File Coverage

blib/lib/Convert/PEM.pm

Criterion	Covered	Total	%
statement	325	347	93.6
branch	87	136	63.9
condition	22	45	48.8
subroutine	69	74	93.2
pod	17	24	70.8
total	520	626	83.0

package Convert::PEM;
use strict;
use 5.008_001;

use base qw( Class::ErrorHandler );

use MIME::Base64;
use Digest::MD5 qw( md5 );
use Convert::ASN1;
use Carp qw( croak );
use Convert::PEM::CBC;
use Crypt::PRNG qw( random_bytes );


use vars qw( $VERSION $DefaultCipher );
our $VERSION = '0.13'; # VERSION

our $DefaultCipher = 'DES-EDE3-CBC';

sub new {
    my $class = shift;
    my $pem = bless { }, $class;
    $pem->init(@_);
}

sub init {
    my $pem = shift;
    my %param = @_;
    unless (exists $param{Name}) {
        return (ref $pem)->error("init: Name is required");
    }
    else {
        $pem->{Name} = $param{Name};
        $pem->{ASN} = $param{ASN} if exists $param{ASN};
        $pem->{Cipher} = $param{Cipher} if exists $param{Cipher};
    }

    if (exists $pem->{ASN}) {
        $pem->{Macro} = $param{Macro};
        my $asn = $pem->{_asn} = Convert::ASN1->new;
        $asn->prepare( $pem->{ASN} ) or
            return (ref $pem)->error("ASN prepare failed: $asn->{error}");
    }

    $pem->_getform(%param) or return;
    $pem;
}

sub _getform {
    my $pem = shift;
    my %param = @_;

    my $in = defined $param{InForm} ? uc($param{InForm}) : 'PEM';
    $in =~ m/^(PEM|DER)$/ or return $pem->error("Invalid InForm '$in': must be PEM or DER");
    $pem->{InForm} = $in;

    my $out = defined $param{OutForm} ? uc($param{OutForm}) : 'PEM';
    $out =~ m/^(PEM|DER)$/ or return $pem->error("Invalid OutForm '$out': must be PEM or DER");
    $pem->{OutForm} = $out;
    $pem;
}

sub asn {
    my $pem = shift;
    my $asn = $pem->{_asn} || return;
    my %prm = @_;
    my $m = $prm{Macro} || $pem->{Macro};
    $m ? $asn->find($m) : $asn;
}

sub ASN     { $_[0]->{ASN}     }
sub name    { $_[0]->{Name}    }
sub cipher  { $_[0]->{Cipher}  }
sub inform  { $_[0]->{InForm}  }
sub outform { $_[0]->{OutForm} }
sub macro   { $_[0]->{Macro}   }

sub read {
    my $pem = shift;
    my %param = @_;

    my $blob;
    my $fname = delete $param{Filename};
    open my $FH, $fname or
        return $pem->error("Can't open $fname: $!");
    binmode $FH;
    read($FH, $blob, -s $fname);
    close $FH;

    $pem->{InForm} eq 'DER'
        ? $pem->from_der( DER => $blob )
        : $pem->decode(%param, Content => $blob);
}

sub write {
    my $pem = shift;
    my %param = @_;

    my $fname = delete $param{Filename} or
        return $pem->error("write: Filename is required");

    my $blob = $pem->{OutForm} eq 'DER'
        ? $pem->to_der(%param)
        : $pem->encode(%param);

    open my $FH, ">$fname" or
        return $pem->error("Can't open $fname: $!");
    binmode $FH;
    print $FH $blob;
    close $FH;
    $blob;
}

sub from_der {
    my $pem = shift;
    my %param = @_;

    # should always be unencrypted at this point
    my $obj;
    if (exists $pem->{ASN}) {
        my $asn = $pem->asn;
        if (my $macro = ($param{Macro} || $pem->{Macro})) {
            $asn = $asn->find($macro) or
                return $pem->error("Can't find Macro $macro");
        }
        $obj = $asn->decode( $param{DER} ) or
            return $pem->error("ASN encode failed: $asn->{error}");
    }
    else {
        $obj = $param{DER};
    }
    $obj;
}

sub decode {
    my $pem = shift;
    my %param = @_;
    if (exists $param{DER}) { return $pem->from_der(%param) }
    my $blob = $param{Content} or
        return $pem->error("'Content' is required");
    chomp $blob;

    my $dec = $pem->explode($blob) or return;
    my $name = $param{Name} || $pem->name;
    return $pem->error("Object $dec->{Object} does not match " . $name)
        unless $dec->{Object} eq $name;

    my $head = $dec->{Headers};
    my $buf = $dec->{Content};
    my %headers = map { $_->[0] => $_->[1] } @$head;
    if (%headers && $headers{'Proc-Type'} eq '4,ENCRYPTED') {
        $buf = $pem->decrypt( Ciphertext => $buf,
                              Info       => $headers{'DEK-Info'},
                              Password   => $param{Password} )
            or return;
    }
    $param{DER} = $buf;
    my $obj = $pem->from_der( %param )
        or return;

    $obj;
}

sub to_der {
    my $pem = shift;
    my %param = @_;

    my $buf;
    if (exists $pem->{ASN}) {
        my $asn = $pem->asn;
        if (my $macro = ($param{Macro} || $pem->{Macro})) {
            $asn = $asn->find($macro) or
                return $pem->error("Can't find Macro $macro");
        }
        $buf = $asn->encode( $param{Content} ) or
            return $pem->error("ASN encode failed: $asn->{error}");
    }
    else {
        $buf = $param{Content}
    }
    $buf;
}

sub encode {
    my $pem = shift;
    my %param = @_;

    my $buf = $param{DER} || $pem->to_der(%param);
    my (@headers);
    if ($param{Password}) {
        my ($info);
        ($buf, $info) = $pem->encrypt( Plaintext => $buf,
                                       %param )
            or return;
        push @headers, [ 'Proc-Type' => '4,ENCRYPTED' ];
        push @headers, [ 'DEK-Info'  => $info ];
    }

    $pem->implode( Object  => $param{Name} || $pem->name,
                   Headers => \@headers,
                   Content => $buf );
}

sub explode {
    my $pem = shift;
    my ($message) = @_;

    # Canonicalize line endings into "\n".
    $message =~ s/\r\n|\n|\r/\n/g;

    my ($head, $object, $headers, $content, $tail) = $message =~
        m:(-----BEGIN ([^\n\-]+)-----)\n(.*?\n\n)?(.+)(-----END .*?-----)$:s;
    my $buf = decode_base64($content);

    my @headers;
    if ($headers) {
        for my $h ( split /\n/, $headers ) {
            my ($k, $v) = split /:\s*/, $h, 2;
            push @headers, [ $k => $v ] if $k;
        }
    }

    { Content => $buf,
      Object  => $object,
      Headers => \@headers }
}

sub implode {
    my $pem = shift;
    my %param = @_;
    my $head = "-----BEGIN $param{Object}-----";
    my $tail = "-----END $param{Object}-----";
    my $content = encode_base64( $param{Content}, '' );
    $content =~ s!(.{1,64})!$1\n!g;
    my $headers = join '',
                  map { "$_->[0]: $_->[1]\n" }
                  @{ $param{Headers} };
    $headers .= "\n" if $headers;
    "$head\n$headers$content$tail\n";
}

use vars qw( %CTYPES );
%CTYPES = (
    'DES-CBC'           =>    {c => 'Crypt::DES',         ks=>8,  bs=>8,  },
    'DES-EDE3-CBC'      =>    {c => 'Crypt::DES_EDE3',    ks=>24, bs=>8,  },
    'AES-128-CBC'       =>    {c => 'Crypt::Rijndael',    ks=>16, bs=>16, },
    'AES-192-CBC'       =>    {c => 'Crypt::Rijndael',    ks=>24, bs=>16, },
    'AES-256-CBC'       =>    {c => 'Crypt::Rijndael',    ks=>32, bs=>16, },
    'CAMELLIA-128-CBC'  =>    {c => 'Crypt::Camellia',    ks=>16, bs=>16, },
    'CAMELLIA-192-CBC'  =>    {c => 'Crypt::Camellia',    ks=>24, bs=>16, },
    'CAMELLIA-256-CBC'  =>    {c => 'Crypt::Camellia',    ks=>32, bs=>16, },
    'IDEA-CBC'          =>    {c => 'Crypt::IDEA',        ks=>16, bs=>8,  },
    'SEED-CBC'          =>    {c => 'Crypt::SEED',        ks=>16, bs=>16, },
);

#### cipher module support and configuration
sub list_ciphers { return wantarray ? sort keys %CTYPES : join(':', sort keys %CTYPES); }

sub list_cipher_modules {
    # expect a cipher name, if found, return the module name used for encryption/decryption
    my $pem = ref($_[0]) || $_[0] eq __PACKAGE__ ? shift : '';
    if (defined $_[0]) {
        my $cn = has_cipher(shift) || return undef;
        return $CTYPES{$cn}->{c};
    }
    return wantarray
        ? map { $CTYPES{$_}->{c} } sort keys %CTYPES
        : join(':', map { $CTYPES{$_}->{c} } sort keys %CTYPES);
}

sub has_cipher {
    # expect a cipher name, return the cipher name if found
    my $pem = ref($_[0]) || $_[0] eq __PACKAGE__ ? shift : '';
    my $cn = uc(+shift);
    return $cn if exists $CTYPES{$cn} && exists $CTYPES{$cn}->{c};
    # try to figure out what cipher is meant in an overkill fashion
    $cn =~ s/(DES.*3|3DES|EDE)|(DES)|([a-zA-Z]+)(?:-?(\d+)(?:-?(\w+))?)/
        if ($1) {
            'DES-EDE3-CBC'
        } elsif ($2) {
            'DES-CBC'
        }
        else {
            $3.($4 ? "-".$4 : "").($5 ? "-$5" : "")
        }
    /e;
    my @c = sort grep { $_ =~ m/$cn/ } keys %CTYPES;
    # return undef unless @c;
    $c[0];
}

sub has_cipher_module
{
    my $pem = ref($_[0]) || $_[0] eq __PACKAGE__ ? shift : '';
    if (my $cn = has_cipher($_[0])) {
        eval "use $CTYPES{$cn}->{c};";
        if ($@) { undef $@; return undef; }
        return $CTYPES{$cn}->{c};
    }
}

sub set_cipher_module
{
    my $pem = ref($_[0]) || $_[0] eq __PACKAGE__ ? shift : '';
    # cipher name, cipher module name, replace all
    my ($cn,$cm,$all) = @_;
    $all = 1 unless defined $all;
    # when setting ciphers, must use exact name
    if (exists $CTYPES{$cn}) {
        eval "use $cm ;";
        if ($@) { undef $@; return undef; }
        if ($all && exists $CTYPES{$cn}->{c}) {
            my $old_cm = $CTYPES{$cn}->{c};
            foreach my $def (values %CTYPES) {
                $def->{c} = $cm if $def->{c} eq $old_cm;
            }
        }
        else {
            $CTYPES{$cn}->{c} = $cm;
        }
        return $cm;
    }
    return undef;
}

#### cipher functions
sub decrypt {
    my $pem = shift;
    my %param = @_;
    my $passphrase = $param{Password} || "";
    my ($ctype, $iv) = split /,/, $param{Info};
    my $cmod = $CTYPES{$ctype} or
        return $pem->error("Unrecognized cipher: '$ctype'");
    $iv = pack "H*", $iv;
    eval "use $cmod->{c}; 1;" || croak "Failed loading cipher module '$cmod->{c}'";
    my $key = Convert::PEM::CBC::bytes_to_key($passphrase,$iv,\&md5,$cmod->{ks});
    my $cm = $cmod->{c}; $cm =~ s/^Crypt::(?=IDEA$)//; # fix IDEA
    my $cbc = Convert::PEM::CBC->new(
                   Cipher     => $cm->new($key),
                   IV         => $iv );
    my $buf = $cbc->decrypt($param{Ciphertext}) or
        return $pem->error("Decryption failed: " . $cbc->errstr);
    $buf;
}

sub encrypt {
    my $pem = shift;
    my %param = @_;
    $param{Password} or return $param{Plaintext};

    $param{Cipher} = $DefaultCipher if !$param{Cipher};
    my $ctype = $pem->has_cipher( $param{Cipher} );
    my $cmod = $CTYPES{$ctype} or
        return $pem->error("Unrecognized cipher: '$ctype'");
    eval "use $cmod->{c}; 1;" || croak "Error loading cypher module '$cmod->{c}'";

    ## allow custom IV for encryption
    my $iv = $pem->_getiv(%param, bs => $cmod->{bs}) or return;
    my $key = Convert::PEM::CBC::bytes_to_key( $param{Password}, $iv, \&md5, $cmod->{ks} );
    my $cm = $cmod->{c}; $cm =~ s/^Crypt::(?=IDEA$)//; # fix IDEA
    my $cbc = Convert::PEM::CBC->new(
                    IV            =>    $iv,
                    Cipher        =>    $cm->new($key) );
    $iv = uc join '', unpack "H*", $cbc->iv;
    my $buf = $cbc->encrypt($param{Plaintext}) or
        return $pem->error("Encryption failed: " . $cbc->errstr);
    ($buf, "$ctype,$iv");
}

sub _getiv {
    my $pem = shift;
    my %p = @_;

    my $iv;
    if (exists $p{IV}) {
        if ($p{IV} =~ m/^[a-fA-F\d]+$/) {
            $iv = pack("H*",$p{IV});
            return length($iv) == $p{bs}
                ? $iv
                : $pem->error("Provided IV length is invalid");
        }
        else {
            return $pem->error("Provided IV must be in hex format");
        }
    }
    $iv = random_bytes($p{bs});
    croak "Internal error: unexpected IV length" if length($iv) != $p{bs};
    $iv;
}

1;
__END__