1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: ct_prn.c,v 1.6 2021/12/18 16:34:52 tb Exp $ */
2*de0e0e4dSAntonio Huete Jimenez /*
3*de0e0e4dSAntonio Huete Jimenez * Written by Rob Stradling (rob@comodo.com) and Stephen Henson
4*de0e0e4dSAntonio Huete Jimenez * (steve@openssl.org) for the OpenSSL project 2014.
5*de0e0e4dSAntonio Huete Jimenez */
6*de0e0e4dSAntonio Huete Jimenez /* ====================================================================
7*de0e0e4dSAntonio Huete Jimenez * Copyright (c) 2014 The OpenSSL Project. All rights reserved.
8*de0e0e4dSAntonio Huete Jimenez *
9*de0e0e4dSAntonio Huete Jimenez * Redistribution and use in source and binary forms, with or without
10*de0e0e4dSAntonio Huete Jimenez * modification, are permitted provided that the following conditions
11*de0e0e4dSAntonio Huete Jimenez * are met:
12*de0e0e4dSAntonio Huete Jimenez *
13*de0e0e4dSAntonio Huete Jimenez * 1. Redistributions of source code must retain the above copyright
14*de0e0e4dSAntonio Huete Jimenez * notice, this list of conditions and the following disclaimer.
15*de0e0e4dSAntonio Huete Jimenez *
16*de0e0e4dSAntonio Huete Jimenez * 2. Redistributions in binary form must reproduce the above copyright
17*de0e0e4dSAntonio Huete Jimenez * notice, this list of conditions and the following disclaimer in
18*de0e0e4dSAntonio Huete Jimenez * the documentation and/or other materials provided with the
19*de0e0e4dSAntonio Huete Jimenez * distribution.
20*de0e0e4dSAntonio Huete Jimenez *
21*de0e0e4dSAntonio Huete Jimenez * 3. All advertising materials mentioning features or use of this
22*de0e0e4dSAntonio Huete Jimenez * software must display the following acknowledgment:
23*de0e0e4dSAntonio Huete Jimenez * "This product includes software developed by the OpenSSL Project
24*de0e0e4dSAntonio Huete Jimenez * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25*de0e0e4dSAntonio Huete Jimenez *
26*de0e0e4dSAntonio Huete Jimenez * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27*de0e0e4dSAntonio Huete Jimenez * endorse or promote products derived from this software without
28*de0e0e4dSAntonio Huete Jimenez * prior written permission. For written permission, please contact
29*de0e0e4dSAntonio Huete Jimenez * licensing@OpenSSL.org.
30*de0e0e4dSAntonio Huete Jimenez *
31*de0e0e4dSAntonio Huete Jimenez * 5. Products derived from this software may not be called "OpenSSL"
32*de0e0e4dSAntonio Huete Jimenez * nor may "OpenSSL" appear in their names without prior written
33*de0e0e4dSAntonio Huete Jimenez * permission of the OpenSSL Project.
34*de0e0e4dSAntonio Huete Jimenez *
35*de0e0e4dSAntonio Huete Jimenez * 6. Redistributions of any form whatsoever must retain the following
36*de0e0e4dSAntonio Huete Jimenez * acknowledgment:
37*de0e0e4dSAntonio Huete Jimenez * "This product includes software developed by the OpenSSL Project
38*de0e0e4dSAntonio Huete Jimenez * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39*de0e0e4dSAntonio Huete Jimenez *
40*de0e0e4dSAntonio Huete Jimenez * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41*de0e0e4dSAntonio Huete Jimenez * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42*de0e0e4dSAntonio Huete Jimenez * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43*de0e0e4dSAntonio Huete Jimenez * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44*de0e0e4dSAntonio Huete Jimenez * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45*de0e0e4dSAntonio Huete Jimenez * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46*de0e0e4dSAntonio Huete Jimenez * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47*de0e0e4dSAntonio Huete Jimenez * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48*de0e0e4dSAntonio Huete Jimenez * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49*de0e0e4dSAntonio Huete Jimenez * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50*de0e0e4dSAntonio Huete Jimenez * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51*de0e0e4dSAntonio Huete Jimenez * OF THE POSSIBILITY OF SUCH DAMAGE.
52*de0e0e4dSAntonio Huete Jimenez * ====================================================================
53*de0e0e4dSAntonio Huete Jimenez *
54*de0e0e4dSAntonio Huete Jimenez * This product includes cryptographic software written by Eric Young
55*de0e0e4dSAntonio Huete Jimenez * (eay@cryptsoft.com). This product includes software written by Tim
56*de0e0e4dSAntonio Huete Jimenez * Hudson (tjh@cryptsoft.com).
57*de0e0e4dSAntonio Huete Jimenez *
58*de0e0e4dSAntonio Huete Jimenez */
59*de0e0e4dSAntonio Huete Jimenez
60*de0e0e4dSAntonio Huete Jimenez #ifdef OPENSSL_NO_CT
61*de0e0e4dSAntonio Huete Jimenez # error "CT is disabled"
62*de0e0e4dSAntonio Huete Jimenez #endif
63*de0e0e4dSAntonio Huete Jimenez
64*de0e0e4dSAntonio Huete Jimenez #include <openssl/asn1.h>
65*de0e0e4dSAntonio Huete Jimenez #include <openssl/bio.h>
66*de0e0e4dSAntonio Huete Jimenez
67*de0e0e4dSAntonio Huete Jimenez #include "ct_local.h"
68*de0e0e4dSAntonio Huete Jimenez
69*de0e0e4dSAntonio Huete Jimenez /*
70*de0e0e4dSAntonio Huete Jimenez * XXX public api in OpenSSL 1.1.0 but this is the only thing that uses it.
71*de0e0e4dSAntonio Huete Jimenez * so I am stuffing it here for the moment.
72*de0e0e4dSAntonio Huete Jimenez */
73*de0e0e4dSAntonio Huete Jimenez static int
BIO_hex_string(BIO * out,int indent,int width,unsigned char * data,int datalen)74*de0e0e4dSAntonio Huete Jimenez BIO_hex_string(BIO *out, int indent, int width, unsigned char *data,
75*de0e0e4dSAntonio Huete Jimenez int datalen)
76*de0e0e4dSAntonio Huete Jimenez {
77*de0e0e4dSAntonio Huete Jimenez int i, j = 0;
78*de0e0e4dSAntonio Huete Jimenez
79*de0e0e4dSAntonio Huete Jimenez if (datalen < 1)
80*de0e0e4dSAntonio Huete Jimenez return 1;
81*de0e0e4dSAntonio Huete Jimenez
82*de0e0e4dSAntonio Huete Jimenez for (i = 0; i < datalen - 1; i++) {
83*de0e0e4dSAntonio Huete Jimenez if (i && !j)
84*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%*s", indent, "");
85*de0e0e4dSAntonio Huete Jimenez
86*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%02X:", data[i]);
87*de0e0e4dSAntonio Huete Jimenez
88*de0e0e4dSAntonio Huete Jimenez j = (j + 1) % width;
89*de0e0e4dSAntonio Huete Jimenez if (!j)
90*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n");
91*de0e0e4dSAntonio Huete Jimenez }
92*de0e0e4dSAntonio Huete Jimenez
93*de0e0e4dSAntonio Huete Jimenez if (i && !j)
94*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%*s", indent, "");
95*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%02X", data[datalen - 1]);
96*de0e0e4dSAntonio Huete Jimenez return 1;
97*de0e0e4dSAntonio Huete Jimenez }
98*de0e0e4dSAntonio Huete Jimenez
99*de0e0e4dSAntonio Huete Jimenez static void
SCT_signature_algorithms_print(const SCT * sct,BIO * out)100*de0e0e4dSAntonio Huete Jimenez SCT_signature_algorithms_print(const SCT *sct, BIO *out)
101*de0e0e4dSAntonio Huete Jimenez {
102*de0e0e4dSAntonio Huete Jimenez int nid = SCT_get_signature_nid(sct);
103*de0e0e4dSAntonio Huete Jimenez
104*de0e0e4dSAntonio Huete Jimenez if (nid == NID_undef)
105*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%02X%02X", sct->hash_alg, sct->sig_alg);
106*de0e0e4dSAntonio Huete Jimenez else
107*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%s", OBJ_nid2ln(nid));
108*de0e0e4dSAntonio Huete Jimenez }
109*de0e0e4dSAntonio Huete Jimenez
110*de0e0e4dSAntonio Huete Jimenez static void
timestamp_print(uint64_t timestamp,BIO * out)111*de0e0e4dSAntonio Huete Jimenez timestamp_print(uint64_t timestamp, BIO *out)
112*de0e0e4dSAntonio Huete Jimenez {
113*de0e0e4dSAntonio Huete Jimenez ASN1_GENERALIZEDTIME *gen = ASN1_GENERALIZEDTIME_new();
114*de0e0e4dSAntonio Huete Jimenez char genstr[20];
115*de0e0e4dSAntonio Huete Jimenez
116*de0e0e4dSAntonio Huete Jimenez if (gen == NULL)
117*de0e0e4dSAntonio Huete Jimenez return;
118*de0e0e4dSAntonio Huete Jimenez ASN1_GENERALIZEDTIME_adj(gen, (time_t)0, (int)(timestamp / 86400000),
119*de0e0e4dSAntonio Huete Jimenez (timestamp % 86400000) / 1000);
120*de0e0e4dSAntonio Huete Jimenez /*
121*de0e0e4dSAntonio Huete Jimenez * Note GeneralizedTime from ASN1_GENERALIZETIME_adj is always 15
122*de0e0e4dSAntonio Huete Jimenez * characters long with a final Z. Update it with fractional seconds.
123*de0e0e4dSAntonio Huete Jimenez */
124*de0e0e4dSAntonio Huete Jimenez snprintf(genstr, sizeof(genstr), "%.14sZ", ASN1_STRING_get0_data(gen));
125*de0e0e4dSAntonio Huete Jimenez if (ASN1_GENERALIZEDTIME_set_string(gen, genstr))
126*de0e0e4dSAntonio Huete Jimenez ASN1_GENERALIZEDTIME_print(out, gen);
127*de0e0e4dSAntonio Huete Jimenez ASN1_GENERALIZEDTIME_free(gen);
128*de0e0e4dSAntonio Huete Jimenez }
129*de0e0e4dSAntonio Huete Jimenez
130*de0e0e4dSAntonio Huete Jimenez const char *
SCT_validation_status_string(const SCT * sct)131*de0e0e4dSAntonio Huete Jimenez SCT_validation_status_string(const SCT *sct)
132*de0e0e4dSAntonio Huete Jimenez {
133*de0e0e4dSAntonio Huete Jimenez switch (SCT_get_validation_status(sct)) {
134*de0e0e4dSAntonio Huete Jimenez case SCT_VALIDATION_STATUS_NOT_SET:
135*de0e0e4dSAntonio Huete Jimenez return "not set";
136*de0e0e4dSAntonio Huete Jimenez case SCT_VALIDATION_STATUS_UNKNOWN_VERSION:
137*de0e0e4dSAntonio Huete Jimenez return "unknown version";
138*de0e0e4dSAntonio Huete Jimenez case SCT_VALIDATION_STATUS_UNKNOWN_LOG:
139*de0e0e4dSAntonio Huete Jimenez return "unknown log";
140*de0e0e4dSAntonio Huete Jimenez case SCT_VALIDATION_STATUS_UNVERIFIED:
141*de0e0e4dSAntonio Huete Jimenez return "unverified";
142*de0e0e4dSAntonio Huete Jimenez case SCT_VALIDATION_STATUS_INVALID:
143*de0e0e4dSAntonio Huete Jimenez return "invalid";
144*de0e0e4dSAntonio Huete Jimenez case SCT_VALIDATION_STATUS_VALID:
145*de0e0e4dSAntonio Huete Jimenez return "valid";
146*de0e0e4dSAntonio Huete Jimenez }
147*de0e0e4dSAntonio Huete Jimenez return "unknown status";
148*de0e0e4dSAntonio Huete Jimenez }
149*de0e0e4dSAntonio Huete Jimenez
150*de0e0e4dSAntonio Huete Jimenez void
SCT_print(const SCT * sct,BIO * out,int indent,const CTLOG_STORE * log_store)151*de0e0e4dSAntonio Huete Jimenez SCT_print(const SCT *sct, BIO *out, int indent, const CTLOG_STORE *log_store)
152*de0e0e4dSAntonio Huete Jimenez {
153*de0e0e4dSAntonio Huete Jimenez const CTLOG *log = NULL;
154*de0e0e4dSAntonio Huete Jimenez
155*de0e0e4dSAntonio Huete Jimenez if (log_store != NULL) {
156*de0e0e4dSAntonio Huete Jimenez log = CTLOG_STORE_get0_log_by_id(log_store, sct->log_id,
157*de0e0e4dSAntonio Huete Jimenez sct->log_id_len);
158*de0e0e4dSAntonio Huete Jimenez }
159*de0e0e4dSAntonio Huete Jimenez
160*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%*sSigned Certificate Timestamp:", indent, "");
161*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*sVersion : ", indent + 4, "");
162*de0e0e4dSAntonio Huete Jimenez
163*de0e0e4dSAntonio Huete Jimenez if (sct->version != SCT_VERSION_V1) {
164*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "unknown\n%*s", indent + 16, "");
165*de0e0e4dSAntonio Huete Jimenez BIO_hex_string(out, indent + 16, 16, sct->sct, sct->sct_len);
166*de0e0e4dSAntonio Huete Jimenez return;
167*de0e0e4dSAntonio Huete Jimenez }
168*de0e0e4dSAntonio Huete Jimenez
169*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "v1 (0x0)");
170*de0e0e4dSAntonio Huete Jimenez
171*de0e0e4dSAntonio Huete Jimenez if (log != NULL) {
172*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*sLog : %s", indent + 4, "",
173*de0e0e4dSAntonio Huete Jimenez CTLOG_get0_name(log));
174*de0e0e4dSAntonio Huete Jimenez }
175*de0e0e4dSAntonio Huete Jimenez
176*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*sLog ID : ", indent + 4, "");
177*de0e0e4dSAntonio Huete Jimenez BIO_hex_string(out, indent + 16, 16, sct->log_id, sct->log_id_len);
178*de0e0e4dSAntonio Huete Jimenez
179*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*sTimestamp : ", indent + 4, "");
180*de0e0e4dSAntonio Huete Jimenez timestamp_print(sct->timestamp, out);
181*de0e0e4dSAntonio Huete Jimenez
182*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*sExtensions: ", indent + 4, "");
183*de0e0e4dSAntonio Huete Jimenez if (sct->ext_len == 0)
184*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "none");
185*de0e0e4dSAntonio Huete Jimenez else
186*de0e0e4dSAntonio Huete Jimenez BIO_hex_string(out, indent + 16, 16, sct->ext, sct->ext_len);
187*de0e0e4dSAntonio Huete Jimenez
188*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*sSignature : ", indent + 4, "");
189*de0e0e4dSAntonio Huete Jimenez SCT_signature_algorithms_print(sct, out);
190*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "\n%*s ", indent + 4, "");
191*de0e0e4dSAntonio Huete Jimenez BIO_hex_string(out, indent + 16, 16, sct->sig, sct->sig_len);
192*de0e0e4dSAntonio Huete Jimenez }
193*de0e0e4dSAntonio Huete Jimenez
194*de0e0e4dSAntonio Huete Jimenez void
SCT_LIST_print(const STACK_OF (SCT)* sct_list,BIO * out,int indent,const char * separator,const CTLOG_STORE * log_store)195*de0e0e4dSAntonio Huete Jimenez SCT_LIST_print(const STACK_OF(SCT) *sct_list, BIO *out, int indent,
196*de0e0e4dSAntonio Huete Jimenez const char *separator, const CTLOG_STORE *log_store)
197*de0e0e4dSAntonio Huete Jimenez {
198*de0e0e4dSAntonio Huete Jimenez int sct_count = sk_SCT_num(sct_list);
199*de0e0e4dSAntonio Huete Jimenez int i;
200*de0e0e4dSAntonio Huete Jimenez
201*de0e0e4dSAntonio Huete Jimenez for (i = 0; i < sct_count; ++i) {
202*de0e0e4dSAntonio Huete Jimenez SCT *sct = sk_SCT_value(sct_list, i);
203*de0e0e4dSAntonio Huete Jimenez
204*de0e0e4dSAntonio Huete Jimenez SCT_print(sct, out, indent, log_store);
205*de0e0e4dSAntonio Huete Jimenez if (i < sk_SCT_num(sct_list) - 1)
206*de0e0e4dSAntonio Huete Jimenez BIO_printf(out, "%s", separator);
207*de0e0e4dSAntonio Huete Jimenez }
208*de0e0e4dSAntonio Huete Jimenez }
209