On 06/11/13 17:27, Dr. Stephen Henson wrote:
On Wed, Nov 06, 2013, Rob Stradling wrote:
These 2 #defines exist for SSL_CTX-extra_certs:
SSL_CTX_add_extra_chain_cert
SSL_CTX_get_extra_chain_certs
SSL_CTX_clear_extra_chain_certs
In 1.0.2-dev, the #defines such as SSL_CTX_add0_chain_cert allow me
to specify different chains for different certificate types, but
AFAICT there are no associated get() or clear() functions.
I can't see a way to squeeze a standalone SSL_CTX_get_chain_certs
function into SSL_CTX_ctrl(). There's only 1 pointer argument
available, so I can't pass in an X509* (to indicate which cert I
want the chain for) and get back a STACK_OF(X509)* (the chain).
One option would be to have another SSL_CTX_ctrl #define called
SSL_CTX_get_cert_type, which would accept an X509* and return the
index of that cert (i.e. SSL_CTX-CERT-pkeys[index]-x509), or -1
if not found. That index could then be passed to
SSL_CTX_get_chain_certs in the larg argument.
However, since the SSL_PKEY_* #defines are private (in ssl_locl.h),
I'm unsure whether exposing these values in the public APIs would be
acceptable.
The other option would be to write SSL_CTX_get_chain_certs() as a
proper function (instead of a SSL_CTX_ctrl #define), but I'm unsure
whether or not that would be better than the first option.
Any preference?
The index for certificates could change in future so I'd rather not expose it
in a public API.
Agreed. I can imagine some future version of OpenSSL being able to
accommodate several ECC certs, each with a key on a different named
curve, for example.
OpenSSL has the concept of a current certificate which could be used here.
This refers to the last certificate set. So you'd have (for example) a way to
retrieve extra chain certificates for the current certificate.
For that to work properly you'd also have to have a way to set the current
certtificate, without the risk of disturbing the existing structure.
So perhaps something like:
int SSL_set_current_cert(SSL *ssl, X509 *x);
Works for me. :-)
I think the word select instead of set in that function name might
help to make its purpose slightly clearer. (I can imagine someone who
doesn't like reading man pages thinking this function will do the same
thing as SSL_use_certificate() ).
Which returns 1 and sets the current certificate to one containing 'x' if a
match is found and returns 0 and does nothing if no match is found. Also with
an SSL_CTX version.
Does the attached patch (against the master branch) look acceptable?
Thanks.
--
Rob Stradling
Senior Research Development Scientist
COMODO - Creating Trust Online
diff --git a/doc/ssl/SSL_CTX_add1_chain_cert.pod b/doc/ssl/SSL_CTX_add1_chain_cert.pod
index 04f7526..2d2161a 100644
--- a/doc/ssl/SSL_CTX_add1_chain_cert.pod
+++ b/doc/ssl/SSL_CTX_add1_chain_cert.pod
@@ -3,9 +3,11 @@
=head1 NAME
SSL_CTX_set0_chain, SSL_CTX_set1_chain, SSL_CTX_add0_chain_cert,
-SSL_CTX_add1_chain_cert, SSL_set0_chain, SSL_set1_chain,
-SSL_add0_chain_cert, SSL_add1_chain_cert, SSL_CTX_build_cert_chain,
-SSL_build_cert_chain - extra chain certificate processing
+SSL_CTX_add1_chain_cert, SSL_CTX_get0_chain_certs, SSL_CTX_clear_chain_certs,
+SSL_set0_chain, SSL_set1_chain, SSL_add0_chain_cert, SSL_add1_chain_cert,
+SSL_get0_chain_certs, SSL_clear_chain_certs, SSL_CTX_build_cert_chain,
+SSL_build_cert_chain, SSL_CTX_select_current_cert,
+SSL_select_current_cert - extra chain certificate processing
=head1 SYNOPSIS
@@ -13,36 +15,58 @@ SSL_build_cert_chain - extra chain certificate processing
int SSL_CTX_set0_chain(SSL_CTX *ctx, STACK_OF(X509) *sk);
int SSL_CTX_set1_chain(SSL_CTX *ctx, STACK_OF(X509) *sk);
- int SSL_CTX_add0_chain_cert(SSL_CTX *ctx, STACK_OF(X509) *x509);
+ int SSL_CTX_add0_chain_cert(SSL_CTX *ctx, X509 *x509);
int SSL_CTX_add1_chain_cert(SSL_CTX *ctx, X509 *x509);
+ int SSL_CTX_get0_chain_certs(SSL_CTX *ctx, STACK_OF(X509) **sk);
+ int SSL_CTX_clear_chain_certs(SSL_CTX *ctx);
int SSL_set0_chain(SSL *ssl, STACK_OF(X509) *sk);
int SSL_set1_chain(SSL *ssl, STACK_OF(X509) *sk);
- int SSL_add0_chain_cert(SSL *ssl, STACK_OF(X509) *x509);
+ int SSL_add0_chain_cert(SSL *ssl, X509 *x509);
int SSL_add1_chain_cert(SSL *ssl, X509 *x509);
+ int SSL_get0_chain_certs(SSL *ssl, STACK_OF(X509) **sk);
+ int SSL_clear_chain_certs(SSL *ssl);
int SSL_CTX_build_cert_chain(SSL_CTX *ctx, flags);
- int SSL_build_cert_chain(SSL_CTX *ctx, flags);
+ int SSL_build_cert_chain(SSL *ssl, flags);
+
+ int SSL_CTX_select_current_cert(SSL_CTX *ctx, X509 *x509);
+ int SSL_select_current_cert(SSL *ssl, X509 *x509);
=head1 DESCRIPTION
SSL_CTX_set0_chain() and SSL_CTX_set1_chain() set the certificate chain
-associated with the current certificate of Bctx to Bsk. If Bsk is set
-to BNULL any existing chain is cleared.
+associated with the current certificate of Bctx to Bsk.
SSL_CTX_add0_chain_cert() and SSL_CTX_add1_chain_cert() append the single
certificate Bx509 to the chain
