From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 164951FF09B for ; Mon, 09 Nov 2026 11:38:15 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 7119D216A9; Mon, 09 Nov 2026 11:37:50 +0100 (CET) From: Thomas Ellmenreich To: pve-devel@lists.proxmox.com Subject: [PATCH common 0/3] pem parser: handle missing newline edge case Date: Mon, 9 Nov 2026 11:37:30 +0100 Message-ID: <20261109103733.128704-1-t.ellmenreich@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1794220663258 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.352 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: FCFBIIN3KDZV6Y4VRHV4VGWWCE4W3HM6 X-Message-ID-Hash: FCFBIIN3KDZV6Y4VRHV4VGWWCE4W3HM6 X-MailFrom: t.ellmenreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Thomas Ellmenreich X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: After the previous series: [0] was already applied, I realized that the parsing ignores a specific edgecase. Currently the header does not force a newline, and neither does the footer, only the content does. This means that something like the following is allowed and this series addresses this edgecase. -----BEGIN CERTIFICATE-----TG9yZW0gaXBzdW0= -----END CERTIFICATE----- Since I began changing the header and footer regexes, I wrote some tests to also fix the functionality of pem_to_der, which is when I noticed that the above certificate is decoded to "Lorem ipsum" instead of just "Lorem ipsum". In the case of pem_to_der I have decided to introduce a clearer error boundary, meaning that we die quickly instead of returning gibberish. I further restricted the allowed characters of a label so that the label can't just glob up everything. This example would be interpreted as one long header, and then die, saying that a footer is missing, which might be misleading. v - label begins here ... ends here - v -----BEGIN CERTIFICATE-----TG9yZW0gaXBzdW0=-----END CERTIFICATE----- ^ *here By limiting the label characters it will stop looking for a label *here and then just say it can't find a header as there is no newline. Open Questions -------------- - There is one edge case I did not properly cover. This occurs when a chain like the following is passed to the pem_to_der subroutine: v -----BEGIN CERTIFICATE----- . TG9yZW0gaXBzdW0= . -----END CERTIFICATE----------BEGIN CERTIFICATE----- . TG9yZW0gaXBzdW0= ^ -----END CERTIFICATE----- In this case, everything between the first and last line is passed to the decoding function. That function stops decoding as soon as the first '=' is encountered, so the result is actually correct. I have added a test for this, and deemed it not necessary to fix, as it would add a lot of unnecessary complexity, and works as it is now. [0]: https://lore.proxmox.com/all/20260805141114.190477-1-t.ellmenreich@proxmox.com/T/#u pve-common: Thomas Ellmenreich (3): pem to der: make header and footer parsing stricter tests: introduce tests for pem_to_der check pem: force at least one newline after header and footer src/PVE/Certificate.pm | 15 ++-- test/Makefile | 1 + test/check_pem_test.pl | 77 ++++++++++++++++++- test/pem_to_der_test.pl | 161 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 247 insertions(+), 7 deletions(-) create mode 100755 test/pem_to_der_test.pl Summary over all repositories: 4 files changed, 247 insertions(+), 7 deletions(-) -- Generated by murpp 0.12.0