archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 23:04:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8249783: Simplify DerValue and DerInputStream

Browse source 
Reviewed-by: valeriep
This commit is contained in:
Weijun Wang 2020-10-01 18:55:35 +00:00
parent 9230c2aaae
commit 3c4e824aa5
8 changed files with 867 additions and 1501 deletions
Download patch file Download diff file Expand all files Collapse all files

632
src/java.base/share/classes/sun/security/util/DerInputStream.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -28,11 +28,8 @@ package sun.security.util;
import java.io.InputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.nio.charset.Charset;
import java.util.Arrays;
import java.util.Date;
import java.util.Vector;
import static java.nio.charset.StandardCharsets.*;
/**
* A DER input stream, used for parsing ASN.1 DER-encoded data such as
@ -59,510 +56,173 @@ import static java.nio.charset.StandardCharsets.*;
public class DerInputStream {
/*
* This version only supports fully buffered DER. This is easy to
* work with, though if large objects are manipulated DER becomes
* awkward to deal with. That's where BER is useful, since BER
* handles streaming data relatively well.
*/
DerInputBuffer buffer;
// The static part
final byte[] data;
final int start; // inclusive
final int end; // exclusive
final boolean allowBER;
/** The DER tag of the value; one of the tag_ constants. */
public byte tag;
// The moving part
int pos;
int mark;
/**
* Create a DER input stream from a data buffer. The buffer is not
* copied, it is shared. Accordingly, the buffer should be treated
* as read-only.
* Constructs a DerInputStream by assigning all its fields.
*
* @param data the buffer from which to create the string (CONSUMED)
* No checking on arguments since all callers are internal.
* {@code data} should never be null even if length is 0.
*/
public DerInputStream(byte[] data, int start, int length, boolean allowBER) {
this.data = data;
this.start = start;
this.end = start + length;
this.allowBER = allowBER;
this.pos = start;
this.mark = start;
}
public DerInputStream(byte[] data) throws IOException {
init(data, 0, data.length, true);
this(data, 0, data.length, true);
}
/**
* Create a DER input stream from part of a data buffer with
* additional arg to control whether DER checks are enforced.
* The buffer is not copied, it is shared. Accordingly, the
* buffer should be treated as read-only.
*
* @param data the buffer from which to create the string (CONSUMED)
* @param offset the first index of <em>data</em> which will
* be read as DER input in the new stream
* @param len how long a chunk of the buffer to use,
* starting at "offset"
* @param allowBER whether to allow constructed indefinite-length
* encoding as well as tolerate leading 0s
*/
public DerInputStream(byte[] data, int offset, int len,
boolean allowBER) throws IOException {
init(data, offset, len, allowBER);
}
/**
* Create a DER input stream from part of a data buffer.
* The buffer is not copied, it is shared. Accordingly, the
* buffer should be treated as read-only.
*
* @param data the buffer from which to create the string (CONSUMED)
* @param offset the first index of <em>data</em> which will
* be read as DER input in the new stream
* @param len how long a chunk of the buffer to use,
* starting at "offset"
*/
public DerInputStream(byte[] data, int offset, int len) throws IOException {
init(data, offset, len, true);
}
/*
* private helper routine
*/
private void init(byte[] data, int offset, int len, boolean allowBER) throws IOException {
if ((offset+2 > data.length) || (offset+len > data.length)) {
throw new IOException("Encoding bytes too short");
}
// check for indefinite length encoding
if (DerIndefLenConverter.isIndefinite(data[offset+1])) {
if (!allowBER) {
throw new IOException("Indefinite length BER encoding found");
} else {
byte[] inData = new byte[len];
System.arraycopy(data, offset, inData, 0, len);
DerIndefLenConverter derIn = new DerIndefLenConverter();
byte[] result = derIn.convertBytes(inData);
if (result == null) {
throw new IOException("not all indef len BER resolved");
} else {
buffer = new DerInputBuffer(result, allowBER);
}
}
} else {
buffer = new DerInputBuffer(data, offset, len, allowBER);
}
buffer.mark(Integer.MAX_VALUE);
}
DerInputStream(DerInputBuffer buf) {
buffer = buf;
buffer.mark(Integer.MAX_VALUE);
this(data, offset, len, true);
}
/**
* Creates a new DER input stream from part of this input stream.
*
* @param len how long a chunk of the current input stream to use,
* starting at the current position.
* @param do_skip true if the existing data in the input stream should
* be skipped. If this value is false, the next data read
* on this stream and the newly created stream will be the
* same.
*/
public DerInputStream subStream(int len, boolean do_skip)
throws IOException {
DerInputBuffer newbuf = buffer.dup();
newbuf.truncate(len);
if (do_skip) {
buffer.skip(len);
}
return new DerInputStream(newbuf);
}
/**
* Return what has been written to this DerInputStream
* as a byte array. Useful for debugging.
* Returns the remaining unread bytes, or, all bytes if none read yet.
*/
public byte[] toByteArray() {
return buffer.toByteArray();
return Arrays.copyOfRange(data, pos, end);
}
/*
* PRIMITIVES -- these are "universal" ASN.1 simple types.
/**
* Reads a DerValue from this stream. After the call, the data pointer
* is right after this DerValue so that the next call will read the
* next DerValue.
*
* INTEGER, ENUMERATED, BIT STRING, OCTET STRING, NULL
* OBJECT IDENTIFIER, SEQUENCE (OF), SET (OF)
* UTF8String, PrintableString, T61String, IA5String, UTCTime,
* GeneralizedTime, BMPString.
* Note: UniversalString not supported till encoder is available.
*/
/**
* Get an integer from the input stream as an integer.
*
* @return the integer held in this DER input stream.
*/
public int getInteger() throws IOException {
if (buffer.read() != DerValue.tag_Integer) {
throw new IOException("DER input, Integer tag error");
}
return buffer.getInteger(getDefiniteLength(buffer));
}
/**
* Get a integer from the input stream as a BigInteger object.
*
* @return the integer held in this DER input stream.
*/
public BigInteger getBigInteger() throws IOException {
if (buffer.read() != DerValue.tag_Integer) {
throw new IOException("DER input, Integer tag error");
}
return buffer.getBigInteger(getDefiniteLength(buffer), false);
}
/**
* Returns an ASN.1 INTEGER value as a positive BigInteger.
* This is just to deal with implementations that incorrectly encode
* some values as negative.
*
* @return the integer held in this DER value as a BigInteger.
*/
public BigInteger getPositiveBigInteger() throws IOException {
if (buffer.read() != DerValue.tag_Integer) {
throw new IOException("DER input, Integer tag error");
}
return buffer.getBigInteger(getDefiniteLength(buffer), true);
}
/**
* Get an enumerated from the input stream.
*
* @return the integer held in this DER input stream.
*/
public int getEnumerated() throws IOException {
if (buffer.read() != DerValue.tag_Enumerated) {
throw new IOException("DER input, Enumerated tag error");
}
return buffer.getInteger(getDefiniteLength(buffer));
}
/**
* Get a bit string from the input stream. Padded bits (if any)
* will be stripped off before the bit string is returned.
*/
public byte[] getBitString() throws IOException {
if (buffer.read() != DerValue.tag_BitString)
throw new IOException("DER input not an bit string");
return buffer.getBitString(getDefiniteLength(buffer));
}
/**
* Get a bit string from the input stream. The bit string need
* not be byte-aligned.
*/
public BitArray getUnalignedBitString() throws IOException {
if (buffer.read() != DerValue.tag_BitString) {
throw new IOException("DER input not a bit string");
}
int length = getDefiniteLength(buffer);
if (length == 0) {
return new BitArray(0);
}
/*
* First byte = number of excess bits in the last octet of the
* representation.
*/
length--;
int excessBits = buffer.read();
if (excessBits < 0) {
throw new IOException("Unused bits of bit string invalid");
}
int validBits = length*8 - excessBits;
if (validBits < 0) {
throw new IOException("Valid bits of bit string invalid");
}
byte[] repn = new byte[length];
if ((length != 0) && (buffer.read(repn) != length)) {
throw new IOException("Short read of DER bit string");
}
return new BitArray(validBits, repn);
}
/**
* Returns an ASN.1 OCTET STRING from the input stream.
*/
public byte[] getOctetString() throws IOException {
if (buffer.read() != DerValue.tag_OctetString)
throw new IOException("DER input not an octet string");
int length = getDefiniteLength(buffer);
byte[] retval = new byte[length];
if ((length != 0) && (buffer.read(retval) != length))
throw new IOException("Short read of DER octet string");
return retval;
}
/**
* Returns the asked number of bytes from the input stream.
*/
public void getBytes(byte[] val) throws IOException {
if ((val.length != 0) && (buffer.read(val) != val.length)) {
throw new IOException("Short read of DER octet string");
}
}
/**
* Reads an encoded null value from the input stream.
*/
public void getNull() throws IOException {
if (buffer.read() != DerValue.tag_Null || buffer.read() != 0)
throw new IOException("getNull, bad data");
}
/**
* Reads an X.200 style Object Identifier from the stream.
*/
public ObjectIdentifier getOID() throws IOException {
return new ObjectIdentifier(this);
}
/**
* Return a sequence of encoded entities. ASN.1 sequences are
* ordered, and they are often used, like a "struct" in C or C++,
* to group data values. They may have optional or context
* specific values.
*
* @param startLen guess about how long the sequence will be
* (used to initialize an auto-growing data structure)
* @return array of the values in the sequence
*/
public DerValue[] getSequence(int startLen) throws IOException {
tag = (byte)buffer.read();
if (tag != DerValue.tag_Sequence)
throw new IOException("Sequence tag error");
return readVector(startLen);
}
/**
* Return a set of encoded entities. ASN.1 sets are unordered,
* though DER may specify an order for some kinds of sets (such
* as the attributes in an X.500 relative distinguished name)
* to facilitate binary comparisons of encoded values.
*
* @param startLen guess about how large the set will be
* (used to initialize an auto-growing data structure)
* @return array of the values in the sequence
*/
public DerValue[] getSet(int startLen) throws IOException {
tag = (byte)buffer.read();
if (tag != DerValue.tag_Set)
throw new IOException("Set tag error");
return readVector(startLen);
}
/**
* Return a set of encoded entities. ASN.1 sets are unordered,
* though DER may specify an order for some kinds of sets (such
* as the attributes in an X.500 relative distinguished name)
* to facilitate binary comparisons of encoded values.
*
* @param startLen guess about how large the set will be
* (used to initialize an auto-growing data structure)
* @param implicit if true tag is assumed implicit.
* @return array of the values in the sequence
*/
public DerValue[] getSet(int startLen, boolean implicit)
throws IOException {
tag = (byte)buffer.read();
if (!implicit) {
if (tag != DerValue.tag_Set) {
throw new IOException("Set tag error");
}
}
return (readVector(startLen));
}
/*
* Read a "vector" of values ... set or sequence have the
* same encoding, except for the initial tag, so both use
* this same helper routine.
*/
protected DerValue[] readVector(int startLen) throws IOException {
DerInputStream newstr;
byte lenByte = (byte)buffer.read();
int len = getLength(lenByte, buffer);
if (len == -1) {
// indefinite length encoding found
buffer = new DerInputBuffer(
DerIndefLenConverter.convertStream(buffer, lenByte, tag),
buffer.allowBER);
if (tag != buffer.read())
throw new IOException("Indefinite length encoding" +
" not supported");
len = DerInputStream.getDefiniteLength(buffer);
}
if (len == 0)
// return empty array instead of null, which should be
// used only for missing optionals
return new DerValue[0];
/*
* Create a temporary stream from which to read the data,
* unless it's not really needed.
*/
if (buffer.available() == len)
newstr = this;
else
newstr = subStream(len, true);
/*
* Pull values out of the stream.
*/
Vector<DerValue> vec = new Vector<>(startLen);
DerValue value;
do {
value = new DerValue(newstr.buffer, buffer.allowBER);
vec.addElement(value);
} while (newstr.available() > 0);
if (newstr.available() != 0)
throw new IOException("Extra data at end of vector");
/*
* Now stick them into the array we're returning.
*/
int i, max = vec.size();
DerValue[] retval = new DerValue[max];
for (i = 0; i < max; i++)
retval[i] = vec.elementAt(i);
return retval;
}
/**
* Get a single DER-encoded value from the input stream.
* It can often be useful to pull a value from the stream
* and defer parsing it. For example, you can pull a nested
* sequence out with one call, and only examine its elements
* later when you really need to.
* @return the read DerValue.
* @throws IOException if a DerValue cannot be constructed starting from
* this position because of byte shortage or encoding error.
*/
public DerValue getDerValue() throws IOException {
return new DerValue(buffer);
DerValue result = new DerValue(
this.data, this.pos, this.end - this.pos, this.allowBER, true);
if (result.buffer != this.data) {
// Indefinite length observed. Unused bytes in data are appended
// to the end of return value by DerIndefLenConverter::convertBytes
// and stay inside result.buffer.
int unused = result.buffer.length - result.end;
this.pos = this.data.length - unused;
} else {
this.pos = result.end;
}
return result;
}
// The following getXyz methods are mostly shorthands for getDerValue().getXyz().
public int getInteger() throws IOException {
return getDerValue().getInteger();
}
public BigInteger getBigInteger() throws IOException {
return getDerValue().getBigInteger();
}
public BigInteger getPositiveBigInteger() throws IOException {
return getDerValue().getPositiveBigInteger();
}
public int getEnumerated() throws IOException {
return getDerValue().getEnumerated();
}
public byte[] getBitString() throws IOException {
return getDerValue().getBitString();
}
public BitArray getUnalignedBitString() throws IOException {
return getDerValue().getUnalignedBitString();
}
public byte[] getOctetString() throws IOException {
// Not identical to DerValue::getOctetString. This method
// does not accept constructed OCTET STRING.
DerValue v = getDerValue();
if (v.tag != DerValue.tag_OctetString) {
throw new IOException("DER input not an octet string");
}
return v.getOctetString();
}
public void getNull() throws IOException {
getDerValue().getNull();
}
public ObjectIdentifier getOID() throws IOException {
return getDerValue().getOID();
}
/**
* Read a string that was encoded as a UTF8String DER value.
*/
public String getUTF8String() throws IOException {
return readString(DerValue.tag_UTF8String, "UTF-8", UTF_8);
return getDerValue().getUTF8String();
}
/**
* Read a string that was encoded as a PrintableString DER value.
*/
public String getPrintableString() throws IOException {
return readString(DerValue.tag_PrintableString, "Printable",
US_ASCII);
return getDerValue().getPrintableString();
}
/**
* Read a string that was encoded as a T61String DER value.
*/
public String getT61String() throws IOException {
/*
* Works for common characters between T61 and ASCII.
*/
return readString(DerValue.tag_T61String, "T61", ISO_8859_1);
return getDerValue().getT61String();
}
/**
* Read a string that was encoded as a IA5String DER value.
*/
public String getIA5String() throws IOException {
return readString(DerValue.tag_IA5String, "IA5", US_ASCII);
}
/**
* Read a string that was encoded as a BMPString DER value.
*/
public String getBMPString() throws IOException {
return readString(DerValue.tag_BMPString, "BMP", UTF_16BE);
return getDerValue().getBMPString();
}
public String getIA5String() throws IOException {
return getDerValue().getIA5String();
}
/**
* Read a string that was encoded as a GeneralString DER value.
*/
public String getGeneralString() throws IOException {
return readString(DerValue.tag_GeneralString, "General",
US_ASCII);
return getDerValue().getGeneralString();
}
/**
* Private helper routine to read an encoded string from the input
* stream.
* @param stringTag the tag for the type of string to read
* @param stringName a name to display in error messages
* @param enc the encoder to use to interpret the data. Should
* correspond to the stringTag above.
*/
private String readString(byte stringTag, String stringName,
Charset charset) throws IOException {
if (buffer.read() != stringTag)
throw new IOException("DER input not a " +
stringName + " string");
int length = getDefiniteLength(buffer);
byte[] retval = new byte[length];
if ((length != 0) && (buffer.read(retval) != length))
throw new IOException("Short read of DER " +
stringName + " string");
return new String(retval, charset);
}
/**
* Get a UTC encoded time value from the input stream.
*/
public Date getUTCTime() throws IOException {
if (buffer.read() != DerValue.tag_UtcTime)
throw new IOException("DER input, UTCtime tag invalid ");
return buffer.getUTCTime(getDefiniteLength(buffer));
return getDerValue().getUTCTime();
}
/**
* Get a Generalized encoded time value from the input stream.
*/
public Date getGeneralizedTime() throws IOException {
if (buffer.read() != DerValue.tag_GeneralizedTime)
throw new IOException("DER input, GeneralizedTime tag invalid ");
return buffer.getGeneralizedTime(getDefiniteLength(buffer));
return getDerValue().getGeneralizedTime();
}
/*
* Get a byte from the input stream.
*/
// package private
int getByte() throws IOException {
return (0x00ff & buffer.read());
// Read a series of DerValue objects which is the sub-elements
// of a SEQUENCE and SET.
public DerValue[] getSequence(int startLen) throws IOException {
return getDerValue().subs(DerValue.tag_Sequence, startLen);
}
public DerValue[] getSet(int startLen) throws IOException {
return getDerValue().subs(DerValue.tag_Set, startLen);
}
public DerValue[] getSet(int startLen, boolean implicit) throws IOException {
if (implicit) {
return getDerValue().subs((byte) 0, startLen);
} else {
return getSet(startLen);
}
}
public int peekByte() throws IOException {
return buffer.peek();
if (pos == end) {
throw new IOException("At end");
}
return data[pos];
}
// package private
int getLength() throws IOException {
return getLength(buffer);
}
/*
/**
* Get a length from the input stream, allowing for at most 32 bits of
* encoding to be used. (Not the same as getting a tagged integer!)
*
@ -570,38 +230,26 @@ public class DerInputStream {
* @exception IOException on parsing error or unsupported lengths.
*/
static int getLength(InputStream in) throws IOException {
return getLength(in.read(), in);
}
/*
* Get a length from the input stream, allowing for at most 32 bits of
* encoding to be used. (Not the same as getting a tagged integer!)
*
* @return the length or -1 if indefinite length found.
* @exception IOException on parsing error or unsupported lengths.
*/
static int getLength(int lenByte, InputStream in) throws IOException {
int value, tmp;
int lenByte = in.read();
if (lenByte == -1) {
throw new IOException("Short read of DER length");
}
if (lenByte == 0x80) {
return -1;
}
int value, tmp;
String mdName = "DerInputStream.getLength(): ";
tmp = lenByte;
if ((tmp & 0x080) == 0x00) { // short form, 1 byte datum
value = tmp;
} else { // long form or indefinite
} else { // long form
tmp &= 0x07f;
/*
* NOTE: tmp == 0 indicates indefinite length encoded data.
* tmp > 4 indicates more than 4Gb of data.
*/
if (tmp == 0)
return -1;
if (tmp < 0 || tmp > 4)
throw new IOException(mdName + "lengthTag=" + tmp + ", "
+ ((tmp < 0) ? "incorrect DER encoding." : "too big."));
// tmp > 4 indicates more than 4Gb of data.
if (tmp > 4) {
throw new IOException(mdName + "lengthTag=" + tmp + ", too big.");
}
value = 0x0ff & in.read();
tmp--;
@ -622,12 +270,8 @@ public class DerInputStream {
return value;
}
int getDefiniteLength() throws IOException {
return getDefiniteLength(buffer);
}
/*
* Get a length from the input stream.
* Get a definite length from the input stream.
*
* @return the length
* @exception IOException on parsing error or if indefinite length found.
@ -643,22 +287,22 @@ public class DerInputStream {
/**
* Mark the current position in the buffer, so that
* a later call to <code>reset</code> will return here.
* The {@code readAheadLimit} is useless here because
* all data is available and we can go to anywhere at will.
*/
public void mark(int value) { buffer.mark(value); }
public void mark(int readAheadLimit) { mark = pos; }
/**
* Return to the position of the last <code>mark</code>
* call. A mark is implicitly set at the beginning of
* the stream when it is created.
*/
public void reset() { buffer.reset(); }
public void reset() { pos = mark; }
/**
* Returns the number of bytes available for reading.
* This is most useful for testing whether the stream is
* empty.
*/
public int available() { return buffer.available(); }
public int available() { return end - pos; }
}