X-Git-Url: https://git.openssl.org/?a=blobdiff_plain;f=apps%2Fpkcs8.c;h=a9583335178b7d781ac3a0f9c9400b14b0c4bd25;hb=480116f06236b470d5561d0e6780498944ac3375;hp=442eced7efc9b24208f8ac4c19ce22f5c6d2d208;hpb=3cbb7937fa9ab7cbdab57ff37575d223b6153ec2;p=openssl.git

diff --git a/apps/pkcs8.c b/apps/pkcs8.c
index 442eced7ef..a958333517 100644
--- a/apps/pkcs8.c
+++ b/apps/pkcs8.c
@@ -56,6 +56,8 @@
  *
  */
 #include <stdio.h>
+#include <string.h>
+#include "apps.h"
 #include <openssl/pem.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -71,13 +73,15 @@ int MAIN(int argc, char **argv)
 	BIO *in = NULL, *out = NULL;
 	int topk8 = 0;
 	int pbe_nid = -1;
+	const EVP_CIPHER *cipher = NULL;
 	int iter = PKCS12_DEFAULT_ITER;
 	int informat, outformat;
 	int p8_broken = PKCS8_OK;
+	int nocrypt = 0;
 	X509_SIG *p8;
 	PKCS8_PRIV_KEY_INFO *p8inf;
 	EVP_PKEY *pkey;
-	char pass[50];
+	char pass[50], *passin = NULL, *passout = NULL;
 	int badarg = 0;
 	if (bio_err == NULL) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
 	informat=FORMAT_PEM;
@@ -86,7 +90,27 @@ int MAIN(int argc, char **argv)
 	SSLeay_add_all_algorithms();
 	args = argv + 1;
 	while (!badarg && *args && *args[0] == '-') {
-		if (!strcmp(*args,"-inform")) {
+		if (!strcmp(*args,"-v2")) {
+			if (args[1]) {
+				args++;
+				cipher=EVP_get_cipherbyname(*args);
+				if(!cipher) {
+					BIO_printf(bio_err,
+						 "Unknown cipher %s\n", *args);
+					badarg = 1;
+				}
+			} else badarg = 1;
+		} else if (!strcmp(*args,"-v1")) {
+			if (args[1]) {
+				args++;
+				pbe_nid=OBJ_txt2nid(*args);
+				if(pbe_nid == NID_undef) {
+					BIO_printf(bio_err,
+						 "Unknown PBE algorithm %s\n", *args);
+					badarg = 1;
+				}
+			} else badarg = 1;
+		} else if (!strcmp(*args,"-inform")) {
 			if (args[1]) {
 				args++;
 				informat=str2fmt(*args);
@@ -98,7 +122,40 @@ int MAIN(int argc, char **argv)
 			} else badarg = 1;
 		} else if (!strcmp (*args, "-topk8")) topk8 = 1;
 		else if (!strcmp (*args, "-noiter")) iter = 1;
+		else if (!strcmp (*args, "-nocrypt")) nocrypt = 1;
 		else if (!strcmp (*args, "-nooct")) p8_broken = PKCS8_NO_OCTET;
+		else if (!strcmp(*args,"-passin"))
+			{
+			if (!args[1]) goto bad;
+			passin= *(++args);
+			}
+		else if (!strcmp(*args,"-envpassin"))
+			{
+			if (!args[1]) goto bad;
+			if(!(passin= getenv(*(++args))))
+				{
+				BIO_printf(bio_err,
+				 "Can't read environment variable %s\n",
+								*args);
+				badarg = 1;
+				}
+			}
+		else if (strcmp(*args,"-envpassout") == 0)
+			{
+			if (!args[1]) goto bad;
+			if(!(passout= getenv(*(++args))))
+				{
+				BIO_printf(bio_err,
+				 "Can't read environment variable %s\n",
+								*args);
+				badarg = 1;
+				}
+			}
+		else if (!strcmp(*args,"-passout"))
+			{
+			if (!args[1]) goto bad;
+			passout= *(++args);
+			}
 		else if (!strcmp (*args, "-in")) {
 			if (args[1]) {
 				args++;
@@ -114,21 +171,31 @@ int MAIN(int argc, char **argv)
 	}
 
 	if (badarg) {
-		BIO_printf (bio_err, "Usage pkcs8 [options]\n");
-		BIO_printf (bio_err, "where options are\n");
-		BIO_printf (bio_err, "-in file	input file\n");
-		BIO_printf (bio_err, "-out file	output file\n");
-		BIO_printf (bio_err, "-topk8    output PKCS8 file\n");
-		BIO_printf (bio_err, "-nooct    use (broken) no octet form\n");
-		BIO_printf (bio_err, "-noiter   use 1 as iteration cound\n");
+		bad:
+		BIO_printf(bio_err, "Usage pkcs8 [options]\n");
+		BIO_printf(bio_err, "where options are\n");
+		BIO_printf(bio_err, "-in file   input file\n");
+		BIO_printf(bio_err, "-inform X  input format (DER or PEM)\n");
+		BIO_printf(bio_err, "-passin arg     input file pass phrase\n");
+		BIO_printf(bio_err, "-envpassin arg  environment variable containing input file pass phrase\n");
+		BIO_printf(bio_err, "-outform X output format (DER or PEM)\n");
+		BIO_printf(bio_err, "-out file  output file\n");
+		BIO_printf(bio_err, "-passout arg    input file pass phrase\n");
+		BIO_printf(bio_err, "-envpassout arg environment variable containing input file pass phrase\n");
+		BIO_printf(bio_err, "-topk8     output PKCS8 file\n");
+		BIO_printf(bio_err, "-nooct     use (broken) no octet form\n");
+		BIO_printf(bio_err, "-noiter    use 1 as iteration count\n");
+		BIO_printf(bio_err, "-nocrypt   use or expect unencrypted private key\n");
+		BIO_printf(bio_err, "-v2 alg    use PKCS#5 v2.0 and cipher \"alg\"\n");
+		BIO_printf(bio_err, "-v1 obj    use PKCS#5 v1.5 and cipher \"alg\"\n");
 		return (1);
 	}
 
-	if (pbe_nid == -1) pbe_nid = NID_pbeWithMD5AndDES_CBC;
+	if ((pbe_nid == -1) && !cipher) pbe_nid = NID_pbeWithMD5AndDES_CBC;
 
 	if (infile) {
-		if (!(in = BIO_new_file (infile, "rb"))) {
-			BIO_printf (bio_err,
+		if (!(in = BIO_new_file(infile, "rb"))) {
+			BIO_printf(bio_err,
 				 "Can't open input file %s\n", infile);
 			return (1);
 		}
@@ -136,53 +203,103 @@ int MAIN(int argc, char **argv)
 
 	if (outfile) {
 		if (!(out = BIO_new_file (outfile, "wb"))) {
-			BIO_printf (bio_err,
+			BIO_printf(bio_err,
 				 "Can't open output file %s\n", outfile);
 			return (1);
 		}
 	} else out = BIO_new_fp (stdout, BIO_NOCLOSE);
 
 	if (topk8) {
-		if (!(pkey = PEM_read_bio_PrivateKey(in, NULL, NULL))) {
-			BIO_printf (bio_err, "Error reading key\n", outfile);
+		if(informat == FORMAT_PEM)
+			pkey = PEM_read_bio_PrivateKey(in, NULL, PEM_cb, passin);
+		else if(informat == FORMAT_ASN1)
+			pkey = d2i_PrivateKey_bio(in, NULL);
+		else {
+			BIO_printf(bio_err, "Bad format specified for key\n");
+			return (1);
+		}
+		if (!pkey) {
+			BIO_printf(bio_err, "Error reading key\n", outfile);
 			ERR_print_errors(bio_err);
 			return (1);
 		}
+		BIO_free(in);
 		if (!(p8inf = EVP_PKEY2PKCS8(pkey))) {
-			BIO_printf (bio_err, "Error converting key\n", outfile);
+			BIO_printf(bio_err, "Error converting key\n", outfile);
 			ERR_print_errors(bio_err);
 			return (1);
 		}
 		PKCS8_set_broken(p8inf, p8_broken);
-		EVP_read_pw_string(pass, 50, "Enter Encryption Password:", 1);
-		if (!(p8 = PKCS8_encrypt(pbe_nid, pass, strlen(pass),
-				 NULL, 0, iter, p8inf))) {
-			BIO_printf (bio_err, "Error encrypting key\n", outfile);
-			ERR_print_errors(bio_err);
-			return (1);
+		if(nocrypt) {
+			if(outformat == FORMAT_PEM) 
+				PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf);
+			else if(outformat == FORMAT_ASN1)
+				i2d_PKCS8_PRIV_KEY_INFO_bio(out, p8inf);
+			else {
+				BIO_printf(bio_err, "Bad format specified for key\n");
+				return (1);
+			}
+		} else {
+			if(!passout) {
+				passout = pass;
+				EVP_read_pw_string(pass, 50, "Enter Encryption Password:", 1);
+			}
+			if (!(p8 = PKCS8_encrypt(pbe_nid, cipher,
+					passout, strlen(passout),
+					NULL, 0, iter, p8inf))) {
+				BIO_printf(bio_err, "Error encrypting key\n",
+								 outfile);
+				ERR_print_errors(bio_err);
+				return (1);
+			}
+			if(outformat == FORMAT_PEM) 
+				PEM_write_bio_PKCS8(out, p8);
+			else if(outformat == FORMAT_ASN1)
+				i2d_PKCS8_bio(out, p8);
+			else {
+				BIO_printf(bio_err, "Bad format specified for key\n");
+				return (1);
+			}
+			X509_SIG_free(p8);
 		}
 		PKCS8_PRIV_KEY_INFO_free (p8inf);
-		PEM_write_bio_PKCS8 (out, p8);
-		X509_SIG_free(p8);
+		EVP_PKEY_free(pkey);
+		BIO_free(out);
 		return (0);
 	}
 
-	if(informat == FORMAT_PEM) 
-		p8 = PEM_read_bio_PKCS8(in, NULL, NULL);
-	else if(informat == FORMAT_ASN1)
-		p8 = d2i_PKCS8_bio(in, NULL);
-	else {
-		BIO_printf(bio_err, "Bad input format specified for key\n");
-		return (1);
-	}
+	if(nocrypt) {
+		if(informat == FORMAT_PEM) 
+			p8inf = PEM_read_bio_PKCS8_PRIV_KEY_INFO(in,NULL,NULL, NULL);
+		else if(informat == FORMAT_ASN1)
+			p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(in, NULL);
+		else {
+			BIO_printf(bio_err, "Bad format specified for key\n");
+			return (1);
+		}
+	} else {
+		if(informat == FORMAT_PEM) 
+			p8 = PEM_read_bio_PKCS8(in, NULL, NULL, NULL);
+		else if(informat == FORMAT_ASN1)
+			p8 = d2i_PKCS8_bio(in, NULL);
+		else {
+			BIO_printf(bio_err, "Bad format specified for key\n");
+			return (1);
+		}
 
-	if (!p8) {
-		BIO_printf (bio_err, "Error reading key\n", outfile);
-		ERR_print_errors(bio_err);
-		return (1);
+		if (!p8) {
+			BIO_printf (bio_err, "Error reading key\n", outfile);
+			ERR_print_errors(bio_err);
+			return (1);
+		}
+		if(!passin) {
+			passin = pass;
+			EVP_read_pw_string(pass, 50, "Enter Password:", 0);
+		}
+		p8inf = M_PKCS8_decrypt(p8, passin, strlen(passin));
+		X509_SIG_free(p8);
 	}
-	EVP_read_pw_string(pass, 50, "Enter Password:", 0);
-	p8inf = M_PKCS8_decrypt(p8, pass, strlen(pass));
+
 	if (!p8inf) {
 		BIO_printf(bio_err, "Error decrypting key\n", outfile);
 		ERR_print_errors(bio_err);
@@ -209,8 +326,18 @@ int MAIN(int argc, char **argv)
 	}
 	
 	PKCS8_PRIV_KEY_INFO_free(p8inf);
+	if(outformat == FORMAT_PEM) 
+		PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, PEM_cb, passout);
+	else if(outformat == FORMAT_ASN1)
+		i2d_PrivateKey_bio(out, pkey);
+	else {
+		BIO_printf(bio_err, "Bad format specified for key\n");
+			return (1);
+	}
 
-	PEM_write_bio_PrivateKey (out, pkey, NULL, NULL, 0, NULL);
+	EVP_PKEY_free(pkey);
+	BIO_free(out);
+	BIO_free(in);
 
 	return (0);
 }