[[EMAIL PROTECTED] - Thu Jun 6 08:55:05 2002]:
> On Wed, Jun 05, 2002 at 03:10:58PM +0200, Lutz Jaenicke via RT wrote:
> >
> > [[EMAIL PROTECTED] - Wed Jun 5 14:48:52 2002]:
> >
> > > ck_ssl.c: In function k_tn_tls_negotiate':
> > > ck_ssl.c:3232: ID_uniqueIdentifier' undeclared (first use in this
> > > function)
> > > ck_ssl.c:3232: (Each undeclared identifier is reported only once
> > > ck_ssl.c:3232: for each function it appears in.)
> > > ck_ssl.c: In function k_ssl_incoming':
> > > ck_ssl.c:3529: ID_uniqueIdentifier' undeclared (first use in this
> > > function)
> > > *** Error code 1
>
> Thank you for a reply.
> >
> > The problem is caused by inconsistent definitions for the OID
> values.
> > According to RFC2256, the OID 2.5.4.45 is assigned to
> > X500UniqueIdentifier. UniqueIdentifier was assigned to
> > pilotAttributeType.44 in RFC1274.
> > If you have a look into crypto/objects/objects.txt you will see,
> that
> > this was (still is) commented out. The reason is that
> UniqueIdentifier
> > was (incorrectly) used for 2.5.4.45...
> > In OpenSSL 0.9.7 I renamed the entry for 2.5.4.45 to fully comply
> with
> > RFC2256. Now UniqueIdentifier is missing, as I did not uncomment the
> > entry for RFC1274 (otherwise maybe nobody would have noted and only
> > later strange failures would have been reported).
> I see.
>
> Let's discuss how to fix it!?
>
> For instance, mod_ssl 2.8.8-1.3.24 use workaround:
> #ifndef NID_uniqueIdentifier
> #define NID_uniqueIdentifier 102
> #endif
I don't like this option. As it is now, the new (correct)
NID_uniqueIdentifier is not yet enabled. Once it is, this mechanism will
fail.
> ######
> ######
> ######
>
> Also, markus@ created this temp patch:
> +@@ -102,6 +104,13 @@
> + !ERROR This module requires OpenSSL 0.9.5a or higher
> + #endif /* OPENSSL_VERSION_NUMBER */
> + #endif /* SSLDLL */
> ++
> ++#if OPENSSL_VERSION_NUMBER < 0x00907000L
> ++#else
> ++ #ifndef NID_UniqueIdentifier
> ++ #define NID_uniqueIdentifier NID_x500UniqueIdentifier
> ++ #endif
> ++#endif
> +
> + static int auth_ssl_valid = 0;
> + static char *auth_ssl_name = 0; /* this holds the oneline name */
That looks better, but not finally good enough. I think that the correct
solution would be something like:
* Replace all occurences of NID_UniqueIdentifier with
ID_X500UniqueIdentifier.
* Then:
#if OPENSSL_VERSION_NUMBER < 0x00907000L
#define NID_X500UniqueIdentifier NID_UniqueIdentifier
#endif
Of course, this will still break compatibility with application not
especially prepared.
Best regards,
Lutz
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
