Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add oneline subject/issuer to the output #976

Merged
merged 1 commit into from
Jul 12, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,9 @@ class Certificate
std::string sha1Digest;
std::string sha256Digest;
std::string subjectRaw;
std::string subjectOneline;
std::string issuerRaw;
std::string issuerOneline;
Attributes subject;
Attributes issuer;

Expand All @@ -63,6 +65,8 @@ class Certificate
const std::string& getSha256Digest() const;
const std::string& getRawSubject() const;
const std::string& getRawIssuer() const;
const std::string& getOnelineSubject() const;
const std::string& getOnelineIssuer() const;
const Certificate::Attributes& getSubject() const;
const Certificate::Attributes& getIssuer() const;
/// @}
Expand Down
18 changes: 18 additions & 0 deletions src/fileformat/file_format/pe/authenticode/x509_certificate.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -235,11 +235,29 @@ std::string X509Certificate::getRawIssuer() const
return X509NameToString(X509_get_issuer_name(cert));
}

// Oneline version for YARA compatibility
std::string X509Certificate::getOnelineSubject() const
{
char buffer[256] = {0};
X509_NAME_oneline(X509_get_subject_name(cert), buffer, sizeof(buffer));
return std::string(buffer);
}

// Oneline version for YARA compatibility
std::string X509Certificate::getOnelineIssuer() const
{
char buffer[256] = {0};
X509_NAME_oneline(X509_get_issuer_name(cert), buffer, sizeof(buffer));
return std::string(buffer);
}

Certificate X509Certificate::createCertificate() const
{
Certificate out_cert;
out_cert.issuerRaw = getRawIssuer();
out_cert.issuerOneline = getOnelineIssuer();
out_cert.subjectRaw = getRawSubject();
out_cert.subjectOneline = getOnelineSubject();
out_cert.issuer = getIssuer();
out_cert.subject = getSubject();
out_cert.publicKey = getPublicKey();
Expand Down
2 changes: 2 additions & 0 deletions src/fileformat/file_format/pe/authenticode/x509_certificate.h
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ class X509Certificate
std::string getValidSince() const;
std::string getRawSubject() const;
std::string getRawIssuer() const;
std::string getOnelineSubject() const;
std::string getOnelineIssuer() const;
std::string getSerialNumber() const;
std::string getSignatureAlgorithm() const;
std::string getPublicKey() const;
Expand Down
8 changes: 8 additions & 0 deletions src/fileformat/types/certificate_table/certificate.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,14 @@ const std::string& Certificate::getRawIssuer() const
return issuerRaw;
}

const std::string& Certificate::getOnelineSubject() const
{
return subjectOneline;
}
const std::string& Certificate::getOnelineIssuer() const
{
return issuerOneline;
}
/**
* Get subject of certificate in form of attributes
* @return Subject of certificate
Expand Down
2 changes: 2 additions & 0 deletions src/fileinfo/file_presentation/json_presentation.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -396,6 +396,8 @@ void WriteCertificateChain(JsonPresentation::Writer& writer, const std::vector<C
writer.StartObject();
serializeString(writer, "subject", cert.getRawSubject());
serializeString(writer, "issuer", cert.getRawIssuer());
serializeString(writer, "subjectOneline", cert.getOnelineSubject());
serializeString(writer, "issuerOneline", cert.getOnelineIssuer());
serializeString(writer, "serialNumber", cert.getSerialNumber());
serializeString(writer, "publicKeyAlgorithm", cert.getPublicKeyAlgorithm());
serializeString(writer, "signatureAlgorithm", cert.getSignatureAlgorithm());;
Expand Down