path: root/lib/x509/pkcs7-output.c

/*
 * Copyright (C) 2015 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

#include "gnutls_int.h"
#include <common.h>
#include <x509.h>
#include <x509_int.h>
#include <num.h>
#include "errors.h"
#include <extras/randomart.h>
#include <pkcs7_int.h>

#define addf _gnutls_buffer_append_printf
#define adds _gnutls_buffer_append_str

static void print_dn(gnutls_buffer_st *str, const char *prefix,
		     const gnutls_datum_t *raw)
{
	gnutls_x509_dn_t dn = NULL;
	gnutls_datum_t output = { NULL, 0 };
	int ret;

	ret = gnutls_x509_dn_init(&dn);
	if (ret < 0) {
		addf(str, "%s: [error]\n", prefix);
		return;
	}

	ret = gnutls_x509_dn_import(dn, raw);
	if (ret < 0) {
		addf(str, "%s: [error]\n", prefix);
		goto cleanup;
	}

	ret = gnutls_x509_dn_get_str2(dn, &output, 0);
	if (ret < 0) {
		addf(str, "%s: [error]\n", prefix);
		goto cleanup;
	}

	addf(str, "%s: %s\n", prefix, output.data);

cleanup:
	gnutls_x509_dn_deinit(dn);
	gnutls_free(output.data);
}

/* Do not encode ASN1 and type for now */
#define ENTRY(oid, name, type)                                           \
	{                                                                \
		oid, sizeof(oid) - 1, name, sizeof(name) - 1, NULL, type \
	}
#define ENTRY2(oid, name)                                           \
	{                                                           \
		oid, sizeof(oid) - 1, name, sizeof(name) - 1, NULL, \
			ASN1_ETYPE_INVALID                          \
	}

static const struct oid_to_string pkcs7_attrs[] = {
	ENTRY("1.2.840.113549.1.9.3", "contentType", ASN1_ETYPE_OBJECT_ID),
	ENTRY("1.2.840.113549.1.9.4", "messageDigest", ASN1_ETYPE_OCTET_STRING),
	ENTRY("1.2.840.113549.1.9.5", "signingTime", ASN1_ETYPE_INVALID),
	ENTRY2("1.2.840.113549.1.9.6", "countersignature"),
	ENTRY2("1.2.840.113549.1.9.15", "smimeCapabilities"),

	ENTRY2("1.2.840.113549.1.9.16.2.1", "aa-receiptRequest"),
	ENTRY2("1.2.840.113549.1.9.16.2.2", "aa-securityLabel"),
	ENTRY2("1.2.840.113549.1.9.16.2.3", "aa-mlExpandHistory"),
	ENTRY2("1.2.840.113549.1.9.16.2.4", "aa-contentHint"),
	ENTRY2("1.2.840.113549.1.9.16.2.9", "aa-equivalentLabels"),
	ENTRY2("1.2.840.113549.1.9.16.2.10", "aa-contentReference"),
	ENTRY2("1.2.840.113549.1.9.16.2.11", "aa-encrypKeyPref"),
	ENTRY2("1.2.840.113549.1.9.16.2.12", "aa-signingCertificate"),
	ENTRY2("1.2.840.113549.1.9.16.2.19", "aa-ets-otherSigCert"),
	ENTRY2("1.2.840.113549.1.9.16.2.47", "aa-signingCertificateV2"),

	{ NULL, 0, NULL, 0, NULL, 0 }
};

static void print_raw(gnutls_buffer_st *str, const char *prefix,
		      const gnutls_datum_t *raw)
{
	gnutls_datum_t result;
	int ret;

	if (raw->data == NULL || raw->size == 0)
		return;

	ret = gnutls_hex_encode2(raw, &result);
	if (ret < 0) {
		addf(str, "%s: [error]\n", prefix);
		return;
	}

	addf(str, "%s: %s\n", prefix, result.data);
	gnutls_free(result.data);
}

static void print_pkcs7_info(gnutls_pkcs7_signature_info_st *info,
			     gnutls_buffer_st *str,
			     gnutls_certificate_print_formats_t format)
{
	unsigned i;
	char *oid;
	gnutls_datum_t data;
	char prefix[128];
	char s[42];
	size_t max;
	int ret;
	const struct oid_to_string *entry;

	if (info->issuer_dn.size > 0)
		print_dn(str, "\tSigner's issuer DN", &info->issuer_dn);
	print_raw(str, "\tSigner's serial", &info->signer_serial);
	print_raw(str, "\tSigner's issuer key ID", &info->issuer_keyid);
	if (info->signing_time != -1) {
		struct tm t;
		if (gmtime_r(&info->signing_time, &t) == NULL) {
			addf(str, "error: gmtime_r (%ld)\n",
			     (unsigned long)info->signing_time);
		} else {
			max = sizeof(s);
			if (strftime(s, max, "%a %b %d %H:%M:%S UTC %Y", &t) ==
			    0) {
				addf(str, "error: strftime (%ld)\n",
				     (unsigned long)info->signing_time);
			} else {
				addf(str, "\tSigning time: %s\n", s);
			}
		}
	}

	addf(str, "\tSignature Algorithm: %s\n",
	     gnutls_sign_get_name(info->algo));

	if (format == GNUTLS_CRT_PRINT_FULL) {
		if (info->signed_attrs) {
			for (i = 0;; i++) {
				ret = gnutls_pkcs7_get_attr(info->signed_attrs,
							    i, &oid, &data, 0);
				if (ret < 0)
					break;
				if (i == 0)
					addf(str, "\tSigned Attributes:\n");

				entry = _gnutls_oid_get_entry(pkcs7_attrs, oid);
				snprintf(prefix, sizeof(prefix), "\t\t%s",
					 (entry && entry->name_desc) ?
						 entry->name_desc :
						 oid);
				print_raw(str, prefix, &data);
				gnutls_free(data.data);
			}
		}
		if (info->unsigned_attrs) {
			for (i = 0;; i++) {
				ret = gnutls_pkcs7_get_attr(
					info->unsigned_attrs, i, &oid, &data,
					0);
				if (ret < 0)
					break;
				if (i == 0)
					addf(str, "\tUnsigned Attributes:\n");

				entry = _gnutls_oid_get_entry(pkcs7_attrs, oid);
				snprintf(prefix, sizeof(prefix), "\t\t%s",
					 (entry && entry->name_desc) ?
						 entry->name_desc :
						 oid);
				print_raw(str, prefix, &data);
				gnutls_free(data.data);
			}
		}
	}
	adds(str, "\n");
}

/**
 * gnutls_pkcs7_print_signature_info:
 * @info: The PKCS7 signature info struct to be printed
 * @format: Indicate the format to use
 * @out: Newly allocated datum with null terminated string.
 *
 * This function will pretty print a PKCS #7 signature info structure, suitable
 * for display to a human.
 *
 * Currently the supported formats are %GNUTLS_CRT_PRINT_FULL and
 * %GNUTLS_CRT_PRINT_COMPACT.
 *
 * The output @out needs to be deallocated using gnutls_free().
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 *
 * Since: 3.6.14
 **/
int gnutls_pkcs7_print_signature_info(gnutls_pkcs7_signature_info_st *info,
				      gnutls_certificate_print_formats_t format,
				      gnutls_datum_t *out)
{
	gnutls_buffer_st str;

	_gnutls_buffer_init(&str);
	print_pkcs7_info(info, &str, format);

	return _gnutls_buffer_to_datum(&str, out, 1);
}

/**
 * gnutls_pkcs7_crt_print:
 * @pkcs7: The PKCS7 struct to be printed
 * @format: Indicate the format to use
 * @out: Newly allocated datum with null terminated string.
 *
 * This function will pretty print a signed PKCS #7 structure, suitable for
 * display to a human.
 *
 * Currently the supported formats are %GNUTLS_CRT_PRINT_FULL and
 * %GNUTLS_CRT_PRINT_COMPACT.
 *
 * The output @out needs to be deallocated using gnutls_free().
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 *   negative error value.
 **/
int gnutls_pkcs7_print(gnutls_pkcs7_t pkcs7,
		       gnutls_certificate_print_formats_t format,
		       gnutls_datum_t *out)
{
	int count, ret, i;
	gnutls_pkcs7_signature_info_st info;
	gnutls_buffer_st str;
	const char *oid;

	_gnutls_buffer_init(&str);

	/* For backwards compatibility with structures using the default OID,
	 * we don't print the eContent Type explicitly */
	oid = gnutls_pkcs7_get_embedded_data_oid(pkcs7);
	if (oid) {
		if (strcmp(oid, DATA_OID) != 0 &&
		    strcmp(oid, DIGESTED_DATA_OID) != 0) {
			addf(&str, "eContent Type: %s\n", oid);
		}
	}

	for (i = 0;; i++) {
		if (i == 0)
			addf(&str, "Signers:\n");

		ret = gnutls_pkcs7_get_signature_info(pkcs7, i, &info);
		if (ret < 0)
			break;

		print_pkcs7_info(&info, &str, format);
		gnutls_pkcs7_signature_info_deinit(&info);
	}

	if (format == GNUTLS_CRT_PRINT_FULL) {
		gnutls_datum_t data, b64;

		count = gnutls_pkcs7_get_crt_count(pkcs7);

		if (count > 0) {
			addf(&str, "Number of certificates: %u\n\n", count);

			for (i = 0; i < count; i++) {
				ret = gnutls_pkcs7_get_crt_raw2(pkcs7, i,
								&data);
				if (ret < 0) {
					addf(&str,
					     "Error: cannot print certificate %d\n",
					     i);
					continue;
				}

				ret = gnutls_pem_base64_encode_alloc(
					"CERTIFICATE", &data, &b64);
				if (ret < 0) {
					gnutls_free(data.data);
					continue;
				}

				adds(&str, (char *)b64.data);
				adds(&str, "\n");
				gnutls_free(b64.data);
				gnutls_free(data.data);
			}
		}

		count = gnutls_pkcs7_get_crl_count(pkcs7);
		if (count > 0) {
			addf(&str, "Number of CRLs: %u\n\n", count);

			for (i = 0; i < count; i++) {
				ret = gnutls_pkcs7_get_crl_raw2(pkcs7, i,
								&data);
				if (ret < 0) {
					addf(&str,
					     "Error: cannot print certificate %d\n",
					     i);
					continue;
				}

				ret = gnutls_pem_base64_encode_alloc(
					"X509 CRL", &data, &b64);
				if (ret < 0) {
					gnutls_free(data.data);
					continue;
				}

				adds(&str, (char *)b64.data);
				adds(&str, "\n");
				gnutls_free(b64.data);
				gnutls_free(data.data);
			}
		}
	}

	return _gnutls_buffer_to_datum(&str, out, 1);
}