1 /* 2 * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 package sun.security.util; 27 28 import java.io.InputStream; 29 import java.io.IOException; 30 import java.io.EOFException; 31 import java.util.Date; 32 import java.util.Vector; 33 import java.math.BigInteger; 34 import java.io.DataInputStream; 35 36 /** 37 * A DER input stream, used for parsing ASN.1 DER-encoded data such as 38 * that found in X.509 certificates. DER is a subset of BER/1, which has 39 * the advantage that it allows only a single encoding of primitive data. 40 * (High level data such as dates still support many encodings.) That is, 41 * it uses the "Definite" Encoding Rules (DER) not the "Basic" ones (BER). 42 * 43 * <P>Note that, like BER/1, DER streams are streams of explicitly 44 * tagged data values. Accordingly, this programming interface does 45 * not expose any variant of the java.io.InputStream interface, since 46 * that kind of input stream holds untagged data values and using that 47 * I/O model could prevent correct parsing of the DER data. 48 * 49 * <P>At this time, this class supports only a subset of the types of DER 50 * data encodings which are defined. That subset is sufficient for parsing 51 * most X.509 certificates. 52 * 53 * 54 * @author David Brownell 55 * @author Amit Kapoor 56 * @author Hemma Prafullchandra 57 */ 58 59 public class DerInputStream { 60 61 /* 62 * This version only supports fully buffered DER. This is easy to 63 * work with, though if large objects are manipulated DER becomes 64 * awkward to deal with. That's where BER is useful, since BER 65 * handles streaming data relatively well. 66 */ 67 DerInputBuffer buffer; 68 69 /** The DER tag of the value; one of the tag_ constants. */ 70 public byte tag; 71 72 /** 73 * Create a DER input stream from a data buffer. The buffer is not 74 * copied, it is shared. Accordingly, the buffer should be treated 75 * as read-only. 76 * 77 * @param data the buffer from which to create the string (CONSUMED) 78 */ DerInputStream(byte[] data)79 public DerInputStream(byte[] data) throws IOException { 80 init(data, 0, data.length, true); 81 } 82 83 /** 84 * Create a DER input stream from part of a data buffer. 85 * The buffer is not copied, it is shared. Accordingly, the 86 * buffer should be treated as read-only. 87 * 88 * @param data the buffer from which to create the string (CONSUMED) 89 * @param offset the first index of <em>data</em> which will 90 * be read as DER input in the new stream 91 * @param len how long a chunk of the buffer to use, 92 * starting at "offset" 93 */ DerInputStream(byte[] data, int offset, int len)94 public DerInputStream(byte[] data, int offset, int len) throws IOException { 95 init(data, offset, len, true); 96 } 97 98 /** 99 * Create a DER input stream from part of a data buffer with 100 * additional arg to indicate whether to allow constructed 101 * indefinite-length encoding. 102 * The buffer is not copied, it is shared. Accordingly, the 103 * buffer should be treated as read-only. 104 * 105 * @param data the buffer from which to create the string (CONSUMED) 106 * @param offset the first index of <em>data</em> which will 107 * be read as DER input in the new stream 108 * @param len how long a chunk of the buffer to use, 109 * starting at "offset" 110 * @param allowIndefiniteLength whether to allow constructed 111 * indefinite-length encoding 112 */ DerInputStream(byte[] data, int offset, int len, boolean allowIndefiniteLength)113 public DerInputStream(byte[] data, int offset, int len, 114 boolean allowIndefiniteLength) throws IOException { 115 init(data, offset, len, allowIndefiniteLength); 116 } 117 118 /* 119 * private helper routine 120 */ init(byte[] data, int offset, int len, boolean allowIndefiniteLength)121 private void init(byte[] data, int offset, int len, 122 boolean allowIndefiniteLength) throws IOException { 123 if ((offset+2 > data.length) || (offset+len > data.length)) { 124 throw new IOException("Encoding bytes too short"); 125 } 126 // check for indefinite length encoding 127 if (DerIndefLenConverter.isIndefinite(data[offset+1])) { 128 if (!allowIndefiniteLength) { 129 throw new IOException("Indefinite length BER encoding found"); 130 } else { 131 byte[] inData = new byte[len]; 132 System.arraycopy(data, offset, inData, 0, len); 133 134 DerIndefLenConverter derIn = new DerIndefLenConverter(); 135 buffer = new DerInputBuffer(derIn.convert(inData)); 136 } 137 } else 138 buffer = new DerInputBuffer(data, offset, len); 139 buffer.mark(Integer.MAX_VALUE); 140 } 141 DerInputStream(DerInputBuffer buf)142 DerInputStream(DerInputBuffer buf) { 143 buffer = buf; 144 buffer.mark(Integer.MAX_VALUE); 145 } 146 147 /** 148 * Creates a new DER input stream from part of this input stream. 149 * 150 * @param len how long a chunk of the current input stream to use, 151 * starting at the current position. 152 * @param do_skip true if the existing data in the input stream should 153 * be skipped. If this value is false, the next data read 154 * on this stream and the newly created stream will be the 155 * same. 156 */ subStream(int len, boolean do_skip)157 public DerInputStream subStream(int len, boolean do_skip) 158 throws IOException { 159 DerInputBuffer newbuf = buffer.dup(); 160 161 newbuf.truncate(len); 162 if (do_skip) { 163 buffer.skip(len); 164 } 165 return new DerInputStream(newbuf); 166 } 167 168 /** 169 * Return what has been written to this DerInputStream 170 * as a byte array. Useful for debugging. 171 */ toByteArray()172 public byte[] toByteArray() { 173 return buffer.toByteArray(); 174 } 175 176 /* 177 * PRIMITIVES -- these are "universal" ASN.1 simple types. 178 * 179 * INTEGER, ENUMERATED, BIT STRING, OCTET STRING, NULL 180 * OBJECT IDENTIFIER, SEQUENCE (OF), SET (OF) 181 * UTF8String, PrintableString, T61String, IA5String, UTCTime, 182 * GeneralizedTime, BMPString. 183 * Note: UniversalString not supported till encoder is available. 184 */ 185 186 /** 187 * Get an integer from the input stream as an integer. 188 * 189 * @return the integer held in this DER input stream. 190 */ getInteger()191 public int getInteger() throws IOException { 192 if (buffer.read() != DerValue.tag_Integer) { 193 throw new IOException("DER input, Integer tag error"); 194 } 195 return buffer.getInteger(getLength(buffer)); 196 } 197 198 /** 199 * Get a integer from the input stream as a BigInteger object. 200 * 201 * @return the integer held in this DER input stream. 202 */ getBigInteger()203 public BigInteger getBigInteger() throws IOException { 204 if (buffer.read() != DerValue.tag_Integer) { 205 throw new IOException("DER input, Integer tag error"); 206 } 207 return buffer.getBigInteger(getLength(buffer), false); 208 } 209 210 /** 211 * Returns an ASN.1 INTEGER value as a positive BigInteger. 212 * This is just to deal with implementations that incorrectly encode 213 * some values as negative. 214 * 215 * @return the integer held in this DER value as a BigInteger. 216 */ getPositiveBigInteger()217 public BigInteger getPositiveBigInteger() throws IOException { 218 if (buffer.read() != DerValue.tag_Integer) { 219 throw new IOException("DER input, Integer tag error"); 220 } 221 return buffer.getBigInteger(getLength(buffer), true); 222 } 223 224 /** 225 * Get an enumerated from the input stream. 226 * 227 * @return the integer held in this DER input stream. 228 */ getEnumerated()229 public int getEnumerated() throws IOException { 230 if (buffer.read() != DerValue.tag_Enumerated) { 231 throw new IOException("DER input, Enumerated tag error"); 232 } 233 return buffer.getInteger(getLength(buffer)); 234 } 235 236 /** 237 * Get a bit string from the input stream. Padded bits (if any) 238 * will be stripped off before the bit string is returned. 239 */ getBitString()240 public byte[] getBitString() throws IOException { 241 if (buffer.read() != DerValue.tag_BitString) 242 throw new IOException("DER input not an bit string"); 243 244 return buffer.getBitString(getLength(buffer)); 245 } 246 247 /** 248 * Get a bit string from the input stream. The bit string need 249 * not be byte-aligned. 250 */ getUnalignedBitString()251 public BitArray getUnalignedBitString() throws IOException { 252 if (buffer.read() != DerValue.tag_BitString) 253 throw new IOException("DER input not a bit string"); 254 255 int length = getLength(buffer) - 1; 256 257 /* 258 * First byte = number of excess bits in the last octet of the 259 * representation. 260 */ 261 int excessBits = buffer.read(); 262 if (excessBits < 0) { 263 throw new IOException("Unused bits of bit string invalid"); 264 } 265 int validBits = length*8 - excessBits; 266 if (validBits < 0) { 267 throw new IOException("Valid bits of bit string invalid"); 268 } 269 270 byte[] repn = new byte[length]; 271 272 if ((length != 0) && (buffer.read(repn) != length)) { 273 throw new IOException("Short read of DER bit string"); 274 } 275 276 return new BitArray(validBits, repn); 277 } 278 279 /** 280 * Returns an ASN.1 OCTET STRING from the input stream. 281 */ getOctetString()282 public byte[] getOctetString() throws IOException { 283 if (buffer.read() != DerValue.tag_OctetString) 284 throw new IOException("DER input not an octet string"); 285 286 int length = getLength(buffer); 287 byte[] retval = new byte[length]; 288 if ((length != 0) && (buffer.read(retval) != length)) 289 throw new IOException("Short read of DER octet string"); 290 291 return retval; 292 } 293 294 /** 295 * Returns the asked number of bytes from the input stream. 296 */ getBytes(byte[] val)297 public void getBytes(byte[] val) throws IOException { 298 if ((val.length != 0) && (buffer.read(val) != val.length)) { 299 throw new IOException("Short read of DER octet string"); 300 } 301 } 302 303 /** 304 * Reads an encoded null value from the input stream. 305 */ getNull()306 public void getNull() throws IOException { 307 if (buffer.read() != DerValue.tag_Null || buffer.read() != 0) 308 throw new IOException("getNull, bad data"); 309 } 310 311 /** 312 * Reads an X.200 style Object Identifier from the stream. 313 */ getOID()314 public ObjectIdentifier getOID() throws IOException { 315 return new ObjectIdentifier(this); 316 } 317 318 /** 319 * Return a sequence of encoded entities. ASN.1 sequences are 320 * ordered, and they are often used, like a "struct" in C or C++, 321 * to group data values. They may have optional or context 322 * specific values. 323 * 324 * @param startLen guess about how long the sequence will be 325 * (used to initialize an auto-growing data structure) 326 * @return array of the values in the sequence 327 */ getSequence(int startLen, boolean originalEncodedFormRetained)328 public DerValue[] getSequence(int startLen, 329 boolean originalEncodedFormRetained) throws IOException { 330 tag = (byte)buffer.read(); 331 if (tag != DerValue.tag_Sequence) 332 throw new IOException("Sequence tag error"); 333 return readVector(startLen, originalEncodedFormRetained); 334 } 335 336 /** 337 * Return a sequence of encoded entities. ASN.1 sequences are 338 * ordered, and they are often used, like a "struct" in C or C++, 339 * to group data values. They may have optional or context 340 * specific values. 341 * 342 * @param startLen guess about how long the sequence will be 343 * (used to initialize an auto-growing data structure) 344 * @return array of the values in the sequence 345 */ getSequence(int startLen)346 public DerValue[] getSequence(int startLen) throws IOException { 347 return getSequence( 348 startLen, 349 false); // no need to retain original encoded form 350 } 351 352 /** 353 * Return a set of encoded entities. ASN.1 sets are unordered, 354 * though DER may specify an order for some kinds of sets (such 355 * as the attributes in an X.500 relative distinguished name) 356 * to facilitate binary comparisons of encoded values. 357 * 358 * @param startLen guess about how large the set will be 359 * (used to initialize an auto-growing data structure) 360 * @return array of the values in the sequence 361 */ getSet(int startLen)362 public DerValue[] getSet(int startLen) throws IOException { 363 tag = (byte)buffer.read(); 364 if (tag != DerValue.tag_Set) 365 throw new IOException("Set tag error"); 366 return readVector(startLen); 367 } 368 369 /** 370 * Return a set of encoded entities. ASN.1 sets are unordered, 371 * though DER may specify an order for some kinds of sets (such 372 * as the attributes in an X.500 relative distinguished name) 373 * to facilitate binary comparisons of encoded values. 374 * 375 * @param startLen guess about how large the set will be 376 * (used to initialize an auto-growing data structure) 377 * @param implicit if true tag is assumed implicit. 378 * @return array of the values in the sequence 379 */ getSet(int startLen, boolean implicit)380 public DerValue[] getSet(int startLen, boolean implicit) 381 throws IOException { 382 return getSet( 383 startLen, 384 implicit, 385 false); // no need to retain original encoded form 386 } 387 getSet(int startLen, boolean implicit, boolean originalEncodedFormRetained)388 public DerValue[] getSet(int startLen, boolean implicit, 389 boolean originalEncodedFormRetained) 390 throws IOException { 391 tag = (byte)buffer.read(); 392 if (!implicit) { 393 if (tag != DerValue.tag_Set) { 394 throw new IOException("Set tag error"); 395 } 396 } 397 return (readVector(startLen, originalEncodedFormRetained)); 398 } 399 400 /* 401 * Read a "vector" of values ... set or sequence have the 402 * same encoding, except for the initial tag, so both use 403 * this same helper routine. 404 */ readVector(int startLen)405 protected DerValue[] readVector(int startLen) throws IOException { 406 return readVector( 407 startLen, 408 false); // no need to retain original encoded form 409 } 410 411 /* 412 * Read a "vector" of values ... set or sequence have the 413 * same encoding, except for the initial tag, so both use 414 * this same helper routine. 415 */ readVector(int startLen, boolean originalEncodedFormRetained)416 protected DerValue[] readVector(int startLen, 417 boolean originalEncodedFormRetained) throws IOException { 418 DerInputStream newstr; 419 420 byte lenByte = (byte)buffer.read(); 421 int len = getLength(lenByte, buffer); 422 423 if (len == -1) { 424 // indefinite length encoding found 425 int readLen = buffer.available(); 426 int offset = 2; // for tag and length bytes 427 byte[] indefData = new byte[readLen + offset]; 428 indefData[0] = tag; 429 indefData[1] = lenByte; 430 DataInputStream dis = new DataInputStream(buffer); 431 dis.readFully(indefData, offset, readLen); 432 dis.close(); 433 DerIndefLenConverter derIn = new DerIndefLenConverter(); 434 buffer = new DerInputBuffer(derIn.convert(indefData)); 435 if (tag != buffer.read()) 436 throw new IOException("Indefinite length encoding" + 437 " not supported"); 438 len = DerInputStream.getLength(buffer); 439 } 440 441 if (len == 0) 442 // return empty array instead of null, which should be 443 // used only for missing optionals 444 return new DerValue[0]; 445 446 /* 447 * Create a temporary stream from which to read the data, 448 * unless it's not really needed. 449 */ 450 if (buffer.available() == len) 451 newstr = this; 452 else 453 newstr = subStream(len, true); 454 455 /* 456 * Pull values out of the stream. 457 */ 458 Vector<DerValue> vec = new Vector<DerValue>(startLen); 459 DerValue value; 460 461 do { 462 value = new DerValue(newstr.buffer, originalEncodedFormRetained); 463 vec.addElement(value); 464 } while (newstr.available() > 0); 465 466 if (newstr.available() != 0) 467 throw new IOException("Extra data at end of vector"); 468 469 /* 470 * Now stick them into the array we're returning. 471 */ 472 int i, max = vec.size(); 473 DerValue[] retval = new DerValue[max]; 474 475 for (i = 0; i < max; i++) 476 retval[i] = vec.elementAt(i); 477 478 return retval; 479 } 480 481 /** 482 * Get a single DER-encoded value from the input stream. 483 * It can often be useful to pull a value from the stream 484 * and defer parsing it. For example, you can pull a nested 485 * sequence out with one call, and only examine its elements 486 * later when you really need to. 487 */ getDerValue()488 public DerValue getDerValue() throws IOException { 489 return new DerValue(buffer); 490 } 491 492 /** 493 * Read a string that was encoded as a UTF8String DER value. 494 */ getUTF8String()495 public String getUTF8String() throws IOException { 496 return readString(DerValue.tag_UTF8String, "UTF-8", "UTF8"); 497 } 498 499 /** 500 * Read a string that was encoded as a PrintableString DER value. 501 */ getPrintableString()502 public String getPrintableString() throws IOException { 503 return readString(DerValue.tag_PrintableString, "Printable", 504 "ASCII"); 505 } 506 507 /** 508 * Read a string that was encoded as a T61String DER value. 509 */ getT61String()510 public String getT61String() throws IOException { 511 /* 512 * Works for common characters between T61 and ASCII. 513 */ 514 return readString(DerValue.tag_T61String, "T61", "ISO-8859-1"); 515 } 516 517 /** 518 * Read a string that was encoded as a IA5tring DER value. 519 */ getIA5String()520 public String getIA5String() throws IOException { 521 return readString(DerValue.tag_IA5String, "IA5", "ASCII"); 522 } 523 524 /** 525 * Read a string that was encoded as a BMPString DER value. 526 */ getBMPString()527 public String getBMPString() throws IOException { 528 return readString(DerValue.tag_BMPString, "BMP", 529 "UnicodeBigUnmarked"); 530 } 531 532 /** 533 * Read a string that was encoded as a GeneralString DER value. 534 */ getGeneralString()535 public String getGeneralString() throws IOException { 536 return readString(DerValue.tag_GeneralString, "General", 537 "ASCII"); 538 } 539 540 /** 541 * Private helper routine to read an encoded string from the input 542 * stream. 543 * @param stringTag the tag for the type of string to read 544 * @param stringName a name to display in error messages 545 * @param enc the encoder to use to interpret the data. Should 546 * correspond to the stringTag above. 547 */ readString(byte stringTag, String stringName, String enc)548 private String readString(byte stringTag, String stringName, 549 String enc) throws IOException { 550 551 if (buffer.read() != stringTag) 552 throw new IOException("DER input not a " + 553 stringName + " string"); 554 555 int length = getLength(buffer); 556 byte[] retval = new byte[length]; 557 if ((length != 0) && (buffer.read(retval) != length)) 558 throw new IOException("Short read of DER " + 559 stringName + " string"); 560 561 return new String(retval, enc); 562 } 563 564 /** 565 * Get a UTC encoded time value from the input stream. 566 */ getUTCTime()567 public Date getUTCTime() throws IOException { 568 if (buffer.read() != DerValue.tag_UtcTime) 569 throw new IOException("DER input, UTCtime tag invalid "); 570 return buffer.getUTCTime(getLength(buffer)); 571 } 572 573 /** 574 * Get a Generalized encoded time value from the input stream. 575 */ getGeneralizedTime()576 public Date getGeneralizedTime() throws IOException { 577 if (buffer.read() != DerValue.tag_GeneralizedTime) 578 throw new IOException("DER input, GeneralizedTime tag invalid "); 579 return buffer.getGeneralizedTime(getLength(buffer)); 580 } 581 582 /* 583 * Get a byte from the input stream. 584 */ 585 // package private getByte()586 int getByte() throws IOException { 587 return (0x00ff & buffer.read()); 588 } 589 peekByte()590 public int peekByte() throws IOException { 591 return buffer.peek(); 592 } 593 594 // package private getLength()595 int getLength() throws IOException { 596 return getLength(buffer); 597 } 598 599 /* 600 * Get a length from the input stream, allowing for at most 32 bits of 601 * encoding to be used. (Not the same as getting a tagged integer!) 602 * 603 * @return the length or -1 if indefinite length found. 604 * @exception IOException on parsing error or unsupported lengths. 605 */ getLength(InputStream in)606 static int getLength(InputStream in) throws IOException { 607 return getLength(in.read(), in); 608 } 609 610 /* 611 * Get a length from the input stream, allowing for at most 32 bits of 612 * encoding to be used. (Not the same as getting a tagged integer!) 613 * 614 * @return the length or -1 if indefinite length found. 615 * @exception IOException on parsing error or unsupported lengths. 616 */ getLength(int lenByte, InputStream in)617 static int getLength(int lenByte, InputStream in) throws IOException { 618 int value, tmp; 619 if (lenByte == -1) { 620 throw new IOException("Short read of DER length"); 621 } 622 623 String mdName = "DerInputStream.getLength(): "; 624 tmp = lenByte; 625 if ((tmp & 0x080) == 0x00) { // short form, 1 byte datum 626 value = tmp; 627 } else { // long form or indefinite 628 tmp &= 0x07f; 629 630 /* 631 * NOTE: tmp == 0 indicates indefinite length encoded data. 632 * tmp > 4 indicates more than 4Gb of data. 633 */ 634 if (tmp == 0) 635 return -1; 636 if (tmp < 0 || tmp > 4) 637 throw new IOException(mdName + "lengthTag=" + tmp + ", " 638 + ((tmp < 0) ? "incorrect DER encoding." : "too big.")); 639 640 value = 0x0ff & in.read(); 641 tmp--; 642 if (value == 0) { 643 // DER requires length value be encoded in minimum number of bytes 644 throw new IOException(mdName + "Redundant length bytes found"); 645 } 646 while (tmp-- > 0) { 647 value <<= 8; 648 value += 0x0ff & in.read(); 649 } 650 if (value < 0) { 651 throw new IOException(mdName + "Invalid length bytes"); 652 } else if (value <= 127) { 653 throw new IOException(mdName + "Should use short form for length"); 654 } 655 } 656 return value; 657 } 658 659 /** 660 * Mark the current position in the buffer, so that 661 * a later call to <code>reset</code> will return here. 662 */ mark(int value)663 public void mark(int value) { buffer.mark(value); } 664 665 666 /** 667 * Return to the position of the last <code>mark</code> 668 * call. A mark is implicitly set at the beginning of 669 * the stream when it is created. 670 */ reset()671 public void reset() { buffer.reset(); } 672 673 674 /** 675 * Returns the number of bytes available for reading. 676 * This is most useful for testing whether the stream is 677 * empty. 678 */ available()679 public int available() { return buffer.available(); } 680 } 681