From 6b167313f422b8744c1f4edc8688f7e6923a3a73 Mon Sep 17 00:00:00 2001 From: Damian Hobson-Garcia Date: Fri, 30 Jun 2023 17:44:29 -0400 Subject: Attribute certificate printing functions Add functions to print an attribute certificate. Several attribute value types defined by the RFC 5755 specification are multi-field values (i.e ASN1_SEQUENCE rather than an ASN1_STRING or similar format). Currently those values are printed using `ASN1_item_print`. A more user-friendly output mechanism (maybe similar to the i2r_ functions used for X509 extensions) could be added in future. Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/15857) --- doc/build.info | 6 +++ doc/man3/X509_ACERT_print_ex.pod | 112 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 118 insertions(+) create mode 100644 doc/man3/X509_ACERT_print_ex.pod (limited to 'doc') diff --git a/doc/build.info b/doc/build.info index da0e7a637f..43bb3c8a1d 100644 --- a/doc/build.info +++ b/doc/build.info @@ -2803,6 +2803,10 @@ DEPEND[html/man3/X509_ACERT_get0_holder_baseCertId.html]=man3/X509_ACERT_get0_ho GENERATE[html/man3/X509_ACERT_get0_holder_baseCertId.html]=man3/X509_ACERT_get0_holder_baseCertId.pod DEPEND[man/man3/X509_ACERT_get0_holder_baseCertId.3]=man3/X509_ACERT_get0_holder_baseCertId.pod GENERATE[man/man3/X509_ACERT_get0_holder_baseCertId.3]=man3/X509_ACERT_get0_holder_baseCertId.pod +DEPEND[html/man3/X509_ACERT_print_ex.html]=man3/X509_ACERT_print_ex.pod +GENERATE[html/man3/X509_ACERT_print_ex.html]=man3/X509_ACERT_print_ex.pod +DEPEND[man/man3/X509_ACERT_print_ex.3]=man3/X509_ACERT_print_ex.pod +GENERATE[man/man3/X509_ACERT_print_ex.3]=man3/X509_ACERT_print_ex.pod DEPEND[html/man3/X509_ALGOR_dup.html]=man3/X509_ALGOR_dup.pod GENERATE[html/man3/X509_ALGOR_dup.html]=man3/X509_ALGOR_dup.pod DEPEND[man/man3/X509_ALGOR_dup.3]=man3/X509_ALGOR_dup.pod @@ -3636,6 +3640,7 @@ html/man3/UI_new.html \ html/man3/X509V3_get_d2i.html \ html/man3/X509V3_set_ctx.html \ html/man3/X509_ACERT_get0_holder_baseCertId.html \ +html/man3/X509_ACERT_print_ex.html \ html/man3/X509_ALGOR_dup.html \ html/man3/X509_ATTRIBUTE.html \ html/man3/X509_CRL_get0_by_serial.html \ @@ -4282,6 +4287,7 @@ man/man3/UI_new.3 \ man/man3/X509V3_get_d2i.3 \ man/man3/X509V3_set_ctx.3 \ man/man3/X509_ACERT_get0_holder_baseCertId.3 \ +man/man3/X509_ACERT_print_ex.3 \ man/man3/X509_ALGOR_dup.3 \ man/man3/X509_ATTRIBUTE.3 \ man/man3/X509_CRL_get0_by_serial.3 \ diff --git a/doc/man3/X509_ACERT_print_ex.pod b/doc/man3/X509_ACERT_print_ex.pod new file mode 100644 index 0000000000..3a5e0c7a51 --- /dev/null +++ b/doc/man3/X509_ACERT_print_ex.pod @@ -0,0 +1,112 @@ +=pod + +=head1 NAME + +X509_ACERT_print_ex, X509_ACERT_print +- X509_ACERT printing routines + +=head1 SYNOPSIS + + #include + + int X509_ACERT_print(BIO *bp, X509_ACERT *acert); + int X509_ACERT_print_ex(BIO *bp, X509_ACERT *acert, unsigned long nmflags, + unsigned long cflag); + +=head1 DESCRIPTION + +X509_ACERT_print_ex() prints a human readable version of the attribute +certificate I to BIO I. + +The following data contained in the attribute certificate is printed +in order: + +=over 4 + +=item * + +The header text "Attribute certificate:" and "Data:" (X509_FLAG_NO_HEADER) + += item * + +The attribute certificate version number as defined by the standard, +followed in parentheses by the value contained in the version field in +hexadecimal notation. If the version number is not a valid value according +to the specification, only the raw value is printed. +See X509_ACERT_get_version(3) for details. (X509_FLAG_NO_VERSION) + += item * + +The serial number of the attribute certificate (X509_FLAG_NO_SERIAL) + += item * + +The identity of the holder of the attribute certificate. If the +holder issuer name is present, the first GENERAL_NAME +returned by X509_ACERT_get0_holder_entityName() is printed. +If the holder baseCertificateId is present, the issuer name +(printed with X509_NAME_print_ex) and serial number of the +holder's certificate are displayed. (X509_FLAG_NO_SUBJECT) + += item * + +The name of the attribute certificate issuer as returned from +X509_ACERT_get0_issuerName() and printed using X509_NAME_print_ex(). +(X509_FLAG_NO_ISSUER) + += item * + +The period of validity between the times returned from X509_ACERT_get0_notBefore() +and X509_ACERT_get0_notAfter(). The values are printed as a generalized times +using ASN1_GENERALIZEDTIME_print(). (X509_FLAG_NO_VALIDITY) + += item * + +The list of attributes contained in the attribute certificate. +The attribute type is printed with i2a_ASN1_OBJECT(). String valued +attributes are printed as raw string data. ASN1 encoded values are +printed with ASN1_parse_dump(). (X509_FLAG_NO_ATTRIBUTES) + += item * + +All X.509 extensions contained in the attribute certificate. (X509_FLAG_NO_EXTENSIONS) + += item * + +The signature is printed with X509_signature_print(). (X509_FLAG_NO_SIGDUMP) + +If I is specifies as X509_FLAG_COMPAT, all of the above data in the +attribute certificate will be printed. + +The I flag determines the format used to output all fields printed using +X509_NAME_print_ex(). See L for details. + +X509_ACERT_print() is equivalent to calling X509_ACERT_print_ex() with the +I and I set to XN_FLAG_COMPAT and X509_FLAG_COMPAT +respectively. + +=back + +=head1 RETURN VALUES + +X509_ACERT_print_ex() X509_ACERT_print() return 1 for +success and 0 for failure. + +=head1 SEE ALSO + +L + +=head1 HISTORY + +X509_ACERT_print() and X509_ACERT_print_ex() were added in OpenSSL 3.4. + +=head1 COPYRIGHT + +Copyright 2023 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L. + +=cut -- cgit v1.2.3