fix(core): harden wire validation and queues

core/src/wire.rs

@@ -18,6 +18,42 @@ fn bounded(value: &str, minimum: usize, maximum: usize) -> bool {
     (minimum..=maximum).contains(&value.len())
 }
 
+fn contains_private_key_pem(value: &str) -> bool {
+    value.lines().any(|line| {
+        let line = line.trim();
+        line.starts_with("-----BEGIN ") && line.ends_with("-----") && line.contains("PRIVATE KEY")
+    })
+}
+
+const fn base64url_value(value: u8) -> Option<u8> {
+    match value {
+        b'A'..=b'Z' => Some(value - b'A'),
+        b'a'..=b'z' => Some(value - b'a' + 26),
+        b'0'..=b'9' => Some(value - b'0' + 52),
+        b'-' => Some(62),
+        b'_' => Some(63),
+        _ => None,
+    }
+}
+
+fn raw_base64url_decoded_len(value: &str) -> Option<usize> {
+    let bytes = value.as_bytes();
+    if bytes.is_empty() || bytes.iter().any(|byte| base64url_value(*byte).is_none()) {
+        return None;
+    }
+    let remainder_bytes = match bytes.len() % 4 {
+        0 => 0,
+        2 if base64url_value(*bytes.last()?)?.trailing_zeros() >= 4 => 1,
+        3 if base64url_value(*bytes.last()?)?.trailing_zeros() >= 2 => 2,
+        _ => return None,
+    };
+    bytes
+        .len()
+        .checked_div(4)?
+        .checked_mul(3)?
+        .checked_add(remainder_bytes)
+}
+
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
 struct Timestamp {
     year: u16,
@@ -359,6 +395,8 @@ impl NativeTunnelCredential {
             || !bounded(&credential.device_key_id, 1, 128)
             || !bounded(&credential.certificate_chain_pem, 1, 65_536)
             || !bounded(&credential.trust_bundle_pem, 1, 65_536)
+            || contains_private_key_pem(&credential.certificate_chain_pem)
+            || contains_private_key_pem(&credential.trust_bundle_pem)
             || timestamp(&credential.expires_at, false).is_none()
         {
             return Err(CoreError::InvalidArgument);
@@ -409,6 +447,11 @@ impl TunnelAdmissionRequest {
             || !bounded(&request.grant, 43, 256)
             || !bounded(&request.client_nonce, 16, 128)
             || request.device_signature.len() != 86
+            || !matches!(
+                raw_base64url_decoded_len(&request.client_nonce),
+                Some(12..=96)
+            )
+            || raw_base64url_decoded_len(&request.device_signature) != Some(64)
         {
             return Err(CoreError::InvalidArgument);
         }