Added --ask-pass certtool option to allow asking for passwords even when in batch mode.

6 files changed, 18 insertions, 4 deletions

diff --git a/src/certtool-args.def b/src/certtool-args.def
index d1ad4aac63..b9b29b87e1 100644
--- a/src/certtool-args.def
+++ b/src/certtool-args.def
@@ -365,6 +365,13 @@ flag = {
 };
 
 flag = {
+    name      = ask-pass;
+    disabled;
+    descrip   = "Enable interaction for entering password when in batch mode.";
+    doc   = "This option will enable interaction to enter password when in batch mode. That is useful when the template option has been specified.";
+};
+
+flag = {
     name      = pkcs-cipher;
     arg-type  = string;
     arg-name  = "Cipher";
diff --git a/src/certtool-cfg.c b/src/certtool-cfg.c
index 81be6db89e..54cd5211f7 100644
--- a/src/certtool-cfg.c
+++ b/src/certtool-cfg.c
@@ -50,6 +50,7 @@
 #include "certtool-common.h"
 
 extern int batch;
+extern int ask_pass;
 
 #define MAX_ENTRIES 128
 #define MAX_POLICIES 8
@@ -462,7 +463,7 @@ int read_yesno(const char *input_str, int def)
  */
 const char *get_pass(void)
 {
-	if (batch)
+	if (batch && !ask_pass)
 		return cfg.password;
 	else
 		return getpass("Enter password: ");
@@ -470,7 +471,7 @@ const char *get_pass(void)
 
 const char *get_confirmed_pass(bool empty_ok)
 {
-	if (batch)
+	if (batch && !ask_pass)
 		return cfg.password;
 	else {
 		const char *pass = NULL;
@@ -498,7 +499,7 @@ const char *get_confirmed_pass(bool empty_ok)
 
 const char *get_challenge_pass(void)
 {
-	if (batch)
+	if (batch && !ask_pass)
 		return cfg.challenge_password;
 	else
 		return getpass("Enter a challenge password: ");
diff --git a/src/certtool.c b/src/certtool.c
index c4fcd66d55..aff75e9e14 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -81,6 +81,7 @@ gnutls_certificate_print_formats_t full_format = GNUTLS_CRT_PRINT_FULL;
 /* non interactive operation if set
  */
 int batch;
+int ask_pass;
 
 
 static void tls_log_func(int level, const char *str)
@@ -1054,6 +1055,8 @@ static void cmd_parser(int argc, char **argv)
 		template_parse(OPT_ARG(TEMPLATE));
 	}
 
+	ask_pass = ENABLED_OPT(ASK_PASS);
+
 	gnutls_global_set_log_function(tls_log_func);
 
 	if (HAVE_OPT(DEBUG)) {
diff --git a/src/danetool.c b/src/danetool.c
index 1f2c8e27e4..8b7b1ead62 100644
--- a/src/danetool.c
+++ b/src/danetool.c
@@ -63,7 +63,8 @@ static gnutls_digest_algorithm_t default_dig;
 
 /* non interactive operation if set
  */
-int batch;
+int batch = 0;
+int ask_pass = 0;
 
 
 static void tls_log_func(int level, const char *str)
diff --git a/src/p11tool.c b/src/p11tool.c
index e92dfc2601..cf9ccb7d58 100644
--- a/src/p11tool.c
+++ b/src/p11tool.c
@@ -51,6 +51,7 @@ static void cmd_parser(int argc, char **argv);
 
 static FILE *outfile;
 int batch = 0;
+int ask_pass = 0;
 
 static void tls_log_func(int level, const char *str)
 {
diff --git a/src/tpmtool.c b/src/tpmtool.c
index 0ce6bfb4b4..4deede0d05 100644
--- a/src/tpmtool.c
+++ b/src/tpmtool.c
@@ -59,6 +59,7 @@ static gnutls_tpmkey_fmt_t inkey_format, outkey_format;
 static FILE *outfile;
 static FILE *infile;
 int batch = 0;
+int ask_pass = 0;
 
 static void tls_log_func(int level, const char *str)
 {