@blamejs/pki 0.8.7 → 0.8.10

package/lib/schema-pkix.js

@@ -8,6 +8,7 @@ var constants = require("./constants");
 var schema = require("./schema-engine");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var frameworkError = require("./framework-error");
 var _hasOwn = intrinsic.hasOwn;
 var _forEach = intrinsic.forEach;
 var _map = intrinsic.map;
@@ -59,26 +60,109 @@ var ct = require("./ct");
 var _PEM_BEGIN = "-----BEGIN ";
 var _PEM_END = "-----END ";
 var _PEM_DASHES = "-----";
+var _BOM_LATIN1 = intrinsic.fromCharCode(0xef) + intrinsic.fromCharCode(0xbb) + intrinsic.fromCharCode(0xbf);
+var _BOM_UTF16 = intrinsic.fromCharCode(0xfeff);
+
+/** @internal How many characters of a byte-order mark open `text`. The mark reaches the scanner in
+ * whichever form the caller's decode produced: the three characters EF BB BF from a latin1 read or
+ * a Buffer, and the single U+FEFF from a UTF-8 one. Knowing one form and not the other means
+ * walking past the first boundary line of a file written in the other, which drops its first
+ * object without saying so. */
+function _bomWidth(text) {
+  if (_strSlice(text, 0, 3) === _BOM_LATIN1) return 3;
+  return _charAt(text, 0) === _BOM_UTF16 ? 1 : 0;
+}
+
+/** @internal The offset just past the end of the line `at` sits on, and the offset of the next
+ * line's first character. A boundary is recognized at a line start only, which is what keeps prose
+ * quoting one mid-sentence from being read as a block (RFC 7468 sec. 2). */
+function _lineEnd(text, at) {
+  var i = at;
+  while (i < text.length) {
+    var c = _charCodeAt(text, i);
+    if (c === 13 || c === 10) return i;
+    i += 1;
+  }
+  return i;
+}
+function _nextLineStart(text, lineEnd) {
+  if (lineEnd >= text.length) return text.length;
+  if (_charCodeAt(text, lineEnd) === 13 && _charCodeAt(text, lineEnd + 1) === 10) return lineEnd + 2;
+  return lineEnd + 1;
+}
+
+/** @internal RFC 7468 sec. 3: `labelchar = %x21-2C / %x2E-7E`, every printable character except
+ * the space and the hyphen-minus, and `label = [ labelchar *( ["-" / SP] labelchar ) ]`. So a
+ * label may be empty, may carry a hyphen or a space BETWEEN two of its characters, and may not
+ * open or close with one or carry two in a row. Reading a narrower set makes a conforming file
+ * look like it holds no blocks. */
+function _isLabelChar(c) { return (c >= 0x21 && c <= 0x2c) || (c >= 0x2e && c <= 0x7e); }
+function _isRfc7468Label(text, from, to) {
+  if (from === to) return true;
+  var prevWasChar = false;
+  for (var i = from; i < to; i++) {
+    var c = _charCodeAt(text, i);
+    if (_isLabelChar(c)) { prevWasChar = true; continue; }
+    if (c !== 0x2d && c !== 0x20) return false;
+    if (!prevWasChar) return false;
+    if (i + 1 === to) return false;
+    prevWasChar = false;
+  }
+  return prevWasChar;
+}
+
+/** @internal A boundary line: the keyword, a label, five hyphens, and the end of the line. RFC 7468
+ * sec. 3's parsing grammar ends a line with `W* eol`, so whitespace after the hyphens belongs to
+ * the line ending. Every ASCII whitespace character is taken that way, space, tab, vertical tab and
+ * form feed alike, because the cost of the two readings is not symmetric: treating one of them as
+ * content makes the object behind that boundary invisible, so a reader of one object hands back the
+ * first object of a file holding two and says nothing about the second. Anything that is not
+ * whitespace after the hyphens is content, and the line is prose. The label is everything between
+ * the keyword and the hyphens, because a label may itself carry a hyphen and only the line's end
+ * says where it stops. */
+function _boundaryLabel(text, start, end, keyword) {
+  var p = start + keyword.length;
+  if (p > end || _strSlice(text, start, p) !== keyword) return null;
+  var lineEnd = end;
+  while (lineEnd > p) {
+    var w = _charCodeAt(text, lineEnd - 1);
+    if (w !== 0x20 && w !== 0x09 && w !== 0x0b && w !== 0x0c) break;
+    lineEnd -= 1;
+  }
+  var labelEnd = lineEnd - 5;
+  if (labelEnd < p || _strSlice(text, labelEnd, lineEnd) !== _PEM_DASHES) return null;
+  if (!_isRfc7468Label(text, p, labelEnd)) return null;
+  return _strSlice(text, p, labelEnd);
+}
 
+/** @internal One forward pass over the lines from `from`. The END is matched as a boundary line in
+ * its own right and its label is read off that line, rather than searching for the BEGIN label's
+ * own marker: searching for it runs a block's body on to the next matching END, swallowing whatever
+ * lies between, and rescanning from `bi + 1` after a miss walks the remainder of the file once per
+ * BEGIN line, which is quadratic on text a parse door accepts from anywhere. */
 function _findPemBlock(text, from) {
-  var searchFrom = from;
-  for (;;) {
-    var bi = _strIndexOf(text, _PEM_BEGIN, searchFrom);
-    if (bi === -1) return null;
-    var p = bi + _PEM_BEGIN.length, ls = p;
-    while (p < text.length) {
-      var c = _charCodeAt(text, p);
-      if (!((c >= 65 && c <= 90) || (c >= 48 && c <= 57) || c === 32)) break;
-      p += 1;
+  var at = from;
+  /** @internal A byte-order mark is not part of the first line's content, so a boundary on that
+   * line is still at a line start. */
+  if (at === 0) at = _bomWidth(text);
+  while (at < text.length) {
+    var end = _lineEnd(text, at);
+    var label = _boundaryLabel(text, at, end, _PEM_BEGIN);
+    if (label === null) { at = _nextLineStart(text, end); continue; }
+    var bodyStart = _nextLineStart(text, end);
+    var scan = bodyStart;
+    while (scan < text.length) {
+      var lineEnd = _lineEnd(text, scan);
+      var endLabel = _boundaryLabel(text, scan, lineEnd, _PEM_END);
+      if (endLabel !== null) {
+        return { index: at, label: label, endLabel: endLabel,
+          body: _strSlice(text, bodyStart, scan), end: _nextLineStart(text, lineEnd) };
+      }
+      scan = _nextLineStart(text, lineEnd);
     }
-    if (p === ls || _strSlice(text, p, p + 5) !== _PEM_DASHES) { searchFrom = bi + 1; continue; }
-    var label = _strSlice(text, ls, p);
-    var bodyStart = p + 5;
-    var endMarker = _PEM_END + label + _PEM_DASHES;
-    var ei = _strIndexOf(text, endMarker, bodyStart);
-    if (ei === -1) { searchFrom = bi + 1; continue; }
-    return { index: bi, label: label, body: _strSlice(text, bodyStart, ei), end: ei + endMarker.length };
+    return null;
   }
+  return null;
 }
 
 function _stripB64Whitespace(s) {
@@ -110,11 +194,45 @@ function pemDecode(text, label, PemError) {
   });
   var m = _findPemBlock(text, 0);
   if (!m) throw new PemError("pem/no-block", "no PEM block found");
-  if (label && m.label !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m.label));
+  if (m.endLabel !== m.label) {
+    throw new PemError("pem/label-mismatch", "a block opened as " + _stringify(m.label) + " is closed as " + _stringify(m.endLabel) + " (RFC 7468 sec. 2 requires the same label on both boundaries)");
+  }
+  /** @internal `null` opts out of the label check. The empty string is a LABEL, which RFC 7468
+   * sec. 3 writes as `[ labelchar *( ... ) ]`, so a caller asking for it is asking for the empty
+   * label and not asking for nothing. */
+  if (label !== null && label !== undefined && m.label !== label) {
+    throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m.label));
+  }
+  var rest = _countBlocksFrom(text, m.end);
+  if (rest.opened !== null) {
+    throw new PemError("pem/unterminated-block", "a block opened as " + _stringify(rest.opened) +
+      " after the first object is never closed, so what the input holds cannot be read; this verb reads one object");
+  }
+  if (rest.closed > 0) {
+    throw new PemError("pem/multiple-blocks", "the input holds " + (rest.closed + 1) +
+      " PEM blocks and this verb reads one object; read a file of several objects with pki.schema.pem.decodeBundle");
+  }
   var b64 = _stripB64Whitespace(m.body);
   return guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body");
 }
 
+/** @internal What follows `from`: how many further blocks close, capped at the bundle ceiling so
+ * the count in a refusal is bounded, and the label of a block that opens and never closes. A
+ * trailing boundary with no end is an object too, and reading past it would take the first block
+ * and report nothing about what the rest of the file was trying to be. Each scan resumes where the
+ * last block ended, so the walk over the remainder is linear in the text rather than per block. */
+function _countBlocksFrom(text, from) {
+  var n = 0, at = from, m;
+  while (n < constants.LIMITS.PEM_MAX_BLOCKS) {
+    m = _findPemBlockOrOpen(text, at);
+    if (m === null) break;
+    if (m.unterminated) return { closed: n, opened: m.label };
+    n++;
+    at = m.end;
+  }
+  return { closed: n, opened: null };
+}
+
 function pemDecodeAll(text, label, PemError) {
   label = label || "CERTIFICATE";
   text = guard.text.decode(text, constants.LIMITS.PEM_MAX_BYTES, PemError, {
@@ -124,6 +242,9 @@ function pemDecodeAll(text, label, PemError) {
   var lastEnd = 0, m;
   while ((m = _findPemBlock(text, lastEnd)) !== null) {
     if (_hasNonWhitespace(_strSlice(text, lastEnd, m.index))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted around PEM blocks (RFC 8555 sec. 9.1)");
+    if (m.endLabel !== m.label) {
+      throw new PemError("pem/label-mismatch", "a block opened as " + _stringify(m.label) + " is closed as " + _stringify(m.endLabel) + " (RFC 7468 sec. 2 requires the same label on both boundaries)");
+    }
     if (m.label !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m.label));
     var b64 = _stripB64Whitespace(m.body);
     _push(blocks, guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body"));
@@ -157,29 +278,173 @@ function pemEncode(der, label, PemError) {
   return "-----BEGIN " + label + "-----\n" + b64 + "\n-----END " + label + "-----\n";
 }
 
-function _keepBase64(s) {
-  var out = "", runStart = 0, i;
-  for (i = 0; i < s.length; i++) {
-    var c = _charCodeAt(s, i);
-    if (!((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c === 43 || c === 47 || c === 61)) {
-      if (i > runStart) out += _strSlice(s, runStart, i);
-      runStart = i + 1;
+/** @internal The RFC 1421 headers an OpenSSL traditional encrypted key carries between the
+ * boundary and the body. They are not base64, so a reader that does not know them reports a
+ * transfer fault and sends the operator looking for the wrong thing. */
+function _hasLegacyHeaders(body) {
+  var at = 0;
+  while (at < body.length) {
+    var end = _lineEnd(body, at);
+    var line = _strSlice(body, at, end);
+    if (_strSlice(line, 0, 10) === "Proc-Type:" || _strSlice(line, 0, 9) === "DEK-Info:") return true;
+    if (line !== "" && _strIndexOf(line, ":") === -1) return false;
+    at = _nextLineStart(body, end);
+  }
+  return false;
+}
+
+/** @internal A bound a caller may tighten and may not raise, which is how every other cap in this
+ * file reads: the ceiling is the toolkit's and the floor is the caller's business. */
+function _blockCap(given, ceiling, what, PemError) {
+  if (given === undefined || given === null) return ceiling;
+  if (typeof given !== "number" || !intrinsic.isSafeInteger(given) || given < 1) {
+    throw new PemError("pem/bad-input", what + " must be a positive whole number");
+  }
+  if (given > ceiling) {
+    throw new PemError("pem/bad-input", what + " may only tighten the " + ceiling + " this toolkit reads, not raise it");
+  }
+  return given;
+}
+
+/** @internal Reads every encapsulated block of one text (RFC 7468 sec. 2). Explanatory text before,
+ * between and after the blocks is text, which is the difference between this and the sec. 9.1 chain
+ * profile `pemDecodeAll` enforces. Each row carries the label that named the object, because the
+ * label is the only thing separating a CERTIFICATE from a TRUSTED CERTIFICATE or a PRIVATE KEY, and
+ * the byte offset it started at, so a fault in a file of hundreds names the one object it is about. */
+function pemDecodeBundle(text, opts, PemError, detect) {
+  opts = opts || {};
+  var maxBlocks = _blockCap(opts.maxBlocks, constants.LIMITS.PEM_MAX_BLOCKS, "maxBlocks", PemError);
+  var maxDecoded = _blockCap(opts.maxDecodedBytes, constants.LIMITS.PEM_MAX_DECODED_BYTES, "maxDecodedBytes", PemError);
+  var route = opts.route === true;
+  text = guard.text.decode(text, constants.LIMITS.PEM_MAX_BYTES, PemError, {
+    charset: "latin1", tooLarge: "pem/too-large", badInput: "pem/bad-input", label: "PEM input",
+  });
+
+  var rows = [], at = 0, decoded = 0;
+  for (;;) {
+    var m = _findPemBlockOrOpen(text, at);
+    if (m === null) break;
+    if (m.unterminated) {
+      throw new PemError("pem/unterminated-block", "a block opened as " + _stringify(m.label) +
+        " at byte " + m.index + " is never closed (RFC 7468 sec. 2)");
+    }
+    if (m.endLabel !== m.label) {
+      throw new PemError("pem/end-mismatch", "the block at byte " + m.index + " is opened as " +
+        _stringify(m.label) + " and closed as " + _stringify(m.endLabel) + " (RFC 7468 sec. 2)");
+    }
+    if (rows.length === maxBlocks) {
+      throw new PemError("pem/too-many-blocks", "the file carries more than the " + maxBlocks + " objects this read admits");
+    }
+    if (_hasLegacyHeaders(m.body)) {
+      throw new PemError("pem/legacy-headers", "the object at byte " + m.index +
+        " carries RFC 1421 Proc-Type and DEK-Info headers, so its body is encrypted under a passphrase this reader does not take");
+    }
+    var b64 = _stripB64Whitespace(m.body);
+    var der = guard.encoding.base64(b64, null, function (c, msg) {
+      return new PemError(c, "object " + rows.length + " at byte " + m.index + ": " + msg);
+    }, "pem/bad-base64", "PEM base64 body");
+    decoded += der.length;
+    if (decoded > maxDecoded) {
+      throw new PemError("pem/too-large", "the objects of this file decode to more than the " +
+        maxDecoded + " bytes this read admits");
     }
+    var row = { index: rows.length, offset: m.index, label: m.label, der: der };
+    if (route) {
+      var name = detect(der, m.label);
+      row.format = _labelFormat(m.label, name, m.index, PemError);
+    }
+    _push(rows, row);
+    at = m.end;
+  }
+  if (rows.length === 0) throw new PemError("pem/no-block", "no PEM block found");
+  return rows;
+}
+
+/** @internal What the label claims, against what the bytes are. Deciding silently is the case
+ * RFC 7468 sec. 2's security considerations point at, so a disagreement is a verdict. The two
+ * private-key structures RFC 5958 defines each have their own label (RFC 7468 sec. 10 and
+ * sec. 11) and their own detector, so neither is read as the other. */
+function _labelFormat(label, detected, offset, PemError) {
+  var claimed = PEM_LABEL_FORMAT[label];
+  if (claimed === undefined) return null;
+  if (detected !== claimed) {
+    throw new PemError("pem/label-structure-mismatch", "the object at byte " + offset + " is labeled " +
+      _stringify(label) + ", which names the " + claimed + " structure, and its bytes are " +
+      (detected === null ? "no structure this toolkit reads" : "the " + detected + " structure"));
+  }
+  return claimed;
+}
+
+/** @internal The RFC 7468 sec. 5 to sec. 13 labels this toolkit has a parser for. A label outside
+ * it is a known object of an unknown kind, which is a row rather than a refusal. The legacy labels
+ * sec. 5, sec. 6 and sec. 8 say a generator SHOULD NOT emit are deliberately absent. */
+var PEM_LABEL_FORMAT = intrinsic.assign(intrinsic.create(null), {
+  "CERTIFICATE": "x509",
+  "X509 CRL": "crl",
+  "CERTIFICATE REQUEST": "csr",
+  "NEW CERTIFICATE REQUEST": "csr",
+  "PRIVATE KEY": "pkcs8",
+  "ENCRYPTED PRIVATE KEY": "pkcs8-encrypted",
+  "RSA PRIVATE KEY": "pkcs1",
+  "RSA PUBLIC KEY": "pkcs1-public",
+  "EC PRIVATE KEY": "sec1",
+  "CMS": "cms",
+  "ATTRIBUTE CERTIFICATE": "attrcert",
+  "PKCS12": "pkcs12",
+});
+
+/** @internal One block, or the fact that one was opened and never closed. `_findPemBlock` answers
+ * null for both "no more blocks" and "a block that does not end", and a reader of a whole file has
+ * to tell those apart to name the fault. */
+function _findPemBlockOrOpen(text, from) {
+  var m = _findPemBlock(text, from);
+  if (m !== null) return m;
+  var at = from;
+  if (at === 0) at = _bomWidth(text);
+  while (at < text.length) {
+    var end = _lineEnd(text, at);
+    var label = _boundaryLabel(text, at, end, _PEM_BEGIN);
+    if (label !== null) return { unterminated: true, index: at, label: label };
+    at = _nextLineStart(text, end);
+  }
+  return null;
+}
+
+/** @internal Writes an ordered list of objects to one text. Each label goes through the same
+ * validation the single-object writer applies, so a label carrying a boundary cannot put a block
+ * into the file that the caller never named. */
+function pemEncodeBundle(objects, PemError) {
+  if (!intrinsic.isArray(objects)) {
+    throw new PemError("pem/bad-input", "encodeBundle takes an array of { label, der } objects");
+  }
+  var n = objects.length, out = "";
+  if (n === 0) throw new PemError("pem/bad-input", "encodeBundle takes at least one object");
+  if (n > constants.LIMITS.PEM_MAX_BLOCKS) {
+    throw new PemError("pem/too-many-blocks", "more than the " + constants.LIMITS.PEM_MAX_BLOCKS + " objects this writer admits");
+  }
+  for (var i = 0; i < n; i++) {
+    var o = objects[i];
+    if (o === null || typeof o !== "object") {
+      throw new PemError("pem/bad-input", "object " + i + " must be { label, der }");
+    }
+    out += pemEncode(o.der, o.label, PemError);
   }
-  if (i > runStart) out += _strSlice(s, runStart, i);
   return out;
 }
 
-// @internal
-function pemDecodeLenient(text, label) {
-  var begin = _PEM_BEGIN + label + _PEM_DASHES;
-  var end = _PEM_END + label + _PEM_DASHES;
-  var bi = _strIndexOf(text, begin);
-  if (bi === -1) return null;
-  var bodyStart = bi + begin.length;
-  var ei = _strIndexOf(text, end, bodyStart);
-  if (ei === -1) return null;
-  return _bufferFrom(_keepBase64(_strSlice(text, bodyStart, ei)), "base64");
+/** @internal The entity doors (a signer certificate, a TSA certificate, a CMS message given as PEM)
+ * read through the same scanner every parse door reads through, so the two cannot disagree about
+ * the same bytes. `null` means the file holds no block under `label`, which is what lets a caller
+ * try a second label. Every other fault is the caller's own `E(code, message)`, so the verb keeps
+ * its error code while the message names what the file actually is. */
+function pemDecodeLenient(text, label, E, code) {
+  try {
+    return pemDecode(text, label, frameworkError.PemError);
+  } catch (e) {
+    if (e && (e.code === "pem/no-block" || e.code === "pem/label-mismatch")) return null;
+    if (typeof E === "function") throw E(code, "the PEM input is not one " + label + " object: " + e.message);
+    throw e;
+  }
 }
 
 /** @internal Every refusal below is built from opts, so opts is checked before the first one can be
@@ -196,27 +461,42 @@ function _requireCoerceOpts(opts) {
   }
 }
 
+/** @internal The largest input either arm of `coerceToDer` could go on to accept: PEM text for the
+ * armored arm, DER for the other. Past it neither arm can succeed, so the size is decided first. */
+var _COERCE_MAX_BYTES = constants.LIMITS.PEM_MAX_BYTES > constants.LIMITS.DER_MAX_BYTES
+  ? constants.LIMITS.PEM_MAX_BYTES : constants.LIMITS.DER_MAX_BYTES;
+
 function coerceToDer(input, opts) {
   _requireCoerceOpts(opts);
   if (typeof input === "string") return pemDecode(input, opts.pemLabel, opts.PemError);
   if (guard.bytes.isByteSource(input)) {
     var buf = guard.bytes.source(input, opts.ErrorClass, opts.prefix + "/bad-input", "parse");
+    /** @internal The ceiling is applied before the armor probe rather than after it. The probe
+     * walks until the first byte no text file carries, which on DER is its first byte and on
+     * printable input is the whole of it, so a buffer past every cap either arm could accept
+     * would otherwise be read end to end on the way to being refused for its size. */
+    guard.limits.byteCap(buf, _COERCE_MAX_BYTES, function (c, m) { return new opts.ErrorClass(c, m); },
+      opts.prefix + "/too-large", "parse input");
     return _isPemArmor(buf) ? pemDecode(buf, opts.pemLabel, opts.PemError) : buf;
   }
   throw new opts.ErrorClass(opts.prefix + "/bad-input", "parse expects a DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) or a PEM string");
 }
 
+/** @internal Whether a buffer is armored text rather than DER. Read from a fixed window at the
+ * front, the answer is wrong for a file whose explanatory text is longer than the window, and the
+ * caller then hands PEM to the DER decoder and reports the DER as malformed. So the whole buffer is
+ * walked, and it costs nothing on DER: the walk stops at the first byte no text file carries, which
+ * for a DER SEQUENCE is its first byte. */
 function _isPemArmor(buf) {
-  var head = _bufToString(_subarray(buf, 0, 4096), "latin1");
-  var idx = _strIndexOf(head, "-----BEGIN");
-  if (idx === -1) return false;
-  for (var i = 0; i < idx; i++) {
+  var n = buf.length;
+  for (var i = 0; i < n; i++) {
     var c = buf[i];
     var textByte = (c >= 0x20 && c < 0x7f) || c === 0x09 || c === 0x0a || c === 0x0d ||
       c === 0xef || c === 0xbb || c === 0xbf;
     if (!textByte) return false;
+    if (c === 0x2d && _bufToString(_subarray(buf, i, i + 10), "latin1") === "-----BEGIN") return true;
   }
-  return true;
+  return false;
 }
 
 /** @internal The codec's resource refusals, as distinct from its malformed-input refusals. A
@@ -1585,6 +1865,8 @@ module.exports = {
   dnsNameProblem: dnsNameProblem,
   pemDecode: pemDecode,
   pemDecodeAll: pemDecodeAll,
+  pemDecodeBundle: pemDecodeBundle,
+  pemEncodeBundle: pemEncodeBundle,
   pemDecodeLenient: pemDecodeLenient,
   pemEncode: pemEncode,
   isJsWhitespace: _isJsWhitespace,