[PATCH common 0/3] pem parser: handle missing newline edge case

[Thomas Ellmenreich <t.ellmenreich@proxmox.com>]

After the previous series: [0] was already applied, I realized that the
parsing ignores a specific edgecase. Currently the header does not force
a newline, and neither does the footer, only the content does. This means
that something like the following is allowed and this series addresses
this edgecase.

    -----BEGIN CERTIFICATE-----TG9yZW0gaXBzdW0=
    -----END CERTIFICATE-----

Since I began changing the header and footer regexes, I wrote some tests
to also fix the functionality of pem_to_der, which is when I noticed that
the above certificate is decoded to "<gibberish bytes>Lorem ipsum" instead
of just "Lorem ipsum".

In the case of pem_to_der I have decided to introduce a clearer error
boundary, meaning that we die quickly instead of returning gibberish. I
further restricted the allowed characters of a label so that the label
can't just glob up everything.

    This example would be interpreted as one long header, and then die,
    saying that a footer is missing, which might be misleading.

               v - label begins here       ...        ends here - v
    -----BEGIN CERTIFICATE-----TG9yZW0gaXBzdW0=-----END CERTIFICATE-----
                          ^ *here

    By limiting the label characters it will stop looking for a label
    *here and then just say it can't find a header as there is no newline.

Open Questions
--------------

 - There is one edge case I did not properly cover. This occurs when a chain
   like the following is passed to the pem_to_der subroutine:

   v -----BEGIN CERTIFICATE-----
   . TG9yZW0gaXBzdW0=
   . -----END CERTIFICATE----------BEGIN CERTIFICATE-----
   . TG9yZW0gaXBzdW0=
   ^ -----END CERTIFICATE-----

   In this case, everything between the first and last line is passed to
   the decoding function. That function stops decoding as soon as the first
   '=' is encountered, so the result is actually correct.

   I have added a test for this, and deemed it not necessary to fix, as it
   would add a lot of unnecessary complexity, and works as it is now.


[0]: https://lore.proxmox.com/all/20260805141114.190477-1-t.ellmenreich@proxmox.com/T/#u


pve-common:

Thomas Ellmenreich (3):
  pem to der: make header and footer parsing stricter
  tests: introduce tests for pem_to_der
  check pem: force at least one newline after header and footer

 src/PVE/Certificate.pm  |  15 ++--
 test/Makefile           |   1 +
 test/check_pem_test.pl  |  77 ++++++++++++++++++-
 test/pem_to_der_test.pl | 161 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 247 insertions(+), 7 deletions(-)
 create mode 100755 test/pem_to_der_test.pl


Summary over all repositories:
  4 files changed, 247 insertions(+), 7 deletions(-)

-- 
Generated by murpp 0.12.0