Ben Laurie wrote:
>
> Dr Stephen Henson wrote:
> >
> > Ben Laurie wrote:
> > >
> > > Dr Stephen Henson wrote:
> > > > 4. There is no way to lookup by other methods, for example lookup by
> > > > subject key id (needed for proper certificate chain verification) or
> > > > lookup by issuer name (needed to find matching certificates in an SSL
> > > > client when authentication is requested). To add new lookup methods you
> > > > need to add new function pointers to the X509_LOOKUP_METHOD structure
> > > > and this breaks all existing code!
> > >
> > > Not sure I understand this one: so long as you are prepared to recompile
> > > existing code, any new function pointers will be NULL.
> > >
> >
> > Yes you're right provided you can recompile existing code.
> >
> > I was getting a bit ahead of myself there. One of the other desirable
> > (IMHO) requirements I didn't mention was that a driver could be written
> > that exists as a shared library which can then be used by other
> > applications. In that case the driver source might not even be
> > available.
> >
> > In that case I think that adding extra lookup methods will fall over
> > because they might point to garbage.
>
> In that case you use magic numbers to avoid looking for the extra
> methods.
>
I suppose this could be done by having a number in the structure which
says which version of the API is supported. Not at the beginning though
because that is taken. This does present problems if the someone wants
to add a device specific "search by" method.
Unfortunately some of the other problems make it tricky to extend the
structure because the current lookups only return one matching object.
Personally I'd prefer dumping it entirely because it wasn't intended to
be used for a full database like API.
I was thinking more along the lines of the PKCS#11 (but cut down a bit)
to handle this kind of thing where you treat each 'object' as a set of
'attributes' and can search for objects that match a given attribute.
Something like:
int search(X509DB *db, int obj_type, int attr_type, void *attr,
int attrlen, STACK **ret);
You need something like this when you want to examine and modify the
returned objects anyway. Having lots of little change_this_attr or
get_this_attr could get unmanagable very quickly. Though macros for 'get
certificate/CRL/key from object' would be useful.
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
