generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add new test option set the version in generated certificates: this

Browse Source 
is needed to test some profiles/protocols which reject certificates
with unsupported versions.
(cherry picked from commit df316fd43c5b1e063b84279f245087a578b67e9b)
This commit is contained in:
Dr. Stephen Henson 2012-11-30 19:24:13 +00:00
parent 0d04af1e72
commit 8c33e40d2e
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
apps/x509.c
View File

@ -166,6 +166,9 @@ static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,
CONF *conf, char *section, ASN1_INTEGER *sno); CONF *conf, char *section, ASN1_INTEGER *sno);
static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt); static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
static int reqfile=0; static int reqfile=0;
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
static int force_version=2;
#endif
int MAIN(int, char **); int MAIN(int, char **);
@ -288,6 +291,13 @@ int MAIN(int argc, char **argv)
if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv))) if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
goto bad; goto bad;
} }
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
else if (strcmp(*argv,"-force_version") == 0)
{
if (--argc < 1) goto bad;
force_version=atoi(*(++argv)) - 1;
}
#endif
else if (strcmp(*argv,"-days") == 0) else if (strcmp(*argv,"-days") == 0)
{ {
if (--argc < 1) goto bad; if (--argc < 1) goto bad;
@ -1247,7 +1257,11 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
if (conf) if (conf)
{ {
X509V3_CTX ctx2; X509V3_CTX ctx2;
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
X509_set_version(x, force_version);
#else
X509_set_version(x,2); /* version 3 certificate */ X509_set_version(x,2); /* version 3 certificate */
#endif
X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0); X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);
X509V3_set_nconf(&ctx2, conf); X509V3_set_nconf(&ctx2, conf);
if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) goto end; if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) goto end;
@ -1325,7 +1339,11 @@ static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *dig
if (conf) if (conf)
{ {
X509V3_CTX ctx; X509V3_CTX ctx;
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
X509_set_version(x, force_version);
#else
X509_set_version(x,2); /* version 3 certificate */ X509_set_version(x,2); /* version 3 certificate */
#endif
X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0); X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0);
X509V3_set_nconf(&ctx, conf); X509V3_set_nconf(&ctx, conf);
if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) goto err; if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) goto err;