Upgrade chrome's OpenSSL to same version Android ships with.

openssl/apps/pkcs12.c

 /* pkcs12.c */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
 /* ====================================================================
  * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ skipping 50 matching lines @@
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include "apps.h"
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs12.h>
 
-#ifdef OPENSSL_SYS_NETWARE
-/* Rename these functions to avoid name clashes on NetWare OS */
-#define uni2asc OPENSSL_uni2asc
-#define asc2uni OPENSSL_asc2uni
-#endif
-
 #define PROG pkcs12_main
 
 const EVP_CIPHER *enc;
 
 
 #define NOKEYS          0x1
 #define NOCERTS         0x2
 #define INFO            0x4
 #define CLCERTS         0x8
 #define CACERTS         0x10
 
 int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain);
 int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int options, char *pempass);
 int dump_certs_pkeys_bags(BIO *out, STACK_OF(PKCS12_SAFEBAG) *bags, char *pass,
                           int passlen, int options, char *pempass);
 int dump_certs_pkeys_bag(BIO *out, PKCS12_SAFEBAG *bags, char *pass, int passlen, int options, char *pempass);
 int print_attribs(BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst,const char *name);
 void hex_prin(BIO *out, unsigned char *buf, int len);
 int alg_print(BIO *x, X509_ALGOR *alg);
 int cert_load(BIO *in, STACK_OF(X509) *sk);
+static int set_pbe(BIO *err, int *ppbe, const char *str);
 
 int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
 {
     ENGINE *e = NULL;
     char *infile=NULL, *outfile=NULL, *keyname = NULL;  
     char *certfile=NULL;
     BIO *in=NULL, *out = NULL;
     char **args;
     char *name = NULL;
     char *csp_name = NULL;
     int add_lmk = 0;
     PKCS12 *p12 = NULL;
     char pass[50], macpass[50];
     int export_cert = 0;
     int options = 0;
     int chain = 0;
     int badarg = 0;
     int iter = PKCS12_DEFAULT_ITER;
     int maciter = PKCS12_DEFAULT_ITER;
     int twopass = 0;
     int keytype = 0;
-    int cert_pbe;
+    int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
     int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
     int ret = 1;
     int macver = 1;
     int noprompt = 0;
-    STACK *canames = NULL;
+    STACK_OF(OPENSSL_STRING) *canames = NULL;
     char *cpass = NULL, *mpass = NULL;
     char *passargin = NULL, *passargout = NULL, *passarg = NULL;
     char *passin = NULL, *passout = NULL;
     char *inrand = NULL;
+    char *macalg = NULL;
     char *CApath = NULL, *CAfile = NULL;
 #ifndef OPENSSL_NO_ENGINE
     char *engine=NULL;
 #endif
 
     apps_startup();
 
-#ifdef OPENSSL_FIPS
-    if (FIPS_mode())
-        cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-    else
-#endif
-    cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
-
     enc = EVP_des_ede3_cbc();
     if (bio_err == NULL ) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
 
         if (!load_config(bio_err, NULL))
                 goto end;
 
     args = argv + 1;
 
 
     while (*args) {
@@ skipping 30 matching lines @@
                 else if (!strcmp(*args,"-camellia192")) enc=EVP_camellia_192_cbc();
                 else if (!strcmp(*args,"-camellia256")) enc=EVP_camellia_256_cbc();
 #endif
                 else if (!strcmp (*args, "-noiter")) iter = 1;
                 else if (!strcmp (*args, "-maciter"))
                                          maciter = PKCS12_DEFAULT_ITER;
                 else if (!strcmp (*args, "-nomaciter"))
                                          maciter = 1;
                 else if (!strcmp (*args, "-nomac"))
                                          maciter = -1;
+                else if (!strcmp (*args, "-macalg"))
+                    if (args[1]) {
+                        args++; 
+                        macalg = *args;
+                    } else badarg = 1;
                 else if (!strcmp (*args, "-nodes")) enc=NULL;
                 else if (!strcmp (*args, "-certpbe")) {
-                        if (args[1]) {
-                                args++;
-                                if (!strcmp(*args, "NONE"))
-                                        cert_pbe = -1;
-                                else
-                                        cert_pbe=OBJ_txt2nid(*args);
-                                if(cert_pbe == NID_undef) {
-                                        BIO_printf(bio_err,
-                                                 "Unknown PBE algorithm %s\n", *args);
-                                        badarg = 1;
-                                }
-                        } else badarg = 1;
+                        if (!set_pbe(bio_err, &cert_pbe, *++args))
+                                badarg = 1;
                 } else if (!strcmp (*args, "-keypbe")) {
-                        if (args[1]) {
-                                args++;
-                                if (!strcmp(*args, "NONE"))
-                                        key_pbe = -1;
-                                else
-                                        key_pbe=OBJ_txt2nid(*args);
-                                if(key_pbe == NID_undef) {
-                                        BIO_printf(bio_err,
-                                                 "Unknown PBE algorithm %s\n", *args);
-                                        badarg = 1;
-                                }
-                        } else badarg = 1;
+                        if (!set_pbe(bio_err, &key_pbe, *++args))
+                                badarg = 1;
                 } else if (!strcmp (*args, "-rand")) {
                     if (args[1]) {
                         args++; 
                         inrand = *args;
                     } else badarg = 1;
                 } else if (!strcmp (*args, "-inkey")) {
                     if (args[1]) {
                         args++; 
                         keyname = *args;
                     } else badarg = 1;
@@ skipping 10 matching lines @@
                 } else if (!strcmp (*args, "-LMK"))
                         add_lmk = 1;
                 else if (!strcmp (*args, "-CSP")) {
                     if (args[1]) {
                         args++; 
                         csp_name = *args;
                     } else badarg = 1;
                 } else if (!strcmp (*args, "-caname")) {
                     if (args[1]) {
                         args++; 
-                        if (!canames) canames = sk_new_null();
-                        sk_push(canames, *args);
+                        if (!canames) canames = sk_OPENSSL_STRING_new_null();
+                        sk_OPENSSL_STRING_push(canames, *args);
                     } else badarg = 1;
                 } else if (!strcmp (*args, "-in")) {
                     if (args[1]) {
                         args++; 
                         infile = *args;
                     } else badarg = 1;
                 } else if (!strcmp (*args, "-out")) {
                     if (args[1]) {
                         args++; 
                         outfile = *args;
@@ skipping 68 matching lines @@
 #ifndef OPENSSL_NO_AES
         BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
         BIO_printf (bio_err, "              encrypt PEM output with cbc aes\n");
 #endif
 #ifndef OPENSSL_NO_CAMELLIA
         BIO_printf (bio_err, "-camellia128, -camellia192, -camellia256\n");
         BIO_printf (bio_err, "              encrypt PEM output with cbc camellia\n");
 #endif
         BIO_printf (bio_err, "-nodes        don't encrypt private keys\n");
         BIO_printf (bio_err, "-noiter       don't use encryption iteration\n");
+        BIO_printf (bio_err, "-nomaciter    don't use MAC iteration\n");
         BIO_printf (bio_err, "-maciter      use MAC iteration\n");
+        BIO_printf (bio_err, "-nomac        don't generate MAC\n");
         BIO_printf (bio_err, "-twopass      separate MAC, encryption passwords\n");
         BIO_printf (bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
         BIO_printf (bio_err, "-certpbe alg  specify certificate PBE algorithm (default RC2-40)\n");
         BIO_printf (bio_err, "-keypbe alg   specify private key PBE algorithm (default 3DES)\n");
+        BIO_printf (bio_err, "-macalg alg   digest algorithm used in MAC (default SHA1)\n");
         BIO_printf (bio_err, "-keyex        set MS key exchange type\n");
         BIO_printf (bio_err, "-keysig       set MS key signature type\n");
         BIO_printf (bio_err, "-password p   set import/export password source\n");
         BIO_printf (bio_err, "-passin p     input file pass phrase source\n");
         BIO_printf (bio_err, "-passout p    output file pass phrase source\n");
 #ifndef OPENSSL_NO_ENGINE
         BIO_printf (bio_err, "-engine e     use engine e, possibly a hardware device.\n");
 #endif
         BIO_printf(bio_err,  "-rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
         BIO_printf(bio_err,  "              load the file (or the files in the directory) into\n");
         BIO_printf(bio_err,  "              the random number generator\n");
-        BIO_printf(bio_err,  "-CSP name     Microsoft CSP name\n");
-        BIO_printf(bio_err,  "-LMK          Add local machine keyset attribute to private key\n");
+        BIO_printf(bio_err,  "-CSP name     Microsoft CSP name\n");
+        BIO_printf(bio_err,  "-LMK          Add local machine keyset attribute to private key\n");
         goto end;
     }
 
 #ifndef OPENSSL_NO_ENGINE
     e = setup_engine(bio_err, engine, 0);
 #endif
 
     if(passarg) {
         if(export_cert) passargout = passarg;
         else passargin = passarg;
@@ skipping 69 matching lines @@
         }
 #ifdef CRYPTO_MDEBUG
     CRYPTO_pop_info();
 #endif
     }
 
     if (export_cert) {
         EVP_PKEY *key = NULL;
         X509 *ucert = NULL, *x = NULL;
         STACK_OF(X509) *certs=NULL;
+        const EVP_MD *macmd = NULL;
         unsigned char *catmp = NULL;
         int i;
 
         if ((options & (NOCERTS|NOKEYS)) == (NOCERTS|NOKEYS))
                 {       
                 BIO_printf(bio_err, "Nothing to do!\n");
                 goto export_end;
                 }
 
         if (options & NOCERTS)
@@ skipping 106 matching lines @@
                                 BIO_printf (bio_err, "Error %s getting chain.\n",
                                         X509_verify_cert_error_string(vret));
                         else
                                 ERR_print_errors(bio_err);
                         goto export_end;
                 }                       
         }
 
         /* Add any CA names */
 
-        for (i = 0; i < sk_num(canames); i++)
+        for (i = 0; i < sk_OPENSSL_STRING_num(canames); i++)
                 {
-                catmp = (unsigned char *)sk_value(canames, i);
+                catmp = (unsigned char *)sk_OPENSSL_STRING_value(canames, i);
                 X509_alias_set1(sk_X509_value(certs, i), catmp, -1);
                 }
 
         if (csp_name && key)
                 EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
                                 MBSTRING_ASC, (unsigned char *)csp_name, -1);
 
         if (add_lmk && key)
                 EVP_PKEY_add1_attr_by_NID(key, NID_LocalKeySet, 0, NULL, -1);
 
@@ skipping 17 matching lines @@
 
         p12 = PKCS12_create(cpass, name, key, ucert, certs,
                                 key_pbe, cert_pbe, iter, -1, keytype);
 
         if (!p12)
                 {
                 ERR_print_errors (bio_err);
                 goto export_end;
                 }
 
+        if (macalg)
+                {
+                macmd = EVP_get_digestbyname(macalg);
+                if (!macmd)
+                        {
+                        BIO_printf(bio_err, "Unknown digest algorithm %s\n", 
+                                                macalg);
+                        }
+                }
+
         if (maciter != -1)
-                PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, NULL);
+                PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
         CRYPTO_push_info("writing pkcs12");
 #endif
 
         i2d_PKCS12_bio(out, p12);
 
         ret = 0;
 
@@ skipping 26 matching lines @@
     if(!noprompt && EVP_read_pw_string(pass, sizeof pass, "Enter Import Password:", 0)) {
         BIO_printf (bio_err, "Can't read Password\n");
         goto end;
     }
 #ifdef CRYPTO_MDEBUG
     CRYPTO_pop_info();
 #endif
 
     if (!twopass) BUF_strlcpy(macpass, pass, sizeof macpass);
 
-    if (options & INFO) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);
+    if ((options & INFO) && p12->mac) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);
     if(macver) {
 #ifdef CRYPTO_MDEBUG
     CRYPTO_push_info("verify MAC");
 #endif
         /* If we enter empty password try no password first */
         if(!mpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
                 /* If mac and crypto pass the same set it to NULL too */
                 if(!twopass) cpass = NULL;
         } else if (!PKCS12_verify_mac(p12, mpass, -1)) {
             BIO_printf (bio_err, "Mac verify error: invalid password?\n");
@@ skipping 19 matching lines @@
 #endif
     ret = 0;
  end:
     if (p12) PKCS12_free(p12);
     if(export_cert || inrand) app_RAND_write_file(NULL, bio_err);
 #ifdef CRYPTO_MDEBUG
     CRYPTO_remove_all_info();
 #endif
     BIO_free(in);
     BIO_free_all(out);
-    if (canames) sk_free(canames);
+    if (canames) sk_OPENSSL_STRING_free(canames);
     if(passin) OPENSSL_free(passin);
     if(passout) OPENSSL_free(passout);
     apps_shutdown();
     OPENSSL_EXIT(ret);
 }
 
 int dump_certs_keys_p12 (BIO *out, PKCS12 *p12, char *pass,
              int passlen, int options, char *pempass)
 {
         STACK_OF(PKCS7) *asafes = NULL;
@@ skipping 215 matching lines @@
                 BIO_printf(out, "    ");
                 if(attr_nid == NID_undef) {
                         i2a_ASN1_OBJECT (out, attr->object);
                         BIO_printf(out, ": ");
                 } else BIO_printf(out, "%s: ", OBJ_nid2ln(attr_nid));
 
                 if(sk_ASN1_TYPE_num(attr->value.set)) {
                         av = sk_ASN1_TYPE_value(attr->value.set, 0);
                         switch(av->type) {
                                 case V_ASN1_BMPSTRING:
-                                value = uni2asc(av->value.bmpstring->data,
+                                value = OPENSSL_uni2asc(av->value.bmpstring->data,
                                                av->value.bmpstring->length);
                                 BIO_printf(out, "%s\n", value);
                                 OPENSSL_free(value);
                                 break;
 
                                 case V_ASN1_OCTET_STRING:
                                 hex_prin(out, av->value.octet_string->data,
                                         av->value.octet_string->length);
                                 BIO_printf(out, "\n");  
                                 break;
@@ skipping 12 matching lines @@
         }
         return 1;
 }
 
 void hex_prin(BIO *out, unsigned char *buf, int len)
 {
         int i;
         for (i = 0; i < len; i++) BIO_printf (out, "%02X ", buf[i]);
 }
 
+static int set_pbe(BIO *err, int *ppbe, const char *str)
+        {
+        if (!str)
+                return 0;
+        if (!strcmp(str, "NONE"))
+                {
+                *ppbe = -1;
+                return 1;
+                }
+        *ppbe=OBJ_txt2nid(str);
+        if (*ppbe == NID_undef)
+                {
+                BIO_printf(bio_err, "Unknown PBE algorithm %s\n", str);
+                return 0;
+                }
+        return 1;
+        }
+                        
 #endif