src/libcharon/encoding/parser.c

   1 /*
   2  * Copyright (C) 2005-2009 Martin Willi
   3  * Copyright (C) 2005 Jan Hutter
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <stdlib.h>
  18 #include <arpa/inet.h>
  19 #include <string.h>
  20
  21 #include "parser.h"
  22
  23 #include <library.h>
  24 #include <daemon.h>
  25 #include <utils/linked_list.h>
  26 #include <encoding/payloads/encodings.h>
  27 #include <encoding/payloads/payload.h>
  28 #include <encoding/payloads/sa_payload.h>
  29 #include <encoding/payloads/proposal_substructure.h>
  30 #include <encoding/payloads/transform_substructure.h>
  31 #include <encoding/payloads/transform_attribute.h>
  32 #include <encoding/payloads/ke_payload.h>
  33 #include <encoding/payloads/nonce_payload.h>
  34 #include <encoding/payloads/id_payload.h>
  35 #include <encoding/payloads/notify_payload.h>
  36 #include <encoding/payloads/encryption_payload.h>
  37 #include <encoding/payloads/auth_payload.h>
  38 #include <encoding/payloads/cert_payload.h>
  39 #include <encoding/payloads/certreq_payload.h>
  40 #include <encoding/payloads/ts_payload.h>
  41 #include <encoding/payloads/delete_payload.h>
  42 #include <encoding/payloads/vendor_id_payload.h>
  43 #include <encoding/payloads/cp_payload.h>
  44 #include <encoding/payloads/configuration_attribute.h>
  45 #include <encoding/payloads/eap_payload.h>
  46 #include <encoding/payloads/unknown_payload.h>
  47
  48
  49 typedef struct private_parser_t private_parser_t;
  50
  51 /**
  52  * Private data stored in a context.
  53  *
  54  * Contains pointers and counters to store current state.
  55  */
  56 struct private_parser_t {
  57         /**
  58          * Public members, see parser_t.
  59          */
  60         parser_t public;
  61
  62         /**
  63          * Current bit for reading in input data.
  64          */
  65         u_int8_t bit_pos;
  66
  67         /**
  68          * Current byte for reading in input data.
  69          */
  70         u_int8_t *byte_pos;
  71
  72         /**
  73          * Input data to parse.
  74          */
  75         u_int8_t *input;
  76
  77         /**
  78          * Roof of input, used for length-checking.
  79          */
  80         u_int8_t *input_roof;
  81
  82         /**
  83          * Set of encoding rules for this parsing session.
  84          */
  85         encoding_rule_t *rules;
  86 };
  87
  88 /**
  89  * Log invalid length error
  90  */
  91 static bool short_input(private_parser_t *this, int number)
  92 {
  93         DBG1(DBG_ENC, "  not enough input to parse rule %d %N",
  94                  number, encoding_type_names, this->rules[number].type);
  95         return FALSE;
  96 }
  97
  98 /**
  99  * Log unaligned rules
 100  */
 101 static bool bad_bitpos(private_parser_t *this, int number)
 102 {
 103         DBG1(DBG_ENC, "  found rule %d %N on bitpos %d",
 104                  number, encoding_type_names, this->rules[number].type, this->bit_pos);
 105         return FALSE;
 106 }
 107
 108 /**
 109  * Parse a 4-Bit unsigned integer from the current parsing position.
 110  */
 111 static bool parse_uint4(private_parser_t *this, int rule_number,
 112                                                 u_int8_t *output_pos)
 113 {
 114         if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 115         {
 116                 return short_input(this, rule_number);
 117         }
 118         switch (this->bit_pos)
 119         {
 120                 case 0:
 121                         if (output_pos)
 122                         {
 123                                 *output_pos = *(this->byte_pos) >> 4;
 124                         }
 125                         this->bit_pos = 4;
 126                         break;
 127                 case 4:
 128                         if (output_pos)
 129                         {
 130                                 *output_pos = *(this->byte_pos) & 0x0F;
 131                         }
 132                         this->bit_pos = 0;
 133                         this->byte_pos++;
 134                         break;
 135                 default:
 136                         return bad_bitpos(this, rule_number);
 137         }
 138         if (output_pos)
 139         {
 140                 DBG3(DBG_ENC, "   => %d", *output_pos);
 141         }
 142         return TRUE;
 143 }
 144
 145 /**
 146  * Parse a 8-Bit unsigned integer from the current parsing position.
 147  */
 148 static bool parse_uint8(private_parser_t *this, int rule_number,
 149                                                 u_int8_t *output_pos)
 150 {
 151         if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 152         {
 153                 return short_input(this, rule_number);
 154         }
 155         if (this->bit_pos)
 156         {
 157                 return bad_bitpos(this, rule_number);
 158         }
 159         if (output_pos)
 160         {
 161                 *output_pos = *(this->byte_pos);
 162                 DBG3(DBG_ENC, "   => %d", *output_pos);
 163         }
 164         this->byte_pos++;
 165         return TRUE;
 166 }
 167
 168 /**
 169  * Parse a 15-Bit unsigned integer from the current parsing position.
 170  */
 171 static bool parse_uint15(private_parser_t *this, int rule_number,
 172                                                  u_int16_t *output_pos)
 173 {
 174         if (this->byte_pos + sizeof(u_int16_t) > this->input_roof)
 175         {
 176                 return short_input(this, rule_number);
 177         }
 178         if (this->bit_pos != 1)
 179         {
 180                 return bad_bitpos(this, rule_number);
 181         }
 182         if (output_pos)
 183         {
 184                 memcpy(output_pos, this->byte_pos, sizeof(u_int16_t));
 185                 *output_pos = ntohs(*output_pos) & ~0x8000;
 186                 DBG3(DBG_ENC, "   => %d", *output_pos);
 187         }
 188         this->byte_pos += sizeof(u_int16_t);
 189         this->bit_pos = 0;
 190         return TRUE;
 191 }
 192
 193 /**
 194  * Parse a 16-Bit unsigned integer from the current parsing position.
 195  */
 196 static bool parse_uint16(private_parser_t *this, int rule_number,
 197                                                  u_int16_t *output_pos)
 198 {
 199         if (this->byte_pos + sizeof(u_int16_t) > this->input_roof)
 200         {
 201                 return short_input(this, rule_number);
 202         }
 203         if (this->bit_pos)
 204         {
 205                 return bad_bitpos(this, rule_number);
 206         }
 207         if (output_pos)
 208         {
 209                 memcpy(output_pos, this->byte_pos, sizeof(u_int16_t));
 210                 *output_pos = ntohs(*output_pos);
 211                 DBG3(DBG_ENC, "   => %d", *output_pos);
 212         }
 213         this->byte_pos += sizeof(u_int16_t);
 214         return TRUE;
 215 }
 216 /**
 217  * Parse a 32-Bit unsigned integer from the current parsing position.
 218  */
 219 static bool parse_uint32(private_parser_t *this, int rule_number,
 220                                                  u_int32_t *output_pos)
 221 {
 222         if (this->byte_pos + sizeof(u_int32_t) > this->input_roof)
 223         {
 224                 return short_input(this, rule_number);
 225         }
 226         if (this->bit_pos)
 227         {
 228                 return bad_bitpos(this, rule_number);
 229         }
 230         if (output_pos)
 231         {
 232                 memcpy(output_pos, this->byte_pos, sizeof(u_int32_t));
 233                 *output_pos = ntohl(*output_pos);
 234                 DBG3(DBG_ENC, "   => %d", *output_pos);
 235         }
 236         this->byte_pos += sizeof(u_int32_t);
 237         return TRUE;
 238 }
 239
 240 /**
 241  * Parse a given amount of bytes and writes them to a specific location
 242  */
 243 static bool parse_bytes(private_parser_t *this, int rule_number,
 244                                                 u_int8_t *output_pos, int bytes)
 245 {
 246         if (this->byte_pos + bytes > this->input_roof)
 247         {
 248                 return short_input(this, rule_number);
 249         }
 250         if (this->bit_pos)
 251         {
 252                 return bad_bitpos(this, rule_number);
 253         }
 254         if (output_pos)
 255         {
 256                 memcpy(output_pos, this->byte_pos, bytes);
 257                 DBG3(DBG_ENC, "   => %b", output_pos, bytes);
 258         }
 259         this->byte_pos += bytes;
 260         return TRUE;
 261 }
 262
 263 /**
 264  * Parse a single Bit from the current parsing position
 265  */
 266 static bool parse_bit(private_parser_t *this, int rule_number,
 267                                           bool *output_pos)
 268 {
 269         if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 270         {
 271                 return short_input(this, rule_number);
 272         }
 273         if (output_pos)
 274         {
 275                 u_int8_t mask;
 276                 mask = 0x01 << (7 - this->bit_pos);
 277                 *output_pos = *this->byte_pos & mask;
 278
 279                 if (*output_pos)
 280                 {       /* set to a "clean", comparable true */
 281                         *output_pos = TRUE;
 282                 }
 283                 DBG3(DBG_ENC, "   => %d", *output_pos);
 284         }
 285         this->bit_pos = (this->bit_pos + 1) % 8;
 286         if (this->bit_pos == 0)
 287         {
 288                 this->byte_pos++;
 289         }
 290         return TRUE;
 291 }
 292
 293 /**
 294  * Parse substructures in a list.
 295  */
 296 static bool parse_list(private_parser_t *this, int rule_number,
 297                         linked_list_t **output_pos, payload_type_t payload_type, int length)
 298 {
 299         linked_list_t *list = *output_pos;
 300
 301         if (length < 0)
 302         {
 303                 return short_input(this, rule_number);
 304         }
 305         if (this->bit_pos)
 306         {
 307                 return bad_bitpos(this, rule_number);
 308         }
 309         while (length > 0)
 310         {
 311                 u_int8_t *pos_before = this->byte_pos;
 312                 payload_t *payload;
 313
 314                 DBG2(DBG_ENC, "  %d bytes left, parsing recursively %N",
 315                          length, payload_type_names, payload_type);
 316
 317                 if (this->public.parse_payload(&this->public, payload_type,
 318                                                                            &payload) != SUCCESS)
 319                 {
 320                         DBG1(DBG_ENC, "  parsing of a %N substructure failed",
 321                                  payload_type_names, payload_type);
 322                         return FALSE;
 323                 }
 324                 list->insert_last(list, payload);
 325                 length -= this->byte_pos - pos_before;
 326         }
 327         if (length != 0)
 328         {       /* must yield exactly to zero */
 329                 DBG1(DBG_ENC, "  length of %N substructure list invalid",
 330                          payload_type_names, payload_type);
 331                 return FALSE;
 332         }
 333         *output_pos = list;
 334         return TRUE;
 335 }
 336
 337 /**
 338  * Parse data from current parsing position in a chunk.
 339  */
 340 static bool parse_chunk(private_parser_t *this, int rule_number,
 341                                                 chunk_t *output_pos, int length)
 342 {
 343         if (this->byte_pos + length > this->input_roof)
 344         {
 345                 return short_input(this, rule_number);
 346         }
 347         if (this->bit_pos)
 348         {
 349                 return bad_bitpos(this, rule_number);
 350         }
 351         if (output_pos)
 352         {
 353                 *output_pos = chunk_alloc(length);
 354                 memcpy(output_pos->ptr, this->byte_pos, length);
 355                 DBG3(DBG_ENC, "   => %b", output_pos->ptr, length);
 356         }
 357         this->byte_pos += length;
 358         return TRUE;
 359 }
 360
 361 /**
 362  * Map a encoding type to a encoded payload
 363  */
 364 static payload_type_t map_wrapped_payload(encoding_type_t type)
 365 {
 366         switch (type)
 367         {
 368                 case PROPOSALS:
 369                         return PROPOSAL_SUBSTRUCTURE;
 370                 case PROPOSALS_V1:
 371                         return PROPOSAL_SUBSTRUCTURE_V1;
 372                 case TRANSFORMS:
 373                         return TRANSFORM_SUBSTRUCTURE;
 374                 case TRANSFORMS_V1:
 375                         return TRANSFORM_SUBSTRUCTURE_V1;
 376                 case TRANSFORM_ATTRIBUTES:
 377                         return TRANSFORM_ATTRIBUTE;
 378                 case TRANSFORM_ATTRIBUTES_V1:
 379                         return TRANSFORM_ATTRIBUTE_V1;
 380                 case CONFIGURATION_ATTRIBUTES:
 381                         return CONFIGURATION_ATTRIBUTE;
 382                 case TRAFFIC_SELECTORS:
 383                         return TRAFFIC_SELECTOR_SUBSTRUCTURE;
 384                 default:
 385                         return NO_PAYLOAD;
 386         }
 387 }
 388
 389 METHOD(parser_t, parse_payload, status_t,
 390         private_parser_t *this, payload_type_t payload_type, payload_t **payload)
 391 {
 392         payload_t *pld;
 393         void *output;
 394         int payload_length = 0, spi_size = 0, attribute_length = 0, header_length;
 395         u_int16_t ts_type = 0;
 396         bool attribute_format = FALSE;
 397         int rule_number, rule_count;
 398         encoding_rule_t *rule;
 399
 400         /* create instance of the payload to parse */
 401         pld = payload_create(payload_type);
 402
 403         DBG2(DBG_ENC, "parsing %N payload, %d bytes left",
 404                  payload_type_names, payload_type, this->input_roof - this->byte_pos);
 405
 406         DBG3(DBG_ENC, "parsing payload from %b",
 407                  this->byte_pos, this->input_roof - this->byte_pos);
 408
 409         /* base pointer for output, avoids casting in every rule */
 410         output = pld;
 411
 412         header_length = pld->get_header_length(pld);
 413         /* parse the payload with its own rulse */
 414         rule_count = pld->get_encoding_rules(pld, &this->rules);
 415         for (rule_number = 0; rule_number < rule_count; rule_number++)
 416         {
 417                 rule = &(this->rules[rule_number]);
 418                 DBG2(DBG_ENC, "  parsing rule %d %N",
 419                          rule_number, encoding_type_names, rule->type);
 420                 switch (rule->type)
 421                 {
 422                         case U_INT_4:
 423                         {
 424                                 if (!parse_uint4(this, rule_number, output + rule->offset))
 425                                 {
 426                                         pld->destroy(pld);
 427                                         return PARSE_ERROR;
 428                                 }
 429                                 break;
 430                         }
 431                         case U_INT_8:
 432                         case RESERVED_BYTE:
 433                         {
 434                                 if (!parse_uint8(this, rule_number, output + rule->offset))
 435                                 {
 436                                         pld->destroy(pld);
 437                                         return PARSE_ERROR;
 438                                 }
 439                                 break;
 440                         }
 441                         case U_INT_16:
 442                         {
 443                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 444                                 {
 445                                         pld->destroy(pld);
 446                                         return PARSE_ERROR;
 447                                 }
 448                                 break;
 449                         }
 450                         case U_INT_32:
 451                         case HEADER_LENGTH:
 452                         {
 453                                 if (!parse_uint32(this, rule_number, output + rule->offset))
 454                                 {
 455                                         pld->destroy(pld);
 456                                         return PARSE_ERROR;
 457                                 }
 458                                 break;
 459                         }
 460                         case IKE_SPI:
 461                         {
 462                                 if (!parse_bytes(this, rule_number, output + rule->offset, 8))
 463                                 {
 464                                         pld->destroy(pld);
 465                                         return PARSE_ERROR;
 466                                 }
 467                                 break;
 468                         }
 469                         case RESERVED_BIT:
 470                         case FLAG:
 471                         {
 472                                 if (!parse_bit(this, rule_number, output + rule->offset))
 473                                 {
 474                                         pld->destroy(pld);
 475                                         return PARSE_ERROR;
 476                                 }
 477                                 break;
 478                         }
 479                         case PAYLOAD_LENGTH:
 480                         {
 481                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 482                                 {
 483                                         pld->destroy(pld);
 484                                         return PARSE_ERROR;
 485                                 }
 486                                 /* parsed u_int16 should be aligned */
 487                                 payload_length = *(u_int16_t*)(output + rule->offset);
 488                                 /* all payloads must have at least 4 bytes header */
 489                                 if (payload_length < 4)
 490                                 {
 491                                         pld->destroy(pld);
 492                                         return PARSE_ERROR;
 493                                 }
 494                                 break;
 495                         }
 496                         case SPI_SIZE:
 497                         {
 498                                 if (!parse_uint8(this, rule_number, output + rule->offset))
 499                                 {
 500                                         pld->destroy(pld);
 501                                         return PARSE_ERROR;
 502                                 }
 503                                 spi_size = *(u_int8_t*)(output + rule->offset);
 504                                 break;
 505                         }
 506                         case SPI:
 507                         {
 508                                 if (!parse_chunk(this, rule_number, output + rule->offset,
 509                                                                  spi_size))
 510                                 {
 511                                         pld->destroy(pld);
 512                                         return PARSE_ERROR;
 513                                 }
 514                                 break;
 515                         }
 516                         /* lists */
 517                         case PROPOSALS:
 518                         case PROPOSALS_V1:
 519                         case TRANSFORMS:
 520                         case TRANSFORMS_V1:
 521                         case TRANSFORM_ATTRIBUTES:
 522                         case TRANSFORM_ATTRIBUTES_V1:
 523                         case TRAFFIC_SELECTORS:
 524                         {
 525                                 if (payload_length < header_length ||
 526                                         !parse_list(this, rule_number, output + rule->offset,
 527                                                                 map_wrapped_payload(rule->type),
 528                                                                 payload_length - header_length))
 529                                 {
 530                                         pld->destroy(pld);
 531                                         return PARSE_ERROR;
 532                                 }
 533                                 break;
 534                         }
 535                         /* chunks */
 536                         case NONCE_DATA:
 537                         case ID_DATA:
 538                         case AUTH_DATA:
 539                         case CERT_DATA:
 540                         case CERTREQ_DATA:
 541                         case EAP_DATA:
 542                         case SPIS:
 543                         case VID_DATA:
 544                         case CONFIGURATION_ATTRIBUTE_VALUE:
 545                         case KEY_EXCHANGE_DATA:
 546                         case KEY_EXCHANGE_DATA_V1:
 547                         case NOTIFICATION_DATA:
 548                         case ENCRYPTED_DATA:
 549                         case UNKNOWN_DATA:
 550                         {
 551                                 if (payload_length < header_length ||
 552                                         !parse_chunk(this, rule_number, output + rule->offset,
 553                                                                  payload_length - header_length))
 554                                 {
 555                                         pld->destroy(pld);
 556                                         return PARSE_ERROR;
 557                                 }
 558                                 break;
 559                         }
 560                         case ATTRIBUTE_FORMAT:
 561                         {
 562                                 if (!parse_bit(this, rule_number, output + rule->offset))
 563                                 {
 564                                         pld->destroy(pld);
 565                                         return PARSE_ERROR;
 566                                 }
 567                                 attribute_format = *(bool*)(output + rule->offset);
 568                                 break;
 569                         }
 570                         case ATTRIBUTE_TYPE:
 571                         {
 572                                 if (!parse_uint15(this, rule_number, output + rule->offset))
 573                                 {
 574                                         pld->destroy(pld);
 575                                         return PARSE_ERROR;
 576                                 }
 577                                 break;
 578                         }
 579                         case CONFIGURATION_ATTRIBUTE_LENGTH:
 580                         {
 581                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 582                                 {
 583                                         pld->destroy(pld);
 584                                         return PARSE_ERROR;
 585                                 }
 586                                 attribute_length = *(u_int16_t*)(output + rule->offset);
 587                                 break;
 588                         }
 589                         case ATTRIBUTE_LENGTH_OR_VALUE:
 590                         {
 591                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 592                                 {
 593                                         pld->destroy(pld);
 594                                         return PARSE_ERROR;
 595                                 }
 596                                 attribute_length = *(u_int16_t*)(output + rule->offset);
 597                                 break;
 598                         }
 599                         case ATTRIBUTE_VALUE:
 600                         {
 601                                 if (attribute_format == FALSE &&
 602                                         !parse_chunk(this, rule_number, output + rule->offset,
 603                                                                  attribute_length))
 604                                 {
 605                                         pld->destroy(pld);
 606                                         return PARSE_ERROR;
 607                                 }
 608                                 break;
 609                         }
 610                         case TS_TYPE:
 611                         {
 612                                 if (!parse_uint8(this, rule_number, output + rule->offset))
 613                                 {
 614                                         pld->destroy(pld);
 615                                         return PARSE_ERROR;
 616                                 }
 617                                 ts_type = *(u_int8_t*)(output + rule->offset);
 618                                 break;
 619                         }
 620                         case ADDRESS:
 621                         {
 622                                 int address_length = (ts_type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 623
 624                                 if (!parse_chunk(this, rule_number, output + rule->offset,
 625                                                                  address_length))
 626                                 {
 627                                         pld->destroy(pld);
 628                                         return PARSE_ERROR;
 629                                 }
 630                                 break;
 631                         }
 632                         default:
 633                         {
 634                                 DBG1(DBG_ENC, "  no rule to parse rule %d %N",
 635                                          rule_number, encoding_type_names, rule->type);
 636                                 pld->destroy(pld);
 637                                 return PARSE_ERROR;
 638                         }
 639                 }
 640                 /* process next rulue */
 641                 rule++;
 642         }
 643
 644         *payload = pld;
 645         DBG2(DBG_ENC, "parsing %N payload finished",
 646                  payload_type_names, payload_type);
 647         return SUCCESS;
 648 }
 649
 650 METHOD(parser_t, get_remaining_byte_count, int,
 651         private_parser_t *this)
 652 {
 653         return this->input_roof - this->byte_pos;
 654 }
 655
 656 METHOD(parser_t, reset_context, void,
 657         private_parser_t *this)
 658 {
 659         this->byte_pos = this->input;
 660         this->bit_pos = 0;
 661 }
 662
 663 METHOD(parser_t, destroy, void,
 664         private_parser_t *this)
 665 {
 666         free(this);
 667 }
 668
 669 /*
 670  * Described in header.
 671  */
 672 parser_t *parser_create(chunk_t data)
 673 {
 674         private_parser_t *this;
 675
 676         INIT(this,
 677                 .public = {
 678                         .parse_payload = _parse_payload,
 679                         .reset_context = _reset_context,
 680                         .get_remaining_byte_count = _get_remaining_byte_count,
 681                         .destroy = _destroy,
 682                 },
 683                 .input = data.ptr,
 684                 .byte_pos = data.ptr,
 685                 .input_roof = data.ptr + data.len,
 686         );
 687
 688         return &this->public;
 689 }
 690