@blamejs/pki 0.8.3 → 0.8.5

package/lib/schema-c509.js

@@ -413,16 +413,16 @@ function _generalNameToDer(intVal, valueNode, ipMode, isNative) {
   if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);
   throw _err("c509/bad-extensions", "GeneralName int " + intVal + " has no C509 sec. 8.13 registry row");
 }
-function _generalNameFromDer(gn, ipMode) {
+function _generalNameFromDer(gn, ipMode, ctx) {
   var t = gn.tagNumber;
   if (t === 1 || t === 2 || t === 6) return [cbor.build.int(BigInt(t)), cbor.build.textString(gn.value)];
-  if (t === 4) { var nm = _dirNameToCbor(gn.bytes); return nm == null ? null : [cbor.build.int(4n), nm]; }
+  if (t === 4) { var nm = _dirNameToCbor(gn.bytes, ctx); return nm == null ? null : [cbor.build.int(4n), nm]; }
   if (t === 7) {
     if (!ipMode) return [cbor.build.int(7n), cbor.build.byteString(gn.value)];
     var ip = _ncIpFromDer(gn.value); return ip == null ? null : [cbor.build.int(7n), cbor.build.byteString(ip)];
   }
   if (t === 8) return [cbor.build.int(8n), _oidCbor(gn.value)];
-  if (t === 0) return _otherNameFromDer(gn.value);
+  if (t === 0) return _otherNameFromDer(gn.value, ctx);
   return null;
 }
 
@@ -434,10 +434,10 @@ function _generalNamesToDer(node, isNative) {
   for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false, isNative));
   return out;
 }
-function _generalNamesFromDer(gnNodes) {
+function _generalNamesFromDer(gnNodes, ctx) {
   var out = [];
   for (var i = 0; i < gnNodes.length; i++) {
-    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], NS), false);
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], schema.withResources(NS, ctx)), false, ctx);
     if (pair == null) return null;
     out.push(pair[0]); out.push(pair[1]);
   }
@@ -470,11 +470,11 @@ function _otherNameToDer(node, intVal) {
   }
   return b.contextConstructed(0, Buffer.concat([b.oid(typeId), b.explicit(0, inner)]));
 }
-function _otherNameFromDer(v) {
+function _otherNameFromDer(v, ctx) {
   var onInt = ON_INT_BY_OID[v.typeId];
   if (onInt === undefined) return [cbor.build.int(0n), cbor.build.array([_oidCbor(v.typeId), cbor.build.byteString(v.valueBytes)])];
   var inner;
-  try { inner = asn1.decode(v.valueBytes); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed otherName value yields null, so the extension does not compact and is carried in C509 general form (raw bytes)
+  try { inner = pkix.decodeNested(v.valueBytes, ctx, "an otherName value"); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed otherName value yields null, so the extension does not compact and is carried in C509 general form (raw bytes)
   if (onInt === -1) {
     if (inner.tagClass !== "universal" || inner.tagNumber !== asn1.TAGS.SEQUENCE || !inner.children || inner.children.length !== 2) return null;
     var hwType, hwSerial;
@@ -492,11 +492,11 @@ function _otherNameFromDer(v) {
   return [cbor.build.int(-3n), cbor.build.byteString(mac)];
 }
 
-function _dirNameToCbor(gnBytes) {
-  var node = asn1.decode(gnBytes);
+function _dirNameToCbor(gnBytes, ctx) {
+  var node = pkix.decodeNested(gnBytes, ctx, "a directoryName value");
   if (!node.children || node.children.length !== 1) return null;
   var name;
-  try { name = _c509NameFromDer(node.children[0].bytes); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed directoryName yields null, so the extension is carried in C509 general form instead
+  try { name = _c509NameFromDer(node.children[0].bytes, ctx); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed directoryName yields null, so the extension is carried in C509 general form instead
   try { return _encName(name, true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a directoryName that does not re-encode yields null, so the extension is carried in C509 general form instead
 }
 
@@ -745,13 +745,13 @@ function _subtreesToDer(node, isNative) {
   for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true, isNative)]));
   return Buffer.concat(out);
 }
-function _subtreesFromDer(subtreeNodes) {
+function _subtreesFromDer(subtreeNodes, ctx) {
   if (!subtreeNodes.length) return null;
   var out = [];
   for (var i = 0; i < subtreeNodes.length; i++) {
     var st = subtreeNodes[i];
     if (st.tagClass !== "universal" || st.tagNumber !== asn1.TAGS.SEQUENCE || !st.children || st.children.length !== 1) return null;
-    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], NS), true);
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], schema.withResources(NS, ctx)), true, ctx);
     if (pair == null) return null;
     out.push(pair[0]); out.push(pair[1]);
   }
@@ -836,7 +836,7 @@ function _dpToDer(dpNode, isNative) {
   if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true, isNative)))));
   return b.sequence(fields);
 }
-function _dpFromDer(dp) {
+function _dpFromDer(dp, ctx) {
   if (dp.tagClass !== "universal" || dp.tagNumber !== asn1.TAGS.SEQUENCE || !dp.children) return null;
   var fullNameUris = null, reasonsVal = null, crlIssuerCbor = null, lastTag = -1;
   for (var i = 0; i < dp.children.length; i++) {
@@ -862,7 +862,7 @@ function _dpFromDer(dp) {
       if (!f.children || f.children.length !== 1) return null;
       var ci = f.children[0];
       if (ci.tagClass !== "context" || ci.tagNumber !== 4 || !ci.children || ci.children.length !== 1) return null;
-      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes), true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a malformed CRL-issuer name yields null, so the distributionPoint is carried in C509 general form instead
+      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes, ctx), true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a malformed CRL-issuer name yields null, so the distributionPoint is carried in C509 general form instead
     } else return null;
   }
   if (fullNameUris == null) return null;
@@ -1054,15 +1054,15 @@ function _extValueToDer(name, node, isNative) {
   }
 }
 
-function _extValueFromDer(name, der) {
+function _extValueFromDer(name, der, ctx) {
   var node;
   try {
-  node = asn1.decode(der);
+  node = pkix.decodeNested(der, ctx, "an extension value");
   switch (name) {
     case "subjectKeyIdentifier":
       return cbor.build.byteString(asn1.read.octetString(node));
     case "keyUsage": {
-      var bits = _keyUsageBitsFromDer(der);
+      var bits = _keyUsageBitsFromDer(der, ctx);
       return bits == null ? null : cbor.build.uint(BigInt(bits));
     }
     case "basicConstraints": {
@@ -1081,7 +1081,7 @@ function _extValueFromDer(name, der) {
       if (akids.length === 3 && akids[0].tagClass === "context" && akids[0].tagNumber === 0 &&
           akids[1].tagClass === "context" && akids[1].tagNumber === 1 && akids[1].children &&
           akids[2].tagClass === "context" && akids[2].tagNumber === 2) {
-        var akiIssuer = _generalNamesFromDer(akids[1].children);
+        var akiIssuer = _generalNamesFromDer(akids[1].children, ctx);
         if (akiIssuer == null) return null;
         var akiSerial = asn1.read.integerImplicit(akids[2], 2);
         if (akiSerial < 0n) return null;
@@ -1112,7 +1112,7 @@ function _extValueFromDer(name, der) {
       if (sanMembers.length === 1 && sanMembers[0].tagClass === "context" && sanMembers[0].tagNumber === 2) {
         return cbor.build.textString(schema.walk(GN_LEAF, sanMembers[0], NS).value);
       }
-      var sanItems = _generalNamesFromDer(sanMembers);
+      var sanItems = _generalNamesFromDer(sanMembers, ctx);
       return sanItems == null ? null : cbor.build.array(sanItems);
     }
     case "nameConstraints": {
@@ -1122,7 +1122,7 @@ function _extValueFromDer(name, der) {
         var ncf = node.children[nci];
         if (ncf.tagClass !== "context" || ncf.tagNumber <= ncLast) return null;
         ncLast = ncf.tagNumber;
-        var subItems = _subtreesFromDer(ncf.children || []);
+        var subItems = _subtreesFromDer(ncf.children || [], ctx);
         if (subItems == null) return null;
         if (ncf.tagNumber === 0) { permCbor = cbor.build.array(subItems); sawNc = true; }
         else if (ncf.tagNumber === 1) { exclCbor = cbor.build.array(subItems); sawNc = true; }
@@ -1151,7 +1151,7 @@ function _extValueFromDer(name, der) {
       var dps = node.children || [];
       if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || dps.length < 1) return null;
       var dpResults = [];
-      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi]); if (dpr == null) return null; dpResults.push(dpr); }
+      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi], ctx); if (dpr == null) return null; dpResults.push(dpr); }
       if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
       return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
     }
@@ -1377,14 +1377,14 @@ function _sdaFromDer(node) {
  * the codec represents it, and one without a codec always, since its int form carries the same
  * bytes. An extension the codec cannot represent keeps the generic form on every certificate type.
  */
-function _assertSpecificExtension(dotted, valContent, isNative) {
+function _assertSpecificExtension(dotted, valContent, isNative, ctx) {
   var canon = EXT_NAME_BY_OID[dotted];
   if (!isNative || canon === undefined) return;
-  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative) == null)) return;
+  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative, ctx) == null)) return;
   throw _err("c509/non-specific-encoding", "extension " + canon + " has a C509 registry id that carries this value, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
 }
-function _tryCompactExtValue(name, der, isNative) {
-  var compact = _extValueFromDer(name, der);
+function _tryCompactExtValue(name, der, isNative, ctx) {
+  var compact = _extValueFromDer(name, der, ctx);
   if (compact == null) return null;
   var recon;
   try {
@@ -1395,7 +1395,7 @@ function _tryCompactExtValue(name, der, isNative) {
   return recon.equals(der) ? compact : null;
 }
 
-function _extensions(node, isNative) {
+function _extensions(node, isNative, ctx) {
   if (node.majorType === 0 || node.majorType === 1) {
     var iv = Number(cbor.read.int(node));
     return [{ name: "keyUsage", oid: oid.byName("keyUsage"), critical: iv < 0, keyUsageBits: Math.abs(iv) }];
@@ -1437,7 +1437,7 @@ function _extensions(node, isNative) {
         if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
         valContent = valNode.content;
       }
-      _assertSpecificExtension(extOid, valContent, isNative);
+      _assertSpecificExtension(extOid, valContent, isNative, ctx);
     }
     out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
   }
@@ -1637,21 +1637,49 @@ function parse(input, callerOpts) {
     if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
     subjectPublicKey = f[8].content;
   }
-  var extensions = _extensions(f[9], type === 2);
+  /** @internal A native certificate's extension values are opaque DER inside the CBOR, so reading
+   *  one is a second decode that restarts depth and item counting and takes the caps this door
+   *  was given. The latch is re-read before the result is returned. */
+  var nested = pkix.nestedContext(NS, caps);
+  var result;
+  try {
+    result = _finishParse(f, root, nested, {
+      type: type, serial: serial, sHex: sHex, sigAlg: sigAlg, issuer: issuer,
+      notBefore: notBefore, notAfter: notAfter, subject: subject, spkAlg: spkAlg,
+      subjectPublicKey: subjectPublicKey, rsaKey: rsaKey,
+    });
+  } catch (e) {
+    if (nested.budget.exhausted() && !(e && e.code === "c509/too-large")) throw _budgetRefusal(e);
+    throw e;
+  }
+  if (nested.budget.exhausted()) throw _budgetRefusal(null);
+  return result;
+}
+
+/** @internal The refusal a cap produces, as distinct from a statement about the bytes. It is read
+ *  off the latch rather than off a throw, because the probe that reads an extension value absorbs
+ *  a failure by returning null. */
+function _budgetRefusal(cause) {
+  return _err("c509/too-large", "the C509 certificate exceeds the decode budget for this parse", cause || undefined);
+}
+
+function _finishParse(f, root, nested, fields) {
+  var type = fields.type;
+  var extensions = _extensions(f[9], type === 2, nested.ns);
   if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
   var signatureValue = f[10].content;
 
   var result = {
     certificateType: type,
-    serialNumber: serial,
-    serialNumberHex: sHex,
-    signatureAlgorithm: sigAlg,
-    issuer: issuer,
-    validity: { notBefore: notBefore, notAfter: notAfter },
-    subject: subject,
-    subjectPublicKeyAlgorithm: spkAlg,
-    subjectPublicKey: subjectPublicKey,
-    rsaPublicKey: rsaKey,
+    serialNumber: fields.serial,
+    serialNumberHex: fields.sHex,
+    signatureAlgorithm: fields.sigAlg,
+    issuer: fields.issuer,
+    validity: { notBefore: fields.notBefore, notAfter: fields.notAfter },
+    subject: fields.subject,
+    subjectPublicKeyAlgorithm: fields.spkAlg,
+    subjectPublicKey: fields.subjectPublicKey,
+    rsaPublicKey: fields.rsaKey,
     extensions: extensions,
     signatureValue: signatureValue,
   };
@@ -1660,7 +1688,6 @@ function parse(input, callerOpts) {
   if (type === 2) result.signedData = result._fieldBytes;
 
   if (type === 3) result.reconstructedDer = _reconstructDer(result, f[10]);
-
   return result;
 }
 
@@ -1883,8 +1910,8 @@ function _euiFromCn(value) {
   if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
   return bytes;
 }
-function _c509NameFromDer(nameBytes) {
-  var node = asn1.decode(nameBytes);
+function _c509NameFromDer(nameBytes, ctx) {
+  var node = pkix.decodeNested(nameBytes, ctx, "a Name value");
   var rdns = [];
   (node.children || []).forEach(function (rdnSet) {
     if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
@@ -1905,10 +1932,10 @@ function _c509NameFromDer(nameBytes) {
   });
   return { rdns: rdns };
 }
-function _keyUsageBitsFromDer(extnValue) {
+function _keyUsageBitsFromDer(extnValue, ctx) {
   var bs;
   try {
-    bs = asn1.read.bitString(asn1.decode(extnValue));
+    bs = asn1.read.bitString(pkix.decodeNested(extnValue, ctx, "a keyUsage extension value"));
   } catch (_e) {
     return null;
   }
@@ -1925,6 +1952,7 @@ function _magBytes(intNode) {
 }
 function _sigMagWidth(derSig) {
   var n;
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   try { n = asn1.decode(derSig); } catch (e) { throw _err("c509/bad-signature", "the ECDSA issuer signature is not valid DER", e); }
   if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("c509/bad-signature", "the ECDSA issuer signature must be a SEQUENCE of two INTEGERs");
   for (var i = 0; i < 2; i++) {
@@ -1969,12 +1997,14 @@ _derToType3 = function (input, opts) {
   var sigAlgName = sigCanon === undefined ? c.signatureAlgorithm.name : sigCanon;
   if (String(sigAlgName || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (sigAlgName || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.oid !== oid.byName("ecPublicKey")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
   var curveCanon = EC_CURVE_BY_OID[curveOid];
   var curve = curveCanon === undefined ? oid.name(curveOid) : curveCanon;
   var coordLen = EC_FIELD_BYTES[curve];
   if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
   var sigCurve = _resolveIssuerSigCurve(c, opts, sigAlgName);
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
   return {
     certificateType: 3,

package/lib/schema-cmc.js

@@ -195,8 +195,8 @@ function readExtendedFailInfo(children, what) {
   return { failInfoOID: asn1.read.oid(children[0]), failInfoValueBytes: children[1].bytes };
 }
 
-function parseStatusInfo(valueDer, version, bodyPartID) {
-  var root = asn1.decode(valueDer);
+function parseStatusInfo(valueDer, version, bodyPartID, ctx) {
+  var root = pkix.decodeNested(valueDer, ctx, "a CMCStatusInfo value");
   if (root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.constructed) {
     throw E("cmc/bad-status-info", "a CMCStatusInfo value must be a SEQUENCE");
   }
@@ -447,14 +447,15 @@ var PKI_RESPONSE = schema.seq([
  * that is not one could never be checked against anything. This is asked of a CHALLENGED request only.
  * A request body carries what its sender sent, and judging it is the enrollment's business, not the
  * decoder's. */
-function _assertAnswerableRequest(request) {
+function _assertAnswerableRequest(request, ctx) {
   if (request.arm !== "tcr" && request.arm !== "crm") return;
   /** @internal A CertReqMessages of one, which is the shape the CRMF parser takes; built outside the
    * catch below so only the parse it wraps can be what fails. */
   var payload = request.arm === "tcr" ? request.certificationRequestBytes
     : asn1.build.sequence([asn1.build.raw(request.certReqMsgBytes)]);
   try {
-    if (request.arm === "tcr") { csr.parse(payload); } else { crmf.parse(payload); }
+    var caps = ctx ? ctx.caps : undefined;
+    if (request.arm === "tcr") { csr.parse(payload, caps); } else { crmf.parse(payload, caps); }
   } catch (e) {
     throw E("cmc/bad-pop-challenge",
       "the request an EncryptedPOP quotes is not a " +
@@ -464,13 +465,13 @@ function _assertAnswerableRequest(request) {
   }
 }
 
-function parseEncryptedPop(node) {
+function parseEncryptedPop(node, ctx) {
   if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
       node.children.length !== 5) {
     throw E("cmc/bad-pop-challenge",
       "an EncryptedPOP is SEQUENCE { request, cms, thePOPAlgID, witnessAlgID, witness } (RFC 5272 sec. 6.7)");
   }
-  var envelope = _assertEnvelopedChallenge(node.children[1]);
+  var envelope = _assertEnvelopedChallenge(node.children[1], ctx);
   var request;
   try { request = parseTaggedRequest(node.children[0]); }
   catch (e) {
@@ -478,7 +479,7 @@ function parseEncryptedPop(node) {
       "an EncryptedPOP quotes the request it challenges as a TaggedRequest: " +
       ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
   }
-  _assertAnswerableRequest(request);
+  _assertAnswerableRequest(request, ctx);
   return {
     request: request,
     /** @internal The TaggedRequest exactly as it arrived. A proof of possession is a MAC over these
@@ -526,7 +527,7 @@ function parseDecryptedPop(node) {
  * on unopened because opening them needs key material this parser does not hold. Unopened is not
  * unchecked: a field that is not a ContentInfo carrying an EnvelopedData cannot be a challenge, and
  * saying so here is what keeps a control that could never be answered from reading as one. */
-function _assertEnvelopedChallenge(node) {
+function _assertEnvelopedChallenge(node, ctx) {
   var kids = pkix.rootSequenceChildren(node, 2, 2);
   if (!kids) {
     throw E("cmc/bad-pop-challenge",
@@ -557,7 +558,7 @@ function _assertEnvelopedChallenge(node) {
    * a challenge addressed only that way is refused here, and `pki.cms.decrypt` could not open it
    * either, so it is refused where the reason can be named rather than after a failed answer. */
   var enveloped;
-  try { enveloped = cms.walkEnvelopedData(content.children[0]); }
+  try { enveloped = cms.walkEnvelopedData(content.children[0], ctx); }
   catch (e) {
     throw E("cmc/bad-pop-challenge",
       "an EncryptedPOP's ContentInfo does not carry an EnvelopedData a recipient could open: " +
@@ -594,26 +595,26 @@ function _popAlgorithm(node, what) {
 }
 
 /** @internal One AttributeValue, which is what a control carrying a single structure holds. */
-function _onlyValue(c, what) {
+function _onlyValue(c, what, ctx) {
   if (c.values.length !== 1) {
     throw E("cmc/bad-pop-challenge",
       "a " + what + " control carries exactly one AttributeValue, got " + c.values.length);
   }
-  return asn1.decode(c.values[0]);
+  return pkix.decodeNested(c.values[0], ctx, what + " control value");
 }
 
-function _decodePopChallenges(controls) {
+function _decodePopChallenges(controls, ctx) {
   for (var i = 0; i < controls.length; i++) {
     var c = controls[i];
     if (c.attrType === OID_ENCRYPTED_POP) {
-      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP"));
+      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP", ctx), ctx);
     } else if (c.attrType === OID_DECRYPTED_POP) {
-      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP"));
+      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP", ctx));
     }
   }
 }
 
-function _collectStatuses(controls) {
+function _collectStatuses(controls, ctx) {
   var out = [];
   for (var i = 0; i < controls.length; i++) {
     var c = controls[i];
@@ -622,15 +623,15 @@ function _collectStatuses(controls) {
     if (c.values.length !== 1) {
       throw E("cmc/bad-status-info", "a CMC status control carries exactly one AttributeValue, got " + c.values.length);
     }
-    out.push(parseStatusInfo(c.values[0], version, c.bodyPartID));
+    out.push(parseStatusInfo(c.values[0], version, c.bodyPartID, ctx));
   }
   return out;
 }
 
-function _finishBody(body, where) {
+function _finishBody(body, where, ctx) {
   for (var i = 0; i < body.controls.length; i++) assertControlPlacement(body.controls[i], where);
-  _decodePopChallenges(body.controls);
-  body.statuses = _collectStatuses(body.controls);
+  _decodePopChallenges(body.controls, ctx);
+  body.statuses = _collectStatuses(body.controls, ctx);
   body.unhandled = body.controls.filter(function (c) {
     return c.attrType !== OID_STATUS_INFO && c.attrType !== OID_STATUS_INFO_V2 && c.attrName === null;
   });
@@ -674,7 +675,7 @@ function parsePkiData(input, callerOpts) {
   return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
     var body = schema.walk(PKI_DATA, root, ns).result;
     body.bytes = root.bytes;
-    return _finishBody(body, "pkiData");
+    return _finishBody(body, "pkiData", ns);
   });
 }
 
@@ -706,7 +707,7 @@ function parsePkiResponse(input, callerOpts) {
   return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
     var body = schema.walk(PKI_RESPONSE, root, ns).result;
     body.bytes = root.bytes;
-    return _finishBody(body, "pkiResponse");
+    return _finishBody(body, "pkiResponse", ns);
   });
 }
 
@@ -793,7 +794,9 @@ function parse(input, callerOpts) {
     throw E("cmc/no-content",
       "a Full PKI Request / Response carries its body as the encapsulated content; this SignedData is detached (RFC 5272 sec. 3.2)");
   }
-  var body = eContentType === OID_PKI_DATA ? parsePkiData(encap.eContent) : parsePkiResponse(encap.eContent);
+  var body = eContentType === OID_PKI_DATA
+    ? parsePkiData(encap.eContent, caps)
+    : parsePkiResponse(encap.eContent, caps);
   body.cms = parsedCms;
   body.eContentType = eContentType;
   return body;

package/lib/schema-cmp.js

@@ -283,7 +283,7 @@ var GEN_MSG_CONTENT = schema.seqOf(INFO_TYPE_AND_VALUE, {
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-var CERT_TEMPLATE_LEAF = schema.decode(function (n) { return crmf.walkCertTemplate(n); });
+var CERT_TEMPLATE_LEAF = schema.decode(function (n, ctx) { return crmf.walkCertTemplate(n, ctx); });
 var REV_DETAILS = schema.seq([
   schema.field("certDetails", CERT_TEMPLATE_LEAF),
   schema.optional("crlEntryDetails", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
@@ -348,7 +348,7 @@ var ENCRYPTED_KEY = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 },
     schema: schema.decode(function (n, ctx) {
       var env;
-      try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(n))); }
+      try { env = cms.walkEnvelopedData(pkix.decodeNested(asn1.sequenceTlv(n), ctx, "an EncryptedKey envelopedData"), ctx); }
       catch (e) {
         throw ctx.E("cmp/bad-cert-response", "envelopedData [0] must be a well-formed IMPLICIT EnvelopedData (RFC 9810 sec. 5.2.2)", e);
       }
@@ -521,7 +521,7 @@ var BODY = schema.decode(function (n, ctx) {
   var out = { arm: BODY_ARMS[n.tagNumber], tag: n.tagNumber, bytes: inner.bytes };
   if (CRMF_ARMS[n.tagNumber]) {
     var isCcr = n.tagNumber === 13;
-    out.decoded = crmf.walkCertReqMessages(inner, { allowSigningAlg: isCcr, allowV1Version: isCcr });
+    out.decoded = crmf.walkCertReqMessages(inner, { allowSigningAlg: isCcr, allowV1Version: isCcr }, ctx);
   } else if (DECODED_ARMS[n.tagNumber]) {
     var match = schema.walk(DECODED_ARMS[n.tagNumber], inner, ctx);
     out.decoded = match.result;
@@ -612,7 +612,7 @@ var PKI_MESSAGE = schema.seq([
           for (var cn = 0; cn < controls.length; cn++) {
             if (controls[cn].type !== OID_PKI_ARCHIVE_OPTIONS) continue;
             var arch;
-            try { arch = asn1.decode(controls[cn].value); }
+            try { arch = pkix.decodeNested(controls[cn].value, ctx, "a pkiArchiveOptions control value"); }
             catch (e) { throw ctx.E("cmp/bad-body", "a ccr pkiArchiveOptions control did not decode (RFC 9810 sec. 5.3.11)", e); }
             if (arch.tagClass === "context" && arch.tagNumber === 0) {
               throw ctx.E("cmp/bad-body", "a cross-certification request (ccr) must not send the private key -- a pkiArchiveOptions encryptedPrivKey control is forbidden (RFC 9810 sec. 5.3.11, sec. 5.2.8.3.1)");
@@ -631,7 +631,7 @@ var PKI_MESSAGE = schema.seq([
         if (archCtrls && header.pvno !== 3) {
           for (var ac = 0; ac < archCtrls.length; ac++) {
             if (archCtrls[ac].type !== OID_PKI_ARCHIVE_OPTIONS) continue;
-            var opt = asn1.decode(archCtrls[ac].value);
+            var opt = pkix.decodeNested(archCtrls[ac].value, ctx, "a pkiArchiveOptions control value");
             if (opt.tagClass === "context" && opt.tagNumber === 0 && opt.children && opt.children.length >= 1 &&
                 opt.children[0].tagClass === "context" && opt.children[0].tagNumber === 0) {
               throw ctx.E("cmp/bad-version", "a pkiArchiveOptions encryptedPrivKey using the EnvelopedData form requires CMP version cmp2021(3) (RFC 9810 sec. 5.2.8.3.1, sec. 7)");
@@ -643,7 +643,7 @@ var PKI_MESSAGE = schema.seq([
     if (header.generalInfo) {
       for (var gi = 0; gi < header.generalInfo.length; gi++) {
         if (header.generalInfo[gi].type !== OID_CERT_PROFILE) continue;
-        var profileCount = asn1.decode(header.generalInfo[gi].value).children.length;
+        var profileCount = pkix.decodeNested(header.generalInfo[gi].value, ctx, "a certProfile infoValue").children.length;
         var bodyCount = null;
         if (body.arm === "p10cr") bodyCount = 1;
         else if (body.decoded && body.decoded.messages) bodyCount = body.decoded.messages.length;
@@ -654,13 +654,13 @@ var PKI_MESSAGE = schema.seq([
       }
     }
     if (body.arm === "ckuann" && header.pvno !== 3) {
-      var caKeyUpd = asn1.decode(body.bytes);
+      var caKeyUpd = pkix.decodeNested(body.bytes, ctx, "a ckuann body");
       if (caKeyUpd.tagClass === "context" && caKeyUpd.tagNumber === 0) {
         throw ctx.E("cmp/bad-version", "a ckuann using the cAKeyUpdAnnV3 [0] RootCaKeyUpdateContent form requires CMP version cmp2021(3) (RFC 9810 sec. 5.3.13, sec. 7)");
       }
     }
     if (body.arm === "popdecc" && header.pvno !== 3) {
-      var challenges = asn1.decode(body.bytes);
+      var challenges = pkix.decodeNested(body.bytes, ctx, "a popdecc body");
       if (challenges.tagClass === "universal" && challenges.tagNumber === TAGS.SEQUENCE && challenges.children) {
         for (var chi = 0; chi < challenges.children.length; chi++) {
           var chKids = challenges.children[chi].children;