new oid in subject alt name

2002-04-17 Thread CAMUS Sylvie FTRD/DTL/ISS 
Title: new oid in subject alt name





Hi 
I want to add a new oid in the subject altname and I can't do it. 
I have look at sources (v3.alt.c) and i have seen the function which returns an error : 
--
GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
CONF_VALUE *cnf)
{
char is_string = 0;
int type;
GENERAL_NAME *gen = NULL; 
char *name, *value; 
name = cnf->name;
value = cnf->value; 
if(!value) {
X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_MISSING_VALUE);
return NULL;
} 
if(!(gen = GENERAL_NAME_new())) {
X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
return NULL;
} 
if(!name_cmp(name, "email")) {
is_string = 1;
type = GEN_EMAIL;
} else if(!name_cmp(name, "URI")) {
is_string = 1;
type = GEN_URI;
} else if(!name_cmp(name, "DNS")) {
is_string = 1;
type = GEN_DNS;
} else if(!name_cmp(name, "RID")) {
ASN1_OBJECT *obj;
if(!(obj = OBJ_txt2obj(value,0))) {
X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_BAD_OBJECT);
ERR_add_error_data(2, "value=", value);
goto err;
}
gen->d.rid = obj;
type = GEN_RID;
} else if(!name_cmp(name, "IP")) {
int i1,i2,i3,i4;
unsigned char ip[4];
if((sscanf(value, "%d.%d.%d.%d",&i1,&i2,&i3,&i4) != 4) ||
(i1 < 0) || (i1 > 255) || (i2 < 0) || (i2 > 255) ||
(i3 < 0) || (i3 > 255) || (i4 < 0) || (i4 > 255) ) {
X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_BAD_IP_ADDRESS);
ERR_add_error_data(2, "value=", value);
goto err;
}
ip[0] = i1; ip[1] = i2 ; ip[2] = i3 ; ip[3] = i4;
if(!(gen->d.ip = M_ASN1_OCTET_STRING_new()) ||
!ASN1_STRING_set(gen->d.ip, ip, 4)) {
X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
goto err;
}
type = GEN_IPADD;
} else {
X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_UNSUPPORTED_OPTION);
ERR_add_error_data(2, "name=", name);
goto err;
} 
if(is_string) {
if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
!ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
strlen(value))) {
X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
goto err;
}
} 
gen->type = type; 
return gen; 
err:
GENERAL_NAME_free(gen);
return NULL;
} 
---
Now, i understand why i cannot add a new oid in the subject altname. 
But, i don't understand theses restrictions about oids accepted for subject alt name (email,ip,...)? What are the reasons?

Thank you very much. 
ps : i have alreeady sent this mail in openssl-users mailing list but i haven't received any answer.

Re: How best to build certificates for New business naming scheme

2002-04-17 Thread David Lyon 

Thanks Oscar,

Your information has been very helpful.

For us, the basics is having a system that is inexpensive and works
reliably. This could never be said for X.500 and that's why we see so few
systems based on those proposed standards in the world today.

Why we are bothering, is that X.500 had many good ideas all those years ago.
We're now resurrecting those ideas and building them into a IRBM (Instant
Reliable Business Messaging) system that works.

I take my hat off to all the guys like you who are working diligently to
ensure that all the little things in OpenSSL are working properly. You're
doing a great job. Keep it up.

We on the other hand are doing something a little different that hasn't
quite been done before and we need to "break a few rules" in order to make a
system that is inexpensive whilst at the same time user friendly and
reliable.

In any case, we're having a lot of fun doing it, and our customers keep
wanting more so we have to continue.

Have a great day,

David Lyon
Product Manager
Global TradeDesk
www.globaltradedesk.com


- Original Message -
From: "Oscar Jacobsson" <[EMAIL PROTECTED]>
To: "David Lyon" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Tuesday, April 16, 2002 10:53 PM
Subject: Re: How best to build certificates for New business naming scheme


> Might I then suggest brushing up on your basics before venturing
> further?
>
> file://oscar
>
> David Lyon wrote:
> >
> > > This does break the naming recommendations given in X.521 Annex B
> > > though, which don't allow for a stateOrProvinceName.
> >
> > Yes, of course. The old Annex B, we obviously forgot about that one.
>

__
OpenSSL Project http://www.openssl.org
Development Mailing List   [EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]

Small patch to 0.9.6c crypto/objects/obj_dat.c

2002-04-17 Thread Howard Chu 

I just checked the CVS head and this patch should be valid there as well:

diff -u -r1.1 obj_dat.c
--- obj_dat.c   2002/04/18 04:34:17 1.1
+++ obj_dat.c   2002/04/18 04:35:10
@@ -437,8 +437,7 @@
return(0);
}

-   nid=OBJ_obj2nid(a);
-   if ((nid == NID_undef) || no_name) {
+   if (no_name || (nid=OBJ_obj2nid(a)) == NID_undef) {
len=a->length;
p=a->data;

(Just a slight speedup when I'm munging DNs by OID...) I hope you can commit
this for 0.9.6d/0.9.7 without too much trouble.  :)

  -- Howard Chu
  Chief Architect, Symas Corp.   Director, Highland Sun
  http://www.symas.com   http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support

__
OpenSSL Project http://www.openssl.org
Development Mailing List   [EMAIL PROTECTED]
Automated List Manager   [EMAIL PROTECTED]