Re: 1.0.2 to 1.1 migration problem with verify_callback()

[Remy Lebeau]

In my verify callback (for 1.0.2, mind you), I use 
X509_STORE_CTX_get_app_data(ctx) to get the SSL* pointer. 
X509_STORE_CTX_get_app_data(ctx) is a macro in OpenSSL's "x509_vfy.h" 
header file that maps to X509_STORE_CTX_get_ex_data(ctx,0) (why doesn't 
it use SSL_get_ex_data_X509_STORE_CTX_idx() instead of 0?).



Remy Lebeau
Lebeau Software

On 8/5/2019 7:40 AM, Matt Caswell wrote:

 From within your callback you can do this to get hold of the SSL object:

SSL *s = (SSL *)X509_STORE_CTX_get_ex_data(ctx,
SSL_get_ex_data_X509_STORE_CTX_idx());

And then this to get hold of the hostname requested:

const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);

Re: [openssl-users] Custom X509_LOOKUP_METHOD in OpenSSL 1.1

[Remy Lebeau]

I would definitely need something like this.  I have some library code 
that uses OpenSSL 1.0.2 (can't upgrade to 1.1.x yet because of all the 
interface changes), and it currently has to use a custom 
X509_LOOKUP_METHOD to handle Unicode filenames on Windows (in fact, this 
library had to completely replace several OpenSSL functions in order to 
work with Unicode filenames for things like certificate files, key 
files, etc).


It would be REALLY REALLY nice if OpenSSL worked with Unicode 
filenames/paths consistently on Windows!  BIO functions like 
BIO_new_file(), BIO_read_filename(), etc do support UTF-8 encoded 
filenames on Windows, but not all SSL functions use BIOs to access 
files/directories, so UTF-8 filenames/paths are only supported 
consistently on POSIX platforms whose file/directory APIs accept UTF-8 
encoded strings.  Windows does not support that, filenames/paths must be 
encoded in ANSI or UTF-16 only.


What is OpenSSL's current status regarding this?


Remy Lebeau
Lebeau Software

On 2/7/2018 3:59 PM, Salz, Rich via openssl-users wrote:


Yes, if there’s something that was made impossible to do because of 
things being made opaque, adding the missing API’s would be a bugfix 
and go into 1.1.0 and beyond.  It woud be great if you could create a PR.





-- 
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users