]> git.ipfire.org Git - thirdparty/openssl.git/blame - apps/pkcs12.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Process digest option after loading providers
[thirdparty/openssl.git] / apps / pkcs12.c
CommitLineData
0f113f3e 1/*
33388b44 2 * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
ee0508d4 3 *
dffa7520 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
846e33c7
RS		 5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
ee0508d4
DSH		 8 */
9
6e04afb8 10#include <openssl/opensslconf.h>
6e04afb8 11
1ae56f2f
RS		 12#include <stdio.h>
13#include <stdlib.h>
14#include <string.h>
15#include "apps.h"
16#include "progs.h"
17#include <openssl/crypto.h>
18#include <openssl/err.h>
19#include <openssl/pem.h>
20#include <openssl/pkcs12.h>
15c9aa3a 21#include <openssl/provider.h>
1ae56f2f
RS		 22
23#define NOKEYS 0x1
24#define NOCERTS 0x2
25#define INFO 0x4
26#define CLCERTS 0x8
27#define CACERTS 0x10
0f113f3e 28
eee95522 29#define PASSWD_BUF_SIZE 2048
902161e8
DDO		 30#define PKCS12_DEFAULT_PBE NID_aes_256_cbc
31
32#define WARN_EXPORT(opt) \
33 BIO_printf(bio_err, "Warning: -%s option ignored with -export\n", opt);
34#define WARN_NO_EXPORT(opt) \
35 BIO_printf(bio_err, "Warning: -%s option ignored without -export\n", opt);
eee95522 36
e29c73c9 37static int get_cert_chain(X509 *cert, X509_STORE *store,
1d6c8670 38 STACK_OF(X509) *untrusted_certs,
e29c73c9 39 STACK_OF(X509) **chain);
28da1455
MC		 40int dump_certs_keys_p12(BIO *out, const PKCS12 *p12,
41 const char *pass, int passlen, int options,
42 char *pempass, const EVP_CIPHER *enc);
43int dump_certs_pkeys_bags(BIO *out, const STACK_OF(PKCS12_SAFEBAG) *bags,
44 const char *pass, int passlen, int options,
45 char *pempass, const EVP_CIPHER *enc);
46int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bags,
47 const char *pass, int passlen,
48 int options, char *pempass, const EVP_CIPHER *enc);
dbcc7b45 49void print_attribute(BIO *out, const ASN1_TYPE *av);
b2e57e09 50int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
0f113f3e 51 const char *name);
ee0508d4 52void hex_prin(BIO *out, unsigned char *buf, int len);
59b4da05 53static int alg_print(const X509_ALGOR *alg);
84c15db5 54int cert_load(BIO *in, STACK_OF(X509) *sk);
7e1b7485
RS		 55static int set_pbe(int *ppbe, const char *str);
56
57typedef enum OPTION_choice {
58 OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
59 OPT_CIPHER, OPT_NOKEYS, OPT_KEYEX, OPT_KEYSIG, OPT_NOCERTS, OPT_CLCERTS,
60 OPT_CACERTS, OPT_NOOUT, OPT_INFO, OPT_CHAIN, OPT_TWOPASS, OPT_NOMACVER,
1fdde917 61 OPT_DESCERT, OPT_EXPORT, OPT_ITER, OPT_NOITER, OPT_MACITER, OPT_NOMACITER,
ef898017 62 OPT_NOMAC, OPT_LMK, OPT_NODES, OPT_NOENC, OPT_MACALG, OPT_CERTPBE, OPT_KEYPBE,
1d6c8670
DDO		 63 OPT_INKEY, OPT_CERTFILE, OPT_UNTRUSTED, OPT_PASSCERTS,
64 OPT_NAME, OPT_CSP, OPT_CANAME,
7e1b7485 65 OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
fd3397fc 66 OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE,
15c9aa3a 67 OPT_R_ENUM, OPT_PROV_ENUM, OPT_LEGACY_ALG
7e1b7485
RS		 68} OPTION_CHOICE;
69
44c83ebd 70const OPTIONS pkcs12_options[] = {
5388f986 71 OPT_SECTION("General"),
7e1b7485 72 {"help", OPT_HELP, '-', "Display this summary"},
902161e8
DDO		 73 {"in", OPT_IN, '<', "Input file"},
74 {"out", OPT_OUT, '>', "Output file"},
75 {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
76 {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
77 {"password", OPT_PASSWORD, 's', "Set PKCS#12 import/export password source"},
78 {"twopass", OPT_TWOPASS, '-', "Separate MAC, encryption passwords"},
79 {"nokeys", OPT_NOKEYS, '-', "Don't output private keys"},
80 {"nocerts", OPT_NOCERTS, '-', "Don't output certificates"},
81 {"noout", OPT_NOOUT, '-', "Don't output anything, just verify PKCS#12 input"},
9ab9b16b
DDO		 82 {"legacy", OPT_LEGACY_ALG, '-',
83#ifdef OPENSSL_NO_RC2
84 "Use legacy encryption algorithm 3DES_CBC for keys and certs"
85#else
86 "Use legacy encryption: 3DES_CBC for keys, RC2_CBC for certs"
87#endif
88 },
1ae56f2f 89#ifndef OPENSSL_NO_ENGINE
5388f986 90 {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
1ae56f2f 91#endif
902161e8
DDO		 92 OPT_PROV_OPTIONS,
93 OPT_R_OPTIONS,
908c9fc7 94
902161e8
DDO		 95 OPT_SECTION("PKCS#12 import (parsing PKCS#12)"),
96 {"info", OPT_INFO, '-', "Print info about PKCS#12 structure"},
97 {"nomacver", OPT_NOMACVER, '-', "Don't verify integrity MAC"},
98 {"clcerts", OPT_CLCERTS, '-', "Only output client certificates"},
99 {"cacerts", OPT_CACERTS, '-', "Only output CA certificates"},
100 {"", OPT_CIPHER, '-', "Any supported cipher for output encryption"},
101 {"noenc", OPT_NOENC, '-', "Don't encrypt private keys"},
102 {"nodes", OPT_NODES, '-', "Don't encrypt private keys; deprecated"},
103
104 OPT_SECTION("PKCS#12 output (export)"),
105 {"export", OPT_EXPORT, '-', "Create PKCS12 file"},
908c9fc7
DDO		 106 {"inkey", OPT_INKEY, 's', "Private key, else read from -in input file"},
107 {"certfile", OPT_CERTFILE, '<', "Extra certificates for PKCS12 output"},
908c9fc7 108 {"passcerts", OPT_PASSCERTS, 's', "Certificate file pass phrase source"},
902161e8
DDO		 109 {"chain", OPT_CHAIN, '-', "Build and add certificate chain for EE cert,"},
110 {OPT_MORE_STR, 0, 0,
111 "which is the 1st cert from -in matching the privte key (if given)"},
112 {"untrusted", OPT_UNTRUSTED, '<', "Untrusted certificates for chain building"},
5388f986 113 {"CAfile", OPT_CAFILE, '<', "PEM-format file of CA's"},
902161e8 114 {"CApath", OPT_CAPATH, '/', "PEM-format directory of CA's"},
5388f986
RS		 115 {"CAstore", OPT_CASTORE, ':', "URI to store of CA's"},
116 {"no-CAfile", OPT_NOCAFILE, '-',
117 "Do not load the default certificates file"},
118 {"no-CApath", OPT_NOCAPATH, '-',
119 "Do not load certificates from the default certificates directory"},
120 {"no-CAstore", OPT_NOCASTORE, '-',
121 "Do not load certificates from the default certificates store"},
908c9fc7 122 {"name", OPT_NAME, 's', "Use name as friendly name"},
908c9fc7
DDO		 123 {"caname", OPT_CANAME, 's',
124 "Use name as CA friendly name (can be repeated)"},
902161e8 125 {"CSP", OPT_CSP, 's', "Microsoft CSP name"},
908c9fc7
DDO		 126 {"LMK", OPT_LMK, '-',
127 "Add local machine keyset attribute to private key"},
1d6c8670
DDO		 128 {"keyex", OPT_KEYEX, '-', "Set key type to MS key exchange"},
129 {"keysig", OPT_KEYSIG, '-', "Set key type to MS key signature"},
902161e8 130 {"keypbe", OPT_KEYPBE, 's', "Private key PBE algorithm (default AES-256 CBC)"},
7e1b7485 131 {"certpbe", OPT_CERTPBE, 's',
15c9aa3a 132 "Certificate PBE algorithm (default PBES2 with PBKDF2 and AES-256 CBC)"},
902161e8
DDO		 133 {"descert", OPT_DESCERT, '-',
134 "Encrypt output with 3DES (default PBES2 with PBKDF2 and AES-256 CBC)"},
135 {"macalg", OPT_MACALG, 's',
136 "Digest algorithm to use in MAC (default SHA1)"},
9ab9b16b
DDO		 137 {"iter", OPT_ITER, 'p', "Specify the iteration count for encryption and MAC"},
138 {"noiter", OPT_NOITER, '-', "Don't use encryption iteration"},
902161e8 139 {"nomaciter", OPT_NOMACITER, '-', "Don't use MAC iteration)"},
1fdde917 140 {"maciter", OPT_MACITER, '-', "Unused, kept for backwards compatibility"},
7e1b7485 141 {"nomac", OPT_NOMAC, '-', "Don't generate MAC"},
7e1b7485
RS		 142 {NULL}
143};
667ac4ec 144
7e1b7485 145int pkcs12_main(int argc, char **argv)
ee0508d4 146{
7e1b7485 147 char *infile = NULL, *outfile = NULL, *keyname = NULL, *certfile = NULL;
1d6c8670 148 char *untrusted = NULL;
b3c5aadf 149 char *passcertsarg = NULL, *passcerts = NULL;
7e1b7485 150 char *name = NULL, *csp_name = NULL;
eee95522 151 char pass[PASSWD_BUF_SIZE] = "", macpass[PASSWD_BUF_SIZE] = "";
902161e8 152 int export_pkcs12 = 0, options = 0, chain = 0, twopass = 0, keytype = 0, use_legacy = 0;
7e1b7485 153 int iter = PKCS12_DEFAULT_ITER, maciter = PKCS12_DEFAULT_ITER;
9ab9b16b
DDO		 154 int cert_pbe = PKCS12_DEFAULT_PBE;
155 int key_pbe = PKCS12_DEFAULT_PBE;
923b1857
RL		 156 int ret = 1, macver = 1, add_lmk = 0, private = 0;
157 int noprompt = 0;
7e1b7485 158 char *passinarg = NULL, *passoutarg = NULL, *passarg = NULL;
3ee1eac2 159 char *passin = NULL, *passout = NULL, *macalg = NULL;
647ac8d3 160 char *cpass = NULL, *mpass = NULL, *badpass = NULL;
fd3397fc
RL		 161 const char *CApath = NULL, *CAfile = NULL, *CAstore = NULL, *prog;
162 int noCApath = 0, noCAfile = 0, noCAstore = 0;
7e1b7485
RS		 163 ENGINE *e = NULL;
164 BIO *in = NULL, *out = NULL;
165 PKCS12 *p12 = NULL;
c869da88 166 STACK_OF(OPENSSL_STRING) *canames = NULL;
902161e8 167 const char *enc_flag = NULL;
9ab9b16b
DDO		 168 const EVP_CIPHER *const default_enc = EVP_aes_256_cbc();
169 const EVP_CIPHER *enc = default_enc;
7e1b7485
RS		 170 OPTION_CHOICE o;
171
172 prog = opt_init(argc, argv, pkcs12_options);
173 while ((o = opt_next()) != OPT_EOF) {
174 switch (o) {
175 case OPT_EOF:
176 case OPT_ERR:
177 opthelp:
178 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
179 goto end;
180 case OPT_HELP:
181 opt_help(pkcs12_options);
182 ret = 0;
183 goto end;
184 case OPT_NOKEYS:
185 options |= NOKEYS;
186 break;
187 case OPT_KEYEX:
188 keytype = KEY_EX;
189 break;
190 case OPT_KEYSIG:
191 keytype = KEY_SIG;
192 break;
193 case OPT_NOCERTS:
194 options |= NOCERTS;
195 break;
196 case OPT_CLCERTS:
197 options |= CLCERTS;
198 break;
199 case OPT_CACERTS:
200 options |= CACERTS;
201 break;
202 case OPT_NOOUT:
203 options |= (NOKEYS | NOCERTS);
204 break;
205 case OPT_INFO:
206 options |= INFO;
207 break;
208 case OPT_CHAIN:
209 chain = 1;
210 break;
211 case OPT_TWOPASS:
212 twopass = 1;
213 break;
214 case OPT_NOMACVER:
215 macver = 0;
216 break;
217 case OPT_DESCERT:
218 cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
219 break;
220 case OPT_EXPORT:
902161e8 221 export_pkcs12 = 1;
7e1b7485
RS		 222 break;
223 case OPT_CIPHER:
902161e8
DDO		 224 enc_flag = opt_unknown();
225 if (!opt_cipher(enc_flag, &enc))
7e1b7485
RS		 226 goto opthelp;
227 break;
1fdde917
IG		 228 case OPT_ITER:
229 if (!opt_int(opt_arg(), &iter))
230 goto opthelp;
231 maciter = iter;
232 break;
7e1b7485
RS		 233 case OPT_NOITER:
234 iter = 1;
235 break;
236 case OPT_MACITER:
1fdde917 237 /* no-op */
7e1b7485
RS		 238 break;
239 case OPT_NOMACITER:
240 maciter = 1;
241 break;
242 case OPT_NOMAC:
852feb3b 243 cert_pbe = -1;
7e1b7485
RS		 244 maciter = -1;
245 break;
246 case OPT_MACALG:
247 macalg = opt_arg();
248 break;
249 case OPT_NODES:
ef898017 250 case OPT_NOENC:
902161e8 251 enc_flag = opt_flag() + 1;
7e1b7485
RS		 252 enc = NULL;
253 break;
254 case OPT_CERTPBE:
255 if (!set_pbe(&cert_pbe, opt_arg()))
256 goto opthelp;
257 break;
258 case OPT_KEYPBE:
259 if (!set_pbe(&key_pbe, opt_arg()))
260 goto opthelp;
261 break;
3ee1eac2
RS		 262 case OPT_R_CASES:
263 if (!opt_rand(o))
264 goto end;
7e1b7485
RS		 265 break;
266 case OPT_INKEY:
267 keyname = opt_arg();
268 break;
269 case OPT_CERTFILE:
270 certfile = opt_arg();
271 break;
1d6c8670
DDO		 272 case OPT_UNTRUSTED:
273 untrusted = opt_arg();
274 break;
b3c5aadf
DDO		 275 case OPT_PASSCERTS:
276 passcertsarg = opt_arg();
277 break;
7e1b7485
RS		 278 case OPT_NAME:
279 name = opt_arg();
280 break;
281 case OPT_LMK:
282 add_lmk = 1;
283 break;
284 case OPT_CSP:
285 csp_name = opt_arg();
286 break;
287 case OPT_CANAME:
288 if (canames == NULL
289 && (canames = sk_OPENSSL_STRING_new_null()) == NULL)
290 goto end;
291 sk_OPENSSL_STRING_push(canames, opt_arg());
292 break;
293 case OPT_IN:
294 infile = opt_arg();
295 break;
296 case OPT_OUT:
297 outfile = opt_arg();
298 break;
299 case OPT_PASSIN:
300 passinarg = opt_arg();
301 break;
302 case OPT_PASSOUT:
303 passoutarg = opt_arg();
304 break;
305 case OPT_PASSWORD:
306 passarg = opt_arg();
307 break;
308 case OPT_CAPATH:
309 CApath = opt_arg();
310 break;
fd3397fc
RL		 311 case OPT_CASTORE:
312 CAstore = opt_arg();
313 break;
7e1b7485
RS		 314 case OPT_CAFILE:
315 CAfile = opt_arg();
316 break;
2b6bcb70
MC		 317 case OPT_NOCAPATH:
318 noCApath = 1;
319 break;
fd3397fc
RL		 320 case OPT_NOCASTORE:
321 noCAstore = 1;
322 break;
2b6bcb70
MC		 323 case OPT_NOCAFILE:
324 noCAfile = 1;
325 break;
7e1b7485 326 case OPT_ENGINE:
333b070e 327 e = setup_engine(opt_arg(), 0);
7e1b7485 328 break;
15c9aa3a
SP		 329 case OPT_LEGACY_ALG:
330 use_legacy = 1;
331 break;
6bd4e3f2
P		 332 case OPT_PROV_CASES:
333 if (!opt_provider(o))
334 goto end;
335 break;
7e1b7485 336 }
ee0508d4 337 }
021410ea
RS		 338
339 /* No extra arguments. */
7e1b7485 340 argc = opt_num_rest();
021410ea
RS		 341 if (argc != 0)
342 goto opthelp;
15c9aa3a 343
51e5df0e 344 app_RAND_load();
902161e8
DDO		 345 if (export_pkcs12) {
346 if ((options & INFO) != 0)
347 WARN_EXPORT("info");
348 if (macver == 0)
349 WARN_EXPORT("nomacver");
350 if ((options & CLCERTS) != 0)
351 WARN_EXPORT("clcerts");
352 if ((options & CACERTS) != 0)
353 WARN_EXPORT("cacerts");
354 if (enc != default_enc)
355 BIO_printf(bio_err,
356 "Warning: output encryption option -%s ignored with -export\n", enc_flag);
357 } else {
358 if (keyname != NULL)
359 WARN_NO_EXPORT("inkey");
1d6c8670 360 if (certfile != NULL)
902161e8 361 WARN_NO_EXPORT("certfile");
1d6c8670 362 if (passcertsarg != NULL)
902161e8
DDO		 363 WARN_NO_EXPORT("passcerts");
364 if (chain)
365 WARN_NO_EXPORT("chain");
366 if (untrusted != NULL)
367 WARN_NO_EXPORT("untrusted");
368 if (CAfile != NULL)
369 WARN_NO_EXPORT("CAfile");
370 if (CApath != NULL)
371 WARN_NO_EXPORT("CApath");
372 if (CAstore != NULL)
373 WARN_NO_EXPORT("CAstore");
374 if (noCAfile)
375 WARN_NO_EXPORT("no-CAfile");
376 if (noCApath)
377 WARN_NO_EXPORT("no-CApath");
378 if (noCAstore)
379 WARN_NO_EXPORT("no-CAstore");
1d6c8670 380 if (name != NULL)
902161e8 381 WARN_NO_EXPORT("name");
1d6c8670 382 if (canames != NULL)
902161e8
DDO		 383 WARN_NO_EXPORT("caname");
384 if (csp_name != NULL)
385 WARN_NO_EXPORT("CSP");
386 if (add_lmk)
387 WARN_NO_EXPORT("LMK");
388 if (keytype == KEY_EX)
389 WARN_NO_EXPORT("keyex");
390 if (keytype == KEY_SIG)
391 WARN_NO_EXPORT("keysig");
392 if (key_pbe != PKCS12_DEFAULT_PBE)
393 WARN_NO_EXPORT("keypbe");
394 if (cert_pbe != PKCS12_DEFAULT_PBE && cert_pbe != -1)
395 WARN_NO_EXPORT("certpbe and -descert");
1d6c8670 396 if (macalg != NULL)
902161e8
DDO		 397 WARN_NO_EXPORT("macalg");
398 if (iter != PKCS12_DEFAULT_ITER)
399 WARN_NO_EXPORT("iter and -noiter");
400 if (maciter == 1)
401 WARN_NO_EXPORT("nomaciter");
402 if (cert_pbe == -1 && maciter == -1)
403 WARN_NO_EXPORT("nomac");
1d6c8670 404 }
15c9aa3a
SP		 405 if (use_legacy) {
406 /* load the legacy provider if not loaded already*/
407 if (!OSSL_PROVIDER_available(app_get0_libctx(), "legacy")) {
408 if (!app_provider_load(app_get0_libctx(), "legacy"))
409 goto end;
410 /* load the default provider explicitly */
411 if (!app_provider_load(app_get0_libctx(), "default"))
412 goto end;
413 }
9ab9b16b
DDO		 414 if (cert_pbe == PKCS12_DEFAULT_PBE) {
415 /* Adapt default algorithm */
15c9aa3a
SP		 416#ifndef OPENSSL_NO_RC2
417 cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
418#else
419 cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
420#endif
421 }
422
9ab9b16b
DDO		 423 if (key_pbe == PKCS12_DEFAULT_PBE)
424 key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
425 if (enc == default_enc)
426 enc = EVP_des_ede3_cbc();
15c9aa3a
SP		 427 }
428
03358517 429
3b061a00 430 private = 1;
ee0508d4 431
b3c5aadf
DDO		 432 if (!app_passwd(passcertsarg, NULL, &passcerts, NULL)) {
433 BIO_printf(bio_err, "Error getting certificate file password\n");
434 goto end;
435 }
436
2234212c 437 if (passarg != NULL) {
902161e8 438 if (export_pkcs12)
7e1b7485 439 passoutarg = passarg;
0f113f3e 440 else
7e1b7485 441 passinarg = passarg;
a3fe382e
DSH		 442 }
443
7e1b7485 444 if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
0f113f3e
MC		 445 BIO_printf(bio_err, "Error getting passwords\n");
446 goto end;
a3fe382e
DSH		 447 }
448
2234212c 449 if (cpass == NULL) {
902161e8 450 if (export_pkcs12)
0f113f3e
MC		 451 cpass = passout;
452 else
453 cpass = passin;
f07fb9b2
DSH		 454 }
455
2234212c 456 if (cpass != NULL) {
0f113f3e
MC		 457 mpass = cpass;
458 noprompt = 1;
40b64553 459 if (twopass) {
902161e8 460 if (export_pkcs12)
40b64553
MC		 461 BIO_printf(bio_err, "Option -twopass cannot be used with -passout or -password\n");
462 else
463 BIO_printf(bio_err, "Option -twopass cannot be used with -passin or -password\n");
464 goto end;
465 }
f07fb9b2 466 } else {
0f113f3e
MC		 467 cpass = pass;
468 mpass = macpass;
e40b7abe
DSH		 469 }
470
ee0508d4 471 if (twopass) {
2234212c 472 /* To avoid bit rot */
923b1857 473 if (1) {
48feaceb 474#ifndef OPENSSL_NO_UI_CONSOLE
cbe29648 475 if (EVP_read_pw_string(
902161e8 476 macpass, sizeof(macpass), "Enter MAC Password:", export_pkcs12)) {
923b1857
RL		 477 BIO_printf(bio_err, "Can't read Password\n");
478 goto end;
479 }
480 } else {
481#endif
482 BIO_printf(bio_err, "Unsupported option -twopass\n");
0f113f3e
MC		 483 goto end;
484 }
ee0508d4
DSH		 485 }
486
902161e8 487 if (export_pkcs12) {
0f113f3e 488 EVP_PKEY *key = NULL;
1d6c8670 489 X509 *ee_cert = NULL, *x = NULL;
0f113f3e 490 STACK_OF(X509) *certs = NULL;
1d6c8670 491 STACK_OF(X509) *untrusted_certs = NULL;
0f113f3e
MC		 492 const EVP_MD *macmd = NULL;
493 unsigned char *catmp = NULL;
494 int i;
495
496 if ((options & (NOCERTS | NOKEYS)) == (NOCERTS | NOKEYS)) {
902161e8 497 BIO_printf(bio_err, "Nothing to export due to -noout or -nocerts and -nokeys\n");
0f113f3e
MC		 498 goto export_end;
499 }
500
1d6c8670 501 if ((options & NOCERTS) != 0) {
0f113f3e 502 chain = 0;
1d6c8670
DDO		 503 BIO_printf(bio_err, "Warning: -chain option ignored with -nocerts\n");
504 }
0f113f3e 505
0f113f3e 506 if (!(options & NOKEYS)) {
7e1b7485 507 key = load_key(keyname ? keyname : infile,
1d6c8670
DDO		 508 FORMAT_PEM, 1, passin, e,
509 keyname ?
510 "private key from -inkey file" :
511 "private key from -in file");
2234212c 512 if (key == NULL)
0f113f3e
MC		 513 goto export_end;
514 }
0f113f3e 515
1d6c8670 516 /* Load all certs in input file */
0f113f3e 517 if (!(options & NOCERTS)) {
1d6c8670
DDO		 518 if (!load_certs(infile, &certs, passin,
519 "certificates from -in file"))
0f113f3e 520 goto export_end;
1d6c8670
DDO		 521 if (sk_X509_num(certs) < 1) {
522 BIO_printf(bio_err, "No certificate in -in file %s\n", infile);
523 goto export_end;
524 }
0f113f3e 525
2234212c 526 if (key != NULL) {
0f113f3e
MC		 527 /* Look for matching private key */
528 for (i = 0; i < sk_X509_num(certs); i++) {
529 x = sk_X509_value(certs, i);
530 if (X509_check_private_key(x, key)) {
1d6c8670 531 ee_cert = x;
0f113f3e 532 /* Zero keyid and alias */
1d6c8670
DDO		 533 X509_keyid_set1(ee_cert, NULL, 0);
534 X509_alias_set1(ee_cert, NULL, 0);
0f113f3e
MC		 535 /* Remove from list */
536 (void)sk_X509_delete(certs, i);
537 break;
538 }
539 }
1d6c8670 540 if (ee_cert == NULL) {
0f113f3e 541 BIO_printf(bio_err,
1d6c8670
DDO		 542 "No cert in -in file '%s' matches private key\n",
543 infile);
0f113f3e
MC		 544 goto export_end;
545 }
1d6c8670
DDO		 546 } else {
547 ee_cert = X509_dup(sk_X509_value(certs, 0)); /* take 1st cert */
0f113f3e 548 }
0f113f3e 549 }
0f113f3e 550
1d6c8670
DDO		 551 /* Load any untrusted certificates for chain building */
552 if (untrusted != NULL) {
553 if (!load_certs(untrusted, &untrusted_certs, passcerts,
554 "untrusted certificates"))
0f113f3e 555 goto export_end;
0f113f3e 556 }
0f113f3e 557
1d6c8670 558 /* If chaining get chain from end entity cert */
0f113f3e
MC		 559 if (chain) {
560 int vret;
561 STACK_OF(X509) *chain2;
7e1b7485 562 X509_STORE *store;
1d6c8670
DDO		 563
564 if (ee_cert == NULL) {
565 BIO_printf(bio_err,
566 "No end entity certificate to check with -chain\n");
567 goto export_end;
568 }
569
fd3397fc
RL		 570 if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
571 CAstore, noCAstore))
2b6bcb70 572 == NULL)
0f113f3e 573 goto export_end;
0f113f3e 574
1d6c8670 575 vret = get_cert_chain(ee_cert, store, untrusted_certs, &chain2);
0f113f3e
MC		 576 X509_STORE_free(store);
577
e29c73c9 578 if (vret == X509_V_OK) {
5e8cd0a4 579 int add_certs;
1d6c8670
DDO		 580 /* Remove from chain2 the first (end entity) certificate */
581 X509_free(sk_X509_shift(chain2));
582 /* Add the remaining certs (except for duplicates) */
5e8cd0a4
SL		 583 add_certs = X509_add_certs(certs, chain2, X509_ADD_FLAG_UP_REF
584 | X509_ADD_FLAG_NO_DUP);
1d6c8670 585 sk_X509_pop_free(chain2, X509_free);
5e8cd0a4
SL		 586 if (!add_certs)
587 goto export_end;
0f113f3e 588 } else {
e29c73c9 589 if (vret != X509_V_ERR_UNSPECIFIED)
1d6c8670 590 BIO_printf(bio_err, "Error getting chain: %s\n",
0f113f3e 591 X509_verify_cert_error_string(vret));
0f113f3e
MC		 592 goto export_end;
593 }
594 }
595
1d6c8670
DDO		 596 /* Add any extra certificates asked for */
597 if (certfile != NULL) {
598 if (!load_certs(certfile, &certs, passcerts,
599 "extra certificates from -certfile"))
600 goto export_end;
601 }
0f113f3e 602
1d6c8670 603 /* Add any CA names */
0f113f3e
MC		 604 for (i = 0; i < sk_OPENSSL_STRING_num(canames); i++) {
605 catmp = (unsigned char *)sk_OPENSSL_STRING_value(canames, i);
606 X509_alias_set1(sk_X509_value(certs, i), catmp, -1);
607 }
608
2234212c 609 if (csp_name != NULL && key != NULL)
0f113f3e
MC		 610 EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
611 MBSTRING_ASC, (unsigned char *)csp_name,
612 -1);
613
2234212c 614 if (add_lmk && key != NULL)
0f113f3e
MC		 615 EVP_PKEY_add1_attr_by_NID(key, NID_LocalKeySet, 0, NULL, -1);
616
b84965af 617 if (!noprompt && !(enc == NULL && maciter == -1)) {
2234212c 618 /* To avoid bit rot */
923b1857 619 if (1) {
48feaceb 620#ifndef OPENSSL_NO_UI_CONSOLE
cbe29648
RS		 621 if (EVP_read_pw_string(pass, sizeof(pass),
622 "Enter Export Password:", 1)) {
923b1857
RL		 623 BIO_printf(bio_err, "Can't read Password\n");
624 goto export_end;
625 }
626 } else {
627#endif
628 BIO_printf(bio_err, "Password required\n");
629 goto export_end;
630 }
0f113f3e 631 }
923b1857 632
0f113f3e 633 if (!twopass)
eee95522 634 OPENSSL_strlcpy(macpass, pass, sizeof(macpass));
0f113f3e 635
1d6c8670 636 p12 = PKCS12_create(cpass, name, key, ee_cert, certs,
0f113f3e
MC		 637 key_pbe, cert_pbe, iter, -1, keytype);
638
12a765a5 639 if (p12 == NULL) {
9c73e48a
DO		 640 BIO_printf(bio_err, "Error creating PKCS12 structure for %s\n",
641 outfile);
0f113f3e
MC		 642 goto export_end;
643 }
644
1d6c8670 645 if (macalg != NULL) {
7e1b7485
RS		 646 if (!opt_md(macalg, &macmd))
647 goto opthelp;
0f113f3e
MC		 648 }
649
650 if (maciter != -1)
651 PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
652
3b061a00 653 assert(private);
bdd58d98
RL		 654
655 out = bio_open_owner(outfile, FORMAT_PKCS12, private);
656 if (out == NULL)
657 goto end;
658
0f113f3e
MC		 659 i2d_PKCS12_bio(out, p12);
660
661 ret = 0;
662
663 export_end:
0f113f3e 664
c5ba2d99 665 EVP_PKEY_free(key);
222561fe 666 sk_X509_pop_free(certs, X509_free);
1d6c8670
DDO		 667 sk_X509_pop_free(untrusted_certs, X509_free);
668 X509_free(ee_cert);
0f113f3e 669
9c73e48a 670 ERR_print_errors(bio_err);
0f113f3e 671 goto end;
ee0508d4 672
ee86c3f5 673 }
ee0508d4 674
bdd58d98
RL		 675 in = bio_open_default(infile, 'r', FORMAT_PKCS12);
676 if (in == NULL)
677 goto end;
678 out = bio_open_owner(outfile, FORMAT_PEM, private);
679 if (out == NULL)
680 goto end;
681
75ebbd9a 682 if ((p12 = d2i_PKCS12_bio(in, NULL)) == NULL) {
0f113f3e
MC		 683 ERR_print_errors(bio_err);
684 goto end;
ee0508d4 685 }
7e1b7485 686
923b1857
RL		 687 if (!noprompt) {
688 if (1) {
48feaceb 689#ifndef OPENSSL_NO_UI_CONSOLE
cbe29648 690 if (EVP_read_pw_string(pass, sizeof(pass), "Enter Import Password:",
923b1857
RL		 691 0)) {
692 BIO_printf(bio_err, "Can't read Password\n");
693 goto end;
694 }
695 } else {
696#endif
697 BIO_printf(bio_err, "Password required\n");
698 goto end;
699 }
ee0508d4 700 }
0f113f3e
MC		 701
702 if (!twopass)
cbe29648 703 OPENSSL_strlcpy(macpass, pass, sizeof(macpass));
0f113f3e 704
776cfa9b 705 if ((options & INFO) && PKCS12_mac_present(p12)) {
59b4da05
DSH		 706 const ASN1_INTEGER *tmaciter;
707 const X509_ALGOR *macalgid;
ac4e2577 708 const ASN1_OBJECT *macobj;
11a25d34
HK		 709 const ASN1_OCTET_STRING *tmac;
710 const ASN1_OCTET_STRING *tsalt;
711
712 PKCS12_get0_mac(&tmac, &macalgid, &tsalt, &tmaciter, p12);
713 /* current hash algorithms do not use parameters so extract just name,
714 in future alg_print() may be needed */
44c248b5 715 X509_ALGOR_get0(&macobj, NULL, NULL, macalgid);
7eb370ee 716 BIO_puts(bio_err, "MAC: ");
44c248b5 717 i2a_ASN1_OBJECT(bio_err, macobj);
7eb370ee 718 BIO_printf(bio_err, ", Iteration %ld\n",
11a25d34
HK		 719 tmaciter != NULL ? ASN1_INTEGER_get(tmaciter) : 1L);
720 BIO_printf(bio_err, "MAC length: %ld, salt length: %ld\n",
721 tmac != NULL ? ASN1_STRING_length(tmac) : 0L,
722 tsalt != NULL ? ASN1_STRING_length(tsalt) : 0L);
776cfa9b 723 }
0f113f3e 724 if (macver) {
0f113f3e
MC		 725 /* If we enter empty password try no password first */
726 if (!mpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
727 /* If mac and crypto pass the same set it to NULL too */
728 if (!twopass)
729 cpass = NULL;
730 } else if (!PKCS12_verify_mac(p12, mpass, -1)) {
647ac8d3
DSH		 731 /*
732 * May be UTF8 from previous version of OpenSSL:
733 * convert to a UTF8 form which will translate
734 * to the same Unicode password.
735 */
736 unsigned char *utmp;
737 int utmplen;
738 utmp = OPENSSL_asc2uni(mpass, -1, NULL, &utmplen);
739 if (utmp == NULL)
740 goto end;
741 badpass = OPENSSL_uni2utf8(utmp, utmplen);
742 OPENSSL_free(utmp);
743 if (!PKCS12_verify_mac(p12, badpass, -1)) {
744 BIO_printf(bio_err, "Mac verify error: invalid password?\n");
745 ERR_print_errors(bio_err);
746 goto end;
747 } else {
748 BIO_printf(bio_err, "Warning: using broken algorithm\n");
749 if (!twopass)
750 cpass = badpass;
751 }
0f113f3e 752 }
ee0508d4 753 }
7e1b7485 754
3b061a00 755 assert(private);
7e1b7485 756 if (!dump_certs_keys_p12(out, p12, cpass, -1, options, passout, enc)) {
0f113f3e
MC		 757 BIO_printf(bio_err, "Error outputting keys and certificates\n");
758 ERR_print_errors(bio_err);
759 goto end;
ee0508d4 760 }
ee0508d4 761 ret = 0;
88364bc2 762 end:
e0e920b1 763 PKCS12_free(p12);
dd1abd44 764 release_engine(e);
a873356c 765 BIO_free(in);
645749ef 766 BIO_free_all(out);
25aaa98a 767 sk_OPENSSL_STRING_free(canames);
647ac8d3 768 OPENSSL_free(badpass);
b3c5aadf 769 OPENSSL_free(passcerts);
b548a1f1
RS		 770 OPENSSL_free(passin);
771 OPENSSL_free(passout);
eee95522 772 return ret;
ee0508d4
DSH		 773}
774
28da1455 775int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
7e1b7485
RS		 776 int passlen, int options, char *pempass,
777 const EVP_CIPHER *enc)
ee0508d4 778{
0f113f3e
MC		 779 STACK_OF(PKCS7) *asafes = NULL;
780 STACK_OF(PKCS12_SAFEBAG) *bags;
781 int i, bagnid;
782 int ret = 0;
783 PKCS7 *p7;
784
75ebbd9a 785 if ((asafes = PKCS12_unpack_authsafes(p12)) == NULL)
0f113f3e
MC		 786 return 0;
787 for (i = 0; i < sk_PKCS7_num(asafes); i++) {
788 p7 = sk_PKCS7_value(asafes, i);
789 bagnid = OBJ_obj2nid(p7->type);
790 if (bagnid == NID_pkcs7_data) {
791 bags = PKCS12_unpack_p7data(p7);
792 if (options & INFO)
793 BIO_printf(bio_err, "PKCS7 Data\n");
794 } else if (bagnid == NID_pkcs7_encrypted) {
795 if (options & INFO) {
796 BIO_printf(bio_err, "PKCS7 Encrypted data: ");
ecf3a1fb 797 alg_print(p7->d.encrypted->enc_data->algorithm);
0f113f3e
MC		 798 }
799 bags = PKCS12_unpack_p7encdata(p7, pass, passlen);
2234212c 800 } else {
0f113f3e 801 continue;
2234212c 802 }
0f113f3e
MC		 803 if (!bags)
804 goto err;
805 if (!dump_certs_pkeys_bags(out, bags, pass, passlen,
7e1b7485 806 options, pempass, enc)) {
0f113f3e
MC		 807 sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
808 goto err;
809 }
810 sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
811 bags = NULL;
812 }
813 ret = 1;
814
815 err:
e0e920b1 816 sk_PKCS7_pop_free(asafes, PKCS7_free);
0f113f3e 817 return ret;
ee0508d4
DSH		 818}
819
28da1455
MC		 820int dump_certs_pkeys_bags(BIO *out, const STACK_OF(PKCS12_SAFEBAG) *bags,
821 const char *pass, int passlen, int options,
822 char *pempass, const EVP_CIPHER *enc)
ee0508d4 823{
0f113f3e
MC		 824 int i;
825 for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
826 if (!dump_certs_pkeys_bag(out,
827 sk_PKCS12_SAFEBAG_value(bags, i),
7e1b7485 828 pass, passlen, options, pempass, enc))
0f113f3e
MC		 829 return 0;
830 }
831 return 1;
ee0508d4
DSH		 832}
833
28da1455
MC		 834int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bag,
835 const char *pass, int passlen, int options,
836 char *pempass, const EVP_CIPHER *enc)
ee0508d4 837{
0f113f3e
MC		 838 EVP_PKEY *pkey;
839 PKCS8_PRIV_KEY_INFO *p8;
28da1455 840 const PKCS8_PRIV_KEY_INFO *p8c;
0f113f3e 841 X509 *x509;
28da1455 842 const STACK_OF(X509_ATTRIBUTE) *attrs;
c73aa309 843 int ret = 0;
776cfa9b
DSH		 844
845 attrs = PKCS12_SAFEBAG_get0_attrs(bag);
0f113f3e 846
762ee38d 847 switch (PKCS12_SAFEBAG_get_nid(bag)) {
0f113f3e
MC		 848 case NID_keyBag:
849 if (options & INFO)
850 BIO_printf(bio_err, "Key bag\n");
851 if (options & NOKEYS)
852 return 1;
776cfa9b 853 print_attribs(out, attrs, "Bag Attributes");
28da1455
MC		 854 p8c = PKCS12_SAFEBAG_get0_p8inf(bag);
855 if ((pkey = EVP_PKCS82PKEY(p8c)) == NULL)
0f113f3e 856 return 0;
28da1455 857 print_attribs(out, PKCS8_pkey_get0_attrs(p8c), "Key Attributes");
c73aa309 858 ret = PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, pempass);
0f113f3e
MC		 859 EVP_PKEY_free(pkey);
860 break;
861
862 case NID_pkcs8ShroudedKeyBag:
863 if (options & INFO) {
59b4da05
DSH		 864 const X509_SIG *tp8;
865 const X509_ALGOR *tp8alg;
c9018bdf 866
0f113f3e 867 BIO_printf(bio_err, "Shrouded Keybag: ");
776cfa9b 868 tp8 = PKCS12_SAFEBAG_get0_pkcs8(bag);
59b4da05 869 X509_SIG_get0(tp8, &tp8alg, NULL);
a6eb1ce6 870 alg_print(tp8alg);
0f113f3e
MC		 871 }
872 if (options & NOKEYS)
873 return 1;
776cfa9b 874 print_attribs(out, attrs, "Bag Attributes");
75ebbd9a 875 if ((p8 = PKCS12_decrypt_skey(bag, pass, passlen)) == NULL)
0f113f3e 876 return 0;
75ebbd9a 877 if ((pkey = EVP_PKCS82PKEY(p8)) == NULL) {
0f113f3e
MC		 878 PKCS8_PRIV_KEY_INFO_free(p8);
879 return 0;
880 }
54dbf423 881 print_attribs(out, PKCS8_pkey_get0_attrs(p8), "Key Attributes");
0f113f3e 882 PKCS8_PRIV_KEY_INFO_free(p8);
c73aa309 883 ret = PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, pempass);
0f113f3e
MC		 884 EVP_PKEY_free(pkey);
885 break;
886
887 case NID_certBag:
888 if (options & INFO)
889 BIO_printf(bio_err, "Certificate bag\n");
890 if (options & NOCERTS)
891 return 1;
762ee38d 892 if (PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID)) {
0f113f3e
MC		 893 if (options & CACERTS)
894 return 1;
895 } else if (options & CLCERTS)
896 return 1;
776cfa9b 897 print_attribs(out, attrs, "Bag Attributes");
762ee38d 898 if (PKCS12_SAFEBAG_get_bag_nid(bag) != NID_x509Certificate)
0f113f3e 899 return 1;
762ee38d 900 if ((x509 = PKCS12_SAFEBAG_get1_cert(bag)) == NULL)
0f113f3e
MC		 901 return 0;
902 dump_cert_text(out, x509);
c73aa309 903 ret = PEM_write_bio_X509(out, x509);
0f113f3e
MC		 904 X509_free(x509);
905 break;
906
c5ec6dcf
JS		 907 case NID_secretBag:
908 if (options & INFO)
909 BIO_printf(bio_err, "Secret bag\n");
910 print_attribs(out, attrs, "Bag Attributes");
911 BIO_printf(bio_err, "Bag Type: ");
912 i2a_ASN1_OBJECT(bio_err, PKCS12_SAFEBAG_get0_bag_type(bag));
913 BIO_printf(bio_err, "\nBag Value: ");
914 print_attribute(out, PKCS12_SAFEBAG_get0_bag_obj(bag));
915 return 1;
916
0f113f3e
MC		 917 case NID_safeContentsBag:
918 if (options & INFO)
919 BIO_printf(bio_err, "Safe Contents bag\n");
776cfa9b
DSH		 920 print_attribs(out, attrs, "Bag Attributes");
921 return dump_certs_pkeys_bags(out, PKCS12_SAFEBAG_get0_safes(bag),
922 pass, passlen, options, pempass, enc);
0f113f3e
MC		 923
924 default:
925 BIO_printf(bio_err, "Warning unsupported bag type: ");
776cfa9b 926 i2a_ASN1_OBJECT(bio_err, PKCS12_SAFEBAG_get0_type(bag));
0f113f3e
MC		 927 BIO_printf(bio_err, "\n");
928 return 1;
0f113f3e 929 }
c73aa309 930 return ret;
ee0508d4
DSH		 931}
932
933/* Given a single certificate return a verified chain or NULL if error */
934
e29c73c9 935static int get_cert_chain(X509 *cert, X509_STORE *store,
1d6c8670 936 STACK_OF(X509) *untrusted_certs,
e29c73c9 937 STACK_OF(X509) **chain)
ee0508d4 938{
f0e0fd51 939 X509_STORE_CTX *store_ctx = NULL;
e29c73c9 940 STACK_OF(X509) *chn = NULL;
0f113f3e
MC		 941 int i = 0;
942
d8652be0 943 store_ctx = X509_STORE_CTX_new_ex(app_get0_libctx(), app_get0_propq());
f0e0fd51
RS		 944 if (store_ctx == NULL) {
945 i = X509_V_ERR_UNSPECIFIED;
946 goto end;
947 }
1d6c8670 948 if (!X509_STORE_CTX_init(store_ctx, store, cert, untrusted_certs)) {
f0e0fd51
RS		 949 i = X509_V_ERR_UNSPECIFIED;
950 goto end;
e29c73c9
VD		 951 }
952
f0e0fd51
RS		 953
954 if (X509_verify_cert(store_ctx) > 0)
955 chn = X509_STORE_CTX_get1_chain(store_ctx);
956 else if ((i = X509_STORE_CTX_get_error(store_ctx)) == 0)
e29c73c9
VD		 957 i = X509_V_ERR_UNSPECIFIED;
958
f0e0fd51
RS		 959end:
960 X509_STORE_CTX_free(store_ctx);
0f113f3e 961 *chain = chn;
0f113f3e
MC		 962 return i;
963}
964
59b4da05 965static int alg_print(const X509_ALGOR *alg)
ee0508d4 966{
ab6a591c 967 int pbenid, aparamtype;
ac4e2577
DSH		 968 const ASN1_OBJECT *aoid;
969 const void *aparam;
ab6a591c
DSH		 970 PBEPARAM *pbe = NULL;
971
972 X509_ALGOR_get0(&aoid, &aparamtype, &aparam, alg);
973
974 pbenid = OBJ_obj2nid(aoid);
975
976 BIO_printf(bio_err, "%s", OBJ_nid2ln(pbenid));
977
978 /*
979 * If PBE algorithm is PBES2 decode algorithm parameters
980 * for additional details.
981 */
982 if (pbenid == NID_pbes2) {
983 PBE2PARAM *pbe2 = NULL;
984 int encnid;
985 if (aparamtype == V_ASN1_SEQUENCE)
986 pbe2 = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(PBE2PARAM));
987 if (pbe2 == NULL) {
dc46fc25 988 BIO_puts(bio_err, ", <unsupported parameters>");
ab6a591c
DSH		 989 goto done;
990 }
991 X509_ALGOR_get0(&aoid, &aparamtype, &aparam, pbe2->keyfunc);
992 pbenid = OBJ_obj2nid(aoid);
993 X509_ALGOR_get0(&aoid, NULL, NULL, pbe2->encryption);
994 encnid = OBJ_obj2nid(aoid);
995 BIO_printf(bio_err, ", %s, %s", OBJ_nid2ln(pbenid),
996 OBJ_nid2sn(encnid));
997 /* If KDF is PBKDF2 decode parameters */
998 if (pbenid == NID_id_pbkdf2) {
999 PBKDF2PARAM *kdf = NULL;
1000 int prfnid;
1001 if (aparamtype == V_ASN1_SEQUENCE)
1002 kdf = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(PBKDF2PARAM));
1003 if (kdf == NULL) {
dc46fc25 1004 BIO_puts(bio_err, ", <unsupported parameters>");
ab6a591c
DSH		 1005 goto done;
1006 }
ecf3a1fb 1007
ab6a591c
DSH		 1008 if (kdf->prf == NULL) {
1009 prfnid = NID_hmacWithSHA1;
1010 } else {
1011 X509_ALGOR_get0(&aoid, NULL, NULL, kdf->prf);
1012 prfnid = OBJ_obj2nid(aoid);
1013 }
1014 BIO_printf(bio_err, ", Iteration %ld, PRF %s",
1015 ASN1_INTEGER_get(kdf->iter), OBJ_nid2sn(prfnid));
1016 PBKDF2PARAM_free(kdf);
402f26e6 1017#ifndef OPENSSL_NO_SCRYPT
75f163d3
HK		 1018 } else if (pbenid == NID_id_scrypt) {
1019 SCRYPT_PARAMS *kdf = NULL;
1020
1021 if (aparamtype == V_ASN1_SEQUENCE)
1022 kdf = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(SCRYPT_PARAMS));
1023 if (kdf == NULL) {
1024 BIO_puts(bio_err, ", <unsupported parameters>");
1025 goto done;
1026 }
1027 BIO_printf(bio_err, ", Salt length: %d, Cost(N): %ld, "
c2969ff6 1028 "Block size(r): %ld, Parallelism(p): %ld",
75f163d3
HK		 1029 ASN1_STRING_length(kdf->salt),
1030 ASN1_INTEGER_get(kdf->costParameter),
1031 ASN1_INTEGER_get(kdf->blockSize),
1032 ASN1_INTEGER_get(kdf->parallelizationParameter));
1033 SCRYPT_PARAMS_free(kdf);
402f26e6 1034#endif
ab6a591c
DSH		 1035 }
1036 PBE2PARAM_free(pbe2);
1037 } else {
1038 if (aparamtype == V_ASN1_SEQUENCE)
1039 pbe = ASN1_item_unpack(aparam, ASN1_ITEM_rptr(PBEPARAM));
1040 if (pbe == NULL) {
dc46fc25 1041 BIO_puts(bio_err, ", <unsupported parameters>");
ab6a591c
DSH		 1042 goto done;
1043 }
1044 BIO_printf(bio_err, ", Iteration %ld", ASN1_INTEGER_get(pbe->iter));
1045 PBEPARAM_free(pbe);
1046 }
1047 done:
1048 BIO_puts(bio_err, "\n");
0f113f3e 1049 return 1;
ee0508d4
DSH		 1050}
1051
1052/* Load all certificates from a given file */
1053
84c15db5 1054int cert_load(BIO *in, STACK_OF(X509) *sk)
ee0508d4 1055{
d5e66eab 1056 int ret = 0;
0f113f3e 1057 X509 *cert;
d5e66eab 1058
0f113f3e 1059 while ((cert = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
0f113f3e 1060 ret = 1;
d5e66eab
SL		 1061 if (!sk_X509_push(sk, cert))
1062 return 0;
0f113f3e 1063 }
0f113f3e
MC		 1064 if (ret)
1065 ERR_clear_error();
1066 return ret;
ee0508d4
DSH		 1067}
1068
dbcc7b45
JS		 1069/* Generalised x509 attribute value print */
1070
1071void print_attribute(BIO *out, const ASN1_TYPE *av)
1072{
1073 char *value;
1074
1075 switch (av->type) {
1076 case V_ASN1_BMPSTRING:
1077 value = OPENSSL_uni2asc(av->value.bmpstring->data,
1078 av->value.bmpstring->length);
1079 BIO_printf(out, "%s\n", value);
1080 OPENSSL_free(value);
1081 break;
1082
c5ec6dcf
JS		 1083 case V_ASN1_UTF8STRING:
1084 BIO_printf(out, "%s\n", av->value.utf8string->data);
1085 break;
1086
dbcc7b45
JS		 1087 case V_ASN1_OCTET_STRING:
1088 hex_prin(out, av->value.octet_string->data,
1089 av->value.octet_string->length);
1090 BIO_printf(out, "\n");
1091 break;
1092
1093 case V_ASN1_BIT_STRING:
1094 hex_prin(out, av->value.bit_string->data,
1095 av->value.bit_string->length);
1096 BIO_printf(out, "\n");
1097 break;
1098
1099 default:
1100 BIO_printf(out, "<Unsupported tag %d>\n", av->type);
1101 break;
1102 }
1103}
1104
ee0508d4
DSH		 1105/* Generalised attribute print: handle PKCS#8 and bag attributes */
1106
b2e57e09 1107int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
0f113f3e 1108 const char *name)
ee0508d4 1109{
0f113f3e
MC		 1110 X509_ATTRIBUTE *attr;
1111 ASN1_TYPE *av;
dbcc7b45 1112 int i, j, attr_nid;
0f113f3e
MC		 1113 if (!attrlst) {
1114 BIO_printf(out, "%s: <No Attributes>\n", name);
1115 return 1;
1116 }
1117 if (!sk_X509_ATTRIBUTE_num(attrlst)) {
1118 BIO_printf(out, "%s: <Empty Attributes>\n", name);
1119 return 1;
1120 }
1121 BIO_printf(out, "%s\n", name);
1122 for (i = 0; i < sk_X509_ATTRIBUTE_num(attrlst); i++) {
9b0a4531 1123 ASN1_OBJECT *attr_obj;
0f113f3e 1124 attr = sk_X509_ATTRIBUTE_value(attrlst, i);
9b0a4531
DSH		 1125 attr_obj = X509_ATTRIBUTE_get0_object(attr);
1126 attr_nid = OBJ_obj2nid(attr_obj);
0f113f3e
MC		 1127 BIO_printf(out, " ");
1128 if (attr_nid == NID_undef) {
9b0a4531 1129 i2a_ASN1_OBJECT(out, attr_obj);
0f113f3e 1130 BIO_printf(out, ": ");
2234212c 1131 } else {
0f113f3e 1132 BIO_printf(out, "%s: ", OBJ_nid2ln(attr_nid));
2234212c 1133 }
0f113f3e 1134
9b0a4531 1135 if (X509_ATTRIBUTE_count(attr)) {
dbcc7b45
JS		 1136 for (j = 0; j < X509_ATTRIBUTE_count(attr); j++)
1137 {
1138 av = X509_ATTRIBUTE_get0_type(attr, j);
1139 print_attribute(out, av);
0f113f3e 1140 }
2234212c 1141 } else {
0f113f3e 1142 BIO_printf(out, "<No Values>\n");
2234212c 1143 }
0f113f3e
MC		 1144 }
1145 return 1;
ee0508d4
DSH		 1146}
1147
6b691a5c 1148void hex_prin(BIO *out, unsigned char *buf, int len)
ee0508d4 1149{
0f113f3e
MC		 1150 int i;
1151 for (i = 0; i < len; i++)
1152 BIO_printf(out, "%02X ", buf[i]);
ee0508d4 1153}
a8515441 1154
7e1b7485 1155static int set_pbe(int *ppbe, const char *str)
0f113f3e
MC		 1156{
1157 if (!str)
1158 return 0;
86885c28 1159 if (strcmp(str, "NONE") == 0) {
0f113f3e
MC		 1160 *ppbe = -1;
1161 return 1;
1162 }
1163 *ppbe = OBJ_txt2nid(str);
1164 if (*ppbe == NID_undef) {
1165 BIO_printf(bio_err, "Unknown PBE algorithm %s\n", str);
1166 return 0;
1167 }
1168 return 1;
1169}
A mirror of the official openssl repository