1 /*-
2 * Copyright (c) 2016 Christos Zoulas
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
15 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
16 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
18 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24 * POSSIBILITY OF SUCH DAMAGE.
25 */
26 /*
27 * DER (Distinguished Encoding Rules) Parser
28 *
29 * Sources:
30 * https://en.wikipedia.org/wiki/X.690
31 * http://fm4dd.com/openssl/certexamples.htm
32 * http://blog.engelke.com/2014/10/17/parsing-ber-and-der-encoded-asn-1-objects/
33 */
34 #ifndef TEST_DER
35 #include "file.h"
36
37 #ifndef lint
38 FILE_RCSID("@(#)$File: der.c,v 1.27 2022/09/24 20:30:13 christos Exp $")
39 #endif
40 #else
41 #define SIZE_T_FORMAT "z"
42 #define CAST(a, b) ((a)(b))
43 #endif
44
45 #include <sys/types.h>
46
47 #include <stdio.h>
48 #include <fcntl.h>
49 #include <stdlib.h>
50 #include <string.h>
51 #include <ctype.h>
52
53 #ifndef TEST_DER
54 #include "magic.h"
55 #include "der.h"
56 #else
57 #ifdef HAVE_SYS_MMAN_H
58 #include <sys/mman.h>
59 #endif
60 #include <sys/stat.h>
61 #include <err.h>
62 #endif
63
64 #define DER_BAD CAST(uint32_t, -1)
65
66 #define DER_CLASS_UNIVERSAL 0
67 #define DER_CLASS_APPLICATION 1
68 #define DER_CLASS_CONTEXT 2
69 #define DER_CLASS_PRIVATE 3
70 #if defined(DEBUG_DER) || defined(TEST_DER)
71 static const char der_class[] = "UACP";
72 #endif
73
74 #define DER_TYPE_PRIMITIVE 0
75 #define DER_TYPE_CONSTRUCTED 1
76 #if defined(DEBUG_DER) || defined(TEST_DER)
77 static const char der_type[] = "PC";
78 #endif
79
80 #define DER_TAG_EOC 0x00
81 #define DER_TAG_BOOLEAN 0x01
82 #define DER_TAG_INTEGER 0x02
83 #define DER_TAG_BIT STRING 0x03
84 #define DER_TAG_OCTET_STRING 0x04
85 #define DER_TAG_NULL 0x05
86 #define DER_TAG_OBJECT_IDENTIFIER 0x06
87 #define DER_TAG_OBJECT_DESCRIPTOR 0x07
88 #define DER_TAG_EXTERNAL 0x08
89 #define DER_TAG_REAL 0x09
90 #define DER_TAG_ENUMERATED 0x0a
91 #define DER_TAG_EMBEDDED_PDV 0x0b
92 #define DER_TAG_UTF8_STRING 0x0c
93 #define DER_TAG_RELATIVE_OID 0x0d
94 #define DER_TAG_TIME 0x0e
95 #define DER_TAG_RESERVED_2 0x0f
96 #define DER_TAG_SEQUENCE 0x10
97 #define DER_TAG_SET 0x11
98 #define DER_TAG_NUMERIC_STRING 0x12
99 #define DER_TAG_PRINTABLE_STRING 0x13
100 #define DER_TAG_T61_STRING 0x14
101 #define DER_TAG_VIDEOTEX_STRING 0x15
102 #define DER_TAG_IA5_STRING 0x16
103 #define DER_TAG_UTCTIME 0x17
104 #define DER_TAG_GENERALIZED_TIME 0x18
105 #define DER_TAG_GRAPHIC_STRING 0x19
106 #define DER_TAG_VISIBLE_STRING 0x1a
107 #define DER_TAG_GENERAL_STRING 0x1b
108 #define DER_TAG_UNIVERSAL_STRING 0x1c
109 #define DER_TAG_CHARACTER_STRING 0x1d
110 #define DER_TAG_BMP_STRING 0x1e
111 #define DER_TAG_DATE 0x1f
112 #define DER_TAG_TIME_OF_DAY 0x20
113 #define DER_TAG_DATE_TIME 0x21
114 #define DER_TAG_DURATION 0x22
115 #define DER_TAG_OID_IRI 0x23
116 #define DER_TAG_RELATIVE_OID_IRI 0x24
117 #define DER_TAG_LAST 0x25
118
119 static const char *der__tag[] = {
120 "eoc", "bool", "int", "bit_str", "octet_str",
121 "null", "obj_id", "obj_desc", "ext", "real",
122 "enum", "embed", "utf8_str", "rel_oid", "time",
123 "res2", "seq", "set", "num_str", "prt_str",
124 "t61_str", "vid_str", "ia5_str", "utc_time", "gen_time",
125 "gr_str", "vis_str", "gen_str", "univ_str", "char_str",
126 "bmp_str", "date", "tod", "datetime", "duration",
127 "oid-iri", "rel-oid-iri",
128 };
129
130 #ifdef DEBUG_DER
131 #define DPRINTF(a) printf a
132 #else
133 #define DPRINTF(a)
134 #endif
135
136 #ifdef TEST_DER
137 static uint8_t
getclass(uint8_t c)138 getclass(uint8_t c)
139 {
140 return c >> 6;
141 }
142
143 static uint8_t
gettype(uint8_t c)144 gettype(uint8_t c)
145 {
146 return (c >> 5) & 1;
147 }
148 #endif
149
150 static uint32_t
gettag(const uint8_t * c,size_t * p,size_t l)151 gettag(const uint8_t *c, size_t *p, size_t l)
152 {
153 uint32_t tag;
154
155 if (*p >= l)
156 return DER_BAD;
157
158 tag = c[(*p)++] & 0x1f;
159
160 if (tag != 0x1f)
161 return tag;
162
163 if (*p >= l)
164 return DER_BAD;
165
166 while (c[*p] >= 0x80) {
167 tag = tag * 128 + c[(*p)++] - 0x80;
168 if (*p >= l)
169 return DER_BAD;
170 }
171 return tag;
172 }
173
174 /*
175 * Read the length of a DER tag from the input.
176 *
177 * `c` is the input, `p` is an output parameter that specifies how much of the
178 * input we consumed, and `l` is the maximum input length.
179 *
180 * Returns the length, or DER_BAD if the end of the input is reached or the
181 * length exceeds the remaining input.
182 */
183 static uint32_t
getlength(const uint8_t * c,size_t * p,size_t l)184 getlength(const uint8_t *c, size_t *p, size_t l)
185 {
186 uint8_t digits, i;
187 size_t len;
188 int is_onebyte_result;
189
190 if (*p >= l) {
191 DPRINTF(("%s:[1] %zu >= %zu\n", __func__, *p, l));
192 return DER_BAD;
193 }
194
195 /*
196 * Digits can either be 0b0 followed by the result, or 0b1
197 * followed by the number of digits of the result. In either case,
198 * we verify that we can read so many bytes from the input.
199 */
200 is_onebyte_result = (c[*p] & 0x80) == 0;
201 digits = c[(*p)++] & 0x7f;
202 if (*p + digits >= l) {
203 DPRINTF(("%s:[2] %zu + %u >= %zu\n", __func__, *p, digits, l));
204 return DER_BAD;
205 }
206
207 if (is_onebyte_result)
208 return digits;
209
210 /*
211 * Decode len. We've already verified that we're allowed to read
212 * `digits` bytes.
213 */
214 len = 0;
215 for (i = 0; i < digits; i++)
216 len = (len << 8) | c[(*p)++];
217
218 if (len > UINT32_MAX - *p || *p + len > l) {
219 DPRINTF(("%s:[3] bad len %zu + %zu >= %zu\n",
220 __func__, *p, len, l));
221 return DER_BAD;
222 }
223 return CAST(uint32_t, len);
224 }
225
226 static const char *
der_tag(char * buf,size_t len,uint32_t tag)227 der_tag(char *buf, size_t len, uint32_t tag)
228 {
229 if (tag < DER_TAG_LAST)
230 strlcpy(buf, der__tag[tag], len);
231 else
232 snprintf(buf, len, "%#x", tag);
233 return buf;
234 }
235
236 #ifndef TEST_DER
237 static int
der_data(char * buf,size_t blen,uint32_t tag,const void * q,uint32_t len)238 der_data(char *buf, size_t blen, uint32_t tag, const void *q, uint32_t len)
239 {
240 uint32_t i;
241 const uint8_t *d = CAST(const uint8_t *, q);
242 switch (tag) {
243 case DER_TAG_PRINTABLE_STRING:
244 case DER_TAG_UTF8_STRING:
245 case DER_TAG_IA5_STRING:
246 return snprintf(buf, blen, "%.*s", len, RCAST(const char *, q));
247 case DER_TAG_UTCTIME:
248 if (len < 12)
249 break;
250 return snprintf(buf, blen,
251 "20%c%c-%c%c-%c%c %c%c:%c%c:%c%c GMT", d[0], d[1], d[2],
252 d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11]);
253 default:
254 break;
255 }
256
257 for (i = 0; i < len; i++) {
258 uint32_t z = i << 1;
259 if (z < blen - 2)
260 snprintf(buf + z, blen - z, "%.2x", d[i]);
261 }
262 return len * 2;
263 }
264
265 int32_t
der_offs(struct magic_set * ms,struct magic * m,size_t nbytes)266 der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
267 {
268 const uint8_t *b = RCAST(const uint8_t *, ms->search.s);
269 size_t offs = 0, len = ms->search.s_len ? ms->search.s_len : nbytes;
270
271 if (gettag(b, &offs, len) == DER_BAD) {
272 DPRINTF(("%s: bad tag 1\n", __func__));
273 return -1;
274 }
275 DPRINTF(("%s1: %u %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset,
276 offs, m->offset));
277
278 uint32_t tlen = getlength(b, &offs, len);
279 if (tlen == DER_BAD) {
280 DPRINTF(("%s: bad tag 2\n", __func__));
281 return -1;
282 }
283 DPRINTF(("%s2: %u %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
284 offs, tlen));
285
286 offs += ms->offset + m->offset;
287 DPRINTF(("cont_level = %d\n", m->cont_level));
288 #ifdef DEBUG_DER
289 size_t i;
290 for (i = 0; i < m->cont_level; i++)
291 printf("cont_level[%" SIZE_T_FORMAT "u] = %d\n", i,
292 ms->c.li[i].off);
293 #endif
294 if (m->cont_level != 0) {
295 if (offs + tlen > nbytes)
296 return -1;
297 ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen);
298 DPRINTF(("cont_level[%u] = %d\n", m->cont_level - 1,
299 ms->c.li[m->cont_level - 1].off));
300 }
301 return CAST(int32_t, offs);
302 }
303
304 int
der_cmp(struct magic_set * ms,struct magic * m)305 der_cmp(struct magic_set *ms, struct magic *m)
306 {
307 const uint8_t *b = RCAST(const uint8_t *, ms->search.s);
308 const char *s = m->value.s;
309 size_t offs = 0, len = ms->search.s_len;
310 uint32_t tag, tlen;
311 char buf[128];
312
313 DPRINTF(("%s: compare %zu bytes\n", __func__, len));
314
315 tag = gettag(b, &offs, len);
316 if (tag == DER_BAD) {
317 DPRINTF(("%s: bad tag 1\n", __func__));
318 return -1;
319 }
320
321 DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset,
322 offs, m->offset));
323
324 tlen = getlength(b, &offs, len);
325 if (tlen == DER_BAD) {
326 DPRINTF(("%s: bad tag 2\n", __func__));
327 return -1;
328 }
329
330 der_tag(buf, sizeof(buf), tag);
331 if ((ms->flags & MAGIC_DEBUG) != 0)
332 fprintf(stderr, "%s: tag %p got=%s exp=%s\n", __func__, b,
333 buf, s);
334 size_t slen = strlen(buf);
335
336 if (strncmp(buf, s, slen) != 0) {
337 DPRINTF(("%s: no string match %s != %s\n", __func__, buf, s));
338 return 0;
339 }
340
341 s += slen;
342
343 again:
344 switch (*s) {
345 case '\0':
346 DPRINTF(("%s: EOF match\n", __func__));
347 return 1;
348 case '=':
349 s++;
350 goto val;
351 default:
352 if (!isdigit(CAST(unsigned char, *s))) {
353 DPRINTF(("%s: no digit %c\n", __func__, *s));
354 return 0;
355 }
356
357 slen = 0;
358 do
359 slen = slen * 10 + *s - '0';
360 while (isdigit(CAST(unsigned char, *++s)));
361 if ((ms->flags & MAGIC_DEBUG) != 0)
362 fprintf(stderr, "%s: len %" SIZE_T_FORMAT "u %u\n",
363 __func__, slen, tlen);
364 if (tlen != slen) {
365 DPRINTF(("%s: len %u != %zu\n", __func__, tlen, slen));
366 return 0;
367 }
368 goto again;
369 }
370 val:
371 DPRINTF(("%s: before data %" SIZE_T_FORMAT "u %u\n", __func__, offs,
372 tlen));
373 der_data(buf, sizeof(buf), tag, b + offs, tlen);
374 if ((ms->flags & MAGIC_DEBUG) != 0)
375 fprintf(stderr, "%s: data %s %s\n", __func__, buf, s);
376 if (strcmp(buf, s) != 0 && strcmp("x", s) != 0) {
377 DPRINTF(("%s: no string match %s != %s\n", __func__, buf, s));
378 return 0;
379 }
380 strlcpy(ms->ms_value.s, buf, sizeof(ms->ms_value.s));
381 DPRINTF(("%s: complete match\n", __func__));
382 return 1;
383 }
384 #endif
385
386 #ifdef TEST_DER
387 static void
printtag(uint32_t tag,const void * q,uint32_t len)388 printtag(uint32_t tag, const void *q, uint32_t len)
389 {
390 const uint8_t *d = q;
391 switch (tag) {
392 case DER_TAG_PRINTABLE_STRING:
393 case DER_TAG_UTF8_STRING:
394 case DER_TAG_IA5_STRING:
395 case DER_TAG_UTCTIME:
396 printf("%.*s\n", len, (const char *)q);
397 return;
398 default:
399 break;
400 }
401
402 for (uint32_t i = 0; i < len; i++)
403 printf("%.2x", d[i]);
404 printf("\n");
405 }
406
407 static void
printdata(size_t level,const void * v,size_t x,size_t l)408 printdata(size_t level, const void *v, size_t x, size_t l)
409 {
410 const uint8_t *p = v, *ep = p + l;
411 size_t ox;
412 char buf[128];
413
414 while (p + x < ep) {
415 const uint8_t *q;
416 uint8_t c = getclass(p[x]);
417 uint8_t t = gettype(p[x]);
418 ox = x;
419 // if (x != 0)
420 // printf("%.2x %.2x %.2x\n", p[x - 1], p[x], p[x + 1]);
421 uint32_t tag = gettag(p, &x, ep - p + x);
422 if (p + x >= ep)
423 break;
424 uint32_t len = getlength(p, &x, ep - p + x);
425
426 printf("%" SIZE_T_FORMAT "u %" SIZE_T_FORMAT "u-%"
427 SIZE_T_FORMAT "u %c,%c,%s,%u:", level, ox, x,
428 der_class[c], der_type[t],
429 der_tag(buf, sizeof(buf), tag), len);
430 q = p + x;
431 if (p + len > ep)
432 errx(EXIT_FAILURE, "corrupt der");
433 printtag(tag, q, len);
434 if (t != DER_TYPE_PRIMITIVE)
435 printdata(level + 1, p, x, len + x);
436 x += len;
437 }
438 }
439
440 int
main(int argc,char * argv[])441 main(int argc, char *argv[])
442 {
443 int fd;
444 struct stat st;
445 size_t l;
446 void *p;
447
448 if ((fd = open(argv[1], O_RDONLY)) == -1)
449 err(EXIT_FAILURE, "open `%s'", argv[1]);
450 if (fstat(fd, &st) == -1)
451 err(EXIT_FAILURE, "stat `%s'", argv[1]);
452 l = (size_t)st.st_size;
453 if ((p = mmap(NULL, l, PROT_READ, MAP_FILE, fd, 0)) == MAP_FAILED)
454 err(EXIT_FAILURE, "mmap `%s'", argv[1]);
455
456 printdata(0, p, 0, l);
457 munmap(p, l);
458 return 0;
459 }
460 #endif
461
