8322 nl: misleading-indentation

[unleashed/tickless.git] / usr / src / common / net / wanboot / p12auxpars.c

/*
 * ====================================================================
 * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    licensing@OpenSSL.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

/*
 * Copyright 2002, 2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident   "%Z%%M% %I%     %E% SMI"

#include <stdio.h>
#include <strings.h>
#include <stdlib.h>

#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/x509.h>

#include <openssl/pkcs12.h>
#include <p12aux.h>
#include <auxutil.h>
#include <p12err.h>

/*
 * Briefly, a note on the APIs provided by this module.
 *
 * The sunw_PKCS_parse, parse_pkcs12 and sunw_PKCS12_contents APIs
 * replace OpenSSL funcionality provided by PKCS12_parse and its
 * supporting routines.
 *
 * The APIs provided here provide more functionality:
 *
 * - sunw_PKCS12_parse provides:
 *
 *   earlier MAC processing than PKCS12_parse
 *
 *   treats the handling of the difference between CA certs and certs
 *   with matching private keys differently that PKCS12_parse does.  In
 *   PKCS12_parse, any cert which is not the one selected is assumed to be
 *   a CA cert.  In parse_pkcs12, certs which have matching private keys are
 *   not returned as part of the CA certs.
 *
 *   the matching of private keys and certs is done at this level, rather than
 *   at the lower levels which were used in the openssl implementation.  This
 *   is part of the changes introduced so that the parsing functions can
 *   return just a cert, just a private key, the stack of CA certs or any
 *   combination.
 *
 *   added DO_FIRST_PAIR, DO_LAST_PAIR and DO_UNMATCHING matchty support.
 *
 *   do a much better job of cleaning up.  Specifically, free the added
 *   attributes on the private key which was done by calling
 *   sunw_evp_pkey_free().
 *
 *   in sunw_PKCS12_contents, handle allocation of the stacks of certificates
 *   and private keys so that a) the original stacks are not changed unless
 *   the parsing was successful; b) it will either extend stacks passed in,
 *   or allocate new ones if none were supplied.
 *
 * - for parse_outer vs. parse_pk12() (from the openssl source base):
 *
 *   this calls lower levels with stacks of private keys and certs, rather
 *   that a cert, a private key and a stack for CA certs.
 *
 * - In the case of parse_all_bags vs. parse_bags, there is no real difference,
 *   other than use of stacks of private keys and certificates (as opposed
 *   to one cert, one private key and a stack of CA certificates).
 *
 * - Finally, for parse_one_bag vs. parse_bag:
 *
 *   got rid of the bugs the openssl matching of keys and certificates.
 *
 *   got rid of the requirement that there is one private key and a matching
 *   cert somewhere in the input.  This was done by moving the matching
 *   code to a higher level.
 *
 *   put any localKeyID and/or friendlyName attributes found in the structures
 *   returned, so that they can be used at higher levels for searching, etc.
 *
 *   added some error returns (like an error when there is an unsupported
 *   bag type, an unsupported certificate type or an unsupported key type)
 *
 *   Added cleanup before returning.
 */

static int parse_pkcs12(PKCS12 *, const char *, int, char *, int, char *,
    EVP_PKEY **, X509 **, STACK_OF(X509) **);

static int parse_outer(PKCS12 *, const char *, STACK_OF(EVP_PKEY) *,
    STACK_OF(X509) *);

static int parse_all_bags(STACK_OF(PKCS12_SAFEBAG) *, const char *,
    STACK_OF(EVP_PKEY) *, STACK_OF(X509) *);

static int parse_one_bag(PKCS12_SAFEBAG *, const char *, STACK_OF(EVP_PKEY) *,
    STACK_OF(X509) *);

static int sunw_PKCS12_contents(PKCS12 *p12, const char *pass,
    STACK_OF(EVP_PKEY) **pkey, STACK_OF(X509) **certs);

/*
 * sunw_PKCS12_parse - Parse a PKCS12 structure and break it into its parts.
 *
 * Parse and decrypt a PKCS#12 structure returning user key, user cert and/or
 * other (CA) certs. Note either ca should be NULL, *ca should be NULL,
 * or it should point to a valid STACK_OF(X509) structure. pkey and cert can
 * be passed uninitialized.
 *
 * Arguments:
 *   p12      - Structure with pkcs12 info to be parsed
 *   pass     - Pass phrase for the private key (possibly empty) or NULL if
 *              there is none.
 *   matchty  - Info about which certs/keys to return if many are in the file.
 *   keyid    - If private key localkeyids friendlynames are to match a
 *              predetermined value, the value to match. This value should
 *              be an octet string.
 *   keyid_len- Length of the keyid byte string.
 *   name_str - If friendlynames are to match a predetermined value, the value
 *               to match. This value should be a NULL terminated string.
 *   pkey     - Points to location pointing to the private key returned.
 *   cert     - Points to locaiton which points to the client cert returned
 *   ca       - Points to location that points to a stack of 'certificate
 *               authority' certs/trust anchors.
 *
 * Match based on the value of 'matchty' and the contents of 'keyid'
 * and/or 'name_str', as appropriate.  Go through the lists of certs and
 * private keys which were taken from the pkcs12 structure, looking for
 * matches of the requested type.  This function only searches the lists of
 * matching private keys and client certificates.  Kinds of matches allowed,
 * and the order in which they will be checked, are:
 *
 *   1) Find the key and/or cert whose localkeyid attributes matches
 *      'keyid'.
 *   2) Find the key and/or cert whose friendlyname attributes matches
 *      'name_str'
 *   3) Return the first matching key/cert pair found.
 *   4) Return the last matching key/cert pair found.
 *   5) Return whatever cert and/or key are available, even unmatching.
 *
 *   Append to the CA list, the certs which do not have matching private
 *   keys and which were not selected.
 *
 * If none of the bits are set, no client certs or private keys will be
 * returned.  CA (aka trust anchor) certs can be.
 *
 * Notes: If #3 is selected, then #4 will never occur.  CA certs will be
 * selected after a cert/key pairs are isolated.
 *
 * Returns:
 *  <  0 - An error returned.  Call ERR_get_error() to get errors information.
 *         Where possible, memory has been freed.
 *  >= 0 - Objects were found and returned.  Which objects are indicated by
 *         which bits are set (FOUND_PKEY, FOUND_CERT, FOUND_CA_CERTS).
 */
int
sunw_PKCS12_parse(PKCS12 *p12, const char *pass, int matchty, char *keyid,
    int keyid_len, char *name_str, EVP_PKEY **pkey, X509 **cert,
    STACK_OF(X509) **ca)
{
        boolean_t ca_supplied;
        int retval = -1;

        /* If NULL PKCS12 structure, this is an error */
        if (p12 == NULL) {
                SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG);
                return (-1);
        }

        /* Set up arguments....  These will be allocated if needed */
        if (pkey)
                *pkey = NULL;
        if (cert)
                *cert = NULL;

        /*
         * If there is already a ca list, use it.  Otherwise, allocate one
         * and free is later if an error occurs or whatever.)
         */
        ca_supplied = (ca != NULL && *ca != NULL);
        if (ca != NULL && *ca == NULL) {
                if ((*ca = sk_X509_new_null()) == NULL) {
                        SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_MEMORY_FAILURE);
                        return (-1);
                }
        }

        /*
         * If password is zero length or NULL then try verifying both cases
         * to determine which password is correct. The reason for this is that
         * under PKCS#12 password based encryption no password and a zero
         * length password are two different things. If the password has a
         * non-zero length and is not NULL then call PKCS12_verify_mac() with
         * a length of '-1' and let it use strlen() to figure out the length
         * of the password.
         */
        /* Check the mac */
        if (pass == NULL || *pass == '\0') {
                if (PKCS12_verify_mac(p12, NULL, 0))
                        pass = NULL;
                else if (PKCS12_verify_mac(p12, "", 0))
                        pass = "";
                else {
                        SUNWerr(SUNW_F_PKCS12_PARSE,
                            SUNW_R_MAC_VERIFY_FAILURE);
                        goto err;
                }
        } else if (PKCS12_verify_mac(p12, pass, -1) == 0) {
                SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_MAC_VERIFY_FAILURE);
                goto err;
        }

        retval = parse_pkcs12(p12, pass, matchty, keyid, keyid_len,
            name_str, pkey, cert, ca);
        if (retval < 0) {
                SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_PKCS12_PARSE_ERR);
                goto err;
        }
        return (retval);

err:
        if (pkey && *pkey) {
                sunw_evp_pkey_free(*pkey);
        }
        if (cert && *cert)
                X509_free(*cert);
        if (ca_supplied == B_FALSE && ca != NULL)
                sk_X509_pop_free(*ca, X509_free);

        return (-1);

}

/*
 * parse_pkcs12 - Oversee parsing of the pkcs12 structure.  Get it
 *         parsed.  After that either return what's found directly, or
 *         do any required matching.
 *
 * Arguments:
 *   p12      - Structure with pkcs12 info to be parsed
 *   pass     - Pass phrase for the private key (possibly empty) or NULL if
 *              there is none.
 *   matchty  - Info about which certs/keys to return if many are in the file.
 *   keyid    - If private key localkeyids friendlynames are to match a
 *              predetermined value, the value to match. This value should
 *              be an octet string.
 *   keyid_len- Length of the keyid byte string.
 *   name_str - If friendlynames are to match a predetermined value, the value
 *               to match. This value should be a NULL terminated string.
 *   pkey     - Points to location pointing to the private key returned.
 *   cert     - Points to locaiton which points to the client cert returned
 *   ca       - Points to location that points to a stack of 'certificate
 *              authority' certs/trust anchors.
 *
 *   Note about error codes:  This function is an internal function, and the
 *   place where it is called sets error codes.  Therefore only set an error
 *   code if it is something that is unique or if the function which detected
 *   the error doesn't set one.
 *
 * Returns:
 *   == -1 - An error occurred.  Call ERR_get_error() to get error information.
 *           Where possible, memory has been freed.
 *   == 0  - No matching returns were found.
 *    > 0  - This is the aithmetic 'or' of the FOUND_* bits that indicate which
 *           of the requested entries were found.
 */
static int
parse_pkcs12(PKCS12 *p12, const char *pass, int matchty, char *keyid,
    int kstr_len, char *name_str, EVP_PKEY **pkey, X509 **cert,
    STACK_OF(X509) **ca)
{
        STACK_OF(EVP_PKEY) *work_kl = NULL;     /* Head for private key list */
        STACK_OF(EVP_PKEY) *nocerts = NULL;     /* Head for alt. key list */
        STACK_OF(X509) *work_ca = NULL;         /* Head for cert list */
        STACK_OF(X509) *work_cl = NULL;
        int retval = 0;
        int n;

        retval = sunw_PKCS12_contents(p12, pass, &work_kl, &work_ca);
        if (retval < 0) {
                goto cleanup;
        } else if (retval == 0) {
                /*
                 * Not really an error here - its just that nothing was found.
                 */
                goto cleanup;
        }

        if (sk_EVP_PKEY_num(work_kl) > 0) {

                if (sunw_split_certs(work_kl, work_ca, &work_cl, &nocerts)
                    < 0) {
                        goto cleanup;
                }
        }

        /*
         * Go through the lists of certs and private keys which were
         * returned, looking for matches of the appropriate type.  Do these
         * in the order described above.
         */
        if ((matchty & DO_FIND_KEYID) != 0) {

                if (keyid == NULL) {
                        SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG);
                        retval = -1;
                        goto cleanup;
                }

                /* See if string matches localkeyid's */
                retval = sunw_find_localkeyid(keyid, kstr_len,
                    work_kl, work_cl, pkey, cert);
                if (retval != 0) {
                        if (retval == -1)
                                goto cleanup;
                        else
                                goto last_part;
                }
        }
        if ((matchty & DO_FIND_FN) != 0) {

                if (name_str == NULL) {
                        SUNWerr(SUNW_F_PKCS12_PARSE, SUNW_R_INVALID_ARG);
                        retval = -1;
                        goto cleanup;
                }

                /* See if string matches friendly names */
                retval = sunw_find_fname(name_str, work_kl, work_cl,
                    pkey, cert);
                if (retval != 0) {
                        if (retval == -1)
                                goto cleanup;
                        else
                                goto last_part;
                }
        }

        if (matchty & DO_FIRST_PAIR) {

                /* Find the first cert and private key and return them */
                retval = get_key_cert(0, work_kl, pkey, work_cl, cert);
                if (retval != 0) {
                        if (retval == -1)
                                goto cleanup;
                        else
                                goto last_part;
                }
        }

        if (matchty & DO_LAST_PAIR) {

                /*
                 * Find the last matching cert and private key and return
                 * them.  Since keys which don't have matching client certs
                 * are at the end of the list of keys, use the number of
                 * client certs to compute the position of the last private
                 * key which matches a client cert.
                 */
                n = sk_X509_num(work_cl) - 1;
                retval = get_key_cert(n, work_kl, pkey, work_cl, cert);
                if (retval != 0) {
                        if (retval == -1)
                                goto cleanup;
                        else
                                goto last_part;
                }
        }

        if (matchty & DO_UNMATCHING) {
                STACK_OF(EVP_PKEY) *tmpk;
                STACK_OF(X509) *tmpc;

                /* Find the first cert and private key and return them */
                tmpc = work_cl;
                if (work_cl == NULL || sk_X509_num(work_cl) == 0)
                        tmpc = work_ca;
                tmpk = work_kl;
                if (work_kl == NULL || sk_EVP_PKEY_num(work_kl) == 0)
                        tmpk = nocerts;
                retval = get_key_cert(0, tmpk, pkey, tmpc, cert);
                if (retval != 0) {
                        if (retval == -1)
                                goto cleanup;
                        else
                                goto last_part;
                }
        }

last_part:
        /* If no errors, terminate normally */
        if (retval != -1)
                retval |= set_results(NULL, NULL, NULL, NULL, ca, &work_ca,
                    NULL, NULL);
        if (retval >= 0) {
                goto clean_part;
        }

        /* Fallthrough is intentional in error cases. */
cleanup:
        if (pkey != NULL && *pkey != NULL) {
                sunw_evp_pkey_free(*pkey);
                *pkey = NULL;
        }
        if (cert != NULL && *cert != NULL) {
                X509_free(*cert);
                *cert = NULL;
        }

clean_part:

        if (work_kl != NULL) {
                sk_EVP_PKEY_pop_free(work_kl, sunw_evp_pkey_free);
        }
        if (work_ca != NULL)
                sk_X509_pop_free(work_ca, X509_free);
        if (work_cl != NULL)
                sk_X509_pop_free(work_cl, X509_free);

        return (retval);
}

/*
 * sunw_PKCS12_contents() parses a pkcs#12 structure and returns component
 *     parts found, without evaluation.
 *
 * Parse and decrypt a PKCS#12 structure returning any user keys and/or
 * various certs. Note these should either be NULL, *whatever should
 * be NULL, or it should point to a valid STACK_OF(X509) structure.
 *
 * Arguments:
 *   p12      - Structure with pkcs12 info to be parsed
 *   pass     - Pass phrase for the private key and entire pkcs12 wad (possibly
 *              empty) or NULL if there is none.
 *   pkeys    - Points to address of a stack of private keys to return.
 *   certs    - Points to address of a stack of client certs return.
 *
 *   Note:  The certs and keys being returned are in random order.
 *
 * Returns:
 *  <  0 - An error returned.  Call ERR_get_error() to get errors information.
 *         Where possible, memory has been freed.
 *  >= 0 - Objects were found and returned.  Which objects are indicated by
 *         which bits are set (FOUND_PKEY or FOUND_CERT)
 */
static int
sunw_PKCS12_contents(PKCS12 *p12, const char *pass, STACK_OF(EVP_PKEY) **pkey,
    STACK_OF(X509) **certs)
{
        STACK_OF(EVP_PKEY) *work_kl = NULL;
        STACK_OF(X509) *work_ca = NULL;
        int retval = -1;

        /*
         * Allocate the working stacks for private key and for the
         * ca certs.
         */
        if ((work_kl = sk_EVP_PKEY_new_null()) == NULL) {
                SUNWerr(SUNW_F_PKCS12_CONTENTS, SUNW_R_MEMORY_FAILURE);
                goto cleanup;
        }

        if ((work_ca = sk_X509_new_null()) == NULL) {
                SUNWerr(SUNW_F_PKCS12_CONTENTS, SUNW_R_MEMORY_FAILURE);
                goto cleanup;
        }

        if (parse_outer(p12, pass, work_kl, work_ca) == 0) {
                /*
                 * Error already on stack
                 */
                goto cleanup;
        }

        /* on error, set_results() returns an error on the stack */
        retval = set_results(pkey, &work_kl, certs, &work_ca, NULL,
            NULL, NULL, NULL);

cleanup:
        if (work_kl != NULL) {
                sk_EVP_PKEY_pop_free(work_kl, sunw_evp_pkey_free);
        }

        return (retval);
}

/*
 * parse_outer - Unpack the outer PKCS#12 structure and go through the
 *         individual bags.  Return stacks of certs, private keys found and
 *         CA certs found.
 *
 *   Note about error codes:  This function is an internal function, and the
 *   place where it is called sets error codes.
 *
 * Returns:
 *    0 - An error returned.  Call ERR_get_error() to get errors information.
 *        Where possible, memory has been freed.
 *    1 - PKCS12 data object was parsed and lists of certs and private keys
 *        were returned.
 */
static int
parse_outer(PKCS12 *p12, const char *pass, STACK_OF(EVP_PKEY) *kl,
    STACK_OF(X509) *cl)
{
        STACK_OF(PKCS12_SAFEBAG) *bags;
        STACK_OF(PKCS7) *asafes;
        int i, bagnid;
        PKCS7 *p7;

        if ((asafes = M_PKCS12_unpack_authsafes(p12)) == NULL)
                return (0);

        for (i = 0; i < sk_PKCS7_num(asafes); i++) {
                p7 = sk_PKCS7_value(asafes, i);
                bagnid = OBJ_obj2nid(p7->type);
                if (bagnid == NID_pkcs7_data) {
                        bags = M_PKCS12_unpack_p7data(p7);
                } else if (bagnid == NID_pkcs7_encrypted) {
                        /*
                         * A length of '-1' means strlen() can be used
                         * to determine the password length.
                         */
                        bags = M_PKCS12_unpack_p7encdata(p7, pass, -1);
                } else {
                        SUNWerr(SUNW_F_PARSE_OUTER, SUNW_R_BAD_BAGTYPE);
                        return (0);
                }

                if (bags == NULL) {
                        SUNWerr(SUNW_F_PARSE_OUTER, SUNW_R_PARSE_BAG_ERR);
                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                        return (0);
                }
                if (parse_all_bags(bags, pass, kl, cl) == 0) {
                        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                        return (0);
                }
        }

        return (1);
}

/*
 * parse_all_bags - go through the stack of bags, parsing each.
 *
 *   Note about error codes:  This function is an internal function, and the
 *   place where it is called sets error codes.
 *
 * Returns:
 *    0 - An error returned.  Call ERR_get_error() to get errors information.
 *        Where possible, memory has been freed.
 *    1 - Stack of safebags was parsed and lists of certs and private keys
 *        were returned.
 */
static int
parse_all_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
    STACK_OF(EVP_PKEY) *kl, STACK_OF(X509) *cl)
{
        int i;
        for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
                if (parse_one_bag(sk_PKCS12_SAFEBAG_value(bags, i),
                    pass, kl, cl) == 0)
                        return (0);
        }
        return (1);
}

/*
 * parse_one_bag - Parse an individual bag
 *
 *   i = parse_one_bag(bag, pass, kl, cl);
 *
 * Arguments:
 *   bag        - pkcs12 safebag to parse.
 *   pass       - password for use in decryption of shrouded keybag
 *   kl         - Stack of private keys found so far.  New private keys will
 *                be added here if found.
 *   cl         - Stack of certs found so far.  New certificates will be
 *                added here if found.
 *
 * Returns:
 *    0 - An error returned.  Call ERR_get_error() to get errors information.
 *        Where possible, memory has been freed.
 *    1 - one safebag was parsed. If it contained a cert or private key, it
 *        was added to the stack of certs or private keys found, respectively.
 *        localKeyId or friendlyName attributes are returned with the
 *        private key or certificate.
 */
static int
parse_one_bag(PKCS12_SAFEBAG *bag, const char *pass, STACK_OF(EVP_PKEY) *kl,
    STACK_OF(X509) *cl)
{
        X509_ATTRIBUTE *attr = NULL;
        ASN1_TYPE *keyid = NULL;
        ASN1_TYPE *fname = NULL;
        PKCS8_PRIV_KEY_INFO *p8;
        EVP_PKEY *pkey = NULL;
        X509 *x509 = NULL;
        uchar_t *data = NULL;
        char *str = NULL;
        int retval = 1;

        keyid = PKCS12_get_attr(bag, NID_localKeyID);
        fname = PKCS12_get_attr(bag, NID_friendlyName);

        switch (M_PKCS12_bag_type(bag)) {
        case NID_keyBag:
                if ((pkey = EVP_PKCS82PKEY(bag->value.keybag)) == NULL) {
                        SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR);
                        retval = 0;
                        break;
                }
                break;

        case NID_pkcs8ShroudedKeyBag:
                /*
                 * A length of '-1' means strlen() can be used
                 * to determine the password length.
                 */
                if ((p8 = M_PKCS12_decrypt_skey(bag, pass, -1)) == NULL) {
                        SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR);
                        retval = 0;
                        break;
                }
                pkey = EVP_PKCS82PKEY(p8);
                PKCS8_PRIV_KEY_INFO_free(p8);
                if (pkey == NULL) {
                        SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_PARSE_BAG_ERR);
                        retval = 0;
                }
                break;

        case NID_certBag:
                if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate) {
                        SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_BAD_CERTTYPE);
                        break;
                }
                if ((x509 = M_PKCS12_certbag2x509(bag)) == NULL) {
                        SUNWerr(SUNW_F_PARSE_ONE_BAG,
                            SUNW_R_PARSE_CERT_ERR);
                        retval = 0;
                        break;
                }

                if (keyid != NULL) {
                        if (keyid->type != V_ASN1_OCTET_STRING) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_BAD_LKID);
                                retval = 0;
                                break;
                        }
                        if (X509_keyid_set1(x509,
                            keyid->value.octet_string->data,
                            keyid->value.octet_string->length) == 0) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_SET_LKID_ERR);
                                retval = 0;
                                break;
                        }
                }

                if (fname != NULL) {
                        ASN1_STRING *tmpstr = NULL;
                        int len;

                        if (fname->type != V_ASN1_BMPSTRING) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_BAD_FNAME);
                                retval = 0;
                                break;
                        }

                        tmpstr = fname->value.asn1_string;
                        len = ASN1_STRING_to_UTF8(&data, tmpstr);
                        if (len < 0) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_SET_FNAME_ERR);
                                retval = 0;
                                break;
                        }

                        if (X509_alias_set1(x509, data, len) == 0) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_SET_FNAME_ERR);
                                retval = 0;
                                break;
                        }
                }

                if (sk_X509_push(cl, x509) == 0) {
                        SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_MEMORY_FAILURE);
                        retval = 0;
                        break;
                }
                x509 = NULL;
                break;

        case NID_safeContentsBag:
                if (keyid != NULL)
                        ASN1_TYPE_free(keyid);
                if (fname != NULL)
                        ASN1_TYPE_free(fname);
                if (parse_all_bags(bag->value.safes, pass, kl, cl) == 0) {
                        /*
                         * Error already on stack
                         */
                        return (0);
                }
                return (1);

        default:
                if (keyid != NULL)
                        ASN1_TYPE_free(keyid);
                if (fname != NULL)
                        ASN1_TYPE_free(fname);
                SUNWerr(SUNW_F_PARSE_ONE_BAG, SUNW_R_BAD_BAGTYPE);
                return (0);
        }


        if (pkey != NULL) {
                if (retval != 0 && (keyid != NULL || fname != NULL) &&
                    pkey->attributes == NULL) {
                        pkey->attributes = sk_X509_ATTRIBUTE_new_null();
                        if (pkey->attributes == NULL) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_MEMORY_FAILURE);
                                retval = 0;
                        }
                }

                if (retval != 0 && keyid != NULL) {
                        attr = type2attrib(keyid, NID_localKeyID);
                        if (attr == NULL)
                                /*
                                 * Error already on stack
                                 */
                                retval = 0;
                        else {
                                keyid = NULL;
                                if (sk_X509_ATTRIBUTE_push(pkey->attributes,
                                    attr) == 0) {
                                        SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                            SUNW_R_MEMORY_FAILURE);
                                        retval = 0;
                                } else {
                                        attr = NULL;
                                }
                        }
                }

                if (retval != 0 && fname != NULL) {
                        attr = type2attrib(fname, NID_friendlyName);
                        if (attr == NULL) {
                                /*
                                 * Error already on stack
                                 */
                                retval = 0;
                        } else {
                                fname = NULL;
                                if (sk_X509_ATTRIBUTE_push(pkey->attributes,
                                    attr) == 0) {
                                        SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                            SUNW_R_MEMORY_FAILURE);
                                        retval = 0;
                                } else {
                                        attr = NULL;
                                }
                        }
                }

                /* Save the private key */
                if (retval != 0) {
                        if (sk_EVP_PKEY_push(kl, pkey) == 0) {
                                SUNWerr(SUNW_F_PARSE_ONE_BAG,
                                    SUNW_R_MEMORY_FAILURE);
                                retval = 0;
                        } else {
                                pkey = NULL;
                        }
                }
        }

        if (pkey != NULL) {
                sunw_evp_pkey_free(pkey);
        }

        if (x509 != NULL)
                X509_free(x509);

        if (keyid != NULL)
                ASN1_TYPE_free(keyid);

        if (fname != NULL)
                ASN1_TYPE_free(fname);

        if (attr != NULL)
                X509_ATTRIBUTE_free(attr);

        if (data != NULL)
                OPENSSL_free(data);

        if (str != NULL)
                OPENSSL_free(str);

        return (retval);
}