1 /* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/bytestring.h>
16
17 #include <assert.h>
18 #include <string.h>
19
20 #include "internal.h"
21
22
23 // kMaxDepth limits the recursion depth to avoid overflowing the stack.
24 static const uint32_t kMaxDepth = 128;
25
26 // is_string_type returns one if |tag| is a string type and zero otherwise. It
27 // ignores the constructed bit.
is_string_type(CBS_ASN1_TAG tag)28 static int is_string_type(CBS_ASN1_TAG tag) {
29 // While BER supports constructed BIT STRINGS, OpenSSL misparses them. To
30 // avoid acting on an ambiguous input, we do not support constructed BIT
31 // STRINGS. See https://github.com/openssl/openssl/issues/12810.
32 switch (tag & ~CBS_ASN1_CONSTRUCTED) {
33 case CBS_ASN1_OCTETSTRING:
34 case CBS_ASN1_UTF8STRING:
35 case CBS_ASN1_NUMERICSTRING:
36 case CBS_ASN1_PRINTABLESTRING:
37 case CBS_ASN1_T61STRING:
38 case CBS_ASN1_VIDEOTEXSTRING:
39 case CBS_ASN1_IA5STRING:
40 case CBS_ASN1_GRAPHICSTRING:
41 case CBS_ASN1_VISIBLESTRING:
42 case CBS_ASN1_GENERALSTRING:
43 case CBS_ASN1_UNIVERSALSTRING:
44 case CBS_ASN1_BMPSTRING:
45 return 1;
46 default:
47 return 0;
48 }
49 }
50
51 // cbs_find_ber walks an ASN.1 structure in |orig_in| and sets |*ber_found|
52 // depending on whether an indefinite length element or constructed string was
53 // found. The value of |orig_in| is not changed. It returns one on success (i.e.
54 // |*ber_found| was set) and zero on error.
cbs_find_ber(const CBS * orig_in,int * ber_found,uint32_t depth)55 static int cbs_find_ber(const CBS *orig_in, int *ber_found, uint32_t depth) {
56 if (depth > kMaxDepth) {
57 return 0;
58 }
59
60 CBS in = *orig_in;
61 *ber_found = 0;
62
63 while (CBS_len(&in) > 0) {
64 CBS contents;
65 CBS_ASN1_TAG tag;
66 size_t header_len;
67 int indefinite;
68 if (!CBS_get_any_ber_asn1_element(&in, &contents, &tag, &header_len,
69 ber_found, &indefinite)) {
70 return 0;
71 }
72 if (*ber_found) {
73 return 1;
74 }
75 if (tag & CBS_ASN1_CONSTRUCTED) {
76 if (is_string_type(tag)) {
77 // Constructed strings are only legal in BER and require conversion.
78 *ber_found = 1;
79 return 1;
80 }
81 if (!CBS_skip(&contents, header_len) ||
82 !cbs_find_ber(&contents, ber_found, depth + 1)) {
83 return 0;
84 }
85 if (*ber_found) {
86 // We already found BER. No need to continue parsing.
87 return 1;
88 }
89 }
90 }
91
92 return 1;
93 }
94
95 // cbs_get_eoc returns one if |cbs| begins with an "end of contents" (EOC) value
96 // and zero otherwise. If an EOC was found, it advances |cbs| past it.
cbs_get_eoc(CBS * cbs)97 static int cbs_get_eoc(CBS *cbs) {
98 if (CBS_len(cbs) >= 2 &&
99 CBS_data(cbs)[0] == 0 && CBS_data(cbs)[1] == 0) {
100 return CBS_skip(cbs, 2);
101 }
102 return 0;
103 }
104
105 // cbs_convert_ber reads BER data from |in| and writes DER data to |out|. If
106 // |string_tag| is non-zero, then all elements must match |string_tag| up to the
107 // constructed bit and primitive element bodies are written to |out| without
108 // element headers. This is used when concatenating the fragments of a
109 // constructed string. If |looking_for_eoc| is set then any EOC elements found
110 // will cause the function to return after consuming it. It returns one on
111 // success and zero on error.
cbs_convert_ber(CBS * in,CBB * out,CBS_ASN1_TAG string_tag,int looking_for_eoc,uint32_t depth)112 static int cbs_convert_ber(CBS *in, CBB *out, CBS_ASN1_TAG string_tag,
113 int looking_for_eoc, uint32_t depth) {
114 assert(!(string_tag & CBS_ASN1_CONSTRUCTED));
115
116 if (depth > kMaxDepth) {
117 return 0;
118 }
119
120 while (CBS_len(in) > 0) {
121 if (looking_for_eoc && cbs_get_eoc(in)) {
122 return 1;
123 }
124
125 CBS contents;
126 CBS_ASN1_TAG tag, child_string_tag = string_tag;
127 size_t header_len;
128 int indefinite;
129 CBB *out_contents, out_contents_storage;
130 if (!CBS_get_any_ber_asn1_element(in, &contents, &tag, &header_len,
131 /*out_ber_found=*/NULL, &indefinite)) {
132 return 0;
133 }
134
135 if (string_tag != 0) {
136 // This is part of a constructed string. All elements must match
137 // |string_tag| up to the constructed bit and get appended to |out|
138 // without a child element.
139 if ((tag & ~CBS_ASN1_CONSTRUCTED) != string_tag) {
140 return 0;
141 }
142 out_contents = out;
143 } else {
144 CBS_ASN1_TAG out_tag = tag;
145 if ((tag & CBS_ASN1_CONSTRUCTED) && is_string_type(tag)) {
146 // If a constructed string, clear the constructed bit and inform
147 // children to concatenate bodies.
148 out_tag &= ~CBS_ASN1_CONSTRUCTED;
149 child_string_tag = out_tag;
150 }
151 if (!CBB_add_asn1(out, &out_contents_storage, out_tag)) {
152 return 0;
153 }
154 out_contents = &out_contents_storage;
155 }
156
157 if (indefinite) {
158 if (!cbs_convert_ber(in, out_contents, child_string_tag,
159 /*looking_for_eoc=*/1, depth + 1) ||
160 !CBB_flush(out)) {
161 return 0;
162 }
163 continue;
164 }
165
166 if (!CBS_skip(&contents, header_len)) {
167 return 0;
168 }
169
170 if (tag & CBS_ASN1_CONSTRUCTED) {
171 // Recurse into children.
172 if (!cbs_convert_ber(&contents, out_contents, child_string_tag,
173 /*looking_for_eoc=*/0, depth + 1)) {
174 return 0;
175 }
176 } else {
177 // Copy primitive contents as-is.
178 if (!CBB_add_bytes(out_contents, CBS_data(&contents),
179 CBS_len(&contents))) {
180 return 0;
181 }
182 }
183
184 if (!CBB_flush(out)) {
185 return 0;
186 }
187 }
188
189 return looking_for_eoc == 0;
190 }
191
CBS_asn1_ber_to_der(CBS * in,CBS * out,uint8_t ** out_storage)192 int CBS_asn1_ber_to_der(CBS *in, CBS *out, uint8_t **out_storage) {
193 CBB cbb;
194
195 // First, do a quick walk to find any indefinite-length elements. Most of the
196 // time we hope that there aren't any and thus we can quickly return.
197 int conversion_needed;
198 if (!cbs_find_ber(in, &conversion_needed, 0)) {
199 return 0;
200 }
201
202 if (!conversion_needed) {
203 if (!CBS_get_any_asn1_element(in, out, NULL, NULL)) {
204 return 0;
205 }
206 *out_storage = NULL;
207 return 1;
208 }
209
210 size_t len;
211 if (!CBB_init(&cbb, CBS_len(in)) ||
212 !cbs_convert_ber(in, &cbb, 0, 0, 0) ||
213 !CBB_finish(&cbb, out_storage, &len)) {
214 CBB_cleanup(&cbb);
215 return 0;
216 }
217
218 CBS_init(out, *out_storage, len);
219 return 1;
220 }
221
CBS_get_asn1_implicit_string(CBS * in,CBS * out,uint8_t ** out_storage,CBS_ASN1_TAG outer_tag,CBS_ASN1_TAG inner_tag)222 int CBS_get_asn1_implicit_string(CBS *in, CBS *out, uint8_t **out_storage,
223 CBS_ASN1_TAG outer_tag,
224 CBS_ASN1_TAG inner_tag) {
225 assert(!(outer_tag & CBS_ASN1_CONSTRUCTED));
226 assert(!(inner_tag & CBS_ASN1_CONSTRUCTED));
227 assert(is_string_type(inner_tag));
228
229 if (CBS_peek_asn1_tag(in, outer_tag)) {
230 // Normal implicitly-tagged string.
231 *out_storage = NULL;
232 return CBS_get_asn1(in, out, outer_tag);
233 }
234
235 // Otherwise, try to parse an implicitly-tagged constructed string.
236 // |CBS_asn1_ber_to_der| is assumed to have run, so only allow one level deep
237 // of nesting.
238 CBB result;
239 CBS child;
240 if (!CBB_init(&result, CBS_len(in)) ||
241 !CBS_get_asn1(in, &child, outer_tag | CBS_ASN1_CONSTRUCTED)) {
242 goto err;
243 }
244
245 while (CBS_len(&child) > 0) {
246 CBS chunk;
247 if (!CBS_get_asn1(&child, &chunk, inner_tag) ||
248 !CBB_add_bytes(&result, CBS_data(&chunk), CBS_len(&chunk))) {
249 goto err;
250 }
251 }
252
253 uint8_t *data;
254 size_t len;
255 if (!CBB_finish(&result, &data, &len)) {
256 goto err;
257 }
258
259 CBS_init(out, data, len);
260 *out_storage = data;
261 return 1;
262
263 err:
264 CBB_cleanup(&result);
265 return 0;
266 }
267