2 * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "internal/cryptlib.h"
12 #include <openssl/pkcs12.h>
13 #include "p12_local.h"
15 static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG
) **pbags
,
18 static int copy_bag_attr(PKCS12_SAFEBAG
*bag
, EVP_PKEY
*pkey
, int nid
)
22 idx
= EVP_PKEY_get_attr_by_NID(pkey
, nid
, -1);
25 attr
= EVP_PKEY_get_attr(pkey
, idx
);
26 if (!X509at_add1_attr(&bag
->attrib
, attr
))
31 PKCS12
*PKCS12_create(const char *pass
, const char *name
, EVP_PKEY
*pkey
, X509
*cert
,
32 STACK_OF(X509
) *ca
, int nid_key
, int nid_cert
, int iter
,
33 int mac_iter
, int keytype
)
36 STACK_OF(PKCS7
) *safes
= NULL
;
37 STACK_OF(PKCS12_SAFEBAG
) *bags
= NULL
;
38 PKCS12_SAFEBAG
*bag
= NULL
;
40 unsigned char keyid
[EVP_MAX_MD_SIZE
];
41 unsigned int keyidlen
= 0;
46 nid_cert
= NID_pbe_WithSHA1And3_Key_TripleDES_CBC
;
48 nid_cert
= NID_pbe_WithSHA1And40BitRC2_CBC
;
51 nid_key
= NID_pbe_WithSHA1And3_Key_TripleDES_CBC
;
53 iter
= PKCS12_DEFAULT_ITER
;
57 if (!pkey
&& !cert
&& !ca
) {
58 PKCS12err(PKCS12_F_PKCS12_CREATE
, PKCS12_R_INVALID_NULL_ARGUMENT
);
63 if (!X509_check_private_key(cert
, pkey
))
65 X509_digest(cert
, EVP_sha1(), keyid
, &keyidlen
);
69 bag
= PKCS12_add_cert(&bags
, cert
);
70 if (name
&& !PKCS12_add_friendlyname(bag
, name
, -1))
72 if (keyidlen
&& !PKCS12_add_localkeyid(bag
, keyid
, keyidlen
))
76 /* Add all other certificates */
77 for (i
= 0; i
< sk_X509_num(ca
); i
++) {
78 if (!PKCS12_add_cert(&bags
, sk_X509_value(ca
, i
)))
82 if (bags
&& !PKCS12_add_safe(&safes
, bags
, nid_cert
, iter
, pass
))
85 sk_PKCS12_SAFEBAG_pop_free(bags
, PKCS12_SAFEBAG_free
);
89 bag
= PKCS12_add_key(&bags
, pkey
, keytype
, iter
, nid_key
, pass
);
94 if (!copy_bag_attr(bag
, pkey
, NID_ms_csp_name
))
96 if (!copy_bag_attr(bag
, pkey
, NID_LocalKeySet
))
99 if (name
&& !PKCS12_add_friendlyname(bag
, name
, -1))
101 if (keyidlen
&& !PKCS12_add_localkeyid(bag
, keyid
, keyidlen
))
105 if (bags
&& !PKCS12_add_safe(&safes
, bags
, -1, 0, NULL
))
108 sk_PKCS12_SAFEBAG_pop_free(bags
, PKCS12_SAFEBAG_free
);
111 p12
= PKCS12_add_safes(safes
, 0);
116 sk_PKCS7_pop_free(safes
, PKCS7_free
);
120 if ((mac_iter
!= -1) &&
121 !PKCS12_set_mac(p12
, pass
, -1, NULL
, 0, mac_iter
, NULL
))
128 sk_PKCS7_pop_free(safes
, PKCS7_free
);
129 sk_PKCS12_SAFEBAG_pop_free(bags
, PKCS12_SAFEBAG_free
);
134 PKCS12_SAFEBAG
*PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG
) **pbags
, X509
*cert
)
136 PKCS12_SAFEBAG
*bag
= NULL
;
139 unsigned char *keyid
;
142 /* Add user certificate */
143 if ((bag
= PKCS12_SAFEBAG_create_cert(cert
)) == NULL
)
147 * Use friendlyName and localKeyID in certificate. (if present)
150 name
= (char *)X509_alias_get0(cert
, &namelen
);
152 if (name
&& !PKCS12_add_friendlyname(bag
, name
, namelen
))
155 keyid
= X509_keyid_get0(cert
, &keyidlen
);
157 if (keyid
&& !PKCS12_add_localkeyid(bag
, keyid
, keyidlen
))
160 if (!pkcs12_add_bag(pbags
, bag
))
166 PKCS12_SAFEBAG_free(bag
);
171 PKCS12_SAFEBAG
*PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG
) **pbags
,
172 EVP_PKEY
*key
, int key_usage
, int iter
,
173 int nid_key
, const char *pass
)
176 PKCS12_SAFEBAG
*bag
= NULL
;
177 PKCS8_PRIV_KEY_INFO
*p8
= NULL
;
179 /* Make a PKCS#8 structure */
180 if ((p8
= EVP_PKEY2PKCS8(key
)) == NULL
)
182 if (key_usage
&& !PKCS8_add_keyusage(p8
, key_usage
))
185 bag
= PKCS12_SAFEBAG_create_pkcs8_encrypt(nid_key
, pass
, -1, NULL
, 0,
187 PKCS8_PRIV_KEY_INFO_free(p8
);
189 bag
= PKCS12_SAFEBAG_create0_p8inf(p8
);
194 if (!pkcs12_add_bag(pbags
, bag
))
200 PKCS12_SAFEBAG_free(bag
);
205 int PKCS12_add_safe(STACK_OF(PKCS7
) **psafes
, STACK_OF(PKCS12_SAFEBAG
) *bags
,
206 int nid_safe
, int iter
, const char *pass
)
212 *psafes
= sk_PKCS7_new_null();
220 #ifdef OPENSSL_NO_RC2
221 nid_safe
= NID_pbe_WithSHA1And3_Key_TripleDES_CBC
;
223 nid_safe
= NID_pbe_WithSHA1And40BitRC2_CBC
;
227 p7
= PKCS12_pack_p7data(bags
);
229 p7
= PKCS12_pack_p7encdata(nid_safe
, pass
, -1, NULL
, 0, iter
, bags
);
233 if (!sk_PKCS7_push(*psafes
, p7
))
240 sk_PKCS7_free(*psafes
);
248 static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG
) **pbags
,
255 *pbags
= sk_PKCS12_SAFEBAG_new_null();
262 if (!sk_PKCS12_SAFEBAG_push(*pbags
, bag
)) {
264 sk_PKCS12_SAFEBAG_free(*pbags
);
274 PKCS12
*PKCS12_add_safes(STACK_OF(PKCS7
) *safes
, int nid_p7
)
278 nid_p7
= NID_pkcs7_data
;
279 p12
= PKCS12_init(nid_p7
);
284 if (!PKCS12_pack_authsafes(p12
, safes
)) {