kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
35c8afd314
boringssl/crypto/bytestring/internal.h

76 lines
3.4 KiB
C
Raw Normal View History

Rework support for ASN.1 BER. Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 18:54:06 +01:00
/* Copyright (c) 2014, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#ifndef OPENSSL_HEADER_BYTESTRING_INTERNAL_H
#define OPENSSL_HEADER_BYTESTRING_INTERNAL_H
#include <openssl/base.h>
#if defined(__cplusplus)
extern "C" {
#endif
Parse BER for PKCS#12 more accurately. CBS_asn1_ber_to_der currently uses heuristics because implicitly-tagged constructed strings in BER are ambiguous with implicitly-tagged sequences. It's not possible to convert BER to DER without knowing the schema. Fortunately, implicitly tagged strings don't appear often so instead split the job up: CBS_asn1_ber_to_der fixes indefinite-length elements and constructed strings it can see. Implicitly-tagged strings it leaves uncoverted, but they will only nest one level down (because BER kindly allows one to nest constructed strings arbitrarily!). CBS_get_asn1_implicit_string then performs the final concatenation at parse time. This isn't much more complex and lets us parse BER more accurately and also reject a number of mis-encoded values (e.g. constructed INTEGERs are not a thing) we'd previously let through. The downside is the post-conversion parsing code must be aware of this limitation of CBS_asn1_ber_to_der. Fortunately, there's only one implicitly-tagged string in our PKCS#12 code. (In the category of things that really really don't matter, but I had spare cycles and the old BER converter is weird.) Change-Id: Iebdd13b08559fa158b308ef83a5bb07bfdf80ae8 Reviewed-on: https://boringssl-review.googlesource.com/7052 Reviewed-by: Adam Langley <agl@google.com>
2016-01-09 00:53:29 +00:00
/* CBS_asn1_ber_to_der reads a BER element from |in|. If it finds
* indefinite-length elements or constructed strings then it converts the BER
* data to DER and sets |*out| and |*out_length| to describe a malloced buffer
* containing the DER data. Additionally, |*in| will be advanced over the BER
* element.
Rework support for ASN.1 BER. Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 18:54:06 +01:00
*
Parse BER for PKCS#12 more accurately. CBS_asn1_ber_to_der currently uses heuristics because implicitly-tagged constructed strings in BER are ambiguous with implicitly-tagged sequences. It's not possible to convert BER to DER without knowing the schema. Fortunately, implicitly tagged strings don't appear often so instead split the job up: CBS_asn1_ber_to_der fixes indefinite-length elements and constructed strings it can see. Implicitly-tagged strings it leaves uncoverted, but they will only nest one level down (because BER kindly allows one to nest constructed strings arbitrarily!). CBS_get_asn1_implicit_string then performs the final concatenation at parse time. This isn't much more complex and lets us parse BER more accurately and also reject a number of mis-encoded values (e.g. constructed INTEGERs are not a thing) we'd previously let through. The downside is the post-conversion parsing code must be aware of this limitation of CBS_asn1_ber_to_der. Fortunately, there's only one implicitly-tagged string in our PKCS#12 code. (In the category of things that really really don't matter, but I had spare cycles and the old BER converter is weird.) Change-Id: Iebdd13b08559fa158b308ef83a5bb07bfdf80ae8 Reviewed-on: https://boringssl-review.googlesource.com/7052 Reviewed-by: Adam Langley <agl@google.com>
2016-01-09 00:53:29 +00:00
* If it doesn't find any indefinite-length elements or constructed strings then
* it sets |*out| to NULL and |*in| is unmodified.
Rework support for ASN.1 BER. Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 18:54:06 +01:00
*
Parse BER for PKCS#12 more accurately. CBS_asn1_ber_to_der currently uses heuristics because implicitly-tagged constructed strings in BER are ambiguous with implicitly-tagged sequences. It's not possible to convert BER to DER without knowing the schema. Fortunately, implicitly tagged strings don't appear often so instead split the job up: CBS_asn1_ber_to_der fixes indefinite-length elements and constructed strings it can see. Implicitly-tagged strings it leaves uncoverted, but they will only nest one level down (because BER kindly allows one to nest constructed strings arbitrarily!). CBS_get_asn1_implicit_string then performs the final concatenation at parse time. This isn't much more complex and lets us parse BER more accurately and also reject a number of mis-encoded values (e.g. constructed INTEGERs are not a thing) we'd previously let through. The downside is the post-conversion parsing code must be aware of this limitation of CBS_asn1_ber_to_der. Fortunately, there's only one implicitly-tagged string in our PKCS#12 code. (In the category of things that really really don't matter, but I had spare cycles and the old BER converter is weird.) Change-Id: Iebdd13b08559fa158b308ef83a5bb07bfdf80ae8 Reviewed-on: https://boringssl-review.googlesource.com/7052 Reviewed-by: Adam Langley <agl@google.com>
2016-01-09 00:53:29 +00:00
* This function should successfully process any valid BER input, however it
* will not convert all of BER's deviations from DER. BER is ambiguous between
* implicitly-tagged SEQUENCEs of strings and implicitly-tagged constructed
* strings. Implicitly-tagged strings must be parsed with
* |CBS_get_ber_implicitly_tagged_string| instead of |CBS_get_asn1|. The caller
* must also account for BER variations in the contents of a primitive.
Rework support for ASN.1 BER. Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 18:54:06 +01:00
*
* It returns one on success and zero otherwise. */
Export CBS_asn1_ber_to_der. We don't really want to expose this but the bytestring test calls this function directly and, when linked against a shared library, thus needs it to be in the dynamic symbol table. Change-Id: Ife01da36fe142026a6a3e545cff746512b966ee6
2014-08-27 20:36:59 +01:00
OPENSSL_EXPORT int CBS_asn1_ber_to_der(CBS *in, uint8_t **out, size_t *out_len);
Rework support for ASN.1 BER. Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 18:54:06 +01:00
Parse BER for PKCS#12 more accurately. CBS_asn1_ber_to_der currently uses heuristics because implicitly-tagged constructed strings in BER are ambiguous with implicitly-tagged sequences. It's not possible to convert BER to DER without knowing the schema. Fortunately, implicitly tagged strings don't appear often so instead split the job up: CBS_asn1_ber_to_der fixes indefinite-length elements and constructed strings it can see. Implicitly-tagged strings it leaves uncoverted, but they will only nest one level down (because BER kindly allows one to nest constructed strings arbitrarily!). CBS_get_asn1_implicit_string then performs the final concatenation at parse time. This isn't much more complex and lets us parse BER more accurately and also reject a number of mis-encoded values (e.g. constructed INTEGERs are not a thing) we'd previously let through. The downside is the post-conversion parsing code must be aware of this limitation of CBS_asn1_ber_to_der. Fortunately, there's only one implicitly-tagged string in our PKCS#12 code. (In the category of things that really really don't matter, but I had spare cycles and the old BER converter is weird.) Change-Id: Iebdd13b08559fa158b308ef83a5bb07bfdf80ae8 Reviewed-on: https://boringssl-review.googlesource.com/7052 Reviewed-by: Adam Langley <agl@google.com>
2016-01-09 00:53:29 +00:00
/* CBS_get_asn1_implicit_string parses a BER string of primitive type
* |inner_tag| implicitly-tagged with |outer_tag|. It sets |out| to the
* contents. If concatenation was needed, it sets |*out_storage| to a buffer
* which the caller must release with |OPENSSL_free|. Otherwise, it sets
* |*out_storage| to NULL.
*
* This function does not parse all of BER. It requires the string be
* definite-length. Constructed strings are allowed, but all children of the
* outermost element must be primitive. The caller should use
* |CBS_asn1_ber_to_der| before running this function.
*
* It returns one on success and zero otherwise. */
OPENSSL_EXPORT int CBS_get_asn1_implicit_string(CBS *in, CBS *out,
uint8_t **out_storage,
unsigned outer_tag,
unsigned inner_tag);
Add a convenience function for i2d compatibility wrappers. An i2d compatibility function is rather long, so add CBB_finish_i2d for part of it. It takes a CBB as input so only a 'marshal' function is needed, rather than a 'to_bytes' one. Also replace the *inp d2i update pattern with a slightly shorter one. Change-Id: Ibb41059c9532f6a8ce33460890cc1afe26adc97c Reviewed-on: https://boringssl-review.googlesource.com/6868 Reviewed-by: Adam Langley <agl@google.com>
2016-01-03 08:57:37 +00:00
/* CBB_finish_i2d calls |CBB_finish| on |cbb| which must have been initialized
* with |CBB_init|. If |outp| is not NULL then the result is written to |*outp|
* and |*outp| is advanced just past the output. It returns the number of bytes
* in the result, whether written or not, or a negative value on error. On
* error, it calls |CBB_cleanup| on |cbb|.
*
* This function may be used to help implement legacy i2d ASN.1 functions. */
int CBB_finish_i2d(CBB *cbb, uint8_t **outp);
Rework support for ASN.1 BER. Previously, the ASN.1 functions in bytestring were capable of processing indefinite length elements when the _ber functions were used. That works well enough for PKCS#3, but NSS goes a bit crazy with BER encoding and PKCS#12. Rather than complicate the core bytestring functions further, the BER support is removed from them and moved to a separate function that converts from BER to DER (if needed). Change-Id: I2212b28e99bab9fab8c61f80d2012d3e5a3cc2f0 Reviewed-on: https://boringssl-review.googlesource.com/1591 Reviewed-by: Adam Langley <agl@google.com>
2014-08-21 18:54:06 +01:00
#if defined(__cplusplus)
} /* extern C */
#endif
#endif /* OPENSSL_HEADER_BYTESTRING_INTERNAL_H */
Reference in New Issue Copy Permalink