/*

 * Copyright (C) 2007-2016 Free Software Foundation, Inc.

 * Copyright (C) 2015-2017 Red Hat, Inc.

 *

 * Author: Simon Josefsson, Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* Functions for printing X.509 Certificate structures

 */

#include "gnutls_int.h"

#include <common.h>

#include <x509.h>

#include <x509_int.h>

#include <num.h>

#include "errors.h"

#include "hello_ext.h"

#include "ip.h"

#define addf _gnutls_buffer_append_printf

#define adds _gnutls_buffer_append_str

#define NON_NULL(x) (((x)!=NULL)?((char*)(x)):"")

#define ERROR_STR (char*) "(error)"

static void print_idn_name(gnutls_buffer_st *str, const char *prefix, const char *type, gnutls_datum_t *name)

{

	unsigned printable = 1;

	unsigned is_printed = 0;

	gnutls_datum_t out = {NULL, 0};

	int ret;

	if (!_gnutls_str_is_print((char*)name->data, name->size))

		printable = 0;

	is_printed = 0;

	if (!printable) {

		addf(str,  _("%s%s: %.*s (contains illegal chars)\n"), prefix, type, name->size, NON_NULL(name->data));

		is_printed = 1;

	} else if (name->data != NULL) {

		if (strstr((char*)name->data, "xn--") != NULL) {

			ret = gnutls_idna_reverse_map((char*)name->data, name->size, &out, 0);

			if (ret >= 0) {

				addf(str,  _("%s%s: %.*s (%s)\n"), prefix, type, name->size, NON_NULL(name->data), out.data);

				is_printed = 1;

				gnutls_free(out.data);

			}

		}

	}

	if (is_printed == 0) {

		addf(str,  _("%s%s: %.*s\n"), prefix, type, name->size, NON_NULL(name->data));

	}

}

static void print_idn_email(gnutls_buffer_st *str, const char *prefix, const char *type, gnutls_datum_t *name)

{

	unsigned printable = 1;

	unsigned is_printed = 0;

	gnutls_datum_t out = {NULL, 0};

	int ret;

	if (!_gnutls_str_is_print((char*)name->data, name->size))

		printable = 0;

	is_printed = 0;

	if (!printable) {

		addf(str,  _("%s%s: %.*s (contains illegal chars)\n"), prefix, type, name->size, NON_NULL(name->data));

		is_printed = 1;

	} else if (name->data != NULL) {

		if (strstr((char*)name->data, "xn--") != NULL) {

			ret = _gnutls_idna_email_reverse_map((char*)name->data, name->size, &out;;

			if (ret >= 0) {

				addf(str,  _("%s%s: %.*s (%s)\n"), prefix, type, name->size, NON_NULL(name->data), out.data);

				is_printed = 1;

				gnutls_free(out.data);

			}

		}

	}

	if (is_printed == 0) {

		addf(str,  _("%s%s: %.*s\n"), prefix, type, name->size, NON_NULL(name->data));

	}

}

static void

print_name(gnutls_buffer_st *str, const char *prefix, unsigned type, gnutls_datum_t *name, unsigned ip_is_cidr)

{

	char *sname = (char*)name->data;

	char str_ip[64];

	const char *p;

	if ((type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_OTHERNAME_XMPP

	     || type == GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL

	     || type == GNUTLS_SAN_RFC822NAME

	     || type == GNUTLS_SAN_URI) && sname != NULL && strlen(sname) != name->size) {

		adds(str,

		     _("warning: SAN contains an embedded NUL, "

			      "replacing with '!'\n"));

		while (strlen(sname) < name->size)

			name->data[strlen(sname)] = '!';

	}

	switch (type) {

	case GNUTLS_SAN_DNSNAME:

		print_idn_name(str, prefix, "DNSname", name);

		break;

	case GNUTLS_SAN_RFC822NAME:

		print_idn_email(str, prefix, "RFC822Name", name);

		break;

	case GNUTLS_SAN_URI:

		addf(str,  _("%sURI: %.*s\n"), prefix, name->size, NON_NULL(name->data));

		break;

	case GNUTLS_SAN_IPADDRESS:

		if (!ip_is_cidr)

			p = _gnutls_ip_to_string(name->data, name->size, str_ip, sizeof(str_ip));

		else

			p = _gnutls_cidr_to_string(name->data, name->size, str_ip, sizeof(str_ip));

		if (p == NULL)

			p = ERROR_STR;

		addf(str, "%sIPAddress: %s\n", prefix, p);

		break;

	case GNUTLS_SAN_DN:

		addf(str,  _("%sdirectoryName: %.*s\n"), prefix, name->size, NON_NULL(name->data));

		break;

	case GNUTLS_SAN_REGISTERED_ID:

			addf(str,  _("%sRegistered ID: %.*s\n"), prefix, name->size, NON_NULL(name->data));

			break;

	case GNUTLS_SAN_OTHERNAME_XMPP:

		addf(str,  _("%sXMPP Address: %.*s\n"), prefix, name->size, NON_NULL(name->data));

		break;

	case GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL:

		addf(str,  _("%sKRB5Principal: %.*s\n"), prefix, name->size, NON_NULL(name->data));

		break;

	default:

		addf(str,  _("%sUnknown name: "), prefix);

		_gnutls_buffer_hexprint(str, name->data, name->size);

		adds(str, "\n");

		break;

	}

}

static char *get_pk_name(gnutls_x509_crt_t cert, unsigned *bits)

{

	char oid[MAX_OID_SIZE];

	size_t oid_size;

	oid_size = sizeof(oid);

	int ret;

	ret = gnutls_x509_crt_get_pk_algorithm(cert, bits);

	if (ret > 0) {

		const char *name = gnutls_pk_algorithm_get_name(ret);

		if (name != NULL)

			return gnutls_strdup(name);

	}

	ret = gnutls_x509_crt_get_pk_oid(cert, oid, &oid_size);

	if (ret < 0)

		return NULL;

	return gnutls_strdup(oid);

}

static char *crq_get_pk_name(gnutls_x509_crq_t crq)

{

	char oid[MAX_OID_SIZE];

	size_t oid_size;

	oid_size = sizeof(oid);

	int ret;

	ret = gnutls_x509_crq_get_pk_algorithm(crq, NULL);

	if (ret > 0) {

		const char *name = gnutls_pk_algorithm_get_name(ret);

		if (name != NULL)

			return gnutls_strdup(name);

	}

	ret = gnutls_x509_crq_get_pk_oid(crq, oid, &oid_size);

	if (ret < 0)

		return NULL;

	return gnutls_strdup(oid);

}

static char *get_sign_name(gnutls_x509_crt_t cert, int *algo)

{

	char oid[MAX_OID_SIZE];

	size_t oid_size;

	oid_size = sizeof(oid);

	int ret;

	*algo = 0;

	ret = gnutls_x509_crt_get_signature_algorithm(cert);

	if (ret > 0) {

		const char *name = gnutls_sign_get_name(ret);

		*algo = ret;

		if (name != NULL)

			return gnutls_strdup(name);

	}

	ret = gnutls_x509_crt_get_signature_oid(cert, oid, &oid_size);

	if (ret < 0)

		return NULL;

	return gnutls_strdup(oid);

}

static char *crq_get_sign_name(gnutls_x509_crq_t crq)

{

	char oid[MAX_OID_SIZE];

	size_t oid_size;

	oid_size = sizeof(oid);

	int ret;

	ret = gnutls_x509_crq_get_signature_algorithm(crq);

	if (ret > 0) {

		const char *name = gnutls_sign_get_name(ret);

		if (name != NULL)

			return gnutls_strdup(name);

	}

	ret = gnutls_x509_crq_get_signature_oid(crq, oid, &oid_size);

	if (ret < 0)

		return NULL;

	return gnutls_strdup(oid);

}

static char *crl_get_sign_name(gnutls_x509_crl_t crl, int *algo)

{

	char oid[MAX_OID_SIZE];

	size_t oid_size;

	oid_size = sizeof(oid);

	int ret;

	*algo = 0;

	ret = gnutls_x509_crl_get_signature_algorithm(crl);

	if (ret > 0) {

		const char *name = gnutls_sign_get_name(ret);

		*algo = ret;

		if (name != NULL)

			return gnutls_strdup(name);

	}

	ret = gnutls_x509_crl_get_signature_oid(crl, oid, &oid_size);

	if (ret < 0)

		return NULL;

	return gnutls_strdup(oid);

}

static void print_proxy(gnutls_buffer_st * str, gnutls_datum_t *der)

{

	int pathlen;

	char *policyLanguage;

	char *policy;

	size_t npolicy;

	int err;

	err = gnutls_x509_ext_import_proxy(der, &pathlen, &policyLanguage,

					&policy, &npolicy);

	if (err < 0) {

		addf(str, "error: get_proxy: %s\n", gnutls_strerror(err));

		return;

	}

	if (pathlen >= 0)

		addf(str, _("\t\t\tPath Length Constraint: %d\n"),

		     pathlen);

	addf(str, _("\t\t\tPolicy Language: %s"), policyLanguage);

	if (strcmp(policyLanguage, "1.3.6.1.5.5.7.21.1") == 0)

		adds(str, " (id-ppl-inheritALL)\n");

	else if (strcmp(policyLanguage, "1.3.6.1.5.5.7.21.2") == 0)

		adds(str, " (id-ppl-independent)\n");

	else

		adds(str, "\n");

	if (npolicy) {

		adds(str, _("\t\t\tPolicy:\n\t\t\t\tASCII: "));

		_gnutls_buffer_asciiprint(str, policy, npolicy);

		adds(str, _("\n\t\t\t\tHexdump: "));

		_gnutls_buffer_hexprint(str, policy, npolicy);

		adds(str, "\n");

	}

	gnutls_free(policy);

	gnutls_free(policyLanguage);

}

static void print_nc(gnutls_buffer_st * str, const char* prefix, gnutls_datum_t *der)

{

	gnutls_x509_name_constraints_t nc;

	int ret;

	unsigned idx = 0;

	gnutls_datum_t name;

	unsigned type;

	char new_prefix[16];

	ret = gnutls_x509_name_constraints_init(&nc);

	if (ret < 0)

		return;

	ret = gnutls_x509_ext_import_name_constraints(der, nc, 0);

	if (ret < 0)

		goto cleanup;

	snprintf(new_prefix, sizeof(new_prefix), "%s\t\t\t\t", prefix);

	do {

		ret = gnutls_x509_name_constraints_get_permitted(nc, idx++, &type, &name);

		if (ret >= 0) {

			if (idx == 1)

				addf(str,  _("%s\t\t\tPermitted:\n"), prefix);

			print_name(str, new_prefix, type, &name, 1);

		}

	} while (ret == 0);

	idx = 0;

	do {

		ret = gnutls_x509_name_constraints_get_excluded(nc, idx++, &type, &name);

		if (ret >= 0) {

			if (idx == 1)

				addf(str,  _("%s\t\t\tExcluded:\n"), prefix);

			print_name(str, new_prefix, type, &name, 1);

		}

	} while (ret == 0);

cleanup:

	gnutls_x509_name_constraints_deinit(nc);

}

static void print_aia(gnutls_buffer_st * str, const gnutls_datum_t *der)

{

	int err;

	int seq;

	gnutls_datum_t san = { NULL, 0 }, oid = {NULL, 0};

	gnutls_x509_aia_t aia;

	unsigned int san_type;

	err = gnutls_x509_aia_init(&aia);

	if (err < 0)

		return;

	err = gnutls_x509_ext_import_aia(der, aia, 0);

	if (err < 0) {

		addf(str, "error: get_aia: %s\n",

		     gnutls_strerror(err));

		goto cleanup;

	}

	for (seq=0;;seq++) {

		err = gnutls_x509_aia_get(aia, seq, &oid, &san_type, &san;;

		if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			goto cleanup;

		if (err < 0) {

			addf(str, "error: aia_get: %s\n",

			     gnutls_strerror(err));

			goto cleanup;

		}

		if (strcmp((char*)oid.data, GNUTLS_OID_AD_OCSP) == 0)

			addf(str, _("\t\t\tAccess Method: %s (%s)\n"), GNUTLS_OID_AD_OCSP, "id-ad-ocsp");

		else if (strcmp((char*)oid.data, GNUTLS_OID_AD_CAISSUERS) == 0)

			addf(str, _("\t\t\tAccess Method: %s (%s)\n"), GNUTLS_OID_AD_CAISSUERS, "id-ad-caIssuers");

		else {

			addf(str, _("\t\t\tAccess Method: %s (%s)\n"), (char*)oid.data, "UNKNOWN");

		}

		adds(str, "\t\t\tAccess Location ");

		print_name(str, "", san_type, &san, 0);

	}

cleanup:

	gnutls_x509_aia_deinit(aia);

}

static void print_ski(gnutls_buffer_st * str, gnutls_datum_t *der)

{

	gnutls_datum_t id = {NULL, 0};

	int err;

	err = gnutls_x509_ext_import_subject_key_id(der, &id;;

	if (err < 0) {

		addf(str, "error: get_subject_key_id: %s\n",

		     gnutls_strerror(err));

		return;

	}

	adds(str, "\t\t\t");

	_gnutls_buffer_hexprint(str, id.data, id.size);

	adds(str, "\n");

	gnutls_free(id.data);

}

#define TYPE_CRT 2

#define TYPE_CRQ 3

typedef union {

	gnutls_x509_crt_t crt;

	gnutls_x509_crq_t crq;

} cert_type_t;

static void

print_aki_gn_serial(gnutls_buffer_st * str, gnutls_x509_aki_t aki)

{

	gnutls_datum_t san, other_oid, serial;

	unsigned int alt_type;

	int err;

	err =

	    gnutls_x509_aki_get_cert_issuer(aki,

					    0, &alt_type, &san, &other_oid, &serial);

	if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

		return;

	} else if (err < 0) {

		addf(str, "error: gnutls_x509_aki_get_cert_issuer: %s\n",

		     gnutls_strerror(err));

		return;

	}

	print_name(str, "\t\t\t", alt_type, &san, 0);

	adds(str, "\t\t\tserial: ");

	_gnutls_buffer_hexprint(str, serial.data, serial.size);

	adds(str, "\n");

}

static void print_aki(gnutls_buffer_st * str, gnutls_datum_t *der)

{

	int err;

	gnutls_x509_aki_t aki;

	gnutls_datum_t id;

	err = gnutls_x509_aki_init(&aki);

	if (err < 0) {

		addf(str, "error: gnutls_x509_aki_init: %s\n",

		     gnutls_strerror(err));

		return;

	}

	err = gnutls_x509_ext_import_authority_key_id(der, aki, 0);

	if (err < 0) {

		addf(str, "error: gnutls_x509_ext_import_authority_key_id: %s\n",

		     gnutls_strerror(err));

		goto cleanup;

	}

	/* Check if an alternative name is there */

	print_aki_gn_serial(str, aki);

	err = gnutls_x509_aki_get_id(aki, &id;;

	if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

		goto cleanup;

	} else if (err < 0) {

		addf(str, "error: gnutls_x509_aki_get_id: %s\n",

		     gnutls_strerror(err));

		goto cleanup;

	}

	adds(str, "\t\t\t");

	_gnutls_buffer_hexprint(str, id.data, id.size);

	adds(str, "\n");

 cleanup:

	gnutls_x509_aki_deinit(aki);

}

static void

print_key_usage2(gnutls_buffer_st * str, const char *prefix, unsigned int key_usage)

{

	if (key_usage & GNUTLS_KEY_DIGITAL_SIGNATURE)

		addf(str, _("%sDigital signature.\n"), prefix);

	if (key_usage & GNUTLS_KEY_NON_REPUDIATION)

		addf(str, _("%sNon repudiation.\n"), prefix);

	if (key_usage & GNUTLS_KEY_KEY_ENCIPHERMENT)

		addf(str, _("%sKey encipherment.\n"), prefix);

	if (key_usage & GNUTLS_KEY_DATA_ENCIPHERMENT)

		addf(str, _("%sData encipherment.\n"), prefix);

	if (key_usage & GNUTLS_KEY_KEY_AGREEMENT)

		addf(str, _("%sKey agreement.\n"), prefix);

	if (key_usage & GNUTLS_KEY_KEY_CERT_SIGN)

		addf(str, _("%sCertificate signing.\n"), prefix);

	if (key_usage & GNUTLS_KEY_CRL_SIGN)

		addf(str, _("%sCRL signing.\n"), prefix);

	if (key_usage & GNUTLS_KEY_ENCIPHER_ONLY)

		addf(str, _("%sKey encipher only.\n"), prefix);

	if (key_usage & GNUTLS_KEY_DECIPHER_ONLY)

		addf(str, _("%sKey decipher only.\n"), prefix);

}

static void

print_key_usage(gnutls_buffer_st * str, const char *prefix, gnutls_datum_t *der)

{

	unsigned int key_usage;

	int err;

	err = gnutls_x509_ext_import_key_usage(der, &key_usage);

	if (err < 0) {

		addf(str, "error: get_key_usage: %s\n",

		     gnutls_strerror(err));

		return;

	}

	print_key_usage2(str, prefix, key_usage);

}

static void

print_private_key_usage_period(gnutls_buffer_st * str, const char *prefix, gnutls_datum_t *der)

{

	time_t activation, expiration;

	int err;

	char s[42];

	struct tm t;

	size_t max;

	err = gnutls_x509_ext_import_private_key_usage_period(der, &activation, &expiration);

	if (err < 0) {

		addf(str, "error: get_private_key_usage_period: %s\n",

		     gnutls_strerror(err));

		return;

	}

	max = sizeof(s);

	if (gmtime_r(&activation, &t) == NULL)

		addf(str, "error: gmtime_r (%ld)\n",

		     (unsigned long) activation);

	else if (strftime(s, max, "%a %b %d %H:%M:%S UTC %Y", &t) == 0)

		addf(str, "error: strftime (%ld)\n",

		     (unsigned long) activation);

	else

		addf(str, _("\t\t\tNot Before: %s\n"), s);

	if (gmtime_r(&expiration, &t) == NULL)

		addf(str, "error: gmtime_r (%ld)\n",

		     (unsigned long) expiration);

	else if (strftime(s, max, "%a %b %d %H:%M:%S UTC %Y", &t) == 0)

		addf(str, "error: strftime (%ld)\n",

		     (unsigned long) expiration);

	else

		addf(str, _("\t\t\tNot After: %s\n"), s);

}

static void print_crldist(gnutls_buffer_st * str, gnutls_datum_t *der)

{

	int err;

	int indx;

	gnutls_x509_crl_dist_points_t dp;

	unsigned int flags, type;

	gnutls_datum_t dist;

	err = gnutls_x509_crl_dist_points_init(&dp;;

	if (err < 0) {

		addf(str, "error: gnutls_x509_crl_dist_points_init: %s\n",

		     gnutls_strerror(err));

		return;

	}

	err = gnutls_x509_ext_import_crl_dist_points(der, dp, 0);

	if (err < 0) {

		addf(str, "error: gnutls_x509_ext_import_crl_dist_points: %s\n",

		     gnutls_strerror(err));

		goto cleanup;

	}

	for (indx = 0;; indx++) {

		err =

		    gnutls_x509_crl_dist_points_get(dp, indx, &type, &dist, &flags);

		if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			goto cleanup;

		else if (err < 0) {

			addf(str, "error: get_crl_dist_points: %s\n",

			     gnutls_strerror(err));

			return;

		}

		print_name(str, "\t\t\t", type, &dist, 0);

	}

 cleanup:

	gnutls_x509_crl_dist_points_deinit(dp);

}

static void

print_key_purpose(gnutls_buffer_st * str, const char *prefix, gnutls_datum_t *der)

{

	int indx;

	gnutls_datum_t oid;

	char *p;

	int err;

	gnutls_x509_key_purposes_t purposes;

	err = gnutls_x509_key_purpose_init(&purposes);

	if (err < 0) {

		addf(str, "error: gnutls_x509_key_purpose_init: %s\n",

		     gnutls_strerror(err));

		return;

	}

	err = gnutls_x509_ext_import_key_purposes(der, purposes, 0);

	if (err < 0) {

		addf(str, "error: gnutls_x509_ext_import_key_purposes: %s\n",

		     gnutls_strerror(err));

		goto cleanup;

	}

	for (indx = 0;; indx++) {

		err = gnutls_x509_key_purpose_get(purposes, indx, &oid;;

		if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			goto cleanup;

		else if (err < 0) {

			addf(str, "error: gnutls_x509_key_purpose_get: %s\n",

			     gnutls_strerror(err));

			goto cleanup;

		}

		p = (void*)oid.data;

		if (strcmp(p, GNUTLS_KP_TLS_WWW_SERVER) == 0)

			addf(str, _("%s\t\t\tTLS WWW Server.\n"), prefix);

		else if (strcmp(p, GNUTLS_KP_TLS_WWW_CLIENT) == 0)

			addf(str, _("%s\t\t\tTLS WWW Client.\n"), prefix);

		else if (strcmp(p, GNUTLS_KP_CODE_SIGNING) == 0)

			addf(str, _("%s\t\t\tCode signing.\n"), prefix);

		else if (strcmp(p, GNUTLS_KP_EMAIL_PROTECTION) == 0)

			addf(str, _("%s\t\t\tEmail protection.\n"),

			     prefix);

		else if (strcmp(p, GNUTLS_KP_TIME_STAMPING) == 0)

			addf(str, _("%s\t\t\tTime stamping.\n"), prefix);

		else if (strcmp(p, GNUTLS_KP_OCSP_SIGNING) == 0)

			addf(str, _("%s\t\t\tOCSP signing.\n"), prefix);

		else if (strcmp(p, GNUTLS_KP_IPSEC_IKE) == 0)

			addf(str, _("%s\t\t\tIpsec IKE.\n"), prefix);

		else if (strcmp(p, GNUTLS_KP_ANY) == 0)

			addf(str, _("%s\t\t\tAny purpose.\n"), prefix);

		else

			addf(str, "%s\t\t\t%s\n", prefix, p);

	}

 cleanup:

	gnutls_x509_key_purpose_deinit(purposes);

}

static void

print_basic(gnutls_buffer_st * str, const char *prefix, gnutls_datum_t *der)

{

	int pathlen;

	unsigned ca;

	int err;

	err = gnutls_x509_ext_import_basic_constraints(der, &ca, &pathlen);

	if (err < 0) {

		addf(str, "error: get_basic_constraints: %s\n",

		     gnutls_strerror(err));

		return;

	}

	if (ca == 0)

		addf(str, _("%s\t\t\tCertificate Authority (CA): FALSE\n"),

		     prefix);

	else

		addf(str, _("%s\t\t\tCertificate Authority (CA): TRUE\n"),

		     prefix);

	if (pathlen >= 0)

		addf(str, _("%s\t\t\tPath Length Constraint: %d\n"),

		     prefix, pathlen);

}

static void

print_altname(gnutls_buffer_st * str, const char *prefix, gnutls_datum_t *der)

{

	unsigned int altname_idx;

	gnutls_subject_alt_names_t names;

	unsigned int type;

	gnutls_datum_t san;

	gnutls_datum_t othername;

	char pfx[16];

	int err;

	err = gnutls_subject_alt_names_init(&names);

	if (err < 0) {

		addf(str, "error: gnutls_subject_alt_names_init: %s\n",

		     gnutls_strerror(err));

		return;

	}

	err = gnutls_x509_ext_import_subject_alt_names(der, names, 0);

	if (err < 0) {

		addf(str, "error: gnutls_x509_ext_import_subject_alt_names: %s\n",

		     gnutls_strerror(err));

		goto cleanup;

	}

	for (altname_idx = 0;; altname_idx++) {

		err = gnutls_subject_alt_names_get(names, altname_idx,

						   &type, &san, &othername);

		if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			break;

		else if (err < 0) {

			addf(str,

			     "error: gnutls_subject_alt_names_get: %s\n",

			     gnutls_strerror(err));

			break;

		}

		if (type == GNUTLS_SAN_OTHERNAME) {

			unsigned vtype;

			gnutls_datum_t virt;

			err = gnutls_x509_othername_to_virtual((char*)othername.data, &san, &vtype, &virt);

			if (err >= 0) {

				snprintf(pfx, sizeof(pfx), "%s\t\t\t", prefix);

				print_name(str, pfx, vtype, &virt, 0);

				gnutls_free(virt.data);

				continue;

			}

			addf(str,

			     _("%s\t\t\totherName OID: %.*s\n"),

			     prefix, (int)othername.size, (char*)othername.data);

			addf(str, _("%s\t\t\totherName DER: "),

				     prefix);

			_gnutls_buffer_hexprint(str, san.data, san.size);

			addf(str, _("\n%s\t\t\totherName ASCII: "),

				     prefix);

			_gnutls_buffer_asciiprint(str, (char*)san.data, san.size);

				addf(str, "\n");

		} else {

			snprintf(pfx, sizeof(pfx), "%s\t\t\t", prefix);

			print_name(str, pfx, type, &san, 0);

		}

	}

 cleanup:

	gnutls_subject_alt_names_deinit(names);

}

static void

guiddump(gnutls_buffer_st * str, const char *data, size_t len,

	 const char *spc)

{

	size_t j;

	if (spc)

		adds(str, spc);

	addf(str, "{");

	addf(str, "%.2X", (unsigned char) data[3]);

	addf(str, "%.2X", (unsigned char) data[2]);

	addf(str, "%.2X", (unsigned char) data[1]);

	addf(str, "%.2X", (unsigned char) data[0]);

	addf(str, "-");

	addf(str, "%.2X", (unsigned char) data[5]);

	addf(str, "%.2X", (unsigned char) data[4]);

	addf(str, "-");

	addf(str, "%.2X", (unsigned char) data[7]);

	addf(str, "%.2X", (unsigned char) data[6]);

	addf(str, "-");

	addf(str, "%.2X", (unsigned char) data[8]);

	addf(str, "%.2X", (unsigned char) data[9]);

	addf(str, "-");

	for (j = 10; j < 16; j++) {

		addf(str, "%.2X", (unsigned char) data[j]);

	}

	addf(str, "}\n");

}

static void

print_unique_ids(gnutls_buffer_st * str, const gnutls_x509_crt_t cert)

{

	int result;

	char buf[256];		/* if its longer, we won't bother to print it */

	size_t buf_size = 256;

	result =

	    gnutls_x509_crt_get_issuer_unique_id(cert, buf, &buf_size);

	if (result >= 0) {

		addf(str, ("\tIssuer Unique ID:\n"));

		_gnutls_buffer_hexdump(str, buf, buf_size, "\t\t\t");

		if (buf_size == 16) {	/* this could be a GUID */

			guiddump(str, buf, buf_size, "\t\t\t");

		}

	}

	buf_size = 256;

	result =

	    gnutls_x509_crt_get_subject_unique_id(cert, buf, &buf_size);

	if (result >= 0) {

		addf(str, ("\tSubject Unique ID:\n"));

		_gnutls_buffer_hexdump(str, buf, buf_size, "\t\t\t");

		if (buf_size == 16) {	/* this could be a GUID */

			guiddump(str, buf, buf_size, "\t\t\t");

		}

	}

}

static void print_tlsfeatures(gnutls_buffer_st * str, const char *prefix, const gnutls_datum_t *der)

{

	int err;

	int seq;

	gnutls_x509_tlsfeatures_t features;

	const char *name;

	unsigned int feature;

	err = gnutls_x509_tlsfeatures_init(&features);

	if (err < 0)

		return;

	err = gnutls_x509_ext_import_tlsfeatures(der, features, 0);

	if (err < 0) {

		addf(str, "error: get_tlsfeatures: %s\n",

			 gnutls_strerror(err));

		goto cleanup;

	}

	for (seq=0;;seq++) {

		err = gnutls_x509_tlsfeatures_get(features, seq, &feature);

		if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			goto cleanup;

		if (err < 0) {

			addf(str, "error: get_tlsfeatures: %s\n",

				 gnutls_strerror(err));

			goto cleanup;

		}

		name = gnutls_ext_get_name(feature);

		if (name == NULL)

			addf(str, "%s\t\t\t%u\n", prefix, feature);

		else

			addf(str, "%s\t\t\t%s(%u)\n", prefix, name, feature);

	}

cleanup:

	gnutls_x509_tlsfeatures_deinit(features);

}

static void print_subject_sign_tool(gnutls_buffer_st * str, const char *prefix, const gnutls_datum_t *der)

{

	int ret;

	gnutls_datum_t tmp = {NULL, 0};