X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;ds=sidebyside;f=apps%2Fpkcs8.c;h=43a828484784944349297087ab14ebbd1e601136;hb=fd836aeee017d4c7fef8e4d21afa07081e815be2;hp=9e9b92b33ee615a477d4222a3091a379e15ebe60;hpb=74678cc2f8132ad34f7c33731c4765cf3083de8c;p=oweals%2Fopenssl.git diff --git a/apps/pkcs8.c b/apps/pkcs8.c index 9e9b92b33e..43a8284847 100644 --- a/apps/pkcs8.c +++ b/apps/pkcs8.c @@ -56,18 +56,22 @@ * */ #include +#include +#include "apps.h" #include #include #include #include -#include "apps.h" #define PROG pkcs8_main +int MAIN(int, char **); int MAIN(int argc, char **argv) { + ENGINE *e = NULL; char **args, *infile = NULL, *outfile = NULL; + char *passargin = NULL, *passargout = NULL; BIO *in = NULL, *out = NULL; int topk8 = 0; int pbe_nid = -1; @@ -78,14 +82,23 @@ int MAIN(int argc, char **argv) int nocrypt = 0; X509_SIG *p8; PKCS8_PRIV_KEY_INFO *p8inf; - EVP_PKEY *pkey; - char pass[50]; + EVP_PKEY *pkey=NULL; + char pass[50], *passin = NULL, *passout = NULL, *p8pass = NULL; int badarg = 0; +#ifndef OPENSSL_NO_ENGINE + char *engine=NULL; +#endif + if (bio_err == NULL) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE); + + if (!load_config(bio_err, NULL)) + goto end; + informat=FORMAT_PEM; outformat=FORMAT_PEM; + ERR_load_crypto_strings(); - SSLeay_add_all_algorithms(); + OpenSSL_add_all_algorithms(); args = argv + 1; while (!badarg && *args && *args[0] == '-') { if (!strcmp(*args,"-v2")) { @@ -98,6 +111,16 @@ int MAIN(int argc, char **argv) badarg = 1; } } else badarg = 1; + } else if (!strcmp(*args,"-v1")) { + if (args[1]) { + args++; + pbe_nid=OBJ_txt2nid(*args); + if(pbe_nid == NID_undef) { + BIO_printf(bio_err, + "Unknown PBE algorithm %s\n", *args); + badarg = 1; + } + } else badarg = 1; } else if (!strcmp(*args,"-inform")) { if (args[1]) { args++; @@ -112,6 +135,25 @@ int MAIN(int argc, char **argv) else if (!strcmp (*args, "-noiter")) iter = 1; else if (!strcmp (*args, "-nocrypt")) nocrypt = 1; else if (!strcmp (*args, "-nooct")) p8_broken = PKCS8_NO_OCTET; + else if (!strcmp (*args, "-nsdb")) p8_broken = PKCS8_NS_DB; + else if (!strcmp (*args, "-embed")) p8_broken = PKCS8_EMBEDDED_PARAM; + else if (!strcmp(*args,"-passin")) + { + if (!args[1]) goto bad; + passargin= *(++args); + } + else if (!strcmp(*args,"-passout")) + { + if (!args[1]) goto bad; + passargout= *(++args); + } +#ifndef OPENSSL_NO_ENGINE + else if (strcmp(*args,"-engine") == 0) + { + if (!args[1]) goto bad; + engine= *(++args); + } +#endif else if (!strcmp (*args, "-in")) { if (args[1]) { args++; @@ -127,25 +169,43 @@ int MAIN(int argc, char **argv) } if (badarg) { - BIO_printf (bio_err, "Usage pkcs8 [options]\n"); - BIO_printf (bio_err, "where options are\n"); - BIO_printf (bio_err, "-in file input file\n"); - BIO_printf (bio_err, "-inform X input format (DER or PEM)\n"); - BIO_printf (bio_err, "-outform X output format (DER or PEM)\n"); - BIO_printf (bio_err, "-out file output file\n"); - BIO_printf (bio_err, "-topk8 output PKCS8 file\n"); - BIO_printf (bio_err, "-nooct use (broken) no octet form\n"); - BIO_printf (bio_err, "-noiter use 1 as iteration count\n"); - BIO_printf (bio_err, "-nocrypt use or expect unencrypted private key\n"); - BIO_printf (bio_err, "-v2 alg use PKCS#5 v2.0 and cipher \"alg\"\n"); + bad: + BIO_printf(bio_err, "Usage pkcs8 [options]\n"); + BIO_printf(bio_err, "where options are\n"); + BIO_printf(bio_err, "-in file input file\n"); + BIO_printf(bio_err, "-inform X input format (DER or PEM)\n"); + BIO_printf(bio_err, "-passin arg input file pass phrase source\n"); + BIO_printf(bio_err, "-outform X output format (DER or PEM)\n"); + BIO_printf(bio_err, "-out file output file\n"); + BIO_printf(bio_err, "-passout arg output file pass phrase source\n"); + BIO_printf(bio_err, "-topk8 output PKCS8 file\n"); + BIO_printf(bio_err, "-nooct use (nonstandard) no octet format\n"); + BIO_printf(bio_err, "-embed use (nonstandard) embedded DSA parameters format\n"); + BIO_printf(bio_err, "-nsdb use (nonstandard) DSA Netscape DB format\n"); + BIO_printf(bio_err, "-noiter use 1 as iteration count\n"); + BIO_printf(bio_err, "-nocrypt use or expect unencrypted private key\n"); + BIO_printf(bio_err, "-v2 alg use PKCS#5 v2.0 and cipher \"alg\"\n"); + BIO_printf(bio_err, "-v1 obj use PKCS#5 v1.5 and cipher \"alg\"\n"); +#ifndef OPENSSL_NO_ENGINE + BIO_printf(bio_err," -engine e use engine e, possibly a hardware device.\n"); +#endif + return (1); + } + +#ifndef OPENSSL_NO_ENGINE + e = setup_engine(bio_err, engine, 0); +#endif + + if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) { + BIO_printf(bio_err, "Error getting passwords\n"); return (1); } if ((pbe_nid == -1) && !cipher) pbe_nid = NID_pbeWithMD5AndDES_CBC; if (infile) { - if (!(in = BIO_new_file (infile, "rb"))) { - BIO_printf (bio_err, + if (!(in = BIO_new_file(infile, "rb"))) { + BIO_printf(bio_err, "Can't open input file %s\n", infile); return (1); } @@ -153,25 +213,35 @@ int MAIN(int argc, char **argv) if (outfile) { if (!(out = BIO_new_file (outfile, "wb"))) { - BIO_printf (bio_err, + BIO_printf(bio_err, "Can't open output file %s\n", outfile); return (1); } - } else out = BIO_new_fp (stdout, BIO_NOCLOSE); - - if (topk8) { - if (!(pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL))) { - BIO_printf (bio_err, "Error reading key\n", outfile); - ERR_print_errors(bio_err); + } else { + out = BIO_new_fp (stdout, BIO_NOCLOSE); +#ifdef OPENSSL_SYS_VMS + { + BIO *tmpbio = BIO_new(BIO_f_linebuffer()); + out = BIO_push(tmpbio, out); + } +#endif + } + if (topk8) + { + BIO_free(in); /* Not needed in this section */ + pkey = load_key(bio_err, infile, informat, 1, + passin, e, "key"); + if (!pkey) { + BIO_free_all(out); return (1); } - BIO_free(in); - if (!(p8inf = EVP_PKEY2PKCS8(pkey))) { - BIO_printf (bio_err, "Error converting key\n", outfile); + if (!(p8inf = EVP_PKEY2PKCS8_broken(pkey, p8_broken))) { + BIO_printf(bio_err, "Error converting key\n"); ERR_print_errors(bio_err); + EVP_PKEY_free(pkey); + BIO_free_all(out); return (1); } - PKCS8_set_broken(p8inf, p8_broken); if(nocrypt) { if(outformat == FORMAT_PEM) PEM_write_bio_PKCS8_PRIV_KEY_INFO(out, p8inf); @@ -179,31 +249,53 @@ int MAIN(int argc, char **argv) i2d_PKCS8_PRIV_KEY_INFO_bio(out, p8inf); else { BIO_printf(bio_err, "Bad format specified for key\n"); + PKCS8_PRIV_KEY_INFO_free(p8inf); + EVP_PKEY_free(pkey); + BIO_free_all(out); return (1); } } else { - EVP_read_pw_string(pass, 50, "Enter Encryption Password:", 1); + if(passout) p8pass = passout; + else { + p8pass = pass; + if (EVP_read_pw_string(pass, sizeof pass, "Enter Encryption Password:", 1)) + { + PKCS8_PRIV_KEY_INFO_free(p8inf); + EVP_PKEY_free(pkey); + BIO_free_all(out); + return (1); + } + } + app_RAND_load_file(NULL, bio_err, 0); if (!(p8 = PKCS8_encrypt(pbe_nid, cipher, - pass, strlen(pass), + p8pass, strlen(p8pass), NULL, 0, iter, p8inf))) { - BIO_printf (bio_err, "Error encrypting key\n", - outfile); + BIO_printf(bio_err, "Error encrypting key\n"); ERR_print_errors(bio_err); + PKCS8_PRIV_KEY_INFO_free(p8inf); + EVP_PKEY_free(pkey); + BIO_free_all(out); return (1); } + app_RAND_write_file(NULL, bio_err); if(outformat == FORMAT_PEM) - PEM_write_bio_PKCS8 (out, p8); + PEM_write_bio_PKCS8(out, p8); else if(outformat == FORMAT_ASN1) i2d_PKCS8_bio(out, p8); else { BIO_printf(bio_err, "Bad format specified for key\n"); + PKCS8_PRIV_KEY_INFO_free(p8inf); + EVP_PKEY_free(pkey); + BIO_free_all(out); return (1); } X509_SIG_free(p8); } PKCS8_PRIV_KEY_INFO_free (p8inf); EVP_PKEY_free(pkey); - BIO_free(out); + BIO_free_all(out); + if(passin) OPENSSL_free(passin); + if(passout) OPENSSL_free(passout); return (0); } @@ -227,23 +319,27 @@ int MAIN(int argc, char **argv) } if (!p8) { - BIO_printf (bio_err, "Error reading key\n", outfile); + BIO_printf (bio_err, "Error reading key\n"); ERR_print_errors(bio_err); return (1); } - EVP_read_pw_string(pass, 50, "Enter Password:", 0); - p8inf = M_PKCS8_decrypt(p8, pass, strlen(pass)); + if(passin) p8pass = passin; + else { + p8pass = pass; + EVP_read_pw_string(pass, sizeof pass, "Enter Password:", 0); + } + p8inf = PKCS8_decrypt(p8, p8pass, strlen(p8pass)); X509_SIG_free(p8); } if (!p8inf) { - BIO_printf(bio_err, "Error decrypting key\n", outfile); + BIO_printf(bio_err, "Error decrypting key\n"); ERR_print_errors(bio_err); return (1); } if (!(pkey = EVP_PKCS82PKEY(p8inf))) { - BIO_printf(bio_err, "Error converting key\n", outfile); + BIO_printf(bio_err, "Error converting key\n"); ERR_print_errors(bio_err); return (1); } @@ -252,7 +348,15 @@ int MAIN(int argc, char **argv) BIO_printf(bio_err, "Warning: broken key encoding: "); switch (p8inf->broken) { case PKCS8_NO_OCTET: - BIO_printf(bio_err, "No Octet String\n"); + BIO_printf(bio_err, "No Octet String in PrivateKey\n"); + break; + + case PKCS8_EMBEDDED_PARAM: + BIO_printf(bio_err, "DSA parameters included in PrivateKey\n"); + break; + + case PKCS8_NS_DB: + BIO_printf(bio_err, "DSA public key include in PrivateKey\n"); break; default: @@ -262,12 +366,21 @@ int MAIN(int argc, char **argv) } PKCS8_PRIV_KEY_INFO_free(p8inf); + if(outformat == FORMAT_PEM) + PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, passout); + else if(outformat == FORMAT_ASN1) + i2d_PrivateKey_bio(out, pkey); + else { + BIO_printf(bio_err, "Bad format specified for key\n"); + return (1); + } - PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, NULL); - + end: EVP_PKEY_free(pkey); - BIO_free(out); + BIO_free_all(out); BIO_free(in); + if(passin) OPENSSL_free(passin); + if(passout) OPENSSL_free(passout); return (0); }