diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2004-12-29 01:07:14 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2004-12-29 01:07:14 +0000 |
| commit | e90faddaf859f1e68798e04678bd8bf07800bce3 (patch) | |
| tree | c40db71c8b3370c1f88d3aff2dc0e20dcb394c49 /apps | |
| parent | f1ce306f301dc4214a9def53b079dfbcf8dcb299 (diff) | |
Prompt for passphrases for PKCS12 input format
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/apps.c | 62 |
1 files changed, 52 insertions, 10 deletions
diff --git a/apps/apps.c b/apps/apps.c index 38ad3b07b1..e08c4bdeba 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -688,6 +688,51 @@ int add_oid_section(BIO *err, CONF *conf) return 1; } +static int load_pkcs12(BIO *err, BIO *in, const char *desc, + pem_password_cb *pem_cb, void *cb_data, + EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca) + { + const char *pass; + char tpass[PEM_BUFSIZE]; + int len, ret = 0; + PKCS12 *p12; + p12 = d2i_PKCS12_bio(in, NULL); + if (p12 == NULL) + { + BIO_printf(err, "Error loading PKCS12 file for %s\n", desc); + goto err; + } + /* See if an empty password will do */ + if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) + pass = ""; + else + { + if (!pem_cb) + pem_cb = (pem_password_cb *)password_callback; + len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data); + if (len < 0) + { + BIO_printf(err, "Passpharse callback error for %s\n", + desc); + goto err; + } + if (len < PEM_BUFSIZE) + tpass[len] = 0; + if (!PKCS12_verify_mac(p12, tpass, len)) + { + BIO_printf(err, + "Mac verify error (wrong password?) in PKCS12 file for %s\n", desc); + goto err; + } + pass = tpass; + } + ret = PKCS12_parse(p12, pass, pkey, cert, ca); + err: + if (p12) + PKCS12_free(p12); + return ret; + } + X509 *load_cert(BIO *err, const char *file, int format, const char *pass, ENGINE *e, const char *cert_descrip) { @@ -768,11 +813,9 @@ X509 *load_cert(BIO *err, const char *file, int format, (pem_password_cb *)password_callback, NULL); else if (format == FORMAT_PKCS12) { - PKCS12 *p12 = d2i_PKCS12_bio(cert, NULL); - - PKCS12_parse(p12, NULL, NULL, &x, NULL); - PKCS12_free(p12); - p12 = NULL; + if (!load_pkcs12(err, cert,cert_descrip, NULL, NULL, + NULL, &x, NULL)) + goto end; } else { BIO_printf(err,"bad input format specified for %s\n", @@ -851,11 +894,10 @@ EVP_PKEY *load_key(BIO *err, const char *file, int format, int maybe_stdin, #endif else if (format == FORMAT_PKCS12) { - PKCS12 *p12 = d2i_PKCS12_bio(key, NULL); - - PKCS12_parse(p12, pass, &pkey, NULL, NULL); - PKCS12_free(p12); - p12 = NULL; + if (!load_pkcs12(err, key, key_descrip, + (pem_password_cb *)password_callback, &cb_data, + &pkey, NULL, NULL)) + goto end; } else { |