These functions add CRL checking, X509 Extension handling and proxy validation.
typedef int(*) globus_gsi_extension_callback_t(globus_gsi_callback_data_t callback_data, X509_EXTENSION *extension) |
Typedef for a callback that may be registered for dealing with unhandled X.509 extension.
globus_result_t globus_gsi_callback_get_X509_STORE_callback_data_index | ( | int * | index | ) |
Retrieve or create the index for our callback data structure in the X509_STORE.
index | Will contain the index upon return |
globus_result_t globus_gsi_callback_get_SSL_callback_data_index | ( | int * | index | ) |
Retrieve or create the index for our callback data structure in the SSL structure.
index | Will contain the index upon return |
int globus_gsi_callback_X509_verify_cert | ( | X509_STORE_CTX * | context, | |
void * | arg | |||
) |
This function wraps the OpenSSL certificate verification callback for the purpose of a replacing the standard issuer check with one that deals with proxy certificates.
Should be used with SSL_CTX_set_cert_verify_callback()
context | The X509_STORE_CTX for which to register the callback. | |
arg | Arguments to the callback. Currently ignored. |
int globus_gsi_callback_create_proxy_callback | ( | int | preverify_ok, | |
X509_STORE_CTX * | x509_context | |||
) |
This function provides a path validation callback for validation outside of a SSL session.
It should be used in X509_STORE_set_verify_cb_func().
preverify_ok | Communicates the result of default validation steps performed by OpenSSL | |
x509_context | The validation state object |
int globus_gsi_callback_handshake_callback | ( | int | preverify_ok, | |
X509_STORE_CTX * | x509_context | |||
) |
This function provides a path validation callback for the validation part of establishing a SSL session.
It handles proxy certificates, X509 Extensions and CRL checking. It should be used in SSL_CTX_set_verify().
preverify_ok | Communicates the result of default validation steps performed by OpenSSL | |
x509_context | The validation state object. |
int globus_gsi_callback_check_issued | ( | X509_STORE_CTX * | context, | |
X509 * | cert, | |||
X509 * | issuer | |||
) |
This function wraps the OpenSSL X509_check_issued() call and catches the error caused by the fact that a proxy certificate issuer may not have to have the correct KeyUsage fields set.
context | The validation state object. | |
cert | The certificate to check | |
issuer | The issuer certificate to check |
about globus |
globus toolkit |
dev.globus
Comments? webmaster@globus.org