1 | /* |
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at |
7 | * https://www.openssl.org/source/license.html |
8 | */ |
9 | |
10 | #include <stdio.h> |
11 | #include "internal/cryptlib.h" |
12 | #include <openssl/buffer.h> |
13 | #include <openssl/bn.h> |
14 | #include <openssl/objects.h> |
15 | #include <openssl/x509.h> |
16 | #include <openssl/x509v3.h> |
17 | #include "crypto/asn1.h" |
18 | |
19 | #ifndef OPENSSL_NO_STDIO |
20 | int X509_print_fp(FILE *fp, X509 *x) |
21 | { |
22 | return X509_print_ex_fp(fp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); |
23 | } |
24 | |
25 | int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, |
26 | unsigned long cflag) |
27 | { |
28 | BIO *b; |
29 | int ret; |
30 | |
31 | if ((b = BIO_new(BIO_s_file())) == NULL) { |
32 | X509err(X509_F_X509_PRINT_EX_FP, ERR_R_BUF_LIB); |
33 | return 0; |
34 | } |
35 | BIO_set_fp(b, fp, BIO_NOCLOSE); |
36 | ret = X509_print_ex(b, x, nmflag, cflag); |
37 | BIO_free(b); |
38 | return ret; |
39 | } |
40 | #endif |
41 | |
42 | int X509_print(BIO *bp, X509 *x) |
43 | { |
44 | return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); |
45 | } |
46 | |
47 | int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, |
48 | unsigned long cflag) |
49 | { |
50 | long l; |
51 | int ret = 0, i; |
52 | char *m = NULL, mlch = ' '; |
53 | int nmindent = 0; |
54 | ASN1_INTEGER *bs; |
55 | EVP_PKEY *pkey = NULL; |
56 | const char *neg; |
57 | |
58 | if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) { |
59 | mlch = '\n'; |
60 | nmindent = 12; |
61 | } |
62 | |
63 | if (nmflags == X509_FLAG_COMPAT) |
64 | nmindent = 16; |
65 | |
66 | if (!(cflag & X509_FLAG_NO_HEADER)) { |
67 | if (BIO_write(bp, "Certificate:\n" , 13) <= 0) |
68 | goto err; |
69 | if (BIO_write(bp, " Data:\n" , 10) <= 0) |
70 | goto err; |
71 | } |
72 | if (!(cflag & X509_FLAG_NO_VERSION)) { |
73 | l = X509_get_version(x); |
74 | if (l >= 0 && l <= 2) { |
75 | if (BIO_printf(bp, "%8sVersion: %ld (0x%lx)\n" , "" , l + 1, (unsigned long)l) <= 0) |
76 | goto err; |
77 | } else { |
78 | if (BIO_printf(bp, "%8sVersion: Unknown (%ld)\n" , "" , l) <= 0) |
79 | goto err; |
80 | } |
81 | } |
82 | if (!(cflag & X509_FLAG_NO_SERIAL)) { |
83 | |
84 | if (BIO_write(bp, " Serial Number:" , 22) <= 0) |
85 | goto err; |
86 | |
87 | bs = X509_get_serialNumber(x); |
88 | if (bs->length <= (int)sizeof(long)) { |
89 | ERR_set_mark(); |
90 | l = ASN1_INTEGER_get(bs); |
91 | ERR_pop_to_mark(); |
92 | } else { |
93 | l = -1; |
94 | } |
95 | if (l != -1) { |
96 | unsigned long ul; |
97 | if (bs->type == V_ASN1_NEG_INTEGER) { |
98 | ul = 0 - (unsigned long)l; |
99 | neg = "-" ; |
100 | } else { |
101 | ul = l; |
102 | neg = "" ; |
103 | } |
104 | if (BIO_printf(bp, " %s%lu (%s0x%lx)\n" , neg, ul, neg, ul) <= 0) |
105 | goto err; |
106 | } else { |
107 | neg = (bs->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : "" ; |
108 | if (BIO_printf(bp, "\n%12s%s" , "" , neg) <= 0) |
109 | goto err; |
110 | |
111 | for (i = 0; i < bs->length; i++) { |
112 | if (BIO_printf(bp, "%02x%c" , bs->data[i], |
113 | ((i + 1 == bs->length) ? '\n' : ':')) <= 0) |
114 | goto err; |
115 | } |
116 | } |
117 | |
118 | } |
119 | |
120 | if (!(cflag & X509_FLAG_NO_SIGNAME)) { |
121 | const X509_ALGOR *tsig_alg = X509_get0_tbs_sigalg(x); |
122 | |
123 | if (BIO_puts(bp, " " ) <= 0) |
124 | goto err; |
125 | if (X509_signature_print(bp, tsig_alg, NULL) <= 0) |
126 | goto err; |
127 | } |
128 | |
129 | if (!(cflag & X509_FLAG_NO_ISSUER)) { |
130 | if (BIO_printf(bp, " Issuer:%c" , mlch) <= 0) |
131 | goto err; |
132 | if (X509_NAME_print_ex(bp, X509_get_issuer_name(x), nmindent, nmflags) |
133 | < 0) |
134 | goto err; |
135 | if (BIO_write(bp, "\n" , 1) <= 0) |
136 | goto err; |
137 | } |
138 | if (!(cflag & X509_FLAG_NO_VALIDITY)) { |
139 | if (BIO_write(bp, " Validity\n" , 17) <= 0) |
140 | goto err; |
141 | if (BIO_write(bp, " Not Before: " , 24) <= 0) |
142 | goto err; |
143 | if (!ASN1_TIME_print(bp, X509_get0_notBefore(x))) |
144 | goto err; |
145 | if (BIO_write(bp, "\n Not After : " , 25) <= 0) |
146 | goto err; |
147 | if (!ASN1_TIME_print(bp, X509_get0_notAfter(x))) |
148 | goto err; |
149 | if (BIO_write(bp, "\n" , 1) <= 0) |
150 | goto err; |
151 | } |
152 | if (!(cflag & X509_FLAG_NO_SUBJECT)) { |
153 | if (BIO_printf(bp, " Subject:%c" , mlch) <= 0) |
154 | goto err; |
155 | if (X509_NAME_print_ex |
156 | (bp, X509_get_subject_name(x), nmindent, nmflags) < 0) |
157 | goto err; |
158 | if (BIO_write(bp, "\n" , 1) <= 0) |
159 | goto err; |
160 | } |
161 | if (!(cflag & X509_FLAG_NO_PUBKEY)) { |
162 | X509_PUBKEY *xpkey = X509_get_X509_PUBKEY(x); |
163 | ASN1_OBJECT *xpoid; |
164 | X509_PUBKEY_get0_param(&xpoid, NULL, NULL, NULL, xpkey); |
165 | if (BIO_write(bp, " Subject Public Key Info:\n" , 33) <= 0) |
166 | goto err; |
167 | if (BIO_printf(bp, "%12sPublic Key Algorithm: " , "" ) <= 0) |
168 | goto err; |
169 | if (i2a_ASN1_OBJECT(bp, xpoid) <= 0) |
170 | goto err; |
171 | if (BIO_puts(bp, "\n" ) <= 0) |
172 | goto err; |
173 | |
174 | pkey = X509_get0_pubkey(x); |
175 | if (pkey == NULL) { |
176 | BIO_printf(bp, "%12sUnable to load Public Key\n" , "" ); |
177 | ERR_print_errors(bp); |
178 | } else { |
179 | EVP_PKEY_print_public(bp, pkey, 16, NULL); |
180 | } |
181 | } |
182 | |
183 | if (!(cflag & X509_FLAG_NO_IDS)) { |
184 | const ASN1_BIT_STRING *iuid, *suid; |
185 | X509_get0_uids(x, &iuid, &suid); |
186 | if (iuid != NULL) { |
187 | if (BIO_printf(bp, "%8sIssuer Unique ID: " , "" ) <= 0) |
188 | goto err; |
189 | if (!X509_signature_dump(bp, iuid, 12)) |
190 | goto err; |
191 | } |
192 | if (suid != NULL) { |
193 | if (BIO_printf(bp, "%8sSubject Unique ID: " , "" ) <= 0) |
194 | goto err; |
195 | if (!X509_signature_dump(bp, suid, 12)) |
196 | goto err; |
197 | } |
198 | } |
199 | |
200 | if (!(cflag & X509_FLAG_NO_EXTENSIONS)) |
201 | X509V3_extensions_print(bp, "X509v3 extensions" , |
202 | X509_get0_extensions(x), cflag, 8); |
203 | |
204 | if (!(cflag & X509_FLAG_NO_SIGDUMP)) { |
205 | const X509_ALGOR *sig_alg; |
206 | const ASN1_BIT_STRING *sig; |
207 | X509_get0_signature(&sig, &sig_alg, x); |
208 | if (X509_signature_print(bp, sig_alg, sig) <= 0) |
209 | goto err; |
210 | } |
211 | if (!(cflag & X509_FLAG_NO_AUX)) { |
212 | if (!X509_aux_print(bp, x, 0)) |
213 | goto err; |
214 | } |
215 | ret = 1; |
216 | err: |
217 | OPENSSL_free(m); |
218 | return ret; |
219 | } |
220 | |
221 | int X509_ocspid_print(BIO *bp, X509 *x) |
222 | { |
223 | unsigned char *der = NULL; |
224 | unsigned char *dertmp; |
225 | int derlen; |
226 | int i; |
227 | unsigned char SHA1md[SHA_DIGEST_LENGTH]; |
228 | ASN1_BIT_STRING *keybstr; |
229 | X509_NAME *subj; |
230 | |
231 | /* |
232 | * display the hash of the subject as it would appear in OCSP requests |
233 | */ |
234 | if (BIO_printf(bp, " Subject OCSP hash: " ) <= 0) |
235 | goto err; |
236 | subj = X509_get_subject_name(x); |
237 | derlen = i2d_X509_NAME(subj, NULL); |
238 | if ((der = dertmp = OPENSSL_malloc(derlen)) == NULL) |
239 | goto err; |
240 | i2d_X509_NAME(subj, &dertmp); |
241 | |
242 | if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL)) |
243 | goto err; |
244 | for (i = 0; i < SHA_DIGEST_LENGTH; i++) { |
245 | if (BIO_printf(bp, "%02X" , SHA1md[i]) <= 0) |
246 | goto err; |
247 | } |
248 | OPENSSL_free(der); |
249 | der = NULL; |
250 | |
251 | /* |
252 | * display the hash of the public key as it would appear in OCSP requests |
253 | */ |
254 | if (BIO_printf(bp, "\n Public key OCSP hash: " ) <= 0) |
255 | goto err; |
256 | |
257 | keybstr = X509_get0_pubkey_bitstr(x); |
258 | |
259 | if (keybstr == NULL) |
260 | goto err; |
261 | |
262 | if (!EVP_Digest(ASN1_STRING_get0_data(keybstr), |
263 | ASN1_STRING_length(keybstr), SHA1md, NULL, EVP_sha1(), |
264 | NULL)) |
265 | goto err; |
266 | for (i = 0; i < SHA_DIGEST_LENGTH; i++) { |
267 | if (BIO_printf(bp, "%02X" , SHA1md[i]) <= 0) |
268 | goto err; |
269 | } |
270 | BIO_printf(bp, "\n" ); |
271 | |
272 | return 1; |
273 | err: |
274 | OPENSSL_free(der); |
275 | return 0; |
276 | } |
277 | |
278 | int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent) |
279 | { |
280 | const unsigned char *s; |
281 | int i, n; |
282 | |
283 | n = sig->length; |
284 | s = sig->data; |
285 | for (i = 0; i < n; i++) { |
286 | if ((i % 18) == 0) { |
287 | if (i > 0 && BIO_write(bp, "\n" , 1) <= 0) |
288 | return 0; |
289 | if (BIO_indent(bp, indent, indent) <= 0) |
290 | return 0; |
291 | } |
292 | if (BIO_printf(bp, "%02x%s" , s[i], ((i + 1) == n) ? "" : ":" ) <= 0) |
293 | return 0; |
294 | } |
295 | if (BIO_write(bp, "\n" , 1) != 1) |
296 | return 0; |
297 | |
298 | return 1; |
299 | } |
300 | |
301 | int X509_signature_print(BIO *bp, const X509_ALGOR *sigalg, |
302 | const ASN1_STRING *sig) |
303 | { |
304 | int sig_nid; |
305 | int indent = 4; |
306 | if (BIO_printf(bp, "%*sSignature Algorithm: " , indent, "" ) <= 0) |
307 | return 0; |
308 | if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0) |
309 | return 0; |
310 | |
311 | if (sig && BIO_printf(bp, "\n%*sSignature Value:" , indent, "" ) <= 0) |
312 | return 0; |
313 | sig_nid = OBJ_obj2nid(sigalg->algorithm); |
314 | if (sig_nid != NID_undef) { |
315 | int pkey_nid, dig_nid; |
316 | const EVP_PKEY_ASN1_METHOD *ameth; |
317 | if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid)) { |
318 | ameth = EVP_PKEY_asn1_find(NULL, pkey_nid); |
319 | if (ameth && ameth->sig_print) |
320 | return ameth->sig_print(bp, sigalg, sig, indent + 4, 0); |
321 | } |
322 | } |
323 | if (BIO_write(bp, "\n" , 1) != 1) |
324 | return 0; |
325 | if (sig) |
326 | return X509_signature_dump(bp, sig, indent + 4); |
327 | return 1; |
328 | } |
329 | |
330 | int X509_aux_print(BIO *out, X509 *x, int indent) |
331 | { |
332 | char oidstr[80], first; |
333 | STACK_OF(ASN1_OBJECT) *trust, *reject; |
334 | const unsigned char *alias, *keyid; |
335 | int keyidlen; |
336 | int i; |
337 | if (X509_trusted(x) == 0) |
338 | return 1; |
339 | trust = X509_get0_trust_objects(x); |
340 | reject = X509_get0_reject_objects(x); |
341 | if (trust) { |
342 | first = 1; |
343 | BIO_printf(out, "%*sTrusted Uses:\n%*s" , indent, "" , indent + 2, "" ); |
344 | for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) { |
345 | if (!first) |
346 | BIO_puts(out, ", " ); |
347 | else |
348 | first = 0; |
349 | OBJ_obj2txt(oidstr, sizeof(oidstr), |
350 | sk_ASN1_OBJECT_value(trust, i), 0); |
351 | BIO_puts(out, oidstr); |
352 | } |
353 | BIO_puts(out, "\n" ); |
354 | } else |
355 | BIO_printf(out, "%*sNo Trusted Uses.\n" , indent, "" ); |
356 | if (reject) { |
357 | first = 1; |
358 | BIO_printf(out, "%*sRejected Uses:\n%*s" , indent, "" , indent + 2, "" ); |
359 | for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) { |
360 | if (!first) |
361 | BIO_puts(out, ", " ); |
362 | else |
363 | first = 0; |
364 | OBJ_obj2txt(oidstr, sizeof(oidstr), |
365 | sk_ASN1_OBJECT_value(reject, i), 0); |
366 | BIO_puts(out, oidstr); |
367 | } |
368 | BIO_puts(out, "\n" ); |
369 | } else |
370 | BIO_printf(out, "%*sNo Rejected Uses.\n" , indent, "" ); |
371 | alias = X509_alias_get0(x, NULL); |
372 | if (alias) |
373 | BIO_printf(out, "%*sAlias: %s\n" , indent, "" , alias); |
374 | keyid = X509_keyid_get0(x, &keyidlen); |
375 | if (keyid) { |
376 | BIO_printf(out, "%*sKey Id: " , indent, "" ); |
377 | for (i = 0; i < keyidlen; i++) |
378 | BIO_printf(out, "%s%02X" , i ? ":" : "" , keyid[i]); |
379 | BIO_write(out, "\n" , 1); |
380 | } |
381 | return 1; |
382 | } |
383 | |