From 3b7680da8db6bcb5ee4448753af6124e42d003be Mon Sep 17 00:00:00 2001 From: Zhi Guan Date: Sun, 28 Jun 2026 11:29:23 +0800 Subject: [PATCH] Merge p256/p384keygen to eckeygen --- CMakeLists.txt | 7 ++- cmake/tool_cert.cmake | 4 +- include/gmssl/passwd.h | 3 +- include/gmssl/version.h | 2 +- src/passwd.c | 56 ++++++++++++++++++---- tools/certgen.c | 4 +- tools/cmsdecrypt.c | 4 +- tools/cmssign.c | 4 +- tools/crlgen.c | 4 +- tools/{p256keygen.c => eckeygen.c} | 77 ++++++++++++++++++++++++++---- tools/gmssl.c | 14 +++--- tools/ocspsign.c | 4 +- tools/passwd.c | 12 ++--- tools/passwd.h | 4 +- tools/quic_server.c | 4 +- tools/reqgen.c | 6 +-- tools/reqsign.c | 4 +- tools/sdfdecrypt.c | 4 +- tools/sdfsign.c | 4 +- tools/sdftest.c | 4 +- tools/sdfutil.c | 8 ++-- tools/skfutil.c | 4 +- tools/sm2decrypt.c | 4 +- tools/sm2exch.c | 32 ++++++------- tools/sm2keygen.c | 4 +- tools/sm2sign.c | 4 +- tools/sm3_pbkdf2.c | 4 +- tools/sm9decrypt.c | 4 +- tools/sm9exch.c | 12 ++--- tools/sm9keygen.c | 8 ++-- tools/sm9setup.c | 5 +- tools/sm9sign.c | 4 +- tools/tlcp_client.c | 4 +- tools/tlcp_server.c | 4 +- tools/tls12_client.c | 4 +- tools/tls12_server.c | 4 +- tools/tls13_client.c | 4 +- tools/tls13_server.c | 4 +- 38 files changed, 218 insertions(+), 124 deletions(-) rename tools/{p256keygen.c => eckeygen.c} (59%) diff --git a/CMakeLists.txt b/CMakeLists.txt index 05abcab8..19caa230 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -537,7 +537,6 @@ if (ENABLE_SECP256R1) endif() add_definitions(-DENABLE_SECP256R1) list(APPEND src src/bn.c src/secp256r1.c) - list(APPEND tools tools/p256keygen.c) list(APPEND tests bn secp256r1 secp256r1_key ecdsa) endif() @@ -555,6 +554,10 @@ if (ENABLE_SECP384R1) list(APPEND tests secp384r1 secp384r1_key secp384r1_ecdsa) endif() +if (ENABLE_SECP256R1 OR ENABLE_SECP384R1) + list(APPEND tools tools/eckeygen.c) +endif() + if (ENABLE_LMS) message(STATUS "ENABLE_LMS is ON") add_definitions(-DENABLE_LMS) @@ -1019,7 +1022,7 @@ endif() # set(CPACK_PACKAGE_NAME "GmSSL") set(CPACK_PACKAGE_VENDOR "GmSSL develop team") -set(CPACK_PACKAGE_VERSION "3.3.0-dev.1182") +set(CPACK_PACKAGE_VERSION "3.3.0-dev.1183") set(CPACK_PACKAGE_DESCRIPTION_FILE ${PROJECT_SOURCE_DIR}/README.md) set(CPACK_NSIS_MODIFY_PATH ON) include(CPack) diff --git a/cmake/tool_cert.cmake b/cmake/tool_cert.cmake index 5881b1b8..814fafcf 100644 --- a/cmake/tool_cert.cmake +++ b/cmake/tool_cert.cmake @@ -33,10 +33,10 @@ endfunction() function(gmssl_generate_p256_key key_file export_file) if(export_file) - gmssl_run(bin/gmssl p256keygen -pass ${GMSSL_TEST_PASS} -out "${key_file}" -export "${export_file}") + gmssl_run(bin/gmssl eckeygen -curve secp256r1 -pass ${GMSSL_TEST_PASS} -out "${key_file}" -export "${export_file}") gmssl_require_generated_file("${export_file}") else() - gmssl_run(bin/gmssl p256keygen -pass ${GMSSL_TEST_PASS} -out "${key_file}") + gmssl_run(bin/gmssl eckeygen -curve secp256r1 -pass ${GMSSL_TEST_PASS} -out "${key_file}") endif() gmssl_require_generated_file("${key_file}") endfunction() diff --git a/include/gmssl/passwd.h b/include/gmssl/passwd.h index 3e986500..c082f56a 100644 --- a/include/gmssl/passwd.h +++ b/include/gmssl/passwd.h @@ -16,8 +16,7 @@ extern "C" { #endif - -int gmssl_read_password(const char *prompt, char *pass, size_t passlen); +int gmssl_read_password(const char *prompt, char *pass, size_t passlen, int do_confirm); #ifdef __cplusplus diff --git a/include/gmssl/version.h b/include/gmssl/version.h index fdf8ee61..94df07db 100644 --- a/include/gmssl/version.h +++ b/include/gmssl/version.h @@ -18,7 +18,7 @@ extern "C" { #define GMSSL_VERSION_NUM 30300 -#define GMSSL_VERSION_STR "GmSSL 3.3.0-dev.1182" +#define GMSSL_VERSION_STR "GmSSL 3.3.0-dev.1183" int gmssl_version_num(void); const char *gmssl_version_str(void); diff --git a/src/passwd.c b/src/passwd.c index 4079ee47..f0087e04 100644 --- a/src/passwd.c +++ b/src/passwd.c @@ -8,6 +8,7 @@ */ #include +#include #include #include #include @@ -63,9 +64,52 @@ static int gmssl_password_read_line(FILE *in, FILE *out, const char *prompt, cha return 1; } +static int gmssl_password_read(FILE *in, FILE *out, const char *prompt, + char *pass, size_t passlen, int do_confirm) +{ + char *confirm = NULL; + int ret = -1; + + ret = gmssl_password_read_line(in, out, prompt, pass, passlen); + fputc('\n', out); + fflush(out); + if (ret != 1) { + goto end; + } + + if (do_confirm) { + if (!(confirm = malloc(passlen))) { + error_print(); + goto end; + } + ret = gmssl_password_read_line(in, out, "Confirm: ", confirm, passlen); + fputc('\n', out); + fflush(out); + if (ret != 1) { + goto end; + } + if (strcmp(pass, confirm) != 0) { + error_print(); + goto end; + } + } + + ret = 1; + +end: + if (ret != 1) { + gmssl_secure_clear(pass, passlen); + } + if (confirm) { + gmssl_secure_clear(confirm, passlen); + free(confirm); + } + return ret; +} + #if defined(_WIN32) -int gmssl_read_password(const char *prompt, char *pass, size_t passlen) +int gmssl_read_password(const char *prompt, char *pass, size_t passlen, int do_confirm) { FILE *in = NULL; FILE *out = NULL; @@ -98,14 +142,12 @@ int gmssl_read_password(const char *prompt, char *pass, size_t passlen) goto end; } - ret = gmssl_password_read_line(in, out, prompt, pass, passlen); + ret = gmssl_password_read(in, out, prompt, pass, passlen, do_confirm); if (!SetConsoleMode(in_handle, old_mode)) { error_print(); ret = -1; } - fputc('\n', out); - fflush(out); end: if (in) fclose(in); @@ -116,7 +158,7 @@ end: #else -int gmssl_read_password(const char *prompt, char *pass, size_t passlen) +int gmssl_read_password(const char *prompt, char *pass, size_t passlen, int do_confirm) { FILE *tty = NULL; int fd; @@ -148,14 +190,12 @@ int gmssl_read_password(const char *prompt, char *pass, size_t passlen) goto end; } - ret = gmssl_password_read_line(tty, tty, prompt, pass, passlen); + ret = gmssl_password_read(tty, tty, prompt, pass, passlen, do_confirm); if (tcsetattr(fd, TCSAFLUSH, &old_termios) < 0) { error_print(); ret = -1; } - fputc('\n', tty); - fflush(tty); end: if (tty) fclose(tty); diff --git a/tools/certgen.c b/tools/certgen.c index 20a541ae..0826783b 100644 --- a/tools/certgen.c +++ b/tools/certgen.c @@ -414,8 +414,8 @@ bad: goto end; } if (!pass && algor != OID_ec_public_key) { - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } } diff --git a/tools/cmsdecrypt.c b/tools/cmsdecrypt.c index 185787dd..eb654ec4 100644 --- a/tools/cmsdecrypt.c +++ b/tools/cmsdecrypt.c @@ -112,8 +112,8 @@ bad: fprintf(stderr, "%s: '-key' option required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (!certfile) { diff --git a/tools/cmssign.c b/tools/cmssign.c index 4c32a89a..c1ee5891 100644 --- a/tools/cmssign.c +++ b/tools/cmssign.c @@ -107,8 +107,8 @@ bad: fprintf(stderr, "%s: '-key' option required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (!certfile) { diff --git a/tools/crlgen.c b/tools/crlgen.c index 955acb12..ee0d8138 100644 --- a/tools/crlgen.c +++ b/tools/crlgen.c @@ -259,8 +259,8 @@ bad: } if (!pass && x509_pub.algor == OID_ec_public_key) { - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } } diff --git a/tools/p256keygen.c b/tools/eckeygen.c similarity index 59% rename from tools/p256keygen.c rename to tools/eckeygen.c index e1c38fc0..4857e1fe 100644 --- a/tools/p256keygen.c +++ b/tools/eckeygen.c @@ -17,26 +17,50 @@ #include "passwd.h" -static const char *usage = "[-pass str] [-out pem] [-pubout pem]\n"; +static const char *usage = "-curve str [-pass str] [-out pem] [-pubout pem]\n"; static const char *options = "Options\n" "\n" +" -curve str EC curve name, supported curves: secp256r1, prime256v1, secp384r1\n" +" SM2 is not supported by this command, use `sm2keygen` instead\n" " -pass pass Password to encrypt the private key, prompt if not given\n" " -out pem Output password-encrypted PKCS #8 private key in PEM format\n" " -pubout pem Output public key in PEM format\n" -" -export pem Output non-encrypted PKCS#8 private key in PEM format\n" +" -export pem Output non-encrypted EC private key in PEM format\n" "\n" "Examples\n" "\n" -" gmssl p256keygen -pass P@ssw0rd -out p256.pem\n" -" gmssl p256keygen -pass P@ssw0rd -out p256.pem -pubout p256pub.pem\n" +" gmssl eckeygen -curve secp256r1 -pass P@ssw0rd -out p256.pem\n" +" gmssl eckeygen -curve secp384r1 -pass P@ssw0rd -out p384.pem -pubout p384pub.pem\n" "\n"; -int p256keygen_main(int argc, char **argv) +static int eckeygen_curve_from_name(const char *name) +{ + if (!name) { + return OID_undef; + } + if (!strcmp(name, "sm2") || !strcmp(name, "sm2p256v1")) { + return OID_sm2; + } +#ifdef ENABLE_SECP256R1 + if (!strcmp(name, "secp256r1") || !strcmp(name, "prime256v1")) { + return OID_secp256r1; + } +#endif +#ifdef ENABLE_SECP384R1 + if (!strcmp(name, "secp384r1")) { + return OID_secp384r1; + } +#endif + return OID_undef; +} + +int eckeygen_main(int argc, char **argv) { int ret = 1; char *prog = argv[0]; + char *curve_name = NULL; char *pass = NULL; char passbuf[GMSSL_PASSWORD_MAX_SIZE] = {0}; char *outfile = NULL; @@ -45,8 +69,8 @@ int p256keygen_main(int argc, char **argv) FILE *outfp = stdout; FILE *puboutfp = stdout; FILE *exportfp = NULL; - int curve_oid = OID_secp256r1; - X509_KEY key; + int curve_oid = OID_undef; + X509_KEY key = {0}; argc--; argv++; @@ -62,6 +86,9 @@ int p256keygen_main(int argc, char **argv) printf("%s\n", options); ret = 0; goto end; + } else if (!strcmp(*argv, "-curve")) { + if (--argc < 1) goto bad; + curve_name = *(++argv); } else if (!strcmp(*argv, "-pass")) { if (--argc < 1) goto bad; pass = *(++argv); @@ -98,8 +125,22 @@ bad: argv++; } - if (gmssl_tool_get_password(prog, "Password to encrypt private key", outfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (!curve_name) { + fprintf(stderr, "gmssl %s: option '-curve' required\n", prog); + goto end; + } + curve_oid = eckeygen_curve_from_name(curve_name); + if (curve_oid == OID_sm2) { + fprintf(stderr, "gmssl %s: SM2 curve is not supported, use `sm2keygen` instead\n", prog); + goto end; + } + if (curve_oid == OID_undef) { + fprintf(stderr, "gmssl %s: unsupported curve '%s'\n", prog, curve_name); + goto end; + } + + if (gmssl_tool_get_password(prog, "pass", outfile, &pass, + passbuf, sizeof(passbuf), 1) != 1) { goto end; } @@ -116,7 +157,22 @@ bad: goto end; } if (exportfp) { - if (secp256r1_private_key_to_pem(&key.u.secp256r1_key, exportfp) != 1) { + switch (curve_oid) { +#ifdef ENABLE_SECP256R1 + case OID_secp256r1: + ret = secp256r1_private_key_to_pem(&key.u.secp256r1_key, exportfp); + break; +#endif +#ifdef ENABLE_SECP384R1 + case OID_secp384r1: + ret = secp384r1_private_key_to_pem(&key.u.secp384r1_key, exportfp); + break; +#endif + default: + ret = -1; + break; + } + if (ret != 1) { fprintf(stderr, "gmssl %s: inner failure\n", prog); goto end; } @@ -129,5 +185,6 @@ end: gmssl_secure_clear(passbuf, sizeof(passbuf)); if (outfile && outfp) fclose(outfp); if (puboutfile && puboutfp) fclose(puboutfp); + if (exportfile && exportfp) fclose(exportfp); return ret; } diff --git a/tools/gmssl.c b/tools/gmssl.c index 2f6acd1b..0b86ed9b 100644 --- a/tools/gmssl.c +++ b/tools/gmssl.c @@ -101,8 +101,8 @@ extern int sctverify_main(int argc, char **argv); extern int quic_client_main(int argc, char **argv); extern int quic_server_main(int argc, char **argv); #endif -#ifdef ENABLE_SECP256R1 -extern int p256keygen_main(int argc, char **argv); +#if defined(ENABLE_SECP256R1) || defined(ENABLE_SECP384R1) +extern int eckeygen_main(int argc, char **argv); #endif #ifdef ENABLE_LMS extern int lmskeygen_main(int argc, char **argv); @@ -225,8 +225,8 @@ static const char *options = " cmsdecrypt Decrypt CMS EnvelopedData\n" " cmsparse Parse CMS (cryptographic message syntax) file\n" #endif -#ifdef ENABLE_SECP256R1 - " p256keygen Generate P-256 (secp256r1, prime256v1) keypair\n" +#if defined(ENABLE_SECP256R1) || defined(ENABLE_SECP384R1) + " eckeygen Generate EC keypair on a named curve\n" #endif #ifdef ENABLE_LMS " lmskeygen Generate LMS-SM3 (Leighton-Micali Signature) keypair\n" @@ -450,9 +450,9 @@ int main(int argc, char **argv) } else if (!strcmp(*argv, "quic_server")) { return quic_server_main(argc, argv); #endif -#ifdef ENABLE_SECP256R1 - } else if (!strcmp(*argv, "p256keygen")) { - return p256keygen_main(argc, argv); +#if defined(ENABLE_SECP256R1) || defined(ENABLE_SECP384R1) + } else if (!strcmp(*argv, "eckeygen")) { + return eckeygen_main(argc, argv); #endif #ifdef ENABLE_LMS } else if (!strcmp(*argv, "lmskeygen")) { diff --git a/tools/ocspsign.c b/tools/ocspsign.c index ff3fa747..b40fd2df 100644 --- a/tools/ocspsign.c +++ b/tools/ocspsign.c @@ -406,8 +406,8 @@ bad: goto end; } if (!pass && signer_pub.algor == OID_ec_public_key) { - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } } diff --git a/tools/passwd.c b/tools/passwd.c index 0435d6f4..d094d4ae 100644 --- a/tools/passwd.c +++ b/tools/passwd.c @@ -13,16 +13,16 @@ int gmssl_tool_read_password(const char *prog, const char *label, - const char *file, char *pass, size_t passlen) + const char *file, char *pass, size_t passlen, int do_confirm) { char prompt[512]; int len; if (!prog) prog = "gmssl"; - if (!label) label = "Password"; + if (!label) label = "pass"; if (file && file[0]) { - len = snprintf(prompt, sizeof(prompt), "gmssl %s: %s '%s': ", prog, label, file); + len = snprintf(prompt, sizeof(prompt), "gmssl %s: %s %s: ", prog, label, file); } else { len = snprintf(prompt, sizeof(prompt), "gmssl %s: %s: ", prog, label); } @@ -30,11 +30,11 @@ int gmssl_tool_read_password(const char *prog, const char *label, return -1; } - return gmssl_read_password(prompt, pass, passlen); + return gmssl_read_password(prompt, pass, passlen, do_confirm); } int gmssl_tool_get_password(const char *prog, const char *label, - const char *file, char **pass, char *passbuf, size_t passlen) + const char *file, char **pass, char *passbuf, size_t passlen, int do_confirm) { if (!pass || !passbuf) { return -1; @@ -42,7 +42,7 @@ int gmssl_tool_get_password(const char *prog, const char *label, if (*pass) { return 1; } - if (gmssl_tool_read_password(prog, label, file, passbuf, passlen) != 1) { + if (gmssl_tool_read_password(prog, label, file, passbuf, passlen, do_confirm) != 1) { return -1; } *pass = passbuf; diff --git a/tools/passwd.h b/tools/passwd.h index 21080d8e..3518092f 100644 --- a/tools/passwd.h +++ b/tools/passwd.h @@ -20,9 +20,9 @@ extern "C" { #define GMSSL_PASSWORD_MAX_SIZE 256 int gmssl_tool_read_password(const char *prog, const char *label, - const char *file, char *pass, size_t passlen); + const char *file, char *pass, size_t passlen, int do_confirm); int gmssl_tool_get_password(const char *prog, const char *label, - const char *file, char **pass, char *passbuf, size_t passlen); + const char *file, char **pass, char *passbuf, size_t passlen, int do_confirm); #ifdef __cplusplus diff --git a/tools/quic_server.c b/tools/quic_server.c index b5be8b7a..f5a5c4a2 100644 --- a/tools/quic_server.c +++ b/tools/quic_server.c @@ -773,8 +773,8 @@ bad: fprintf(stderr, "%s: -cert and -key required\n", prog); return 1; } - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { return 1; } diff --git a/tools/reqgen.c b/tools/reqgen.c index f68b02a1..1493f2a6 100644 --- a/tools/reqgen.c +++ b/tools/reqgen.c @@ -64,7 +64,7 @@ static char *usage = " gmssl sm2keygen -pass P@ssw0rd -out sm2key.pem\n" " gmssl reqgen -CN www.gmssl.org -key sm2key.pem -pass P@ssw0rd -out sm2req.pem\n" "\n" -" gmssl p256keygen -pass P@ssw0rd -out p256key.pem\n" +" gmssl eckeygen -curve secp256r1 -pass P@ssw0rd -out p256key.pem\n" " gmssl reqgen -CN www.gmssl.org -key p256key.pem -pass P@ssw0rd -out p256req.pem\n" "\n"; @@ -217,8 +217,8 @@ bad: } if (!pass && algor == OID_ec_public_key) { - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } } diff --git a/tools/reqsign.c b/tools/reqsign.c index 4d785c5a..2dc710a0 100644 --- a/tools/reqsign.c +++ b/tools/reqsign.c @@ -473,8 +473,8 @@ bad: goto end; } if (!pass && issuer_public_key.algor == OID_ec_public_key) { - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } } diff --git a/tools/sdfdecrypt.c b/tools/sdfdecrypt.c index 21d4ef07..88e6c48c 100755 --- a/tools/sdfdecrypt.c +++ b/tools/sdfdecrypt.c @@ -141,8 +141,8 @@ bad: fprintf(stderr, "gmssl %s: '-key' option required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", NULL, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/sdfsign.c b/tools/sdfsign.c index ae16aa3c..b71d42fe 100644 --- a/tools/sdfsign.c +++ b/tools/sdfsign.c @@ -127,8 +127,8 @@ bad: fprintf(stderr, "gmssl %s: '-key' option required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", NULL, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/sdftest.c b/tools/sdftest.c index 5dfbe5f8..a43a5772 100644 --- a/tools/sdftest.c +++ b/tools/sdftest.c @@ -2204,8 +2204,8 @@ bad: fprintf(stderr, "gmssl %s: option `-lib` missing\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", NULL, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/sdfutil.c b/tools/sdfutil.c index bc96b1e3..f408afdf 100644 --- a/tools/sdfutil.c +++ b/tools/sdfutil.c @@ -145,8 +145,8 @@ bad: fprintf(stderr, "%s: invalid key index\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", NULL, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (sdf_load_sign_key(&dev, &key, keyindex, pass) != 1) { @@ -171,8 +171,8 @@ bad: fprintf(stderr, "%s: invalid key index\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", NULL, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (sdf_load_sign_key(&dev, &key, keyindex, pass) != 1) { diff --git a/tools/skfutil.c b/tools/skfutil.c index 73d51a4e..ed0e74b5 100644 --- a/tools/skfutil.c +++ b/tools/skfutil.c @@ -197,8 +197,8 @@ bad: fprintf(stderr, "%s: option '-container' required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to access SKF container", container_name, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", container_name, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/sm2decrypt.c b/tools/sm2decrypt.c index 7dbb4c23..59a6a59f 100644 --- a/tools/sm2decrypt.c +++ b/tools/sm2decrypt.c @@ -107,8 +107,8 @@ bad: fprintf(stderr, "gmssl %s: '-key' option required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/sm2exch.c b/tools/sm2exch.c index 228c6808..85633360 100644 --- a/tools/sm2exch.c +++ b/tools/sm2exch.c @@ -906,20 +906,18 @@ bad: } if (!strcmp(stage, "init")) { - if (exch_keyoutfile && gmssl_tool_get_password(prog, - "Password to encrypt exchange private key", exch_keyoutfile, - &exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) { + if (exch_keyoutfile && gmssl_tool_get_password(prog, "exchpass", + exch_keyoutfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 1) != 1) { goto end; } ret = sm2exch_stage_init(exch_keyoutfile, exch_pass, outfile, format, prog); } else if (!strcmp(stage, "respond")) { - if (keyfile && gmssl_tool_get_password(prog, "Password to open private key", - keyfile, &pass, passbuf, sizeof(passbuf)) != 1) { + if (keyfile && gmssl_tool_get_password(prog, "pass", + keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) { goto end; } - if (exch_keyoutfile && gmssl_tool_get_password(prog, - "Password to encrypt exchange private key", exch_keyoutfile, - &exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) { + if (exch_keyoutfile && gmssl_tool_get_password(prog, "exchpass", + exch_keyoutfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 1) != 1) { goto end; } ret = sm2exch_stage_respond(keyfile, pass, pubkeyfile, certfile, @@ -927,13 +925,12 @@ bad: infile, exch_keyoutfile, exch_pass, secret_stateoutfile, outfile, keylen, format, prog); } else if (!strcmp(stage, "confirm")) { - if (keyfile && gmssl_tool_get_password(prog, "Password to open private key", - keyfile, &pass, passbuf, sizeof(passbuf)) != 1) { + if (keyfile && gmssl_tool_get_password(prog, "pass", + keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) { goto end; } - if (exch_keyfile && gmssl_tool_get_password(prog, - "Password to open exchange private key", exch_keyfile, - &exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) { + if (exch_keyfile && gmssl_tool_get_password(prog, "exchpass", + exch_keyfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 0) != 1) { goto end; } ret = sm2exch_stage_confirm(keyfile, pass, pubkeyfile, certfile, @@ -941,13 +938,12 @@ bad: exch_keyfile, exch_pass, infile, secret_stateoutfile, keyoutfile, outfile, keylen, format, prog); } else if (!strcmp(stage, "finish")) { - if (keyfile && gmssl_tool_get_password(prog, "Password to open private key", - keyfile, &pass, passbuf, sizeof(passbuf)) != 1) { + if (keyfile && gmssl_tool_get_password(prog, "pass", + keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) { goto end; } - if (exch_keyfile && gmssl_tool_get_password(prog, - "Password to open exchange private key", exch_keyfile, - &exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) { + if (exch_keyfile && gmssl_tool_get_password(prog, "exchpass", + exch_keyfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 0) != 1) { goto end; } ret = sm2exch_stage_finish(keyfile, pass, pubkeyfile, certfile, diff --git a/tools/sm2keygen.c b/tools/sm2keygen.c index 6e1fad8b..188346e5 100644 --- a/tools/sm2keygen.c +++ b/tools/sm2keygen.c @@ -87,8 +87,8 @@ bad: argv++; } - if (gmssl_tool_get_password(prog, "Password to encrypt private key", outfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", outfile, &pass, + passbuf, sizeof(passbuf), 1) != 1) { goto end; } diff --git a/tools/sm2sign.c b/tools/sm2sign.c index 14024dca..8946c257 100644 --- a/tools/sm2sign.c +++ b/tools/sm2sign.c @@ -114,8 +114,8 @@ bad: fprintf(stderr, "gmssl %s: '-key' option required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (sm2_private_key_info_decrypt_from_pem(&key, pass, keyfp) != 1) { diff --git a/tools/sm3_pbkdf2.c b/tools/sm3_pbkdf2.c index aee8f216..e6ed240c 100644 --- a/tools/sm3_pbkdf2.c +++ b/tools/sm3_pbkdf2.c @@ -124,8 +124,8 @@ bad: argv++; } - if (gmssl_tool_get_password(prog, "Password", NULL, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", NULL, &pass, + passbuf, sizeof(passbuf), 1) != 1) { goto end; } if (!salthex) { diff --git a/tools/sm9decrypt.c b/tools/sm9decrypt.c index 69d54c87..6c0087bd 100644 --- a/tools/sm9decrypt.c +++ b/tools/sm9decrypt.c @@ -109,8 +109,8 @@ bad: error_print(); goto end; } - if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/sm9exch.c b/tools/sm9exch.c index 11b07057..f1a5b817 100644 --- a/tools/sm9exch.c +++ b/tools/sm9exch.c @@ -752,24 +752,24 @@ bad: ret = sm9exch_stage_init(mpkfile, peer_id, peer_id_len, exch_keyoutfile, outfile, format, prog); } else if (!strcmp(stage, "respond")) { - if (keyfile && gmssl_tool_get_password(prog, "Password to open private key", - keyfile, &pass, passbuf, sizeof(passbuf)) != 1) { + if (keyfile && gmssl_tool_get_password(prog, "pass", + keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) { goto end; } ret = sm9exch_stage_respond(mpkfile, keyfile, pass, id, id_len, peer_id, peer_id_len, infile, exch_keyoutfile, outfile, keylen, format, prog); } else if (!strcmp(stage, "confirm")) { - if (keyfile && gmssl_tool_get_password(prog, "Password to open private key", - keyfile, &pass, passbuf, sizeof(passbuf)) != 1) { + if (keyfile && gmssl_tool_get_password(prog, "pass", + keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) { goto end; } ret = sm9exch_stage_confirm(mpkfile, keyfile, pass, id, id_len, peer_id, peer_id_len, exch_keyfile, infile, keyoutfile, outfile, keylen, format, prog); } else if (!strcmp(stage, "finish")) { - if (keyfile && gmssl_tool_get_password(prog, "Password to open private key", - keyfile, &pass, passbuf, sizeof(passbuf)) != 1) { + if (keyfile && gmssl_tool_get_password(prog, "pass", + keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) { goto end; } ret = sm9exch_stage_finish(mpkfile, keyfile, pass, id, id_len, diff --git a/tools/sm9keygen.c b/tools/sm9keygen.c index 792305f5..1ec9b431 100644 --- a/tools/sm9keygen.c +++ b/tools/sm9keygen.c @@ -119,10 +119,10 @@ bad: fprintf(stderr, "%s: option '-id' is required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to decrypt master private key", infile, - &inpass, inpassbuf, sizeof(inpassbuf)) != 1 - || gmssl_tool_get_password(prog, "Password to encrypt user private key", outfile, - &outpass, outpassbuf, sizeof(outpassbuf)) != 1) { + if (gmssl_tool_get_password(prog, "inpass", infile, + &inpass, inpassbuf, sizeof(inpassbuf), 0) != 1 + || gmssl_tool_get_password(prog, "outpass", outfile, + &outpass, outpassbuf, sizeof(outpassbuf), 1) != 1) { goto end; } diff --git a/tools/sm9setup.c b/tools/sm9setup.c index f449b24b..bf39c34e 100644 --- a/tools/sm9setup.c +++ b/tools/sm9setup.c @@ -103,8 +103,8 @@ bad: error_print(); goto end; } - if (gmssl_tool_get_password(prog, "Password to encrypt master private key", outfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", outfile, &pass, + passbuf, sizeof(passbuf), 1) != 1) { goto end; } @@ -164,4 +164,3 @@ end: - diff --git a/tools/sm9sign.c b/tools/sm9sign.c index fbd08659..63deb3ff 100644 --- a/tools/sm9sign.c +++ b/tools/sm9sign.c @@ -106,8 +106,8 @@ bad: error_print(); goto end; } - if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } diff --git a/tools/tlcp_client.c b/tools/tlcp_client.c index cd30e4ca..6b598c5b 100644 --- a/tools/tlcp_client.c +++ b/tools/tlcp_client.c @@ -475,8 +475,8 @@ bad: fprintf(stderr, "%s: option '-key' missing\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (has_ecdhe_cipher_suite) { diff --git a/tools/tlcp_server.c b/tools/tlcp_server.c index 9e6a0b7f..8c44207b 100644 --- a/tools/tlcp_server.c +++ b/tools/tlcp_server.c @@ -274,8 +274,8 @@ bad: return 1; } for (i = signpasses_cnt; i < signkeyfiles_cnt; i++) { - if (gmssl_tool_read_password(prog, "Password to decrypt private key", - signkeyfiles[i], passbufs[i], sizeof(passbufs[i])) != 1) { + if (gmssl_tool_read_password(prog, "pass", + signkeyfiles[i], passbufs[i], sizeof(passbufs[i]), 0) != 1) { goto end; } signpasses[i] = passbufs[i]; diff --git a/tools/tls12_client.c b/tools/tls12_client.c index 5ff819df..33c2b794 100644 --- a/tools/tls12_client.c +++ b/tools/tls12_client.c @@ -439,8 +439,8 @@ bad: fprintf(stderr, "%s: option '-key' missing\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (tls_ctx_set_certificate_and_key(&ctx, certfile, keyfile, pass) != 1) { diff --git a/tools/tls12_server.c b/tools/tls12_server.c index 673ff84b..b6c56cd4 100644 --- a/tools/tls12_server.c +++ b/tools/tls12_server.c @@ -301,8 +301,8 @@ bad: return -1; } for (i = passes_cnt; i < keyfiles_cnt; i++) { - if (gmssl_tool_read_password(prog, "Password to decrypt private key", - keyfiles[i], passbufs[i], sizeof(passbufs[i])) != 1) { + if (gmssl_tool_read_password(prog, "pass", + keyfiles[i], passbufs[i], sizeof(passbufs[i]), 0) != 1) { goto end; } passes[i] = passbufs[i]; diff --git a/tools/tls13_client.c b/tools/tls13_client.c index dccef863..94d5d9be 100644 --- a/tools/tls13_client.c +++ b/tools/tls13_client.c @@ -571,8 +571,8 @@ bad: fprintf(stderr, "%s: option -key is required\n", prog); goto end; } - if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass, - passbuf, sizeof(passbuf)) != 1) { + if (gmssl_tool_get_password(prog, "pass", keyfile, &pass, + passbuf, sizeof(passbuf), 0) != 1) { goto end; } if (tls_ctx_add_certificate_chain_and_key(&ctx, certfile, keyfile, pass) != 1) { diff --git a/tools/tls13_server.c b/tools/tls13_server.c index 39db6cd0..fd231565 100644 --- a/tools/tls13_server.c +++ b/tools/tls13_server.c @@ -361,8 +361,8 @@ bad: return -1; } for (i = passes_cnt; i < keyfiles_cnt; i++) { - if (gmssl_tool_read_password(prog, "Password to decrypt private key", - keyfiles[i], passbufs[i], sizeof(passbufs[i])) != 1) { + if (gmssl_tool_read_password(prog, "pass", + keyfiles[i], passbufs[i], sizeof(passbufs[i]), 0) != 1) { goto end; } passes[i] = passbufs[i];