xref: /PHP-8.2/ext/fileinfo/libmagic/der.c (revision 3b9173dc)
1 /*-
2  * Copyright (c) 2016 Christos Zoulas
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
15  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
16  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
18  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24  * POSSIBILITY OF SUCH DAMAGE.
25  */
26 /*
27  * DER (Distinguished Encoding Rules) Parser
28  *
29  * Sources:
30  * https://en.wikipedia.org/wiki/X.690
31  * http://fm4dd.com/openssl/certexamples.htm
32  * http://blog.engelke.com/2014/10/17/parsing-ber-and-der-encoded-asn-1-objects/
33  */
34 #ifndef TEST_DER
35 #include "file.h"
36 
37 #ifndef lint
38 FILE_RCSID("@(#)$File: der.c,v 1.21 2020/06/15 00:58:10 christos Exp $")
39 #endif
40 #else
41 #define SIZE_T_FORMAT "z"
42 #define CAST(a, b) ((a)(b))
43 #endif
44 
45 #include <sys/types.h>
46 
47 #include <stdio.h>
48 #include <fcntl.h>
49 #include <stdlib.h>
50 #include <string.h>
51 #include <ctype.h>
52 
53 #ifndef TEST_DER
54 #include "magic.h"
55 #include "der.h"
56 #else
57 #ifndef PHP_WIN32
58 #include <sys/mman.h>
59 #endif
60 #include <sys/stat.h>
61 #include <err.h>
62 #endif
63 
64 #define DER_BAD	CAST(uint32_t, -1)
65 
66 #define DER_CLASS_UNIVERSAL	0
67 #define	DER_CLASS_APPLICATION	1
68 #define	DER_CLASS_CONTEXT	2
69 #define	DER_CLASS_PRIVATE	3
70 #if defined(DEBUG_DER) || defined(TEST_DER)
71 static const char der_class[] = "UACP";
72 #endif
73 
74 #define DER_TYPE_PRIMITIVE	0
75 #define DER_TYPE_CONSTRUCTED	1
76 #if defined(DEBUG_DER) || defined(TEST_DER)
77 static const char der_type[] = "PC";
78 #endif
79 
80 #define	DER_TAG_EOC			0x00
81 #define	DER_TAG_BOOLEAN			0x01
82 #define	DER_TAG_INTEGER			0x02
83 #define	DER_TAG_BIT STRING		0x03
84 #define	DER_TAG_OCTET_STRING		0x04
85 #define	DER_TAG_NULL			0x05
86 #define	DER_TAG_OBJECT_IDENTIFIER	0x06
87 #define	DER_TAG_OBJECT_DESCRIPTOR	0x07
88 #define	DER_TAG_EXTERNAL		0x08
89 #define	DER_TAG_REAL			0x09
90 #define	DER_TAG_ENUMERATED		0x0a
91 #define	DER_TAG_EMBEDDED_PDV		0x0b
92 #define	DER_TAG_UTF8_STRING		0x0c
93 #define	DER_TAG_RELATIVE_OID		0x0d
94 #define DER_TAG_TIME			0x0e
95 #define DER_TAG_RESERVED_2		0x0f
96 #define	DER_TAG_SEQUENCE		0x10
97 #define	DER_TAG_SET			0x11
98 #define	DER_TAG_NUMERIC_STRING		0x12
99 #define	DER_TAG_PRINTABLE_STRING	0x13
100 #define	DER_TAG_T61_STRING		0x14
101 #define	DER_TAG_VIDEOTEX_STRING		0x15
102 #define	DER_TAG_IA5_STRING		0x16
103 #define	DER_TAG_UTCTIME			0x17
104 #define	DER_TAG_GENERALIZED_TIME	0x18
105 #define	DER_TAG_GRAPHIC_STRING		0x19
106 #define	DER_TAG_VISIBLE_STRING		0x1a
107 #define	DER_TAG_GENERAL_STRING		0x1b
108 #define	DER_TAG_UNIVERSAL_STRING	0x1c
109 #define	DER_TAG_CHARACTER_STRING	0x1d
110 #define	DER_TAG_BMP_STRING		0x1e
111 #define	DER_TAG_DATE			0x1f
112 #define	DER_TAG_TIME_OF_DAY		0x20
113 #define	DER_TAG_DATE_TIME		0x21
114 #define	DER_TAG_DURATION		0x22
115 #define	DER_TAG_OID_IRI			0x23
116 #define	DER_TAG_RELATIVE_OID_IRI	0x24
117 #define	DER_TAG_LAST			0x25
118 
119 static const char *der__tag[] = {
120 	"eoc", "bool", "int", "bit_str", "octet_str",
121 	"null", "obj_id", "obj_desc", "ext", "real",
122 	"enum", "embed", "utf8_str", "rel_oid", "time",
123 	"res2", "seq", "set", "num_str", "prt_str",
124 	"t61_str", "vid_str", "ia5_str", "utc_time", "gen_time",
125 	"gr_str", "vis_str", "gen_str", "univ_str", "char_str",
126 	"bmp_str", "date", "tod", "datetime", "duration",
127 	"oid-iri", "rel-oid-iri",
128 };
129 
130 #ifdef DEBUG_DER
131 #define DPRINTF(a) printf a
132 #else
133 #define DPRINTF(a)
134 #endif
135 
136 #ifdef TEST_DER
137 static uint8_t
getclass(uint8_t c)138 getclass(uint8_t c)
139 {
140 	return c >> 6;
141 }
142 
143 static uint8_t
gettype(uint8_t c)144 gettype(uint8_t c)
145 {
146 	return (c >> 5) & 1;
147 }
148 #endif
149 
150 static uint32_t
gettag(const uint8_t * c,size_t * p,size_t l)151 gettag(const uint8_t *c, size_t *p, size_t l)
152 {
153 	uint32_t tag;
154 
155 	if (*p >= l)
156 		return DER_BAD;
157 
158 	tag = c[(*p)++] & 0x1f;
159 
160 	if (tag != 0x1f)
161 		return tag;
162 
163 	if (*p >= l)
164 		return DER_BAD;
165 
166 	while (c[*p] >= 0x80) {
167 		tag = tag * 128 + c[(*p)++] - 0x80;
168 		if (*p >= l)
169 			return DER_BAD;
170 	}
171 	return tag;
172 }
173 
174 /*
175  * Read the length of a DER tag from the input.
176  *
177  * `c` is the input, `p` is an output parameter that specifies how much of the
178  * input we consumed, and `l` is the maximum input length.
179  *
180  * Returns the length, or DER_BAD if the end of the input is reached or the
181  * length exceeds the remaining input.
182  */
183 static uint32_t
getlength(const uint8_t * c,size_t * p,size_t l)184 getlength(const uint8_t *c, size_t *p, size_t l)
185 {
186 	uint8_t digits, i;
187 	size_t len;
188 	int is_onebyte_result;
189 
190 	if (*p >= l) {
191 		DPRINTF(("%s:[1] %zu >= %zu\n", __func__, *p, l));
192 		return DER_BAD;
193 	}
194 
195 	/*
196 	 * Digits can either be 0b0 followed by the result, or 0b1
197 	 * followed by the number of digits of the result. In either case,
198 	 * we verify that we can read so many bytes from the input.
199 	 */
200 	is_onebyte_result = (c[*p] & 0x80) == 0;
201 	digits = c[(*p)++] & 0x7f;
202 	if (*p + digits >= l) {
203 		DPRINTF(("%s:[2] %zu + %u >= %zu\n", __func__, *p, digits, l));
204 		return DER_BAD;
205 	}
206 
207 	if (is_onebyte_result)
208 		return digits;
209 
210 	/*
211 	 * Decode len. We've already verified that we're allowed to read
212 	 * `digits` bytes.
213 	 */
214 	len = 0;
215 	for (i = 0; i < digits; i++)
216 		len = (len << 8) | c[(*p)++];
217 
218 	if (len > UINT32_MAX - *p || *p + len > l) {
219 		DPRINTF(("%s:[3] bad len %zu + %zu >= %zu\n",
220 		    __func__, *p, len, l));
221 		return DER_BAD;
222 	}
223 	return CAST(uint32_t, len);
224 }
225 
226 static const char *
der_tag(char * buf,size_t len,uint32_t tag)227 der_tag(char *buf, size_t len, uint32_t tag)
228 {
229 	if (tag < DER_TAG_LAST)
230 		strlcpy(buf, der__tag[tag], len);
231 	else
232 		snprintf(buf, len, "%#x", tag);
233 	return buf;
234 }
235 
236 #ifndef TEST_DER
237 static int
der_data(char * buf,size_t blen,uint32_t tag,const void * q,uint32_t len)238 der_data(char *buf, size_t blen, uint32_t tag, const void *q, uint32_t len)
239 {
240 	const uint8_t *d = CAST(const uint8_t *, q);
241 	switch (tag) {
242 	case DER_TAG_PRINTABLE_STRING:
243 	case DER_TAG_UTF8_STRING:
244 	case DER_TAG_IA5_STRING:
245 		return snprintf(buf, blen, "%.*s", len, RCAST(const char *, q));
246 	case DER_TAG_UTCTIME:
247 		if (len < 12)
248 			break;
249 		return snprintf(buf, blen,
250 		    "20%c%c-%c%c-%c%c %c%c:%c%c:%c%c GMT", d[0], d[1], d[2],
251 		    d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11]);
252 	default:
253 		break;
254 	}
255 
256 	for (uint32_t i = 0; i < len; i++) {
257 		uint32_t z = i << 1;
258 		if (z < blen - 2)
259 			snprintf(buf + z, blen - z, "%.2x", d[i]);
260 	}
261 	return len * 2;
262 }
263 
264 int32_t
der_offs(struct magic_set * ms,struct magic * m,size_t nbytes)265 der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
266 {
267 	const uint8_t *b = RCAST(const uint8_t *, ms->search.s);
268 	size_t offs = 0, len = ms->search.s_len ? ms->search.s_len : nbytes;
269 
270 	if (gettag(b, &offs, len) == DER_BAD) {
271 		DPRINTF(("%s: bad tag 1\n", __func__));
272 		return -1;
273 	}
274 	DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
275 	    offs, m->offset));
276 
277 	uint32_t tlen = getlength(b, &offs, len);
278 	if (tlen == DER_BAD) {
279 		DPRINTF(("%s: bad tag 2\n", __func__));
280 		return -1;
281 	}
282 	DPRINTF(("%s2: %d %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
283 	    offs, tlen));
284 
285 	offs += ms->offset + m->offset;
286 	DPRINTF(("cont_level = %d\n", m->cont_level));
287 #ifdef DEBUG_DER
288 	for (size_t i = 0; i < m->cont_level; i++)
289 		printf("cont_level[%" SIZE_T_FORMAT "u] = %u\n", i,
290 		    ms->c.li[i].off);
291 #endif
292 	if (m->cont_level != 0) {
293 		if (offs + tlen > nbytes)
294 			return -1;
295 		ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen);
296 		DPRINTF(("cont_level[%u] = %u\n", m->cont_level - 1,
297 		    ms->c.li[m->cont_level - 1].off));
298 	}
299 	return CAST(int32_t, offs);
300 }
301 
302 int
der_cmp(struct magic_set * ms,struct magic * m)303 der_cmp(struct magic_set *ms, struct magic *m)
304 {
305 	const uint8_t *b = RCAST(const uint8_t *, ms->search.s);
306 	const char *s = m->value.s;
307 	size_t offs = 0, len = ms->search.s_len;
308 	uint32_t tag, tlen;
309 	char buf[128];
310 
311 	DPRINTF(("%s: compare %zu bytes\n", __func__, len));
312 
313 	tag = gettag(b, &offs, len);
314 	if (tag == DER_BAD) {
315 		DPRINTF(("%s: bad tag 1\n", __func__));
316 		return -1;
317 	}
318 
319 	DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
320 	    offs, m->offset));
321 
322 	tlen = getlength(b, &offs, len);
323 	if (tlen == DER_BAD) {
324 		DPRINTF(("%s: bad tag 2\n", __func__));
325 		return -1;
326 	}
327 
328 	der_tag(buf, sizeof(buf), tag);
329 	if ((ms->flags & MAGIC_DEBUG) != 0)
330 		fprintf(stderr, "%s: tag %p got=%s exp=%s\n", __func__, b,
331 		    buf, s);
332 	size_t slen = strlen(buf);
333 
334 	if (strncmp(buf, s, slen) != 0)
335 		return 0;
336 
337 	s += slen;
338 
339 again:
340 	switch (*s) {
341 	case '\0':
342 		return 1;
343 	case '=':
344 		s++;
345 		goto val;
346 	default:
347 		if (!isdigit(CAST(unsigned char, *s)))
348 			return 0;
349 
350 		slen = 0;
351 		do
352 			slen = slen * 10 + *s - '0';
353 		while (isdigit(CAST(unsigned char, *++s)));
354 		if ((ms->flags & MAGIC_DEBUG) != 0)
355 			fprintf(stderr, "%s: len %" SIZE_T_FORMAT "u %u\n",
356 			    __func__, slen, tlen);
357 		if (tlen != slen)
358 			return 0;
359 		goto again;
360 	}
361 val:
362 	DPRINTF(("%s: before data %" SIZE_T_FORMAT "u %u\n", __func__, offs,
363 	    tlen));
364 	der_data(buf, sizeof(buf), tag, b + offs, tlen);
365 	if ((ms->flags & MAGIC_DEBUG) != 0)
366 		fprintf(stderr, "%s: data %s %s\n", __func__, buf, s);
367 	if (strcmp(buf, s) != 0 && strcmp("x", s) != 0)
368 		return 0;
369 	strlcpy(ms->ms_value.s, buf, sizeof(ms->ms_value.s));
370 	return 1;
371 }
372 #endif
373 
374 #ifdef TEST_DER
375 static void
printtag(uint32_t tag,const void * q,uint32_t len)376 printtag(uint32_t tag, const void *q, uint32_t len)
377 {
378 	const uint8_t *d = q;
379 	switch (tag) {
380 	case DER_TAG_PRINTABLE_STRING:
381 	case DER_TAG_UTF8_STRING:
382 	case DER_TAG_IA5_STRING:
383 	case DER_TAG_UTCTIME:
384 		printf("%.*s\n", len, (const char *)q);
385 		return;
386 	default:
387 		break;
388 	}
389 
390 	for (uint32_t i = 0; i < len; i++)
391 		printf("%.2x", d[i]);
392 	printf("\n");
393 }
394 
395 static void
printdata(size_t level,const void * v,size_t x,size_t l)396 printdata(size_t level, const void *v, size_t x, size_t l)
397 {
398 	const uint8_t *p = v, *ep = p + l;
399 	size_t ox;
400 	char buf[128];
401 
402 	while (p + x < ep) {
403 		const uint8_t *q;
404 		uint8_t c = getclass(p[x]);
405 		uint8_t t = gettype(p[x]);
406 		ox = x;
407 //		if (x != 0)
408 //		printf("%.2x %.2x %.2x\n", p[x - 1], p[x], p[x + 1]);
409 		uint32_t tag = gettag(p, &x, ep - p + x);
410 		if (p + x >= ep)
411 			break;
412 		uint32_t len = getlength(p, &x, ep - p + x);
413 
414 		printf("%" SIZE_T_FORMAT "u %" SIZE_T_FORMAT "u-%"
415 		    SIZE_T_FORMAT "u %c,%c,%s,%u:", level, ox, x,
416 		    der_class[c], der_type[t],
417 		    der_tag(buf, sizeof(buf), tag), len);
418 		q = p + x;
419 		if (p + len > ep)
420 			errx(EXIT_FAILURE, "corrupt der");
421 		printtag(tag, q, len);
422 		if (t != DER_TYPE_PRIMITIVE)
423 			printdata(level + 1, p, x, len + x);
424 		x += len;
425 	}
426 }
427 
428 int
main(int argc,char * argv[])429 main(int argc, char *argv[])
430 {
431 	int fd;
432 	struct stat st;
433 	size_t l;
434 	void *p;
435 
436 	if ((fd = open(argv[1], O_RDONLY)) == -1)
437 		err(EXIT_FAILURE, "open `%s'", argv[1]);
438 	if (fstat(fd, &st) == -1)
439 		err(EXIT_FAILURE, "stat `%s'", argv[1]);
440 	l = (size_t)st.st_size;
441 	if ((p = mmap(NULL, l, PROT_READ, MAP_FILE, fd, 0)) == MAP_FAILED)
442 		err(EXIT_FAILURE, "mmap `%s'", argv[1]);
443 
444 	printdata(0, p, 0, l);
445 	munmap(p, l);
446 	return 0;
447 }
448 #endif
449