/src/openssl41/crypto/x509/x_attrib.c

Source
/*
 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/asn1t.h>
#include <openssl/x509.h>
#include "x509_local.h"
#include <crypto/x509.h>

#include <crypto/asn1.h>

/*-
 * X509_ATTRIBUTE: this has the following form:
 *
 * typedef struct x509_attributes_st
 *      {
 *      ASN1_OBJECT *object;
 *      STACK_OF(ASN1_TYPE) *set;
 *      } X509_ATTRIBUTE;
 *
 */

ASN1_SEQUENCE(X509_ATTRIBUTE) = {
    ASN1_SIMPLE(X509_ATTRIBUTE, object, ASN1_OBJECT),
    ASN1_SET_OF(X509_ATTRIBUTE, set, ASN1_ANY)
} ASN1_SEQUENCE_END(X509_ATTRIBUTE)

IMPLEMENT_ASN1_FUNCTIONS(X509_ATTRIBUTE)
IMPLEMENT_ASN1_DUP_FUNCTION(X509_ATTRIBUTE)

X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, void *value)
{
    X509_ATTRIBUTE *ret = NULL;
    ASN1_TYPE *val = NULL;
    ASN1_OBJECT *oid;

    if ((oid = OBJ_nid2obj(nid)) == NULL)
        return NULL;
    if ((ret = X509_ATTRIBUTE_new()) == NULL)
        return NULL;
    ret->object = oid;
    if ((val = ASN1_TYPE_new()) == NULL)
        goto err;
    if (!sk_ASN1_TYPE_push(ret->set, val))
        goto err;

    ASN1_TYPE_set(val, atrtype, value);
    return ret;
err:
    X509_ATTRIBUTE_free(ret);
    ASN1_TYPE_free(val);
    return NULL;
}

static int print_oid(BIO *out, const ASN1_OBJECT *oid)
{
    const char *ln;
    char objbuf[80];
    int rc;

    if (OBJ_obj2txt(objbuf, sizeof(objbuf), oid, 1) <= 0)
        return 0;
    ln = OBJ_nid2ln(OBJ_obj2nid(oid));
    rc = (ln != NULL)
        ? BIO_printf(out, "%s (%s)", objbuf, ln)
        : BIO_printf(out, "%s", objbuf);
    return (rc >= 0);
}

int ossl_print_attribute_value(BIO *out,
    int obj_nid,
    const ASN1_TYPE *av,
    int indent)
{
    ASN1_STRING *str;
    unsigned char *value;
    X509_NAME *xn = NULL;
    int64_t int_val;
    int ret = 1;

    switch (av->type) {
    case V_ASN1_BOOLEAN:
        if (av->value.boolean) {
            return BIO_printf(out, "%*sTRUE", indent, "") >= 4;
        } else {
            return BIO_printf(out, "%*sFALSE", indent, "") >= 5;
        }

    case V_ASN1_INTEGER:
    case V_ASN1_ENUMERATED:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        if (ASN1_ENUMERATED_get_int64(&int_val, av->value.integer) > 0) {
            return BIO_printf(out, "%lld", (long long int)int_val) > 0;
        }
        str = av->value.integer;
        return ossl_bio_print_hex(out, str->data, str->length);

    case V_ASN1_BIT_STRING:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        return ossl_bio_print_hex(out, av->value.bit_string->data,
            av->value.bit_string->length);

    case V_ASN1_OCTET_STRING:
    case V_ASN1_VIDEOTEXSTRING:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        return ossl_bio_print_hex(out, av->value.octet_string->data,
            av->value.octet_string->length);

    case V_ASN1_NULL:
        return BIO_printf(out, "%*sNULL", indent, "") >= 4;

    case V_ASN1_OBJECT:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        return print_oid(out, av->value.object);

    /*
     * ObjectDescriptor is an IMPLICIT GraphicString, but GeneralString is a
     * superset supported by OpenSSL, so we will use that anywhere a
     * GraphicString is needed here.
     */
    case V_ASN1_GENERALSTRING:
    case V_ASN1_GRAPHICSTRING:
    case V_ASN1_OBJECT_DESCRIPTOR:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.generalstring->length,
                   av->value.generalstring->length
                       ? av->value.generalstring->data
                       : (const unsigned char *)"")
            >= 0;

        /* EXTERNAL would go here. */
        /* EMBEDDED PDV would go here. */

    case V_ASN1_UTF8STRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.utf8string->length,
                   av->value.utf8string->length
                       ? av->value.utf8string->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_REAL:
        return BIO_printf(out, "%*sREAL", indent, "") >= 4;

        /* RELATIVE-OID would go here. */
        /* TIME would go here. */

    case V_ASN1_SEQUENCE:
        switch (obj_nid) {
        case NID_undef: /* Unrecognized OID. */
            break;
        /* Attribute types with DN syntax. */
        case NID_member:
        case NID_roleOccupant:
        case NID_seeAlso:
        case NID_manager:
        case NID_documentAuthor:
        case NID_secretary:
        case NID_associatedName:
        case NID_dITRedirect:
        case NID_owner:
            /*
             * d2i_ functions increment the ppin pointer. See doc/man3/d2i_X509.pod.
             * This preserves the original  pointer. We don't want to corrupt this
             * value.
             */
            value = av->value.sequence->data;
            xn = d2i_X509_NAME(NULL,
                (const unsigned char **)&value,
                av->value.sequence->length);
            if (xn == NULL) {
                BIO_puts(out, "(COULD NOT DECODE DISTINGUISHED NAME)\n");
                return 0;
            }
            if (X509_NAME_print_ex(out, xn, indent, XN_FLAG_SEP_CPLUS_SPC) <= 0)
                ret = 0;
            X509_NAME_free(xn);
            return ret;

        default:
            break;
        }
        return ASN1_parse_dump(out, av->value.sequence->data,
                   av->value.sequence->length, indent, 1)
            > 0;

    case V_ASN1_SET:
        return ASN1_parse_dump(out, av->value.set->data,
                   av->value.set->length, indent, 1)
            > 0;

    /*
     * UTCTime ::= [UNIVERSAL 23] IMPLICIT VisibleString
     * GeneralizedTime ::= [UNIVERSAL 24] IMPLICIT VisibleString
     * VisibleString is a superset for NumericString, so it will work for that.
     */
    case V_ASN1_VISIBLESTRING:
    case V_ASN1_UTCTIME:
    case V_ASN1_GENERALIZEDTIME:
    case V_ASN1_NUMERICSTRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.visiblestring->length,
                   av->value.visiblestring->length
                       ? av->value.visiblestring->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_PRINTABLESTRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.printablestring->length,
                   av->value.printablestring->length
                       ? av->value.printablestring->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_T61STRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.t61string->length,
                   av->value.t61string->length
                       ? av->value.t61string->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_IA5STRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.ia5string->length,
                   av->value.ia5string->length
                       ? av->value.ia5string->data
                       : (const unsigned char *)"")
            >= 0;

    /* UniversalString would go here. */
    /* CHARACTER STRING would go here. */
    /* BMPString would go here. */
    /* DATE would go here. */
    /* TIME-OF-DAY would go here. */
    /* DATE-TIME would go here. */
    /* DURATION would go here. */
    /* OID-IRI would go here. */
    /* RELATIVE-OID-IRI would go here. */

    /* Would it be appropriate to just hexdump? */
    default:
        return BIO_printf(out,
                   "%*s<Unsupported tag %d>",
                   indent,
                   "",
                   av->type)
            >= 0;
    }
}

Coverage Report

Created: 2026-09-12 06:55

Line	Count	Source
1		/*
2		* Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include "internal/cryptlib.h"
12		#include <openssl/objects.h>
13		#include <openssl/asn1t.h>
14		#include <openssl/x509.h>
15		#include "x509_local.h"
16		#include <crypto/x509.h>
17
18		#include <crypto/asn1.h>
19
20		/*-
21		* X509_ATTRIBUTE: this has the following form:
22		*
23		* typedef struct x509_attributes_st
24		* {
25		* ASN1_OBJECT *object;
26		* STACK_OF(ASN1_TYPE) *set;
27		* } X509_ATTRIBUTE;
28		*
29		*/
30
31		ASN1_SEQUENCE(X509_ATTRIBUTE) = {
32		ASN1_SIMPLE(X509_ATTRIBUTE, object, ASN1_OBJECT),
33		ASN1_SET_OF(X509_ATTRIBUTE, set, ASN1_ANY)
34	3.47M	} ASN1_SEQUENCE_END(X509_ATTRIBUTE)
35	3.47M
36	3.47M	IMPLEMENT_ASN1_FUNCTIONS(X509_ATTRIBUTE)
37	3.47M	IMPLEMENT_ASN1_DUP_FUNCTION(X509_ATTRIBUTE)
38	3.47M
39	3.47M	X509_ATTRIBUTE X509_ATTRIBUTE_create(int nid, int atrtype, void value)
40	3.47M	{
41	0	X509_ATTRIBUTE *ret = NULL;
42	0	ASN1_TYPE *val = NULL;
43	0	ASN1_OBJECT *oid;
44
45	0	if ((oid = OBJ_nid2obj(nid)) == NULL)
46	0	return NULL;
47	0	if ((ret = X509_ATTRIBUTE_new()) == NULL)
48	0	return NULL;
49	0	ret->object = oid;
50	0	if ((val = ASN1_TYPE_new()) == NULL)
51	0	goto err;
52	0	if (!sk_ASN1_TYPE_push(ret->set, val))
53	0	goto err;
54
55	0	ASN1_TYPE_set(val, atrtype, value);
56	0	return ret;
57	0	err:
58	0	X509_ATTRIBUTE_free(ret);
59	0	ASN1_TYPE_free(val);
60	0	return NULL;
61	0	}
62
63		static int print_oid(BIO out, const ASN1_OBJECT oid)
64	7.91k	{
65	7.91k	const char *ln;
66	7.91k	char objbuf[80];
67	7.91k	int rc;
68
69	7.91k	if (OBJ_obj2txt(objbuf, sizeof(objbuf), oid, 1) <= 0)
70	1	return 0;
71	7.91k	ln = OBJ_nid2ln(OBJ_obj2nid(oid));
72	7.91k	rc = (ln != NULL)
73	7.91k	? BIO_printf(out, "%s (%s)", objbuf, ln)
74	7.91k	: BIO_printf(out, "%s", objbuf);
75	7.91k	return (rc >= 0);
76	7.91k	}
77
78		int ossl_print_attribute_value(BIO *out,
79		int obj_nid,
80		const ASN1_TYPE *av,
81		int indent)
82	271k	{
83	271k	ASN1_STRING *str;
84	271k	unsigned char *value;
85	271k	X509_NAME *xn = NULL;
86	271k	int64_t int_val;
87	271k	int ret = 1;
88
89	271k	switch (av->type) {
90	2.35k	case V_ASN1_BOOLEAN:
91	2.35k	if (av->value.boolean) {
92	1.95k	return BIO_printf(out, "%*sTRUE", indent, "") >= 4;
93	1.95k	} else {
94	396	return BIO_printf(out, "%*sFALSE", indent, "") >= 5;
95	396	}
96
97	3.08k	case V_ASN1_INTEGER:
98	11.5k	case V_ASN1_ENUMERATED:
99	11.5k	if (BIO_printf(out, "%*s", indent, "") < 0)
100	0	return 0;
101	11.5k	if (ASN1_ENUMERATED_get_int64(&int_val, av->value.integer) > 0) {
102	4.89k	return BIO_printf(out, "%lld", (long long int)int_val) > 0;
103	4.89k	}
104	6.65k	str = av->value.integer;
105	6.65k	return ossl_bio_print_hex(out, str->data, str->length);
106
107	2.36k	case V_ASN1_BIT_STRING:
108	2.36k	if (BIO_printf(out, "%*s", indent, "") < 0)
109	0	return 0;
110	2.36k	return ossl_bio_print_hex(out, av->value.bit_string->data,
111	2.36k	av->value.bit_string->length);
112
113	103k	case V_ASN1_OCTET_STRING:
114	105k	case V_ASN1_VIDEOTEXSTRING:
115	105k	if (BIO_printf(out, "%*s", indent, "") < 0)
116	0	return 0;
117	105k	return ossl_bio_print_hex(out, av->value.octet_string->data,
118	105k	av->value.octet_string->length);
119
120	1.89k	case V_ASN1_NULL:
121	1.89k	return BIO_printf(out, "%*sNULL", indent, "") >= 4;
122
123	3.02k	case V_ASN1_OBJECT:
124	3.02k	if (BIO_printf(out, "%*s", indent, "") < 0)
125	0	return 0;
126	3.02k	return print_oid(out, av->value.object);
127
128		/*
129		* ObjectDescriptor is an IMPLICIT GraphicString, but GeneralString is a
130		* superset supported by OpenSSL, so we will use that anywhere a
131		* GraphicString is needed here.
132		*/
133	2.16k	case V_ASN1_GENERALSTRING:
134	3.29k	case V_ASN1_GRAPHICSTRING:
135	9.08k	case V_ASN1_OBJECT_DESCRIPTOR:
136	9.08k	return BIO_printf(out, "%s%.s", indent, "",
137	9.08k	av->value.generalstring->length,
138	9.08k	av->value.generalstring->length
139	9.08k	? av->value.generalstring->data
140	9.08k	: (const unsigned char *)"")
141	9.08k	>= 0;
142
143		/* EXTERNAL would go here. */
144		/* EMBEDDED PDV would go here. */
145
146	2.97k	case V_ASN1_UTF8STRING:
147	2.97k	return BIO_printf(out, "%s%.s", indent, "",
148	2.97k	av->value.utf8string->length,
149	2.97k	av->value.utf8string->length
150	2.97k	? av->value.utf8string->data
151	2.97k	: (const unsigned char *)"")
152	2.97k	>= 0;
153
154	1.30k	case V_ASN1_REAL:
155	1.30k	return BIO_printf(out, "%*sREAL", indent, "") >= 4;
156
157		/* RELATIVE-OID would go here. */
158		/* TIME would go here. */
159
160	50.7k	case V_ASN1_SEQUENCE:
161	50.7k	switch (obj_nid) {
162	39.9k	case NID_undef: /* Unrecognized OID. */
163	39.9k	break;
164		/* Attribute types with DN syntax. */
165	877	case NID_member:
166	1.98k	case NID_roleOccupant:
167	3.02k	case NID_seeAlso:
168	3.02k	case NID_manager:
169	3.02k	case NID_documentAuthor:
170	3.02k	case NID_secretary:
171	3.02k	case NID_associatedName:
172	3.02k	case NID_dITRedirect:
173	4.28k	case NID_owner:
174		/*
175		* d2i_ functions increment the ppin pointer. See doc/man3/d2i_X509.pod.
176		* This preserves the original pointer. We don't want to corrupt this
177		* value.
178		*/
179	4.28k	value = av->value.sequence->data;
180	4.28k	xn = d2i_X509_NAME(NULL,
181	4.28k	(const unsigned char **)&value,
182	4.28k	av->value.sequence->length);
183	4.28k	if (xn == NULL) {
184	242	BIO_puts(out, "(COULD NOT DECODE DISTINGUISHED NAME)\n");
185	242	return 0;
186	242	}
187	4.04k	if (X509_NAME_print_ex(out, xn, indent, XN_FLAG_SEP_CPLUS_SPC) <= 0)
188	0	ret = 0;
189	4.04k	X509_NAME_free(xn);
190	4.04k	return ret;
191
192	6.52k	default:
193	6.52k	break;
194	50.7k	}
195	46.4k	return ASN1_parse_dump(out, av->value.sequence->data,
196	46.4k	av->value.sequence->length, indent, 1)
197	46.4k	> 0;
198
199	19.2k	case V_ASN1_SET:
200	19.2k	return ASN1_parse_dump(out, av->value.set->data,
201	19.2k	av->value.set->length, indent, 1)
202	19.2k	> 0;
203
204		/*
205		* UTCTime ::= [UNIVERSAL 23] IMPLICIT VisibleString
206		* GeneralizedTime ::= [UNIVERSAL 24] IMPLICIT VisibleString
207		* VisibleString is a superset for NumericString, so it will work for that.
208		*/
209	2.27k	case V_ASN1_VISIBLESTRING:
210	3.38k	case V_ASN1_UTCTIME:
211	4.70k	case V_ASN1_GENERALIZEDTIME:
212	6.63k	case V_ASN1_NUMERICSTRING:
213	6.63k	return BIO_printf(out, "%s%.s", indent, "",
214	6.63k	av->value.visiblestring->length,
215	6.63k	av->value.visiblestring->length
216	6.63k	? av->value.visiblestring->data
217	6.63k	: (const unsigned char *)"")
218	6.63k	>= 0;
219
220	2.21k	case V_ASN1_PRINTABLESTRING:
221	2.21k	return BIO_printf(out, "%s%.s", indent, "",
222	2.21k	av->value.printablestring->length,
223	2.21k	av->value.printablestring->length
224	2.21k	? av->value.printablestring->data
225	2.21k	: (const unsigned char *)"")
226	2.21k	>= 0;
227
228	1.51k	case V_ASN1_T61STRING:
229	1.51k	return BIO_printf(out, "%s%.s", indent, "",
230	1.51k	av->value.t61string->length,
231	1.51k	av->value.t61string->length
232	1.51k	? av->value.t61string->data
233	1.51k	: (const unsigned char *)"")
234	1.51k	>= 0;
235
236	1.41k	case V_ASN1_IA5STRING:
237	1.41k	return BIO_printf(out, "%s%.s", indent, "",
238	1.41k	av->value.ia5string->length,
239	1.41k	av->value.ia5string->length
240	1.41k	? av->value.ia5string->data
241	1.41k	: (const unsigned char *)"")
242	1.41k	>= 0;
243
244		/* UniversalString would go here. */
245		/* CHARACTER STRING would go here. */
246		/* BMPString would go here. */
247		/* DATE would go here. */
248		/* TIME-OF-DAY would go here. */
249		/* DATE-TIME would go here. */
250		/* DURATION would go here. */
251		/* OID-IRI would go here. */
252		/* RELATIVE-OID-IRI would go here. */
253
254		/* Would it be appropriate to just hexdump? */
255	49.3k	default:
256	49.3k	return BIO_printf(out,
257	49.3k	"%*s<Unsupported tag %d>",
258	49.3k	indent,
259	49.3k	"",
260	49.3k	av->type)
261	49.3k	>= 0;
262	271k	}
263	271k	}