]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * | |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <stdio.h> | |
11 | #include "internal/cryptlib.h" | |
12 | #include <openssl/buffer.h> | |
13 | #include <openssl/bn.h> | |
14 | #include <openssl/objects.h> | |
15 | #include <openssl/x509.h> | |
16 | #include <openssl/x509v3.h> | |
17 | #include "crypto/asn1.h" | |
18 | #include "crypto/x509.h" | |
19 | ||
20 | #ifndef OPENSSL_NO_STDIO | |
21 | int X509_print_fp(FILE *fp, X509 *x) | |
22 | { | |
23 | return X509_print_ex_fp(fp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); | |
24 | } | |
25 | ||
26 | int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, | |
27 | unsigned long cflag) | |
28 | { | |
29 | BIO *b; | |
30 | int ret; | |
31 | ||
32 | if ((b = BIO_new(BIO_s_file())) == NULL) { | |
33 | X509err(X509_F_X509_PRINT_EX_FP, ERR_R_BUF_LIB); | |
34 | return 0; | |
35 | } | |
36 | BIO_set_fp(b, fp, BIO_NOCLOSE); | |
37 | ret = X509_print_ex(b, x, nmflag, cflag); | |
38 | BIO_free(b); | |
39 | return ret; | |
40 | } | |
41 | #endif | |
42 | ||
43 | int X509_print(BIO *bp, X509 *x) | |
44 | { | |
45 | return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); | |
46 | } | |
47 | ||
48 | int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, | |
49 | unsigned long cflag) | |
50 | { | |
51 | long l; | |
52 | int ret = 0, i; | |
53 | char *m = NULL, mlch = ' '; | |
54 | int nmindent = 0; | |
55 | ASN1_INTEGER *bs; | |
56 | EVP_PKEY *pkey = NULL; | |
57 | const char *neg; | |
58 | ||
59 | if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) { | |
60 | mlch = '\n'; | |
61 | nmindent = 12; | |
62 | } | |
63 | ||
64 | if (nmflags == X509_FLAG_COMPAT) | |
65 | nmindent = 16; | |
66 | ||
67 | if (!(cflag & X509_FLAG_NO_HEADER)) { | |
68 | if (BIO_write(bp, "Certificate:\n", 13) <= 0) | |
69 | goto err; | |
70 | if (BIO_write(bp, " Data:\n", 10) <= 0) | |
71 | goto err; | |
72 | } | |
73 | if (!(cflag & X509_FLAG_NO_VERSION)) { | |
74 | l = X509_get_version(x); | |
75 | if (l >= 0 && l <= 2) { | |
76 | if (BIO_printf(bp, "%8sVersion: %ld (0x%lx)\n", "", l + 1, (unsigned long)l) <= 0) | |
77 | goto err; | |
78 | } else { | |
79 | if (BIO_printf(bp, "%8sVersion: Unknown (%ld)\n", "", l) <= 0) | |
80 | goto err; | |
81 | } | |
82 | } | |
83 | if (!(cflag & X509_FLAG_NO_SERIAL)) { | |
84 | ||
85 | if (BIO_write(bp, " Serial Number:", 22) <= 0) | |
86 | goto err; | |
87 | ||
88 | bs = X509_get_serialNumber(x); | |
89 | if (bs->length <= (int)sizeof(long)) { | |
90 | ERR_set_mark(); | |
91 | l = ASN1_INTEGER_get(bs); | |
92 | ERR_pop_to_mark(); | |
93 | } else { | |
94 | l = -1; | |
95 | } | |
96 | if (l != -1) { | |
97 | unsigned long ul; | |
98 | if (bs->type == V_ASN1_NEG_INTEGER) { | |
99 | ul = 0 - (unsigned long)l; | |
100 | neg = "-"; | |
101 | } else { | |
102 | ul = l; | |
103 | neg = ""; | |
104 | } | |
105 | if (BIO_printf(bp, " %s%lu (%s0x%lx)\n", neg, ul, neg, ul) <= 0) | |
106 | goto err; | |
107 | } else { | |
108 | neg = (bs->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : ""; | |
109 | if (BIO_printf(bp, "\n%12s%s", "", neg) <= 0) | |
110 | goto err; | |
111 | ||
112 | for (i = 0; i < bs->length; i++) { | |
113 | if (BIO_printf(bp, "%02x%c", bs->data[i], | |
114 | ((i + 1 == bs->length) ? '\n' : ':')) <= 0) | |
115 | goto err; | |
116 | } | |
117 | } | |
118 | ||
119 | } | |
120 | ||
121 | if (!(cflag & X509_FLAG_NO_SIGNAME)) { | |
122 | const X509_ALGOR *tsig_alg = X509_get0_tbs_sigalg(x); | |
123 | ||
124 | if (BIO_puts(bp, " ") <= 0) | |
125 | goto err; | |
126 | if (X509_signature_print(bp, tsig_alg, NULL) <= 0) | |
127 | goto err; | |
128 | } | |
129 | ||
130 | if (!(cflag & X509_FLAG_NO_ISSUER)) { | |
131 | if (BIO_printf(bp, " Issuer:%c", mlch) <= 0) | |
132 | goto err; | |
133 | if (X509_NAME_print_ex(bp, X509_get_issuer_name(x), nmindent, nmflags) | |
134 | < 0) | |
135 | goto err; | |
136 | if (BIO_write(bp, "\n", 1) <= 0) | |
137 | goto err; | |
138 | } | |
139 | if (!(cflag & X509_FLAG_NO_VALIDITY)) { | |
140 | if (BIO_write(bp, " Validity\n", 17) <= 0) | |
141 | goto err; | |
142 | if (BIO_write(bp, " Not Before: ", 24) <= 0) | |
143 | goto err; | |
144 | if (!ASN1_TIME_print(bp, X509_get0_notBefore(x))) | |
145 | goto err; | |
146 | if (BIO_write(bp, "\n Not After : ", 25) <= 0) | |
147 | goto err; | |
148 | if (!ASN1_TIME_print(bp, X509_get0_notAfter(x))) | |
149 | goto err; | |
150 | if (BIO_write(bp, "\n", 1) <= 0) | |
151 | goto err; | |
152 | } | |
153 | if (!(cflag & X509_FLAG_NO_SUBJECT)) { | |
154 | if (BIO_printf(bp, " Subject:%c", mlch) <= 0) | |
155 | goto err; | |
156 | if (X509_NAME_print_ex | |
157 | (bp, X509_get_subject_name(x), nmindent, nmflags) < 0) | |
158 | goto err; | |
159 | if (BIO_write(bp, "\n", 1) <= 0) | |
160 | goto err; | |
161 | } | |
162 | if (!(cflag & X509_FLAG_NO_PUBKEY)) { | |
163 | X509_PUBKEY *xpkey = X509_get_X509_PUBKEY(x); | |
164 | ASN1_OBJECT *xpoid; | |
165 | X509_PUBKEY_get0_param(&xpoid, NULL, NULL, NULL, xpkey); | |
166 | if (BIO_write(bp, " Subject Public Key Info:\n", 33) <= 0) | |
167 | goto err; | |
168 | if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0) | |
169 | goto err; | |
170 | if (i2a_ASN1_OBJECT(bp, xpoid) <= 0) | |
171 | goto err; | |
172 | if (BIO_puts(bp, "\n") <= 0) | |
173 | goto err; | |
174 | ||
175 | pkey = X509_get0_pubkey(x); | |
176 | if (pkey == NULL) { | |
177 | BIO_printf(bp, "%12sUnable to load Public Key\n", ""); | |
178 | ERR_print_errors(bp); | |
179 | } else { | |
180 | EVP_PKEY_print_public(bp, pkey, 16, NULL); | |
181 | } | |
182 | } | |
183 | ||
184 | if (!(cflag & X509_FLAG_NO_IDS)) { | |
185 | const ASN1_BIT_STRING *iuid, *suid; | |
186 | X509_get0_uids(x, &iuid, &suid); | |
187 | if (iuid != NULL) { | |
188 | if (BIO_printf(bp, "%8sIssuer Unique ID: ", "") <= 0) | |
189 | goto err; | |
190 | if (!X509_signature_dump(bp, iuid, 12)) | |
191 | goto err; | |
192 | } | |
193 | if (suid != NULL) { | |
194 | if (BIO_printf(bp, "%8sSubject Unique ID: ", "") <= 0) | |
195 | goto err; | |
196 | if (!X509_signature_dump(bp, suid, 12)) | |
197 | goto err; | |
198 | } | |
199 | } | |
200 | ||
201 | if (!(cflag & X509_FLAG_NO_EXTENSIONS)) | |
202 | X509V3_extensions_print(bp, "X509v3 extensions", | |
203 | X509_get0_extensions(x), cflag, 8); | |
204 | ||
205 | if (!(cflag & X509_FLAG_NO_SIGDUMP)) { | |
206 | const X509_ALGOR *sig_alg; | |
207 | const ASN1_BIT_STRING *sig; | |
208 | X509_get0_signature(&sig, &sig_alg, x); | |
209 | if (X509_signature_print(bp, sig_alg, sig) <= 0) | |
210 | goto err; | |
211 | } | |
212 | if (!(cflag & X509_FLAG_NO_AUX)) { | |
213 | if (!X509_aux_print(bp, x, 0)) | |
214 | goto err; | |
215 | } | |
216 | ret = 1; | |
217 | err: | |
218 | OPENSSL_free(m); | |
219 | return ret; | |
220 | } | |
221 | ||
222 | int X509_ocspid_print(BIO *bp, X509 *x) | |
223 | { | |
224 | unsigned char *der = NULL; | |
225 | unsigned char *dertmp; | |
226 | int derlen; | |
227 | int i; | |
228 | unsigned char SHA1md[SHA_DIGEST_LENGTH]; | |
229 | ASN1_BIT_STRING *keybstr; | |
230 | const X509_NAME *subj; | |
231 | ||
232 | /* | |
233 | * display the hash of the subject as it would appear in OCSP requests | |
234 | */ | |
235 | if (BIO_printf(bp, " Subject OCSP hash: ") <= 0) | |
236 | goto err; | |
237 | subj = X509_get_subject_name(x); | |
238 | derlen = i2d_X509_NAME(subj, NULL); | |
239 | if ((der = dertmp = OPENSSL_malloc(derlen)) == NULL) | |
240 | goto err; | |
241 | i2d_X509_NAME(subj, &dertmp); | |
242 | ||
243 | if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL)) | |
244 | goto err; | |
245 | for (i = 0; i < SHA_DIGEST_LENGTH; i++) { | |
246 | if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0) | |
247 | goto err; | |
248 | } | |
249 | OPENSSL_free(der); | |
250 | der = NULL; | |
251 | ||
252 | /* | |
253 | * display the hash of the public key as it would appear in OCSP requests | |
254 | */ | |
255 | if (BIO_printf(bp, "\n Public key OCSP hash: ") <= 0) | |
256 | goto err; | |
257 | ||
258 | keybstr = X509_get0_pubkey_bitstr(x); | |
259 | ||
260 | if (keybstr == NULL) | |
261 | goto err; | |
262 | ||
263 | if (!EVP_Digest(ASN1_STRING_get0_data(keybstr), | |
264 | ASN1_STRING_length(keybstr), SHA1md, NULL, EVP_sha1(), | |
265 | NULL)) | |
266 | goto err; | |
267 | for (i = 0; i < SHA_DIGEST_LENGTH; i++) { | |
268 | if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0) | |
269 | goto err; | |
270 | } | |
271 | BIO_printf(bp, "\n"); | |
272 | ||
273 | return 1; | |
274 | err: | |
275 | OPENSSL_free(der); | |
276 | return 0; | |
277 | } | |
278 | ||
279 | int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent) | |
280 | { | |
281 | const unsigned char *s; | |
282 | int i, n; | |
283 | ||
284 | n = sig->length; | |
285 | s = sig->data; | |
286 | for (i = 0; i < n; i++) { | |
287 | if ((i % 18) == 0) { | |
288 | if (i > 0 && BIO_write(bp, "\n", 1) <= 0) | |
289 | return 0; | |
290 | if (BIO_indent(bp, indent, indent) <= 0) | |
291 | return 0; | |
292 | } | |
293 | if (BIO_printf(bp, "%02x%s", s[i], ((i + 1) == n) ? "" : ":") <= 0) | |
294 | return 0; | |
295 | } | |
296 | if (BIO_write(bp, "\n", 1) != 1) | |
297 | return 0; | |
298 | ||
299 | return 1; | |
300 | } | |
301 | ||
302 | int X509_signature_print(BIO *bp, const X509_ALGOR *sigalg, | |
303 | const ASN1_STRING *sig) | |
304 | { | |
305 | int sig_nid; | |
306 | int indent = 4; | |
307 | if (BIO_printf(bp, "%*sSignature Algorithm: ", indent, "") <= 0) | |
308 | return 0; | |
309 | if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0) | |
310 | return 0; | |
311 | ||
312 | if (sig && BIO_printf(bp, "\n%*sSignature Value:", indent, "") <= 0) | |
313 | return 0; | |
314 | sig_nid = OBJ_obj2nid(sigalg->algorithm); | |
315 | if (sig_nid != NID_undef) { | |
316 | int pkey_nid, dig_nid; | |
317 | const EVP_PKEY_ASN1_METHOD *ameth; | |
318 | if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid)) { | |
319 | ameth = EVP_PKEY_asn1_find(NULL, pkey_nid); | |
320 | if (ameth && ameth->sig_print) | |
321 | return ameth->sig_print(bp, sigalg, sig, indent + 4, 0); | |
322 | } | |
323 | } | |
324 | if (BIO_write(bp, "\n", 1) != 1) | |
325 | return 0; | |
326 | if (sig) | |
327 | return X509_signature_dump(bp, sig, indent + 4); | |
328 | return 1; | |
329 | } | |
330 | ||
331 | int X509_aux_print(BIO *out, X509 *x, int indent) | |
332 | { | |
333 | char oidstr[80], first; | |
334 | STACK_OF(ASN1_OBJECT) *trust, *reject; | |
335 | const unsigned char *alias, *keyid; | |
336 | int keyidlen; | |
337 | int i; | |
338 | if (X509_trusted(x) == 0) | |
339 | return 1; | |
340 | trust = X509_get0_trust_objects(x); | |
341 | reject = X509_get0_reject_objects(x); | |
342 | if (trust) { | |
343 | first = 1; | |
344 | BIO_printf(out, "%*sTrusted Uses:\n%*s", indent, "", indent + 2, ""); | |
345 | for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) { | |
346 | if (!first) | |
347 | BIO_puts(out, ", "); | |
348 | else | |
349 | first = 0; | |
350 | OBJ_obj2txt(oidstr, sizeof(oidstr), | |
351 | sk_ASN1_OBJECT_value(trust, i), 0); | |
352 | BIO_puts(out, oidstr); | |
353 | } | |
354 | BIO_puts(out, "\n"); | |
355 | } else | |
356 | BIO_printf(out, "%*sNo Trusted Uses.\n", indent, ""); | |
357 | if (reject) { | |
358 | first = 1; | |
359 | BIO_printf(out, "%*sRejected Uses:\n%*s", indent, "", indent + 2, ""); | |
360 | for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) { | |
361 | if (!first) | |
362 | BIO_puts(out, ", "); | |
363 | else | |
364 | first = 0; | |
365 | OBJ_obj2txt(oidstr, sizeof(oidstr), | |
366 | sk_ASN1_OBJECT_value(reject, i), 0); | |
367 | BIO_puts(out, oidstr); | |
368 | } | |
369 | BIO_puts(out, "\n"); | |
370 | } else | |
371 | BIO_printf(out, "%*sNo Rejected Uses.\n", indent, ""); | |
372 | alias = X509_alias_get0(x, NULL); | |
373 | if (alias) | |
374 | BIO_printf(out, "%*sAlias: %s\n", indent, "", alias); | |
375 | keyid = X509_keyid_get0(x, &keyidlen); | |
376 | if (keyid) { | |
377 | BIO_printf(out, "%*sKey Id: ", indent, ""); | |
378 | for (i = 0; i < keyidlen; i++) | |
379 | BIO_printf(out, "%s%02X", i ? ":" : "", keyid[i]); | |
380 | BIO_write(out, "\n", 1); | |
381 | } | |
382 | return 1; | |
383 | } | |
384 | ||
385 | /* | |
386 | * Helper functions for improving certificate verification error diagnostics | |
387 | */ | |
388 | ||
389 | int x509_print_ex_brief(BIO *bio, X509 *cert, unsigned long neg_cflags) | |
390 | { | |
391 | unsigned long flags = ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | | |
392 | XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN; | |
393 | ||
394 | if (cert == NULL) | |
395 | return BIO_printf(bio, " (no certificate)\n") > 0; | |
396 | if (BIO_printf(bio, " certificate\n") <= 0 | |
397 | || !X509_print_ex(bio, cert, flags, ~X509_FLAG_NO_SUBJECT)) | |
398 | return 0; | |
399 | if (X509_check_issued((X509 *)cert, cert) == X509_V_OK) { | |
400 | if (BIO_printf(bio, " self-issued\n") <= 0) | |
401 | return 0; | |
402 | } else { | |
403 | if (BIO_printf(bio, " ") <= 0 | |
404 | || !X509_print_ex(bio, cert, flags, ~X509_FLAG_NO_ISSUER)) | |
405 | return 0; | |
406 | } | |
407 | if (!X509_print_ex(bio, cert, flags, | |
408 | ~(X509_FLAG_NO_SERIAL | X509_FLAG_NO_VALIDITY))) | |
409 | return 0; | |
410 | if (X509_cmp_current_time(X509_get0_notBefore(cert)) > 0) | |
411 | if (BIO_printf(bio, " not yet valid\n") <= 0) | |
412 | return 0; | |
413 | if (X509_cmp_current_time(X509_get0_notAfter(cert)) < 0) | |
414 | if (BIO_printf(bio, " no more valid\n") <= 0) | |
415 | return 0; | |
416 | return X509_print_ex(bio, cert, flags, ~(neg_cflags)); | |
417 | } | |
418 | ||
419 | static int print_certs(BIO *bio, const STACK_OF(X509) *certs) | |
420 | { | |
421 | int i; | |
422 | ||
423 | if (certs == NULL || sk_X509_num(certs) <= 0) | |
424 | return BIO_printf(bio, " (no certificates)\n") >= 0; | |
425 | ||
426 | for (i = 0; i < sk_X509_num(certs); i++) { | |
427 | X509 *cert = sk_X509_value(certs, i); | |
428 | if (cert != NULL && !x509_print_ex_brief(bio, cert, 0)) | |
429 | return 0; | |
430 | } | |
431 | return 1; | |
432 | } | |
433 | ||
434 | static int print_store_certs(BIO *bio, X509_STORE *store) | |
435 | { | |
436 | if (store != NULL) { | |
437 | STACK_OF(X509) *certs = X509_STORE_get1_all_certs(store); | |
438 | int ret = print_certs(bio, certs); | |
439 | ||
440 | sk_X509_pop_free(certs, X509_free); | |
441 | return ret; | |
442 | } else { | |
443 | return BIO_printf(bio, " (no trusted store)\n") >= 0; | |
444 | } | |
445 | } | |
446 | ||
447 | /* Extend the error queue with details on a failed cert verification */ | |
448 | int X509_STORE_CTX_print_verify_cb(int ok, X509_STORE_CTX *ctx) | |
449 | { | |
450 | if (ok == 0 && ctx != NULL) { | |
451 | int cert_error = X509_STORE_CTX_get_error(ctx); | |
452 | int depth = X509_STORE_CTX_get_error_depth(ctx); | |
453 | X509 *cert = X509_STORE_CTX_get_current_cert(ctx); | |
454 | BIO *bio = BIO_new(BIO_s_mem()); /* may be NULL */ | |
455 | ||
456 | BIO_printf(bio, "%s at depth=%d error=%d (%s)\n", | |
457 | X509_STORE_CTX_get0_parent_ctx(ctx) != NULL | |
458 | ? "CRL path validation" : "certificate verification", | |
459 | depth, cert_error, | |
460 | X509_verify_cert_error_string(cert_error)); | |
461 | BIO_printf(bio, "failure for:\n"); | |
462 | x509_print_ex_brief(bio, cert, X509_FLAG_NO_EXTENSIONS); | |
463 | if (cert_error == X509_V_ERR_CERT_UNTRUSTED | |
464 | || cert_error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT | |
465 | || cert_error == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN | |
466 | || cert_error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT | |
467 | || cert_error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY | |
468 | || cert_error == X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER | |
469 | || cert_error == X509_V_ERR_STORE_LOOKUP) { | |
470 | BIO_printf(bio, "non-trusted certs:\n"); | |
471 | print_certs(bio, X509_STORE_CTX_get0_untrusted(ctx)); | |
472 | BIO_printf(bio, "certs in trust store:\n"); | |
473 | print_store_certs(bio, X509_STORE_CTX_get0_store(ctx)); | |
474 | } | |
475 | CMPerr(0, X509_R_CERTIFICATE_VERIFICATION_FAILED); | |
476 | ERR_add_error_mem_bio("\n", bio); | |
477 | BIO_free(bio); | |
478 | } | |
479 | ||
480 | /* | |
481 | * TODO we could check policies here too, e.g.: | |
482 | * if (cert_error == X509_V_OK && ok == 2) | |
483 | * policies_print(NULL, ctx); | |
484 | */ | |
485 | ||
486 | return ok; | |
487 | } |