src/libcharon/encoding/parser.c

   1 /*
   2  * Copyright (C) 2005-2009 Martin Willi
   3  * Copyright (C) 2005 Jan Hutter
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <stdlib.h>
  18 #include <arpa/inet.h>
  19 #include <string.h>
  20
  21 #include "parser.h"
  22
  23 #include <library.h>
  24 #include <daemon.h>
  25 #include <collections/linked_list.h>
  26 #include <encoding/payloads/encodings.h>
  27 #include <encoding/payloads/payload.h>
  28 #include <encoding/payloads/sa_payload.h>
  29 #include <encoding/payloads/proposal_substructure.h>
  30 #include <encoding/payloads/transform_substructure.h>
  31 #include <encoding/payloads/transform_attribute.h>
  32 #include <encoding/payloads/ke_payload.h>
  33 #include <encoding/payloads/nonce_payload.h>
  34 #include <encoding/payloads/id_payload.h>
  35 #include <encoding/payloads/notify_payload.h>
  36 #include <encoding/payloads/encryption_payload.h>
  37 #include <encoding/payloads/auth_payload.h>
  38 #include <encoding/payloads/cert_payload.h>
  39 #include <encoding/payloads/certreq_payload.h>
  40 #include <encoding/payloads/ts_payload.h>
  41 #include <encoding/payloads/delete_payload.h>
  42 #include <encoding/payloads/vendor_id_payload.h>
  43 #include <encoding/payloads/cp_payload.h>
  44 #include <encoding/payloads/configuration_attribute.h>
  45 #include <encoding/payloads/eap_payload.h>
  46 #include <encoding/payloads/unknown_payload.h>
  47
  48
  49 typedef struct private_parser_t private_parser_t;
  50
  51 /**
  52  * Private data stored in a context.
  53  *
  54  * Contains pointers and counters to store current state.
  55  */
  56 struct private_parser_t {
  57         /**
  58          * Public members, see parser_t.
  59          */
  60         parser_t public;
  61
  62         /**
  63          * Current bit for reading in input data.
  64          */
  65         u_int8_t bit_pos;
  66
  67         /**
  68          * Current byte for reading in input data.
  69          */
  70         u_int8_t *byte_pos;
  71
  72         /**
  73          * Input data to parse.
  74          */
  75         u_int8_t *input;
  76
  77         /**
  78          * Roof of input, used for length-checking.
  79          */
  80         u_int8_t *input_roof;
  81
  82         /**
  83          * Set of encoding rules for this parsing session.
  84          */
  85         encoding_rule_t *rules;
  86 };
  87
  88 /**
  89  * Log invalid length error
  90  */
  91 static bool short_input(private_parser_t *this, int number)
  92 {
  93         DBG1(DBG_ENC, "  not enough input to parse rule %d %N",
  94                  number, encoding_type_names, this->rules[number].type);
  95         return FALSE;
  96 }
  97
  98 /**
  99  * Log unaligned rules
 100  */
 101 static bool bad_bitpos(private_parser_t *this, int number)
 102 {
 103         DBG1(DBG_ENC, "  found rule %d %N on bitpos %d",
 104                  number, encoding_type_names, this->rules[number].type, this->bit_pos);
 105         return FALSE;
 106 }
 107
 108 /**
 109  * Parse a 4-Bit unsigned integer from the current parsing position.
 110  */
 111 static bool parse_uint4(private_parser_t *this, int rule_number,
 112                                                 u_int8_t *output_pos)
 113 {
 114         if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 115         {
 116                 return short_input(this, rule_number);
 117         }
 118         switch (this->bit_pos)
 119         {
 120                 case 0:
 121                         if (output_pos)
 122                         {
 123                                 *output_pos = *(this->byte_pos) >> 4;
 124                         }
 125                         this->bit_pos = 4;
 126                         break;
 127                 case 4:
 128                         if (output_pos)
 129                         {
 130                                 *output_pos = *(this->byte_pos) & 0x0F;
 131                         }
 132                         this->bit_pos = 0;
 133                         this->byte_pos++;
 134                         break;
 135                 default:
 136                         return bad_bitpos(this, rule_number);
 137         }
 138         if (output_pos)
 139         {
 140                 DBG3(DBG_ENC, "   => %hhu", *output_pos);
 141         }
 142         return TRUE;
 143 }
 144
 145 /**
 146  * Parse a 8-Bit unsigned integer from the current parsing position.
 147  */
 148 static bool parse_uint8(private_parser_t *this, int rule_number,
 149                                                 u_int8_t *output_pos)
 150 {
 151         if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 152         {
 153                 return short_input(this, rule_number);
 154         }
 155         if (this->bit_pos)
 156         {
 157                 return bad_bitpos(this, rule_number);
 158         }
 159         if (output_pos)
 160         {
 161                 *output_pos = *(this->byte_pos);
 162                 DBG3(DBG_ENC, "   => %hhu", *output_pos);
 163         }
 164         this->byte_pos++;
 165         return TRUE;
 166 }
 167
 168 /**
 169  * Parse a 15-Bit unsigned integer from the current parsing position.
 170  */
 171 static bool parse_uint15(private_parser_t *this, int rule_number,
 172                                                  u_int16_t *output_pos)
 173 {
 174         if (this->byte_pos + sizeof(u_int16_t) > this->input_roof)
 175         {
 176                 return short_input(this, rule_number);
 177         }
 178         if (this->bit_pos != 1)
 179         {
 180                 return bad_bitpos(this, rule_number);
 181         }
 182         if (output_pos)
 183         {
 184                 memcpy(output_pos, this->byte_pos, sizeof(u_int16_t));
 185                 *output_pos = ntohs(*output_pos) & ~0x8000;
 186                 DBG3(DBG_ENC, "   => %hu", *output_pos);
 187         }
 188         this->byte_pos += sizeof(u_int16_t);
 189         this->bit_pos = 0;
 190         return TRUE;
 191 }
 192
 193 /**
 194  * Parse a 16-Bit unsigned integer from the current parsing position.
 195  */
 196 static bool parse_uint16(private_parser_t *this, int rule_number,
 197                                                  u_int16_t *output_pos)
 198 {
 199         if (this->byte_pos + sizeof(u_int16_t) > this->input_roof)
 200         {
 201                 return short_input(this, rule_number);
 202         }
 203         if (this->bit_pos)
 204         {
 205                 return bad_bitpos(this, rule_number);
 206         }
 207         if (output_pos)
 208         {
 209                 memcpy(output_pos, this->byte_pos, sizeof(u_int16_t));
 210                 *output_pos = ntohs(*output_pos);
 211                 DBG3(DBG_ENC, "   => %hu", *output_pos);
 212         }
 213         this->byte_pos += sizeof(u_int16_t);
 214         return TRUE;
 215 }
 216 /**
 217  * Parse a 32-Bit unsigned integer from the current parsing position.
 218  */
 219 static bool parse_uint32(private_parser_t *this, int rule_number,
 220                                                  u_int32_t *output_pos)
 221 {
 222         if (this->byte_pos + sizeof(u_int32_t) > this->input_roof)
 223         {
 224                 return short_input(this, rule_number);
 225         }
 226         if (this->bit_pos)
 227         {
 228                 return bad_bitpos(this, rule_number);
 229         }
 230         if (output_pos)
 231         {
 232                 memcpy(output_pos, this->byte_pos, sizeof(u_int32_t));
 233                 *output_pos = ntohl(*output_pos);
 234                 DBG3(DBG_ENC, "   => %u", *output_pos);
 235         }
 236         this->byte_pos += sizeof(u_int32_t);
 237         return TRUE;
 238 }
 239
 240 /**
 241  * Parse a given amount of bytes and writes them to a specific location
 242  */
 243 static bool parse_bytes(private_parser_t *this, int rule_number,
 244                                                 u_int8_t *output_pos, int bytes)
 245 {
 246         if (this->byte_pos + bytes > this->input_roof)
 247         {
 248                 return short_input(this, rule_number);
 249         }
 250         if (this->bit_pos)
 251         {
 252                 return bad_bitpos(this, rule_number);
 253         }
 254         if (output_pos)
 255         {
 256                 memcpy(output_pos, this->byte_pos, bytes);
 257                 DBG3(DBG_ENC, "   %b", output_pos, bytes);
 258         }
 259         this->byte_pos += bytes;
 260         return TRUE;
 261 }
 262
 263 /**
 264  * Parse a single Bit from the current parsing position
 265  */
 266 static bool parse_bit(private_parser_t *this, int rule_number,
 267                                           bool *output_pos)
 268 {
 269         if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 270         {
 271                 return short_input(this, rule_number);
 272         }
 273         if (output_pos)
 274         {
 275                 u_int8_t mask;
 276                 mask = 0x01 << (7 - this->bit_pos);
 277                 *output_pos = *this->byte_pos & mask;
 278
 279                 if (*output_pos)
 280                 {       /* set to a "clean", comparable true */
 281                         *output_pos = TRUE;
 282                 }
 283                 DBG3(DBG_ENC, "   => %d", *output_pos);
 284         }
 285         this->bit_pos = (this->bit_pos + 1) % 8;
 286         if (this->bit_pos == 0)
 287         {
 288                 this->byte_pos++;
 289         }
 290         return TRUE;
 291 }
 292
 293 /**
 294  * Parse substructures in a list.
 295  */
 296 static bool parse_list(private_parser_t *this, int rule_number,
 297                         linked_list_t **output_pos, payload_type_t payload_type, int length)
 298 {
 299         linked_list_t *list = *output_pos;
 300
 301         if (length < 0)
 302         {
 303                 return short_input(this, rule_number);
 304         }
 305         if (this->bit_pos)
 306         {
 307                 return bad_bitpos(this, rule_number);
 308         }
 309         while (length > 0)
 310         {
 311                 u_int8_t *pos_before = this->byte_pos;
 312                 payload_t *payload;
 313
 314                 DBG2(DBG_ENC, "  %d bytes left, parsing recursively %N",
 315                          length, payload_type_names, payload_type);
 316
 317                 if (this->public.parse_payload(&this->public, payload_type,
 318                                                                            &payload) != SUCCESS)
 319                 {
 320                         DBG1(DBG_ENC, "  parsing of a %N substructure failed",
 321                                  payload_type_names, payload_type);
 322                         return FALSE;
 323                 }
 324                 list->insert_last(list, payload);
 325                 length -= this->byte_pos - pos_before;
 326         }
 327         if (length != 0)
 328         {       /* must yield exactly to zero */
 329                 DBG1(DBG_ENC, "  length of %N substructure list invalid",
 330                          payload_type_names, payload_type);
 331                 return FALSE;
 332         }
 333         *output_pos = list;
 334         return TRUE;
 335 }
 336
 337 /**
 338  * Parse data from current parsing position in a chunk.
 339  */
 340 static bool parse_chunk(private_parser_t *this, int rule_number,
 341                                                 chunk_t *output_pos, int length)
 342 {
 343         if (this->byte_pos + length > this->input_roof)
 344         {
 345                 return short_input(this, rule_number);
 346         }
 347         if (this->bit_pos)
 348         {
 349                 return bad_bitpos(this, rule_number);
 350         }
 351         if (output_pos)
 352         {
 353                 *output_pos = chunk_alloc(length);
 354                 memcpy(output_pos->ptr, this->byte_pos, length);
 355                 DBG3(DBG_ENC, "   %b", output_pos->ptr, length);
 356         }
 357         this->byte_pos += length;
 358         return TRUE;
 359 }
 360
 361 METHOD(parser_t, parse_payload, status_t,
 362         private_parser_t *this, payload_type_t payload_type, payload_t **payload)
 363 {
 364         payload_t *pld;
 365         void *output;
 366         int payload_length = 0, spi_size = 0, attribute_length = 0, header_length;
 367         u_int16_t ts_type = 0;
 368         bool attribute_format = FALSE;
 369         int rule_number, rule_count;
 370         encoding_rule_t *rule;
 371
 372         /* create instance of the payload to parse */
 373         pld = payload_create(payload_type);
 374
 375         DBG2(DBG_ENC, "parsing %N payload, %d bytes left",
 376                  payload_type_names, payload_type, this->input_roof - this->byte_pos);
 377
 378         DBG3(DBG_ENC, "parsing payload from %b",
 379                  this->byte_pos, (u_int)(this->input_roof - this->byte_pos));
 380
 381         /* base pointer for output, avoids casting in every rule */
 382         output = pld;
 383         /* parse the payload with its own rulse */
 384         rule_count = pld->get_encoding_rules(pld, &this->rules);
 385         for (rule_number = 0; rule_number < rule_count; rule_number++)
 386         {
 387                 /* update header length for each rule, as it is dynamic (SPIs) */
 388                 header_length = pld->get_header_length(pld);
 389
 390                 rule = &(this->rules[rule_number]);
 391                 DBG2(DBG_ENC, "  parsing rule %d %N",
 392                          rule_number, encoding_type_names, rule->type);
 393                 switch ((int)rule->type)
 394                 {
 395                         case U_INT_4:
 396                         {
 397                                 if (!parse_uint4(this, rule_number, output + rule->offset))
 398                                 {
 399                                         pld->destroy(pld);
 400                                         return PARSE_ERROR;
 401                                 }
 402                                 break;
 403                         }
 404                         case U_INT_8:
 405                         case RESERVED_BYTE:
 406                         {
 407                                 if (!parse_uint8(this, rule_number, output + rule->offset))
 408                                 {
 409                                         pld->destroy(pld);
 410                                         return PARSE_ERROR;
 411                                 }
 412                                 break;
 413                         }
 414                         case U_INT_16:
 415                         {
 416                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 417                                 {
 418                                         pld->destroy(pld);
 419                                         return PARSE_ERROR;
 420                                 }
 421                                 break;
 422                         }
 423                         case U_INT_32:
 424                         case HEADER_LENGTH:
 425                         {
 426                                 if (!parse_uint32(this, rule_number, output + rule->offset))
 427                                 {
 428                                         pld->destroy(pld);
 429                                         return PARSE_ERROR;
 430                                 }
 431                                 break;
 432                         }
 433                         case IKE_SPI:
 434                         {
 435                                 if (!parse_bytes(this, rule_number, output + rule->offset, 8))
 436                                 {
 437                                         pld->destroy(pld);
 438                                         return PARSE_ERROR;
 439                                 }
 440                                 break;
 441                         }
 442                         case RESERVED_BIT:
 443                         case FLAG:
 444                         {
 445                                 if (!parse_bit(this, rule_number, output + rule->offset))
 446                                 {
 447                                         pld->destroy(pld);
 448                                         return PARSE_ERROR;
 449                                 }
 450                                 break;
 451                         }
 452                         case PAYLOAD_LENGTH:
 453                         {
 454                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 455                                 {
 456                                         pld->destroy(pld);
 457                                         return PARSE_ERROR;
 458                                 }
 459                                 /* parsed u_int16 should be aligned */
 460                                 payload_length = *(u_int16_t*)(output + rule->offset);
 461                                 /* all payloads must have at least 4 bytes header */
 462                                 if (payload_length < 4)
 463                                 {
 464                                         pld->destroy(pld);
 465                                         return PARSE_ERROR;
 466                                 }
 467                                 break;
 468                         }
 469                         case SPI_SIZE:
 470                         {
 471                                 if (!parse_uint8(this, rule_number, output + rule->offset))
 472                                 {
 473                                         pld->destroy(pld);
 474                                         return PARSE_ERROR;
 475                                 }
 476                                 spi_size = *(u_int8_t*)(output + rule->offset);
 477                                 break;
 478                         }
 479                         case SPI:
 480                         {
 481                                 if (!parse_chunk(this, rule_number, output + rule->offset,
 482                                                                  spi_size))
 483                                 {
 484                                         pld->destroy(pld);
 485                                         return PARSE_ERROR;
 486                                 }
 487                                 break;
 488                         }
 489                         case PAYLOAD_LIST + PLV2_PROPOSAL_SUBSTRUCTURE:
 490                         case PAYLOAD_LIST + PLV1_PROPOSAL_SUBSTRUCTURE:
 491                         case PAYLOAD_LIST + PLV2_TRANSFORM_SUBSTRUCTURE:
 492                         case PAYLOAD_LIST + PLV1_TRANSFORM_SUBSTRUCTURE:
 493                         case PAYLOAD_LIST + PLV2_TRANSFORM_ATTRIBUTE:
 494                         case PAYLOAD_LIST + PLV1_TRANSFORM_ATTRIBUTE:
 495                         case PAYLOAD_LIST + PLV2_CONFIGURATION_ATTRIBUTE:
 496                         case PAYLOAD_LIST + PLV1_CONFIGURATION_ATTRIBUTE:
 497                         case PAYLOAD_LIST + PLV2_TRAFFIC_SELECTOR_SUBSTRUCTURE:
 498                         {
 499                                 if (payload_length < header_length ||
 500                                         !parse_list(this, rule_number, output + rule->offset,
 501                                                                 rule->type - PAYLOAD_LIST,
 502                                                                 payload_length - header_length))
 503                                 {
 504                                         pld->destroy(pld);
 505                                         return PARSE_ERROR;
 506                                 }
 507                                 break;
 508                         }
 509                         case CHUNK_DATA:
 510                         {
 511                                 if (payload_length < header_length ||
 512                                         !parse_chunk(this, rule_number, output + rule->offset,
 513                                                                  payload_length - header_length))
 514                                 {
 515                                         pld->destroy(pld);
 516                                         return PARSE_ERROR;
 517                                 }
 518                                 break;
 519                         }
 520                         case ENCRYPTED_DATA:
 521                         {
 522                                 if (!parse_chunk(this, rule_number, output + rule->offset,
 523                                                                  this->input_roof - this->byte_pos))
 524                                 {
 525                                         pld->destroy(pld);
 526                                         return PARSE_ERROR;
 527                                 }
 528                                 break;
 529                         }
 530                         case ATTRIBUTE_FORMAT:
 531                         {
 532                                 if (!parse_bit(this, rule_number, output + rule->offset))
 533                                 {
 534                                         pld->destroy(pld);
 535                                         return PARSE_ERROR;
 536                                 }
 537                                 attribute_format = *(bool*)(output + rule->offset);
 538                                 break;
 539                         }
 540                         case ATTRIBUTE_TYPE:
 541                         {
 542                                 if (!parse_uint15(this, rule_number, output + rule->offset))
 543                                 {
 544                                         pld->destroy(pld);
 545                                         return PARSE_ERROR;
 546                                 }
 547                                 break;
 548                         }
 549                         case ATTRIBUTE_LENGTH:
 550                         {
 551                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 552                                 {
 553                                         pld->destroy(pld);
 554                                         return PARSE_ERROR;
 555                                 }
 556                                 attribute_length = *(u_int16_t*)(output + rule->offset);
 557                                 break;
 558                         }
 559                         case ATTRIBUTE_LENGTH_OR_VALUE:
 560                         {
 561                                 if (!parse_uint16(this, rule_number, output + rule->offset))
 562                                 {
 563                                         pld->destroy(pld);
 564                                         return PARSE_ERROR;
 565                                 }
 566                                 attribute_length = *(u_int16_t*)(output + rule->offset);
 567                                 break;
 568                         }
 569                         case ATTRIBUTE_VALUE:
 570                         {
 571                                 if (attribute_format == FALSE &&
 572                                         !parse_chunk(this, rule_number, output + rule->offset,
 573                                                                  attribute_length))
 574                                 {
 575                                         pld->destroy(pld);
 576                                         return PARSE_ERROR;
 577                                 }
 578                                 break;
 579                         }
 580                         case TS_TYPE:
 581                         {
 582                                 if (!parse_uint8(this, rule_number, output + rule->offset))
 583                                 {
 584                                         pld->destroy(pld);
 585                                         return PARSE_ERROR;
 586                                 }
 587                                 ts_type = *(u_int8_t*)(output + rule->offset);
 588                                 break;
 589                         }
 590                         case ADDRESS:
 591                         {
 592                                 int address_length = (ts_type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
 593
 594                                 if (!parse_chunk(this, rule_number, output + rule->offset,
 595                                                                  address_length))
 596                                 {
 597                                         pld->destroy(pld);
 598                                         return PARSE_ERROR;
 599                                 }
 600                                 break;
 601                         }
 602                         default:
 603                         {
 604                                 DBG1(DBG_ENC, "  no rule to parse rule %d %N",
 605                                          rule_number, encoding_type_names, rule->type);
 606                                 pld->destroy(pld);
 607                                 return PARSE_ERROR;
 608                         }
 609                 }
 610                 /* process next rulue */
 611                 rule++;
 612         }
 613
 614         *payload = pld;
 615         DBG2(DBG_ENC, "parsing %N payload finished",
 616                  payload_type_names, payload_type);
 617         return SUCCESS;
 618 }
 619
 620 METHOD(parser_t, get_remaining_byte_count, int,
 621         private_parser_t *this)
 622 {
 623         return this->input_roof - this->byte_pos;
 624 }
 625
 626 METHOD(parser_t, reset_context, void,
 627         private_parser_t *this)
 628 {
 629         this->byte_pos = this->input;
 630         this->bit_pos = 0;
 631 }
 632
 633 METHOD(parser_t, destroy, void,
 634         private_parser_t *this)
 635 {
 636         free(this);
 637 }
 638
 639 /*
 640  * Described in header.
 641  */
 642 parser_t *parser_create(chunk_t data)
 643 {
 644         private_parser_t *this;
 645
 646         INIT(this,
 647                 .public = {
 648                         .parse_payload = _parse_payload,
 649                         .reset_context = _reset_context,
 650                         .get_remaining_byte_count = _get_remaining_byte_count,
 651                         .destroy = _destroy,
 652                 },
 653                 .input = data.ptr,
 654                 .byte_pos = data.ptr,
 655                 .input_roof = data.ptr + data.len,
 656         );
 657
 658         return &this->public;
 659 }
 660