xref: /onnv-gate/usr/src/lib/libkmf/ber_der/common/decode.c (revision 11973:480f5412d630)

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
 *
 * The contents of this file are subject to the Netscape Public License
 * Version 1.0 (the "NPL"); you may not use this file except in
 * compliance with the NPL.  You may obtain a copy of the NPL at
 * http://www.mozilla.org/NPL/
 *
 * Software distributed under the NPL is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the NPL
 * for the specific language governing rights and limitations under the
 * NPL.
 *
 * The Initial Developer of this code under the NPL is Netscape
 * Communications Corporation.  Portions created by Netscape are
 * Copyright (C) 1998 Netscape Communications Corporation.  All Rights
 * Reserved.
 */

/*
 * Copyright (c) 1990 Regents of the University of Michigan.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that this notice is preserved and that due credit is given
 * to the University of Michigan at Ann Arbor. The name of the University
 * may not be used to endorse or promote products derived from this
 * software without specific prior written permission. This software
 * is provided ``as is'' without express or implied warranty.
 */

/* decode.c - ber input decoding routines */

#include <strings.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <inttypes.h>

#include <ber_der.h>
#include "kmfber_int.h"

static void
ber_svecfree(char **vals)
{
	int	i;

	if (vals == NULL)
		return;
	for (i = 0; vals[i] != NULL; i++)
		free(vals[i]);
	free((char *)vals);
}

/*
 * Note: kmfber_get_tag() only uses the ber_end and ber_ptr elements of ber.
 * If that changes, the kmfber_peek_tag() and/or
 * kmfkmfber_skip_tag() implementations will need to be changed.
 */
/* return the tag - KMFBER_DEFAULT returned means trouble */
static ber_tag_t
kmfber_get_tag(BerElement *ber)
{
	unsigned char	xbyte;
	ber_tag_t	tag;
	char		*tagp;
	int		i;

	if (kmfber_read(ber, (char *)&xbyte, 1) != 1)
		return (KMFBER_DEFAULT);

	if ((xbyte & KMFBER_BIG_TAG_MASK) != KMFBER_BIG_TAG_MASK)
		return ((ber_uint_t)xbyte);

	tagp = (char *)&tag;
	tagp[0] = xbyte;
	for (i = 1; i < sizeof (ber_int_t); i++) {
		if (kmfber_read(ber, (char *)&xbyte, 1) != 1)
			return (KMFBER_DEFAULT);

		tagp[i] = xbyte;

		if (! (xbyte & KMFBER_MORE_TAG_MASK))
			break;
	}

	/* tag too big! */
	if (i == sizeof (ber_int_t))
		return (KMFBER_DEFAULT);

	/* want leading, not trailing 0's */
	return (tag >> (sizeof (ber_int_t)- i - 1));
}

/*
 * Note: kmfber_skip_tag() only uses the ber_end and ber_ptr elements of ber.
 * If that changes, the implementation of kmfber_peek_tag() will need to
 * be changed.
 */
ber_tag_t
kmfber_skip_tag(BerElement *ber, ber_len_t *len)
{
	ber_tag_t	tag;
	unsigned char	lc;
	int		noctets, diff;
	uint32_t	netlen;

	/*
	 * Any ber element looks like this: tag length contents.
	 * Assuming everything's ok, we return the tag byte (we
	 * can assume a single byte), and return the length in len.
	 *
	 * Assumptions:
	 *	1) definite lengths
	 *	2) primitive encodings used whenever possible
	 */

	/*
	 * First, we read the tag.
	 */

	if ((tag = kmfber_get_tag(ber)) == KMFBER_DEFAULT)
		return (KMFBER_DEFAULT);

	/*
	 * Next, read the length.  The first byte contains the length of
	 * the length.  If bit 8 is set, the length is the long form,
	 * otherwise it's the short form.  We don't allow a length that's
	 * greater than what we can hold in an unsigned long.
	 */

	*len = 0;
	netlen = 0;
	if (kmfber_read(ber, (char *)&lc, 1) != 1)
		return (KMFBER_DEFAULT);
	if (lc & 0x80) {
		noctets = (lc & 0x7f);
		if (noctets > sizeof (ber_uint_t))
			return (KMFBER_DEFAULT);
		diff = sizeof (ber_int_t) - noctets;
		if (kmfber_read(ber, (char *)&netlen + diff, noctets)
		    != noctets)
			return (KMFBER_DEFAULT);
		*len = ntohl(netlen);
	} else {
		*len = lc;
	}

	return (tag);
}


/*
 * Note: Previously, we passed the "ber" parameter directly to
 * kmfber_skip_tag(), saving and restoring the ber_ptr element only.
 * We now take advantage of the fact that the only ber structure
 * elements touched by kmfber_skip_tag() are ber_end and ber_ptr.
 * If that changes, this code must change too.
 */
static ber_tag_t
kmfber_peek_tag(BerElement *ber, ber_len_t *len)
{
	BerElement	bercopy;

	bercopy.ber_end = ber->ber_end;
	bercopy.ber_ptr = ber->ber_ptr;
	return (kmfber_skip_tag(&bercopy, len));
}

static int
ber_getnint(BerElement *ber, ber_int_t *num, ber_slen_t len)
{
	int i;
	ber_int_t value;
	unsigned char buffer[sizeof (ber_int_t)];
	/*
	 * The tag and length have already been stripped off.  We should
	 * be sitting right before len bytes of 2's complement integer,
	 * ready to be read straight into an int.  We may have to sign
	 * extend after we read it in.
	 */

	if (len > sizeof (buffer))
		return (-1);

	/* read into the low-order bytes of netnum */
	if (kmfber_read(ber, (char *)buffer, len) != len)
		return (-1);

	/* This sets the required sign extension */
	if (len != 0) {
		value = 0x80 & buffer[0] ? (-1) : 0;
	} else {
		value = 0;
	}

	for (i = 0; i < len; i++)
		value = (value << 8) | buffer[i];

	*num = value;

	return (len);
}

static ber_tag_t
kmfber_get_int(BerElement *ber, ber_int_t *num)
{
	ber_tag_t	tag;
	ber_len_t	len;

	if ((tag = kmfber_skip_tag(ber, &len)) == KMFBER_DEFAULT)
		return (KMFBER_DEFAULT);

	/*
	 * len is being demoted to a long here --  possible conversion error
	 */

	if (ber_getnint(ber, num, (int)len) != (ber_slen_t)len)
		return (KMFBER_DEFAULT);
	else
		return (tag);
}

static ber_tag_t
kmfber_get_stringb(BerElement *ber, char *buf, ber_len_t *len)
{
	ber_len_t	datalen;
	ber_tag_t	tag;
#ifdef STR_TRANSLATION
	char		*transbuf;
#endif /* STR_TRANSLATION */

	if ((tag = kmfber_skip_tag(ber, &datalen)) == KMFBER_DEFAULT)
		return (KMFBER_DEFAULT);
	if (datalen > (*len - 1))
		return (KMFBER_DEFAULT);

	/*
	 * datalen is being demoted to a long here --  possible conversion error
	 */

	if (kmfber_read(ber, buf, datalen) != (ber_slen_t)datalen)
		return (KMFBER_DEFAULT);

	buf[datalen] = '\0';

#ifdef STR_TRANSLATION
	if (datalen > 0 && (ber->ber_options & KMFBER_OPT_TRANSLATE_STRINGS)
	    != 0 && ber->ber_decode_translate_proc != NULL) {

		transbuf = buf;
		++datalen;
		if ((*(ber->ber_decode_translate_proc))(&transbuf, &datalen,
		    0) != 0) {
			return (KMFBER_DEFAULT);
		}
		if (datalen > *len) {
			free(transbuf);
			return (KMFBER_DEFAULT);
		}
		(void) memmove(buf, transbuf, datalen);
		free(transbuf);
		--datalen;
	}
#endif /* STR_TRANSLATION */

	*len = datalen;
	return (tag);
}

static ber_tag_t
kmfber_get_stringa(BerElement *ber, char **buf)
{
	ber_len_t	datalen;
	ber_tag_t	tag;

	if ((tag = kmfber_skip_tag(ber, &datalen)) == KMFBER_DEFAULT)
		return (KMFBER_DEFAULT);

	if ((*buf = (char *)malloc((size_t)datalen + 1)) == NULL)
		return (KMFBER_DEFAULT);

	/*
	 * datalen is being demoted to a long here --  possible conversion error
	 */
	if (kmfber_read(ber, *buf, datalen) != (ber_slen_t)datalen)
		return (KMFBER_DEFAULT);
	(*buf)[datalen] = '\0';

	return (tag);
}

ber_tag_t
ber_get_oid(BerElement *ber, struct berval *oid)
{
	ber_len_t	len;
	ber_tag_t	tag;

	if ((tag = kmfber_skip_tag(ber, &len)) != 0x06) {
		return (KMFBER_DEFAULT);
	}

	if ((oid->bv_val = (char *)malloc((size_t)len + 1)) == NULL) {
		return (KMFBER_DEFAULT);
	}
	oid->bv_len = len;

	if (kmfber_read(ber, oid->bv_val, oid->bv_len) !=
	    (ber_slen_t)oid->bv_len)
		return (KMFBER_DEFAULT);

	return (tag);
}

ber_tag_t
ber_get_bigint(BerElement *ber, struct berval **bv)
{
	ber_len_t	len;
	ber_tag_t	tag;

	if ((*bv = (struct berval *)malloc(sizeof (struct berval)))
	    == NULL) {
		return (KMFBER_DEFAULT);
	}
	(*bv)->bv_len = 0;
	(*bv)->bv_val = NULL;

	if ((tag = kmfber_skip_tag(ber, &len)) != BER_INTEGER) {
		return (KMFBER_DEFAULT);
	}

	if (((*bv)->bv_val = (char *)malloc((size_t)len + 1))
	    == NULL) {
		return (KMFBER_DEFAULT);
	}

	/*
	 * len is being demoted to a long here --  possible conversion error
	 */
	if (kmfber_read(ber, (*bv)->bv_val, len) != (ber_slen_t)len)
		return (KMFBER_DEFAULT);

	(*bv)->bv_len = len;

	/* If DER encoding, strip leading 0's if high-order bit is set */
	if (ber->ber_options & KMFBER_OPT_USE_DER) {
		char *p = (*bv)->bv_val;
		while ((*p == 0x00) && ((*bv)->bv_len > 0) && (p[1] & 0x80)) {
			p++;
			(*bv)->bv_len--;
		}
		/*
		 * Shift the buffer to the beginning of the allocated space
		 * so it can be properly freed later.
		 */
		if ((p > (*bv)->bv_val) && ((*bv)->bv_len > 0))
			(void) bcopy(p, (*bv)->bv_val, (*bv)->bv_len);
	}

	return (tag);
}

static ber_tag_t
kmfber_get_stringal(BerElement *ber, struct berval **bv)
{
	ber_len_t	len;
	ber_tag_t	tag;

	if ((*bv = (struct berval *)malloc(sizeof (struct berval)))
	    == NULL) {
		return (KMFBER_DEFAULT);
	}

	if ((tag = kmfber_skip_tag(ber, &len)) == KMFBER_DEFAULT) {
		return (KMFBER_DEFAULT);
	}

	if (((*bv)->bv_val = (char *)malloc((size_t)len + 1))
	    == NULL) {
		return (KMFBER_DEFAULT);
	}

	/*
	 * len is being demoted to a long here --  possible conversion error
	 */
	if (kmfber_read(ber, (*bv)->bv_val, len) != (ber_slen_t)len)
		return (KMFBER_DEFAULT);
	((*bv)->bv_val)[len] = '\0';
	(*bv)->bv_len = len;

	return (tag);
}

static ber_tag_t
kmfber_get_bitstringa(BerElement *ber, char **buf, ber_len_t *blen)
{
	ber_len_t	datalen;
	ber_tag_t	tag;
	unsigned char	unusedbits;

	if ((tag = kmfber_skip_tag(ber, &datalen)) == KMFBER_DEFAULT)
		return (KMFBER_DEFAULT);

	if ((*buf = (char *)malloc((size_t)datalen - 1)) == NULL)
		return (KMFBER_DEFAULT);

	if (kmfber_read(ber, (char *)&unusedbits, 1) != 1)
		return (KMFBER_DEFAULT);

	/* Subtract 1 for the unused bits */
	datalen--;

	/*
	 * datalen is being demoted to a long here --  possible conversion error
	 */
	if (kmfber_read(ber, *buf, datalen) != (ber_slen_t)datalen)
		return (KMFBER_DEFAULT);

	*blen = datalen * 8 - unusedbits;
	return (tag);
}

static ber_tag_t
kmfber_get_null(BerElement *ber)
{
	ber_len_t	len;
	ber_tag_t tag;

	if ((tag = kmfber_skip_tag(ber, &len)) == KMFBER_DEFAULT)
		return (KMFBER_DEFAULT);

	if (len != 0)
		return (KMFBER_DEFAULT);

	return (tag);
}

static ber_tag_t
kmfber_get_boolean(BerElement *ber, int *boolval)
{
	ber_int_t	longbool;
	int		rc;

	rc = kmfber_get_int(ber, &longbool);
	*boolval = longbool;

	return (rc);
}

ber_tag_t
kmfber_first_element(BerElement *ber, ber_len_t *len, char **last)
{
	/* skip the sequence header, use the len to mark where to stop */
	if (kmfber_skip_tag(ber, len) == KMFBER_DEFAULT) {
		return (KMFBER_ERROR);
	}

	*last = ber->ber_ptr + *len;

	if (*last == ber->ber_ptr) {
		return (KMFBER_END_OF_SEQORSET);
	}

	return (kmfber_peek_tag(ber, len));
}

ber_tag_t
kmfber_next_element(BerElement *ber, ber_len_t *len, char *last)
{
	if (ber->ber_ptr == last) {
		return (KMFBER_END_OF_SEQORSET);
	}

	return (kmfber_peek_tag(ber, len));
}

void
kmfber_bvfree(struct berval *bv)
{
	if (bv != NULL) {
		if (bv->bv_val != NULL) {
			free(bv->bv_val);
		}
		free((char *)bv);
	}
}

void
kmfber_bvecfree(struct berval **bv)
{
	int	i;

	if (bv != NULL) {
		for (i = 0; bv[i] != NULL; i++) {
			kmfber_bvfree(bv[i]);
		}
		free((char *)bv);
	}
}

/* VARARGS */
ber_tag_t
kmfber_scanf(BerElement *ber, const char *fmt, ...)
{
	va_list		ap;
	char		*last, *p;
	char		*s, **ss, ***sss;
	struct berval 	***bv, **bvp, *bval;
	int		*i, j;
	ber_slen_t	*l;
	ber_int_t	rc, tag, *b_int;
	ber_tag_t	*t;
	ber_len_t	len;
	size_t		array_size;

	va_start(ap, fmt);

	for (rc = 0, p = (char *)fmt; *p && rc != KMFBER_DEFAULT; p++) {
	switch (*p) {
		case 'a':	/* octet string - allocate storage as needed */
		ss = va_arg(ap, char **);
		rc = kmfber_get_stringa(ber, ss);
		break;

		case 'b':	/* boolean */
		i = va_arg(ap, int *);
		rc = kmfber_get_boolean(ber, i);
		break;

		case 'D':	/* Object ID */
		bval = va_arg(ap, struct berval *);
		rc = ber_get_oid(ber, bval);
		break;
		case 'e':	/* enumerated */
		case 'i':	/* int */
		b_int = va_arg(ap, ber_int_t *);
		rc = kmfber_get_int(ber, b_int);
		break;

		case 'l':	/* length of next item */
		l = va_arg(ap, ber_slen_t *);
		rc = kmfber_peek_tag(ber, (ber_len_t *)l);
		break;

		case 'n':	/* null */
		rc = kmfber_get_null(ber);
		break;

		case 's':	/* octet string - in a buffer */
		s = va_arg(ap, char *);
		l = va_arg(ap, ber_slen_t *);
		rc = kmfber_get_stringb(ber, s, (ber_len_t *)l);
		break;

		case 'o':	/* octet string in a supplied berval */
		bval = va_arg(ap, struct berval *);
		(void) kmfber_peek_tag(ber, &bval->bv_len);
		rc = kmfber_get_stringa(ber, &bval->bv_val);
		break;

		case 'I': /* variable length Integer */
		/* Treat INTEGER same as an OCTET string, but ignore the tag */
		bvp = va_arg(ap, struct berval **);
		rc = ber_get_bigint(ber, bvp);
		break;
		case 'O': /* octet string - allocate & include length */
		bvp = va_arg(ap, struct berval **);
		rc = kmfber_get_stringal(ber, bvp);
		break;

		case 'B':	/* bit string - allocate storage as needed */
		ss = va_arg(ap, char **);
		l = va_arg(ap, ber_slen_t *); /* for length, in bits */
		rc = kmfber_get_bitstringa(ber, ss, (ber_len_t *)l);
		break;

		case 't':	/* tag of next item */
		t = va_arg(ap, ber_tag_t *);
		*t = kmfber_peek_tag(ber, &len);
		rc = (ber_int_t)(*t);
		break;

		case 'T':	/* skip tag of next item */
		t = va_arg(ap, ber_tag_t *);
		*t = kmfber_skip_tag(ber, &len);
		rc = (ber_int_t)(*t);
		break;

		case 'v':	/* sequence of strings */
		sss = va_arg(ap, char ***);
		if (sss == NULL)
			break;
		*sss = NULL;
		j = 0;
		array_size = 0;
		for (tag = kmfber_first_element(ber, &len, &last);
		    (tag != KMFBER_DEFAULT &&
		    tag != KMFBER_END_OF_SEQORSET &&
		    rc != KMFBER_DEFAULT);
		    tag = kmfber_next_element(ber, &len, last)) {
			if (*sss == NULL) {
				/* Make room for at least 15 strings */
				*sss = (char **)malloc(16 * sizeof (char *));
				array_size = 16;
			} else {
				if ((size_t)(j+2) > array_size) {
					/* We'v overflowed our buffer */
					*sss = (char **)realloc(*sss,
					    (array_size * 2) * sizeof (char *));
					array_size = array_size * 2;
				}
			}
			rc = kmfber_get_stringa(ber, &((*sss)[j]));
			j++;
		}
		if (rc != KMFBER_DEFAULT && tag != KMFBER_END_OF_SEQORSET) {
			rc = KMFBER_DEFAULT;
		}
		if (j > 0)
			(*sss)[j] = NULL;
		break;

		case 'V':	/* sequence of strings + lengths */
		bv = va_arg(ap, struct berval ***);
		*bv = NULL;
		j = 0;
		for (tag = kmfber_first_element(ber, &len, &last);
		    (tag != KMFBER_DEFAULT &&
		    tag != KMFBER_END_OF_SEQORSET &&
		    rc != KMFBER_DEFAULT);
		    tag = kmfber_next_element(ber, &len, last)) {
			if (*bv == NULL) {
				*bv = (struct berval **)malloc(
				    2 * sizeof (struct berval *));
			} else {
				*bv = (struct berval **)realloc(*bv,
				    (j + 2) * sizeof (struct berval *));
			}
			rc = kmfber_get_stringal(ber, &((*bv)[j]));
			j++;
		}
		if (rc != KMFBER_DEFAULT &&
		    tag != KMFBER_END_OF_SEQORSET) {
			rc = KMFBER_DEFAULT;
		}
		if (j > 0)
			(*bv)[j] = NULL;
		break;

		case 'x':	/* skip the next element - whatever it is */
		if ((rc = kmfber_skip_tag(ber, &len)) == KMFBER_DEFAULT)
			break;
		ber->ber_ptr += len;
		break;

		case '{':	/* begin sequence */
		case '[':	/* begin set */
		if (*(p + 1) != 'v' && *(p + 1) != 'V')
			rc = kmfber_skip_tag(ber, &len);
		break;

		case '}':	/* end sequence */
		case ']':	/* end set */
		break;

		default:
		rc = KMFBER_DEFAULT;
		break;
		}
	}


	va_end(ap);
	if (rc == KMFBER_DEFAULT) {
	va_start(ap, fmt);
	for (p--; fmt < p && *fmt; fmt++) {
		switch (*fmt) {
		case 'a':	/* octet string - allocate storage as needed */
			ss = va_arg(ap, char **);
			if (ss != NULL && *ss != NULL) {
				free(*ss);
				*ss = NULL;
			}
			break;

		case 'b':	/* boolean */
			i = va_arg(ap, int *);
			break;

		case 'e':	/* enumerated */
		case 'i':	/* int */
			l = va_arg(ap, ber_slen_t *);
			break;

		case 'l':	/* length of next item */
			l = va_arg(ap, ber_slen_t *);
			break;

		case 'n':	/* null */
			break;

		case 's':	/* octet string - in a buffer */
			s = va_arg(ap, char *);
			l = va_arg(ap, ber_slen_t *);
			break;

		case 'o':	/* octet string in a supplied berval */
			bval = va_arg(ap, struct berval *);
			if (bval->bv_val) free(bval->bv_val);
			(void) memset(bval, 0, sizeof (struct berval));
			break;

		case 'O':	/* octet string - allocate & include length */
			bvp = va_arg(ap, struct berval **);
			kmfber_bvfree(*bvp);
			bvp = NULL;
			break;

		case 'B':	/* bit string - allocate storage as needed */
			ss = va_arg(ap, char **);
			l = va_arg(ap, ber_slen_t *); /* for length, in bits */
			if (ss != NULL && *ss != NULL) {
				free(*ss);
				*ss = NULL;
			}
			break;

		case 't':	/* tag of next item */
			t = va_arg(ap, ber_tag_t *);
			break;
		case 'T':	/* skip tag of next item */
			t = va_arg(ap, ber_tag_t *);
			break;

		case 'v':	/* sequence of strings */
			sss = va_arg(ap, char ***);
			if (sss != NULL && *sss != NULL) {
				ber_svecfree(*sss);
				*sss = NULL;
			}
			break;

		case 'V':	/* sequence of strings + lengths */
			bv = va_arg(ap, struct berval ***);
			kmfber_bvecfree(*bv);
			*bv = NULL;
			break;

		case 'x':	/* skip the next element - whatever it is */
			break;

		case '{':	/* begin sequence */
		case '[':	/* begin set */
			break;

		case '}':	/* end sequence */
		case ']':	/* end set */
			break;

		default:
			break;
		}
	} /* for */
	va_end(ap);
	} /* if */

	return (rc);
}

struct berval *
kmfber_bvdup(const struct berval *bv)
{
	struct berval	*new;

	if ((new = (struct berval *)malloc(sizeof (struct berval)))
	    == NULL) {
		return (NULL);
	}
	if (bv->bv_val == NULL) {
		new->bv_val = NULL;
		new->bv_len = 0;
	} else {
		if ((new->bv_val = (char *)malloc(bv->bv_len + 1))
		    == NULL) {
			return (NULL);
		}
		(void) memmove(new->bv_val, bv->bv_val, (size_t)bv->bv_len);
		new->bv_val[bv->bv_len] = '\0';
		new->bv_len = bv->bv_len;
	}

	return (new);
}