Functions that plug into various plug points in the OpenSSL path validation mechanism. More...
Functions that plug into various plug points in the OpenSSL path validation mechanism.
These functions add CRL checking, X509 Extension handling and proxy validation.
typedef int(* globus_gsi_extension_callback_t)(globus_gsi_callback_data_t callback_data, X509_EXTENSION *extension) |
Typedef for a callback that may be registered for dealing with unhandled X.509 extension.
globus_result_t globus_gsi_callback_get_X509_STORE_callback_data_index | ( | int * | index | ) |
Retrieve or create the index for our callback data structure in the X509_STORE.
index | Will contain the index upon return |
globus_result_t globus_gsi_callback_get_SSL_callback_data_index | ( | int * | index | ) |
Retrieve or create the index for our callback data structure in the SSL structure.
index | Will contain the index upon return |
int globus_gsi_callback_X509_verify_cert | ( | X509_STORE_CTX * | context, | |
void * | arg | |||
) |
This function wraps the OpenSSL certificate verification callback for the purpose of a replacing the standard issuer check with one that deals with proxy certificates.
Should be used with SSL_CTX_set_cert_verify_callback()
context | The X509_STORE_CTX for which to register the callback. | |
arg | Arguments to the callback. Currently ignored. |
int globus_gsi_callback_create_proxy_callback | ( | int | preverify_ok, | |
X509_STORE_CTX * | x509_context | |||
) |
This function provides a path validation callback for validation outside of a SSL session.
It should be used in X509_STORE_set_verify_cb_func().
preverify_ok | Communicates the result of default validation steps performed by OpenSSL | |
x509_context | The validation state object |
int globus_gsi_callback_handshake_callback | ( | int | preverify_ok, | |
X509_STORE_CTX * | x509_context | |||
) |
This function provides a path validation callback for the validation part of establishing a SSL session.
It handles proxy certificates, X509 Extensions and CRL checking. It should be used in SSL_CTX_set_verify().
preverify_ok | Communicates the result of default validation steps performed by OpenSSL | |
x509_context | The validation state object. |
int globus_gsi_callback_check_issued | ( | X509_STORE_CTX * | context, | |
X509 * | cert, | |||
X509 * | issuer | |||
) |
This function wraps the OpenSSL X509_check_issued() call and catches the error caused by the fact that a proxy certificate issuer may not have to have the correct KeyUsage fields set.
context | The validation state object. | |
cert | The certificate to check | |
issuer | The issuer certificate to check |
about globus |
globus toolkit |
dev.globus
Comments? webmaster@globus.org