int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
{
    unsigned char mac[EVP_MAX_MD_SIZE];
    unsigned int maclen;
    const ASN1_OCTET_STRING *macoct;

    if (p12->mac == NULL) {
        PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, PKCS12_R_MAC_ABSENT);
        return 0;
    }
    if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen,
                        PKCS12_key_gen_utf8)) {
        PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, PKCS12_R_MAC_GENERATION_ERROR);
        return 0;
    }
    X509_SIG_get0(p12->mac->dinfo, NULL, &macoct);
    if (maclen != (unsigned int)ASN1_STRING_length(macoct))
        return 0;

    if (CRYPTO_memcmp(mac, ASN1_STRING_get0_data(macoct), maclen) != 0) {
        if (pass == NULL)
            return 0;
        /*
         * In order to facilitate accessing old data retry with
         * old-style broken password ...
         */
        if (!pkcs12_gen_mac(p12, pass, passlen, mac, &maclen,
                            PKCS12_key_gen_asc)) {
            PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC, PKCS12_R_MAC_GENERATION_ERROR);
            return 0;
        }
        if ((maclen != (unsigned int)ASN1_STRING_length(macoct))
            || CRYPTO_memcmp(mac, ASN1_STRING_get0_data(macoct), maclen) != 0)
            return 0;
        else
            PKCS12_key_gen = PKCS12_key_gen_asc;
        /*
         * ... and if suceeded, pass it on to PKCS12_PBE_keyivgen.
         */
    }
    return 1;
}