1 /* 2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include "internal/cryptlib.h" 12 #include <openssl/buffer.h> 13 #include <openssl/bn.h> 14 #include <openssl/objects.h> 15 #include <openssl/x509.h> 16 #include <openssl/x509v3.h> 17 #include "crypto/asn1.h" 18 #include "crypto/x509.h" 19 20 #ifndef OPENSSL_NO_STDIO 21 int X509_print_fp(FILE *fp, X509 *x) 22 { 23 return X509_print_ex_fp(fp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); 24 } 25 26 int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, 27 unsigned long cflag) 28 { 29 BIO *b; 30 int ret; 31 32 if ((b = BIO_new(BIO_s_file())) == NULL) { 33 ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB); 34 return 0; 35 } 36 BIO_set_fp(b, fp, BIO_NOCLOSE); 37 ret = X509_print_ex(b, x, nmflag, cflag); 38 BIO_free(b); 39 return ret; 40 } 41 #endif 42 43 int X509_print(BIO *bp, X509 *x) 44 { 45 return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); 46 } 47 48 int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, 49 unsigned long cflag) 50 { 51 long l; 52 int ret = 0, i; 53 char *m = NULL, mlch = ' '; 54 int nmindent = 0, printok = 0; 55 EVP_PKEY *pkey = NULL; 56 const char *neg; 57 58 if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) { 59 mlch = '\n'; 60 nmindent = 12; 61 } 62 63 if (nmflags == X509_FLAG_COMPAT) { 64 nmindent = 16; 65 printok = 1; 66 } 67 68 if (!(cflag & X509_FLAG_NO_HEADER)) { 69 if (BIO_write(bp, "Certificate:\n", 13) <= 0) 70 goto err; 71 if (BIO_write(bp, " Data:\n", 10) <= 0) 72 goto err; 73 } 74 if (!(cflag & X509_FLAG_NO_VERSION)) { 75 l = X509_get_version(x); 76 if (l >= X509_VERSION_1 && l <= X509_VERSION_3) { 77 if (BIO_printf(bp, "%8sVersion: %ld (0x%lx)\n", "", l + 1, (unsigned long)l) <= 0) 78 goto err; 79 } else { 80 if (BIO_printf(bp, "%8sVersion: Unknown (%ld)\n", "", l) <= 0) 81 goto err; 82 } 83 } 84 if (!(cflag & X509_FLAG_NO_SERIAL)) { 85 const ASN1_INTEGER *bs = X509_get0_serialNumber(x); 86 87 if (BIO_write(bp, " Serial Number:", 22) <= 0) 88 goto err; 89 90 if (bs->length <= (int)sizeof(long)) { 91 ERR_set_mark(); 92 l = ASN1_INTEGER_get(bs); 93 ERR_pop_to_mark(); 94 } else { 95 l = -1; 96 } 97 if (l != -1) { 98 unsigned long ul; 99 if (bs->type == V_ASN1_NEG_INTEGER) { 100 ul = 0 - (unsigned long)l; 101 neg = "-"; 102 } else { 103 ul = l; 104 neg = ""; 105 } 106 if (BIO_printf(bp, " %s%lu (%s0x%lx)\n", neg, ul, neg, ul) <= 0) 107 goto err; 108 } else { 109 neg = (bs->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : ""; 110 if (BIO_printf(bp, "\n%12s%s", "", neg) <= 0) 111 goto err; 112 113 for (i = 0; i < bs->length; i++) { 114 if (BIO_printf(bp, "%02x%c", bs->data[i], 115 ((i + 1 == bs->length) ? '\n' : ':')) <= 0) 116 goto err; 117 } 118 } 119 120 } 121 122 if (!(cflag & X509_FLAG_NO_SIGNAME)) { 123 const X509_ALGOR *tsig_alg = X509_get0_tbs_sigalg(x); 124 125 if (BIO_puts(bp, " ") <= 0) 126 goto err; 127 if (X509_signature_print(bp, tsig_alg, NULL) <= 0) 128 goto err; 129 } 130 131 if (!(cflag & X509_FLAG_NO_ISSUER)) { 132 if (BIO_printf(bp, " Issuer:%c", mlch) <= 0) 133 goto err; 134 if (X509_NAME_print_ex(bp, X509_get_issuer_name(x), nmindent, nmflags) 135 < printok) 136 goto err; 137 if (BIO_write(bp, "\n", 1) <= 0) 138 goto err; 139 } 140 if (!(cflag & X509_FLAG_NO_VALIDITY)) { 141 if (BIO_write(bp, " Validity\n", 17) <= 0) 142 goto err; 143 if (BIO_write(bp, " Not Before: ", 24) <= 0) 144 goto err; 145 if (ossl_asn1_time_print_ex(bp, X509_get0_notBefore(x), ASN1_DTFLGS_RFC822) == 0) 146 goto err; 147 if (BIO_write(bp, "\n Not After : ", 25) <= 0) 148 goto err; 149 if (ossl_asn1_time_print_ex(bp, X509_get0_notAfter(x), ASN1_DTFLGS_RFC822) == 0) 150 goto err; 151 if (BIO_write(bp, "\n", 1) <= 0) 152 goto err; 153 } 154 if (!(cflag & X509_FLAG_NO_SUBJECT)) { 155 if (BIO_printf(bp, " Subject:%c", mlch) <= 0) 156 goto err; 157 if (X509_NAME_print_ex 158 (bp, X509_get_subject_name(x), nmindent, nmflags) < printok) 159 goto err; 160 if (BIO_write(bp, "\n", 1) <= 0) 161 goto err; 162 } 163 if (!(cflag & X509_FLAG_NO_PUBKEY)) { 164 X509_PUBKEY *xpkey = X509_get_X509_PUBKEY(x); 165 ASN1_OBJECT *xpoid; 166 X509_PUBKEY_get0_param(&xpoid, NULL, NULL, NULL, xpkey); 167 if (BIO_write(bp, " Subject Public Key Info:\n", 33) <= 0) 168 goto err; 169 if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0) 170 goto err; 171 if (i2a_ASN1_OBJECT(bp, xpoid) <= 0) 172 goto err; 173 if (BIO_puts(bp, "\n") <= 0) 174 goto err; 175 176 pkey = X509_get0_pubkey(x); 177 if (pkey == NULL) { 178 BIO_printf(bp, "%12sUnable to load Public Key\n", ""); 179 ERR_print_errors(bp); 180 } else { 181 EVP_PKEY_print_public(bp, pkey, 16, NULL); 182 } 183 } 184 185 if (!(cflag & X509_FLAG_NO_IDS)) { 186 const ASN1_BIT_STRING *iuid, *suid; 187 X509_get0_uids(x, &iuid, &suid); 188 if (iuid != NULL) { 189 if (BIO_printf(bp, "%8sIssuer Unique ID: ", "") <= 0) 190 goto err; 191 if (!X509_signature_dump(bp, iuid, 12)) 192 goto err; 193 } 194 if (suid != NULL) { 195 if (BIO_printf(bp, "%8sSubject Unique ID: ", "") <= 0) 196 goto err; 197 if (!X509_signature_dump(bp, suid, 12)) 198 goto err; 199 } 200 } 201 202 if (!(cflag & X509_FLAG_NO_EXTENSIONS) 203 && !X509V3_extensions_print(bp, "X509v3 extensions", 204 X509_get0_extensions(x), cflag, 8)) 205 goto err; 206 207 if (!(cflag & X509_FLAG_NO_SIGDUMP)) { 208 const X509_ALGOR *sig_alg; 209 const ASN1_BIT_STRING *sig; 210 X509_get0_signature(&sig, &sig_alg, x); 211 if (X509_signature_print(bp, sig_alg, sig) <= 0) 212 goto err; 213 } 214 if (!(cflag & X509_FLAG_NO_AUX)) { 215 if (!X509_aux_print(bp, x, 0)) 216 goto err; 217 } 218 ret = 1; 219 err: 220 OPENSSL_free(m); 221 return ret; 222 } 223 224 int X509_ocspid_print(BIO *bp, X509 *x) 225 { 226 unsigned char *der = NULL; 227 unsigned char *dertmp; 228 int derlen; 229 int i; 230 unsigned char SHA1md[SHA_DIGEST_LENGTH]; 231 ASN1_BIT_STRING *keybstr; 232 const X509_NAME *subj; 233 EVP_MD *md = NULL; 234 235 if (x == NULL || bp == NULL) 236 return 0; 237 /* 238 * display the hash of the subject as it would appear in OCSP requests 239 */ 240 if (BIO_printf(bp, " Subject OCSP hash: ") <= 0) 241 goto err; 242 subj = X509_get_subject_name(x); 243 derlen = i2d_X509_NAME(subj, NULL); 244 if (derlen <= 0) 245 goto err; 246 if ((der = dertmp = OPENSSL_malloc(derlen)) == NULL) 247 goto err; 248 i2d_X509_NAME(subj, &dertmp); 249 250 md = EVP_MD_fetch(x->libctx, SN_sha1, x->propq); 251 if (md == NULL) 252 goto err; 253 if (!EVP_Digest(der, derlen, SHA1md, NULL, md, NULL)) 254 goto err; 255 for (i = 0; i < SHA_DIGEST_LENGTH; i++) { 256 if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0) 257 goto err; 258 } 259 OPENSSL_free(der); 260 der = NULL; 261 262 /* 263 * display the hash of the public key as it would appear in OCSP requests 264 */ 265 if (BIO_printf(bp, "\n Public key OCSP hash: ") <= 0) 266 goto err; 267 268 keybstr = X509_get0_pubkey_bitstr(x); 269 270 if (keybstr == NULL) 271 goto err; 272 273 if (!EVP_Digest(ASN1_STRING_get0_data(keybstr), 274 ASN1_STRING_length(keybstr), SHA1md, NULL, md, NULL)) 275 goto err; 276 for (i = 0; i < SHA_DIGEST_LENGTH; i++) { 277 if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0) 278 goto err; 279 } 280 BIO_printf(bp, "\n"); 281 EVP_MD_free(md); 282 283 return 1; 284 err: 285 OPENSSL_free(der); 286 EVP_MD_free(md); 287 return 0; 288 } 289 290 int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent) 291 { 292 const unsigned char *s; 293 int i, n; 294 295 n = sig->length; 296 s = sig->data; 297 for (i = 0; i < n; i++) { 298 if ((i % 18) == 0) { 299 if (i > 0 && BIO_write(bp, "\n", 1) <= 0) 300 return 0; 301 if (BIO_indent(bp, indent, indent) <= 0) 302 return 0; 303 } 304 if (BIO_printf(bp, "%02x%s", s[i], ((i + 1) == n) ? "" : ":") <= 0) 305 return 0; 306 } 307 if (BIO_write(bp, "\n", 1) != 1) 308 return 0; 309 310 return 1; 311 } 312 313 int X509_signature_print(BIO *bp, const X509_ALGOR *sigalg, 314 const ASN1_STRING *sig) 315 { 316 int sig_nid; 317 int indent = 4; 318 if (BIO_printf(bp, "%*sSignature Algorithm: ", indent, "") <= 0) 319 return 0; 320 if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0) 321 return 0; 322 323 if (sig && BIO_printf(bp, "\n%*sSignature Value:", indent, "") <= 0) 324 return 0; 325 sig_nid = OBJ_obj2nid(sigalg->algorithm); 326 if (sig_nid != NID_undef) { 327 int pkey_nid, dig_nid; 328 const EVP_PKEY_ASN1_METHOD *ameth; 329 if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid)) { 330 ameth = EVP_PKEY_asn1_find(NULL, pkey_nid); 331 if (ameth && ameth->sig_print) 332 return ameth->sig_print(bp, sigalg, sig, indent + 4, 0); 333 } 334 } 335 if (BIO_write(bp, "\n", 1) != 1) 336 return 0; 337 if (sig) 338 return X509_signature_dump(bp, sig, indent + 4); 339 return 1; 340 } 341 342 int X509_aux_print(BIO *out, X509 *x, int indent) 343 { 344 char oidstr[80], first; 345 STACK_OF(ASN1_OBJECT) *trust, *reject; 346 const unsigned char *alias, *keyid; 347 int keyidlen; 348 int i; 349 if (X509_trusted(x) == 0) 350 return 1; 351 trust = X509_get0_trust_objects(x); 352 reject = X509_get0_reject_objects(x); 353 if (trust) { 354 first = 1; 355 BIO_printf(out, "%*sTrusted Uses:\n%*s", indent, "", indent + 2, ""); 356 for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) { 357 if (!first) 358 BIO_puts(out, ", "); 359 else 360 first = 0; 361 OBJ_obj2txt(oidstr, sizeof(oidstr), 362 sk_ASN1_OBJECT_value(trust, i), 0); 363 BIO_puts(out, oidstr); 364 } 365 BIO_puts(out, "\n"); 366 } else 367 BIO_printf(out, "%*sNo Trusted Uses.\n", indent, ""); 368 if (reject) { 369 first = 1; 370 BIO_printf(out, "%*sRejected Uses:\n%*s", indent, "", indent + 2, ""); 371 for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) { 372 if (!first) 373 BIO_puts(out, ", "); 374 else 375 first = 0; 376 OBJ_obj2txt(oidstr, sizeof(oidstr), 377 sk_ASN1_OBJECT_value(reject, i), 0); 378 BIO_puts(out, oidstr); 379 } 380 BIO_puts(out, "\n"); 381 } else 382 BIO_printf(out, "%*sNo Rejected Uses.\n", indent, ""); 383 alias = X509_alias_get0(x, &i); 384 if (alias) 385 BIO_printf(out, "%*sAlias: %.*s\n", indent, "", i, alias); 386 keyid = X509_keyid_get0(x, &keyidlen); 387 if (keyid) { 388 BIO_printf(out, "%*sKey Id: ", indent, ""); 389 for (i = 0; i < keyidlen; i++) 390 BIO_printf(out, "%s%02X", i ? ":" : "", keyid[i]); 391 BIO_write(out, "\n", 1); 392 } 393 return 1; 394 } 395 396 /* 397 * Helper functions for improving certificate verification error diagnostics 398 */ 399 400 int ossl_x509_print_ex_brief(BIO *bio, X509 *cert, unsigned long neg_cflags) 401 { 402 unsigned long flags = ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | 403 XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN; 404 405 if (cert == NULL) 406 return BIO_printf(bio, " (no certificate)\n") > 0; 407 if (BIO_printf(bio, " certificate\n") <= 0 408 || !X509_print_ex(bio, cert, flags, ~X509_FLAG_NO_SUBJECT)) 409 return 0; 410 if (X509_check_issued((X509 *)cert, cert) == X509_V_OK) { 411 if (BIO_printf(bio, " self-issued\n") <= 0) 412 return 0; 413 } else { 414 if (BIO_printf(bio, " ") <= 0 415 || !X509_print_ex(bio, cert, flags, ~X509_FLAG_NO_ISSUER)) 416 return 0; 417 } 418 if (!X509_print_ex(bio, cert, flags, 419 ~(X509_FLAG_NO_SERIAL | X509_FLAG_NO_VALIDITY))) 420 return 0; 421 if (X509_cmp_current_time(X509_get0_notBefore(cert)) > 0) 422 if (BIO_printf(bio, " not yet valid\n") <= 0) 423 return 0; 424 if (X509_cmp_current_time(X509_get0_notAfter(cert)) < 0) 425 if (BIO_printf(bio, " no more valid\n") <= 0) 426 return 0; 427 return X509_print_ex(bio, cert, flags, 428 ~neg_cflags & ~X509_FLAG_EXTENSIONS_ONLY_KID); 429 } 430 431 static int print_certs(BIO *bio, const STACK_OF(X509) *certs) 432 { 433 int i; 434 435 if (certs == NULL || sk_X509_num(certs) <= 0) 436 return BIO_printf(bio, " (no certificates)\n") >= 0; 437 438 for (i = 0; i < sk_X509_num(certs); i++) { 439 X509 *cert = sk_X509_value(certs, i); 440 441 if (cert != NULL) { 442 if (!ossl_x509_print_ex_brief(bio, cert, 0)) 443 return 0; 444 if (!X509V3_extensions_print(bio, NULL, 445 X509_get0_extensions(cert), 446 X509_FLAG_EXTENSIONS_ONLY_KID, 8)) 447 return 0; 448 } 449 } 450 return 1; 451 } 452 453 static int print_store_certs(BIO *bio, X509_STORE *store) 454 { 455 if (store != NULL) { 456 STACK_OF(X509) *certs = X509_STORE_get1_all_certs(store); 457 int ret = print_certs(bio, certs); 458 459 sk_X509_pop_free(certs, X509_free); 460 return ret; 461 } else { 462 return BIO_printf(bio, " (no trusted store)\n") >= 0; 463 } 464 } 465 466 /* Extend the error queue with details on a failed cert verification */ 467 int X509_STORE_CTX_print_verify_cb(int ok, X509_STORE_CTX *ctx) 468 { 469 if (ok == 0 && ctx != NULL) { 470 int cert_error = X509_STORE_CTX_get_error(ctx); 471 BIO *bio = BIO_new(BIO_s_mem()); /* may be NULL */ 472 473 BIO_printf(bio, "%s at depth = %d error = %d (%s)\n", 474 X509_STORE_CTX_get0_parent_ctx(ctx) != NULL 475 ? "CRL path validation" 476 : "Certificate verification", 477 X509_STORE_CTX_get_error_depth(ctx), 478 cert_error, X509_verify_cert_error_string(cert_error)); 479 { 480 X509_STORE *ts = X509_STORE_CTX_get0_store(ctx); 481 X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts); 482 char *str; 483 int idx = 0; 484 485 switch (cert_error) { 486 case X509_V_ERR_HOSTNAME_MISMATCH: 487 BIO_printf(bio, "Expected hostname(s) = "); 488 while ((str = X509_VERIFY_PARAM_get0_host(vpm, idx++)) != NULL) 489 BIO_printf(bio, "%s%s", idx == 1 ? "" : ", ", str); 490 BIO_printf(bio, "\n"); 491 break; 492 case X509_V_ERR_EMAIL_MISMATCH: 493 str = X509_VERIFY_PARAM_get0_email(vpm); 494 if (str != NULL) 495 BIO_printf(bio, "Expected email address = %s\n", str); 496 break; 497 case X509_V_ERR_IP_ADDRESS_MISMATCH: 498 str = X509_VERIFY_PARAM_get1_ip_asc(vpm); 499 if (str != NULL) 500 BIO_printf(bio, "Expected IP address = %s\n", str); 501 OPENSSL_free(str); 502 break; 503 default: 504 break; 505 } 506 } 507 508 BIO_printf(bio, "Failure for:\n"); 509 ossl_x509_print_ex_brief(bio, X509_STORE_CTX_get_current_cert(ctx), 510 X509_FLAG_NO_EXTENSIONS); 511 if (cert_error == X509_V_ERR_CERT_UNTRUSTED 512 || cert_error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 513 || cert_error == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 514 || cert_error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 515 || cert_error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 516 || cert_error == X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 517 || cert_error == X509_V_ERR_STORE_LOOKUP) { 518 BIO_printf(bio, "Non-trusted certs:\n"); 519 print_certs(bio, X509_STORE_CTX_get0_untrusted(ctx)); 520 BIO_printf(bio, "Certs in trust store:\n"); 521 print_store_certs(bio, X509_STORE_CTX_get0_store(ctx)); 522 } 523 ERR_raise(ERR_LIB_X509, X509_R_CERTIFICATE_VERIFICATION_FAILED); 524 ERR_add_error_mem_bio("\n", bio); 525 BIO_free(bio); 526 } 527 528 return ok; 529 } 530