@blamejs/pki 0.1.31 → 0.2.0

package/lib/schema-attrcert.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
 var AttrCertError = frameworkError.AttrCertError;
@@ -119,6 +120,10 @@ var OBJECT_DIGEST_INFO = schema.seq([
     if (m.fields.otherObjectTypeID.present) {
       throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 sec. 7.3 forbids");
     }
+    // The objectDigest is a whole-octet digest over the identified object; a
+    // non-octet-aligned BIT STRING is malformed (RFC 5755 sec. 4.1) and has no
+    // in-tree verify layer to catch it later, so reject it at parse.
+    guard.crypto.assertOctetAligned(m.fields.objectDigest.value, ctx.E, "attrcert/bad-object-digest-info", "objectDigest");
     return {
       digestedObjectType: t,
       otherObjectTypeID: null,

package/lib/schema-cms.js

@@ -214,7 +214,13 @@ function _assertContentTypeMatchesAttrs(attrs, eContentType) {
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type !== OID_CONTENT_TYPE) continue;
     if (attrs[i].values.length !== 1) throw NS.E("cms/bad-content-type-attr", "the content-type attribute must be single-valued (RFC 5652 sec. 11.1)");
-    var ctv = asn1.read.oid(asn1.decode(attrs[i].values[0]));
+    // ContentType ::= OBJECT IDENTIFIER -- validate the value's full syntax (tag AND
+    // minimal base-128 OID content) with the CMS typed verdict, so a malformed value
+    // on a path that does not run _checkContentBindingAttrs (AuthEnvelopedData,
+    // RFC 5083 sec. 2.1) surfaces cms/bad-content-type-attr, not the raw asn1/* error.
+    var ctv;
+    try { ctv = asn1.read.oid(asn1.decode(attrs[i].values[0])); }
+    catch (e) { throw NS.E("cms/bad-content-type-attr", "the content-type attribute value must be a valid OBJECT IDENTIFIER", e); }
     if (ctv !== eContentType) throw NS.E("cms/content-type-mismatch", "the content-type attribute (" + ctv + ") must equal the eContentType (" + eContentType + ") (RFC 5652 sec. 5.3)");
   }
 }
@@ -1155,6 +1161,20 @@ function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).
 function walkSignedData(node) { return schema.walk(SIGNED_DATA, node, NS).result; }
 function walkEncryptedData(node) { return schema.walk(ENCRYPTED_DATA, node, NS).result; }
 
+// assertAttachedCiphertext(eci, E, code, label): reject an EnvelopedData /
+// EncryptedData encryptedContentInfo whose encryptedContent (the payload itself)
+// is absent OR zero-length. RFC 5652 sec. 6.1 / RFC 5083 permit DETACHED content,
+// so this is NOT enforced in the base walker -- it is a per-PROFILE opt-in for a
+// consumer that requires the ciphertext to be present (an EST server-generated
+// key, a PKCS#12 shrouded bag): a valid envelope that delivers NOTHING is
+// verification-of-nothing (CWE-20). E is the caller's (code, message) factory.
+function assertAttachedCiphertext(eci, E, code, label) {
+  if (!eci || eci.encryptedContent === null || eci.encryptedContent.length === 0) {
+    throw E(code, (label || "encrypted content") + " must carry a non-empty attached ciphertext (RFC 5652 sec. 6.1), not be detached or empty");
+  }
+  return eci;
+}
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
@@ -1163,4 +1183,5 @@ module.exports = {
   walkEnvelopedData: walkEnvelopedData,
   walkSignedData: walkSignedData,
   walkEncryptedData: walkEncryptedData,
+  assertAttachedCiphertext: assertAttachedCiphertext,
 };

package/lib/schema-crmf.js

@@ -255,11 +255,9 @@ function popoPrivKey(type) {
       }
       // The encrypted key material MUST be present -- CMS allows a detached
       // EnvelopedData (encryptedContent OPTIONAL), but a POP with no key to verify
-      // or archive is meaningless. A zero-length attached ciphertext is the same
-      // fault as a detached one (the rule the CMP encryptedKey arm also holds).
-      if (env.encryptedContentInfo.encryptedContent == null || env.encryptedContentInfo.encryptedContent.length === 0) {
-        throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData MUST carry a non-empty encrypted key in encryptedContent (RFC 4211 sec. 4.2)");
-      }
+      // or archive is meaningless. The shared CMS assert rejects a null OR
+      // zero-length attached ciphertext (the rule the EST / PKCS#12 siblings hold).
+      cms.assertAttachedCiphertext(env.encryptedContentInfo, ctx.E, "crmf/bad-popo", "encryptedKey [4] EnvelopedData");
     }
     return { type: type, method: POPOPRIVKEY_METHODS[inner.tagNumber], bytes: n.bytes };
   });

package/lib/schema-ocsp.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var constants = require("./constants");
 var frameworkError = require("./framework-error");
 
 var OcspError = frameworkError.OcspError;
@@ -119,7 +120,10 @@ function _rawSignature(field) {
 
 // certs [0] EXPLICIT SEQUENCE OF Certificate -- each element raw. Shared by the
 // request Signature and the BasicOCSPResponse.
-var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs" });
+// The certs list is capped: the delegated-responder authorization loop verifies
+// each candidate BEFORE the response signature is checked, so an unbounded list in
+// a relayed / stapled response would drive unbounded pre-auth signature verifies.
+var CERTS = schema.seqOf(certificateBytes(), { assert: "sequence", code: "ocsp/bad-certs", what: "certs", max: constants.LIMITS.OCSP_MAX_CERTS, maxCode: "ocsp/too-many-certs" });
 
 // Validate the OCSP protocol extension values in a decoded extension list --
 // applied to every extension surface (request / single-request / response /

package/lib/schema-pkix.js

@@ -47,11 +47,8 @@ function pemDecode(text, label, PemError) {
   if (!m) throw new PemError("pem/no-block", "no PEM block found");
   if (label && m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + JSON.stringify(label) + " block, got " + JSON.stringify(m[1]));
   var b64 = m[2].replace(/[\r\n\t ]+/g, "");
-  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64)) throw new PemError("pem/bad-base64", "PEM body is not valid base64");
-  if (b64.length % 4 !== 0) throw new PemError("pem/bad-base64", "PEM base64 body must be whole 4-character groups (RFC 4648 sec. 3.5)");
-  var der = Buffer.from(b64, "base64");
-  if (der.toString("base64") !== b64) throw new PemError("pem/bad-base64", "PEM base64 body is not canonical (RFC 4648 sec. 3.5)");
-  return der;
+  // Strict canonical base64 (RFC 4648 sec. 3.5) via the shared encoding guard.
+  return guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body");
 }
 
 // pemDecodeAll(text, label, PemError): decode EVERY PEM block under the STRICT
@@ -72,10 +69,7 @@ function pemDecodeAll(text, label, PemError) {
     if (/\S/.test(text.slice(lastEnd, m.index))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted around PEM blocks (RFC 8555 sec. 9.1)");
     if (m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + JSON.stringify(label) + " block, got " + JSON.stringify(m[1]));
     var b64 = m[2].replace(/[\r\n\t ]+/g, "");
-    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64) || b64.length % 4 !== 0) throw new PemError("pem/bad-base64", "PEM body is not canonical base64 (RFC 4648 sec. 3.5)");
-    var der = Buffer.from(b64, "base64");
-    if (der.toString("base64") !== b64) throw new PemError("pem/bad-base64", "PEM base64 body is not canonical (RFC 4648 sec. 3.5)");
-    blocks.push(der);
+    blocks.push(guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body"));
     lastEnd = re.lastIndex;
   }
   if (blocks.length === 0) throw new PemError("pem/no-block", "no PEM block found");
@@ -92,7 +86,10 @@ function pemEncode(der, label, PemError) {
   if (typeof label !== "string" || !/^[A-Z0-9]+( [A-Z0-9]+)*$/.test(label)) {
     throw new PemError("pem/bad-label", "pemEncode requires an uppercase A-Z0-9 label with single spaces");
   }
-  var buf = Buffer.isBuffer(der) ? der : Buffer.from(der);
+  // Re-view through the byte guard: a string input would silently utf8-armor into
+  // a bogus PEM, and a detached-backed Buffer would armor an empty body -- both
+  // fail closed (a Uint8Array / Buffer of real DER re-views cleanly).
+  var buf = guard.bytes.view(der, PemError, "pem/bad-input", "pemEncode DER input");
   var b64 = buf.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "");
   return "-----BEGIN " + label + "-----\n" + b64 + "\n-----END " + label + "-----\n";
 }
@@ -270,10 +267,12 @@ function attrValueToString(ns) {
     if (typeof value === "string" && value.charAt(0) === "\\") return asn1.build.utf8(value.slice(1));
     if (typeof value === "string" && value.charAt(0) === "#") {
       var hex = value.slice(1);
-      if (!/^(?:[0-9A-Fa-f]{2})+$/.test(hex)) {
+      if (hex.length === 0) {
         throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must be a non-empty even run of hex digits (RFC 4514 sec. 2.4)");
       }
-      var raw = Buffer.from(hex, "hex");
+      // Strict canonical hex via the shared encoding guard (even-length, canonical,
+      // no silent truncation at the first non-hex character).
+      var raw = guard.encoding.hex(hex, null, ns.E, ns.prefix + "/bad-atv", "a #hex attribute value");
       try { asn1.decode(raw); }
       catch (e) { throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must encode exactly one DER TLV", e); }
       return raw;
@@ -550,6 +549,36 @@ function generalNames(ns, opts) {
   return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
 }
 
+// DistributionPointName ::= CHOICE { fullName [0] IMPLICIT GeneralNames,
+// nameRelativeToCRLIssuer [1] IMPLICIT RelativeDistinguishedName } (RFC 5280
+// sec. 4.2.1.13). The caller hands the CHOICE node itself -- the alternative
+// INSIDE the [0]-tagged distributionPoint field wrapper (a context tag on a
+// CHOICE-typed field is always EXPLICIT, so the wire nests [0]{ [0]|[1] ... }).
+// fullName surfaces each element's RAW GeneralName DER as { kind: "fullName",
+// names: [Buffer, ...] } -- the byte-exact comparison key the sec. 5.2.5
+// "identical encoding MUST be used" correspondence rule requires;
+// nameRelativeToCRLIssuer surfaces its full [1]-tagged TLV as { kind: "rdn",
+// bytes: Buffer } (byte-identical [1] TLVs are byte-identical RDN fragments).
+// An empty fullName (GeneralNames is SIZE 1..MAX), a malformed element, or any
+// other alternative throws the caller's `code`. Shared by the
+// cRLDistributionPoints / freshestCRL extension decoders and the CRL checker's
+// IssuingDistributionPoint decode, so the two sides of the sec. 6.3.3(b)(2)(i)
+// correspondence comparison cannot drift.
+function distributionPointName(ns, node, code) {
+  if (node && node.tagClass === "context" && node.tagNumber === 0) {
+    var gns = schema.walk(generalNames(ns, { implicitTag: 0, code: code, what: "DistributionPointName fullName" }), node, ns).result;
+    return { kind: "fullName", names: gns.names.map(function (n) { return n.bytes; }) };
+  }
+  if (node && node.tagClass === "context" && node.tagNumber === 1) {
+    // [1] IMPLICIT RelativeDistinguishedName -- the context tag replaces the
+    // SET tag, so the node's direct children are the AttributeTypeAndValues.
+    schema.walk(schema.implicitSetOf(1, attributeTypeAndValue(ns), {
+      min: 1, code: code, what: "DistributionPointName nameRelativeToCRLIssuer" }), node, ns);
+    return { kind: "rdn", bytes: node.bytes };
+  }
+  throw ns.E(code, "DistributionPointName must be fullName [0] or nameRelativeToCRLIssuer [1] (RFC 5280 sec. 4.2.1.13)");
+}
+
 // certExtensionDecoders(ns) -- the ns-parameterized RFC 5280 sec. 4.2.1 extension
 // VALUE decoders. `x509.parse` surfaces each extension as { oid, name, critical,
 // value } with `value` the raw inner OCTET-STRING content (a Buffer); the path
@@ -837,6 +866,54 @@ function certExtensionDecoders(ns) {
     return { poison: true };
   }
 
+  // cRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
+  // (RFC 5280 sec. 4.2.1.13); DistributionPoint ::= SEQUENCE {
+  // distributionPoint [0] DistributionPointName OPTIONAL, reasons [1]
+  // ReasonFlags OPTIONAL, cRLIssuer [2] GeneralNames OPTIONAL }. "a
+  // DistributionPoint MUST NOT consist of only the reasons field; either
+  // distributionPoint or cRLIssuer MUST be present" -- a reasons-only (or
+  // empty) DistributionPoint is malformed. The DistributionPointName is
+  // surfaced through the shared helper (raw name encodings -- the sec. 5.2.5
+  // correspondence key); `reasons` stays a raw BIT STRING ({ unusedBits,
+  // bytes }); cRLIssuer is a validated GeneralNames with decoded values.
+  // FreshestCRL ::= CRLDistributionPoints (sec. 4.2.1.15), so the SAME decoder
+  // serves both OIDs -- one codec, both registry rows.
+  function crlDistributionPoints(buf) {
+    var C = ns.prefix + "/bad-crl-distribution-points";
+    var kids = seqChildren(buf, C, "CRLDistributionPoints");
+    if (kids.length < 1) throw ns.E(C, "CRLDistributionPoints must contain at least one DistributionPoint (RFC 5280 sec. 4.2.1.13)");
+    return kids.map(function (dp) {
+      if (dp.tagClass !== "universal" || dp.tagNumber !== _T.SEQUENCE || !dp.children) {
+        throw ns.E(C, "DistributionPoint must be a SEQUENCE { distributionPoint?, reasons?, cRLIssuer? }");
+      }
+      var out = { distributionPoint: null, reasons: null, cRLIssuer: null };
+      var lastTag = -1;
+      dp.children.forEach(function (f) {
+        if (f.tagClass !== "context") throw ns.E(C, "DistributionPoint fields are context-tagged [0]/[1]/[2]");
+        if (f.tagNumber <= lastTag) throw ns.E(C, "DistributionPoint fields must be unique and in ascending order (DER)");
+        lastTag = f.tagNumber;
+        if (f.tagNumber === 0) {
+          // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE.
+          if (!f.children || f.children.length !== 1) throw ns.E(C, "DistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
+          out.distributionPoint = distributionPointName(ns, f.children[0], C);
+        } else if (f.tagNumber === 1) {
+          var bs;
+          try { bs = asn1.read.bitStringImplicit(f, 1); }
+          catch (e) { throw ns.E(C, "DistributionPoint reasons [1] must be an IMPLICIT ReasonFlags BIT STRING", e); }
+          out.reasons = { unusedBits: bs.unusedBits, bytes: bs.bytes };
+        } else if (f.tagNumber === 2) {
+          out.cRLIssuer = schema.walk(generalNames(ns, { implicitTag: 2, decodeValue: true, code: C, what: "DistributionPoint cRLIssuer" }), f, ns).result;
+        } else {
+          throw ns.E(C, "DistributionPoint has an unexpected field [" + f.tagNumber + "]");
+        }
+      });
+      if (out.distributionPoint === null && out.cRLIssuer === null) {
+        throw ns.E(C, "a DistributionPoint must include distributionPoint or cRLIssuer -- it MUST NOT consist of only the reasons field (RFC 5280 sec. 4.2.1.13)");
+      }
+      return out;
+    });
+  }
+
   // byName returns undefined for an unregistered name; keying a decoder row
   // under "undefined" would silently drop that extension from dispatch (the
   // consumer would treat the extension as structurally unvalidated / absent),
@@ -861,6 +938,8 @@ function certExtensionDecoders(ns) {
   byOid[O("subjectKeyIdentifier")] = subjectKeyIdentifier;
   byOid[O("signedCertificateTimestampList")] = sctList;
   byOid[O("precertificatePoison")] = precertPoison;
+  byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
+  byOid[O("freshestCRL")] = crlDistributionPoints;
   return { byOid: byOid };
 }
 
@@ -1069,6 +1148,7 @@ module.exports = {
   name: name,
   generalName: generalName,
   generalNames: generalNames,
+  distributionPointName: distributionPointName,
   generalizedTime: generalizedTime,
   utf8Text: utf8Text,
   rawNonEmptySequence: rawNonEmptySequence,