import OpenSSL-1.0.0a

11 files changed, 134 insertions, 126 deletions

diff --git a/src/lib/libcrypto/pkcs12/p12_add.c b/src/lib/libcrypto/pkcs12/p12_add.c
index 1f3e378f5c..27ac5facfa 100644
--- a/src/lib/libcrypto/pkcs12/p12_add.c
+++ b/src/lib/libcrypto/pkcs12/p12_add.c
@@ -106,6 +106,7 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass,
              PKCS8_PRIV_KEY_INFO *p8)
 {
         PKCS12_SAFEBAG *bag;
+        const EVP_CIPHER *pbe_ciph;
 
         /* Set up the safe bag */
         if (!(bag = PKCS12_SAFEBAG_new())) {
@@ -114,8 +115,14 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass,
         }
 
         bag->type = OBJ_nid2obj(NID_pkcs8ShroudedKeyBag);
+
+        pbe_ciph = EVP_get_cipherbynid(pbe_nid);
+
+        if (pbe_ciph)
+                pbe_nid = -1;
+
         if (!(bag->value.shkeybag = 
-          PKCS8_encrypt(pbe_nid, NULL, pass, passlen, salt, saltlen, iter,
+          PKCS8_encrypt(pbe_nid, pbe_ciph, pass, passlen, salt, saltlen, iter,
                                                                          p8))) {
                 PKCS12err(PKCS12_F_PKCS12_MAKE_SHKEYBAG, ERR_R_MALLOC_FAILURE);
                 return NULL;
@@ -164,6 +171,7 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen,
 {
         PKCS7 *p7;
         X509_ALGOR *pbe;
+        const EVP_CIPHER *pbe_ciph;
         if (!(p7 = PKCS7_new())) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
@@ -173,7 +181,15 @@ PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen,
                                 PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE);
                 return NULL;
         }
-        if (!(pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen))) {
+
+        pbe_ciph = EVP_get_cipherbynid(pbe_nid);
+
+        if (pbe_ciph)
+                pbe = PKCS5_pbe2_set(pbe_ciph, iter, salt, saltlen);
+        else
+                pbe = PKCS5_pbe_set(pbe_nid, iter, salt, saltlen);
+
+        if (!pbe) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7ENCDATA, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
diff --git a/src/lib/libcrypto/pkcs12/p12_attr.c b/src/lib/libcrypto/pkcs12/p12_attr.c
index 68d6c5ad15..e4d9c25647 100644
--- a/src/lib/libcrypto/pkcs12/p12_attr.c
+++ b/src/lib/libcrypto/pkcs12/p12_attr.c
@@ -139,7 +139,7 @@ char *PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag)
         ASN1_TYPE *atype;
         if (!(atype = PKCS12_get_attr(bag, NID_friendlyName))) return NULL;
         if (atype->type != V_ASN1_BMPSTRING) return NULL;
-        return uni2asc(atype->value.bmpstring->data,
+        return OPENSSL_uni2asc(atype->value.bmpstring->data,
                                  atype->value.bmpstring->length);
 }
 
diff --git a/src/lib/libcrypto/pkcs12/p12_crpt.c b/src/lib/libcrypto/pkcs12/p12_crpt.c
index f8b952e27e..b71d07b4d0 100644
--- a/src/lib/libcrypto/pkcs12/p12_crpt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crpt.c
@@ -60,28 +60,10 @@
 #include "cryptlib.h"
 #include <openssl/pkcs12.h>
 
-/* PKCS#12 specific PBE functions */
+/* PKCS#12 PBE algorithms now in static table */
 
 void PKCS12_PBE_add(void)
 {
-#ifndef OPENSSL_NO_RC4
-EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC4, EVP_rc4(), EVP_sha1(),
-                                                         PKCS12_PBE_keyivgen);
-EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC4, EVP_rc4_40(), EVP_sha1(),
-                                                         PKCS12_PBE_keyivgen);
-#endif
-#ifndef OPENSSL_NO_DES
-EVP_PBE_alg_add(NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
-                        EVP_des_ede3_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
-EVP_PBE_alg_add(NID_pbe_WithSHA1And2_Key_TripleDES_CBC, 
-                        EVP_des_ede_cbc(), EVP_sha1(), PKCS12_PBE_keyivgen);
-#endif
-#ifndef OPENSSL_NO_RC2
-EVP_PBE_alg_add(NID_pbe_WithSHA1And128BitRC2_CBC, EVP_rc2_cbc(),
-                                        EVP_sha1(), PKCS12_PBE_keyivgen);
-EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC2_CBC, EVP_rc2_40_cbc(),
-                                        EVP_sha1(), PKCS12_PBE_keyivgen);
-#endif
 }
 
 int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
diff --git a/src/lib/libcrypto/pkcs12/p12_crt.c b/src/lib/libcrypto/pkcs12/p12_crt.c
index 9522342fa5..96b131defa 100644
--- a/src/lib/libcrypto/pkcs12/p12_crt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crt.c
@@ -59,10 +59,6 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/pkcs12.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
 
 
 static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag);
@@ -94,14 +90,7 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
 
         /* Set defaults */
         if (!nid_cert)
-                {
-#ifdef OPENSSL_FIPS
-                if (FIPS_mode())
-                        nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-                else
-#endif
                 nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
-                }
         if (!nid_key)
                 nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
         if (!iter)
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index 9e57eee4a4..a29794bbbc 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -81,15 +81,18 @@ int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt,
         int ret;
         unsigned char *unipass;
         int uniplen;
+
         if(!pass) {
                 unipass = NULL;
                 uniplen = 0;
-        } else if (!asc2uni(pass, passlen, &unipass, &uniplen)) {
+        } else if (!OPENSSL_asc2uni(pass, passlen, &unipass, &uniplen)) {
                 PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC,ERR_R_MALLOC_FAILURE);
                 return 0;
         }
         ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen,
                                                  id, iter, n, out, md_type);
+        if (ret <= 0)
+            return 0;
         if(unipass) {
                 OPENSSL_cleanse(unipass, uniplen);      /* Clear password from memory */
                 OPENSSL_free(unipass);
@@ -129,6 +132,8 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
 #endif
         v = EVP_MD_block_size (md_type);
         u = EVP_MD_size (md_type);
+        if (u < 0)
+            return 0;
         D = OPENSSL_malloc (v);
         Ai = OPENSSL_malloc (u);
         B = OPENSSL_malloc (v + 1);
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index 5c4c6ec988..292cc3ed4a 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -63,16 +63,13 @@
 /* Simplified PKCS#12 routines */
 
 static int parse_pk12( PKCS12 *p12, const char *pass, int passlen,
-                EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca);
+                EVP_PKEY **pkey, STACK_OF(X509) *ocerts);
 
 static int parse_bags( STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
-                       int passlen, EVP_PKEY **pkey, X509 **cert,
-                       STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
-                       char *keymatch);
+                       int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts);
 
 static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen,
-                        EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
-                        ASN1_OCTET_STRING **keyid, char *keymatch);
+                        EVP_PKEY **pkey, STACK_OF(X509) *ocerts);
 
 /* Parse and decrypt a PKCS#12 structure returning user key, user cert
  * and other (CA) certs. Note either ca should be NULL, *ca should be NULL,
@@ -83,24 +80,20 @@ static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen,
 int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
              STACK_OF(X509) **ca)
 {
-
+        STACK_OF(X509) *ocerts = NULL;
+        X509 *x = NULL;
         /* Check for NULL PKCS12 structure */
 
-        if(!p12) {
+        if(!p12)
+                {
                 PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
                 return 0;
-        }
-
-        /* Allocate stack for ca certificates if needed */
-        if ((ca != NULL) && (*ca == NULL)) {
-                if (!(*ca = sk_X509_new_null())) {
-                        PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
-                        return 0;
                 }
-        }
 
-        if(pkey) *pkey = NULL;
-        if(cert) *cert = NULL;
+        if(pkey)
+                *pkey = NULL;
+        if(cert)
+                *cert = NULL;
 
         /* Check the mac */
 
@@ -122,19 +115,61 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
                 goto err;
         }
 
-        if (!parse_pk12 (p12, pass, -1, pkey, cert, ca))
+        /* Allocate stack for other certificates */
+        ocerts = sk_X509_new_null();
+
+        if (!ocerts)
+                {
+                PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+
+        if (!parse_pk12 (p12, pass, -1, pkey, ocerts))
                 {
                 PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR);
                 goto err;
                 }
 
+        while ((x = sk_X509_pop(ocerts)))
+                {
+                if (pkey && *pkey && cert && !*cert)
+                        {
+                        if (X509_check_private_key(x, *pkey))
+                                {
+                                *cert = x;
+                                x = NULL;
+                                }
+                        }
+
+                if (ca && x)
+                        {
+                        if (!*ca)
+                                *ca = sk_X509_new_null();
+                        if (!*ca)
+                                goto err;
+                        if (!sk_X509_push(*ca, x))
+                                goto err;
+                        x = NULL;
+                        }
+                if (x)
+                        X509_free(x);
+                }
+
+        if (ocerts)
+                sk_X509_pop_free(ocerts, X509_free);
+
         return 1;
 
  err:
 
-        if (pkey && *pkey) EVP_PKEY_free(*pkey);
-        if (cert && *cert) X509_free(*cert);
-        if (ca) sk_X509_pop_free(*ca, X509_free);
+        if (pkey && *pkey)
+                EVP_PKEY_free(*pkey);
+        if (cert && *cert)
+                X509_free(*cert);
+        if (x)
+                X509_free(*cert);
+        if (ocerts)
+                sk_X509_pop_free(ocerts, X509_free);
         return 0;
 
 }
@@ -142,15 +177,13 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 /* Parse the outer PKCS#12 structure */
 
 static int parse_pk12(PKCS12 *p12, const char *pass, int passlen,
-             EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
+             EVP_PKEY **pkey, STACK_OF(X509) *ocerts)
 {
         STACK_OF(PKCS7) *asafes;
         STACK_OF(PKCS12_SAFEBAG) *bags;
         int i, bagnid;
         PKCS7 *p7;
-        ASN1_OCTET_STRING *keyid = NULL;
 
-        char keymatch = 0;
         if (!(asafes = PKCS12_unpack_authsafes (p12))) return 0;
         for (i = 0; i < sk_PKCS7_num (asafes); i++) {
                 p7 = sk_PKCS7_value (asafes, i);
@@ -164,8 +197,7 @@ static int parse_pk12(PKCS12 *p12, const char *pass, int passlen,
                         sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
-                if (!parse_bags(bags, pass, passlen, pkey, cert, ca,
-                                                         &keyid, &keymatch)) {
+                if (!parse_bags(bags, pass, passlen, pkey, ocerts)) {
                         sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
                         sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
@@ -173,89 +205,65 @@ static int parse_pk12(PKCS12 *p12, const char *pass, int passlen,
                 sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
         }
         sk_PKCS7_pop_free(asafes, PKCS7_free);
-        if (keyid) M_ASN1_OCTET_STRING_free(keyid);
         return 1;
 }
 
 
 static int parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
-                      int passlen, EVP_PKEY **pkey, X509 **cert,
-                      STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
-                      char *keymatch)
+                      int passlen, EVP_PKEY **pkey, STACK_OF(X509) *ocerts)
 {
         int i;
         for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
                 if (!parse_bag(sk_PKCS12_SAFEBAG_value (bags, i),
-                         pass, passlen, pkey, cert, ca, keyid,
-                                                         keymatch)) return 0;
+                                 pass, passlen, pkey, ocerts))
+                        return 0;
         }
         return 1;
 }
 
-#define MATCH_KEY  0x1
-#define MATCH_CERT 0x2
-#define MATCH_ALL  0x3
-
 static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
-                     EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
-                     ASN1_OCTET_STRING **keyid,
-                     char *keymatch)
+                     EVP_PKEY **pkey, STACK_OF(X509) *ocerts)
 {
         PKCS8_PRIV_KEY_INFO *p8;
         X509 *x509;
-        ASN1_OCTET_STRING *lkey = NULL, *ckid = NULL;
         ASN1_TYPE *attrib;
         ASN1_BMPSTRING *fname = NULL;
+        ASN1_OCTET_STRING *lkid = NULL;
 
         if ((attrib = PKCS12_get_attr (bag, NID_friendlyName)))
                 fname = attrib->value.bmpstring;
 
-        if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) {
-                lkey = attrib->value.octet_string;
-                ckid = lkey;
-        }
+        if ((attrib = PKCS12_get_attr (bag, NID_localKeyID)))
+                lkid = attrib->value.octet_string;
 
-        /* Check for any local key id matching (if needed) */
-        if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
-                if (*keyid) {
-                        if (M_ASN1_OCTET_STRING_cmp(*keyid, lkey)) lkey = NULL;
-                } else {
-                        if (!(*keyid = M_ASN1_OCTET_STRING_dup(lkey))) {
-                                PKCS12err(PKCS12_F_PARSE_BAG,ERR_R_MALLOC_FAILURE);
-                                return 0;
-                    }
-                }
-        }
-        
         switch (M_PKCS12_bag_type(bag))
         {
         case NID_keyBag:
-                if (!lkey || !pkey) return 1;   
-                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag))) return 0;
-                *keymatch |= MATCH_KEY;
+                if (!pkey || *pkey)
+                        return 1;       
+                if (!(*pkey = EVP_PKCS82PKEY(bag->value.keybag)))
+                        return 0;
         break;
 
         case NID_pkcs8ShroudedKeyBag:
-                if (!lkey || !pkey) return 1;   
+                if (!pkey || *pkey)
+                        return 1;       
                 if (!(p8 = PKCS12_decrypt_skey(bag, pass, passlen)))
                                 return 0;
                 *pkey = EVP_PKCS82PKEY(p8);
                 PKCS8_PRIV_KEY_INFO_free(p8);
                 if (!(*pkey)) return 0;
-                *keymatch |= MATCH_KEY;
         break;
 
         case NID_certBag:
                 if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )
-                                                                 return 1;
-                if (!(x509 = PKCS12_certbag2x509(bag))) return 0;
-                if(ckid)
+                        return 1;
+                if (!(x509 = PKCS12_certbag2x509(bag)))
+                        return 0;
+                if(lkid && !X509_keyid_set1(x509, lkid->data, lkid->length))
                         {
-                        if (!X509_keyid_set1(x509, ckid->data, ckid->length))
-                                {
-                                X509_free(x509);
-                                return 0;
-                                }
+                        X509_free(x509);
+                        return 0;
                         }
                 if(fname) {
                         int len, r;
@@ -272,20 +280,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                         }
                 }
 
+                if(!sk_X509_push(ocerts, x509))
+                        {
+                        X509_free(x509);
+                        return 0;
+                        }
 
-                if (lkey) {
-                        *keymatch |= MATCH_CERT;
-                        if (cert) *cert = x509;
-                        else X509_free(x509);
-                } else {
-                        if(ca) sk_X509_push (*ca, x509);
-                        else X509_free(x509);
-                }
         break;
 
         case NID_safeContentsBag:
                 return parse_bags(bag->value.safes, pass, passlen,
-                                        pkey, cert, ca, keyid, keymatch);
+                                        pkey, ocerts);
         break;
 
         default:
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index 70bfef6e5d..9ab740d51f 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -71,6 +71,7 @@ int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
         HMAC_CTX hmac;
         unsigned char key[EVP_MAX_MD_SIZE], *salt;
         int saltlen, iter;
+        int md_size;
 
         if (!PKCS7_type_is_data(p12->authsafes))
                 {
@@ -87,13 +88,16 @@ int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
                 PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_UNKNOWN_DIGEST_ALGORITHM);
                 return 0;
         }
+        md_size = EVP_MD_size(md_type);
+        if (md_size < 0)
+            return 0;
         if(!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter,
-                                 EVP_MD_size(md_type), key, md_type)) {
+                                 md_size, key, md_type)) {
                 PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_KEY_GEN_ERROR);
                 return 0;
         }
         HMAC_CTX_init(&hmac);
-        HMAC_Init_ex(&hmac, key, EVP_MD_size(md_type), md_type, NULL);
+        HMAC_Init_ex(&hmac, key, md_size, md_type, NULL);
         HMAC_Update(&hmac, p12->authsafes->d.data->data,
                                          p12->authsafes->d.data->length);
         HMAC_Final(&hmac, mac, maclen);
diff --git a/src/lib/libcrypto/pkcs12/p12_npas.c b/src/lib/libcrypto/pkcs12/p12_npas.c
index 47e5e9c377..2f71355150 100644
--- a/src/lib/libcrypto/pkcs12/p12_npas.c
+++ b/src/lib/libcrypto/pkcs12/p12_npas.c
@@ -120,8 +120,13 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
                         bags = PKCS12_unpack_p7data(p7);
                 } else if (bagnid == NID_pkcs7_encrypted) {
                         bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
-                        alg_get(p7->d.encrypted->enc_data->algorithm,
-                                &pbe_nid, &pbe_iter, &pbe_saltlen);
+                        if (!alg_get(p7->d.encrypted->enc_data->algorithm,
+                                &pbe_nid, &pbe_iter, &pbe_saltlen))
+                                {
+                                sk_PKCS12_SAFEBAG_pop_free(bags,
+                                                PKCS12_SAFEBAG_free);
+                                bags = NULL;
+                                }
                 } else continue;
                 if (!bags) {
                         sk_PKCS7_pop_free(asafes, PKCS7_free);
@@ -193,7 +198,9 @@ static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass)
         if(M_PKCS12_bag_type(bag) != NID_pkcs8ShroudedKeyBag) return 1;
 
         if (!(p8 = PKCS8_decrypt(bag->value.shkeybag, oldpass, -1))) return 0;
-        alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter, &p8_saltlen);
+        if (!alg_get(bag->value.shkeybag->algor, &p8_nid, &p8_iter,
+                                                        &p8_saltlen))
+                return 0;
         if(!(p8new = PKCS8_encrypt(p8_nid, NULL, newpass, -1, NULL, p8_saltlen,
                                                      p8_iter, p8))) return 0;
         X509_SIG_free(bag->value.shkeybag);
@@ -208,9 +215,11 @@ static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
 
         p = alg->parameter->value.sequence->data;
         pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
+        if (!pbe)
+                return 0;
         *pnid = OBJ_obj2nid(alg->algorithm);
         *piter = ASN1_INTEGER_get(pbe->iter);
         *psaltlen = pbe->salt->length;
         PBEPARAM_free(pbe);
-        return 0;
+        return 1;
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_utl.c b/src/lib/libcrypto/pkcs12/p12_utl.c
index ca30ac4f6d..59c6f453f6 100644
--- a/src/lib/libcrypto/pkcs12/p12_utl.c
+++ b/src/lib/libcrypto/pkcs12/p12_utl.c
@@ -62,7 +62,7 @@
 
 /* Cheap and nasty Unicode stuff */
 
-unsigned char *asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen)
+unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen)
 {
         int ulen, i;
         unsigned char *unitmp;
@@ -81,7 +81,7 @@ unsigned char *asc2uni(const char *asc, int asclen, unsigned char **uni, int *un
         return unitmp;
 }
 
-char *uni2asc(unsigned char *uni, int unilen)
+char *OPENSSL_uni2asc(unsigned char *uni, int unilen)
 {
         int asclen, i;
         char *asctmp;
diff --git a/src/lib/libcrypto/pkcs12/pk12err.c b/src/lib/libcrypto/pkcs12/pk12err.c
index 07a1fb6907..f6ddf2df12 100644
--- a/src/lib/libcrypto/pkcs12/pk12err.c
+++ b/src/lib/libcrypto/pkcs12/pk12err.c
@@ -1,6 +1,6 @@
 /* crypto/pkcs12/pk12err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/src/lib/libcrypto/pkcs12/pkcs12.h b/src/lib/libcrypto/pkcs12/pkcs12.h
index 4bee605dc0..b17eb9f42b 100644
--- a/src/lib/libcrypto/pkcs12/pkcs12.h
+++ b/src/lib/libcrypto/pkcs12/pkcs12.h
@@ -108,8 +108,6 @@ PKCS12_MAC_DATA *mac;
 PKCS7 *authsafes;
 } PKCS12;
 
-PREDECLARE_STACK_OF(PKCS12_SAFEBAG)
-
 typedef struct {
 ASN1_OBJECT *type;
 union {
@@ -232,8 +230,8 @@ int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
                    const EVP_MD *md_type);
 int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt,
                                          int saltlen, const EVP_MD *md_type);
-unsigned char *asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen);
-char *uni2asc(unsigned char *uni, int unilen);
+unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, unsigned char **uni, int *unilen);
+char *OPENSSL_uni2asc(unsigned char *uni, int unilen);
 
 DECLARE_ASN1_FUNCTIONS(PKCS12)
 DECLARE_ASN1_FUNCTIONS(PKCS12_MAC_DATA)