ASN.1 encoding. More...

#include <stdint.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include <time.h>
#include <ipxe/tables.h>
#include <ipxe/image.h>
#include <ipxe/crypto.h>
#include <ipxe/asn1.h>

Macros
#define	EINVAL_ASN1_EMPTY __einfo_error ( EINFO_EINVAL_ASN1_EMPTY )
#define	EINFO_EINVAL_ASN1_EMPTY __einfo_uniqify ( EINFO_EINVAL, 0x01, "Empty or underlength cursor" )
#define	EINVAL_ASN1_LEN_LEN __einfo_error ( EINFO_EINVAL_ASN1_LEN_LEN )
#define	EINFO_EINVAL_ASN1_LEN_LEN __einfo_uniqify ( EINFO_EINVAL, 0x02, "Length field overruns cursor" )
#define	EINVAL_ASN1_LEN __einfo_error ( EINFO_EINVAL_ASN1_LEN )
#define	EINFO_EINVAL_ASN1_LEN __einfo_uniqify ( EINFO_EINVAL, 0x03, "Field overruns cursor" )
#define	EINVAL_ASN1_BOOLEAN __einfo_error ( EINFO_EINVAL_ASN1_BOOLEAN )
#define	EINFO_EINVAL_ASN1_BOOLEAN __einfo_uniqify ( EINFO_EINVAL, 0x04, "Invalid boolean" )
#define	EINVAL_ASN1_INTEGER __einfo_error ( EINFO_EINVAL_ASN1_INTEGER )
#define	EINFO_EINVAL_ASN1_INTEGER __einfo_uniqify ( EINFO_EINVAL, 0x04, "Invalid integer" )
#define	EINVAL_ASN1_TIME __einfo_error ( EINFO_EINVAL_ASN1_TIME )
#define	EINFO_EINVAL_ASN1_TIME __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid time" )
#define	EINVAL_ASN1_ALGORITHM __einfo_error ( EINFO_EINVAL_ASN1_ALGORITHM )
#define	EINFO_EINVAL_ASN1_ALGORITHM __einfo_uniqify ( EINFO_EINVAL, 0x06, "Invalid algorithm" )
#define	EINVAL_BIT_STRING __einfo_error ( EINFO_EINVAL_BIT_STRING )
#define	EINFO_EINVAL_BIT_STRING __einfo_uniqify ( EINFO_EINVAL, 0x07, "Invalid bit string" )
#define	ENOTSUP_ALGORITHM __einfo_error ( EINFO_ENOTSUP_ALGORITHM )
#define	EINFO_ENOTSUP_ALGORITHM __einfo_uniqify ( EINFO_ENOTSUP, 0x01, "Unsupported algorithm" )
#define	ENOTSUP_HIGH __einfo_error ( EINFO_ENOTSUP_HIGH )
#define	EINFO_ENOTSUP_HIGH __einfo_uniqify ( EINFO_ENOTSUP, 0x02, "Unsupported high tag number" )
#define	ENOTTY_ALGORITHM __einfo_error ( EINFO_ENOTTY_ALGORITHM )
#define	EINFO_ENOTTY_ALGORITHM __einfo_uniqify ( EINFO_ENOTTY, 0x01, "Inappropriate algorithm" )

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static int	asn1_start (struct asn1_cursor *cursor, unsigned int type)
	Start parsing ASN.1 object.
int	asn1_enter (struct asn1_cursor *cursor, unsigned int type)
	Enter ASN.1 object.
int	asn1_skip_if_exists (struct asn1_cursor *cursor, unsigned int type)
	Skip ASN.1 object if present.
int	asn1_skip (struct asn1_cursor *cursor, unsigned int type)
	Skip ASN.1 object.
int	asn1_shrink (struct asn1_cursor *cursor, unsigned int type)
	Shrink ASN.1 cursor to fit object.
int	asn1_enter_any (struct asn1_cursor *cursor)
	Enter ASN.1 object of any type.
int	asn1_skip_any (struct asn1_cursor *cursor)
	Skip ASN.1 object of any type.
int	asn1_shrink_any (struct asn1_cursor *cursor)
	Shrink ASN.1 object of any type.
int	asn1_enter_bits (struct asn1_cursor cursor, unsigned int unused)
	Enter ASN.1 bit string.
int	asn1_enter_unsigned (struct asn1_cursor *cursor)
	Enter ASN.1 unsigned integer.
int	asn1_boolean (const struct asn1_cursor *cursor)
	Parse value of ASN.1 boolean.
int	asn1_integer (const struct asn1_cursor cursor, int value)
	Parse value of ASN.1 integer.
int	asn1_compare (const struct asn1_cursor cursor1, const struct asn1_cursor cursor2)
	Compare two ASN.1 objects.
static struct asn1_algorithm *	asn1_find_algorithm (const struct asn1_cursor *cursor)
	Identify ASN.1 algorithm by OID.
int	asn1_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm algorithm, struct asn1_cursor params)
	Parse ASN.1 OID-identified algorithm.
int	asn1_pubkey_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm *algorithm)
	Parse ASN.1 OID-identified public-key algorithm.
int	asn1_digest_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm *algorithm)
	Parse ASN.1 OID-identified digest algorithm.
int	asn1_cipher_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm algorithm, struct asn1_cursor params)
	Parse ASN.1 OID-identified cipher algorithm.
int	asn1_signature_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm *algorithm)
	Parse ASN.1 OID-identified signature algorithm.
int	asn1_curve_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm wrapper, struct asn1_algorithm **algorithm)
	Parse ASN.1 OID-identified elliptic curve algorithm.
int	asn1_check_algorithm (const struct asn1_cursor cursor, struct asn1_algorithm expected, struct asn1_cursor *params)
	Check ASN.1 OID-identified algorithm.
int	asn1_parse_cbc (struct asn1_algorithm algorithm, struct asn1_cursor params)
	Parse ASN.1 CBC cipher parameters.
int	asn1_parse_gcm (struct asn1_algorithm algorithm __unused, struct asn1_cursor params)
	Parse ASN.1 GCM cipher parameters.
int	asn1_generalized_time (const struct asn1_cursor cursor, time_t time)
	Parse ASN.1 GeneralizedTime.
static size_t	asn1_header (struct asn1_builder_header *header, unsigned int type, size_t len)
	Construct ASN.1 header.
size_t	asn1_header_len (size_t len)
	Calculate ASN.1 header length.
int	asn1_grow (struct asn1_builder *builder, size_t extra)
	Grow ASN.1 builder.
int	asn1_prepend_raw (struct asn1_builder builder, const void data, size_t len)
	Prepend raw data to ASN.1 builder.
int	asn1_prepend (struct asn1_builder builder, unsigned int type, const void data, size_t len)
	Prepend data to ASN.1 builder.
int	asn1_wrap (struct asn1_builder *builder, unsigned int type)
	Wrap ASN.1 builder.
int	image_asn1 (struct image image, size_t offset, struct asn1_cursor *cursor)
	Extract ASN.1 object from image.
	REQUIRING_SYMBOL (image_asn1)
	REQUIRE_OBJECT (config_asn1)

Detailed Description

ASN.1 encoding.

The ASN.1 parsing helper functions are designed to be safe to use on untrusted input, including malformed input. Any parsing error will cause the function to invalidate the cursor by setting its length field to zero before returning.

All parsing helper functions will strictly respect the cursor's bounds for all purposes (including for determining the tag type and the tag length). An invalidated cursor (or any cursor that happens to naturally end up with a zero length, e.g. by skipping the only existent object) may therefore safely be passed in to any parsing helper function.

A consequence of this design is that it is not necessary to check the return status from all parsing helper functions in a sequence, only to check the return status from the last. The standard C comma operator may safely be used to connect a sequence of ASN.1 parsing operations. For example:

if ( ( rc = ( asn1_enter ( cursor, ASN1_SEQUENCE ),
         asn1_skip ( cursor, ASN1_INTEGER ),
         asn1_enter ( cursor, ASN1_SEQUENCE ) ) ) != 0 ) {
   return rc;
}

or equivalently, just:

asn1_enter ( cursor, ASN1_SEQUENCE );
asn1_skip ( cursor, ASN1_INTEGER );
if ( ( rc = asn1_enter ( cursor, ASN1_SEQUENCE ) ) != 0 )
   return rc;

The caller may not need to check the return status from the parsing helper functions at all. For example, a caller that is trying to extract a fixed-length octet string from within a deeply nested ASN.1 structure may simply check that the resulting cursor length is correct (which it would have to check anyway). Since any error will produce a zero-length cursor, this check would also suffice to catch any parsing errors.

The cursor navigation functions such as asn1_enter() and asn1_skip() will validate the type and length bytes (which they consume themselves), but will not otherwise validate the contents of the cursor. Callers must perform their own validation after navigating to the expected data structure (e.g. by checking that the resulting length is correct), or use the higher-level helpers such as asn1_boolean() and asn1_integer() that validate and extract the semantic contents of cursors.

The type ASN1_ANY may be used as a wildcard type to enter or skip an object of any type.

The function asn1_skip_if_exists() may be useful when parsing objects where an encountered type is not knowable in advance (e.g. for sequences containing optional elements). If the potential type is not found, then asn1_skip_if_exists() will return an error but will not invalidate the cursor (since a missing optional object is not a parsing error).

The function asn1_type() may be used to determine the type of an unknown object. Calling asn1_type() on an invalidated cursor will return ASN1_END (and the cursor will remain invalidated).

Definition in file asn1.c.

Macro Definition Documentation

◆ EINVAL_ASN1_EMPTY

#define EINVAL_ASN1_EMPTY __einfo_error ( EINFO_EINVAL_ASN1_EMPTY )

Definition at line 118 of file asn1.c.

118#define EINVAL_ASN1_EMPTY \

119 __einfo_error ( EINFO_EINVAL_ASN1_EMPTY )

Referenced by asn1_start().

◆ EINFO_EINVAL_ASN1_EMPTY

#define EINFO_EINVAL_ASN1_EMPTY __einfo_uniqify ( EINFO_EINVAL, 0x01, "Empty or underlength cursor" )

Definition at line 120 of file asn1.c.

120#define EINFO_EINVAL_ASN1_EMPTY \

121 __einfo_uniqify ( EINFO_EINVAL, 0x01, "Empty or underlength cursor" )

◆ EINVAL_ASN1_LEN_LEN

#define EINVAL_ASN1_LEN_LEN __einfo_error ( EINFO_EINVAL_ASN1_LEN_LEN )

Definition at line 122 of file asn1.c.

122#define EINVAL_ASN1_LEN_LEN \

123 __einfo_error ( EINFO_EINVAL_ASN1_LEN_LEN )

Referenced by asn1_start().

◆ EINFO_EINVAL_ASN1_LEN_LEN

#define EINFO_EINVAL_ASN1_LEN_LEN __einfo_uniqify ( EINFO_EINVAL, 0x02, "Length field overruns cursor" )

Definition at line 124 of file asn1.c.

124#define EINFO_EINVAL_ASN1_LEN_LEN \

125 __einfo_uniqify ( EINFO_EINVAL, 0x02, "Length field overruns cursor" )

◆ EINVAL_ASN1_LEN

#define EINVAL_ASN1_LEN __einfo_error ( EINFO_EINVAL_ASN1_LEN )

Definition at line 126 of file asn1.c.

126#define EINVAL_ASN1_LEN \

127 __einfo_error ( EINFO_EINVAL_ASN1_LEN )

Referenced by asn1_start().

◆ EINFO_EINVAL_ASN1_LEN

#define EINFO_EINVAL_ASN1_LEN __einfo_uniqify ( EINFO_EINVAL, 0x03, "Field overruns cursor" )

Definition at line 128 of file asn1.c.

128#define EINFO_EINVAL_ASN1_LEN \

129 __einfo_uniqify ( EINFO_EINVAL, 0x03, "Field overruns cursor" )

◆ EINVAL_ASN1_BOOLEAN

#define EINVAL_ASN1_BOOLEAN __einfo_error ( EINFO_EINVAL_ASN1_BOOLEAN )

Definition at line 130 of file asn1.c.

130#define EINVAL_ASN1_BOOLEAN \

131 __einfo_error ( EINFO_EINVAL_ASN1_BOOLEAN )

Referenced by asn1_boolean().

◆ EINFO_EINVAL_ASN1_BOOLEAN

#define EINFO_EINVAL_ASN1_BOOLEAN __einfo_uniqify ( EINFO_EINVAL, 0x04, "Invalid boolean" )

Definition at line 132 of file asn1.c.

132#define EINFO_EINVAL_ASN1_BOOLEAN \

133 __einfo_uniqify ( EINFO_EINVAL, 0x04, "Invalid boolean" )

◆ EINVAL_ASN1_INTEGER

#define EINVAL_ASN1_INTEGER __einfo_error ( EINFO_EINVAL_ASN1_INTEGER )

Definition at line 134 of file asn1.c.

134#define EINVAL_ASN1_INTEGER \

135 __einfo_error ( EINFO_EINVAL_ASN1_INTEGER )

Referenced by asn1_integer().

◆ EINFO_EINVAL_ASN1_INTEGER

#define EINFO_EINVAL_ASN1_INTEGER __einfo_uniqify ( EINFO_EINVAL, 0x04, "Invalid integer" )

Definition at line 136 of file asn1.c.

136#define EINFO_EINVAL_ASN1_INTEGER \

137 __einfo_uniqify ( EINFO_EINVAL, 0x04, "Invalid integer" )

◆ EINVAL_ASN1_TIME

#define EINVAL_ASN1_TIME __einfo_error ( EINFO_EINVAL_ASN1_TIME )

Definition at line 138 of file asn1.c.

138#define EINVAL_ASN1_TIME \

139 __einfo_error ( EINFO_EINVAL_ASN1_TIME )

Referenced by asn1_generalized_time().

◆ EINFO_EINVAL_ASN1_TIME

#define EINFO_EINVAL_ASN1_TIME __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid time" )

Definition at line 140 of file asn1.c.

140#define EINFO_EINVAL_ASN1_TIME \

141 __einfo_uniqify ( EINFO_EINVAL, 0x05, "Invalid time" )

◆ EINVAL_ASN1_ALGORITHM

#define EINVAL_ASN1_ALGORITHM __einfo_error ( EINFO_EINVAL_ASN1_ALGORITHM )

Definition at line 142 of file asn1.c.

142#define EINVAL_ASN1_ALGORITHM \

143 __einfo_error ( EINFO_EINVAL_ASN1_ALGORITHM )

Referenced by asn1_algorithm().

◆ EINFO_EINVAL_ASN1_ALGORITHM

#define EINFO_EINVAL_ASN1_ALGORITHM __einfo_uniqify ( EINFO_EINVAL, 0x06, "Invalid algorithm" )

Definition at line 144 of file asn1.c.

144#define EINFO_EINVAL_ASN1_ALGORITHM \

145 __einfo_uniqify ( EINFO_EINVAL, 0x06, "Invalid algorithm" )

◆ EINVAL_BIT_STRING

#define EINVAL_BIT_STRING __einfo_error ( EINFO_EINVAL_BIT_STRING )

Definition at line 146 of file asn1.c.

146#define EINVAL_BIT_STRING \

147 __einfo_error ( EINFO_EINVAL_BIT_STRING )

Referenced by asn1_enter_bits().

◆ EINFO_EINVAL_BIT_STRING

#define EINFO_EINVAL_BIT_STRING __einfo_uniqify ( EINFO_EINVAL, 0x07, "Invalid bit string" )

Definition at line 148 of file asn1.c.

148#define EINFO_EINVAL_BIT_STRING \

149 __einfo_uniqify ( EINFO_EINVAL, 0x07, "Invalid bit string" )

◆ ENOTSUP_ALGORITHM

#define ENOTSUP_ALGORITHM __einfo_error ( EINFO_ENOTSUP_ALGORITHM )

Definition at line 150 of file asn1.c.

150#define ENOTSUP_ALGORITHM \

151 __einfo_error ( EINFO_ENOTSUP_ALGORITHM )

Referenced by asn1_algorithm(), and asn1_curve_algorithm().

◆ EINFO_ENOTSUP_ALGORITHM

#define EINFO_ENOTSUP_ALGORITHM __einfo_uniqify ( EINFO_ENOTSUP, 0x01, "Unsupported algorithm" )

Definition at line 152 of file asn1.c.

152#define EINFO_ENOTSUP_ALGORITHM \

153 __einfo_uniqify ( EINFO_ENOTSUP, 0x01, "Unsupported algorithm" )

◆ ENOTSUP_HIGH

#define ENOTSUP_HIGH __einfo_error ( EINFO_ENOTSUP_HIGH )

Definition at line 154 of file asn1.c.

154#define ENOTSUP_HIGH \

155 __einfo_error ( EINFO_ENOTSUP_HIGH )

Referenced by asn1_start().

◆ EINFO_ENOTSUP_HIGH

#define EINFO_ENOTSUP_HIGH __einfo_uniqify ( EINFO_ENOTSUP, 0x02, "Unsupported high tag number" )

Definition at line 156 of file asn1.c.

156#define EINFO_ENOTSUP_HIGH \

157 __einfo_uniqify ( EINFO_ENOTSUP, 0x02, "Unsupported high tag number" )

◆ ENOTTY_ALGORITHM

#define ENOTTY_ALGORITHM __einfo_error ( EINFO_ENOTTY_ALGORITHM )

Definition at line 158 of file asn1.c.

158#define ENOTTY_ALGORITHM \

159 __einfo_error ( EINFO_ENOTTY_ALGORITHM )

Referenced by asn1_check_algorithm(), asn1_cipher_algorithm(), asn1_curve_algorithm(), asn1_digest_algorithm(), asn1_pubkey_algorithm(), and asn1_signature_algorithm().

◆ EINFO_ENOTTY_ALGORITHM

#define EINFO_ENOTTY_ALGORITHM __einfo_uniqify ( EINFO_ENOTTY, 0x01, "Inappropriate algorithm" )

Definition at line 160 of file asn1.c.

160#define EINFO_ENOTTY_ALGORITHM \

161 __einfo_uniqify ( EINFO_ENOTTY, 0x01, "Inappropriate algorithm" )

Function Documentation

◆ FILE_LICENCE()

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL )

◆ FILE_SECBOOT()

FILE_SECBOOT ( PERMITTED )

◆ asn1_start()

int asn1_start	(	struct asn1_cursor *	cursor,
		unsigned int	type )

static

Start parsing ASN.1 object.

Parameters

cursor	ASN.1 object cursor
type	Expected type, or ASN1_ANY

Return values

len	Length of object body, or negative error

The object cursor will be updated to point to the start of the object body (i.e. the first byte following the length byte(s)), and the length of the object body (i.e. the number of bytes until the following object tag, if any) is returned.

If the expected type is not found, the object cursor will not be modified. If any other error occurs, the object cursor will be invalidated.

Definition at line 179 of file asn1.c.

                                                                        {
        unsigned int len_len;
        unsigned int len;
        uint8_t high_byte;
 
        /* Sanity check */
        if ( cursor->len < 2 /* Tag byte and first length byte */ ) {
                if ( cursor->len )
                        DBGC ( cursor, "ASN1 %p too short\n", cursor );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL_ASN1_EMPTY;
        }
 
        /* Refuse to handle multi-byte tags */
        if ( ( asn1_type ( cursor ) & ASN1_HIGH ) == ASN1_HIGH ) {
                DBGC ( cursor, "ASN1 %p has unsupported high tag number\n",
                       cursor );
                asn1_invalidate_cursor ( cursor );
                return -ENOTSUP_HIGH;
        }
 
        /* Check the tag byte */
        if ( ( type != ASN1_ANY ) && ( type != asn1_type ( cursor ) ) ) {
                DBGC ( cursor, "ASN1 %p type mismatch (expected %d, got %d)\n",
                       cursor, type, *( ( uint8_t * ) cursor->data ) );
                return -ENXIO;
        }
        cursor->data++;
        cursor->len--;
 
        /* Extract length of the length field and sanity check */
        len_len = *( ( uint8_t * ) cursor->data );
        if ( len_len & 0x80 ) {
                len_len = ( len_len & 0x7f );
                cursor->data++;
                cursor->len--;
        } else {
                len_len = 1;
        }
        if ( ( len_len == 0 ) || ( cursor->len < len_len ) ) {
                DBGC ( cursor, "ASN1 %p bad length field length %d (min 0, "
                       "max %zd)\n", cursor, len_len, cursor->len );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL_ASN1_LEN_LEN;
        }
 
        /* Extract the length and sanity check */
        for ( len = 0 ; len_len ; len_len-- ) {
                high_byte = ( len >> ( 8 * ( sizeof ( len ) - 1 ) ) );
                if ( high_byte ) {
                        DBGC ( cursor, "ASN1 %p unrepresentable length\n",
                               cursor );
                        asn1_invalidate_cursor ( cursor );
                        return -EINVAL_ASN1_LEN;
                }
                len <<= 8;
                len |= *( ( uint8_t * ) cursor->data );
                cursor->data++;
                cursor->len--;
        }
        if ( ( cursor->len < len ) || ( ( ( int ) len ) < 0 ) ) {
                DBGC ( cursor, "ASN1 %p bad length %d (min 0, max %zd)\n",
                       cursor, len, cursor->len );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL_ASN1_LEN;
        }
 
        return len;
}

References ASN1_ANY, ASN1_HIGH, asn1_invalidate_cursor(), asn1_type(), asn1_cursor::data, DBGC, EINVAL_ASN1_EMPTY, EINVAL_ASN1_LEN, EINVAL_ASN1_LEN_LEN, ENOTSUP_HIGH, ENXIO, asn1_cursor::len, len, and type.

Referenced by asn1_enter(), asn1_shrink(), and asn1_skip_if_exists().

◆ asn1_enter()

int asn1_enter	(	struct asn1_cursor *	cursor,
		unsigned int	type )

Enter ASN.1 object.

Parameters

cursor	ASN.1 object cursor
type	Expected type, or ASN1_ANY

Return values

rc	Return status code

The object cursor will be updated to point to the body of the current ASN.1 object.

If any error occurs, the object cursor will be invalidated.

Definition at line 261 of file asn1.c.

                                                                 {
        int len;
 
        /* Parse current object */
        len = asn1_start ( cursor, type );
        if ( len < 0 ) {
                asn1_invalidate_cursor ( cursor );
                return len;
        }
 
        /* Update cursor */
        if ( ( ( size_t ) len ) <= cursor->len )
                cursor->len = len;
 
        DBGC ( cursor, "ASN1 %p entered object type %02x (len %x)\n",
               cursor, type, len );
        return 0;
}

References asn1_invalidate_cursor(), asn1_start(), DBGC, asn1_cursor::len, len, and type.

Referenced by asn1_algorithm(), asn1_boolean(), asn1_curve_algorithm(), asn1_enter_any(), asn1_enter_bits(), asn1_enter_unsigned(), asn1_generalized_time(), asn1_integer(), asn1_parse_cbc(), asn1_parse_gcm(), cms_parse(), cms_parse_certificates(), cms_parse_content_type(), cms_parse_encrypted(), cms_parse_enveloped(), cms_parse_identifier(), cms_parse_mac(), cms_parse_participant(), cms_parse_participants(), cms_parse_signed(), cms_parse_value(), ecdsa_parse_key(), ecdsa_verify(), ocsp_compare_responder_key_hash(), ocsp_parse_basic_response(), ocsp_parse_cert_id(), ocsp_parse_certs(), ocsp_parse_response(), ocsp_parse_response_bytes(), ocsp_parse_response_status(), ocsp_parse_response_type(), ocsp_parse_responses(), ocsp_parse_tbs_response_data(), ocsp_request(), rsa_parse_mod_exp(), validator_append(), x509_parse(), x509_parse_access_description(), x509_parse_authority_info_access(), x509_parse_basic_constraints(), x509_parse_common_name(), x509_parse_extended_key_usage(), x509_parse_extension(), x509_parse_extensions(), x509_parse_key_purpose(), x509_parse_ocsp(), x509_parse_public_key(), x509_parse_subject_alt_name(), x509_parse_tbscertificate(), x509_parse_validity(), and x509_parse_version().

◆ asn1_skip_if_exists()

int asn1_skip_if_exists	(	struct asn1_cursor *	cursor,
		unsigned int	type )

Skip ASN.1 object if present.

Parameters

cursor	ASN.1 object cursor
type	Expected type, or ASN1_ANY

Return values

rc	Return status code

The object cursor will be updated to point to the next ASN.1 object.

If the expected type is not found, the object cursor will not be modified. If any other error occurs, the object cursor will be invalidated.

Definition at line 294 of file asn1.c.

                                                                          {
        int len;
 
        /* Parse current object */
        len = asn1_start ( cursor, type );
        if ( len < 0 )
                return len;
 
        /* Update cursor */
        cursor->data += len;
        cursor->len -= len;
 
        DBGC ( cursor, "ASN1 %p skipped object type %02x (len %x)\n",
               cursor, type, len );
        return 0;
}

References asn1_start(), asn1_cursor::data, DBGC, asn1_cursor::len, len, and type.

Referenced by asn1_skip(), cms_parse_enveloped(), cms_parse_participant(), cms_parse_signed(), and ocsp_parse_tbs_response_data().

◆ asn1_skip()

int asn1_skip	(	struct asn1_cursor *	cursor,
		unsigned int	type )

Skip ASN.1 object.

Parameters

cursor	ASN.1 object cursor
type	Expected type, or ASN1_ANY

Return values

rc	Return status code

The object cursor will be updated to point to the next ASN.1 object.

If any error occurs, the object cursor will be invalidated.

Definition at line 323 of file asn1.c.

                                                                {
        int rc;
 
        if ( ( rc = asn1_skip_if_exists ( cursor, type ) ) != 0 ) {
                asn1_invalidate_cursor ( cursor );
                return rc;
        }
 
        return 0;
}

References asn1_invalidate_cursor(), asn1_skip_if_exists(), rc, and type.

Referenced by asn1_skip_any(), cms_parse_encrypted(), cms_parse_enveloped(), cms_parse_participant(), cms_parse_signed(), der_image_probe(), ecdsa_parse_key(), ocsp_parse_cert_id(), ocsp_request(), and rsa_parse_mod_exp().

◆ asn1_shrink()

int asn1_shrink	(	struct asn1_cursor *	cursor,
		unsigned int	type )

Shrink ASN.1 cursor to fit object.

Parameters

cursor	ASN.1 object cursor
type	Expected type, or ASN1_ANY

Return values

rc	Return status code

The object cursor will be shrunk to contain only the current ASN.1 object.

If any error occurs, the object cursor will be invalidated.

Definition at line 346 of file asn1.c.

                                                                  {
        struct asn1_cursor temp;
        const void *end;
        int len;
 
        /* Find end of object */
        memcpy ( &temp, cursor, sizeof ( temp ) );
        len = asn1_start ( &temp, type );
        if ( len < 0 ) {
                asn1_invalidate_cursor ( cursor );
                return len;
        }
        end = ( temp.data + len );
 
        /* Shrink original cursor to contain only its first object */
        cursor->len = ( end - cursor->data );
 
        return 0;
}

References asn1_invalidate_cursor(), asn1_start(), asn1_cursor::data, end, asn1_cursor::len, len, memcpy(), and type.

Referenced by asn1_shrink_any(), cms_parse_identifier(), ocsp_parse_cert_id(), x509_parse_issuer(), and x509_parse_serial().

◆ asn1_enter_any()

int asn1_enter_any ( struct asn1_cursor * cursor )

Enter ASN.1 object of any type.

Parameters

cursor ASN.1 object cursor

Return values

rc	Return status code

Definition at line 372 of file asn1.c.

                                                  {
        return asn1_enter ( cursor, ASN1_ANY );
}

References ASN1_ANY, and asn1_enter().

Referenced by ecdsa_parse_key(), ocsp_parse_responder_id(), x509_check_alt_name(), and x509_parse_common_name().

◆ asn1_skip_any()

int asn1_skip_any ( struct asn1_cursor * cursor )

Skip ASN.1 object of any type.

Parameters

cursor ASN.1 object cursor

Return values

rc	Return status code

Definition at line 382 of file asn1.c.

                                                 {
        return asn1_skip ( cursor, ASN1_ANY );
}

References ASN1_ANY, and asn1_skip().

Referenced by asn1_algorithm(), cms_parse(), cms_parse_certificates(), cms_parse_enveloped(), cms_parse_identifier(), cms_parse_participant(), cms_parse_participants(), cms_parse_signed(), ecdsa_parse_key(), ecdsa_verify(), ocsp_parse_basic_response(), ocsp_parse_certs(), ocsp_parse_response(), ocsp_parse_response_bytes(), ocsp_parse_responses(), ocsp_parse_tbs_response_data(), rsa_parse_mod_exp(), validator_append(), x509_check_name(), x509_parse(), x509_parse_access_description(), x509_parse_authority_info_access(), x509_parse_basic_constraints(), x509_parse_common_name(), x509_parse_extended_key_usage(), x509_parse_extension(), x509_parse_extensions(), x509_parse_public_key(), x509_parse_tbscertificate(), and x509_parse_validity().

◆ asn1_shrink_any()

int asn1_shrink_any ( struct asn1_cursor * cursor )

Shrink ASN.1 object of any type.

Parameters

cursor ASN.1 object cursor

Return values

rc	Return status code

Definition at line 392 of file asn1.c.

                                                   {
        return asn1_shrink ( cursor, ASN1_ANY );
}

References ASN1_ANY, and asn1_shrink().

Referenced by cms_message(), der_asn1(), ocsp_parse_tbs_response_data(), x509_certificate(), x509_parse_public_key(), x509_parse_subject(), and x509_parse_tbscertificate().

◆ asn1_enter_bits()

int asn1_enter_bits	(	struct asn1_cursor *	cursor,
		unsigned int *	unused )

Enter ASN.1 bit string.

Parameters

cursor	ASN.1 cursor
unused	Unused bits to fill in (or NULL to require all used)

Return values

rc	Return status code

Definition at line 403 of file asn1.c.

                                                                         {
        const struct {
                uint8_t unused;
                uint8_t data[0];
        } __attribute__ (( packed )) *bit_string;
        const uint8_t *last;
        unsigned int unused_bits;
        int rc;
 
        /* Enter bit string */
        if ( ( rc = asn1_enter ( cursor, ASN1_BIT_STRING ) ) != 0 )
                return rc;
 
        /* Check that bit string header exists */
        if ( cursor->len < sizeof ( *bit_string ) ) {
                DBGC ( cursor, "ASN1 %p invalid bit string:\n", cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL_BIT_STRING;
        }
        bit_string = cursor->data;
        last = ( cursor->data + cursor->len - 1 );
        cursor->data = &bit_string->data;
        cursor->len -= offsetof ( typeof ( *bit_string ), data );
        unused_bits = bit_string->unused;
 
        /* Check validity of unused bits */
        if ( ( unused_bits >= 8 ) ||
             ( ( unused_bits > 0 ) && ( cursor->len == 0 ) ) ||
             ( ( *last & ( 0xffU >> ( 8 - unused_bits ) ) ) != 0 ) ) {
                DBGC ( cursor, "ASN1 %p invalid bit string:\n", cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL_BIT_STRING;
        }
 
        /* Record or check number of unused bits, as applicable */
        if ( unused ) {
                *unused = unused_bits;
        } else if ( unused_bits ) {
                DBGC ( cursor, "ASN1 %p invalid integral bit string:\n",
                       cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL_BIT_STRING;
        }
 
        return 0;
}

References __attribute__, ASN1_BIT_STRING, asn1_enter(), asn1_invalidate_cursor(), asn1_cursor::data, data, DBGC, DBGC_HDA, EINVAL_BIT_STRING, asn1_cursor::len, offsetof, rc, typeof(), and unused.

Referenced by ecdsa_parse_key(), ocsp_parse_basic_response(), rsa_parse_mod_exp(), x509_parse(), x509_parse_key_usage(), and x509_parse_public_key().

◆ asn1_enter_unsigned()

int asn1_enter_unsigned ( struct asn1_cursor * cursor )

Enter ASN.1 unsigned integer.

Parameters

cursor ASN.1 object cursor

Return values

rc	Return status code

Definition at line 459 of file asn1.c.

                                                       {
        uint8_t msb;
        int rc;
 
        /* Enter integer */
        if ( ( rc = asn1_enter ( cursor, ASN1_INTEGER ) ) != 0 )
                return rc;
 
        /* Reject empty integers */
        if ( ! cursor->len ) {
                DBGC ( cursor, "ASN1 %p empty unsigned integer\n", cursor );
                /* Cursor is already invalid */
                return -EINVAL;
        }
 
        /* Reject negative values */
        msb = *( ( uint8_t * ) cursor->data );
        if ( msb & 0x80 ) {
                DBGC ( cursor, "ASN1 %p negative unsigned integer:\n",
                       cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                asn1_invalidate_cursor ( cursor );
                return -EINVAL;
        }
 
        /* Skip any initial positive sign byte(s) */
        while ( ( cursor->len > 1 ) && ( msb == 0x00 ) ) {
                cursor->data++;
                cursor->len--;
                msb = *( ( uint8_t * ) cursor->data );
        }
 
        return 0;
}

References asn1_enter(), ASN1_INTEGER, asn1_invalidate_cursor(), asn1_cursor::data, DBGC, DBGC_HDA, EINVAL, asn1_cursor::len, and rc.

Referenced by ecdsa_parse_signature(), and rsa_parse_mod_exp().

◆ asn1_boolean()

int asn1_boolean ( const struct asn1_cursor * cursor )

Parse value of ASN.1 boolean.

Parameters

cursor ASN.1 object cursor

Return values

value Value, or negative error

Definition at line 500 of file asn1.c.

                                                      {
        struct asn1_cursor contents;
        const struct {
                uint8_t value;
        } __attribute__ (( packed )) *boolean;
 
        /* Enter boolean */
        memcpy ( &contents, cursor, sizeof ( contents ) );
        asn1_enter ( &contents, ASN1_BOOLEAN );
        if ( contents.len != sizeof ( *boolean ) )
                return -EINVAL_ASN1_BOOLEAN;
 
        /* Extract value */
        boolean = contents.data;
        return boolean->value;
}

References __attribute__, ASN1_BOOLEAN, asn1_enter(), asn1_cursor::data, EINVAL_ASN1_BOOLEAN, asn1_cursor::len, memcpy(), and value.

Referenced by x509_parse_basic_constraints(), and x509_parse_extension().

◆ asn1_integer()

int asn1_integer	(	const struct asn1_cursor *	cursor,
		int *	value )

Parse value of ASN.1 integer.

Parameters

cursor	ASN.1 object cursor
value	Value to fill in

Return values

rc	Return status code

Definition at line 524 of file asn1.c.

                                                                  {
        struct asn1_cursor contents;
        uint8_t high_byte;
        int rc;
 
        /* Enter integer */
        memcpy ( &contents, cursor, sizeof ( contents ) );
        if ( ( rc = asn1_enter ( &contents, ASN1_INTEGER ) ) != 0 )
                return rc;
        if ( contents.len < 1 )
                return -EINVAL_ASN1_INTEGER;
 
        /* Initialise value according to sign byte */
        *value = *( ( int8_t * ) contents.data );
        contents.data++;
        contents.len--;
 
        /* Process value */
        while ( contents.len ) {
                high_byte = ( (*value) >> ( 8 * ( sizeof ( *value ) - 1 ) ) );
                if ( ( high_byte != 0x00 ) && ( high_byte != 0xff ) ) {
                        DBGC ( cursor, "ASN1 %p integer overflow\n", cursor );
                        return -EINVAL_ASN1_INTEGER;
                }
                *value = ( ( *value << 8 ) | *( ( uint8_t * ) contents.data ) );
                contents.data++;
                contents.len--;
        }
 
        return 0;
}

References asn1_enter(), ASN1_INTEGER, asn1_cursor::data, DBGC, EINVAL_ASN1_INTEGER, asn1_cursor::len, memcpy(), rc, and value.

Referenced by x509_parse_basic_constraints(), and x509_parse_version().

◆ asn1_compare()

int asn1_compare	(	const struct asn1_cursor *	cursor1,
		const struct asn1_cursor *	cursor2 )

Compare two ASN.1 objects.

Parameters

cursor1	ASN.1 object cursor
cursor2	ASN.1 object cursor

Return values

difference Difference as returned by memcmp()

Note that invalid and empty cursors will compare as equal with each other.

Definition at line 566 of file asn1.c.

                                                       {
        int difference;
 
        difference = ( cursor2->len - cursor1->len );
        return ( difference ? difference :
                 memcmp ( cursor1->data, cursor2->data, cursor1->len ) );
}

References asn1_cursor::data, asn1_cursor::len, and memcmp().

Referenced by asn1_find_algorithm(), cms_parse_content_type(), ocsp_compare_responder_name(), ocsp_parse_cert_id(), ocsp_parse_response_type(), pubkey_decrypt_okx(), pubkey_encrypt_decrypt_okx(), pubkey_encrypt_okx(), pubkey_sign_okx(), rsa_match(), x509_check_issuer(), x509_find(), x509_find_access_method(), x509_find_extension(), x509_find_issuer_serial(), x509_find_subject(), x509_is_self_signed(), x509_parse_common_name(), and x509_parse_key_purpose().

◆ asn1_find_algorithm()

struct asn1_algorithm * asn1_find_algorithm ( const struct asn1_cursor * cursor )

static

Identify ASN.1 algorithm by OID.

Parameters

cursor ASN.1 object cursor

Return values

algorithm Algorithm, or NULL

Definition at line 583 of file asn1.c.

                                                         {
        struct asn1_algorithm *algorithm;
 
        for_each_table_entry ( algorithm, ASN1_ALGORITHMS ) {
                if ( asn1_compare ( &algorithm->oid, cursor ) == 0 )
                        return algorithm;
        }
 
        return NULL;
}

References algorithm, ASN1_ALGORITHMS, asn1_compare(), for_each_table_entry, and NULL.

Referenced by asn1_algorithm(), and asn1_curve_algorithm().

◆ asn1_algorithm()

int asn1_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm **	algorithm,
		struct asn1_cursor *	params )

Parse ASN.1 OID-identified algorithm.

Parameters

cursor ASN.1 object cursor

Return values

algorithm	Algorithm
params	Algorithm parameters, or NULL
rc	Return status code

Definition at line 602 of file asn1.c.

                                                  {
        struct asn1_cursor contents;
        int rc;
 
        /* Enter algorithm */
        memcpy ( &contents, cursor, sizeof ( contents ) );
        asn1_enter ( &contents, ASN1_SEQUENCE );
 
        /* Get raw parameters, if applicable */
        if ( params ) {
                memcpy ( params, &contents, sizeof ( *params ) );
                asn1_skip_any ( params );
        }
 
        /* Enter algorithm identifier */
        if ( ( rc = asn1_enter ( &contents, ASN1_OID ) ) != 0 ) {
                DBGC ( cursor, "ASN1 %p cannot locate algorithm OID:\n",
                       cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -EINVAL_ASN1_ALGORITHM;
        }
 
        /* Identify algorithm */
        *algorithm = asn1_find_algorithm ( &contents );
        if ( ! *algorithm ) {
                DBGC ( cursor, "ASN1 %p unrecognised algorithm:\n", cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTSUP_ALGORITHM;
        }
 
        /* Parse parameters, if applicable */
        if ( params && (*algorithm)->parse &&
             ( ( rc = (*algorithm)->parse ( *algorithm, params ) ) != 0 ) ) {
                DBGC ( cursor, "ASN1 %p cannot parse %s parameters: %s\n",
                       cursor, (*algorithm)->name, strerror ( rc ) );
                return rc;
        }
 
        return 0;
}

References algorithm, asn1_enter(), asn1_find_algorithm(), ASN1_OID, ASN1_SEQUENCE, asn1_skip_any(), asn1_cursor::data, DBGC, DBGC_HDA, EINVAL_ASN1_ALGORITHM, ENOTSUP_ALGORITHM, asn1_cursor::len, memcpy(), rc, and strerror().

◆ asn1_pubkey_algorithm()

int asn1_pubkey_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm **	algorithm )

Parse ASN.1 OID-identified public-key algorithm.

Parameters

cursor ASN.1 object cursor

Return values

algorithm	Algorithm
rc	Return status code

Definition at line 652 of file asn1.c.

                                                                {
        int rc;
 
        /* Parse algorithm */
        if ( ( rc = asn1_algorithm ( cursor, algorithm, NULL ) ) != 0 )
                return rc;
 
        /* Check algorithm has a public key */
        if ( ! (*algorithm)->pubkey ) {
                DBGC ( cursor, "ASN1 %p algorithm %s is not a public-key "
                       "algorithm:\n", cursor, (*algorithm)->name );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTTY_ALGORITHM;
        }
 
        return 0;
}

References algorithm, asn1_cursor::data, DBGC, DBGC_HDA, ENOTTY_ALGORITHM, asn1_cursor::len, NULL, and rc.

Referenced by cms_parse_pubkey_algorithm(), and x509_parse_public_key().

◆ asn1_digest_algorithm()

int asn1_digest_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm **	algorithm )

Parse ASN.1 OID-identified digest algorithm.

Parameters

cursor ASN.1 object cursor

Return values

algorithm	Algorithm
rc	Return status code

Definition at line 678 of file asn1.c.

                                                                {
        int rc;
 
        /* Parse algorithm */
        if ( ( rc = asn1_algorithm ( cursor, algorithm, NULL ) ) != 0 )
                return rc;
 
        /* Check algorithm has a digest */
        if ( ! (*algorithm)->digest ) {
                DBGC ( cursor, "ASN1 %p algorithm %s is not a digest "
                       "algorithm:\n", cursor, (*algorithm)->name );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTTY_ALGORITHM;
        }
 
        return 0;
}

References algorithm, asn1_cursor::data, DBGC, DBGC_HDA, ENOTTY_ALGORITHM, asn1_cursor::len, NULL, and rc.

Referenced by cms_parse_digest_algorithm().

◆ asn1_cipher_algorithm()

int asn1_cipher_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm **	algorithm,
		struct asn1_cursor *	params )

Parse ASN.1 OID-identified cipher algorithm.

Parameters

cursor ASN.1 object cursor

Return values

algorithm	Algorithm
params	Algorithm parameters, or NULL
rc	Return status code

Definition at line 705 of file asn1.c.

                                                         {
        int rc;
 
        /* Parse algorithm */
        if ( ( rc = asn1_algorithm ( cursor, algorithm, params ) ) != 0 )
                return rc;
 
        /* Check algorithm has a cipher */
        if ( ! (*algorithm)->cipher ) {
                DBGC ( cursor, "ASN1 %p algorithm %s is not a cipher "
                       "algorithm:\n", cursor, (*algorithm)->name );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTTY_ALGORITHM;
        }
 
        return 0;
}

References algorithm, asn1_cursor::data, DBGC, DBGC_HDA, ENOTTY_ALGORITHM, asn1_cursor::len, and rc.

Referenced by cms_parse_cipher_algorithm().

◆ asn1_signature_algorithm()

int asn1_signature_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm **	algorithm )

Parse ASN.1 OID-identified signature algorithm.

Parameters

cursor ASN.1 object cursor

Return values

algorithm	Algorithm
rc	Return status code

Definition at line 732 of file asn1.c.

                                                                   {
        int rc;
 
        /* Parse algorithm */
        if ( ( rc = asn1_algorithm ( cursor, algorithm, NULL ) ) != 0 )
                return rc;
 
        /* Check algorithm has a public key */
        if ( ! (*algorithm)->pubkey ) {
                DBGC ( cursor, "ASN1 %p algorithm %s is not a signature "
                       "algorithm:\n", cursor, (*algorithm)->name );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTTY_ALGORITHM;
        }
 
        /* Check algorithm has a digest */
        if ( ! (*algorithm)->digest ) {
                DBGC ( cursor, "ASN1 %p algorithm %s is not a signature "
                       "algorithm:\n", cursor, (*algorithm)->name );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTTY_ALGORITHM;
        }
 
        return 0;
}

References algorithm, asn1_cursor::data, DBGC, DBGC_HDA, ENOTTY_ALGORITHM, asn1_cursor::len, NULL, and rc.

Referenced by ocsp_parse_basic_response(), x509_parse(), and x509_parse_tbscertificate().

◆ asn1_curve_algorithm()

int asn1_curve_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm *	wrapper,
		struct asn1_algorithm **	algorithm )

Parse ASN.1 OID-identified elliptic curve algorithm.

Parameters

cursor	ASN.1 object cursor
wrapper	Optional wrapper algorithm, or NULL

Return values

algorithm	Algorithm
rc	Return status code

Definition at line 767 of file asn1.c.

                                                               {
        struct asn1_cursor curve;
 
        /* Elliptic curves are identified as either:
         *
         * - a wrapper algorithm "id-ecPublicKey" with the actual
         *   curve specified in the algorithm parameters, or
         *
         * - a standalone object identifier for the curve
         */
        if ( ( wrapper == NULL ) ||
             ( asn1_check_algorithm ( cursor, wrapper, &curve ) != 0 ) ) {
                memcpy ( &curve, cursor, sizeof ( curve ) );
        }
 
        /* Identify curve */
        asn1_enter ( &curve, ASN1_OID );
        *algorithm = asn1_find_algorithm ( &curve );
        if ( ! *algorithm ) {
                DBGC ( cursor, "ASN1 %p unrecognised EC algorithm:\n",
                       cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTSUP_ALGORITHM;
        }
 
        /* Check algorithm has an elliptic curve */
        if ( ! (*algorithm)->curve ) {
                DBGC ( cursor, "ASN1 %p algorithm %s is not an elliptic curve "
                       "algorithm:\n", cursor, (*algorithm)->name );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -ENOTTY_ALGORITHM;
        }
 
        return 0;
}

References algorithm, asn1_check_algorithm(), asn1_enter(), asn1_find_algorithm(), ASN1_OID, asn1_cursor::data, DBGC, DBGC_HDA, ENOTSUP_ALGORITHM, ENOTTY_ALGORITHM, asn1_cursor::len, memcpy(), and NULL.

Referenced by ecdsa_parse_key().

◆ asn1_check_algorithm()

int asn1_check_algorithm	(	const struct asn1_cursor *	cursor,
		struct asn1_algorithm *	expected,
		struct asn1_cursor *	params )

Check ASN.1 OID-identified algorithm.

Parameters

cursor	ASN.1 object cursor
expected	Expected algorithm

Return values

params	Algorithm parameters, or NULL
rc	Return status code

Definition at line 813 of file asn1.c.

                                                        {
        struct asn1_algorithm *actual;
        int rc;
 
        /* Parse algorithm */
        if ( ( rc = asn1_algorithm ( cursor, &actual, params ) ) != 0 )
                return rc;
 
        /* Check algorithm matches */
        if ( actual != expected ) {
                DBGC ( cursor, "ASN1 %p algorithm %s does not match %s\n",
                       cursor, actual->name, expected->name );
                return -ENOTTY_ALGORITHM;
        }
 
        return 0;
}

References DBGC, ENOTTY_ALGORITHM, asn1_algorithm::name, and rc.

Referenced by asn1_curve_algorithm(), and rsa_parse_mod_exp().

◆ asn1_parse_cbc()

int asn1_parse_cbc	(	struct asn1_algorithm *	algorithm,
		struct asn1_cursor *	params )

Parse ASN.1 CBC cipher parameters.

Parameters

algorithm	Algorithm
param	Parameters to parse

Return values

rc	Return status code

Definition at line 840 of file asn1.c.

                                                  {
        struct cipher_algorithm *cipher = algorithm->cipher;
 
        /* Sanity check */
        assert ( cipher != NULL );
 
        /* Enter parameters */
        asn1_enter ( params, ASN1_OCTET_STRING );
 
        /* Check length */
        if ( params->len != cipher->blocksize )
                return -EINVAL;
 
        return 0;
}

References algorithm, asn1_enter(), ASN1_OCTET_STRING, assert, cipher_algorithm::blocksize, EINVAL, asn1_cursor::len, and NULL.

◆ asn1_parse_gcm()

int asn1_parse_gcm	(	struct asn1_algorithm *algorithm	__unused,
		struct asn1_cursor *	params )

Parse ASN.1 GCM cipher parameters.

Parameters

algorithm	Algorithm
param	Parameters to parse

Return values

rc	Return status code

Definition at line 864 of file asn1.c.

                                                  {
 
        /* Enter parameters */
        asn1_enter ( params, ASN1_SEQUENCE );
 
        /* Enter nonce */
        return asn1_enter ( params, ASN1_OCTET_STRING );
}

References __unused, algorithm, asn1_enter(), ASN1_OCTET_STRING, and ASN1_SEQUENCE.

◆ asn1_generalized_time()

int asn1_generalized_time	(	const struct asn1_cursor *	cursor,
		time_t *	time )

Parse ASN.1 GeneralizedTime.

Parameters

cursor	ASN.1 cursor
time	Time to fill in

Return values

rc	Return status code

RFC 5280 section 4.1.2.5 places several restrictions on the allowed formats for UTCTime and GeneralizedTime, and mandates the interpretation of centuryless year values.

Definition at line 885 of file asn1.c.

                                                                             {
        struct asn1_cursor contents;
        unsigned int have_century;
        unsigned int type;
        union {
                struct {
                        uint8_t century;
                        uint8_t year;
                        uint8_t month;
                        uint8_t day;
                        uint8_t hour;
                        uint8_t minute;
                        uint8_t second;
                } __attribute__ (( packed )) named;
                uint8_t raw[7];
        } pairs;
        struct tm tm;
        const uint8_t *data;
        size_t remaining;
        unsigned int tens;
        unsigned int units;
        unsigned int i;
        int rc;
 
        /* Determine time format utcTime/generalizedTime */
        memcpy ( &contents, cursor, sizeof ( contents ) );
        type = asn1_type ( &contents );
        switch ( type ) {
        case ASN1_UTC_TIME:
                have_century = 0;
                break;
        case ASN1_GENERALIZED_TIME:
                have_century = 1;
                break;
        default:
                DBGC ( cursor, "ASN1 %p invalid time type %02x\n",
                       cursor, type );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -EINVAL_ASN1_TIME;
        }
 
        /* Enter utcTime/generalizedTime */
        if ( ( rc = asn1_enter ( &contents, type ) ) != 0 ) {
                DBGC ( cursor, "ASN1 %p cannot locate %s time:\n", cursor,
                       ( ( type == ASN1_UTC_TIME ) ? "UTC" : "generalized" ) );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return rc;
        }
 
        /* Parse digit string a pair at a time */
        memset ( &pairs, 0, sizeof ( pairs ) );
        data = contents.data;
        remaining = contents.len;
        for ( i = ( have_century ? 0 : 1 ) ; i < sizeof ( pairs.raw ) ; i++ ) {
                if ( remaining < 2 ) {
                        /* Some certificates violate the X.509 RFC by
                         * omitting the "seconds" value.
                         */
                        if ( i == ( sizeof ( pairs.raw ) - 1 ) )
                                break;
                        DBGC ( cursor, "ASN1 %p invalid time:\n", cursor );
                        DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                        return -EINVAL_ASN1_TIME;
                }
                tens = data[0];
                units = data[1];
                if ( ! ( isdigit ( tens ) && isdigit ( units ) ) ) {
                        DBGC ( cursor, "ASN1 %p invalid time:\n", cursor );
                        DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                        return -EINVAL_ASN1_TIME;
                }
                pairs.raw[i] = ( ( 10 * ( tens - '0' ) ) + ( units - '0' ) );
                data += 2;
                remaining -= 2;
        }
 
        /* Determine century if applicable */
        if ( ! have_century )
                pairs.named.century = ( ( pairs.named.year >= 50 ) ? 19 : 20 );
 
        /* Check for trailing "Z" */
        if ( ( remaining != 1 ) || ( data[0] != 'Z' ) ) {
                DBGC ( cursor, "ASN1 %p invalid time:\n", cursor );
                DBGC_HDA ( cursor, 0, cursor->data, cursor->len );
                return -EINVAL_ASN1_TIME;
        }
 
        /* Fill in time */
        tm.tm_year = ( ( ( pairs.named.century - 19 ) * 100 ) +
                       pairs.named.year );
        tm.tm_mon = ( pairs.named.month - 1 );
        tm.tm_mday = pairs.named.day;
        tm.tm_hour = pairs.named.hour;
        tm.tm_min = pairs.named.minute;
        tm.tm_sec = pairs.named.second;
 
        /* Convert to seconds since the Epoch */
        *time = mktime ( &tm );
 
        return 0;
}

References __attribute__, asn1_enter(), ASN1_GENERALIZED_TIME, asn1_type(), ASN1_UTC_TIME, century, asn1_cursor::data, data, day, DBGC, DBGC_HDA, EINVAL_ASN1_TIME, isdigit(), asn1_cursor::len, memcpy(), memset(), mktime(), month, raw, rc, tm::tm_hour, tm::tm_mday, tm::tm_min, tm::tm_mon, tm::tm_sec, tm::tm_year, type, and year.

Referenced by ocsp_parse_responses(), and x509_parse_validity().

◆ asn1_header()

size_t asn1_header	(	struct asn1_builder_header *	header,
		unsigned int	type,
		size_t	len )

static

Construct ASN.1 header.

Parameters

header	ASN.1 builder header
type	Type
len	Content length

Return values

header_len Header length

Definition at line 995 of file asn1.c.

                                                            {
        unsigned int header_len = 2;
        unsigned int len_len = 0;
        size_t temp;
 
        /* Construct header */
        header->type = type;
        if ( len < 0x80 ) {
                header->length[0] = len;
        } else {
                for ( temp = len ; temp ; temp >>= 8 )
                        len_len++;
                header->length[0] = ( 0x80 | len_len );
                header_len += len_len;
                for ( temp = len ; temp ; temp >>= 8 )
                        header->length[len_len--] = ( temp & 0xff );
        }
 
        return header_len;
}

References header, len, and type.

Referenced by asn1_header_len(), asn1_prepend(), and asn1_wrap().

◆ asn1_header_len()

size_t asn1_header_len ( size_t len )

Calculate ASN.1 header length.

Parameters

len	Content length

Return values

header_len Header length

Definition at line 1023 of file asn1.c.

                                      {
        struct asn1_builder_header header;
 
        return asn1_header ( &header, ASN1_ANY, len );
}

References ASN1_ANY, asn1_header(), header, and len.

Referenced by ecdsa_parse_signature(), and ecdsa_verify().

◆ asn1_grow()

int asn1_grow	(	struct asn1_builder *	builder,
		size_t	extra )

Grow ASN.1 builder.

Parameters

builder	ASN.1 builder
extra	Extra space to prepend

Return values

rc	Return status code

Definition at line 1036 of file asn1.c.

                                                             {
        size_t new_len;
        void *new;
 
        /* As with the ASN1 parsing functions, make errors permanent */
        if ( builder->len && ! builder->data )
                return -ENOMEM;
 
        /* Reallocate data buffer */
        new_len = ( builder->len + extra );
        new = realloc ( builder->data, new_len );
        if ( ! new ) {
                zfree ( builder->data );
                builder->data = NULL;
                return -ENOMEM;
        }
        builder->data = new;
 
        /* Move existing data to end of buffer */
        memmove ( ( builder->data + extra ), builder->data, builder->len );
        builder->len = new_len;
 
        return 0;
}

References asn1_builder::data, ENOMEM, extra, asn1_builder::len, memmove(), NULL, realloc(), and zfree().

Referenced by asn1_prepend(), asn1_prepend_raw(), asn1_wrap(), rsa_pkcs1_decrypt(), rsa_pkcs1_encrypt(), rsa_sign(), and tls_key_build().

◆ asn1_prepend_raw()

int asn1_prepend_raw	(	struct asn1_builder *	builder,
		const void *	data,
		size_t	len )

Prepend raw data to ASN.1 builder.

Parameters

builder	ASN.1 builder
data	Data to prepend
len	Length of data to prepend

Return values

rc	Return status code

Definition at line 1069 of file asn1.c.

                                    {
        int rc;
 
        /* Grow buffer */
        if ( ( rc = asn1_grow ( builder, len ) ) != 0 )
                return rc;
 
        /* Populate data buffer */
        memcpy ( builder->data, data, len );
 
        return 0;
}

References asn1_grow(), asn1_builder::data, data, len, memcpy(), and rc.

Referenced by icert_cert(), icert_certs(), ocsp_request(), tls_send_certificate_verify(), and tls_send_client_key_exchange().

◆ asn1_prepend()

int asn1_prepend	(	struct asn1_builder *	builder,
		unsigned int	type,
		const void *	data,
		size_t	len )

Prepend data to ASN.1 builder.

Parameters

builder	ASN.1 builder
type	Type
data	Data to prepend
len	Length of data to prepend

Return values

rc	Return status code

Definition at line 1092 of file asn1.c.

                                                  {
        struct asn1_builder_header header;
        size_t header_len;
        int rc;
 
        /* Construct header */
        header_len = asn1_header ( &header, type, len );
 
        /* Grow buffer */
        if ( ( rc = asn1_grow ( builder, header_len + len ) ) != 0 )
                return rc;
 
        /* Populate data buffer */
        memcpy ( builder->data, &header, header_len );
        memcpy ( ( builder->data + header_len ), data, len );
 
        return 0;
}

References asn1_grow(), asn1_header(), asn1_builder::data, data, header, len, memcpy(), rc, and type.

Referenced by ecdsa_prepend_signature(), icert_certs(), and ocsp_request().

◆ asn1_wrap()

int asn1_wrap	(	struct asn1_builder *	builder,
		unsigned int	type )

Wrap ASN.1 builder.

Parameters

builder	ASN.1 builder
type	Type

Return values

rc	Return status code

Definition at line 1119 of file asn1.c.

                                                                  {
        struct asn1_builder_header header;
        size_t header_len;
        int rc;
 
        /* Construct header */
        header_len = asn1_header ( &header, type, builder->len );
 
        /* Grow buffer */
        if ( ( rc = asn1_grow ( builder, header_len ) ) != 0 )
                return rc;
 
        /* Populate data buffer */
        memcpy ( builder->data, &header, header_len );
 
        return 0;
}

References asn1_grow(), asn1_header(), asn1_builder::data, header, asn1_builder::len, memcpy(), rc, and type.

Referenced by ecdsa_sign(), icert_cert(), icert_certs(), and ocsp_request().

◆ image_asn1()

int image_asn1	(	struct image *	image,
		size_t	offset,
		struct asn1_cursor **	cursor )

Extract ASN.1 object from image.

Parameters

image	Image
offset	Offset within image
cursor	ASN.1 cursor to fill in

Return values

next	Offset to next image, or negative error

The caller is responsible for eventually calling free() on the allocated ASN.1 cursor.

Definition at line 1148 of file asn1.c.

                                               {
        int next;
        int rc;
 
        /* Sanity check */
        assert ( offset <= image->len );
 
        /* Check that this image can be used to extract an ASN.1 object */
        if ( ! ( image->type && image->type->asn1 ) )
                return -ENOTSUP;
 
        /* Try creating ASN.1 cursor */
        next = image->type->asn1 ( image, offset, cursor );
        if ( next < 0 ) {
                rc = next;
                DBGC ( image, "IMAGE %s could not extract ASN.1 object: %s\n",
                       image->name, strerror ( rc ) );
                return rc;
        }
 
        return next;
}

References image_type::asn1, assert, DBGC, ENOTSUP, len, image::name, next, offset, rc, strerror(), and image::type.

Referenced by asn1_okx(), cms_message(), image_x509(), and REQUIRING_SYMBOL().

◆ REQUIRING_SYMBOL()

REQUIRING_SYMBOL ( image_asn1 )

References image_asn1().

◆ REQUIRE_OBJECT()

REQUIRE_OBJECT ( config_asn1 )

Macros

Functions

Detailed Description

Macro Definition Documentation

◆ EINVAL_ASN1_EMPTY

◆ EINFO_EINVAL_ASN1_EMPTY

◆ EINVAL_ASN1_LEN_LEN

◆ EINFO_EINVAL_ASN1_LEN_LEN

◆ EINVAL_ASN1_LEN

◆ EINFO_EINVAL_ASN1_LEN

◆ EINVAL_ASN1_BOOLEAN

◆ EINFO_EINVAL_ASN1_BOOLEAN

◆ EINVAL_ASN1_INTEGER

◆ EINFO_EINVAL_ASN1_INTEGER

◆ EINVAL_ASN1_TIME

◆ EINFO_EINVAL_ASN1_TIME

◆ EINVAL_ASN1_ALGORITHM

◆ EINFO_EINVAL_ASN1_ALGORITHM

◆ EINVAL_BIT_STRING

◆ EINFO_EINVAL_BIT_STRING

◆ ENOTSUP_ALGORITHM

◆ EINFO_ENOTSUP_ALGORITHM

◆ ENOTSUP_HIGH

◆ EINFO_ENOTSUP_HIGH

◆ ENOTTY_ALGORITHM

◆ EINFO_ENOTTY_ALGORITHM

Function Documentation

◆ FILE_LICENCE()

◆ FILE_SECBOOT()

◆ asn1_start()

◆ asn1_enter()

◆ asn1_skip_if_exists()

◆ asn1_skip()

◆ asn1_shrink()

◆ asn1_enter_any()

◆ asn1_skip_any()

◆ asn1_shrink_any()

◆ asn1_enter_bits()

◆ asn1_enter_unsigned()

◆ asn1_boolean()

◆ asn1_integer()

◆ asn1_compare()

◆ asn1_find_algorithm()

◆ asn1_algorithm()

◆ asn1_pubkey_algorithm()

◆ asn1_digest_algorithm()

◆ asn1_cipher_algorithm()

◆ asn1_signature_algorithm()

◆ asn1_curve_algorithm()

◆ asn1_check_algorithm()

◆ asn1_parse_cbc()

◆ asn1_parse_gcm()

◆ asn1_generalized_time()

◆ asn1_header()

◆ asn1_header_len()

◆ asn1_grow()

◆ asn1_prepend_raw()

◆ asn1_prepend()

◆ asn1_wrap()

◆ image_asn1()

◆ REQUIRING_SYMBOL()

◆ REQUIRE_OBJECT()