C++ ASN1_TIME_print函数代码示例

int
X509_CRL_print(BIO *out, X509_CRL *x)
{
	STACK_OF(X509_REVOKED) *rev;
	X509_REVOKED *r;
	long l;
	int i;
	char *p;

	BIO_printf(out, "Certificate Revocation List (CRL):\n");
	l = X509_CRL_get_version(x);
	if (l < 0 || l == LONG_MAX)
		goto err;
	BIO_printf(out, "%8sVersion %lu (0x%lx)\n", "", l + 1, l);
	i = OBJ_obj2nid(x->sig_alg->algorithm);
	if (X509_signature_print(out, x->sig_alg, NULL) == 0)
		goto err;
	p = X509_NAME_oneline(X509_CRL_get_issuer(x), NULL, 0);
	if (p == NULL)
		goto err;
	BIO_printf(out, "%8sIssuer: %s\n", "", p);
	free(p);
	BIO_printf(out, "%8sLast Update: ", "");
	ASN1_TIME_print(out, X509_CRL_get_lastUpdate(x));
	BIO_printf(out, "\n%8sNext Update: ", "");
	if (X509_CRL_get_nextUpdate(x))
		ASN1_TIME_print(out, X509_CRL_get_nextUpdate(x));
	else
		BIO_printf(out, "NONE");
	BIO_printf(out, "\n");

	X509V3_extensions_print(out, "CRL extensions",
	    x->crl->extensions, 0, 8);

	rev = X509_CRL_get_REVOKED(x);

	if (sk_X509_REVOKED_num(rev) > 0)
		BIO_printf(out, "Revoked Certificates:\n");
	else
		BIO_printf(out, "No Revoked Certificates.\n");

	for (i = 0; i < sk_X509_REVOKED_num(rev); i++) {
		r = sk_X509_REVOKED_value(rev, i);
		BIO_printf(out, "    Serial Number: ");
		i2a_ASN1_INTEGER(out, r->serialNumber);
		BIO_printf(out, "\n        Revocation Date: ");
		ASN1_TIME_print(out, r->revocationDate);
		BIO_printf(out, "\n");
		X509V3_extensions_print(out, "CRL entry extensions",
		    r->extensions, 0, 8);
	}
	if (X509_signature_print(out, x->sig_alg, x->signature) == 0)
		goto err;

	return 1;

err:
	return 0;
}

int
verify_callback(int ok, X509_STORE_CTX * ctx)
{
	X509 *err_cert;
	int err, depth;

	err_cert = X509_STORE_CTX_get_current_cert(ctx);
	err = X509_STORE_CTX_get_error(ctx);
	depth = X509_STORE_CTX_get_error_depth(ctx);

	BIO_printf(bio_err, "depth=%d ", depth);
	if (err_cert) {
		X509_NAME_print_ex(bio_err, X509_get_subject_name(err_cert),
		    0, XN_FLAG_ONELINE);
		BIO_puts(bio_err, "\n");
	} else
		BIO_puts(bio_err, "<no cert>\n");
	if (!ok) {
		BIO_printf(bio_err, "verify error:num=%d:%s\n", err,
		    X509_verify_cert_error_string(err));
		if (verify_depth >= depth) {
			if (!verify_return_error)
				ok = 1;
			verify_error = X509_V_OK;
		} else {
			ok = 0;
			verify_error = X509_V_ERR_CERT_CHAIN_TOO_LONG;
		}
	}
	switch (err) {
	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
		BIO_puts(bio_err, "issuer= ");
		X509_NAME_print_ex(bio_err, X509_get_issuer_name(err_cert),
		    0, XN_FLAG_ONELINE);
		BIO_puts(bio_err, "\n");
		break;
	case X509_V_ERR_CERT_NOT_YET_VALID:
	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
		BIO_printf(bio_err, "notBefore=");
		ASN1_TIME_print(bio_err, X509_get_notBefore(err_cert));
		BIO_printf(bio_err, "\n");
		break;
	case X509_V_ERR_CERT_HAS_EXPIRED:
	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
		BIO_printf(bio_err, "notAfter=");
		ASN1_TIME_print(bio_err, X509_get_notAfter(err_cert));
		BIO_printf(bio_err, "\n");
		break;
	case X509_V_ERR_NO_EXPLICIT_POLICY:
		policies_print(bio_err, ctx);
		break;
	}
	if (err == X509_V_OK && ok == 2)
		policies_print(bio_err, ctx);

	BIO_printf(bio_err, "verify return:%d\n", ok);
	return (ok);
}

int X509_CRL_print_ex(BIO *out, X509_CRL *x, unsigned long nmflag)
{
    STACK_OF(X509_REVOKED) *rev;
    X509_REVOKED *r;
    const X509_ALGOR *sig_alg;
    const ASN1_BIT_STRING *sig;
    long l;
    int i;

    BIO_printf(out, "Certificate Revocation List (CRL):\n");
    l = X509_CRL_get_version(x);
    if (l >= 0 && l <= 1)
        BIO_printf(out, "%8sVersion %ld (0x%lx)\n", "", l + 1, (unsigned long)l);
    else
        BIO_printf(out, "%8sVersion unknown (%ld)\n", "", l);
    X509_CRL_get0_signature(x, &sig, &sig_alg);
    BIO_puts(out, "    ");
    X509_signature_print(out, sig_alg, NULL);
    BIO_printf(out, "%8sIssuer: ", "");
    X509_NAME_print_ex(out, X509_CRL_get_issuer(x), 0, nmflag);
    BIO_puts(out, "\n");
    BIO_printf(out, "%8sLast Update: ", "");
    ASN1_TIME_print(out, X509_CRL_get0_lastUpdate(x));
    BIO_printf(out, "\n%8sNext Update: ", "");
    if (X509_CRL_get0_nextUpdate(x))
        ASN1_TIME_print(out, X509_CRL_get0_nextUpdate(x));
    else
        BIO_printf(out, "NONE");
    BIO_printf(out, "\n");

    X509V3_extensions_print(out, "CRL extensions",
                            X509_CRL_get0_extensions(x), 0, 8);

    rev = X509_CRL_get_REVOKED(x);

    if (sk_X509_REVOKED_num(rev) > 0)
        BIO_printf(out, "Revoked Certificates:\n");
    else
        BIO_printf(out, "No Revoked Certificates.\n");

    for (i = 0; i < sk_X509_REVOKED_num(rev); i++) {
        r = sk_X509_REVOKED_value(rev, i);
        BIO_printf(out, "    Serial Number: ");
        i2a_ASN1_INTEGER(out, X509_REVOKED_get0_serialNumber(r));
        BIO_printf(out, "\n        Revocation Date: ");
        ASN1_TIME_print(out, X509_REVOKED_get0_revocationDate(r));
        BIO_printf(out, "\n");
        X509V3_extensions_print(out, "CRL entry extensions",
                                X509_REVOKED_get0_extensions(r), 0, 8);
    }
    X509_signature_print(out, sig_alg, sig);

    return 1;

}

EXPORT_C int X509_CRL_print(BIO *out, X509_CRL *x)
{
	STACK_OF(X509_REVOKED) *rev;
	X509_REVOKED *r;
	long l;
	int i, n;
	char *p;

	BIO_printf(out, "Certificate Revocation List (CRL):\n");
	l = X509_CRL_get_version(x);
	BIO_printf(out, "%8sVersion %lu (0x%lx)\n", "", l+1, l);
	i = OBJ_obj2nid(x->sig_alg->algorithm);
	BIO_printf(out, "%8sSignature Algorithm: %s\n", "",
				 (i == NID_undef) ? "NONE" : OBJ_nid2ln(i));
	p=X509_NAME_oneline(X509_CRL_get_issuer(x),NULL,0);
	BIO_printf(out,"%8sIssuer: %s\n","",p);
	OPENSSL_free(p);
	BIO_printf(out,"%8sLast Update: ","");
	ASN1_TIME_print(out,X509_CRL_get_lastUpdate(x));
	BIO_printf(out,"\n%8sNext Update: ","");
	if (X509_CRL_get_nextUpdate(x))
		 ASN1_TIME_print(out,X509_CRL_get_nextUpdate(x));
	else BIO_printf(out,"NONE");
	BIO_printf(out,"\n");

	n=X509_CRL_get_ext_count(x);
	X509V3_extensions_print(out, "CRL extensions",
						x->crl->extensions, 0, 8);

	rev = X509_CRL_get_REVOKED(x);

	if(sk_X509_REVOKED_num(rev) > 0)
	    BIO_printf(out, "Revoked Certificates:\n");
	else BIO_printf(out, "No Revoked Certificates.\n");

	for(i = 0; i < sk_X509_REVOKED_num(rev); i++) {
		r = sk_X509_REVOKED_value(rev, i);
		BIO_printf(out,"    Serial Number: ");
		i2a_ASN1_INTEGER(out,r->serialNumber);
		BIO_printf(out,"\n        Revocation Date: ");
		ASN1_TIME_print(out,r->revocationDate);
		BIO_printf(out,"\n");
		X509V3_extensions_print(out, "CRL entry extensions",
						r->extensions, 0, 8);
	}
	X509_signature_print(out, x->sig_alg, x->signature);

	return 1;

}

/* Verify certificate callback.  Gets invoked by crypto/x509/x509_vfy.c:
 * internal_verify() after it checks the signature and the time of 
 * the certificate.  Copied from apps/s_cb.c.  Configured through 
 * verify_depth and verify_error, initialized in main().  Doesn't
 * really do much other than print verify errors to the screen and
 * ignore errors down to verify_depth.  Mainly an example of how
 * OpenSSL let's your app have a say in certificate validating.
 * At this point OpenSSL has checked the signature and dates are 
 * good, so you don't need to do that.  One thing you could do 
 * here would be to verify the certificate status with an on-line
 * service, e.g. via OCSP.
 */
int verify_cb(int ok, X509_STORE_CTX *ctx) {
  char buf[256];
  X509 *err_cert;
  int err,depth;
  BIO* bio_err;
	int verify_error = X509_V_OK, verify_depth = 0;

  if ((bio_err=BIO_new(BIO_s_file())) == NULL) return(0);

  BIO_set_fp(bio_err,stderr,BIO_NOCLOSE);

  err_cert=X509_STORE_CTX_get_current_cert(ctx);
  err=X509_STORE_CTX_get_error(ctx);
  depth=X509_STORE_CTX_get_error_depth(ctx);

  X509_NAME_oneline(X509_get_subject_name(err_cert),buf,256);
  BIO_printf(bio_err,"depth=%d %s\n",depth,buf);
  if (!ok) {
    BIO_printf(bio_err,"verify error:num=%d:%s\n",err,
               X509_verify_cert_error_string(err));
    if (depth > verify_depth) {
      verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG;
    } else {
      ok=1;
      verify_error=X509_V_OK;
    }
  }
  switch (ctx->error) {
  case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
    X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,256);
    BIO_printf(bio_err,"issuer= %s\n",buf);
    break;
  case X509_V_ERR_CERT_NOT_YET_VALID:
  case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
    BIO_printf(bio_err,"notBefore=");
    ASN1_TIME_print(bio_err,X509_get_notBefore(ctx->current_cert));
    BIO_printf(bio_err,"\n");
    break;
  case X509_V_ERR_CERT_HAS_EXPIRED:
  case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
    BIO_printf(bio_err,"notAfter=");
    ASN1_TIME_print(bio_err,X509_get_notAfter(ctx->current_cert));
    BIO_printf(bio_err,"\n");
    break;
  }
  BIO_printf(bio_err,"verify return:%d\n",ok);
  BIO_free(bio_err);
  return(ok);
}

int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
	{
	char buf[256];
	X509 *err_cert;
	int err,depth;

	err_cert=X509_STORE_CTX_get_current_cert(ctx);
	err=	X509_STORE_CTX_get_error(ctx);
	depth=	X509_STORE_CTX_get_error_depth(ctx);

	X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof buf);
	BIO_printf(bio_err,"depth=%d %s\n",depth,buf);
	if (!ok)
		{
		BIO_printf(bio_err,"verify error:num=%d:%s\n",err,
			X509_verify_cert_error_string(err));
		if (verify_depth >= depth)
			{
			ok=1;
			verify_error=X509_V_OK;
			}
		else
			{
			ok=0;
			verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG;
			}
		}
	switch (ctx->error)
		{
	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
		X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,sizeof buf);
		BIO_printf(bio_err,"issuer= %s\n",buf);
		break;
	case X509_V_ERR_CERT_NOT_YET_VALID:
	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
		BIO_printf(bio_err,"notBefore=");
		ASN1_TIME_print(bio_err,X509_get_notBefore(ctx->current_cert));
		BIO_printf(bio_err,"\n");
		break;
	case X509_V_ERR_CERT_HAS_EXPIRED:
	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
		BIO_printf(bio_err,"notAfter=");
		ASN1_TIME_print(bio_err,X509_get_notAfter(ctx->current_cert));
		BIO_printf(bio_err,"\n");
		break;
		}
	BIO_printf(bio_err,"verify return:%d\n",ok);
	return(ok);
	}

/*
 * openssl crl -in ca.crl -text
 */
void show_crl(char * ca_name)
{
    X509_CRL * crl ;
    X509_REVOKED * rev ;
    int i, total ;
    STACK_OF(X509_REVOKED) * rev_list ;
    BIO * out ;

    if ((crl = load_crl(ca_name))==NULL) {
        printf("No CRL found\n");
        return ;
    }
    rev_list = X509_CRL_get_REVOKED(crl);
    total = sk_X509_REVOKED_num(rev_list);

    out = BIO_new(BIO_s_file());
    out = BIO_new_fp(stdout, BIO_NOCLOSE);

    BIO_printf(out, "-- Revoked certificates found in CRL\n");
    for (i=0 ; i<total ; i++) {
        rev=sk_X509_REVOKED_value(rev_list, i);
        BIO_printf(out, "serial: ");
        i2a_ASN1_INTEGER(out, rev->serialNumber);
        BIO_printf(out, "\n  date: ");
        ASN1_TIME_print(out, rev->revocationDate);
        BIO_printf(out, "\n\n");
    }
    X509_CRL_free(crl);
    BIO_free_all(out);
    return ;
}

int getTimeString(ASN1_TIME *time_data, char *buf, int buflen)
{
  int result;
  BIO* bio = BIO_new(BIO_s_mem());

  if (NULL == bio)
    {
      result = CERT_MEMORY_ERROR;
    }
  else
    {
      BUF_MEM *bufmem;

      ASN1_TIME_print(bio, time_data);
      BIO_get_mem_ptr(bio, &bufmem); /* is this allocating? */

      if (NULL == buf)
        {
          result = CERT_NULL_BUFFER;
        }
      else if (bufmem->length >= buflen)
        {

          result = CERT_BUFFER_LIMIT_EXCEEDED;
        }
      else
        {
          memcpy(buf, bufmem->data, bufmem->length);
          buf[bufmem->length] = 0;
          result = CERT_OK;
        }
      BIO_free( bio );
    }
  return result;
} /* getTimeString */

const datetime X509Certificate_OpenSSL::convertX509Date(void* time) const
{
	char* buffer;
	BIO* out = BIO_new(BIO_s_mem());
	BIO_set_close(out, BIO_CLOSE);

	ASN1_TIME* asn1_time = reinterpret_cast<ASN1_TIME*>(time);
	ASN1_TIME_print(out, asn1_time);

	int sz = BIO_get_mem_data(out, &buffer);
	char* dest = new char[sz + 1];
	dest[sz] = 0;
	memcpy(dest, buffer, sz);
	vmime::string t(dest);  
  
	BIO_free(out);
	delete dest;

	if (t.size() > 0)
	{
		char month[4] = {0};
		char zone[4] = {0};
		int day, hour, minute, second, year;
		int nrconv = sscanf(t.c_str(), "%s %2d %02d:%02d:%02d %d%s", month, &day, &hour, &minute, &second,&year,zone);

		if (nrconv >= 6)
			return datetime(year, sg_monthMap.getMonth(vmime::string(month)), day, hour, minute, second);		
	}

	// let datetime try and parse it
	return datetime(t);
}

static void log_time(const int level, const char *txt, ASN1_TIME *t) {
#ifndef HAVE_LIB_CYASSL
    char *cp;
    BIO *bio;
    int n;

    if(!t)
        return;
    bio=BIO_new(BIO_s_mem());
    if(!bio)
        return;
    ASN1_TIME_print(bio, t);
    n=BIO_pending(bio);
    cp=str_alloc(n+1);
    n=BIO_read(bio, cp, n);
    if(n<0) {
        BIO_free(bio);
        str_free(cp);
        return;
    }
    cp[n]='\0';
    BIO_free(bio);
    s_log(level, "%s: %s", txt, cp);
    str_free(cp);
#else
    s_log(level, "%s: N/A", txt);
#endif
}

int convertAsn1ToString(ASN1_TIME *notAfter, char buffer[]) {
	BIO *bio = BIO_new(BIO_s_mem());
	ASN1_TIME_print(bio, notAfter);
	BIO_gets(bio, buffer, BUFLEN);
	BIO_free(bio);
	return 0;
}

/* Appends information about an issued certificate to the index file. */
int add_to_index(X509 *cert)
{
	FILE *fp = NULL;
	BIO *bio = NULL;
	X509_NAME *subject = X509_get_subject_name(cert);
	long serial = ASN1_INTEGER_get(X509_get_serialNumber(cert));

	fp = fopen(CA_PATH(caIni.indexFile), "a");
	if (fp != NULL) {
		bio = BIO_new_fp(fp, BIO_CLOSE);

		/* Write serial */
		BIO_printf(bio, "%ld\t", serial);

		/* Write notBefore time */
		ASN1_TIME_print(bio, X509_get_notBefore(cert));
		BIO_printf(bio, "\t");

		/* Write subject */
		X509_NAME_print_ex(bio, subject, 0, 0);
		BIO_printf(bio, "\n");

		BIO_free(bio); /* Closes fp too */
		return 1;
	}

	return 0;
}

std::string genHumanReadableDateTime(ASN1_TIME* time) {
  BIO* bio_stream = BIO_new(BIO_s_mem());
  if (bio_stream == nullptr) {
    return "";
  }

  // ANS1_TIME_print's format is: Mon DD HH:MM:SS YYYY GMT
  // e.g. Jan 1 00:00:00 1970 GMT (always GMT)
  auto buffer_size = 32;
  char buffer[32] = {0};
  if (!ASN1_TIME_print(bio_stream, time)) {
    BIO_free(bio_stream);
    return "";
  }

  // BIO_gets() returns amount of data successfully read or written
  // (if the return value is positive) or that no data was successfully
  // read or written if the result is 0 or -1.
  if (BIO_gets(bio_stream, buffer, buffer_size) <= 0) {
    BIO_free(bio_stream);
    return "";
  }
  BIO_free(bio_stream);
  return std::string(buffer);
}

static	int
_VerifyCallBack(
	int		ok,
	X509_STORE_CTX	*ctx)
{
	char buf[256];
	X509 *err_cert;
	BIO	*bio_err;
	char *ptr = NULL;
	char printable[256] = {'\0'};
	int length;

	bio_err = BIO_new(BIO_s_mem());
	err_cert = X509_STORE_CTX_get_current_cert(ctx);
	X509_STORE_CTX_get_error(ctx);

	X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof buf);
	switch (ctx->error) {
	  case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
	  case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
		X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,sizeof buf);
		SSL_Error(_d(" Unable to get issuer cert.\n issuer= %s\n"), buf);
		break;
	  case X509_V_ERR_CERT_NOT_YET_VALID:
	  case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
		SSL_Error(_d(" Error in cert not_before field.\n notBefore="));
		ASN1_TIME_print(bio_err,X509_get_notBefore(ctx->current_cert));
				length = BIO_get_mem_data(bio_err, &ptr);
				memcpy(printable, ptr, length - 1);
		SSL_Error("%s\n", printable);
		break;
	  case X509_V_ERR_CERT_HAS_EXPIRED:
	  case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
		SSL_Error(_d(" Error in cert not_after field.\n notAfter="));
		ASN1_TIME_print(bio_err,X509_get_notAfter(ctx->current_cert));
				length = BIO_get_mem_data(bio_err, &ptr);
				memcpy(printable, ptr, length - 1);
		SSL_Error("%s\n", printable);
		break;
	}
	BIO_free(bio_err);
	return(ok);
}

static int get_validity(str* res, int local, int bound, sip_msg_t* msg)
{
#define NOT_BEFORE 0
#define NOT_AFTER 1
    static char buf[1024];
    X509* cert;
    struct tcp_connection* c;
    BUF_MEM* p;
    BIO* mem = 0;
    ASN1_TIME* date;

    if (get_cert(&cert, &c, msg, local) < 0) return -1;

    switch (bound) {
    case NOT_BEFORE:
        date = X509_get_notBefore(cert);
        break;
    case NOT_AFTER:
        date = X509_get_notAfter(cert);
        break;
    default:
        BUG("Unexpected parameter value \"%d\"\n", bound);
        goto err;
    }

    mem = BIO_new(BIO_s_mem());
    if (!mem) {
        ERR("Error while creating memory BIO\n");
        goto err;
    }

    if (!ASN1_TIME_print(mem, date)) {
        ERR("Error while printing certificate date/time\n");
        goto err;
    }

    BIO_get_mem_ptr(mem, &p);
    if (p->length >= 1024) {
        ERR("Date/time too long\n");
        goto err;
    }
    memcpy(buf, p->data, p->length);
    res->s = buf;
    res->len = p->length;

    BIO_free(mem);
    if (!local) X509_free(cert);
    tcpconn_put(c);
    return 0;
err:
    if (mem) BIO_free(mem);
    if (!local) X509_free(cert);
    tcpconn_put(c);
    return -1;
}