[PATCH common 3/3] check pem: force at least one newline after header and footer

[Thomas Ellmenreich <t.ellmenreich@proxmox.com>]

Previously, the newlines after a header and footer were optional, only
the content enforced a newline, which meant that the validation didn't
catch an erroneous PEM's.

Extend the header and footer regexes to account for this, as well as
expecting the start of a line before each. In the case of the footer
the following newline can also be the end of the string.

Fixes: 2e8941e ("fix #5978: pem parser: relax parsing of chain entries")
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 src/PVE/Certificate.pm |  8 ++---
 test/check_pem_test.pl | 77 +++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 80 insertions(+), 5 deletions(-)

diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index 6985d75..7072c21 100644
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -106,11 +106,11 @@ PVE::JSONSchema::register_standard_option(
 
 my $header_re = sub {
     my ($label) = @_;
-    return qr!-----BEGIN\ $label-----(?:\s|\n)*!;
+    return qr!(?m:^)-----BEGIN\ $label-----(?:\s|\n)*\n(?:\s|\n)*!;
 };
 my $footer_re = sub {
     my ($label) = @_;
-    return qr!-----END\ $label-----(?:\s|\n)*!;
+    return qr!(?m:^)-----END\ $label-----(?:\s|\n)*(?:$|\n)!;
 };
 my $pem_re = sub {
     my ($label) = @_;
@@ -190,9 +190,9 @@ sub pem_to_der {
     $content = strip_leading_text($content);
 
     # only take first PEM entry
-    $content =~ s/^$header$//mg
+    $content =~ s/$header//mg
         or die "Could not convert PEM to DER, no header found.\n";
-    $content =~ s/^$footer.*//ms
+    $content =~ s/$footer.*//ms
         or die "Could not convert PEM to DER, no footer found.\n";
 
     $content = decode_base64($content);
diff --git a/test/check_pem_test.pl b/test/check_pem_test.pl
index 4917d2b..b47a54d 100755
--- a/test/check_pem_test.pl
+++ b/test/check_pem_test.pl
@@ -28,6 +28,32 @@ Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
 SAAwRQIhANfakefakefakefakefakefakefakefakefake
 -----END CERTIFICATE-----
 EOF
+    },
+    {
+        expected_success => 1,
+        name => "full pem no terminating newline",
+        pem => q{-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----},
+        expected_result => q{-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----}
     },
     {
         expected_success => 1,
@@ -68,7 +94,7 @@ test
 EOF
     },
     {
-        expected_success => 1,
+        expected_success => 0,
         name => "only newline pem",
         pem => <<'EOF',
 -----BEGIN CERTIFICATE-----
@@ -152,6 +178,22 @@ EOF
 -----BEGIN CERTIFICATE-----
 42JlZ2tseTxzZWl2IGF3ZWlidm4=
 -----END CERTIFICATE-----
+EOF
+    },
+    {
+        expected_success => 0,
+        name => "missing newline pem",
+        multiple => 1,
+        pem => <<'EOF',
+-----BEGIN CERTIFICATE-----12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE----------BEGIN CERTIFICATE-----
+
+
+
+
+
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
 EOF
     },
     {
@@ -175,6 +217,39 @@ dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
 c2JlZ2tseTxzZWl2IGF3ZWlidm4=
 -----END CERTIFICATE-----
 EOF
+    },
+    {
+        expected_success => 1,
+        name => "multiple pem with no terminating newline",
+        multiple => 1,
+        pem => q{Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----},
+        expected_result => q{-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----}
     },
     {
         expected_success => 1,
-- 
2.47.3