From: Bodo Moeller <[EMAIL PROTECTED]>
moeller> If we add the paramter list declaration for app_verify_callback to
moeller> ssl/ssl.h and ssl/ssl_lib.c (which I think we should do for type
moeller> safety), applications written for old releases will not compile
moeller> without modification if they use SSL_CTX_set_cert_verify_callback().
moeller> But the only application that I know of that actually uses this
moeller> function is by myself, and I can accept this incompatibility.
Considering how we have behaved so far, I'm not sure I see that as a
problem in any case. Remember all the changes in the DES
implementation? Remember the constification? I believe we have
bigger changes crashing on the application authors than this
particular beastie...
Also, even when SSL_CTX_set_cert_verify_callback() *is* used, in how
many places do you think you'll find it in a typical application? I'm
guessing at just a few, and a patch would probably be really easy to
deliver.
About how many places it's used, I can count 3 so far: you, D.K. and
sendmail. I don't think that's too much. This is relatively low-impact.
--
Richard Levitte \ Spannv�gen 38, II \ [EMAIL PROTECTED]
Redakteur@Stacken \ S-168 35 BROMMA \ T: +46-8-26 52 47
\ SWEDEN \ or +46-733-72 88 11
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Software Engineer, GemPlus: http://www.gemplus.com/
Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
