/*
- * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
- * 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
+ * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
*
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/pkcs12.h>
-#include "p12_lcl.h"
/* Cheap and nasty Unicode stuff */
return unitmp;
}
-char *OPENSSL_uni2asc(unsigned char *uni, int unilen)
+char *OPENSSL_uni2asc(const unsigned char *uni, int unilen)
{
int asclen, i;
char *asctmp;
-
+ /* string must contain an even number of bytes */
+ if (unilen & 1)
+ return NULL;
asclen = unilen / 2;
/* If no terminating zero allow for one */
if (!unilen || uni[unilen - 1])
return asctmp;
}
-int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12)
+/*
+ * OPENSSL_{utf82uni|uni2utf8} perform conversion between UTF-8 and
+ * PKCS#12 BMPString format, which is specified as big-endian UTF-16.
+ * One should keep in mind that even though BMPString is passed as
+ * unsigned char *, it's not the kind of string you can exercise e.g.
+ * strlen on. Caller also has to keep in mind that its length is
+ * expressed not in number of UTF-16 characters, but in number of
+ * bytes the string occupies, and treat it, the length, accordingly.
+ */
+unsigned char *OPENSSL_utf82uni(const char *asc, int asclen,
+ unsigned char **uni, int *unilen)
{
- return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS12), bp, p12);
-}
+ int ulen, i, j;
+ unsigned char *unitmp, *ret;
+ unsigned long utf32chr = 0;
-#ifndef OPENSSL_NO_STDIO
-int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12)
-{
- return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS12), fp, p12);
-}
-#endif
+ if (asclen == -1)
+ asclen = strlen(asc);
-PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12)
-{
- return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS12), bp, p12);
-}
+ for (ulen = 0, i = 0; i < asclen; i += j) {
+ j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
+
+ /*
+ * Following condition is somewhat opportunistic is sense that
+ * decoding failure is used as *indirect* indication that input
+ * string might in fact be extended ASCII/ANSI/ISO-8859-X. The
+ * fallback is taken in hope that it would allow to process
+ * files created with previous OpenSSL version, which used the
+ * naive OPENSSL_asc2uni all along. It might be worth noting
+ * that probability of false positive depends on language. In
+ * cases covered by ISO Latin 1 probability is very low, because
+ * any printable non-ASCII alphabet letter followed by another
+ * or any ASCII character will trigger failure and fallback.
+ * In other cases situation can be intensified by the fact that
+ * English letters are not part of alternative keyboard layout,
+ * but even then there should be plenty of pairs that trigger
+ * decoding failure...
+ */
+ if (j < 0)
+ return OPENSSL_asc2uni(asc, asclen, uni, unilen);
+
+ if (utf32chr > 0x10FFFF) /* UTF-16 cap */
+ return NULL;
+
+ if (utf32chr >= 0x10000) /* pair of UTF-16 characters */
+ ulen += 2*2;
+ else /* or just one */
+ ulen += 2;
+ }
-#ifndef OPENSSL_NO_STDIO
-PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12)
-{
- return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS12), fp, p12);
-}
-#endif
+ ulen += 2; /* for trailing UTF16 zero */
-PKCS12_SAFEBAG *PKCS12_SAFEBAG_new_cert(X509 *x509)
-{
- return PKCS12_item_pack_safebag(x509, ASN1_ITEM_rptr(X509),
- NID_x509Certificate, NID_certBag);
-}
+ if ((ret = OPENSSL_malloc(ulen)) == NULL)
+ return NULL;
-PKCS12_SAFEBAG *PKCS12_SAFEBAG_new_crl(X509_CRL *crl)
-{
- return PKCS12_item_pack_safebag(crl, ASN1_ITEM_rptr(X509_CRL),
- NID_x509Crl, NID_crlBag);
+ /* re-run the loop writing down UTF-16 characters in big-endian order */
+ for (unitmp = ret, i = 0; i < asclen; i += j) {
+ j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
+ if (utf32chr >= 0x10000) { /* pair if UTF-16 characters */
+ unsigned int hi, lo;
+
+ utf32chr -= 0x10000;
+ hi = 0xD800 + (utf32chr>>10);
+ lo = 0xDC00 + (utf32chr&0x3ff);
+ *unitmp++ = (unsigned char)(hi>>8);
+ *unitmp++ = (unsigned char)(hi);
+ *unitmp++ = (unsigned char)(lo>>8);
+ *unitmp++ = (unsigned char)(lo);
+ } else { /* or just one */
+ *unitmp++ = (unsigned char)(utf32chr>>8);
+ *unitmp++ = (unsigned char)(utf32chr);
+ }
+ }
+ /* Make result double null terminated */
+ *unitmp++ = 0;
+ *unitmp++ = 0;
+ if (unilen)
+ *unilen = ulen;
+ if (uni)
+ *uni = ret;
+ return ret;
}
-X509 *PKCS12_SAFEBAG_get1_cert(PKCS12_SAFEBAG *bag)
+static int bmp_to_utf8(char *str, const unsigned char *utf16, int len)
{
- if (PKCS12_SAFEBAG_get_nid(bag) != NID_certBag)
- return NULL;
- if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Certificate)
- return NULL;
- return ASN1_item_unpack(bag->value.bag->value.octet,
- ASN1_ITEM_rptr(X509));
-}
+ unsigned long utf32chr;
-X509_CRL *PKCS12_SAFEBAG_get1_crl(PKCS12_SAFEBAG *bag)
-{
- if (PKCS12_SAFEBAG_get_nid(bag) != NID_crlBag)
- return NULL;
- if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Crl)
- return NULL;
- return ASN1_item_unpack(bag->value.bag->value.octet,
- ASN1_ITEM_rptr(X509_CRL));
-}
+ if (len == 0) return 0;
-ASN1_TYPE *PKCS12_SAFEBAG_get0_attr(PKCS12_SAFEBAG *bag, int attr_nid)
-{
- return PKCS12_get_attr_gen(bag->attrib, attr_nid);
-}
+ if (len < 2) return -1;
-ASN1_TYPE *PKCS8_get_attr(PKCS8_PRIV_KEY_INFO *p8, int attr_nid)
-{
- return PKCS12_get_attr_gen(p8->attributes, attr_nid);
-}
+ /* pull UTF-16 character in big-endian order */
+ utf32chr = (utf16[0]<<8) | utf16[1];
-int PKCS12_mac_present(PKCS12 *p12)
-{
-return p12->mac ? 1 : 0;
-}
+ if (utf32chr >= 0xD800 && utf32chr < 0xE000) { /* two chars */
+ unsigned int lo;
-void PKCS12_get0_mac(ASN1_OCTET_STRING **pmac, X509_ALGOR **pmacalg,
- ASN1_OCTET_STRING **psalt, ASN1_INTEGER **piter,
- PKCS12 *p12)
-{
- if (p12->mac) {
- if (pmac)
- *pmac = p12->mac->dinfo->digest;
- if (pmacalg)
- *pmacalg = p12->mac->dinfo->algor;
- if (psalt)
- *psalt = p12->mac->salt;
- if (piter)
- *piter = p12->mac->iter;
- } else {
- if (pmac)
- *pmac = NULL;
- if (pmacalg)
- *pmacalg = NULL;
- if (psalt)
- *psalt = NULL;
- if (piter)
- *piter = NULL;
+ if (len < 4) return -1;
+
+ utf32chr -= 0xD800;
+ utf32chr <<= 10;
+ lo = (utf16[2]<<8) | utf16[3];
+ if (lo < 0xDC00 || lo >= 0xE000) return -1;
+ utf32chr |= lo-0xDC00;
+ utf32chr += 0x10000;
}
+
+ return UTF8_putc((unsigned char *)str, len > 4 ? 4 : len, utf32chr);
}
-PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(PKCS12_SAFEBAG *bag)
+char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
{
- if (PKCS12_SAFEBAG_get_nid(bag) != NID_keyBag)
+ int asclen, i, j;
+ char *asctmp;
+
+ /* string must contain an even number of bytes */
+ if (unilen & 1)
return NULL;
- return bag->value.keybag;
-}
-X509_SIG *PKCS12_SAFEBAG_get0_pkcs8(PKCS12_SAFEBAG *bag)
-{
- if (OBJ_obj2nid(bag->type) != NID_pkcs8ShroudedKeyBag)
+ for (asclen = 0, i = 0; i < unilen; ) {
+ j = bmp_to_utf8(NULL, uni+i, unilen-i);
+ /*
+ * falling back to OPENSSL_uni2asc makes lesser sense [than
+ * falling back to OPENSSL_asc2uni in OPENSSL_utf82uni above],
+ * it's done rather to maintain symmetry...
+ */
+ if (j < 0) return OPENSSL_uni2asc(uni, unilen);
+ if (j == 4) i += 4;
+ else i += 2;
+ asclen += j;
+ }
+
+ /* If no terminating zero allow for one */
+ if (!unilen || (uni[unilen-2]||uni[unilen - 1]))
+ asclen++;
+
+ if ((asctmp = OPENSSL_malloc(asclen)) == NULL)
return NULL;
- return bag->value.shkeybag;
+
+ /* re-run the loop emitting UTF-8 string */
+ for (asclen = 0, i = 0; i < unilen; ) {
+ j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
+ if (j == 4) i += 4;
+ else i += 2;
+ asclen += j;
+ }
+
+ /* If no terminating zero write one */
+ if (!unilen || (uni[unilen-2]||uni[unilen - 1]))
+ asctmp[asclen] = '\0';
+
+ return asctmp;
}
-STACK_OF(PKCS12_SAFEBAG) *PKCS12_SAFEBAG_get0_safes(PKCS12_SAFEBAG *bag)
+int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12)
{
- if (OBJ_obj2nid(bag->type) != NID_safeContentsBag)
- return NULL;
- return bag->value.safes;
+ return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS12), bp, p12);
}
-ASN1_OBJECT *PKCS12_SAFEBAG_get0_type(PKCS12_SAFEBAG *bag)
+#ifndef OPENSSL_NO_STDIO
+int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12)
{
- return bag->type;
+ return ASN1_item_i2d_fp(ASN1_ITEM_rptr(PKCS12), fp, p12);
}
+#endif
-int PKCS12_SAFEBAG_get_nid(PKCS12_SAFEBAG *bag)
+PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12)
{
- return OBJ_obj2nid(bag->type);
+ return ASN1_item_d2i_bio(ASN1_ITEM_rptr(PKCS12), bp, p12);
}
-int PKCS12_SAFEBAG_get_bag_nid(PKCS12_SAFEBAG *bag)
+#ifndef OPENSSL_NO_STDIO
+PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12)
{
- int btype = PKCS12_SAFEBAG_get_nid(bag);
- if (btype != NID_certBag || btype != NID_crlBag || btype != NID_secretBag)
- return -1;
- return OBJ_obj2nid(bag->value.bag->type);
+ return ASN1_item_d2i_fp(ASN1_ITEM_rptr(PKCS12), fp, p12);
}
+#endif