crypto/pkcs12: add UTF8 support. (9e6b2f54) · Commits · CYBER - Cyber Security / TS 103 523 MSP / ETS / ETS OpenSSL

crypto/pkcs12/p12_key.c

+23 −0

Original line number	Diff line number	Diff line
		@@ -50,6 +50,29 @@ int PKCS12_key_gen_asc(const char pass, int passlen, unsigned char salt,
		return ret;
		}

		int PKCS12_key_gen_utf8(const char pass, int passlen, unsigned char salt,
		int saltlen, int id, int iter, int n,
		unsigned char out, const EVP_MD md_type)
		{
		int ret;
		unsigned char *unipass;
		int uniplen;

		if (!pass) {
		unipass = NULL;
		uniplen = 0;
		} else if (!OPENSSL_utf82uni(pass, passlen, &unipass, &uniplen)) {
		PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UTF8, ERR_R_MALLOC_FAILURE);
		return 0;
		}
		ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen,
		id, iter, n, out, md_type);
		if (ret <= 0)
		return 0;
		OPENSSL_clear_free(unipass, uniplen);
		return ret;
		}

		int PKCS12_key_gen_uni(unsigned char pass, int passlen, unsigned char salt,
		int saltlen, int id, int iter, int n,
		unsigned char out, const EVP_MD md_type)

crypto/pkcs12/p12_utl.c

+150 −1

Original line number	Diff line number	Diff line
		@@ -38,7 +38,7 @@ unsigned char OPENSSL_asc2uni(const char asc, int asclen,
		return unitmp;
		}

		char OPENSSL_uni2asc(unsigned char uni, int unilen)
		char OPENSSL_uni2asc(const unsigned char uni, int unilen)
		{
		int asclen, i;
		char *asctmp;
		@@ -58,6 +58,155 @@ char OPENSSL_uni2asc(unsigned char uni, int unilen)
		return asctmp;
		}

		/*
		* OPENSSL_{utf82uni\|uni2utf8} perform conversion between UTF-8 and
		* PKCS#12 BMPString format, which is specified as big-endian UTF-16.
		* One should keep in mind that even though BMPString is passed as
		* unsigned char *, it's not the kind of string you can exercise e.g.
		* strlen on. Caller also has to keep in mind that its length is
		* expressed not in number of UTF-16 characters, but in number of
		* bytes the string occupies, and treat it, the length, accordingly.
		*/
		unsigned char OPENSSL_utf82uni(const char asc, int asclen,
		unsigned char *uni, int unilen)
		{
		int ulen, i, j;
		unsigned char unitmp, ret;
		unsigned long utf32chr = 0;

		if (asclen == -1)
		asclen = strlen(asc);

		for (ulen = 0, i = 0; i < asclen; i += j) {
		j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);

		/*
		* Following condition is somewhat opportunistic is sense that
		* decoding failure is used as indirect indication that input
		* string might in fact be extended ASCII/ANSI/ISO-8859-X. The
		* fallback is taken in hope that it would allow to process
		* files created with previous OpenSSL version, which used the
		* naive OPENSSL_asc2uni all along. It might be worth noting
		* that probability of false positive depends on language. In
		* cases covered by ISO Latin 1 probability is very low, because
		* any printable non-ASCII alphabet letter followed by another
		* or any ASCII character will trigger failure and fallback.
		* In other cases situation can be intensified by the fact that
		* English letters are not part of alternative keyboard layout,
		* but even then there should be plenty of pairs that trigger
		* decoding failure...
		*/
		if (j < 0)
		return OPENSSL_asc2uni(asc, asclen, uni, unilen);

		if (utf32chr > 0x10FFFF) /* UTF-16 cap */
		return NULL;

		if (utf32chr >= 0x10000) /* pair of UTF-16 characters */
		ulen += 2*2;
		else /* or just one */
		ulen += 2;
		}

		ulen += 2; /* for trailing UTF16 zero */

		if ((ret = OPENSSL_malloc(ulen)) == NULL)
		return NULL;

		/* re-run the loop writing down UTF-16 characters in big-endian order */
		for (unitmp = ret, i = 0; i < asclen; i += j) {
		j = UTF8_getc((const unsigned char *)asc+i, asclen-i, &utf32chr);
		if (utf32chr >= 0x10000) { /* pair if UTF-16 characters */
		unsigned int hi, lo;

		utf32chr -= 0x10000;
		hi = 0xD800 + (utf32chr>>10);
		lo = 0xDC00 + (utf32chr&0x3ff);
		*unitmp++ = (unsigned char)(hi>>8);
		*unitmp++ = (unsigned char)(hi);
		*unitmp++ = (unsigned char)(lo>>8);
		*unitmp++ = (unsigned char)(lo);
		} else { /* or just one */
		*unitmp++ = (unsigned char)(utf32chr>>8);
		*unitmp++ = (unsigned char)(utf32chr);
		}
		}
		/* Make result double null terminated */
		*unitmp++ = 0;
		*unitmp++ = 0;
		if (unilen)
		*unilen = ulen;
		if (uni)
		*uni = ret;
		return ret;
		}

		static int bmp_to_utf8(char str, const unsigned char utf16, int len)
		{
		unsigned long utf32chr;

		if (len == 0) return 0;

		if (len < 2) return -1;

		/* pull UTF-16 character in big-endian order */
		utf32chr = (utf16[0]<<8) \| utf16[1];

		if (utf32chr >= 0xD800 && utf32chr < 0xE000) { /* two chars */
		unsigned int lo;

		if (len < 4) return -1;

		utf32chr -= 0xD800;
		utf32chr <<= 10;
		lo = (utf16[2]<<8) \| utf16[3];
		if (lo < 0xDC00 \|\| lo >= 0xE000) return -1;
		utf32chr \|= lo-0xDC00;
		utf32chr += 0x10000;
		}

		return UTF8_putc((unsigned char *)str, len > 4 ? 4 : len, utf32chr);
		}

		char OPENSSL_uni2utf8(const unsigned char uni, int unilen)
		{
		int asclen, i, j;
		char *asctmp;

		for (asclen = 0, i = 0; i < unilen; ) {
		j = bmp_to_utf8(NULL, uni+i, unilen-i);
		/*
		* falling back to OPENSSL_uni2asc makes lesser sense, it's
		* done rather to maintain symmetry...
		*/
		if (j < 0) return OPENSSL_uni2asc(uni, unilen);
		if (j == 4) i += 4;
		else i += 2;
		asclen += j;
		}

		/* If no terminating zero allow for one */
		if (!unilen \|\| (uni[unilen-2]\|\|uni[unilen - 1]))
		asclen++;

		if ((asctmp = OPENSSL_malloc(asclen)) == NULL)
		return NULL;

		/* re-run the loop emitting UTF-8 string */
		for (asclen = 0, i = 0; i < unilen; ) {
		j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
		if (j == 4) i += 4;
		else i += 2;
		asclen += j;
		}

		/* If no terminating zero write one */
		if (!unilen \|\| (uni[unilen-2]\|\|uni[unilen - 1]))
		asctmp[asclen] = '\0';

		return asctmp;
		}

		int i2d_PKCS12_bio(BIO bp, PKCS12 p12)
		{
		return ASN1_item_i2d_bio(ASN1_ITEM_rptr(PKCS12), bp, p12);

crypto/pkcs12/pk12err.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -27,6 +27,7 @@ static ERR_STRING_DATA PKCS12_str_functs[] = {
		{ERR_FUNC(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG), "PKCS12_item_pack_safebag"},
		{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_ASC), "PKCS12_key_gen_asc"},
		{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UNI), "PKCS12_key_gen_uni"},
		{ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UTF8), "PKCS12_key_gen_utf8"},
		{ERR_FUNC(PKCS12_F_PKCS12_NEWPASS), "PKCS12_newpass"},
		{ERR_FUNC(PKCS12_F_PKCS12_PACK_P7DATA), "PKCS12_pack_p7data"},
		{ERR_FUNC(PKCS12_F_PKCS12_PACK_P7ENCDATA), "PKCS12_pack_p7encdata"},

include/openssl/pkcs12.h

+8 −1

Original line number	Diff line number	Diff line
		@@ -170,6 +170,9 @@ int PKCS12_key_gen_asc(const char pass, int passlen, unsigned char salt,
		int PKCS12_key_gen_uni(unsigned char pass, int passlen, unsigned char salt,
		int saltlen, int id, int iter, int n,
		unsigned char out, const EVP_MD md_type);
		int PKCS12_key_gen_utf8(const char pass, int passlen, unsigned char salt,
		int saltlen, int id, int iter, int n,
		unsigned char out, const EVP_MD md_type);
		int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX ctx, const char pass, int passlen,
		ASN1_TYPE param, const EVP_CIPHER cipher,
		const EVP_MD *md_type, int en_de);
		@@ -183,7 +186,10 @@ int PKCS12_setup_mac(PKCS12 p12, int iter, unsigned char salt,
		int saltlen, const EVP_MD *md_type);
		unsigned char OPENSSL_asc2uni(const char asc, int asclen,
		unsigned char *uni, int unilen);
		char OPENSSL_uni2asc(unsigned char uni, int unilen);
		char OPENSSL_uni2asc(const unsigned char uni, int unilen);
		unsigned char OPENSSL_utf82uni(const char asc, int asclen,
		unsigned char *uni, int unilen);
		char OPENSSL_uni2utf8(const unsigned char uni, int unilen);

		DECLARE_ASN1_FUNCTIONS(PKCS12)
		DECLARE_ASN1_FUNCTIONS(PKCS12_MAC_DATA)
		@@ -237,6 +243,7 @@ int ERR_load_PKCS12_strings(void);
		# define PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG 117
		# define PKCS12_F_PKCS12_KEY_GEN_ASC 110
		# define PKCS12_F_PKCS12_KEY_GEN_UNI 111
		# define PKCS12_F_PKCS12_KEY_GEN_UTF8 116
		# define PKCS12_F_PKCS12_NEWPASS 128
		# define PKCS12_F_PKCS12_PACK_P7DATA 114
		# define PKCS12_F_PKCS12_PACK_P7ENCDATA 115

util/libcrypto.num

+4 −0

Original line number	Diff line number	Diff line
		@@ -4199,3 +4199,7 @@ X509_get0_notBefore 4145 1_1_0 EXIST::FUNCTION:
		X509_get0_notAfter 4146 1_1_0 EXIST::FUNCTION:
		X509_CRL_get0_nextUpdate 4147 1_1_0 EXIST::FUNCTION:
		BIO_get_new_index 4148 1_1_0 EXIST::FUNCTION:
		OPENSSL_utf82uni 4149 1_1_0 EXIST::FUNCTION:
		PKCS12_add_friendlyname_utf8 4150 1_1_0 EXIST::FUNCTION:
		OPENSSL_uni2utf8 4151 1_1_0 EXIST::FUNCTION:
		PKCS12_key_gen_utf8 4152 1_1_0 EXIST::FUNCTION: