1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2  * All rights reserved.
3  *
4  * This package is an SSL implementation written
5  * by Eric Young (eay@cryptsoft.com).
6  * The implementation was written so as to conform with Netscapes SSL.
7  *
8  * This library is free for commercial and non-commercial use as long as
9  * the following conditions are aheared to.  The following conditions
10  * apply to all code found in this distribution, be it the RC4, RSA,
11  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
12  * included with this distribution is covered by the same copyright terms
13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14  *
15  * Copyright remains Eric Young's, and as such any Copyright notices in
16  * the code are not to be removed.
17  * If this package is used in a product, Eric Young should be given attribution
18  * as the author of the parts of the library used.
19  * This can be in the form of a textual message at program startup or
20  * in documentation (online or textual) provided with the package.
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  * 1. Redistributions of source code must retain the copyright
26  *    notice, this list of conditions and the following disclaimer.
27  * 2. Redistributions in binary form must reproduce the above copyright
28  *    notice, this list of conditions and the following disclaimer in the
29  *    documentation and/or other materials provided with the distribution.
30  * 3. All advertising materials mentioning features or use of this software
31  *    must display the following acknowledgement:
32  *    "This product includes cryptographic software written by
33  *     Eric Young (eay@cryptsoft.com)"
34  *    The word 'cryptographic' can be left out if the rouines from the library
35  *    being used are not cryptographic related :-).
36  * 4. If you include any Windows specific code (or a derivative thereof) from
37  *    the apps directory (application code) you must include an acknowledgement:
38  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39  *
40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50  * SUCH DAMAGE.
51  *
52  * The licence and distribution terms for any publically available version or
53  * derivative of this code cannot be changed.  i.e. this code cannot simply be
54  * copied and put under another distribution licence
55  * [including the GNU Public Licence.] */
56 
57 #include <openssl/bio.h>
58 
59 #include <assert.h>
60 #include <errno.h>
61 #include <limits.h>
62 #include <string.h>
63 
64 #include <openssl/err.h>
65 #include <openssl/mem.h>
66 #include <openssl/thread.h>
67 
68 #include "../internal.h"
69 
70 
71 /* BIO_set initialises a BIO structure to have the given type and sets the
72  * reference count to one. It returns one on success or zero on error. */
bio_set(BIO * bio,const BIO_METHOD * method)73 static int bio_set(BIO *bio, const BIO_METHOD *method) {
74   /* This function can be called with a stack allocated |BIO| so we have to
75    * assume that the contents of |BIO| are arbitary. This also means that it'll
76    * leak memory if you call |BIO_set| twice on the same BIO. */
77   memset(bio, 0, sizeof(BIO));
78 
79   bio->method = method;
80   bio->shutdown = 1;
81   bio->references = 1;
82 
83   if (method->create != NULL && !method->create(bio)) {
84     return 0;
85   }
86 
87   return 1;
88 }
89 
BIO_new(const BIO_METHOD * method)90 BIO *BIO_new(const BIO_METHOD *method) {
91   BIO *ret = OPENSSL_malloc(sizeof(BIO));
92   if (ret == NULL) {
93     OPENSSL_PUT_ERROR(BIO, BIO_new, ERR_R_MALLOC_FAILURE);
94     return NULL;
95   }
96 
97   if (!bio_set(ret, method)) {
98     OPENSSL_free(ret);
99     ret = NULL;
100   }
101 
102   return ret;
103 }
104 
BIO_free(BIO * bio)105 int BIO_free(BIO *bio) {
106   BIO *next_bio;
107 
108   for (; bio != NULL; bio = next_bio) {
109     if (!CRYPTO_refcount_dec_and_test_zero(&bio->references)) {
110       return 0;
111     }
112 
113     if (bio->callback != NULL) {
114       int i = (int)bio->callback(bio, BIO_CB_FREE, NULL, 0, 0, 1);
115       if (i <= 0) {
116         return i;
117       }
118     }
119 
120     next_bio = BIO_pop(bio);
121 
122     if (bio->method != NULL && bio->method->destroy != NULL) {
123       bio->method->destroy(bio);
124     }
125 
126     OPENSSL_free(bio);
127   }
128   return 1;
129 }
130 
BIO_up_ref(BIO * bio)131 BIO *BIO_up_ref(BIO *bio) {
132   CRYPTO_refcount_inc(&bio->references);
133   return bio;
134 }
135 
BIO_vfree(BIO * bio)136 void BIO_vfree(BIO *bio) {
137   BIO_free(bio);
138 }
139 
BIO_free_all(BIO * bio)140 void BIO_free_all(BIO *bio) {
141   BIO_free(bio);
142 }
143 
bio_io(BIO * bio,void * buf,int len,size_t method_offset,int callback_flags,size_t * num)144 static int bio_io(BIO *bio, void *buf, int len, size_t method_offset,
145                   int callback_flags, size_t *num) {
146   int i;
147   typedef int (*io_func_t)(BIO *, char *, int);
148   io_func_t io_func = NULL;
149 
150   if (bio != NULL && bio->method != NULL) {
151     io_func =
152         *((const io_func_t *)(((const uint8_t *)bio->method) + method_offset));
153   }
154 
155   if (io_func == NULL) {
156     OPENSSL_PUT_ERROR(BIO, bio_io, BIO_R_UNSUPPORTED_METHOD);
157     return -2;
158   }
159 
160   if (bio->callback != NULL) {
161     i = (int) bio->callback(bio, callback_flags, buf, len, 0L, 1L);
162     if (i <= 0) {
163       return i;
164     }
165   }
166 
167   if (!bio->init) {
168     OPENSSL_PUT_ERROR(BIO, bio_io, BIO_R_UNINITIALIZED);
169     return -2;
170   }
171 
172   i = 0;
173   if (buf != NULL && len > 0) {
174     i = io_func(bio, buf, len);
175   }
176 
177   if (i > 0) {
178     *num += i;
179   }
180 
181   if (bio->callback != NULL) {
182     i = (int)(bio->callback(bio, callback_flags | BIO_CB_RETURN, buf, len, 0L,
183                             (long)i));
184   }
185 
186   return i;
187 }
188 
BIO_read(BIO * bio,void * buf,int len)189 int BIO_read(BIO *bio, void *buf, int len) {
190   return bio_io(bio, buf, len, offsetof(BIO_METHOD, bread), BIO_CB_READ,
191                 &bio->num_read);
192 }
193 
BIO_gets(BIO * bio,char * buf,int len)194 int BIO_gets(BIO *bio, char *buf, int len) {
195   return bio_io(bio, buf, len, offsetof(BIO_METHOD, bgets), BIO_CB_GETS,
196                 &bio->num_read);
197 }
198 
BIO_write(BIO * bio,const void * in,int inl)199 int BIO_write(BIO *bio, const void *in, int inl) {
200   return bio_io(bio, (char *)in, inl, offsetof(BIO_METHOD, bwrite),
201                 BIO_CB_WRITE, &bio->num_write);
202 }
203 
BIO_puts(BIO * bio,const char * in)204 int BIO_puts(BIO *bio, const char *in) {
205   return BIO_write(bio, in, strlen(in));
206 }
207 
BIO_flush(BIO * bio)208 int BIO_flush(BIO *bio) {
209   return BIO_ctrl(bio, BIO_CTRL_FLUSH, 0, NULL);
210 }
211 
BIO_ctrl(BIO * bio,int cmd,long larg,void * parg)212 long BIO_ctrl(BIO *bio, int cmd, long larg, void *parg) {
213   long ret;
214 
215   if (bio == NULL) {
216     return 0;
217   }
218 
219   if (bio->method == NULL || bio->method->ctrl == NULL) {
220     OPENSSL_PUT_ERROR(BIO, BIO_ctrl, BIO_R_UNSUPPORTED_METHOD);
221     return -2;
222   }
223 
224   if (bio->callback != NULL) {
225     ret = bio->callback(bio, BIO_CB_CTRL, parg, cmd, larg, 1);
226     if (ret <= 0) {
227       return ret;
228     }
229   }
230 
231   ret = bio->method->ctrl(bio, cmd, larg, parg);
232 
233   if (bio->callback != NULL) {
234     ret = bio->callback(bio, BIO_CB_CTRL | BIO_CB_RETURN, parg, cmd, larg, ret);
235   }
236 
237   return ret;
238 }
239 
BIO_ptr_ctrl(BIO * b,int cmd,long larg)240 char *BIO_ptr_ctrl(BIO *b, int cmd, long larg) {
241   char *p = NULL;
242 
243   if (BIO_ctrl(b, cmd, larg, (void *)&p) <= 0) {
244     return NULL;
245   }
246 
247   return p;
248 }
249 
BIO_int_ctrl(BIO * b,int cmd,long larg,int iarg)250 long BIO_int_ctrl(BIO *b, int cmd, long larg, int iarg) {
251   int i = iarg;
252 
253   return BIO_ctrl(b, cmd, larg, (void *)&i);
254 }
255 
BIO_reset(BIO * bio)256 int BIO_reset(BIO *bio) {
257   return BIO_ctrl(bio, BIO_CTRL_RESET, 0, NULL);
258 }
259 
BIO_set_flags(BIO * bio,int flags)260 void BIO_set_flags(BIO *bio, int flags) {
261   bio->flags |= flags;
262 }
263 
BIO_test_flags(const BIO * bio,int flags)264 int BIO_test_flags(const BIO *bio, int flags) {
265   return bio->flags & flags;
266 }
267 
BIO_should_read(const BIO * bio)268 int BIO_should_read(const BIO *bio) {
269   return BIO_test_flags(bio, BIO_FLAGS_READ);
270 }
271 
BIO_should_write(const BIO * bio)272 int BIO_should_write(const BIO *bio) {
273   return BIO_test_flags(bio, BIO_FLAGS_WRITE);
274 }
275 
BIO_should_retry(const BIO * bio)276 int BIO_should_retry(const BIO *bio) {
277   return BIO_test_flags(bio, BIO_FLAGS_SHOULD_RETRY);
278 }
279 
BIO_should_io_special(const BIO * bio)280 int BIO_should_io_special(const BIO *bio) {
281   return BIO_test_flags(bio, BIO_FLAGS_IO_SPECIAL);
282 }
283 
BIO_get_retry_reason(const BIO * bio)284 int BIO_get_retry_reason(const BIO *bio) { return bio->retry_reason; }
285 
BIO_clear_flags(BIO * bio,int flags)286 void BIO_clear_flags(BIO *bio, int flags) {
287   bio->flags &= ~flags;
288 }
289 
BIO_set_retry_read(BIO * bio)290 void BIO_set_retry_read(BIO *bio) {
291   bio->flags |= BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY;
292 }
293 
BIO_set_retry_write(BIO * bio)294 void BIO_set_retry_write(BIO *bio) {
295   bio->flags |= BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY;
296 }
297 
298 static const int kRetryFlags = BIO_FLAGS_RWS | BIO_FLAGS_SHOULD_RETRY;
299 
BIO_get_retry_flags(BIO * bio)300 int BIO_get_retry_flags(BIO *bio) {
301   return bio->flags & kRetryFlags;
302 }
303 
BIO_clear_retry_flags(BIO * bio)304 void BIO_clear_retry_flags(BIO *bio) {
305   bio->flags &= ~kRetryFlags;
306   bio->retry_reason = 0;
307 }
308 
BIO_method_type(const BIO * bio)309 int BIO_method_type(const BIO *bio) { return bio->method->type; }
310 
BIO_copy_next_retry(BIO * bio)311 void BIO_copy_next_retry(BIO *bio) {
312   BIO_clear_retry_flags(bio);
313   BIO_set_flags(bio, BIO_get_retry_flags(bio->next_bio));
314   bio->retry_reason = bio->next_bio->retry_reason;
315 }
316 
BIO_callback_ctrl(BIO * bio,int cmd,bio_info_cb fp)317 long BIO_callback_ctrl(BIO *bio, int cmd, bio_info_cb fp) {
318   long ret;
319   bio_info_cb cb;
320 
321   if (bio == NULL) {
322     return 0;
323   }
324 
325   if (bio->method == NULL || bio->method->callback_ctrl == NULL) {
326     OPENSSL_PUT_ERROR(BIO, BIO_callback_ctrl, BIO_R_UNSUPPORTED_METHOD);
327     return 0;
328   }
329 
330   cb = bio->callback;
331 
332   if (cb != NULL) {
333     ret = cb(bio, BIO_CB_CTRL, (void *)&fp, cmd, 0, 1L);
334     if (ret <= 0) {
335       return ret;
336     }
337   }
338 
339   ret = bio->method->callback_ctrl(bio, cmd, fp);
340 
341   if (cb != NULL) {
342     ret = cb(bio, BIO_CB_CTRL | BIO_CB_RETURN, (void *)&fp, cmd, 0, ret);
343   }
344 
345   return ret;
346 }
347 
BIO_pending(const BIO * bio)348 size_t BIO_pending(const BIO *bio) {
349   return BIO_ctrl((BIO *) bio, BIO_CTRL_PENDING, 0, NULL);
350 }
351 
BIO_ctrl_pending(const BIO * bio)352 size_t BIO_ctrl_pending(const BIO *bio) {
353   return BIO_pending(bio);
354 }
355 
BIO_wpending(const BIO * bio)356 size_t BIO_wpending(const BIO *bio) {
357   return BIO_ctrl((BIO *) bio, BIO_CTRL_WPENDING, 0, NULL);
358 }
359 
BIO_set_close(BIO * bio,int close_flag)360 int BIO_set_close(BIO *bio, int close_flag) {
361   return BIO_ctrl(bio, BIO_CTRL_SET_CLOSE, close_flag, NULL);
362 }
363 
BIO_set_callback(BIO * bio,bio_info_cb callback_func)364 void BIO_set_callback(BIO *bio, bio_info_cb callback_func) {
365   bio->callback = callback_func;
366 }
367 
BIO_set_callback_arg(BIO * bio,char * arg)368 void BIO_set_callback_arg(BIO *bio, char *arg) {
369   bio->cb_arg = arg;
370 }
371 
BIO_get_callback_arg(const BIO * bio)372 char *BIO_get_callback_arg(const BIO *bio) {
373   return bio->cb_arg;
374 }
375 
BIO_number_read(const BIO * bio)376 OPENSSL_EXPORT size_t BIO_number_read(const BIO *bio) {
377   return bio->num_read;
378 }
379 
BIO_number_written(const BIO * bio)380 OPENSSL_EXPORT size_t BIO_number_written(const BIO *bio) {
381   return bio->num_write;
382 }
383 
BIO_push(BIO * bio,BIO * appended_bio)384 BIO *BIO_push(BIO *bio, BIO *appended_bio) {
385   BIO *last_bio;
386 
387   if (bio == NULL) {
388     return bio;
389   }
390 
391   last_bio = bio;
392   while (last_bio->next_bio != NULL) {
393     last_bio = last_bio->next_bio;
394   }
395 
396   last_bio->next_bio = appended_bio;
397   return bio;
398 }
399 
BIO_pop(BIO * bio)400 BIO *BIO_pop(BIO *bio) {
401   BIO *ret;
402 
403   if (bio == NULL) {
404     return NULL;
405   }
406   ret = bio->next_bio;
407   bio->next_bio = NULL;
408   return ret;
409 }
410 
BIO_next(BIO * bio)411 BIO *BIO_next(BIO *bio) {
412   if (!bio) {
413     return NULL;
414   }
415   return bio->next_bio;
416 }
417 
BIO_find_type(BIO * bio,int type)418 BIO *BIO_find_type(BIO *bio, int type) {
419   int method_type, mask;
420 
421   if (!bio) {
422     return NULL;
423   }
424   mask = type & 0xff;
425 
426   do {
427     if (bio->method != NULL) {
428       method_type = bio->method->type;
429 
430       if (!mask) {
431         if (method_type & type) {
432           return bio;
433         }
434       } else if (method_type == type) {
435         return bio;
436       }
437     }
438     bio = bio->next_bio;
439   } while (bio != NULL);
440 
441   return NULL;
442 }
443 
BIO_indent(BIO * bio,unsigned indent,unsigned max_indent)444 int BIO_indent(BIO *bio, unsigned indent, unsigned max_indent) {
445   if (indent > max_indent) {
446     indent = max_indent;
447   }
448 
449   while (indent--) {
450     if (BIO_puts(bio, " ") != 1) {
451       return 0;
452     }
453   }
454   return 1;
455 }
456 
print_bio(const char * str,size_t len,void * bio)457 static int print_bio(const char *str, size_t len, void *bio) {
458   return BIO_write((BIO *)bio, str, len);
459 }
460 
BIO_print_errors(BIO * bio)461 void BIO_print_errors(BIO *bio) {
462   ERR_print_errors_cb(print_bio, bio);
463 }
464 
465 /* bio_read_all reads everything from |bio| and prepends |prefix| to it. On
466  * success, |*out| is set to an allocated buffer (which should be freed with
467  * |OPENSSL_free|), |*out_len| is set to its length and one is returned. The
468  * buffer will contain |prefix| followed by the contents of |bio|. On failure,
469  * zero is returned.
470  *
471  * The function will fail if the size of the output would equal or exceed
472  * |max_len|. */
bio_read_all(BIO * bio,uint8_t ** out,size_t * out_len,const uint8_t * prefix,size_t prefix_len,size_t max_len)473 static int bio_read_all(BIO *bio, uint8_t **out, size_t *out_len,
474                         const uint8_t *prefix, size_t prefix_len,
475                         size_t max_len) {
476   static const size_t kChunkSize = 4096;
477 
478   size_t len = prefix_len + kChunkSize;
479   if (len > max_len) {
480     len = max_len;
481   }
482   if (len < prefix_len) {
483     return 0;
484   }
485   *out = OPENSSL_malloc(len);
486   if (*out == NULL) {
487     return 0;
488   }
489   memcpy(*out, prefix, prefix_len);
490   size_t done = prefix_len;
491 
492   for (;;) {
493     if (done == len) {
494       OPENSSL_free(*out);
495       return 0;
496     }
497     const size_t todo = len - done;
498     assert(todo < INT_MAX);
499     const int n = BIO_read(bio, *out + done, todo);
500     if (n == 0) {
501       *out_len = done;
502       return 1;
503     } else if (n == -1) {
504       OPENSSL_free(*out);
505       return 0;
506     }
507 
508     done += n;
509     if (len < max_len && len - done < kChunkSize / 2) {
510       len += kChunkSize;
511       if (len < kChunkSize || len > max_len) {
512         len = max_len;
513       }
514       uint8_t *new_buf = OPENSSL_realloc(*out, len);
515       if (new_buf == NULL) {
516         OPENSSL_free(*out);
517         return 0;
518       }
519       *out = new_buf;
520     }
521   }
522 }
523 
BIO_read_asn1(BIO * bio,uint8_t ** out,size_t * out_len,size_t max_len)524 int BIO_read_asn1(BIO *bio, uint8_t **out, size_t *out_len, size_t max_len) {
525   uint8_t header[6];
526 
527   static const size_t kInitialHeaderLen = 2;
528   if (BIO_read(bio, header, kInitialHeaderLen) != kInitialHeaderLen) {
529     return 0;
530   }
531 
532   const uint8_t tag = header[0];
533   const uint8_t length_byte = header[1];
534 
535   if ((tag & 0x1f) == 0x1f) {
536     /* Long form tags are not supported. */
537     return 0;
538   }
539 
540   size_t len, header_len;
541   if ((length_byte & 0x80) == 0) {
542     /* Short form length. */
543     len = length_byte;
544     header_len = kInitialHeaderLen;
545   } else {
546     const size_t num_bytes = length_byte & 0x7f;
547 
548     if ((tag & 0x20 /* constructed */) != 0 && num_bytes == 0) {
549       /* indefinite length. */
550       return bio_read_all(bio, out, out_len, header, kInitialHeaderLen,
551                           max_len);
552     }
553 
554     if (num_bytes == 0 || num_bytes > 4) {
555       return 0;
556     }
557 
558     if (BIO_read(bio, header + kInitialHeaderLen, num_bytes) != num_bytes) {
559       return 0;
560     }
561     header_len = kInitialHeaderLen + num_bytes;
562 
563     uint32_t len32 = 0;
564     unsigned i;
565     for (i = 0; i < num_bytes; i++) {
566       len32 <<= 8;
567       len32 |= header[kInitialHeaderLen + i];
568     }
569 
570     if (len32 < 128) {
571       /* Length should have used short-form encoding. */
572       return 0;
573     }
574 
575     if ((len32 >> ((num_bytes-1)*8)) == 0) {
576       /* Length should have been at least one byte shorter. */
577       return 0;
578     }
579 
580     len = len32;
581   }
582 
583   if (len + header_len < len ||
584       len + header_len > max_len) {
585     return 0;
586   }
587   len += header_len;
588   *out_len = len;
589 
590   *out = OPENSSL_malloc(len);
591   if (*out == NULL) {
592     return 0;
593   }
594   memcpy(*out, header, header_len);
595   if (BIO_read(bio, (*out) + header_len, len - header_len) !=
596       len - header_len) {
597     OPENSSL_free(*out);
598     return 0;
599   }
600 
601   return 1;
602 }
603