crypto: make PEM parsing RFC7468-compliant

PR-URL: #23164Fixes: #13612Fixes: #22815 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: James M Snell <[email protected]>

Author: tniessen

src/node_crypto.cc

@@ -45,13 +45,6 @@
 #include<memory>
 #include<vector>
 
-staticconstchar PUBLIC_KEY_PFX[] = "-----BEGIN PUBLIC KEY-----";
-staticconstint PUBLIC_KEY_PFX_LEN = sizeof(PUBLIC_KEY_PFX) - 1;
-staticconstchar PUBRSA_KEY_PFX[] = "-----BEGIN RSA PUBLIC KEY-----";
-staticconstint PUBRSA_KEY_PFX_LEN = sizeof(PUBRSA_KEY_PFX) - 1;
-staticconstchar CERTIFICATE_PFX[] = "-----BEGIN CERTIFICATE-----";
-staticconstint CERTIFICATE_PFX_LEN = sizeof(CERTIFICATE_PFX) - 1;
-
 staticconstint X509_NAME_FLAGS = ASN1_STRFLGS_ESC_CTRL
  | ASN1_STRFLGS_UTF8_CONVERT
  | XN_FLAG_SEP_MULTILINE
@@ -3656,38 +3649,64 @@ enum ParsePublicKeyResult{
 kParsePublicFailed
 };
 
+static ParsePublicKeyResult TryParsePublicKey(
+ EVPKeyPointer* pkey,
+const BIOPointer& bp,
+constchar* name,
+// NOLINTNEXTLINE(runtime/int)
+ std::function<EVP_PKEY*(constunsignedchar** p, long l)> parse){
+unsignedchar* der_data;
+long der_len; // NOLINT(runtime/int)
+
+// This skips surrounding data and decodes PEM to DER.
+{
+ MarkPopErrorOnReturn mark_pop_error_on_return;
+if (PEM_bytes_read_bio(&der_data, &der_len, nullptr, name,
+ bp.get(), nullptr, nullptr) != 1)
+returnkParsePublicNotRecognized;
+ }
+
+// OpenSSL might modify the pointer, so we need to make a copy before parsing.
+constunsignedchar* p = der_data;
+ pkey->reset(parse(&p, der_len));
+OPENSSL_clear_free(der_data, der_len);
+
+return *pkey ? kParsePublicOk : kParsePublicFailed;
+}
+
 static ParsePublicKeyResult ParsePublicKey(EVPKeyPointer* pkey,
 constchar* key_pem,
 int key_pem_len){
  BIOPointer bp(BIO_new_mem_buf(const_cast<char*>(key_pem), key_pem_len));
 if (!bp)
 returnkParsePublicFailed;
 
-// Check if this is a PKCS#8 or RSA public key before trying as X.509.
-if (strncmp(key_pem, PUBLIC_KEY_PFX, PUBLIC_KEY_PFX_LEN) == 0){
- pkey->reset(
-PEM_read_bio_PUBKEY(bp.get(), nullptr, NoPasswordCallback, nullptr));
- } elseif (strncmp(key_pem, PUBRSA_KEY_PFX, PUBRSA_KEY_PFX_LEN) == 0){
- RSAPointer rsa(PEM_read_bio_RSAPublicKey(
- bp.get(), nullptr, PasswordCallback, nullptr));
-if (rsa){
- pkey->reset(EVP_PKEY_new());
-if (*pkey)
-EVP_PKEY_set1_RSA(pkey->get(), rsa.get());
- }
- } elseif (strncmp(key_pem, CERTIFICATE_PFX, CERTIFICATE_PFX_LEN) == 0){
-// X.509 fallback
- X509Pointer x509(PEM_read_bio_X509(
- bp.get(), nullptr, NoPasswordCallback, nullptr));
-if (!x509)
-returnkParsePublicFailed;
-
- pkey->reset(X509_get_pubkey(x509.get()));
- } else{
-returnkParsePublicNotRecognized;
- }
-
-return *pkey ? kParsePublicOk : kParsePublicFailed;
+ ParsePublicKeyResult ret;
+
+// Try PKCS#8 first.
+ ret = TryParsePublicKey(pkey, bp, "PUBLIC KEY",
+ [](constunsignedchar** p, long l){// NOLINT(runtime/int)
+returnd2i_PUBKEY(nullptr, p, l);
+ });
+if (ret != kParsePublicNotRecognized)
+return ret;
+
+// Maybe it is PKCS#1.
+CHECK(BIO_reset(bp.get()));
+ ret = TryParsePublicKey(pkey, bp, "RSA PUBLIC KEY",
+ [](constunsignedchar** p, long l){// NOLINT(runtime/int)
+returnd2i_PublicKey(EVP_PKEY_RSA, nullptr, p, l);
+ });
+if (ret != kParsePublicNotRecognized)
+return ret;
+
+// X.509 fallback.
+CHECK(BIO_reset(bp.get()));
+returnTryParsePublicKey(pkey, bp, "CERTIFICATE",
+ [](constunsignedchar** p, long l){// NOLINT(runtime/int)
+ X509Pointer x509(d2i_X509(nullptr, p, l));
+return x509 ? X509_get_pubkey(x509.get()) : nullptr;
+ });
 }
 
 voidVerify::Initialize(Environment* env, v8::Local<Object> target){