/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

/* vim: set ts=8 sts=2 et sw=2 tw=80: */

/* This code is made available to you under your choice of the following sets

 * of licensing terms:

 */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/.

 */

/* Copyright 2013 Mozilla Contributors

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include "pkixder.h"

#include "pkixutil.h"

namespace mozilla { namespace pkix { namespace der {

// Too complicated to be inline

Result

ReadTagAndGetValue(Reader& input, /*out*/ uint8_t& tag, /*out*/ Input& value)

{

  Result rv;

  rv = input.Read(tag);

  if (rv != Success) {

    return rv;

  }

  if ((tag & 0x1F) == 0x1F) {

    return Result::ERROR_BAD_DER; // high tag number form not allowed

  }

  uint16_t length;

  // The short form of length is a single byte with the high order bit set

  // to zero. The long form of length is one byte with the high order bit

  // set, followed by N bytes, where N is encoded in the lowest 7 bits of

  // the first byte.

  uint8_t length1;

  rv = input.Read(length1);

  if (rv != Success) {

    return rv;

  }

  if (!(length1 & 0x80)) {

    length = length1;

  } else if (length1 == 0x81) {

    uint8_t length2;

    rv = input.Read(length2);

    if (rv != Success) {

      return rv;

    }

    if (length2 < 128) {

      // Not shortest possible encoding

      return Result::ERROR_BAD_DER;

    }

    length = length2;

  } else if (length1 == 0x82) {

    rv = input.Read(length);

    if (rv != Success) {

      return rv;

    }

    if (length < 256) {

      // Not shortest possible encoding

      return Result::ERROR_BAD_DER;

    }

  } else {

    // We don't support lengths larger than 2^16 - 1.

    return Result::ERROR_BAD_DER;

  }

  return input.Skip(length, value);

}

static Result

OptionalNull(Reader& input)

{

  if (input.Peek(NULLTag)) {

    return Null(input);

  }

  return Success;

}

namespace {

Result

AlgorithmIdentifierValue(Reader& input, /*out*/ Reader& algorithmOIDValue)

{

  Result rv = ExpectTagAndGetValue(input, der::OIDTag, algorithmOIDValue);

  if (rv != Success) {

    return rv;

  }

  return OptionalNull(input);

}

} // namespace

Result

SignatureAlgorithmIdentifierValue(Reader& input,

                                 /*out*/ PublicKeyAlgorithm& publicKeyAlgorithm,

                                 /*out*/ DigestAlgorithm& digestAlgorithm)

{

  // RFC 5758 Section 3.2 (ECDSA with SHA-2), and RFC 3279 Section 2.2.3

  // (ECDSA with SHA-1) say that parameters must be omitted.

  //

  // RFC 4055 Section 5 and RFC 3279 Section 2.2.1 both say that parameters for

  // RSA must be encoded as NULL; we relax that requirement by allowing the

  // NULL to be omitted, to match all the other signature algorithms we support

  // and for compatibility.

  Reader algorithmID;

  Result rv = AlgorithmIdentifierValue(input, algorithmID);

  if (rv != Success) {

    return rv;

  }

  // RFC 5758 Section 3.2 (ecdsa-with-SHA224 is intentionally excluded)

  // python DottedOIDToCode.py ecdsa-with-SHA256 1.2.840.10045.4.3.2

  static const uint8_t ecdsa_with_SHA256[] = {

    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02

  };

  // python DottedOIDToCode.py ecdsa-with-SHA384 1.2.840.10045.4.3.3

  static const uint8_t ecdsa_with_SHA384[] = {

    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03

  };

  // python DottedOIDToCode.py ecdsa-with-SHA512 1.2.840.10045.4.3.4

  static const uint8_t ecdsa_with_SHA512[] = {

    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x04

  };

  // RFC 4055 Section 5 (sha224WithRSAEncryption is intentionally excluded)

  // python DottedOIDToCode.py sha256WithRSAEncryption 1.2.840.113549.1.1.11

  static const uint8_t sha256WithRSAEncryption[] = {

    0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b

  };

  // python DottedOIDToCode.py sha384WithRSAEncryption 1.2.840.113549.1.1.12

  static const uint8_t sha384WithRSAEncryption[] = {

    0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0c

  };

  // python DottedOIDToCode.py sha512WithRSAEncryption 1.2.840.113549.1.1.13

  static const uint8_t sha512WithRSAEncryption[] = {

    0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d

  };

  // RFC 3279 Section 2.2.1

  // python DottedOIDToCode.py sha-1WithRSAEncryption 1.2.840.113549.1.1.5

  static const uint8_t sha_1WithRSAEncryption[] = {

    0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05

  };

  // NIST Open Systems Environment (OSE) Implementor's Workshop (OIW)

  // http://www.oiw.org/agreements/stable/12s-9412.txt (no longer works).

  // http://www.imc.org/ietf-pkix/old-archive-97/msg01166.html

  // We need to support this this non-PKIX OID for compatibility.

  // python DottedOIDToCode.py sha1WithRSASignature 1.3.14.3.2.29

  static const uint8_t sha1WithRSASignature[] = {

    0x2b, 0x0e, 0x03, 0x02, 0x1d

  };

  // RFC 3279 Section 2.2.3

  // python DottedOIDToCode.py ecdsa-with-SHA1 1.2.840.10045.4.1

  static const uint8_t ecdsa_with_SHA1[] = {

    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x01

  };

  // Matching is attempted based on a rough estimate of the commonality of the

  // algorithm, to minimize the number of MatchRest calls.

  if (algorithmID.MatchRest(sha256WithRSAEncryption)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::RSA_PKCS1;

    digestAlgorithm = DigestAlgorithm::sha256;

  } else if (algorithmID.MatchRest(ecdsa_with_SHA256)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::ECDSA;

    digestAlgorithm = DigestAlgorithm::sha256;

  } else if (algorithmID.MatchRest(sha_1WithRSAEncryption)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::RSA_PKCS1;

    digestAlgorithm = DigestAlgorithm::sha1;

  } else if (algorithmID.MatchRest(ecdsa_with_SHA1)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::ECDSA;

    digestAlgorithm = DigestAlgorithm::sha1;

  } else if (algorithmID.MatchRest(ecdsa_with_SHA384)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::ECDSA;

    digestAlgorithm = DigestAlgorithm::sha384;

  } else if (algorithmID.MatchRest(ecdsa_with_SHA512)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::ECDSA;

    digestAlgorithm = DigestAlgorithm::sha512;

  } else if (algorithmID.MatchRest(sha384WithRSAEncryption)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::RSA_PKCS1;

    digestAlgorithm = DigestAlgorithm::sha384;

  } else if (algorithmID.MatchRest(sha512WithRSAEncryption)) {

    publicKeyAlgorithm = PublicKeyAlgorithm::RSA_PKCS1;

    digestAlgorithm = DigestAlgorithm::sha512;

  } else if (algorithmID.MatchRest(sha1WithRSASignature)) {

    // XXX(bug 1042479): recognize this old OID for compatibility.

    publicKeyAlgorithm = PublicKeyAlgorithm::RSA_PKCS1;

    digestAlgorithm = DigestAlgorithm::sha1;

  } else {

    return Result::ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED;

  }

  return Success;

}

Result

DigestAlgorithmIdentifier(Reader& input, /*out*/ DigestAlgorithm& algorithm)

{

  return der::Nested(input, SEQUENCE, [&algorithm](Reader& r) -> Result {

    Reader algorithmID;

    Result rv = AlgorithmIdentifierValue(r, algorithmID);

    if (rv != Success) {

      return rv;

    }

    // RFC 4055 Section 2.1

    // python DottedOIDToCode.py id-sha1 1.3.14.3.2.26

    static const uint8_t id_sha1[] = {

      0x2b, 0x0e, 0x03, 0x02, 0x1a

    };

    // python DottedOIDToCode.py id-sha256 2.16.840.1.101.3.4.2.1

    static const uint8_t id_sha256[] = {

      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01

    };

    // python DottedOIDToCode.py id-sha384 2.16.840.1.101.3.4.2.2

    static const uint8_t id_sha384[] = {

      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02

    };

    // python DottedOIDToCode.py id-sha512 2.16.840.1.101.3.4.2.3

    static const uint8_t id_sha512[] = {

      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03

    };

    // Matching is attempted based on a rough estimate of the commonality of the

    // algorithm, to minimize the number of MatchRest calls.

    if (algorithmID.MatchRest(id_sha1)) {

      algorithm = DigestAlgorithm::sha1;

    } else if (algorithmID.MatchRest(id_sha256)) {

      algorithm = DigestAlgorithm::sha256;

    } else if (algorithmID.MatchRest(id_sha384)) {

      algorithm = DigestAlgorithm::sha384;

    } else if (algorithmID.MatchRest(id_sha512)) {

      algorithm = DigestAlgorithm::sha512;

    } else {

      return Result::ERROR_INVALID_ALGORITHM;

    }

    return Success;

  });

}

Result

SignedData(Reader& input, /*out*/ Reader& tbs,

           /*out*/ SignedDataWithSignature& signedData)

{

  Reader::Mark mark(input.GetMark());

  Result rv;

  rv = ExpectTagAndGetValue(input, SEQUENCE, tbs);

  if (rv != Success) {

    return rv;

  }

  rv = input.GetInput(mark, signedData.data);

  if (rv != Success) {

    return rv;

  }

  rv = ExpectTagAndGetValue(input, der::SEQUENCE, signedData.algorithm);

  if (rv != Success) {

    return rv;

  }

  rv = BitStringWithNoUnusedBits(input, signedData.signature);

  if (rv == Result::ERROR_BAD_DER) {

    rv = Result::ERROR_BAD_SIGNATURE;

  }

  return rv;

}

Result

BitStringWithNoUnusedBits(Reader& input, /*out*/ Input& value)

{

  Reader valueWithUnusedBits;

  Result rv = ExpectTagAndGetValue(input, BIT_STRING, valueWithUnusedBits);

  if (rv != Success) {

    return rv;

  }

  uint8_t unusedBitsAtEnd;

  if (valueWithUnusedBits.Read(unusedBitsAtEnd) != Success) {

    return Result::ERROR_BAD_DER;

  }

  // XXX: Really the constraint should be that unusedBitsAtEnd must be less

  // than 7. But, we suspect there are no real-world values in OCSP responses

  // or certificates with non-zero unused bits. It seems like NSS assumes this

  // in various places, so we enforce it too in order to simplify this code. If

  // we find compatibility issues, we'll know we're wrong and we'll have to

  // figure out how to shift the bits around.

  if (unusedBitsAtEnd != 0) {

    return Result::ERROR_BAD_DER;

  }

  return valueWithUnusedBits.SkipToEnd(value);

}

static inline Result

ReadDigit(Reader& input, /*out*/ unsigned int& value)

{

  uint8_t b;

  if (input.Read(b) != Success) {

    return Result::ERROR_INVALID_DER_TIME;

  }

  if (b < '0' || b > '9') {

    return Result::ERROR_INVALID_DER_TIME;

  }

  value = static_cast<unsigned int>(b - static_cast<uint8_t>('0'));

  return Success;

}

static inline Result

ReadTwoDigits(Reader& input, unsigned int minValue, unsigned int maxValue,

              /*out*/ unsigned int& value)

{

  unsigned int hi;

  Result rv = ReadDigit(input, hi);

  if (rv != Success) {

    return rv;

  }

  unsigned int lo;

  rv = ReadDigit(input, lo);

  if (rv != Success) {

    return rv;

  }

  value = (hi * 10) + lo;

  if (value < minValue || value > maxValue) {

    return Result::ERROR_INVALID_DER_TIME;

  }

  return Success;

}

namespace internal {

// We parse GeneralizedTime and UTCTime according to RFC 5280 and we do not

// accept all time formats allowed in the ASN.1 spec. That is,

// GeneralizedTime must always be in the format YYYYMMDDHHMMSSZ and UTCTime

// must always be in the format YYMMDDHHMMSSZ. Timezone formats of the form

// +HH:MM or -HH:MM or NOT accepted.

Result

TimeChoice(Reader& tagged, uint8_t expectedTag, /*out*/ Time& time)

{

  unsigned int days;

  Reader input;

  Result rv = ExpectTagAndGetValue(tagged, expectedTag, input);

  if (rv != Success) {

    return rv;

  }

  unsigned int yearHi;

  unsigned int yearLo;

  if (expectedTag == GENERALIZED_TIME) {

    rv = ReadTwoDigits(input, 0, 99, yearHi);

    if (rv != Success) {

      return rv;

    }

    rv = ReadTwoDigits(input, 0, 99, yearLo);

    if (rv != Success) {

      return rv;

    }

  } else if (expectedTag == UTCTime) {

    rv = ReadTwoDigits(input, 0, 99, yearLo);

    if (rv != Success) {

      return rv;

    }

    yearHi = yearLo >= 50u ? 19u : 20u;

  } else {

    return NotReached("invalid tag given to TimeChoice",

                      Result::ERROR_INVALID_DER_TIME);

  }

  unsigned int year = (yearHi * 100u) + yearLo;

  if (year < 1970u) {

    // We don't support dates before January 1, 1970 because that is the epoch.

    return Result::ERROR_INVALID_DER_TIME;

  }

  days = DaysBeforeYear(year);

  unsigned int month;

  rv = ReadTwoDigits(input, 1u, 12u, month);

  if (rv != Success) {

    return rv;

  }

  unsigned int daysInMonth;

  static const unsigned int jan = 31u;

  const unsigned int feb = ((year % 4u == 0u) &&

                           ((year % 100u != 0u) || (year % 400u == 0u)))

                         ? 29u

                         : 28u;

  static const unsigned int mar = 31u;

  static const unsigned int apr = 30u;

  static const unsigned int may = 31u;

  static const unsigned int jun = 30u;

  static const unsigned int jul = 31u;

  static const unsigned int aug = 31u;

  static const unsigned int sep = 30u;

  static const unsigned int oct = 31u;

  static const unsigned int nov = 30u;

  static const unsigned int dec = 31u;

  switch (month) {

    case 1:  daysInMonth = jan; break;

    case 2:  daysInMonth = feb; days += jan; break;

    case 3:  daysInMonth = mar; days += jan + feb; break;

    case 4:  daysInMonth = apr; days += jan + feb + mar; break;

    case 5:  daysInMonth = may; days += jan + feb + mar + apr; break;

    case 6:  daysInMonth = jun; days += jan + feb + mar + apr + may; break;

    case 7:  daysInMonth = jul; days += jan + feb + mar + apr + may + jun;

             break;

    case 8:  daysInMonth = aug; days += jan + feb + mar + apr + may + jun +

                                        jul;

             break;

    case 9:  daysInMonth = sep; days += jan + feb + mar + apr + may + jun +

                                        jul + aug;

             break;

    case 10: daysInMonth = oct; days += jan + feb + mar + apr + may + jun +

                                        jul + aug + sep;

             break;

    case 11: daysInMonth = nov; days += jan + feb + mar + apr + may + jun +

                                        jul + aug + sep + oct;

             break;

    case 12: daysInMonth = dec; days += jan + feb + mar + apr + may + jun +

                                        jul + aug + sep + oct + nov;

             break;

    default:

      return NotReached("month already bounds-checked by ReadTwoDigits",

                        Result::FATAL_ERROR_INVALID_STATE);

  }

  unsigned int dayOfMonth;

  rv = ReadTwoDigits(input, 1u, daysInMonth, dayOfMonth);

  if (rv != Success) {

    return rv;

  }

  days += dayOfMonth - 1;

  unsigned int hours;

  rv = ReadTwoDigits(input, 0u, 23u, hours);

  if (rv != Success) {

    return rv;

  }

  unsigned int minutes;

  rv = ReadTwoDigits(input, 0u, 59u, minutes);

  if (rv != Success) {

    return rv;

  }

  unsigned int seconds;

  rv = ReadTwoDigits(input, 0u, 59u, seconds);

  if (rv != Success) {

    return rv;

  }

  uint8_t b;

  if (input.Read(b) != Success) {

    return Result::ERROR_INVALID_DER_TIME;

  }

  if (b != 'Z') {

    return Result::ERROR_INVALID_DER_TIME;

  }

  if (End(input) != Success) {

    return Result::ERROR_INVALID_DER_TIME;

  }

  uint64_t totalSeconds = (static_cast<uint64_t>(days) * 24u * 60u * 60u) +

                          (static_cast<uint64_t>(hours)      * 60u * 60u) +

                          (static_cast<uint64_t>(minutes)          * 60u) +

                          seconds;

  time = TimeFromElapsedSecondsAD(totalSeconds);

  return Success;

}

Result

IntegralBytes(Reader& input, uint8_t tag,

              IntegralValueRestriction valueRestriction,

              /*out*/ Input& value,

              /*optional out*/ Input::size_type* significantBytes)

{

  Result rv = ExpectTagAndGetValue(input, tag, value);

  if (rv != Success) {

    return rv;

  }

  Reader reader(value);

  // There must be at least one byte in the value. (Zero is encoded with a

  // single 0x00 value byte.)

  uint8_t firstByte;

  rv = reader.Read(firstByte);

  if (rv != Success) {

    if (rv == Result::ERROR_BAD_DER) {

      return Result::ERROR_INVALID_INTEGER_ENCODING;

    }

    return rv;

  }

  // If there is a byte after an initial 0x00/0xFF, then the initial byte

  // indicates a positive/negative integer value with its high bit set/unset.

  bool prefixed = !reader.AtEnd() && (firstByte == 0 || firstByte == 0xff);

  if (prefixed) {

    uint8_t nextByte;

    if (reader.Read(nextByte) != Success) {

      return NotReached("Read of one byte failed but not at end.",

                        Result::FATAL_ERROR_LIBRARY_FAILURE);

    }

    if ((firstByte & 0x80) == (nextByte & 0x80)) {

      return Result::ERROR_INVALID_INTEGER_ENCODING;

    }

  }

  switch (valueRestriction) {

    case IntegralValueRestriction::MustBe0To127:

      if (value.GetLength() != 1 || (firstByte & 0x80) != 0) {

        return Result::ERROR_INVALID_INTEGER_ENCODING;

      }

      break;

    case IntegralValueRestriction::MustBePositive:

      if ((value.GetLength() == 1 && firstByte == 0) ||

          (firstByte & 0x80) != 0) {

        return Result::ERROR_INVALID_INTEGER_ENCODING;

      }

      break;

    case IntegralValueRestriction::NoRestriction:

      break;

  }

  if (significantBytes) {

    *significantBytes = value.GetLength();

    if (prefixed) {

      assert(*significantBytes > 1);

      --*significantBytes;

    }

    assert(*significantBytes > 0);

  }

  return Success;

}

// This parser will only parse values between 0..127. If this range is

// increased then callers will need to be changed.

Result

IntegralValue(Reader& input, uint8_t tag, /*out*/ uint8_t& value)

{

  // Conveniently, all the Integers that we actually have to be able to parse

  // are positive and very small. Consequently, this parser is *much* simpler

  // than a general Integer parser would need to be.

  Input valueBytes;

  Result rv = IntegralBytes(input, tag, IntegralValueRestriction::MustBe0To127,

                            valueBytes, nullptr);

  if (rv != Success) {

    return rv;

  }

  Reader valueReader(valueBytes);

  rv = valueReader.Read(value);

  if (rv != Success) {

    return NotReached("IntegralBytes already validated the value.", rv);

  }

  rv = End(valueReader);

  assert(rv == Success); // guaranteed by IntegralBytes's range checks.

  return rv;

}

} // namespace internal

Result

OptionalVersion(Reader& input, /*out*/ Version& version)

{

  static const uint8_t TAG = CONTEXT_SPECIFIC | CONSTRUCTED | 0;

  if (!input.Peek(TAG)) {

    version = Version::v1;

    return Success;

  }

  return Nested(input, TAG, [&version](Reader& value) -> Result {

    uint8_t integerValue;

    Result rv = Integer(value, integerValue);

    if (rv != Success) {

      return rv;

    }

    // XXX(bug 1031093): We shouldn't accept an explicit encoding of v1,

    // but we do here for compatibility reasons.

    switch (integerValue) {

      case static_cast<uint8_t>(Version::v3): version = Version::v3; break;

      case static_cast<uint8_t>(Version::v2): version = Version::v2; break;

      case static_cast<uint8_t>(Version::v1): version = Version::v1; break;

      case static_cast<uint8_t>(Version::v4): version = Version::v4; break;

      default:

        return Result::ERROR_BAD_DER;

    }

    return Success;

  });

}

} } } // namespace mozilla::pkix::der