Dr Stephen Henson wrote:
>
> Ben Laurie wrote:
> >
> > Dr Stephen Henson wrote:
> > > 4. There is no way to lookup by other methods, for example lookup by
> > > subject key id (needed for proper certificate chain verification) or
> > > lookup by issuer name (needed to find matching certificates in an SSL
> > > client when authentication is requested). To add new lookup methods you
> > > need to add new function pointers to the X509_LOOKUP_METHOD structure
> > > and this breaks all existing code!
> >
> > Not sure I understand this one: so long as you are prepared to recompile
> > existing code, any new function pointers will be NULL.
> >
>
> Yes you're right provided you can recompile existing code.
>
> I was getting a bit ahead of myself there. One of the other desirable
> (IMHO) requirements I didn't mention was that a driver could be written
> that exists as a shared library which can then be used by other
> applications. In that case the driver source might not even be
> available.
>
> In that case I think that adding extra lookup methods will fall over
> because they might point to garbage.
In that case you use magic numbers to avoid looking for the extra
methods.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
