asn1.h

00001 /**
00002  * \file asn1.h
00003  *
00004  * \brief Generic ASN.1 parsing
00005  */
00006 /*
00007  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
00008  *  SPDX-License-Identifier: Apache-2.0
00009  *
00010  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
00011  *  not use this file except in compliance with the License.
00012  *  You may obtain a copy of the License at
00013  *
00014  *  http://www.apache.org/licenses/LICENSE-2.0
00015  *
00016  *  Unless required by applicable law or agreed to in writing, software
00017  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
00018  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
00019  *  See the License for the specific language governing permissions and
00020  *  limitations under the License.
00021  *
00022  *  This file is part of mbed TLS (https://tls.mbed.org)
00023  */
00024 #ifndef MBEDTLS_ASN1_H
00025 #define MBEDTLS_ASN1_H
00026 
00027 #if !defined(MBEDTLS_CONFIG_FILE)
00028 #include "mbedtls/config.h"
00029 #else
00030 #include MBEDTLS_CONFIG_FILE
00031 #endif
00032 
00033 #include <stddef.h>
00034 
00035 #if defined(MBEDTLS_BIGNUM_C)
00036 #include "mbedtls/bignum.h"
00037 #endif
00038 
00039 /**
00040  * \addtogroup asn1_module
00041  * \{
00042  */
00043 
00044 /**
00045  * \name ASN1 Error codes
00046  * These error codes are OR'ed to X509 error codes for
00047  * higher error granularity.
00048  * ASN1 is a standard to specify data structures.
00049  * \{
00050  */
00051 #define MBEDTLS_ERR_ASN1_OUT_OF_DATA                      -0x0060  /**< Out of data when parsing an ASN1 data structure. */
00052 #define MBEDTLS_ERR_ASN1_UNEXPECTED_TAG                   -0x0062  /**< ASN1 tag was of an unexpected value. */
00053 #define MBEDTLS_ERR_ASN1_INVALID_LENGTH                   -0x0064  /**< Error when trying to determine the length or invalid length. */
00054 #define MBEDTLS_ERR_ASN1_LENGTH_MISMATCH                  -0x0066  /**< Actual length differs from expected length. */
00055 #define MBEDTLS_ERR_ASN1_INVALID_DATA                     -0x0068  /**< Data is invalid. */
00056 #define MBEDTLS_ERR_ASN1_ALLOC_FAILED                     -0x006A  /**< Memory allocation failed */
00057 #define MBEDTLS_ERR_ASN1_BUF_TOO_SMALL                    -0x006C  /**< Buffer too small when writing ASN.1 data structure. */
00058 
00059 /* \} name */
00060 
00061 /**
00062  * \name DER constants
00063  * These constants comply with the DER encoded ASN.1 type tags.
00064  * DER encoding uses hexadecimal representation.
00065  * An example DER sequence is:\n
00066  * - 0x02 -- tag indicating INTEGER
00067  * - 0x01 -- length in octets
00068  * - 0x05 -- value
00069  * Such sequences are typically read into Mbed TLS's \c mbedtls_x509_buf.
00070  * \{
00071  */
00072 #define MBEDTLS_ASN1_BOOLEAN                 0x01
00073 #define MBEDTLS_ASN1_INTEGER                 0x02
00074 #define MBEDTLS_ASN1_BIT_STRING              0x03
00075 #define MBEDTLS_ASN1_OCTET_STRING            0x04
00076 #define MBEDTLS_ASN1_NULL                    0x05
00077 #define MBEDTLS_ASN1_OID                     0x06
00078 #define MBEDTLS_ASN1_UTF8_STRING             0x0C
00079 #define MBEDTLS_ASN1_SEQUENCE                0x10
00080 #define MBEDTLS_ASN1_SET                     0x11
00081 #define MBEDTLS_ASN1_PRINTABLE_STRING        0x13
00082 #define MBEDTLS_ASN1_T61_STRING              0x14
00083 #define MBEDTLS_ASN1_IA5_STRING              0x16
00084 #define MBEDTLS_ASN1_UTC_TIME                0x17
00085 #define MBEDTLS_ASN1_GENERALIZED_TIME        0x18
00086 #define MBEDTLS_ASN1_UNIVERSAL_STRING        0x1C
00087 #define MBEDTLS_ASN1_BMP_STRING              0x1E
00088 #define MBEDTLS_ASN1_PRIMITIVE               0x00
00089 #define MBEDTLS_ASN1_CONSTRUCTED             0x20
00090 #define MBEDTLS_ASN1_CONTEXT_SPECIFIC        0x80
00091 
00092 /*
00093  * Bit masks for each of the components of an ASN.1 tag as specified in
00094  * ITU X.690 (08/2015), section 8.1 "General rules for encoding",
00095  * paragraph 8.1.2.2:
00096  *
00097  * Bit  8     7   6   5          1
00098  *     +-------+-----+------------+
00099  *     | Class | P/C | Tag number |
00100  *     +-------+-----+------------+
00101  */
00102 #define MBEDTLS_ASN1_TAG_CLASS_MASK          0xC0
00103 #define MBEDTLS_ASN1_TAG_PC_MASK             0x20
00104 #define MBEDTLS_ASN1_TAG_VALUE_MASK          0x1F
00105 
00106 /* \} name */
00107 /* \} addtogroup asn1_module */
00108 
00109 /** Returns the size of the binary string, without the trailing \\0 */
00110 #define MBEDTLS_OID_SIZE(x) (sizeof(x) - 1)
00111 
00112 /**
00113  * Compares an mbedtls_asn1_buf structure to a reference OID.
00114  *
00115  * Only works for 'defined' oid_str values (MBEDTLS_OID_HMAC_SHA1), you cannot use a
00116  * 'unsigned char *oid' here!
00117  */
00118 #define MBEDTLS_OID_CMP(oid_str, oid_buf)                                   \
00119         ( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf)->len ) ||                \
00120           memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) != 0 )
00121 
00122 #ifdef __cplusplus
00123 extern "C" {
00124 #endif
00125 
00126 /**
00127  * \name Functions to parse ASN.1 data structures
00128  * \{
00129  */
00130 
00131 /**
00132  * Type-length-value structure that allows for ASN1 using DER.
00133  */
00134 typedef struct mbedtls_asn1_buf
00135 {
00136     int tag;                /**< ASN1 type, e.g. MBEDTLS_ASN1_UTF8_STRING. */
00137     size_t len;             /**< ASN1 length, in octets. */
00138     unsigned char *p;       /**< ASN1 data, e.g. in ASCII. */
00139 }
00140 mbedtls_asn1_buf;
00141 
00142 /**
00143  * Container for ASN1 bit strings.
00144  */
00145 typedef struct mbedtls_asn1_bitstring
00146 {
00147     size_t len;                 /**< ASN1 length, in octets. */
00148     unsigned char unused_bits;  /**< Number of unused bits at the end of the string */
00149     unsigned char *p;           /**< Raw ASN1 data for the bit string */
00150 }
00151 mbedtls_asn1_bitstring;
00152 
00153 /**
00154  * Container for a sequence of ASN.1 items
00155  */
00156 typedef struct mbedtls_asn1_sequence
00157 {
00158     mbedtls_asn1_buf buf;                   /**< Buffer containing the given ASN.1 item. */
00159     struct mbedtls_asn1_sequence *next;    /**< The next entry in the sequence. */
00160 }
00161 mbedtls_asn1_sequence;
00162 
00163 /**
00164  * Container for a sequence or list of 'named' ASN.1 data items
00165  */
00166 typedef struct mbedtls_asn1_named_data
00167 {
00168     mbedtls_asn1_buf oid;                   /**< The object identifier. */
00169     mbedtls_asn1_buf val;                   /**< The named value. */
00170     struct mbedtls_asn1_named_data *next;  /**< The next entry in the sequence. */
00171     unsigned char next_merged;      /**< Merge next item into the current one? */
00172 }
00173 mbedtls_asn1_named_data;
00174 
00175 /**
00176  * \brief       Get the length of an ASN.1 element.
00177  *              Updates the pointer to immediately behind the length.
00178  *
00179  * \param p     On entry, \c *p points to the first byte of the length,
00180  *              i.e. immediately after the tag.
00181  *              On successful completion, \c *p points to the first byte
00182  *              after the length, i.e. the first byte of the content.
00183  *              On error, the value of \c *p is undefined.
00184  * \param end   End of data.
00185  * \param len   On successful completion, \c *len contains the length
00186  *              read from the ASN.1 input.
00187  *
00188  * \return      0 if successful.
00189  * \return      #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element
00190  *              would end beyond \p end.
00191  * \return      #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparseable.
00192  */
00193 int mbedtls_asn1_get_len( unsigned char **p,
00194                           const unsigned char *end,
00195                           size_t *len );
00196 
00197 /**
00198  * \brief       Get the tag and length of the element.
00199  *              Check for the requested tag.
00200  *              Updates the pointer to immediately behind the tag and length.
00201  *
00202  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00203  *              On successful completion, \c *p points to the first byte
00204  *              after the length, i.e. the first byte of the content.
00205  *              On error, the value of \c *p is undefined.
00206  * \param end   End of data.
00207  * \param len   On successful completion, \c *len contains the length
00208  *              read from the ASN.1 input.
00209  * \param tag   The expected tag.
00210  *
00211  * \return      0 if successful.
00212  * \return      #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the data does not start
00213  *              with the requested tag.
00214  * \return      #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element
00215  *              would end beyond \p end.
00216  * \return      #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparseable.
00217  */
00218 int mbedtls_asn1_get_tag( unsigned char **p,
00219                           const unsigned char *end,
00220                           size_t *len, int tag );
00221 
00222 /**
00223  * \brief       Retrieve a boolean ASN.1 tag and its value.
00224  *              Updates the pointer to immediately behind the full tag.
00225  *
00226  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00227  *              On successful completion, \c *p points to the first byte
00228  *              beyond the ASN.1 element.
00229  *              On error, the value of \c *p is undefined.
00230  * \param end   End of data.
00231  * \param val   On success, the parsed value (\c 0 or \c 1).
00232  *
00233  * \return      0 if successful.
00234  * \return      An ASN.1 error code if the input does not start with
00235  *              a valid ASN.1 BOOLEAN.
00236  */
00237 int mbedtls_asn1_get_bool( unsigned char **p,
00238                            const unsigned char *end,
00239                            int *val );
00240 
00241 /**
00242  * \brief       Retrieve an integer ASN.1 tag and its value.
00243  *              Updates the pointer to immediately behind the full tag.
00244  *
00245  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00246  *              On successful completion, \c *p points to the first byte
00247  *              beyond the ASN.1 element.
00248  *              On error, the value of \c *p is undefined.
00249  * \param end   End of data.
00250  * \param val   On success, the parsed value.
00251  *
00252  * \return      0 if successful.
00253  * \return      An ASN.1 error code if the input does not start with
00254  *              a valid ASN.1 INTEGER.
00255  * \return      #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does
00256  *              not fit in an \c int.
00257  * \return      An ASN.1 error code if the input does not start with
00258  *              a valid ASN.1 INTEGER.
00259  */
00260 int mbedtls_asn1_get_int( unsigned char **p,
00261                           const unsigned char *end,
00262                           int *val );
00263 
00264 /**
00265  * \brief       Retrieve a bitstring ASN.1 tag and its value.
00266  *              Updates the pointer to immediately behind the full tag.
00267  *
00268  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00269  *              On successful completion, \c *p is equal to \p end.
00270  *              On error, the value of \c *p is undefined.
00271  * \param end   End of data.
00272  * \param bs    On success, ::mbedtls_asn1_bitstring information about
00273  *              the parsed value.
00274  *
00275  * \return      0 if successful.
00276  * \return      #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains
00277  *              extra data after a valid BIT STRING.
00278  * \return      An ASN.1 error code if the input does not start with
00279  *              a valid ASN.1 BIT STRING.
00280  */
00281 int mbedtls_asn1_get_bitstring( unsigned char **p, const unsigned char *end,
00282                                 mbedtls_asn1_bitstring *bs );
00283 
00284 /**
00285  * \brief       Retrieve a bitstring ASN.1 tag without unused bits and its
00286  *              value.
00287  *              Updates the pointer to the beginning of the bit/octet string.
00288  *
00289  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00290  *              On successful completion, \c *p points to the first byte
00291  *              of the content of the BIT STRING.
00292  *              On error, the value of \c *p is undefined.
00293  * \param end   End of data.
00294  * \param len   On success, \c *len is the length of the content in bytes.
00295  *
00296  * \return      0 if successful.
00297  * \return      #MBEDTLS_ERR_ASN1_INVALID_DATA if the input starts with
00298  *              a valid BIT STRING with a nonzero number of unused bits.
00299  * \return      An ASN.1 error code if the input does not start with
00300  *              a valid ASN.1 BIT STRING.
00301  */
00302 int mbedtls_asn1_get_bitstring_null( unsigned char **p,
00303                                      const unsigned char *end,
00304                                      size_t *len );
00305 
00306 /**
00307  * \brief       Parses and splits an ASN.1 "SEQUENCE OF <tag>".
00308  *              Updates the pointer to immediately behind the full sequence tag.
00309  *
00310  * \note        On error, this function may return a partial list in \p cur.
00311  *              You must set `cur->next = NULL` before calling this function!
00312  *              Otherwise it is impossible to distinguish a previously non-null
00313  *              pointer from a pointer to an object allocated by this function.
00314  *
00315  * \note        If the sequence is empty, this function does not modify
00316  *              \c *cur. If the sequence is valid and non-empty, this
00317  *              function sets `cur->buf.tag` to \p tag. This allows
00318  *              callers to distinguish between an empty sequence and
00319  *              a one-element sequence.
00320  *
00321  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00322  *              On successful completion, \c *p is equal to \p end.
00323  *              On error, the value of \c *p is undefined.
00324  * \param end   End of data.
00325  * \param cur   A ::mbedtls_asn1_sequence which this function fills.
00326  *              When this function returns, \c *cur is the head of a linked
00327  *              list. Each node in this list is allocated with
00328  *              mbedtls_calloc() apart from \p cur itself, and should
00329  *              therefore be freed with mbedtls_free().
00330  *              The list describes the content of the sequence.
00331  *              The head of the list (i.e. \c *cur itself) describes the
00332  *              first element, `*cur->next` describes the second element, etc.
00333  *              For each element, `buf.tag == tag`, `buf.len` is the length
00334  *              of the content of the content of the element, and `buf.p`
00335  *              points to the first byte of the content (i.e. immediately
00336  *              past the length of the element).
00337  *              Note that list elements may be allocated even on error.
00338  * \param tag   Each element of the sequence must have this tag.
00339  *
00340  * \return      0 if successful.
00341  * \return      #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains
00342  *              extra data after a valid SEQUENCE OF \p tag.
00343  * \return      #MBEDTLS_ERR_ASN1_ALLOC_FAILED if a memory allocation failed.
00344  * \return      An ASN.1 error code if the input does not start with
00345  *              a valid ASN.1 BIT STRING.
00346  */
00347 int mbedtls_asn1_get_sequence_of( unsigned char **p,
00348                                   const unsigned char *end,
00349                                   mbedtls_asn1_sequence *cur,
00350                                   int tag );
00351 
00352 #if defined(MBEDTLS_BIGNUM_C)
00353 /**
00354  * \brief       Retrieve an integer ASN.1 tag and its value.
00355  *              Updates the pointer to immediately behind the full tag.
00356  *
00357  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00358  *              On successful completion, \c *p points to the first byte
00359  *              beyond the ASN.1 element.
00360  *              On error, the value of \c *p is undefined.
00361  * \param end   End of data.
00362  * \param X     On success, the parsed value.
00363  *
00364  * \return      0 if successful.
00365  * \return      An ASN.1 error code if the input does not start with
00366  *              a valid ASN.1 INTEGER.
00367  * \return      #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does
00368  *              not fit in an \c int.
00369  * \return      An MPI error code if the parsed value is too large.
00370  * \return      An ASN.1 error code if the input does not start with
00371  *              a valid ASN.1 INTEGER.
00372  */
00373 int mbedtls_asn1_get_mpi( unsigned char **p,
00374                           const unsigned char *end,
00375                           mbedtls_mpi *X );
00376 #endif /* MBEDTLS_BIGNUM_C */
00377 
00378 /**
00379  * \brief       Retrieve an AlgorithmIdentifier ASN.1 sequence.
00380  *              Updates the pointer to immediately behind the full
00381  *              AlgorithmIdentifier.
00382  *
00383  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00384  *              On successful completion, \c *p points to the first byte
00385  *              beyond the AlgorithmIdentifier element.
00386  *              On error, the value of \c *p is undefined.
00387  * \param end   End of data.
00388  * \param alg   The buffer to receive the OID.
00389  * \param params The buffer to receive the parameters.
00390  *              This is zeroized if there are no parameters.
00391  *
00392  * \return      0 if successful or a specific ASN.1 or MPI error code.
00393  */
00394 int mbedtls_asn1_get_alg( unsigned char **p,
00395                   const unsigned char *end,
00396                   mbedtls_asn1_buf *alg, mbedtls_asn1_buf *params );
00397 
00398 /**
00399  * \brief       Retrieve an AlgorithmIdentifier ASN.1 sequence with NULL or no
00400  *              params.
00401  *              Updates the pointer to immediately behind the full
00402  *              AlgorithmIdentifier.
00403  *
00404  * \param p     On entry, \c *p points to the start of the ASN.1 element.
00405  *              On successful completion, \c *p points to the first byte
00406  *              beyond the AlgorithmIdentifier element.
00407  *              On error, the value of \c *p is undefined.
00408  * \param end   End of data.
00409  * \param alg   The buffer to receive the OID.
00410  *
00411  * \return      0 if successful or a specific ASN.1 or MPI error code.
00412  */
00413 int mbedtls_asn1_get_alg_null( unsigned char **p,
00414                        const unsigned char *end,
00415                        mbedtls_asn1_buf *alg );
00416 
00417 /**
00418  * \brief       Find a specific named_data entry in a sequence or list based on
00419  *              the OID.
00420  *
00421  * \param list  The list to seek through
00422  * \param oid   The OID to look for
00423  * \param len   Size of the OID
00424  *
00425  * \return      NULL if not found, or a pointer to the existing entry.
00426  */
00427 mbedtls_asn1_named_data *mbedtls_asn1_find_named_data( mbedtls_asn1_named_data *list,
00428                                        const char *oid, size_t len );
00429 
00430 /**
00431  * \brief       Free a mbedtls_asn1_named_data entry
00432  *
00433  * \param entry The named data entry to free.
00434  *              This function calls mbedtls_free() on
00435  *              `entry->oid.p` and `entry->val.p`.
00436  */
00437 void mbedtls_asn1_free_named_data( mbedtls_asn1_named_data *entry );
00438 
00439 /**
00440  * \brief       Free all entries in a mbedtls_asn1_named_data list.
00441  *
00442  * \param head  Pointer to the head of the list of named data entries to free.
00443  *              This function calls mbedtls_asn1_free_named_data() and
00444  *              mbedtls_free() on each list element and
00445  *              sets \c *head to \c NULL.
00446  */
00447 void mbedtls_asn1_free_named_data_list( mbedtls_asn1_named_data **head );
00448 
00449 #ifdef __cplusplus
00450 }
00451 #endif
00452 
00453 #endif /* asn1.h */