From: Tomas Mraz <tomas@openssl.org>
Date: Fri, 5 Mar 2021 16:22:35 +0000 (+0100)
Subject: apps/pkcs12: Properly detect MAC setup failure
X-Git-Tag: openssl-3.0.0-alpha13~24
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=913f9d5e52f0541c2fb9c3b60d3fc785f35eacae;p=thirdparty%2Fopenssl.git

apps/pkcs12: Properly detect MAC setup failure

The MAC requires PKCS12KDF support which is not present
in FIPS provider as it is not an approved KDF algorithm.
Suggest using -nomac if MAC is not required.

Fixes #14057

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14445)
---

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 241122b76ad..00c5a9bc4bb 100644
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -655,7 +655,11 @@ int pkcs12_main(int argc, char **argv)
         }
 
         if (maciter != -1)
-            PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
+            if (!PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd)) {
+                BIO_printf(bio_err, "Error creating PKCS12 MAC; no PKCS12KDF support?\n");
+                BIO_printf(bio_err, "Use -nomac if MAC not required and PKCS12KDF support not available.\n");
+                goto export_end;
+            }
 
         assert(private);
 
diff --git a/doc/man1/openssl-pkcs12.pod.in b/doc/man1/openssl-pkcs12.pod.in
index 65c10d1adbd..b367be2b7f4 100644
--- a/doc/man1/openssl-pkcs12.pod.in
+++ b/doc/man1/openssl-pkcs12.pod.in
@@ -333,7 +333,7 @@ then both, the private key and the certificates are encrypted using triple DES.
 
 =item B<-macalg> I<digest>
 
-Specify the MAC digest algorithm. If not included them SHA1 will be used.
+Specify the MAC digest algorithm. If not included SHA1 will be used.
 
 =item B<-iter> I<count>
 
@@ -362,7 +362,9 @@ to be needed to use MAC iterations counts but they are now used by default.
 
 =item B<-nomac>
 
-Don't attempt to provide the MAC integrity.
+Do not attempt to provide the MAC integrity. This can be useful with the FIPS
+provider as the PKCS12 MAC requires PKCS12KDF which is not an approved FIPS
+algorithm and cannot be supported by the FIPS provider.
 
 =back