octoleo/phpseclib
1
0
Fork 0
mirror of https://github.com/phpseclib/phpseclib.git synced 2025-01-28 17:48:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

ASN1: make it so that null is returned if the BER can't be decoded

Browse Source
This commit is contained in:
terrafrost 2022-06-18 21:40:12 -05:00
parent e0adfa1712
commit 9a1d16fe97
10 changed files with 70 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
phpseclib/Crypt/Common/Formats/Keys/PKCS8.php
View File

@ -344,12 +344,15 @@ abstract class PKCS8 extends PKCS
$meta['meta']['algorithm'] = $algorithm; $meta['meta']['algorithm'] = $algorithm;
$temp = ASN1::decodeBER($decrypted['encryptionAlgorithm']['parameters']); $temp = ASN1::decodeBER($decrypted['encryptionAlgorithm']['parameters']);
if (!$temp) {
throw new \RuntimeException('Unable to decode BER');
}
extract(ASN1::asn1map($temp[0], Maps\PBEParameter::MAP)); extract(ASN1::asn1map($temp[0], Maps\PBEParameter::MAP));
$iterationCount = (int) $iterationCount->toString(); $iterationCount = (int) $iterationCount->toString();
$cipher->setPassword($password, $kdf, $hash, $salt, $iterationCount); $cipher->setPassword($password, $kdf, $hash, $salt, $iterationCount);
$key = $cipher->decrypt($decrypted['encryptedData']); $key = $cipher->decrypt($decrypted['encryptedData']);
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER 2'); throw new \RuntimeException('Unable to decode BER 2');
} }
@ -358,6 +361,9 @@ abstract class PKCS8 extends PKCS
$meta['meta']['algorithm'] = $algorithm; $meta['meta']['algorithm'] = $algorithm;
$temp = ASN1::decodeBER($decrypted['encryptionAlgorithm']['parameters']); $temp = ASN1::decodeBER($decrypted['encryptionAlgorithm']['parameters']);
if (!$temp) {
throw new \RuntimeException('Unable to decode BER');
}
$temp = ASN1::asn1map($temp[0], Maps\PBES2params::MAP); $temp = ASN1::asn1map($temp[0], Maps\PBES2params::MAP);
extract($temp); extract($temp);
@ -365,6 +371,9 @@ abstract class PKCS8 extends PKCS
$meta['meta']['cipher'] = $encryptionScheme['algorithm']; $meta['meta']['cipher'] = $encryptionScheme['algorithm'];
$temp = ASN1::decodeBER($decrypted['encryptionAlgorithm']['parameters']); $temp = ASN1::decodeBER($decrypted['encryptionAlgorithm']['parameters']);
if (!$temp) {
throw new \RuntimeException('Unable to decode BER');
}
$temp = ASN1::asn1map($temp[0], Maps\PBES2params::MAP); $temp = ASN1::asn1map($temp[0], Maps\PBES2params::MAP);
extract($temp); extract($temp);
@ -372,6 +381,9 @@ abstract class PKCS8 extends PKCS
$cipher->setIV($encryptionScheme['parameters']['octetString']); $cipher->setIV($encryptionScheme['parameters']['octetString']);
} else { } else {
$temp = ASN1::decodeBER($encryptionScheme['parameters']); $temp = ASN1::decodeBER($encryptionScheme['parameters']);
if (!$temp) {
throw new \RuntimeException('Unable to decode BER');
}
extract(ASN1::asn1map($temp[0], Maps\RC2CBCParameter::MAP)); extract(ASN1::asn1map($temp[0], Maps\RC2CBCParameter::MAP));
$effectiveKeyLength = (int) $rc2ParametersVersion->toString(); $effectiveKeyLength = (int) $rc2ParametersVersion->toString();
switch ($effectiveKeyLength) { switch ($effectiveKeyLength) {
@ -394,6 +406,9 @@ abstract class PKCS8 extends PKCS
switch ($keyDerivationFunc['algorithm']) { switch ($keyDerivationFunc['algorithm']) {
case 'id-PBKDF2': case 'id-PBKDF2':
$temp = ASN1::decodeBER($keyDerivationFunc['parameters']); $temp = ASN1::decodeBER($keyDerivationFunc['parameters']);
if (!$temp) {
throw new \RuntimeException('Unable to decode BER');
}
$prf = ['algorithm' => 'id-hmacWithSHA1']; $prf = ['algorithm' => 'id-hmacWithSHA1'];
$params = ASN1::asn1map($temp[0], Maps\PBKDF2params::MAP); $params = ASN1::asn1map($temp[0], Maps\PBKDF2params::MAP);
extract($params); extract($params);
@ -412,7 +427,7 @@ abstract class PKCS8 extends PKCS
$cipher->setPassword(...$params); $cipher->setPassword(...$params);
$key = $cipher->decrypt($decrypted['encryptedData']); $key = $cipher->decrypt($decrypted['encryptedData']);
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER 3'); throw new \RuntimeException('Unable to decode BER 3');
} }
break; break;
@ -647,7 +662,7 @@ abstract class PKCS8 extends PKCS
} }
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }
@ -671,12 +686,18 @@ abstract class PKCS8 extends PKCS
if ($r['encryptionAlgorithm']['algorithm'] == 'id-PBES2') { if ($r['encryptionAlgorithm']['algorithm'] == 'id-PBES2') {
$decoded = ASN1::decodeBER($r['encryptionAlgorithm']['parameters']->element); $decoded = ASN1::decodeBER($r['encryptionAlgorithm']['parameters']->element);
if (!$decoded) {
throw new \RuntimeException('Unable to decode BER');
}
$r['encryptionAlgorithm']['parameters'] = ASN1::asn1map($decoded[0], ASN1\Maps\PBES2params::MAP); $r['encryptionAlgorithm']['parameters'] = ASN1::asn1map($decoded[0], ASN1\Maps\PBES2params::MAP);
$kdf = &$r['encryptionAlgorithm']['parameters']['keyDerivationFunc']; $kdf = &$r['encryptionAlgorithm']['parameters']['keyDerivationFunc'];
switch ($kdf['algorithm']) { switch ($kdf['algorithm']) {
case 'id-PBKDF2': case 'id-PBKDF2':
$decoded = ASN1::decodeBER($kdf['parameters']->element); $decoded = ASN1::decodeBER($kdf['parameters']->element);
if (!$decoded) {
throw new \RuntimeException('Unable to decode BER');
}
$kdf['parameters'] = ASN1::asn1map($decoded[0], Maps\PBKDF2params::MAP); $kdf['parameters'] = ASN1::asn1map($decoded[0], Maps\PBKDF2params::MAP);
} }
} }

2
phpseclib/Crypt/DH/Formats/Keys/PKCS1.php
View File

@ -45,7 +45,7 @@ abstract class PKCS1 extends Progenitor
$key = parent::load($key, $password); $key = parent::load($key, $password);
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }

3
phpseclib/Crypt/DH/Formats/Keys/PKCS8.php
View File

@ -90,8 +90,7 @@ abstract class PKCS8 extends Progenitor
$decoded = ASN1::decodeBER($key[$type]); $decoded = ASN1::decodeBER($key[$type]);
switch (true) { switch (true) {
case empty($decoded): case !isset($decoded):
case !is_array($decoded):
case !isset($decoded[0]['content']): case !isset($decoded[0]['content']):
case !$decoded[0]['content'] instanceof BigInteger: case !$decoded[0]['content'] instanceof BigInteger:
throw new \RuntimeException('Unable to decode BER of parameters'); throw new \RuntimeException('Unable to decode BER of parameters');

2
phpseclib/Crypt/DSA/Formats/Keys/PKCS1.php
View File

@ -52,7 +52,7 @@ abstract class PKCS1 extends Progenitor
$key = parent::load($key, $password); $key = parent::load($key, $password);
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }

2
phpseclib/Crypt/DSA/Formats/Keys/PKCS8.php
View File

@ -84,7 +84,7 @@ abstract class PKCS8 extends Progenitor
} }
$decoded = ASN1::decodeBER($key[$type . 'Algorithm']['parameters']->element); $decoded = ASN1::decodeBER($key[$type . 'Algorithm']['parameters']->element);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER of parameters'); throw new \RuntimeException('Unable to decode BER of parameters');
} }
$components = ASN1::asn1map($decoded[0], Maps\DSAParams::MAP); $components = ASN1::asn1map($decoded[0], Maps\DSAParams::MAP);

6
phpseclib/Crypt/EC/Formats/Keys/PKCS1.php
View File

@ -66,7 +66,7 @@ abstract class PKCS1 extends Progenitor
preg_match('#-*BEGIN EC PRIVATE KEY-*[^-]*-*END EC PRIVATE KEY-*#s', $key, $matches); preg_match('#-*BEGIN EC PRIVATE KEY-*[^-]*-*END EC PRIVATE KEY-*#s', $key, $matches);
$decoded = parent::load($matches[0], $password); $decoded = parent::load($matches[0], $password);
$decoded = ASN1::decodeBER($decoded); $decoded = ASN1::decodeBER($decoded);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }
@ -82,7 +82,7 @@ abstract class PKCS1 extends Progenitor
preg_match('#-*BEGIN EC PARAMETERS-*[^-]*-*END EC PARAMETERS-*#s', $key, $matches); preg_match('#-*BEGIN EC PARAMETERS-*[^-]*-*END EC PARAMETERS-*#s', $key, $matches);
$decoded = parent::load($matches[0], ''); $decoded = parent::load($matches[0], '');
$decoded = ASN1::decodeBER($decoded); $decoded = ASN1::decodeBER($decoded);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }
$ecParams = ASN1::asn1map($decoded[0], Maps\ECParameters::MAP); $ecParams = ASN1::asn1map($decoded[0], Maps\ECParameters::MAP);
@ -113,7 +113,7 @@ abstract class PKCS1 extends Progenitor
$key = parent::load($key, $password); $key = parent::load($key, $password);
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }

6
phpseclib/Crypt/EC/Formats/Keys/PKCS8.php
View File

@ -98,6 +98,9 @@ abstract class PKCS8 extends Progenitor
} }
$decoded = ASN1::decodeBER($key[$type . 'Algorithm']['parameters']->element); $decoded = ASN1::decodeBER($key[$type . 'Algorithm']['parameters']->element);
if (!$decoded) {
throw new \RuntimeException('Unable to decode BER');
}
$params = ASN1::asn1map($decoded[0], Maps\ECParameters::MAP); $params = ASN1::asn1map($decoded[0], Maps\ECParameters::MAP);
if (!$params) { if (!$params) {
throw new \RuntimeException('Unable to decode the parameters using Maps\ECParameters'); throw new \RuntimeException('Unable to decode the parameters using Maps\ECParameters');
@ -113,6 +116,9 @@ abstract class PKCS8 extends Progenitor
} }
$decoded = ASN1::decodeBER($key['privateKey']); $decoded = ASN1::decodeBER($key['privateKey']);
if (!$decoded) {
throw new \RuntimeException('Unable to decode BER');
}
$key = ASN1::asn1map($decoded[0], Maps\ECPrivateKey::MAP); $key = ASN1::asn1map($decoded[0], Maps\ECPrivateKey::MAP);
if (isset($key['parameters']) && $params != $key['parameters']) { if (isset($key['parameters']) && $params != $key['parameters']) {
throw new \RuntimeException('The PKCS8 parameter field does not match the private key parameter field'); throw new \RuntimeException('The PKCS8 parameter field does not match the private key parameter field');

2
phpseclib/Crypt/RSA/Formats/Keys/PKCS1.php
View File

@ -59,7 +59,7 @@ abstract class PKCS1 extends Progenitor
$key = parent::load($key, $password); $key = parent::load($key, $password);
$decoded = ASN1::decodeBER($key); $decoded = ASN1::decodeBER($key);
if (empty($decoded)) { if (!$decoded) {
throw new \RuntimeException('Unable to decode BER'); throw new \RuntimeException('Unable to decode BER');
} }

10
phpseclib/File/ASN1.php
View File

@ -191,7 +191,7 @@ abstract class ASN1
* Serves a similar purpose to openssl's asn1parse * Serves a similar purpose to openssl's asn1parse
* *
* @param Element|string $encoded * @param Element|string $encoded
* @return array * @return ?array
*/ */
public static function decodeBER($encoded) public static function decodeBER($encoded)
{ {
@ -201,10 +201,12 @@ abstract class ASN1
self::$encoded = $encoded; self::$encoded = $encoded;
$decoded = [self::decode_ber($encoded)]; $decoded = self::decode_ber($encoded);
if ($decoded === false) {
return null;
}
// encapsulate in an array for BC with the old decodeBER return [self::decode_ber($encoded)];
return $decoded;
} }
/** /**

31
phpseclib/File/X509.php
View File

@ -468,7 +468,7 @@ class X509
$decoded = ASN1::decodeBER($cert); $decoded = ASN1::decodeBER($cert);
if (!empty($decoded)) { if ($decoded) {
$x509 = ASN1::asn1map($decoded[0], Maps\Certificate::MAP); $x509 = ASN1::asn1map($decoded[0], Maps\Certificate::MAP);
} }
if (!isset($x509) || $x509 === false) { if (!isset($x509) || $x509 === false) {
@ -593,6 +593,9 @@ class X509
[static::class, 'decodeNameConstraintIP'] : [static::class, 'decodeNameConstraintIP'] :
[static::class, 'decodeIP']; [static::class, 'decodeIP'];
$decoded = ASN1::decodeBER($value); $decoded = ASN1::decodeBER($value);
if (!$decoded) {
continue;
}
$mapped = ASN1::asn1map($decoded[0], $map, ['iPAddress' => $decoder]); $mapped = ASN1::asn1map($decoded[0], $map, ['iPAddress' => $decoder]);
$value = $mapped === false ? $decoded[0] : $mapped; $value = $mapped === false ? $decoded[0] : $mapped;
@ -607,6 +610,9 @@ class X509
$subvalue = &$value[$j]['policyQualifiers'][$k]['qualifier']; $subvalue = &$value[$j]['policyQualifiers'][$k]['qualifier'];
if ($map !== false) { if ($map !== false) {
$decoded = ASN1::decodeBER($subvalue); $decoded = ASN1::decodeBER($subvalue);
if (!$decoded) {
continue;
}
$mapped = ASN1::asn1map($decoded[0], $map); $mapped = ASN1::asn1map($decoded[0], $map);
$subvalue = $mapped === false ? $decoded[0] : $mapped; $subvalue = $mapped === false ? $decoded[0] : $mapped;
} }
@ -722,6 +728,9 @@ class X509
$value = ASN1::encodeDER($values[$j], Maps\AttributeValue::MAP); $value = ASN1::encodeDER($values[$j], Maps\AttributeValue::MAP);
$decoded = ASN1::decodeBER($value); $decoded = ASN1::decodeBER($value);
if (!is_bool($map)) { if (!is_bool($map)) {
if (!$decoded) {
continue;
}
$mapped = ASN1::asn1map($decoded[0], $map); $mapped = ASN1::asn1map($decoded[0], $map);
if ($mapped !== false) { if ($mapped !== false) {
$values[$j] = $mapped; $values[$j] = $mapped;
@ -771,6 +780,9 @@ class X509
if (!is_bool($map)) { if (!is_bool($map)) {
$temp = ASN1::encodeDER($values[$j], $map); $temp = ASN1::encodeDER($values[$j], $map);
$decoded = ASN1::decodeBER($temp); $decoded = ASN1::decodeBER($temp);
if (!$decoded) {
continue;
}
$values[$j] = ASN1::asn1map($decoded[0], Maps\AttributeValue::MAP); $values[$j] = ASN1::asn1map($decoded[0], Maps\AttributeValue::MAP);
} }
} }
@ -799,6 +811,9 @@ class X509
$map = $this->getMapping($type); $map = $this->getMapping($type);
if (!is_bool($map)) { if (!is_bool($map)) {
$decoded = ASN1::decodeBER($value); $decoded = ASN1::decodeBER($value);
if (!$decoded) {
continue;
}
$value = ASN1::asn1map($decoded[0], $map); $value = ASN1::asn1map($decoded[0], $map);
} }
} }
@ -1721,6 +1736,9 @@ class X509
$map = $this->getMapping($propName); $map = $this->getMapping($propName);
if (!is_bool($map)) { if (!is_bool($map)) {
$decoded = ASN1::decodeBER($v); $decoded = ASN1::decodeBER($v);
if (!$decoded) {
return false;
}
$v = ASN1::asn1map($decoded[0], $map); $v = ASN1::asn1map($decoded[0], $map);
} }
} }
@ -2182,7 +2200,7 @@ class X509
$decoded = ASN1::decodeBER($csr); $decoded = ASN1::decodeBER($csr);
if (empty($decoded)) { if (!$decoded) {
$this->currentCert = false; $this->currentCert = false;
return false; return false;
} }
@ -2295,7 +2313,7 @@ class X509
$decoded = ASN1::decodeBER($spkac); $decoded = ASN1::decodeBER($spkac);
if (empty($decoded)) { if (!$decoded) {
$this->currentCert = false; $this->currentCert = false;
return false; return false;
} }
@ -2393,7 +2411,7 @@ class X509
$decoded = ASN1::decodeBER($crl); $decoded = ASN1::decodeBER($crl);
if (empty($decoded)) { if (!$decoded) {
$this->currentCert = false; $this->currentCert = false;
return false; return false;
} }
@ -3610,7 +3628,7 @@ class X509
case $key instanceof Element: case $key instanceof Element:
// Assume the element is a bitstring-packed key. // Assume the element is a bitstring-packed key.
$decoded = ASN1::decodeBER($key->element); $decoded = ASN1::decodeBER($key->element);
if (empty($decoded)) { if (!$decoded) {
return false; return false;
} }
$raw = ASN1::asn1map($decoded[0], ['type' => ASN1::TYPE_BIT_STRING]); $raw = ASN1::asn1map($decoded[0], ['type' => ASN1::TYPE_BIT_STRING]);
@ -3669,6 +3687,9 @@ class X509
$publicKey = base64_decode(preg_replace('#-.+-|[\r\n]#', '', $this->publicKey->toString($format))); $publicKey = base64_decode(preg_replace('#-.+-|[\r\n]#', '', $this->publicKey->toString($format)));
$decoded = ASN1::decodeBER($publicKey); $decoded = ASN1::decodeBER($publicKey);
if (!$decoded) {
return false;
}
$mapped = ASN1::asn1map($decoded[0], Maps\SubjectPublicKeyInfo::MAP); $mapped = ASN1::asn1map($decoded[0], Maps\SubjectPublicKeyInfo::MAP);
if (!is_array($mapped)) { if (!is_array($mapped)) {
return false; return false;