aboutsummaryrefslogtreecommitdiffstats
path: root/lib/public_key/include
diff options
context:
space:
mode:
authorIngela Anderton Andin <[email protected]>2010-09-03 15:04:49 +0200
committerIngela Anderton Andin <[email protected]>2010-09-06 14:52:50 +0200
commit71e720e56888faa6da3856d5c5e08c8e983c9d5d (patch)
tree5d04ed4f0ac8ce5ecf6855f2af9f7523d6adacc3 /lib/public_key/include
parente752dcdefda84291cf819036a600b983326dae25 (diff)
downloadotp-71e720e56888faa6da3856d5c5e08c8e983c9d5d.tar.gz
otp-71e720e56888faa6da3856d5c5e08c8e983c9d5d.tar.bz2
otp-71e720e56888faa6da3856d5c5e08c8e983c9d5d.zip
Handling of path validation errors by the application
Changed the behavior of the verify_fun option so that the application can be responsible for handling path validation errors even on the server side. Also replaced the not yet documented validate_extensions_fun to be handled by the verify_fun instead. If the verify callback fun returns {fail, Reason}, the verification process is immediately stopped and an alert is sent to the peer and the TLS/SSL handshake is terminated. If the verify callback fun returns {valid, UserState}, the verification process is continued. If the verify callback fun always returns {valid, UserState}, the TLS/SSL handshake will not be terminated with respect to verification failures and the connection will be established. The verify callback fun will also be able to verify application specific extensions.
Diffstat (limited to 'lib/public_key/include')
-rw-r--r--lib/public_key/include/public_key.hrl11
1 files changed, 9 insertions, 2 deletions
diff --git a/lib/public_key/include/public_key.hrl b/lib/public_key/include/public_key.hrl
index 6503321042..82681502ab 100644
--- a/lib/public_key/include/public_key.hrl
+++ b/lib/public_key/include/public_key.hrl
@@ -1,7 +1,7 @@
%%
%% %CopyrightBegin%
%%
-%% Copyright Ericsson AB 2008-2009. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
%%
%% The contents of this file are subject to the Erlang Public License,
%% Version 1.1, (the "License"); you may not use this file except in
@@ -28,6 +28,13 @@
algorithm,
parameters = asn1_NOVALUE}).
+-define(DEFAULT_VERIFYFUN,
+ {fun(_,{bad_cert, _} = Reason, _) ->
+ {fail, Reason};
+ (_,{extension, _}, UserState) ->
+ {unknown, UserState}
+ end, []}).
+
-record(path_validation_state, {
valid_policy_tree,
explicit_policy,
@@ -42,7 +49,7 @@
working_public_key_parameters,
working_issuer_name,
max_path_length,
- acc_errors, %% If verify_none option is set
+ verify_fun,
user_state
}).