OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2
if you are using the ssl26 packages for ssh and other things to work you will
need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs

15 files changed, 310 insertions, 70 deletions

diff --git a/src/lib/libcrypto/pkcs12/Makefile.ssl b/src/lib/libcrypto/pkcs12/Makefile.ssl
index 7b0c65fad9..5716f608b6 100644
--- a/src/lib/libcrypto/pkcs12/Makefile.ssl
+++ b/src/lib/libcrypto/pkcs12/Makefile.ssl
@@ -1,5 +1,5 @@
 #
-# SSLeay/crypto/asn1/Makefile
+# SSLeay/crypto/pkcs12/Makefile
 #
 
 DIR=    pkcs12
@@ -24,10 +24,10 @@ APPS=
 LIB=$(TOP)/libcrypto.a
 LIBSRC= p12_add.c p12_attr.c p12_bags.c p12_crpt.c p12_crt.c p12_decr.c \
         p12_init.c p12_key.c p12_kiss.c p12_lib.c p12_mac.c p12_mutl.c\
-        p12_sbag.c p12_utl.c pk12err.c
+        p12_sbag.c p12_utl.c p12_npas.c pk12err.c
 LIBOBJ= p12_add.o p12_attr.o p12_bags.o p12_crpt.o p12_crt.o p12_decr.o \
         p12_init.o p12_key.o p12_kiss.o p12_lib.o p12_mac.o p12_mutl.o\
-        p12_sbag.o p12_utl.o pk12err.o
+        p12_sbag.o p12_utl.o p12_npas.o pk12err.o
 
 SRC= $(LIBSRC)
 
@@ -293,6 +293,23 @@ p12_mutl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 p12_mutl.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 p12_mutl.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 p12_mutl.o: ../cryptlib.h
+p12_npas.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+p12_npas.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+p12_npas.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+p12_npas.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+p12_npas.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
+p12_npas.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+p12_npas.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_npas.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+p12_npas.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_npas.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
+p12_npas.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs12.h
+p12_npas.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+p12_npas.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+p12_npas.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+p12_npas.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+p12_npas.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_npas.o: ../../include/openssl/x509_vfy.h
 p12_sbag.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 p12_sbag.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 p12_sbag.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
diff --git a/src/lib/libcrypto/pkcs12/p12_add.c b/src/lib/libcrypto/pkcs12/p12_add.c
index ae3d9de3b4..d045cbba8d 100644
--- a/src/lib/libcrypto/pkcs12/p12_add.c
+++ b/src/lib/libcrypto/pkcs12/p12_add.c
@@ -133,7 +133,7 @@ PKCS7 *PKCS12_pack_p7data (STACK *sk)
                 return NULL;
         }
         p7->type = OBJ_nid2obj(NID_pkcs7_data);
-        if (!(p7->d.data = ASN1_OCTET_STRING_new())) {
+        if (!(p7->d.data = M_ASN1_OCTET_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -157,20 +157,18 @@ PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        p7->type = OBJ_nid2obj(NID_pkcs7_encrypted);
-        if (!(p7->d.encrypted = PKCS7_ENCRYPT_new ())) {
-                PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
+        if(!PKCS7_set_type(p7, NID_pkcs7_encrypted)) {
+                PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA,
+                                PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE);
                 return NULL;
         }
-        ASN1_INTEGER_set (p7->d.encrypted->version, 0);
-        p7->d.encrypted->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_data);
         if (!(pbe = PKCS5_pbe_set (pbe_nid, iter, salt, saltlen))) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         X509_ALGOR_free(p7->d.encrypted->enc_data->algorithm);
         p7->d.encrypted->enc_data->algorithm = pbe;
-        ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
+        M_ASN1_OCTET_STRING_free(p7->d.encrypted->enc_data->enc_data);
         if (!(p7->d.encrypted->enc_data->enc_data =
         PKCS12_i2d_encrypt (pbe, i2d_PKCS12_SAFEBAG, pass, passlen,
                                  (char *)bags, 1))) {
@@ -191,24 +189,28 @@ X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
 
         if (!(p8 = X509_SIG_new())) {
                 PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE);
-                return NULL;
+                goto err;
         }
 
         if(pbe_nid == -1) pbe = PKCS5_pbe2_set(cipher, iter, salt, saltlen);
         else pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen);
         if(!pbe) {
-                PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_MALLOC_FAILURE);
-                return NULL;
+                PKCS12err(PKCS12_F_PKCS8_ENCRYPT, ERR_R_ASN1_LIB);
+                goto err;
         }
         X509_ALGOR_free(p8->algor);
         p8->algor = pbe;
-        ASN1_OCTET_STRING_free(p8->digest);
+        M_ASN1_OCTET_STRING_free(p8->digest);
         if (!(p8->digest = 
         PKCS12_i2d_encrypt (pbe, i2d_PKCS8_PRIV_KEY_INFO, pass, passlen,
                                                  (char *)p8inf, 0))) {
                 PKCS12err(PKCS12_F_PKCS8_ENCRYPT, PKCS12_R_ENCRYPT_ERROR);
-                return NULL;
+                goto err;
         }
 
         return p8;
+
+        err:
+        X509_SIG_free(p8);
+        return NULL;
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_attr.c b/src/lib/libcrypto/pkcs12/p12_attr.c
index 31c9782b77..f559351d18 100644
--- a/src/lib/libcrypto/pkcs12/p12_attr.c
+++ b/src/lib/libcrypto/pkcs12/p12_attr.c
@@ -73,11 +73,11 @@ int PKCS12_add_localkeyid (PKCS12_SAFEBAG *bag, unsigned char *name,
                 return 0;
         }
         keyid->type = V_ASN1_OCTET_STRING;
-        if (!(oct = ASN1_OCTET_STRING_new())) {
+        if (!(oct = M_ASN1_OCTET_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!ASN1_OCTET_STRING_set(oct, name, namelen)) {
+        if (!M_ASN1_OCTET_STRING_set(oct, name, namelen)) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -115,11 +115,11 @@ int PKCS8_add_keyusage (PKCS8_PRIV_KEY_INFO *p8, int usage)
                 return 0;
         }
         keyid->type = V_ASN1_BIT_STRING;
-        if (!(bstr = ASN1_BIT_STRING_new())) {
+        if (!(bstr = M_ASN1_BIT_STRING_new())) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!ASN1_BIT_STRING_set(bstr, &us_val, 1)) {
+        if (!M_ASN1_BIT_STRING_set(bstr, &us_val, 1)) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -176,7 +176,7 @@ int PKCS12_add_friendlyname_uni (PKCS12_SAFEBAG *bag,
                 return 0;
         }
         fname->type = V_ASN1_BMPSTRING;
-        if (!(bmp = ASN1_BMPSTRING_new())) {
+        if (!(bmp = M_ASN1_BMPSTRING_new())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
diff --git a/src/lib/libcrypto/pkcs12/p12_bags.c b/src/lib/libcrypto/pkcs12/p12_bags.c
index d6eab92c83..c358b06735 100644
--- a/src/lib/libcrypto/pkcs12/p12_bags.c
+++ b/src/lib/libcrypto/pkcs12/p12_bags.c
@@ -171,15 +171,15 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         switch (OBJ_obj2nid(a->type)) {
 
                 case NID_x509Certificate:
-                        ASN1_OCTET_STRING_free (a->value.x509cert);
+                        M_ASN1_OCTET_STRING_free (a->value.x509cert);
                 break;
 
                 case NID_x509Crl:
-                        ASN1_OCTET_STRING_free (a->value.x509crl);
+                        M_ASN1_OCTET_STRING_free (a->value.x509crl);
                 break;
 
                 case NID_sdsiCertificate:
-                        ASN1_IA5STRING_free (a->value.sdsicert);
+                        M_ASN1_IA5STRING_free (a->value.sdsicert);
                 break;
 
                 default:
@@ -188,5 +188,5 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         }
 
         ASN1_OBJECT_free (a->type);
-        Free ((char *)a);
+        Free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_crpt.c b/src/lib/libcrypto/pkcs12/p12_crpt.c
index 6de6f8128f..7b96584f07 100644
--- a/src/lib/libcrypto/pkcs12/p12_crpt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crpt.c
@@ -70,10 +70,12 @@ EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC4, EVP_rc4(), EVP_sha1(),
 EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC4, EVP_rc4_40(), EVP_sha1(),
                                                          PKCS12_PBE_keyivgen);
 #endif
+#ifndef NO_DES
 EVP_PBE_alg_add(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
                         EVP_des_ede3_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
 EVP_PBE_alg_add(NID_pbe_WithSHA1And2_Key_TripleDES_CBC, 
                         EVP_des_ede_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
+#endif
 #ifndef NO_RC2
 EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC2_CBC, EVP_rc2_cbc(),
                                         EVP_sha1(), PKCS12_PBE_keyivgen);
diff --git a/src/lib/libcrypto/pkcs12/p12_decr.c b/src/lib/libcrypto/pkcs12/p12_decr.c
index d3d288e187..4be44eac50 100644
--- a/src/lib/libcrypto/pkcs12/p12_decr.c
+++ b/src/lib/libcrypto/pkcs12/p12_decr.c
@@ -155,7 +155,7 @@ ASN1_OCTET_STRING *PKCS12_i2d_encrypt (X509_ALGOR *algor, int (*i2d)(),
         ASN1_OCTET_STRING *oct;
         unsigned char *in, *p;
         int inlen;
-        if (!(oct = ASN1_OCTET_STRING_new ())) {
+        if (!(oct = M_ASN1_OCTET_STRING_new ())) {
                 PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
diff --git a/src/lib/libcrypto/pkcs12/p12_init.c b/src/lib/libcrypto/pkcs12/p12_init.c
index dc6ab41db8..d5d4884c82 100644
--- a/src/lib/libcrypto/pkcs12/p12_init.c
+++ b/src/lib/libcrypto/pkcs12/p12_init.c
@@ -69,11 +69,11 @@ PKCS12 *PKCS12_init (int mode)
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        if (!(pkcs12->version = ASN1_INTEGER_new ())) {
+        if (!(pkcs12->version = M_ASN1_INTEGER_new ())) {
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-        ASN1_INTEGER_set (pkcs12->version, 3);
+        ASN1_INTEGER_set(pkcs12->version, 3);
         if (!(pkcs12->authsafes = PKCS7_new())) {
                 PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                 return NULL;
@@ -82,7 +82,7 @@ PKCS12 *PKCS12_init (int mode)
         switch (mode) {
                 case NID_pkcs7_data:
                         if (!(pkcs12->authsafes->d.data =
-                                 ASN1_OCTET_STRING_new())) {
+                                 M_ASN1_OCTET_STRING_new())) {
                         PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
                         return NULL;
                 }
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index 25d8cdae57..02fdd20e2f 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -64,7 +64,7 @@
 /* Uncomment out this line to get debugging info about key generation */
 /*#define DEBUG_KEYGEN*/
 #ifdef DEBUG_KEYGEN
-#include <bio.h>
+#include <openssl/bio.h>
 extern BIO *bio_err;
 void h__dump (unsigned char *p, int len);
 #endif
@@ -104,13 +104,12 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef  DEBUG_KEYGEN
         unsigned char *tmpout = out;
         int tmpn = n;
-        BIO_printf (bio_err, "KEYGEN DEBUG\n");
-        BIO_printf (bio_err, "ID %d, ITER %d\n", id, iter);
-        BIO_printf (bio_err, "Password (length %d):\n", passlen);
-        h__dump (pass, passlen);
-        BIO_printf (bio_err, "Salt (length %d):\n", saltlen);
-        h__dump (salt, saltlen);
-        BIO_printf (bio_err, "ID %d, ITER %d\n\n", id, iter);
+        fprintf(stderr, "KEYGEN DEBUG\n");
+        fprintf(stderr, "ID %d, ITER %d\n", id, iter);
+        fprintf(stderr, "Password (length %d):\n", passlen);
+        h__dump(pass, passlen);
+        fprintf(stderr, "Salt (length %d):\n", saltlen);
+        h__dump(salt, saltlen);
 #endif
         v = EVP_MD_block_size (md_type);
         u = EVP_MD_size (md_type);
@@ -150,8 +149,8 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
                         BN_free (Ij);
                         BN_free (Bpl1);
 #ifdef DEBUG_KEYGEN
-                        BIO_printf (bio_err, "Output KEY (length %d)\n", tmpn);
-                        h__dump (tmpout, tmpn);
+                        fprintf(stderr, "Output KEY (length %d)\n", tmpn);
+                        h__dump(tmpout, tmpn);
 #endif
                         return 1;       
                 }
@@ -176,7 +175,7 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef DEBUG_KEYGEN
 void h__dump (unsigned char *p, int len)
 {
-        for (; len --; p++) BIO_printf (bio_err, "%02X", *p);
-        BIO_printf (bio_err, "\n");     
+        for (; len --; p++) fprintf(stderr, "%02X", *p);
+        fprintf(stderr, "\n");  
 }
 #endif
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index 767e1303da..08a60556e0 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -139,16 +139,16 @@ static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
                         sk_pop_free (asafes, PKCS7_free);
                         return 0;
                 }
-                if (!parse_bags (bags, pass, passlen, pkey, cert, ca,
+                if (!parse_bags(bags, pass, passlen, pkey, cert, ca,
                                                          &keyid, &keymatch)) {
-                        sk_pop_free (bags, PKCS12_SAFEBAG_free);
-                        sk_pop_free (asafes, PKCS7_free);
+                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
-                sk_pop_free (bags, PKCS12_SAFEBAG_free);
+                sk_pop_free(bags, PKCS12_SAFEBAG_free);
         }
-        sk_pop_free (asafes, PKCS7_free);
-        if (keyid) ASN1_OCTET_STRING_free (keyid);
+        sk_pop_free(asafes, PKCS7_free);
+        if (keyid) M_ASN1_OCTET_STRING_free(keyid);
         return 1;
 }
 
@@ -158,8 +158,8 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
                        ASN1_OCTET_STRING **keyid, char *keymatch)
 {
         int i;
-        for (i = 0; i < sk_num (bags); i++) {
-                if (!parse_bag ((PKCS12_SAFEBAG *)sk_value (bags, i),
+        for (i = 0; i < sk_num(bags); i++) {
+                if (!parse_bag((PKCS12_SAFEBAG *)sk_value (bags, i),
                          pass, passlen, pkey, cert, ca, keyid,
                                                          keymatch)) return 0;
         }
@@ -170,7 +170,7 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
 #define MATCH_CERT 0x2
 #define MATCH_ALL  0x3
 
-static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
+static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                       EVP_PKEY **pkey, X509 **cert, STACK **ca,
                       ASN1_OCTET_STRING **keyid,
              char *keymatch)
@@ -187,9 +187,9 @@ static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
         /* Check for any local key id matching (if needed) */
         if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
                 if (*keyid) {
-                        if (ASN1_OCTET_STRING_cmp (*keyid, lkey)) lkey = NULL;
+                        if (M_ASN1_OCTET_STRING_cmp(*keyid, lkey)) lkey = NULL;
                 } else {
-                        if (!(*keyid = ASN1_OCTET_STRING_dup (lkey))) {
+                        if (!(*keyid = M_ASN1_OCTET_STRING_dup(lkey))) {
                                 PKCS12err(PKCS12_F_PARSE_BAGS,ERR_R_MALLOC_FAILURE);
                                 return 0;
                     }
@@ -200,16 +200,16 @@ static int parse_bag (PKCS12_SAFEBAG *bag, const char *pass, int passlen,
         {
         case NID_keyBag:
                 if (!lkey || !pkey) return 1;   
-                if (!(*pkey = EVP_PKCS82PKEY (bag->value.keybag))) return 0;
+                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0;
                 *keymatch |= MATCH_KEY;
         break;
 
         case NID_pkcs8ShroudedKeyBag:
                 if (!lkey || !pkey) return 1;   
-                if (!(p8 = M_PKCS12_decrypt_skey (bag, pass, passlen)))
+                if (!(p8 = M_PKCS12_decrypt_skey(bag, pass, passlen)))
                                 return 0;
-                *pkey = EVP_PKCS82PKEY (p8);
-                PKCS8_PRIV_KEY_INFO_free (p8);
+                *pkey = EVP_PKCS82PKEY(p8);
+                PKCS8_PRIV_KEY_INFO_free(p8);
                 if (!(*pkey)) return 0;
                 *keymatch |= MATCH_KEY;
         break;
diff --git a/src/lib/libcrypto/pkcs12/p12_lib.c b/src/lib/libcrypto/pkcs12/p12_lib.c
index 00a6695d9b..7ca9c14908 100644
--- a/src/lib/libcrypto/pkcs12/p12_lib.c
+++ b/src/lib/libcrypto/pkcs12/p12_lib.c
@@ -104,8 +104,8 @@ PKCS12 *PKCS12_new(void)
 void PKCS12_free (PKCS12 *a)
 {
         if (a == NULL) return;
-        ASN1_INTEGER_free (a->version);
+        M_ASN1_INTEGER_free(a->version);
         PKCS12_MAC_DATA_free (a->mac);
         PKCS7_free (a->authsafes);
-        Free ((char *)a);
+        Free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_mac.c b/src/lib/libcrypto/pkcs12/p12_mac.c
index f163d4cfaa..f5ab0d6464 100644
--- a/src/lib/libcrypto/pkcs12/p12_mac.c
+++ b/src/lib/libcrypto/pkcs12/p12_mac.c
@@ -82,9 +82,9 @@ PKCS12_MAC_DATA *PKCS12_MAC_DATA_new(void)
         ASN1_CTX c;
         M_ASN1_New_Malloc(ret, PKCS12_MAC_DATA);
         ret->dinfo = X509_SIG_new();
-        ret->salt = ASN1_OCTET_STRING_new();
+        ret->salt = M_ASN1_OCTET_STRING_new();
         ret->iter = NULL;
-        return (ret);
+        return(ret);
         M_ASN1_New_Error(ASN1_F_PKCS12_MAC_DATA_NEW);
 }
 
@@ -94,9 +94,9 @@ PKCS12_MAC_DATA *d2i_PKCS12_MAC_DATA(PKCS12_MAC_DATA **a, unsigned char **pp,
         M_ASN1_D2I_vars(a,PKCS12_MAC_DATA *,PKCS12_MAC_DATA_new);
         M_ASN1_D2I_Init();
         M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get (ret->dinfo, d2i_X509_SIG);
-        M_ASN1_D2I_get (ret->salt, d2i_ASN1_OCTET_STRING);
-        M_ASN1_D2I_get_opt (ret->iter, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
+        M_ASN1_D2I_get(ret->dinfo, d2i_X509_SIG);
+        M_ASN1_D2I_get(ret->salt, d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_opt(ret->iter, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
         M_ASN1_D2I_Finish(a, PKCS12_MAC_DATA_free, ASN1_F_D2I_PKCS12_MAC_DATA);
 }
 
@@ -104,7 +104,7 @@ void PKCS12_MAC_DATA_free (PKCS12_MAC_DATA *a)
 {
         if (a == NULL) return;
         X509_SIG_free (a->dinfo);
-        ASN1_OCTET_STRING_free (a->salt);
-        ASN1_INTEGER_free (a->iter);
-        Free ((char *)a);
+        M_ASN1_OCTET_STRING_free(a->salt);
+        M_ASN1_INTEGER_free(a->iter);
+        Free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index bac558d6b9..f1094b3840 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -131,7 +131,7 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_GENERATION_ERROR);
                 return 0;
         }
-        if (!(ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {
+        if (!(M_ASN1_OCTET_STRING_set (p12->mac->dinfo->digest, mac, maclen))) {
                 PKCS12err(PKCS12_F_PKCS12_SET_MAC,PKCS12_R_MAC_STRING_SET_ERROR);
                                                 return 0;
         }
@@ -142,13 +142,13 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
 int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
              EVP_MD *md_type)
 {
-        if (!(p12->mac = PKCS12_MAC_DATA_new ())) return PKCS12_ERROR;
+        if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR;
         if (iter > 1) {
-                if(!(p12->mac->iter = ASN1_INTEGER_new())) {
+                if(!(p12->mac->iter = M_ASN1_INTEGER_new())) {
                         PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                         return 0;
                 }
-                ASN1_INTEGER_set (p12->mac->iter, iter);
+                ASN1_INTEGER_set(p12->mac->iter, iter);
         }
         if (!saltlen) saltlen = PKCS12_SALT_LEN;
         p12->mac->salt->length = saltlen;
@@ -156,7 +156,10 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!salt) RAND_bytes (p12->mac->salt->data, saltlen);
+        if (!salt) {
+                if (RAND_bytes (p12->mac->salt->data, saltlen) <= 0)
+                        return 0;
+        }
         else memcpy (p12->mac->salt->data, salt, saltlen);
         p12->mac->dinfo->algor->algorithm = OBJ_nid2obj(EVP_MD_type(md_type));
         if (!(p12->mac->dinfo->algor->parameter = ASN1_TYPE_new())) {
diff --git a/src/lib/libcrypto/pkcs12/p12_npas.c b/src/lib/libcrypto/pkcs12/p12_npas.c
new file mode 100644
index 0000000000..ee71707e2c
--- /dev/null
+++ b/src/lib/libcrypto/pkcs12/p12_npas.c
@@ -0,0 +1,212 @@
+/* p12_npas.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/pem.h>
+#include <openssl/err.h>
+#include <openssl/pkcs12.h>
+
+/* PKCS#12 password change routine */
+
+static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass);
+static int newpass_bags(STACK *bags, char *oldpass,  char *newpass);
+static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass);
+static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen);
+
+/* 
+ * Change the password on a PKCS#12 structure.
+ */
+
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass)
+{
+
+/* Check for NULL PKCS12 structure */
+
+if(!p12) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
+        return 0;
+}
+
+/* Check the mac */
+
+if (!PKCS12_verify_mac(p12, oldpass, -1)) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE);
+        return 0;
+}
+
+if (!newpass_p12(p12, oldpass, newpass)) {
+        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR);
+        return 0;
+}
+
+return 1;
+
+}
+
+/* Parse the outer PKCS#12 structure */
+
+static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
+{
+        STACK *asafes, *newsafes, *bags;
+        int i, bagnid, pbe_nid, pbe_iter, pbe_saltlen;
+        PKCS7 *p7, *p7new;
+        ASN1_OCTET_STRING *p12_data_tmp = NULL, *macnew = NULL;
+        unsigned char mac[EVP_MAX_MD_SIZE];
+        unsigned int maclen;
+        if (!(asafes = M_PKCS12_unpack_authsafes(p12))) return 0;
+        if(!(newsafes = sk_new(NULL))) return 0;
+        for (i = 0; i < sk_num (asafes); i++) {
+                p7 = (PKCS7 *) sk_value(asafes, i);
+                bagnid = OBJ_obj2nid(p7->type);
+                if (bagnid == NID_pkcs7_data) {
+                        bags = M_PKCS12_unpack_p7data(p7);
+                } else if (bagnid == NID_pkcs7_encrypted) {
+                        bags = M_PKCS12_unpack_p7encdata(p7, oldpass, -1);
+                        alg_get(p7->d.encrypted->enc_data->algorithm,
+                                &pbe_nid, &pbe_iter, &pbe_saltlen);
+                } else continue;
+                if (!bags) {
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                if (!newpass_bags(bags, oldpass, newpass)) {
+                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                /* Repack bag in same form with new password */
+                if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags);
+                else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL,
+                                                 pbe_saltlen, pbe_iter, bags);
+                sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                if(!p7new) {
+                        sk_pop_free(asafes, PKCS7_free);
+                        return 0;
+                }
+                sk_push(newsafes, (char *)p7new);
+        }
+        sk_pop_free(asafes, PKCS7_free);
+
+        /* Repack safe: save old safe in case of error */
+
+        p12_data_tmp = p12->authsafes->d.data;
+        if(!(p12->authsafes->d.data = ASN1_OCTET_STRING_new())) goto saferr;
+        if(!M_PKCS12_pack_authsafes(p12, newsafes)) goto saferr;
+
+        if(!PKCS12_gen_mac(p12, newpass, -1, mac, &maclen)) goto saferr;
+        if(!(macnew = ASN1_OCTET_STRING_new())) goto saferr;
+        if(!ASN1_OCTET_STRING_set(macnew, mac, maclen)) goto saferr;
+        ASN1_OCTET_STRING_free(p12->mac->dinfo->digest);
+        p12->mac->dinfo->digest = macnew;
+        ASN1_OCTET_STRING_free(p12_data_tmp);
+
+        return 1;
+
+        saferr:
+        /* Restore old safe */
+        ASN1_OCTET_STRING_free(p12->authsafes->d.data);
+        ASN1_OCTET_STRING_free(macnew);
+        p12->authsafes->d.data = p12_data_tmp;
+        return 0;
+
+}
+
+
+static int newpass_bags(STACK *bags, char *oldpass,  char *newpass)
+{
+        int i;
+        for (i = 0; i < sk_num(bags); i++) {
+                if (!newpass_bag((PKCS12_SAFEBAG *)sk_value(bags, i),
+                                                 oldpass, newpass)) return 0;
+        }
+        return 1;
+}
+
+/* Change password of safebag: only needs handle shrouded keybags */
+
+static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass)
+{
+        PKCS8_PRIV_KEY_INFO *p8;
+        X509_SIG *p8new;
+        int p8_nid, p8_saltlen, p8_iter;
+
+        if(M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) return 1;
+
+        if (!(p8 = M_PKCS12_decrypt_skey(bag, oldpass, -1))) return 0;
+        alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter, &p8_saltlen);
+        if(!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen,
+                                                     p8_iter, p8))) return 0;
+        X509_SIG_free(bag->value.shkeybag);
+        bag->value.shkeybag = p8new;
+        return 1;
+}
+
+static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
+{
+        PBEPARAM *pbe;
+        unsigned char *p;
+        p = alg->parameter->value.sequence->data;
+        pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
+        *pnid = OBJ_obj2nid(alg->algorithm);
+        *piter = ASN1_INTEGER_get(pbe->iter);
+        *psaltlen = pbe->salt->length;
+        PBEPARAM_free(pbe);
+        return 0;
+}
diff --git a/src/lib/libcrypto/pkcs12/pk12err.c b/src/lib/libcrypto/pkcs12/pk12err.c
index 38d7be7675..9d8de10e1e 100644
--- a/src/lib/libcrypto/pkcs12/pk12err.c
+++ b/src/lib/libcrypto/pkcs12/pk12err.c
@@ -79,6 +79,7 @@ static ERR_STRING_DATA PKCS12_str_functs[]=
 {ERR_PACK(0,PKCS12_F_PKCS12_KEY_GEN_UNI,0),     "PKCS12_key_gen_uni"},
 {ERR_PACK(0,PKCS12_F_PKCS12_MAKE_KEYBAG,0),     "PKCS12_MAKE_KEYBAG"},
 {ERR_PACK(0,PKCS12_F_PKCS12_MAKE_SHKEYBAG,0),   "PKCS12_MAKE_SHKEYBAG"},
+{ERR_PACK(0,PKCS12_F_PKCS12_NEWPASS,0), "PKCS12_newpass"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7DATA,0),     "PKCS12_pack_p7data"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_P7ENCDATA,0),  "PKCS12_pack_p7encdata"},
 {ERR_PACK(0,PKCS12_F_PKCS12_PACK_SAFEBAG,0),    "PKCS12_pack_safebag"},
@@ -99,6 +100,7 @@ static ERR_STRING_DATA PKCS12_str_reasons[]=
 {PKCS12_R_DECODE_ERROR                   ,"decode error"},
 {PKCS12_R_ENCODE_ERROR                   ,"encode error"},
 {PKCS12_R_ENCRYPT_ERROR                  ,"encrypt error"},
+{PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE,"error setting encrypted data type"},
 {PKCS12_R_INVALID_NULL_ARGUMENT          ,"invalid null argument"},
 {PKCS12_R_INVALID_NULL_PKCS12_POINTER    ,"invalid null pkcs12 pointer"},
 {PKCS12_R_IV_GEN_ERROR                   ,"iv gen error"},
diff --git a/src/lib/libcrypto/pkcs12/pkcs12.h b/src/lib/libcrypto/pkcs12/pkcs12.h
index 4cfba5e6c6..254000fa12 100644
--- a/src/lib/libcrypto/pkcs12/pkcs12.h
+++ b/src/lib/libcrypto/pkcs12/pkcs12.h
@@ -273,6 +273,7 @@ int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12);
 int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12);
 PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12);
 PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
+int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass);
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -296,6 +297,7 @@ PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
 #define PKCS12_F_PKCS12_KEY_GEN_UNI                      111
 #define PKCS12_F_PKCS12_MAKE_KEYBAG                      112
 #define PKCS12_F_PKCS12_MAKE_SHKEYBAG                    113
+#define PKCS12_F_PKCS12_NEWPASS                          128
 #define PKCS12_F_PKCS12_PACK_P7DATA                      114
 #define PKCS12_F_PKCS12_PACK_P7ENCDATA                   115
 #define PKCS12_F_PKCS12_PACK_SAFEBAG                     117
@@ -313,6 +315,7 @@ PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12);
 #define PKCS12_R_DECODE_ERROR                            101
 #define PKCS12_R_ENCODE_ERROR                            102
 #define PKCS12_R_ENCRYPT_ERROR                           103
+#define PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE       120
 #define PKCS12_R_INVALID_NULL_ARGUMENT                   104
 #define PKCS12_R_INVALID_NULL_PKCS12_POINTER             105
 #define PKCS12_R_IV_GEN_ERROR                            106