1 /*- 2 * Copyright (c) 2016 Christos Zoulas 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 15 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 16 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 17 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 18 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 19 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 20 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 21 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 22 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 23 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 24 * POSSIBILITY OF SUCH DAMAGE. 25 */ 26 /* 27 * DER (Distinguished Encoding Rules) Parser 28 * 29 * Sources: 30 * https://en.wikipedia.org/wiki/X.690 31 * http://fm4dd.com/openssl/certexamples.htm 32 * http://blog.engelke.com/2014/10/17/parsing-ber-and-der-encoded-asn-1-objects/ 33 */ 34 #ifndef TEST_DER 35 #include "file.h" 36 37 #ifndef lint 38 FILE_RCSID("@(#)$File: der.c,v 1.27 2022/09/24 20:30:13 christos Exp $") 39 #endif 40 #else 41 #define SIZE_T_FORMAT "z" 42 #define CAST(a, b) ((a)(b)) 43 #endif 44 45 #include <sys/types.h> 46 47 #include <stdio.h> 48 #include <fcntl.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <ctype.h> 52 53 #ifndef TEST_DER 54 #include "magic.h" 55 #include "der.h" 56 #else 57 #include <sys/mman.h> 58 #include <sys/stat.h> 59 #include <err.h> 60 #endif 61 62 #define DER_BAD CAST(uint32_t, -1) 63 64 #define DER_CLASS_UNIVERSAL 0 65 #define DER_CLASS_APPLICATION 1 66 #define DER_CLASS_CONTEXT 2 67 #define DER_CLASS_PRIVATE 3 68 #if defined(DEBUG_DER) || defined(TEST_DER) 69 static const char der_class[] = "UACP"; 70 #endif 71 72 #define DER_TYPE_PRIMITIVE 0 73 #define DER_TYPE_CONSTRUCTED 1 74 #if defined(DEBUG_DER) || defined(TEST_DER) 75 static const char der_type[] = "PC"; 76 #endif 77 78 #define DER_TAG_EOC 0x00 79 #define DER_TAG_BOOLEAN 0x01 80 #define DER_TAG_INTEGER 0x02 81 #define DER_TAG_BIT STRING 0x03 82 #define DER_TAG_OCTET_STRING 0x04 83 #define DER_TAG_NULL 0x05 84 #define DER_TAG_OBJECT_IDENTIFIER 0x06 85 #define DER_TAG_OBJECT_DESCRIPTOR 0x07 86 #define DER_TAG_EXTERNAL 0x08 87 #define DER_TAG_REAL 0x09 88 #define DER_TAG_ENUMERATED 0x0a 89 #define DER_TAG_EMBEDDED_PDV 0x0b 90 #define DER_TAG_UTF8_STRING 0x0c 91 #define DER_TAG_RELATIVE_OID 0x0d 92 #define DER_TAG_TIME 0x0e 93 #define DER_TAG_RESERVED_2 0x0f 94 #define DER_TAG_SEQUENCE 0x10 95 #define DER_TAG_SET 0x11 96 #define DER_TAG_NUMERIC_STRING 0x12 97 #define DER_TAG_PRINTABLE_STRING 0x13 98 #define DER_TAG_T61_STRING 0x14 99 #define DER_TAG_VIDEOTEX_STRING 0x15 100 #define DER_TAG_IA5_STRING 0x16 101 #define DER_TAG_UTCTIME 0x17 102 #define DER_TAG_GENERALIZED_TIME 0x18 103 #define DER_TAG_GRAPHIC_STRING 0x19 104 #define DER_TAG_VISIBLE_STRING 0x1a 105 #define DER_TAG_GENERAL_STRING 0x1b 106 #define DER_TAG_UNIVERSAL_STRING 0x1c 107 #define DER_TAG_CHARACTER_STRING 0x1d 108 #define DER_TAG_BMP_STRING 0x1e 109 #define DER_TAG_DATE 0x1f 110 #define DER_TAG_TIME_OF_DAY 0x20 111 #define DER_TAG_DATE_TIME 0x21 112 #define DER_TAG_DURATION 0x22 113 #define DER_TAG_OID_IRI 0x23 114 #define DER_TAG_RELATIVE_OID_IRI 0x24 115 #define DER_TAG_LAST 0x25 116 117 static const char *der__tag[] = { 118 "eoc", "bool", "int", "bit_str", "octet_str", 119 "null", "obj_id", "obj_desc", "ext", "real", 120 "enum", "embed", "utf8_str", "rel_oid", "time", 121 "res2", "seq", "set", "num_str", "prt_str", 122 "t61_str", "vid_str", "ia5_str", "utc_time", "gen_time", 123 "gr_str", "vis_str", "gen_str", "univ_str", "char_str", 124 "bmp_str", "date", "tod", "datetime", "duration", 125 "oid-iri", "rel-oid-iri", 126 }; 127 128 #ifdef DEBUG_DER 129 #define DPRINTF(a) printf a 130 #else 131 #define DPRINTF(a) 132 #endif 133 134 #ifdef TEST_DER 135 static uint8_t 136 getclass(uint8_t c) 137 { 138 return c >> 6; 139 } 140 141 static uint8_t 142 gettype(uint8_t c) 143 { 144 return (c >> 5) & 1; 145 } 146 #endif 147 148 static uint32_t 149 gettag(const uint8_t *c, size_t *p, size_t l) 150 { 151 uint32_t tag; 152 153 if (*p >= l) 154 return DER_BAD; 155 156 tag = c[(*p)++] & 0x1f; 157 158 if (tag != 0x1f) 159 return tag; 160 161 if (*p >= l) 162 return DER_BAD; 163 164 while (c[*p] >= 0x80) { 165 tag = tag * 128 + c[(*p)++] - 0x80; 166 if (*p >= l) 167 return DER_BAD; 168 } 169 return tag; 170 } 171 172 /* 173 * Read the length of a DER tag from the input. 174 * 175 * `c` is the input, `p` is an output parameter that specifies how much of the 176 * input we consumed, and `l` is the maximum input length. 177 * 178 * Returns the length, or DER_BAD if the end of the input is reached or the 179 * length exceeds the remaining input. 180 */ 181 static uint32_t 182 getlength(const uint8_t *c, size_t *p, size_t l) 183 { 184 uint8_t digits, i; 185 size_t len; 186 int is_onebyte_result; 187 188 if (*p >= l) { 189 DPRINTF(("%s:[1] %zu >= %zu\n", __func__, *p, l)); 190 return DER_BAD; 191 } 192 193 /* 194 * Digits can either be 0b0 followed by the result, or 0b1 195 * followed by the number of digits of the result. In either case, 196 * we verify that we can read so many bytes from the input. 197 */ 198 is_onebyte_result = (c[*p] & 0x80) == 0; 199 digits = c[(*p)++] & 0x7f; 200 if (*p + digits >= l) { 201 DPRINTF(("%s:[2] %zu + %u >= %zu\n", __func__, *p, digits, l)); 202 return DER_BAD; 203 } 204 205 if (is_onebyte_result) 206 return digits; 207 208 /* 209 * Decode len. We've already verified that we're allowed to read 210 * `digits` bytes. 211 */ 212 len = 0; 213 for (i = 0; i < digits; i++) 214 len = (len << 8) | c[(*p)++]; 215 216 if (len > UINT32_MAX - *p || *p + len > l) { 217 DPRINTF(("%s:[3] bad len %zu + %zu >= %zu\n", 218 __func__, *p, len, l)); 219 return DER_BAD; 220 } 221 return CAST(uint32_t, len); 222 } 223 224 static const char * 225 der_tag(char *buf, size_t len, uint32_t tag) 226 { 227 if (tag < DER_TAG_LAST) 228 strlcpy(buf, der__tag[tag], len); 229 else 230 snprintf(buf, len, "%#x", tag); 231 return buf; 232 } 233 234 #ifndef TEST_DER 235 static int 236 der_data(char *buf, size_t blen, uint32_t tag, const void *q, uint32_t len) 237 { 238 uint32_t i; 239 const uint8_t *d = CAST(const uint8_t *, q); 240 switch (tag) { 241 case DER_TAG_PRINTABLE_STRING: 242 case DER_TAG_UTF8_STRING: 243 case DER_TAG_IA5_STRING: 244 return snprintf(buf, blen, "%.*s", len, RCAST(const char *, q)); 245 case DER_TAG_UTCTIME: 246 if (len < 12) 247 break; 248 return snprintf(buf, blen, 249 "20%c%c-%c%c-%c%c %c%c:%c%c:%c%c GMT", d[0], d[1], d[2], 250 d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11]); 251 default: 252 break; 253 } 254 255 for (i = 0; i < len; i++) { 256 uint32_t z = i << 1; 257 if (z < blen - 2) 258 snprintf(buf + z, blen - z, "%.2x", d[i]); 259 } 260 return len * 2; 261 } 262 263 int32_t 264 der_offs(struct magic_set *ms, struct magic *m, size_t nbytes) 265 { 266 const uint8_t *b = RCAST(const uint8_t *, ms->search.s); 267 size_t offs = 0, len = ms->search.s_len ? ms->search.s_len : nbytes; 268 269 if (gettag(b, &offs, len) == DER_BAD) { 270 DPRINTF(("%s: bad tag 1\n", __func__)); 271 return -1; 272 } 273 DPRINTF(("%s1: %u %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset, 274 offs, m->offset)); 275 276 uint32_t tlen = getlength(b, &offs, len); 277 if (tlen == DER_BAD) { 278 DPRINTF(("%s: bad tag 2\n", __func__)); 279 return -1; 280 } 281 DPRINTF(("%s2: %u %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset, 282 offs, tlen)); 283 284 offs += ms->offset + m->offset; 285 DPRINTF(("cont_level = %d\n", m->cont_level)); 286 #ifdef DEBUG_DER 287 size_t i; 288 for (i = 0; i < m->cont_level; i++) 289 printf("cont_level[%" SIZE_T_FORMAT "u] = %d\n", i, 290 ms->c.li[i].off); 291 #endif 292 if (m->cont_level != 0) { 293 if (offs + tlen > nbytes) 294 return -1; 295 ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen); 296 DPRINTF(("cont_level[%u] = %d\n", m->cont_level - 1, 297 ms->c.li[m->cont_level - 1].off)); 298 } 299 return CAST(int32_t, offs); 300 } 301 302 int 303 der_cmp(struct magic_set *ms, struct magic *m) 304 { 305 const uint8_t *b = RCAST(const uint8_t *, ms->search.s); 306 const char *s = m->value.s; 307 size_t offs = 0, len = ms->search.s_len; 308 uint32_t tag, tlen; 309 char buf[128]; 310 311 DPRINTF(("%s: compare %zu bytes\n", __func__, len)); 312 313 tag = gettag(b, &offs, len); 314 if (tag == DER_BAD) { 315 DPRINTF(("%s: bad tag 1\n", __func__)); 316 return -1; 317 } 318 319 DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset, 320 offs, m->offset)); 321 322 tlen = getlength(b, &offs, len); 323 if (tlen == DER_BAD) { 324 DPRINTF(("%s: bad tag 2\n", __func__)); 325 return -1; 326 } 327 328 der_tag(buf, sizeof(buf), tag); 329 if ((ms->flags & MAGIC_DEBUG) != 0) 330 fprintf(stderr, "%s: tag %p got=%s exp=%s\n", __func__, b, 331 buf, s); 332 size_t slen = strlen(buf); 333 334 if (strncmp(buf, s, slen) != 0) { 335 DPRINTF(("%s: no string match %s != %s\n", __func__, buf, s)); 336 return 0; 337 } 338 339 s += slen; 340 341 again: 342 switch (*s) { 343 case '\0': 344 DPRINTF(("%s: EOF match\n", __func__)); 345 return 1; 346 case '=': 347 s++; 348 goto val; 349 default: 350 if (!isdigit(CAST(unsigned char, *s))) { 351 DPRINTF(("%s: no digit %c\n", __func__, *s)); 352 return 0; 353 } 354 355 slen = 0; 356 do 357 slen = slen * 10 + *s - '0'; 358 while (isdigit(CAST(unsigned char, *++s))); 359 if ((ms->flags & MAGIC_DEBUG) != 0) 360 fprintf(stderr, "%s: len %" SIZE_T_FORMAT "u %u\n", 361 __func__, slen, tlen); 362 if (tlen != slen) { 363 DPRINTF(("%s: len %u != %zu\n", __func__, tlen, slen)); 364 return 0; 365 } 366 goto again; 367 } 368 val: 369 DPRINTF(("%s: before data %" SIZE_T_FORMAT "u %u\n", __func__, offs, 370 tlen)); 371 der_data(buf, sizeof(buf), tag, b + offs, tlen); 372 if ((ms->flags & MAGIC_DEBUG) != 0) 373 fprintf(stderr, "%s: data %s %s\n", __func__, buf, s); 374 if (strcmp(buf, s) != 0 && strcmp("x", s) != 0) { 375 DPRINTF(("%s: no string match %s != %s\n", __func__, buf, s)); 376 return 0; 377 } 378 strlcpy(ms->ms_value.s, buf, sizeof(ms->ms_value.s)); 379 DPRINTF(("%s: complete match\n", __func__)); 380 return 1; 381 } 382 #endif 383 384 #ifdef TEST_DER 385 static void 386 printtag(uint32_t tag, const void *q, uint32_t len) 387 { 388 const uint8_t *d = q; 389 switch (tag) { 390 case DER_TAG_PRINTABLE_STRING: 391 case DER_TAG_UTF8_STRING: 392 case DER_TAG_IA5_STRING: 393 case DER_TAG_UTCTIME: 394 printf("%.*s\n", len, (const char *)q); 395 return; 396 default: 397 break; 398 } 399 400 for (uint32_t i = 0; i < len; i++) 401 printf("%.2x", d[i]); 402 printf("\n"); 403 } 404 405 static void 406 printdata(size_t level, const void *v, size_t x, size_t l) 407 { 408 const uint8_t *p = v, *ep = p + l; 409 size_t ox; 410 char buf[128]; 411 412 while (p + x < ep) { 413 const uint8_t *q; 414 uint8_t c = getclass(p[x]); 415 uint8_t t = gettype(p[x]); 416 ox = x; 417 // if (x != 0) 418 // printf("%.2x %.2x %.2x\n", p[x - 1], p[x], p[x + 1]); 419 uint32_t tag = gettag(p, &x, ep - p + x); 420 if (p + x >= ep) 421 break; 422 uint32_t len = getlength(p, &x, ep - p + x); 423 424 printf("%" SIZE_T_FORMAT "u %" SIZE_T_FORMAT "u-%" 425 SIZE_T_FORMAT "u %c,%c,%s,%u:", level, ox, x, 426 der_class[c], der_type[t], 427 der_tag(buf, sizeof(buf), tag), len); 428 q = p + x; 429 if (p + len > ep) 430 errx(EXIT_FAILURE, "corrupt der"); 431 printtag(tag, q, len); 432 if (t != DER_TYPE_PRIMITIVE) 433 printdata(level + 1, p, x, len + x); 434 x += len; 435 } 436 } 437 438 int 439 main(int argc, char *argv[]) 440 { 441 int fd; 442 struct stat st; 443 size_t l; 444 void *p; 445 446 if ((fd = open(argv[1], O_RDONLY)) == -1) 447 err(EXIT_FAILURE, "open `%s'", argv[1]); 448 if (fstat(fd, &st) == -1) 449 err(EXIT_FAILURE, "stat `%s'", argv[1]); 450 l = (size_t)st.st_size; 451 if ((p = mmap(NULL, l, PROT_READ, MAP_FILE, fd, 0)) == MAP_FAILED) 452 err(EXIT_FAILURE, "mmap `%s'", argv[1]); 453 454 printdata(0, p, 0, l); 455 munmap(p, l); 456 return 0; 457 } 458 #endif 459