Re: patches for X509_EXTENSION and a few other things

Conrad Steenberg wrote:

I'll post a link on Friday. The code is a little too "result oriented" 
right now.

Matt Rodriguez
> Hi Matt
>
> Could you perhaps send a link to the code you use to create the proxy
> certificates with M2Crypto?
>
> Thanks!
>
> Conrad
>
> On Tue, 2005-11-29 at 17:45 -0800, Matt Rodriguez wrote:
>   
>> I've done a little work with M2Crypto because I've been using it to 
>> generate proxy certificates. Proxy Certificates need to have a proxy 
>> certificate info extension for openssl to recognize them. Openssl 
>> versions 0.9.8 and later have support for proxy certificates. 
>>
>> So here are the changes that I've made.
>>
>> 1. I added a as_der method to the EVP class in EVP.py. This calls 
>> i2d_PUBKEY to
>> get the DER encoding.
>>
>> 2. I changed the new_extensions function in X509. It initializes a LHASH 
>> and a
>> X509V3_CTX objects, and passes them into the X509V3_ext_conf function. I 
>> did this
>> was because to use the ProxyCertInfo extension it needed an initialized 
>> context object,
>> otherwise I would get a segmentation fault. This is because the 
>> X509_EXTENSION_METHOD object assoctiated with PCI does not contain v2i 
>> or s2i functions. The method does have an r2i function, but the 
>> do_ext_nconf  does a check
>> on the context to see if it has a db or db_meth object. If the context 
>> is NULL then there is
>> a segmentation fault.
>>
>> If there is another way to create a PCI extension using M2Crypto without 
>> this patch, I'd like
>> to know about it. 
>>
>> 3. Changes to setup.py. I've mentioned this in previous posts. I added 
>> an option so that one
>> could build M2Crypto against openssl that is installed in an arbitrary 
>> location.
>>
>> 4. I added a quick test to test_evp.py that tests the as_der method.
>>
>> 5. I fixed an obvious memory leak in _x509.i in the x509_extension_get_name.
>>
>> I've tested these changes with openssl-0.9.8a using valgrind to make 
>> sure my changes
>> didn't leak any more memory.
>>
>>
>> Please let me know if there are any problems with the patches or if 
>> there is anything I can
>> do to facilitate adding these patches to M2Crypto.
>>
>> Matt Rodriguez
>>