Parse ASN.1 root record in x509 certificates (seladb#1540)

Author: seladb

Packet++/header/SSLHandshake.h

@@ -3,6 +3,7 @@
 #include <utility>
 #include "SSLCommon.h"
 #include "PointerVector.h"
+#include "Asn1Codec.h"
 
 /**
  * @file
@@ -301,6 +302,12 @@ namespace pcpp
 			return m_DataLen;
 		}
 
+		/**
+		 * @return The root ASN.1 record of the certificate data. All of the certificate data will be under this record.
+		 * If the Root ASN.1 record is malformed, an exception is thrown
+		 */
+		Asn1SequenceRecord* getRootAsn1Record();
+
 		/**
 		 * Certificate messages usually spread on more than 1 packet. So a certificate is likely to split between 2
 		 * packets or more. This method provides an indication whether all certificate data exists or only part of it
@@ -312,6 +319,7 @@ namespace pcpp
 		}
 
 	private:
+		std::unique_ptr<Asn1Record> m_Asn1Record;
 		uint8_t* m_Data;
 		size_t m_DataLen;
 		bool m_AllDataExists;

Packet++/src/SSLHandshake.cpp

@@ -1216,6 +1216,20 @@ namespace pcpp
 		return result;
 	}
 
+	// --------------------------
+	// SSLx509Certificate methods
+	// --------------------------
+
+	Asn1SequenceRecord* SSLx509Certificate::getRootAsn1Record()
+	{
+		if (m_Asn1Record == nullptr)
+		{
+			m_Asn1Record = Asn1Record::decode(m_Data, m_DataLen);
+		}
+
+		return m_Asn1Record->castAs<Asn1SequenceRecord>();
+	}
+
 	// ---------------------------
 	// SSLHandshakeMessage methods
 	// ---------------------------

Tests/Packet++Test/Tests/SSLTests.cpp

@@ -353,13 +353,18 @@ PTF_TEST_CASE(SSLMultipleRecordParsing3Test)
 	PTF_ASSERT_TRUE(pos != std::string::npos);
 	pos = certBuffer.find("Internal Development CA");
 	PTF_ASSERT_EQUAL(pos, std::string::npos, ptr);
+	auto asn1Record = cert->getRootAsn1Record();
+	PTF_ASSERT_NOT_NULL(asn1Record);
+	PTF_ASSERT_EQUAL(asn1Record->getSubRecords().size(), 3);
+
 	cert = certMsg->getCertificate(1);
 	PTF_ASSERT_NOT_NULL(cert);
 	PTF_ASSERT_TRUE(cert->allDataExists());
 	PTF_ASSERT_EQUAL(cert->getDataLength(), 1728);
 	certBuffer = std::string(cert->getData(), cert->getData() + cert->getDataLength());
 	pos = certBuffer.find("Internal Development CA");
 	PTF_ASSERT_TRUE(pos != std::string::npos);
+
 	cert = certMsg->getCertificate(2);
 	PTF_ASSERT_NOT_NULL(cert);
 	PTF_ASSERT_TRUE(cert->allDataExists());