK_TIME;

	}



IMPLEMENT_STACK_OF(X509)

IMPLEMENT_STACK_OF(X509)

IMPLEMENT_ASN1_SET_OF(X509)

IMPLEMENT_ASN1_SET_OF(X509)

crypto/x509/x509_vfy.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -380,6 +380,8 @@ int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose); 
int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);

int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);

int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,

int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,

				int purpose, int trust);

				int purpose, int trust);

void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, long flags);

void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, long flags, time_t t);





#ifdef  __cplusplus

#ifdef  __cplusplus

}

}