The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
decode.c
Go to the documentation of this file.
1/*
2 * This library is free software; you can redistribute it and/or
3 * modify it under the terms of the GNU Lesser General Public
4 * License as published by the Free Software Foundation; either
5 * version 2.1 of the License, or (at your option) any later version.
6 *
7 * This library is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
10 * Lesser General Public License for more details.
11 *
12 * You should have received a copy of the GNU Lesser General Public
13 * License along with this library; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 9a55d09b6cea9e36ea17976dfff5b82ca7851aea $
19 *
20 * @file protocols/der/decode.c
21 * @brief Functions to decode DER encoded data.
22 *
23 * @author Arran Cudbard-Bell (a.cudbardb@freeradius.org)
24 * @author Ethan Thompson (ethan.thompson@inkbridge.io)
25 *
26 * @copyright 2025 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
27 * @copyright 2025 Network RADIUS SAS (legal@networkradius.com)
28 */
29
30#include <freeradius-devel/io/test_point.h>
31#include <freeradius-devel/util/dbuff.h>
32#include <freeradius-devel/util/decode.h>
33#include <freeradius-devel/util/dict.h>
34#include <freeradius-devel/util/pair.h>
35#include <freeradius-devel/util/proto.h>
36#include <freeradius-devel/util/sbuff.h>
37#include <freeradius-devel/util/struct.h>
38#include <freeradius-devel/util/time.h>
39#include <freeradius-devel/util/dict_ext.h>
40
41#include "der.h"
42
47
48#define IS_DER_TAG_CONTINUATION(_tag) (((_tag) & DER_TAG_CONTINUATION) == DER_TAG_CONTINUATION)
49#define IS_DER_TAG_CONSTRUCTED(_tag) (((_tag) & 0x20) == 0x20)
50#define IS_DER_LEN_MULTI_BYTE(_len) (((_len) & DER_LEN_MULTI_BYTE) == DER_LEN_MULTI_BYTE)
51
52typedef ssize_t (*fr_der_decode_oid_t)(uint64_t subidentifier, void *uctx, bool is_last);
53
54static ssize_t fr_der_decode_oid(fr_dbuff_t *in, fr_der_decode_oid_t func, void *uctx) CC_HINT(nonnull);
55
56static ssize_t fr_der_decode_hdr(fr_dict_attr_t const *parent, fr_dbuff_t *in, uint8_t *tag, size_t *len,
57 fr_der_tag_t expected) CC_HINT(nonnull(2,3,4));
58
59typedef ssize_t (*fr_der_decode_t)(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
60 fr_der_decode_ctx_t *decode_ctx);
61
66
67/** Function signature for DER decode functions
68 *
69 * @param[in] ctx Allocation context
70 * @param[in] out Where to store the decoded pairs.
71 * @param[in] parent Parent attribute. This should be the root of the dictionary
72 * we're using to decode DER data initially, and then nested children.
73 * @param[in] in The DER encoded data.
74 * @param[in] decode_ctx Any decode specific data.
75 * @return
76 * - > 0 on success. How many bytes were decoded.
77 * - 0 no bytes decoded.
78 * - < 0 on error. May be the offset (as a negative value) where the error occurred.
79 */
80static ssize_t fr_der_decode_pair_dbuff(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
81 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx) CC_HINT(nonnull);
82
83static ssize_t fr_der_decode_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
84 bool const allowed_chars[], fr_der_decode_ctx_t *decode_ctx) CC_HINT(nonnull(1,2,3,4,6));
85
86static ssize_t fr_der_decode_boolean(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
87 UNUSED fr_der_decode_ctx_t *decode_ctx)
88{
89 fr_pair_t *vp;
90 fr_dbuff_t our_in = FR_DBUFF(in);
91 uint8_t value = 0;
92
93 size_t len = fr_dbuff_remaining(&our_in);
94
95 fr_assert(fr_type_is_bool(parent->type));
96
97 /*
98 * ISO/IEC 8825-1:2021
99 * 8.2 Encoding of a boolean value
100 * 8.2.1 The encoding of a boolean value shall be primitive.
101 * The contents octets shall consist of a single octet.
102 * 8.2.2 If the boolean value is:
103 * FALSE the octet shall be zero [0x00].
104 * If the boolean value is TRUE the octet shall have any non-zero value, as a sender's option.
105 *
106 * 11.1 Boolean values
107 * If the encoding represents the boolean value TRUE, its single contents octet shall have all
108 * eight bits set to one [0xff]. (Contrast with 8.2.2.)
109 */
110 if (len != 1) {
111 fr_strerror_printf_push("Boolean has incorrect length (%zu). Must be 1.", len);
112 return -1;
113 }
114
115 FR_DBUFF_OUT_RETURN(&value, &our_in);
116
117 if (unlikely((value != DER_BOOLEAN_FALSE) && (value != DER_BOOLEAN_TRUE))) {
118 fr_strerror_printf_push("Boolean is not correctly DER encoded (0x%02" PRIx32 " or 0x%02" PRIx32 ").", DER_BOOLEAN_FALSE,
119 DER_BOOLEAN_TRUE);
120 return -1;
121 }
122
123 vp = fr_pair_afrom_da(ctx, parent);
124 if (unlikely(vp == NULL)) {
125 fr_strerror_const_push("Out of memory");
126 return -1;
127 }
128
129 vp->vp_bool = value > 0;
130
131 fr_pair_append(out, vp);
132
133 return fr_dbuff_set(in, &our_in);
134}
135
136static ssize_t fr_der_decode_integer(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
137 UNUSED fr_der_decode_ctx_t *decode_ctx)
138{
139 fr_pair_t *vp;
140 fr_dbuff_t our_in = FR_DBUFF(in);
141 uint64_t value = 0;
142 uint8_t sign = 0;
143 size_t i;
144
145 size_t len = fr_dbuff_remaining(&our_in);
146
147 if (parent->type != FR_TYPE_INT64) {
148 fr_strerror_printf_push("Expected parent type 'int64', got attribute %s of type %s", parent->name,
149 fr_type_to_str(parent->type));
150 return -1;
151 }
152
153 if (len > sizeof(value)) {
154 fr_strerror_printf_push("Integer too large (%zu)", len);
155 return -1;
156 }
157
158 /*
159 * ISO/IEC 8825-1:2021
160 * 8.3 Encoding of an integer value
161 * 8.3.1 The encoding of an integer value shall be primitive.
162 * The contents octets shall consist of one or more octets.
163 * 8.3.2 If the contents octets of an integer value encoding consist of more than one octet,
164 * then the bits of the first octet and bit 8 of the second octet:
165 * a) shall not all be ones; and
166 * b) shall not all be zero.
167 * NOTE - These rules ensure that an integer value is always encoded in the smallest possible number
168 * of octets. 8.3.3 The contents octets shall be a two's complement binary number equal to the
169 * integer value, and consisting of bits 8 to 1 of the first octet, followed by bits 8 to 1 of the
170 * second octet, followed by bits 8 to 1 of each octet in turn up to and including the last octet of
171 * the contents octets.
172 */
173 FR_DBUFF_OUT_RETURN(&sign, &our_in);
174
175 if (sign & 0x80) {
176 /*
177 * If the sign bit is set, this fill the upper bits with all zeros,
178 * and set the lower bits to "sign".
179 * This is important for the case where the length of the integer is less than the length of the
180 * integer type.
181 */
182 value = ~(uint64_t) 0xff;
183 }
184
185 value |= sign;
186
187 if (len > 1) {
188 /*
189 * If the length of the integer is greater than 1, we need to check that the first 9 bits:
190 * 1. are not all 0s; and
191 * 2. are not all 1s
192 * These two conditions are necessary to ensure that the integer conforms to DER.
193 */
194 uint8_t byte;
195
196 FR_DBUFF_OUT_RETURN(&byte, &our_in);
197
198 if ((((value & 0xff) == 0xff) && (byte & 0x80)) || (((~value & 0xff) == 0xff) && !(byte & 0x80))) {
199 fr_strerror_const_push("Integer is not correctly DER encoded. First two bytes are all 0s or all 1s.");
200 return -1;
201 }
202
203 value = (value << 8) | byte;
204 }
205
206 for (i = 2; i < len; i++) {
207 uint8_t byte;
208
209 FR_DBUFF_OUT_RETURN(&byte, &our_in);
210 value = (value << 8) | byte;
211 }
212
213 vp = fr_pair_afrom_da(ctx, parent);
214 if (unlikely(vp == NULL)) {
215 fr_strerror_const_push("Out of memory");
216 return -1;
217 }
218
219 vp->vp_int64 = value;
220
221 fr_pair_append(out, vp);
222
223 return fr_dbuff_set(in, &our_in);
224}
225
226static ssize_t fr_der_decode_bitstring(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
227 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
228{
229 fr_pair_t *vp;
230 fr_dbuff_t our_in = FR_DBUFF(in);
231 uint8_t unused_bits = 0;
232 uint8_t *data;
233
234 ssize_t data_len = 0, index = 0;
235 size_t len = fr_dbuff_remaining(&our_in);
236
237 fr_assert(fr_type_is_octets(parent->type) || fr_type_is_struct(parent->type));
238
239 /*
240 * Now we know that the parent is an octets attribute, we can decode the bitstring
241 */
242
243 /*
244 * ISO/IEC 8825-1:2021
245 * 8.6 Encoding of a bitstring value
246 * 8.6.1 The encoding of a bitstring value shall be either primitive or constructed at the option
247 * of the sender.
248 * NOTE - Where it is necessary to transfer part of a bit string before the entire
249 * bitstring is available, the constructed encoding is used.
250 * 8.6.2 The contents octets for the primitive encoding shall contain an initial octet followed
251 * by zero, one or more subsequent octets.
252 * 8.6.2.1 The bits in the bitstring value, commencing with the leading bit and proceeding
253 * to the trailing bit, shall be placed in bits 8 to 1 of the first subsequent
254 * octet, followed by bits 8 to 1 of the second subsequent octet, followed by bits
255 * 8 to 1 of each octet in turn, followed by as many bits as are needed of the
256 * final subsequent octet, commencing with bit 8.
257 * NOTE - The terms "leading bit" and "trailing bit" are defined in
258 * Rec. ITU-T X.680 | ISO/IEC 8824-1, 22.2.
259 * 8.6.2.2 The initial octet shall encode, as an unsigned binary integer with bit 1 as the
260 * least significant bit, the number of unused bits in the final subsequent octet.
261 * The number shall be in the range zero to seven.
262 * 8.6.2.3 If the bitstring is empty, there shall be no subsequent octets, and the initial
263 * octet shall be zero.
264 *
265 * 10.2 String encoding forms
266 * For bitstring, octetstring and restricted character string types, the constructed form of
267 * encoding shall not be used. (Contrast with 8.23.6.)
268 *
269 * 11.2 Unused bits 11.2.1 Each unused bit in the final octet of the encoding of a bit string value shall
270 * be set to zero.
271 */
272
273 FR_DBUFF_OUT_RETURN(&unused_bits, &our_in);
274
275 if (unlikely(unused_bits > 7)) {
276 /*
277 * This means an entire byte is unused bits. Which is not allowed.
278 */
279 fr_strerror_const_push("Invalid number of unused bits in 'bitstring'");
280 return -1;
281 }
282
283 if ((len == 1) && unused_bits) {
284 fr_strerror_const_push("Insufficient data for 'bitstring'. Missing data bytes");
285 return -1;
286 }
287
288 if (fr_type_is_struct(parent->type)) {
289 if (!len) {
290 fr_strerror_const_push("Insufficient data for 'struct'. Missing data bytes");
291 return -1;
292 }
293
294 /*
295 * If the parent is a struct attribute, we will not be adding the unused bits count to the first
296 * byte
297 */
298 data_len = len - 1;
299 } else {
300 data_len = len;
301 }
302
303 data = talloc_array(decode_ctx->tmp_ctx, uint8_t, data_len);
304 if (unlikely(!data)) {
305 fr_strerror_const_push("Out of memory");
306 return -1;
307 }
308
309 if (fr_type_is_octets(parent->type)) {
310 /*
311 * If the parent is an octets attribute, we need to add the unused bits count to the first byte
312 */
313 index = 1;
314 data[0] = unused_bits;
315 }
316
317 for (; index < data_len; index++) {
318 uint8_t byte;
319
320 FR_DBUFF_OUT_RETURN(&byte, &our_in);
321
322 data[index] = byte;
323 }
324
325 /*
326 * Remove the unused bits from the last byte
327 */
328 if (unused_bits) {
329 uint8_t mask = 0xff << unused_bits;
330
331 data[data_len - 1] &= mask;
332 }
333
334 if (fr_type_is_struct(parent->type)) {
335 ssize_t slen;
336
337 slen = fr_struct_from_network(ctx, out, parent, data, data_len, decode_ctx, NULL, NULL);
338
339 /*
340 * If the structure decoder didn't consume all the data, we need to free the data and bail out
341 */
342 if (unlikely(slen < data_len - 1)) {
343 fr_strerror_printf_push("Bitstring structure decoder didn't consume all data. Consumed %zd of %zu bytes",
344 slen, data_len);
345 error:
346 talloc_free(data);
347 return -1;
348 }
349
350 talloc_free(data);
351 return fr_dbuff_set(in, &our_in);
352 }
353
354 vp = fr_pair_afrom_da(ctx, parent);
355 if (unlikely(!vp)) {
356 fr_strerror_const_push("Out of memory");
357 goto error;
358 }
359
360 /*
361 * Add the bitstring to the pair value as octets
362 */
363 fr_pair_value_memdup(vp, data, len, false);
364
365 fr_pair_append(out, vp);
366
367 return fr_dbuff_set(in, &our_in);
368}
369
370static ssize_t fr_der_decode_octetstring(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
371 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
372{
373 fr_pair_t *vp;
374 fr_dbuff_t our_in = FR_DBUFF(in);
375 uint8_t *data = NULL;
376
377 size_t len = fr_dbuff_remaining(&our_in);
378
379 fr_assert(fr_type_is_octets(parent->type));
380
381 /*
382 * ISO/IEC 8825-1:2021
383 * 8.7 Encoding of an octetstring value
384 * 8.7.1 The encoding of an octetstring value shall be either primitive or constructed at the
385 * option of the sender.
386 * NOTE - Where it is necessary to transfer part of an octet string before the entire
387 * octetstring is available, the constructed encoding is used.
388 * 8.7.2 The primitive encoding contains zero, one or more contents octets equal in value to the
389 * octets in the data value, in the order they appear in the data value, and with the most
390 * significant bit of an octet of the data value aligned with the most significant bit of an
391 * octet of the contents octets.
392 * 8.7.3 The contents octets for the constructed encoding shall consist of zero, one, or more
393 * encodings.
394 * NOTE - Each such encoding includes identifier, length, and contents octets, and may
395 * include end-of-contents octets if it is constructed.
396 * 8.7.3.1 To encode an octetstring value in this way, it is segmented. Each segment shall
397 * consist of a series of consecutive octets of the value. There shall be no
398 * significance placed on the segment boundaries.
399 * NOTE - A segment may be of size zero, i.e. contain no octets.
400 *
401 * 10.2 String encoding forms
402 * For bitstring, octetstring and restricted character string types, the constructed form of
403 * encoding shall not be used. (Contrast with 8.23.6.)
404 */
405
406 vp = fr_pair_afrom_da(ctx, parent);
407 if (unlikely(!vp)) {
408 oom:
409 fr_strerror_const_push("Out of memory");
410 return -1;
411 }
412
413 if (unlikely(fr_pair_value_mem_alloc(vp, &data, len, false) < 0)) {
414 talloc_free(vp);
415 goto oom;
416 }
417
418 (void) fr_dbuff_out_memcpy(data, &our_in, len); /* this can never fail */
419
420 fr_pair_append(out, vp);
421
422 return fr_dbuff_set(in, &our_in);
423}
424
425static ssize_t fr_der_decode_null(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
426 UNUSED fr_der_decode_ctx_t *decode_ctx)
427{
428 fr_pair_t *vp;
429 fr_dbuff_t our_in = FR_DBUFF(in);
430
431 if (fr_dbuff_remaining(&our_in) != 0) {
432 fr_strerror_const_push("Null has non-zero length");
433 return -1;
434 }
435
436 /*
437 * ISO/IEC 8825-1:2021
438 * 8.8 Encoding of a null value 8.8.1 The encoding of a null value shall be primitive. 8.8.2 The contents
439 * octets shall not contain any octets. NOTE - The length octet is zero.
440 */
441
442 vp = fr_pair_afrom_da(ctx, parent);
443 if (unlikely(!vp)) {
444 fr_strerror_const_push("Out of memory");
445 return -1;
446 }
447
448 fr_pair_append(out, vp);
449
450 return fr_dbuff_set(in, &our_in);
451}
452
453typedef struct {
454 TALLOC_CTX *ctx; //!< Allocation context
455 fr_dict_attr_t const *parent_da; //!< Parent dictionary attribute
456 fr_pair_list_t *parent_list; //!< Parent pair list
457 char oid_buff[1024]; //!< Buffer to store the OID string
458 fr_sbuff_marker_t marker; //!< Marker of the current position in the OID buffer
459} fr_der_decode_oid_to_str_ctx_t; //!< Context for decoding an OID to a string
460
461/** Decode an OID to a string
462 *
463 * @param[in] subidentifier The subidentifier to decode
464 * @param[in] uctx User context
465 * @param[in] is_last Is this the last subidentifier in the OID
466 * @return
467 * - 1 on success
468 * - < 0 on error
469 */
470static ssize_t fr_der_decode_oid_to_str(uint64_t subidentifier, void *uctx, bool is_last)
471{
472 fr_der_decode_oid_to_str_ctx_t *decode_ctx = uctx;
473 fr_sbuff_marker_t marker = decode_ctx->marker;
474 fr_sbuff_t sb = FR_SBUFF_OUT(decode_ctx->oid_buff, sizeof(decode_ctx->oid_buff));
475
476 FR_PROTO_TRACE("Decoding OID to string");
477 if (decode_ctx->oid_buff[0] == '\0') {
478 /*
479 * First subidentifier
480 */
481 if (unlikely(fr_sbuff_in_sprintf(&sb, "%" PRIu64, subidentifier) < 0)) {
482 oom:
483 fr_strerror_const_push("Out of memory");
484 return -1;
485 }
486
487 fr_sbuff_marker(&marker, &sb);
488
489 decode_ctx->marker = marker;
490 return 1;
491 }
492
493 fr_sbuff_set(&sb, &marker);
494
495 FR_SBUFF_IN_SPRINTF_RETURN(&sb, ".%" PRIu64, subidentifier);
496 fr_sbuff_marker(&marker, &sb);
497
498 decode_ctx->marker = marker;
499
500 if (is_last) {
501 /*
502 * If this is the last subidentifier, we need to create a vp with the oid string, and add
503 * it to the parent list
504 */
505 fr_pair_t *vp;
506
507 fr_assert(fr_type_is_string(decode_ctx->parent_da->type));
508
509 vp = fr_pair_afrom_da(decode_ctx->ctx, decode_ctx->parent_da);
510 if (unlikely(!vp)) goto oom;
511
512 if (fr_pair_value_bstrndup(vp, decode_ctx->oid_buff, fr_sbuff_used(&sb), false) < 0) {
513 talloc_free(vp);
514 goto oom;
515 }
516
517 fr_pair_append(decode_ctx->parent_list, vp);
518
519 decode_ctx->ctx = vp;
520 }
521
522 return 1;
523}
524
525typedef struct {
526 TALLOC_CTX *ctx; //!< Allocation context
527 fr_dict_attr_t const *parent_da; //!< Parent dictionary attribute
528 fr_pair_list_t *parent_list; //!< Parent pair list
529} fr_der_decode_oid_to_da_ctx_t; //!< Context for decoding an OID to a dictionary attribute
530
531/** Decode an OID to a dictionary attribute
532 *
533 * @param[in] subidentifier The subidentifier to decode
534 * @param[in] uctx User context
535 * @param[in] is_last Is this the last subidentifier in the OID
536 * @return
537 * - 1 on success
538 * - < 0 on error
539 */
540static ssize_t fr_der_decode_oid_to_da(uint64_t subidentifier, void *uctx, bool is_last)
541{
542 fr_der_decode_oid_to_da_ctx_t *decode_ctx = uctx;
543 fr_pair_t *vp;
544 fr_dict_attr_t const *da;
545
546 fr_dict_attr_t const *parent_da = fr_type_is_group(decode_ctx->parent_da->type) ?
547 fr_dict_attr_ref(decode_ctx->parent_da) :
548 decode_ctx->parent_da;
549
550 FR_PROTO_TRACE("Decoding OID to dictionary attribute");
551 FR_PROTO_TRACE("decode context - Parent Name: %s Sub-Identifier %" PRIu64, parent_da->name, subidentifier);
552 FR_PROTO_TRACE("decode context - Parent Address: %p", parent_da);
553
554 da = fr_dict_attr_child_by_num(parent_da, subidentifier);
555
556 if (is_last) {
557 if (unlikely(da == NULL)) {
558 decode_ctx->parent_da = fr_dict_attr_unknown_typed_afrom_num(decode_ctx->ctx, parent_da,
559 subidentifier, FR_TYPE_OCTETS);
560
561 if (unlikely(decode_ctx->parent_da == NULL)) {
562 return -1;
563 }
564
565 FR_PROTO_TRACE("Created DA: %s", decode_ctx->parent_da->name);
566 return 1;
567 }
568
569 decode_ctx->parent_da = da;
570
571 FR_PROTO_TRACE("Created DA: %s", decode_ctx->parent_da->name);
572 return 1;
573 }
574
575 if (unlikely(da == NULL)) {
576 /*
577 * We need to create an unknown attribute for this subidentifier so we can store the raw data
578 */
579 fr_dict_attr_t *unknown_da =
580 fr_dict_attr_unknown_typed_afrom_num(decode_ctx->ctx, parent_da, subidentifier, FR_TYPE_TLV);
581
582 if (unlikely(unknown_da == NULL)) {
583 oom:
584 fr_strerror_const_push("Out of memory");
585 return -1;
586 }
587
588 vp = fr_pair_afrom_da(decode_ctx->ctx, unknown_da);
589
590 talloc_free(unknown_da);
591 } else {
592 vp = fr_pair_afrom_da(decode_ctx->ctx, da);
593 }
594
595 if (unlikely(!vp)) goto oom;
596
597 fr_pair_append(decode_ctx->parent_list, vp);
598
599 decode_ctx->ctx = vp;
600 decode_ctx->parent_da = vp->da;
601 decode_ctx->parent_list = &vp->vp_group;
602
603 FR_PROTO_TRACE("Created DA: %s", decode_ctx->parent_da->name);
604 return 1;
605}
606
607/** Decode an OID from a DER encoded buffer using a callback
608 *
609 * @param[in] in The DER encoded data.
610 * @param[in] func The callback function to call for each subidentifier.
611 * @param[in] uctx User context for the callback function.
612 * @return
613 * - 0 on success
614 * - < 0 on error
615 */
616static ssize_t fr_der_decode_oid(fr_dbuff_t *in, fr_der_decode_oid_t func, void *uctx)
617{
618 fr_dbuff_t our_in = FR_DBUFF(in);
619 bool first;
620 uint64_t oid;
621 int magnitude;
622 size_t len = fr_dbuff_remaining(&our_in); /* we decode the entire dbuff */
623
624 /*
625 * ISO/IEC 8825-1:2021
626 * 8.19 Encoding of an object identifier value
627 * 8.19.1 The encoding of an object identifier value shall be primitive.
628 * 8.19.2 The contents octets shall be an (ordered) list of encodings of subidentifiers (see 8.19.3
629 * and 8.19.4) concatenated together. Each subidentifier is represented as a series of
630 * (one or more) octets. Bit 8 of each octet indicates whether it is the last in the series: bit 8
631 * of the last octet is zero; bit 8 of each preceding octet is one. Bits 7 to 1 of the octets in
632 * the series collectively encode the subidentifier. Conceptually, these groups of bits are
633 * concatenated to form an unsigned binary number whose most significant bit is bit 7 of the first
634 * octet and whose least significant bit is bit 1 of the last octet. The subidentifier shall be
635 * encoded in the fewest possible octets, that is, the leading octet of the subidentifier shall not
636 * have the value 8016.
637 * 8.19.3 The number of subidentifiers (N) shall be one less than the number of object identifier
638 * components in the object identifier value being encoded. 8.19.4 The numerical value of the
639 * first subidentifier is derived from the values of the first two object identifier components in
640 * the object identifier value being encoded, using the formula: (X*40) + Y where X is the value
641 * of the first object identifier component and Y is the value of the second object identifier
642 * component. NOTE - This packing of the first two object identifier components recognizes that
643 * only three values are allocated from the root node, and at most 39 subsequent values from nodes
644 * reached by X = 0 and X = 1. 8.19.5 The numerical value of the ith subidentifier, (2 <= i <= N) is
645 * that of the (i + 1)th object identifier component.
646 */
647
648 FR_PROTO_TRACE("Decoding OID");
649 FR_PROTO_HEX_DUMP(fr_dbuff_current(&our_in), len, "buff in OID");
650
651 first = true;
652 oid = 0;
653 magnitude = 0;
654
655 /*
656 * Loop until done.
657 */
658 while (len) {
659 uint8_t byte;
660
661 FR_DBUFF_OUT_RETURN(&byte, &our_in);
662
663 magnitude++;
664 if (magnitude > 9) {
665 fr_strerror_const_push("OID subidentifier too large (>63 bits)");
666 return -1;
667 }
668
669 /*
670 * Shift in the new data.
671 */
672 oid <<= 7;
673 oid |= byte & 0x7f;
674 len--;
675
676 /*
677 * There's more? The MUST be more if the high bit is set.
678 */
679 if ((byte & 0x80) != 0) {
680 if (len == 0) {
681 fr_strerror_const_push("OID subidentifier is truncated");
682 return -1;
683 }
684 continue;
685 }
686
687 /*
688 * The initial packed field has the first two compenents included, as (x * 40) + y.
689 */
690 if (first) {
691 uint64_t first_component;
692
693 if (oid < 40) {
694 first_component = 0;
695
696 } else if (oid < 80) {
697 first_component = 1;
698 oid -= 40;
699
700 } else {
701 first_component = 2;
702 oid -= 80;
703 }
704 first = false;
705
706 /*
707 * Note that we allow OID=1 here. It doesn't make sense, but whatever.
708 */
709 FR_PROTO_TRACE("decode context - first OID: %" PRIu64, first_component);
710 if (unlikely(func(first_component, uctx, (len == 0)) <= 0)) return -1;
711 }
712
713 FR_PROTO_TRACE("decode context - OID: %" PRIu64, oid);
714 if (unlikely(func(oid, uctx, (len == 0)) <= 0)) return -1;
715
716 /*
717 * Reset fields.
718 */
719 oid = 0;
720 magnitude = 0;
721 }
722
723 return fr_dbuff_set(in, &our_in);
724}
725
726
727static ssize_t fr_der_decode_utf8_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
728 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
729{
730 /*
731 * @todo - check for valid UTF8 string.
732 */
733
734 return fr_der_decode_string(ctx, out, parent, in, NULL, decode_ctx);
735}
736
737static ssize_t fr_der_decode_sequence(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
738 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
739{
740 fr_pair_t *vp;
741 fr_dict_attr_t const *child = NULL;
742 fr_dbuff_t our_in = FR_DBUFF(in);
743 fr_der_attr_flags_t const *flags = fr_der_attr_flags(parent);
744
745 fr_assert(fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
746
747 /*
748 * ISO/IEC 8825-1:2021
749 * 8.9 Encoding of a sequence value
750 * 8.9.1 The encoding of a sequence value shall be constructed.
751 * 8.9.2 The contents octets shall consist of the complete encoding of one data value from each of
752 * the types listed in the ASN.1 definition of the sequence type, in the order of their
753 * appearance in the definition, unless the type was referenced with the keyword OPTIONAL
754 * or the keyword DEFAULT.
755 * 8.9.3 The encoding of a data value may, but need not, be present for a type referenced with the
756 * keyword OPTIONAL or the keyword DEFAULT. If present, it shall appear in the order of
757 * appearance of the corresponding type in the ASN.1 definition.
758 *
759 * 11.5 Set and sequence components with default value
760 * The encoding of a set value or sequence value shall not include an encoding for any component
761 * value which is equal to its default value.
762 */
763
764 if (flags->min && !fr_dbuff_remaining(&our_in)) {
765 fr_strerror_printf_push("Expected at last %d elements in %s, got 0", flags->min, parent->name);
766 return -1;
767 }
768
769 vp = fr_pair_afrom_da(ctx, parent);
770 if (unlikely(!vp)) {
771 fr_strerror_const_push("Out of memory");
772 return -1;
773 }
774
775 /*
776 * This is a sequence-of, which means it either has only one child, or it's a sequence_of=choice,
777 * and all of the children are numbered options.
778 */
779 if (unlikely(flags->is_sequence_of)) {
780 if (flags->sequence_of != FR_DER_TAG_CHOICE) {
781 child = fr_dict_attr_iterate_children(parent, &child);
782 if (!child) {
783 fr_strerror_printf_push("Sequence %s has no children", parent->name);
784 error:
785 talloc_free(vp);
786 return -1;
787 }
788 }
789
790 /*
791 * Decode all of the data.
792 */
793 while (fr_dbuff_remaining(&our_in) > 0) {
794 ssize_t slen;
795 uint8_t current_tag;
796 uint8_t tag_byte;
797 uint8_t *current_marker = fr_dbuff_current(&our_in);
798
799 FR_DBUFF_OUT_RETURN(&tag_byte, &our_in);
800
801 current_tag = (tag_byte & DER_TAG_CONTINUATION); /* always <= FR_DER_TAG_MAX */
802
803 /*
804 * If we have a choice, the children must be numbered. The class can be CONTEXT,
805 * PRIVATE, or ENTERPRISE.
806 *
807 * Otherwise the children are standard DER tags. The class must be UNIVERSAL.
808 */
809 if (unlikely(flags->sequence_of == FR_DER_TAG_CHOICE)) {
810 if ((tag_byte & DER_TAG_CLASS_MASK) == FR_DER_CLASS_UNIVERSAL) {
811 unexpected_class:
812 fr_strerror_printf_push("Tag has unexpected class %20x", tag_byte & DER_TAG_CLASS_MASK);
813 goto error;
814 }
815
816 child = fr_dict_attr_child_by_num(parent, current_tag);
817 if (!child) {
818 fr_der_attr_flags_t *child_flags;
819
820 child = fr_dict_attr_unknown_raw_afrom_num(decode_ctx->tmp_ctx, parent, current_tag);
821 if (!child) goto error;
822
823 /*
824 * Save the option and class, so that we can encode it later.
825 */
826 child_flags = fr_dict_attr_ext(child, FR_DICT_ATTR_EXT_PROTOCOL_SPECIFIC);
827 child_flags->is_option = true;
828 child_flags->option = current_tag;
829 child_flags->class = tag_byte & DER_TAG_CLASS_MASK;
830 }
831
832 } else if (unlikely(current_tag != flags->sequence_of)) {
833 if ((tag_byte & DER_TAG_CLASS_MASK) != FR_DER_CLASS_UNIVERSAL) {
834 goto unexpected_class;
835 }
836
837 fr_strerror_printf_push("Attribute %s is a sequence_of=%s which does not allow DER type '%s'",
838 parent->name,
839 fr_der_tag_to_str(flags->sequence_of),
840 fr_der_tag_to_str(current_tag));
841 goto error;
842 }
843
844 FR_PROTO_TRACE("decode context %s -> %s", parent->name, child->name);
845
846 fr_dbuff_set(&our_in, current_marker);
847
848 /*
849 * A child could have been encoded with zero bytes if it has a default value.
850 */
851 slen = fr_der_decode_pair_dbuff(vp, &vp->vp_group, child, &our_in, decode_ctx);
852 if (unlikely(slen < 0)) {
853 fr_strerror_printf_push("Failed decoding %s", vp->da->name);
854 goto error;
855 }
856 }
857
858 fr_pair_append(out, vp);
859
860 return fr_dbuff_set(in, &our_in);
861 }
862
863 /*
864 * Decode the children. Since it's not a sequence_of=..., we must have a random bunch of
865 * children. The children are packed in order. Some may be optional.
866 *
867 * We loop over all of the children, because some might have default values.
868 */
869 while ((child = fr_dict_attr_iterate_children(parent, &child))) {
870 ssize_t ret;
871
872 FR_PROTO_TRACE("decode context %s -> %s", parent->name, child->name);
873
874 ret = fr_der_decode_pair_dbuff(vp, &vp->vp_group, child, &our_in, decode_ctx);
875 if (unlikely(ret < 0)) {
876 fr_strerror_printf_push("Failed decoding %s", vp->da->name);
877 talloc_free(vp);
878 return ret;
879 }
880 }
881
882 /*
883 * Ensure that we grab all of the data.
884 *
885 * @todo - if there is data left over, decode it as raw octets. We then also have to keep track
886 * of the maximum child number, and create unknown attributes starting from the last one.
887 */
888 if (fr_dbuff_remaining(&our_in)) {
889 FR_PROTO_TRACE("Ignoring extra data in sequence");
890 FR_PROTO_HEX_DUMP(fr_dbuff_current(&our_in), fr_dbuff_remaining(&our_in), " ");
891
892 (void) fr_dbuff_advance(&our_in, fr_dbuff_remaining(&our_in));
893 }
894
895 fr_pair_append(out, vp);
896
897 return fr_dbuff_set(in, &our_in);
898}
899
900static ssize_t fr_der_decode_set(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
901 fr_der_decode_ctx_t *decode_ctx)
902{
903 fr_pair_t *vp;
904 fr_dict_attr_t const *child = NULL;
905 fr_dbuff_t our_in = FR_DBUFF(in);
906 fr_dbuff_marker_t previous_marker;
907 uint8_t previous_tag = 0x00;
908 size_t previous_len = 0;
909 fr_der_attr_flags_t const *flags = fr_der_attr_flags(parent);
910
911 fr_assert(fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
912
913 /*
914 * ISO/IEC 8825-1:2021
915 * 8.11 Encoding of a set value
916 * 8.11.1 The encoding of a set value shall be constructed.
917 * 8.11.2 The contents octets shall consist of the complete encoding of one data value from each
918 * of the types listed in the ASN.1 definition of the set type, in an order chosen by the
919 * sender, unless the type was referenced with the keyword OPTIONAL or the keyword DEFAULT.
920 * 8.11.3 The encoding of a data value may, but need not, be present for a type referenced with the
921 * keyword OPTIONAL or the keyword DEFAULT.
922 *
923 * 11.5 Set and sequence components with default value
924 * The encoding of a set value or sequence value shall not include an encoding for any component
925 * value which is equal to its default value.
926 */
927
928 if (flags->min && !fr_dbuff_remaining(&our_in)) {
929 fr_strerror_printf_push("Expected at last %d elements in %s, got 0", flags->min, parent->name);
930 return -1;
931 }
932
933 vp = fr_pair_afrom_da(ctx, parent);
934 if (unlikely(!vp)) {
935 fr_strerror_const_push("Out of memory");
936 return -1;
937 }
938
939 if (flags->is_set_of) {
940 /*
941 * There should only be one child in a "set_of". We can't check this when we load
942 * the dictionaries, because there is no "finalize" callback.
943 *
944 * @todo - we would need to walk through all of the dictionary attributes, and
945 * call a new function which would check whether or not the parent had any
946 * children. And if not, return a load-time error.
947 */
948 child = NULL;
949 child = fr_dict_attr_iterate_children(parent, &child);
950 if (!child) {
951 fr_strerror_printf_push("Missing child for %s", parent->name);
952 return -1;
953 }
954
955 while (fr_dbuff_remaining(&our_in) > 0) {
956 fr_dbuff_marker_t current_value_marker;
957 ssize_t ret;
958 uint8_t current_tag;
959 uint8_t *current_marker = fr_dbuff_current(&our_in);
960 size_t len;
961
962 FR_PROTO_TRACE("decode context %s -> %s", parent->name, child->name);
963
964 if (unlikely(fr_der_decode_hdr(NULL, &our_in, &current_tag, &len, flags->set_of) <= 0)) {
965 ret = -1;
966 error:
967 talloc_free(vp);
968 fr_strerror_printf_push("Failed decoding %s", parent->name);
969 return ret;
970 }
971
972 fr_dbuff_marker(&current_value_marker, &our_in);
973
974 /*
975 * Ensure that the contents of the tags are sorted.
976 */
977 if (previous_tag) {
978 uint8_t prev_byte = 0, curr_byte = 0;
979 fr_dbuff_t previous_item = FR_DBUFF(&previous_marker);
980
981 fr_dbuff_set_end(&previous_item, fr_dbuff_current(&previous_marker) + previous_len);
982
983 do {
984 FR_DBUFF_OUT_RETURN(&prev_byte, &previous_item);
985 FR_DBUFF_OUT_RETURN(&curr_byte, &our_in);
986
987 if (prev_byte > curr_byte) {
988 fr_strerror_const_push("Set tags are not in ascending order");
989 ret = -1;
990 goto error;
991 }
992
993 if (prev_byte < curr_byte) {
994 break;
995 }
996
997 } while (fr_dbuff_remaining(&our_in) > 0 && fr_dbuff_remaining(&previous_item) > 0);
998
999 if (prev_byte > curr_byte && fr_dbuff_remaining(&previous_item) > 0) {
1000 fr_strerror_const_push(
1001 "Set tags are not in ascending order. Previous item has more data");
1002 ret = -1;
1003 goto error;
1004 }
1005 }
1006
1007 previous_tag = current_tag;
1008 previous_len = len;
1009
1010 previous_marker = current_value_marker;
1011
1012 fr_dbuff_set(&our_in, current_marker);
1013
1014 ret = fr_der_decode_pair_dbuff(vp, &vp->vp_group, child, &our_in, decode_ctx);
1015 if (unlikely(ret <= 0)) {
1016 fr_strerror_printf_push("Failed decoding %s", vp->da->name);
1017 goto error;
1018 }
1019 }
1020
1021 fr_pair_append(out, vp);
1022
1023 return fr_dbuff_set(in, &our_in);
1024 }
1025
1026 /*
1027 * Decode the children. Since it's not a sequence_of=..., we must have a set of children. The
1028 * children are packed in order. Some may be optional.
1029 */
1030 while ((child = fr_dict_attr_iterate_children(parent, &child))) {
1031 ssize_t ret;
1032 uint8_t current_tag;
1033
1034 FR_PROTO_TRACE("decode context %s -> %s", parent->name, child->name);
1035
1036 if (fr_dbuff_remaining(&our_in)) {
1037 uint8_t *current_ptr = fr_dbuff_current(&our_in);
1038
1039 /*
1040 * Check that the tag is in ascending order
1041 */
1042 FR_DBUFF_OUT_RETURN(&current_tag, &our_in);
1043
1044 if (unlikely(current_tag < previous_tag)) {
1045 fr_strerror_const_push("Set tags are not in ascending order");
1046 talloc_free(vp);
1047 return -1;
1048 }
1049
1050 previous_tag = current_tag;
1051
1052 /*
1053 * Reset the buffer to the start of the tag
1054 */
1055 fr_dbuff_set(&our_in, current_ptr);
1056 }
1057
1058 /*
1059 * A child could have been encoded with zero bytes if it has a default value.
1060 */
1061 ret = fr_der_decode_pair_dbuff(vp, &vp->vp_group, child, &our_in, decode_ctx);
1062 if (unlikely(ret < 0)) {
1063 fr_strerror_printf_push("Failed decoding %s", vp->da->name);
1064 talloc_free(vp);
1065 return ret;
1066 }
1067 }
1068
1069 /*
1070 * Ensure that we grab all of the data.
1071 *
1072 * @todo - if there is data left over, decode it as raw octets. We then also have to keep track
1073 * of the maximum child number, and create unknown attributes starting from the last one.
1074 */
1075 if (fr_dbuff_remaining(&our_in)) {
1076 FR_PROTO_TRACE("Ignoring extra data in set");
1077 FR_PROTO_HEX_DUMP(fr_dbuff_current(&our_in), fr_dbuff_remaining(&our_in), " ");
1078
1079 (void) fr_dbuff_advance(&our_in, fr_dbuff_remaining(&our_in));
1080 }
1081
1082 fr_pair_append(out, vp);
1083
1084 return fr_dbuff_set(in, &our_in);
1085}
1086
1087static ssize_t fr_der_decode_printable_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1088 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1089{
1090 static bool const allowed_chars[UINT8_MAX + 1] = {
1091 [' '] = true, ['\''] = true, ['('] = true, [')'] = true,
1092 ['+'] = true, [','] = true, ['-'] = true, ['.'] = true,
1093 ['/'] = true, [':'] = true, ['='] = true, ['?'] = true,
1094 ['A' ... 'Z'] = true, ['a' ... 'z'] = true,
1095 ['0' ... '9'] = true,
1096 };
1097
1098 return fr_der_decode_string(ctx, out, parent, in, allowed_chars, decode_ctx);
1099}
1100
1101static ssize_t fr_der_decode_t61_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1102 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1103{
1104 static bool const allowed_chars[UINT8_MAX + 1] = {
1105 [0x08] = true, [0x0A] = true, [0x0C] = true, [0x0D] = true,
1106 [0x0E] = true, [0x0F] = true, [0x19] = true, [0x1A] = true,
1107 [0x1B] = true, [0x1D] = true, [' '] = true, ['!'] = true,
1108 ['"'] = true, ['%'] = true, ['&'] = true, ['\''] = true,
1109 ['('] = true, [')'] = true, ['*'] = true, ['+'] = true,
1110 [','] = true, ['-'] = true, ['.'] = true, ['/'] = true,
1111 [':'] = true, [';'] = true, ['<'] = true, ['='] = true,
1112 ['>'] = true, ['?'] = true, ['@'] = true, ['['] = true,
1113 [']'] = true, ['_'] = true, ['|'] = true, [0x7F] = true,
1114 [0x8B] = true, [0x8C] = true, [0x9B] = true, [0xA0] = true,
1115 [0xA1] = true, [0xA2] = true, [0xA3] = true, [0xA4] = true,
1116 [0xA5] = true, [0xA6] = true, [0xA7] = true, [0xA8] = true,
1117 [0xAB] = true, [0xB0] = true, [0xB1] = true, [0xB2] = true,
1118 [0xB3] = true, [0xB4] = true, [0xB5] = true, [0xB6] = true,
1119 [0xB7] = true, [0xB8] = true, [0xBB] = true, [0xBC] = true,
1120 [0xBD] = true, [0xBE] = true, [0xBF] = true, [0xC1] = true,
1121 [0xC2] = true, [0xC3] = true, [0xC4] = true, [0xC5] = true,
1122 [0xC6] = true, [0xC7] = true, [0xC8] = true, [0xC9] = true,
1123 [0xCA] = true, [0xCB] = true, [0xCC] = true, [0xCD] = true,
1124 [0xCE] = true, [0xCF] = true, [0xE0] = true, [0xE1] = true,
1125 [0xE2] = true, [0xE3] = true, [0xE4] = true, [0xE5] = true,
1126 [0xE7] = true, [0xE8] = true, [0xE9] = true, [0xEA] = true,
1127 [0xEB] = true, [0xEC] = true, [0xED] = true, [0xEE] = true,
1128 [0xEF] = true, [0xF0] = true, [0xF1] = true, [0xF2] = true,
1129 [0xF3] = true, [0xF4] = true, [0xF5] = true, [0xF6] = true,
1130 [0xF7] = true, [0xF8] = true, [0xF9] = true, [0xFA] = true,
1131 [0xFB] = true, [0xFC] = true, [0xFD] = true, [0xFE] = true,
1132 ['A' ... 'Z'] = true, ['a' ... 'z'] = true,
1133 ['0' ... '9'] = true,
1134 };
1135
1136 return fr_der_decode_string(ctx, out, parent, in, allowed_chars, decode_ctx);
1137}
1138
1139/*
1140 * 128 characters exactly. Identical to the first 128 characters of the ASCII alphabet.
1141 */
1142static ssize_t fr_der_decode_ia5_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1143 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1144{
1145#if 0
1146 static bool const allowed_chars[UINT8_MAX + 1] = {
1147 [0x00 ... 0x7f] = true,
1148 };
1149#endif
1150
1151 return fr_der_decode_string(ctx, out, parent, in, NULL, decode_ctx);
1152}
1153
1154static ssize_t fr_der_decode_utc_time(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1155 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1156{
1157 fr_pair_t *vp;
1158 fr_dbuff_t our_in = FR_DBUFF(in);
1159 char timestr[DER_UTC_TIME_LEN + 1] = {};
1160 char *p;
1161 struct tm tm = {};
1162
1163 fr_assert(fr_type_is_date(parent->type));
1164
1165 /*
1166 * ISO/IEC 8825-1:2021
1167 * 8.25 Encoding for values of the useful types
1168 * The following "useful types" shall be encoded as if they had been replaced by their definitions
1169 * given in clauses 46-48 of Rec. ITU-T X.680 | ISO/IEC 8824-1:
1170 * - generalized time;
1171 * - universal time;
1172 * - object descriptor.
1173 *
1174 * 8.26 Encoding for values of the TIME type and the useful time types
1175 * 8.26 Encoding for values of the TIME type and the useful time types 8.26.1 Encoding for values
1176 * of the TIME type NOTE - The defined time types are subtypes of the TIME type, with the same
1177 * tag, and have the same encoding as the TIME type. 8.26.1.1 The encoding of the TIME type shall
1178 * be primitive. 8.26.1.2 The contents octets shall be the UTF-8 encoding of the value notation,
1179 * after the removal of initial and final QUOTATION MARK (34) characters.
1180 *
1181 * 11.8 UTCTime
1182 * 11.8.1 The encoding shall terminate with "Z", as described in the ITU-T X.680 | ISO/IEC 8824-1
1183 * clause on UTCTime.
1184 * 11.8.2 The seconds element shall always be present.
1185 * 11.8.3 Midnight (GMT) shall be represented as "YYMMDD000000Z", where "YYMMDD" represents the
1186 * day following the midnight in question.
1187 */
1188
1189 /*
1190 * The format of a UTC time is "YYMMDDhhmmssZ"
1191 * Where:
1192 * 1. YY is the year
1193 * 2. MM is the month
1194 * 3. DD is the day
1195 * 4. hh is the hour
1196 * 5. mm is the minute
1197 * 6. ss is the second (not optional in DER)
1198 * 7. Z is the timezone (UTC)
1199 */
1200
1201 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *)timestr, &our_in, DER_UTC_TIME_LEN);
1202
1203 if (memchr(timestr, '\0', DER_UTC_TIME_LEN) != NULL) {
1204 fr_strerror_const_push("UTC time contains null byte");
1205 return -1;
1206 }
1207
1208 timestr[DER_UTC_TIME_LEN] = '\0';
1209
1210 p = strptime(timestr, "%y%m%d%H%M%SZ", &tm);
1211
1212 if (unlikely(p == NULL) || *p != '\0') {
1213 fr_strerror_const_push("Invalid UTC time format");
1214 return -1;
1215 }
1216
1217 vp = fr_pair_afrom_da(ctx, parent);
1218 if (unlikely(!vp)) {
1219 fr_strerror_const_push("Out of memory");
1220 return -1;
1221 }
1222
1223 vp->vp_date = fr_unix_time_from_tm(&tm);
1224
1225 fr_pair_append(out, vp);
1226
1227 return fr_dbuff_set(in, &our_in);
1228}
1229
1230static ssize_t fr_der_decode_generalized_time(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1231 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1232{
1233 fr_pair_t *vp;
1234 fr_dbuff_t our_in = FR_DBUFF(in);
1235 char timestr[DER_GENERALIZED_TIME_LEN_MIN + 1] = {};
1236 char *p;
1237 unsigned long subseconds = 0;
1238 struct tm tm = {};
1239
1240 size_t len = fr_dbuff_remaining(&our_in);
1241
1242 fr_assert(fr_type_is_date(parent->type));
1243
1244 if (len < DER_GENERALIZED_TIME_LEN_MIN) {
1245 fr_strerror_const_push("Insufficient data for generalized time or incorrect length");
1246 return -1;
1247 }
1248
1249 /*
1250 * ISO/IEC 8825-1:2021
1251 * 8.25 Encoding for values of the useful types
1252 * The following "useful types" shall be encoded as if they had been replaced by their definitions
1253 * given in clauses 46-48 of Rec. ITU-T X.680 | ISO/IEC 8824-1:
1254 * - generalized time;
1255 * - universal time;
1256 * - object descriptor.
1257 *
1258 * 8.26 Encoding for values of the TIME type and the useful time types
1259 * 8.26 Encoding for values of the TIME type and the useful time types 8.26.1 Encoding for values
1260 * of the TIME type NOTE - The defined time types are subtypes of the TIME type, with the same
1261 * tag, and have the same encoding as the TIME type. 8.26.1.1 The encoding of the TIME type shall
1262 * be primitive. 8.26.1.2 The contents octets shall be the UTF-8 encoding of the value notation,
1263 * after the removal of initial and final QUOTATION MARK (34) characters.
1264 *
1265 * 11.7 GeneralizedTime
1266 * 11.7.1 The encoding shall terminate with a "Z", as described in the Rec. ITU-T X.680 | ISO/IEC
1267 * 8824-1 clause on GeneralizedTime.
1268 * 11.7.2 The seconds element shall always be present.
1269 * 11.7.3 The fractional-seconds elements, if present, shall omit all trailing zeros; if the
1270 * elements correspond to 0, they shall be wholly omitted, and the decimal point element
1271 * also shall be omitted.
1272 */
1273
1274 /*
1275 * The format of a generalized time is "YYYYMMDDHHMMSS[.fff]Z"
1276 * Where:
1277 * 1. YYYY is the year
1278 * 2. MM is the month
1279 * 3. DD is the day
1280 * 4. HH is the hour
1281 * 5. MM is the minute
1282 * 6. SS is the second
1283 * 7. fff is the fraction of a second (optional)
1284 * 8. Z is the timezone (UTC)
1285 */
1286
1287 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *)timestr, &our_in, DER_GENERALIZED_TIME_LEN_MIN);
1288
1289 if (memchr(timestr, '\0', DER_GENERALIZED_TIME_LEN_MIN) != NULL) {
1290 fr_strerror_const_push("Generalized time contains null byte");
1291 return -1;
1292 }
1293
1294 if (timestr[DER_GENERALIZED_TIME_LEN_MIN - 1] != 'Z' && timestr[DER_GENERALIZED_TIME_LEN_MIN - 1] != '.') {
1295 fr_strerror_const_push("Incorrect format for generalized time. Missing timezone");
1296 return -1;
1297 }
1298
1299 /*
1300 * Check if the fractional seconds are present
1301 */
1302 if (timestr[DER_GENERALIZED_TIME_LEN_MIN - 1] == '.') {
1303 /*
1304 * We only support subseconds up to 4 decimal places
1305 */
1306 char subsecstring[DER_GENERALIZED_TIME_PRECISION_MAX + 1];
1307
1308 uint8_t precision = DER_GENERALIZED_TIME_PRECISION_MAX;
1309
1310 if (unlikely(fr_dbuff_remaining(&our_in) - 1 < DER_GENERALIZED_TIME_PRECISION_MAX)) {
1311 precision = fr_dbuff_remaining(&our_in) - 1;
1312 }
1313
1314 if (unlikely(precision == 0)) {
1315 fr_strerror_const_push("Insufficient data for subseconds");
1316 return -1;
1317 }
1318
1319 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *)subsecstring, &our_in, precision);
1320
1321 if (memchr(subsecstring, '\0', precision) != NULL) {
1322 fr_strerror_const_push("Generalized time contains null byte in subseconds");
1323 return -1;
1324 }
1325
1326 subsecstring[DER_GENERALIZED_TIME_PRECISION_MAX] = '\0';
1327
1328 /*
1329 * Convert the subseconds to an unsigned long
1330 */
1331 subseconds = strtoul(subsecstring, NULL, 10);
1332
1333 /*
1334 * Scale to nanoseconds
1335 */
1336 subseconds *= 1000000;
1337 }
1338
1339 /*
1340 * Make sure the timezone is UTC (Z)
1341 */
1342 timestr[DER_GENERALIZED_TIME_LEN_MIN - 1] = 'Z';
1343
1344 timestr[DER_GENERALIZED_TIME_LEN_MIN] = '\0';
1345
1346 p = strptime(timestr, "%Y%m%d%H%M%SZ", &tm);
1347
1348 if (unlikely(p == NULL)) {
1349 fr_strerror_const_push("Invalid generalized time format (strptime)");
1350 return -1;
1351 }
1352
1353 vp = fr_pair_afrom_da(ctx, parent);
1354 if (unlikely(!vp)) {
1355 fr_strerror_const_push("Out of memory");
1356 return -1;
1357 }
1358
1359 vp->vp_date = fr_unix_time_add(fr_unix_time_from_tm(&tm), fr_time_delta_wrap(subseconds));
1360
1361 fr_pair_append(out, vp);
1362
1363 /*
1364 * Move to the end of the buffer
1365 * This is necessary because the fractional seconds are being ignored
1366 */
1367 fr_dbuff_advance(&our_in, fr_dbuff_remaining(&our_in));
1368
1369 return fr_dbuff_set(in, &our_in);
1370}
1371
1372static ssize_t fr_der_decode_visible_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1373 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1374{
1375 static bool const allowed_chars[UINT8_MAX + 1] = {
1376 [' '] = true, ['!'] = true, ['"'] = true, ['#'] = true,
1377 ['$'] = true, ['%'] = true, ['&'] = true, ['\''] = true,
1378 ['('] = true, [')'] = true, ['*'] = true, ['+'] = true,
1379 [','] = true, ['-'] = true, ['.'] = true, ['/'] = true,
1380 [':'] = true, [';'] = true, ['<'] = true, ['='] = true,
1381 ['>'] = true, ['?'] = true, ['@'] = true, ['['] = true,
1382 ['\\'] = true, [']'] = true, ['^'] = true, ['_'] = true,
1383 ['`'] = true, ['{'] = true, ['|'] = true, ['}'] = true,
1384 ['A' ... 'Z'] = true, ['a' ... 'z'] = true,
1385 ['0' ... '9'] = true,
1386 };
1387
1388 return fr_der_decode_string(ctx, out, parent, in, allowed_chars, decode_ctx);
1389}
1390
1391/*
1392 * We have per-type function names to make it clear that different types have different decoders.
1393 * However, the methods to decode them are the same. So rather than having trampoline functions, we just
1394 * use defines.
1395 */
1396#define fr_der_decode_enumerated fr_der_decode_integer
1397
1398static ssize_t fr_der_decode_general_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1399 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1400{
1401 return fr_der_decode_string(ctx, out, parent, in, NULL, decode_ctx);
1402}
1403
1404static ssize_t fr_der_decode_universal_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1405 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1406{
1407 return fr_der_decode_string(ctx, out, parent, in, NULL, decode_ctx);
1408}
1409
1410static ssize_t fr_der_decode_ipv4_addr(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1411 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1412{
1413 uint8_t byte;
1414 fr_pair_t *vp;
1415 fr_dbuff_t our_in = FR_DBUFF(in);
1416
1417 /*
1418 * RFC3779 Section 2.1.1.
1419 *
1420 * An IP address or prefix is encoded in the IP address delegation
1421 * extension as a DER-encoded ASN.1 BIT STRING containing the constant
1422 * most-significant bits. Recall [X.690] that the DER encoding of a BIT
1423 * STRING consists of the BIT STRING type (0x03), followed by (an
1424 * encoding of) the number of value octets, followed by the value. The
1425 * value consists of an "initial octet" that specifies the number of
1426 * unused bits in the last value octet, followed by the "subsequent
1427 * octets" that contain the octets of the bit string. (For IP
1428 * addresses, the encoding of the length will be just the length.)
1429 */
1430
1431 if (fr_dbuff_remaining(&our_in) != 1 + sizeof(vp->vp_ipv4addr)) {
1432 fr_strerror_printf_push("Invalid ipv4addr size. Expected %zu, got %zu",
1433 1 + sizeof(vp->vp_ipv4addr), fr_dbuff_remaining(&our_in));
1434 return -1;
1435 }
1436
1437 FR_DBUFF_OUT_RETURN(&byte, &our_in);
1438 if (byte != 0) {
1439 fr_strerror_printf_push("Invalid ipv4addr prefix is non-zero (%02x)", byte);
1440 return -1;
1441 }
1442
1443 vp = fr_pair_afrom_da(ctx, parent);
1444 if (unlikely(!vp)) {
1445 fr_strerror_const_push("Out of memory");
1446 return -1;
1447 }
1448
1449 vp->vp_ip.af = AF_INET;
1450 vp->vp_ip.prefix = 32;
1451 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *) &vp->vp_ipv4addr, &our_in, sizeof(vp->vp_ipv4addr));
1452
1453 fr_pair_append(out, vp);
1454
1455 return fr_dbuff_set(in, &our_in);
1456}
1457
1458static ssize_t fr_der_decode_ipv4_prefix(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1459 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1460{
1461 uint8_t byte;
1462 fr_pair_t *vp;
1463 fr_dbuff_t our_in = FR_DBUFF(in);
1464 size_t len = fr_dbuff_remaining(&our_in);
1465
1466 /*
1467 * RFC3779 Section 2.1.1.
1468 *
1469 * An IP address or prefix is encoded in the IP address delegation
1470 * extension as a DER-encoded ASN.1 BIT STRING containing the constant
1471 * most-significant bits. Recall [X.690] that the DER encoding of a BIT
1472 * STRING consists of the BIT STRING type (0x03), followed by (an
1473 * encoding of) the number of value octets, followed by the value. The
1474 * value consists of an "initial octet" that specifies the number of
1475 * unused bits in the last value octet, followed by the "subsequent
1476 * octets" that contain the octets of the bit string. (For IP
1477 * addresses, the encoding of the length will be just the length.)
1478 */
1479
1480 if (!len || (len > 1 + sizeof(vp->vp_ipv4addr))) {
1481 fr_strerror_printf_push("Invalid ipv4prefix size. Expected 1..%zu, got %zu",
1482 1 + sizeof(vp->vp_ipv4addr), len);
1483 return -1;
1484 }
1485 len--;
1486
1487 FR_DBUFF_OUT_RETURN(&byte, &our_in);
1488 if (byte > 7) {
1489 fr_strerror_printf_push("Invalid ipv4prefix is too large (%02x)", byte);
1490 return -1;
1491 }
1492
1493 vp = fr_pair_afrom_da(ctx, parent);
1494 if (unlikely(!vp)) {
1495 fr_strerror_const_push("Out of memory");
1496 return -1;
1497 }
1498
1499 vp->vp_ip.af = AF_INET;
1500 vp->vp_ip.prefix = len * 8 - byte;
1501
1502 if (len) FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *) &vp->vp_ipv4addr, &our_in, len);
1503
1504 fr_pair_append(out, vp);
1505
1506 return fr_dbuff_set(in, &our_in);
1507}
1508
1509static ssize_t fr_der_decode_ipv6_addr(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1510 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1511{
1512 uint8_t byte;
1513 fr_pair_t *vp;
1514 fr_dbuff_t our_in = FR_DBUFF(in);
1515
1516 /*
1517 * RFC3779 Section 2.1.1.
1518 *
1519 * An IP address or prefix is encoded in the IP address delegation
1520 * extension as a DER-encoded ASN.1 BIT STRING containing the constant
1521 * most-significant bits. Recall [X.690] that the DER encoding of a BIT
1522 * STRING consists of the BIT STRING type (0x03), followed by (an
1523 * encoding of) the number of value octets, followed by the value. The
1524 * value consists of an "initial octet" that specifies the number of
1525 * unused bits in the last value octet, followed by the "subsequent
1526 * octets" that contain the octets of the bit string. (For IP
1527 * addresses, the encoding of the length will be just the length.)
1528 */
1529
1530 if (fr_dbuff_remaining(&our_in) != 1 + sizeof(vp->vp_ipv6addr)) {
1531 fr_strerror_printf_push("Invalid ipv6addr size. Expected %zu, got %zu",
1532 1 + sizeof(vp->vp_ipv6addr), fr_dbuff_remaining(&our_in));
1533 return -1;
1534 }
1535
1536 FR_DBUFF_OUT_RETURN(&byte, &our_in);
1537 if (byte != 0) {
1538 fr_strerror_printf_push("Invalid ipv6addr prefix is non-zero (%02x)", byte);
1539 return -1;
1540 }
1541
1542 vp = fr_pair_afrom_da(ctx, parent);
1543 if (unlikely(!vp)) {
1544 fr_strerror_const_push("Out of memory");
1545 return -1;
1546 }
1547
1548 vp->vp_ip.af = AF_INET6;
1549 vp->vp_ip.prefix = 128;
1550 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *) &vp->vp_ipv6addr, &our_in, sizeof(vp->vp_ipv6addr));
1551
1552 fr_pair_append(out, vp);
1553
1554 return fr_dbuff_set(in, &our_in);
1555}
1556
1557static ssize_t fr_der_decode_ipv6_prefix(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1558 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1559{
1560 uint8_t byte;
1561 fr_pair_t *vp;
1562 fr_dbuff_t our_in = FR_DBUFF(in);
1563 size_t len = fr_dbuff_remaining(&our_in);
1564
1565 /*
1566 * RFC3779 Section 2.1.1.
1567 *
1568 * An IP address or prefix is encoded in the IP address delegation
1569 * extension as a DER-encoded ASN.1 BIT STRING containing the constant
1570 * most-significant bits. Recall [X.690] that the DER encoding of a BIT
1571 * STRING consists of the BIT STRING type (0x03), followed by (an
1572 * encoding of) the number of value octets, followed by the value. The
1573 * value consists of an "initial octet" that specifies the number of
1574 * unused bits in the last value octet, followed by the "subsequent
1575 * octets" that contain the octets of the bit string. (For IP
1576 * addresses, the encoding of the length will be just the length.)
1577 */
1578
1579 if (!len || (len > 1 + sizeof(vp->vp_ipv6addr))) {
1580 fr_strerror_printf_push("Invalid ipv6prefix size. Expected 1..%zu, got %zu",
1581 1 + sizeof(vp->vp_ipv6addr), len);
1582 return -1;
1583 }
1584 len--;
1585
1586 FR_DBUFF_OUT_RETURN(&byte, &our_in);
1587 if (byte > 7) {
1588 fr_strerror_printf_push("Invalid ipv6prefix is too large (%02x)", byte);
1589 return -1;
1590 }
1591
1592 vp = fr_pair_afrom_da(ctx, parent);
1593 if (unlikely(!vp)) {
1594 fr_strerror_const_push("Out of memory");
1595 return -1;
1596 }
1597
1598 vp->vp_ip.af = AF_INET6;
1599 vp->vp_ip.prefix = len * 8 - byte;
1600
1601 if (len) FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *) &vp->vp_ipv6addr, &our_in, len);
1602
1603 fr_pair_append(out, vp);
1604
1605 return fr_dbuff_set(in, &our_in);
1606}
1607
1608static ssize_t fr_der_decode_combo_ip_addr(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1609 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1610{
1611 fr_pair_t *vp;
1612 fr_dbuff_t our_in = FR_DBUFF(in);
1613 size_t len = fr_dbuff_remaining(&our_in);
1614
1615 /*
1616 * RFC5280 Section 4.2.1.6
1617 *
1618 * When the subjectAltName extension contains an iPAddress, the address
1619 * MUST be stored in the octet string in "network byte order", as
1620 * specified in [RFC791]. The least significant bit (LSB) of each octet
1621 * is the LSB of the corresponding byte in the network address. For IP
1622 * version 4, as specified in [RFC791], the octet string MUST contain
1623 * exactly four octets. For IP version 6, as specified in
1624 * [RFC2460], the octet string MUST contain exactly sixteen octets.
1625 */
1626 if ((len != 4) && (len != 16)) {
1627 fr_strerror_printf_push("Invalid combo_ip_addr size. Expected 4 or 16, got %zu",
1628 len);
1629 return -1;
1630 }
1631
1632 vp = fr_pair_afrom_da(ctx, parent);
1633 if (unlikely(!vp)) {
1634 fr_strerror_const_push("Out of memory");
1635 return -1;
1636 }
1637
1638 if (len == 4) {
1639 vp->vp_ip.af = AF_INET;
1640 vp->vp_ip.prefix = 32;
1641 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *) &vp->vp_ipv4addr, &our_in, sizeof(vp->vp_ipv4addr));
1642
1643 } else {
1644 vp->vp_ip.af = AF_INET6;
1645 vp->vp_ip.prefix = 128;
1646 FR_DBUFF_OUT_MEMCPY_RETURN((uint8_t *) &vp->vp_ipv6addr, &our_in, sizeof(vp->vp_ipv6addr));
1647 }
1648
1649 fr_pair_append(out, vp);
1650
1651 return fr_dbuff_set(in, &our_in);
1652}
1653
1654static ssize_t fr_der_decode_oid_wrapper(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1655 fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
1656{
1657 ssize_t slen;
1658 fr_der_decode_oid_to_str_ctx_t uctx = {
1659 .ctx = ctx,
1660 .parent_da = parent,
1661 .parent_list = out,
1662 .oid_buff = {},
1663 .marker = {},
1664 };
1665
1666 /*
1667 * We don't use an intermediate dbuff here. We're not
1668 * doing anything with the dbuff, so an extra buffer
1669 * isn't necessary.
1670 */
1671 slen = fr_der_decode_oid(in, fr_der_decode_oid_to_str, &uctx);
1672 if (unlikely(slen <= 0)) return -1; /* OIDs of zero length are invalid */
1673
1674 return slen;
1675}
1676
1677/** Decode an OID value pair
1678 *
1679 * @param[in] ctx Talloc context
1680 * @param[out] out Output list
1681 * @param[in] parent Parent attribute
1682 * @param[in] in Input buffer
1683 * @param[in] decode_ctx Decode context
1684 *
1685 * @return 0 on success, -1 on failure
1686 */
1687static ssize_t fr_der_decode_oid_and_value(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1688 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
1689{
1690 fr_dbuff_t our_in = FR_DBUFF(in);
1691 fr_dbuff_t oid_in;
1692 fr_der_decode_oid_to_da_ctx_t uctx;
1693 fr_pair_t *vp;
1694
1695 uint8_t tag;
1696 size_t oid_len;
1697 ssize_t slen;
1698
1699 FR_PROTO_TRACE("Decoding OID value pair");
1700
1701 fr_assert(fr_type_is_group(parent->type));
1702
1703 /*
1704 * A very common pattern in DER encoding is to have a sequence of set containing two things: an OID and a
1705 * value, where the OID is used to determine how to decode the value.
1706 * We will be decoding the OID first and then try to find the attribute associated with that OID to then
1707 * decode the value. If no attribute is found, one will be created and the value will be stored as raw
1708 * octets in the attribute.
1709 */
1710
1711 if (unlikely((slen = fr_der_decode_hdr(parent, &our_in, &tag, &oid_len, FR_DER_TAG_OID)) <= 0)) {
1712 error:
1713 fr_strerror_printf_push("Failed decoding %s OID header", parent->name);
1714 return slen;
1715 }
1716
1717 FR_PROTO_TRACE("Attribute %s, tag %u", parent->name, tag);
1718
1719 vp = fr_pair_afrom_da(ctx, parent);
1720 if (unlikely(vp == NULL)) {
1721 fr_strerror_const_push("Out of memory");
1722 return -1;
1723 }
1724
1725 uctx.ctx = vp;
1726 uctx.parent_da = fr_dict_attr_ref(parent);
1727 uctx.parent_list = &vp->vp_group;
1728
1729 fr_assert(uctx.parent_da != NULL);
1730
1731 /*
1732 * Limit the OID decoding to the length as given by the OID header.
1733 */
1734 oid_in = FR_DBUFF(&our_in);
1735 fr_dbuff_set_end(&oid_in, fr_dbuff_current(&oid_in) + oid_len);
1736
1737 slen = fr_der_decode_oid(&oid_in, fr_der_decode_oid_to_da, &uctx);
1738 if (unlikely(slen <= 0)) goto error;
1739
1740 /*
1741 * Skip the OID data.
1742 */
1743 FR_DBUFF_ADVANCE_RETURN(&our_in, oid_len);
1744
1745 if (unlikely(uctx.parent_da->flags.is_unknown)) {
1746 /*
1747 * This pair is not in the dictionary.
1748 * We will store the value as raw octets.
1749 */
1750 if (unlikely((slen = fr_der_decode_octetstring(uctx.ctx, uctx.parent_list, uctx.parent_da, &our_in,
1751 decode_ctx)) < 0)) {
1752 fr_strerror_printf_push("Failed decoding %s OID value", parent->name);
1753 return -1;
1754 }
1755 } else if (unlikely((slen = fr_der_decode_pair_dbuff(uctx.ctx, uctx.parent_list, uctx.parent_da, &our_in,
1756 decode_ctx)) < 0)) {
1757 fr_strerror_printf_push("Failed decoding %s OID value", parent->name);
1758 return -1;
1759 }
1760
1761 fr_pair_append(out, vp);
1762
1763 return fr_dbuff_set(in, &our_in);
1764}
1765
1766static const fr_der_tag_decode_t tag_funcs[FR_DER_TAG_VALUE_MAX] = {
1767 [FR_DER_TAG_BOOLEAN] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_boolean },
1768 [FR_DER_TAG_INTEGER] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_integer },
1769 [FR_DER_TAG_OID] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_oid_wrapper },
1770 [FR_DER_TAG_BITSTRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_bitstring },
1771 [FR_DER_TAG_OCTETSTRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_octetstring },
1772 [FR_DER_TAG_NULL] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_null },
1773 [FR_DER_TAG_ENUMERATED] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_enumerated },
1774 [FR_DER_TAG_UTF8_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_utf8_string },
1775 [FR_DER_TAG_SEQUENCE] = { .constructed = FR_DER_TAG_CONSTRUCTED, .decode = fr_der_decode_sequence },
1776 [FR_DER_TAG_SET] = { .constructed = FR_DER_TAG_CONSTRUCTED, .decode = fr_der_decode_set },
1777 [FR_DER_TAG_PRINTABLE_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE,
1778 .decode = fr_der_decode_printable_string },
1779 [FR_DER_TAG_T61_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_t61_string },
1780 [FR_DER_TAG_IA5_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_ia5_string },
1781 [FR_DER_TAG_UTC_TIME] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_utc_time },
1782 [FR_DER_TAG_GENERALIZED_TIME] = { .constructed = FR_DER_TAG_PRIMITIVE,
1783 .decode = fr_der_decode_generalized_time },
1784 [FR_DER_TAG_VISIBLE_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_visible_string },
1785 [FR_DER_TAG_GENERAL_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE, .decode = fr_der_decode_general_string },
1786 [FR_DER_TAG_UNIVERSAL_STRING] = { .constructed = FR_DER_TAG_PRIMITIVE,
1787 .decode = fr_der_decode_universal_string },
1788};
1789
1798
1802
1803/** Decode the tag and length fields of a DER encoded structure
1804 *
1805 * @param[in] parent Parent attribute
1806 * @param[in] in Input buffer
1807 * @param[out] tag Tag value
1808 * @param[out] len Length of the value field
1809 * @param[in] expected the expected / required tag
1810 *
1811 * @return 0 on success, -1 on failure
1812 */
1813static ssize_t fr_der_decode_hdr(fr_dict_attr_t const *parent, fr_dbuff_t *in, uint8_t *tag, size_t *len,
1814 fr_der_tag_t expected)
1815{
1816 fr_dbuff_t our_in = FR_DBUFF(in);
1817 uint8_t tag_byte;
1818 uint8_t len_byte;
1819 fr_der_tag_decode_t const *func;
1820 fr_der_tag_class_t tag_class;
1821 fr_der_tag_constructed_t constructed;
1822 fr_der_attr_flags_t const *flags;
1823
1824 if (fr_dbuff_out(&tag_byte, &our_in) < 0) {
1825 error:
1826 fr_strerror_const_push("Failed decoding DER header - insufficient data");
1827 return -1;
1828 }
1829
1830 /*
1831 * Decode the tag flags
1832 */
1833 tag_class = (tag_byte & DER_TAG_CLASS_MASK);
1834 constructed = IS_DER_TAG_CONSTRUCTED(tag_byte);
1835
1836 /*
1837 * Decode the tag
1838 */
1839 if (IS_DER_TAG_CONTINUATION(tag_byte)) {
1840 /*
1841 * We have a multi-byte tag
1842 *
1843 * Note: Multi-byte tags would mean having a tag number that is greater than 30 (0x1E) (since tag
1844 * 31 would indicate a multi-byte tag). For most use-cases, this should not be needed, since all
1845 * of the basic ASN.1 types have values under 30, and if a CHOICE type were to have over 30 options
1846 * (meaning a multi-byte tag would be needed), that would be a very complex CHOICE type that
1847 * should probably be simplified.
1848 */
1849 fr_strerror_const_push("Multi-byte tags are not supported");
1850 return -1;
1851 }
1852
1853 *tag = tag_byte & DER_TAG_CONTINUATION;
1854
1855 /*
1856 * Check if the tag is not universal
1857 */
1858 switch (tag_class) {
1859 case FR_DER_CLASS_UNIVERSAL:
1860 if ((*tag == FR_DER_TAG_INVALID) || (*tag >= FR_DER_TAG_VALUE_MAX)) {
1861 fr_strerror_printf_push("Invalid tag %u", *tag);
1862 return -1;
1863 }
1864
1865 if ((expected != FR_DER_TAG_INVALID) && (*tag != expected)) {
1866 fr_strerror_printf_push("Invalid tag %s. Expected tag %s",
1867 fr_der_tag_to_str(*tag), fr_der_tag_to_str(expected));
1868 return -1;
1869 }
1870 break;
1871
1872 default:
1873 /*
1874 * The data type will need to be resolved using the dictionary and the tag value
1875 */
1876 if (!parent) {
1877 fr_strerror_const_push("No parent attribute to resolve tag to class");
1878 return -1;
1879 }
1880 flags = fr_der_attr_flags(parent);
1881
1882 if (tag_class != flags->class) {
1883 fr_strerror_printf_push("Invalid DER class %02x for attribute %s. Expected DER class %02x",
1884 tag_class, parent->name, flags->class);
1885 return -1;
1886 }
1887
1888 /*
1889 * Doesn't match, check if it's optional.
1890 */
1891 if (flags->is_option) {
1892 if (*tag != flags->option) {
1893 if (flags->optional) return 0;
1894
1895 fr_strerror_printf_push("Invalid option %u for attribute %s. Expected option %u",
1896 *tag, parent->name, flags->option);
1897 return -1;
1898 }
1899
1900 *tag = flags->der_type;
1901
1902 } else {
1903 if (*tag != flags->der_type) {
1904 if (flags->optional) return 0;
1905
1906 fr_strerror_printf_push("Invalid tag %s for attribute %s. Expected tag %s",
1907 fr_der_tag_to_str(*tag), parent->name, fr_der_tag_to_str(flags->der_type));
1908 return -1;
1909 }
1910 }
1911 fr_assert(flags->der_type != FR_DER_TAG_INVALID);
1912 fr_assert(flags->der_type < NUM_ELEMENTS(tag_funcs));
1913 break;
1914 }
1915
1916 func = &tag_funcs[*tag];
1917 fr_assert(func != NULL);
1918
1919 if (unlikely(func->decode == NULL)) {
1920 fr_strerror_printf_push("No decode function for tag %u", *tag);
1921 return -1;
1922 }
1923
1924 if (IS_DER_TAG_CONSTRUCTED(func->constructed) != constructed) {
1925 fr_strerror_printf_push("Constructed flag mismatch for tag %u", *tag);
1926 return -1;
1927 }
1928
1929 if (fr_dbuff_out(&len_byte, &our_in) < 0) goto error;
1930
1931 /*
1932 * Check if the length is a multi-byte length field
1933 */
1934 if (IS_DER_LEN_MULTI_BYTE(len_byte)) {
1935 uint8_t len_len = len_byte & 0x7f;
1936 *len = 0;
1937
1938 /*
1939 * Length bits of zero is an indeterminate length field where
1940 * the length is encoded in the data instead.
1941 */
1942 if (len_len > 0) {
1943 if (unlikely(len_len > sizeof(*len))) {
1944 fr_strerror_printf_push("Length field too large (%" PRIu32 ")", len_len);
1945 return -1;
1946 }
1947
1948 while (len_len--) {
1949 if (fr_dbuff_out(&len_byte, &our_in) < 0) goto error;
1950 *len = (*len << 8) | len_byte;
1951 }
1952 } else if (!constructed) {
1953 fr_strerror_const_push("Primitive data with indefinite form length field is invalid");
1954 return -1;
1955 }
1956
1957 } else {
1958 *len = len_byte;
1959 }
1960
1961 /*
1962 * Ensure that there is the correct amount of data available to read.
1963 */
1964 if (*len && unlikely((fr_dbuff_extend_lowat(NULL, &our_in, *len) < *len))) {
1965 fr_strerror_printf_push("Insufficient data for length field (%zu)", *len);
1966 return -1;
1967 }
1968
1969 return fr_dbuff_set(in, &our_in);
1970}
1971
1972/** Decode a CHOICE type
1973 * This is where the actual decoding of the CHOICE type happens. The CHOICE type is a type that can have multiple
1974 * types, but only one of them can be present at a time. The type that is present is determined by the tag of the
1975 * data
1976 *
1977 * @param[in] ctx Talloc context
1978 * @param[in] out Output list
1979 * @param[in] parent Parent attribute
1980 * @param[in] in Input buffer
1981 * @param[in] decode_ctx Decode context
1982 */
1983static ssize_t fr_der_decode_choice(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
1984 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
1985{
1986 fr_pair_t *vp;
1987 fr_dict_attr_t const *child = NULL;
1988 fr_dbuff_t our_in = FR_DBUFF(in);
1989 uint8_t tag;
1990 uint8_t tag_byte;
1991 uint8_t *current_marker = fr_dbuff_current(&our_in);
1992
1993 fr_assert(fr_type_is_struct(parent->type) || fr_type_is_tlv(parent->type) || fr_type_is_group(parent->type));
1994
1995 FR_DBUFF_OUT_RETURN(&tag_byte, &our_in);
1996
1997 if (unlikely(IS_DER_TAG_CONTINUATION(tag_byte))) {
1998 fr_strerror_printf_push("Attribute %s is a choice, but received tag with continuation bit set",
1999 parent->name);
2000 return -1;
2001 }
2002
2003 tag = (tag_byte & DER_TAG_CONTINUATION);
2004
2005 child = fr_dict_attr_child_by_num(parent, tag);
2006 if (unlikely(!child)) {
2007 fr_strerror_printf_push("Attribute %s is a choice, but received unknown option %u",
2008 parent->name, tag);
2009 return -1;
2010 }
2011
2012 fr_dbuff_set(&our_in, current_marker);
2013
2014 vp = fr_pair_afrom_da(ctx, parent);
2015 if (unlikely(!vp)) {
2016 fr_strerror_const_push("Out of memory");
2017 return -1;
2018 }
2019
2020 if (unlikely(fr_der_decode_pair_dbuff(vp, &vp->vp_group, child, &our_in, decode_ctx) < 0)) {
2021 fr_strerror_printf_push("Failed decoding %s", vp->da->name);
2022 talloc_free(vp);
2023 return -1;
2024 }
2025
2026 fr_pair_append(out, vp);
2027
2028 return fr_dbuff_set(in, &our_in);
2029}
2030
2031/** Decode an X509 Extentions Field
2032 *
2033 * @param[in] ctx Talloc context
2034 * @param[in] out Output list
2035 * @param[in] in Input buffer
2036 * @param[in] parent Parent attribute
2037 * @param[in] decode_ctx Decode context
2038 *
2039 * @return 0 on success, -1 on failure
2040 */
2041static ssize_t fr_der_decode_x509_extensions(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dbuff_t *in,
2042 fr_dict_attr_t const *parent, fr_der_decode_ctx_t *decode_ctx)
2043{
2044 fr_dbuff_t our_in = FR_DBUFF(in);
2045 fr_pair_t *vp, *vp2;
2046 fr_dict_attr_t const *ref;
2047
2048 uint8_t tag;
2049 uint64_t max;
2050 size_t len;
2051 ssize_t slen;
2052
2053 FR_PROTO_TRACE("Decoding extensions");
2054 FR_PROTO_TRACE("Attribute %s", parent->name);
2055 FR_PROTO_HEX_DUMP(fr_dbuff_current(in), fr_dbuff_remaining(in), "Top of extension decoding");
2056
2057 fr_assert(fr_type_is_group(parent->type));
2058
2059 /*
2060 * RFC 5280 Section 4.2
2061 * The extensions defined for X.509 v3 certificates provide methods for
2062 * associating additional attributes with users or public keys and for
2063 * managing relationships between CAs. The X.509 v3 certificate format
2064 * also allows communities to define private extensions to carry
2065 * information unique to those communities. Each extension in a
2066 * certificate is designated as either critical or non-critical.
2067 *
2068 * Each extension includes an OID and an ASN.1 structure. When an
2069 * extension appears in a certificate, the OID appears as the field
2070 * extnID and the corresponding ASN.1 DER encoded structure is the value
2071 * of the octet string extnValue.
2072 *
2073 * RFC 5280 Section A.1 Explicitly Tagged Module, 1988 Syntax
2074 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
2075 *
2076 * Extension ::= SEQUENCE {
2077 * extnID OBJECT IDENTIFIER,
2078 * critical BOOLEAN DEFAULT FALSE,
2079 * extnValue OCTET STRING
2080 * -- contains the DER encoding of an ASN.1 value
2081 * -- corresponding to the extension type identified
2082 * -- by extnID
2083 * }
2084 *
2085 * So the extensions are a SEQUENCE of SEQUENCEs containing an OID, a boolean and an OCTET STRING.
2086 * Note: If the boolean value is false, it should not be included in the encoding.
2087 */
2088
2089 /*
2090 * Get the overall length of the first inner sequence.
2091 * Ideally this should fill the entire outer sequence.
2092 */
2093 if (unlikely((slen = fr_der_decode_hdr(parent, &our_in, &tag, &len, FR_DER_TAG_SEQUENCE)) <= 0)) {
2094 fr_strerror_printf_push("Failed decoding %s sequence header", parent->name);
2095 return slen;
2096 }
2097
2098 if (len != fr_dbuff_remaining(&our_in)) {
2099 fr_strerror_printf_push("Inner %s x509extension sequence does not exactly fill the outer sequence",
2100 parent->name);
2101 return -1;
2102 }
2103
2104 /*
2105 * Normal extensions are decoded into the normal parent.
2106 */
2107 vp = fr_pair_afrom_da(ctx, parent);
2108 if (unlikely(!vp)) {
2109 oom:
2110 fr_strerror_const_push("Out of memory");
2111 return -1;
2112 }
2113
2114 /*
2115 * Critical extensions are decoded into the Critical parent.
2116 */
2117 ref = fr_dict_attr_ref(parent);
2118 fr_assert(ref != NULL);
2119 ref = fr_dict_attr_by_name(NULL, ref, "Critical");
2120 fr_assert(ref != NULL);
2121
2122 vp2 = fr_pair_afrom_da(vp, ref);
2123 if (unlikely(vp2 == NULL)) {
2124 talloc_free(vp);
2125 goto oom;
2126 }
2127
2128 max = fr_der_flag_max(parent); /* Maximum number of extensions which can be used here */
2129
2130 /*
2131 * Each extension is composed of a sequence containing the following objects:
2132 *
2133 * extnID OID - a printable string "1.2.3.4"
2134 * critical BOOLEAN OPTIONAL DEFAULT FALSE
2135 * extnValue OCTETSTRING - the DER encoding of the referenced ASN.1 extension
2136 */
2137 while (fr_dbuff_remaining(&our_in) > 0) {
2138 fr_dbuff_t seq_in = FR_DBUFF(&our_in);
2139 fr_dbuff_t oid_in;
2140 fr_der_decode_oid_to_da_ctx_t uctx;
2141 size_t seq_len, oid_len, ext_len;
2142
2143 FR_PROTO_HEX_DUMP(fr_dbuff_current(&our_in), fr_dbuff_remaining(&our_in), "inner x509 sequence");
2144
2145 if (!max) {
2146 fr_strerror_printf_push("Too many extensions - reached the limit of %" PRIu64, max);
2147 return -1;
2148 }
2149
2150 if (unlikely((slen = fr_der_decode_hdr(parent, &seq_in, &tag, &seq_len, FR_DER_TAG_SEQUENCE)) <= 0)) {
2151 fr_strerror_printf_push("Failed decoding %s extension inner sequence header",
2152 parent->name);
2153 error:
2154 talloc_free(vp);
2155 return slen;
2156 }
2157
2158 /*
2159 * Limit decoding for the inner sequence.
2160 */
2161 fr_dbuff_set_end(&seq_in, fr_dbuff_current(&seq_in) + seq_len);
2162
2163 /*
2164 * Start decoding the OID.
2165 */
2166 if (unlikely((slen = fr_der_decode_hdr(NULL, &seq_in, &tag, &oid_len, FR_DER_TAG_OID)) <= 0)) {
2167 fr_strerror_printf_push("Failed decoding %s OID header", parent->name);
2168 goto error;
2169 }
2170
2171 /*
2172 * Create a buffer where we can decode the OID. This lets us avoid any back and forth
2173 * with markers.
2174 *
2175 * The OID and extnValue will get decoded into a "critical" or "non-critical" vp,
2176 * depending on the value of the boolean Critical field. So we don't know where to
2177 * decode the OID until we see the Critical field. As a result, we have to save a
2178 * temporary OID buffer.
2179 */
2180 oid_in = FR_DBUFF(&seq_in);
2181 fr_dbuff_set_end(&oid_in, fr_dbuff_current(&oid_in) + oid_len);
2182
2183 FR_PROTO_TRACE("inner x509 OID length %zu", oid_len);
2184 FR_PROTO_HEX_DUMP(fr_dbuff_current(&oid_in), fr_dbuff_remaining(&oid_in), "inner x509 OID");
2185
2186 /*
2187 * Skip the OID data. We'll decode that later.
2188 */
2189 FR_DBUFF_ADVANCE_RETURN(&seq_in, oid_len);
2190
2191 /*
2192 * The next thing is either Critical, or is the extValue.
2193 */
2194 if (unlikely(fr_der_decode_hdr(NULL, &seq_in, &tag, &ext_len, FR_DER_TAG_INVALID) <= 0)) {
2195 fr_strerror_printf_push("Failed decoding %s extnValue", parent->name);
2196 slen = -1;
2197 goto error;
2198 }
2199
2200 uctx.ctx = vp;
2201 uctx.parent_da = vp->da;
2202 uctx.parent_list = &vp->vp_group;
2203
2204 /*
2205 * The optional boolean Critical field. This tells us where the extensions will be
2206 * decoded to.
2207 */
2208 if (tag == FR_DER_TAG_BOOLEAN) {
2209 uint8_t is_critical = false;
2210
2211 /*
2212 * This Extension has the Critical field.
2213 * If this value is true, we will be storing the pair in the critical list
2214 */
2215 if (unlikely(fr_dbuff_out(&is_critical, &seq_in) <= 0)) {
2216 fr_strerror_const_push("Insufficient data for isCritical field");
2217 slen = -1;
2218 goto error;
2219 }
2220
2221 /*
2222 * 0x00 is false. 0xff is true. But we don't care about invalid boolean values.
2223 */
2224 if (is_critical) {
2225 uctx.ctx = vp2;
2226 uctx.parent_da = vp2->da;
2227 uctx.parent_list = &vp2->vp_group;
2228 }
2229
2230 /*
2231 * The next header should be the extnValue
2232 */
2233 if (unlikely(fr_der_decode_hdr(NULL, &seq_in, &tag, &ext_len, FR_DER_TAG_OCTETSTRING) <= 0)) {
2234 fr_strerror_printf_push("Failed decoding %s extnValue", parent->name);
2235 slen = -1;
2236 goto error;
2237 }
2238 } else {
2239 /*
2240 * The extnValue is DER tag OCTETSTRING.
2241 */
2242 if (unlikely(tag != FR_DER_TAG_OCTETSTRING)) {
2243 fr_strerror_printf_push("Expected tag OCTETSTRING for the %s extnValue. Got tag %s",
2244 parent->name, fr_der_tag_to_str(tag));
2245 slen = -1;
2246 goto error;
2247 }
2248 }
2249
2250 /*
2251 * We leave the seq_in buffer at the extnValue field, which lets us decode it later.
2252 */
2253 FR_PROTO_HEX_DUMP(fr_dbuff_current(&seq_in), fr_dbuff_remaining(&seq_in),
2254 "extnValue");
2255
2256 /*
2257 * Decode the OID, which gets us the DA which lets us know how to decode the extnValue.
2258 */
2259 if (unlikely((slen = fr_der_decode_oid(&oid_in, fr_der_decode_oid_to_da, &uctx)) <= 0)) {
2260 fr_strerror_const_push("Failed decoding OID in extension");
2261 goto error;
2262 }
2263
2264 /*
2265 * This has been updated with the OID reference.
2266 */
2267 fr_assert(uctx.parent_da != NULL);
2268
2269 FR_PROTO_HEX_DUMP(fr_dbuff_current(&seq_in), fr_dbuff_remaining(&seq_in), "inner x509 extnValue");
2270
2271 /*
2272 * The extension was not found in the dictionary. We will store the value as raw octets.
2273 */
2274 if (uctx.parent_da->flags.is_unknown) {
2275 slen = fr_der_decode_octetstring(uctx.ctx, uctx.parent_list, uctx.parent_da,
2276 &seq_in, decode_ctx);
2277 } else {
2278 slen = fr_der_decode_pair_dbuff(uctx.ctx, uctx.parent_list, uctx.parent_da, &seq_in,
2279 decode_ctx);
2280 }
2281 if (unlikely(slen < 0)) {
2282 fr_strerror_printf_push("Failed decoding %s extValue", parent->name);
2283 goto error;
2284 }
2285
2286 if (fr_dbuff_remaining(&seq_in)) {
2287 fr_strerror_printf_push("Failed to decode all of the data in the %s x509_extensions inner sequence",
2288 parent->name);
2289 return -1;
2290 }
2291
2292 FR_PROTO_HEX_DUMP(fr_dbuff_current(&seq_in), fr_dbuff_remaining(&seq_in),
2293 "Remaining data after decoding all of the extension");
2294 max--;
2295
2296 (void) fr_dbuff_set(&our_in, &seq_in);
2297 }
2298
2299 if (fr_pair_list_num_elements(&vp2->children) > 0) {
2300 fr_pair_prepend(&vp->vp_group, vp2);
2301 } else {
2302 talloc_free(vp2);
2303 }
2304
2305 fr_pair_append(out, vp);
2306
2307 return fr_dbuff_set(in, fr_dbuff_end(&our_in));
2308}
2309
2310static ssize_t fr_der_decode_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in,
2311 bool const allowed_chars[], UNUSED fr_der_decode_ctx_t *decode_ctx)
2312{
2313 fr_pair_t *vp;
2314 fr_dbuff_t our_in = FR_DBUFF(in);
2315 char *str = NULL;
2316
2317 size_t pos, len = fr_dbuff_remaining(&our_in);
2318
2319 fr_assert(fr_type_is_string(parent->type));
2320
2321 /*
2322 * ISO/IEC 8825-1:2021
2323 * 8.23 Encoding for values of the restricted character string types
2324 * 8.23.1 The data value consists of a string of characters from the character set specified in the ASN.1
2325 * type definition. 8.23.2 Each data value shall be encoded independently of other data values of
2326 * the same type.
2327 * 8.23.3 Each character string type shall be encoded as if it had been declared:
2328 * [UNIVERSAL x] IMPLICIT OCTET STRING
2329 * where x is the number of the universal class tag assigned to the character string type in
2330 * Rec. ITU-T X.680 | ISO/IEC 8824-1. The value of the octet string is specified in 8.23.4 and
2331 * 8.23.5.
2332 */
2333
2334 vp = fr_pair_afrom_da(ctx, parent);
2335 if (unlikely(!vp)) {
2336 oom:
2337 fr_strerror_const_push("Out of memory");
2338 return -1;
2339 }
2340
2341 if (unlikely(fr_pair_value_bstr_alloc(vp, &str, len, false) < 0)) {
2342 talloc_free(vp);
2343 goto oom;
2344 }
2345
2346 (void) fr_dbuff_out_memcpy((uint8_t *)str, &our_in, len); /* this can never fail */
2347
2348 if (allowed_chars && len) {
2349 fr_sbuff_t sbuff;
2350 sbuff = FR_SBUFF_OUT(str, len);
2351
2352 if ((pos = fr_sbuff_adv_past_allowed(&sbuff, SIZE_MAX, allowed_chars, NULL)) < len - 1) {
2353 invalid:
2354 fr_strerror_printf_push("Invalid character in a string (%" PRId32 ")", str[pos]);
2355 return -1;
2356 }
2357
2358 // Check the final character
2359 if (!allowed_chars[(uint8_t)str[pos]]) goto invalid;
2360 }
2361
2362 str[len] = '\0';
2363
2364 fr_pair_append(out, vp);
2365
2366 return fr_dbuff_set(in, &our_in);
2367}
2368
2369static ssize_t fr_der_decode_pair_dbuff(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent,
2370 fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
2371{
2372 fr_dbuff_t our_in = FR_DBUFF(in);
2373 fr_der_tag_decode_t const *func;
2374 ssize_t slen;
2375 uint8_t tag;
2376 size_t len;
2377 fr_der_attr_flags_t const *flags = fr_der_attr_flags(parent);
2378
2379 /*
2380 * ISO/IEC 8825-1:2021
2381 * The structure of a DER encoding is as follows:
2382 *
2383 * +------------+--------+-------+
2384 * | IDENTIFIER | LENGTH | VALUE |
2385 * +------------+--------+-------+
2386 *
2387 * The IDENTIFIER is a tag that specifies the type of the value field and is encoded as follows:
2388 *
2389 * 8 7 6 5 4 3 2 1
2390 * +---+---+-----+---+---+---+---+---+
2391 * | Class | P/C | Tag Number |
2392 * +---+---+-----+---+---+---+---+---+
2393 * |
2394 * |- 0 = Primitive
2395 * |- 1 = Constructed
2396 *
2397 * The CLASS field specifies the encoding class of the tag and may be one of the following values:
2398 *
2399 * +------------------+-------+-------+
2400 * | Class | Bit 8 | Bit 7 |
2401 * +------------------+-------+-------+
2402 * | UNIVERSAL | 0 | 0 |
2403 * | APPLICATION | 0 | 1 |
2404 * | CONTEXT-SPECIFIC | 1 | 0 |
2405 * | PRIVATE | 1 | 1 |
2406 * +------------------+-------+-------+
2407 *
2408 * The P/C field specifies whether the value field is primitive or constructed.
2409 * The TAG NUMBER field specifies the tag number of the value field and is encoded as an unsigned binary
2410 * integer.
2411 *
2412 * The LENGTH field specifies the length of the VALUE field and is encoded as an unsigned binary integer
2413 * and may be encoded as a single byte or multiple bytes.
2414 *
2415 * The VALUE field contains LENGTH number of bytes and is encoded according to the tag.
2416 *
2417 */
2418
2419 /*
2420 * Ensure that we have at least 2 bytes for the header.
2421 */
2422 slen = fr_dbuff_extend_lowat(NULL, &our_in, 2);
2423 if (unlikely(slen < 0)) {
2424 fr_strerror_const("Failed trying to read more data");
2425 return -1;
2426 }
2427
2428 /*
2429 * One byte is not enough.
2430 */
2431 if (unlikely(slen == 1)) {
2432 fr_strerror_printf_push("Truncated header while trying to decode %s", parent->name);
2433 return -1;
2434 }
2435
2436 /*
2437 * No header, we may need to create a default value.
2438 */
2439 if (unlikely(slen == 0)) {
2440 fr_pair_t *vp;
2441
2442 if (likely(!flags->has_default_value)) return 0;
2443
2444 create_default:
2445 vp = fr_pair_afrom_da(ctx, parent);
2446 if (unlikely(!vp)) {
2447 fr_strerror_const_push("Out of memory");
2448 return -1;
2449 }
2450
2451 if (fr_value_box_copy(vp, &vp->data, flags->default_value) < 0) {
2452 talloc_free(vp);
2453 return -1;
2454 }
2455
2456 vp->data.enumv = vp->da;
2457
2458 fr_pair_append(out, vp);
2459
2460 return 0;
2461 }
2462
2463 if (unlikely(flags->is_choice)) {
2464 slen = fr_der_decode_choice(ctx, out, parent, &our_in, decode_ctx);
2465
2466 if (unlikely(slen <= 0)) return slen;
2467
2468 return fr_dbuff_set(in, &our_in);
2469 }
2470
2471 slen = fr_der_decode_hdr(parent, &our_in, &tag, &len, FR_DER_TAG_INVALID);
2472 if ((slen == 0) && flags->optional) return 0;
2473 if (slen <= 0) {
2474 fr_strerror_printf_push("Failed decoding %s header", parent->name);
2475 return -1;
2476 }
2477
2478 FR_PROTO_TRACE("Attribute %s, tag %u", parent->name, tag);
2479
2480 /*
2481 * Limit the length of the data to be decoded.
2482 */
2483 fr_dbuff_set_end(&our_in, fr_dbuff_current(&our_in) + len);
2484
2485 /*
2486 * Unknown attributes have no defaults, and can be zero
2487 * length. We also ignore whatever tag and class is
2488 * being used.
2489 *
2490 * @todo - we need to store the tag and class somewhere,
2491 * so that re-encoding the "raw" data type will result in
2492 * the same data.
2493 */
2494 if (unlikely(parent->flags.is_unknown)) {
2495 func = &tag_funcs[FR_DER_TAG_OCTETSTRING];
2496 goto decode_it;
2497 }
2498
2499 /*
2500 * No data? Try to set a default value, OR decode it as
2501 * NULL.
2502 */
2503 if (unlikely(fr_dbuff_remaining(&our_in) == 0)) {
2504 if (flags->has_default_value) goto create_default;
2505
2506 if (tag == FR_DER_TAG_NULL) {
2507 func = &tag_funcs[FR_DER_TAG_NULL];
2508 goto decode_it;
2509 }
2510
2511 }
2512
2513 /*
2514 * Hacks for serialNumber
2515 */
2516 if (unlikely((tag == FR_DER_TAG_INTEGER) && (parent->type == FR_TYPE_OCTETS))) {
2517 func = &tag_funcs[FR_DER_TAG_OCTETSTRING];
2518 goto decode_it;
2519 }
2520
2521 /*
2522 * We didn't get the expected tag. If it's not allowed for this parent, OR it's not an
2523 * equivalent tag, then that is likely an error.
2524 *
2525 * The "compatible" check is to really to hack around Time and DirectoryString. It's technically
2526 * wrong, and should perhaps be fixed.
2527 *
2528 * @todo - parse 'string' and 'date', and then set flags->restrictions to allow any compatible
2529 * DER tags, as a hack. Doing that makes this a little more generic? Or, add support for data
2530 * types "Time" and "DirectoryString", and do the right thing. Or, define them as separate
2531 * attributes in dictionarty.common, and remove the "tags compatible" checks.
2532 */
2533 if (unlikely((tag != flags->der_type) &&
2534 (!fr_type_to_der_tag_valid(parent->type, tag) || !fr_der_tags_compatible(tag, flags->der_type)))) {
2535 /*
2536 * Optional or not, if we can create a default value, then do so.
2537 */
2538 if (flags->has_default_value) goto create_default;
2539
2540 /*
2541 * Optional means "decoded nothing". Otherwise it's a hard failure.
2542 */
2543 if (!flags->optional) {
2544 fr_strerror_printf_push("Failed decoding %s - got tag '%s', expected '%s'", parent->name,
2545 fr_der_tag_to_str(tag), fr_der_tag_to_str(flags->der_type));
2546 return -1;
2547 }
2548
2549 return 0;
2550 }
2551
2552 if (flags->is_extensions) {
2553 slen = fr_der_decode_x509_extensions(ctx, out, &our_in, parent, decode_ctx);
2554 if (slen <= 0) return slen;
2555
2556 return fr_dbuff_set(in, &our_in);
2557 }
2558
2559 func = &type_funcs[parent->type];
2560 if (!func->decode) func = &tag_funcs[tag];
2561 fr_assert(func != NULL);
2562 fr_assert(func->decode != NULL);
2563
2564 /*
2565 * Enforce limits on min/max.
2566 */
2567 switch (tag) {
2568 case FR_DER_TAG_SEQUENCE:
2569 case FR_DER_TAG_SET:
2570 /*
2571 * min/max is the number of elements, NOT the number of bytes. The set / sequence
2572 * decoder has to validate its input.
2573 */
2574
2575 /*
2576 * If the sequence or set is an OID Value pair, then we decode it with the special OID
2577 * Value decoder.
2578 */
2579 if (flags->is_oid_and_value) func = &oid_and_value_func;
2580 break;
2581
2582 /*
2583 * min/max applies to the decoded values.
2584 */
2585 case FR_DER_TAG_INTEGER:
2586 case FR_DER_TAG_ENUMERATED:
2587 break;
2588
2589 default:
2590 if (parent->flags.is_raw) break;
2591
2592 /*
2593 * min/max can be fixed width, but we only care for 'octets' and 'string'.
2594 *
2595 * @todo - when we support IP addresses (which DER usually encodes as strings), this
2596 * check will have to be updated.
2597 */
2598 if (parent->flags.is_known_width) {
2599 if (!fr_type_is_variable_size(parent->type)) break;
2600
2601 if (len != parent->flags.length) {
2602 fr_strerror_printf_push("Data length (%zu) is different from expected fixed size (%u)", len, parent->flags.length);
2603 return -1;
2604 }
2605
2606 break;
2607 }
2608
2609 if (flags->min && (len < flags->min)) {
2610 fr_strerror_printf_push("Data length (%zu) is smaller than expected minimum size (%u)", len, flags->min);
2611 return -1;
2612 }
2613
2614 fr_assert(flags->max <= DER_MAX_STR); /* 'max' is always set in the attr_valid() function */
2615
2616 if (unlikely(len > flags->max)) {
2617 fr_strerror_printf_push("Data length (%zu) exceeds max size (%" PRIu64 ")", len, flags->max);
2618 return -1;
2619 }
2620 break;
2621 }
2622
2623 /*
2624 * The decode function can return 0 if len==0. This is true for 'null' data types, and
2625 * for variable-sized types such as strings.
2626 */
2627decode_it:
2628 slen = func->decode(ctx, out, parent, &our_in, decode_ctx);
2629 if (unlikely(slen < 0)) return slen;
2630
2631 /*
2632 * There may be extra data, in which case we ignore it.
2633 *
2634 * @todo - if the data type is fixed size, then return an error.
2635 */
2636 if ((size_t) slen < len) {
2637 FR_PROTO_TRACE("Ignoring extra data");
2638 FR_PROTO_HEX_DUMP(fr_dbuff_current(&our_in), fr_dbuff_remaining(&our_in), " ");
2639
2640 fr_dbuff_advance(&our_in, len - (size_t) slen);
2641 }
2642
2643 return fr_dbuff_set(in, &our_in);
2644}
2645
2646static ssize_t fr_der_decode_proto(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t const *data, size_t data_len,
2647 void *proto_ctx)
2648{
2649 fr_dbuff_t our_in = FR_DBUFF_TMP(data, data_len);
2650
2651 fr_dict_attr_t const *parent = fr_dict_root(dict_der);
2652
2653 if (unlikely(parent == fr_dict_root(dict_der))) {
2654 fr_strerror_printf_push("Invalid dictionary. DER decoding requires a specific dictionary.");
2655 return -1;
2656 }
2657
2658 return fr_der_decode_pair_dbuff(ctx, out, parent, &our_in, proto_ctx);
2659}
2660
2661/** Decode a DER structure using the specific dictionary
2662 *
2663 * @param[in] ctx to allocate new pairs in.
2664 * @param[in] out where new VPs will be added
2665 * @param[in] parent Parent attribute. This should be the root of the dictionary
2666 * we're using to decode DER data. This only specifies structures
2667 * like SEQUENCES. OID based pairs are resolved using the global
2668 * dictionary tree.
2669 *
2670 */
2671static ssize_t decode_pair(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, uint8_t const *data,
2672 size_t data_len, void *decode_ctx)
2673{
2674 if (unlikely(parent == fr_dict_root(dict_der))) {
2675 fr_strerror_printf_push("Invalid dictionary. DER decoding requires a specific dictionary.");
2676 return -1;
2677 }
2678
2679 return fr_der_decode_pair_dbuff(ctx, out, parent, &FR_DBUFF_TMP(data, data_len), decode_ctx);
2680}
2681
2682/*
2683 * Test points
2684 */
2685static int decode_test_ctx(void **out, TALLOC_CTX *ctx, UNUSED fr_dict_t const *dict)
2686{
2687 fr_der_decode_ctx_t *test_ctx;
2688
2689 test_ctx = talloc_zero(ctx, fr_der_decode_ctx_t);
2690 if (!test_ctx) return -1;
2691
2692 test_ctx->tmp_ctx = talloc(test_ctx, uint8_t);
2693 test_ctx->oid_value_pairs = false;
2694
2695 *out = test_ctx;
2696
2697 return 0;
2698}
2699
2700extern fr_test_point_pair_decode_t der_tp_decode_pair;
2705
2706extern fr_test_point_proto_decode_t der_tp_decode_proto;
unlikely
#define unlikely(_x)
Definition build.h:383
UNUSED
#define UNUSED
Definition build.h:317
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition build.h:339
min
static size_t min(size_t x, size_t y)
Definition dbuff.c:66
fr_dbuff_advance
#define fr_dbuff_advance(_dbuff_or_marker, _len)
Advance 'current' position in dbuff or marker by _len bytes.
Definition dbuff.h:1072
FR_DBUFF_ADVANCE_RETURN
#define FR_DBUFF_ADVANCE_RETURN(_dbuff_or_marker, _len)
Advance the 'current' position in dbuff or marker by _len bytes returning if _len is out of range.
Definition dbuff.h:1088
fr_dbuff_marker_t
struct fr_dbuff_marker_s fr_dbuff_marker_t
A position marker associated with a dbuff.
Definition dbuff.h:81
fr_dbuff_current
#define fr_dbuff_current(_dbuff_or_marker)
Return the 'current' position of a dbuff or marker.
Definition dbuff.h:911
fr_dbuff_set
#define fr_dbuff_set(_dst, _src)
Set the 'current' position in a dbuff or marker using another dbuff or marker, a char pointer,...
Definition dbuff.h:1004
fr_dbuff_out_memcpy
#define fr_dbuff_out_memcpy(_out, _dbuff_or_marker, _outlen)
Copy exactly _outlen bytes from the dbuff.
Definition dbuff.h:1732
fr_dbuff_extend_lowat
#define fr_dbuff_extend_lowat(_status, _dbuff_or_marker, _lowat)
Extend if we're below _lowat.
Definition dbuff.h:660
fr_dbuff_end
#define fr_dbuff_end(_dbuff_or_marker)
Return the current 'end' position of a dbuff or marker.
Definition dbuff.h:938
fr_dbuff_remaining
#define fr_dbuff_remaining(_dbuff_or_marker)
Return the number of bytes remaining between the dbuff or marker and the end of the buffer.
Definition dbuff.h:743
FR_DBUFF_OUT_MEMCPY_RETURN
#define FR_DBUFF_OUT_MEMCPY_RETURN(_out, _dbuff_or_marker, _outlen)
Copy outlen bytes from the dbuff returning if there's insufficient data in the dbuff.
Definition dbuff.h:1752
fr_dbuff_marker
static uint8_t * fr_dbuff_marker(fr_dbuff_marker_t *m, fr_dbuff_t *dbuff)
Initialises a new marker pointing to the 'current' position of the dbuff.
Definition dbuff.h:1192
FR_DBUFF
#define FR_DBUFF(_dbuff_or_marker)
Create a new dbuff pointing to the same underlying buffer.
Definition dbuff.h:222
FR_DBUFF_OUT_RETURN
#define FR_DBUFF_OUT_RETURN(_out, _dbuff_or_marker)
Copy data from a dbuff or marker to a fixed sized C type returning if there is insufficient data.
Definition dbuff.h:1818
fr_dbuff_out
#define fr_dbuff_out(_out, _dbuff_or_marker)
Copy data from a dbuff or marker to a fixed sized C type.
Definition dbuff.h:1799
fr_dbuff_set_end
#define fr_dbuff_set_end(_dst, _end)
Set a new 'end' position in a dbuff or marker.
Definition dbuff.h:1051
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:514
fr_der_tag_t
fr_der_tag_t
Enumeration describing the data types in a DER encoded structure.
Definition der.h:36
FR_DER_TAG_IA5_STRING
@ FR_DER_TAG_IA5_STRING
String of IA5 (7bit) chars.
Definition der.h:50
FR_DER_TAG_SEQUENCE
@ FR_DER_TAG_SEQUENCE
A sequence of DER encoded data (a structure).
Definition der.h:46
FR_DER_TAG_SET
@ FR_DER_TAG_SET
A set of DER encoded data (a structure).
Definition der.h:47
FR_DER_TAG_INTEGER
@ FR_DER_TAG_INTEGER
Arbitrary width signed integer.
Definition der.h:39
FR_DER_TAG_BOOLEAN
@ FR_DER_TAG_BOOLEAN
Boolean true/false.
Definition der.h:38
FR_DER_TAG_CHOICE
@ FR_DER_TAG_CHOICE
A choice of types. Techically not a DER tag, but used to represent a choice.
Definition der.h:58
FR_DER_TAG_UTF8_STRING
@ FR_DER_TAG_UTF8_STRING
String of UTF8 chars.
Definition der.h:45
FR_DER_TAG_UTC_TIME
@ FR_DER_TAG_UTC_TIME
A time in UTC "YYMMDDhhmmssZ" format.
Definition der.h:51
FR_DER_TAG_GENERALIZED_TIME
@ FR_DER_TAG_GENERALIZED_TIME
A time in "YYYYMMDDHHMMSS[.fff]Z" format.
Definition der.h:52
FR_DER_TAG_INVALID
@ FR_DER_TAG_INVALID
Invalid tag.
Definition der.h:37
FR_DER_TAG_NULL
@ FR_DER_TAG_NULL
An empty value.
Definition der.h:42
FR_DER_TAG_OCTETSTRING
@ FR_DER_TAG_OCTETSTRING
String of octets (length field specifies bytes).
Definition der.h:41
FR_DER_TAG_VISIBLE_STRING
@ FR_DER_TAG_VISIBLE_STRING
String of visible chars.
Definition der.h:53
FR_DER_TAG_BITSTRING
@ FR_DER_TAG_BITSTRING
String of bits (length field specifies bits).
Definition der.h:40
FR_DER_TAG_T61_STRING
@ FR_DER_TAG_T61_STRING
String of T61 (8bit) chars.
Definition der.h:49
FR_DER_TAG_ENUMERATED
@ FR_DER_TAG_ENUMERATED
An enumerated value.
Definition der.h:44
FR_DER_TAG_UNIVERSAL_STRING
@ FR_DER_TAG_UNIVERSAL_STRING
String of universal chars.
Definition der.h:55
FR_DER_TAG_PRINTABLE_STRING
@ FR_DER_TAG_PRINTABLE_STRING
String of printable chars.
Definition der.h:48
FR_DER_TAG_GENERAL_STRING
@ FR_DER_TAG_GENERAL_STRING
String of general chars.
Definition der.h:54
FR_DER_TAG_OID
@ FR_DER_TAG_OID
Reference to an OID based attribute.
Definition der.h:43
fr_der_attr_flags_t::optional
bool optional
optional, we MUST already have set 'option'
Definition der.h:108
fr_der_attr_flags_t::is_extensions
bool is_extensions
a list of X.509 extensions
Definition der.h:112
fr_der_attr_flags_t::der_type
fr_der_tag_t der_type
the DER type, which is different from the FreeRADIUS type
Definition der.h:97
fr_der_attr_flags_t::is_option
bool is_option
has an option defined
Definition der.h:107
fr_der_attr_flags_t::is_sequence_of
bool is_sequence_of
sequence_of has been defined
Definition der.h:109
DER_BOOLEAN_TRUE
#define DER_BOOLEAN_TRUE
DER encoded boolean true value.
Definition der.h:93
fr_der_attr_flags_t::is_set_of
bool is_set_of
set_of has been defined
Definition der.h:110
DER_TAG_CONTINUATION
#define DER_TAG_CONTINUATION
Mask to check if the tag is a continuation.
Definition der.h:88
DER_BOOLEAN_FALSE
#define DER_BOOLEAN_FALSE
DER encoded boolean false value.
Definition der.h:92
DER_TAG_CLASS_MASK
#define DER_TAG_CLASS_MASK
Mask to extract the class from the tag.
Definition der.h:84
fr_der_flag_max
#define fr_der_flag_max(_da)
Definition der.h:132
DER_UTC_TIME_LEN
#define DER_UTC_TIME_LEN
Length of the UTC time string.
Definition der.h:80
fr_der_tag_constructed_t
fr_der_tag_constructed_t
Definition der.h:65
FR_DER_TAG_CONSTRUCTED
@ FR_DER_TAG_CONSTRUCTED
This is a sequence or set, it contains children.
Definition der.h:67
FR_DER_TAG_PRIMITIVE
@ FR_DER_TAG_PRIMITIVE
This is a leaf value, it contains no children.
Definition der.h:66
DER_GENERALIZED_TIME_PRECISION_MAX
#define DER_GENERALIZED_TIME_PRECISION_MAX
Maximum precision of the generalized time string.
Definition der.h:82
DER_MAX_STR
#define DER_MAX_STR
Definition der.h:78
fr_der_attr_flags_t::min
uint8_t min
mininum count
Definition der.h:105
fr_der_attr_flags_t::is_oid_and_value
bool is_oid_and_value
is OID+value
Definition der.h:111
fr_der_attr_flags
static fr_der_attr_flags_t const * fr_der_attr_flags(fr_dict_attr_t const *da)
Definition der.h:119
fr_der_attr_flags_t::is_choice
bool is_choice
DER name "choice".
Definition der.h:115
FR_DER_TAG_VALUE_MAX
#define FR_DER_TAG_VALUE_MAX
tags >=max can't exist
Definition der.h:63
fr_der_attr_flags_t::option
uint8_t option
an "attribute number" encoded in the tag field.
Definition der.h:106
fr_der_attr_flags_t::has_default_value
bool has_default_value
a default value exists
Definition der.h:113
fr_der_attr_flags_t::class
fr_der_tag_class_t class
tag Class
Definition der.h:96
DER_GENERALIZED_TIME_LEN_MIN
#define DER_GENERALIZED_TIME_LEN_MIN
Minimum length of the generalized time string.
Definition der.h:81
fr_der_attr_flags_t::max
uint64_t max
maximum count of items in a sequence, set, or string.
Definition der.h:103
fr_der_tag_class_t
fr_der_tag_class_t
Definition der.h:70
FR_DER_CLASS_UNIVERSAL
@ FR_DER_CLASS_UNIVERSAL
Definition der.h:71
fr_der_attr_flags_t
Definition der.h:95
fr_dict_attr_by_name
fr_dict_attr_t const * fr_dict_attr_by_name(fr_dict_attr_err_t *err, fr_dict_attr_t const *parent, char const *attr))
Locate a fr_dict_attr_t by its name.
Definition dict_util.c:3270
fr_dict_attr_unknown_raw_afrom_num
static fr_dict_attr_t * fr_dict_attr_unknown_raw_afrom_num(TALLOC_CTX *ctx, fr_dict_attr_t const *parent, unsigned int attr)
Definition dict.h:585
fr_dict_root
fr_dict_attr_t const * fr_dict_root(fr_dict_t const *dict)
Return the root attribute of a dictionary.
Definition dict_util.c:2407
FR_DICT_ATTR_EXT_PROTOCOL_SPECIFIC
@ FR_DICT_ATTR_EXT_PROTOCOL_SPECIFIC
Protocol specific extensions.
Definition dict.h:175
fr_dict_attr_iterate_children
fr_dict_attr_t const * fr_dict_attr_iterate_children(fr_dict_attr_t const *parent, fr_dict_attr_t const **prev)
Iterate over children of a DA.
Definition dict_util.c:4703
fr_dict_attr_unknown_typed_afrom_num
static fr_dict_attr_t * fr_dict_attr_unknown_typed_afrom_num(TALLOC_CTX *ctx, fr_dict_attr_t const *parent, unsigned int num, fr_type_t type)
Definition dict.h:570
fr_dict_attr_child_by_num
fr_dict_attr_t const * fr_dict_attr_child_by_num(fr_dict_attr_t const *parent, unsigned int attr)
Check if a child attribute exists in a parent using an attribute number.
Definition dict_util.c:3335
in
static fr_slen_t in
Definition dict.h:831
fr_dict_attr_ext
static void * fr_dict_attr_ext(fr_dict_attr_t const *da, fr_dict_attr_ext_t ext)
Definition dict_ext.h:140
fr_dict_attr_ref
static fr_dict_attr_t const * fr_dict_attr_ref(fr_dict_attr_t const *da)
Return the reference associated with a group type attribute.
Definition dict_ext.h:184
value
Test enumeration values.
Definition dict_test.h:92
talloc_free
talloc_free(reap)
FR_TYPE_IPV4_ADDR
@ FR_TYPE_IPV4_ADDR
32 Bit IPv4 Address.
Definition merged_model.c:86
FR_TYPE_TLV
@ FR_TYPE_TLV
Contains nested attributes.
Definition merged_model.c:118
FR_TYPE_IPV6_PREFIX
@ FR_TYPE_IPV6_PREFIX
IPv6 Prefix.
Definition merged_model.c:89
FR_TYPE_MAX
@ FR_TYPE_MAX
Number of defined data types.
Definition merged_model.c:130
FR_TYPE_INT64
@ FR_TYPE_INT64
64 Bit signed integer.
Definition merged_model.c:106
FR_TYPE_IPV6_ADDR
@ FR_TYPE_IPV6_ADDR
128 Bit IPv6 Address.
Definition merged_model.c:88
FR_TYPE_IPV4_PREFIX
@ FR_TYPE_IPV4_PREFIX
IPv4 Prefix.
Definition merged_model.c:87
FR_TYPE_COMBO_IP_ADDR
@ FR_TYPE_COMBO_IP_ADDR
IPv4 or IPv6 address depending on length.
Definition merged_model.c:91
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition merged_model.c:84
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
UINT8_MAX
#define UINT8_MAX
Definition merged_model.c:32
fr_dbuff_t
Definition merged_model.c:41
fr_dict_attr_t
Definition merged_model.c:133
fr_dict_t
Definition merged_model.c:198
fr_sbuff_t
Definition merged_model.c:37
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2937
fr_pair_append
int fr_pair_append(fr_pair_list_t *list, fr_pair_t *to_add)
Add a VP to the end of the list.
Definition pair.c:1347
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:285
fr_pair_value_bstrndup
int fr_pair_value_bstrndup(fr_pair_t *vp, char const *src, size_t len, bool tainted)
Copy data into a "string" type value pair.
Definition pair.c:2787
fr_pair_value_bstr_alloc
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
Definition pair.c:2733
fr_pair_value_mem_alloc
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
Definition pair.c:2886
fr_pair_prepend
int fr_pair_prepend(fr_pair_list_t *list, fr_pair_t *to_add)
Add a VP to the start of the list.
Definition pair.c:1316
decode_test_ctx
static int decode_test_ctx(void **out, TALLOC_CTX *ctx, UNUSED fr_dict_t const *dict)
Definition decode.c:102
fr_der_tags_compatible
bool fr_der_tags_compatible(fr_der_tag_t tag1, fr_der_tag_t tag2)
Definition base.c:98
fr_type_to_der_tag_valid
bool fr_type_to_der_tag_valid(fr_type_t type, fr_der_tag_t tag)
Definition base.c:172
fr_der_tag_to_str
char const * fr_der_tag_to_str(fr_der_tag_t tag)
Definition base.c:75
dict_der
fr_dict_t const * dict_der
Definition base.c:38
fr_der_decode_oid_t
ssize_t(* fr_der_decode_oid_t)(uint64_t subidentifier, void *uctx, bool is_last)
Definition decode.c:52
fr_der_decode_oid_to_da
static ssize_t fr_der_decode_oid_to_da(uint64_t subidentifier, void *uctx, bool is_last)
Decode an OID to a dictionary attribute.
Definition decode.c:540
IS_DER_TAG_CONTINUATION
#define IS_DER_TAG_CONTINUATION(_tag)
Definition decode.c:48
fr_der_decode_oid_to_str_ctx_t::oid_buff
char oid_buff[1024]
Buffer to store the OID string.
Definition decode.c:457
fr_der_decode_oid_and_value
static ssize_t fr_der_decode_oid_and_value(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Decode an OID value pair.
Definition decode.c:1687
fr_der_decode_visible_string
static ssize_t fr_der_decode_visible_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1372
fr_der_decode_generalized_time
static ssize_t fr_der_decode_generalized_time(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1230
fr_der_decode_oid_to_da_ctx_t::ctx
TALLOC_CTX * ctx
Allocation context.
Definition decode.c:526
fr_der_decode_pair_dbuff
static ssize_t fr_der_decode_pair_dbuff(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Function signature for DER decode functions.
Definition decode.c:2369
fr_der_decode_oid_wrapper
static ssize_t fr_der_decode_oid_wrapper(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1654
fr_der_decode_t61_string
static ssize_t fr_der_decode_t61_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1101
fr_der_tag_decode_t::decode
fr_der_decode_t decode
Definition decode.c:64
fr_der_decode_universal_string
static ssize_t fr_der_decode_universal_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1404
fr_der_decode_hdr
static ssize_t fr_der_decode_hdr(fr_dict_attr_t const *parent, fr_dbuff_t *in, uint8_t *tag, size_t *len, fr_der_tag_t expected))
Decode the tag and length fields of a DER encoded structure.
Definition decode.c:1813
fr_der_decode_ipv4_addr
static ssize_t fr_der_decode_ipv4_addr(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1410
IS_DER_LEN_MULTI_BYTE
#define IS_DER_LEN_MULTI_BYTE(_len)
Definition decode.c:50
fr_der_decode_general_string
static ssize_t fr_der_decode_general_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1398
der_tp_decode_proto
fr_test_point_proto_decode_t der_tp_decode_proto
Definition decode.c:2707
oid_and_value_func
static const fr_der_tag_decode_t oid_and_value_func
Definition decode.c:1799
fr_der_decode_proto
static ssize_t fr_der_decode_proto(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t const *data, size_t data_len, void *proto_ctx)
Definition decode.c:2646
fr_der_decode_ipv6_addr
static ssize_t fr_der_decode_ipv6_addr(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1509
fr_der_decode_integer
static ssize_t fr_der_decode_integer(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:136
type_funcs
static const fr_der_tag_decode_t type_funcs[FR_TYPE_MAX]
Definition decode.c:1790
fr_der_decode_bitstring
static ssize_t fr_der_decode_bitstring(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:226
fr_der_decode_choice
static ssize_t fr_der_decode_choice(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Decode a CHOICE type This is where the actual decoding of the CHOICE type happens.
Definition decode.c:1983
fr_der_tag_decode_t::constructed
fr_der_tag_constructed_t constructed
Definition decode.c:63
fr_der_decode_octetstring
static ssize_t fr_der_decode_octetstring(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:370
fr_der_decode_ia5_string
static ssize_t fr_der_decode_ia5_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1142
fr_der_decode_oid_to_str_ctx_t::parent_da
fr_dict_attr_t const * parent_da
Parent dictionary attribute.
Definition decode.c:455
fr_der_decode_null
static ssize_t fr_der_decode_null(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:425
fr_der_decode_enumerated
#define fr_der_decode_enumerated
Definition decode.c:1396
fr_der_decode_oid_to_str_ctx_t::marker
fr_sbuff_marker_t marker
Marker of the current position in the OID buffer.
Definition decode.c:458
fr_der_decode_oid_to_da_ctx_t::parent_list
fr_pair_list_t * parent_list
Parent pair list.
Definition decode.c:528
fr_der_decode_x509_extensions
static ssize_t fr_der_decode_x509_extensions(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dbuff_t *in, fr_dict_attr_t const *parent, fr_der_decode_ctx_t *decode_ctx)
Decode an X509 Extentions Field.
Definition decode.c:2041
fr_der_decode_oid_to_str
static ssize_t fr_der_decode_oid_to_str(uint64_t subidentifier, void *uctx, bool is_last)
Decode an OID to a string.
Definition decode.c:470
fr_der_decode_utf8_string
static ssize_t fr_der_decode_utf8_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:727
fr_der_decode_printable_string
static ssize_t fr_der_decode_printable_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1087
fr_der_decode_oid
static ssize_t fr_der_decode_oid(fr_dbuff_t *in, fr_der_decode_oid_t func, void *uctx)
Decode an OID from a DER encoded buffer using a callback.
Definition decode.c:616
fr_der_decode_oid_to_str_ctx_t::ctx
TALLOC_CTX * ctx
Allocation context.
Definition decode.c:454
fr_der_decode_utc_time
static ssize_t fr_der_decode_utc_time(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1154
fr_der_decode_ipv4_prefix
static ssize_t fr_der_decode_ipv4_prefix(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1458
IS_DER_TAG_CONSTRUCTED
#define IS_DER_TAG_CONSTRUCTED(_tag)
Definition decode.c:49
fr_der_decode_oid_to_da_ctx_t::parent_da
fr_dict_attr_t const * parent_da
Parent dictionary attribute.
Definition decode.c:527
fr_der_decode_t
ssize_t(* fr_der_decode_t)(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:59
fr_der_decode_string
static ssize_t fr_der_decode_string(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, bool const allowed_chars[], fr_der_decode_ctx_t *decode_ctx))
fr_der_decode_set
static ssize_t fr_der_decode_set(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:900
fr_der_decode_ipv6_prefix
static ssize_t fr_der_decode_ipv6_prefix(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1557
tag_funcs
static const fr_der_tag_decode_t tag_funcs[FR_DER_TAG_VALUE_MAX]
Definition decode.c:1766
fr_der_decode_boolean
static ssize_t fr_der_decode_boolean(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:86
der_tp_decode_pair
fr_test_point_pair_decode_t der_tp_decode_pair
Definition decode.c:2701
fr_der_decode_combo_ip_addr
static ssize_t fr_der_decode_combo_ip_addr(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, UNUSED fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:1608
fr_der_decode_oid_to_str_ctx_t::parent_list
fr_pair_list_t * parent_list
Parent pair list.
Definition decode.c:456
fr_der_decode_ctx_t::tmp_ctx
uint8_t * tmp_ctx
Definition decode.c:44
fr_der_decode_sequence
static ssize_t fr_der_decode_sequence(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, fr_dbuff_t *in, fr_der_decode_ctx_t *decode_ctx)
Definition decode.c:737
fr_der_decode_ctx_t
Definition decode.c:43
fr_der_decode_oid_to_da_ctx_t
Definition decode.c:525
fr_der_decode_oid_to_str_ctx_t
Definition decode.c:453
fr_der_tag_decode_t
Definition decode.c:62
decode_pair
static ssize_t decode_pair(TALLOC_CTX *ctx, fr_pair_list_t *out, NDEBUG_UNUSED fr_dict_attr_t const *parent, uint8_t const *data, size_t data_len, void *decode_ctx)
Definition decode.c:502
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
timestr
static char timestr[50]
Definition radsniff.c:55
mask
static uint32_t mask
Definition rbmonkey.c:39
fr_sbuff_adv_past_allowed
size_t fr_sbuff_adv_past_allowed(fr_sbuff_t *sbuff, size_t len, bool const allowed[static UINT8_MAX+1], fr_sbuff_term_t const *tt)
Wind position past characters in the allowed set.
Definition sbuff.c:1777
fr_sbuff_in_sprintf
ssize_t fr_sbuff_in_sprintf(fr_sbuff_t *sbuff, char const *fmt,...)
Print using a fmt string to an sbuff.
Definition sbuff.c:1595
fr_sbuff_set
#define fr_sbuff_set(_dst, _src)
FR_SBUFF_IN_SPRINTF_RETURN
#define FR_SBUFF_IN_SPRINTF_RETURN(...)
FR_SBUFF_OUT
#define FR_SBUFF_OUT(_start, _len_or_end)
fr_sbuff_used
#define fr_sbuff_used(_sbuff_or_marker)
fr_sbuff_ptr_s
Definition sbuff.h:84
vp
fr_pair_t * vp
Definition state_machine.c:2262
fr_struct_from_network
ssize_t fr_struct_from_network(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *parent, uint8_t const *data, size_t data_len, void *decode_ctx, fr_pair_decode_value_t decode_value, fr_pair_decode_value_t decode_tlv)
Convert a STRUCT to one or more VPs.
Definition struct.c:33
pair_list_s
Definition pair.h:52
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
value_pair_s::da
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
Definition pair.h:69
fr_test_point_pair_decode_t::test_ctx
fr_test_point_ctx_alloc_t test_ctx
Allocate a test ctx for the encoder.
Definition test_point.h:85
fr_test_point_proto_decode_t::test_ctx
fr_test_point_ctx_alloc_t test_ctx
Allocate a test ctx for the encoder.
Definition test_point.h:67
fr_test_point_pair_decode_t
Entry point for pair decoders.
Definition test_point.h:84
fr_test_point_proto_decode_t
Entry point for protocol decoders.
Definition test_point.h:66
fr_unix_time_from_tm
fr_unix_time_t fr_unix_time_from_tm(struct tm *tm)
Definition time.c:672
fr_time_delta_wrap
#define fr_time_delta_wrap(_time)
Definition time.h:152
fr_unix_time_add
#define fr_unix_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:324
fr_pair_list_num_elements
size_t fr_pair_list_num_elements(fr_pair_list_t const *list)
Get the length of a list of fr_pair_t.
Definition pair_inline.c:151
parent
static fr_slen_t parent
Definition pair.h:845
FR_PROTO_HEX_DUMP
#define FR_PROTO_HEX_DUMP(_data, _data_len, _fmt,...)
Definition proto.h:41
FR_PROTO_TRACE
#define FR_PROTO_TRACE(_fmt,...)
Definition proto.h:40
fr_strerror_printf_push
#define fr_strerror_printf_push(_fmt,...)
Add a message to an existing stack of messages at the tail.
Definition strerror.h:84
fr_strerror_const_push
#define fr_strerror_const_push(_msg)
Definition strerror.h:227
fr_strerror_const
#define fr_strerror_const(_msg)
Definition strerror.h:223
fr_type_is_group
#define fr_type_is_group(_x)
Definition types.h:355
fr_type_is_octets
#define fr_type_is_octets(_x)
Definition types.h:328
fr_type_is_variable_size
#define fr_type_is_variable_size(_x)
Definition types.h:367
fr_type_is_date
#define fr_type_is_date(_x)
Definition types.h:348
fr_type_is_string
#define fr_type_is_string(_x)
Definition types.h:327
fr_type_is_bool
#define fr_type_is_bool(_x)
Definition types.h:337
fr_type_is_tlv
#define fr_type_is_tlv(_x)
Definition types.h:351
fr_type_to_str
static char const * fr_type_to_str(fr_type_t type)
Return a static string containing the type name.
Definition types.h:433
fr_type_is_struct
#define fr_type_is_struct(_x)
Definition types.h:352
fr_value_box_copy
int fr_value_box_copy(TALLOC_CTX *ctx, fr_value_box_t *dst, const fr_value_box_t *src)
Copy value data verbatim duplicating any buffers.
Definition value.c:3759
data
static fr_slen_t data
Definition value.h:1274
nonnull
int nonnull(2, 5))
out
static size_t char ** out
Definition value.h:1012
Generated by   doxygen 1.9.8