@blamejs/pki 0.1.16 → 0.1.18

package/lib/schema-engine.js

@@ -93,39 +93,49 @@ function _assertArity(schema, kids, ctx) {
 // the OID / INTEGER / string reads). `decode(fn)` hands the whole node to fn,
 // which owns its try/catch and code mapping. `any()` yields the node itself.
 
-function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid }; }
-function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer }; }
-function boolean()        { return { kind: "leaf", read: asn1.read.boolean }; }
-function octetString()    { return { kind: "leaf", read: asn1.read.octetString }; }
-function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; } }; }
+// Leaves carry BOTH directions: `read(node) -> value` and `write(value) -> DER TLV`,
+// so a single leaf definition drives decode (walk) and encode (build). A [tag]
+// IMPLICIT leaf's write emits the context-tagged TLV directly, mirroring its read.
+function _implicitIntContent(v) { return asn1.decode(asn1.build.integer(v)).content; }
+function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid, write: function (v) { return asn1.build.oid(v); } }; }
+function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer, write: function (v) { return asn1.build.integer(v); } }; }
+function boolean()        { return { kind: "leaf", read: asn1.read.boolean, write: function (v) { return asn1.build.boolean(v); } }; }
+function octetString()    { return { kind: "leaf", read: asn1.read.octetString, write: function (v) { return asn1.build.octetString(v); } }; }
+function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.bitString(v.bytes, v.unusedBits); } }; }
 // A [tag] IMPLICIT BIT STRING leaf (context-class primitive) — the primitive-leaf
 // counterpart to implicitSetOf, for e.g. the PKCS#8 publicKey [1] (RFC 5958 §2).
-function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; } }; }
+function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.contextPrimitive(tag, Buffer.concat([Buffer.from([v.unusedBits]), v.bytes])); } }; }
 // A [tag] IMPLICIT OCTET STRING leaf (context-class primitive) — the sibling of
 // implicitBitString, for e.g. the CMS SignerIdentifier subjectKeyIdentifier [0]
 // (RFC 5652 §5.3). Yields the raw content bytes.
-function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); } }; }
+function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, v); } }; }
 // A [tag] IMPLICIT NULL leaf (context-class primitive, empty content) — the sibling
 // of implicitBitString/implicitOctetString, for e.g. the OCSP CertStatus good [0] /
 // unknown [2] arms (RFC 6960 §4.2.1). Yields null; rejects a constructed or
 // non-empty [tag] node fail-closed.
-function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); } }; }
+function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); }, write: function () { return asn1.build.contextPrimitive(tag, Buffer.alloc(0)); } }; }
 // A [tag] IMPLICIT INTEGER leaf (context-class primitive) — the integer sibling of
 // implicitBitString, for the RFC 3161 Accuracy millis [0] / micros [1] fields
 // (context-tagged primitive INTEGERs). Yields a BigInt; a constructed or wrong-tag
 // node fails asn1/* at the codec.
-function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); } }; }
+function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, _implicitIntContent(v)); } }; }
 function any()            { return { kind: "any" }; }
-function decode(fn)       { return { kind: "decode", fn: fn }; }
+// decode(fn, write?): a custom decode leaf; `write` is its optional paired encoder
+// (value -> DER TLV) so the same leaf drives both directions.
+function decode(fn, write) { return { kind: "decode", fn: fn, write: write }; }
 
 // time(ns): a UTCTime / GeneralizedTime value, asserting the tag before the
-// codec reads it (mirrors _parseValidityTime's x509/bad-time guard).
+// codec reads it (mirrors _parseValidityTime's x509/bad-time guard). Encodes as
+// UTCTime for years 1950..2049 and GeneralizedTime otherwise (RFC 5280 §4.1.2.5).
 function time(ns) {
   return decode(function (n, ctx) {
     if (n.tagClass !== "universal" || (n.tagNumber !== TAGS.UTC_TIME && n.tagNumber !== TAGS.GENERALIZED_TIME)) {
       _fail(ctx, ns.prefix + "/bad-time", "time must be UTCTime or GeneralizedTime");
     }
     return asn1.read.time(n);
+  }, function (date) {
+    var y = date.getUTCFullYear();
+    return (y >= 1950 && y < 2050) ? asn1.build.utcTime(date) : asn1.build.generalizedTime(date);
   });
 }
 
@@ -136,6 +146,10 @@ function optional(name, schema, opts) {
   opts = opts || {};
   // How the optional field is recognized at its position:
   //   - default:       a context [tag] (the certificate version [0] shape).
+  //   - tags:          a context tag in the set — an OPTIONAL field whose type is
+  //     itself a CHOICE of several context alternatives, e.g. the CRMF CertReqMsg
+  //     popo ProofOfPossession ([0]..[3]) sitting before the universal-SEQUENCE
+  //     regInfo (RFC 4211 §3), where ANY of the CHOICE's tags marks it present.
   //   - whenUniversal: the next element iff its UNIVERSAL tag is in the set —
   //     the CRL TBSCertList shape (bare INTEGER version, Time nextUpdate,
   //     SEQUENCE revokedCertificates), disambiguated by tag, not a context [n].
@@ -147,7 +161,9 @@ function optional(name, schema, opts) {
     ? function () { return true; }
     : opts.whenUniversal
       ? function (n) { return n.tagClass === "universal" && opts.whenUniversal.indexOf(n.tagNumber) !== -1; }
-      : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
+      : opts.tags
+        ? function (n) { return n.tagClass === "context" && opts.tags.indexOf(n.tagNumber) !== -1; }
+        : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
   return { fkind: "optional", name: name, schema: schema, tag: opts.tag, match: match,
            explicit: !!opts.explicit, emptyCode: opts.emptyCode, hasDefault: ("default" in opts), def: opts.default };
 }
@@ -184,12 +200,14 @@ function choice(alts, opts) {
 function seqOf(item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: opts.assert || "sequence", code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOf(item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: opts.assert || "set", derSetOrder: true, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOfUnique(item, keyFn, opts) {
   return setOf(item, Object.assign({ unique: keyFn }, opts || {}));
@@ -200,7 +218,8 @@ function setOfUnique(item, keyFn, opts) {
 function implicitSetOf(tag, item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 // [tag] IMPLICIT SEQUENCE OF item — the context tag REPLACES the universal SEQUENCE
 // tag, so the node is a context-class constructed [tag] whose direct children are the
@@ -209,7 +228,8 @@ function implicitSetOf(tag, item, opts) {
 function implicitSeqOf(tag, item, opts) {
   opts = opts || {};
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
-           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+           min: opts.min, max: opts.max, maxCode: opts.maxCode,
+           unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 
 // ---- the walk engine -------------------------------------------------
@@ -218,7 +238,7 @@ function implicitSeqOf(tag, item, opts) {
  * @primitive  pki.schema.engine.walk
  * @signature  pki.schema.engine.walk(schema, node, ctx) -> value
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       X.690, X.680
  * @related    pki.asn1.decode, pki.schema.x509.parse
  *
@@ -288,6 +308,12 @@ function _walkRepeat(schema, node, ctx) {
   if (schema.min != null && kids.length < schema.min) {
     _fail(ctx, schema.code, (schema.what || "value") + " must contain at least " + schema.min + " element(s)");
   }
+  // The element-count ceiling: a container of a great many tiny elements
+  // amplifies memory through per-element walk products, so a schema that
+  // parses attacker-sized lists declares `max` and fails typed instead.
+  if (schema.max != null && kids.length > schema.max) {
+    _fail(ctx, schema.maxCode || schema.code, (schema.what || "value") + " exceeds the element cap " + schema.max);
+  }
   // DER (X.690 §11.6) — the components of a SET OF appear in ascending order, the
   // encodings compared as octet strings. SEQUENCE OF is order-preserving and is
   // exempt (no derSetOrder). Compare full TLV byte strings, the same canonical
@@ -389,6 +415,178 @@ function _consumeTrailing(fld, kids, start, fields, ctx) {
   }
 }
 
+// ---- the encode engine (the inverse of walk) -------------------------
+// encode(schema, value) is the constructor direction of the SAME schema walk
+// decodes: it interprets the schema against a plain structural value and emits
+// canonical DER. A single schema definition therefore drives both directions, so
+// context-tag (EXPLICIT/IMPLICIT) handling cannot diverge between them — the class
+// of bug where a decoder reads a [tag] IMPLICIT field but an ad-hoc encoder emits
+// the wrong tag is structurally retired. Encode errors are authoring faults (a bad
+// value / an un-encodable schema), thrown as plain Errors, not parse verdicts.
+
+function _encFail(message) { throw new Error("schema.encode: " + message); }
+
+/**
+ * @primitive  pki.schema.engine.encode
+ * @signature  pki.schema.engine.encode(schema, value, ctx) -> Buffer
+ * @since      0.1.17
+ * @status     experimental
+ * @spec       X.690, X.680
+ * @related    pki.schema.engine.walk
+ *
+ * Encode a structural value to canonical DER by interpreting the SAME schema
+ * `walk` decodes — the constructor direction. `value` mirrors the schema: a `seq`
+ * takes `{ fieldName: value }`, a leaf its natural JS value (an OID string, a
+ * BigInt, a `{ unusedBits, bytes }` BIT STRING, a `Date`), a `repeat` an array, a
+ * `choice` `{ arm, value }`. EXPLICIT wrappers and IMPLICIT `[tag]` retagging are
+ * applied by the engine, so `walk(schema, decode(encode(schema, v)))` round-trips.
+ *
+ * @example
+ *   var S = pki.schema.engine;
+ *   var der = S.encode(S.seq([S.field("n", S.integerLeaf())]), { n: 42n });
+ */
+function encode(schema, value, ctx) {
+  switch (schema.kind) {
+    case "leaf":     return schema.write(value);
+    case "any":      return Buffer.isBuffer(value) ? value : value.bytes;
+    case "decode":
+      if (typeof schema.write !== "function") _encFail("this decode leaf has no paired encoder (decode(fn, write))");
+      return schema.write(value, ctx);
+    case "seq":      return _encodeSeq(schema, value, ctx);
+    case "explicit": return asn1.build.explicit(schema.tag, encode(schema.schema, value, ctx));
+    case "repeat":   return _encodeRepeat(schema, value, ctx);
+    case "choice":   return _encodeChoice(schema, value, ctx);
+    default:         _encFail("cannot encode schema kind " + JSON.stringify(schema.kind));
+  }
+  return undefined;
+}
+
+function _wrapConstructed(schema, parts) {
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  var mode = schema.assert || "sequence";
+  if (mode === "set") return asn1.build.set(parts);
+  // "constructed" is a DECODE-time leniency (accept any constructed shape); the
+  // canonical encoding is a universal SEQUENCE, same as "sequence".
+  if (mode === "sequence" || mode === "constructed") return asn1.build.sequence(parts);
+  _encFail("cannot encode a seq/repeat with assert " + JSON.stringify(mode));
+  return undefined;
+}
+
+function _present(v) { return v !== undefined && v !== null; }
+
+function _encodeSeq(schema, value, ctx) {
+  value = value || {};
+  var parts = [];
+  for (var f = 0; f < schema.fields.length; f++) {
+    var fld = schema.fields[f];
+    if (fld.fkind === "required") {
+      parts.push(encode(fld.schema, value[fld.name], ctx));
+    } else if (fld.fkind === "optional") {
+      if (_present(value[fld.name])) {
+        var enc = encode(fld.schema, value[fld.name], ctx);
+        parts.push(fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
+      }
+    } else if (fld.fkind === "trailing") {
+      // Emit present members in strictly-increasing tag order (the walk's rule).
+      var members = fld.members.slice().sort(function (a, b) { return a.tag - b.tag; });
+      for (var i = 0; i < members.length; i++) {
+        var mm = members[i];
+        if (_present(value[mm.name])) {
+          var menc = encode(mm.schema, value[mm.name], ctx);
+          parts.push(mm.explicit ? asn1.build.explicit(mm.tag, menc) : menc);
+        }
+      }
+    }
+  }
+  return _wrapConstructed(schema, parts);
+}
+
+function _encodeRepeat(schema, items, ctx) {
+  if (!Array.isArray(items)) _encFail("a repeat value must be an array");
+  // Enforce the SAME constraints walk enforces, so encode never emits DER its own
+  // decoder rejects (the walk(decode(encode)) invariant): the SIZE minimum, and
+  // semantic uniqueness (the key computed exactly as walk does, off the round-tripped
+  // item — a duplicate is an authoring fault, not a parse verdict).
+  if (schema.min != null && items.length < schema.min) {
+    _encFail("this repeat requires at least " + schema.min + " element(s) but got " + items.length);
+  }
+  if (schema.max != null && items.length > schema.max) {
+    _encFail("this repeat caps at " + schema.max + " element(s) but got " + items.length);
+  }
+  var parts = items.map(function (it) { return encode(schema.item, it, ctx); });
+  if (schema.unique) {
+    var seen = new Set();
+    parts.forEach(function (tlv) {
+      var item = { node: asn1.decode(tlv) };
+      item.value = walk(schema.item, item.node, ctx);
+      var key = schema.unique(item);
+      if (seen.has(key)) _encFail("this repeat requires unique elements but got a duplicate key: " + key);
+      seen.add(key);
+    });
+  }
+  if (schema.derSetOrder) parts = parts.slice().sort(Buffer.compare);
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  return schema.assert === "set" ? asn1.build.set(parts) : asn1.build.sequence(parts);
+}
+
+function _encodeChoice(schema, value, ctx) {
+  if (!value || typeof value.arm !== "number" || value.arm < 0 || value.arm >= schema.alts.length) {
+    _encFail("a choice value must be { arm: <index>, value: <arm value> }");
+  }
+  return encode(schema.alts[value.arm].schema, value.value, ctx);
+}
+
+/**
+ * @primitive  pki.schema.engine.embeddedDer
+ * @signature  pki.schema.engine.embeddedDer(schema, bytes, ctx, opts?) -> value
+ * @since      0.1.18
+ * @status     experimental
+ * @spec       X.690
+ * @defends    ASN.1-parser-DoS (CWE-400)
+ * @related    pki.schema.engine.walk, pki.asn1.decode
+ *
+ * Decode a fresh DER (or, with `ber: true`, BER) blob carried inside an
+ * already-decoded value — an OCTET STRING whose content is itself an encoded
+ * structure — and walk it against a schema. A codec failure is wrapped in the
+ * caller's typed `code`; a schema rejection keeps its own code. This is the
+ * one named form of the re-decode idiom, so the caps that a fresh
+ * `pki.asn1.decode` would restart from zero can be carried across re-decode
+ * boundaries: a shared `budget` (`{ remaining: n }`) decrements on every call
+ * and fails with `budgetCode` at zero, bounding how many nested blobs one
+ * parse may unwrap however deeply a container chains them.
+ *
+ * @opts
+ *   code:       string,   // typed code wrapping a codec failure (required)
+ *   what:       string,   // human label for the wrapped message
+ *   ber:        boolean,  // default false — BER content region (RFC 7292 §4.1)
+ *   budget:     object,   // { remaining: n } shared across a parse's re-decodes
+ *   budgetCode: string,   // typed code when the budget is exhausted
+ *
+ * @example
+ *   var S = pki.schema.engine;
+ *   var INNER = S.seq([S.field("version", S.integerLeaf())], { code: "app/bad-inner" });
+ *   var ns = { prefix: "app", E: MyError, oid: pki.oid };
+ *   S.embeddedDer(INNER, pki.asn1.build.sequence([pki.asn1.build.integer(3n)]), ns,
+ *     { code: "app/bad-der", what: "the embedded structure" });
+ */
+function embeddedDer(schema, bytes, ctx, opts) {
+  opts = opts || {};
+  if (opts.budget) {
+    if (!(opts.budget.remaining > 0)) {
+      throw ctx.E(opts.budgetCode || opts.code, (opts.what || "embedded DER") +
+        ": the cross-decode budget is exhausted (nesting chained across too many re-decode boundaries)");
+    }
+    opts.budget.remaining -= 1;
+  }
+  var node;
+  try {
+    node = asn1.decode(bytes, opts.ber ? { ber: true } : undefined);
+  } catch (e) {
+    throw ctx.E(opts.code, (opts.what || "embedded DER") + " did not decode: " + e.message, e);
+  }
+  return walk(schema, node, ctx);
+}
+
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
@@ -399,5 +597,5 @@ module.exports = {
   implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
-  walk: walk,
+  walk: walk, encode: encode, embeddedDer: embeddedDer,
 };

package/lib/schema-ocsp.js

@@ -294,14 +294,12 @@ var RESPONSE_BYTES = schema.seq([
     if (responseType !== OID_OCSP_BASIC) {
       throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 §4.2.1)");
     }
-    var inner;
-    try { inner = asn1.decode(raw); }
-    catch (e) { throw NS.E("ocsp/bad-der", "BasicOCSPResponse DER did not decode: " + ((e && e.message) || String(e)), e); }
     return {
       responseType: responseType,
       responseTypeName: ctx.oid.name(responseType) || null,
       response: raw,
-      basicResponse: schema.walk(BASIC_OCSP_RESPONSE, inner, ctx).result,
+      basicResponse: schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
+        { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result,
     };
   },
 });
@@ -425,7 +423,7 @@ var OCSP_REQUEST = schema.seq([
  * @primitive  pki.schema.ocsp.parseRequest
  * @signature  pki.schema.ocsp.parseRequest(input) -> ocspRequest
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6960
  * @related    pki.schema.ocsp.parseResponse, pki.schema.parse
  *
@@ -447,7 +445,7 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  * @primitive  pki.schema.ocsp.parseResponse
  * @signature  pki.schema.ocsp.parseResponse(input) -> ocspResponse
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6960
  * @related    pki.schema.ocsp.parseRequest, pki.schema.parse
  *
@@ -471,7 +469,7 @@ var parseResponse = pkix.makeParser({ pemLabel: "OCSP RESPONSE", PemError: PemEr
  * @primitive  pki.schema.ocsp.pemDecode
  * @signature  pki.schema.ocsp.pemDecode(text, label?) -> Buffer
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 6960
  * @related    pki.schema.ocsp.parseResponse
  *