On Thu, Feb 10, 2022 at 03:02:15PM +0100, Claudio Jeker wrote:
> This adds the needed bits to print CRL files.
> Using ASN1_INTEGER_get() is probably bad at least I think there is the
> possibility the serial number wont fit in the long. I hope tb@ has a
> better solution :)
According to RFC 5280, issuer + serialNumber must identify the cert
uniquely so applications should be able to handle serialNumbers of
at least 20 octets. The upper bound is 64 octets.
I don't have a particularly elegant solution. The options offered
by libcrypto that come to mind are to convert to a BIGNUM and use
BN_print_fp() or to use a BIO and i2a_ASN1_INTEGER. Neither is
particularly appealing.
I would suggest something along these lines:
const ASN1_INTEGER *serial;
char *hex_str;
serial = X509_REVOKED_get0_serialNumber(rev);
if (serial != NULL && ASN1_STRING_length(serial) > 0)
hex_str = hex_encode(ASN1_STRING_get0_data(serial),
ASN1_STRING_length(serial));
else {
if ((hex_str = strdup("invalid")) == NULL)
err(1, NULL);
}
x509_get_time(X509_REVOKED_get0_revocationDate(rev), &t);
printf(" Serial: %8s\tRevocation Date: %s\n", hex_str,
time2str(t));
free(hex_str);
That is, if you can live with leading zeros and uppercase hex digits.
> I created x509_get_time() to streamline the ASN1_TIME to time_t
> conversion and replaced a bunch of calls. mft.c uses ASN1_GENERALIZEDTIME
> and can not be converted.
We already check that the ASN.1 type is ASN1_GENERALIZEDTIME before
calling mft_parse_time(). I'm not sure how much this being slightly
stricter buys us.
> Apart from that it seems to work.
I like it. This line has a trailing tab:
> + printf("Authority key identifier: %s\n", pretty_key_id(p->aki));
I'm ok to land this as it is and we can bikeshed the ASN1_INTEGER
conversion in tree.
