1*7c478bd9Sstevel@tonic-gate /*
2*7c478bd9Sstevel@tonic-gate * Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
3*7c478bd9Sstevel@tonic-gate * project 1999.
4*7c478bd9Sstevel@tonic-gate */
5*7c478bd9Sstevel@tonic-gate /*
6*7c478bd9Sstevel@tonic-gate * ====================================================================
7*7c478bd9Sstevel@tonic-gate * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
8*7c478bd9Sstevel@tonic-gate *
9*7c478bd9Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
10*7c478bd9Sstevel@tonic-gate * modification, are permitted provided that the following conditions
11*7c478bd9Sstevel@tonic-gate * are met:
12*7c478bd9Sstevel@tonic-gate *
13*7c478bd9Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
14*7c478bd9Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
15*7c478bd9Sstevel@tonic-gate *
16*7c478bd9Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
17*7c478bd9Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in
18*7c478bd9Sstevel@tonic-gate * the documentation and/or other materials provided with the
19*7c478bd9Sstevel@tonic-gate * distribution.
20*7c478bd9Sstevel@tonic-gate *
21*7c478bd9Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this
22*7c478bd9Sstevel@tonic-gate * software must display the following acknowledgment:
23*7c478bd9Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project
24*7c478bd9Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25*7c478bd9Sstevel@tonic-gate *
26*7c478bd9Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27*7c478bd9Sstevel@tonic-gate * endorse or promote products derived from this software without
28*7c478bd9Sstevel@tonic-gate * prior written permission. For written permission, please contact
29*7c478bd9Sstevel@tonic-gate * licensing@OpenSSL.org.
30*7c478bd9Sstevel@tonic-gate *
31*7c478bd9Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL"
32*7c478bd9Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written
33*7c478bd9Sstevel@tonic-gate * permission of the OpenSSL Project.
34*7c478bd9Sstevel@tonic-gate *
35*7c478bd9Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following
36*7c478bd9Sstevel@tonic-gate * acknowledgment:
37*7c478bd9Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project
38*7c478bd9Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39*7c478bd9Sstevel@tonic-gate *
40*7c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41*7c478bd9Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42*7c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43*7c478bd9Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44*7c478bd9Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45*7c478bd9Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46*7c478bd9Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47*7c478bd9Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48*7c478bd9Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49*7c478bd9Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50*7c478bd9Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51*7c478bd9Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE.
52*7c478bd9Sstevel@tonic-gate * ====================================================================
53*7c478bd9Sstevel@tonic-gate *
54*7c478bd9Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young
55*7c478bd9Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim
56*7c478bd9Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com).
57*7c478bd9Sstevel@tonic-gate *
58*7c478bd9Sstevel@tonic-gate */
59*7c478bd9Sstevel@tonic-gate
60*7c478bd9Sstevel@tonic-gate /*
61*7c478bd9Sstevel@tonic-gate * Copyright 2002, 2003 Sun Microsystems, Inc. All rights reserved.
62*7c478bd9Sstevel@tonic-gate * Use is subject to license terms.
63*7c478bd9Sstevel@tonic-gate */
64*7c478bd9Sstevel@tonic-gate
65*7c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
66*7c478bd9Sstevel@tonic-gate
67*7c478bd9Sstevel@tonic-gate #include <stdio.h>
68*7c478bd9Sstevel@tonic-gate #include <strings.h>
69*7c478bd9Sstevel@tonic-gate
70*7c478bd9Sstevel@tonic-gate #include <openssl/crypto.h>
71*7c478bd9Sstevel@tonic-gate #include <openssl/err.h>
72*7c478bd9Sstevel@tonic-gate #include <openssl/x509.h>
73*7c478bd9Sstevel@tonic-gate
74*7c478bd9Sstevel@tonic-gate #include <openssl/pkcs12.h>
75*7c478bd9Sstevel@tonic-gate #include <p12aux.h>
76*7c478bd9Sstevel@tonic-gate #include <auxutil.h>
77*7c478bd9Sstevel@tonic-gate #include <p12err.h>
78*7c478bd9Sstevel@tonic-gate
79*7c478bd9Sstevel@tonic-gate /*
80*7c478bd9Sstevel@tonic-gate * sunw_PKCS12_create() creates a pkcs#12 structure and given component parts.
81*7c478bd9Sstevel@tonic-gate *
82*7c478bd9Sstevel@tonic-gate * Given one or more of user private key, user cert and/or other (CA) certs,
83*7c478bd9Sstevel@tonic-gate * return an encrypted PKCS12 structure containing them.
84*7c478bd9Sstevel@tonic-gate *
85*7c478bd9Sstevel@tonic-gate * Arguments:
86*7c478bd9Sstevel@tonic-gate * pass - Pass phrase for the pkcs12 structure and private key (possibly
87*7c478bd9Sstevel@tonic-gate * empty) or NULL if there is none. It will be used to encrypt
88*7c478bd9Sstevel@tonic-gate * both the private key(s) and as the pass phrase for the whole
89*7c478bd9Sstevel@tonic-gate * pkcs12 wad.
90*7c478bd9Sstevel@tonic-gate * pkeys - Points to stack of private keys.
91*7c478bd9Sstevel@tonic-gate * certs - Points to stack of client (public ke) certs
92*7c478bd9Sstevel@tonic-gate * cacerts - Points to stack of 'certificate authority' certs (or trust
93*7c478bd9Sstevel@tonic-gate * anchors).
94*7c478bd9Sstevel@tonic-gate *
95*7c478bd9Sstevel@tonic-gate * Note that any of these may be NULL.
96*7c478bd9Sstevel@tonic-gate *
97*7c478bd9Sstevel@tonic-gate * Returns:
98*7c478bd9Sstevel@tonic-gate * NULL - An error occurred.
99*7c478bd9Sstevel@tonic-gate * != NULL - Address of PKCS12 structure. The user is responsible for
100*7c478bd9Sstevel@tonic-gate * freeing the memory when done.
101*7c478bd9Sstevel@tonic-gate */
102*7c478bd9Sstevel@tonic-gate PKCS12 *
sunw_PKCS12_create(const char * pass,STACK_OF (EVP_PKEY)* pkeys,STACK_OF (X509)* certs,STACK_OF (X509)* cacerts)103*7c478bd9Sstevel@tonic-gate sunw_PKCS12_create(const char *pass, STACK_OF(EVP_PKEY) *pkeys,
104*7c478bd9Sstevel@tonic-gate STACK_OF(X509) *certs, STACK_OF(X509) *cacerts)
105*7c478bd9Sstevel@tonic-gate {
106*7c478bd9Sstevel@tonic-gate int nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
107*7c478bd9Sstevel@tonic-gate int nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
108*7c478bd9Sstevel@tonic-gate STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
109*7c478bd9Sstevel@tonic-gate STACK_OF(PKCS7) *safes = NULL;
110*7c478bd9Sstevel@tonic-gate PKCS12_SAFEBAG *bag = NULL;
111*7c478bd9Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO *p8 = NULL;
112*7c478bd9Sstevel@tonic-gate EVP_PKEY *pkey = NULL;
113*7c478bd9Sstevel@tonic-gate PKCS12 *ret_p12 = NULL;
114*7c478bd9Sstevel@tonic-gate PKCS12 *p12 = NULL;
115*7c478bd9Sstevel@tonic-gate PKCS7 *authsafe = NULL;
116*7c478bd9Sstevel@tonic-gate X509 *cert = NULL;
117*7c478bd9Sstevel@tonic-gate uchar_t *str = NULL;
118*7c478bd9Sstevel@tonic-gate int certs_there = 0;
119*7c478bd9Sstevel@tonic-gate int keys_there = 0;
120*7c478bd9Sstevel@tonic-gate int len;
121*7c478bd9Sstevel@tonic-gate int i;
122*7c478bd9Sstevel@tonic-gate
123*7c478bd9Sstevel@tonic-gate if ((safes = sk_PKCS7_new_null()) == NULL) {
124*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
125*7c478bd9Sstevel@tonic-gate return (NULL);
126*7c478bd9Sstevel@tonic-gate }
127*7c478bd9Sstevel@tonic-gate
128*7c478bd9Sstevel@tonic-gate if ((bags = sk_PKCS12_SAFEBAG_new_null()) == NULL) {
129*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
130*7c478bd9Sstevel@tonic-gate goto err_ret;
131*7c478bd9Sstevel@tonic-gate }
132*7c478bd9Sstevel@tonic-gate
133*7c478bd9Sstevel@tonic-gate if (certs != NULL && sk_X509_num(certs) > 0) {
134*7c478bd9Sstevel@tonic-gate
135*7c478bd9Sstevel@tonic-gate for (i = 0; i < sk_X509_num(certs); i++) {
136*7c478bd9Sstevel@tonic-gate cert = sk_X509_value(certs, i);
137*7c478bd9Sstevel@tonic-gate
138*7c478bd9Sstevel@tonic-gate /* Add user certificate */
139*7c478bd9Sstevel@tonic-gate if ((bag = M_PKCS12_x5092certbag(cert)) == NULL) {
140*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_CERT_ERR);
141*7c478bd9Sstevel@tonic-gate goto err_ret;
142*7c478bd9Sstevel@tonic-gate }
143*7c478bd9Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->alias != NULL &&
144*7c478bd9Sstevel@tonic-gate cert->aux->alias->type == V_ASN1_UTF8STRING) {
145*7c478bd9Sstevel@tonic-gate str = utf82ascstr(cert->aux->alias);
146*7c478bd9Sstevel@tonic-gate if (str == NULL) {
147*7c478bd9Sstevel@tonic-gate /*
148*7c478bd9Sstevel@tonic-gate * Error already on stack
149*7c478bd9Sstevel@tonic-gate */
150*7c478bd9Sstevel@tonic-gate goto err_ret;
151*7c478bd9Sstevel@tonic-gate }
152*7c478bd9Sstevel@tonic-gate if (PKCS12_add_friendlyname_asc(bag,
153*7c478bd9Sstevel@tonic-gate (char const *) str,
154*7c478bd9Sstevel@tonic-gate strlen((char const *) str)) == 0) {
155*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
156*7c478bd9Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
157*7c478bd9Sstevel@tonic-gate goto err_ret;
158*7c478bd9Sstevel@tonic-gate }
159*7c478bd9Sstevel@tonic-gate }
160*7c478bd9Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->keyid != NULL &&
161*7c478bd9Sstevel@tonic-gate cert->aux->keyid->type == V_ASN1_OCTET_STRING) {
162*7c478bd9Sstevel@tonic-gate str = cert->aux->keyid->data;
163*7c478bd9Sstevel@tonic-gate len = cert->aux->keyid->length;
164*7c478bd9Sstevel@tonic-gate
165*7c478bd9Sstevel@tonic-gate if (str != NULL &&
166*7c478bd9Sstevel@tonic-gate PKCS12_add_localkeyid(bag, str, len) == 0) {
167*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
168*7c478bd9Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
169*7c478bd9Sstevel@tonic-gate goto err_ret;
170*7c478bd9Sstevel@tonic-gate }
171*7c478bd9Sstevel@tonic-gate }
172*7c478bd9Sstevel@tonic-gate if (sk_PKCS12_SAFEBAG_push(bags, bag) == 0) {
173*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
174*7c478bd9Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
175*7c478bd9Sstevel@tonic-gate goto err_ret;
176*7c478bd9Sstevel@tonic-gate }
177*7c478bd9Sstevel@tonic-gate certs_there++;
178*7c478bd9Sstevel@tonic-gate bag = NULL;
179*7c478bd9Sstevel@tonic-gate }
180*7c478bd9Sstevel@tonic-gate }
181*7c478bd9Sstevel@tonic-gate
182*7c478bd9Sstevel@tonic-gate if (cacerts != NULL && sk_X509_num(cacerts) > 0) {
183*7c478bd9Sstevel@tonic-gate
184*7c478bd9Sstevel@tonic-gate /* Put all certs in structure */
185*7c478bd9Sstevel@tonic-gate for (i = 0; i < sk_X509_num(cacerts); i++) {
186*7c478bd9Sstevel@tonic-gate cert = sk_X509_value(cacerts, i);
187*7c478bd9Sstevel@tonic-gate if ((bag = M_PKCS12_x5092certbag(cert)) == NULL) {
188*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_CERT_ERR);
189*7c478bd9Sstevel@tonic-gate goto err_ret;
190*7c478bd9Sstevel@tonic-gate }
191*7c478bd9Sstevel@tonic-gate
192*7c478bd9Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->alias != NULL &&
193*7c478bd9Sstevel@tonic-gate cert->aux->alias->type == V_ASN1_UTF8STRING) {
194*7c478bd9Sstevel@tonic-gate str = utf82ascstr(cert->aux->alias);
195*7c478bd9Sstevel@tonic-gate if (str == NULL) {
196*7c478bd9Sstevel@tonic-gate /*
197*7c478bd9Sstevel@tonic-gate * Error already on stack
198*7c478bd9Sstevel@tonic-gate */
199*7c478bd9Sstevel@tonic-gate goto err_ret;
200*7c478bd9Sstevel@tonic-gate }
201*7c478bd9Sstevel@tonic-gate if (PKCS12_add_friendlyname_asc(
202*7c478bd9Sstevel@tonic-gate bag, (char const *) str,
203*7c478bd9Sstevel@tonic-gate strlen((char const *) str)) == 0) {
204*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
205*7c478bd9Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
206*7c478bd9Sstevel@tonic-gate goto err_ret;
207*7c478bd9Sstevel@tonic-gate }
208*7c478bd9Sstevel@tonic-gate }
209*7c478bd9Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->keyid != NULL &&
210*7c478bd9Sstevel@tonic-gate cert->aux->keyid->type == V_ASN1_OCTET_STRING) {
211*7c478bd9Sstevel@tonic-gate str = cert->aux->keyid->data;
212*7c478bd9Sstevel@tonic-gate len = cert->aux->keyid->length;
213*7c478bd9Sstevel@tonic-gate
214*7c478bd9Sstevel@tonic-gate if (str != NULL &&
215*7c478bd9Sstevel@tonic-gate PKCS12_add_localkeyid(bag, str, len) == 0) {
216*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
217*7c478bd9Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
218*7c478bd9Sstevel@tonic-gate goto err_ret;
219*7c478bd9Sstevel@tonic-gate }
220*7c478bd9Sstevel@tonic-gate }
221*7c478bd9Sstevel@tonic-gate if (sk_PKCS12_SAFEBAG_push(bags, bag) == 0) {
222*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
223*7c478bd9Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
224*7c478bd9Sstevel@tonic-gate goto err_ret;
225*7c478bd9Sstevel@tonic-gate }
226*7c478bd9Sstevel@tonic-gate certs_there++;
227*7c478bd9Sstevel@tonic-gate bag = NULL;
228*7c478bd9Sstevel@tonic-gate }
229*7c478bd9Sstevel@tonic-gate }
230*7c478bd9Sstevel@tonic-gate
231*7c478bd9Sstevel@tonic-gate if (certs != NULL || cacerts != NULL && certs_there) {
232*7c478bd9Sstevel@tonic-gate /* Turn certbags into encrypted authsafe */
233*7c478bd9Sstevel@tonic-gate authsafe = PKCS12_pack_p7encdata(nid_cert, pass, -1,
234*7c478bd9Sstevel@tonic-gate NULL, 0, PKCS12_DEFAULT_ITER, bags);
235*7c478bd9Sstevel@tonic-gate if (authsafe == NULL) {
236*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_CERT_ERR);
237*7c478bd9Sstevel@tonic-gate goto err_ret;
238*7c478bd9Sstevel@tonic-gate }
239*7c478bd9Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
240*7c478bd9Sstevel@tonic-gate bags = NULL;
241*7c478bd9Sstevel@tonic-gate
242*7c478bd9Sstevel@tonic-gate if (sk_PKCS7_push(safes, authsafe) == 0) {
243*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
244*7c478bd9Sstevel@tonic-gate goto err_ret;
245*7c478bd9Sstevel@tonic-gate }
246*7c478bd9Sstevel@tonic-gate authsafe = NULL;
247*7c478bd9Sstevel@tonic-gate }
248*7c478bd9Sstevel@tonic-gate
249*7c478bd9Sstevel@tonic-gate if (pkeys != NULL && sk_EVP_PKEY_num(pkeys) > 0) {
250*7c478bd9Sstevel@tonic-gate
251*7c478bd9Sstevel@tonic-gate if (bags == NULL &&
252*7c478bd9Sstevel@tonic-gate (bags = sk_PKCS12_SAFEBAG_new_null()) == NULL) {
253*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
254*7c478bd9Sstevel@tonic-gate goto err_ret;
255*7c478bd9Sstevel@tonic-gate }
256*7c478bd9Sstevel@tonic-gate
257*7c478bd9Sstevel@tonic-gate for (i = 0; i < sk_EVP_PKEY_num(pkeys); i++) {
258*7c478bd9Sstevel@tonic-gate
259*7c478bd9Sstevel@tonic-gate pkey = sk_EVP_PKEY_value(pkeys, i);
260*7c478bd9Sstevel@tonic-gate
261*7c478bd9Sstevel@tonic-gate /* Make a shrouded key bag */
262*7c478bd9Sstevel@tonic-gate if ((p8 = EVP_PKEY2PKCS8(pkey)) == NULL) {
263*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKEY_ERR);
264*7c478bd9Sstevel@tonic-gate goto err_ret;
265*7c478bd9Sstevel@tonic-gate }
266*7c478bd9Sstevel@tonic-gate
267*7c478bd9Sstevel@tonic-gate bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0,
268*7c478bd9Sstevel@tonic-gate PKCS12_DEFAULT_ITER, p8);
269*7c478bd9Sstevel@tonic-gate if (bag == NULL) {
270*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
271*7c478bd9Sstevel@tonic-gate SUNW_R_MAKE_BAG_ERR);
272*7c478bd9Sstevel@tonic-gate goto err_ret;
273*7c478bd9Sstevel@tonic-gate }
274*7c478bd9Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO_free(p8);
275*7c478bd9Sstevel@tonic-gate p8 = NULL;
276*7c478bd9Sstevel@tonic-gate
277*7c478bd9Sstevel@tonic-gate len = sunw_get_pkey_fname(GETDO_COPY, pkey,
278*7c478bd9Sstevel@tonic-gate (char **)&str);
279*7c478bd9Sstevel@tonic-gate if (str != NULL) {
280*7c478bd9Sstevel@tonic-gate if (PKCS12_add_friendlyname_asc(bag,
281*7c478bd9Sstevel@tonic-gate (const char *)str, len) == 0) {
282*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
283*7c478bd9Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
284*7c478bd9Sstevel@tonic-gate goto err_ret;
285*7c478bd9Sstevel@tonic-gate }
286*7c478bd9Sstevel@tonic-gate }
287*7c478bd9Sstevel@tonic-gate str = NULL;
288*7c478bd9Sstevel@tonic-gate
289*7c478bd9Sstevel@tonic-gate len = sunw_get_pkey_localkeyid(GETDO_COPY, pkey,
290*7c478bd9Sstevel@tonic-gate (char **)&str, &len);
291*7c478bd9Sstevel@tonic-gate if (str != NULL) {
292*7c478bd9Sstevel@tonic-gate if (PKCS12_add_localkeyid(bag, str, len) == 0) {
293*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
294*7c478bd9Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
295*7c478bd9Sstevel@tonic-gate goto err_ret;
296*7c478bd9Sstevel@tonic-gate }
297*7c478bd9Sstevel@tonic-gate }
298*7c478bd9Sstevel@tonic-gate str = NULL;
299*7c478bd9Sstevel@tonic-gate
300*7c478bd9Sstevel@tonic-gate if (sk_PKCS12_SAFEBAG_push(bags, bag) == 0) {
301*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
302*7c478bd9Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
303*7c478bd9Sstevel@tonic-gate goto err_ret;
304*7c478bd9Sstevel@tonic-gate }
305*7c478bd9Sstevel@tonic-gate keys_there++;
306*7c478bd9Sstevel@tonic-gate bag = NULL;
307*7c478bd9Sstevel@tonic-gate }
308*7c478bd9Sstevel@tonic-gate
309*7c478bd9Sstevel@tonic-gate if (keys_there) {
310*7c478bd9Sstevel@tonic-gate /* Turn into unencrypted authsafe */
311*7c478bd9Sstevel@tonic-gate authsafe = PKCS12_pack_p7data(bags);
312*7c478bd9Sstevel@tonic-gate if (authsafe == NULL) {
313*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
314*7c478bd9Sstevel@tonic-gate SUNW_R_PKCS12_CREATE_ERR);
315*7c478bd9Sstevel@tonic-gate goto err_ret;
316*7c478bd9Sstevel@tonic-gate }
317*7c478bd9Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
318*7c478bd9Sstevel@tonic-gate bags = NULL;
319*7c478bd9Sstevel@tonic-gate
320*7c478bd9Sstevel@tonic-gate if (sk_PKCS7_push(safes, authsafe) == 0) {
321*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
322*7c478bd9Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
323*7c478bd9Sstevel@tonic-gate }
324*7c478bd9Sstevel@tonic-gate authsafe = NULL;
325*7c478bd9Sstevel@tonic-gate }
326*7c478bd9Sstevel@tonic-gate }
327*7c478bd9Sstevel@tonic-gate
328*7c478bd9Sstevel@tonic-gate if (certs_there == 0 && keys_there == 0) {
329*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKCS12_EMPTY_ERR);
330*7c478bd9Sstevel@tonic-gate goto err_ret;
331*7c478bd9Sstevel@tonic-gate }
332*7c478bd9Sstevel@tonic-gate
333*7c478bd9Sstevel@tonic-gate if ((p12 = PKCS12_init(NID_pkcs7_data)) == NULL) {
334*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKCS12_CREATE_ERR);
335*7c478bd9Sstevel@tonic-gate goto err_ret;
336*7c478bd9Sstevel@tonic-gate }
337*7c478bd9Sstevel@tonic-gate
338*7c478bd9Sstevel@tonic-gate /*
339*7c478bd9Sstevel@tonic-gate * Note that safes is copied by the following. Therefore, it needs
340*7c478bd9Sstevel@tonic-gate * to be freed whether or not the following succeeds.
341*7c478bd9Sstevel@tonic-gate */
342*7c478bd9Sstevel@tonic-gate if (M_PKCS12_pack_authsafes(p12, safes) == 0) {
343*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKCS12_CREATE_ERR);
344*7c478bd9Sstevel@tonic-gate goto err_ret;
345*7c478bd9Sstevel@tonic-gate }
346*7c478bd9Sstevel@tonic-gate if (PKCS12_set_mac(p12, pass, -1, NULL, 0, 2048, NULL) == 0) {
347*7c478bd9Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MAC_CREATE_FAILURE);
348*7c478bd9Sstevel@tonic-gate goto err_ret;
349*7c478bd9Sstevel@tonic-gate }
350*7c478bd9Sstevel@tonic-gate
351*7c478bd9Sstevel@tonic-gate ret_p12 = p12;
352*7c478bd9Sstevel@tonic-gate p12 = NULL;
353*7c478bd9Sstevel@tonic-gate
354*7c478bd9Sstevel@tonic-gate /* Fallthrough is intentional */
355*7c478bd9Sstevel@tonic-gate
356*7c478bd9Sstevel@tonic-gate err_ret:
357*7c478bd9Sstevel@tonic-gate
358*7c478bd9Sstevel@tonic-gate if (str != NULL)
359*7c478bd9Sstevel@tonic-gate free(str);
360*7c478bd9Sstevel@tonic-gate
361*7c478bd9Sstevel@tonic-gate if (p8 != NULL)
362*7c478bd9Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO_free(p8);
363*7c478bd9Sstevel@tonic-gate
364*7c478bd9Sstevel@tonic-gate if (bag != NULL)
365*7c478bd9Sstevel@tonic-gate PKCS12_SAFEBAG_free(bag);
366*7c478bd9Sstevel@tonic-gate if (bags != NULL)
367*7c478bd9Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
368*7c478bd9Sstevel@tonic-gate if (authsafe != NULL)
369*7c478bd9Sstevel@tonic-gate PKCS7_free(authsafe);
370*7c478bd9Sstevel@tonic-gate if (safes != NULL)
371*7c478bd9Sstevel@tonic-gate sk_PKCS7_pop_free(safes, PKCS7_free);
372*7c478bd9Sstevel@tonic-gate if (p12 != NULL)
373*7c478bd9Sstevel@tonic-gate PKCS12_free(p12);
374*7c478bd9Sstevel@tonic-gate
375*7c478bd9Sstevel@tonic-gate return (ret_p12);
376*7c478bd9Sstevel@tonic-gate }
377