xref: /openbsd/lib/libcrypto/x509/x509_cpols.c (revision fb9eeb22)
1*fb9eeb22Stb /* $OpenBSD: x509_cpols.c,v 1.11 2023/04/26 20:54:21 tb Exp $ */
2e500e238Sjsing /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3e500e238Sjsing  * project 1999.
4e500e238Sjsing  */
5e500e238Sjsing /* ====================================================================
6e500e238Sjsing  * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
7e500e238Sjsing  *
8e500e238Sjsing  * Redistribution and use in source and binary forms, with or without
9e500e238Sjsing  * modification, are permitted provided that the following conditions
10e500e238Sjsing  * are met:
11e500e238Sjsing  *
12e500e238Sjsing  * 1. Redistributions of source code must retain the above copyright
13e500e238Sjsing  *    notice, this list of conditions and the following disclaimer.
14e500e238Sjsing  *
15e500e238Sjsing  * 2. Redistributions in binary form must reproduce the above copyright
16e500e238Sjsing  *    notice, this list of conditions and the following disclaimer in
17e500e238Sjsing  *    the documentation and/or other materials provided with the
18e500e238Sjsing  *    distribution.
19e500e238Sjsing  *
20e500e238Sjsing  * 3. All advertising materials mentioning features or use of this
21e500e238Sjsing  *    software must display the following acknowledgment:
22e500e238Sjsing  *    "This product includes software developed by the OpenSSL Project
23e500e238Sjsing  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24e500e238Sjsing  *
25e500e238Sjsing  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26e500e238Sjsing  *    endorse or promote products derived from this software without
27e500e238Sjsing  *    prior written permission. For written permission, please contact
28e500e238Sjsing  *    licensing@OpenSSL.org.
29e500e238Sjsing  *
30e500e238Sjsing  * 5. Products derived from this software may not be called "OpenSSL"
31e500e238Sjsing  *    nor may "OpenSSL" appear in their names without prior written
32e500e238Sjsing  *    permission of the OpenSSL Project.
33e500e238Sjsing  *
34e500e238Sjsing  * 6. Redistributions of any form whatsoever must retain the following
35e500e238Sjsing  *    acknowledgment:
36e500e238Sjsing  *    "This product includes software developed by the OpenSSL Project
37e500e238Sjsing  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38e500e238Sjsing  *
39e500e238Sjsing  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40e500e238Sjsing  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41e500e238Sjsing  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42e500e238Sjsing  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43e500e238Sjsing  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44e500e238Sjsing  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45e500e238Sjsing  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46e500e238Sjsing  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47e500e238Sjsing  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48e500e238Sjsing  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49e500e238Sjsing  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50e500e238Sjsing  * OF THE POSSIBILITY OF SUCH DAMAGE.
51e500e238Sjsing  * ====================================================================
52e500e238Sjsing  *
53e500e238Sjsing  * This product includes cryptographic software written by Eric Young
54e500e238Sjsing  * (eay@cryptsoft.com).  This product includes software written by Tim
55e500e238Sjsing  * Hudson (tjh@cryptsoft.com).
56e500e238Sjsing  *
57e500e238Sjsing  */
58e500e238Sjsing 
59e500e238Sjsing #include <stdio.h>
60e500e238Sjsing #include <string.h>
61e500e238Sjsing 
62e500e238Sjsing #include <openssl/asn1.h>
63e500e238Sjsing #include <openssl/asn1t.h>
64e500e238Sjsing #include <openssl/conf.h>
65e500e238Sjsing #include <openssl/err.h>
66e500e238Sjsing #include <openssl/x509v3.h>
67e500e238Sjsing 
68c9675a23Stb #include "x509_local.h"
69e500e238Sjsing 
70e500e238Sjsing /* Certificate policies extension support: this one is a bit complex... */
71e500e238Sjsing 
72e500e238Sjsing static int i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol,
73e500e238Sjsing     BIO *out, int indent);
74e500e238Sjsing static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method,
75e500e238Sjsing     X509V3_CTX *ctx, char *value);
76e500e238Sjsing static void print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals,
77e500e238Sjsing     int indent);
78e500e238Sjsing static void print_notice(BIO *out, USERNOTICE *notice, int indent);
79e500e238Sjsing static POLICYINFO *policy_section(X509V3_CTX *ctx,
80e500e238Sjsing     STACK_OF(CONF_VALUE) *polstrs, int ia5org);
81e500e238Sjsing static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
82e500e238Sjsing     STACK_OF(CONF_VALUE) *unot, int ia5org);
83e500e238Sjsing static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos);
84e500e238Sjsing 
85e500e238Sjsing const X509V3_EXT_METHOD v3_cpols = {
86e500e238Sjsing 	.ext_nid = NID_certificate_policies,
87e500e238Sjsing 	.ext_flags = 0,
88e500e238Sjsing 	.it = &CERTIFICATEPOLICIES_it,
89e500e238Sjsing 	.ext_new = NULL,
90e500e238Sjsing 	.ext_free = NULL,
91e500e238Sjsing 	.d2i = NULL,
92e500e238Sjsing 	.i2d = NULL,
93e500e238Sjsing 	.i2s = NULL,
94e500e238Sjsing 	.s2i = NULL,
95e500e238Sjsing 	.i2v = NULL,
96e500e238Sjsing 	.v2i = NULL,
97e500e238Sjsing 	.i2r = (X509V3_EXT_I2R)i2r_certpol,
98e500e238Sjsing 	.r2i = (X509V3_EXT_R2I)r2i_certpol,
99e500e238Sjsing 	.usr_data = NULL,
100e500e238Sjsing };
101e500e238Sjsing 
102e500e238Sjsing static const ASN1_TEMPLATE CERTIFICATEPOLICIES_item_tt = {
103e500e238Sjsing 	.flags = ASN1_TFLG_SEQUENCE_OF,
104e500e238Sjsing 	.tag = 0,
105e500e238Sjsing 	.offset = 0,
106e500e238Sjsing 	.field_name = "CERTIFICATEPOLICIES",
107e500e238Sjsing 	.item = &POLICYINFO_it,
108e500e238Sjsing };
109e500e238Sjsing 
110e500e238Sjsing const ASN1_ITEM CERTIFICATEPOLICIES_it = {
111e500e238Sjsing 	.itype = ASN1_ITYPE_PRIMITIVE,
112e500e238Sjsing 	.utype = -1,
113e500e238Sjsing 	.templates = &CERTIFICATEPOLICIES_item_tt,
114e500e238Sjsing 	.tcount = 0,
115e500e238Sjsing 	.funcs = NULL,
116e500e238Sjsing 	.size = 0,
117e500e238Sjsing 	.sname = "CERTIFICATEPOLICIES",
118e500e238Sjsing };
119e500e238Sjsing 
120e500e238Sjsing 
121e500e238Sjsing CERTIFICATEPOLICIES *
d2i_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES ** a,const unsigned char ** in,long len)122e500e238Sjsing d2i_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES **a, const unsigned char **in, long len)
123e500e238Sjsing {
124e500e238Sjsing 	return (CERTIFICATEPOLICIES *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
125e500e238Sjsing 	    &CERTIFICATEPOLICIES_it);
126e500e238Sjsing }
127cedac418Stb LCRYPTO_ALIAS(d2i_CERTIFICATEPOLICIES);
128e500e238Sjsing 
129e500e238Sjsing int
i2d_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES * a,unsigned char ** out)130e500e238Sjsing i2d_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES *a, unsigned char **out)
131e500e238Sjsing {
132e500e238Sjsing 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &CERTIFICATEPOLICIES_it);
133e500e238Sjsing }
134cedac418Stb LCRYPTO_ALIAS(i2d_CERTIFICATEPOLICIES);
135e500e238Sjsing 
136e500e238Sjsing CERTIFICATEPOLICIES *
CERTIFICATEPOLICIES_new(void)137e500e238Sjsing CERTIFICATEPOLICIES_new(void)
138e500e238Sjsing {
139e500e238Sjsing 	return (CERTIFICATEPOLICIES *)ASN1_item_new(&CERTIFICATEPOLICIES_it);
140e500e238Sjsing }
141cedac418Stb LCRYPTO_ALIAS(CERTIFICATEPOLICIES_new);
142e500e238Sjsing 
143e500e238Sjsing void
CERTIFICATEPOLICIES_free(CERTIFICATEPOLICIES * a)144e500e238Sjsing CERTIFICATEPOLICIES_free(CERTIFICATEPOLICIES *a)
145e500e238Sjsing {
146e500e238Sjsing 	ASN1_item_free((ASN1_VALUE *)a, &CERTIFICATEPOLICIES_it);
147e500e238Sjsing }
148cedac418Stb LCRYPTO_ALIAS(CERTIFICATEPOLICIES_free);
149e500e238Sjsing 
150e500e238Sjsing static const ASN1_TEMPLATE POLICYINFO_seq_tt[] = {
151e500e238Sjsing 	{
152e500e238Sjsing 		.flags = 0,
153e500e238Sjsing 		.tag = 0,
154e500e238Sjsing 		.offset = offsetof(POLICYINFO, policyid),
155e500e238Sjsing 		.field_name = "policyid",
156e500e238Sjsing 		.item = &ASN1_OBJECT_it,
157e500e238Sjsing 	},
158e500e238Sjsing 	{
159e500e238Sjsing 		.flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
160e500e238Sjsing 		.tag = 0,
161e500e238Sjsing 		.offset = offsetof(POLICYINFO, qualifiers),
162e500e238Sjsing 		.field_name = "qualifiers",
163e500e238Sjsing 		.item = &POLICYQUALINFO_it,
164e500e238Sjsing 	},
165e500e238Sjsing };
166e500e238Sjsing 
167e500e238Sjsing const ASN1_ITEM POLICYINFO_it = {
168e500e238Sjsing 	.itype = ASN1_ITYPE_SEQUENCE,
169e500e238Sjsing 	.utype = V_ASN1_SEQUENCE,
170e500e238Sjsing 	.templates = POLICYINFO_seq_tt,
171e500e238Sjsing 	.tcount = sizeof(POLICYINFO_seq_tt) / sizeof(ASN1_TEMPLATE),
172e500e238Sjsing 	.funcs = NULL,
173e500e238Sjsing 	.size = sizeof(POLICYINFO),
174e500e238Sjsing 	.sname = "POLICYINFO",
175e500e238Sjsing };
176e500e238Sjsing 
177e500e238Sjsing 
178e500e238Sjsing POLICYINFO *
d2i_POLICYINFO(POLICYINFO ** a,const unsigned char ** in,long len)179e500e238Sjsing d2i_POLICYINFO(POLICYINFO **a, const unsigned char **in, long len)
180e500e238Sjsing {
181e500e238Sjsing 	return (POLICYINFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
182e500e238Sjsing 	    &POLICYINFO_it);
183e500e238Sjsing }
184cedac418Stb LCRYPTO_ALIAS(d2i_POLICYINFO);
185e500e238Sjsing 
186e500e238Sjsing int
i2d_POLICYINFO(POLICYINFO * a,unsigned char ** out)187e500e238Sjsing i2d_POLICYINFO(POLICYINFO *a, unsigned char **out)
188e500e238Sjsing {
189e500e238Sjsing 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &POLICYINFO_it);
190e500e238Sjsing }
191cedac418Stb LCRYPTO_ALIAS(i2d_POLICYINFO);
192e500e238Sjsing 
193e500e238Sjsing POLICYINFO *
POLICYINFO_new(void)194e500e238Sjsing POLICYINFO_new(void)
195e500e238Sjsing {
196e500e238Sjsing 	return (POLICYINFO *)ASN1_item_new(&POLICYINFO_it);
197e500e238Sjsing }
198cedac418Stb LCRYPTO_ALIAS(POLICYINFO_new);
199e500e238Sjsing 
200e500e238Sjsing void
POLICYINFO_free(POLICYINFO * a)201e500e238Sjsing POLICYINFO_free(POLICYINFO *a)
202e500e238Sjsing {
203e500e238Sjsing 	ASN1_item_free((ASN1_VALUE *)a, &POLICYINFO_it);
204e500e238Sjsing }
205cedac418Stb LCRYPTO_ALIAS(POLICYINFO_free);
206e500e238Sjsing 
207e500e238Sjsing static const ASN1_TEMPLATE policydefault_tt = {
208e500e238Sjsing 	.flags = 0,
209e500e238Sjsing 	.tag = 0,
210e500e238Sjsing 	.offset = offsetof(POLICYQUALINFO, d.other),
211e500e238Sjsing 	.field_name = "d.other",
212e500e238Sjsing 	.item = &ASN1_ANY_it,
213e500e238Sjsing };
214e500e238Sjsing 
215e500e238Sjsing static const ASN1_ADB_TABLE POLICYQUALINFO_adbtbl[] = {
216e500e238Sjsing 	{
217e500e238Sjsing 		.value = NID_id_qt_cps,
218e500e238Sjsing 		.tt = {
219e500e238Sjsing 			.flags = 0,
220e500e238Sjsing 			.tag = 0,
221e500e238Sjsing 			.offset = offsetof(POLICYQUALINFO, d.cpsuri),
222e500e238Sjsing 			.field_name = "d.cpsuri",
223e500e238Sjsing 			.item = &ASN1_IA5STRING_it,
224e500e238Sjsing 		},
225e500e238Sjsing 	},
226e500e238Sjsing 	{
227e500e238Sjsing 		.value = NID_id_qt_unotice,
228e500e238Sjsing 		.tt = {
229e500e238Sjsing 			.flags = 0,
230e500e238Sjsing 			.tag = 0,
231e500e238Sjsing 			.offset = offsetof(POLICYQUALINFO, d.usernotice),
232e500e238Sjsing 			.field_name = "d.usernotice",
233e500e238Sjsing 			.item = &USERNOTICE_it,
234e500e238Sjsing 		},
235e500e238Sjsing 	},
236e500e238Sjsing };
237e500e238Sjsing 
238e500e238Sjsing static const ASN1_ADB POLICYQUALINFO_adb = {
239e500e238Sjsing 	.flags = 0,
240e500e238Sjsing 	.offset = offsetof(POLICYQUALINFO, pqualid),
241e500e238Sjsing 	.tbl = POLICYQUALINFO_adbtbl,
242e500e238Sjsing 	.tblcount = sizeof(POLICYQUALINFO_adbtbl) / sizeof(ASN1_ADB_TABLE),
243e500e238Sjsing 	.default_tt = &policydefault_tt,
244e500e238Sjsing 	.null_tt = NULL,
245e500e238Sjsing };
246e500e238Sjsing 
247e500e238Sjsing static const ASN1_TEMPLATE POLICYQUALINFO_seq_tt[] = {
248e500e238Sjsing 	{
249e500e238Sjsing 		.flags = 0,
250e500e238Sjsing 		.tag = 0,
251e500e238Sjsing 		.offset = offsetof(POLICYQUALINFO, pqualid),
252e500e238Sjsing 		.field_name = "pqualid",
253e500e238Sjsing 		.item = &ASN1_OBJECT_it,
254e500e238Sjsing 	},
255e500e238Sjsing 	{
256e500e238Sjsing 		.flags = ASN1_TFLG_ADB_OID,
257e500e238Sjsing 		.tag = -1,
258e500e238Sjsing 		.offset = 0,
259e500e238Sjsing 		.field_name = "POLICYQUALINFO",
260e500e238Sjsing 		.item = (const ASN1_ITEM *)&POLICYQUALINFO_adb,
261e500e238Sjsing 	},
262e500e238Sjsing };
263e500e238Sjsing 
264e500e238Sjsing const ASN1_ITEM POLICYQUALINFO_it = {
265e500e238Sjsing 	.itype = ASN1_ITYPE_SEQUENCE,
266e500e238Sjsing 	.utype = V_ASN1_SEQUENCE,
267e500e238Sjsing 	.templates = POLICYQUALINFO_seq_tt,
268e500e238Sjsing 	.tcount = sizeof(POLICYQUALINFO_seq_tt) / sizeof(ASN1_TEMPLATE),
269e500e238Sjsing 	.funcs = NULL,
270e500e238Sjsing 	.size = sizeof(POLICYQUALINFO),
271e500e238Sjsing 	.sname = "POLICYQUALINFO",
272e500e238Sjsing };
273e500e238Sjsing 
274e500e238Sjsing 
275e500e238Sjsing POLICYQUALINFO *
d2i_POLICYQUALINFO(POLICYQUALINFO ** a,const unsigned char ** in,long len)276e500e238Sjsing d2i_POLICYQUALINFO(POLICYQUALINFO **a, const unsigned char **in, long len)
277e500e238Sjsing {
278e500e238Sjsing 	return (POLICYQUALINFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
279e500e238Sjsing 	    &POLICYQUALINFO_it);
280e500e238Sjsing }
281cedac418Stb LCRYPTO_ALIAS(d2i_POLICYQUALINFO);
282e500e238Sjsing 
283e500e238Sjsing int
i2d_POLICYQUALINFO(POLICYQUALINFO * a,unsigned char ** out)284e500e238Sjsing i2d_POLICYQUALINFO(POLICYQUALINFO *a, unsigned char **out)
285e500e238Sjsing {
286e500e238Sjsing 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &POLICYQUALINFO_it);
287e500e238Sjsing }
288cedac418Stb LCRYPTO_ALIAS(i2d_POLICYQUALINFO);
289e500e238Sjsing 
290e500e238Sjsing POLICYQUALINFO *
POLICYQUALINFO_new(void)291e500e238Sjsing POLICYQUALINFO_new(void)
292e500e238Sjsing {
293e500e238Sjsing 	return (POLICYQUALINFO *)ASN1_item_new(&POLICYQUALINFO_it);
294e500e238Sjsing }
295cedac418Stb LCRYPTO_ALIAS(POLICYQUALINFO_new);
296e500e238Sjsing 
297e500e238Sjsing void
POLICYQUALINFO_free(POLICYQUALINFO * a)298e500e238Sjsing POLICYQUALINFO_free(POLICYQUALINFO *a)
299e500e238Sjsing {
300e500e238Sjsing 	ASN1_item_free((ASN1_VALUE *)a, &POLICYQUALINFO_it);
301e500e238Sjsing }
302cedac418Stb LCRYPTO_ALIAS(POLICYQUALINFO_free);
303e500e238Sjsing 
304e500e238Sjsing static const ASN1_TEMPLATE USERNOTICE_seq_tt[] = {
305e500e238Sjsing 	{
306e500e238Sjsing 		.flags = ASN1_TFLG_OPTIONAL,
307e500e238Sjsing 		.tag = 0,
308e500e238Sjsing 		.offset = offsetof(USERNOTICE, noticeref),
309e500e238Sjsing 		.field_name = "noticeref",
310e500e238Sjsing 		.item = &NOTICEREF_it,
311e500e238Sjsing 	},
312e500e238Sjsing 	{
313e500e238Sjsing 		.flags = ASN1_TFLG_OPTIONAL,
314e500e238Sjsing 		.tag = 0,
315e500e238Sjsing 		.offset = offsetof(USERNOTICE, exptext),
316e500e238Sjsing 		.field_name = "exptext",
317e500e238Sjsing 		.item = &DISPLAYTEXT_it,
318e500e238Sjsing 	},
319e500e238Sjsing };
320e500e238Sjsing 
321e500e238Sjsing const ASN1_ITEM USERNOTICE_it = {
322e500e238Sjsing 	.itype = ASN1_ITYPE_SEQUENCE,
323e500e238Sjsing 	.utype = V_ASN1_SEQUENCE,
324e500e238Sjsing 	.templates = USERNOTICE_seq_tt,
325e500e238Sjsing 	.tcount = sizeof(USERNOTICE_seq_tt) / sizeof(ASN1_TEMPLATE),
326e500e238Sjsing 	.funcs = NULL,
327e500e238Sjsing 	.size = sizeof(USERNOTICE),
328e500e238Sjsing 	.sname = "USERNOTICE",
329e500e238Sjsing };
330e500e238Sjsing 
331e500e238Sjsing 
332e500e238Sjsing USERNOTICE *
d2i_USERNOTICE(USERNOTICE ** a,const unsigned char ** in,long len)333e500e238Sjsing d2i_USERNOTICE(USERNOTICE **a, const unsigned char **in, long len)
334e500e238Sjsing {
335e500e238Sjsing 	return (USERNOTICE *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
336e500e238Sjsing 	    &USERNOTICE_it);
337e500e238Sjsing }
338cedac418Stb LCRYPTO_ALIAS(d2i_USERNOTICE);
339e500e238Sjsing 
340e500e238Sjsing int
i2d_USERNOTICE(USERNOTICE * a,unsigned char ** out)341e500e238Sjsing i2d_USERNOTICE(USERNOTICE *a, unsigned char **out)
342e500e238Sjsing {
343e500e238Sjsing 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &USERNOTICE_it);
344e500e238Sjsing }
345cedac418Stb LCRYPTO_ALIAS(i2d_USERNOTICE);
346e500e238Sjsing 
347e500e238Sjsing USERNOTICE *
USERNOTICE_new(void)348e500e238Sjsing USERNOTICE_new(void)
349e500e238Sjsing {
350e500e238Sjsing 	return (USERNOTICE *)ASN1_item_new(&USERNOTICE_it);
351e500e238Sjsing }
352cedac418Stb LCRYPTO_ALIAS(USERNOTICE_new);
353e500e238Sjsing 
354e500e238Sjsing void
USERNOTICE_free(USERNOTICE * a)355e500e238Sjsing USERNOTICE_free(USERNOTICE *a)
356e500e238Sjsing {
357e500e238Sjsing 	ASN1_item_free((ASN1_VALUE *)a, &USERNOTICE_it);
358e500e238Sjsing }
359cedac418Stb LCRYPTO_ALIAS(USERNOTICE_free);
360e500e238Sjsing 
361e500e238Sjsing static const ASN1_TEMPLATE NOTICEREF_seq_tt[] = {
362e500e238Sjsing 	{
363e500e238Sjsing 		.flags = 0,
364e500e238Sjsing 		.tag = 0,
365e500e238Sjsing 		.offset = offsetof(NOTICEREF, organization),
366e500e238Sjsing 		.field_name = "organization",
367e500e238Sjsing 		.item = &DISPLAYTEXT_it,
368e500e238Sjsing 	},
369e500e238Sjsing 	{
370e500e238Sjsing 		.flags = ASN1_TFLG_SEQUENCE_OF,
371e500e238Sjsing 		.tag = 0,
372e500e238Sjsing 		.offset = offsetof(NOTICEREF, noticenos),
373e500e238Sjsing 		.field_name = "noticenos",
374e500e238Sjsing 		.item = &ASN1_INTEGER_it,
375e500e238Sjsing 	},
376e500e238Sjsing };
377e500e238Sjsing 
378e500e238Sjsing const ASN1_ITEM NOTICEREF_it = {
379e500e238Sjsing 	.itype = ASN1_ITYPE_SEQUENCE,
380e500e238Sjsing 	.utype = V_ASN1_SEQUENCE,
381e500e238Sjsing 	.templates = NOTICEREF_seq_tt,
382e500e238Sjsing 	.tcount = sizeof(NOTICEREF_seq_tt) / sizeof(ASN1_TEMPLATE),
383e500e238Sjsing 	.funcs = NULL,
384e500e238Sjsing 	.size = sizeof(NOTICEREF),
385e500e238Sjsing 	.sname = "NOTICEREF",
386e500e238Sjsing };
387e500e238Sjsing 
388e500e238Sjsing 
389e500e238Sjsing NOTICEREF *
d2i_NOTICEREF(NOTICEREF ** a,const unsigned char ** in,long len)390e500e238Sjsing d2i_NOTICEREF(NOTICEREF **a, const unsigned char **in, long len)
391e500e238Sjsing {
392e500e238Sjsing 	return (NOTICEREF *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
393e500e238Sjsing 	    &NOTICEREF_it);
394e500e238Sjsing }
395cedac418Stb LCRYPTO_ALIAS(d2i_NOTICEREF);
396e500e238Sjsing 
397e500e238Sjsing int
i2d_NOTICEREF(NOTICEREF * a,unsigned char ** out)398e500e238Sjsing i2d_NOTICEREF(NOTICEREF *a, unsigned char **out)
399e500e238Sjsing {
400e500e238Sjsing 	return ASN1_item_i2d((ASN1_VALUE *)a, out, &NOTICEREF_it);
401e500e238Sjsing }
402cedac418Stb LCRYPTO_ALIAS(i2d_NOTICEREF);
403e500e238Sjsing 
404e500e238Sjsing NOTICEREF *
NOTICEREF_new(void)405e500e238Sjsing NOTICEREF_new(void)
406e500e238Sjsing {
407e500e238Sjsing 	return (NOTICEREF *)ASN1_item_new(&NOTICEREF_it);
408e500e238Sjsing }
409cedac418Stb LCRYPTO_ALIAS(NOTICEREF_new);
410e500e238Sjsing 
411e500e238Sjsing void
NOTICEREF_free(NOTICEREF * a)412e500e238Sjsing NOTICEREF_free(NOTICEREF *a)
413e500e238Sjsing {
414e500e238Sjsing 	ASN1_item_free((ASN1_VALUE *)a, &NOTICEREF_it);
415e500e238Sjsing }
416cedac418Stb LCRYPTO_ALIAS(NOTICEREF_free);
417e500e238Sjsing 
STACK_OF(POLICYINFO)418e500e238Sjsing static STACK_OF(POLICYINFO) *
419e500e238Sjsing r2i_certpol(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *value)
420e500e238Sjsing {
421e500e238Sjsing 	STACK_OF(POLICYINFO) *pols = NULL;
422e500e238Sjsing 	char *pstr;
423e500e238Sjsing 	POLICYINFO *pol;
424e500e238Sjsing 	ASN1_OBJECT *pobj;
425e500e238Sjsing 	STACK_OF(CONF_VALUE) *vals;
426e500e238Sjsing 	CONF_VALUE *cnf;
427e500e238Sjsing 	int i, ia5org;
428e500e238Sjsing 
429e500e238Sjsing 	pols = sk_POLICYINFO_new_null();
430e500e238Sjsing 	if (pols == NULL) {
431e500e238Sjsing 		X509V3error(ERR_R_MALLOC_FAILURE);
432e500e238Sjsing 		return NULL;
433e500e238Sjsing 	}
434e500e238Sjsing 	vals = X509V3_parse_list(value);
435e500e238Sjsing 	if (vals == NULL) {
436e500e238Sjsing 		X509V3error(ERR_R_X509V3_LIB);
437e500e238Sjsing 		goto err;
438e500e238Sjsing 	}
439e500e238Sjsing 	ia5org = 0;
440e500e238Sjsing 	for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
441e500e238Sjsing 		cnf = sk_CONF_VALUE_value(vals, i);
442e500e238Sjsing 		if (cnf->value || !cnf->name) {
443e500e238Sjsing 			X509V3error(X509V3_R_INVALID_POLICY_IDENTIFIER);
444e500e238Sjsing 			X509V3_conf_err(cnf);
445e500e238Sjsing 			goto err;
446e500e238Sjsing 		}
447e500e238Sjsing 		pstr = cnf->name;
448e500e238Sjsing 		if (!strcmp(pstr, "ia5org")) {
449e500e238Sjsing 			ia5org = 1;
450e500e238Sjsing 			continue;
451e500e238Sjsing 		} else if (*pstr == '@') {
452e500e238Sjsing 			STACK_OF(CONF_VALUE) *polsect;
453e500e238Sjsing 			polsect = X509V3_get_section(ctx, pstr + 1);
454e500e238Sjsing 			if (!polsect) {
455e500e238Sjsing 				X509V3error(X509V3_R_INVALID_SECTION);
456e500e238Sjsing 				X509V3_conf_err(cnf);
457e500e238Sjsing 				goto err;
458e500e238Sjsing 			}
459e500e238Sjsing 			pol = policy_section(ctx, polsect, ia5org);
460e500e238Sjsing 			X509V3_section_free(ctx, polsect);
461e500e238Sjsing 			if (!pol)
462e500e238Sjsing 				goto err;
463e500e238Sjsing 		} else {
464e500e238Sjsing 			if (!(pobj = OBJ_txt2obj(cnf->name, 0))) {
465e500e238Sjsing 				X509V3error(X509V3_R_INVALID_OBJECT_IDENTIFIER);
466e500e238Sjsing 				X509V3_conf_err(cnf);
467e500e238Sjsing 				goto err;
468e500e238Sjsing 			}
469e500e238Sjsing 			pol = POLICYINFO_new();
470e500e238Sjsing 			pol->policyid = pobj;
471e500e238Sjsing 		}
472e500e238Sjsing 		if (!sk_POLICYINFO_push(pols, pol)){
473e500e238Sjsing 			POLICYINFO_free(pol);
474e500e238Sjsing 			X509V3error(ERR_R_MALLOC_FAILURE);
475e500e238Sjsing 			goto err;
476e500e238Sjsing 		}
477e500e238Sjsing 	}
478e500e238Sjsing 	sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
479e500e238Sjsing 	return pols;
480e500e238Sjsing 
481e500e238Sjsing err:
482e500e238Sjsing 	sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
483e500e238Sjsing 	sk_POLICYINFO_pop_free(pols, POLICYINFO_free);
484e500e238Sjsing 	return NULL;
485e500e238Sjsing }
486e500e238Sjsing 
487e500e238Sjsing static POLICYINFO *
policy_section(X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* polstrs,int ia5org)488e500e238Sjsing policy_section(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *polstrs, int ia5org)
489e500e238Sjsing {
490e500e238Sjsing 	int i;
491e500e238Sjsing 	CONF_VALUE *cnf;
492e500e238Sjsing 	POLICYINFO *pol;
493e500e238Sjsing 	POLICYQUALINFO *nqual = NULL;
494e500e238Sjsing 
495e500e238Sjsing 	if ((pol = POLICYINFO_new()) == NULL)
496e500e238Sjsing 		goto merr;
497e500e238Sjsing 	for (i = 0; i < sk_CONF_VALUE_num(polstrs); i++) {
498e500e238Sjsing 		cnf = sk_CONF_VALUE_value(polstrs, i);
499e500e238Sjsing 		if (strcmp(cnf->name, "policyIdentifier") == 0) {
500e500e238Sjsing 			ASN1_OBJECT *pobj;
501e500e238Sjsing 
502e500e238Sjsing 			if ((pobj = OBJ_txt2obj(cnf->value, 0)) == NULL) {
503e500e238Sjsing 				X509V3error(X509V3_R_INVALID_OBJECT_IDENTIFIER);
504e500e238Sjsing 				X509V3_conf_err(cnf);
505e500e238Sjsing 				goto err;
506e500e238Sjsing 			}
507e500e238Sjsing 			pol->policyid = pobj;
508e500e238Sjsing 		} else if (name_cmp(cnf->name, "CPS") == 0) {
509e500e238Sjsing 			if ((nqual = POLICYQUALINFO_new()) == NULL)
510e500e238Sjsing 				goto merr;
511e500e238Sjsing 			nqual->pqualid = OBJ_nid2obj(NID_id_qt_cps);
512e500e238Sjsing 			nqual->d.cpsuri = ASN1_IA5STRING_new();
513e500e238Sjsing 			if (nqual->d.cpsuri == NULL)
514e500e238Sjsing 				goto merr;
515e500e238Sjsing 			if (ASN1_STRING_set(nqual->d.cpsuri, cnf->value,
516e500e238Sjsing 			    strlen(cnf->value)) == 0)
517e500e238Sjsing 				goto merr;
518e500e238Sjsing 
519e500e238Sjsing 			if (pol->qualifiers == NULL) {
520e500e238Sjsing 				pol->qualifiers = sk_POLICYQUALINFO_new_null();
521e500e238Sjsing 				if (pol->qualifiers == NULL)
522e500e238Sjsing 					goto merr;
523e500e238Sjsing 			}
524e500e238Sjsing 			if (sk_POLICYQUALINFO_push(pol->qualifiers, nqual) == 0)
525e500e238Sjsing 				goto merr;
526e500e238Sjsing 			nqual = NULL;
527e500e238Sjsing 		} else if (name_cmp(cnf->name, "userNotice") == 0) {
528e500e238Sjsing 			STACK_OF(CONF_VALUE) *unot;
529e500e238Sjsing 			POLICYQUALINFO *qual;
530e500e238Sjsing 
531e500e238Sjsing 			if (*cnf->value != '@') {
532e500e238Sjsing 				X509V3error(X509V3_R_EXPECTED_A_SECTION_NAME);
533e500e238Sjsing 				X509V3_conf_err(cnf);
534e500e238Sjsing 				goto err;
535e500e238Sjsing 			}
536e500e238Sjsing 			unot = X509V3_get_section(ctx, cnf->value + 1);
537e500e238Sjsing 			if (unot == NULL) {
538e500e238Sjsing 				X509V3error(X509V3_R_INVALID_SECTION);
539e500e238Sjsing 				X509V3_conf_err(cnf);
540e500e238Sjsing 				goto err;
541e500e238Sjsing 			}
542e500e238Sjsing 			qual = notice_section(ctx, unot, ia5org);
543e500e238Sjsing 			X509V3_section_free(ctx, unot);
544e500e238Sjsing 			if (qual == NULL)
545e500e238Sjsing 				goto err;
546e500e238Sjsing 
547e500e238Sjsing 			if (pol->qualifiers == NULL) {
548e500e238Sjsing 				pol->qualifiers = sk_POLICYQUALINFO_new_null();
549e500e238Sjsing 				if (pol->qualifiers == NULL)
550e500e238Sjsing 					goto merr;
551e500e238Sjsing 			}
552e500e238Sjsing 			if (sk_POLICYQUALINFO_push(pol->qualifiers, qual) == 0)
553e500e238Sjsing 				goto merr;
554e500e238Sjsing 		} else {
555e500e238Sjsing 			X509V3error(X509V3_R_INVALID_OPTION);
556e500e238Sjsing 			X509V3_conf_err(cnf);
557e500e238Sjsing 			goto err;
558e500e238Sjsing 		}
559e500e238Sjsing 	}
560e500e238Sjsing 	if (pol->policyid == NULL) {
561e500e238Sjsing 		X509V3error(X509V3_R_NO_POLICY_IDENTIFIER);
562e500e238Sjsing 		goto err;
563e500e238Sjsing 	}
564e500e238Sjsing 
565e500e238Sjsing 	return pol;
566e500e238Sjsing 
567e500e238Sjsing merr:
568e500e238Sjsing 	X509V3error(ERR_R_MALLOC_FAILURE);
569e500e238Sjsing 
570e500e238Sjsing err:
571e500e238Sjsing 	POLICYQUALINFO_free(nqual);
572e500e238Sjsing 	POLICYINFO_free(pol);
573e500e238Sjsing 	return NULL;
574e500e238Sjsing }
575e500e238Sjsing 
576e500e238Sjsing static POLICYQUALINFO *
notice_section(X509V3_CTX * ctx,STACK_OF (CONF_VALUE)* unot,int ia5org)577e500e238Sjsing notice_section(X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *unot, int ia5org)
578e500e238Sjsing {
579e500e238Sjsing 	int i, ret;
580e500e238Sjsing 	CONF_VALUE *cnf;
581e500e238Sjsing 	USERNOTICE *not;
582e500e238Sjsing 	POLICYQUALINFO *qual;
583e500e238Sjsing 
584e500e238Sjsing 	if (!(qual = POLICYQUALINFO_new()))
585e500e238Sjsing 		goto merr;
586e500e238Sjsing 	qual->pqualid = OBJ_nid2obj(NID_id_qt_unotice);
587e500e238Sjsing 	if (!(not = USERNOTICE_new()))
588e500e238Sjsing 		goto merr;
589e500e238Sjsing 	qual->d.usernotice = not;
590e500e238Sjsing 	for (i = 0; i < sk_CONF_VALUE_num(unot); i++) {
591e500e238Sjsing 		cnf = sk_CONF_VALUE_value(unot, i);
592e500e238Sjsing 		if (!strcmp(cnf->name, "explicitText")) {
593e500e238Sjsing 			if (not->exptext == NULL) {
5943201f0b1Stb 				not->exptext = ASN1_UTF8STRING_new();
595e500e238Sjsing 				if (not->exptext == NULL)
596e500e238Sjsing 					goto merr;
597e500e238Sjsing 			}
598e500e238Sjsing 			if (!ASN1_STRING_set(not->exptext, cnf->value,
599e500e238Sjsing 			    strlen(cnf->value)))
600e500e238Sjsing 				goto merr;
601e500e238Sjsing 		} else if (!strcmp(cnf->name, "organization")) {
602e500e238Sjsing 			NOTICEREF *nref;
603e500e238Sjsing 			if (!not->noticeref) {
604e500e238Sjsing 				if (!(nref = NOTICEREF_new()))
605e500e238Sjsing 					goto merr;
606e500e238Sjsing 				not->noticeref = nref;
607e500e238Sjsing 			} else
608e500e238Sjsing 				nref = not->noticeref;
609e500e238Sjsing 			if (ia5org)
610e500e238Sjsing 				nref->organization->type = V_ASN1_IA5STRING;
611e500e238Sjsing 			else
612e500e238Sjsing 				nref->organization->type = V_ASN1_VISIBLESTRING;
613e500e238Sjsing 			if (!ASN1_STRING_set(nref->organization, cnf->value,
614e500e238Sjsing 			    strlen(cnf->value)))
615e500e238Sjsing 				goto merr;
616e500e238Sjsing 		} else if (!strcmp(cnf->name, "noticeNumbers")) {
617e500e238Sjsing 			NOTICEREF *nref;
618e500e238Sjsing 			STACK_OF(CONF_VALUE) *nos;
619e500e238Sjsing 			if (!not->noticeref) {
620e500e238Sjsing 				if (!(nref = NOTICEREF_new()))
621e500e238Sjsing 					goto merr;
622e500e238Sjsing 				not->noticeref = nref;
623e500e238Sjsing 			} else
624e500e238Sjsing 				nref = not->noticeref;
625e500e238Sjsing 			nos = X509V3_parse_list(cnf->value);
626e500e238Sjsing 			if (!nos || !sk_CONF_VALUE_num(nos)) {
627e500e238Sjsing 				X509V3error(X509V3_R_INVALID_NUMBERS);
628e500e238Sjsing 				X509V3_conf_err(cnf);
629e500e238Sjsing 				if (nos != NULL)
630e500e238Sjsing 					sk_CONF_VALUE_pop_free(nos,
631e500e238Sjsing 					    X509V3_conf_free);
632e500e238Sjsing 				goto err;
633e500e238Sjsing 			}
634e500e238Sjsing 			ret = nref_nos(nref->noticenos, nos);
635e500e238Sjsing 			sk_CONF_VALUE_pop_free(nos, X509V3_conf_free);
636e500e238Sjsing 			if (!ret)
637e500e238Sjsing 				goto err;
638e500e238Sjsing 		} else {
639e500e238Sjsing 			X509V3error(X509V3_R_INVALID_OPTION);
640e500e238Sjsing 			X509V3_conf_err(cnf);
641e500e238Sjsing 			goto err;
642e500e238Sjsing 		}
643e500e238Sjsing 	}
644e500e238Sjsing 
645e500e238Sjsing 	if (not->noticeref &&
646e500e238Sjsing 	    (!not->noticeref->noticenos || !not->noticeref->organization)) {
647e500e238Sjsing 		X509V3error(X509V3_R_NEED_ORGANIZATION_AND_NUMBERS);
648e500e238Sjsing 		goto err;
649e500e238Sjsing 	}
650e500e238Sjsing 
651e500e238Sjsing 	return qual;
652e500e238Sjsing 
653e500e238Sjsing merr:
654e500e238Sjsing 	X509V3error(ERR_R_MALLOC_FAILURE);
655e500e238Sjsing 
656e500e238Sjsing err:
657e500e238Sjsing 	POLICYQUALINFO_free(qual);
658e500e238Sjsing 	return NULL;
659e500e238Sjsing }
660e500e238Sjsing 
661e500e238Sjsing static int
nref_nos(STACK_OF (ASN1_INTEGER)* nnums,STACK_OF (CONF_VALUE)* nos)662e500e238Sjsing nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos)
663e500e238Sjsing {
664e500e238Sjsing 	CONF_VALUE *cnf;
665e500e238Sjsing 	ASN1_INTEGER *aint;
666e500e238Sjsing 	int i;
667e500e238Sjsing 
668e500e238Sjsing 	for (i = 0; i < sk_CONF_VALUE_num(nos); i++) {
669e500e238Sjsing 		cnf = sk_CONF_VALUE_value(nos, i);
670e500e238Sjsing 		if (!(aint = s2i_ASN1_INTEGER(NULL, cnf->name))) {
671e500e238Sjsing 			X509V3error(X509V3_R_INVALID_NUMBER);
672e500e238Sjsing 			goto err;
673e500e238Sjsing 		}
674e500e238Sjsing 		if (!sk_ASN1_INTEGER_push(nnums, aint))
675e500e238Sjsing 			goto merr;
676e500e238Sjsing 	}
677e500e238Sjsing 	return 1;
678e500e238Sjsing 
679e500e238Sjsing merr:
680e500e238Sjsing 	X509V3error(ERR_R_MALLOC_FAILURE);
681e500e238Sjsing 
682e500e238Sjsing err:
683e500e238Sjsing 	sk_ASN1_INTEGER_pop_free(nnums, ASN1_STRING_free);
684e500e238Sjsing 	return 0;
685e500e238Sjsing }
686e500e238Sjsing 
687e500e238Sjsing static int
i2r_certpol(X509V3_EXT_METHOD * method,STACK_OF (POLICYINFO)* pol,BIO * out,int indent)688e500e238Sjsing i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol, BIO *out,
689e500e238Sjsing     int indent)
690e500e238Sjsing {
691e500e238Sjsing 	int i;
692e500e238Sjsing 	POLICYINFO *pinfo;
693e500e238Sjsing 
694e500e238Sjsing 	/* First print out the policy OIDs */
695e500e238Sjsing 	for (i = 0; i < sk_POLICYINFO_num(pol); i++) {
696e500e238Sjsing 		pinfo = sk_POLICYINFO_value(pol, i);
697e500e238Sjsing 		BIO_printf(out, "%*sPolicy: ", indent, "");
698e500e238Sjsing 		i2a_ASN1_OBJECT(out, pinfo->policyid);
699e500e238Sjsing 		BIO_puts(out, "\n");
700e500e238Sjsing 		if (pinfo->qualifiers)
701e500e238Sjsing 			print_qualifiers(out, pinfo->qualifiers, indent + 2);
702e500e238Sjsing 	}
703e500e238Sjsing 	return 1;
704e500e238Sjsing }
705e500e238Sjsing 
706e500e238Sjsing static void
print_qualifiers(BIO * out,STACK_OF (POLICYQUALINFO)* quals,int indent)707e500e238Sjsing print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals, int indent)
708e500e238Sjsing {
709e500e238Sjsing 	POLICYQUALINFO *qualinfo;
710e500e238Sjsing 	int i;
711e500e238Sjsing 
712e500e238Sjsing 	for (i = 0; i < sk_POLICYQUALINFO_num(quals); i++) {
713e500e238Sjsing 		qualinfo = sk_POLICYQUALINFO_value(quals, i);
714e500e238Sjsing 		switch (OBJ_obj2nid(qualinfo->pqualid)) {
715e500e238Sjsing 		case NID_id_qt_cps:
7163d508f29Stb 			BIO_printf(out, "%*sCPS: %.*s\n", indent, "",
7173d508f29Stb 			    qualinfo->d.cpsuri->length,
718e500e238Sjsing 			    qualinfo->d.cpsuri->data);
719e500e238Sjsing 			break;
720e500e238Sjsing 
721e500e238Sjsing 		case NID_id_qt_unotice:
722e500e238Sjsing 			BIO_printf(out, "%*sUser Notice:\n", indent, "");
723e500e238Sjsing 			print_notice(out, qualinfo->d.usernotice, indent + 2);
724e500e238Sjsing 			break;
725e500e238Sjsing 
726e500e238Sjsing 		default:
727e500e238Sjsing 			BIO_printf(out, "%*sUnknown Qualifier: ",
728e500e238Sjsing 			    indent + 2, "");
729e500e238Sjsing 
730e500e238Sjsing 			i2a_ASN1_OBJECT(out, qualinfo->pqualid);
731e500e238Sjsing 			BIO_puts(out, "\n");
732e500e238Sjsing 			break;
733e500e238Sjsing 		}
734e500e238Sjsing 	}
735e500e238Sjsing }
736e500e238Sjsing 
737e500e238Sjsing static void
print_notice(BIO * out,USERNOTICE * notice,int indent)738e500e238Sjsing print_notice(BIO *out, USERNOTICE *notice, int indent)
739e500e238Sjsing {
740e500e238Sjsing 	int i;
741e500e238Sjsing 
742e500e238Sjsing 	if (notice->noticeref) {
743e500e238Sjsing 		NOTICEREF *ref;
744e500e238Sjsing 		ref = notice->noticeref;
7453d508f29Stb 		BIO_printf(out, "%*sOrganization: %.*s\n", indent, "",
7463d508f29Stb 		    ref->organization->length, ref->organization->data);
747e500e238Sjsing 		BIO_printf(out, "%*sNumber%s: ", indent, "",
748e500e238Sjsing 		    sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
749e500e238Sjsing 		for (i = 0; i < sk_ASN1_INTEGER_num(ref->noticenos); i++) {
750e500e238Sjsing 			ASN1_INTEGER *num;
751e500e238Sjsing 			char *tmp;
752e500e238Sjsing 			num = sk_ASN1_INTEGER_value(ref->noticenos, i);
753e500e238Sjsing 			if (i)
754e500e238Sjsing 				BIO_puts(out, ", ");
755e500e238Sjsing 			tmp = i2s_ASN1_INTEGER(NULL, num);
756e500e238Sjsing 			BIO_puts(out, tmp);
757e500e238Sjsing 			free(tmp);
758e500e238Sjsing 		}
759e500e238Sjsing 		BIO_puts(out, "\n");
760e500e238Sjsing 	}
761e500e238Sjsing 	if (notice->exptext)
7623d508f29Stb 		BIO_printf(out, "%*sExplicit Text: %.*s\n", indent, "",
7633d508f29Stb 		    notice->exptext->length, notice->exptext->data);
764e500e238Sjsing }
765