/src/openssl41/crypto/x509/x_attrib.c

Source
/*
 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/objects.h>
#include <openssl/asn1t.h>
#include <openssl/x509.h>
#include "x509_local.h"
#include <crypto/x509.h>

#include <crypto/asn1.h>

/*-
 * X509_ATTRIBUTE: this has the following form:
 *
 * typedef struct x509_attributes_st
 *      {
 *      ASN1_OBJECT *object;
 *      STACK_OF(ASN1_TYPE) *set;
 *      } X509_ATTRIBUTE;
 *
 */

ASN1_SEQUENCE(X509_ATTRIBUTE) = {
    ASN1_SIMPLE(X509_ATTRIBUTE, object, ASN1_OBJECT),
    ASN1_SET_OF(X509_ATTRIBUTE, set, ASN1_ANY)
} ASN1_SEQUENCE_END(X509_ATTRIBUTE)

IMPLEMENT_ASN1_FUNCTIONS(X509_ATTRIBUTE)
IMPLEMENT_ASN1_DUP_FUNCTION(X509_ATTRIBUTE)

X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, void *value)
{
    X509_ATTRIBUTE *ret = NULL;
    ASN1_TYPE *val = NULL;
    ASN1_OBJECT *oid;

    if ((oid = OBJ_nid2obj(nid)) == NULL)
        return NULL;
    if ((ret = X509_ATTRIBUTE_new()) == NULL)
        return NULL;
    ret->object = oid;
    if ((val = ASN1_TYPE_new()) == NULL)
        goto err;
    if (!sk_ASN1_TYPE_push(ret->set, val))
        goto err;

    ASN1_TYPE_set(val, atrtype, value);
    return ret;
err:
    X509_ATTRIBUTE_free(ret);
    ASN1_TYPE_free(val);
    return NULL;
}

static int print_oid(BIO *out, const ASN1_OBJECT *oid)
{
    const char *ln;
    char objbuf[80];
    int rc;

    if (OBJ_obj2txt(objbuf, sizeof(objbuf), oid, 1) <= 0)
        return 0;
    ln = OBJ_nid2ln(OBJ_obj2nid(oid));
    rc = (ln != NULL)
        ? BIO_printf(out, "%s (%s)", objbuf, ln)
        : BIO_printf(out, "%s", objbuf);
    return (rc >= 0);
}

int ossl_print_attribute_value(BIO *out,
    int obj_nid,
    const ASN1_TYPE *av,
    int indent)
{
    ASN1_STRING *str;
    unsigned char *value;
    X509_NAME *xn = NULL;
    int64_t int_val;
    int ret = 1;

    switch (av->type) {
    case V_ASN1_BOOLEAN:
        if (av->value.boolean) {
            return BIO_printf(out, "%*sTRUE", indent, "") >= 4;
        } else {
            return BIO_printf(out, "%*sFALSE", indent, "") >= 5;
        }

    case V_ASN1_INTEGER:
    case V_ASN1_ENUMERATED:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        if (ASN1_ENUMERATED_get_int64(&int_val, av->value.integer) > 0) {
            return BIO_printf(out, "%lld", (long long int)int_val) > 0;
        }
        str = av->value.integer;
        return ossl_bio_print_hex(out, str->data, str->length);

    case V_ASN1_BIT_STRING:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        return ossl_bio_print_hex(out, av->value.bit_string->data,
            av->value.bit_string->length);

    case V_ASN1_OCTET_STRING:
    case V_ASN1_VIDEOTEXSTRING:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        return ossl_bio_print_hex(out, av->value.octet_string->data,
            av->value.octet_string->length);

    case V_ASN1_NULL:
        return BIO_printf(out, "%*sNULL", indent, "") >= 4;

    case V_ASN1_OBJECT:
        if (BIO_printf(out, "%*s", indent, "") < 0)
            return 0;
        return print_oid(out, av->value.object);

    /*
     * ObjectDescriptor is an IMPLICIT GraphicString, but GeneralString is a
     * superset supported by OpenSSL, so we will use that anywhere a
     * GraphicString is needed here.
     */
    case V_ASN1_GENERALSTRING:
    case V_ASN1_GRAPHICSTRING:
    case V_ASN1_OBJECT_DESCRIPTOR:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.generalstring->length,
                   av->value.generalstring->length
                       ? av->value.generalstring->data
                       : (const unsigned char *)"")
            >= 0;

        /* EXTERNAL would go here. */
        /* EMBEDDED PDV would go here. */

    case V_ASN1_UTF8STRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.utf8string->length,
                   av->value.utf8string->length
                       ? av->value.utf8string->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_REAL:
        return BIO_printf(out, "%*sREAL", indent, "") >= 4;

        /* RELATIVE-OID would go here. */
        /* TIME would go here. */

    case V_ASN1_SEQUENCE:
        switch (obj_nid) {
        case NID_undef: /* Unrecognized OID. */
            break;
        /* Attribute types with DN syntax. */
        case NID_member:
        case NID_roleOccupant:
        case NID_seeAlso:
        case NID_manager:
        case NID_documentAuthor:
        case NID_secretary:
        case NID_associatedName:
        case NID_dITRedirect:
        case NID_owner:
            /*
             * d2i_ functions increment the ppin pointer. See doc/man3/d2i_X509.pod.
             * This preserves the original  pointer. We don't want to corrupt this
             * value.
             */
            value = av->value.sequence->data;
            xn = d2i_X509_NAME(NULL,
                (const unsigned char **)&value,
                av->value.sequence->length);
            if (xn == NULL) {
                BIO_puts(out, "(COULD NOT DECODE DISTINGUISHED NAME)\n");
                return 0;
            }
            if (X509_NAME_print_ex(out, xn, indent, XN_FLAG_SEP_CPLUS_SPC) <= 0)
                ret = 0;
            X509_NAME_free(xn);
            return ret;

        default:
            break;
        }
        return ASN1_parse_dump(out, av->value.sequence->data,
                   av->value.sequence->length, indent, 1)
            > 0;

    case V_ASN1_SET:
        return ASN1_parse_dump(out, av->value.set->data,
                   av->value.set->length, indent, 1)
            > 0;

    /*
     * UTCTime ::= [UNIVERSAL 23] IMPLICIT VisibleString
     * GeneralizedTime ::= [UNIVERSAL 24] IMPLICIT VisibleString
     * VisibleString is a superset for NumericString, so it will work for that.
     */
    case V_ASN1_VISIBLESTRING:
    case V_ASN1_UTCTIME:
    case V_ASN1_GENERALIZEDTIME:
    case V_ASN1_NUMERICSTRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.visiblestring->length,
                   av->value.visiblestring->length
                       ? av->value.visiblestring->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_PRINTABLESTRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.printablestring->length,
                   av->value.printablestring->length
                       ? av->value.printablestring->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_T61STRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.t61string->length,
                   av->value.t61string->length
                       ? av->value.t61string->data
                       : (const unsigned char *)"")
            >= 0;

    case V_ASN1_IA5STRING:
        return BIO_printf(out, "%*s%.*s", indent, "",
                   av->value.ia5string->length,
                   av->value.ia5string->length
                       ? av->value.ia5string->data
                       : (const unsigned char *)"")
            >= 0;

    /* UniversalString would go here. */
    /* CHARACTER STRING would go here. */
    /* BMPString would go here. */
    /* DATE would go here. */
    /* TIME-OF-DAY would go here. */
    /* DATE-TIME would go here. */
    /* DURATION would go here. */
    /* OID-IRI would go here. */
    /* RELATIVE-OID-IRI would go here. */

    /* Would it be appropriate to just hexdump? */
    default:
        return BIO_printf(out,
                   "%*s<Unsupported tag %d>",
                   indent,
                   "",
                   av->type)
            >= 0;
    }
}

Coverage Report

Created: 2026-10-28 06:28

Line	Count	Source
1		/*
2		* Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include "internal/cryptlib.h"
12		#include <openssl/objects.h>
13		#include <openssl/asn1t.h>
14		#include <openssl/x509.h>
15		#include "x509_local.h"
16		#include <crypto/x509.h>
17
18		#include <crypto/asn1.h>
19
20		/*-
21		* X509_ATTRIBUTE: this has the following form:
22		*
23		* typedef struct x509_attributes_st
24		* {
25		* ASN1_OBJECT *object;
26		* STACK_OF(ASN1_TYPE) *set;
27		* } X509_ATTRIBUTE;
28		*
29		*/
30
31		ASN1_SEQUENCE(X509_ATTRIBUTE) = {
32		ASN1_SIMPLE(X509_ATTRIBUTE, object, ASN1_OBJECT),
33		ASN1_SET_OF(X509_ATTRIBUTE, set, ASN1_ANY)
34	4.35M	} ASN1_SEQUENCE_END(X509_ATTRIBUTE)
35	4.35M
36	4.35M	IMPLEMENT_ASN1_FUNCTIONS(X509_ATTRIBUTE)
37	4.35M	IMPLEMENT_ASN1_DUP_FUNCTION(X509_ATTRIBUTE)
38	4.35M
39	4.35M	X509_ATTRIBUTE X509_ATTRIBUTE_create(int nid, int atrtype, void value)
40	4.35M	{
41	0	X509_ATTRIBUTE *ret = NULL;
42	0	ASN1_TYPE *val = NULL;
43	0	ASN1_OBJECT *oid;
44
45	0	if ((oid = OBJ_nid2obj(nid)) == NULL)
46	0	return NULL;
47	0	if ((ret = X509_ATTRIBUTE_new()) == NULL)
48	0	return NULL;
49	0	ret->object = oid;
50	0	if ((val = ASN1_TYPE_new()) == NULL)
51	0	goto err;
52	0	if (!sk_ASN1_TYPE_push(ret->set, val))
53	0	goto err;
54
55	0	ASN1_TYPE_set(val, atrtype, value);
56	0	return ret;
57	0	err:
58	0	X509_ATTRIBUTE_free(ret);
59	0	ASN1_TYPE_free(val);
60	0	return NULL;
61	0	}
62
63		static int print_oid(BIO out, const ASN1_OBJECT oid)
64	10.4k	{
65	10.4k	const char *ln;
66	10.4k	char objbuf[80];
67	10.4k	int rc;
68
69	10.4k	if (OBJ_obj2txt(objbuf, sizeof(objbuf), oid, 1) <= 0)
70	1	return 0;
71	10.4k	ln = OBJ_nid2ln(OBJ_obj2nid(oid));
72	10.4k	rc = (ln != NULL)
73	10.4k	? BIO_printf(out, "%s (%s)", objbuf, ln)
74	10.4k	: BIO_printf(out, "%s", objbuf);
75	10.4k	return (rc >= 0);
76	10.4k	}
77
78		int ossl_print_attribute_value(BIO *out,
79		int obj_nid,
80		const ASN1_TYPE *av,
81		int indent)
82	397k	{
83	397k	ASN1_STRING *str;
84	397k	unsigned char *value;
85	397k	X509_NAME *xn = NULL;
86	397k	int64_t int_val;
87	397k	int ret = 1;
88
89	397k	switch (av->type) {
90	5.42k	case V_ASN1_BOOLEAN:
91	5.42k	if (av->value.boolean) {
92	4.49k	return BIO_printf(out, "%*sTRUE", indent, "") >= 4;
93	4.49k	} else {
94	931	return BIO_printf(out, "%*sFALSE", indent, "") >= 5;
95	931	}
96
97	3.14k	case V_ASN1_INTEGER:
98	11.4k	case V_ASN1_ENUMERATED:
99	11.4k	if (BIO_printf(out, "%*s", indent, "") < 0)
100	0	return 0;
101	11.4k	if (ASN1_ENUMERATED_get_int64(&int_val, av->value.integer) > 0) {
102	4.83k	return BIO_printf(out, "%lld", (long long int)int_val) > 0;
103	4.83k	}
104	6.64k	str = av->value.integer;
105	6.64k	return ossl_bio_print_hex(out, str->data, str->length);
106
107	6.49k	case V_ASN1_BIT_STRING:
108	6.49k	if (BIO_printf(out, "%*s", indent, "") < 0)
109	0	return 0;
110	6.49k	return ossl_bio_print_hex(out, av->value.bit_string->data,
111	6.49k	av->value.bit_string->length);
112
113	135k	case V_ASN1_OCTET_STRING:
114	138k	case V_ASN1_VIDEOTEXSTRING:
115	138k	if (BIO_printf(out, "%*s", indent, "") < 0)
116	0	return 0;
117	138k	return ossl_bio_print_hex(out, av->value.octet_string->data,
118	138k	av->value.octet_string->length);
119
120	2.86k	case V_ASN1_NULL:
121	2.86k	return BIO_printf(out, "%*sNULL", indent, "") >= 4;
122
123	3.91k	case V_ASN1_OBJECT:
124	3.91k	if (BIO_printf(out, "%*s", indent, "") < 0)
125	0	return 0;
126	3.91k	return print_oid(out, av->value.object);
127
128		/*
129		* ObjectDescriptor is an IMPLICIT GraphicString, but GeneralString is a
130		* superset supported by OpenSSL, so we will use that anywhere a
131		* GraphicString is needed here.
132		*/
133	2.58k	case V_ASN1_GENERALSTRING:
134	3.80k	case V_ASN1_GRAPHICSTRING:
135	10.3k	case V_ASN1_OBJECT_DESCRIPTOR:
136	10.3k	return BIO_printf(out, "%s%.s", indent, "",
137	10.3k	av->value.generalstring->length,
138	10.3k	av->value.generalstring->length
139	10.3k	? av->value.generalstring->data
140	10.3k	: (const unsigned char *)"")
141	10.3k	>= 0;
142
143		/* EXTERNAL would go here. */
144		/* EMBEDDED PDV would go here. */
145
146	3.30k	case V_ASN1_UTF8STRING:
147	3.30k	return BIO_printf(out, "%s%.s", indent, "",
148	3.30k	av->value.utf8string->length,
149	3.30k	av->value.utf8string->length
150	3.30k	? av->value.utf8string->data
151	3.30k	: (const unsigned char *)"")
152	3.30k	>= 0;
153
154	2.15k	case V_ASN1_REAL:
155	2.15k	return BIO_printf(out, "%*sREAL", indent, "") >= 4;
156
157		/* RELATIVE-OID would go here. */
158		/* TIME would go here. */
159
160	101k	case V_ASN1_SEQUENCE:
161	101k	switch (obj_nid) {
162	38.2k	case NID_undef: /* Unrecognized OID. */
163	38.2k	break;
164		/* Attribute types with DN syntax. */
165	1.36k	case NID_member:
166	2.59k	case NID_roleOccupant:
167	5.55k	case NID_seeAlso:
168	5.55k	case NID_manager:
169	5.55k	case NID_documentAuthor:
170	5.55k	case NID_secretary:
171	5.55k	case NID_associatedName:
172	5.55k	case NID_dITRedirect:
173	6.81k	case NID_owner:
174		/*
175		* d2i_ functions increment the ppin pointer. See doc/man3/d2i_X509.pod.
176		* This preserves the original pointer. We don't want to corrupt this
177		* value.
178		*/
179	6.81k	value = av->value.sequence->data;
180	6.81k	xn = d2i_X509_NAME(NULL,
181	6.81k	(const unsigned char **)&value,
182	6.81k	av->value.sequence->length);
183	6.81k	if (xn == NULL) {
184	247	BIO_puts(out, "(COULD NOT DECODE DISTINGUISHED NAME)\n");
185	247	return 0;
186	247	}
187	6.57k	if (X509_NAME_print_ex(out, xn, indent, XN_FLAG_SEP_CPLUS_SPC) <= 0)
188	0	ret = 0;
189	6.57k	X509_NAME_free(xn);
190	6.57k	return ret;
191
192	56.3k	default:
193	56.3k	break;
194	101k	}
195	94.6k	return ASN1_parse_dump(out, av->value.sequence->data,
196	94.6k	av->value.sequence->length, indent, 1)
197	94.6k	> 0;
198
199	22.0k	case V_ASN1_SET:
200	22.0k	return ASN1_parse_dump(out, av->value.set->data,
201	22.0k	av->value.set->length, indent, 1)
202	22.0k	> 0;
203
204		/*
205		* UTCTime ::= [UNIVERSAL 23] IMPLICIT VisibleString
206		* GeneralizedTime ::= [UNIVERSAL 24] IMPLICIT VisibleString
207		* VisibleString is a superset for NumericString, so it will work for that.
208		*/
209	4.74k	case V_ASN1_VISIBLESTRING:
210	5.99k	case V_ASN1_UTCTIME:
211	7.53k	case V_ASN1_GENERALIZEDTIME:
212	9.79k	case V_ASN1_NUMERICSTRING:
213	9.79k	return BIO_printf(out, "%s%.s", indent, "",
214	9.79k	av->value.visiblestring->length,
215	9.79k	av->value.visiblestring->length
216	9.79k	? av->value.visiblestring->data
217	9.79k	: (const unsigned char *)"")
218	9.79k	>= 0;
219
220	2.13k	case V_ASN1_PRINTABLESTRING:
221	2.13k	return BIO_printf(out, "%s%.s", indent, "",
222	2.13k	av->value.printablestring->length,
223	2.13k	av->value.printablestring->length
224	2.13k	? av->value.printablestring->data
225	2.13k	: (const unsigned char *)"")
226	2.13k	>= 0;
227
228	1.94k	case V_ASN1_T61STRING:
229	1.94k	return BIO_printf(out, "%s%.s", indent, "",
230	1.94k	av->value.t61string->length,
231	1.94k	av->value.t61string->length
232	1.94k	? av->value.t61string->data
233	1.94k	: (const unsigned char *)"")
234	1.94k	>= 0;
235
236	2.24k	case V_ASN1_IA5STRING:
237	2.24k	return BIO_printf(out, "%s%.s", indent, "",
238	2.24k	av->value.ia5string->length,
239	2.24k	av->value.ia5string->length
240	2.24k	? av->value.ia5string->data
241	2.24k	: (const unsigned char *)"")
242	2.24k	>= 0;
243
244		/* UniversalString would go here. */
245		/* CHARACTER STRING would go here. */
246		/* BMPString would go here. */
247		/* DATE would go here. */
248		/* TIME-OF-DAY would go here. */
249		/* DATE-TIME would go here. */
250		/* DURATION would go here. */
251		/* OID-IRI would go here. */
252		/* RELATIVE-OID-IRI would go here. */
253
254		/* Would it be appropriate to just hexdump? */
255	73.1k	default:
256	73.1k	return BIO_printf(out,
257	73.1k	"%*s<Unsupported tag %d>",
258	73.1k	indent,
259	73.1k	"",
260	73.1k	av->type)
261	73.1k	>= 0;
262	397k	}
263	397k	}