1 /* Decoder for ASN.1 BER/DER/CER encoded bytestream
3 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
12 #include <linux/export.h>
13 #include <linux/kernel.h>
14 #include <linux/errno.h>
15 #include <linux/asn1_decoder.h>
16 #include <linux/asn1_ber_bytecode.h>
18 static const unsigned char asn1_op_lengths
[ASN1_OP__NR
] = {
20 [ASN1_OP_MATCH
] = 1 + 1,
21 [ASN1_OP_MATCH_OR_SKIP
] = 1 + 1,
22 [ASN1_OP_MATCH_ACT
] = 1 + 1 + 1,
23 [ASN1_OP_MATCH_ACT_OR_SKIP
] = 1 + 1 + 1,
24 [ASN1_OP_MATCH_JUMP
] = 1 + 1 + 1,
25 [ASN1_OP_MATCH_JUMP_OR_SKIP
] = 1 + 1 + 1,
26 [ASN1_OP_MATCH_ANY
] = 1,
27 [ASN1_OP_MATCH_ANY_ACT
] = 1 + 1,
28 [ASN1_OP_COND_MATCH_OR_SKIP
] = 1 + 1,
29 [ASN1_OP_COND_MATCH_ACT_OR_SKIP
] = 1 + 1 + 1,
30 [ASN1_OP_COND_MATCH_JUMP_OR_SKIP
] = 1 + 1 + 1,
31 [ASN1_OP_COND_MATCH_ANY
] = 1,
32 [ASN1_OP_COND_MATCH_ANY_ACT
] = 1 + 1,
33 [ASN1_OP_COND_FAIL
] = 1,
34 [ASN1_OP_COMPLETE
] = 1,
35 [ASN1_OP_ACT
] = 1 + 1,
37 [ASN1_OP_END_SEQ
] = 1,
38 [ASN1_OP_END_SEQ_OF
] = 1 + 1,
39 [ASN1_OP_END_SET
] = 1,
40 [ASN1_OP_END_SET_OF
] = 1 + 1,
41 [ASN1_OP_END_SEQ_ACT
] = 1 + 1,
42 [ASN1_OP_END_SEQ_OF_ACT
] = 1 + 1 + 1,
43 [ASN1_OP_END_SET_ACT
] = 1 + 1,
44 [ASN1_OP_END_SET_OF_ACT
] = 1 + 1 + 1,
48 * Find the length of an indefinite length object
50 static int asn1_find_indefinite_length(const unsigned char *data
, size_t datalen
,
51 const char **_errmsg
, size_t *_err_dp
)
53 unsigned char tag
, tmp
;
54 size_t dp
= 0, len
, n
;
58 if (unlikely(datalen
- dp
< 2)) {
61 goto data_overrun_error
;
64 /* Extract a tag from the data */
67 /* It appears to be an EOC. */
70 if (--indef_level
<= 0)
75 if (unlikely((tag
& 0x1f) == 0x1f)) {
77 if (unlikely(datalen
- dp
< 2))
78 goto data_overrun_error
;
83 /* Extract the length */
90 if (unlikely(len
== 0x80)) {
91 /* Indefinite length */
92 if (unlikely((tag
& ASN1_CONS_BIT
) == ASN1_PRIM
<< 5))
93 goto indefinite_len_primitive
;
99 if (unlikely(n
> sizeof(size_t) - 1))
100 goto length_too_long
;
101 if (unlikely(n
> datalen
- dp
))
102 goto data_overrun_error
;
103 for (len
= 0; n
> 0; n
--) {
111 *_errmsg
= "Unsupported length";
113 indefinite_len_primitive
:
114 *_errmsg
= "Indefinite len primitive not permitted";
117 *_errmsg
= "Invalid length EOC";
120 *_errmsg
= "Data overrun error";
123 *_errmsg
= "Missing EOC in indefinite len cons";
130 * asn1_ber_decoder - Decoder BER/DER/CER ASN.1 according to pattern
131 * @decoder: The decoder definition (produced by asn1_compiler)
132 * @context: The caller's context (to be passed to the action functions)
133 * @data: The encoded data
134 * @datasize: The size of the encoded data
136 * Decode BER/DER/CER encoded ASN.1 data according to a bytecode pattern
137 * produced by asn1_compiler. Action functions are called on marked tags to
138 * allow the caller to retrieve significant data.
142 * To keep down the amount of stack used by this function, the following limits
145 * (1) This won't handle datalen > 65535 without increasing the size of the
146 * cons stack elements and length_too_long checking.
148 * (2) The stack of constructed types is 10 deep. If the depth of non-leaf
149 * constructed types exceeds this, the decode will fail.
151 * (3) The SET type (not the SET OF type) isn't really supported as tracking
152 * what members of the set have been seen is a pain.
154 int asn1_ber_decoder(const struct asn1_decoder
*decoder
,
156 const unsigned char *data
,
159 const unsigned char *machine
= decoder
->machine
;
160 const asn1_action_t
*actions
= decoder
->actions
;
161 size_t machlen
= decoder
->machlen
;
163 unsigned char tag
= 0, csp
= 0, jsp
= 0, optag
= 0, hdr
= 0;
165 size_t pc
= 0, dp
= 0, tdp
= 0, len
= 0;
168 unsigned char flags
= 0;
169 #define FLAG_INDEFINITE_LENGTH 0x01
170 #define FLAG_MATCHED 0x02
171 #define FLAG_CONS 0x20 /* Corresponds to CONS bit in the opcode tag
172 * - ie. whether or not we are going to parse
176 #define NR_CONS_STACK 10
177 unsigned short cons_dp_stack
[NR_CONS_STACK
];
178 unsigned short cons_datalen_stack
[NR_CONS_STACK
];
179 unsigned char cons_hdrlen_stack
[NR_CONS_STACK
];
180 #define NR_JUMP_STACK 10
181 unsigned char jump_stack
[NR_JUMP_STACK
];
187 pr_debug("next_op: pc=\e[32m%zu\e[m/%zu dp=\e[33m%zu\e[m/%zu C=%d J=%d\n",
188 pc
, machlen
, dp
, datalen
, csp
, jsp
);
189 if (unlikely(pc
>= machlen
))
190 goto machine_overrun_error
;
192 if (unlikely(pc
+ asn1_op_lengths
[op
] > machlen
))
193 goto machine_overrun_error
;
195 /* If this command is meant to match a tag, then do that before
196 * evaluating the command.
198 if (op
<= ASN1_OP__MATCHES_TAG
) {
201 /* Skip conditional matches if possible */
202 if ((op
& ASN1_OP_MATCH__COND
&&
203 flags
& FLAG_MATCHED
) ||
205 pc
+= asn1_op_lengths
[op
];
212 /* Extract a tag from the data */
213 if (unlikely(dp
>= datalen
- 1))
214 goto data_overrun_error
;
216 if (unlikely((tag
& 0x1f) == 0x1f))
217 goto long_tag_not_supported
;
219 if (op
& ASN1_OP_MATCH__ANY
) {
220 pr_debug("- any %02x\n", tag
);
222 /* Extract the tag from the machine
223 * - Either CONS or PRIM are permitted in the data if
224 * CONS is not set in the op stream, otherwise CONS
227 optag
= machine
[pc
+ 1];
228 flags
|= optag
& FLAG_CONS
;
230 /* Determine whether the tag matched */
232 tmp
&= ~(optag
& ASN1_CONS_BIT
);
233 pr_debug("- match? %02x %02x %02x\n", tag
, optag
, tmp
);
235 /* All odd-numbered tags are MATCH_OR_SKIP. */
236 if (op
& ASN1_OP_MATCH__SKIP
) {
237 pc
+= asn1_op_lengths
[op
];
244 flags
|= FLAG_MATCHED
;
248 if (unlikely(len
== 0x80)) {
249 /* Indefinite length */
250 if (unlikely(!(tag
& ASN1_CONS_BIT
)))
251 goto indefinite_len_primitive
;
252 flags
|= FLAG_INDEFINITE_LENGTH
;
253 if (unlikely(2 > datalen
- dp
))
254 goto data_overrun_error
;
258 goto length_too_long
;
259 if (unlikely(dp
>= datalen
- n
))
260 goto data_overrun_error
;
262 for (len
= 0; n
> 0; n
--) {
266 if (unlikely(len
> datalen
- dp
))
267 goto data_overrun_error
;
271 if (flags
& FLAG_CONS
) {
272 /* For expected compound forms, we stack the positions
273 * of the start and end of the data.
275 if (unlikely(csp
>= NR_CONS_STACK
))
276 goto cons_stack_overflow
;
277 cons_dp_stack
[csp
] = dp
;
278 cons_hdrlen_stack
[csp
] = hdr
;
279 if (!(flags
& FLAG_INDEFINITE_LENGTH
)) {
280 cons_datalen_stack
[csp
] = datalen
;
283 cons_datalen_stack
[csp
] = 0;
288 pr_debug("- TAG: %02x %zu%s\n",
289 tag
, len
, flags
& FLAG_CONS
? " CONS" : "");
293 /* Decide how to handle the operation */
295 case ASN1_OP_MATCH_ANY_ACT
:
296 case ASN1_OP_COND_MATCH_ANY_ACT
:
297 ret
= actions
[machine
[pc
+ 1]](context
, hdr
, tag
, data
+ dp
, len
);
302 case ASN1_OP_MATCH_ACT
:
303 case ASN1_OP_MATCH_ACT_OR_SKIP
:
304 case ASN1_OP_COND_MATCH_ACT_OR_SKIP
:
305 ret
= actions
[machine
[pc
+ 2]](context
, hdr
, tag
, data
+ dp
, len
);
311 case ASN1_OP_MATCH_OR_SKIP
:
312 case ASN1_OP_MATCH_ANY
:
313 case ASN1_OP_COND_MATCH_OR_SKIP
:
314 case ASN1_OP_COND_MATCH_ANY
:
316 if (!(flags
& FLAG_CONS
)) {
317 if (flags
& FLAG_INDEFINITE_LENGTH
) {
318 len
= asn1_find_indefinite_length(
319 data
+ dp
, datalen
- dp
, &errmsg
, &dp
);
323 pr_debug("- LEAF: %zu\n", len
);
326 pc
+= asn1_op_lengths
[op
];
329 case ASN1_OP_MATCH_JUMP
:
330 case ASN1_OP_MATCH_JUMP_OR_SKIP
:
331 case ASN1_OP_COND_MATCH_JUMP_OR_SKIP
:
332 pr_debug("- MATCH_JUMP\n");
333 if (unlikely(jsp
== NR_JUMP_STACK
))
334 goto jump_stack_overflow
;
335 jump_stack
[jsp
++] = pc
+ asn1_op_lengths
[op
];
336 pc
= machine
[pc
+ 2];
339 case ASN1_OP_COND_FAIL
:
340 if (unlikely(!(flags
& FLAG_MATCHED
)))
342 pc
+= asn1_op_lengths
[op
];
345 case ASN1_OP_COMPLETE
:
346 if (unlikely(jsp
!= 0 || csp
!= 0)) {
347 pr_err("ASN.1 decoder error: Stacks not empty at completion (%u, %u)\n",
353 case ASN1_OP_END_SET
:
354 case ASN1_OP_END_SET_ACT
:
355 if (unlikely(!(flags
& FLAG_MATCHED
)))
357 case ASN1_OP_END_SEQ
:
358 case ASN1_OP_END_SET_OF
:
359 case ASN1_OP_END_SEQ_OF
:
360 case ASN1_OP_END_SEQ_ACT
:
361 case ASN1_OP_END_SET_OF_ACT
:
362 case ASN1_OP_END_SEQ_OF_ACT
:
363 if (unlikely(csp
<= 0))
364 goto cons_stack_underflow
;
366 tdp
= cons_dp_stack
[csp
];
367 hdr
= cons_hdrlen_stack
[csp
];
369 datalen
= cons_datalen_stack
[csp
];
370 pr_debug("- end cons t=%zu dp=%zu l=%zu/%zu\n",
371 tdp
, dp
, len
, datalen
);
373 /* Indefinite length - check for the EOC. */
375 if (unlikely(datalen
- dp
< 2))
376 goto data_overrun_error
;
377 if (data
[dp
++] != 0) {
378 if (op
& ASN1_OP_END__OF
) {
381 pc
= machine
[pc
+ 1];
382 pr_debug("- continue\n");
391 if (dp
< len
&& (op
& ASN1_OP_END__OF
)) {
394 pc
= machine
[pc
+ 1];
395 pr_debug("- continue\n");
399 goto cons_length_error
;
401 pr_debug("- cons len l=%zu d=%zu\n", len
, dp
- tdp
);
404 if (op
& ASN1_OP_END__ACT
) {
406 if (op
& ASN1_OP_END__OF
)
407 act
= machine
[pc
+ 2];
409 act
= machine
[pc
+ 1];
410 ret
= actions
[act
](context
, hdr
, 0, data
+ tdp
, len
);
412 pc
+= asn1_op_lengths
[op
];
416 ret
= actions
[machine
[pc
+ 1]](context
, hdr
, tag
, data
+ tdp
, len
);
417 pc
+= asn1_op_lengths
[op
];
421 if (unlikely(jsp
<= 0))
422 goto jump_stack_underflow
;
423 pc
= jump_stack
[--jsp
];
430 /* Shouldn't reach here */
431 pr_err("ASN.1 decoder error: Found reserved opcode (%u)\n", op
);
435 errmsg
= "Data overrun error";
437 machine_overrun_error
:
438 errmsg
= "Machine overrun error";
440 jump_stack_underflow
:
441 errmsg
= "Jump stack underflow";
444 errmsg
= "Jump stack overflow";
446 cons_stack_underflow
:
447 errmsg
= "Cons stack underflow";
450 errmsg
= "Cons stack overflow";
453 errmsg
= "Cons length error";
456 errmsg
= "Missing EOC in indefinite len cons";
459 errmsg
= "Invalid length EOC";
462 errmsg
= "Unsupported length";
464 indefinite_len_primitive
:
465 errmsg
= "Indefinite len primitive not permitted";
468 errmsg
= "Unexpected tag";
470 long_tag_not_supported
:
471 errmsg
= "Long tag not supported";
473 pr_debug("\nASN1: %s [m=%zu d=%zu ot=%02x t=%02x l=%zu]\n",
474 errmsg
, pc
, dp
, optag
, tag
, len
);
477 EXPORT_SYMBOL_GPL(asn1_ber_decoder
);