Ben Laurie wrote:
>
> Dr Stephen Henson wrote:
> > 4. There is no way to lookup by other methods, for example lookup by
> > subject key id (needed for proper certificate chain verification) or
> > lookup by issuer name (needed to find matching certificates in an SSL
> > client when authentication is requested). To add new lookup methods you
> > need to add new function pointers to the X509_LOOKUP_METHOD structure
> > and this breaks all existing code!
>
> Not sure I understand this one: so long as you are prepared to recompile
> existing code, any new function pointers will be NULL.
>
Yes you're right provided you can recompile existing code.
I was getting a bit ahead of myself there. One of the other desirable
(IMHO) requirements I didn't mention was that a driver could be written
that exists as a shared library which can then be used by other
applications. In that case the driver source might not even be
available.
In that case I think that adding extra lookup methods will fall over
because they might point to garbage.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
