Commit 84b65340 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Two new PKCS#12 demo programs. 

Update PKCS12_parse().

Make the keyid in certificate aux info more usable.
parent f50c11ca

CHANGES

+5 −0
Original line number Diff line number Diff line
@@ -4,6 +4,11 @@ 


 Changes between 0.9.5a and 0.9.6  [xx XXX 2000]



  *) Add two demo programs for PKCS12_parse() and PKCS12_create().

     Update PKCS12_parse() so it copies the friendlyName and the

     keyid to the certificates aux info.

     [Steve Henson]



  *) Fix bug in PKCS7_verify() which caused an infinite loop

     if there was more than one signature.

     [Sven Uszpelkat <su@celocom.de>]

FAQ

+12 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ OpenSSL - Frequently Asked Questions 
* Why does the linker complain about undefined symbols?

* Where can I get a compiled version of OpenSSL?

* I've compiled a program under Windows and it crashes: why?

* I've tried using <M_some_evil_pkcs12_macro> and I get errors why?

* I've called <some function> and it fails, why?

* I just get a load of numbers for the error output, what do they mean?

* Why do I get errors about unknown algorithms?
@@ -181,6 +182,17 @@ otherwise the conflict will cause a program to crash: typically on the 
first BIO related read or write operation.





* I've tried using <M_some_evil_pkcs12_macro> and I get errors why?



This usually happens when you try compiling something using the PKCS#12

macros with a C++ compiler. There is hardly ever any need to use the

PKCS#12 macros in a program, it is much easier to parse and create

PKCS#12 files using the PKCS12_parse() and PKCS12_create() functions

documented in doc/openssl.txt and with examples in demos/pkcs12. The

'pkcs12' application has to use the macros because it prints out 

debugging information.





* I've called <some function> and it fails, why?



Before submitting a report or asking in one of the mailing lists, you

crypto/asn1/t_x509a.c

+8 −0
Original line number Diff line number Diff line
@@ -98,5 +98,13 @@ int X509_CERT_AUX_print(BIO *out, X509_CERT_AUX *aux, int indent) 
	} else BIO_printf(out, "%*sNo Rejected Uses.\n", indent, "");

	if(aux->alias) BIO_printf(out, "%*sAlias: %s\n", indent, "",

							aux->alias->data);

	if(aux->keyid) {

		BIO_printf(out, "%*sKey Id: ", indent, "");

		for(i = 0; i < aux->keyid->length; i++) 

			BIO_printf(out, "%s%02X", 

				i ? ":" : "",

				aux->keyid->data[i]);

		BIO_write(out,"\n",1);

	}

	return 1;

}

crypto/asn1/x_x509a.c

+8 −0
Original line number Diff line number Diff line
@@ -153,6 +153,14 @@ int X509_alias_set1(X509 *x, unsigned char *name, int len) 
	return ASN1_STRING_set(aux->alias, name, len);

}



int X509_keyid_set1(X509 *x, unsigned char *id, int len)

{

	X509_CERT_AUX *aux;

	if(!(aux = aux_get(x))) return 0;

	if(!aux->keyid && !(aux->keyid = ASN1_OCTET_STRING_new())) return 0;

	return ASN1_STRING_set(aux->keyid, id, len);

}



unsigned char *X509_alias_get0(X509 *x, int *len)

{

	if(!x->aux || !x->aux->alias) return NULL;

crypto/pkcs12/p12_kiss.c

+25 −11
Original line number Diff line number Diff line
@@ -86,17 +86,14 @@ int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, 


	/* Check for NULL PKCS12 structure */



	if(!p12)

		{

	if(!p12) {

		PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER);

		return 0;

	}



	/* Allocate stack for ca certificates if needed */

	if ((ca != NULL) && (*ca == NULL))

		{

		if (!(*ca = sk_X509_new(NULL)))

			{

	if ((ca != NULL) && (*ca == NULL)) {

		if (!(*ca = sk_X509_new(NULL))) {

			PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);

			return 0;

		}
@@ -206,12 +203,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, 
{

	PKCS8_PRIV_KEY_INFO *p8;

	X509 *x509;

	ASN1_OCTET_STRING *lkey = NULL;

	ASN1_OCTET_STRING *lkey = NULL, *ckid = NULL;

	ASN1_TYPE *attrib;

	ASN1_BMPSTRING *fname = NULL;



	if ((attrib = PKCS12_get_attr (bag, NID_friendlyName)))

		fname = attrib->value.bmpstring;



	if ((attrib = PKCS12_get_attr (bag, NID_localKeyID)))

	if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) {

		lkey = attrib->value.octet_string;

		ckid = lkey;

	}



	/* Check for any local key id matching (if needed) */

	if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
@@ -247,6 +249,18 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen, 
		if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )

								 return 1;

		if (!(x509 = M_PKCS12_certbag2x509(bag))) return 0;

		if(ckid) X509_keyid_set1(x509, ckid->data, ckid->length);

		if(fname) {

			int len;

			unsigned char *data;

			len = ASN1_STRING_to_UTF8(&data, fname);

			if(len > 0) {

				X509_alias_set1(x509, data, len);

				OPENSSL_free(data);

			}

		}





		if (lkey) {

			*keymatch |= MATCH_CERT;

			if (cert) *cert = x509;