1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
3*0Sstevel@tonic-gate * project 1999.
4*0Sstevel@tonic-gate */
5*0Sstevel@tonic-gate /*
6*0Sstevel@tonic-gate * ====================================================================
7*0Sstevel@tonic-gate * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
10*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
11*0Sstevel@tonic-gate * are met:
12*0Sstevel@tonic-gate *
13*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
14*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
15*0Sstevel@tonic-gate *
16*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
17*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in
18*0Sstevel@tonic-gate * the documentation and/or other materials provided with the
19*0Sstevel@tonic-gate * distribution.
20*0Sstevel@tonic-gate *
21*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this
22*0Sstevel@tonic-gate * software must display the following acknowledgment:
23*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project
24*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25*0Sstevel@tonic-gate *
26*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27*0Sstevel@tonic-gate * endorse or promote products derived from this software without
28*0Sstevel@tonic-gate * prior written permission. For written permission, please contact
29*0Sstevel@tonic-gate * licensing@OpenSSL.org.
30*0Sstevel@tonic-gate *
31*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL"
32*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written
33*0Sstevel@tonic-gate * permission of the OpenSSL Project.
34*0Sstevel@tonic-gate *
35*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following
36*0Sstevel@tonic-gate * acknowledgment:
37*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project
38*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39*0Sstevel@tonic-gate *
40*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE.
52*0Sstevel@tonic-gate * ====================================================================
53*0Sstevel@tonic-gate *
54*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young
55*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim
56*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com).
57*0Sstevel@tonic-gate *
58*0Sstevel@tonic-gate */
59*0Sstevel@tonic-gate
60*0Sstevel@tonic-gate /*
61*0Sstevel@tonic-gate * Copyright 2002, 2003 Sun Microsystems, Inc. All rights reserved.
62*0Sstevel@tonic-gate * Use is subject to license terms.
63*0Sstevel@tonic-gate */
64*0Sstevel@tonic-gate
65*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
66*0Sstevel@tonic-gate
67*0Sstevel@tonic-gate #include <stdio.h>
68*0Sstevel@tonic-gate #include <strings.h>
69*0Sstevel@tonic-gate
70*0Sstevel@tonic-gate #include <openssl/crypto.h>
71*0Sstevel@tonic-gate #include <openssl/err.h>
72*0Sstevel@tonic-gate #include <openssl/x509.h>
73*0Sstevel@tonic-gate
74*0Sstevel@tonic-gate #include <openssl/pkcs12.h>
75*0Sstevel@tonic-gate #include <p12aux.h>
76*0Sstevel@tonic-gate #include <auxutil.h>
77*0Sstevel@tonic-gate #include <p12err.h>
78*0Sstevel@tonic-gate
79*0Sstevel@tonic-gate /*
80*0Sstevel@tonic-gate * sunw_PKCS12_create() creates a pkcs#12 structure and given component parts.
81*0Sstevel@tonic-gate *
82*0Sstevel@tonic-gate * Given one or more of user private key, user cert and/or other (CA) certs,
83*0Sstevel@tonic-gate * return an encrypted PKCS12 structure containing them.
84*0Sstevel@tonic-gate *
85*0Sstevel@tonic-gate * Arguments:
86*0Sstevel@tonic-gate * pass - Pass phrase for the pkcs12 structure and private key (possibly
87*0Sstevel@tonic-gate * empty) or NULL if there is none. It will be used to encrypt
88*0Sstevel@tonic-gate * both the private key(s) and as the pass phrase for the whole
89*0Sstevel@tonic-gate * pkcs12 wad.
90*0Sstevel@tonic-gate * pkeys - Points to stack of private keys.
91*0Sstevel@tonic-gate * certs - Points to stack of client (public ke) certs
92*0Sstevel@tonic-gate * cacerts - Points to stack of 'certificate authority' certs (or trust
93*0Sstevel@tonic-gate * anchors).
94*0Sstevel@tonic-gate *
95*0Sstevel@tonic-gate * Note that any of these may be NULL.
96*0Sstevel@tonic-gate *
97*0Sstevel@tonic-gate * Returns:
98*0Sstevel@tonic-gate * NULL - An error occurred.
99*0Sstevel@tonic-gate * != NULL - Address of PKCS12 structure. The user is responsible for
100*0Sstevel@tonic-gate * freeing the memory when done.
101*0Sstevel@tonic-gate */
102*0Sstevel@tonic-gate PKCS12 *
sunw_PKCS12_create(const char * pass,STACK_OF (EVP_PKEY)* pkeys,STACK_OF (X509)* certs,STACK_OF (X509)* cacerts)103*0Sstevel@tonic-gate sunw_PKCS12_create(const char *pass, STACK_OF(EVP_PKEY) *pkeys,
104*0Sstevel@tonic-gate STACK_OF(X509) *certs, STACK_OF(X509) *cacerts)
105*0Sstevel@tonic-gate {
106*0Sstevel@tonic-gate int nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
107*0Sstevel@tonic-gate int nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
108*0Sstevel@tonic-gate STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
109*0Sstevel@tonic-gate STACK_OF(PKCS7) *safes = NULL;
110*0Sstevel@tonic-gate PKCS12_SAFEBAG *bag = NULL;
111*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO *p8 = NULL;
112*0Sstevel@tonic-gate EVP_PKEY *pkey = NULL;
113*0Sstevel@tonic-gate PKCS12 *ret_p12 = NULL;
114*0Sstevel@tonic-gate PKCS12 *p12 = NULL;
115*0Sstevel@tonic-gate PKCS7 *authsafe = NULL;
116*0Sstevel@tonic-gate X509 *cert = NULL;
117*0Sstevel@tonic-gate uchar_t *str = NULL;
118*0Sstevel@tonic-gate int certs_there = 0;
119*0Sstevel@tonic-gate int keys_there = 0;
120*0Sstevel@tonic-gate int len;
121*0Sstevel@tonic-gate int i;
122*0Sstevel@tonic-gate
123*0Sstevel@tonic-gate if ((safes = sk_PKCS7_new_null()) == NULL) {
124*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
125*0Sstevel@tonic-gate return (NULL);
126*0Sstevel@tonic-gate }
127*0Sstevel@tonic-gate
128*0Sstevel@tonic-gate if ((bags = sk_PKCS12_SAFEBAG_new_null()) == NULL) {
129*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
130*0Sstevel@tonic-gate goto err_ret;
131*0Sstevel@tonic-gate }
132*0Sstevel@tonic-gate
133*0Sstevel@tonic-gate if (certs != NULL && sk_X509_num(certs) > 0) {
134*0Sstevel@tonic-gate
135*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(certs); i++) {
136*0Sstevel@tonic-gate cert = sk_X509_value(certs, i);
137*0Sstevel@tonic-gate
138*0Sstevel@tonic-gate /* Add user certificate */
139*0Sstevel@tonic-gate if ((bag = M_PKCS12_x5092certbag(cert)) == NULL) {
140*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_CERT_ERR);
141*0Sstevel@tonic-gate goto err_ret;
142*0Sstevel@tonic-gate }
143*0Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->alias != NULL &&
144*0Sstevel@tonic-gate cert->aux->alias->type == V_ASN1_UTF8STRING) {
145*0Sstevel@tonic-gate str = utf82ascstr(cert->aux->alias);
146*0Sstevel@tonic-gate if (str == NULL) {
147*0Sstevel@tonic-gate /*
148*0Sstevel@tonic-gate * Error already on stack
149*0Sstevel@tonic-gate */
150*0Sstevel@tonic-gate goto err_ret;
151*0Sstevel@tonic-gate }
152*0Sstevel@tonic-gate if (PKCS12_add_friendlyname_asc(bag,
153*0Sstevel@tonic-gate (char const *) str,
154*0Sstevel@tonic-gate strlen((char const *) str)) == 0) {
155*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
156*0Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
157*0Sstevel@tonic-gate goto err_ret;
158*0Sstevel@tonic-gate }
159*0Sstevel@tonic-gate }
160*0Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->keyid != NULL &&
161*0Sstevel@tonic-gate cert->aux->keyid->type == V_ASN1_OCTET_STRING) {
162*0Sstevel@tonic-gate str = cert->aux->keyid->data;
163*0Sstevel@tonic-gate len = cert->aux->keyid->length;
164*0Sstevel@tonic-gate
165*0Sstevel@tonic-gate if (str != NULL &&
166*0Sstevel@tonic-gate PKCS12_add_localkeyid(bag, str, len) == 0) {
167*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
168*0Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
169*0Sstevel@tonic-gate goto err_ret;
170*0Sstevel@tonic-gate }
171*0Sstevel@tonic-gate }
172*0Sstevel@tonic-gate if (sk_PKCS12_SAFEBAG_push(bags, bag) == 0) {
173*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
174*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
175*0Sstevel@tonic-gate goto err_ret;
176*0Sstevel@tonic-gate }
177*0Sstevel@tonic-gate certs_there++;
178*0Sstevel@tonic-gate bag = NULL;
179*0Sstevel@tonic-gate }
180*0Sstevel@tonic-gate }
181*0Sstevel@tonic-gate
182*0Sstevel@tonic-gate if (cacerts != NULL && sk_X509_num(cacerts) > 0) {
183*0Sstevel@tonic-gate
184*0Sstevel@tonic-gate /* Put all certs in structure */
185*0Sstevel@tonic-gate for (i = 0; i < sk_X509_num(cacerts); i++) {
186*0Sstevel@tonic-gate cert = sk_X509_value(cacerts, i);
187*0Sstevel@tonic-gate if ((bag = M_PKCS12_x5092certbag(cert)) == NULL) {
188*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_CERT_ERR);
189*0Sstevel@tonic-gate goto err_ret;
190*0Sstevel@tonic-gate }
191*0Sstevel@tonic-gate
192*0Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->alias != NULL &&
193*0Sstevel@tonic-gate cert->aux->alias->type == V_ASN1_UTF8STRING) {
194*0Sstevel@tonic-gate str = utf82ascstr(cert->aux->alias);
195*0Sstevel@tonic-gate if (str == NULL) {
196*0Sstevel@tonic-gate /*
197*0Sstevel@tonic-gate * Error already on stack
198*0Sstevel@tonic-gate */
199*0Sstevel@tonic-gate goto err_ret;
200*0Sstevel@tonic-gate }
201*0Sstevel@tonic-gate if (PKCS12_add_friendlyname_asc(
202*0Sstevel@tonic-gate bag, (char const *) str,
203*0Sstevel@tonic-gate strlen((char const *) str)) == 0) {
204*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
205*0Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
206*0Sstevel@tonic-gate goto err_ret;
207*0Sstevel@tonic-gate }
208*0Sstevel@tonic-gate }
209*0Sstevel@tonic-gate if (cert->aux != NULL && cert->aux->keyid != NULL &&
210*0Sstevel@tonic-gate cert->aux->keyid->type == V_ASN1_OCTET_STRING) {
211*0Sstevel@tonic-gate str = cert->aux->keyid->data;
212*0Sstevel@tonic-gate len = cert->aux->keyid->length;
213*0Sstevel@tonic-gate
214*0Sstevel@tonic-gate if (str != NULL &&
215*0Sstevel@tonic-gate PKCS12_add_localkeyid(bag, str, len) == 0) {
216*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
217*0Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
218*0Sstevel@tonic-gate goto err_ret;
219*0Sstevel@tonic-gate }
220*0Sstevel@tonic-gate }
221*0Sstevel@tonic-gate if (sk_PKCS12_SAFEBAG_push(bags, bag) == 0) {
222*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
223*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
224*0Sstevel@tonic-gate goto err_ret;
225*0Sstevel@tonic-gate }
226*0Sstevel@tonic-gate certs_there++;
227*0Sstevel@tonic-gate bag = NULL;
228*0Sstevel@tonic-gate }
229*0Sstevel@tonic-gate }
230*0Sstevel@tonic-gate
231*0Sstevel@tonic-gate if (certs != NULL || cacerts != NULL && certs_there) {
232*0Sstevel@tonic-gate /* Turn certbags into encrypted authsafe */
233*0Sstevel@tonic-gate authsafe = PKCS12_pack_p7encdata(nid_cert, pass, -1,
234*0Sstevel@tonic-gate NULL, 0, PKCS12_DEFAULT_ITER, bags);
235*0Sstevel@tonic-gate if (authsafe == NULL) {
236*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_CERT_ERR);
237*0Sstevel@tonic-gate goto err_ret;
238*0Sstevel@tonic-gate }
239*0Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
240*0Sstevel@tonic-gate bags = NULL;
241*0Sstevel@tonic-gate
242*0Sstevel@tonic-gate if (sk_PKCS7_push(safes, authsafe) == 0) {
243*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
244*0Sstevel@tonic-gate goto err_ret;
245*0Sstevel@tonic-gate }
246*0Sstevel@tonic-gate authsafe = NULL;
247*0Sstevel@tonic-gate }
248*0Sstevel@tonic-gate
249*0Sstevel@tonic-gate if (pkeys != NULL && sk_EVP_PKEY_num(pkeys) > 0) {
250*0Sstevel@tonic-gate
251*0Sstevel@tonic-gate if (bags == NULL &&
252*0Sstevel@tonic-gate (bags = sk_PKCS12_SAFEBAG_new_null()) == NULL) {
253*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MEMORY_FAILURE);
254*0Sstevel@tonic-gate goto err_ret;
255*0Sstevel@tonic-gate }
256*0Sstevel@tonic-gate
257*0Sstevel@tonic-gate for (i = 0; i < sk_EVP_PKEY_num(pkeys); i++) {
258*0Sstevel@tonic-gate
259*0Sstevel@tonic-gate pkey = sk_EVP_PKEY_value(pkeys, i);
260*0Sstevel@tonic-gate
261*0Sstevel@tonic-gate /* Make a shrouded key bag */
262*0Sstevel@tonic-gate if ((p8 = EVP_PKEY2PKCS8(pkey)) == NULL) {
263*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKEY_ERR);
264*0Sstevel@tonic-gate goto err_ret;
265*0Sstevel@tonic-gate }
266*0Sstevel@tonic-gate
267*0Sstevel@tonic-gate bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0,
268*0Sstevel@tonic-gate PKCS12_DEFAULT_ITER, p8);
269*0Sstevel@tonic-gate if (bag == NULL) {
270*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
271*0Sstevel@tonic-gate SUNW_R_MAKE_BAG_ERR);
272*0Sstevel@tonic-gate goto err_ret;
273*0Sstevel@tonic-gate }
274*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO_free(p8);
275*0Sstevel@tonic-gate p8 = NULL;
276*0Sstevel@tonic-gate
277*0Sstevel@tonic-gate len = sunw_get_pkey_fname(GETDO_COPY, pkey,
278*0Sstevel@tonic-gate (char **)&str);
279*0Sstevel@tonic-gate if (str != NULL) {
280*0Sstevel@tonic-gate if (PKCS12_add_friendlyname_asc(bag,
281*0Sstevel@tonic-gate (const char *)str, len) == 0) {
282*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
283*0Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
284*0Sstevel@tonic-gate goto err_ret;
285*0Sstevel@tonic-gate }
286*0Sstevel@tonic-gate }
287*0Sstevel@tonic-gate str = NULL;
288*0Sstevel@tonic-gate
289*0Sstevel@tonic-gate len = sunw_get_pkey_localkeyid(GETDO_COPY, pkey,
290*0Sstevel@tonic-gate (char **)&str, &len);
291*0Sstevel@tonic-gate if (str != NULL) {
292*0Sstevel@tonic-gate if (PKCS12_add_localkeyid(bag, str, len) == 0) {
293*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
294*0Sstevel@tonic-gate SUNW_R_ADD_ATTR_ERR);
295*0Sstevel@tonic-gate goto err_ret;
296*0Sstevel@tonic-gate }
297*0Sstevel@tonic-gate }
298*0Sstevel@tonic-gate str = NULL;
299*0Sstevel@tonic-gate
300*0Sstevel@tonic-gate if (sk_PKCS12_SAFEBAG_push(bags, bag) == 0) {
301*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
302*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
303*0Sstevel@tonic-gate goto err_ret;
304*0Sstevel@tonic-gate }
305*0Sstevel@tonic-gate keys_there++;
306*0Sstevel@tonic-gate bag = NULL;
307*0Sstevel@tonic-gate }
308*0Sstevel@tonic-gate
309*0Sstevel@tonic-gate if (keys_there) {
310*0Sstevel@tonic-gate /* Turn into unencrypted authsafe */
311*0Sstevel@tonic-gate authsafe = PKCS12_pack_p7data(bags);
312*0Sstevel@tonic-gate if (authsafe == NULL) {
313*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
314*0Sstevel@tonic-gate SUNW_R_PKCS12_CREATE_ERR);
315*0Sstevel@tonic-gate goto err_ret;
316*0Sstevel@tonic-gate }
317*0Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
318*0Sstevel@tonic-gate bags = NULL;
319*0Sstevel@tonic-gate
320*0Sstevel@tonic-gate if (sk_PKCS7_push(safes, authsafe) == 0) {
321*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE,
322*0Sstevel@tonic-gate SUNW_R_MEMORY_FAILURE);
323*0Sstevel@tonic-gate }
324*0Sstevel@tonic-gate authsafe = NULL;
325*0Sstevel@tonic-gate }
326*0Sstevel@tonic-gate }
327*0Sstevel@tonic-gate
328*0Sstevel@tonic-gate if (certs_there == 0 && keys_there == 0) {
329*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKCS12_EMPTY_ERR);
330*0Sstevel@tonic-gate goto err_ret;
331*0Sstevel@tonic-gate }
332*0Sstevel@tonic-gate
333*0Sstevel@tonic-gate if ((p12 = PKCS12_init(NID_pkcs7_data)) == NULL) {
334*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKCS12_CREATE_ERR);
335*0Sstevel@tonic-gate goto err_ret;
336*0Sstevel@tonic-gate }
337*0Sstevel@tonic-gate
338*0Sstevel@tonic-gate /*
339*0Sstevel@tonic-gate * Note that safes is copied by the following. Therefore, it needs
340*0Sstevel@tonic-gate * to be freed whether or not the following succeeds.
341*0Sstevel@tonic-gate */
342*0Sstevel@tonic-gate if (M_PKCS12_pack_authsafes(p12, safes) == 0) {
343*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_PKCS12_CREATE_ERR);
344*0Sstevel@tonic-gate goto err_ret;
345*0Sstevel@tonic-gate }
346*0Sstevel@tonic-gate if (PKCS12_set_mac(p12, pass, -1, NULL, 0, 2048, NULL) == 0) {
347*0Sstevel@tonic-gate SUNWerr(SUNW_F_PKCS12_CREATE, SUNW_R_MAC_CREATE_FAILURE);
348*0Sstevel@tonic-gate goto err_ret;
349*0Sstevel@tonic-gate }
350*0Sstevel@tonic-gate
351*0Sstevel@tonic-gate ret_p12 = p12;
352*0Sstevel@tonic-gate p12 = NULL;
353*0Sstevel@tonic-gate
354*0Sstevel@tonic-gate /* Fallthrough is intentional */
355*0Sstevel@tonic-gate
356*0Sstevel@tonic-gate err_ret:
357*0Sstevel@tonic-gate
358*0Sstevel@tonic-gate if (str != NULL)
359*0Sstevel@tonic-gate free(str);
360*0Sstevel@tonic-gate
361*0Sstevel@tonic-gate if (p8 != NULL)
362*0Sstevel@tonic-gate PKCS8_PRIV_KEY_INFO_free(p8);
363*0Sstevel@tonic-gate
364*0Sstevel@tonic-gate if (bag != NULL)
365*0Sstevel@tonic-gate PKCS12_SAFEBAG_free(bag);
366*0Sstevel@tonic-gate if (bags != NULL)
367*0Sstevel@tonic-gate sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
368*0Sstevel@tonic-gate if (authsafe != NULL)
369*0Sstevel@tonic-gate PKCS7_free(authsafe);
370*0Sstevel@tonic-gate if (safes != NULL)
371*0Sstevel@tonic-gate sk_PKCS7_pop_free(safes, PKCS7_free);
372*0Sstevel@tonic-gate if (p12 != NULL)
373*0Sstevel@tonic-gate PKCS12_free(p12);
374*0Sstevel@tonic-gate
375*0Sstevel@tonic-gate return (ret_p12);
376*0Sstevel@tonic-gate }
377