1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
|
.\" $OpenBSD: ber_read_elements.3,v 1.4 2019/05/16 17:39:21 rob Exp $
.\"
.\" Copyright (c) 2007, 2012 Reyk Floeter <reyk@openbsd.org>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.Dd $Mdocdate: May 16 2019 $
.Dt BER_READ_ELEMENTS 3
.Os
.Sh NAME
.Nm ber_set_readbuf ,
.Nm ber_set_application ,
.Nm ber_read_elements ,
.Nm ber_get_writebuf ,
.Nm ber_write_elements ,
.Nm ber_free
.Nd encode and decode ASN.1 with Basic Encoding Rules
.Sh SYNOPSIS
.In sys/types.h
.In ber.h
.Ft "void"
.Fn "ber_set_readbuf" "struct ber *ber" "void *buf" "size_t len"
.Ft "void"
.Fo "ber_set_application"
.Fa "struct ber *ber"
.Fa "unsigned int (*cb)(struct ber_element *)"
.Fc
.Ft "struct ber_element *"
.Fn "ber_read_elements" "struct ber *ber" "struct ber_element *root"
.Ft "ssize_t"
.Fn "ber_get_writebuf" "struct ber *ber" "void **buf"
.Ft "ssize_t"
.Fn "ber_write_elements" "struct ber *ber" "struct ber_element *root"
.Ft "void"
.Fn "ber_free" "struct ber *ber"
.Sh DESCRIPTION
The BER API provides a mechanism to read and write ASN.1 using the
Basic Encoding Rules.
.Pp
Encoded BER is stored in the following structure:
.Bd -literal
struct ber {
off_t br_offs;
u_char *br_wbuf;
u_char *br_wptr;
u_char *br_wend;
u_char *br_rbuf;
u_char *br_rptr;
u_char *br_rend;
unsigned int (*br_application)(struct ber_element *);
};
.Ed
.Pp
.Fa br_rbuf
and
.Fa br_wbuf
are the read and write buffers for a BER byte stream.
These buffers are used when reading an existing byte stream (e.g. received from
a TLS connection), or when writing a new byte stream in preparation for
subsequent operations performed by the calling application (e.g. network
transmission or export to a file).
.Pp
Intermediary storage of BER elements during encoding and decoding uses the
following structure:
.Bd -literal
struct ber_element {
struct ber_element *be_next;
unsigned int be_type;
unsigned int be_encoding;
size_t be_len;
off_t be_offs;
int be_free;
u_int8_t be_class;
void (*be_cb)(void *, size_t);
void *be_cbarg;
union {
struct ber_element *bv_sub;
void *bv_val;
long long bv_numeric;
} be_union;
#define be_sub be_union.bv_sub
#define be_val be_union.bv_val
#define be_numeric be_union.bv_numeric
};
.Ed
.Pp
.Fn ber_set_readbuf
sets
.Fa br_rbuf
to point an input buffer of BER encoded bytes in preparation for decoding.
It is assumed that
.Fa br_rbuf
is already populated and available to the
application, commonly obtained by
.Xr read 2 ,
.Xr recv 2 ,
or
.Xr tls_read 3 .
.Pp
.Fn ber_read_elements
may then be called to parse, validate, and store the
.Fa ber
data stream into its
consituent
.Vt ber_element
parts for subsequent processing.
The calling application must have explicit knowledge of the expected data
types in order for correct decoding.
.Pp
.Fn ber_get_writebuf
sets
.Fa br_wbuf
to point to an output buffer for writing a BER byte stream.
.Pp
.Fn ber_write_elements
encodes
.Fa root
into a compliant BER byte stream which is written to
.Fa ber
for subsequent use by the calling
functions such as
.Xr send 2 ,
.Xr write 2 ,
or
.Xr tls_write 3 .
.Pp
.Fn ber_free
frees any dynamically allocated storage associated with
.Fa ber .
.Sh RETURN VALUES
.Fn ber_read_elements
returns a pointer to a fully populated list of one or more
.Vt ber_element
structures or
.Dv NULL
on a type mismatch or read error.
.Pp
.Fn ber_get_writebuf
returns the number of bytes contained within the buffer
.Fa buf
or \-1 on failure.
.Pp
.Fn ber_write_elements
returns the number of bytes written.
Otherwise \-1 is returned and the global variable
.Va errno
is set to indicate the error.
.Sh SEE ALSO
.Xr read 2 ,
.Xr recv 2 ,
.Xr send 2 ,
.Xr write 2 ,
.Xr ber_add_string 3 ,
.Xr ber_get_string 3 ,
.Xr ber_oid_cmp 3 ,
.Xr ber_set_header 3 ,
.Xr tls_read 3
.Sh STANDARDS
ITU-T Recommendation X.690, also known as ISO/IEC 8825-1:
Information technology - ASN.1 encoding rules.
.Sh HISTORY
These functions first appeared as internal functions in
.Xr snmpd 8
in
.Ox 4.2
and were moved to libutil in
.Ox 6.6 .
.Sh AUTHORS
.An -nosplit
The
.Nm ber
library was written by
.An Claudio Jeker Aq Mt claudio@openbsd.org ,
.An Marc Balmer Aq Mt marc@openbsd.org
and
.An Reyk Floeter Aq Mt reyk@openbsd.org .
.Sh CAVEATS
The
.Nm ber
API is subject to the following restrictions which are common to the
Distinguished Encoding Rules as defined by X.690:
.Pp
.Bl -enum -compact
.It
Only the definite form of length encoding shall be used, encoded in the
minimum number of octets.
.It
For bitstring, octetstring and restricted character string types, the
constructed form of encoding shall not be used.
.It
If a boolean encoding represents the boolean value TRUE, its single contents
octet shall have all eight bits set to one.
.It
Each unused bit in the final octet of the encoding of a bit string value shall
be set to zero.
.It
If a bitstring value has no 1 bits, then an encoder shall encode the value with
a length of 1 and an initial octet set to 0.
.El
.Pp
In addition, set and sequence values are limited to a maximum of 65535 elements.
No alternative encodings are permitted.
.Pp
.Do
Whereas the basic encoding rules give the sender of an encoding various choices
as to how data values may be encoded, the canonical and distinguished encoding
rules select just one encoding from those allowed by the basic encoding rules.
.Dc
.Bq X.690
.Pp
The restrictions placed on this API avoid the ambiguity inherent in
.Nm ber
encoded ASN.1 thereby acting as a security mitigation.
|
