update FAQ

[openssl.git] / apps / pkcs12.c

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index abd043d801c43ac791e2ffe777bc61015ecf80f0..b54c6f84a4a095d4fcc93c90a3adb19abf9f1a5e 100644 (file)
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -1,5 +1,5 @@
 /* pkcs12.c */
-/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
 /* ====================================================================
@@ -101,6 +101,7 @@ int MAIN(int argc, char **argv)
     char **args;
     char *name = NULL;
     char *csp_name = NULL;
+    int add_lmk = 0;
     PKCS12 *p12 = NULL;
     char pass[50], macpass[50];
     int export_cert = 0;
@@ -116,7 +117,7 @@ int MAIN(int argc, char **argv)
     int ret = 1;
     int macver = 1;
     int noprompt = 0;
-    STACK *canames = NULL;
+    STACK_OF(OPENSSL_STRING) *canames = NULL;
     char *cpass = NULL, *mpass = NULL;
     char *passargin = NULL, *passargout = NULL, *passarg = NULL;
     char *passin = NULL, *passout = NULL;
@@ -155,10 +156,13 @@ int MAIN(int argc, char **argv)
                        cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
                else if (!strcmp (*args, "-export")) export_cert = 1;
                else if (!strcmp (*args, "-des")) enc=EVP_des_cbc();
+               else if (!strcmp (*args, "-des3")) enc = EVP_des_ede3_cbc();
 #ifndef OPENSSL_NO_IDEA
                else if (!strcmp (*args, "-idea")) enc=EVP_idea_cbc();
 #endif
-               else if (!strcmp (*args, "-des3")) enc = EVP_des_ede3_cbc();
+#ifndef OPENSSL_NO_SEED
+               else if (!strcmp(*args, "-seed")) enc=EVP_seed_cbc();
+#endif
 #ifndef OPENSSL_NO_AES
                else if (!strcmp(*args,"-aes128")) enc=EVP_aes_128_cbc();
                else if (!strcmp(*args,"-aes192")) enc=EVP_aes_192_cbc();
@@ -208,7 +212,9 @@ int MAIN(int argc, char **argv)
                        args++; 
                        name = *args;
                    } else badarg = 1;
-               } else if (!strcmp (*args, "-CSP")) {
+               } else if (!strcmp (*args, "-LMK"))
+                       add_lmk = 1;
+               else if (!strcmp (*args, "-CSP")) {
                    if (args[1]) {
                        args++; 
                        csp_name = *args;
@@ -216,8 +222,8 @@ int MAIN(int argc, char **argv)
                } else if (!strcmp (*args, "-caname")) {
                    if (args[1]) {
                        args++; 
-                       if (!canames) canames = sk_new_null();
-                       sk_push(canames, *args);
+                       if (!canames) canames = sk_OPENSSL_STRING_new_null();
+                       sk_OPENSSL_STRING_push(canames, *args);
                    } else badarg = 1;
                } else if (!strcmp (*args, "-in")) {
                    if (args[1]) {
@@ -293,6 +299,9 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_IDEA
        BIO_printf (bio_err, "-idea         encrypt private keys with idea\n");
 #endif
+#ifndef OPENSSL_NO_SEED
+       BIO_printf (bio_err, "-seed         encrypt private keys with seed\n");
+#endif
 #ifndef OPENSSL_NO_AES
        BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
        BIO_printf (bio_err, "              encrypt PEM output with cbc aes\n");
@@ -323,6 +332,7 @@ int MAIN(int argc, char **argv)
        BIO_printf(bio_err,  "              load the file (or the files in the directory) into\n");
        BIO_printf(bio_err,  "              the random number generator\n");
        BIO_printf(bio_err,  "-CSP name     Microsoft CSP name\n");
+       BIO_printf(bio_err,  "-LMK          Add local machine keyset attribute to private key\n");
        goto end;
     }
 
@@ -463,7 +473,7 @@ int MAIN(int argc, char **argv)
                                        X509_keyid_set1(ucert, NULL, 0);
                                        X509_alias_set1(ucert, NULL, 0);
                                        /* Remove from list */
-                                       sk_X509_delete(certs, i);
+                                       (void)sk_X509_delete(certs, i);
                                        break;
                                        }
                                }
@@ -528,24 +538,29 @@ int MAIN(int argc, char **argv)
                    X509_free(sk_X509_value(chain2, 0));
                    sk_X509_free(chain2);
                } else {
-                       BIO_printf (bio_err, "Error %s getting chain.\n",
+                       if (vret >= 0)
+                               BIO_printf (bio_err, "Error %s getting chain.\n",
                                        X509_verify_cert_error_string(vret));
+                       else
+                               ERR_print_errors(bio_err);
                        goto export_end;
                }                       
        }
 
        /* Add any CA names */
 
-       for (i = 0; i < sk_num(canames); i++)
+       for (i = 0; i < sk_OPENSSL_STRING_num(canames); i++)
                {
-               catmp = (unsigned char *)sk_value(canames, i);
+               catmp = (unsigned char *)sk_OPENSSL_STRING_value(canames, i);
                X509_alias_set1(sk_X509_value(certs, i), catmp, -1);
                }
 
        if (csp_name && key)
                EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
                                MBSTRING_ASC, (unsigned char *)csp_name, -1);
-               
+
+       if (add_lmk && key)
+               EVP_PKEY_add1_attr_by_NID(key, NID_LocalKeySet, 0, NULL, -1);
 
 #ifdef CRYPTO_MDEBUG
        CRYPTO_pop_info();
@@ -632,7 +647,7 @@ int MAIN(int argc, char **argv)
 
     if (!twopass) BUF_strlcpy(macpass, pass, sizeof macpass);
 
-    if (options & INFO) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);
+    if ((options & INFO) && p12->mac) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);
     if(macver) {
 #ifdef CRYPTO_MDEBUG
     CRYPTO_push_info("verify MAC");
@@ -672,7 +687,7 @@ int MAIN(int argc, char **argv)
 #endif
     BIO_free(in);
     BIO_free_all(out);
-    if (canames) sk_free(canames);
+    if (canames) sk_OPENSSL_STRING_free(canames);
     if(passin) OPENSSL_free(passin);
     if(passout) OPENSSL_free(passout);
     apps_shutdown();
@@ -813,7 +828,7 @@ int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain)
 {
        X509_STORE_CTX store_ctx;
        STACK_OF(X509) *chn;
-       int i;
+       int i = 0;
 
        /* FIXME: Should really check the return status of X509_STORE_CTX_init
         * for an error, but how that fits into the return value of this
@@ -821,14 +836,17 @@ int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain)
        X509_STORE_CTX_init(&store_ctx, store, cert, NULL);
        if (X509_verify_cert(&store_ctx) <= 0) {
                i = X509_STORE_CTX_get_error (&store_ctx);
+               if (i == 0)
+                       /* avoid returning 0 if X509_verify_cert() did not
+                        * set an appropriate error value in the context */
+                       i = -1;
+               chn = NULL;
                goto err;
-       }
-       chn =  X509_STORE_CTX_get1_chain(&store_ctx);
-       i = 0;
-       *chain = chn;
+       } else
+               chn = X509_STORE_CTX_get1_chain(&store_ctx);
 err:
        X509_STORE_CTX_cleanup(&store_ctx);
-       *chain = NULL;
+       *chain = chn;
        
        return i;
 }      
@@ -905,7 +923,7 @@ int print_attribs (BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst,const char *name)
                        av = sk_ASN1_TYPE_value(attr->value.set, 0);
                        switch(av->type) {
                                case V_ASN1_BMPSTRING:
-                               value = uni2asc(av->value.bmpstring->data,
+                               value = OPENSSL_uni2asc(av->value.bmpstring->data,
                                               av->value.bmpstring->length);
                                BIO_printf(out, "%s\n", value);
                                OPENSSL_free(value);