453 lines
10 KiB
C
453 lines
10 KiB
C
|
// SPDX-License-Identifier: GPL-2.0-only
|
||
|
|
/*
|
||
|
|
* Simple encoder primitives for ASN.1 BER/DER/CER
|
||
|
|
*
|
||
|
|
* Copyright (C) 2019 James.Bottomley@HansenPartnership.com
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include <linux/asn1_encoder.h>
|
||
|
|
#include <linux/bug.h>
|
||
|
|
#include <linux/string.h>
|
||
|
|
#include <linux/module.h>
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_integer() - encode positive integer to ASN.1
|
||
|
|
* @data: pointer to the pointer to the data
|
||
|
|
* @end_data: end of data pointer, points one beyond last usable byte in @data
|
||
|
|
* @integer: integer to be encoded
|
||
|
|
*
|
||
|
|
* This is a simplified encoder: it only currently does
|
||
|
|
* positive integers, but it should be simple enough to add the
|
||
|
|
* negative case if a use comes along.
|
||
|
|
*/
|
||
|
|
unsigned char *
|
||
|
|
asn1_encode_integer(unsigned char *data, const unsigned char *end_data,
|
||
|
|
s64 integer)
|
||
|
|
{
|
||
|
|
int data_len = end_data - data;
|
||
|
|
unsigned char *d = &data[2];
|
||
|
|
bool found = false;
|
||
|
|
int i;
|
||
|
|
|
||
|
|
if (WARN(integer < 0,
|
||
|
|
"BUG: integer encode only supports positive integers"))
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
if (IS_ERR(data))
|
||
|
|
return data;
|
||
|
|
|
||
|
|
/* need at least 3 bytes for tag, length and integer encoding */
|
||
|
|
if (data_len < 3)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
/* remaining length where at d (the start of the integer encoding) */
|
||
|
|
data_len -= 2;
|
||
|
|
|
||
|
|
data[0] = _tag(UNIV, PRIM, INT);
|
||
|
|
if (integer == 0) {
|
||
|
|
*d++ = 0;
|
||
|
|
goto out;
|
||
|
|
}
|
||
|
|
|
||
|
|
for (i = sizeof(integer); i > 0 ; i--) {
|
||
|
|
int byte = integer >> (8 * (i - 1));
|
||
|
|
|
||
|
|
if (!found && byte == 0)
|
||
|
|
continue;
|
||
|
|
|
||
|
|
/*
|
||
|
|
* for a positive number the first byte must have bit
|
||
|
|
* 7 clear in two's complement (otherwise it's a
|
||
|
|
* negative number) so prepend a leading zero if
|
||
|
|
* that's not the case
|
||
|
|
*/
|
||
|
|
if (!found && (byte & 0x80)) {
|
||
|
|
/*
|
||
|
|
* no check needed here, we already know we
|
||
|
|
* have len >= 1
|
||
|
|
*/
|
||
|
|
*d++ = 0;
|
||
|
|
data_len--;
|
||
|
|
}
|
||
|
|
|
||
|
|
found = true;
|
||
|
|
if (data_len == 0)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
*d++ = byte;
|
||
|
|
data_len--;
|
||
|
|
}
|
||
|
|
|
||
|
|
out:
|
||
|
|
data[1] = d - data - 2;
|
||
|
|
|
||
|
|
return d;
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL_GPL(asn1_encode_integer);
|
||
|
|
|
||
|
|
/* calculate the base 128 digit values setting the top bit of the first octet */
|
||
|
|
static int asn1_encode_oid_digit(unsigned char **_data, int *data_len, u32 oid)
|
||
|
|
{
|
||
|
|
unsigned char *data = *_data;
|
||
|
|
int start = 7 + 7 + 7 + 7;
|
||
|
|
int ret = 0;
|
||
|
|
|
||
|
|
if (*data_len < 1)
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
/* quick case */
|
||
|
|
if (oid == 0) {
|
||
|
|
*data++ = 0x80;
|
||
|
|
(*data_len)--;
|
||
|
|
goto out;
|
||
|
|
}
|
||
|
|
|
||
|
|
while (oid >> start == 0)
|
||
|
|
start -= 7;
|
||
|
|
|
||
|
|
while (start > 0 && *data_len > 0) {
|
||
|
|
u8 byte;
|
||
|
|
|
||
|
|
byte = oid >> start;
|
||
|
|
oid = oid - (byte << start);
|
||
|
|
start -= 7;
|
||
|
|
byte |= 0x80;
|
||
|
|
*data++ = byte;
|
||
|
|
(*data_len)--;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (*data_len > 0) {
|
||
|
|
*data++ = oid;
|
||
|
|
(*data_len)--;
|
||
|
|
} else {
|
||
|
|
ret = -EINVAL;
|
||
|
|
}
|
||
|
|
|
||
|
|
out:
|
||
|
|
*_data = data;
|
||
|
|
return ret;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_oid() - encode an oid to ASN.1
|
||
|
|
* @data: position to begin encoding at
|
||
|
|
* @end_data: end of data pointer, points one beyond last usable byte in @data
|
||
|
|
* @oid: array of oids
|
||
|
|
* @oid_len: length of oid array
|
||
|
|
*
|
||
|
|
* this encodes an OID up to ASN.1 when presented as an array of OID values
|
||
|
|
*/
|
||
|
|
unsigned char *
|
||
|
|
asn1_encode_oid(unsigned char *data, const unsigned char *end_data,
|
||
|
|
u32 oid[], int oid_len)
|
||
|
|
{
|
||
|
|
int data_len = end_data - data;
|
||
|
|
unsigned char *d = data + 2;
|
||
|
|
int i, ret;
|
||
|
|
|
||
|
|
if (WARN(oid_len < 2, "OID must have at least two elements"))
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
if (WARN(oid_len > 32, "OID is too large"))
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
if (IS_ERR(data))
|
||
|
|
return data;
|
||
|
|
|
||
|
|
|
||
|
|
/* need at least 3 bytes for tag, length and OID encoding */
|
||
|
|
if (data_len < 3)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
data[0] = _tag(UNIV, PRIM, OID);
|
||
|
|
*d++ = oid[0] * 40 + oid[1];
|
||
|
|
|
||
|
|
data_len -= 3;
|
||
|
|
|
||
|
|
for (i = 2; i < oid_len; i++) {
|
||
|
|
ret = asn1_encode_oid_digit(&d, &data_len, oid[i]);
|
||
|
|
if (ret < 0)
|
||
|
|
return ERR_PTR(ret);
|
||
|
|
}
|
||
|
|
|
||
|
|
data[1] = d - data - 2;
|
||
|
|
|
||
|
|
return d;
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL_GPL(asn1_encode_oid);
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_length() - encode a length to follow an ASN.1 tag
|
||
|
|
* @data: pointer to encode at
|
||
|
|
* @data_len: pointer to remaining length (adjusted by routine)
|
||
|
|
* @len: length to encode
|
||
|
|
*
|
||
|
|
* This routine can encode lengths up to 65535 using the ASN.1 rules.
|
||
|
|
* It will accept a negative length and place a zero length tag
|
||
|
|
* instead (to keep the ASN.1 valid). This convention allows other
|
||
|
|
* encoder primitives to accept negative lengths as singalling the
|
||
|
|
* sequence will be re-encoded when the length is known.
|
||
|
|
*/
|
||
|
|
static int asn1_encode_length(unsigned char **data, int *data_len, int len)
|
||
|
|
{
|
||
|
|
if (*data_len < 1)
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
if (len < 0) {
|
||
|
|
*((*data)++) = 0;
|
||
|
|
(*data_len)--;
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (len <= 0x7f) {
|
||
|
|
*((*data)++) = len;
|
||
|
|
(*data_len)--;
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (*data_len < 2)
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
if (len <= 0xff) {
|
||
|
|
*((*data)++) = 0x81;
|
||
|
|
*((*data)++) = len & 0xff;
|
||
|
|
*data_len -= 2;
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (*data_len < 3)
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
if (len <= 0xffff) {
|
||
|
|
*((*data)++) = 0x82;
|
||
|
|
*((*data)++) = (len >> 8) & 0xff;
|
||
|
|
*((*data)++) = len & 0xff;
|
||
|
|
*data_len -= 3;
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (WARN(len > 0xffffff, "ASN.1 length can't be > 0xffffff"))
|
||
|
|
return -EINVAL;
|
||
|
|
|
||
|
|
if (*data_len < 4)
|
||
|
|
return -EINVAL;
|
||
|
|
*((*data)++) = 0x83;
|
||
|
|
*((*data)++) = (len >> 16) & 0xff;
|
||
|
|
*((*data)++) = (len >> 8) & 0xff;
|
||
|
|
*((*data)++) = len & 0xff;
|
||
|
|
*data_len -= 4;
|
||
|
|
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_tag() - add a tag for optional or explicit value
|
||
|
|
* @data: pointer to place tag at
|
||
|
|
* @end_data: end of data pointer, points one beyond last usable byte in @data
|
||
|
|
* @tag: tag to be placed
|
||
|
|
* @string: the data to be tagged
|
||
|
|
* @len: the length of the data to be tagged
|
||
|
|
*
|
||
|
|
* Note this currently only handles short form tags < 31.
|
||
|
|
*
|
||
|
|
* Standard usage is to pass in a @tag, @string and @length and the
|
||
|
|
* @string will be ASN.1 encoded with @tag and placed into @data. If
|
||
|
|
* the encoding would put data past @end_data then an error is
|
||
|
|
* returned, otherwise a pointer to a position one beyond the encoding
|
||
|
|
* is returned.
|
||
|
|
*
|
||
|
|
* To encode in place pass a NULL @string and -1 for @len and the
|
||
|
|
* maximum allowable beginning and end of the data; all this will do
|
||
|
|
* is add the current maximum length and update the data pointer to
|
||
|
|
* the place where the tag contents should be placed is returned. The
|
||
|
|
* data should be copied in by the calling routine which should then
|
||
|
|
* repeat the prior statement but now with the known length. In order
|
||
|
|
* to avoid having to keep both before and after pointers, the repeat
|
||
|
|
* expects to be called with @data pointing to where the first encode
|
||
|
|
* returned it and still NULL for @string but the real length in @len.
|
||
|
|
*/
|
||
|
|
unsigned char *
|
||
|
|
asn1_encode_tag(unsigned char *data, const unsigned char *end_data,
|
||
|
|
u32 tag, const unsigned char *string, int len)
|
||
|
|
{
|
||
|
|
int data_len = end_data - data;
|
||
|
|
int ret;
|
||
|
|
|
||
|
|
if (WARN(tag > 30, "ASN.1 tag can't be > 30"))
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
if (!string && WARN(len > 127,
|
||
|
|
"BUG: recode tag is too big (>127)"))
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
if (IS_ERR(data))
|
||
|
|
return data;
|
||
|
|
|
||
|
|
if (!string && len > 0) {
|
||
|
|
/*
|
||
|
|
* we're recoding, so move back to the start of the
|
||
|
|
* tag and install a dummy length because the real
|
||
|
|
* data_len should be NULL
|
||
|
|
*/
|
||
|
|
data -= 2;
|
||
|
|
data_len = 2;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (data_len < 2)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
*(data++) = _tagn(CONT, CONS, tag);
|
||
|
|
data_len--;
|
||
|
|
ret = asn1_encode_length(&data, &data_len, len);
|
||
|
|
if (ret < 0)
|
||
|
|
return ERR_PTR(ret);
|
||
|
|
|
||
|
|
if (!string)
|
||
|
|
return data;
|
||
|
|
|
||
|
|
if (data_len < len)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
memcpy(data, string, len);
|
||
|
|
data += len;
|
||
|
|
|
||
|
|
return data;
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL_GPL(asn1_encode_tag);
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_octet_string() - encode an ASN.1 OCTET STRING
|
||
|
|
* @data: pointer to encode at
|
||
|
|
* @end_data: end of data pointer, points one beyond last usable byte in @data
|
||
|
|
* @string: string to be encoded
|
||
|
|
* @len: length of string
|
||
|
|
*
|
||
|
|
* Note ASN.1 octet strings may contain zeros, so the length is obligatory.
|
||
|
|
*/
|
||
|
|
unsigned char *
|
||
|
|
asn1_encode_octet_string(unsigned char *data,
|
||
|
|
const unsigned char *end_data,
|
||
|
|
const unsigned char *string, u32 len)
|
||
|
|
{
|
||
|
|
int data_len = end_data - data;
|
||
|
|
int ret;
|
||
|
|
|
||
|
|
if (IS_ERR(data))
|
||
|
|
return data;
|
||
|
|
|
||
|
|
/* need minimum of 2 bytes for tag and length of zero length string */
|
||
|
|
if (data_len < 2)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
*(data++) = _tag(UNIV, PRIM, OTS);
|
||
|
|
data_len--;
|
||
|
|
|
||
|
|
ret = asn1_encode_length(&data, &data_len, len);
|
||
|
|
if (ret)
|
||
|
|
return ERR_PTR(ret);
|
||
|
|
|
||
|
|
if (data_len < len)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
memcpy(data, string, len);
|
||
|
|
data += len;
|
||
|
|
|
||
|
|
return data;
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL_GPL(asn1_encode_octet_string);
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_sequence() - wrap a byte stream in an ASN.1 SEQUENCE
|
||
|
|
* @data: pointer to encode at
|
||
|
|
* @end_data: end of data pointer, points one beyond last usable byte in @data
|
||
|
|
* @seq: data to be encoded as a sequence
|
||
|
|
* @len: length of the data to be encoded as a sequence
|
||
|
|
*
|
||
|
|
* Fill in a sequence. To encode in place, pass NULL for @seq and -1
|
||
|
|
* for @len; then call again once the length is known (still with NULL
|
||
|
|
* for @seq). In order to avoid having to keep both before and after
|
||
|
|
* pointers, the repeat expects to be called with @data pointing to
|
||
|
|
* where the first encode placed it.
|
||
|
|
*/
|
||
|
|
unsigned char *
|
||
|
|
asn1_encode_sequence(unsigned char *data, const unsigned char *end_data,
|
||
|
|
const unsigned char *seq, int len)
|
||
|
|
{
|
||
|
|
int data_len = end_data - data;
|
||
|
|
int ret;
|
||
|
|
|
||
|
|
if (!seq && WARN(len > 127,
|
||
|
|
"BUG: recode sequence is too big (>127)"))
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
if (IS_ERR(data))
|
||
|
|
return data;
|
||
|
|
|
||
|
|
if (!seq && len >= 0) {
|
||
|
|
/*
|
||
|
|
* we're recoding, so move back to the start of the
|
||
|
|
* sequence and install a dummy length because the
|
||
|
|
* real length should be NULL
|
||
|
|
*/
|
||
|
|
data -= 2;
|
||
|
|
data_len = 2;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (data_len < 2)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
*(data++) = _tag(UNIV, CONS, SEQ);
|
||
|
|
data_len--;
|
||
|
|
|
||
|
|
ret = asn1_encode_length(&data, &data_len, len);
|
||
|
|
if (ret)
|
||
|
|
return ERR_PTR(ret);
|
||
|
|
|
||
|
|
if (!seq)
|
||
|
|
return data;
|
||
|
|
|
||
|
|
if (data_len < len)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
memcpy(data, seq, len);
|
||
|
|
data += len;
|
||
|
|
|
||
|
|
return data;
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL_GPL(asn1_encode_sequence);
|
||
|
|
|
||
|
|
/**
|
||
|
|
* asn1_encode_boolean() - encode a boolean value to ASN.1
|
||
|
|
* @data: pointer to encode at
|
||
|
|
* @end_data: end of data pointer, points one beyond last usable byte in @data
|
||
|
|
* @val: the boolean true/false value
|
||
|
|
*/
|
||
|
|
unsigned char *
|
||
|
|
asn1_encode_boolean(unsigned char *data, const unsigned char *end_data,
|
||
|
|
bool val)
|
||
|
|
{
|
||
|
|
int data_len = end_data - data;
|
||
|
|
|
||
|
|
if (IS_ERR(data))
|
||
|
|
return data;
|
||
|
|
|
||
|
|
/* booleans are 3 bytes: tag, length == 1 and value == 0 or 1 */
|
||
|
|
if (data_len < 3)
|
||
|
|
return ERR_PTR(-EINVAL);
|
||
|
|
|
||
|
|
*(data++) = _tag(UNIV, PRIM, BOOL);
|
||
|
|
data_len--;
|
||
|
|
|
||
|
|
asn1_encode_length(&data, &data_len, 1);
|
||
|
|
|
||
|
|
if (val)
|
||
|
|
*(data++) = 1;
|
||
|
|
else
|
||
|
|
*(data++) = 0;
|
||
|
|
|
||
|
|
return data;
|
||
|
|
}
|
||
|
|
EXPORT_SYMBOL_GPL(asn1_encode_boolean);
|
||
|
|
|
||
|
|
MODULE_LICENSE("GPL");
|