Tidy up pkcs12 application.

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index f3f82ddfc9cbabd24537ca8b0b5ddc05164ee2d1..351f131fe170d925d03897c6b975a2b3af35bb27 100644 (file)
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -238,42 +238,42 @@ int MAIN(int argc, char **argv)
 
     ERR_load_crypto_strings();
 
-    in = BIO_new (BIO_s_file());
-    out = BIO_new (BIO_s_file());
-
-    if (!infile) BIO_set_fp (in, stdin, BIO_NOCLOSE);
-    else {
-        if (BIO_read_filename (in, infile) <= 0) {
+    if (!infile) in = BIO_new_fp(stdin, BIO_NOCLOSE);
+    else in = BIO_new_file(infile, "rb");
+    if (!in) {
+           BIO_printf(bio_err, "Error opening input file %s\n",
+                                               infile ? infile : "<stdin>");
            perror (infile);
            goto end;
-       }
-    }
+   }
 
    if (certfile) {
-       certsin = BIO_new (BIO_s_file());
-        if (BIO_read_filename (certsin, certfile) <= 0) {
+       if(!(certsin = BIO_new_file(certfile, "r"))) {
+           BIO_printf(bio_err, "Can't open certificate file %s\n", certfile);
            perror (certfile);
            goto end;
        }
     }
 
     if (keyname) {
-       inkey = BIO_new (BIO_s_file());
-        if (BIO_read_filename (inkey, keyname) <= 0) {
+       if(!(inkey = BIO_new_file(keyname, "r"))) {
+           BIO_printf(bio_err, "Can't key certificate file %s\n", keyname);
            perror (keyname);
            goto end;
        }
      }
 
-    if (!outfile) BIO_set_fp (out, stdout, BIO_NOCLOSE);
-    else {
-        if (BIO_write_filename (out, outfile) <= 0) {
-           perror (outfile);
-           goto end;
-       }
+    if (!outfile) out = BIO_new_fp(stdout, BIO_NOCLOSE);
+    else out = BIO_new_file(outfile, "wb");
+    if (!out) {
+       BIO_printf(bio_err, "Error opening output file %s\n",
+                                               outfile ? outfile : "<stdout>");
+       perror (outfile);
+       goto end;
     }
     if (twopass) {
-       if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert)) {
+       if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert))
+       {
            BIO_printf (bio_err, "Can't read Password\n");
            goto end;
                }
@@ -285,15 +285,14 @@ if (export_cert) {
        PKCS12_SAFEBAG *bag;
        PKCS8_PRIV_KEY_INFO *p8;
        PKCS7 *authsafe;
-       X509 *cert, *ucert = NULL;
+       X509 *cert = NULL, *ucert = NULL;
        STACK_OF(X509) *certs;
        char *catmp;
-       int i, pmatch = 0;
+       int i;
        unsigned char keyid[EVP_MAX_MD_SIZE];
-       unsigned int keyidlen;
-       /* Get private key so we can match it to a certificate */
+       unsigned int keyidlen = 0;
        key = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, NULL);
-       if (!inkey) (void)BIO_reset(in);
+       if (!inkey) (void) BIO_reset(in);
        if (!key) {
                BIO_printf (bio_err, "Error loading private key\n");
                ERR_print_errors(bio_err);
@@ -308,6 +307,19 @@ if (export_cert) {
                ERR_print_errors(bio_err);
                goto end;
        }
+
+       for(i = 0; i < sk_X509_num(certs); i++) {
+               ucert = sk_X509_value(certs, i);
+               if(X509_check_private_key(ucert, key)) {
+                       X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
+                       break;
+               }
+       }
+
+       if(!keyidlen) {
+               BIO_printf(bio_err, "No certificate matches private key\n");
+               goto end;
+       }
        
        bags = sk_new (NULL);
 
@@ -321,26 +333,10 @@ if (export_cert) {
                BIO_free(certsin);
        }
 
-       /* Find certificate (if any) matching private key */
-
-       for(i = 0; i < sk_X509_num(certs); i++) {
-                       cert = sk_X509_value(certs, i);
-                       if(X509_check_private_key(cert, key)) {
-                               ucert = cert;
-                               break;
-                       }
-       }
-
-       if(!ucert) {
-               BIO_printf(bio_err, "No certificate matches private key\n");
-               goto end;
-       }
-
        /* If chaining get chain from user cert */
        if (chain) {
                int vret;
                STACK_OF(X509) *chain2;
-                       
                vret = get_cert_chain (ucert, &chain2);
                if (vret) {
                        BIO_printf (bio_err, "Error %s getting chain.\n",
@@ -358,12 +354,10 @@ if (export_cert) {
        for(i = 0; i < sk_X509_num(certs); i++) {
                cert = sk_X509_value(certs, i);
                bag = M_PKCS12_x5092certbag(cert);
-               /* If it matches private key mark it */
+               /* If it matches private key set id */
                if(cert == ucert) {
                        if(name) PKCS12_add_friendlyname(bag, name, -1);
-                       X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
                        PKCS12_add_localkeyid(bag, keyid, keyidlen);
-                       pmatch = 1;
                } else if((catmp = sk_shift(canames))) 
                                PKCS12_add_friendlyname(bag, catmp, -1);
                sk_push(bags, (char *)bag);
@@ -378,7 +372,7 @@ if (export_cert) {
         }
        if (!twopass) strcpy(macpass, pass);
        /* Turn certbags into encrypted authsafe */
-       authsafe = PKCS12_pack_p7encdata (cert_pbe, cpass, -1, NULL, 0,
+       authsafe = PKCS12_pack_p7encdata(cert_pbe, cpass, -1, NULL, 0,
                                                                 iter, bags);
        sk_pop_free(bags, PKCS12_SAFEBAG_free);
 
@@ -394,11 +388,11 @@ if (export_cert) {
        p8 = EVP_PKEY2PKCS8 (key);
        EVP_PKEY_free(key);
        if(keytype) PKCS8_add_keyusage(p8, keytype);
-       bag = PKCS12_MAKE_SHKEYBAG (NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
+       bag = PKCS12_MAKE_SHKEYBAG(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
                        cpass, -1, NULL, 0, iter, p8);
        PKCS8_PRIV_KEY_INFO_free(p8);
         if (name) PKCS12_add_friendlyname (bag, name, -1);
-       if(pmatch) PKCS12_add_localkeyid (bag, keyid, keyidlen);
+       PKCS12_add_localkeyid (bag, keyid, keyidlen);
        bags = sk_new(NULL);
        sk_push (bags, (char *)bag);
        /* Turn it into unencrypted safe bag */