@blamejs/pki 0.8.11 → 0.8.14

package/lib/pki-build.js

@@ -436,7 +436,7 @@ function makeBuilder(ctx) {
   }
   function encodeRdn(rdnSpec) {
     if (!rdnSpec || typeof rdnSpec !== "object" || Buffer.isBuffer(rdnSpec)) throw E("bad-name", "each RDN must be an object of { attributeName: value }");
-    var keys = Object.keys(rdnSpec);
+    var keys = guard.identifier.optionNames(rdnSpec);
     if (!keys.length) throw E("bad-name", "an RDN must carry at least one attribute");
     return b.set(keys.map(function (k) { return encodeAtv(k, rdnSpec[k]); }));
   }

package/lib/revocation-fetch.js

@@ -294,7 +294,7 @@ async function _fetchOne(state, req, what) {
 
 function _contentType(headers) {
   var h = headers || {};
-  var keys = Object.keys(h);
+  var keys = guard.identifier.optionNames(h);
   for (var i = 0; i < keys.length; i++) {
     if (keys[i].toLowerCase() !== "content-type") continue;
     try { return mime.parse(String(h[keys[i]])).type; }

package/lib/scep.js

@@ -68,7 +68,12 @@ var MESSAGE_TYPE = Object.assign(Object.create(null), { CertRep: "3", RenewalReq
 var PKI_STATUS = Object.assign(Object.create(null), { SUCCESS: "0", FAILURE: "2", PENDING: "3" });
 var FAIL_INFO = Object.assign(Object.create(null), { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "3", badCertId: "4" });
 
-function _invert(table) { var o = Object.create(null); for (var k in table) if (Object.prototype.hasOwnProperty.call(table, k)) o[table[k]] = k; return o; }
+function _invert(table) {
+  var o = Object.create(null);
+  var names = guard.identifier.optionNames(table);
+  for (var i = 0; i < names.length; i++) o[table[names[i]]] = names[i];
+  return o;
+}
 var MESSAGE_TYPE_BY_CODE = _invert(MESSAGE_TYPE), PKI_STATUS_BY_CODE = _invert(PKI_STATUS), FAIL_INFO_BY_CODE = _invert(FAIL_INFO);
 
 var _PARSE_SUPPORTED = Object.assign(Object.create(null), { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 });
@@ -621,10 +626,10 @@ function _trim(s) { var a = 0, e = s.length; while (a < e && _isWs(s.charCodeAt(
 
 function _header(headers, name) {
   if (!headers || typeof headers !== "object") return null;
-  var found = null, seen = 0, k;
-  for (k in headers) {
-    if (!Object.prototype.hasOwnProperty.call(headers, k)) continue;
-    if (_foldLower(String(k)) === name) { found = headers[k]; seen += 1; }
+  var found = null, seen = 0;
+  var hNames = guard.identifier.optionNames(headers);
+  for (var hi = 0; hi < hNames.length; hi++) {
+    if (_foldLower(String(hNames[hi])) === name) { found = headers[hNames[hi]]; seen += 1; }
   }
   if (seen > 1) throw _err("scep/bad-response", "the response carried more than one " + name + " header");
   return found == null ? null : String(found);
@@ -739,7 +744,7 @@ function _client(method, url, body, headers, opts, checked) {
     maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "scep/bad-input", min: 1, max: C.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
     maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E: _err, code: "scep/bad-input", min: 0, max: 32 }),
   };
-  return _drive(method, url, body, Object.assign({}, headers), opts, transport, budgets);
+  return _drive(method, url, body, guard.identifier.ownOptions(headers), opts, transport, budgets);
 }
 function _requireOk(res, expected, what) {
   var status = res.status;
@@ -1056,7 +1061,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var clientOpts = {
-    tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls,
+    tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls,
     maxRedirects: opts.maxRedirects,
     allowCrossOriginRedirect: opts.allowCrossOriginRedirect,
     timeout: opts.timeout,
@@ -1207,7 +1212,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var want = _resolveQueryTarget(opts);
-  var clientOpts = { tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  var clientOpts = { tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
   if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var senderNonce = nodeCrypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
@@ -1320,7 +1325,14 @@ async function getCrl(baseUrl, opts) {
 }
 
 var _TRANSPORT_KEYS = Object.assign(Object.create(null), { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1, proxy: 1 });
-function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
+function _withKeys(extra) {
+  var o = Object.create(null);
+  var base = guard.identifier.optionNames(_TRANSPORT_KEYS);
+  for (var bi = 0; bi < base.length; bi++) o[base[bi]] = 1;
+  var more = guard.identifier.optionNames(extra);
+  for (var mi = 0; mi < more.length; mi++) o[more[mi]] = 1;
+  return o;
+}
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });
 var _NEXTCACERT_KEYS = _withKeys({ caCertificate: 1 });

package/lib/schema-all.js

@@ -47,6 +47,7 @@ var tsp = require("./schema-tsp");
 var crmf = require("./schema-crmf");
 var cmp = require("./schema-cmp");
 var csrattrs = require("./schema-csrattrs");
+var trustanchor = require("./schema-trustanchor");
 var attrcert = require("./schema-attrcert");
 var smime = require("./schema-smime");
 var cmc = require("./schema-cmc");
@@ -88,6 +89,12 @@ var FORMATS = [
     detect: csrattrs.matches,
     parse: function (input, caps) { return csrattrs.parse(input, caps); },
   },
+  {
+    name: "trustanchor",
+    module: trustanchor,
+    detect: trustanchor.matches,
+    parse: function (input, caps) { return trustanchor.parse(input, caps); },
+  },
   {
     name: "ocsp-request",
     module: ocsp,
@@ -155,7 +162,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // -> ["cms", "tsp", "crmf", "cmp", "csrattrs", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // -> ["cms", "tsp", "crmf", "cmp", "csrattrs", "trustanchor", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -368,6 +375,8 @@ module.exports = {
     decodeExtensions: crmf.decodeExtensions, decodeExtension: crmf.decodeExtension },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   csrattrs: { parse: csrattrs.parse },
+  trustanchor: { parse: trustanchor.parse, parseInfo: trustanchor.parseInfo,
+    pemDecode: trustanchor.pemDecode, pemEncode: trustanchor.pemEncode },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode,
     decodeExtensions: attrcert.decodeExtensions, decodeExtension: attrcert.decodeExtension },
   smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },

package/lib/schema-engine.js

@@ -27,6 +27,7 @@
  */
 
 var asn1 = require("./asn1-der.js");
+var intrinsic = require("./guard-intrinsic");
 
 var TAGS = asn1.TAGS;
 
@@ -339,8 +340,12 @@ function _walkSeq(schema, node, ctx) {
   var kids = _assertShape(schema, node, ctx);
   _assertArity(schema, kids, ctx);
 
-  // allow:registry-table-inherits-object-prototype -- the record a schema's own check and build callbacks read as m.fields, whose keys are the field names that schema declared rather than anything the input supplies
-  var fields = {};
+  /** @internal Prototype-less, so writing a field creates an own property instead of dispatching
+   * through an accessor of the same name on Object.prototype. Every format parser's record is
+   * built here, so a getter-only slot planted under any field name a schema declares would
+   * otherwise throw out of an ordinary parse, and a setter would swallow the decoded value. The
+   * absent-member test below reads it the same way. */
+  var fields = intrinsic.create(null);
   var idx = 0;
   for (var f = 0; f < schema.fields.length; f++) {
     var fld = schema.fields[f];

package/lib/schema-pkix.js

@@ -1456,6 +1456,44 @@ function _extensionRow(ext, opts, index, state, decoded, code, profile) {
  * impossible to READ a certificate carrying a private critical extension, which is what
  * `pki.inspect` and `pki.lint` are for. RFC 5280 sec. 4.2's reject-on-critical rule is the
  * caller's to apply, and the two facts it needs, `critical` and `state`, are on the row. */
+/** @internal RFC 5937 sec. 3.2: "If a basic constraints extension is associated with the trust
+ *  anchor and contains a pathLenConstraint value, set the max_path_length state variable equal to
+ *  the pathLenConstraint value from the basic constraints extension." A trust anchor associates
+ *  one in three ways: the certificate it is supplied as, the `exts` of an RFC 5914
+ *  `TrustAnchorInfo`, and that anchor's `certPath.pathLenConstraint`. The first two are an
+ *  extension list, so both read it here and neither restates the decode. Returns null only where
+ *  the list states no path length. An extension that does not decode is a refusal, not an absent
+ *  limit: nothing validates the anchor's own certificate, so reading an unreadable constraint as
+ *  "no constraint" would leave the anchor less restricted than the store that carries it says. */
+function anchorPathLenFromExtensions(list, ns, label) {
+  if (!intrinsic.isArray(list)) return null;
+  var bcOid = ns.oid.byName("basicConstraints");
+  var decode = certExtensionDecoders(ns).byOid[bcOid];
+  if (typeof decode !== "function") return null;
+  var found = null;
+  _forEach(list, function (ext) {
+    if (!ext || ext.oid !== bcOid || found !== null) return;
+    var value;
+    try { value = decode(ext.value); }
+    catch (e) {
+      throw ns.E(ns.prefix + "/bad-basic-constraints", (label || "the trust anchor") +
+        " carries a basicConstraints extension that does not decode, so the path length it states " +
+        "cannot be read; a trust anchor's constraints are never checked against a path above it, " +
+        "so this is refused rather than read as no constraint", e);
+    }
+    if (value && intrinsic.isInteger(value.pathLenConstraint)) found = value.pathLenConstraint;
+  });
+  return found;
+}
+
+/** @internal The stricter of two path lengths an anchor states, which is the only direction
+ *  RFC 5937 sec. 3.2 allows an anchor to move a validation. */
+function lowerPathLen(a, b) {
+  if (!intrinsic.isInteger(a)) return intrinsic.isInteger(b) ? b : null;
+  if (!intrinsic.isInteger(b)) return a;
+  return a < b ? a : b;
+}
+
 function decodeExtensionList(list, opts) {
   var out = [];
   for (var i = 0; i < list.length; i++) _append(out, decodeOneExtension(list[i], i, opts));
@@ -2409,6 +2447,8 @@ module.exports = {
   scopedCertDecoder: scopedCertDecoder,
   crlExtensionDecoders: crlExtensionDecoders,
   decodeExtensionList: decodeExtensionList,
+  anchorPathLenFromExtensions: anchorPathLenFromExtensions,
+  lowerPathLen: lowerPathLen,
   extensionDoor: extensionDoor,
   _decodeHelpers: _decodeHelpers,
   attribute: attribute,