/*

 * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the OpenSSL license (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)

/*

 * On VMS, you need to define this to get the declaration of fileno().  The

 * value 2 is to make sure no function defined in POSIX-2 is left undefined.

 */

# define _POSIX_C_SOURCE 2

#endif

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/types.h>

#ifndef OPENSSL_NO_POSIX_IO

# include <sys/stat.h>

# include <fcntl.h>

#endif

#include <ctype.h>

#include <errno.h>

#include <openssl/err.h>

#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <openssl/pem.h>

#include <openssl/pkcs12.h>

#include <openssl/ui.h>

#include <openssl/safestack.h>

#ifndef OPENSSL_NO_ENGINE

# include <openssl/engine.h>

#endif

#ifndef OPENSSL_NO_RSA

# include <openssl/rsa.h>

#endif

#include <openssl/bn.h>

#include <openssl/ssl.h>

#include "apps.h"

#ifdef _WIN32

static int WIN32_rename(const char *from, const char *to);

# define rename(from,to) WIN32_rename((from),(to))

#endif

#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)

# include <conio.h>

#endif

#if defined(OPENSSL_SYS_MSDOS) && !defined(_WIN32)

# define _kbhit kbhit

#endif

typedef struct {

    const char *name;

    unsigned long flag;

    unsigned long mask;

} NAME_EX_TBL;

static UI_METHOD *ui_method = NULL;

static const UI_METHOD *ui_fallback_method = NULL;

static int set_table_opts(unsigned long *flags, const char *arg,

                          const NAME_EX_TBL * in_tbl);

static int set_multi_opts(unsigned long *flags, const char *arg,

                          const NAME_EX_TBL * in_tbl);

int app_init(long mesgwin);

int chopup_args(ARGS *arg, char *buf)

{

    int quoted;

    char c = '\0', *p = NULL;

    arg->argc = 0;

    if (arg->size == 0) {

        arg->size = 20;

        arg->argv = app_malloc(sizeof(*arg->argv) * arg->size, "argv space");

    }

    for (p = buf;;) {

        /* Skip whitespace. */

        while (*p && isspace(_UC(*p)))

            p++;

        if (!*p)

            break;

        /* The start of something good :-) */

        if (arg->argc >= arg->size) {

            char **tmp;

            arg->size += 20;

            tmp = OPENSSL_realloc(arg->argv, sizeof(*arg->argv) * arg->size);

            if (tmp == NULL)

                return 0;

            arg->argv = tmp;

        }

        quoted = *p == '\'' || *p == '"';

        if (quoted)

            c = *p++;

        arg->argv[arg->argc++] = p;

        /* now look for the end of this */

        if (quoted) {

            while (*p && *p != c)

                p++;

            *p++ = '\0';

        } else {

            while (*p && !isspace(_UC(*p)))

                p++;

            if (*p)

                *p++ = '\0';

        }

    }

    arg->argv[arg->argc] = NULL;

    return 1;

}

#ifndef APP_INIT

int app_init(long mesgwin)

{

    return 1;

}

#endif

int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile,

                             const char *CApath, int noCAfile, int noCApath)

{

    if (CAfile == NULL && CApath == NULL) {

        if (!noCAfile && SSL_CTX_set_default_verify_file(ctx) <= 0)

            return 0;

        if (!noCApath && SSL_CTX_set_default_verify_dir(ctx) <= 0)

            return 0;

        return 1;

    }

    return SSL_CTX_load_verify_locations(ctx, CAfile, CApath);

}

#ifndef OPENSSL_NO_CT

int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path)

{

    if (path == NULL)

        return SSL_CTX_set_default_ctlog_list_file(ctx);

    return SSL_CTX_set_ctlog_list_file(ctx, path);

}

#endif

static unsigned long nmflag = 0;

static char nmflag_set = 0;

int set_nameopt(const char *arg)

{

    int ret = set_name_ex(&nmflag, arg);

    if (ret)

        nmflag_set = 1;

    return ret;

}

unsigned long get_nameopt(void)

{

    return (nmflag_set) ? nmflag : XN_FLAG_ONELINE;

}

int dump_cert_text(BIO *out, X509 *x)

{

    print_name(out, "subject=", X509_get_subject_name(x), get_nameopt());

    BIO_puts(out, "\n");

    print_name(out, "issuer=", X509_get_issuer_name(x), get_nameopt());

    BIO_puts(out, "\n");

    return 0;

}

static int ui_open(UI *ui)

{

    int (*opener)(UI *ui) = UI_method_get_opener(ui_fallback_method);

    if (opener)

        return opener(ui);

    return 1;

}

static int ui_read(UI *ui, UI_STRING *uis)

{

    int (*reader)(UI *ui, UI_STRING *uis) = NULL;

    if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD

        && UI_get0_user_data(ui)) {

        switch (UI_get_string_type(uis)) {

        case UIT_PROMPT:

        case UIT_VERIFY:

            {

                const char *password =

                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;

                if (password && password[0] != '\0') {

                    UI_set_result(ui, uis, password);

                    return 1;

                }

            }

            break;

        case UIT_NONE:

        case UIT_BOOLEAN:

        case UIT_INFO:

        case UIT_ERROR:

            break;

        }

    }

    reader = UI_method_get_reader(ui_fallback_method);

    if (reader)

        return reader(ui, uis);

    return 1;

}

static int ui_write(UI *ui, UI_STRING *uis)

{

    int (*writer)(UI *ui, UI_STRING *uis) = NULL;

    if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD

        && UI_get0_user_data(ui)) {

        switch (UI_get_string_type(uis)) {

        case UIT_PROMPT:

        case UIT_VERIFY:

            {

                const char *password =

                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;

                if (password && password[0] != '\0')

                    return 1;

            }

            break;

        case UIT_NONE:

        case UIT_BOOLEAN:

        case UIT_INFO:

        case UIT_ERROR:

            break;

        }

    }

    writer = UI_method_get_writer(ui_fallback_method);

    if (writer)

        return writer(ui, uis);

    return 1;

}

static int ui_close(UI *ui)

{

    int (*closer)(UI *ui) = UI_method_get_closer(ui_fallback_method);

    if (closer)

        return closer(ui);

    return 1;

}

int setup_ui_method(void)

{

    ui_fallback_method = UI_null();

#ifndef OPENSSL_NO_UI_CONSOLE

    ui_fallback_method = UI_OpenSSL();

#endif

    ui_method = UI_create_method("OpenSSL application user interface");

    UI_method_set_opener(ui_method, ui_open);

    UI_method_set_reader(ui_method, ui_read);

    UI_method_set_writer(ui_method, ui_write);

    UI_method_set_closer(ui_method, ui_close);

    return 0;

}

void destroy_ui_method(void)

{

    if (ui_method) {

        UI_destroy_method(ui_method);

        ui_method = NULL;

    }

}

const UI_METHOD *get_ui_method(void)

{

    return ui_method;

}

int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp)

{

    int res = 0;

    UI *ui = NULL;

    PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp;

    ui = UI_new_method(ui_method);

    if (ui) {

        int ok = 0;

        char *buff = NULL;

        int ui_flags = 0;

        const char *prompt_info = NULL;

        char *prompt;

        if (cb_data != NULL && cb_data->prompt_info != NULL)

            prompt_info = cb_data->prompt_info;

        prompt = UI_construct_prompt(ui, "pass phrase", prompt_info);

        if (!prompt) {

            BIO_printf(bio_err, "Out of memory\n");

            UI_free(ui);

            return 0;

        }

        ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD;

        UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);

        /* We know that there is no previous user data to return to us */

        (void)UI_add_user_data(ui, cb_data);

        ok = UI_add_input_string(ui, prompt, ui_flags, buf,

                                 PW_MIN_LENGTH, bufsiz - 1);

        if (ok >= 0 && verify) {

            buff = app_malloc(bufsiz, "password buffer");

            ok = UI_add_verify_string(ui, prompt, ui_flags, buff,

                                      PW_MIN_LENGTH, bufsiz - 1, buf);

        }

        if (ok >= 0)

            do {

                ok = UI_process(ui);

            } while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));

        OPENSSL_clear_free(buff, (unsigned int)bufsiz);

        if (ok >= 0)

            res = strlen(buf);

        if (ok == -1) {

            BIO_printf(bio_err, "User interface error\n");

            ERR_print_errors(bio_err);

            OPENSSL_cleanse(buf, (unsigned int)bufsiz);

            res = 0;

        }

        if (ok == -2) {

            BIO_printf(bio_err, "aborted!\n");

            OPENSSL_cleanse(buf, (unsigned int)bufsiz);

            res = 0;

        }

        UI_free(ui);

        OPENSSL_free(prompt);

    }

    return res;

}

static char *app_get_pass(const char *arg, int keepbio);

int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2)

{

    int same;

    if (arg2 == NULL || arg1 == NULL || strcmp(arg1, arg2))

        same = 0;

    else

        same = 1;

    if (arg1 != NULL) {

        *pass1 = app_get_pass(arg1, same);

        if (*pass1 == NULL)

            return 0;

    } else if (pass1 != NULL) {

        *pass1 = NULL;

    }

    if (arg2 != NULL) {

        *pass2 = app_get_pass(arg2, same ? 2 : 0);

        if (*pass2 == NULL)

            return 0;

    } else if (pass2 != NULL) {

        *pass2 = NULL;

    }

    return 1;

}

static char *app_get_pass(const char *arg, int keepbio)

{

    char *tmp, tpass[APP_PASS_LEN];

    static BIO *pwdbio = NULL;

    int i;

    if (strncmp(arg, "pass:", 5) == 0)

        return OPENSSL_strdup(arg + 5);

    if (strncmp(arg, "env:", 4) == 0) {

        tmp = getenv(arg + 4);

        if (tmp == NULL) {

            BIO_printf(bio_err, "Can't read environment variable %s\n", arg + 4);

            return NULL;

        }

        return OPENSSL_strdup(tmp);

    }

    if (!keepbio || pwdbio == NULL) {

        if (strncmp(arg, "file:", 5) == 0) {

            pwdbio = BIO_new_file(arg + 5, "r");

            if (pwdbio == NULL) {

                BIO_printf(bio_err, "Can't open file %s\n", arg + 5);

                return NULL;

            }

#if !defined(_WIN32)

            /*

             * Under _WIN32, which covers even Win64 and CE, file

             * descriptors referenced by BIO_s_fd are not inherited

             * by child process and therefore below is not an option.

             * It could have been an option if bss_fd.c was operating

             * on real Windows descriptors, such as those obtained

             * with CreateFile.

             */

        } else if (strncmp(arg, "fd:", 3) == 0) {

            BIO *btmp;

            i = atoi(arg + 3);

            if (i >= 0)

                pwdbio = BIO_new_fd(i, BIO_NOCLOSE);

            if ((i < 0) || !pwdbio) {

                BIO_printf(bio_err, "Can't access file descriptor %s\n", arg + 3);

                return NULL;

            }

            /*

             * Can't do BIO_gets on an fd BIO so add a buffering BIO

             */

            btmp = BIO_new(BIO_f_buffer());

            pwdbio = BIO_push(btmp, pwdbio);

#endif

        } else if (strcmp(arg, "stdin") == 0) {

            pwdbio = dup_bio_in(FORMAT_TEXT);

            if (!pwdbio) {

                BIO_printf(bio_err, "Can't open BIO for stdin\n");

                return NULL;

            }

        } else {

            BIO_printf(bio_err, "Invalid password argument \"%s\"\n", arg);

            return NULL;

        }

    }

    i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);

    if (keepbio != 1) {

        BIO_free_all(pwdbio);

        pwdbio = NULL;

    }

    if (i <= 0) {

        BIO_printf(bio_err, "Error reading password from BIO\n");

        return NULL;

    }

    tmp = strchr(tpass, '\n');

    if (tmp != NULL)

        *tmp = 0;

    return OPENSSL_strdup(tpass);

}

CONF *app_load_config_bio(BIO *in, const char *filename)

{

    long errorline = -1;

    CONF *conf;

    int i;

    conf = NCONF_new(NULL);

    i = NCONF_load_bio(conf, in, &errorline);

    if (i > 0)

        return conf;

    if (errorline <= 0) {

        BIO_printf(bio_err, "%s: Can't load ", opt_getprog());

    } else {

        BIO_printf(bio_err, "%s: Error on line %ld of ", opt_getprog(),

                   errorline);

    }

    if (filename != NULL)

        BIO_printf(bio_err, "config file \"%s\"\n", filename);

    else

        BIO_printf(bio_err, "config input");

    NCONF_free(conf);

    return NULL;

}

CONF *app_load_config(const char *filename)

{

    BIO *in;

    CONF *conf;

    in = bio_open_default(filename, 'r', FORMAT_TEXT);

    if (in == NULL)

        return NULL;

    conf = app_load_config_bio(in, filename);

    BIO_free(in);

    return conf;

}

CONF *app_load_config_quiet(const char *filename)

{

    BIO *in;

    CONF *conf;

    in = bio_open_default_quiet(filename, 'r', FORMAT_TEXT);

    if (in == NULL)

        return NULL;

    conf = app_load_config_bio(in, filename);

    BIO_free(in);

    return conf;

}

int app_load_modules(const CONF *config)

{

    CONF *to_free = NULL;

    if (config == NULL)

        config = to_free = app_load_config_quiet(default_config_file);

    if (config == NULL)

        return 1;

    if (CONF_modules_load(config, NULL, 0) <= 0) {

        BIO_printf(bio_err, "Error configuring OpenSSL modules\n");

        ERR_print_errors(bio_err);

        NCONF_free(to_free);

        return 0;

    }

    NCONF_free(to_free);

    return 1;

}

int add_oid_section(CONF *conf)

{

    char *p;

    STACK_OF(CONF_VALUE) *sktmp;

    CONF_VALUE *cnf;

    int i;

    if ((p = NCONF_get_string(conf, NULL, "oid_section")) == NULL) {

        ERR_clear_error();

        return 1;

    }

    if ((sktmp = NCONF_get_section(conf, p)) == NULL) {

        BIO_printf(bio_err, "problem loading oid section %s\n", p);

        return 0;

    }

    for (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {

        cnf = sk_CONF_VALUE_value(sktmp, i);

        if (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {

            BIO_printf(bio_err, "problem creating object %s=%s\n",

                       cnf->name, cnf->value);

            return 0;

        }

    }

    return 1;

}

static int load_pkcs12(BIO *in, const char *desc,

                       pem_password_cb *pem_cb, void *cb_data,

                       EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)

{

    const char *pass;

    char tpass[PEM_BUFSIZE];

    int len, ret = 0;

    PKCS12 *p12;

    p12 = d2i_PKCS12_bio(in, NULL);

    if (p12 == NULL) {

        BIO_printf(bio_err, "Error loading PKCS12 file for %s\n", desc);

        goto die;

    }

    /* See if an empty password will do */

    if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) {

        pass = "";

    } else {

        if (!pem_cb)

            pem_cb = (pem_password_cb *)password_callback;

        len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);

        if (len < 0) {

            BIO_printf(bio_err, "Passphrase callback error for %s\n", desc);

            goto die;

        }

        if (len < PEM_BUFSIZE)

            tpass[len] = 0;

        if (!PKCS12_verify_mac(p12, tpass, len)) {

            BIO_printf(bio_err,

                       "Mac verify error (wrong password?) in PKCS12 file for %s\n",

                       desc);

            goto die;

        }

        pass = tpass;

    }

    ret = PKCS12_parse(p12, pass, pkey, cert, ca);

 die:

    PKCS12_free(p12);

    return ret;

}

#if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)

static int load_cert_crl_http(const char *url, X509 **pcert, X509_CRL **pcrl)

{

    char *host = NULL, *port = NULL, *path = NULL;

    BIO *bio = NULL;

    OCSP_REQ_CTX *rctx = NULL;

    int use_ssl, rv = 0;

    if (!OCSP_parse_url(url, &host, &port, &path, &use_ssl))

        goto err;

    if (use_ssl) {

        BIO_puts(bio_err, "https not supported\n");

        goto err;

    }

    bio = BIO_new_connect(host);

    if (!bio || !BIO_set_conn_port(bio, port))

        goto err;

    rctx = OCSP_REQ_CTX_new(bio, 1024);

    if (rctx == NULL)

        goto err;

    if (!OCSP_REQ_CTX_http(rctx, "GET", path))

        goto err;

    if (!OCSP_REQ_CTX_add1_header(rctx, "Host", host))

        goto err;

    if (pcert) {

        do {

            rv = X509_http_nbio(rctx, pcert);

        } while (rv == -1);

    } else {

        do {

            rv = X509_CRL_http_nbio(rctx, pcrl);

        } while (rv == -1);

    }

 err:

    OPENSSL_free(host);

    OPENSSL_free(path);

    OPENSSL_free(port);

    BIO_free_all(bio);

    OCSP_REQ_CTX_free(rctx);

    if (rv != 1) {

        BIO_printf(bio_err, "Error loading %s from %s\n",

                   pcert ? "certificate" : "CRL", url);

        ERR_print_errors(bio_err);

    }

    return rv;

}

#endif

X509 *load_cert(const char *file, int format, const char *cert_descrip)

{

    X509 *x = NULL;

    BIO *cert;

    if (format == FORMAT_HTTP) {

#if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)

        load_cert_crl_http(file, &x, NULL);

#endif

        return x;

    }

    if (file == NULL) {

        unbuffer(stdin);

        cert = dup_bio_in(format);

    } else {

        cert = bio_open_default(file, 'r', format);

    }

    if (cert == NULL)

        goto end;

    if (format == FORMAT_ASN1) {

        x = d2i_X509_bio(cert, NULL);

    } else if (format == FORMAT_PEM) {

        x = PEM_read_bio_X509_AUX(cert, NULL,

                                  (pem_password_cb *)password_callback, NULL);

    } else if (format == FORMAT_PKCS12) {

        if (!load_pkcs12(cert, cert_descrip, NULL, NULL, NULL, &x, NULL))

            goto end;

    } else {

        BIO_printf(bio_err, "bad input format specified for %s\n", cert_descrip);

        goto end;

    }

 end:

    if (x == NULL) {

        BIO_printf(bio_err, "unable to load certificate\n");

        ERR_print_errors(bio_err);

    }

    BIO_free(cert);

    return x;

}

X509_CRL *load_crl(const char *infile, int format)

{

    X509_CRL *x = NULL;

    BIO *in = NULL;

    if (format == FORMAT_HTTP) {

#if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)

        load_cert_crl_http(infile, NULL, &x);

#endif

        return x;

    }

    in = bio_open_default(infile, 'r', format);

    if (in == NULL)

        goto end;

    if (format == FORMAT_ASN1) {

        x = d2i_X509_CRL_bio(in, NULL);

    } else if (format == FORMAT_PEM) {

        x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);

    } else {

        BIO_printf(bio_err, "bad input format specified for input crl\n");

        goto end;

    }

    if (x == NULL) {

        BIO_printf(bio_err, "unable to load CRL\n");

        ERR_print_errors(bio_err);

        goto end;

    }

 end:

    BIO_free(in);

    return x;

}

EVP_PKEY *load_key(const char *file, int format, int maybe_stdin,

                   const char *pass, ENGINE *e, const char *key_descrip)

{

    BIO *key = NULL;

    EVP_PKEY *pkey = NULL;

    PW_CB_DATA cb_data;

    cb_data.password = pass;

    cb_data.prompt_info = file;

    if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {

        BIO_printf(bio_err, "no keyfile specified\n");

        goto end;

    }

    if (format == FORMAT_ENGINE) {

        if (e == NULL) {

            BIO_printf(bio_err, "no engine specified\n");

        } else {

#ifndef OPENSSL_NO_ENGINE

            if (ENGINE_init(e)) {

                pkey = ENGINE_load_private_key(e, file, ui_method, &cb_data);

                ENGINE_finish(e);

            }

            if (pkey == NULL) {

                BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip);

                ERR_print_errors(bio_err);

            }

#else

            BIO_printf(bio_err, "engines not supported\n");

#endif

        }

        goto end;

    }

    if (file == NULL && maybe_stdin) {

        unbuffer(stdin);

        key = dup_bio_in(format);

    } else {

        key = bio_open_default(file, 'r', format);

    }

    if (key == NULL)

        goto end;

    if (format == FORMAT_ASN1) {

        pkey = d2i_PrivateKey_bio(key, NULL);

    } else if (format == FORMAT_PEM) {

        pkey = PEM_read_bio_PrivateKey(key, NULL,

                                       (pem_password_cb *)password_callback,

                                       &cb_data);

    } else if (format == FORMAT_PKCS12) {

        if (!load_pkcs12(key, key_descrip,

                         (pem_password_cb *)password_callback, &cb_data,

                         &pkey, NULL, NULL))

            goto end;

#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4)

    } else if (format == FORMAT_MSBLOB) {

        pkey = b2i_PrivateKey_bio(key);

    } else if (format == FORMAT_PVK) {

        pkey = b2i_PVK_bio(key, (pem_password_cb *)password_callback,

                           &cb_data);

#endif

    } else {

        BIO_printf(bio_err, "bad input format specified for key file\n");

        goto end;

    }

 end:

    BIO_free(key);

    if (pkey == NULL) {

        BIO_printf(bio_err, "unable to load %s\n", key_descrip);

        ERR_print_errors(bio_err);

    }

    return pkey;

}

EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin,

                      const char *pass, ENGINE *e, const char *key_descrip)

{

    BIO *key = NULL;

    EVP_PKEY *pkey = NULL;

    PW_CB_DATA cb_data;

    cb_data.password = pass;

    cb_data.prompt_info = file;

    if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {

        BIO_printf(bio_err, "no keyfile specified\n");

        goto end;

    }

    if (format == FORMAT_ENGINE) {

        if (e == NULL) {

            BIO_printf(bio_err, "no engine specified\n");

        } else {

#ifndef OPENSSL_NO_ENGINE

            pkey = ENGINE_load_public_key(e, file, ui_method, &cb_data);

            if (pkey == NULL) {

                BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip);

                ERR_print_errors(bio_err);

            }

#else

            BIO_printf(bio_err, "engines not supported\n");

#endif

        }

        goto end;

    }

    if (file == NULL && maybe_stdin) {

        unbuffer(stdin);

        key = dup_bio_in(format);

    } else {

        key = bio_open_default(file, 'r', format);

    }

    if (key == NULL)

        goto end;

    if (format == FORMAT_ASN1) {

        pkey = d2i_PUBKEY_bio(key, NULL);

    } else if (format == FORMAT_ASN1RSA) {

#ifndef OPENSSL_NO_RSA

        RSA *rsa;

        rsa = d2i_RSAPublicKey_bio(key, NULL);

        if (rsa) {

            pkey = EVP_PKEY_new();

            if (pkey != NULL)

                EVP_PKEY_set1_RSA(pkey, rsa);

            RSA_free(rsa);

        } else

#else

        BIO_printf(bio_err, "RSA keys not supported\n");

#endif

            pkey = NULL;

    } else if (format == FORMAT_PEMRSA) {

#ifndef OPENSSL_NO_RSA

        RSA *rsa;

        rsa = PEM_read_bio_RSAPublicKey(key, NULL,

                                        (pem_password_cb *)password_callback,

                                        &cb_data);

        if (rsa != NULL) {

            pkey = EVP_PKEY_new();

            if (pkey != NULL)

                EVP_PKEY_set1_RSA(pkey, rsa);

            RSA_free(rsa);

        } else

#else

        BIO_printf(bio_err, "RSA keys not supported\n");

#endif

            pkey = NULL;

    } else if (format == FORMAT_PEM) {

        pkey = PEM_read_bio_PUBKEY(key, NULL,

                                   (pem_password_cb *)password_callback,

                                   &cb_data);

#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA)

    } else if (format == FORMAT_MSBLOB) {

        pkey = b2i_PublicKey_bio(key);

#endif

    }

 end:

    BIO_free(key);

    if (pkey == NULL)

        BIO_printf(bio_err, "unable to load %s\n", key_descrip);

    return pkey;

}

static int load_certs_crls(const char *file, int format,

                           const char *pass, const char *desc,

                           STACK_OF(X509) **pcerts,

                           STACK_OF(X509_CRL) **pcrls)

{

    int i;

    BIO *bio;

    STACK_OF(X509_INFO) *xis = NULL;