- int ret = 1;
- int macver = 1;
- int noprompt = 0;
- STACK *canames = NULL;
- char *cpass = NULL, *mpass = NULL;
- char *passargin = NULL, *passargout = NULL, *passarg = NULL;
- char *passin = NULL, *passout = NULL;
- char *inrand = NULL;
- char *CApath = NULL, *CAfile = NULL;
-#ifndef OPENSSL_NO_ENGINE
- char *engine=NULL;
-#endif
-
- apps_startup();
-
- enc = EVP_des_ede3_cbc();
- if (bio_err == NULL ) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
-
- if (!load_config(bio_err, NULL))
- goto end;
-
- args = argv + 1;
-
-
- while (*args) {
- if (*args[0] == '-') {
- if (!strcmp (*args, "-nokeys")) options |= NOKEYS;
- else if (!strcmp (*args, "-keyex")) keytype = KEY_EX;
- else if (!strcmp (*args, "-keysig")) keytype = KEY_SIG;
- else if (!strcmp (*args, "-nocerts")) options |= NOCERTS;
- else if (!strcmp (*args, "-clcerts")) options |= CLCERTS;
- else if (!strcmp (*args, "-cacerts")) options |= CACERTS;
- else if (!strcmp (*args, "-noout")) options |= (NOKEYS|NOCERTS);
- else if (!strcmp (*args, "-info")) options |= INFO;
- else if (!strcmp (*args, "-chain")) chain = 1;
- else if (!strcmp (*args, "-twopass")) twopass = 1;
- else if (!strcmp (*args, "-nomacver")) macver = 0;
- else if (!strcmp (*args, "-descert"))
- cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
- else if (!strcmp (*args, "-export")) export_cert = 1;
- else if (!strcmp (*args, "-des")) enc=EVP_des_cbc();
-#ifndef OPENSSL_NO_IDEA
- else if (!strcmp (*args, "-idea")) enc=EVP_idea_cbc();
-#endif
- else if (!strcmp (*args, "-des3")) enc = EVP_des_ede3_cbc();
-#ifndef OPENSSL_NO_AES
- else if (!strcmp(*args,"-aes128")) enc=EVP_aes_128_cbc();
- else if (!strcmp(*args,"-aes192")) enc=EVP_aes_192_cbc();
- else if (!strcmp(*args,"-aes256")) enc=EVP_aes_256_cbc();
-#endif
- else if (!strcmp (*args, "-noiter")) iter = 1;
- else if (!strcmp (*args, "-maciter"))
- maciter = PKCS12_DEFAULT_ITER;
- else if (!strcmp (*args, "-nomaciter"))
- maciter = 1;
- else if (!strcmp (*args, "-nomac"))
- maciter = -1;
- else if (!strcmp (*args, "-nodes")) enc=NULL;
- else if (!strcmp (*args, "-certpbe")) {
- if (args[1]) {
- args++;
- if (!strcmp(*args, "NONE"))
- cert_pbe = -1;
- cert_pbe=OBJ_txt2nid(*args);
- if(cert_pbe == NID_undef) {
- BIO_printf(bio_err,
- "Unknown PBE algorithm %s\n", *args);
- badarg = 1;
- }
- } else badarg = 1;
- } else if (!strcmp (*args, "-keypbe")) {
- if (args[1]) {
- args++;
- if (!strcmp(*args, "NONE"))
- key_pbe = -1;
- else
- key_pbe=OBJ_txt2nid(*args);
- if(key_pbe == NID_undef) {
- BIO_printf(bio_err,
- "Unknown PBE algorithm %s\n", *args);
- badarg = 1;
- }
- } else badarg = 1;
- } else if (!strcmp (*args, "-rand")) {
- if (args[1]) {
- args++;
- inrand = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-inkey")) {
- if (args[1]) {
- args++;
- keyname = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-certfile")) {
- if (args[1]) {
- args++;
- certfile = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-name")) {
- if (args[1]) {
- args++;
- name = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-CSP")) {
- if (args[1]) {
- args++;
- csp_name = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-caname")) {
- if (args[1]) {
- args++;
- if (!canames) canames = sk_new_null();
- sk_push(canames, *args);
- } else badarg = 1;
- } else if (!strcmp (*args, "-in")) {
- if (args[1]) {
- args++;
- infile = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-out")) {
- if (args[1]) {
- args++;
- outfile = *args;
- } else badarg = 1;
- } else if (!strcmp(*args,"-passin")) {
- if (args[1]) {
- args++;
- passargin = *args;
- } else badarg = 1;
- } else if (!strcmp(*args,"-passout")) {
- if (args[1]) {
- args++;
- passargout = *args;
- } else badarg = 1;
- } else if (!strcmp (*args, "-password")) {
- if (args[1]) {
- args++;
- passarg = *args;
- noprompt = 1;
- } else badarg = 1;
- } else if (!strcmp(*args,"-CApath")) {
- if (args[1]) {
- args++;
- CApath = *args;
- } else badarg = 1;
- } else if (!strcmp(*args,"-CAfile")) {
- if (args[1]) {
- args++;
- CAfile = *args;
- } else badarg = 1;
-#ifndef OPENSSL_NO_ENGINE
- } else if (!strcmp(*args,"-engine")) {
- if (args[1]) {
- args++;
- engine = *args;
- } else badarg = 1;
-#endif
- } else badarg = 1;
-
- } else badarg = 1;
- args++;
- }
-
- if (badarg) {
- BIO_printf (bio_err, "Usage: pkcs12 [options]\n");
- BIO_printf (bio_err, "where options are\n");
- BIO_printf (bio_err, "-export output PKCS12 file\n");
- BIO_printf (bio_err, "-chain add certificate chain\n");
- BIO_printf (bio_err, "-inkey file private key if not infile\n");
- BIO_printf (bio_err, "-certfile f add all certs in f\n");
- BIO_printf (bio_err, "-CApath arg - PEM format directory of CA's\n");
- BIO_printf (bio_err, "-CAfile arg - PEM format file of CA's\n");
- BIO_printf (bio_err, "-name \"name\" use name as friendly name\n");
- BIO_printf (bio_err, "-caname \"nm\" use nm as CA friendly name (can be used more than once).\n");
- BIO_printf (bio_err, "-in infile input filename\n");
- BIO_printf (bio_err, "-out outfile output filename\n");
- BIO_printf (bio_err, "-noout don't output anything, just verify.\n");
- BIO_printf (bio_err, "-nomacver don't verify MAC.\n");
- BIO_printf (bio_err, "-nocerts don't output certificates.\n");
- BIO_printf (bio_err, "-clcerts only output client certificates.\n");
- BIO_printf (bio_err, "-cacerts only output CA certificates.\n");
- BIO_printf (bio_err, "-nokeys don't output private keys.\n");
- BIO_printf (bio_err, "-info give info about PKCS#12 structure.\n");
- BIO_printf (bio_err, "-des encrypt private keys with DES\n");
- BIO_printf (bio_err, "-des3 encrypt private keys with triple DES (default)\n");
-#ifndef OPENSSL_NO_IDEA
- BIO_printf (bio_err, "-idea encrypt private keys with idea\n");
-#endif
-#ifndef OPENSSL_NO_AES
- BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
- BIO_printf (bio_err, " encrypt PEM output with cbc aes\n");
-#endif
- BIO_printf (bio_err, "-nodes don't encrypt private keys\n");
- BIO_printf (bio_err, "-noiter don't use encryption iteration\n");
- BIO_printf (bio_err, "-maciter use MAC iteration\n");
- BIO_printf (bio_err, "-twopass separate MAC, encryption passwords\n");
- BIO_printf (bio_err, "-descert encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
- BIO_printf (bio_err, "-certpbe alg specify certificate PBE algorithm (default RC2-40)\n");
- BIO_printf (bio_err, "-keypbe alg specify private key PBE algorithm (default 3DES)\n");
- BIO_printf (bio_err, "-keyex set MS key exchange type\n");
- BIO_printf (bio_err, "-keysig set MS key signature type\n");
- BIO_printf (bio_err, "-password p set import/export password source\n");
- BIO_printf (bio_err, "-passin p input file pass phrase source\n");
- BIO_printf (bio_err, "-passout p output file pass phrase source\n");
-#ifndef OPENSSL_NO_ENGINE
- BIO_printf (bio_err, "-engine e use engine e, possibly a hardware device.\n");
-#endif
- BIO_printf(bio_err, "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
- BIO_printf(bio_err, " load the file (or the files in the directory) into\n");
- BIO_printf(bio_err, " the random number generator\n");
- goto end;
+ int ret = 1, macver = 1, noprompt = 0, add_lmk = 0;
+ char *passinarg = NULL, *passoutarg = NULL, *passarg = NULL;
+ char *passin = NULL, *passout = NULL, *inrand = NULL, *macalg = NULL;
+ char *cpass = NULL, *mpass = NULL, *CApath = NULL, *CAfile = NULL;
+ char *prog;
+ ENGINE *e = NULL;
+ BIO *in = NULL, *out = NULL;
+ PKCS12 *p12 = NULL;
+ STACK_OF(OPENSSL_STRING) *canames = NULL;
+ const EVP_CIPHER *enc = EVP_des_ede3_cbc();
+ OPTION_CHOICE o;
+
+ prog = opt_init(argc, argv, pkcs12_options);
+ while ((o = opt_next()) != OPT_EOF) {
+ switch (o) {
+ case OPT_EOF:
+ case OPT_ERR:
+ opthelp:
+ BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
+ goto end;
+ case OPT_HELP:
+ opt_help(pkcs12_options);
+ ret = 0;
+ goto end;
+ case OPT_NOKEYS:
+ options |= NOKEYS;
+ break;
+ case OPT_KEYEX:
+ keytype = KEY_EX;
+ break;
+ case OPT_KEYSIG:
+ keytype = KEY_SIG;
+ break;
+ case OPT_NOCERTS:
+ options |= NOCERTS;
+ break;
+ case OPT_CLCERTS:
+ options |= CLCERTS;
+ break;
+ case OPT_CACERTS:
+ options |= CACERTS;
+ break;
+ case OPT_NOOUT:
+ options |= (NOKEYS | NOCERTS);
+ break;
+ case OPT_INFO:
+ options |= INFO;
+ break;
+ case OPT_CHAIN:
+ chain = 1;
+ break;
+ case OPT_TWOPASS:
+ twopass = 1;
+ break;
+ case OPT_NOMACVER:
+ macver = 0;
+ break;
+ case OPT_DESCERT:
+ cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
+ break;
+ case OPT_EXPORT:
+ export_cert = 1;
+ break;
+ case OPT_CIPHER:
+ if (!opt_cipher(opt_unknown(), &enc))
+ goto opthelp;
+ break;
+ case OPT_NOITER:
+ iter = 1;
+ break;
+ case OPT_MACITER:
+ maciter = PKCS12_DEFAULT_ITER;
+ break;
+ case OPT_NOMACITER:
+ maciter = 1;
+ break;
+ case OPT_NOMAC:
+ maciter = -1;
+ break;
+ case OPT_MACALG:
+ macalg = opt_arg();
+ break;
+ case OPT_NODES:
+ enc = NULL;
+ break;
+ case OPT_CERTPBE:
+ if (!set_pbe(&cert_pbe, opt_arg()))
+ goto opthelp;
+ break;
+ case OPT_KEYPBE:
+ if (!set_pbe(&key_pbe, opt_arg()))
+ goto opthelp;
+ break;
+ case OPT_RAND:
+ inrand = opt_arg();
+ break;
+ case OPT_INKEY:
+ keyname = opt_arg();
+ break;
+ case OPT_CERTFILE:
+ certfile = opt_arg();
+ break;
+ case OPT_NAME:
+ name = opt_arg();
+ break;
+ case OPT_LMK:
+ add_lmk = 1;
+ break;
+ case OPT_CSP:
+ csp_name = opt_arg();
+ break;
+ case OPT_CANAME:
+ if (canames == NULL
+ && (canames = sk_OPENSSL_STRING_new_null()) == NULL)
+ goto end;
+ sk_OPENSSL_STRING_push(canames, opt_arg());
+ break;
+ case OPT_IN:
+ infile = opt_arg();
+ break;
+ case OPT_OUT:
+ outfile = opt_arg();
+ break;
+ case OPT_PASSIN:
+ passinarg = opt_arg();
+ break;
+ case OPT_PASSOUT:
+ passoutarg = opt_arg();
+ break;
+ case OPT_PASSWORD:
+ passarg = opt_arg();
+ break;
+ case OPT_CAPATH:
+ CApath = opt_arg();
+ break;
+ case OPT_CAFILE:
+ CAfile = opt_arg();
+ break;
+ case OPT_ENGINE:
+ e = setup_engine(opt_arg(), 0);
+ break;
+ }