fullsailor / pkcs7

Implements a subset of PKCS#7/Crytpographic Message Syntax (rfc2315, rfc5652)
MIT License
123 stars 201 forks source link

parseEnvelopeData does not set EncryptedContent correctly on go 1.10 #31

Closed pranavraja closed 6 years ago

pranavraja commented 6 years ago

Hi,

I've noticed that encrypted data created by hiera-eyaml does not parse correctly with this package with Go 1.10, possibly related to the changes in the struct tags (see https://golang.org/doc/go1.10)

Unmarshal now respects struct field tags using the explicit and tag directives.

I'm not too sure of the inner details of the asn1 format, but I've noticed that removing the struct tag altogether fixes the issue (see https://github.com/pranavraja/pkcs7/commit/c9366af5178a021b618ca891de32ca294c677dc8), and the package tests still pass.

Here is the format of the envelope i'm trying to parse (the output of openssl asn1parse -in encrypteddata -inform DER) in case it helps

    0:d=0  hl=4 l= 393 cons: SEQUENCE
    4:d=1  hl=2 l=   9 prim: OBJECT            :pkcs7-envelopedData
   15:d=1  hl=4 l= 378 cons: cont [ 0 ]
   19:d=2  hl=4 l= 374 cons: SEQUENCE
   23:d=3  hl=2 l=   1 prim: INTEGER           :00
   26:d=3  hl=4 l= 289 cons: SET
   30:d=4  hl=4 l= 285 cons: SEQUENCE
   34:d=5  hl=2 l=   1 prim: INTEGER           :00
   37:d=5  hl=2 l=   5 cons: SEQUENCE
   39:d=6  hl=2 l=   0 cons: SEQUENCE
   41:d=6  hl=2 l=   1 prim: INTEGER           :01
   44:d=5  hl=2 l=  13 cons: SEQUENCE
   46:d=6  hl=2 l=   9 prim: OBJECT            :rsaEncryption
   57:d=6  hl=2 l=   0 prim: NULL
   59:d=5  hl=4 l= 256 prim: OCTET STRING      [HEX DUMP]:...
  319:d=3  hl=2 l=  76 cons: SEQUENCE
  321:d=4  hl=2 l=   9 prim: OBJECT            :pkcs7-data
  332:d=4  hl=2 l=  29 cons: SEQUENCE
  334:d=5  hl=2 l=   9 prim: OBJECT            :aes-256-cbc
  345:d=5  hl=2 l=  16 prim: OCTET STRING      [HEX DUMP]:...
  363:d=4  hl=2 l=  32 prim: cont [ 0 ]
fullsailor commented 6 years ago

Nice catch. I checked the spec and it indeed is supposed to be IMPLICIT, not EXPLICIT. https://tools.ietf.org/html/rfc2315#section-10.1

I'm working on a test & patch now.