1/*-
2 * Copyright (c) 2016 Christos Zoulas
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
15 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
16 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
18 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24 * POSSIBILITY OF SUCH DAMAGE.
25 */
26/*
27 * DER (Distinguished Encoding Rules) Parser
28 *
29 * Sources:
30 * https://en.wikipedia.org/wiki/X.690
31 * http://fm4dd.com/openssl/certexamples.htm
32 * http://blog.engelke.com/2014/10/17/parsing-ber-and-der-encoded-asn-1-objects/
33 */
34#ifndef TEST_DER
35#include "file.h"
36
37#ifndef lint
38FILE_RCSID("@(#)$File: der.c,v 1.27 2022/09/24 20:30:13 christos Exp $")
39#endif
40#else
41#define SIZE_T_FORMAT "z"
42#define CAST(a, b) ((a)(b))
43#endif
44
45#include <sys/types.h>
46
47#include <stdio.h>
48#include <fcntl.h>
49#include <stdlib.h>
50#include <string.h>
51#include <ctype.h>
52
53#ifndef TEST_DER
54#include "magic.h"
55#include "der.h"
56#else
57#include <sys/mman.h>
58#include <sys/stat.h>
59#include <err.h>
60#endif
61
62#define DER_BAD	CAST(uint32_t, -1)
63
64#define DER_CLASS_UNIVERSAL	0
65#define	DER_CLASS_APPLICATION	1
66#define	DER_CLASS_CONTEXT	2
67#define	DER_CLASS_PRIVATE	3
68#if defined(DEBUG_DER) || defined(TEST_DER)
69static const char der_class[] = "UACP";
70#endif
71
72#define DER_TYPE_PRIMITIVE	0
73#define DER_TYPE_CONSTRUCTED	1
74#if defined(DEBUG_DER) || defined(TEST_DER)
75static const char der_type[] = "PC";
76#endif
77
78#define	DER_TAG_EOC			0x00
79#define	DER_TAG_BOOLEAN			0x01
80#define	DER_TAG_INTEGER			0x02
81#define	DER_TAG_BIT STRING		0x03
82#define	DER_TAG_OCTET_STRING		0x04
83#define	DER_TAG_NULL			0x05
84#define	DER_TAG_OBJECT_IDENTIFIER	0x06
85#define	DER_TAG_OBJECT_DESCRIPTOR	0x07
86#define	DER_TAG_EXTERNAL		0x08
87#define	DER_TAG_REAL			0x09
88#define	DER_TAG_ENUMERATED		0x0a
89#define	DER_TAG_EMBEDDED_PDV		0x0b
90#define	DER_TAG_UTF8_STRING		0x0c
91#define	DER_TAG_RELATIVE_OID		0x0d
92#define DER_TAG_TIME			0x0e
93#define DER_TAG_RESERVED_2		0x0f
94#define	DER_TAG_SEQUENCE		0x10
95#define	DER_TAG_SET			0x11
96#define	DER_TAG_NUMERIC_STRING		0x12
97#define	DER_TAG_PRINTABLE_STRING	0x13
98#define	DER_TAG_T61_STRING		0x14
99#define	DER_TAG_VIDEOTEX_STRING		0x15
100#define	DER_TAG_IA5_STRING		0x16
101#define	DER_TAG_UTCTIME			0x17
102#define	DER_TAG_GENERALIZED_TIME	0x18
103#define	DER_TAG_GRAPHIC_STRING		0x19
104#define	DER_TAG_VISIBLE_STRING		0x1a
105#define	DER_TAG_GENERAL_STRING		0x1b
106#define	DER_TAG_UNIVERSAL_STRING	0x1c
107#define	DER_TAG_CHARACTER_STRING	0x1d
108#define	DER_TAG_BMP_STRING		0x1e
109#define	DER_TAG_DATE			0x1f
110#define	DER_TAG_TIME_OF_DAY		0x20
111#define	DER_TAG_DATE_TIME		0x21
112#define	DER_TAG_DURATION		0x22
113#define	DER_TAG_OID_IRI			0x23
114#define	DER_TAG_RELATIVE_OID_IRI	0x24
115#define	DER_TAG_LAST			0x25
116
117static const char *der__tag[] = {
118	"eoc", "bool", "int", "bit_str", "octet_str",
119	"null", "obj_id", "obj_desc", "ext", "real",
120	"enum", "embed", "utf8_str", "rel_oid", "time",
121	"res2", "seq", "set", "num_str", "prt_str",
122	"t61_str", "vid_str", "ia5_str", "utc_time", "gen_time",
123	"gr_str", "vis_str", "gen_str", "univ_str", "char_str",
124	"bmp_str", "date", "tod", "datetime", "duration",
125	"oid-iri", "rel-oid-iri",
126};
127
128#ifdef DEBUG_DER
129#define DPRINTF(a) printf a
130#else
131#define DPRINTF(a)
132#endif
133
134#ifdef TEST_DER
135static uint8_t
136getclass(uint8_t c)
137{
138	return c >> 6;
139}
140
141static uint8_t
142gettype(uint8_t c)
143{
144	return (c >> 5) & 1;
145}
146#endif
147
148static uint32_t
149gettag(const uint8_t *c, size_t *p, size_t l)
150{
151	uint32_t tag;
152
153	if (*p >= l)
154		return DER_BAD;
155
156	tag = c[(*p)++] & 0x1f;
157
158	if (tag != 0x1f)
159		return tag;
160
161	if (*p >= l)
162		return DER_BAD;
163
164	while (c[*p] >= 0x80) {
165		tag = tag * 128 + c[(*p)++] - 0x80;
166		if (*p >= l)
167			return DER_BAD;
168	}
169	return tag;
170}
171
172/*
173 * Read the length of a DER tag from the input.
174 *
175 * `c` is the input, `p` is an output parameter that specifies how much of the
176 * input we consumed, and `l` is the maximum input length.
177 *
178 * Returns the length, or DER_BAD if the end of the input is reached or the
179 * length exceeds the remaining input.
180 */
181static uint32_t
182getlength(const uint8_t *c, size_t *p, size_t l)
183{
184	uint8_t digits, i;
185	size_t len;
186	int is_onebyte_result;
187
188	if (*p >= l) {
189		DPRINTF(("%s:[1] %zu >= %zu\n", __func__, *p, l));
190		return DER_BAD;
191	}
192
193	/*
194	 * Digits can either be 0b0 followed by the result, or 0b1
195	 * followed by the number of digits of the result. In either case,
196	 * we verify that we can read so many bytes from the input.
197	 */
198	is_onebyte_result = (c[*p] & 0x80) == 0;
199	digits = c[(*p)++] & 0x7f;
200	if (*p + digits >= l) {
201		DPRINTF(("%s:[2] %zu + %u >= %zu\n", __func__, *p, digits, l));
202		return DER_BAD;
203	}
204
205	if (is_onebyte_result)
206		return digits;
207
208	/*
209	 * Decode len. We've already verified that we're allowed to read
210	 * `digits` bytes.
211	 */
212	len = 0;
213	for (i = 0; i < digits; i++)
214		len = (len << 8) | c[(*p)++];
215
216	if (len > UINT32_MAX - *p || *p + len > l) {
217		DPRINTF(("%s:[3] bad len %zu + %zu >= %zu\n",
218		    __func__, *p, len, l));
219		return DER_BAD;
220	}
221	return CAST(uint32_t, len);
222}
223
224static const char *
225der_tag(char *buf, size_t len, uint32_t tag)
226{
227	if (tag < DER_TAG_LAST)
228		strlcpy(buf, der__tag[tag], len);
229	else
230		snprintf(buf, len, "%#x", tag);
231	return buf;
232}
233
234#ifndef TEST_DER
235static int
236der_data(char *buf, size_t blen, uint32_t tag, const void *q, uint32_t len)
237{
238	uint32_t i;
239	const uint8_t *d = CAST(const uint8_t *, q);
240	switch (tag) {
241	case DER_TAG_PRINTABLE_STRING:
242	case DER_TAG_UTF8_STRING:
243	case DER_TAG_IA5_STRING:
244		return snprintf(buf, blen, "%.*s", len, RCAST(const char *, q));
245	case DER_TAG_UTCTIME:
246		if (len < 12)
247			break;
248		return snprintf(buf, blen,
249		    "20%c%c-%c%c-%c%c %c%c:%c%c:%c%c GMT", d[0], d[1], d[2],
250		    d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11]);
251	default:
252		break;
253	}
254
255	for (i = 0; i < len; i++) {
256		uint32_t z = i << 1;
257		if (z < blen - 2)
258			snprintf(buf + z, blen - z, "%.2x", d[i]);
259	}
260	return len * 2;
261}
262
263int32_t
264der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
265{
266	const uint8_t *b = RCAST(const uint8_t *, ms->search.s);
267	size_t offs = 0, len = ms->search.s_len ? ms->search.s_len : nbytes;
268
269	if (gettag(b, &offs, len) == DER_BAD) {
270		DPRINTF(("%s: bad tag 1\n", __func__));
271		return -1;
272	}
273	DPRINTF(("%s1: %u %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset,
274	    offs, m->offset));
275
276	uint32_t tlen = getlength(b, &offs, len);
277	if (tlen == DER_BAD) {
278		DPRINTF(("%s: bad tag 2\n", __func__));
279		return -1;
280	}
281	DPRINTF(("%s2: %u %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
282	    offs, tlen));
283
284	offs += ms->offset + m->offset;
285	DPRINTF(("cont_level = %d\n", m->cont_level));
286#ifdef DEBUG_DER
287	size_t i;
288	for (i = 0; i < m->cont_level; i++)
289		printf("cont_level[%" SIZE_T_FORMAT "u] = %d\n", i,
290		    ms->c.li[i].off);
291#endif
292	if (m->cont_level != 0) {
293		if (offs + tlen > nbytes)
294			return -1;
295		ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen);
296		DPRINTF(("cont_level[%u] = %d\n", m->cont_level - 1,
297		    ms->c.li[m->cont_level - 1].off));
298	}
299	return CAST(int32_t, offs);
300}
301
302int
303der_cmp(struct magic_set *ms, struct magic *m)
304{
305	const uint8_t *b = RCAST(const uint8_t *, ms->search.s);
306	const char *s = m->value.s;
307	size_t offs = 0, len = ms->search.s_len;
308	uint32_t tag, tlen;
309	char buf[128];
310
311	DPRINTF(("%s: compare %zu bytes\n", __func__, len));
312
313	tag = gettag(b, &offs, len);
314	if (tag == DER_BAD) {
315		DPRINTF(("%s: bad tag 1\n", __func__));
316		return -1;
317	}
318
319	DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset,
320	    offs, m->offset));
321
322	tlen = getlength(b, &offs, len);
323	if (tlen == DER_BAD) {
324		DPRINTF(("%s: bad tag 2\n", __func__));
325		return -1;
326	}
327
328	der_tag(buf, sizeof(buf), tag);
329	if ((ms->flags & MAGIC_DEBUG) != 0)
330		fprintf(stderr, "%s: tag %p got=%s exp=%s\n", __func__, b,
331		    buf, s);
332	size_t slen = strlen(buf);
333
334	if (strncmp(buf, s, slen) != 0) {
335		DPRINTF(("%s: no string match %s != %s\n", __func__, buf, s));
336		return 0;
337	}
338
339	s += slen;
340
341again:
342	switch (*s) {
343	case '\0':
344		DPRINTF(("%s: EOF match\n", __func__));
345		return 1;
346	case '=':
347		s++;
348		goto val;
349	default:
350		if (!isdigit(CAST(unsigned char, *s))) {
351			DPRINTF(("%s: no digit %c\n", __func__, *s));
352			return 0;
353		}
354
355		slen = 0;
356		do
357			slen = slen * 10 + *s - '0';
358		while (isdigit(CAST(unsigned char, *++s)));
359		if ((ms->flags & MAGIC_DEBUG) != 0)
360			fprintf(stderr, "%s: len %" SIZE_T_FORMAT "u %u\n",
361			    __func__, slen, tlen);
362		if (tlen != slen) {
363			DPRINTF(("%s: len %u != %zu\n", __func__, tlen, slen));
364			return 0;
365		}
366		goto again;
367	}
368val:
369	DPRINTF(("%s: before data %" SIZE_T_FORMAT "u %u\n", __func__, offs,
370	    tlen));
371	der_data(buf, sizeof(buf), tag, b + offs, tlen);
372	if ((ms->flags & MAGIC_DEBUG) != 0)
373		fprintf(stderr, "%s: data %s %s\n", __func__, buf, s);
374	if (strcmp(buf, s) != 0 && strcmp("x", s) != 0) {
375		DPRINTF(("%s: no string match %s != %s\n", __func__, buf, s));
376		return 0;
377	}
378	strlcpy(ms->ms_value.s, buf, sizeof(ms->ms_value.s));
379	DPRINTF(("%s: complete match\n", __func__));
380	return 1;
381}
382#endif
383
384#ifdef TEST_DER
385static void
386printtag(uint32_t tag, const void *q, uint32_t len)
387{
388	const uint8_t *d = q;
389	switch (tag) {
390	case DER_TAG_PRINTABLE_STRING:
391	case DER_TAG_UTF8_STRING:
392	case DER_TAG_IA5_STRING:
393	case DER_TAG_UTCTIME:
394		printf("%.*s\n", len, (const char *)q);
395		return;
396	default:
397		break;
398	}
399
400	for (uint32_t i = 0; i < len; i++)
401		printf("%.2x", d[i]);
402	printf("\n");
403}
404
405static void
406printdata(size_t level, const void *v, size_t x, size_t l)
407{
408	const uint8_t *p = v, *ep = p + l;
409	size_t ox;
410	char buf[128];
411
412	while (p + x < ep) {
413		const uint8_t *q;
414		uint8_t c = getclass(p[x]);
415		uint8_t t = gettype(p[x]);
416		ox = x;
417//		if (x != 0)
418//		printf("%.2x %.2x %.2x\n", p[x - 1], p[x], p[x + 1]);
419		uint32_t tag = gettag(p, &x, ep - p + x);
420		if (p + x >= ep)
421			break;
422		uint32_t len = getlength(p, &x, ep - p + x);
423
424		printf("%" SIZE_T_FORMAT "u %" SIZE_T_FORMAT "u-%"
425		    SIZE_T_FORMAT "u %c,%c,%s,%u:", level, ox, x,
426		    der_class[c], der_type[t],
427		    der_tag(buf, sizeof(buf), tag), len);
428		q = p + x;
429		if (p + len > ep)
430			errx(EXIT_FAILURE, "corrupt der");
431		printtag(tag, q, len);
432		if (t != DER_TYPE_PRIMITIVE)
433			printdata(level + 1, p, x, len + x);
434		x += len;
435	}
436}
437
438int
439main(int argc, char *argv[])
440{
441	int fd;
442	struct stat st;
443	size_t l;
444	void *p;
445
446	if ((fd = open(argv[1], O_RDONLY)) == -1)
447		err(EXIT_FAILURE, "open `%s'", argv[1]);
448	if (fstat(fd, &st) == -1)
449		err(EXIT_FAILURE, "stat `%s'", argv[1]);
450	l = (size_t)st.st_size;
451	if ((p = mmap(NULL, l, PROT_READ, MAP_FILE, fd, 0)) == MAP_FAILED)
452		err(EXIT_FAILURE, "mmap `%s'", argv[1]);
453
454	printdata(0, p, 0, l);
455	munmap(p, l);
456	return 0;
457}
458#endif
459