@blamejs/pki 0.8.30 → 0.8.48

package/lib/inspect.js

@@ -409,6 +409,29 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
   ocspNoCheck: function (decoded, inner) {
     return inner + "OCSP No Check (this is an OCSP responder certificate; do not check its revocation)";
   },
+  /** @internal ITU-T X.509 (2019) clause 9.8. The alternative key and signature run to thousands of
+   *  octets for a post-quantum algorithm, which is the case the extensions exist for, so each is
+   *  reported by its algorithm and its length rather than dumped whole. The algorithm is what a reader
+   *  needs: it says which set of algorithms this certificate is migrating to. */
+  subjectAltPublicKeyInfo: function (decoded, inner) {
+    return inner + "Algorithm: " + (decoded.algorithm.name || decoded.algorithm.oid) + "\n" +
+      inner + "Alternative Public Key: " + decoded.subjectAltPublicKey.length + " bytes";
+  },
+  altSignatureAlgorithm: function (decoded, inner) {
+    return inner + (decoded.name || decoded.oid);
+  },
+  altSignatureValue: function (decoded, inner) {
+    return inner + "Alternative Signature: " + decoded.bytes.length + " bytes";
+  },
+  /** @internal RFC 9763 sec. 4.1 names a second certificate of the same subject by the digest of the
+   *  whole certificate, so both fields are shown: the digest is only meaningful beside the algorithm
+   *  that produced it. */
+  relatedCertificate: function (decoded, inner) {
+    var alg = decoded.hashAlgorithm || decoded.hashAlgorithmOid || "(unnamed algorithm)";
+    var value = Buffer.isBuffer(decoded.hashValue) ? decoded.hashValue : Buffer.alloc(0);
+    return inner + "Hash Algorithm: " + alg + "\n" +
+      inner + "Related Certificate: " + _hexColon(value, { upper: true });
+  },
   subjectKeyIdentifier: function (decoded, inner) {
     return inner + _hexColon(Buffer.isBuffer(decoded) ? decoded : (decoded.bytes || Buffer.alloc(0)), { upper: true });
   },
@@ -419,8 +442,8 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
       decoded.authorityCertIssuer.names.forEach(function (g) { akiLines.push(inner + _gn(g)); });
     }
     if (decoded.authorityCertSerialNumber != null) {
-      var sn = (typeof decoded.authorityCertSerialNumber === "bigint"
-        ? decoded.authorityCertSerialNumber : BigInt(decoded.authorityCertSerialNumber)).toString(16);
+      var sn = guard.range.authoredInteger(decoded.authorityCertSerialNumber, _err,
+        "inspect/bad-input", "authorityCertSerialNumber").toString(16);
       if (sn.length % 2) sn = "0" + sn;
       akiLines.push(inner + "serial:0x" + sn.toUpperCase());
     }
@@ -1983,6 +2006,428 @@ function attrCertReport(input) {
   return L.join("\n") + "\n";
 }
 
+/** @internal The tag names, inverted out of `asn1.TAGS` so the dump cannot name a universal type
+ *  the codec does not have. Tag 0 is the end-of-contents marker X.690 sec. 8.1.5 reserves; the codec
+ *  consumes it rather than naming it, and the header walk renders it as a node of its own. */
+var _DUMP_TAG_NAMES = (function () {
+  var out = Object.create(null);
+  out[0] = "EOC";
+  Object.keys(asn1.TAGS).forEach(function (key) {
+    var name = "";
+    for (var i = 0; i < key.length; i++) name += key[i] === "_" ? " " : key[i];
+    out[asn1.TAGS[key]] = name;
+  });
+  return out;
+})();
+var _DUMP_CLASS_LABEL = Object.assign(Object.create(null), {
+  universal: "UNIVERSAL", application: "APPLICATION", private: "PRIVATE",
+});
+var _DUMP_CLASS_OF = Object.assign(Object.create(null), {
+  0x00: "universal", 0x40: "application", 0x80: "context", 0xc0: "private",
+});
+var _DUMP_TEXT_TAGS = Object.assign(Object.create(null),
+  { 12: 1, 18: 1, 19: 1, 20: 1, 22: 1, 23: 1, 24: 1, 26: 1, 27: 1, 28: 1, 30: 1 });
+var _DUMP_MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+var _DUMP_NAME_COLUMN = 26;
+var _DUMP_OFFSET_COLUMN = 5;
+var _DUMP_LENGTH_COLUMN = 4;
+var _DUMP_MAX_TAG_OCTETS = 4;
+var _DUMP_MAX_LENGTH_OCTETS = 6;
+
+function _padLeft(s, w) { return s.length >= w ? s : " ".repeat(w - s.length) + s; }
+
+/** @internal `length` decides one name: X.690 sec. 8.1.5 gives the end-of-contents value a zero
+ *  length, so a tag-0 value carrying content is not one and is named for its class and number.
+ *  Pass -1 where the length is indefinite, which an end-of-contents value never is. */
+function _dumpTagName(tagClass, tagNumber, length) {
+  if (tagClass === "context") return "[" + tagNumber + "]";
+  if (tagClass === "universal" && tagNumber === 0 && length !== 0) return _DUMP_CLASS_LABEL.universal + " [0]";
+  if (tagClass === "universal" && _DUMP_TAG_NAMES[tagNumber] !== undefined) return _DUMP_TAG_NAMES[tagNumber];
+  return _DUMP_CLASS_LABEL[tagClass] + " [" + tagNumber + "]";
+}
+
+function _dumpLine(offset, depth, hl, len, constructed, name, value) {
+  var head = _padLeft(String(offset), _DUMP_OFFSET_COLUMN) + ":d=" + depth + "  hl=" + hl +
+    " l=" + _padLeft(String(len), _DUMP_LENGTH_COLUMN) + (constructed ? " cons:" : " prim:");
+  var field = " ".repeat(depth) + name;
+  if (value === null) return head + " " + field;
+  /** @internal One space always separates the name from the value, so a field the column cannot
+   *  hold (a long type name at depth) gets that space rather than running into the colon. */
+  var pad = _DUMP_NAME_COLUMN - field.length;
+  return head + " " + field + (pad > 0 ? " ".repeat(pad) : " ") + ":" + value;
+}
+
+function _dumpPrefixed(prefix, omitted) {
+  if (omitted === 0) return prefix;
+  var note = "(" + omitted + " more byte" + (omitted === 1 ? "" : "s") + " not rendered)";
+  return prefix.length === 0 ? note : prefix + " " + note;
+}
+
+function _dumpHex(buf, limit) {
+  if (buf.length === 0) return "(empty)";
+  var keep = buf.length <= limit ? buf.length : limit;
+  return _dumpPrefixed(_hexColon(buf.subarray(0, keep), {}), buf.length - keep);
+}
+
+function _dumpText(buf, limit) {
+  var keep = buf.length <= limit ? buf.length : limit;
+  return _dumpPrefixed(buf.subarray(0, keep).toString("latin1"), buf.length - keep);
+}
+
+/** @internal The magnitude read from the content bytes as a two's-complement BigInt in one pass,
+ *  behind the same per-value byte cap `asn1.read.integer` applies, because a byte-at-a-time
+ *  accumulate over attacker-length content is quadratic. Past that cap the bytes are rendered and
+ *  no magnitude is computed. The hex beside a magnitude is the content as written, so a leading zero
+ *  octet survives; a magnitude rendered back to hex would drop it. */
+function _dumpInteger(content, limit) {
+  if (content.length === 0) return "(empty)";
+  if (content.length > constants.LIMITS.DER_MAX_INTEGER_BYTES + 1) return _dumpHex(content, limit);
+  var mag = BigInt("0x" + content.toString("hex"));
+  var v = (content[0] & 0x80) !== 0 ? mag - (1n << BigInt(content.length * 8)) : mag;
+  var text = v.toString();
+  if (v <= _DUMP_MAX_SAFE && v >= -_DUMP_MAX_SAFE) return text;
+  return text + " (0x" + content.toString("hex") + ")";
+}
+
+function _dumpBitString(content, limit) {
+  if (content.length === 0) return "(empty)";
+  return content[0] + " unused bits, " + _dumpHex(content.subarray(1), limit);
+}
+
+function _dumpOid(content, limit) {
+  var dotted;
+  try { dotted = asn1.decodeOidContent(content); }
+  catch (_e) { return _dumpHex(content, limit); }
+  var name = oid.name(dotted);
+  return name === undefined ? dotted : dotted + " (" + name + ")";
+}
+
+/** @internal `maxValueBytes` bounds every rendering whose size grows with the content length. A hex
+ *  dump and a text rendering are truncated and the omitted count stated, because a prefix of either
+ *  is still true of the value. A magnitude and a dotted OID are read from the whole content and
+ *  cannot be rendered from a prefix at all, so past the cap the bytes are what the report can
+ *  honestly show. A decoded form of fixed size renders whatever the cap is, since it cannot grow the
+ *  report: a BOOLEAN's verdict, and a BIT STRING's unused-bit count above its capped body. */
+function _dumpValue(tagClass, tagNumber, content, limit) {
+  if (tagClass !== "universal") return _dumpHex(content, limit);
+  if (tagNumber === asn1.TAGS.BOOLEAN) {
+    if (content.length === 1 && content[0] === 0xff) return "TRUE";
+    if (content.length === 1 && content[0] === 0x00) return "FALSE";
+    return _dumpHex(content, limit);
+  }
+  if (tagNumber === asn1.TAGS.INTEGER || tagNumber === asn1.TAGS.ENUMERATED) {
+    return content.length <= limit ? _dumpInteger(content, limit) : _dumpHex(content, limit);
+  }
+  if (tagNumber === asn1.TAGS.BIT_STRING) return _dumpBitString(content, limit);
+  if (tagNumber === asn1.TAGS.NULL) return content.length === 0 ? null : _dumpHex(content, limit);
+  if (tagNumber === asn1.TAGS.OBJECT_IDENTIFIER) {
+    return content.length <= limit ? _dumpOid(content, limit) : _dumpHex(content, limit);
+  }
+  if (_DUMP_TEXT_TAGS[tagNumber] === 1 && _printable(content)) return _dumpText(content, limit);
+  return _dumpHex(content, limit);
+}
+
+function _dumpBytes(n) { return n + (n === 1 ? " byte" : " bytes"); }
+function _dumpNodes(n) { return n + (n === 1 ? " node" : " nodes"); }
+function _dumpRemaining(n) { return _dumpBytes(n) + (n === 1 ? " that remains." : " that remain."); }
+
+/** @internal The node cap records the offset it stopped at, not only that it fired: a report that
+ *  covers part of a file has to name where that part ends or a reader cannot tell what it covers. */
+function _dumpCapped(st, offset) {
+  st.capped = true;
+  st.capOffset = offset;
+  return -1;
+}
+
+/** @internal Renders a tree the strict decoder produced. It applies the node cap and not the depth
+ *  cap, because the decode that built this tree was given the same depth cap and refuses a deeper
+ *  one, so no node reaching here is past it. */
+function _dumpNode(node, depth, st) {
+  if (st.capped) return;
+  if (st.nodes >= st.maxNodes) { _dumpCapped(st, node.header.start); return; }
+  st.nodes += 1;
+  var hl = node.header.end - node.header.start;
+  var name = _dumpTagName(node.tagClass, node.tagNumber, node.length);
+  /** @internal `content` and `children` are read without a fallback: a decode gives every primitive
+   *  a Buffer content, empty where the value is, and every constructed node a children array. A
+   *  fallback for either would be dead code standing in for a shape the decoder guarantees. */
+  if (!node.constructed) {
+    st.lines.push(_dumpLine(node.header.start, depth, hl, node.length, false, name,
+      _dumpValue(node.tagClass, node.tagNumber, node.content, st.maxValueBytes)));
+    return;
+  }
+  st.lines.push(_dumpLine(node.header.start, depth, hl, node.length, true, name, null));
+  var kids = node.children;
+  for (var i = 0; i < kids.length; i++) {
+    _dumpNode(kids[i], depth + 1, st);
+    if (st.capped) return;
+  }
+}
+
+/** @internal The header-by-header walk that runs when the strict decoder refuses the input. It reads
+ *  a tag and a length, renders the node, and on the first byte it cannot read records the offset and
+ *  the reason and unwinds. It returns the offset one past the value, or -1 once a stop or the node cap
+ *  has been recorded. It produces text and never a node, so nothing a lax read accepted can reach a
+ *  verify path, and it carries the caller's depth and node caps because it walks hostile nesting
+ *  exactly as a parse does. */
+function _dumpWalk(buf, start, limit, depth, st) {
+  if (st.stop !== null || st.capped) return -1;
+  if (depth > st.maxDepth) {
+    st.stop = { offset: start, reason: "nesting exceeds the depth cap " + st.maxDepth + "." };
+    return -1;
+  }
+  if (st.nodes >= st.maxNodes) return _dumpCapped(st, start);
+  var p = start;
+  if (p >= limit) {
+    st.stop = { offset: start, reason: "the input ends where an identifier octet was expected." };
+    return -1;
+  }
+  var first = buf[p]; p += 1;
+  var constructed = (first & 0x20) !== 0;
+  var tagClass = _DUMP_CLASS_OF[first & 0xc0];
+  var tagNumber = first & 0x1f;
+  if (tagNumber === 0x1f) {
+    tagNumber = 0;
+    var seen = 0;
+    for (;;) {
+      if (p >= limit) {
+        st.stop = { offset: start, reason: "the high-tag-number form runs past the end of the input." };
+        return -1;
+      }
+      var tb = buf[p]; p += 1;
+      tagNumber = (tagNumber * 128) + (tb & 0x7f);
+      seen += 1;
+      if ((tb & 0x80) === 0) break;
+      if (seen >= _DUMP_MAX_TAG_OCTETS) {
+        st.stop = { offset: start, reason: "the tag number uses more than " + _DUMP_MAX_TAG_OCTETS + " octets." };
+        return -1;
+      }
+    }
+  }
+  if (p >= limit) {
+    st.stop = { offset: start, reason: "the input ends where a length octet was expected." };
+    return -1;
+  }
+  var lenByte = buf[p]; p += 1;
+  var indefinite = false;
+  var length = 0;
+  if (lenByte === 0x80) {
+    if (!constructed) {
+      st.stop = { offset: start,
+        reason: "an indefinite length on a primitive value has no end-of-contents octets to find." };
+      return -1;
+    }
+    indefinite = true;
+  } else if ((lenByte & 0x80) !== 0) {
+    var n = lenByte & 0x7f;
+    if (n > _DUMP_MAX_LENGTH_OCTETS) {
+      st.stop = { offset: start, reason: "the length uses more than " + _DUMP_MAX_LENGTH_OCTETS + " octets." };
+      return -1;
+    }
+    if (p + n > limit) {
+      st.stop = { offset: start, reason: "the long-form length runs past the end of the input." };
+      return -1;
+    }
+    for (var j = 0; j < n; j++) length = (length * 256) + buf[p + j];
+    p += n;
+  } else {
+    length = lenByte;
+  }
+  var hl = p - start;
+  var contentStart = p;
+  var name = _dumpTagName(tagClass, tagNumber, indefinite ? -1 : length);
+
+  if (!constructed) {
+    if (length > limit - contentStart) {
+      st.stop = { offset: start,
+        reason: "content length " + length + " overruns the " + _dumpRemaining(limit - contentStart) };
+      return -1;
+    }
+    st.nodes += 1;
+    st.lines.push(_dumpLine(start, depth, hl, length, false, name,
+      _dumpValue(tagClass, tagNumber, buf.subarray(contentStart, contentStart + length), st.maxValueBytes)));
+    return contentStart + length;
+  }
+
+  st.nodes += 1;
+  var cp = contentStart;
+  var kid;
+  if (indefinite) {
+    st.lines.push(_dumpLine(start, depth, hl, "inf", true, name, null));
+    for (;;) {
+      if (cp + 2 > limit) {
+        st.stop = { offset: start,
+          reason: "the indefinite-length value has no end-of-contents octets before the end of the input." };
+        return -1;
+      }
+      if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
+      kid = _dumpWalk(buf, cp, limit, depth + 1, st);
+      if (kid < 0) return -1;
+      cp = kid;
+    }
+    /** @internal The end-of-contents octets are the one node the walk emits without recursing, so
+     *  both caps are applied to them here. Without the depth check an indefinite-length value with
+     *  no children renders a node one level past the cap and the report still says it completed. */
+    if (depth + 1 > st.maxDepth) {
+      st.stop = { offset: cp, reason: "nesting exceeds the depth cap " + st.maxDepth + "." };
+      return -1;
+    }
+    if (st.nodes >= st.maxNodes) return _dumpCapped(st, cp);
+    st.nodes += 1;
+    st.lines.push(_dumpLine(cp, depth + 1, 2, 0, false, _DUMP_TAG_NAMES[0], null));
+    return cp + 2;
+  }
+  st.lines.push(_dumpLine(start, depth, hl, length, true, name, null));
+  var contentEnd = contentStart + length;
+  var childLimit = contentEnd > limit ? limit : contentEnd;
+  while (cp < childLimit) {
+    kid = _dumpWalk(buf, cp, childLimit, depth + 1, st);
+    if (kid < 0) return -1;
+    cp = kid;
+  }
+  if (contentEnd > limit) {
+    st.stop = { offset: start,
+      reason: "content length " + length + " overruns the " + _dumpRemaining(limit - contentStart) };
+    return -1;
+  }
+  return contentEnd;
+}
+
+var KNOWN_DUMP_OPTS = Object.assign(Object.create(null),
+  { maxBytes: 1, maxDepth: 1, maxNodes: 1, maxValueBytes: 1 });
+
+/**
+ * @primitive pki.inspect.asn1
+ * @signature pki.inspect.asn1(input, opts?) -> string
+ * @since 0.8.31
+ * @status stable
+ * @spec X.690, ISO/IEC 8825-1
+ * @defends ASN.1-parser-DoS (CWE-400)
+ * @related pki.asn1.decode, pki.inspect.any
+ *
+ * Render the TLV tree of `input` (a PEM string or DER Buffer) as a structural dump, one
+ * line per value, in the shape `openssl asn1parse` prints: the byte offset, the nesting
+ * depth, the header length, the content length, whether the value is constructed, the tag
+ * name, and for a primitive its rendered content. An OBJECT IDENTIFIER carries its dotted
+ * form and its registry name. A UTCTime or GeneralizedTime renders the bytes as written
+ * rather than a formatted date, so a malformed time is visible instead of normalized away.
+ *
+ * Two routes produce a report and the first line names which one ran. `pki.asn1.decode`
+ * reads the input first, so a conforming file is rendered from the same decoder the rest of
+ * the toolkit parses with. When that decode refuses the bytes, the report names the refusal
+ * and a header-by-header walk renders what it can read: a truncated file, trailing bytes, a
+ * non-minimal length, an indefinite length, a segmented string. The last line of every report
+ * states the outcome: the offset where the structure ends, or the value the walk could not read
+ * through and why, or the bytes that follow the top-level value, or the cap that stopped the
+ * report and where the next value begins. A partial dump cannot be mistaken for a whole
+ * structure. The walk returns text and never a node tree, and it carries the depth and node
+ * caps, so tolerating a broken encoding here relaxes nothing the parsers enforce.
+ *
+ * No value is withheld here. Where the other reports name a key and print none of it, this
+ * one prints bytes, private key material included, which is what a byte-level dump is for.
+ * The caps bound how much of a value is rendered, not whether it is. `pki.inspect.any` and
+ * `pki.inspect.pkcs8` are the reports that name a key without printing it.
+ *
+ * @opts
+ *   maxBytes:      number,  // default and ceiling: C.LIMITS.DER_MAX_BYTES (16 MiB); refuses a
+ *                           // longer input, and tightens only -- a larger value is refused
+ *   maxDepth:      number,  // default: C.LIMITS.DER_MAX_DEPTH (64); stops at this nesting depth
+ *   maxNodes:      number,  // default: C.LIMITS.DUMP_MAX_NODES; stops after this many nodes
+ *   maxValueBytes: number,  // default: C.LIMITS.DUMP_MAX_VALUE_BYTES; renders at most this
+ *                           // many bytes of one value and counts the rest
+ *
+ * @example
+ *   var b = pki.asn1.build;
+ *   var der = b.sequence([b.integer(1), b.oid("2.5.4.3"), b.nullValue()]);
+ *   console.log(pki.inspect.asn1(der));
+ *   // ASN.1 structure: 12 bytes, decoded as DER
+ *   //     0:d=0  hl=2 l=  10 cons: SEQUENCE
+ *   //     2:d=1  hl=2 l=   1 prim:  INTEGER                  :1
+ *   //     5:d=1  hl=2 l=   3 prim:  OBJECT IDENTIFIER        :2.5.4.3 (commonName)
+ *   //    10:d=1  hl=2 l=   0 prim:  NULL
+ *   // Complete: the structure ends at offset 12, the end of the input.
+ *   console.log(pki.inspect.asn1(der.subarray(0, 7)));
+ *   // ASN.1 structure: 7 bytes, header walk
+ *   // DER decode refused: asn1/truncated: content length overruns the buffer
+ *   //     0:d=0  hl=2 l=  10 cons: SEQUENCE
+ *   //     2:d=1  hl=2 l=   1 prim:  INTEGER                  :1
+ *   // Incomplete: the walk could not read the value at offset 5: content length 3 overruns the 0 bytes that remain.
+ */
+function asn1Dump(input, opts) {
+  if (opts === undefined || opts === null) opts = {};
+  if (typeof opts !== "object" || Array.isArray(opts)) {
+    throw _err("inspect/bad-input", "pki.inspect.asn1 options must be an object");
+  }
+  guard.identifier.assertKnownKeys(opts, KNOWN_DUMP_OPTS, _err, "inspect/bad-input",
+    "pki.inspect.asn1 has an unknown option ");
+  var o = guard.identifier.snapshotOptions(opts, KNOWN_DUMP_OPTS);
+  /** @internal `maxBytes` tightens and never raises. The shared parse door carries its own byte
+   *  ceiling and applies it before this verb sees the bytes, so a larger value could not take effect;
+   *  bounding it here refuses that value instead of accepting it and then contradicting it. */
+  var maxBytes = guard.limits.cap(o.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES,
+    { max: constants.LIMITS.DER_MAX_BYTES });
+  var maxDepth = guard.limits.depthCap(o.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);
+  var maxNodes = guard.limits.cap(o.maxNodes, "maxNodes", constants.LIMITS.DUMP_MAX_NODES);
+  var maxValueBytes = guard.limits.cap(o.maxValueBytes, "maxValueBytes", constants.LIMITS.DUMP_MAX_VALUE_BYTES);
+
+  var der;
+  try { der = pkix.coerceToDer(input, _INSPECT_ENTRY); }
+  catch (e) { throw _err("inspect/bad-input", "input must be a DER Buffer or a PEM block", e); }
+  /** @internal Read once, and safe to read off `der` because `pkix.coerceToDer` above has already
+   *  normalized the caller's input: an own `length` property shadowing the real byte count cannot reach
+   *  here. The cap below is therefore a cap on the bytes the walk decodes. */
+  var derLen = der.length;
+  if (derLen === 0) throw _err("inspect/bad-input", "input is empty");
+  if (derLen > maxBytes) {
+    throw _err("inspect/bad-input", "input " + derLen + " bytes exceeds the cap " + maxBytes);
+  }
+
+  var head = ["ASN.1 structure: " + derLen + " bytes, decoded as DER"];
+  var node = null;
+  var refusal = null;
+  /** @internal The decoder builds the whole node tree before the renderer counts a line, so the
+   *  report's node cap reaches it as an item cap or a file of small values allocates a tree the
+   *  report will never print. It is given one node more than the report prints, so a structure just
+   *  past the cap is still read strictly and the report says it stopped at the cap; further past it,
+   *  the decoder refuses, the report names that refusal, and the walk renders the bounded prefix. */
+  try {
+    node = asn1.decode(der, { maxBytes: maxBytes, maxDepth: maxDepth, maxItems: maxNodes + 1 });
+  }
+  catch (e) {
+    refusal = e;
+    head = ["ASN.1 structure: " + der.length + " bytes, header walk",
+      "DER decode refused: " + (e.code || "error") + ": " + e.message];
+  }
+
+  var st = { lines: [], nodes: 0, maxNodes: maxNodes, maxDepth: maxDepth,
+    maxValueBytes: maxValueBytes, capped: false, capOffset: 0, stop: null };
+  var end;
+  if (refusal === null) {
+    _dumpNode(node, 0, st);
+    end = node.header.start + node.bytes.length;
+  } else {
+    end = _dumpWalk(der, 0, der.length, 0, st);
+  }
+
+  /** @internal Every stop names the value the walk could not read THROUGH, which is not the offset
+   *  reading had reached: an unterminated indefinite length is read to the end of the input and the
+   *  value at fault is still the one that opened it. */
+  var tail;
+  if (st.stop !== null) {
+    tail = "Incomplete: the walk could not read the value at offset " + st.stop.offset + ": " +
+      st.stop.reason;
+  } else if (st.capped) {
+    tail = "Incomplete: the report stopped after " + _dumpNodes(maxNodes) + ", the cap on one dump; " +
+      "the next value begins at offset " + st.capOffset + ".";
+  } else if (end < der.length) {
+    tail = "Incomplete: " + _dumpBytes(der.length - end) + " at offset " + end +
+      " follow the top-level value.";
+  } else {
+    tail = "Complete: the structure ends at offset " + end + ", the end of the input.";
+  }
+  return head.concat(st.lines, [tail]).join("\n");
+}
+
 var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), {
   x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport,
   pkcs8: pkcs8Report, pkcs12: pkcs12Report, crmf: crmfReport, cmp: cmpReport,
@@ -2051,6 +2496,7 @@ module.exports = {
   ocspResponse: ocspResponseReport,
   tsp: tspReport,
   attrcert: attrCertReport,
+  asn1: asn1Dump,
   any: any,
   renderedExtensions: Object.keys(EXT_RENDERERS),
 };