qemu

1
/*
2
 * QEMU Crypto ASN.1 DER decoder
3
 *
4
 * Copyright (c) 2022 Bytedance
5
 * Author: lei he <helei.sig11@bytedance.com>
6
 *
7
 * This library is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * This library is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19
 *
20
 */
21

22
#include "qemu/osdep.h"
23
#include "crypto/der.h"
24

25
typedef struct QCryptoDerEncodeNode {
26
    uint8_t tag;
27
    struct QCryptoDerEncodeNode *parent;
28
    struct QCryptoDerEncodeNode *next;
29
    /* for constructed type, data is null */
30
    const uint8_t *data;
31
    size_t dlen;
32
} QCryptoDerEncodeNode;
33

34
typedef struct QCryptoEncodeContext {
35
    QCryptoDerEncodeNode root;
36
    QCryptoDerEncodeNode *current_parent;
37
    QCryptoDerEncodeNode *tail;
38
} QCryptoEncodeContext;
39

40
enum QCryptoDERTypeTag {
41
    QCRYPTO_DER_TYPE_TAG_BOOL = 0x1,
42
    QCRYPTO_DER_TYPE_TAG_INT = 0x2,
43
    QCRYPTO_DER_TYPE_TAG_BIT_STR = 0x3,
44
    QCRYPTO_DER_TYPE_TAG_OCT_STR = 0x4,
45
    QCRYPTO_DER_TYPE_TAG_NULL = 0x5,
46
    QCRYPTO_DER_TYPE_TAG_OID = 0x6,
47
    QCRYPTO_DER_TYPE_TAG_SEQ = 0x10,
48
    QCRYPTO_DER_TYPE_TAG_SET = 0x11,
49
};
50

51
enum QCryptoDERTagClass {
52
    QCRYPTO_DER_TAG_CLASS_UNIV = 0x0,
53
    QCRYPTO_DER_TAG_CLASS_APPL = 0x1,
54
    QCRYPTO_DER_TAG_CLASS_CONT = 0x2,
55
    QCRYPTO_DER_TAG_CLASS_PRIV = 0x3,
56
};
57

58
enum QCryptoDERTagEnc {
59
    QCRYPTO_DER_TAG_ENC_PRIM = 0x0,
60
    QCRYPTO_DER_TAG_ENC_CONS = 0x1,
61
};
62

63
#define QCRYPTO_DER_TAG_ENC_MASK 0x20
64
#define QCRYPTO_DER_TAG_ENC_SHIFT 5
65

66
#define QCRYPTO_DER_TAG_CLASS_MASK 0xc0
67
#define QCRYPTO_DER_TAG_CLASS_SHIFT 6
68

69
#define QCRYPTO_DER_TAG_VAL_MASK 0x1f
70
#define QCRYPTO_DER_SHORT_LEN_MASK 0x80
71

72
#define QCRYPTO_DER_TAG(class, enc, val)           \
73
    (((class) << QCRYPTO_DER_TAG_CLASS_SHIFT) |    \
74
     ((enc) << QCRYPTO_DER_TAG_ENC_SHIFT) | (val))
75

76
/**
77
 * qcrypto_der_encode_length:
78
 * @src_len: the length of source data
79
 * @dst: destination to save the encoded 'length', if dst is NULL, only compute
80
 * the expected buffer size in bytes.
81
 * @dst_len: output parameter, indicates how many bytes wrote.
82
 *
83
 * Encode the 'length' part of TLV tuple.
84
 */
85
static void qcrypto_der_encode_length(size_t src_len,
86
                                      uint8_t *dst, size_t *dst_len)
87
{
88
    size_t max_length = 0xFF;
89
    uint8_t length_bytes = 0, header_byte;
90

91
    if (src_len < QCRYPTO_DER_SHORT_LEN_MASK) {
92
        header_byte = src_len;
93
        *dst_len = 1;
94
    } else {
95
        for (length_bytes = 1; max_length < src_len; length_bytes++) {
96
            max_length = (max_length << 8) + max_length;
97
        }
98
        header_byte = length_bytes;
99
        header_byte |= QCRYPTO_DER_SHORT_LEN_MASK;
100
        *dst_len = length_bytes + 1;
101
    }
102
    if (!dst) {
103
        return;
104
    }
105
    *dst++ = header_byte;
106
    /* Bigendian length bytes */
107
    for (; length_bytes > 0; length_bytes--) {
108
        *dst++ = ((src_len >> (length_bytes - 1) * 8) & 0xFF);
109
    }
110
}
111

112
static uint8_t qcrypto_der_peek_byte(const uint8_t **data, size_t *dlen)
113
{
114
    return **data;
115
}
116

117
static void qcrypto_der_cut_nbytes(const uint8_t **data,
118
                                   size_t *dlen,
119
                                   size_t nbytes)
120
{
121
    *data += nbytes;
122
    *dlen -= nbytes;
123
}
124

125
static uint8_t qcrypto_der_cut_byte(const uint8_t **data, size_t *dlen)
126
{
127
    uint8_t val = qcrypto_der_peek_byte(data, dlen);
128

129
    qcrypto_der_cut_nbytes(data, dlen, 1);
130

131
    return val;
132
}
133

134
static int qcrypto_der_invoke_callback(QCryptoDERDecodeCb cb, void *ctx,
135
                                       const uint8_t *value, size_t vlen,
136
                                       Error **errp)
137
{
138
    if (!cb) {
139
        return 0;
140
    }
141

142
    return cb(ctx, value, vlen, errp);
143
}
144

145
static int qcrypto_der_extract_definite_data(const uint8_t **data, size_t *dlen,
146
                                             QCryptoDERDecodeCb cb, void *ctx,
147
                                             Error **errp)
148
{
149
    const uint8_t *value;
150
    size_t vlen = 0;
151
    uint8_t byte_count = qcrypto_der_cut_byte(data, dlen);
152

153
    /* short format of definite-length */
154
    if (!(byte_count & QCRYPTO_DER_SHORT_LEN_MASK)) {
155
        if (byte_count > *dlen) {
156
            error_setg(errp, "Invalid content length: %u", byte_count);
157
            return -1;
158
        }
159

160
        value = *data;
161
        vlen = byte_count;
162
        qcrypto_der_cut_nbytes(data, dlen, vlen);
163

164
        if (qcrypto_der_invoke_callback(cb, ctx, value, vlen, errp) != 0) {
165
            return -1;
166
        }
167
        return vlen;
168
    }
169

170
    /* Ignore highest bit */
171
    byte_count &= ~QCRYPTO_DER_SHORT_LEN_MASK;
172

173
    /*
174
     * size_t is enough to store the value of length, although the DER
175
     * encoding standard supports larger length.
176
     */
177
    if (byte_count > sizeof(size_t)) {
178
        error_setg(errp, "Invalid byte count of content length: %u",
179
                   byte_count);
180
        return -1;
181
    }
182

183
    if (byte_count > *dlen) {
184
        error_setg(errp, "Invalid content length: %u", byte_count);
185
        return -1;
186
    }
187
    while (byte_count--) {
188
        vlen <<= 8;
189
        vlen += qcrypto_der_cut_byte(data, dlen);
190
    }
191

192
    if (vlen > *dlen) {
193
        error_setg(errp, "Invalid content length: %zu", vlen);
194
        return -1;
195
    }
196

197
    value = *data;
198
    qcrypto_der_cut_nbytes(data, dlen, vlen);
199

200
    if (qcrypto_der_invoke_callback(cb, ctx, value, vlen, errp) != 0) {
201
        return -1;
202
    }
203
    return vlen;
204
}
205

206
static int qcrypto_der_extract_data(const uint8_t **data, size_t *dlen,
207
                                    QCryptoDERDecodeCb cb, void *ctx,
208
                                    Error **errp)
209
{
210
    uint8_t val;
211
    if (*dlen < 1) {
212
        error_setg(errp, "Need more data");
213
        return -1;
214
    }
215
    val = qcrypto_der_peek_byte(data, dlen);
216

217
    /* must use definite length format */
218
    if (val == QCRYPTO_DER_SHORT_LEN_MASK) {
219
        error_setg(errp, "Only definite length format is allowed");
220
        return -1;
221
    }
222

223
    return qcrypto_der_extract_definite_data(data, dlen, cb, ctx, errp);
224
}
225

226
static int qcrypto_der_decode_tlv(const uint8_t expected_tag,
227
                                  const uint8_t **data, size_t *dlen,
228
                                  QCryptoDERDecodeCb cb,
229
                                  void *ctx, Error **errp)
230
{
231
    const uint8_t *saved_data = *data;
232
    size_t saved_dlen = *dlen;
233
    uint8_t tag;
234
    int data_length;
235

236
    if (*dlen < 1) {
237
        error_setg(errp, "Need more data");
238
        return -1;
239
    }
240
    tag = qcrypto_der_cut_byte(data, dlen);
241
    if (tag != expected_tag) {
242
        error_setg(errp, "Unexpected tag: expected: %u, actual: %u",
243
                   expected_tag, tag);
244
        goto error;
245
    }
246

247
    data_length = qcrypto_der_extract_data(data, dlen, cb, ctx, errp);
248
    if (data_length < 0) {
249
        goto error;
250
    }
251
    return data_length;
252

253
error:
254
    *data = saved_data;
255
    *dlen = saved_dlen;
256
    return -1;
257
}
258

259
int qcrypto_der_decode_int(const uint8_t **data, size_t *dlen,
260
                           QCryptoDERDecodeCb cb, void *ctx, Error **errp)
261
{
262
    const uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
263
                                        QCRYPTO_DER_TAG_ENC_PRIM,
264
                                        QCRYPTO_DER_TYPE_TAG_INT);
265
    return qcrypto_der_decode_tlv(tag, data, dlen, cb, ctx, errp);
266
}
267

268
int qcrypto_der_decode_seq(const uint8_t **data, size_t *dlen,
269
                           QCryptoDERDecodeCb cb, void *ctx, Error **errp)
270
{
271
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
272
                                  QCRYPTO_DER_TAG_ENC_CONS,
273
                                  QCRYPTO_DER_TYPE_TAG_SEQ);
274
    return qcrypto_der_decode_tlv(tag, data, dlen, cb, ctx, errp);
275
}
276

277
int qcrypto_der_decode_octet_str(const uint8_t **data, size_t *dlen,
278
                                 QCryptoDERDecodeCb cb, void *ctx, Error **errp)
279
{
280
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
281
                                  QCRYPTO_DER_TAG_ENC_PRIM,
282
                                  QCRYPTO_DER_TYPE_TAG_OCT_STR);
283
    return qcrypto_der_decode_tlv(tag, data, dlen, cb, ctx, errp);
284
}
285

286
int qcrypto_der_decode_bit_str(const uint8_t **data, size_t *dlen,
287
                               QCryptoDERDecodeCb cb, void *ctx, Error **errp)
288
{
289
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
290
                                  QCRYPTO_DER_TAG_ENC_PRIM,
291
                                  QCRYPTO_DER_TYPE_TAG_BIT_STR);
292
    return qcrypto_der_decode_tlv(tag, data, dlen, cb, ctx, errp);
293
}
294

295
int qcrypto_der_decode_oid(const uint8_t **data, size_t *dlen,
296
                           QCryptoDERDecodeCb cb, void *ctx, Error **errp)
297
{
298
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
299
                                  QCRYPTO_DER_TAG_ENC_PRIM,
300
                                  QCRYPTO_DER_TYPE_TAG_OID);
301
    return qcrypto_der_decode_tlv(tag, data, dlen, cb, ctx, errp);
302
}
303

304
int qcrypto_der_decode_ctx_tag(const uint8_t **data, size_t *dlen, int tag_id,
305
                               QCryptoDERDecodeCb cb, void *ctx, Error **errp)
306
{
307
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_CONT,
308
                                  QCRYPTO_DER_TAG_ENC_CONS,
309
                                  tag_id);
310
    return qcrypto_der_decode_tlv(tag, data, dlen, cb, ctx, errp);
311
}
312

313
static void qcrypto_der_encode_prim(QCryptoEncodeContext *ctx, uint8_t tag,
314
                                    const uint8_t *data, size_t dlen)
315
{
316
    QCryptoDerEncodeNode *node = g_new0(QCryptoDerEncodeNode, 1);
317
    size_t nbytes_len;
318

319
    node->tag = tag;
320
    node->data = data;
321
    node->dlen = dlen;
322
    node->parent = ctx->current_parent;
323

324
    qcrypto_der_encode_length(dlen, NULL, &nbytes_len);
325
    /* 1 byte for Tag, nbyte_len for Length, and dlen for Value */
326
    node->parent->dlen += 1 + nbytes_len + dlen;
327

328
    ctx->tail->next = node;
329
    ctx->tail = node;
330
}
331

332
QCryptoEncodeContext *qcrypto_der_encode_ctx_new(void)
333
{
334
    QCryptoEncodeContext *ctx = g_new0(QCryptoEncodeContext, 1);
335
    ctx->current_parent = &ctx->root;
336
    ctx->tail = &ctx->root;
337
    return ctx;
338
}
339

340
static void qcrypto_der_encode_cons_begin(QCryptoEncodeContext *ctx,
341
                                          uint8_t tag)
342
{
343
    QCryptoDerEncodeNode *node = g_new0(QCryptoDerEncodeNode, 1);
344

345
    node->tag = tag;
346
    node->parent = ctx->current_parent;
347
    ctx->current_parent = node;
348
    ctx->tail->next = node;
349
    ctx->tail = node;
350
}
351

352
static void qcrypto_der_encode_cons_end(QCryptoEncodeContext *ctx)
353
{
354
    QCryptoDerEncodeNode *cons_node = ctx->current_parent;
355
    size_t nbytes_len;
356

357
    qcrypto_der_encode_length(cons_node->dlen, NULL, &nbytes_len);
358
    /* 1 byte for Tag, nbyte_len for Length, and dlen for Value */
359
    cons_node->parent->dlen += 1 + nbytes_len + cons_node->dlen;
360
    ctx->current_parent = cons_node->parent;
361
}
362

363
void qcrypto_der_encode_seq_begin(QCryptoEncodeContext *ctx)
364
{
365
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
366
                                  QCRYPTO_DER_TAG_ENC_CONS,
367
                                  QCRYPTO_DER_TYPE_TAG_SEQ);
368
    qcrypto_der_encode_cons_begin(ctx, tag);
369
}
370

371
void qcrypto_der_encode_seq_end(QCryptoEncodeContext *ctx)
372
{
373
    qcrypto_der_encode_cons_end(ctx);
374
}
375

376
void qcrypto_der_encode_oid(QCryptoEncodeContext *ctx,
377
                            const uint8_t *src, size_t src_len)
378
{
379
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
380
                                  QCRYPTO_DER_TAG_ENC_PRIM,
381
                                  QCRYPTO_DER_TYPE_TAG_OID);
382
    qcrypto_der_encode_prim(ctx, tag, src, src_len);
383
}
384

385
void qcrypto_der_encode_int(QCryptoEncodeContext *ctx,
386
                            const uint8_t *src, size_t src_len)
387
{
388
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
389
                                  QCRYPTO_DER_TAG_ENC_PRIM,
390
                                  QCRYPTO_DER_TYPE_TAG_INT);
391
    qcrypto_der_encode_prim(ctx, tag, src, src_len);
392
}
393

394
void qcrypto_der_encode_null(QCryptoEncodeContext *ctx)
395
{
396
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
397
                                  QCRYPTO_DER_TAG_ENC_PRIM,
398
                                  QCRYPTO_DER_TYPE_TAG_NULL);
399
    qcrypto_der_encode_prim(ctx, tag, NULL, 0);
400
}
401

402
void qcrypto_der_encode_octet_str(QCryptoEncodeContext *ctx,
403
                                  const uint8_t *src, size_t src_len)
404
{
405
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
406
                                  QCRYPTO_DER_TAG_ENC_PRIM,
407
                                  QCRYPTO_DER_TYPE_TAG_OCT_STR);
408
    qcrypto_der_encode_prim(ctx, tag, src, src_len);
409
}
410

411
void qcrypto_der_encode_octet_str_begin(QCryptoEncodeContext *ctx)
412
{
413
    uint8_t tag = QCRYPTO_DER_TAG(QCRYPTO_DER_TAG_CLASS_UNIV,
414
                                  QCRYPTO_DER_TAG_ENC_PRIM,
415
                                  QCRYPTO_DER_TYPE_TAG_OCT_STR);
416
    qcrypto_der_encode_cons_begin(ctx, tag);
417
}
418

419
void qcrypto_der_encode_octet_str_end(QCryptoEncodeContext *ctx)
420
{
421
    qcrypto_der_encode_cons_end(ctx);
422
}
423

424
size_t qcrypto_der_encode_ctx_buffer_len(QCryptoEncodeContext *ctx)
425
{
426
    return ctx->root.dlen;
427
}
428

429
void qcrypto_der_encode_ctx_flush_and_free(QCryptoEncodeContext *ctx,
430
                                           uint8_t *dst)
431
{
432
    QCryptoDerEncodeNode *node, *prev;
433
    size_t len;
434

435
    for (prev = &ctx->root;
436
         (node = prev->next) && (prev->next = node->next, 1);) {
437
        /* Tag */
438
        *dst++ = node->tag;
439

440
        /* Length */
441
        qcrypto_der_encode_length(node->dlen, dst, &len);
442
        dst += len;
443

444
        /* Value */
445
        if (node->data) {
446
            memcpy(dst, node->data, node->dlen);
447
            dst += node->dlen;
448
        }
449
        g_free(node);
450
    }
451
    g_free(ctx);
452
}
453