/src/openssl/crypto/pkcs12/p12_crt.c

Source (jump to first uncovered line)
/*
 * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include "internal/cryptlib.h"
#include <openssl/pkcs12.h>
#include "p12_local.h"

static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
                          PKCS12_SAFEBAG *bag);
static PKCS12_SAFEBAG *pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                           X509 *cert,
                                           const char *name,
                                           int namelen,
                                           unsigned char *keyid,
                                           int keyidlen);

static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid)
{
    int idx;
    X509_ATTRIBUTE *attr;
    idx = EVP_PKEY_get_attr_by_NID(pkey, nid, -1);
    if (idx < 0)
        return 1;
    attr = EVP_PKEY_get_attr(pkey, idx);
    if (!X509at_add1_attr(&bag->attrib, attr))
        return 0;
    return 1;
}

PKCS12 *PKCS12_create_ex(const char *pass, const char *name, EVP_PKEY *pkey,
                         X509 *cert, STACK_OF(X509) *ca, int nid_key, int nid_cert,
                         int iter, int mac_iter, int keytype,
                         OSSL_LIB_CTX *ctx, const char *propq)
{
    PKCS12 *p12 = NULL;
    STACK_OF(PKCS7) *safes = NULL;
    STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
    PKCS12_SAFEBAG *bag = NULL;
    int i;
    unsigned char keyid[EVP_MAX_MD_SIZE];
    unsigned int keyidlen = 0;
    int namelen = -1;
    unsigned char *pkeyid = NULL;
    int pkeyidlen = -1;

    /* Set defaults */
    if (nid_cert == NID_undef)
        nid_cert = NID_aes_256_cbc;
    if (nid_key == NID_undef)
        nid_key = NID_aes_256_cbc;
    if (!iter)
        iter = PKCS12_DEFAULT_ITER;
    if (!mac_iter)
        mac_iter = PKCS12_DEFAULT_ITER;

    if (pkey == NULL && cert == NULL && ca == NULL) {
        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_NULL_ARGUMENT);
        return NULL;
    }

    if (pkey && cert) {
        if (!X509_check_private_key(cert, pkey))
            return NULL;
        if (!X509_digest(cert, EVP_sha1(), keyid, &keyidlen))
            return NULL;
    }

    if (cert) {
        if (name == NULL)
            name = (char *)X509_alias_get0(cert, &namelen);
        if (keyidlen > 0) {
            pkeyid = keyid;
            pkeyidlen = keyidlen;
        } else {
            pkeyid = X509_keyid_get0(cert, &pkeyidlen);
        }

        bag = pkcs12_add_cert_bag(&bags, cert, name, namelen, pkeyid, pkeyidlen);
    }

    /* Add all other certificates */
    for (i = 0; i < sk_X509_num(ca); i++) {
        if (!PKCS12_add_cert(&bags, sk_X509_value(ca, i)))
            goto err;
    }

    if (bags && !PKCS12_add_safe_ex(&safes, bags, nid_cert, iter, pass,
                                    ctx, propq))
        goto err;

    sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
    bags = NULL;

    if (pkey) {
        bag = PKCS12_add_key_ex(&bags, pkey, keytype, iter, nid_key, pass,
                                ctx, propq);

        if (!bag)
            goto err;

        if (!copy_bag_attr(bag, pkey, NID_ms_csp_name))
            goto err;
        if (!copy_bag_attr(bag, pkey, NID_LocalKeySet))
            goto err;

        if (name && !PKCS12_add_friendlyname(bag, name, -1))
            goto err;
        if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
            goto err;
    }

    if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL))
        goto err;

    sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
    bags = NULL;

    p12 = PKCS12_add_safes_ex(safes, 0, ctx, propq);

    if (p12 == NULL)
        goto err;

    sk_PKCS7_pop_free(safes, PKCS7_free);

    safes = NULL;

    if ((mac_iter != -1) &&
        !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL))
        goto err;

    return p12;

 err:
    PKCS12_free(p12);
    sk_PKCS7_pop_free(safes, PKCS7_free);
    sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
    return NULL;

}

PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, X509 *cert,
                      STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
                      int mac_iter, int keytype)
{
    return PKCS12_create_ex(pass, name, pkey, cert, ca, nid_key, nid_cert,
                            iter, mac_iter, keytype, NULL, NULL);
}

static PKCS12_SAFEBAG *pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                           X509 *cert,
                                           const char *name,
                                           int namelen,
                                           unsigned char *keyid,
                                           int keyidlen)
{
    PKCS12_SAFEBAG *bag = NULL;

    /* Add user certificate */
    if ((bag = PKCS12_SAFEBAG_create_cert(cert)) == NULL)
        goto err;

    if (name != NULL && !PKCS12_add_friendlyname(bag, name, namelen))
        goto err;

    if (keyid != NULL && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
        goto err;

    if (!pkcs12_add_bag(pbags, bag))
        goto err;

    return bag;

 err:
    PKCS12_SAFEBAG_free(bag);
    return NULL;
}

PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert)
{
    char *name = NULL;
    int namelen = -1;
    unsigned char *keyid = NULL;
    int keyidlen = -1;

    /*
     * Use friendlyName and localKeyID in certificate. (if present)
     */
    name = (char *)X509_alias_get0(cert, &namelen);
    keyid = X509_keyid_get0(cert, &keyidlen);

    return pkcs12_add_cert_bag(pbags, cert, name, namelen, keyid, keyidlen);
}

PKCS12_SAFEBAG *PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                  EVP_PKEY *key, int key_usage, int iter,
                                  int nid_key, const char *pass,
                                  OSSL_LIB_CTX *ctx, const char *propq)
{

    PKCS12_SAFEBAG *bag = NULL;
    PKCS8_PRIV_KEY_INFO *p8 = NULL;

    /* Make a PKCS#8 structure */
    if ((p8 = EVP_PKEY2PKCS8(key)) == NULL)
        goto err;
    if (key_usage && !PKCS8_add_keyusage(p8, key_usage)) {
        PKCS8_PRIV_KEY_INFO_free(p8);
        goto err;
    }
    if (nid_key != -1) {
        /* This call does not take ownership of p8 */
        bag = PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(nid_key, pass, -1, NULL, 0,
                                                     iter, p8, ctx, propq);
    } else {
        bag = PKCS12_SAFEBAG_create0_p8inf(p8);
        if (bag != NULL)
           p8 = NULL; /* bag takes ownership of p8 */
    }
    /* This does not need to be in the error path */
    if (p8 != NULL)
        PKCS8_PRIV_KEY_INFO_free(p8);

    if (bag == NULL || !pkcs12_add_bag(pbags, bag))
        goto err;

    return bag;

 err:
    PKCS12_SAFEBAG_free(bag);
    return NULL;

}

PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags,
                               EVP_PKEY *key, int key_usage, int iter,
                               int nid_key, const char *pass)
{
    return PKCS12_add_key_ex(pbags, key, key_usage, iter, nid_key, pass,
                             NULL, NULL);
}

PKCS12_SAFEBAG *PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) **pbags, 
                                  int nid_type, const unsigned char *value, int len)
{
    PKCS12_SAFEBAG *bag = NULL;

    /* Add secret, storing the value as an octet string */
    if ((bag = PKCS12_SAFEBAG_create_secret(nid_type, V_ASN1_OCTET_STRING, value, len)) == NULL)
        goto err;

    if (!pkcs12_add_bag(pbags, bag))
        goto err;

    return bag;
 err:
    PKCS12_SAFEBAG_free(bag);
    return NULL;
}

int PKCS12_add_safe_ex(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                       int nid_safe, int iter, const char *pass,
                       OSSL_LIB_CTX *ctx, const char *propq)
{
    PKCS7 *p7 = NULL;
    int free_safes = 0;

    if (*psafes == NULL) {
        *psafes = sk_PKCS7_new_null();
        if (*psafes == NULL)
            return 0;
        free_safes = 1;
    }

    if (nid_safe == 0)
#ifdef OPENSSL_NO_RC2
        nid_safe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
#else
        nid_safe = NID_pbe_WithSHA1And40BitRC2_CBC;
#endif

    if (nid_safe == -1)
        p7 = PKCS12_pack_p7data(bags);
    else
        p7 = PKCS12_pack_p7encdata_ex(nid_safe, pass, -1, NULL, 0, iter, bags, ctx, propq);
    if (p7 == NULL)
        goto err;

    if (!sk_PKCS7_push(*psafes, p7))
        goto err;

    return 1;

 err:
    if (free_safes) {
        sk_PKCS7_free(*psafes);
        *psafes = NULL;
    }
    PKCS7_free(p7);
    return 0;
}

int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                    int nid_safe, int iter, const char *pass)
{
    return PKCS12_add_safe_ex(psafes, bags, nid_safe, iter, pass, NULL, NULL);
}

static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
                          PKCS12_SAFEBAG *bag)
{
    int free_bags = 0;

    if (pbags == NULL)
        return 1;
    if (*pbags == NULL) {
        *pbags = sk_PKCS12_SAFEBAG_new_null();
        if (*pbags == NULL)
            return 0;
        free_bags = 1;
    }

    if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) {
        if (free_bags) {
            sk_PKCS12_SAFEBAG_free(*pbags);
            *pbags = NULL;
        }
        return 0;
    }

    return 1;

}

PKCS12 *PKCS12_add_safes_ex(STACK_OF(PKCS7) *safes, int nid_p7,
                            OSSL_LIB_CTX *ctx, const char *propq)
{
    PKCS12 *p12;

    if (nid_p7 <= 0)
        nid_p7 = NID_pkcs7_data;
    p12 = PKCS12_init_ex(nid_p7, ctx, propq);
    if (p12 == NULL)
        return NULL;

    if (!PKCS12_pack_authsafes(p12, safes)) {
        PKCS12_free(p12);
        return NULL;
    }

    return p12;

}

PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7)
{
    return PKCS12_add_safes_ex(safes, nid_p7, NULL, NULL);
}

Coverage Report

Created: 2025-04-22 06:18

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include "internal/cryptlib.h"
12		#include <openssl/pkcs12.h>
13		#include "p12_local.h"
14
15		static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
16		PKCS12_SAFEBAG *bag);
17		static PKCS12_SAFEBAG pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) *pbags,
18		X509 *cert,
19		const char *name,
20		int namelen,
21		unsigned char *keyid,
22		int keyidlen);
23
24		static int copy_bag_attr(PKCS12_SAFEBAG bag, EVP_PKEY pkey, int nid)
25	0	{
26	0	int idx;
27	0	X509_ATTRIBUTE *attr;
28	0	idx = EVP_PKEY_get_attr_by_NID(pkey, nid, -1);
29	0	if (idx < 0)
30	0	return 1;
31	0	attr = EVP_PKEY_get_attr(pkey, idx);
32	0	if (!X509at_add1_attr(&bag->attrib, attr))
33	0	return 0;
34	0	return 1;
35	0	}
36
37		PKCS12 PKCS12_create_ex(const char pass, const char name, EVP_PKEY pkey,
38		X509 cert, STACK_OF(X509) ca, int nid_key, int nid_cert,
39		int iter, int mac_iter, int keytype,
40		OSSL_LIB_CTX ctx, const char propq)
41	0	{
42	0	PKCS12 *p12 = NULL;
43	0	STACK_OF(PKCS7) *safes = NULL;
44	0	STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
45	0	PKCS12_SAFEBAG *bag = NULL;
46	0	int i;
47	0	unsigned char keyid[EVP_MAX_MD_SIZE];
48	0	unsigned int keyidlen = 0;
49	0	int namelen = -1;
50	0	unsigned char *pkeyid = NULL;
51	0	int pkeyidlen = -1;
52
53		/* Set defaults */
54	0	if (nid_cert == NID_undef)
55	0	nid_cert = NID_aes_256_cbc;
56	0	if (nid_key == NID_undef)
57	0	nid_key = NID_aes_256_cbc;
58	0	if (!iter)
59	0	iter = PKCS12_DEFAULT_ITER;
60	0	if (!mac_iter)
61	0	mac_iter = PKCS12_DEFAULT_ITER;
62
63	0	if (pkey == NULL && cert == NULL && ca == NULL) {
64	0	ERR_raise(ERR_LIB_PKCS12, PKCS12_R_INVALID_NULL_ARGUMENT);
65	0	return NULL;
66	0	}
67
68	0	if (pkey && cert) {
69	0	if (!X509_check_private_key(cert, pkey))
70	0	return NULL;
71	0	if (!X509_digest(cert, EVP_sha1(), keyid, &keyidlen))
72	0	return NULL;
73	0	}
74
75	0	if (cert) {
76	0	if (name == NULL)
77	0	name = (char *)X509_alias_get0(cert, &namelen);
78	0	if (keyidlen > 0) {
79	0	pkeyid = keyid;
80	0	pkeyidlen = keyidlen;
81	0	} else {
82	0	pkeyid = X509_keyid_get0(cert, &pkeyidlen);
83	0	}
84
85	0	bag = pkcs12_add_cert_bag(&bags, cert, name, namelen, pkeyid, pkeyidlen);
86	0	}
87
88		/* Add all other certificates */
89	0	for (i = 0; i < sk_X509_num(ca); i++) {
90	0	if (!PKCS12_add_cert(&bags, sk_X509_value(ca, i)))
91	0	goto err;
92	0	}
93
94	0	if (bags && !PKCS12_add_safe_ex(&safes, bags, nid_cert, iter, pass,
95	0	ctx, propq))
96	0	goto err;
97
98	0	sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
99	0	bags = NULL;
100
101	0	if (pkey) {
102	0	bag = PKCS12_add_key_ex(&bags, pkey, keytype, iter, nid_key, pass,
103	0	ctx, propq);
104
105	0	if (!bag)
106	0	goto err;
107
108	0	if (!copy_bag_attr(bag, pkey, NID_ms_csp_name))
109	0	goto err;
110	0	if (!copy_bag_attr(bag, pkey, NID_LocalKeySet))
111	0	goto err;
112
113	0	if (name && !PKCS12_add_friendlyname(bag, name, -1))
114	0	goto err;
115	0	if (keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
116	0	goto err;
117	0	}
118
119	0	if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL))
120	0	goto err;
121
122	0	sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
123	0	bags = NULL;
124
125	0	p12 = PKCS12_add_safes_ex(safes, 0, ctx, propq);
126
127	0	if (p12 == NULL)
128	0	goto err;
129
130	0	sk_PKCS7_pop_free(safes, PKCS7_free);
131
132	0	safes = NULL;
133
134	0	if ((mac_iter != -1) &&
135	0	!PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL))
136	0	goto err;
137
138	0	return p12;
139
140	0	err:
141	0	PKCS12_free(p12);
142	0	sk_PKCS7_pop_free(safes, PKCS7_free);
143	0	sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
144	0	return NULL;
145
146	0	}
147
148		PKCS12 PKCS12_create(const char pass, const char name, EVP_PKEY pkey, X509 *cert,
149		STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
150		int mac_iter, int keytype)
151	0	{
152	0	return PKCS12_create_ex(pass, name, pkey, cert, ca, nid_key, nid_cert,
153	0	iter, mac_iter, keytype, NULL, NULL);
154	0	}
155
156		static PKCS12_SAFEBAG pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) *pbags,
157		X509 *cert,
158		const char *name,
159		int namelen,
160		unsigned char *keyid,
161		int keyidlen)
162	0	{
163	0	PKCS12_SAFEBAG *bag = NULL;
164
165		/* Add user certificate */
166	0	if ((bag = PKCS12_SAFEBAG_create_cert(cert)) == NULL)
167	0	goto err;
168
169	0	if (name != NULL && !PKCS12_add_friendlyname(bag, name, namelen))
170	0	goto err;
171
172	0	if (keyid != NULL && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
173	0	goto err;
174
175	0	if (!pkcs12_add_bag(pbags, bag))
176	0	goto err;
177
178	0	return bag;
179
180	0	err:
181	0	PKCS12_SAFEBAG_free(bag);
182	0	return NULL;
183	0	}
184
185		PKCS12_SAFEBAG PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) pbags, X509 cert)
186	0	{
187	0	char *name = NULL;
188	0	int namelen = -1;
189	0	unsigned char *keyid = NULL;
190	0	int keyidlen = -1;
191
192		/*
193		* Use friendlyName and localKeyID in certificate. (if present)
194		*/
195	0	name = (char *)X509_alias_get0(cert, &namelen);
196	0	keyid = X509_keyid_get0(cert, &keyidlen);
197
198	0	return pkcs12_add_cert_bag(pbags, cert, name, namelen, keyid, keyidlen);
199	0	}
200
201		PKCS12_SAFEBAG PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) *pbags,
202		EVP_PKEY *key, int key_usage, int iter,
203		int nid_key, const char *pass,
204		OSSL_LIB_CTX ctx, const char propq)
205	0	{
206
207	0	PKCS12_SAFEBAG *bag = NULL;
208	0	PKCS8_PRIV_KEY_INFO *p8 = NULL;
209
210		/* Make a PKCS#8 structure */
211	0	if ((p8 = EVP_PKEY2PKCS8(key)) == NULL)
212	0	goto err;
213	0	if (key_usage && !PKCS8_add_keyusage(p8, key_usage)) {
214	0	PKCS8_PRIV_KEY_INFO_free(p8);
215	0	goto err;
216	0	}
217	0	if (nid_key != -1) {
218		/* This call does not take ownership of p8 */
219	0	bag = PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(nid_key, pass, -1, NULL, 0,
220	0	iter, p8, ctx, propq);
221	0	} else {
222	0	bag = PKCS12_SAFEBAG_create0_p8inf(p8);
223	0	if (bag != NULL)
224	0	p8 = NULL; /* bag takes ownership of p8 */
225	0	}
226		/* This does not need to be in the error path */
227	0	if (p8 != NULL)
228	0	PKCS8_PRIV_KEY_INFO_free(p8);
229
230	0	if (bag == NULL \|\| !pkcs12_add_bag(pbags, bag))
231	0	goto err;
232
233	0	return bag;
234
235	0	err:
236	0	PKCS12_SAFEBAG_free(bag);
237	0	return NULL;
238
239	0	}
240
241		PKCS12_SAFEBAG PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) *pbags,
242		EVP_PKEY *key, int key_usage, int iter,
243		int nid_key, const char *pass)
244	0	{
245	0	return PKCS12_add_key_ex(pbags, key, key_usage, iter, nid_key, pass,
246	0	NULL, NULL);
247	0	}
248
249		PKCS12_SAFEBAG PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) *pbags,
250		int nid_type, const unsigned char *value, int len)
251	0	{
252	0	PKCS12_SAFEBAG *bag = NULL;
253
254		/* Add secret, storing the value as an octet string */
255	0	if ((bag = PKCS12_SAFEBAG_create_secret(nid_type, V_ASN1_OCTET_STRING, value, len)) == NULL)
256	0	goto err;
257
258	0	if (!pkcs12_add_bag(pbags, bag))
259	0	goto err;
260
261	0	return bag;
262	0	err:
263	0	PKCS12_SAFEBAG_free(bag);
264	0	return NULL;
265	0	}
266
267		int PKCS12_add_safe_ex(STACK_OF(PKCS7) *psafes, STACK_OF(PKCS12_SAFEBAG) bags,
268		int nid_safe, int iter, const char *pass,
269		OSSL_LIB_CTX ctx, const char propq)
270	0	{
271	0	PKCS7 *p7 = NULL;
272	0	int free_safes = 0;
273
274	0	if (*psafes == NULL) {
275	0	*psafes = sk_PKCS7_new_null();
276	0	if (*psafes == NULL)
277	0	return 0;
278	0	free_safes = 1;
279	0	}
280
281	0	if (nid_safe == 0)
282		#ifdef OPENSSL_NO_RC2
283		nid_safe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
284		#else
285	0	nid_safe = NID_pbe_WithSHA1And40BitRC2_CBC;
286	0	#endif
287
288	0	if (nid_safe == -1)
289	0	p7 = PKCS12_pack_p7data(bags);
290	0	else
291	0	p7 = PKCS12_pack_p7encdata_ex(nid_safe, pass, -1, NULL, 0, iter, bags, ctx, propq);
292	0	if (p7 == NULL)
293	0	goto err;
294
295	0	if (!sk_PKCS7_push(*psafes, p7))
296	0	goto err;
297
298	0	return 1;
299
300	0	err:
301	0	if (free_safes) {
302	0	sk_PKCS7_free(*psafes);
303	0	*psafes = NULL;
304	0	}
305	0	PKCS7_free(p7);
306	0	return 0;
307	0	}
308
309		int PKCS12_add_safe(STACK_OF(PKCS7) *psafes, STACK_OF(PKCS12_SAFEBAG) bags,
310		int nid_safe, int iter, const char *pass)
311	0	{
312	0	return PKCS12_add_safe_ex(psafes, bags, nid_safe, iter, pass, NULL, NULL);
313	0	}
314
315		static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
316		PKCS12_SAFEBAG *bag)
317	0	{
318	0	int free_bags = 0;
319
320	0	if (pbags == NULL)
321	0	return 1;
322	0	if (*pbags == NULL) {
323	0	*pbags = sk_PKCS12_SAFEBAG_new_null();
324	0	if (*pbags == NULL)
325	0	return 0;
326	0	free_bags = 1;
327	0	}
328
329	0	if (!sk_PKCS12_SAFEBAG_push(*pbags, bag)) {
330	0	if (free_bags) {
331	0	sk_PKCS12_SAFEBAG_free(*pbags);
332	0	*pbags = NULL;
333	0	}
334	0	return 0;
335	0	}
336
337	0	return 1;
338
339	0	}
340
341		PKCS12 PKCS12_add_safes_ex(STACK_OF(PKCS7) safes, int nid_p7,
342		OSSL_LIB_CTX ctx, const char propq)
343	0	{
344	0	PKCS12 *p12;
345
346	0	if (nid_p7 <= 0)
347	0	nid_p7 = NID_pkcs7_data;
348	0	p12 = PKCS12_init_ex(nid_p7, ctx, propq);
349	0	if (p12 == NULL)
350	0	return NULL;
351
352	0	if (!PKCS12_pack_authsafes(p12, safes)) {
353	0	PKCS12_free(p12);
354	0	return NULL;
355	0	}
356
357	0	return p12;
358
359	0	}
360
361		PKCS12 PKCS12_add_safes(STACK_OF(PKCS7) safes, int nid_p7)
362	0	{
363	0	return PKCS12_add_safes_ex(safes, nid_p7, NULL, NULL);
364	0	}