lib/x509/pkcs12_bag.c

   1 /*
   2  * Copyright (C) 2003-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 /* Functions that relate on PKCS12 Bag packet parsing.
  24  */
  25
  26 #include <gnutls_int.h>
  27
  28 #include <gnutls_datum.h>
  29 #include <gnutls_global.h>
  30 #include <gnutls_errors.h>
  31 #include <common.h>
  32 #include "x509_int.h"
  33
  34 /**
  35  * gnutls_pkcs12_bag_init:
  36  * @bag: The structure to be initialized
  37  *
  38  * This function will initialize a PKCS12 bag structure. PKCS12 Bags
  39  * usually contain private keys, lists of X.509 Certificates and X.509
  40  * Certificate revocation lists.
  41  *
  42  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
  43  *   negative error value.
  44  **/
  45 int
  46 gnutls_pkcs12_bag_init (gnutls_pkcs12_bag_t * bag)
  47 {
  48   *bag = gnutls_calloc (1, sizeof (gnutls_pkcs12_bag_int));
  49
  50   if (*bag)
  51     {
  52       return 0;                 /* success */
  53     }
  54   return GNUTLS_E_MEMORY_ERROR;
  55 }
  56
  57 static inline void
  58 _pkcs12_bag_free_data (gnutls_pkcs12_bag_t bag)
  59 {
  60   int i;
  61
  62   for (i = 0; i < bag->bag_elements; i++)
  63     {
  64       _gnutls_free_datum (&bag->element[i].data);
  65       _gnutls_free_datum (&bag->element[i].local_key_id);
  66       gnutls_free (bag->element[i].friendly_name);
  67       bag->element[i].friendly_name = NULL;
  68       bag->element[i].type = 0;
  69     }
  70
  71 }
  72
  73
  74 /**
  75  * gnutls_pkcs12_bag_deinit:
  76  * @bag: The structure to be initialized
  77  *
  78  * This function will deinitialize a PKCS12 Bag structure.
  79  **/
  80 void
  81 gnutls_pkcs12_bag_deinit (gnutls_pkcs12_bag_t bag)
  82 {
  83   if (!bag)
  84     return;
  85
  86   _pkcs12_bag_free_data (bag);
  87
  88   gnutls_free (bag);
  89 }
  90
  91 /**
  92  * gnutls_pkcs12_bag_get_type:
  93  * @bag: The bag
  94  * @indx: The element of the bag to get the type
  95  *
  96  * This function will return the bag's type.
  97  *
  98  * Returns: One of the #gnutls_pkcs12_bag_type_t enumerations.
  99  **/
 100 gnutls_pkcs12_bag_type_t
 101 gnutls_pkcs12_bag_get_type (gnutls_pkcs12_bag_t bag, int indx)
 102 {
 103   if (bag == NULL)
 104     {
 105       gnutls_assert ();
 106       return GNUTLS_E_INVALID_REQUEST;
 107     }
 108
 109   if (indx >= bag->bag_elements)
 110     return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 111   return bag->element[indx].type;
 112 }
 113
 114 /**
 115  * gnutls_pkcs12_bag_get_count:
 116  * @bag: The bag
 117  *
 118  * This function will return the number of the elements withing the bag.
 119  *
 120  * Returns: Number of elements in bag, or an negative error code on
 121  *   error.
 122  **/
 123 int
 124 gnutls_pkcs12_bag_get_count (gnutls_pkcs12_bag_t bag)
 125 {
 126   if (bag == NULL)
 127     {
 128       gnutls_assert ();
 129       return GNUTLS_E_INVALID_REQUEST;
 130     }
 131
 132   return bag->bag_elements;
 133 }
 134
 135 /**
 136  * gnutls_pkcs12_bag_get_data:
 137  * @bag: The bag
 138  * @indx: The element of the bag to get the data from
 139  * @data: where the bag's data will be. Should be treated as constant.
 140  *
 141  * This function will return the bag's data. The data is a constant
 142  * that is stored into the bag.  Should not be accessed after the bag
 143  * is deleted.
 144  *
 145  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 146  *   negative error value.
 147  **/
 148 int
 149 gnutls_pkcs12_bag_get_data (gnutls_pkcs12_bag_t bag, int indx,
 150                             gnutls_datum_t * data)
 151 {
 152   if (bag == NULL)
 153     {
 154       gnutls_assert ();
 155       return GNUTLS_E_INVALID_REQUEST;
 156     }
 157
 158   if (indx >= bag->bag_elements)
 159     return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 160
 161   data->data = bag->element[indx].data.data;
 162   data->size = bag->element[indx].data.size;
 163
 164   return 0;
 165 }
 166
 167 #define X509_CERT_OID "1.2.840.113549.1.9.22.1"
 168 #define X509_CRL_OID  "1.2.840.113549.1.9.23.1"
 169 #define RANDOM_NONCE_OID "1.2.840.113549.1.9.25.3"
 170
 171 int
 172 _pkcs12_decode_crt_bag (gnutls_pkcs12_bag_type_t type,
 173                         const gnutls_datum_t * in, gnutls_datum_t * out)
 174 {
 175   int ret;
 176   ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
 177
 178   switch (type)
 179     {
 180     case GNUTLS_BAG_CERTIFICATE:
 181       if ((ret = asn1_create_element (_gnutls_get_pkix (),
 182                                       "PKIX1.pkcs-12-CertBag",
 183                                       &c2)) != ASN1_SUCCESS)
 184         {
 185           gnutls_assert ();
 186           ret = _gnutls_asn2err (ret);
 187           goto cleanup;
 188         }
 189
 190       ret = asn1_der_decoding (&c2, in->data, in->size, NULL);
 191       if (ret != ASN1_SUCCESS)
 192         {
 193           gnutls_assert ();
 194           ret = _gnutls_asn2err (ret);
 195           goto cleanup;
 196         }
 197
 198       ret = _gnutls_x509_read_string (c2, "certValue", out, RV_OCTET_STRING);
 199       if (ret < 0)
 200         {
 201           gnutls_assert ();
 202           goto cleanup;
 203         }
 204       break;
 205
 206     case GNUTLS_BAG_CRL:
 207       if ((ret = asn1_create_element (_gnutls_get_pkix (),
 208                                       "PKIX1.pkcs-12-CRLBag",
 209                                       &c2)) != ASN1_SUCCESS)
 210         {
 211           gnutls_assert ();
 212           ret = _gnutls_asn2err (ret);
 213           goto cleanup;
 214         }
 215
 216       ret = asn1_der_decoding (&c2, in->data, in->size, NULL);
 217       if (ret != ASN1_SUCCESS)
 218         {
 219           gnutls_assert ();
 220           ret = _gnutls_asn2err (ret);
 221           goto cleanup;
 222         }
 223
 224       ret = _gnutls_x509_read_string (c2, "crlValue", out, RV_OCTET_STRING);
 225       if (ret < 0)
 226         {
 227           gnutls_assert ();
 228           goto cleanup;
 229         }
 230       break;
 231
 232     case GNUTLS_BAG_SECRET:
 233       if ((ret = asn1_create_element (_gnutls_get_pkix (),
 234                                       "PKIX1.pkcs-12-SecretBag",
 235                                       &c2)) != ASN1_SUCCESS)
 236         {
 237           gnutls_assert ();
 238           ret = _gnutls_asn2err (ret);
 239           goto cleanup;
 240         }
 241
 242       ret = asn1_der_decoding (&c2, in->data, in->size, NULL);
 243       if (ret != ASN1_SUCCESS)
 244         {
 245           gnutls_assert ();
 246           ret = _gnutls_asn2err (ret);
 247           goto cleanup;
 248         }
 249
 250       ret = _gnutls_x509_read_string (c2, "secretValue", out, RV_OCTET_STRING);
 251       if (ret < 0)
 252         {
 253           gnutls_assert ();
 254           goto cleanup;
 255         }
 256       break;
 257
 258     default:
 259       gnutls_assert ();
 260       asn1_delete_structure (&c2);
 261       return GNUTLS_E_UNIMPLEMENTED_FEATURE;
 262     }
 263
 264   asn1_delete_structure (&c2);
 265
 266   return 0;
 267
 268
 269 cleanup:
 270
 271   asn1_delete_structure (&c2);
 272   return ret;
 273 }
 274
 275
 276 int
 277 _pkcs12_encode_crt_bag (gnutls_pkcs12_bag_type_t type,
 278                         const gnutls_datum_t * raw, gnutls_datum_t * out)
 279 {
 280   int ret;
 281   ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
 282
 283   switch (type)
 284     {
 285     case GNUTLS_BAG_CERTIFICATE:
 286       if ((ret = asn1_create_element (_gnutls_get_pkix (),
 287                                       "PKIX1.pkcs-12-CertBag",
 288                                       &c2)) != ASN1_SUCCESS)
 289         {
 290           gnutls_assert ();
 291           ret = _gnutls_asn2err (ret);
 292           goto cleanup;
 293         }
 294
 295       ret = asn1_write_value (c2, "certId", X509_CERT_OID, 1);
 296       if (ret != ASN1_SUCCESS)
 297         {
 298           gnutls_assert ();
 299           ret = _gnutls_asn2err (ret);
 300           goto cleanup;
 301         }
 302
 303       ret = _gnutls_x509_write_value (c2, "certValue", raw, 1);
 304       if (ret < 0)
 305         {
 306           gnutls_assert ();
 307           goto cleanup;
 308         }
 309       break;
 310
 311     case GNUTLS_BAG_CRL:
 312       if ((ret = asn1_create_element (_gnutls_get_pkix (),
 313                                       "PKIX1.pkcs-12-CRLBag",
 314                                       &c2)) != ASN1_SUCCESS)
 315         {
 316           gnutls_assert ();
 317           ret = _gnutls_asn2err (ret);
 318           goto cleanup;
 319         }
 320
 321       ret = asn1_write_value (c2, "crlId", X509_CRL_OID, 1);
 322       if (ret != ASN1_SUCCESS)
 323         {
 324           gnutls_assert ();
 325           ret = _gnutls_asn2err (ret);
 326           goto cleanup;
 327         }
 328
 329       ret = _gnutls_x509_write_value (c2, "crlValue", raw, 1);
 330       if (ret < 0)
 331         {
 332           gnutls_assert ();
 333           goto cleanup;
 334         }
 335       break;
 336
 337     case GNUTLS_BAG_SECRET:
 338       if ((ret = asn1_create_element (_gnutls_get_pkix (),
 339                                       "PKIX1.pkcs-12-SecretBag",
 340                                       &c2)) != ASN1_SUCCESS)
 341         {
 342           gnutls_assert ();
 343           ret = _gnutls_asn2err (ret);
 344           goto cleanup;
 345         }
 346
 347       ret = asn1_write_value (c2, "secretTypeId", RANDOM_NONCE_OID, 1);
 348       if (ret != ASN1_SUCCESS)
 349         {
 350           gnutls_assert ();
 351           ret = _gnutls_asn2err (ret);
 352           goto cleanup;
 353         }
 354
 355       ret = _gnutls_x509_write_value (c2, "secretValue", raw, 1);
 356       if (ret < 0)
 357         {
 358           gnutls_assert ();
 359           goto cleanup;
 360         }
 361       break;
 362
 363     default:
 364       gnutls_assert ();
 365       asn1_delete_structure (&c2);
 366       return GNUTLS_E_UNIMPLEMENTED_FEATURE;
 367     }
 368
 369   ret = _gnutls_x509_der_encode (c2, "", out, 0);
 370
 371   if (ret < 0)
 372     {
 373       gnutls_assert ();
 374       goto cleanup;
 375     }
 376
 377   asn1_delete_structure (&c2);
 378
 379   return 0;
 380
 381
 382 cleanup:
 383
 384   asn1_delete_structure (&c2);
 385   return ret;
 386 }
 387
 388
 389 /**
 390  * gnutls_pkcs12_bag_set_data:
 391  * @bag: The bag
 392  * @type: The data's type
 393  * @data: the data to be copied.
 394  *
 395  * This function will insert the given data of the given type into
 396  * the bag.
 397  *
 398  * Returns: the index of the added bag on success, or a negative
 399  * value on error.
 400  **/
 401 int
 402 gnutls_pkcs12_bag_set_data (gnutls_pkcs12_bag_t bag,
 403                             gnutls_pkcs12_bag_type_t type,
 404                             const gnutls_datum_t * data)
 405 {
 406   int ret;
 407   if (bag == NULL)
 408     {
 409       gnutls_assert ();
 410       return GNUTLS_E_INVALID_REQUEST;
 411     }
 412
 413   if (bag->bag_elements == MAX_BAG_ELEMENTS - 1)
 414     {
 415       gnutls_assert ();
 416       /* bag is full */
 417       return GNUTLS_E_MEMORY_ERROR;
 418     }
 419
 420   if (bag->bag_elements == 1)
 421     {
 422       /* A bag with a key or an encrypted bag, must have
 423        * only one element.
 424        */
 425
 426       if (bag->element[0].type == GNUTLS_BAG_PKCS8_KEY ||
 427           bag->element[0].type == GNUTLS_BAG_PKCS8_ENCRYPTED_KEY ||
 428           bag->element[0].type == GNUTLS_BAG_ENCRYPTED)
 429         {
 430           gnutls_assert ();
 431           return GNUTLS_E_INVALID_REQUEST;
 432         }
 433     }
 434
 435   ret =
 436     _gnutls_set_datum (&bag->element[bag->bag_elements].data,
 437                        data->data, data->size);
 438
 439   if (ret < 0)
 440     {
 441       gnutls_assert ();
 442       return ret;
 443     }
 444
 445   bag->element[bag->bag_elements].type = type;
 446
 447   bag->bag_elements++;
 448
 449   return bag->bag_elements - 1;
 450 }
 451
 452 /**
 453  * gnutls_pkcs12_bag_set_crt:
 454  * @bag: The bag
 455  * @crt: the certificate to be copied.
 456  *
 457  * This function will insert the given certificate into the
 458  * bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().
 459  *
 460  * Returns: the index of the added bag on success, or a negative
 461  * value on failure.
 462  **/
 463 int
 464 gnutls_pkcs12_bag_set_crt (gnutls_pkcs12_bag_t bag, gnutls_x509_crt_t crt)
 465 {
 466   int ret;
 467   gnutls_datum_t data;
 468
 469   if (bag == NULL)
 470     {
 471       gnutls_assert ();
 472       return GNUTLS_E_INVALID_REQUEST;
 473     }
 474
 475   ret = _gnutls_x509_der_encode (crt->cert, "", &data, 0);
 476   if (ret < 0)
 477     {
 478       gnutls_assert ();
 479       return ret;
 480     }
 481
 482   ret = gnutls_pkcs12_bag_set_data (bag, GNUTLS_BAG_CERTIFICATE, &data);
 483
 484   _gnutls_free_datum (&data);
 485
 486   return ret;
 487 }
 488
 489 /**
 490  * gnutls_pkcs12_bag_set_crl:
 491  * @bag: The bag
 492  * @crl: the CRL to be copied.
 493  *
 494  * This function will insert the given CRL into the
 495  * bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().
 496  *
 497  * Returns: the index of the added bag on success, or a negative error code
 498  * on failure.
 499  **/
 500 int
 501 gnutls_pkcs12_bag_set_crl (gnutls_pkcs12_bag_t bag, gnutls_x509_crl_t crl)
 502 {
 503   int ret;
 504   gnutls_datum_t data;
 505
 506
 507   if (bag == NULL)
 508     {
 509       gnutls_assert ();
 510       return GNUTLS_E_INVALID_REQUEST;
 511     }
 512
 513   ret = _gnutls_x509_der_encode (crl->crl, "", &data, 0);
 514   if (ret < 0)
 515     {
 516       gnutls_assert ();
 517       return ret;
 518     }
 519
 520   ret = gnutls_pkcs12_bag_set_data (bag, GNUTLS_BAG_CRL, &data);
 521
 522   _gnutls_free_datum (&data);
 523
 524   return ret;
 525 }
 526
 527 /**
 528  * gnutls_pkcs12_bag_set_key_id:
 529  * @bag: The bag
 530  * @indx: The bag's element to add the id
 531  * @id: the ID
 532  *
 533  * This function will add the given key ID, to the specified, by the
 534  * index, bag element. The key ID will be encoded as a 'Local key
 535  * identifier' bag attribute, which is usually used to distinguish
 536  * the local private key and the certificate pair.
 537  *
 538  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 539  *   negative error value. or a negative error code on error.
 540  **/
 541 int
 542 gnutls_pkcs12_bag_set_key_id (gnutls_pkcs12_bag_t bag, int indx,
 543                               const gnutls_datum_t * id)
 544 {
 545   int ret;
 546
 547
 548   if (bag == NULL)
 549     {
 550       gnutls_assert ();
 551       return GNUTLS_E_INVALID_REQUEST;
 552     }
 553
 554   if (indx > bag->bag_elements - 1)
 555     {
 556       gnutls_assert ();
 557       return GNUTLS_E_INVALID_REQUEST;
 558     }
 559
 560   ret = _gnutls_set_datum (&bag->element[indx].local_key_id,
 561                            id->data, id->size);
 562
 563   if (ret < 0)
 564     {
 565       gnutls_assert ();
 566       return ret;
 567     }
 568
 569   return 0;
 570 }
 571
 572 /**
 573  * gnutls_pkcs12_bag_get_key_id:
 574  * @bag: The bag
 575  * @indx: The bag's element to add the id
 576  * @id: where the ID will be copied (to be treated as const)
 577  *
 578  * This function will return the key ID, of the specified bag element.
 579  * The key ID is usually used to distinguish the local private key and
 580  * the certificate pair.
 581  *
 582  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 583  *   negative error value. or a negative error code on error.
 584  **/
 585 int
 586 gnutls_pkcs12_bag_get_key_id (gnutls_pkcs12_bag_t bag, int indx,
 587                               gnutls_datum_t * id)
 588 {
 589   if (bag == NULL)
 590     {
 591       gnutls_assert ();
 592       return GNUTLS_E_INVALID_REQUEST;
 593     }
 594
 595   if (indx > bag->bag_elements - 1)
 596     {
 597       gnutls_assert ();
 598       return GNUTLS_E_INVALID_REQUEST;
 599     }
 600
 601   id->data = bag->element[indx].local_key_id.data;
 602   id->size = bag->element[indx].local_key_id.size;
 603
 604   return 0;
 605 }
 606
 607 /**
 608  * gnutls_pkcs12_bag_get_friendly_name:
 609  * @bag: The bag
 610  * @indx: The bag's element to add the id
 611  * @name: will hold a pointer to the name (to be treated as const)
 612  *
 613  * This function will return the friendly name, of the specified bag
 614  * element.  The key ID is usually used to distinguish the local
 615  * private key and the certificate pair.
 616  *
 617  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 618  *   negative error value. or a negative error code on error.
 619  **/
 620 int
 621 gnutls_pkcs12_bag_get_friendly_name (gnutls_pkcs12_bag_t bag, int indx,
 622                                      char **name)
 623 {
 624   if (bag == NULL)
 625     {
 626       gnutls_assert ();
 627       return GNUTLS_E_INVALID_REQUEST;
 628     }
 629
 630   if (indx > bag->bag_elements - 1)
 631     {
 632       gnutls_assert ();
 633       return GNUTLS_E_INVALID_REQUEST;
 634     }
 635
 636   *name = bag->element[indx].friendly_name;
 637
 638   return 0;
 639 }
 640
 641
 642 /**
 643  * gnutls_pkcs12_bag_set_friendly_name:
 644  * @bag: The bag
 645  * @indx: The bag's element to add the id
 646  * @name: the name
 647  *
 648  * This function will add the given key friendly name, to the
 649  * specified, by the index, bag element. The name will be encoded as
 650  * a 'Friendly name' bag attribute, which is usually used to set a
 651  * user name to the local private key and the certificate pair.
 652  *
 653  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 654  *   negative error value. or a negative error code on error.
 655  **/
 656 int
 657 gnutls_pkcs12_bag_set_friendly_name (gnutls_pkcs12_bag_t bag, int indx,
 658                                      const char *name)
 659 {
 660   if (bag == NULL)
 661     {
 662       gnutls_assert ();
 663       return GNUTLS_E_INVALID_REQUEST;
 664     }
 665
 666   if (indx > bag->bag_elements - 1)
 667     {
 668       gnutls_assert ();
 669       return GNUTLS_E_INVALID_REQUEST;
 670     }
 671
 672   bag->element[indx].friendly_name = gnutls_strdup (name);
 673
 674   if (name == NULL)
 675     {
 676       gnutls_assert ();
 677       return GNUTLS_E_MEMORY_ERROR;
 678     }
 679
 680   return 0;
 681 }
 682
 683
 684 /**
 685  * gnutls_pkcs12_bag_decrypt:
 686  * @bag: The bag
 687  * @pass: The password used for encryption, must be ASCII.
 688  *
 689  * This function will decrypt the given encrypted bag and return 0 on
 690  * success.
 691  *
 692  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
 693  *   otherwise a negative error code is returned.
 694  **/
 695 int
 696 gnutls_pkcs12_bag_decrypt (gnutls_pkcs12_bag_t bag, const char *pass)
 697 {
 698   int ret;
 699   gnutls_datum_t dec;
 700
 701   if (bag == NULL)
 702     {
 703       gnutls_assert ();
 704       return GNUTLS_E_INVALID_REQUEST;
 705     }
 706
 707   if (bag->element[0].type != GNUTLS_BAG_ENCRYPTED)
 708     {
 709       gnutls_assert ();
 710       return GNUTLS_E_INVALID_REQUEST;
 711     }
 712
 713   ret = _gnutls_pkcs7_decrypt_data (&bag->element[0].data, pass, &dec);
 714
 715   if (ret < 0)
 716     {
 717       gnutls_assert ();
 718       return ret;
 719     }
 720
 721   /* decryption succeeded. Now decode the SafeContents
 722    * stuff, and parse it.
 723    */
 724
 725   _gnutls_free_datum (&bag->element[0].data);
 726
 727   ret = _pkcs12_decode_safe_contents (&dec, bag);
 728
 729   _gnutls_free_datum (&dec);
 730
 731   if (ret < 0)
 732     {
 733       gnutls_assert ();
 734       return ret;
 735     }
 736
 737   return 0;
 738 }
 739
 740 /**
 741  * gnutls_pkcs12_bag_encrypt:
 742  * @bag: The bag
 743  * @pass: The password used for encryption, must be ASCII
 744  * @flags: should be one of #gnutls_pkcs_encrypt_flags_t elements bitwise or'd
 745  *
 746  * This function will encrypt the given bag.
 747  *
 748  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
 749  *   otherwise a negative error code is returned.
 750  **/
 751 int
 752 gnutls_pkcs12_bag_encrypt (gnutls_pkcs12_bag_t bag, const char *pass,
 753                            unsigned int flags)
 754 {
 755   int ret;
 756   ASN1_TYPE safe_cont = ASN1_TYPE_EMPTY;
 757   gnutls_datum_t der = { NULL, 0 };
 758   gnutls_datum_t enc = { NULL, 0 };
 759   schema_id id;
 760
 761   if (bag == NULL)
 762     {
 763       gnutls_assert ();
 764       return GNUTLS_E_INVALID_REQUEST;
 765     }
 766
 767   if (bag->element[0].type == GNUTLS_BAG_ENCRYPTED)
 768     {
 769       gnutls_assert ();
 770       return GNUTLS_E_INVALID_REQUEST;
 771     }
 772
 773   /* Encode the whole bag to a safe contents
 774    * structure.
 775    */
 776   ret = _pkcs12_encode_safe_contents (bag, &safe_cont, NULL);
 777   if (ret < 0)
 778     {
 779       gnutls_assert ();
 780       return ret;
 781     }
 782
 783   /* DER encode the SafeContents.
 784    */
 785   ret = _gnutls_x509_der_encode (safe_cont, "", &der, 0);
 786
 787   asn1_delete_structure (&safe_cont);
 788
 789   if (ret < 0)
 790     {
 791       gnutls_assert ();
 792       return ret;
 793     }
 794
 795   if (flags & GNUTLS_PKCS_PLAIN)
 796     {
 797       gnutls_assert ();
 798       return GNUTLS_E_INVALID_REQUEST;
 799     }
 800
 801   id = _gnutls_pkcs_flags_to_schema (flags);
 802
 803   /* Now encrypt them.
 804    */
 805   ret = _gnutls_pkcs7_encrypt_data (id, &der, pass, &enc);
 806
 807   _gnutls_free_datum (&der);
 808
 809   if (ret < 0)
 810     {
 811       gnutls_assert ();
 812       return ret;
 813     }
 814
 815   /* encryption succeeded.
 816    */
 817
 818   _pkcs12_bag_free_data (bag);
 819
 820   bag->element[0].type = GNUTLS_BAG_ENCRYPTED;
 821   bag->element[0].data = enc;
 822
 823   bag->bag_elements = 1;
 824
 825
 826   return 0;
 827 }