4f84e20eb0
Previously, the semantics of mbedtls_mps_reader_commit() was to invalidate
all buffers previously fetched via mbedtls_mps_reader_get(), forbidding
any further use by the 'consumer'. This was in fact a necessary constraint
for the current implementation, which did some memory moving in
mbedtls_mps_reader_commit().
This commit simplifies the reader's semantics and implementation in
the following way:
- API: A call to mbedtls_mps_reader_commit() does no longer invalidate
the buffers previously obtained via mbedtls_mps_reader_get().
Instead, they can continue to be used until
mbedtls_mps_reader_reclaim() is called.
Calling mbedtls_mps_reader_commit() now only sets a marker
indicating which parts of the data received through
mbedtls_mps_reader_get() need not be backed up once
mbedtls_mps_reader_reclaim() is called. Allowing the user
to call mbedtls_mbedtls_reader_commit() multiple times
before mbedtls_mps_reader_reclaim() is mere convenience:
We'd get exactly the same functionality if instead of
mbedtls_mps_reader_commit(), there was an additional argument
to mbedtls_mps_reader_reclaim() indicating how much data
to retain. However, the present design is more convenient
for the user and doesn't appear to introduce any unnecessary
complexity (anymore), so we stick with it for now.
- Implementation: mbedtls_mps_reader_commit() is now a 1-liner,
setting the 'commit-marker', but doing nothing else.
Instead, the complexity of mbedtls_mp_reader_reclaim()
slightly increases because it has to deal with creating
backups from both the accumulator and the current
fragment. In the previous implementation, which shifted
the accumulator content with every call to
mbedtls_mps_reader_commit(), only the backup from the
fragment was necessary; with the new implementation
which doesn't shift anything in
mbedtls_mps_reader_commit(), we need to do the
accumulator shift in mbedtls_mps_reader_reclaim().
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
512 lines
18 KiB
C
512 lines
18 KiB
C
/*
|
|
* Message Processing Stack, Reader implementation
|
|
*
|
|
* Copyright The Mbed TLS Contributors
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*
|
|
* This file is part of Mbed TLS (https://tls.mbed.org)
|
|
*/
|
|
|
|
#include "mps_reader.h"
|
|
#include "mps_common.h"
|
|
#include "mps_trace.h"
|
|
|
|
#include <string.h>
|
|
|
|
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
|
|
!defined(inline) && !defined(__cplusplus)
|
|
#define inline __inline
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_MPS_ENABLE_TRACE)
|
|
static int mbedtls_mps_trace_id = MBEDTLS_MPS_TRACE_BIT_READER;
|
|
#endif /* MBEDTLS_MPS_ENABLE_TRACE */
|
|
|
|
/*
|
|
* GENERAL NOTE ON CODING STYLE
|
|
*
|
|
* The following code intentionally separates memory loads
|
|
* and stores from other operations (arithmetic or branches).
|
|
* This leads to the introduction of many local variables
|
|
* and significantly increases the C-code line count, but
|
|
* should not increase the size of generated assembly.
|
|
*
|
|
* This reason for this is twofold:
|
|
* (1) It will ease verification efforts using the VST
|
|
* whose program logic cannot directly reason
|
|
* about instructions containing a load or store in
|
|
* addition to other operations (e.g. *p = *q or
|
|
* tmp = *p + 42).
|
|
* (2) Operating on local variables and writing the results
|
|
* back to the target contexts on success only
|
|
* allows to maintain structure invariants even
|
|
* on failure - this in turn has two benefits:
|
|
* (2.a) If for some reason an error code is not caught
|
|
* and operation continues, functions are nonetheless
|
|
* called with sane contexts, reducing the risk
|
|
* of dangerous behavior.
|
|
* (2.b) Randomized testing is easier if structures
|
|
* remain intact even in the face of failing
|
|
* and/or non-sensical calls.
|
|
* Moreover, it might even reduce code-size because
|
|
* the compiler need not write back temporary results
|
|
* to memory in case of failure.
|
|
*
|
|
*/
|
|
|
|
static inline void mps_reader_zero( mbedtls_mps_reader *rd )
|
|
{
|
|
/* A plain memset() would likely be more efficient,
|
|
* but the current way of zeroing makes it harder
|
|
* to overlook fields which should not be zero-initialized.
|
|
* It's also more suitable for VF efforts since it
|
|
* doesn't require reasoning about structs being
|
|
* interpreted as unstructured binary blobs. */
|
|
static mbedtls_mps_reader const zero =
|
|
{ .frag = NULL,
|
|
.frag_len = 0,
|
|
.commit = 0,
|
|
.end = 0,
|
|
.pending = 0,
|
|
.acc = NULL,
|
|
.acc_len = 0,
|
|
.acc_avail = 0,
|
|
.acc_share = { .acc_remaining = 0 }
|
|
};
|
|
*rd = zero;
|
|
}
|
|
|
|
int mbedtls_mps_reader_init( mbedtls_mps_reader *rd,
|
|
unsigned char *acc,
|
|
mbedtls_mps_size_t acc_len )
|
|
{
|
|
MBEDTLS_MPS_TRACE_INIT( "reader_init, acc len %u", (unsigned) acc_len );
|
|
mps_reader_zero( rd );
|
|
rd->acc = acc;
|
|
rd->acc_len = acc_len;
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|
|
|
|
int mbedtls_mps_reader_free( mbedtls_mps_reader *rd )
|
|
{
|
|
MBEDTLS_MPS_TRACE_INIT( "reader_free" );
|
|
mps_reader_zero( rd );
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|
|
|
|
int mbedtls_mps_reader_feed( mbedtls_mps_reader *rd,
|
|
unsigned char *new_frag,
|
|
mbedtls_mps_size_t new_frag_len )
|
|
{
|
|
unsigned char *acc;
|
|
mbedtls_mps_size_t copy_to_acc;
|
|
MBEDTLS_MPS_TRACE_INIT( "reader_feed, frag %p, len %u",
|
|
(void*) new_frag, (unsigned) new_frag_len );
|
|
|
|
if( new_frag == NULL )
|
|
MBEDTLS_MPS_TRACE_RETURN( MBEDTLS_ERR_MPS_READER_INVALID_ARG );
|
|
|
|
MBEDTLS_MPS_STATE_VALIDATE_RAW( rd->frag == NULL,
|
|
"mbedtls_mps_reader_feed() requires reader to be in producing mode" );
|
|
|
|
acc = rd->acc;
|
|
if( acc != NULL )
|
|
{
|
|
mbedtls_mps_size_t aa, ar;
|
|
|
|
ar = rd->acc_share.acc_remaining;
|
|
aa = rd->acc_avail;
|
|
|
|
copy_to_acc = ar;
|
|
if( copy_to_acc > new_frag_len )
|
|
copy_to_acc = new_frag_len;
|
|
|
|
acc += aa;
|
|
|
|
if( copy_to_acc > 0 )
|
|
memcpy( acc, new_frag, copy_to_acc );
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Copy new data of size %u of %u into accumulator at offset %u",
|
|
(unsigned) copy_to_acc, (unsigned) new_frag_len, (unsigned) aa );
|
|
|
|
/* Check if, with the new fragment, we have enough data. */
|
|
ar -= copy_to_acc;
|
|
if( ar > 0 )
|
|
{
|
|
/* Need more data */
|
|
aa += copy_to_acc;
|
|
rd->acc_share.acc_remaining = ar;
|
|
rd->acc_avail = aa;
|
|
MBEDTLS_MPS_TRACE_RETURN( MBEDTLS_ERR_MPS_READER_NEED_MORE );
|
|
}
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Enough data available to serve user request" );
|
|
|
|
rd->acc_share.frag_offset = aa;
|
|
aa += copy_to_acc;
|
|
rd->acc_avail = aa;
|
|
}
|
|
else
|
|
{
|
|
rd->acc_share.frag_offset = 0;
|
|
}
|
|
|
|
rd->frag = new_frag;
|
|
rd->frag_len = new_frag_len;
|
|
rd->commit = 0;
|
|
rd->end = 0;
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|
|
|
|
|
|
int mbedtls_mps_reader_get( mbedtls_mps_reader *rd,
|
|
mbedtls_mps_size_t desired,
|
|
unsigned char **buffer,
|
|
mbedtls_mps_size_t *buflen )
|
|
{
|
|
unsigned char *frag, *acc;
|
|
mbedtls_mps_size_t end, fo, fl, frag_fetched, frag_remaining;
|
|
MBEDTLS_MPS_TRACE_INIT( "reader_get %p, desired %u",
|
|
(void*) rd, (unsigned) desired );
|
|
|
|
frag = rd->frag;
|
|
MBEDTLS_MPS_STATE_VALIDATE_RAW( frag != NULL,
|
|
"mbedtls_mps_reader_get() requires reader to be in consuming mode" );
|
|
|
|
/* The fragment offset indicates the offset of the fragment
|
|
* from the accmulator, if the latter is present. Use a offset
|
|
* of \c 0 if no accumulator is used. */
|
|
acc = rd->acc;
|
|
if( acc == NULL )
|
|
fo = 0;
|
|
else
|
|
fo = rd->acc_share.frag_offset;
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"frag_off %u, end %u, acc_avail %d",
|
|
(unsigned) fo, (unsigned) rd->end,
|
|
acc == NULL ? -1 : (int) rd->acc_avail );
|
|
|
|
/* Check if we're still serving from the accumulator. */
|
|
end = rd->end;
|
|
if( end < fo )
|
|
{
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Serve the request from the accumulator" );
|
|
if( fo - end < desired )
|
|
{
|
|
/* Illustration of supported and unsupported cases:
|
|
*
|
|
* - Allowed #1
|
|
*
|
|
* +-----------------------------------+
|
|
* | frag |
|
|
* +-----------------------------------+
|
|
*
|
|
* end end+desired
|
|
* | |
|
|
* +-----v-------v-------------+
|
|
* | acc |
|
|
* +---------------------------+
|
|
* | |
|
|
* fo/frag_offset aa/acc_avail
|
|
*
|
|
* - Allowed #2
|
|
*
|
|
* +-----------------------------------+
|
|
* | frag |
|
|
* +-----------------------------------+
|
|
*
|
|
* end end+desired
|
|
* | |
|
|
* +----------v----------------v
|
|
* | acc |
|
|
* +---------------------------+
|
|
* | |
|
|
* fo/frag_offset aa/acc_avail
|
|
*
|
|
* - Not allowed #1 (could be served, but we don't actually use it):
|
|
*
|
|
* +-----------------------------------+
|
|
* | frag |
|
|
* +-----------------------------------+
|
|
*
|
|
* end end+desired
|
|
* | |
|
|
* +------v-------------v------+
|
|
* | acc |
|
|
* +---------------------------+
|
|
* | |
|
|
* fo/frag_offset aa/acc_avail
|
|
*
|
|
*
|
|
* - Not allowed #2 (can't be served with a contiguous buffer):
|
|
*
|
|
* +-----------------------------------+
|
|
* | frag |
|
|
* +-----------------------------------+
|
|
*
|
|
* end end + desired
|
|
* | |
|
|
* +------v--------------------+ v
|
|
* | acc |
|
|
* +---------------------------+
|
|
* | |
|
|
* fo/frag_offset aa/acc_avail
|
|
*
|
|
* In case of Allowed #1 and #2 we're switching to serve from
|
|
* `frag` starting from the next call to mbedtls_mps_reader_get().
|
|
*/
|
|
|
|
mbedtls_mps_size_t aa;
|
|
aa = rd->acc_avail;
|
|
if( aa - end != desired )
|
|
{
|
|
/* It might be possible to serve some of these situations by
|
|
* making additional space in the accumulator, removing those
|
|
* parts that have already been committed.
|
|
* On the other hand, this brings additional complexity and
|
|
* enlarges the code size, while there doesn't seem to be a use
|
|
* case where we don't attempt exactly the same `get` calls when
|
|
* resuming on a reader than what we tried before pausing it.
|
|
* If we believe we adhere to this restricted usage throughout
|
|
* the library, this check is a good opportunity to
|
|
* validate this. */
|
|
MBEDTLS_MPS_TRACE_RETURN(
|
|
MBEDTLS_ERR_MPS_READER_INCONSISTENT_REQUESTS );
|
|
}
|
|
}
|
|
|
|
acc += end;
|
|
*buffer = acc;
|
|
if( buflen != NULL )
|
|
*buflen = desired;
|
|
|
|
end += desired;
|
|
rd->end = end;
|
|
rd->pending = 0;
|
|
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|
|
|
|
/* Attempt to serve the request from the current fragment */
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Serve the request from the current fragment." );
|
|
|
|
fl = rd->frag_len;
|
|
frag_fetched = end - fo; /* The amount of data from the current fragment
|
|
* that has already been passed to the user. */
|
|
frag += frag_fetched;
|
|
frag_remaining = fl - frag_fetched; /* Remaining data in fragment */
|
|
|
|
/* Check if we can serve the read request from the fragment. */
|
|
if( frag_remaining < desired )
|
|
{
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"There's not enough data in the current fragment "
|
|
"to serve the request." );
|
|
/* There's not enough data in the current fragment,
|
|
* so either just RETURN what we have or fail. */
|
|
if( buflen == NULL )
|
|
{
|
|
if( frag_remaining > 0 )
|
|
{
|
|
rd->pending = desired - frag_remaining;
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Remember to collect %u bytes before re-opening",
|
|
(unsigned) rd->pending );
|
|
}
|
|
MBEDTLS_MPS_TRACE_RETURN( MBEDTLS_ERR_MPS_READER_OUT_OF_DATA );
|
|
}
|
|
|
|
desired = frag_remaining;
|
|
}
|
|
|
|
/* There's enough data in the current fragment to serve the
|
|
* (potentially modified) read request. */
|
|
*buffer = frag;
|
|
if( buflen != NULL )
|
|
*buflen = desired;
|
|
|
|
end += desired;
|
|
rd->end = end;
|
|
rd->pending = 0;
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|
|
|
|
int mbedtls_mps_reader_commit( mbedtls_mps_reader *rd )
|
|
{
|
|
mbedtls_mps_size_t end;
|
|
MBEDTLS_MPS_TRACE_INIT( "reader_commit" );
|
|
MBEDTLS_MPS_STATE_VALIDATE_RAW( rd->frag != NULL,
|
|
"mbedtls_mps_reader_commit() requires reader to be in consuming mode" );
|
|
|
|
end = rd->end;
|
|
rd->commit = end;
|
|
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|
|
|
|
int mbedtls_mps_reader_reclaim( mbedtls_mps_reader *rd,
|
|
mbedtls_mps_size_t *paused )
|
|
{
|
|
unsigned char *frag, *acc;
|
|
mbedtls_mps_size_t pending, commit;
|
|
mbedtls_mps_size_t al, fo, fl;
|
|
MBEDTLS_MPS_TRACE_INIT( "mbedtls_mps_reader_reclaim" );
|
|
|
|
if( paused != NULL )
|
|
*paused = 0;
|
|
|
|
frag = rd->frag;
|
|
MBEDTLS_MPS_STATE_VALIDATE_RAW( frag != NULL,
|
|
"mbedtls_mps_reader_reclaim() requires reader to be in consuming mode" );
|
|
|
|
acc = rd->acc;
|
|
pending = rd->pending;
|
|
commit = rd->commit;
|
|
fl = rd->frag_len;
|
|
|
|
if( acc == NULL )
|
|
fo = 0;
|
|
else
|
|
fo = rd->acc_share.frag_offset;
|
|
|
|
if( pending == 0 )
|
|
{
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"No unsatisfied read-request has been logged." );
|
|
|
|
/* Check if there's data left to be consumed. */
|
|
if( commit < fo || commit - fo < fl )
|
|
{
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"There is data left to be consumed." );
|
|
rd->end = commit;
|
|
MBEDTLS_MPS_TRACE_RETURN( MBEDTLS_ERR_MPS_READER_DATA_LEFT );
|
|
}
|
|
|
|
rd->acc_avail = 0;
|
|
rd->acc_share.acc_remaining = 0;
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Fragment has been fully processed and committed." );
|
|
}
|
|
else
|
|
{
|
|
int overflow;
|
|
|
|
mbedtls_mps_size_t acc_backup_offset;
|
|
mbedtls_mps_size_t acc_backup_len;
|
|
mbedtls_mps_size_t frag_backup_offset;
|
|
mbedtls_mps_size_t frag_backup_len;
|
|
|
|
mbedtls_mps_size_t backup_len;
|
|
mbedtls_mps_size_t acc_len_needed;
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"There has been an unsatisfied read with %u bytes overhead.",
|
|
(unsigned) pending );
|
|
|
|
if( acc == NULL )
|
|
{
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"No accumulator present" );
|
|
MBEDTLS_MPS_TRACE_RETURN(
|
|
MBEDTLS_ERR_MPS_READER_NEED_ACCUMULATOR );
|
|
}
|
|
al = rd->acc_len;
|
|
|
|
/* Check if the upper layer has already fetched
|
|
* and committed the contents of the accumulator. */
|
|
if( commit < fo )
|
|
{
|
|
/* No, accumulator is still being processed. */
|
|
frag_backup_offset = 0;
|
|
frag_backup_len = fl;
|
|
acc_backup_offset = commit;
|
|
acc_backup_len = fo - commit;
|
|
}
|
|
else
|
|
{
|
|
/* Yes, the accumulator is already processed. */
|
|
frag_backup_offset = commit - fo;
|
|
frag_backup_len = fl - frag_backup_offset;
|
|
acc_backup_offset = 0;
|
|
acc_backup_len = 0;
|
|
}
|
|
|
|
backup_len = acc_backup_len + frag_backup_len;
|
|
acc_len_needed = backup_len + pending;
|
|
|
|
overflow = 0;
|
|
overflow |= ( backup_len < acc_backup_len );
|
|
overflow |= ( acc_len_needed < backup_len );
|
|
|
|
if( overflow || al < acc_len_needed )
|
|
{
|
|
/* Except for the different return code, we behave as if
|
|
* there hadn't been a call to mbedtls_mps_reader_get()
|
|
* since the last commit. */
|
|
rd->end = commit;
|
|
rd->pending = 0;
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_error,
|
|
"The accumulator is too small to handle the backup." );
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_error,
|
|
"* Size: %u", (unsigned) al );
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_error,
|
|
"* Needed: %u (%u + %u)",
|
|
(unsigned) acc_len_needed,
|
|
(unsigned) backup_len, (unsigned) pending );
|
|
MBEDTLS_MPS_TRACE_RETURN(
|
|
MBEDTLS_ERR_MPS_READER_ACCUMULATOR_TOO_SMALL );
|
|
}
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Fragment backup: %u", (unsigned) frag_backup_len );
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Accumulator backup: %u", (unsigned) acc_backup_len );
|
|
|
|
/* Move uncommitted parts from the accumulator to the front
|
|
* of the accumulator. */
|
|
memmove( acc, acc + acc_backup_offset, acc_backup_len );
|
|
|
|
/* Copy uncmmitted parts of the current fragment to the
|
|
* accumulator. */
|
|
memcpy( acc + acc_backup_len,
|
|
frag + frag_backup_offset, frag_backup_len );
|
|
|
|
rd->acc_avail = backup_len;
|
|
rd->acc_share.acc_remaining = pending;
|
|
|
|
if( paused != NULL )
|
|
*paused = 1;
|
|
}
|
|
|
|
rd->frag = NULL;
|
|
rd->frag_len = 0;
|
|
|
|
rd->commit = 0;
|
|
rd->end = 0;
|
|
rd->pending = 0;
|
|
|
|
MBEDTLS_MPS_TRACE( mbedtls_mps_trace_comment,
|
|
"Final state: aa %u, al %u, ar %u",
|
|
(unsigned) rd->acc_avail, (unsigned) rd->acc_len,
|
|
(unsigned) rd->acc_share.acc_remaining );
|
|
MBEDTLS_MPS_TRACE_RETURN( 0 );
|
|
}
|