~ubuntu-branches/ubuntu/lucid/openssl/lucid-security : contents of apps/crl2p7.c at revision 61

~ubuntu-branches/ubuntu/lucid/openssl/lucid-security : (revision 61)

/* apps/crl2p7.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

/* This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu>
 * and donated 'to the cause' along with lots and lots of other fixes to
 * the library. */

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include "apps.h"
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/pkcs7.h>
#include <openssl/pem.h>
#include <openssl/objects.h>

static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
#undef PROG
#define PROG	crl2pkcs7_main

/* -inform arg	- input format - default PEM (DER or PEM)
 * -outform arg - output format - default PEM
 * -in arg	- input file - default stdin
 * -out arg	- output file - default stdout
 */

int MAIN(int, char **);

int MAIN(int argc, char **argv)
	{
	int i,badops=0;
	BIO *in=NULL,*out=NULL;
	int informat,outformat;
	char *infile,*outfile,*prog,*certfile;
	PKCS7 *p7 = NULL;
	PKCS7_SIGNED *p7s = NULL;
	X509_CRL *crl=NULL;
	STACK *certflst=NULL;
	STACK_OF(X509_CRL) *crl_stack=NULL;
	STACK_OF(X509) *cert_stack=NULL;
	int ret=1,nocrl=0;

	apps_startup();

	if (bio_err == NULL)
		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);

	infile=NULL;
	outfile=NULL;
	informat=FORMAT_PEM;
	outformat=FORMAT_PEM;

	prog=argv[0];
	argc--;
	argv++;
	while (argc >= 1)
		{
		if 	(strcmp(*argv,"-inform") == 0)
			{
			if (--argc < 1) goto bad;
			informat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-outform") == 0)
			{
			if (--argc < 1) goto bad;
			outformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			}
		else if (strcmp(*argv,"-nocrl") == 0)
			{
			nocrl=1;
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-certfile") == 0)
			{
			if (--argc < 1) goto bad;
			if(!certflst) certflst = sk_new_null();
			sk_push(certflst,*(++argv));
			}
		else
			{
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}

	if (badops)
		{
bad:
		BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
		BIO_printf(bio_err,"where options are\n");
		BIO_printf(bio_err," -inform arg    input format - DER or PEM\n");
		BIO_printf(bio_err," -outform arg   output format - DER or PEM\n");
		BIO_printf(bio_err," -in arg        input file\n");
		BIO_printf(bio_err," -out arg       output file\n");
		BIO_printf(bio_err," -certfile arg  certificates file of chain to a trusted CA\n");
		BIO_printf(bio_err,"                (can be used more than once)\n");
		BIO_printf(bio_err," -nocrl         no crl to load, just certs from '-certfile'\n");
		ret = 1;
		goto end;
		}

	ERR_load_crypto_strings();

	in=BIO_new(BIO_s_file());
	out=BIO_new(BIO_s_file());
	if ((in == NULL) || (out == NULL))
		{
		ERR_print_errors(bio_err);
		goto end;
		}

	if (!nocrl)
		{
		if (infile == NULL)
			BIO_set_fp(in,stdin,BIO_NOCLOSE);
		else
			{
			if (BIO_read_filename(in,infile) <= 0)
				{
				perror(infile);
				goto end;
				}
			}

		if 	(informat == FORMAT_ASN1)
			crl=d2i_X509_CRL_bio(in,NULL);
		else if (informat == FORMAT_PEM)
			crl=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
		else	{
			BIO_printf(bio_err,"bad input format specified for input crl\n");
			goto end;
			}
		if (crl == NULL)
			{
			BIO_printf(bio_err,"unable to load CRL\n");
			ERR_print_errors(bio_err);
			goto end;
			}
		}
	
	if ((p7=PKCS7_new()) == NULL) goto end;
	if ((p7s=PKCS7_SIGNED_new()) == NULL) goto end;
	p7->type=OBJ_nid2obj(NID_pkcs7_signed);
	p7->d.sign=p7s;
	p7s->contents->type=OBJ_nid2obj(NID_pkcs7_data);

	if (!ASN1_INTEGER_set(p7s->version,1)) goto end;
	if ((crl_stack=sk_X509_CRL_new_null()) == NULL) goto end;
	p7s->crl=crl_stack;
	if (crl != NULL)
		{
		sk_X509_CRL_push(crl_stack,crl);
		crl=NULL; /* now part of p7 for OPENSSL_freeing */
		}

	if ((cert_stack=sk_X509_new_null()) == NULL) goto end;
	p7s->cert=cert_stack;

	if(certflst) for(i = 0; i < sk_num(certflst); i++) {
		certfile = sk_value(certflst, i);
		if (add_certs_from_file(cert_stack,certfile) < 0)
			{
			BIO_printf(bio_err, "error loading certificates\n");
			ERR_print_errors(bio_err);
			goto end;
			}
	}

	sk_free(certflst);

	if (outfile == NULL)
		{
		BIO_set_fp(out,stdout,BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
		{
		BIO *tmpbio = BIO_new(BIO_f_linebuffer());
		out = BIO_push(tmpbio, out);
		}
#endif
		}
	else
		{
		if (BIO_write_filename(out,outfile) <= 0)
			{
			perror(outfile);
			goto end;
			}
		}

	if 	(outformat == FORMAT_ASN1)
		i=i2d_PKCS7_bio(out,p7);
	else if (outformat == FORMAT_PEM)
		i=PEM_write_bio_PKCS7(out,p7);
	else	{
		BIO_printf(bio_err,"bad output format specified for outfile\n");
		goto end;
		}
	if (!i)
		{
		BIO_printf(bio_err,"unable to write pkcs7 object\n");
		ERR_print_errors(bio_err);
		goto end;
		}
	ret=0;
end:
	if (in != NULL) BIO_free(in);
	if (out != NULL) BIO_free_all(out);
	if (p7 != NULL) PKCS7_free(p7);
	if (crl != NULL) X509_CRL_free(crl);

	apps_shutdown();
	OPENSSL_EXIT(ret);
	}

/*
 *----------------------------------------------------------------------
 * int add_certs_from_file
 *
 *	Read a list of certificates to be checked from a file.
 *
 * Results:
 *	number of certs added if successful, -1 if not.
 *----------------------------------------------------------------------
 */
static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile)
	{
	struct stat st;
	BIO *in=NULL;
	int count=0;
	int ret= -1;
	STACK_OF(X509_INFO) *sk=NULL;
	X509_INFO *xi;

	if ((stat(certfile,&st) != 0))
		{
		BIO_printf(bio_err,"unable to load the file, %s\n",certfile);
		goto end;
		}

	in=BIO_new(BIO_s_file());
	if ((in == NULL) || (BIO_read_filename(in,certfile) <= 0))
		{
		BIO_printf(bio_err,"error opening the file, %s\n",certfile);
		goto end;
		}

	/* This loads from a file, a stack of x509/crl/pkey sets */
	sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL);
	if (sk == NULL) {
		BIO_printf(bio_err,"error reading the file, %s\n",certfile);
		goto end;
	}

	/* scan over it and pull out the CRL's */
	while (sk_X509_INFO_num(sk))
		{
		xi=sk_X509_INFO_shift(sk);
		if (xi->x509 != NULL)
			{
			sk_X509_push(stack,xi->x509);
			xi->x509=NULL;
			count++;
			}
		X509_INFO_free(xi);
		}

	ret=count;
end:
 	/* never need to OPENSSL_free x */
	if (in != NULL) BIO_free(in);
	if (sk != NULL) sk_X509_INFO_free(sk);
	return(ret);
	}


1 by Christoph Martin Import upstream version 0.9.7d	1	/* apps/crl2p7.c */
	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
	8	*
	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
	15	*
	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
	22	*
	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
	37	* 4. If you include any Windows specific code (or a derivative thereof) from
	38	* the apps directory (application code) you must include an acknowledgement:
	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
	40	*
	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
	52	*
	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
	57	*/
	58
	59	/* This was written by Gordon Chaffee <chaffee@plateau.cs.berkeley.edu>
	60	* and donated 'to the cause' along with lots and lots of other fixes to
	61	* the library. */
	62
	63	#include <stdio.h>
	64	#include <string.h>
65	#include <sys/types.h>
66	#include <sys/stat.h>
67	#include "apps.h"
68	#include <openssl/err.h>
69	#include <openssl/evp.h>
70	#include <openssl/x509.h>
71	#include <openssl/pkcs7.h>
72	#include <openssl/pem.h>
73	#include <openssl/objects.h>
74
75	static int add_certs_from_file(STACK_OF(X509) stack, char certfile);
76	#undef PROG
77	#define PROG crl2pkcs7_main
78
79	/* -inform arg - input format - default PEM (DER or PEM)
80	* -outform arg - output format - default PEM
81	* -in arg - input file - default stdin
82	* -out arg - output file - default stdout
83	*/
84
85	int MAIN(int, char **);
86
87	int MAIN(int argc, char **argv)
88	{
89	int i,badops=0;
90	BIO in=NULL,out=NULL;
91	int informat,outformat;
92	char infile,outfile,prog,certfile;
93	PKCS7 *p7 = NULL;
94	PKCS7_SIGNED *p7s = NULL;
95	X509_CRL *crl=NULL;
96	STACK *certflst=NULL;
97	STACK_OF(X509_CRL) *crl_stack=NULL;
98	STACK_OF(X509) *cert_stack=NULL;
99	int ret=1,nocrl=0;
100
101	apps_startup();
102
103	if (bio_err == NULL)
104	if ((bio_err=BIO_new(BIO_s_file())) != NULL)
105	BIO_set_fp(bio_err,stderr,BIO_NOCLOSE\|BIO_FP_TEXT);
106
107	infile=NULL;
108	outfile=NULL;
109	informat=FORMAT_PEM;
110	outformat=FORMAT_PEM;
111
112	prog=argv[0];
113	argc--;
114	argv++;
115	while (argc >= 1)
116	{
117	if (strcmp(*argv,"-inform") == 0)
118	{
119	if (--argc < 1) goto bad;
120	informat=str2fmt(*(++argv));
121	}
122	else if (strcmp(*argv,"-outform") == 0)
123	{
124	if (--argc < 1) goto bad;
125	outformat=str2fmt(*(++argv));
126	}
127	else if (strcmp(*argv,"-in") == 0)
128	{
129	if (--argc < 1) goto bad;
130	infile= *(++argv);
131	}
132	else if (strcmp(*argv,"-nocrl") == 0)
133	{
134	nocrl=1;
135	}
136	else if (strcmp(*argv,"-out") == 0)
137	{
138	if (--argc < 1) goto bad;
139	outfile= *(++argv);
140	}
141	else if (strcmp(*argv,"-certfile") == 0)
142	{
143	if (--argc < 1) goto bad;
144	if(!certflst) certflst = sk_new_null();
145	sk_push(certflst,*(++argv));
146	}
147	else
148	{
149	BIO_printf(bio_err,"unknown option %s\n",*argv);
150	badops=1;
151	break;
152	}
153	argc--;
154	argv++;
155	}
156
157	if (badops)
158	{
159	bad:
160	BIO_printf(bio_err,"%s [options] <infile >outfile\n",prog);
161	BIO_printf(bio_err,"where options are\n");
162	BIO_printf(bio_err," -inform arg input format - DER or PEM\n");
163	BIO_printf(bio_err," -outform arg output format - DER or PEM\n");
164	BIO_printf(bio_err," -in arg input file\n");
165	BIO_printf(bio_err," -out arg output file\n");
166	BIO_printf(bio_err," -certfile arg certificates file of chain to a trusted CA\n");
167	BIO_printf(bio_err," (can be used more than once)\n");
168	BIO_printf(bio_err," -nocrl no crl to load, just certs from '-certfile'\n");
169	ret = 1;
170	goto end;
171	}
172
173	ERR_load_crypto_strings();
174
175	in=BIO_new(BIO_s_file());
176	out=BIO_new(BIO_s_file());
177	if ((in == NULL) \|\| (out == NULL))
178	{
179	ERR_print_errors(bio_err);
180	goto end;
181	}
182
183	if (!nocrl)
184	{
185	if (infile == NULL)
186	BIO_set_fp(in,stdin,BIO_NOCLOSE);
187	else
188	{
189	if (BIO_read_filename(in,infile) <= 0)
190	{
191	perror(infile);
192	goto end;
193	}
194	}
195
196	if (informat == FORMAT_ASN1)
197	crl=d2i_X509_CRL_bio(in,NULL);
198	else if (informat == FORMAT_PEM)
199	crl=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
200	else {
201	BIO_printf(bio_err,"bad input format specified for input crl\n");
202	goto end;
203	}
204	if (crl == NULL)
205	{
206	BIO_printf(bio_err,"unable to load CRL\n");
207	ERR_print_errors(bio_err);
208	goto end;
209	}
210	}
211
212	if ((p7=PKCS7_new()) == NULL) goto end;
213	if ((p7s=PKCS7_SIGNED_new()) == NULL) goto end;
214	p7->type=OBJ_nid2obj(NID_pkcs7_signed);
215	p7->d.sign=p7s;
216	p7s->contents->type=OBJ_nid2obj(NID_pkcs7_data);
217
218	if (!ASN1_INTEGER_set(p7s->version,1)) goto end;
219	if ((crl_stack=sk_X509_CRL_new_null()) == NULL) goto end;
220	p7s->crl=crl_stack;
221	if (crl != NULL)
222	{
223	sk_X509_CRL_push(crl_stack,crl);
224	crl=NULL; /* now part of p7 for OPENSSL_freeing */
225	}
226
227	if ((cert_stack=sk_X509_new_null()) == NULL) goto end;
228	p7s->cert=cert_stack;
229
230	if(certflst) for(i = 0; i < sk_num(certflst); i++) {
231	certfile = sk_value(certflst, i);
232	if (add_certs_from_file(cert_stack,certfile) < 0)
233	{
234	BIO_printf(bio_err, "error loading certificates\n");
235	ERR_print_errors(bio_err);
236	goto end;
237	}
238	}
239
240	sk_free(certflst);
241
242	if (outfile == NULL)
243	{
244	BIO_set_fp(out,stdout,BIO_NOCLOSE);
245	#ifdef OPENSSL_SYS_VMS
246	{
247	BIO *tmpbio = BIO_new(BIO_f_linebuffer());
248	out = BIO_push(tmpbio, out);
249	}
250	#endif
251	}
252	else
253	{
254	if (BIO_write_filename(out,outfile) <= 0)
255	{
256	perror(outfile);
257	goto end;
258	}
259	}
260
261	if (outformat == FORMAT_ASN1)
262	i=i2d_PKCS7_bio(out,p7);
263	else if (outformat == FORMAT_PEM)
264	i=PEM_write_bio_PKCS7(out,p7);
265	else {
266	BIO_printf(bio_err,"bad output format specified for outfile\n");
267	goto end;
268	}
269	if (!i)
270	{
271	BIO_printf(bio_err,"unable to write pkcs7 object\n");
272	ERR_print_errors(bio_err);
273	goto end;
274	}
275	ret=0;
276	end:
277	if (in != NULL) BIO_free(in);
278	if (out != NULL) BIO_free_all(out);
279	if (p7 != NULL) PKCS7_free(p7);
280	if (crl != NULL) X509_CRL_free(crl);
281
282	apps_shutdown();
283	OPENSSL_EXIT(ret);
284	}
285
286	/*
287	*----------------------------------------------------------------------
288	* int add_certs_from_file
289	*
290	* Read a list of certificates to be checked from a file.
291	*
292	* Results:
293	* number of certs added if successful, -1 if not.
294	*----------------------------------------------------------------------
295	*/
296	static int add_certs_from_file(STACK_OF(X509) stack, char certfile)
297	{
298	struct stat st;
299	BIO *in=NULL;
300	int count=0;
301	int ret= -1;
302	STACK_OF(X509_INFO) *sk=NULL;
303	X509_INFO *xi;
304
305	if ((stat(certfile,&st) != 0))
306	{
307	BIO_printf(bio_err,"unable to load the file, %s\n",certfile);
308	goto end;
309	}
310
311	in=BIO_new(BIO_s_file());
312	if ((in == NULL) \|\| (BIO_read_filename(in,certfile) <= 0))
313	{
314	BIO_printf(bio_err,"error opening the file, %s\n",certfile);
315	goto end;
316	}
317
318	/* This loads from a file, a stack of x509/crl/pkey sets */
319	sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL);
320	if (sk == NULL) {
321	BIO_printf(bio_err,"error reading the file, %s\n",certfile);
322	goto end;
323	}
324
325	/* scan over it and pull out the CRL's */
326	while (sk_X509_INFO_num(sk))
327	{
328	xi=sk_X509_INFO_shift(sk);
329	if (xi->x509 != NULL)
330	{
331	sk_X509_push(stack,xi->x509);
332	xi->x509=NULL;
333	count++;
334	}
335	X509_INFO_free(xi);
336	}
337
338	ret=count;
339	end:
340	/* never need to OPENSSL_free x */
341	if (in != NULL) BIO_free(in);
342	if (sk != NULL) sk_X509_INFO_free(sk);
343	return(ret);
344	}
345