X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=apps%2Fpkcs12.c;h=365a8ada937d10a199894f350a8a425726d55533;hp=3f958943b4a37379c8c8337d605f96fd5e1ddef0;hb=3ac82faae5eb02140f347610be0726f549a0aa0a;hpb=f365611ca32190a032db1e292ccf55f110acea9a diff --git a/apps/pkcs12.c b/apps/pkcs12.c index 3f958943b4..365a8ada93 100644 --- a/apps/pkcs12.c +++ b/apps/pkcs12.c @@ -66,6 +66,7 @@ #include #include #include +#include #define PROG pkcs12_main @@ -78,7 +79,7 @@ EVP_CIPHER *enc; #define CLCERTS 0x8 #define CACERTS 0x10 -int get_cert_chain(X509 *cert, STACK_OF(X509) **chain); +int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain); int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int options, char *pempass); int dump_certs_pkeys_bags(BIO *out, STACK_OF(PKCS12_SAFEBAG) *bags, char *pass, int passlen, int options, char *pempass); @@ -92,6 +93,7 @@ int MAIN(int, char **); int MAIN(int argc, char **argv) { + ENGINE *e = NULL; char *infile=NULL, *outfile=NULL, *keyname = NULL; char *certfile=NULL; BIO *in=NULL, *out = NULL, *inkey = NULL, *certsin = NULL; @@ -117,6 +119,8 @@ int MAIN(int argc, char **argv) char *passargin = NULL, *passargout = NULL, *passarg = NULL; char *passin = NULL, *passout = NULL; char *inrand = NULL; + char *CApath = NULL, *CAfile = NULL; + char *engine=NULL; apps_startup(); @@ -196,7 +200,7 @@ int MAIN(int argc, char **argv) } else if (!strcmp (*args, "-caname")) { if (args[1]) { args++; - if (!canames) canames = sk_new(NULL); + if (!canames) canames = sk_new_null(); sk_push(canames, *args); } else badarg = 1; } else if (!strcmp (*args, "-in")) { @@ -225,6 +229,21 @@ int MAIN(int argc, char **argv) passarg = *args; noprompt = 1; } else badarg = 1; + } else if (!strcmp(*args,"-CApath")) { + if (args[1]) { + args++; + CApath = *args; + } else badarg = 1; + } else if (!strcmp(*args,"-CAfile")) { + if (args[1]) { + args++; + CAfile = *args; + } else badarg = 1; + } else if (!strcmp(*args,"-engine")) { + if (args[1]) { + args++; + engine = *args; + } else badarg = 1; } else badarg = 1; } else badarg = 1; @@ -238,6 +257,8 @@ int MAIN(int argc, char **argv) BIO_printf (bio_err, "-chain add certificate chain\n"); BIO_printf (bio_err, "-inkey file private key if not infile\n"); BIO_printf (bio_err, "-certfile f add all certs in f\n"); + BIO_printf (bio_err, "-CApath arg - PEM format directory of CA's\n"); + BIO_printf (bio_err, "-CAfile arg - PEM format file of CA's\n"); BIO_printf (bio_err, "-name \"name\" use name as friendly name\n"); BIO_printf (bio_err, "-caname \"nm\" use nm as CA friendly name (can be used more than once).\n"); BIO_printf (bio_err, "-in infile input filename\n"); @@ -266,12 +287,27 @@ int MAIN(int argc, char **argv) BIO_printf (bio_err, "-password p set import/export password source\n"); BIO_printf (bio_err, "-passin p input file pass phrase source\n"); BIO_printf (bio_err, "-passout p output file pass phrase source\n"); + BIO_printf (bio_err, "-engine e use engine e, possibly a hardware device.\n"); BIO_printf(bio_err, "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR); BIO_printf(bio_err, " load the file (or the files in the directory) into\n"); BIO_printf(bio_err, " the random number generator\n"); goto end; } + if (engine != NULL) { + if((e = ENGINE_by_id(engine)) == NULL) { + BIO_printf(bio_err,"invalid engine \"%s\"\n", engine); + goto end; + } + if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { + BIO_printf(bio_err,"can't use that engine\n"); + goto end; + } + BIO_printf(bio_err,"engine \"%s\" set.\n", engine); + /* Free our "structural" reference. */ + ENGINE_free(e); + } + if(passarg) { if(export_cert) passargout = passarg; else passargin = passarg; @@ -337,8 +373,15 @@ int MAIN(int argc, char **argv) CRYPTO_push_info("write files"); #endif - if (!outfile) out = BIO_new_fp(stdout, BIO_NOCLOSE); - else out = BIO_new_file(outfile, "wb"); + if (!outfile) { + out = BIO_new_fp(stdout, BIO_NOCLOSE); +#ifdef VMS + { + BIO *tmpbio = BIO_new(BIO_f_linebuffer()); + out = BIO_push(tmpbio, out); + } +#endif + } else out = BIO_new_file(outfile, "wb"); if (!out) { BIO_printf(bio_err, "Error opening output file %s\n", outfile ? outfile : ""); @@ -360,21 +403,22 @@ int MAIN(int argc, char **argv) } if (export_cert) { - EVP_PKEY *key; - STACK_OF(PKCS12_SAFEBAG) *bags; - STACK_OF(PKCS7) *safes; - PKCS12_SAFEBAG *bag; - PKCS8_PRIV_KEY_INFO *p8; - PKCS7 *authsafe; + EVP_PKEY *key = NULL; + STACK_OF(PKCS12_SAFEBAG) *bags = NULL; + STACK_OF(PKCS7) *safes = NULL; + PKCS12_SAFEBAG *bag = NULL; + PKCS8_PRIV_KEY_INFO *p8 = NULL; + PKCS7 *authsafe = NULL; X509 *ucert = NULL; STACK_OF(X509) *certs=NULL; - char *catmp; + char *catmp = NULL; int i; unsigned char keyid[EVP_MAX_MD_SIZE]; unsigned int keyidlen = 0; #ifdef CRYPTO_MDEBUG CRYPTO_push_info("process -export_cert"); + CRYPTO_push_info("reading private key"); #endif key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, passin); if (!inkey) (void) BIO_reset(in); @@ -382,18 +426,28 @@ int MAIN(int argc, char **argv) if (!key) { BIO_printf (bio_err, "Error loading private key\n"); ERR_print_errors(bio_err); - goto end; + goto export_end; } - certs = sk_X509_new(NULL); +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("reading certs from input"); +#endif + + certs = sk_X509_new_null(); /* Load in all certs in input file */ if(!cert_load(in, certs)) { BIO_printf(bio_err, "Error loading certificates from input\n"); ERR_print_errors(bio_err); - goto end; + goto export_end; } +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("reading certs from input 2"); +#endif + for(i = 0; i < sk_X509_num(certs); i++) { ucert = sk_X509_value(certs, i); if(X509_check_private_key(ucert, key)) { @@ -401,41 +455,68 @@ int MAIN(int argc, char **argv) break; } } - if(!keyidlen) { + ucert = NULL; BIO_printf(bio_err, "No certificate matches private key\n"); - goto end; + goto export_end; } - bags = sk_PKCS12_SAFEBAG_new (NULL); +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("reading certs from certfile"); +#endif + + bags = sk_PKCS12_SAFEBAG_new_null (); /* Add any more certificates asked for */ if (certsin) { if(!cert_load(certsin, certs)) { BIO_printf(bio_err, "Error loading certificates from certfile\n"); ERR_print_errors(bio_err); - goto end; + goto export_end; } BIO_free(certsin); } +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("building chain"); +#endif + /* If chaining get chain from user cert */ if (chain) { int vret; STACK_OF(X509) *chain2; - vret = get_cert_chain (ucert, &chain2); + X509_STORE *store = X509_STORE_new(); + if (!store) + { + BIO_printf (bio_err, "Memory allocation error\n"); + goto export_end; + } + if (!X509_STORE_load_locations(store, CAfile, CApath)) + X509_STORE_set_default_paths (store); + + vret = get_cert_chain (ucert, store, &chain2); + X509_STORE_free(store); + + if (!vret) { + /* Exclude verified certificate */ + for (i = 1; i < sk_X509_num (chain2) ; i++) + sk_X509_push(certs, sk_X509_value (chain2, i)); + } + sk_X509_free(chain2); if (vret) { BIO_printf (bio_err, "Error %s getting chain.\n", X509_verify_cert_error_string(vret)); - goto end; - } - /* Exclude verified certificate */ - for (i = 1; i < sk_X509_num (chain2) ; i++) - sk_X509_push(certs, sk_X509_value (chain2, i)); - sk_X509_free(chain2); - + goto export_end; + } } +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("building bags"); +#endif + /* We now have loads of certificates: include them all */ for(i = 0; i < sk_X509_num(certs); i++) { X509 *cert = NULL; @@ -450,56 +531,98 @@ int MAIN(int argc, char **argv) sk_PKCS12_SAFEBAG_push(bags, bag); } sk_X509_pop_free(certs, X509_free); - if (canames) sk_free(canames); + certs = NULL; + /* ucert is part of certs so it is already freed */ + ucert = NULL; + +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("encrypting bags"); +#endif if(!noprompt && EVP_read_pw_string(pass, 50, "Enter Export Password:", 1)) { BIO_printf (bio_err, "Can't read Password\n"); - goto end; + goto export_end; } if (!twopass) strcpy(macpass, pass); /* Turn certbags into encrypted authsafe */ authsafe = PKCS12_pack_p7encdata(cert_pbe, cpass, -1, NULL, 0, iter, bags); sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); + bags = NULL; if (!authsafe) { ERR_print_errors (bio_err); - goto end; + goto export_end; } - safes = sk_PKCS7_new (NULL); + safes = sk_PKCS7_new_null (); sk_PKCS7_push (safes, authsafe); +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("building shrouded key bag"); +#endif + /* Make a shrouded key bag */ p8 = EVP_PKEY2PKCS8 (key); - EVP_PKEY_free(key); if(keytype) PKCS8_add_keyusage(p8, keytype); bag = PKCS12_MAKE_SHKEYBAG(key_pbe, cpass, -1, NULL, 0, iter, p8); PKCS8_PRIV_KEY_INFO_free(p8); + p8 = NULL; if (name) PKCS12_add_friendlyname (bag, name, -1); PKCS12_add_localkeyid (bag, keyid, keyidlen); - bags = sk_PKCS12_SAFEBAG_new(NULL); + bags = sk_PKCS12_SAFEBAG_new_null(); sk_PKCS12_SAFEBAG_push (bags, bag); + +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("encrypting shrouded key bag"); +#endif + /* Turn it into unencrypted safe bag */ authsafe = PKCS12_pack_p7data (bags); sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); + bags = NULL; sk_PKCS7_push (safes, authsafe); +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("building pkcs12"); +#endif + p12 = PKCS12_init (NID_pkcs7_data); M_PKCS12_pack_authsafes (p12, safes); sk_PKCS7_pop_free(safes, PKCS7_free); + safes = NULL; PKCS12_set_mac (p12, mpass, -1, NULL, 0, maciter, NULL); - i2d_PKCS12_bio (out, p12); +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_push_info("writing pkcs12"); +#endif - PKCS12_free(p12); + i2d_PKCS12_bio (out, p12); ret = 0; + export_end: +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); + CRYPTO_pop_info(); + CRYPTO_push_info("process -export_cert: freeing"); +#endif + + if (key) EVP_PKEY_free(key); + if (certs) sk_X509_pop_free(certs, X509_free); + if (safes) sk_PKCS7_pop_free(safes, PKCS7_free); + if (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free); + if (ucert) X509_free(ucert); + #ifdef CRYPTO_MDEBUG CRYPTO_pop_info(); #endif @@ -557,14 +680,15 @@ int MAIN(int argc, char **argv) CRYPTO_pop_info(); #endif ret = 0; - end: - PKCS12_free(p12); + end: + if (p12) PKCS12_free(p12); if(export_cert || inrand) app_RAND_write_file(NULL, bio_err); #ifdef CRYPTO_MDEBUG CRYPTO_remove_all_info(); #endif BIO_free(in); - BIO_free(out); + BIO_free_all(out); + if (canames) sk_free(canames); if(passin) OPENSSL_free(passin); if(passout) OPENSSL_free(passout); EXIT(ret); @@ -690,15 +814,12 @@ int dump_certs_pkeys_bag (BIO *out, PKCS12_SAFEBAG *bag, char *pass, /* Hope this is OK .... */ -int get_cert_chain (X509 *cert, STACK_OF(X509) **chain) +int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain) { - X509_STORE *store; X509_STORE_CTX store_ctx; STACK_OF(X509) *chn; int i; - store = X509_STORE_new (); - X509_STORE_set_default_paths (store); X509_STORE_CTX_init(&store_ctx, store, cert, NULL); if (X509_verify_cert(&store_ctx) <= 0) { i = X509_STORE_CTX_get_error (&store_ctx); @@ -709,7 +830,6 @@ int get_cert_chain (X509 *cert, STACK_OF(X509) **chain) *chain = chn; err: X509_STORE_CTX_cleanup(&store_ctx); - X509_STORE_free(store); return i; } @@ -733,10 +853,22 @@ int cert_load(BIO *in, STACK_OF(X509) *sk) int ret; X509 *cert; ret = 0; +#ifdef CRYPTO_MDEBUG + CRYPTO_push_info("cert_load(): reading one cert"); +#endif while((cert = PEM_read_bio_X509(in, NULL, NULL, NULL))) { +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); +#endif ret = 1; sk_X509_push(sk, cert); +#ifdef CRYPTO_MDEBUG + CRYPTO_push_info("cert_load(): reading one cert"); +#endif } +#ifdef CRYPTO_MDEBUG + CRYPTO_pop_info(); +#endif if(ret) ERR_clear_error(); return ret; } @@ -778,14 +910,14 @@ int print_attribs (BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst, char *name) break; case V_ASN1_OCTET_STRING: - hex_prin(out, av->value.bit_string->data, - av->value.bit_string->length); + hex_prin(out, av->value.octet_string->data, + av->value.octet_string->length); BIO_printf(out, "\n"); break; case V_ASN1_BIT_STRING: - hex_prin(out, av->value.octet_string->data, - av->value.octet_string->length); + hex_prin(out, av->value.bit_string->data, + av->value.bit_string->length); BIO_printf(out, "\n"); break;