X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=apps%2Fpkcs8.c;h=43ff86d4f7221e50101669b01c7b9b4584f836d6;hp=a9583335178b7d781ac3a0f9c9400b14b0c4bd25;hb=c869da8839ef5af9df5a4d98f518b079240a0d4b;hpb=20432eae41e35ea28a4d43c0dfc7acfdd9672812

diff --git a/apps/pkcs8.c b/apps/pkcs8.c
index a958333517..43ff86d4f7 100644
--- a/apps/pkcs8.c
+++ b/apps/pkcs8.c
@@ -1,6 +1,6 @@
 /* pkcs8.c */
-/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project 1999-2004.
  */
 /* ====================================================================
  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
@@ -63,13 +63,15 @@
 #include <openssl/evp.h>
 #include <openssl/pkcs12.h>
 
-#include "apps.h"
 #define PROG pkcs8_main
 
+int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
-{
+	{
+	ENGINE *e = NULL;
 	char **args, *infile = NULL, *outfile = NULL;
+	char *passargin = NULL, *passargout = NULL;
 	BIO *in = NULL, *out = NULL;
 	int topk8 = 0;
 	int pbe_nid = -1;
@@ -78,245 +80,328 @@ int MAIN(int argc, char **argv)
 	int informat, outformat;
 	int p8_broken = PKCS8_OK;
 	int nocrypt = 0;
-	X509_SIG *p8;
-	PKCS8_PRIV_KEY_INFO *p8inf;
-	EVP_PKEY *pkey;
-	char pass[50], *passin = NULL, *passout = NULL;
+	X509_SIG *p8 = NULL;
+	PKCS8_PRIV_KEY_INFO *p8inf = NULL;
+	EVP_PKEY *pkey=NULL;
+	char pass[50], *passin = NULL, *passout = NULL, *p8pass = NULL;
 	int badarg = 0;
+	int ret = 1;
+#ifndef OPENSSL_NO_ENGINE
+	char *engine=NULL;
+#endif
+
 	if (bio_err == NULL) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
+
+	if (!load_config(bio_err, NULL))
+		goto end;
+
 	informat=FORMAT_PEM;
 	outformat=FORMAT_PEM;
+
 	ERR_load_crypto_strings();
-	SSLeay_add_all_algorithms();
+	OpenSSL_add_all_algorithms();
 	args = argv + 1;
-	while (!badarg && *args && *args[0] == '-') {
-		if (!strcmp(*args,"-v2")) {
-			if (args[1]) {
+	while (!badarg && *args && *args[0] == '-')
+		{
+		if (!strcmp(*args,"-v2"))
+			{
+			if (args[1])
+				{
 				args++;
 				cipher=EVP_get_cipherbyname(*args);
-				if(!cipher) {
+				if (!cipher)
+					{
 					BIO_printf(bio_err,
 						 "Unknown cipher %s\n", *args);
 					badarg = 1;
+					}
 				}
-			} else badarg = 1;
-		} else if (!strcmp(*args,"-v1")) {
-			if (args[1]) {
+			else
+				badarg = 1;
+			}
+		else if (!strcmp(*args,"-v1"))
+			{
+			if (args[1])
+				{
 				args++;
 				pbe_nid=OBJ_txt2nid(*args);
-				if(pbe_nid == NID_undef) {
+				if (pbe_nid == NID_undef)
+					{
 					BIO_printf(bio_err,
 						 "Unknown PBE algorithm %s\n", *args);
 					badarg = 1;
+					}
 				}
-			} else badarg = 1;
-		} else if (!strcmp(*args,"-inform")) {
-			if (args[1]) {
+			else
+				badarg = 1;
+			}
+		else if (!strcmp(*args,"-inform"))
+			{
+			if (args[1])
+				{
 				args++;
 				informat=str2fmt(*args);
-			} else badarg = 1;
-		} else if (!strcmp(*args,"-outform")) {
-			if (args[1]) {
+				}
+			else badarg = 1;
+			}
+		else if (!strcmp(*args,"-outform"))
+			{
+			if (args[1])
+				{
 				args++;
 				outformat=str2fmt(*args);
-			} else badarg = 1;
-		} else if (!strcmp (*args, "-topk8")) topk8 = 1;
-		else if (!strcmp (*args, "-noiter")) iter = 1;
-		else if (!strcmp (*args, "-nocrypt")) nocrypt = 1;
-		else if (!strcmp (*args, "-nooct")) p8_broken = PKCS8_NO_OCTET;
+				}
+			else badarg = 1;
+			}
+		else if (!strcmp (*args, "-topk8"))
+			topk8 = 1;
+		else if (!strcmp (*args, "-noiter"))
+			iter = 1;
+		else if (!strcmp (*args, "-nocrypt"))
+			nocrypt = 1;
+		else if (!strcmp (*args, "-nooct"))
+			p8_broken = PKCS8_NO_OCTET;
+		else if (!strcmp (*args, "-nsdb"))
+			p8_broken = PKCS8_NS_DB;
+		else if (!strcmp (*args, "-embed"))
+			p8_broken = PKCS8_EMBEDDED_PARAM;
 		else if (!strcmp(*args,"-passin"))
 			{
 			if (!args[1]) goto bad;
-			passin= *(++args);
+			passargin= *(++args);
 			}
-		else if (!strcmp(*args,"-envpassin"))
+		else if (!strcmp(*args,"-passout"))
 			{
 			if (!args[1]) goto bad;
-			if(!(passin= getenv(*(++args))))
-				{
-				BIO_printf(bio_err,
-				 "Can't read environment variable %s\n",
-								*args);
-				badarg = 1;
-				}
+			passargout= *(++args);
 			}
-		else if (strcmp(*args,"-envpassout") == 0)
+#ifndef OPENSSL_NO_ENGINE
+		else if (strcmp(*args,"-engine") == 0)
 			{
 			if (!args[1]) goto bad;
-			if(!(passout= getenv(*(++args))))
-				{
-				BIO_printf(bio_err,
-				 "Can't read environment variable %s\n",
-								*args);
-				badarg = 1;
-				}
+			engine= *(++args);
 			}
-		else if (!strcmp(*args,"-passout"))
+#endif
+		else if (!strcmp (*args, "-in"))
 			{
-			if (!args[1]) goto bad;
-			passout= *(++args);
-			}
-		else if (!strcmp (*args, "-in")) {
-			if (args[1]) {
+			if (args[1])
+				{
 				args++;
 				infile = *args;
-			} else badarg = 1;
-		} else if (!strcmp (*args, "-out")) {
-			if (args[1]) {
+				}
+			else badarg = 1;
+			}
+		else if (!strcmp (*args, "-out"))
+			{
+			if (args[1])
+				{
 				args++;
 				outfile = *args;
-			} else badarg = 1;
-		} else badarg = 1;
+				}
+			else badarg = 1;
+			}
+		else badarg = 1;
 		args++;
-	}
+		}
 
-	if (badarg) {
+	if (badarg)
+		{
 		bad:
 		BIO_printf(bio_err, "Usage pkcs8 [options]\n");
 		BIO_printf(bio_err, "where options are\n");
-		BIO_printf(bio_err, "-in file   input file\n");
-		BIO_printf(bio_err, "-inform X  input format (DER or PEM)\n");
-		BIO_printf(bio_err, "-passin arg     input file pass phrase\n");
-		BIO_printf(bio_err, "-envpassin arg  environment variable containing input file pass phrase\n");
-		BIO_printf(bio_err, "-outform X output format (DER or PEM)\n");
-		BIO_printf(bio_err, "-out file  output file\n");
-		BIO_printf(bio_err, "-passout arg    input file pass phrase\n");
-		BIO_printf(bio_err, "-envpassout arg environment variable containing input file pass phrase\n");
-		BIO_printf(bio_err, "-topk8     output PKCS8 file\n");
-		BIO_printf(bio_err, "-nooct     use (broken) no octet form\n");
-		BIO_printf(bio_err, "-noiter    use 1 as iteration count\n");
-		BIO_printf(bio_err, "-nocrypt   use or expect unencrypted private key\n");
-		BIO_printf(bio_err, "-v2 alg    use PKCS#5 v2.0 and cipher \"alg\"\n");
-		BIO_printf(bio_err, "-v1 obj    use PKCS#5 v1.5 and cipher \"alg\"\n");
-		return (1);
-	}
+		BIO_printf(bio_err, "-in file        input file\n");
+		BIO_printf(bio_err, "-inform X       input format (DER or PEM)\n");
+		BIO_printf(bio_err, "-passin arg     input file pass phrase source\n");
+		BIO_printf(bio_err, "-outform X      output format (DER or PEM)\n");
+		BIO_printf(bio_err, "-out file       output file\n");
+		BIO_printf(bio_err, "-passout arg    output file pass phrase source\n");
+		BIO_printf(bio_err, "-topk8          output PKCS8 file\n");
+		BIO_printf(bio_err, "-nooct          use (nonstandard) no octet format\n");
+		BIO_printf(bio_err, "-embed          use (nonstandard) embedded DSA parameters format\n");
+		BIO_printf(bio_err, "-nsdb           use (nonstandard) DSA Netscape DB format\n");
+		BIO_printf(bio_err, "-noiter         use 1 as iteration count\n");
+		BIO_printf(bio_err, "-nocrypt        use or expect unencrypted private key\n");
+		BIO_printf(bio_err, "-v2 alg         use PKCS#5 v2.0 and cipher \"alg\"\n");
+		BIO_printf(bio_err, "-v1 obj         use PKCS#5 v1.5 and cipher \"alg\"\n");
+#ifndef OPENSSL_NO_ENGINE
+		BIO_printf(bio_err," -engine e       use engine e, possibly a hardware device.\n");
+#endif
+		goto end;
+		}
+
+#ifndef OPENSSL_NO_ENGINE
+        e = setup_engine(bio_err, engine, 0);
+#endif
 
-	if ((pbe_nid == -1) && !cipher) pbe_nid = NID_pbeWithMD5AndDES_CBC;
+	if (!app_passwd(bio_err, passargin, passargout, &passin, &passout))
+		{
+		BIO_printf(bio_err, "Error getting passwords\n");
+		goto end;
+		}
+
+	if ((pbe_nid == -1) && !cipher)
+		pbe_nid = NID_pbeWithMD5AndDES_CBC;
 
-	if (infile) {
-		if (!(in = BIO_new_file(infile, "rb"))) {
+	if (infile)
+		{
+		if (!(in = BIO_new_file(infile, "rb")))
+			{
 			BIO_printf(bio_err,
 				 "Can't open input file %s\n", infile);
-			return (1);
+			goto end;
+			}
 		}
-	} else in = BIO_new_fp (stdin, BIO_NOCLOSE);
+	else
+		in = BIO_new_fp (stdin, BIO_NOCLOSE);
 
-	if (outfile) {
-		if (!(out = BIO_new_file (outfile, "wb"))) {
+	if (outfile)
+		{
+		if (!(out = BIO_new_file (outfile, "wb")))
+			{
 			BIO_printf(bio_err,
 				 "Can't open output file %s\n", outfile);
-			return (1);
-		}
-	} else out = BIO_new_fp (stdout, BIO_NOCLOSE);
-
-	if (topk8) {
-		if(informat == FORMAT_PEM)
-			pkey = PEM_read_bio_PrivateKey(in, NULL, PEM_cb, passin);
-		else if(informat == FORMAT_ASN1)
-			pkey = d2i_PrivateKey_bio(in, NULL);
-		else {
-			BIO_printf(bio_err, "Bad format specified for key\n");
-			return (1);
+			goto end;
+			}
 		}
-		if (!pkey) {
-			BIO_printf(bio_err, "Error reading key\n", outfile);
-			ERR_print_errors(bio_err);
-			return (1);
+	else
+		{
+		out = BIO_new_fp (stdout, BIO_NOCLOSE);
+#ifdef OPENSSL_SYS_VMS
+			{
+			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
+			out = BIO_push(tmpbio, out);
+			}
+#endif
 		}
-		BIO_free(in);
-		if (!(p8inf = EVP_PKEY2PKCS8(pkey))) {
-			BIO_printf(bio_err, "Error converting key\n", outfile);
+	if (topk8)
+		{
+		BIO_free(in); /* Not needed in this section */
+		pkey = load_key(bio_err, infile, informat, 1,
+			passin, e, "key");
+		if (!pkey)
+			goto end;
+		if (!(p8inf = EVP_PKEY2PKCS8_broken(pkey, p8_broken)))
+			{
+			BIO_printf(bio_err, "Error converting key\n");
 			ERR_print_errors(bio_err);
-			return (1);
-		}
-		PKCS8_set_broken(p8inf, p8_broken);
-		if(nocrypt) {
-			if(outformat == FORMAT_PEM) 
+			goto end;
+			}
+		if (nocrypt)
+			{
+			if (outformat == FORMAT_PEM) 
 				PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf);
-			else if(outformat == FORMAT_ASN1)
+			else if (outformat == FORMAT_ASN1)
 				i2d_PKCS8_PRIV_KEY_INFO_bio(out, p8inf);
-			else {
+			else
+				{
 				BIO_printf(bio_err, "Bad format specified for key\n");
-				return (1);
-			}
-		} else {
-			if(!passout) {
-				passout = pass;
-				EVP_read_pw_string(pass, 50, "Enter Encryption Password:", 1);
+				goto end;
+				}
 			}
+		else
+			{
+			if (passout)
+				p8pass = passout;
+			else
+				{
+				p8pass = pass;
+				if (EVP_read_pw_string(pass, sizeof pass, "Enter Encryption Password:", 1))
+					goto end;
+				}
+			app_RAND_load_file(NULL, bio_err, 0);
 			if (!(p8 = PKCS8_encrypt(pbe_nid, cipher,
-					passout, strlen(passout),
-					NULL, 0, iter, p8inf))) {
-				BIO_printf(bio_err, "Error encrypting key\n",
-								 outfile);
+					p8pass, strlen(p8pass),
+					NULL, 0, iter, p8inf)))
+				{
+				BIO_printf(bio_err, "Error encrypting key\n");
 				ERR_print_errors(bio_err);
-				return (1);
-			}
-			if(outformat == FORMAT_PEM) 
+				goto end;
+				}
+			app_RAND_write_file(NULL, bio_err);
+			if (outformat == FORMAT_PEM) 
 				PEM_write_bio_PKCS8(out, p8);
-			else if(outformat == FORMAT_ASN1)
+			else if (outformat == FORMAT_ASN1)
 				i2d_PKCS8_bio(out, p8);
-			else {
+			else
+				{
 				BIO_printf(bio_err, "Bad format specified for key\n");
-				return (1);
+				goto end;
+				}
 			}
-			X509_SIG_free(p8);
+
+		ret = 0;
+		goto end;
 		}
-		PKCS8_PRIV_KEY_INFO_free (p8inf);
-		EVP_PKEY_free(pkey);
-		BIO_free(out);
-		return (0);
-	}
 
-	if(nocrypt) {
-		if(informat == FORMAT_PEM) 
+	if (nocrypt)
+		{
+		if (informat == FORMAT_PEM) 
 			p8inf = PEM_read_bio_PKCS8_PRIV_KEY_INFO(in,NULL,NULL, NULL);
-		else if(informat == FORMAT_ASN1)
+		else if (informat == FORMAT_ASN1)
 			p8inf = d2i_PKCS8_PRIV_KEY_INFO_bio(in, NULL);
-		else {
+		else
+			{
 			BIO_printf(bio_err, "Bad format specified for key\n");
-			return (1);
+			goto end;
+			}
 		}
-	} else {
-		if(informat == FORMAT_PEM) 
+	else
+		{
+		if (informat == FORMAT_PEM) 
 			p8 = PEM_read_bio_PKCS8(in, NULL, NULL, NULL);
-		else if(informat == FORMAT_ASN1)
+		else if (informat == FORMAT_ASN1)
 			p8 = d2i_PKCS8_bio(in, NULL);
-		else {
+		else
+			{
 			BIO_printf(bio_err, "Bad format specified for key\n");
-			return (1);
-		}
+			goto end;
+			}
 
-		if (!p8) {
-			BIO_printf (bio_err, "Error reading key\n", outfile);
+		if (!p8)
+			{
+			BIO_printf (bio_err, "Error reading key\n");
 			ERR_print_errors(bio_err);
-			return (1);
-		}
-		if(!passin) {
-			passin = pass;
-			EVP_read_pw_string(pass, 50, "Enter Password:", 0);
+			goto end;
+			}
+		if (passin)
+			p8pass = passin;
+		else
+			{
+			p8pass = pass;
+			EVP_read_pw_string(pass, sizeof pass, "Enter Password:", 0);
+			}
+		p8inf = PKCS8_decrypt(p8, p8pass, strlen(p8pass));
 		}
-		p8inf = M_PKCS8_decrypt(p8, passin, strlen(passin));
-		X509_SIG_free(p8);
-	}
 
-	if (!p8inf) {
-		BIO_printf(bio_err, "Error decrypting key\n", outfile);
+	if (!p8inf)
+		{
+		BIO_printf(bio_err, "Error decrypting key\n");
 		ERR_print_errors(bio_err);
-		return (1);
-	}
+		goto end;
+		}
 
-	if (!(pkey = EVP_PKCS82PKEY(p8inf))) {
-		BIO_printf(bio_err, "Error converting key\n", outfile);
+	if (!(pkey = EVP_PKCS82PKEY(p8inf)))
+		{
+		BIO_printf(bio_err, "Error converting key\n");
 		ERR_print_errors(bio_err);
-		return (1);
-	}
+		goto end;
+		}
 	
-	if (p8inf->broken) {
+	if (p8inf->broken)
+		{
 		BIO_printf(bio_err, "Warning: broken key encoding: ");
-		switch (p8inf->broken) {
+		switch (p8inf->broken)
+			{
 			case PKCS8_NO_OCTET:
-			BIO_printf(bio_err, "No Octet String\n");
+			BIO_printf(bio_err, "No Octet String in PrivateKey\n");
+			break;
+
+			case PKCS8_EMBEDDED_PARAM:
+			BIO_printf(bio_err, "DSA parameters included in PrivateKey\n");
+			break;
+
+			case PKCS8_NS_DB:
+			BIO_printf(bio_err, "DSA public key include in PrivateKey\n");
 			break;
 
 			default:
@@ -325,19 +410,27 @@ int MAIN(int argc, char **argv)
 		}
 	}
 	
-	PKCS8_PRIV_KEY_INFO_free(p8inf);
-	if(outformat == FORMAT_PEM) 
-		PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, PEM_cb, passout);
-	else if(outformat == FORMAT_ASN1)
+	if (outformat == FORMAT_PEM) 
+		PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout);
+	else if (outformat == FORMAT_ASN1)
 		i2d_PrivateKey_bio(out, pkey);
-	else {
+	else
+		{
 		BIO_printf(bio_err, "Bad format specified for key\n");
-			return (1);
-	}
+			goto end;
+		}
+	ret = 0;
 
+	end:
+	X509_SIG_free(p8);
+	PKCS8_PRIV_KEY_INFO_free(p8inf);
 	EVP_PKEY_free(pkey);
-	BIO_free(out);
+	BIO_free_all(out);
 	BIO_free(in);
+	if (passin)
+		OPENSSL_free(passin);
+	if (passout)
+		OPENSSL_free(passout);
 
-	return (0);
-}
+	return ret;
+	}