generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Tidy up pkcs12 application.

Browse Source
This commit is contained in:
Dr. Stephen Henson 1999-07-29 21:50:34 +00:00
parent 4320afe3be
commit 12ea44704a
1 changed files with 40 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
apps/pkcs12.c
View File

@ -238,42 +238,42 @@ int MAIN(int argc, char **argv)
ERR_load_crypto_strings(); ERR_load_crypto_strings();
in = BIO_new (BIO_s_file()); if (!infile) in = BIO_new_fp(stdin, BIO_NOCLOSE);
out = BIO_new (BIO_s_file()); else in = BIO_new_file(infile, "rb");
if (!in) {
if (!infile) BIO_set_fp (in, stdin, BIO_NOCLOSE); BIO_printf(bio_err, "Error opening input file %s\n",
else { infile ? infile : "<stdin>");
if (BIO_read_filename (in, infile) <= 0) {
perror (infile); perror (infile);
goto end; goto end;
} }
}
if (certfile) { if (certfile) {
certsin = BIO_new (BIO_s_file()); if(!(certsin = BIO_new_file(certfile, "r"))) {
if (BIO_read_filename (certsin, certfile) <= 0) { BIO_printf(bio_err, "Can't open certificate file %s\n", certfile);
perror (certfile); perror (certfile);
goto end; goto end;
} }
} }
if (keyname) { if (keyname) {
inkey = BIO_new (BIO_s_file()); if(!(inkey = BIO_new_file(keyname, "r"))) {
if (BIO_read_filename (inkey, keyname) <= 0) { BIO_printf(bio_err, "Can't key certificate file %s\n", keyname);
perror (keyname); perror (keyname);
goto end; goto end;
} }
} }
if (!outfile) BIO_set_fp (out, stdout, BIO_NOCLOSE); if (!outfile) out = BIO_new_fp(stdout, BIO_NOCLOSE);
else { else out = BIO_new_file(outfile, "wb");
if (BIO_write_filename (out, outfile) <= 0) { if (!out) {
perror (outfile); BIO_printf(bio_err, "Error opening output file %s\n",
goto end; outfile ? outfile : "<stdout>");
} perror (outfile);
goto end;
} }
if (twopass) { if (twopass) {
if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert)) { if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert))
{
BIO_printf (bio_err, "Can't read Password\n"); BIO_printf (bio_err, "Can't read Password\n");
goto end; goto end;
} }
@ -285,15 +285,14 @@ if (export_cert) {
PKCS12_SAFEBAG *bag; PKCS12_SAFEBAG *bag;
PKCS8_PRIV_KEY_INFO *p8; PKCS8_PRIV_KEY_INFO *p8;
PKCS7 *authsafe; PKCS7 *authsafe;
X509 *cert, *ucert = NULL; X509 *cert = NULL, *ucert = NULL;
STACK_OF(X509) *certs; STACK_OF(X509) *certs;
char *catmp; char *catmp;
int i, pmatch = 0; int i;
unsigned char keyid[EVP_MAX_MD_SIZE]; unsigned char keyid[EVP_MAX_MD_SIZE];
unsigned int keyidlen; unsigned int keyidlen = 0;
/* Get private key so we can match it to a certificate */
key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, NULL); key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, NULL);
if (!inkey) (void)BIO_reset(in); if (!inkey) (void) BIO_reset(in);
if (!key) { if (!key) {
BIO_printf (bio_err, "Error loading private key\n"); BIO_printf (bio_err, "Error loading private key\n");
ERR_print_errors(bio_err); ERR_print_errors(bio_err);
@ -308,6 +307,19 @@ if (export_cert) {
ERR_print_errors(bio_err); ERR_print_errors(bio_err);
goto end; goto end;
} }
for(i = 0; i < sk_X509_num(certs); i++) {
ucert = sk_X509_value(certs, i);
if(X509_check_private_key(ucert, key)) {
X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
break;
}
}
if(!keyidlen) {
BIO_printf(bio_err, "No certificate matches private key\n");
goto end;
}
bags = sk_new (NULL); bags = sk_new (NULL);
@ -321,26 +333,10 @@ if (export_cert) {
BIO_free(certsin); BIO_free(certsin);
} }
/* Find certificate (if any) matching private key */
for(i = 0; i < sk_X509_num(certs); i++) {
cert = sk_X509_value(certs, i);
if(X509_check_private_key(cert, key)) {
ucert = cert;
break;
}
}
if(!ucert) {
BIO_printf(bio_err, "No certificate matches private key\n");
goto end;
}
/* If chaining get chain from user cert */ /* If chaining get chain from user cert */
if (chain) { if (chain) {
int vret; int vret;
STACK_OF(X509) *chain2; STACK_OF(X509) *chain2;
vret = get_cert_chain (ucert, &chain2); vret = get_cert_chain (ucert, &chain2);
if (vret) { if (vret) {
BIO_printf (bio_err, "Error %s getting chain.\n", BIO_printf (bio_err, "Error %s getting chain.\n",
@ -358,12 +354,10 @@ if (export_cert) {
for(i = 0; i < sk_X509_num(certs); i++) { for(i = 0; i < sk_X509_num(certs); i++) {
cert = sk_X509_value(certs, i); cert = sk_X509_value(certs, i);
bag = M_PKCS12_x5092certbag(cert); bag = M_PKCS12_x5092certbag(cert);
/* If it matches private key mark it */ /* If it matches private key set id */
if(cert == ucert) { if(cert == ucert) {
if(name) PKCS12_add_friendlyname(bag, name, -1); if(name) PKCS12_add_friendlyname(bag, name, -1);
X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
PKCS12_add_localkeyid(bag, keyid, keyidlen); PKCS12_add_localkeyid(bag, keyid, keyidlen);
pmatch = 1;
} else if((catmp = sk_shift(canames))) } else if((catmp = sk_shift(canames)))
PKCS12_add_friendlyname(bag, catmp, -1); PKCS12_add_friendlyname(bag, catmp, -1);
sk_push(bags, (char *)bag); sk_push(bags, (char *)bag);
@ -378,7 +372,7 @@ if (export_cert) {
} }
if (!twopass) strcpy(macpass, pass); if (!twopass) strcpy(macpass, pass);
/* Turn certbags into encrypted authsafe */ /* Turn certbags into encrypted authsafe */
authsafe = PKCS12_pack_p7encdata (cert_pbe, cpass, -1, NULL, 0, authsafe = PKCS12_pack_p7encdata(cert_pbe, cpass, -1, NULL, 0,
iter, bags); iter, bags);
sk_pop_free(bags, PKCS12_SAFEBAG_free); sk_pop_free(bags, PKCS12_SAFEBAG_free);
@ -394,11 +388,11 @@ if (export_cert) {
p8 = EVP_PKEY2PKCS8 (key); p8 = EVP_PKEY2PKCS8 (key);
EVP_PKEY_free(key); EVP_PKEY_free(key);
if(keytype) PKCS8_add_keyusage(p8, keytype); if(keytype) PKCS8_add_keyusage(p8, keytype);
bag = PKCS12_MAKE_SHKEYBAG (NID_pbe_WithSHA1And3_Key_TripleDES_CBC, bag = PKCS12_MAKE_SHKEYBAG(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
cpass, -1, NULL, 0, iter, p8); cpass, -1, NULL, 0, iter, p8);
PKCS8_PRIV_KEY_INFO_free(p8); PKCS8_PRIV_KEY_INFO_free(p8);
if (name) PKCS12_add_friendlyname (bag, name, -1); if (name) PKCS12_add_friendlyname (bag, name, -1);
if(pmatch) PKCS12_add_localkeyid (bag, keyid, keyidlen); PKCS12_add_localkeyid (bag, keyid, keyidlen);
bags = sk_new(NULL); bags = sk_new(NULL);
sk_push (bags, (char *)bag); sk_push (bags, (char *)bag);
/* Turn it into unencrypted safe bag */ /* Turn it into unencrypted safe bag */