1 files changed, 44 insertions, 18 deletions

diff --git a/src/lib/libcrypto/asn1/t_x509.c b/src/lib/libcrypto/asn1/t_x509.c
index 7cf4557314..71f97a8214 100644
--- a/src/lib/libcrypto/asn1/t_x509.c
+++ b/src/lib/libcrypto/asn1/t_x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_x509.c,v 1.51 2025/02/08 03:41:36 tb Exp $ */
+/* $OpenBSD: t_x509.c,v 1.54 2025/07/01 06:46:39 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -65,13 +65,13 @@
 
 #include <openssl/asn1.h>
 #include <openssl/bio.h>
-#include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/sha.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
+#include "err_local.h"
 #include "evp_local.h"
 #include "x509_local.h"
 
@@ -106,6 +106,28 @@ X509_print(BIO *bp, X509 *x)
 }
 LCRYPTO_ALIAS(X509_print);
 
+static int
+x509_print_uids(BIO *bp, const X509 *x, int indent)
+{
+        const ASN1_BIT_STRING *issuerUID = NULL, *subjectUID = NULL;
+
+        X509_get0_uids(x, &issuerUID, &subjectUID);
+        if (issuerUID != NULL) {
+                if (BIO_printf(bp, "%*sIssuer Unique ID: ", indent, "") <= 0)
+                        return 0;
+                if (!X509_signature_dump(bp, issuerUID, indent + 4))
+                        return 0;
+        }
+        if (subjectUID != NULL) {
+                if (BIO_printf(bp, "%*sSubject Unique ID: ", indent, "") <= 0)
+                        return 0;
+                if (!X509_signature_dump(bp, subjectUID, indent + 4))
+                        return 0;
+        }
+
+        return 1;
+}
+
 int
 X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
 {
@@ -127,9 +149,9 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
 
         ci = x->cert_info;
         if (!(cflag & X509_FLAG_NO_HEADER)) {
-                if (BIO_write(bp, "Certificate:\n", 13) <= 0)
+                if (BIO_printf(bp, "Certificate:\n") <= 0)
                         goto err;
-                if (BIO_write(bp, "    Data:\n", 10) <= 0)
+                if (BIO_printf(bp, "    Data:\n") <= 0)
                         goto err;
         }
         if (!(cflag & X509_FLAG_NO_VERSION)) {
@@ -145,7 +167,7 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
                 }
         }
         if (!(cflag & X509_FLAG_NO_SERIAL)) {
-                if (BIO_write(bp, "        Serial Number:", 22) <= 0)
+                if (BIO_printf(bp, "        Serial Number:") <= 0)
                         goto err;
 
                 bs = X509_get_serialNumber(x);
@@ -196,21 +218,21 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
                 if (X509_NAME_print_ex(bp, X509_get_issuer_name(x),
                     nmindent, nmflags) < (nmflags == X509_FLAG_COMPAT ? 1 : 0))
                         goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
+                if (BIO_printf(bp, "\n") <= 0)
                         goto err;
         }
         if (!(cflag & X509_FLAG_NO_VALIDITY)) {
-                if (BIO_write(bp, "        Validity\n", 17) <= 0)
+                if (BIO_printf(bp, "        Validity\n") <= 0)
                         goto err;
-                if (BIO_write(bp, "            Not Before: ", 24) <= 0)
+                if (BIO_printf(bp, "            Not Before: ") <= 0)
                         goto err;
                 if (!ASN1_TIME_print(bp, X509_get_notBefore(x)))
                         goto err;
-                if (BIO_write(bp, "\n            Not After : ", 25) <= 0)
+                if (BIO_printf(bp, "\n            Not After : ") <= 0)
                         goto err;
                 if (!ASN1_TIME_print(bp, X509_get_notAfter(x)))
                         goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
+                if (BIO_printf(bp, "\n") <= 0)
                         goto err;
         }
         if (!(cflag & X509_FLAG_NO_SUBJECT)) {
@@ -219,12 +241,11 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
                 if (X509_NAME_print_ex(bp, X509_get_subject_name(x),
                     nmindent, nmflags) < (nmflags == X509_FLAG_COMPAT ? 1 : 0))
                         goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
+                if (BIO_printf(bp, "\n") <= 0)
                         goto err;
         }
         if (!(cflag & X509_FLAG_NO_PUBKEY)) {
-                if (BIO_write(bp, "        Subject Public Key Info:\n",
-                    33) <= 0)
+                if (BIO_printf(bp, "        Subject Public Key Info:\n") <= 0)
                         goto err;
                 if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0)
                         goto err;
@@ -243,6 +264,11 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
                 }
         }
 
+        if (!(cflag & X509_FLAG_NO_IDS)) {
+                if (!x509_print_uids(bp, x, 8))
+                        goto err;
+        }
+
         if (!(cflag & X509_FLAG_NO_EXTENSIONS))
                 X509V3_extensions_print(bp, "X509v3 extensions",
                     ci->extensions, cflag, 8);
@@ -325,7 +351,7 @@ X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent)
         s = sig->data;
         for (i = 0; i < n; i++) {
                 if ((i % 18) == 0) {
-                        if (BIO_write(bp, "\n", 1) <= 0)
+                        if (BIO_printf(bp, "\n") <= 0)
                                 return 0;
                         if (BIO_indent(bp, indent, indent) <= 0)
                                 return 0;
@@ -334,7 +360,7 @@ X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent)
                     ((i + 1) == n) ? "" : ":") <= 0)
                         return 0;
         }
-        if (BIO_write(bp, "\n", 1) != 1)
+        if (BIO_printf(bp, "\n") != 1)
                 return 0;
 
         return 1;
@@ -375,7 +401,7 @@ ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
                 return ASN1_UTCTIME_print(bp, tm);
         if (tm->type == V_ASN1_GENERALIZEDTIME)
                 return ASN1_GENERALIZEDTIME_print(bp, tm);
-        BIO_write(bp, "Bad time value", 14);
+        BIO_printf(bp, "Bad time value");
         return (0);
 }
 LCRYPTO_ALIAS(ASN1_TIME_print);
@@ -435,7 +461,7 @@ ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
                 return (1);
 
  err:
-        BIO_write(bp, "Bad time value", 14);
+        BIO_printf(bp, "Bad time value");
         return (0);
 }
 LCRYPTO_ALIAS(ASN1_GENERALIZEDTIME_print);
@@ -479,7 +505,7 @@ ASN1_UTCTIME_print(BIO *bp, const ASN1_UTCTIME *tm)
                 return (1);
 
  err:
-        BIO_write(bp, "Bad time value", 14);
+        BIO_printf(bp, "Bad time value");
         return (0);
 }
 LCRYPTO_ALIAS(ASN1_UTCTIME_print);