1 // Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //     https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include <openssl/asn1.h>
16 
17 #include <assert.h>
18 #include <ctype.h>
19 #include <inttypes.h>
20 #include <limits.h>
21 #include <string.h>
22 #include <time.h>
23 
24 #include <openssl/bio.h>
25 #include <openssl/bytestring.h>
26 #include <openssl/mem.h>
27 
28 #include "../bytestring/internal.h"
29 #include "../internal.h"
30 #include "internal.h"
31 
32 
33 #define ESC_FLAGS                                                           \
34   (ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_ESC_QUOTE | ASN1_STRFLGS_ESC_CTRL | \
35    ASN1_STRFLGS_ESC_MSB)
36 
maybe_write(BIO * out,const void * buf,int len)37 static int maybe_write(BIO *out, const void *buf, int len) {
38   // If |out| is NULL, ignore the output but report the length.
39   return out == NULL || BIO_write(out, buf, len) == len;
40 }
41 
is_control_character(unsigned char c)42 static int is_control_character(unsigned char c) { return c < 32 || c == 127; }
43 
do_esc_char(uint32_t c,unsigned long flags,char * do_quotes,BIO * out,int is_first,int is_last)44 static int do_esc_char(uint32_t c, unsigned long flags, char *do_quotes,
45                        BIO *out, int is_first, int is_last) {
46   // |c| is a |uint32_t| because, depending on |ASN1_STRFLGS_UTF8_CONVERT|,
47   // we may be escaping bytes or Unicode codepoints.
48   char buf[16];  // Large enough for "\\W01234567".
49   unsigned char u8 = (unsigned char)c;
50   if (c > 0xffff) {
51     snprintf(buf, sizeof(buf), "\\W%08" PRIX32, c);
52   } else if (c > 0xff) {
53     snprintf(buf, sizeof(buf), "\\U%04" PRIX32, c);
54   } else if ((flags & ASN1_STRFLGS_ESC_MSB) && c > 0x7f) {
55     snprintf(buf, sizeof(buf), "\\%02X", c);
56   } else if ((flags & ASN1_STRFLGS_ESC_CTRL) && is_control_character(c)) {
57     snprintf(buf, sizeof(buf), "\\%02X", c);
58   } else if (flags & ASN1_STRFLGS_ESC_2253) {
59     // See RFC 2253, sections 2.4 and 4.
60     if (c == '\\' || c == '"') {
61       // Quotes and backslashes are always escaped, quoted or not.
62       snprintf(buf, sizeof(buf), "\\%c", (int)c);
63     } else if (c == ',' || c == '+' || c == '<' || c == '>' || c == ';' ||
64                (is_first && (c == ' ' || c == '#')) ||
65                (is_last && (c == ' '))) {
66       if (flags & ASN1_STRFLGS_ESC_QUOTE) {
67         // No need to escape, just tell the caller to quote.
68         if (do_quotes != NULL) {
69           *do_quotes = 1;
70         }
71         return maybe_write(out, &u8, 1) ? 1 : -1;
72       }
73       snprintf(buf, sizeof(buf), "\\%c", (int)c);
74     } else {
75       return maybe_write(out, &u8, 1) ? 1 : -1;
76     }
77   } else if ((flags & ESC_FLAGS) && c == '\\') {
78     // If any escape flags are set, also escape backslashes.
79     snprintf(buf, sizeof(buf), "\\%c", (int)c);
80   } else {
81     return maybe_write(out, &u8, 1) ? 1 : -1;
82   }
83 
84   static_assert(sizeof(buf) < INT_MAX, "len may not fit in int");
85   int len = (int)strlen(buf);
86   return maybe_write(out, buf, len) ? len : -1;
87 }
88 
89 // This function sends each character in a buffer to do_esc_char(). It
90 // interprets the content formats and converts to or from UTF8 as
91 // appropriate.
92 
do_buf(const unsigned char * buf,int buflen,int encoding,unsigned long flags,char * quotes,BIO * out)93 static int do_buf(const unsigned char *buf, int buflen, int encoding,
94                   unsigned long flags, char *quotes, BIO *out) {
95   int (*get_char)(CBS *cbs, uint32_t *out);
96   int get_char_error;
97   switch (encoding) {
98     case MBSTRING_UNIV:
99       get_char = CBS_get_utf32_be;
100       get_char_error = ASN1_R_INVALID_UNIVERSALSTRING;
101       break;
102     case MBSTRING_BMP:
103       get_char = CBS_get_ucs2_be;
104       get_char_error = ASN1_R_INVALID_BMPSTRING;
105       break;
106     case MBSTRING_ASC:
107       get_char = CBS_get_latin1;
108       get_char_error = ERR_R_INTERNAL_ERROR;  // Should not be possible.
109       break;
110     case MBSTRING_UTF8:
111       get_char = CBS_get_utf8;
112       get_char_error = ASN1_R_INVALID_UTF8STRING;
113       break;
114     default:
115       assert(0);
116       return -1;
117   }
118 
119   CBS cbs;
120   CBS_init(&cbs, buf, buflen);
121   int outlen = 0;
122   while (CBS_len(&cbs) != 0) {
123     const int is_first = CBS_data(&cbs) == buf;
124     uint32_t c;
125     if (!get_char(&cbs, &c)) {
126       OPENSSL_PUT_ERROR(ASN1, get_char_error);
127       return -1;
128     }
129     const int is_last = CBS_len(&cbs) == 0;
130     if (flags & ASN1_STRFLGS_UTF8_CONVERT) {
131       uint8_t utf8_buf[6];
132       CBB utf8_cbb;
133       CBB_init_fixed(&utf8_cbb, utf8_buf, sizeof(utf8_buf));
134       if (!CBB_add_utf8(&utf8_cbb, c)) {
135         OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR);
136         return 1;
137       }
138       size_t utf8_len = CBB_len(&utf8_cbb);
139       for (size_t i = 0; i < utf8_len; i++) {
140         int len = do_esc_char(utf8_buf[i], flags, quotes, out,
141                               is_first && i == 0, is_last && i == utf8_len - 1);
142         if (len < 0) {
143           return -1;
144         }
145         outlen += len;
146       }
147     } else {
148       int len = do_esc_char(c, flags, quotes, out, is_first, is_last);
149       if (len < 0) {
150         return -1;
151       }
152       outlen += len;
153     }
154   }
155   return outlen;
156 }
157 
158 // This function hex dumps a buffer of characters
159 
do_hex_dump(BIO * out,unsigned char * buf,int buflen)160 static int do_hex_dump(BIO *out, unsigned char *buf, int buflen) {
161   static const char hexdig[] = "0123456789ABCDEF";
162   unsigned char *p, *q;
163   char hextmp[2];
164   if (out) {
165     p = buf;
166     q = buf + buflen;
167     while (p != q) {
168       hextmp[0] = hexdig[*p >> 4];
169       hextmp[1] = hexdig[*p & 0xf];
170       if (!maybe_write(out, hextmp, 2)) {
171         return -1;
172       }
173       p++;
174     }
175   }
176   return buflen << 1;
177 }
178 
179 // "dump" a string. This is done when the type is unknown, or the flags
180 // request it. We can either dump the content octets or the entire DER
181 // encoding. This uses the RFC 2253 #01234 format.
182 
do_dump(unsigned long flags,BIO * out,const ASN1_STRING * str)183 static int do_dump(unsigned long flags, BIO *out, const ASN1_STRING *str) {
184   if (!maybe_write(out, "#", 1)) {
185     return -1;
186   }
187 
188   // If we don't dump DER encoding just dump content octets
189   if (!(flags & ASN1_STRFLGS_DUMP_DER)) {
190     int outlen = do_hex_dump(out, str->data, str->length);
191     if (outlen < 0) {
192       return -1;
193     }
194     return outlen + 1;
195   }
196 
197   // Placing the ASN1_STRING in a temporary ASN1_TYPE allows the DER encoding
198   // to readily obtained.
199   ASN1_TYPE t;
200   OPENSSL_memset(&t, 0, sizeof(ASN1_TYPE));
201   asn1_type_set0_string(&t, (ASN1_STRING *)str);
202   unsigned char *der_buf = NULL;
203   int der_len = i2d_ASN1_TYPE(&t, &der_buf);
204   if (der_len < 0) {
205     return -1;
206   }
207   int outlen = do_hex_dump(out, der_buf, der_len);
208   OPENSSL_free(der_buf);
209   if (outlen < 0) {
210     return -1;
211   }
212   return outlen + 1;
213 }
214 
215 // string_type_to_encoding returns the |MBSTRING_*| constant for the encoding
216 // used by the |ASN1_STRING| type |type|, or -1 if |tag| is not a string
217 // type.
string_type_to_encoding(int type)218 static int string_type_to_encoding(int type) {
219   // This function is sometimes passed ASN.1 universal types and sometimes
220   // passed |ASN1_STRING| type values
221   switch (type) {
222     case V_ASN1_UTF8STRING:
223       return MBSTRING_UTF8;
224     case V_ASN1_NUMERICSTRING:
225     case V_ASN1_PRINTABLESTRING:
226     case V_ASN1_T61STRING:
227     case V_ASN1_IA5STRING:
228     case V_ASN1_UTCTIME:
229     case V_ASN1_GENERALIZEDTIME:
230     case V_ASN1_ISO64STRING:
231       // |MBSTRING_ASC| refers to Latin-1, not ASCII.
232       return MBSTRING_ASC;
233     case V_ASN1_UNIVERSALSTRING:
234       return MBSTRING_UNIV;
235     case V_ASN1_BMPSTRING:
236       return MBSTRING_BMP;
237   }
238   return -1;
239 }
240 
241 // This is the main function, print out an ASN1_STRING taking note of various
242 // escape and display options. Returns number of characters written or -1 if
243 // an error occurred.
244 
ASN1_STRING_print_ex(BIO * out,const ASN1_STRING * str,unsigned long flags)245 int ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str,
246                          unsigned long flags) {
247   int type = str->type;
248   int outlen = 0;
249   if (flags & ASN1_STRFLGS_SHOW_TYPE) {
250     const char *tagname = ASN1_tag2str(type);
251     outlen += strlen(tagname);
252     if (!maybe_write(out, tagname, outlen) || !maybe_write(out, ":", 1)) {
253       return -1;
254     }
255     outlen++;
256   }
257 
258   // Decide what to do with |str|, either dump the contents or display it.
259   int encoding;
260   if (flags & ASN1_STRFLGS_DUMP_ALL) {
261     // Dump everything.
262     encoding = -1;
263   } else if (flags & ASN1_STRFLGS_IGNORE_TYPE) {
264     // Ignore the string type and interpret the contents as Latin-1.
265     encoding = MBSTRING_ASC;
266   } else {
267     encoding = string_type_to_encoding(type);
268     if (encoding == -1 && (flags & ASN1_STRFLGS_DUMP_UNKNOWN) == 0) {
269       encoding = MBSTRING_ASC;
270     }
271   }
272 
273   if (encoding == -1) {
274     int len = do_dump(flags, out, str);
275     if (len < 0) {
276       return -1;
277     }
278     outlen += len;
279     return outlen;
280   }
281 
282   // Measure the length.
283   char quotes = 0;
284   int len = do_buf(str->data, str->length, encoding, flags, &quotes, NULL);
285   if (len < 0) {
286     return -1;
287   }
288   outlen += len;
289   if (quotes) {
290     outlen += 2;
291   }
292   if (!out) {
293     return outlen;
294   }
295 
296   // Encode the value.
297   if ((quotes && !maybe_write(out, "\"", 1)) ||
298       do_buf(str->data, str->length, encoding, flags, NULL, out) < 0 ||
299       (quotes && !maybe_write(out, "\"", 1))) {
300     return -1;
301   }
302   return outlen;
303 }
304 
ASN1_STRING_print_ex_fp(FILE * fp,const ASN1_STRING * str,unsigned long flags)305 int ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str,
306                             unsigned long flags) {
307   BIO *bio = NULL;
308   if (fp != NULL) {
309     // If |fp| is NULL, this function returns the number of bytes without
310     // writing.
311     bio = BIO_new_fp(fp, BIO_NOCLOSE);
312     if (bio == NULL) {
313       return -1;
314     }
315   }
316   int ret = ASN1_STRING_print_ex(bio, str, flags);
317   BIO_free(bio);
318   return ret;
319 }
320 
ASN1_STRING_to_UTF8(unsigned char ** out,const ASN1_STRING * in)321 int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in) {
322   if (!in) {
323     return -1;
324   }
325   int mbflag = string_type_to_encoding(in->type);
326   if (mbflag == -1) {
327     OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_TAG);
328     return -1;
329   }
330   ASN1_STRING stmp, *str = &stmp;
331   stmp.data = NULL;
332   stmp.length = 0;
333   stmp.flags = 0;
334   int ret =
335       ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING);
336   if (ret < 0) {
337     return ret;
338   }
339   *out = stmp.data;
340   return stmp.length;
341 }
342 
ASN1_STRING_print(BIO * bp,const ASN1_STRING * v)343 int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v) {
344   int i, n;
345   char buf[80];
346   const char *p;
347 
348   if (v == NULL) {
349     return 0;
350   }
351   n = 0;
352   p = (const char *)v->data;
353   for (i = 0; i < v->length; i++) {
354     if ((p[i] > '~') || ((p[i] < ' ') && (p[i] != '\n') && (p[i] != '\r'))) {
355       buf[n] = '.';
356     } else {
357       buf[n] = p[i];
358     }
359     n++;
360     if (n >= 80) {
361       if (BIO_write(bp, buf, n) <= 0) {
362         return 0;
363       }
364       n = 0;
365     }
366   }
367   if (n > 0) {
368     if (BIO_write(bp, buf, n) <= 0) {
369       return 0;
370     }
371   }
372   return 1;
373 }
374 
ASN1_TIME_print(BIO * bp,const ASN1_TIME * tm)375 int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm) {
376   if (tm->type == V_ASN1_UTCTIME) {
377     return ASN1_UTCTIME_print(bp, tm);
378   }
379   if (tm->type == V_ASN1_GENERALIZEDTIME) {
380     return ASN1_GENERALIZEDTIME_print(bp, tm);
381   }
382   BIO_puts(bp, "Bad time value");
383   return 0;
384 }
385 
386 static const char *const mon[12] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
387                                     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
388 
ASN1_GENERALIZEDTIME_print(BIO * bp,const ASN1_GENERALIZEDTIME * tm)389 int ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm) {
390   CBS cbs;
391   CBS_init(&cbs, tm->data, tm->length);
392   struct tm utc;
393   if (!CBS_parse_generalized_time(&cbs, &utc, /*allow_timezone_offset=*/0)) {
394     BIO_puts(bp, "Bad time value");
395     return 0;
396   }
397 
398   return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d GMT", mon[utc.tm_mon],
399                     utc.tm_mday, utc.tm_hour, utc.tm_min, utc.tm_sec,
400                     utc.tm_year + 1900) > 0;
401 }
402 
ASN1_UTCTIME_print(BIO * bp,const ASN1_UTCTIME * tm)403 int ASN1_UTCTIME_print(BIO *bp, const ASN1_UTCTIME *tm) {
404   CBS cbs;
405   CBS_init(&cbs, tm->data, tm->length);
406   struct tm utc;
407   if (!CBS_parse_utc_time(&cbs, &utc, /*allow_timezone_offset=*/0)) {
408     BIO_puts(bp, "Bad time value");
409     return 0;
410   }
411 
412   return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d GMT", mon[utc.tm_mon],
413                     utc.tm_mday, utc.tm_hour, utc.tm_min, utc.tm_sec,
414                     utc.tm_year + 1900) > 0;
415 }
416