summaryrefslogtreecommitdiff
path: root/src/lib/libssl/bs_ber.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/bs_ber.c390
1 files changed, 211 insertions, 179 deletions
diff --git a/src/lib/libssl/bs_ber.c b/src/lib/libssl/bs_ber.c
index b94b63e37e..cfc9475f9a 100644
--- a/src/lib/libssl/bs_ber.c
+++ b/src/lib/libssl/bs_ber.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: bs_ber.c,v 1.1 2015/02/06 09:36:16 doug Exp $ */ 1/* $OpenBSD: bs_ber.c,v 1.2 2015/02/06 22:22:33 doug Exp $ */
2/* 2/*
3 * Copyright (c) 2014, Google Inc. 3 * Copyright (c) 2014, Google Inc.
4 * 4 *
@@ -20,201 +20,233 @@
20 20
21#include "bytestring.h" 21#include "bytestring.h"
22 22
23/* kMaxDepth is a just a sanity limit. The code should be such that the length 23/*
24 * kMaxDepth is a just a sanity limit. The code should be such that the length
24 * of the input being processes always decreases. None the less, a very large 25 * of the input being processes always decreases. None the less, a very large
25 * input could otherwise cause the stack to overflow. */ 26 * input could otherwise cause the stack to overflow.
27 */
26static const unsigned kMaxDepth = 2048; 28static const unsigned kMaxDepth = 2048;
27 29
28/* cbs_find_ber walks an ASN.1 structure in |orig_in| and sets |*ber_found| 30/*
31 * cbs_find_ber walks an ASN.1 structure in |orig_in| and sets |*ber_found|
29 * depending on whether an indefinite length element was found. The value of 32 * depending on whether an indefinite length element was found. The value of
30 * |in| is not changed. It returns one on success (i.e. |*ber_found| was set) 33 * |in| is not changed. It returns one on success (i.e. |*ber_found| was set)
31 * and zero on error. */ 34 * and zero on error.
32static int cbs_find_ber(CBS *orig_in, char *ber_found, unsigned depth) { 35 */
33 CBS in; 36static int
34 37cbs_find_ber(CBS *orig_in, char *ber_found, unsigned depth)
35 if (depth > kMaxDepth) { 38{
36 return 0; 39 CBS in;
37 } 40
38 41 if (depth > kMaxDepth)
39 CBS_init(&in, CBS_data(orig_in), CBS_len(orig_in)); 42 return 0;
40 *ber_found = 0; 43
41 44 CBS_init(&in, CBS_data(orig_in), CBS_len(orig_in));
42 while (CBS_len(&in) > 0) { 45 *ber_found = 0;
43 CBS contents; 46
44 unsigned tag; 47 while (CBS_len(&in) > 0) {
45 size_t header_len; 48 CBS contents;
46 49 unsigned tag;
47 if (!CBS_get_any_asn1_element(&in, &contents, &tag, &header_len)) { 50 size_t header_len;
48 return 0; 51
49 } 52 if (!CBS_get_any_asn1_element(&in, &contents, &tag,
50 if (CBS_len(&contents) == header_len && 53 &header_len))
51 header_len > 0 && 54 return 0;
52 CBS_data(&contents)[header_len-1] == 0x80) { 55
53 *ber_found = 1; 56 if (CBS_len(&contents) == header_len && header_len > 0 &&
54 return 1; 57 CBS_data(&contents)[header_len-1] == 0x80) {
55 } 58 *ber_found = 1;
56 if (tag & CBS_ASN1_CONSTRUCTED) { 59 return 1;
57 if (!CBS_skip(&contents, header_len) || 60 }
58 !cbs_find_ber(&contents, ber_found, depth + 1)) { 61 if (tag & CBS_ASN1_CONSTRUCTED) {
59 return 0; 62 if (!CBS_skip(&contents, header_len) ||
60 } 63 !cbs_find_ber(&contents, ber_found, depth + 1))
61 } 64 return 0;
62 } 65 }
63 66 }
64 return 1; 67
68 return 1;
65} 69}
66 70
67/* is_primitive_type returns true if |tag| likely a primitive type. Normally 71/*
72 * is_primitive_type returns true if |tag| likely a primitive type. Normally
68 * one can just test the "constructed" bit in the tag but, in BER, even 73 * one can just test the "constructed" bit in the tag but, in BER, even
69 * primitive tags can have the constructed bit if they have indefinite 74 * primitive tags can have the constructed bit if they have indefinite
70 * length. */ 75 * length.
71static char is_primitive_type(unsigned tag) { 76 */
72 return (tag & 0xc0) == 0 && 77static char
73 (tag & 0x1f) != (CBS_ASN1_SEQUENCE & 0x1f) && 78is_primitive_type(unsigned tag)
74 (tag & 0x1f) != (CBS_ASN1_SET & 0x1f); 79{
80 return (tag & 0xc0) == 0 &&
81 (tag & 0x1f) != (CBS_ASN1_SEQUENCE & 0x1f) &&
82 (tag & 0x1f) != (CBS_ASN1_SET & 0x1f);
75} 83}
76 84
77/* is_eoc returns true if |header_len| and |contents|, as returned by 85/*
78 * |CBS_get_any_asn1_element|, indicate an "end of contents" (EOC) value. */ 86 * is_eoc returns true if |header_len| and |contents|, as returned by
79static char is_eoc(size_t header_len, CBS *contents) { 87 * |CBS_get_any_asn1_element|, indicate an "end of contents" (EOC) value.
80 return header_len == 2 && CBS_len(contents) == 2 && 88 */
81 memcmp(CBS_data(contents), "\x00\x00", 2) == 0; 89static char
90is_eoc(size_t header_len, CBS *contents)
91{
92 return header_len == 2 && CBS_len(contents) == 2 &&
93 memcmp(CBS_data(contents), "\x00\x00", 2) == 0;
82} 94}
83 95
84/* cbs_convert_ber reads BER data from |in| and writes DER data to |out|. If 96/*
97 * cbs_convert_ber reads BER data from |in| and writes DER data to |out|. If
85 * |squash_header| is set then the top-level of elements from |in| will not 98 * |squash_header| is set then the top-level of elements from |in| will not
86 * have their headers written. This is used when concatenating the fragments of 99 * have their headers written. This is used when concatenating the fragments of
87 * an indefinite length, primitive value. If |looking_for_eoc| is set then any 100 * an indefinite length, primitive value. If |looking_for_eoc| is set then any
88 * EOC elements found will cause the function to return after consuming it. 101 * EOC elements found will cause the function to return after consuming it.
89 * It returns one on success and zero on error. */ 102 * It returns one on success and zero on error.
90static int cbs_convert_ber(CBS *in, CBB *out, char squash_header, 103 */
91 char looking_for_eoc, unsigned depth) { 104static int
92 if (depth > kMaxDepth) { 105cbs_convert_ber(CBS *in, CBB *out, char squash_header, char looking_for_eoc,
93 return 0; 106 unsigned depth)
94 } 107{
95 108 if (depth > kMaxDepth)
96 while (CBS_len(in) > 0) { 109 return 0;
97 CBS contents; 110
98 unsigned tag; 111 while (CBS_len(in) > 0) {
99 size_t header_len; 112 CBS contents;
100 CBB *out_contents, out_contents_storage; 113 unsigned tag;
101 114 size_t header_len;
102 if (!CBS_get_any_asn1_element(in, &contents, &tag, &header_len)) { 115 CBB *out_contents, out_contents_storage;
103 return 0; 116
104 } 117 if (!CBS_get_any_asn1_element(in, &contents, &tag, &header_len))
105 out_contents = out; 118 return 0;
106 119
107 if (CBS_len(&contents) == header_len) { 120 out_contents = out;
108 if (is_eoc(header_len, &contents)) { 121
109 return looking_for_eoc; 122 if (CBS_len(&contents) == header_len) {
110 } 123 if (is_eoc(header_len, &contents))
111 124 return looking_for_eoc;
112 if (header_len > 0 && CBS_data(&contents)[header_len - 1] == 0x80) { 125
113 /* This is an indefinite length element. If it's a SEQUENCE or SET then 126 if (header_len > 0 &&
114 * we just need to write the out the contents as normal, but with a 127 CBS_data(&contents)[header_len - 1] == 0x80) {
115 * concrete length prefix. 128 /*
116 * 129 * This is an indefinite length element. If
117 * If it's a something else then the contents will be a series of BER 130 * it's a SEQUENCE or SET then we just need to
118 * elements of the same type which need to be concatenated. */ 131 * write the out the contents as normal, but
119 const char context_specific = (tag & 0xc0) == 0x80; 132 * with a concrete length prefix.
120 char squash_child_headers = is_primitive_type(tag); 133 *
121 134 * If it's a something else then the contents
122 /* This is a hack, but it sufficies to handle NSS's output. If we find 135 * will be a series of BER elements of the same
123 * an indefinite length, context-specific tag with a definite, primtive 136 * type which need to be concatenated.
124 * tag inside it, then we assume that the context-specific tag is 137 */
125 * implicit and the tags within are fragments of a primitive type that 138 const char context_specific = (tag & 0xc0)
126 * need to be concatenated. */ 139 == 0x80;
127 if (context_specific && (tag & CBS_ASN1_CONSTRUCTED)) { 140 char squash_child_headers =
128 CBS in_copy, inner_contents; 141 is_primitive_type(tag);
129 unsigned inner_tag; 142
130 size_t inner_header_len; 143 /*
131 144 * This is a hack, but it sufficies to handle
132 CBS_init(&in_copy, CBS_data(in), CBS_len(in)); 145 * NSS's output. If we find an indefinite
133 if (!CBS_get_any_asn1_element(&in_copy, &inner_contents, &inner_tag, 146 * length, context-specific tag with a definite,
134 &inner_header_len)) { 147 * primtive tag inside it, then we assume that
135 return 0; 148 * the context-specific tag is implicit and the
136 } 149 * tags within are fragments of a primitive type
137 if (CBS_len(&inner_contents) > inner_header_len && 150 * that need to be concatenated.
138 is_primitive_type(inner_tag)) { 151 */
139 squash_child_headers = 1; 152 if (context_specific &&
140 } 153 (tag & CBS_ASN1_CONSTRUCTED)) {
141 } 154 CBS in_copy, inner_contents;
142 155 unsigned inner_tag;
143 if (!squash_header) { 156 size_t inner_header_len;
144 unsigned out_tag = tag; 157
145 if (squash_child_headers) { 158 CBS_init(&in_copy, CBS_data(in),
146 out_tag &= ~CBS_ASN1_CONSTRUCTED; 159 CBS_len(in));
147 } 160 if (!CBS_get_any_asn1_element(&in_copy,
148 if (!CBB_add_asn1(out, &out_contents_storage, out_tag)) { 161 &inner_contents, &inner_tag,
149 return 0; 162 &inner_header_len))
150 } 163 return 0;
151 out_contents = &out_contents_storage; 164
152 } 165 if (CBS_len(&inner_contents) >
153 166 inner_header_len &&
154 if (!cbs_convert_ber(in, out_contents, 167 is_primitive_type(inner_tag))
155 squash_child_headers, 168 squash_child_headers = 1;
156 1 /* looking for eoc */, depth + 1)) { 169 }
157 return 0; 170
158 } 171 if (!squash_header) {
159 if (out_contents != out && !CBB_flush(out)) { 172 unsigned out_tag = tag;
160 return 0; 173
161 } 174 if (squash_child_headers)
162 continue; 175 out_tag &=
163 } 176 ~CBS_ASN1_CONSTRUCTED;
164 } 177
165 178 if (!CBB_add_asn1(out,
166 if (!squash_header) { 179 &out_contents_storage, out_tag))
167 if (!CBB_add_asn1(out, &out_contents_storage, tag)) { 180 return 0;
168 return 0; 181
169 } 182 out_contents = &out_contents_storage;
170 out_contents = &out_contents_storage; 183 }
171 } 184
172 185 if (!cbs_convert_ber(in, out_contents,
173 if (!CBS_skip(&contents, header_len)) { 186 squash_child_headers,
174 return 0; 187 1 /* looking for eoc */, depth + 1))
175 } 188 return 0;
176 189
177 if (tag & CBS_ASN1_CONSTRUCTED) { 190 if (out_contents != out && !CBB_flush(out))
178 if (!cbs_convert_ber(&contents, out_contents, 0 /* don't squash header */, 191 return 0;
179 0 /* not looking for eoc */, depth + 1)) { 192
180 return 0; 193 continue;
181 } 194 }
182 } else { 195 }
183 if (!CBB_add_bytes(out_contents, CBS_data(&contents), 196
184 CBS_len(&contents))) { 197 if (!squash_header) {
185 return 0; 198 if (!CBB_add_asn1(out, &out_contents_storage, tag))
186 } 199 return 0;
187 } 200
188 201 out_contents = &out_contents_storage;
189 if (out_contents != out && !CBB_flush(out)) { 202 }
190 return 0; 203
191 } 204 if (!CBS_skip(&contents, header_len))
192 } 205 return 0;
193 206
194 return looking_for_eoc == 0; 207 if (tag & CBS_ASN1_CONSTRUCTED) {
208 if (!cbs_convert_ber(&contents, out_contents,
209 0 /* don't squash header */,
210 0 /* not looking for eoc */, depth + 1))
211 return 0;
212 } else {
213 if (!CBB_add_bytes(out_contents, CBS_data(&contents),
214 CBS_len(&contents)))
215 return 0;
216 }
217
218 if (out_contents != out && !CBB_flush(out))
219 return 0;
220 }
221
222 return looking_for_eoc == 0;
195} 223}
196 224
197int CBS_asn1_ber_to_der(CBS *in, uint8_t **out, size_t *out_len) { 225int
198 CBB cbb; 226CBS_asn1_ber_to_der(CBS *in, uint8_t **out, size_t *out_len)
199 227{
200 /* First, do a quick walk to find any indefinite-length elements. Most of the 228 CBB cbb;
201 * time we hope that there aren't any and thus we can quickly return. */ 229
202 char conversion_needed; 230 /*
203 if (!cbs_find_ber(in, &conversion_needed, 0)) { 231 * First, do a quick walk to find any indefinite-length elements. Most
204 return 0; 232 * of the time we hope that there aren't any and thus we can quickly
205 } 233 * return.
206 234 */
207 if (!conversion_needed) { 235 char conversion_needed;
208 *out = NULL; 236 if (!cbs_find_ber(in, &conversion_needed, 0))
209 *out_len = 0; 237 return 0;
210 return 1; 238
211 } 239 if (!conversion_needed) {
212 240 *out = NULL;
213 CBB_init(&cbb, CBS_len(in)); 241 *out_len = 0;
214 if (!cbs_convert_ber(in, &cbb, 0, 0, 0)) { 242 return 1;
215 CBB_cleanup(&cbb); 243 }
216 return 0; 244
217 } 245 CBB_init(&cbb, CBS_len(in));
218 246 if (!cbs_convert_ber(in, &cbb, 0, 0, 0)) {
219 return CBB_finish(&cbb, out, out_len); 247 CBB_cleanup(&cbb);
248 return 0;
249 }
250
251 return CBB_finish(&cbb, out, out_len);
220} 252}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-07 14:24:36 +0000