GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: usr.bin/openssl/pkcs12.c Lines: 349 510 68.4 %
Date: 2017-11-13 Branches: 191 343 55.7 %

Line Branch Exec Source
1
/* $OpenBSD: pkcs12.c,v 1.9 2017/01/20 08:57:12 deraadt Exp $ */
2
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3
 * project.
4
 */
5
/* ====================================================================
6
 * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 *
15
 * 2. Redistributions in binary form must reproduce the above copyright
16
 *    notice, this list of conditions and the following disclaimer in
17
 *    the documentation and/or other materials provided with the
18
 *    distribution.
19
 *
20
 * 3. All advertising materials mentioning features or use of this
21
 *    software must display the following acknowledgment:
22
 *    "This product includes software developed by the OpenSSL Project
23
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24
 *
25
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26
 *    endorse or promote products derived from this software without
27
 *    prior written permission. For written permission, please contact
28
 *    licensing@OpenSSL.org.
29
 *
30
 * 5. Products derived from this software may not be called "OpenSSL"
31
 *    nor may "OpenSSL" appear in their names without prior written
32
 *    permission of the OpenSSL Project.
33
 *
34
 * 6. Redistributions of any form whatsoever must retain the following
35
 *    acknowledgment:
36
 *    "This product includes software developed by the OpenSSL Project
37
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38
 *
39
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50
 * OF THE POSSIBILITY OF SUCH DAMAGE.
51
 * ====================================================================
52
 *
53
 * This product includes cryptographic software written by Eric Young
54
 * (eay@cryptsoft.com).  This product includes software written by Tim
55
 * Hudson (tjh@cryptsoft.com).
56
 *
57
 */
58
59
#include <openssl/opensslconf.h>
60
61
#if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_SHA1)
62
63
#include <stdio.h>
64
#include <stdlib.h>
65
#include <string.h>
66
67
#include "apps.h"
68
69
#include <openssl/crypto.h>
70
#include <openssl/err.h>
71
#include <openssl/pem.h>
72
#include <openssl/pkcs12.h>
73
74
const EVP_CIPHER *enc;
75
76
#define NOKEYS		0x1
77
#define NOCERTS 	0x2
78
#define INFO		0x4
79
#define CLCERTS		0x8
80
#define CACERTS		0x10
81
82
int get_cert_chain(X509 * cert, X509_STORE * store, STACK_OF(X509) ** chain);
83
int dump_certs_keys_p12(BIO * out, PKCS12 * p12, char *pass, int passlen,
84
    int options, char *pempass);
85
int dump_certs_pkeys_bags(BIO * out, STACK_OF(PKCS12_SAFEBAG) * bags, char *pass,
86
    int passlen, int options, char *pempass);
87
int dump_certs_pkeys_bag(BIO * out, PKCS12_SAFEBAG * bags, char *pass, int passlen,
88
    int options, char *pempass);
89
int print_attribs(BIO * out, STACK_OF(X509_ATTRIBUTE) * attrlst, const char *name);
90
void hex_prin(BIO * out, unsigned char *buf, int len);
91
int alg_print(BIO * x, X509_ALGOR * alg);
92
int cert_load(BIO * in, STACK_OF(X509) * sk);
93
static int set_pbe(BIO * err, int *ppbe, const char *str);
94
95
int
96
pkcs12_main(int argc, char **argv)
97
{
98
	char *infile = NULL, *outfile = NULL, *keyname = NULL;
99
	char *certfile = NULL;
100
	BIO *in = NULL, *out = NULL;
101
	char **args;
102
	char *name = NULL;
103
	char *csp_name = NULL;
104
	int add_lmk = 0;
105
	PKCS12 *p12 = NULL;
106
32
	char pass[50], macpass[50];
107
	int export_cert = 0;
108
	int options = 0;
109
	int chain = 0;
110
	int badarg = 0;
111
	int iter = PKCS12_DEFAULT_ITER;
112
	int maciter = PKCS12_DEFAULT_ITER;
113
	int twopass = 0;
114
	int keytype = 0;
115
16
	int cert_pbe;
116
16
	int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
117
	int ret = 1;
118
	int macver = 1;
119
	int noprompt = 0;
120
	STACK_OF(OPENSSL_STRING) * canames = NULL;
121
	char *cpass = NULL, *mpass = NULL;
122
	char *passargin = NULL, *passargout = NULL, *passarg = NULL;
123
16
	char *passin = NULL, *passout = NULL;
124
	char *macalg = NULL;
125
	char *CApath = NULL, *CAfile = NULL;
126
127
16
	if (single_execution) {
128
16
		if (pledge("stdio cpath wpath rpath tty flock", NULL) == -1) {
129
			perror("pledge");
130
			exit(1);
131
		}
132
	}
133
134
16
	cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
135
136
16
	enc = EVP_des_ede3_cbc();
137
138
16
	args = argv + 1;
139
140
200
	while (*args) {
141
84
		if (*args[0] == '-') {
142
84
			if (!strcmp(*args, "-nokeys"))
143
				options |= NOKEYS;
144
84
			else if (!strcmp(*args, "-keyex"))
145
				keytype = KEY_EX;
146
84
			else if (!strcmp(*args, "-keysig"))
147
				keytype = KEY_SIG;
148
84
			else if (!strcmp(*args, "-nocerts"))
149
				options |= NOCERTS;
150
84
			else if (!strcmp(*args, "-clcerts"))
151
				options |= CLCERTS;
152
84
			else if (!strcmp(*args, "-cacerts"))
153
				options |= CACERTS;
154
84
			else if (!strcmp(*args, "-noout"))
155
4
				options |= (NOKEYS | NOCERTS);
156
80
			else if (!strcmp(*args, "-info"))
157
4
				options |= INFO;
158
76
			else if (!strcmp(*args, "-chain"))
159
4
				chain = 1;
160
72
			else if (!strcmp(*args, "-twopass"))
161
				twopass = 1;
162
72
			else if (!strcmp(*args, "-nomacver"))
163
				macver = 0;
164
72
			else if (!strcmp(*args, "-descert"))
165
				cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
166
72
			else if (!strcmp(*args, "-export"))
167
4
				export_cert = 1;
168
68
			else if (!strcmp(*args, "-des"))
169
				enc = EVP_des_cbc();
170
68
			else if (!strcmp(*args, "-des3"))
171
				enc = EVP_des_ede3_cbc();
172
#ifndef OPENSSL_NO_IDEA
173
68
			else if (!strcmp(*args, "-idea"))
174
				enc = EVP_idea_cbc();
175
#endif
176
#ifndef OPENSSL_NO_AES
177
68
			else if (!strcmp(*args, "-aes128"))
178
				enc = EVP_aes_128_cbc();
179
68
			else if (!strcmp(*args, "-aes192"))
180
				enc = EVP_aes_192_cbc();
181
68
			else if (!strcmp(*args, "-aes256"))
182
				enc = EVP_aes_256_cbc();
183
#endif
184
#ifndef OPENSSL_NO_CAMELLIA
185
68
			else if (!strcmp(*args, "-camellia128"))
186
				enc = EVP_camellia_128_cbc();
187
68
			else if (!strcmp(*args, "-camellia192"))
188
				enc = EVP_camellia_192_cbc();
189
68
			else if (!strcmp(*args, "-camellia256"))
190
				enc = EVP_camellia_256_cbc();
191
#endif
192
68
			else if (!strcmp(*args, "-noiter"))
193
				iter = 1;
194
68
			else if (!strcmp(*args, "-maciter"))
195
				maciter = PKCS12_DEFAULT_ITER;
196
68
			else if (!strcmp(*args, "-nomaciter"))
197
				maciter = 1;
198
68
			else if (!strcmp(*args, "-nomac"))
199
				maciter = -1;
200
68
			else if (!strcmp(*args, "-macalg"))
201
				if (args[1]) {
202
					args++;
203
					macalg = *args;
204
				} else
205
					badarg = 1;
206
68
			else if (!strcmp(*args, "-nodes"))
207
				enc = NULL;
208
68
			else if (!strcmp(*args, "-certpbe")) {
209
4
				if (!set_pbe(bio_err, &cert_pbe, *++args))
210
					badarg = 1;
211
64
			} else if (!strcmp(*args, "-keypbe")) {
212
4
				if (!set_pbe(bio_err, &key_pbe, *++args))
213
					badarg = 1;
214
60
			} else if (!strcmp(*args, "-inkey")) {
215
4
				if (args[1]) {
216
4
					args++;
217
4
					keyname = *args;
218
4
				} else
219
					badarg = 1;
220
56
			} else if (!strcmp(*args, "-certfile")) {
221
4
				if (args[1]) {
222
4
					args++;
223
4
					certfile = *args;
224
4
				} else
225
					badarg = 1;
226
52
			} else if (!strcmp(*args, "-name")) {
227
				if (args[1]) {
228
					args++;
229
					name = *args;
230
				} else
231
					badarg = 1;
232
52
			} else if (!strcmp(*args, "-LMK"))
233
				add_lmk = 1;
234
52
			else if (!strcmp(*args, "-CSP")) {
235
				if (args[1]) {
236
					args++;
237
					csp_name = *args;
238
				} else
239
					badarg = 1;
240
52
			} else if (!strcmp(*args, "-caname")) {
241
4
				if (args[1]) {
242
4
					args++;
243
4
					if (!canames)
244
4
						canames = sk_OPENSSL_STRING_new_null();
245
4
					sk_OPENSSL_STRING_push(canames, *args);
246
4
				} else
247
					badarg = 1;
248
48
			} else if (!strcmp(*args, "-in")) {
249
12
				if (args[1]) {
250
12
					args++;
251
12
					infile = *args;
252
12
				} else
253
					badarg = 1;
254
36
			} else if (!strcmp(*args, "-out")) {
255
8
				if (args[1]) {
256
8
					args++;
257
8
					outfile = *args;
258
8
				} else
259
					badarg = 1;
260
28
			} else if (!strcmp(*args, "-passin")) {
261
12
				if (args[1]) {
262
12
					args++;
263
12
					passargin = *args;
264
12
				} else
265
					badarg = 1;
266
16
			} else if (!strcmp(*args, "-passout")) {
267
8
				if (args[1]) {
268
8
					args++;
269
8
					passargout = *args;
270
8
				} else
271
					badarg = 1;
272
8
			} else if (!strcmp(*args, "-password")) {
273
				if (args[1]) {
274
					args++;
275
					passarg = *args;
276
					noprompt = 1;
277
				} else
278
					badarg = 1;
279
8
			} else if (!strcmp(*args, "-CApath")) {
280
				if (args[1]) {
281
					args++;
282
					CApath = *args;
283
				} else
284
					badarg = 1;
285
8
			} else if (!strcmp(*args, "-CAfile")) {
286
4
				if (args[1]) {
287
4
					args++;
288
4
					CAfile = *args;
289
4
				} else
290
					badarg = 1;
291
			} else
292
				badarg = 1;
293
294
		} else
295
			badarg = 1;
296
84
		args++;
297
	}
298
299
16
	if (badarg) {
300
4
		BIO_printf(bio_err, "Usage: pkcs12 [options]\n");
301
4
		BIO_printf(bio_err, "where options are\n");
302
4
		BIO_printf(bio_err, "-export       output PKCS12 file\n");
303
4
		BIO_printf(bio_err, "-chain        add certificate chain\n");
304
4
		BIO_printf(bio_err, "-inkey file   private key if not infile\n");
305
4
		BIO_printf(bio_err, "-certfile f   add all certs in f\n");
306
4
		BIO_printf(bio_err, "-CApath arg   - PEM format directory of CA's\n");
307
4
		BIO_printf(bio_err, "-CAfile arg   - PEM format file of CA's\n");
308
4
		BIO_printf(bio_err, "-name \"name\"  use name as friendly name\n");
309
4
		BIO_printf(bio_err, "-caname \"nm\"  use nm as CA friendly name (can be used more than once).\n");
310
4
		BIO_printf(bio_err, "-in  infile   input filename\n");
311
4
		BIO_printf(bio_err, "-out outfile  output filename\n");
312
4
		BIO_printf(bio_err, "-noout        don't output anything, just verify.\n");
313
4
		BIO_printf(bio_err, "-nomacver     don't verify MAC.\n");
314
4
		BIO_printf(bio_err, "-nocerts      don't output certificates.\n");
315
4
		BIO_printf(bio_err, "-clcerts      only output client certificates.\n");
316
4
		BIO_printf(bio_err, "-cacerts      only output CA certificates.\n");
317
4
		BIO_printf(bio_err, "-nokeys       don't output private keys.\n");
318
4
		BIO_printf(bio_err, "-info         give info about PKCS#12 structure.\n");
319
4
		BIO_printf(bio_err, "-des          encrypt private keys with DES\n");
320
4
		BIO_printf(bio_err, "-des3         encrypt private keys with triple DES (default)\n");
321
#ifndef OPENSSL_NO_IDEA
322
4
		BIO_printf(bio_err, "-idea         encrypt private keys with idea\n");
323
#endif
324
#ifndef OPENSSL_NO_AES
325
4
		BIO_printf(bio_err, "-aes128, -aes192, -aes256\n");
326
4
		BIO_printf(bio_err, "              encrypt PEM output with cbc aes\n");
327
#endif
328
#ifndef OPENSSL_NO_CAMELLIA
329
4
		BIO_printf(bio_err, "-camellia128, -camellia192, -camellia256\n");
330
4
		BIO_printf(bio_err, "              encrypt PEM output with cbc camellia\n");
331
#endif
332
4
		BIO_printf(bio_err, "-nodes        don't encrypt private keys\n");
333
4
		BIO_printf(bio_err, "-noiter       don't use encryption iteration\n");
334
4
		BIO_printf(bio_err, "-nomaciter    don't use MAC iteration\n");
335
4
		BIO_printf(bio_err, "-maciter      use MAC iteration\n");
336
4
		BIO_printf(bio_err, "-nomac        don't generate MAC\n");
337
4
		BIO_printf(bio_err, "-twopass      separate MAC, encryption passwords\n");
338
4
		BIO_printf(bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
339
4
		BIO_printf(bio_err, "-certpbe alg  specify certificate PBE algorithm (default RC2-40)\n");
340
4
		BIO_printf(bio_err, "-keypbe alg   specify private key PBE algorithm (default 3DES)\n");
341
4
		BIO_printf(bio_err, "-macalg alg   digest algorithm used in MAC (default SHA1)\n");
342
4
		BIO_printf(bio_err, "-keyex        set MS key exchange type\n");
343
4
		BIO_printf(bio_err, "-keysig       set MS key signature type\n");
344
4
		BIO_printf(bio_err, "-password p   set import/export password source\n");
345
4
		BIO_printf(bio_err, "-passin p     input file pass phrase source\n");
346
4
		BIO_printf(bio_err, "-passout p    output file pass phrase source\n");
347
4
		BIO_printf(bio_err, "-CSP name     Microsoft CSP name\n");
348
4
		BIO_printf(bio_err, "-LMK          Add local machine keyset attribute to private key\n");
349
4
		goto end;
350
	}
351
352
12
	if (passarg) {
353
		if (export_cert)
354
			passargout = passarg;
355
		else
356
			passargin = passarg;
357
	}
358
12
	if (!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {
359
		BIO_printf(bio_err, "Error getting passwords\n");
360
		goto end;
361
	}
362
12
	if (!cpass) {
363
12
		if (export_cert)
364
4
			cpass = passout;
365
		else
366
8
			cpass = passin;
367
	}
368
12
	if (cpass) {
369
		mpass = cpass;
370
		noprompt = 1;
371
12
	} else {
372
		cpass = pass;
373
		mpass = macpass;
374
	}
375
376
12
	if (!infile)
377
		in = BIO_new_fp(stdin, BIO_NOCLOSE);
378
	else
379
12
		in = BIO_new_file(infile, "rb");
380
12
	if (!in) {
381
		BIO_printf(bio_err, "Error opening input file %s\n",
382
		    infile ? infile : "<stdin>");
383
		perror(infile);
384
		goto end;
385
	}
386
387
12
	if (!outfile) {
388
4
		out = BIO_new_fp(stdout, BIO_NOCLOSE);
389
4
	} else
390
8
		out = BIO_new_file(outfile, "wb");
391
12
	if (!out) {
392
		BIO_printf(bio_err, "Error opening output file %s\n",
393
		    outfile ? outfile : "<stdout>");
394
		perror(outfile);
395
		goto end;
396
	}
397
12
	if (twopass) {
398
		if (EVP_read_pw_string(macpass, sizeof macpass, "Enter MAC Password:", export_cert)) {
399
			BIO_printf(bio_err, "Can't read Password\n");
400
			goto end;
401
		}
402
	}
403
12
	if (export_cert) {
404
		EVP_PKEY *key = NULL;
405
		X509 *ucert = NULL, *x = NULL;
406
		STACK_OF(X509) * certs = NULL;
407
		const EVP_MD *macmd = NULL;
408
		unsigned char *catmp = NULL;
409
		int i;
410
411
4
		if ((options & (NOCERTS | NOKEYS)) == (NOCERTS | NOKEYS)) {
412
			BIO_printf(bio_err, "Nothing to do!\n");
413
			goto export_end;
414
		}
415
4
		if (options & NOCERTS)
416
			chain = 0;
417
418
4
		if (!(options & NOKEYS)) {
419
8
			key = load_key(bio_err, keyname ? keyname : infile,
420
4
			    FORMAT_PEM, 1, passin, "private key");
421
4
			if (!key)
422
				goto export_end;
423
		}
424
425
		/* Load in all certs in input file */
426
4
		if (!(options & NOCERTS)) {
427
4
			certs = load_certs(bio_err, infile, FORMAT_PEM, NULL,
428
			    "certificates");
429
4
			if (!certs)
430
				goto export_end;
431
432
4
			if (key) {
433
				/* Look for matching private key */
434
8
				for (i = 0; i < sk_X509_num(certs); i++) {
435
4
					x = sk_X509_value(certs, i);
436
4
					if (X509_check_private_key(x, key)) {
437
						ucert = x;
438
						/* Zero keyid and alias */
439
4
						X509_keyid_set1(ucert, NULL, 0);
440
4
						X509_alias_set1(ucert, NULL, 0);
441
						/* Remove from list */
442
4
						(void) sk_X509_delete(certs, i);
443
4
						break;
444
					}
445
				}
446
4
				if (!ucert) {
447
					BIO_printf(bio_err, "No certificate matches private key\n");
448
					goto export_end;
449
				}
450
			}
451
		}
452
453
		/* Add any more certificates asked for */
454
4
		if (certfile) {
455
			STACK_OF(X509) * morecerts = NULL;
456
4
			if (!(morecerts = load_certs(bio_err, certfile, FORMAT_PEM,
457
			    NULL, "certificates from certfile")))
458
				goto export_end;
459
16
			while (sk_X509_num(morecerts) > 0)
460
4
				sk_X509_push(certs, sk_X509_shift(morecerts));
461
4
			sk_X509_free(morecerts);
462
4
		}
463
464
465
		/* If chaining get chain from user cert */
466
4
		if (chain) {
467
			int vret;
468
4
			STACK_OF(X509) * chain2;
469
4
			X509_STORE *store = X509_STORE_new();
470
4
			if (!store) {
471
				BIO_printf(bio_err, "Memory allocation error\n");
472
				goto export_end;
473
			}
474
4
			if (!X509_STORE_load_locations(store, CAfile, CApath))
475
				X509_STORE_set_default_paths(store);
476
477
4
			vret = get_cert_chain(ucert, store, &chain2);
478
4
			X509_STORE_free(store);
479
480
4
			if (!vret) {
481
				/* Exclude verified certificate */
482
16
				for (i = 1; i < sk_X509_num(chain2); i++)
483
4
					sk_X509_push(certs, sk_X509_value(chain2, i));
484
				/* Free first certificate */
485
4
				X509_free(sk_X509_value(chain2, 0));
486
4
				sk_X509_free(chain2);
487
			} else {
488
				if (vret >= 0)
489
					BIO_printf(bio_err, "Error %s getting chain.\n",
490
					    X509_verify_cert_error_string(vret));
491
				else
492
					ERR_print_errors(bio_err);
493
				goto export_end;
494
			}
495
16
		}
496
		/* Add any CA names */
497
498
16
		for (i = 0; i < sk_OPENSSL_STRING_num(canames); i++) {
499
4
			catmp = (unsigned char *) sk_OPENSSL_STRING_value(canames, i);
500
4
			X509_alias_set1(sk_X509_value(certs, i), catmp, -1);
501
		}
502
503
4
		if (csp_name && key)
504
			EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
505
			    MBSTRING_ASC, (unsigned char *) csp_name, -1);
506
507
4
		if (add_lmk && key)
508
			EVP_PKEY_add1_attr_by_NID(key, NID_LocalKeySet, 0, NULL, -1);
509
510
511

4
		if (!noprompt &&
512
		    EVP_read_pw_string(pass, sizeof pass, "Enter Export Password:", 1)) {
513
			BIO_printf(bio_err, "Can't read Password\n");
514
			goto export_end;
515
		}
516
4
		if (!twopass)
517
4
			strlcpy(macpass, pass, sizeof macpass);
518
519
520
4
		p12 = PKCS12_create(cpass, name, key, ucert, certs,
521
4
		    key_pbe, cert_pbe, iter, -1, keytype);
522
523
4
		if (!p12) {
524
			ERR_print_errors(bio_err);
525
			goto export_end;
526
		}
527
4
		if (macalg) {
528
			macmd = EVP_get_digestbyname(macalg);
529
			if (!macmd) {
530
				BIO_printf(bio_err, "Unknown digest algorithm %s\n",
531
				    macalg);
532
			}
533
		}
534
4
		if (maciter != -1)
535
4
			PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
536
537
538
4
		i2d_PKCS12_bio(out, p12);
539
540
4
		ret = 0;
541
542
export_end:
543
544
4
		if (key)
545
4
			EVP_PKEY_free(key);
546
4
		if (certs)
547
4
			sk_X509_pop_free(certs, X509_free);
548
4
		if (ucert)
549
4
			X509_free(ucert);
550
551
4
		goto end;
552
553
	}
554
8
	if (!(p12 = d2i_PKCS12_bio(in, NULL))) {
555
		ERR_print_errors(bio_err);
556
		goto end;
557
	}
558

8
	if (!noprompt && EVP_read_pw_string(pass, sizeof pass, "Enter Import Password:", 0)) {
559
		BIO_printf(bio_err, "Can't read Password\n");
560
		goto end;
561
	}
562
563
8
	if (!twopass)
564
8
		strlcpy(macpass, pass, sizeof macpass);
565
566

12
	if ((options & INFO) && p12->mac)
567
12
		BIO_printf(bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get(p12->mac->iter) : 1);
568
8
	if (macver) {
569
		/* If we enter empty password try no password first */
570

8
		if (!mpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
571
			/* If mac and crypto pass the same set it to NULL too */
572
			if (!twopass)
573
				cpass = NULL;
574
8
		} else if (!PKCS12_verify_mac(p12, mpass, -1)) {
575
			BIO_printf(bio_err, "Mac verify error: invalid password?\n");
576
			ERR_print_errors(bio_err);
577
			goto end;
578
		}
579
8
		BIO_printf(bio_err, "MAC verified OK\n");
580
8
	}
581
8
	if (!dump_certs_keys_p12(out, p12, cpass, -1, options, passout)) {
582
		BIO_printf(bio_err, "Error outputting keys and certificates\n");
583
		ERR_print_errors(bio_err);
584
		goto end;
585
	}
586
8
	ret = 0;
587
end:
588
16
	if (p12)
589
12
		PKCS12_free(p12);
590
16
	BIO_free(in);
591
16
	BIO_free_all(out);
592
16
	if (canames)
593
4
		sk_OPENSSL_STRING_free(canames);
594
16
	free(passin);
595
16
	free(passout);
596
597
16
	return (ret);
598
16
}
599
600
int
601
dump_certs_keys_p12(BIO * out, PKCS12 * p12, char *pass,
602
    int passlen, int options, char *pempass)
603
{
604
	STACK_OF(PKCS7) * asafes = NULL;
605
	STACK_OF(PKCS12_SAFEBAG) * bags;
606
	int i, bagnid;
607
	int ret = 0;
608
	PKCS7 *p7;
609
610
16
	if (!(asafes = PKCS12_unpack_authsafes(p12)))
611
		return 0;
612
48
	for (i = 0; i < sk_PKCS7_num(asafes); i++) {
613
16
		p7 = sk_PKCS7_value(asafes, i);
614
16
		bagnid = OBJ_obj2nid(p7->type);
615
16
		if (bagnid == NID_pkcs7_data) {
616
8
			bags = PKCS12_unpack_p7data(p7);
617
8
			if (options & INFO)
618
4
				BIO_printf(bio_err, "PKCS7 Data\n");
619
8
		} else if (bagnid == NID_pkcs7_encrypted) {
620
8
			if (options & INFO) {
621
4
				BIO_printf(bio_err, "PKCS7 Encrypted data: ");
622
8
				alg_print(bio_err,
623
4
				    p7->d.encrypted->enc_data->algorithm);
624
4
			}
625
8
			bags = PKCS12_unpack_p7encdata(p7, pass, passlen);
626
		} else
627
			continue;
628
16
		if (!bags)
629
			goto err;
630
32
		if (!dump_certs_pkeys_bags(out, bags, pass, passlen,
631
			options, pempass)) {
632
			sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
633
			goto err;
634
		}
635
16
		sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
636
		bags = NULL;
637
16
	}
638
8
	ret = 1;
639
640
err:
641
642
8
	if (asafes)
643
8
		sk_PKCS7_pop_free(asafes, PKCS7_free);
644
8
	return ret;
645
8
}
646
647
int
648
dump_certs_pkeys_bags(BIO * out, STACK_OF(PKCS12_SAFEBAG) * bags,
649
    char *pass, int passlen, int options, char *pempass)
650
{
651
	int i;
652
112
	for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
653
32
		if (!dump_certs_pkeys_bag(out,
654
32
			sk_PKCS12_SAFEBAG_value(bags, i),
655
			pass, passlen,
656
			options, pempass))
657
			return 0;
658
	}
659
16
	return 1;
660
16
}
661
662
int
663
dump_certs_pkeys_bag(BIO * out, PKCS12_SAFEBAG * bag, char *pass,
664
    int passlen, int options, char *pempass)
665
{
666
	EVP_PKEY *pkey;
667
	PKCS8_PRIV_KEY_INFO *p8;
668
	X509 *x509;
669
670

64
	switch (OBJ_obj2nid(bag->type)) {
671
	case NID_keyBag:
672
		if (options & INFO)
673
			BIO_printf(bio_err, "Key bag\n");
674
		if (options & NOKEYS)
675
			return 1;
676
		print_attribs(out, bag->attrib, "Bag Attributes");
677
		p8 = bag->value.keybag;
678
		if (!(pkey = EVP_PKCS82PKEY(p8)))
679
			return 0;
680
		print_attribs(out, p8->attributes, "Key Attributes");
681
		PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, pempass);
682
		EVP_PKEY_free(pkey);
683
		break;
684
685
	case NID_pkcs8ShroudedKeyBag:
686
8
		if (options & INFO) {
687
4
			BIO_printf(bio_err, "Shrouded Keybag: ");
688
4
			alg_print(bio_err, bag->value.shkeybag->algor);
689
4
		}
690
8
		if (options & NOKEYS)
691
4
			return 1;
692
4
		print_attribs(out, bag->attrib, "Bag Attributes");
693
4
		if (!(p8 = PKCS12_decrypt_skey(bag, pass, passlen)))
694
			return 0;
695
4
		if (!(pkey = EVP_PKCS82PKEY(p8))) {
696
			PKCS8_PRIV_KEY_INFO_free(p8);
697
			return 0;
698
		}
699
4
		print_attribs(out, p8->attributes, "Key Attributes");
700
4
		PKCS8_PRIV_KEY_INFO_free(p8);
701
4
		PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, pempass);
702
4
		EVP_PKEY_free(pkey);
703
4
		break;
704
705
	case NID_certBag:
706
24
		if (options & INFO)
707
12
			BIO_printf(bio_err, "Certificate bag\n");
708
24
		if (options & NOCERTS)
709
12
			return 1;
710
12
		if (PKCS12_get_attr(bag, NID_localKeyID)) {
711
4
			if (options & CACERTS)
712
				return 1;
713
8
		} else if (options & CLCERTS)
714
			return 1;
715
12
		print_attribs(out, bag->attrib, "Bag Attributes");
716
12
		if (OBJ_obj2nid(bag->value.bag->type) != NID_x509Certificate)
717
			return 1;
718
12
		if (!(x509 = PKCS12_certbag2x509(bag)))
719
			return 0;
720
12
		dump_cert_text(out, x509);
721
12
		PEM_write_bio_X509(out, x509);
722
12
		X509_free(x509);
723
12
		break;
724
725
	case NID_safeContentsBag:
726
		if (options & INFO)
727
			BIO_printf(bio_err, "Safe Contents bag\n");
728
		print_attribs(out, bag->attrib, "Bag Attributes");
729
		return dump_certs_pkeys_bags(out, bag->value.safes, pass,
730
		    passlen, options, pempass);
731
732
	default:
733
		BIO_printf(bio_err, "Warning unsupported bag type: ");
734
		i2a_ASN1_OBJECT(bio_err, bag->type);
735
		BIO_printf(bio_err, "\n");
736
		return 1;
737
		break;
738
	}
739
16
	return 1;
740
32
}
741
742
/* Given a single certificate return a verified chain or NULL if error */
743
744
/* Hope this is OK .... */
745
746
int
747
get_cert_chain(X509 * cert, X509_STORE * store, STACK_OF(X509) ** chain)
748
{
749
8
	X509_STORE_CTX store_ctx;
750
	STACK_OF(X509) * chn;
751
	int i = 0;
752
753
	/*
754
	 * FIXME: Should really check the return status of
755
	 * X509_STORE_CTX_init for an error, but how that fits into the
756
	 * return value of this function is less obvious.
757
	 */
758
4
	X509_STORE_CTX_init(&store_ctx, store, cert, NULL);
759
8
	if (X509_verify_cert(&store_ctx) <= 0) {
760
		i = X509_STORE_CTX_get_error(&store_ctx);
761
		if (i == 0)
762
			/*
763
			 * avoid returning 0 if X509_verify_cert() did not
764
			 * set an appropriate error value in the context
765
			 */
766
			i = -1;
767
		chn = NULL;
768
		goto err;
769
	} else
770
4
		chn = X509_STORE_CTX_get1_chain(&store_ctx);
771
err:
772
4
	X509_STORE_CTX_cleanup(&store_ctx);
773
4
	*chain = chn;
774
775
4
	return i;
776
4
}
777
778
int
779
alg_print(BIO * x, X509_ALGOR * alg)
780
{
781
	PBEPARAM *pbe;
782
16
	const unsigned char *p;
783
8
	p = alg->parameter->value.sequence->data;
784
8
	pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
785
8
	if (!pbe)
786
8
		return 1;
787
	BIO_printf(bio_err, "%s, Iteration %ld\n",
788
	    OBJ_nid2ln(OBJ_obj2nid(alg->algorithm)),
789
	    ASN1_INTEGER_get(pbe->iter));
790
	PBEPARAM_free(pbe);
791
	return 1;
792
8
}
793
794
/* Load all certificates from a given file */
795
796
int
797
cert_load(BIO * in, STACK_OF(X509) * sk)
798
{
799
	int ret;
800
	X509 *cert;
801
	ret = 0;
802
	while ((cert = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
803
		ret = 1;
804
		sk_X509_push(sk, cert);
805
	}
806
	if (ret)
807
		ERR_clear_error();
808
	return ret;
809
}
810
811
/* Generalised attribute print: handle PKCS#8 and bag attributes */
812
813
int
814
print_attribs(BIO * out, STACK_OF(X509_ATTRIBUTE) * attrlst, const char *name)
815
{
816
	X509_ATTRIBUTE *attr;
817
	ASN1_TYPE *av;
818
	char *value;
819
	int i, attr_nid;
820
40
	if (!attrlst) {
821
8
		BIO_printf(out, "%s: <No Attributes>\n", name);
822
8
		return 1;
823
	}
824
12
	if (!sk_X509_ATTRIBUTE_num(attrlst)) {
825
		BIO_printf(out, "%s: <Empty Attributes>\n", name);
826
		return 1;
827
	}
828
12
	BIO_printf(out, "%s\n", name);
829
48
	for (i = 0; i < sk_X509_ATTRIBUTE_num(attrlst); i++) {
830
12
		attr = sk_X509_ATTRIBUTE_value(attrlst, i);
831
12
		attr_nid = OBJ_obj2nid(attr->object);
832
12
		BIO_printf(out, "    ");
833
12
		if (attr_nid == NID_undef) {
834
			i2a_ASN1_OBJECT(out, attr->object);
835
			BIO_printf(out, ": ");
836
		} else
837
12
			BIO_printf(out, "%s: ", OBJ_nid2ln(attr_nid));
838
839
12
		if (sk_ASN1_TYPE_num(attr->value.set)) {
840
12
			av = sk_ASN1_TYPE_value(attr->value.set, 0);
841

12
			switch (av->type) {
842
			case V_ASN1_BMPSTRING:
843
8
				value = OPENSSL_uni2asc(av->value.bmpstring->data,
844
4
				    av->value.bmpstring->length);
845
4
				BIO_printf(out, "%s\n", value);
846
4
				free(value);
847
4
				break;
848
849
			case V_ASN1_OCTET_STRING:
850
16
				hex_prin(out, av->value.octet_string->data,
851
8
				    av->value.octet_string->length);
852
8
				BIO_printf(out, "\n");
853
8
				break;
854
855
			case V_ASN1_BIT_STRING:
856
				hex_prin(out, av->value.bit_string->data,
857
				    av->value.bit_string->length);
858
				BIO_printf(out, "\n");
859
				break;
860
861
			default:
862
				BIO_printf(out, "<Unsupported tag %d>\n", av->type);
863
				break;
864
			}
865
		} else
866
			BIO_printf(out, "<No Values>\n");
867
	}
868
12
	return 1;
869
20
}
870
871
void
872
hex_prin(BIO * out, unsigned char *buf, int len)
873
{
874
	int i;
875
344
	for (i = 0; i < len; i++)
876
160
		BIO_printf(out, "%02X ", buf[i]);
877
8
}
878
879
static int
880
set_pbe(BIO * err, int *ppbe, const char *str)
881
{
882
16
	if (!str)
883
		return 0;
884
8
	if (!strcmp(str, "NONE")) {
885
		*ppbe = -1;
886
		return 1;
887
	}
888
8
	*ppbe = OBJ_txt2nid(str);
889
8
	if (*ppbe == NID_undef) {
890
		BIO_printf(bio_err, "Unknown PBE algorithm %s\n", str);
891
		return 0;
892
	}
893
8
	return 1;
894
8
}
895
896
#endif