Blame view
lib/asn1_decoder.c
13.2 KB
b4d0d230c treewide: Replace... |
1 |
// SPDX-License-Identifier: GPL-2.0-or-later |
42d5ec27f X.509: Add an ASN... |
2 3 4 5 |
/* Decoder for ASN.1 BER/DER/CER encoded bytestream * * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. * Written by David Howells (dhowells@redhat.com) |
42d5ec27f X.509: Add an ASN... |
6 7 8 9 10 |
*/ #include <linux/export.h> #include <linux/kernel.h> #include <linux/errno.h> |
ccab6058d lib: asn1_decoder... |
11 |
#include <linux/module.h> |
42d5ec27f X.509: Add an ASN... |
12 13 14 15 16 17 18 19 20 21 22 23 |
#include <linux/asn1_decoder.h> #include <linux/asn1_ber_bytecode.h> static const unsigned char asn1_op_lengths[ASN1_OP__NR] = { /* OPC TAG JMP ACT */ [ASN1_OP_MATCH] = 1 + 1, [ASN1_OP_MATCH_OR_SKIP] = 1 + 1, [ASN1_OP_MATCH_ACT] = 1 + 1 + 1, [ASN1_OP_MATCH_ACT_OR_SKIP] = 1 + 1 + 1, [ASN1_OP_MATCH_JUMP] = 1 + 1 + 1, [ASN1_OP_MATCH_JUMP_OR_SKIP] = 1 + 1 + 1, [ASN1_OP_MATCH_ANY] = 1, |
233ce79db ASN.1: Handle 'AN... |
24 |
[ASN1_OP_MATCH_ANY_OR_SKIP] = 1, |
42d5ec27f X.509: Add an ASN... |
25 |
[ASN1_OP_MATCH_ANY_ACT] = 1 + 1, |
233ce79db ASN.1: Handle 'AN... |
26 |
[ASN1_OP_MATCH_ANY_ACT_OR_SKIP] = 1 + 1, |
42d5ec27f X.509: Add an ASN... |
27 28 29 30 |
[ASN1_OP_COND_MATCH_OR_SKIP] = 1 + 1, [ASN1_OP_COND_MATCH_ACT_OR_SKIP] = 1 + 1 + 1, [ASN1_OP_COND_MATCH_JUMP_OR_SKIP] = 1 + 1 + 1, [ASN1_OP_COND_MATCH_ANY] = 1, |
233ce79db ASN.1: Handle 'AN... |
31 |
[ASN1_OP_COND_MATCH_ANY_OR_SKIP] = 1, |
42d5ec27f X.509: Add an ASN... |
32 |
[ASN1_OP_COND_MATCH_ANY_ACT] = 1 + 1, |
233ce79db ASN.1: Handle 'AN... |
33 |
[ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP] = 1 + 1, |
42d5ec27f X.509: Add an ASN... |
34 35 36 |
[ASN1_OP_COND_FAIL] = 1, [ASN1_OP_COMPLETE] = 1, [ASN1_OP_ACT] = 1 + 1, |
3f3af97d8 ASN.1: Fix action... |
37 |
[ASN1_OP_MAYBE_ACT] = 1 + 1, |
42d5ec27f X.509: Add an ASN... |
38 39 40 41 42 43 44 45 46 47 48 49 50 |
[ASN1_OP_RETURN] = 1, [ASN1_OP_END_SEQ] = 1, [ASN1_OP_END_SEQ_OF] = 1 + 1, [ASN1_OP_END_SET] = 1, [ASN1_OP_END_SET_OF] = 1 + 1, [ASN1_OP_END_SEQ_ACT] = 1 + 1, [ASN1_OP_END_SEQ_OF_ACT] = 1 + 1 + 1, [ASN1_OP_END_SET_ACT] = 1 + 1, [ASN1_OP_END_SET_OF_ACT] = 1 + 1 + 1, }; /* * Find the length of an indefinite length object |
dbadc1768 X.509: Fix indefi... |
51 52 53 54 55 |
* @data: The data buffer * @datalen: The end of the innermost containing element in the buffer * @_dp: The data parse cursor (updated before returning) * @_len: Where to return the size of the element. * @_errmsg: Where to return a pointer to an error message on error |
42d5ec27f X.509: Add an ASN... |
56 57 |
*/ static int asn1_find_indefinite_length(const unsigned char *data, size_t datalen, |
dbadc1768 X.509: Fix indefi... |
58 59 |
size_t *_dp, size_t *_len, const char **_errmsg) |
42d5ec27f X.509: Add an ASN... |
60 61 |
{ unsigned char tag, tmp; |
dbadc1768 X.509: Fix indefi... |
62 |
size_t dp = *_dp, len, n; |
42d5ec27f X.509: Add an ASN... |
63 64 65 66 67 68 69 70 71 72 73 |
int indef_level = 1; next_tag: if (unlikely(datalen - dp < 2)) { if (datalen == dp) goto missing_eoc; goto data_overrun_error; } /* Extract a tag from the data */ tag = data[dp++]; |
23c8a812d KEYS: Fix ASN.1 i... |
74 |
if (tag == ASN1_EOC) { |
42d5ec27f X.509: Add an ASN... |
75 76 77 |
/* It appears to be an EOC. */ if (data[dp++] != 0) goto invalid_eoc; |
dbadc1768 X.509: Fix indefi... |
78 79 80 81 82 |
if (--indef_level <= 0) { *_len = dp - *_dp; *_dp = dp; return 0; } |
42d5ec27f X.509: Add an ASN... |
83 84 |
goto next_tag; } |
99cca91e3 ASN.1: Use the AS... |
85 |
if (unlikely((tag & 0x1f) == ASN1_LONG_TAG)) { |
42d5ec27f X.509: Add an ASN... |
86 87 88 89 90 91 92 93 94 |
do { if (unlikely(datalen - dp < 2)) goto data_overrun_error; tmp = data[dp++]; } while (tmp & 0x80); } /* Extract the length */ len = data[dp++]; |
23c8a812d KEYS: Fix ASN.1 i... |
95 96 |
if (len <= 0x7f) goto check_length; |
42d5ec27f X.509: Add an ASN... |
97 |
|
99cca91e3 ASN.1: Use the AS... |
98 |
if (unlikely(len == ASN1_INDEFINITE_LENGTH)) { |
42d5ec27f X.509: Add an ASN... |
99 100 101 102 103 104 105 106 |
/* Indefinite length */ if (unlikely((tag & ASN1_CONS_BIT) == ASN1_PRIM << 5)) goto indefinite_len_primitive; indef_level++; goto next_tag; } n = len - 0x80; |
23c8a812d KEYS: Fix ASN.1 i... |
107 |
if (unlikely(n > sizeof(len) - 1)) |
42d5ec27f X.509: Add an ASN... |
108 109 110 |
goto length_too_long; if (unlikely(n > datalen - dp)) goto data_overrun_error; |
23c8a812d KEYS: Fix ASN.1 i... |
111 112 |
len = 0; for (; n > 0; n--) { |
42d5ec27f X.509: Add an ASN... |
113 114 115 |
len <<= 8; len |= data[dp++]; } |
23c8a812d KEYS: Fix ASN.1 i... |
116 117 118 |
check_length: if (len > datalen - dp) goto data_overrun_error; |
42d5ec27f X.509: Add an ASN... |
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 |
dp += len; goto next_tag; length_too_long: *_errmsg = "Unsupported length"; goto error; indefinite_len_primitive: *_errmsg = "Indefinite len primitive not permitted"; goto error; invalid_eoc: *_errmsg = "Invalid length EOC"; goto error; data_overrun_error: *_errmsg = "Data overrun error"; goto error; missing_eoc: *_errmsg = "Missing EOC in indefinite len cons"; error: |
dbadc1768 X.509: Fix indefi... |
137 |
*_dp = dp; |
42d5ec27f X.509: Add an ASN... |
138 139 140 141 142 143 144 145 |
return -1; } /** * asn1_ber_decoder - Decoder BER/DER/CER ASN.1 according to pattern * @decoder: The decoder definition (produced by asn1_compiler) * @context: The caller's context (to be passed to the action functions) * @data: The encoded data |
548bbff98 lib/asn1_decoder.... |
146 |
* @datalen: The size of the encoded data |
42d5ec27f X.509: Add an ASN... |
147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 |
* * Decode BER/DER/CER encoded ASN.1 data according to a bytecode pattern * produced by asn1_compiler. Action functions are called on marked tags to * allow the caller to retrieve significant data. * * LIMITATIONS: * * To keep down the amount of stack used by this function, the following limits * have been imposed: * * (1) This won't handle datalen > 65535 without increasing the size of the * cons stack elements and length_too_long checking. * * (2) The stack of constructed types is 10 deep. If the depth of non-leaf * constructed types exceeds this, the decode will fail. * * (3) The SET type (not the SET OF type) isn't really supported as tracking * what members of the set have been seen is a pain. */ int asn1_ber_decoder(const struct asn1_decoder *decoder, void *context, const unsigned char *data, size_t datalen) { const unsigned char *machine = decoder->machine; const asn1_action_t *actions = decoder->actions; size_t machlen = decoder->machlen; enum asn1_opcode op; unsigned char tag = 0, csp = 0, jsp = 0, optag = 0, hdr = 0; const char *errmsg; size_t pc = 0, dp = 0, tdp = 0, len = 0; int ret; unsigned char flags = 0; #define FLAG_INDEFINITE_LENGTH 0x01 #define FLAG_MATCHED 0x02 |
3f3af97d8 ASN.1: Fix action... |
183 |
#define FLAG_LAST_MATCHED 0x04 /* Last tag matched */ |
42d5ec27f X.509: Add an ASN... |
184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 |
#define FLAG_CONS 0x20 /* Corresponds to CONS bit in the opcode tag * - ie. whether or not we are going to parse * a compound type. */ #define NR_CONS_STACK 10 unsigned short cons_dp_stack[NR_CONS_STACK]; unsigned short cons_datalen_stack[NR_CONS_STACK]; unsigned char cons_hdrlen_stack[NR_CONS_STACK]; #define NR_JUMP_STACK 10 unsigned char jump_stack[NR_JUMP_STACK]; if (datalen > 65535) return -EMSGSIZE; next_op: pr_debug("next_op: pc=\e[32m%zu\e[m/%zu dp=\e[33m%zu\e[m/%zu C=%d J=%d ", pc, machlen, dp, datalen, csp, jsp); if (unlikely(pc >= machlen)) goto machine_overrun_error; op = machine[pc]; if (unlikely(pc + asn1_op_lengths[op] > machlen)) goto machine_overrun_error; /* If this command is meant to match a tag, then do that before * evaluating the command. */ if (op <= ASN1_OP__MATCHES_TAG) { unsigned char tmp; /* Skip conditional matches if possible */ |
0d62e9dd6 ASN.1: Fix non-ma... |
216 217 |
if ((op & ASN1_OP_MATCH__COND && flags & FLAG_MATCHED) || (op & ASN1_OP_MATCH__SKIP && dp == datalen)) { |
3f3af97d8 ASN.1: Fix action... |
218 |
flags &= ~FLAG_LAST_MATCHED; |
42d5ec27f X.509: Add an ASN... |
219 220 221 222 223 224 225 226 |
pc += asn1_op_lengths[op]; goto next_op; } flags = 0; hdr = 2; /* Extract a tag from the data */ |
624f5ab87 KEYS: fix NULL po... |
227 |
if (unlikely(datalen - dp < 2)) |
42d5ec27f X.509: Add an ASN... |
228 229 |
goto data_overrun_error; tag = data[dp++]; |
99cca91e3 ASN.1: Use the AS... |
230 |
if (unlikely((tag & 0x1f) == ASN1_LONG_TAG)) |
42d5ec27f X.509: Add an ASN... |
231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 |
goto long_tag_not_supported; if (op & ASN1_OP_MATCH__ANY) { pr_debug("- any %02x ", tag); } else { /* Extract the tag from the machine * - Either CONS or PRIM are permitted in the data if * CONS is not set in the op stream, otherwise CONS * is mandatory. */ optag = machine[pc + 1]; flags |= optag & FLAG_CONS; /* Determine whether the tag matched */ tmp = optag ^ tag; tmp &= ~(optag & ASN1_CONS_BIT); pr_debug("- match? %02x %02x %02x ", tag, optag, tmp); if (tmp != 0) { /* All odd-numbered tags are MATCH_OR_SKIP. */ if (op & ASN1_OP_MATCH__SKIP) { pc += asn1_op_lengths[op]; dp--; goto next_op; } goto tag_mismatch; } } flags |= FLAG_MATCHED; len = data[dp++]; if (len > 0x7f) { |
99cca91e3 ASN.1: Use the AS... |
264 |
if (unlikely(len == ASN1_INDEFINITE_LENGTH)) { |
42d5ec27f X.509: Add an ASN... |
265 266 267 268 269 270 271 272 273 274 |
/* Indefinite length */ if (unlikely(!(tag & ASN1_CONS_BIT))) goto indefinite_len_primitive; flags |= FLAG_INDEFINITE_LENGTH; if (unlikely(2 > datalen - dp)) goto data_overrun_error; } else { int n = len - 0x80; if (unlikely(n > 2)) goto length_too_long; |
624f5ab87 KEYS: fix NULL po... |
275 |
if (unlikely(n > datalen - dp)) |
42d5ec27f X.509: Add an ASN... |
276 277 278 279 280 281 282 283 284 |
goto data_overrun_error; hdr += n; for (len = 0; n > 0; n--) { len <<= 8; len |= data[dp++]; } if (unlikely(len > datalen - dp)) goto data_overrun_error; } |
2eb9eabf1 KEYS: fix out-of-... |
285 286 287 |
} else { if (unlikely(len > datalen - dp)) goto data_overrun_error; |
42d5ec27f X.509: Add an ASN... |
288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 |
} if (flags & FLAG_CONS) { /* For expected compound forms, we stack the positions * of the start and end of the data. */ if (unlikely(csp >= NR_CONS_STACK)) goto cons_stack_overflow; cons_dp_stack[csp] = dp; cons_hdrlen_stack[csp] = hdr; if (!(flags & FLAG_INDEFINITE_LENGTH)) { cons_datalen_stack[csp] = datalen; datalen = dp + len; } else { cons_datalen_stack[csp] = 0; } csp++; } pr_debug("- TAG: %02x %zu%s ", tag, len, flags & FLAG_CONS ? " CONS" : ""); tdp = dp; } /* Decide how to handle the operation */ switch (op) { |
42d5ec27f X.509: Add an ASN... |
315 316 |
case ASN1_OP_MATCH: case ASN1_OP_MATCH_OR_SKIP: |
e0058f3a8 ASN.1: fix out-of... |
317 318 |
case ASN1_OP_MATCH_ACT: case ASN1_OP_MATCH_ACT_OR_SKIP: |
42d5ec27f X.509: Add an ASN... |
319 |
case ASN1_OP_MATCH_ANY: |
233ce79db ASN.1: Handle 'AN... |
320 |
case ASN1_OP_MATCH_ANY_OR_SKIP: |
e0058f3a8 ASN.1: fix out-of... |
321 322 |
case ASN1_OP_MATCH_ANY_ACT: case ASN1_OP_MATCH_ANY_ACT_OR_SKIP: |
42d5ec27f X.509: Add an ASN... |
323 |
case ASN1_OP_COND_MATCH_OR_SKIP: |
e0058f3a8 ASN.1: fix out-of... |
324 |
case ASN1_OP_COND_MATCH_ACT_OR_SKIP: |
42d5ec27f X.509: Add an ASN... |
325 |
case ASN1_OP_COND_MATCH_ANY: |
233ce79db ASN.1: Handle 'AN... |
326 |
case ASN1_OP_COND_MATCH_ANY_OR_SKIP: |
e0058f3a8 ASN.1: fix out-of... |
327 328 |
case ASN1_OP_COND_MATCH_ANY_ACT: case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP: |
42d5ec27f X.509: Add an ASN... |
329 330 |
if (!(flags & FLAG_CONS)) { if (flags & FLAG_INDEFINITE_LENGTH) { |
e0058f3a8 ASN.1: fix out-of... |
331 |
size_t tmp = dp; |
dbadc1768 X.509: Fix indefi... |
332 |
ret = asn1_find_indefinite_length( |
e0058f3a8 ASN.1: fix out-of... |
333 |
data, datalen, &tmp, &len, &errmsg); |
dbadc1768 X.509: Fix indefi... |
334 |
if (ret < 0) |
42d5ec27f X.509: Add an ASN... |
335 336 337 338 |
goto error; } pr_debug("- LEAF: %zu ", len); |
42d5ec27f X.509: Add an ASN... |
339 |
} |
e0058f3a8 ASN.1: fix out-of... |
340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 |
if (op & ASN1_OP_MATCH__ACT) { unsigned char act; if (op & ASN1_OP_MATCH__ANY) act = machine[pc + 1]; else act = machine[pc + 2]; ret = actions[act](context, hdr, tag, data + dp, len); if (ret < 0) return ret; } if (!(flags & FLAG_CONS)) dp += len; |
42d5ec27f X.509: Add an ASN... |
355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 |
pc += asn1_op_lengths[op]; goto next_op; case ASN1_OP_MATCH_JUMP: case ASN1_OP_MATCH_JUMP_OR_SKIP: case ASN1_OP_COND_MATCH_JUMP_OR_SKIP: pr_debug("- MATCH_JUMP "); if (unlikely(jsp == NR_JUMP_STACK)) goto jump_stack_overflow; jump_stack[jsp++] = pc + asn1_op_lengths[op]; pc = machine[pc + 2]; goto next_op; case ASN1_OP_COND_FAIL: if (unlikely(!(flags & FLAG_MATCHED))) goto tag_mismatch; pc += asn1_op_lengths[op]; goto next_op; case ASN1_OP_COMPLETE: if (unlikely(jsp != 0 || csp != 0)) { pr_err("ASN.1 decoder error: Stacks not empty at completion (%u, %u) ", jsp, csp); return -EBADMSG; } return 0; case ASN1_OP_END_SET: case ASN1_OP_END_SET_ACT: if (unlikely(!(flags & FLAG_MATCHED))) goto tag_mismatch; |
afb33e40d ASN.1: mark expec... |
388 |
/* fall through */ |
42d5ec27f X.509: Add an ASN... |
389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 |
case ASN1_OP_END_SEQ: case ASN1_OP_END_SET_OF: case ASN1_OP_END_SEQ_OF: case ASN1_OP_END_SEQ_ACT: case ASN1_OP_END_SET_OF_ACT: case ASN1_OP_END_SEQ_OF_ACT: if (unlikely(csp <= 0)) goto cons_stack_underflow; csp--; tdp = cons_dp_stack[csp]; hdr = cons_hdrlen_stack[csp]; len = datalen; datalen = cons_datalen_stack[csp]; pr_debug("- end cons t=%zu dp=%zu l=%zu/%zu ", tdp, dp, len, datalen); if (datalen == 0) { /* Indefinite length - check for the EOC. */ datalen = len; if (unlikely(datalen - dp < 2)) goto data_overrun_error; if (data[dp++] != 0) { if (op & ASN1_OP_END__OF) { dp--; csp++; pc = machine[pc + 1]; pr_debug("- continue "); goto next_op; } goto missing_eoc; } if (data[dp++] != 0) goto invalid_eoc; len = dp - tdp - 2; } else { if (dp < len && (op & ASN1_OP_END__OF)) { datalen = len; csp++; pc = machine[pc + 1]; pr_debug("- continue "); goto next_op; } if (dp != len) goto cons_length_error; len -= tdp; pr_debug("- cons len l=%zu d=%zu ", len, dp - tdp); } if (op & ASN1_OP_END__ACT) { unsigned char act; if (op & ASN1_OP_END__OF) act = machine[pc + 2]; else act = machine[pc + 1]; ret = actions[act](context, hdr, 0, data + tdp, len); |
81a7be2cd ASN.1: check for ... |
447 448 |
if (ret < 0) return ret; |
42d5ec27f X.509: Add an ASN... |
449 450 451 |
} pc += asn1_op_lengths[op]; goto next_op; |
3f3af97d8 ASN.1: Fix action... |
452 453 454 455 456 |
case ASN1_OP_MAYBE_ACT: if (!(flags & FLAG_LAST_MATCHED)) { pc += asn1_op_lengths[op]; goto next_op; } |
afb33e40d ASN.1: mark expec... |
457 |
/* fall through */ |
42d5ec27f X.509: Add an ASN... |
458 459 |
case ASN1_OP_ACT: ret = actions[machine[pc + 1]](context, hdr, tag, data + tdp, len); |
3f3af97d8 ASN.1: Fix action... |
460 461 |
if (ret < 0) return ret; |
42d5ec27f X.509: Add an ASN... |
462 463 464 465 466 467 468 |
pc += asn1_op_lengths[op]; goto next_op; case ASN1_OP_RETURN: if (unlikely(jsp <= 0)) goto jump_stack_underflow; pc = jump_stack[--jsp]; |
3f3af97d8 ASN.1: Fix action... |
469 |
flags |= FLAG_MATCHED | FLAG_LAST_MATCHED; |
42d5ec27f X.509: Add an ASN... |
470 471 472 473 474 475 476 |
goto next_op; default: break; } /* Shouldn't reach here */ |
3f3af97d8 ASN.1: Fix action... |
477 478 479 |
pr_err("ASN.1 decoder error: Found reserved opcode (%u) pc=%zu ", op, pc); |
42d5ec27f X.509: Add an ASN... |
480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 |
return -EBADMSG; data_overrun_error: errmsg = "Data overrun error"; goto error; machine_overrun_error: errmsg = "Machine overrun error"; goto error; jump_stack_underflow: errmsg = "Jump stack underflow"; goto error; jump_stack_overflow: errmsg = "Jump stack overflow"; goto error; cons_stack_underflow: errmsg = "Cons stack underflow"; goto error; cons_stack_overflow: errmsg = "Cons stack overflow"; goto error; cons_length_error: errmsg = "Cons length error"; goto error; missing_eoc: errmsg = "Missing EOC in indefinite len cons"; goto error; invalid_eoc: errmsg = "Invalid length EOC"; goto error; length_too_long: errmsg = "Unsupported length"; goto error; indefinite_len_primitive: errmsg = "Indefinite len primitive not permitted"; goto error; tag_mismatch: errmsg = "Unexpected tag"; goto error; long_tag_not_supported: errmsg = "Long tag not supported"; error: pr_debug(" ASN1: %s [m=%zu d=%zu ot=%02x t=%02x l=%zu] ", errmsg, pc, dp, optag, tag, len); return -EBADMSG; } EXPORT_SYMBOL_GPL(asn1_ber_decoder); |
ccab6058d lib: asn1_decoder... |
528 529 |
MODULE_LICENSE("GPL"); |