Fix a typo in apps/pkcs12.c which was using the wrong part of
[openssl.git] / apps / pkcs12.c
index 88816c9..070993d 100644 (file)
@@ -1,4 +1,6 @@
 /* pkcs12.c */
+#if !defined(NO_DES) && !defined(NO_SHA1)
+
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
  * project 1999.
  */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <openssl/des.h>
-#include <openssl/pem.h>
+#include "apps.h"
+#include <openssl/crypto.h>
 #include <openssl/err.h>
+#include <openssl/pem.h>
 #include <openssl/pkcs12.h>
 
-#include "apps.h"
 #define PROG pkcs12_main
 
 EVP_CIPHER *enc;
@@ -76,15 +78,18 @@ EVP_CIPHER *enc;
 #define CLCERTS                0x8
 #define CACERTS                0x10
 
-int get_cert_chain(X509 *cert, STACK **chain);
-int dump_cert_text (BIO *out, X509 *x);
-int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int options);
-int dump_certs_pkeys_bags(BIO *out, STACK *bags, char *pass, int passlen, int options);
-int dump_certs_pkeys_bag(BIO *out, PKCS12_SAFEBAG *bags, char *pass, int passlen, int options);
-int print_attribs(BIO *out, STACK *attrlst, char *name);
+int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain);
+int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int options, char *pempass);
+int dump_certs_pkeys_bags(BIO *out, STACK_OF(PKCS12_SAFEBAG) *bags, char *pass,
+                         int passlen, int options, char *pempass);
+int dump_certs_pkeys_bag(BIO *out, PKCS12_SAFEBAG *bags, char *pass, int passlen, int options, char *pempass);
+int print_attribs(BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst, char *name);
 void hex_prin(BIO *out, unsigned char *buf, int len);
 int alg_print(BIO *x, X509_ALGOR *alg);
-int cert_load(BIO *in, STACK *sk);
+int cert_load(BIO *in, STACK_OF(X509) *sk);
+
+int MAIN(int, char **);
+
 int MAIN(int argc, char **argv)
 {
     char *infile=NULL, *outfile=NULL, *keyname = NULL; 
@@ -99,15 +104,20 @@ int MAIN(int argc, char **argv)
     int chain = 0;
     int badarg = 0;
     int iter = PKCS12_DEFAULT_ITER;
-    int maciter = 1;
+    int maciter = PKCS12_DEFAULT_ITER;
     int twopass = 0;
     int keytype = 0;
     int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
+    int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
     int ret = 1;
     int macver = 1;
     int noprompt = 0;
     STACK *canames = NULL;
     char *cpass = NULL, *mpass = NULL;
+    char *passargin = NULL, *passargout = NULL, *passarg = NULL;
+    char *passin = NULL, *passout = NULL;
+    char *inrand = NULL;
+    char *CApath = NULL, *CAfile = NULL;
 
     apps_startup();
 
@@ -141,8 +151,35 @@ int MAIN(int argc, char **argv)
                else if (!strcmp (*args, "-noiter")) iter = 1;
                else if (!strcmp (*args, "-maciter"))
                                         maciter = PKCS12_DEFAULT_ITER;
+               else if (!strcmp (*args, "-nomaciter"))
+                                        maciter = 1;
                else if (!strcmp (*args, "-nodes")) enc=NULL;
-               else if (!strcmp (*args, "-inkey")) {
+               else if (!strcmp (*args, "-certpbe")) {
+                       if (args[1]) {
+                               args++;
+                               cert_pbe=OBJ_txt2nid(*args);
+                               if(cert_pbe == NID_undef) {
+                                       BIO_printf(bio_err,
+                                                "Unknown PBE algorithm %s\n", *args);
+                                       badarg = 1;
+                               }
+                       } else badarg = 1;
+               } else if (!strcmp (*args, "-keypbe")) {
+                       if (args[1]) {
+                               args++;
+                               key_pbe=OBJ_txt2nid(*args);
+                               if(key_pbe == NID_undef) {
+                                       BIO_printf(bio_err,
+                                                "Unknown PBE algorithm %s\n", *args);
+                                       badarg = 1;
+                               }
+                       } else badarg = 1;
+               } else if (!strcmp (*args, "-rand")) {
+                   if (args[1]) {
+                       args++; 
+                       inrand = *args;
+                   } else badarg = 1;
+               } else if (!strcmp (*args, "-inkey")) {
                    if (args[1]) {
                        args++; 
                        keyname = *args;
@@ -160,7 +197,7 @@ int MAIN(int argc, char **argv)
                } else if (!strcmp (*args, "-caname")) {
                    if (args[1]) {
                        args++; 
-                       if (!canames) canames = sk_new(NULL);
+                       if (!canames) canames = sk_new_null();
                        sk_push(canames, *args);
                    } else badarg = 1;
                } else if (!strcmp (*args, "-in")) {
@@ -173,22 +210,32 @@ int MAIN(int argc, char **argv)
                        args++; 
                        outfile = *args;
                    } else badarg = 1;
-               } else if (!strcmp (*args, "-envpass")) {
+               } else if (!strcmp(*args,"-passin")) {
                    if (args[1]) {
                        args++; 
-                       if(!(cpass = getenv(*args))) {
-                               BIO_printf(bio_err,
-                                "Can't read environment variable %s\n", *args);
-                               goto end;
-                       }
-                       noprompt = 1;
+                       passargin = *args;
+                   } else badarg = 1;
+               } else if (!strcmp(*args,"-passout")) {
+                   if (args[1]) {
+                       args++; 
+                       passargout = *args;
                    } else badarg = 1;
                } else if (!strcmp (*args, "-password")) {
                    if (args[1]) {
                        args++; 
-                       cpass = *args;
+                       passarg = *args;
                        noprompt = 1;
                    } else badarg = 1;
+               } else if (!strcmp(*args,"-CApath")) {
+                   if (args[1]) {
+                       args++; 
+                       CApath = *args;
+                   } else badarg = 1;
+               } else if (!strcmp(*args,"-CAfile")) {
+                   if (args[1]) {
+                       args++; 
+                       CAfile = *args;
+                   } else badarg = 1;
                } else badarg = 1;
 
        } else badarg = 1;
@@ -202,6 +249,8 @@ int MAIN(int argc, char **argv)
        BIO_printf (bio_err, "-chain        add certificate chain\n");
        BIO_printf (bio_err, "-inkey file   private key if not infile\n");
        BIO_printf (bio_err, "-certfile f   add all certs in f\n");
+       BIO_printf (bio_err, "-CApath arg   - PEM format directory of CA's\n");
+       BIO_printf (bio_err, "-CAfile arg   - PEM format file of CA's\n");
        BIO_printf (bio_err, "-name \"name\"  use name as friendly name\n");
        BIO_printf (bio_err, "-caname \"nm\"  use nm as CA friendly name (can be used more than once).\n");
        BIO_printf (bio_err, "-in  infile   input filename\n");
@@ -223,202 +272,330 @@ int MAIN(int argc, char **argv)
        BIO_printf (bio_err, "-maciter      use MAC iteration\n");
        BIO_printf (bio_err, "-twopass      separate MAC, encryption passwords\n");
        BIO_printf (bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
+       BIO_printf (bio_err, "-certpbe alg  specify certificate PBE algorithm (default RC2-40)\n");
+       BIO_printf (bio_err, "-keypbe alg   specify private key PBE algorithm (default 3DES)\n");
        BIO_printf (bio_err, "-keyex        set MS key exchange type\n");
        BIO_printf (bio_err, "-keysig       set MS key signature type\n");
-       BIO_printf (bio_err, "-password p   set import/export password (NOT RECOMMENDED)\n");
-       BIO_printf (bio_err, "-envpass p    set import/export password from environment\n");
+       BIO_printf (bio_err, "-password p   set import/export password source\n");
+       BIO_printf (bio_err, "-passin p     input file pass phrase source\n");
+       BIO_printf (bio_err, "-passout p    output file pass phrase source\n");
+       BIO_printf(bio_err,  "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+       BIO_printf(bio_err,  "              load the file (or the files in the directory) into\n");
+       BIO_printf(bio_err,  "              the random number generator\n");
        goto end;
     }
 
-    if(cpass) mpass = cpass;
-    else {
+    if(passarg) {
+       if(export_cert) passargout = passarg;
+       else passargin = passarg;
+    }
+
+    if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
+       BIO_printf(bio_err, "Error getting passwords\n");
+       goto end;
+    }
+
+    if(!cpass) {
+       if(export_cert) cpass = passout;
+       else cpass = passin;
+    }
+
+    if(cpass) {
+       mpass = cpass;
+       noprompt = 1;
+    } else {
        cpass = pass;
        mpass = macpass;
     }
 
+    if(export_cert || inrand) {
+       app_RAND_load_file(NULL, bio_err, (inrand != NULL));
+        if (inrand != NULL)
+               BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
+                       app_RAND_load_files(inrand));
+    }
     ERR_load_crypto_strings();
 
-    in = BIO_new (BIO_s_file());
-    out = BIO_new (BIO_s_file());
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("read files");
+#endif
 
-    if (!infile) BIO_set_fp (in, stdin, BIO_NOCLOSE);
-    else {
-        if (BIO_read_filename (in, infile) <= 0) {
+    if (!infile) in = BIO_new_fp(stdin, BIO_NOCLOSE);
+    else in = BIO_new_file(infile, "rb");
+    if (!in) {
+           BIO_printf(bio_err, "Error opening input file %s\n",
+                                               infile ? infile : "<stdin>");
            perror (infile);
            goto end;
-       }
-    }
+   }
 
    if (certfile) {
-       certsin = BIO_new (BIO_s_file());
-        if (BIO_read_filename (certsin, certfile) <= 0) {
+       if(!(certsin = BIO_new_file(certfile, "r"))) {
+           BIO_printf(bio_err, "Can't open certificate file %s\n", certfile);
            perror (certfile);
            goto end;
        }
     }
 
     if (keyname) {
-       inkey = BIO_new (BIO_s_file());
-        if (BIO_read_filename (inkey, keyname) <= 0) {
+       if(!(inkey = BIO_new_file(keyname, "r"))) {
+           BIO_printf(bio_err, "Can't key certificate file %s\n", keyname);
            perror (keyname);
            goto end;
        }
      }
 
-    if (!outfile) BIO_set_fp (out, stdout, BIO_NOCLOSE);
-    else {
-        if (BIO_write_filename (out, outfile) <= 0) {
-           perror (outfile);
-           goto end;
-       }
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+    CRYPTO_push_info("write files");
+#endif
+
+    if (!outfile) out = BIO_new_fp(stdout, BIO_NOCLOSE);
+    else out = BIO_new_file(outfile, "wb");
+    if (!out) {
+       BIO_printf(bio_err, "Error opening output file %s\n",
+                                               outfile ? outfile : "<stdout>");
+       perror (outfile);
+       goto end;
     }
     if (twopass) {
-       if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert)) {
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("read MAC password");
+#endif
+       if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert))
+       {
            BIO_printf (bio_err, "Can't read Password\n");
            goto end;
                }
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
     }
 
-if (export_cert) {
-       EVP_PKEY *key;
-       STACK *bags, *safes;
-       PKCS12_SAFEBAG *bag;
-       PKCS8_PRIV_KEY_INFO *p8;
-       PKCS7 *authsafe;
-       X509 *cert, *ucert = NULL;
-       STACK *certs;
-       char *catmp;
-       int i, pmatch = 0;
+    if (export_cert) {
+       EVP_PKEY *key = NULL;
+       STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
+       STACK_OF(PKCS7) *safes = NULL;
+       PKCS12_SAFEBAG *bag = NULL;
+       PKCS8_PRIV_KEY_INFO *p8 = NULL;
+       PKCS7 *authsafe = NULL;
+       X509 *ucert = NULL;
+       STACK_OF(X509) *certs=NULL;
+       char *catmp = NULL;
+       int i;
        unsigned char keyid[EVP_MAX_MD_SIZE];
-       unsigned int keyidlen;
-       /* Get private key so we can match it to a certificate */
-       key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL);
-       if (!inkey) BIO_reset(in);
+       unsigned int keyidlen = 0;
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_push_info("process -export_cert");
+       CRYPTO_push_info("reading private key");
+#endif
+       key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, passin);
+       if (!inkey) (void) BIO_reset(in);
+       else BIO_free(inkey);
        if (!key) {
                BIO_printf (bio_err, "Error loading private key\n");
                ERR_print_errors(bio_err);
-               goto end;
+               goto export_end;
        }
 
-       certs = sk_new(NULL);
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("reading certs from input");
+#endif
+
+       certs = sk_X509_new_null();
 
        /* Load in all certs in input file */
        if(!cert_load(in, certs)) {
                BIO_printf(bio_err, "Error loading certificates from input\n");
                ERR_print_errors(bio_err);
-               goto end;
+               goto export_end;
+       }
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("reading certs from input 2");
+#endif
+
+       for(i = 0; i < sk_X509_num(certs); i++) {
+               ucert = sk_X509_value(certs, i);
+               if(X509_check_private_key(ucert, key)) {
+                       X509_digest(ucert, EVP_sha1(), keyid, &keyidlen);
+                       break;
+               }
+       }
+       if(!keyidlen) {
+               ucert = NULL;
+               BIO_printf(bio_err, "No certificate matches private key\n");
+               goto export_end;
        }
        
-       bags = sk_new (NULL);
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("reading certs from certfile");
+#endif
+
+       bags = sk_PKCS12_SAFEBAG_new_null ();
 
        /* Add any more certificates asked for */
        if (certsin) {
                if(!cert_load(certsin, certs)) {
                        BIO_printf(bio_err, "Error loading certificates from certfile\n");
                        ERR_print_errors(bio_err);
-                       goto end;
+                       goto export_end;
                }
                BIO_free(certsin);
        }
 
-       /* Find certificate (if any) matching private key */
-
-       for(i = 0; i < sk_num(certs); i++) {
-                       cert = (X509 *)sk_value(certs, i);
-                       if(X509_check_private_key(cert, key)) {
-                               ucert = cert;
-                               break;
-                       }
-       }
-
-       if(!ucert) {
-               BIO_printf(bio_err, "No certificate matches private key\n");
-               goto end;
-       }
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("building chain");
+#endif
 
        /* If chaining get chain from user cert */
        if (chain) {
                int vret;
-               STACK *chain2;
-                       
-               vret = get_cert_chain (ucert, &chain2);
+               STACK_OF(X509) *chain2;
+               X509_STORE *store = X509_STORE_new();
+               if (!store)
+                       {
+                       BIO_printf (bio_err, "Memory allocation error\n");
+                       goto export_end;
+                       }
+               if (!X509_STORE_load_locations(store, CAfile, CApath))
+                       X509_STORE_set_default_paths (store);
+
+               vret = get_cert_chain (ucert, store, &chain2);
+               X509_STORE_free(store);
+
+               if (!vret) {
+                   /* Exclude verified certificate */
+                   for (i = 1; i < sk_X509_num (chain2) ; i++) 
+                       sk_X509_push(certs, sk_X509_value (chain2, i));
+               }
+               sk_X509_free(chain2);
                if (vret) {
                        BIO_printf (bio_err, "Error %s getting chain.\n",
                                        X509_verify_cert_error_string(vret));
-                       goto end;
-               }
-               /* Exclude verified certificate */
-               for (i = 1; i < sk_num (chain2) ; i++) 
-                                sk_push(certs, sk_value (chain2, i));
-               sk_free(chain2);
-                       
+                       goto export_end;
+               }                       
        }
 
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("building bags");
+#endif
+
        /* We now have loads of certificates: include them all */
-       for(i = 0; i < sk_num(certs); i++) {
-               cert = (X509 *)sk_value(certs, i);
+       for(i = 0; i < sk_X509_num(certs); i++) {
+               X509 *cert = NULL;
+               cert = sk_X509_value(certs, i);
                bag = M_PKCS12_x5092certbag(cert);
-               /* If it matches private key mark it */
+               /* If it matches private key set id */
                if(cert == ucert) {
                        if(name) PKCS12_add_friendlyname(bag, name, -1);
-                       X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
                        PKCS12_add_localkeyid(bag, keyid, keyidlen);
-                       pmatch = 1;
                } else if((catmp = sk_shift(canames))) 
                                PKCS12_add_friendlyname(bag, catmp, -1);
-               sk_push(bags, (char *)bag);
+               sk_PKCS12_SAFEBAG_push(bags, bag);
        }
-
-       if (canames) sk_free(canames);
+       sk_X509_pop_free(certs, X509_free);
+       certs = NULL;
+       /* ucert is part of certs so it is already freed */
+       ucert = NULL;
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("encrypting bags");
+#endif
 
        if(!noprompt &&
                EVP_read_pw_string(pass, 50, "Enter Export Password:", 1)) {
            BIO_printf (bio_err, "Can't read Password\n");
-           goto end;
+           goto export_end;
         }
        if (!twopass) strcpy(macpass, pass);
        /* Turn certbags into encrypted authsafe */
-       authsafe = PKCS12_pack_p7encdata (cert_pbe, cpass, -1, NULL, 0,
+       authsafe = PKCS12_pack_p7encdata(cert_pbe, cpass, -1, NULL, 0,
                                                                 iter, bags);
-       sk_pop_free(bags, PKCS12_SAFEBAG_free);
+       sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+       bags = NULL;
 
        if (!authsafe) {
                ERR_print_errors (bio_err);
-               goto end;
+               goto export_end;
        }
 
-       safes = sk_new (NULL);
-       sk_push (safes, (char *)authsafe);
+       safes = sk_PKCS7_new_null ();
+       sk_PKCS7_push (safes, authsafe);
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("building shrouded key bag");
+#endif
 
        /* Make a shrouded key bag */
        p8 = EVP_PKEY2PKCS8 (key);
-       EVP_PKEY_free(key);
        if(keytype) PKCS8_add_keyusage(p8, keytype);
-       bag = PKCS12_MAKE_SHKEYBAG (NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
-                       cpass, -1, NULL, 0, iter, p8);
+       bag = PKCS12_MAKE_SHKEYBAG(key_pbe, cpass, -1, NULL, 0, iter, p8);
        PKCS8_PRIV_KEY_INFO_free(p8);
+       p8 = NULL;
         if (name) PKCS12_add_friendlyname (bag, name, -1);
-       if(pmatch) PKCS12_add_localkeyid (bag, keyid, keyidlen);
-       bags = sk_new(NULL);
-       sk_push (bags, (char *)bag);
+       PKCS12_add_localkeyid (bag, keyid, keyidlen);
+       bags = sk_PKCS12_SAFEBAG_new_null();
+       sk_PKCS12_SAFEBAG_push (bags, bag);
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("encrypting shrouded key bag");
+#endif
+
        /* Turn it into unencrypted safe bag */
        authsafe = PKCS12_pack_p7data (bags);
-       sk_pop_free(bags, PKCS12_SAFEBAG_free);
-       sk_push (safes, (char *)authsafe);
+       sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+       bags = NULL;
+       sk_PKCS7_push (safes, authsafe);
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("building pkcs12");
+#endif
 
        p12 = PKCS12_init (NID_pkcs7_data);
 
        M_PKCS12_pack_authsafes (p12, safes);
 
-       sk_pop_free(safes, PKCS7_free);
+       sk_PKCS7_pop_free(safes, PKCS7_free);
+       safes = NULL;
 
        PKCS12_set_mac (p12, mpass, -1, NULL, 0, maciter, NULL);
 
-       i2d_PKCS12_bio (out, p12);
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_push_info("writing pkcs12");
+#endif
 
-       PKCS12_free(p12);
+       i2d_PKCS12_bio (out, p12);
 
        ret = 0;
+
+    export_end:
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+       CRYPTO_pop_info();
+       CRYPTO_push_info("process -export_cert: freeing");
+#endif
+
+       if (key) EVP_PKEY_free(key);
+       if (certs) sk_X509_pop_free(certs, X509_free);
+       if (safes) sk_PKCS7_pop_free(safes, PKCS7_free);
+       if (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+       if (ucert) X509_free(ucert);
+
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+#endif
        goto end;
        
     }
@@ -428,57 +605,76 @@ if (export_cert) {
        goto end;
     }
 
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("read import password");
+#endif
     if(!noprompt && EVP_read_pw_string(pass, 50, "Enter Import Password:", 0)) {
        BIO_printf (bio_err, "Can't read Password\n");
        goto end;
     }
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
 
     if (!twopass) strcpy(macpass, pass);
 
     if (options & INFO) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);
     if(macver) {
-       if (!PKCS12_verify_mac (p12, mpass, -1)) {
-           BIO_printf (bio_err, "Mac verify errror: invalid password?\n");
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("verify MAC");
+#endif
+       /* If we enter empty password try no password first */
+       if(!macpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
+               /* If mac and crypto pass the same set it to NULL too */
+               if(!twopass) cpass = NULL;
+       } else if (!PKCS12_verify_mac(p12, mpass, -1)) {
+           BIO_printf (bio_err, "Mac verify error: invalid password?\n");
            ERR_print_errors (bio_err);
            goto end;
-       } else BIO_printf (bio_err, "MAC verified OK\n");
+       }
+       BIO_printf (bio_err, "MAC verified OK\n");
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
     }
 
-    if (!dump_certs_keys_p12 (out, p12, cpass, -1, options)) {
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_push_info("output keys and certificates");
+#endif
+    if (!dump_certs_keys_p12 (out, p12, cpass, -1, options, passout)) {
        BIO_printf(bio_err, "Error outputting keys and certificates\n");
        ERR_print_errors (bio_err);
        goto end;
     }
-    PKCS12_free(p12);
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_pop_info();
+#endif
     ret = 0;
-    end:
+ end:
+    if (p12) PKCS12_free(p12);
+    if(export_cert || inrand) app_RAND_write_file(NULL, bio_err);
+#ifdef CRYPTO_MDEBUG
+    CRYPTO_remove_all_info();
+#endif
+    BIO_free(in);
     BIO_free(out);
+    if (canames) sk_free(canames);
+    if(passin) OPENSSL_free(passin);
+    if(passout) OPENSSL_free(passout);
     EXIT(ret);
 }
 
-int dump_cert_text (BIO *out, X509 *x)
-{
-       char buf[256];
-       X509_NAME_oneline(X509_get_subject_name(x),buf,256);
-       BIO_puts(out,"subject=");
-       BIO_puts(out,buf);
-
-       X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
-       BIO_puts(out,"\nissuer= ");
-       BIO_puts(out,buf);
-       BIO_puts(out,"\n");
-        return 0;
-}
-
 int dump_certs_keys_p12 (BIO *out, PKCS12 *p12, char *pass,
-            int passlen, int options)
+            int passlen, int options, char *pempass)
 {
-       STACK *asafes, *bags;
+       STACK_OF(PKCS7) *asafes;
+       STACK_OF(PKCS12_SAFEBAG) *bags;
        int i, bagnid;
        PKCS7 *p7;
+
        if (!( asafes = M_PKCS12_unpack_authsafes (p12))) return 0;
-       for (i = 0; i < sk_num (asafes); i++) {
-               p7 = (PKCS7 *) sk_value (asafes, i);
+       for (i = 0; i < sk_PKCS7_num (asafes); i++) {
+               p7 = sk_PKCS7_value (asafes, i);
                bagnid = OBJ_obj2nid (p7->type);
                if (bagnid == NID_pkcs7_data) {
                        bags = M_PKCS12_unpack_p7data (p7);
@@ -493,30 +689,32 @@ int dump_certs_keys_p12 (BIO *out, PKCS12 *p12, char *pass,
                } else continue;
                if (!bags) return 0;
                if (!dump_certs_pkeys_bags (out, bags, pass, passlen, 
-                                                        options)) {
-                       sk_pop_free (bags, PKCS12_SAFEBAG_free);
+                                                options, pempass)) {
+                       sk_PKCS12_SAFEBAG_pop_free (bags, PKCS12_SAFEBAG_free);
                        return 0;
                }
-               sk_pop_free (bags, PKCS12_SAFEBAG_free);
+               sk_PKCS12_SAFEBAG_pop_free (bags, PKCS12_SAFEBAG_free);
        }
-       sk_pop_free (asafes, PKCS7_free);
+       sk_PKCS7_pop_free (asafes, PKCS7_free);
        return 1;
 }
 
-int dump_certs_pkeys_bags (BIO *out, STACK *bags, char *pass,
-            int passlen, int options)
+int dump_certs_pkeys_bags (BIO *out, STACK_OF(PKCS12_SAFEBAG) *bags,
+                          char *pass, int passlen, int options, char *pempass)
 {
        int i;
-       for (i = 0; i < sk_num (bags); i++) {
+       for (i = 0; i < sk_PKCS12_SAFEBAG_num (bags); i++) {
                if (!dump_certs_pkeys_bag (out,
-                        (PKCS12_SAFEBAG *)sk_value (bags, i), pass, passlen,
-                                                       options)) return 0;
+                                          sk_PKCS12_SAFEBAG_value (bags, i),
+                                          pass, passlen,
+                                          options, pempass))
+                   return 0;
        }
        return 1;
 }
 
 int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
-            int passlen, int options)
+            int passlen, int options, char *pempass)
 {
        EVP_PKEY *pkey;
        PKCS8_PRIV_KEY_INFO *p8;
@@ -531,7 +729,7 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
                p8 = bag->value.keybag;
                if (!(pkey = EVP_PKCS82PKEY (p8))) return 0;
                print_attribs (out, p8->attributes, "Key Attributes");
-               PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL);
+               PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL, pempass);
                EVP_PKEY_free(pkey);
        break;
 
@@ -547,7 +745,7 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
                if (!(pkey = EVP_PKCS82PKEY (p8))) return 0;
                print_attribs (out, p8->attributes, "Key Attributes");
                PKCS8_PRIV_KEY_INFO_free(p8);
-               PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL);
+               PEM_write_bio_PrivateKey (out, pkey, enc, NULL, 0, NULL, pempass);
                EVP_PKEY_free(pkey);
        break;
 
@@ -570,7 +768,7 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
                if (options & INFO) BIO_printf (bio_err, "Safe Contents bag\n");
                print_attribs (out, bag->attrib, "Bag Attributes");
                return dump_certs_pkeys_bags (out, bag->value.safes, pass,
-                                                           passlen, options);
+                                                           passlen, options, pempass);
                                        
        default:
                BIO_printf (bio_err, "Warning unsupported bag type: ");
@@ -586,30 +784,22 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass,
 
 /* Hope this is OK .... */
 
-int get_cert_chain (X509 *cert, STACK **chain)
+int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain)
 {
-       X509_STORE *store;
        X509_STORE_CTX store_ctx;
-       STACK *chn;
+       STACK_OF(X509) *chn;
        int i;
-       X509 *x;
-       store = X509_STORE_new ();
-       X509_STORE_set_default_paths (store);
+
        X509_STORE_CTX_init(&store_ctx, store, cert, NULL);
        if (X509_verify_cert(&store_ctx) <= 0) {
                i = X509_STORE_CTX_get_error (&store_ctx);
                goto err;
        }
-       chn =  sk_dup(X509_STORE_CTX_get_chain (&store_ctx));
-       for (i = 0; i < sk_num(chn); i++) {
-               x = (X509 *)sk_value(chn, i);
-               CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
-       }
+       chn =  X509_STORE_CTX_get1_chain(&store_ctx);
        i = 0;
        *chain = chn;
 err:
        X509_STORE_CTX_cleanup(&store_ctx);
-       X509_STORE_free(store);
        
        return i;
 }      
@@ -628,22 +818,34 @@ int alg_print (BIO *x, X509_ALGOR *alg)
 
 /* Load all certificates from a given file */
 
-int cert_load(BIO *in, STACK *sk)
+int cert_load(BIO *in, STACK_OF(X509) *sk)
 {
        int ret;
        X509 *cert;
        ret = 0;
-       while((cert = PEM_read_bio_X509(in, NULL, NULL))) {
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_push_info("cert_load(): reading one cert");
+#endif
+       while((cert = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
+#ifdef CRYPTO_MDEBUG
+               CRYPTO_pop_info();
+#endif
                ret = 1;
-               sk_push(sk, (char *)cert);
+               sk_X509_push(sk, cert);
+#ifdef CRYPTO_MDEBUG
+               CRYPTO_push_info("cert_load(): reading one cert");
+#endif
        }
+#ifdef CRYPTO_MDEBUG
+       CRYPTO_pop_info();
+#endif
        if(ret) ERR_clear_error();
        return ret;
 }
 
 /* Generalised attribute print: handle PKCS#8 and bag attributes */
 
-int print_attribs (BIO *out, STACK *attrlst, char *name)
+int print_attribs (BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst, char *name)
 {
        X509_ATTRIBUTE *attr;
        ASN1_TYPE *av;
@@ -653,13 +855,13 @@ int print_attribs (BIO *out, STACK *attrlst, char *name)
                BIO_printf(out, "%s: <No Attributes>\n", name);
                return 1;
        }
-       if(!sk_num(attrlst)) {
+       if(!sk_X509_ATTRIBUTE_num(attrlst)) {
                BIO_printf(out, "%s: <Empty Attributes>\n", name);
                return 1;
        }
        BIO_printf(out, "%s\n", name);
-       for(i = 0; i < sk_num(attrlst); i++) {
-               attr = (X509_ATTRIBUTE *) sk_value(attrlst, i);
+       for(i = 0; i < sk_X509_ATTRIBUTE_num(attrlst); i++) {
+               attr = sk_X509_ATTRIBUTE_value(attrlst, i);
                attr_nid = OBJ_obj2nid(attr->object);
                BIO_printf(out, "    ");
                if(attr_nid == NID_undef) {
@@ -674,18 +876,18 @@ int print_attribs (BIO *out, STACK *attrlst, char *name)
                                value = uni2asc(av->value.bmpstring->data,
                                               av->value.bmpstring->length);
                                BIO_printf(out, "%s\n", value);
-                               Free(value);
+                               OPENSSL_free(value);
                                break;
 
                                case V_ASN1_OCTET_STRING:
-                               hex_prin(out, av->value.bit_string->data,
-                                       av->value.bit_string->length);
+                               hex_prin(out, av->value.octet_string->data,
+                                       av->value.octet_string->length);
                                BIO_printf(out, "\n");  
                                break;
 
                                case V_ASN1_BIT_STRING:
-                               hex_prin(out, av->value.octet_string->data,
-                                       av->value.octet_string->length);
+                               hex_prin(out, av->value.bit_string->data,
+                                       av->value.bit_string->length);
                                BIO_printf(out, "\n");  
                                break;
 
@@ -703,3 +905,5 @@ void hex_prin(BIO *out, unsigned char *buf, int len)
        int i;
        for (i = 0; i < len; i++) BIO_printf (out, "%02X ", buf[i]);
 }
+
+#endif