1 /*
2 * ASN.1 DER parsing
3 * Copyright (c) 2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "asn1.h"
19
asn1_get_next(const u8 * buf,size_t len,struct asn1_hdr * hdr)20 int asn1_get_next(const u8 *buf, size_t len, struct asn1_hdr *hdr)
21 {
22 const u8 *pos, *end;
23 u8 tmp;
24
25 os_memset(hdr, 0, sizeof(*hdr));
26 pos = buf;
27 end = buf + len;
28
29 hdr->identifier = *pos++;
30 hdr->class = hdr->identifier >> 6;
31 hdr->constructed = !!(hdr->identifier & (1 << 5));
32
33 if ((hdr->identifier & 0x1f) == 0x1f) {
34 hdr->tag = 0;
35 do {
36 if (pos >= end) {
37 wpa_printf(MSG_DEBUG, "ASN.1: Identifier "
38 "underflow");
39 return -1;
40 }
41 tmp = *pos++;
42 wpa_printf(MSG_MSGDUMP, "ASN.1: Extended tag data: "
43 "0x%02x", tmp);
44 hdr->tag = (hdr->tag << 7) | (tmp & 0x7f);
45 } while (tmp & 0x80);
46 } else
47 hdr->tag = hdr->identifier & 0x1f;
48
49 tmp = *pos++;
50 if (tmp & 0x80) {
51 if (tmp == 0xff) {
52 wpa_printf(MSG_DEBUG, "ASN.1: Reserved length "
53 "value 0xff used");
54 return -1;
55 }
56 tmp &= 0x7f; /* number of subsequent octets */
57 hdr->length = 0;
58 if (tmp > 4) {
59 wpa_printf(MSG_DEBUG, "ASN.1: Too long length field");
60 return -1;
61 }
62 while (tmp--) {
63 if (pos >= end) {
64 wpa_printf(MSG_DEBUG, "ASN.1: Length "
65 "underflow");
66 return -1;
67 }
68 hdr->length = (hdr->length << 8) | *pos++;
69 }
70 } else {
71 /* Short form - length 0..127 in one octet */
72 hdr->length = tmp;
73 }
74
75 if (end < pos || hdr->length > (unsigned int) (end - pos)) {
76 wpa_printf(MSG_DEBUG, "ASN.1: Contents underflow");
77 return -1;
78 }
79
80 hdr->payload = pos;
81 return 0;
82 }
83
84
asn1_parse_oid(const u8 * buf,size_t len,struct asn1_oid * oid)85 int asn1_parse_oid(const u8 *buf, size_t len, struct asn1_oid *oid)
86 {
87 const u8 *pos, *end;
88 unsigned long val;
89 u8 tmp;
90
91 os_memset(oid, 0, sizeof(*oid));
92
93 pos = buf;
94 end = buf + len;
95
96 while (pos < end) {
97 val = 0;
98
99 do {
100 if (pos >= end)
101 return -1;
102 tmp = *pos++;
103 val = (val << 7) | (tmp & 0x7f);
104 } while (tmp & 0x80);
105
106 if (oid->len >= ASN1_MAX_OID_LEN) {
107 wpa_printf(MSG_DEBUG, "ASN.1: Too long OID value");
108 return -1;
109 }
110 if (oid->len == 0) {
111 /*
112 * The first octet encodes the first two object
113 * identifier components in (X*40) + Y formula.
114 * X = 0..2.
115 */
116 oid->oid[0] = val / 40;
117 if (oid->oid[0] > 2)
118 oid->oid[0] = 2;
119 oid->oid[1] = val - oid->oid[0] * 40;
120 oid->len = 2;
121 } else
122 oid->oid[oid->len++] = val;
123 }
124
125 return 0;
126 }
127
128
asn1_get_oid(const u8 * buf,size_t len,struct asn1_oid * oid,const u8 ** next)129 int asn1_get_oid(const u8 *buf, size_t len, struct asn1_oid *oid,
130 const u8 **next)
131 {
132 struct asn1_hdr hdr;
133
134 if (asn1_get_next(buf, len, &hdr) < 0 || hdr.length == 0)
135 return -1;
136
137 if (hdr.class != ASN1_CLASS_UNIVERSAL || hdr.tag != ASN1_TAG_OID) {
138 wpa_printf(MSG_DEBUG, "ASN.1: Expected OID - found class %d "
139 "tag 0x%x", hdr.class, hdr.tag);
140 return -1;
141 }
142
143 *next = hdr.payload + hdr.length;
144
145 return asn1_parse_oid(hdr.payload, hdr.length, oid);
146 }
147
148
asn1_oid_to_str(struct asn1_oid * oid,char * buf,size_t len)149 void asn1_oid_to_str(struct asn1_oid *oid, char *buf, size_t len)
150 {
151 char *pos = buf;
152 size_t i;
153 int ret;
154
155 if (len == 0)
156 return;
157
158 buf[0] = '\0';
159
160 for (i = 0; i < oid->len; i++) {
161 ret = os_snprintf(pos, buf + len - pos,
162 "%s%lu",
163 i == 0 ? "" : ".", oid->oid[i]);
164 if (ret < 0 || ret >= buf + len - pos)
165 break;
166 pos += ret;
167 }
168 buf[len - 1] = '\0';
169 }
170
171
rotate_bits(u8 octet)172 static u8 rotate_bits(u8 octet)
173 {
174 int i;
175 u8 res;
176
177 res = 0;
178 for (i = 0; i < 8; i++) {
179 res <<= 1;
180 if (octet & 1)
181 res |= 1;
182 octet >>= 1;
183 }
184
185 return res;
186 }
187
188
asn1_bit_string_to_long(const u8 * buf,size_t len)189 unsigned long asn1_bit_string_to_long(const u8 *buf, size_t len)
190 {
191 unsigned long val = 0;
192 const u8 *pos = buf;
193
194 /* BER requires that unused bits are zero, so we can ignore the number
195 * of unused bits */
196 pos++;
197
198 if (len >= 2)
199 val |= rotate_bits(*pos++);
200 if (len >= 3)
201 val |= ((unsigned long) rotate_bits(*pos++)) << 8;
202 if (len >= 4)
203 val |= ((unsigned long) rotate_bits(*pos++)) << 16;
204 if (len >= 5)
205 val |= ((unsigned long) rotate_bits(*pos++)) << 24;
206 if (len >= 6)
207 wpa_printf(MSG_DEBUG, "X509: %s - some bits ignored "
208 "(BIT STRING length %lu)",
209 __func__, (unsigned long) len);
210
211 return val;
212 }
213