diff options
author | Richard Levitte <levitte@openssl.org> | 2005-01-17 17:06:58 +0000 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2005-01-17 17:06:58 +0000 |
commit | a7201e9a1bf1282d8a7edcdfc588a62c1217c575 (patch) | |
tree | 9ec5d102f77d5b49b02fbd09c99d3c831d2afba6 /crypto | |
parent | fcd5cca418c1efcd420cfbdcd56182e0524698c1 (diff) |
Changes concering RFC 3820 (proxy certificates) integration:
- Enforce that there should be no policy settings when the language
is one of id-ppl-independent or id-ppl-inheritAll.
- Add functionality to ssltest.c so that it can process proxy rights
and check that they are set correctly. Rights consist of ASCII
letters, and the condition is a boolean expression that includes
letters, parenthesis, &, | and ^.
- Change the proxy certificate configurations so they get proxy
rights that are understood by ssltest.c.
- Add a script that tests proxy certificates with SSL operations.
Other changes:
- Change the copyright end year in mkerr.pl.
- make update.
Diffstat (limited to 'crypto')
-rw-r--r-- | crypto/Makefile.ssl | 4 | ||||
-rw-r--r-- | crypto/comp/Makefile.ssl | 3 | ||||
-rw-r--r-- | crypto/x509/x509_vfy.c | 1 | ||||
-rw-r--r-- | crypto/x509v3/v3_pci.c | 6 | ||||
-rw-r--r-- | crypto/x509v3/v3err.c | 3 | ||||
-rw-r--r-- | crypto/x509v3/x509v3.h | 1 |
6 files changed, 14 insertions, 4 deletions
diff --git a/crypto/Makefile.ssl b/crypto/Makefile.ssl index c03bbc4562..b22e08e9e2 100644 --- a/crypto/Makefile.ssl +++ b/crypto/Makefile.ssl @@ -227,8 +227,8 @@ mem_dbg.o: ../include/openssl/stack.h ../include/openssl/symhacks.h cryptlib.h mem_dbg.o: mem_dbg.c o_dir.o: ../e_os.h ../include/openssl/e_os2.h ../include/openssl/opensslconf.h o_dir.o: LPdir_unix.c o_dir.c o_dir.h -o_str.o: ../include/openssl/e_os2.h ../include/openssl/opensslconf.h o_str.c -o_str.o: o_str.h +o_str.o: ../e_os.h ../include/openssl/e_os2.h ../include/openssl/opensslconf.h +o_str.o: o_str.c o_str.h o_time.o: ../include/openssl/e_os2.h ../include/openssl/opensslconf.h o_time.c o_time.o: o_time.h tmdiff.o: ../e_os.h ../include/openssl/bio.h ../include/openssl/buffer.h diff --git a/crypto/comp/Makefile.ssl b/crypto/comp/Makefile.ssl index 3a4b513016..c2950086ce 100644 --- a/crypto/comp/Makefile.ssl +++ b/crypto/comp/Makefile.ssl @@ -91,7 +91,8 @@ c_rle.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h c_rle.o: ../../include/openssl/symhacks.h c_rle.c c_zlib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h c_zlib.o: ../../include/openssl/comp.h ../../include/openssl/crypto.h -c_zlib.o: ../../include/openssl/e_os2.h ../../include/openssl/obj_mac.h +c_zlib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h +c_zlib.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h c_zlib.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h c_zlib.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h c_zlib.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index cbdd978a7d..ffc07cce6f 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -994,6 +994,7 @@ static int internal_verify(X509_STORE_CTX *ctx) goto end; /* The last error (if any) is still in the error value */ + ctx->current_issuer=xi; ctx->current_cert=xs; ok=(*cb)(1,ctx); if (!ok) goto end; diff --git a/crypto/x509v3/v3_pci.c b/crypto/x509v3/v3_pci.c index 42fb0d74df..b32d968619 100644 --- a/crypto/x509v3/v3_pci.c +++ b/crypto/x509v3/v3_pci.c @@ -273,6 +273,12 @@ static PROXY_CERT_INFO_EXTENSION *r2i_pci(X509V3_EXT_METHOD *method, X509V3err(X509V3_F_R2I_PCI,X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED); goto err; } + i = OBJ_obj2nid(language); + if ((i == NID_Independent || i == NID_id_ppl_inheritAll) && policy) + { + X509V3err(X509V3_F_R2I_PCI,X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY); + goto err; + } pci = PROXY_CERT_INFO_EXTENSION_new(); if (!pci) diff --git a/crypto/x509v3/v3err.c b/crypto/x509v3/v3err.c index ac96c3ff1e..e93f50da14 100644 --- a/crypto/x509v3/v3err.c +++ b/crypto/x509v3/v3err.c @@ -1,6 +1,6 @@ /* crypto/x509v3/v3err.c */ /* ==================================================================== - * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved. + * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -172,6 +172,7 @@ static ERR_STRING_DATA X509V3_str_reasons[]= {X509V3_R_POLICY_PATH_LENGTH ,"policy path length"}, {X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED,"policy path length alreadty defined"}, {X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED,"policy syntax not currently supported"}, +{X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY,"policy when proxy language requires no policy"}, {X509V3_R_SECTION_NOT_FOUND ,"section not found"}, {X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS ,"unable to get issuer details"}, {X509V3_R_UNABLE_TO_GET_ISSUER_KEYID ,"unable to get issuer keyid"}, diff --git a/crypto/x509v3/x509v3.h b/crypto/x509v3/x509v3.h index c1662e2acd..1f801eb25a 100644 --- a/crypto/x509v3/x509v3.h +++ b/crypto/x509v3/x509v3.h @@ -737,6 +737,7 @@ void ERR_load_X509V3_strings(void); #define X509V3_R_POLICY_PATH_LENGTH 156 #define X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED 157 #define X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED 158 +#define X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY 159 #define X509V3_R_SECTION_NOT_FOUND 150 #define X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS 122 #define X509V3_R_UNABLE_TO_GET_ISSUER_KEYID 123 |