Convert openssl(1) pkcs12 to the newer style of option handling

Adapt openssl(1) pkcs12 command to new option handling.
Added pkcs12_options struct, and replaced for-if-strcmp handling with
options_parse().

ok and comments jsing@

1 files changed, 409 insertions, 214 deletions

diff --git a/usr.bin/openssl/pkcs12.c b/usr.bin/openssl/pkcs12.c
index 35a17154f87..a1983eee0f8 100644
--- a/usr.bin/openssl/pkcs12.c
+++ b/usr.bin/openssl/pkcs12.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs12.c,v 1.11 2019/07/23 10:18:32 inoguchi Exp $ */
+/* $OpenBSD: pkcs12.c,v 1.12 2019/07/24 13:49:24 inoguchi Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -119,14 +119,418 @@ static struct {
 	int twopass;
 } pkcs12_config;
 
+static int
+pkcs12_opt_canames(char *arg)
+{
+	if (pkcs12_config.canames == NULL &&
+	    (pkcs12_config.canames = sk_OPENSSL_STRING_new_null()) == NULL)
+		return (1);
+
+	if (!sk_OPENSSL_STRING_push(pkcs12_config.canames, arg))
+		return (1);
+
+	return (0);
+}
+
+static int
+pkcs12_opt_cert_pbe(char *arg)
+{
+	return (!set_pbe(bio_err, &pkcs12_config.cert_pbe, arg));
+}
+
+static int
+pkcs12_opt_key_pbe(char *arg)
+{
+	return (!set_pbe(bio_err, &pkcs12_config.key_pbe, arg));
+}
+
+static int
+pkcs12_opt_passarg(char *arg)
+{
+	pkcs12_config.passarg = arg;
+	pkcs12_config.noprompt = 1;
+	return (0);
+}
+
+static const EVP_CIPHER *get_cipher_by_name(char *name)
+{
+	if (name == NULL || strcmp(name, "") == 0)
+		return (NULL);
+#ifndef OPENSSL_NO_AES
+	else if (strcmp(name, "aes128") == 0)
+		return EVP_aes_128_cbc();
+	else if (strcmp(name, "aes192") == 0)
+		return EVP_aes_192_cbc();
+	else if (strcmp(name, "aes256") == 0)
+		return EVP_aes_256_cbc();
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+	else if (strcmp(name, "camellia128") == 0)
+		return EVP_camellia_128_cbc();
+	else if (strcmp(name, "camellia192") == 0)
+		return EVP_camellia_192_cbc();
+	else if (strcmp(name, "camellia256") == 0)
+		return EVP_camellia_256_cbc();
+#endif
+#ifndef OPENSSL_NO_DES
+	else if (strcmp(name, "des") == 0)
+		return EVP_des_cbc();
+	else if (strcmp(name, "des3") == 0)
+		return EVP_des_ede3_cbc();
+#endif
+#ifndef OPENSSL_NO_IDEA
+	else if (strcmp(name, "idea") == 0)
+		return EVP_idea_cbc();
+#endif
+	else
+		return (NULL);
+}
+
+static int
+pkcs12_opt_enc(int argc, char **argv, int *argsused)
+{
+	char *name = argv[0];
+
+	if (*name++ != '-')
+		return (1);
+
+	if (strcmp(name, "nodes") == 0)
+		pkcs12_config.enc = NULL;
+	else if ((pkcs12_config.enc = get_cipher_by_name(name)) == NULL)
+		return (1);
+
+	*argsused = 1;
+	return (0);
+}
+
+static const struct option pkcs12_options[] = {
+#ifndef OPENSSL_NO_AES
+	{
+		.name = "aes128",
+		.desc = "Encrypt PEM output with CBC AES",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+	{
+		.name = "aes192",
+		.desc = "Encrypt PEM output with CBC AES",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+	{
+		.name = "aes256",
+		.desc = "Encrypt PEM output with CBC AES",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+	{
+		.name = "camellia128",
+		.desc = "Encrypt PEM output with CBC Camellia",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+	{
+		.name = "camellia192",
+		.desc = "Encrypt PEM output with CBC Camellia",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+	{
+		.name = "camellia256",
+		.desc = "Encrypt PEM output with CBC Camellia",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+#endif
+	{
+		.name = "des",
+		.desc = "Encrypt private keys with DES",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+	{
+		.name = "des3",
+		.desc = "Encrypt private keys with triple DES (default)",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+#ifndef OPENSSL_NO_IDEA
+	{
+		.name = "idea",
+		.desc = "Encrypt private keys with IDEA",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+#endif
+	{
+		.name = "cacerts",
+		.desc = "Only output CA certificates",
+		.type = OPTION_VALUE_OR,
+		.opt.value = &pkcs12_config.options,
+		.value = CACERTS,
+	},
+	{
+		.name = "CAfile",
+		.argname = "file",
+		.desc = "PEM format file of CA certificates",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.CAfile,
+	},
+	{
+		.name = "caname",
+		.argname = "name",
+		.desc = "Use name as CA friendly name (can be used more than once)",
+		.type = OPTION_ARG_FUNC,
+		.opt.argfunc = pkcs12_opt_canames,
+	},
+	{
+		.name = "CApath",
+		.argname = "directory",
+		.desc = "PEM format directory of CA certificates",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.CApath,
+	},
+	{
+		.name = "certfile",
+		.argname = "file",
+		.desc = "Add all certs in file",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.certfile,
+	},
+	{
+		.name = "certpbe",
+		.argname = "alg",
+		.desc = "Specify certificate PBE algorithm (default RC2-40)",
+		.type = OPTION_ARG_FUNC,
+		.opt.argfunc = pkcs12_opt_cert_pbe,
+	},
+	{
+		.name = "chain",
+		.desc = "Add certificate chain",
+		.type = OPTION_FLAG,
+		.opt.flag = &pkcs12_config.chain,
+	},
+	{
+		.name = "clcerts",
+		.desc = "Only output client certificates",
+		.type = OPTION_VALUE_OR,
+		.opt.value = &pkcs12_config.options,
+		.value = CLCERTS,
+	},
+	{
+		.name = "CSP",
+		.argname = "name",
+		.desc = "Microsoft CSP name",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.csp_name,
+	},
+	{
+		.name = "descert",
+		.desc = "Encrypt PKCS#12 certificates with triple DES (default RC2-40)",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.cert_pbe,
+		.value = NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
+	},
+	{
+		.name = "export",
+		.desc = "Output PKCS#12 file",
+		.type = OPTION_FLAG,
+		.opt.flag = &pkcs12_config.export_cert,
+	},
+	{
+		.name = "in",
+		.argname = "file",
+		.desc = "Input filename",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.infile,
+	},
+	{
+		.name = "info",
+		.desc = "Give info about PKCS#12 structure",
+		.type = OPTION_VALUE_OR,
+		.opt.value = &pkcs12_config.options,
+		.value = INFO,
+	},
+	{
+		.name = "inkey",
+		.argname = "file",
+		.desc = "Private key if not infile",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.keyname,
+	},
+	{
+		.name = "keyex",
+		.desc = "Set MS key exchange type",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.keytype,
+		.value = KEY_EX,
+	},
+	{
+		.name = "keypbe",
+		.argname = "alg",
+		.desc = "Specify private key PBE algorithm (default 3DES)",
+		.type = OPTION_ARG_FUNC,
+		.opt.argfunc = pkcs12_opt_key_pbe,
+	},
+	{
+		.name = "keysig",
+		.desc = "Set MS key signature type",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.keytype,
+		.value = KEY_SIG,
+	},
+	{
+		.name = "LMK",
+		.desc = "Add local machine keyset attribute to private key",
+		.type = OPTION_FLAG,
+		.opt.flag = &pkcs12_config.add_lmk,
+	},
+	{
+		.name = "macalg",
+		.argname = "alg",
+		.desc = "Digest algorithm used in MAC (default SHA1)",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.macalg,
+	},
+	{
+		.name = "maciter",
+		.desc = "Use MAC iteration",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.maciter,
+		.value = PKCS12_DEFAULT_ITER,
+	},
+	{
+		.name = "name",
+		.argname = "name",
+		.desc = "Use name as friendly name",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.name,
+	},
+	{
+		.name = "nocerts",
+		.desc = "Don't output certificates",
+		.type = OPTION_VALUE_OR,
+		.opt.value = &pkcs12_config.options,
+		.value = NOCERTS,
+	},
+	{
+		.name = "nodes",
+		.desc = "Don't encrypt private keys",
+		.type = OPTION_ARGV_FUNC,
+		.opt.argvfunc = pkcs12_opt_enc,
+	},
+	{
+		.name = "noiter",
+		.desc = "Don't use encryption iteration",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.iter,
+		.value = 1,
+	},
+	{
+		.name = "nokeys",
+		.desc = "Don't output private keys",
+		.type = OPTION_VALUE_OR,
+		.opt.value = &pkcs12_config.options,
+		.value = NOKEYS,
+	},
+	{
+		.name = "nomac",
+		.desc = "Don't generate MAC",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.maciter,
+		.value = -1,
+	},
+	{
+		.name = "nomaciter",
+		.desc = "Don't use MAC iteration",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.maciter,
+		.value = 1,
+	},
+	{
+		.name = "nomacver",
+		.desc = "Don't verify MAC",
+		.type = OPTION_VALUE,
+		.opt.value = &pkcs12_config.macver,
+		.value = 0,
+	},
+	{
+		.name = "noout",
+		.desc = "Don't output anything, just verify",
+		.type = OPTION_VALUE_OR,
+		.opt.value = &pkcs12_config.options,
+		.value = (NOKEYS | NOCERTS),
+	},
+	{
+		.name = "out",
+		.argname = "file",
+		.desc = "Output filename",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.outfile,
+	},
+	{
+		.name = "passin",
+		.argname = "arg",
+		.desc = "Input file passphrase source",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.passargin,
+	},
+	{
+		.name = "passout",
+		.argname = "arg",
+		.desc = "Output file passphrase source",
+		.type = OPTION_ARG,
+		.opt.arg = &pkcs12_config.passargout,
+	},
+	{
+		.name = "password",
+		.argname = "arg",
+		.desc = "Set import/export password source",
+		.type = OPTION_ARG_FUNC,
+		.opt.argfunc = pkcs12_opt_passarg,
+	},
+	{
+		.name = "twopass",
+		.desc = "Separate MAC, encryption passwords",
+		.type = OPTION_FLAG,
+		.opt.flag = &pkcs12_config.twopass,
+	},
+	{ NULL },
+};
+
+static void
+pkcs12_usage(void)
+{
+	fprintf(stderr, "usage: pkcs12 [-aes128 | -aes192 | -aes256 |");
+	fprintf(stderr, " -camellia128 |\n");
+	fprintf(stderr, "    -camellia192 | -camellia256 | -des | -des3 |");
+	fprintf(stderr, " -idea]\n");
+	fprintf(stderr, "    [-cacerts] [-CAfile file] [-caname name]\n");
+	fprintf(stderr, "    [-CApath directory] [-certfile file]");
+	fprintf(stderr, " [-certpbe alg]\n");
+	fprintf(stderr, "    [-chain] [-clcerts] [-CSP name] [-descert]");
+	fprintf(stderr, " [-export]\n");
+	fprintf(stderr, "    [-in file] [-info] [-inkey file] [-keyex]");
+	fprintf(stderr, " [-keypbe alg]\n");
+	fprintf(stderr, "    [-keysig] [-LMK] [-macalg alg] [-maciter]");
+	fprintf(stderr, " [-name name]\n");
+	fprintf(stderr, "    [-nocerts] [-nodes] [-noiter] [-nokeys]");
+	fprintf(stderr, " [-nomac]\n");
+	fprintf(stderr, "    [-nomaciter] [-nomacver] [-noout] [-out file]\n");
+	fprintf(stderr, "    [-passin arg] [-passout arg] [-password arg]");
+	fprintf(stderr, " [-twopass]\n\n");
+	options_usage(pkcs12_options);
+	fprintf(stderr, "\n");
+}
+
 int
 pkcs12_main(int argc, char **argv)
 {
 	BIO *in = NULL, *out = NULL;
-	char **args;
 	PKCS12 *p12 = NULL;
 	char pass[50], macpass[50];
-	int badarg = 0;
 	int ret = 1;
 	char *cpass = NULL, *mpass = NULL;
 	char *passin = NULL, *passout = NULL;
@@ -146,217 +550,8 @@ pkcs12_main(int argc, char **argv)
 	pkcs12_config.maciter = PKCS12_DEFAULT_ITER;
 	pkcs12_config.macver = 1;
 
-	args = argv + 1;
-
-	while (*args) {
-		if (*args[0] == '-') {
-			if (!strcmp(*args, "-nokeys"))
-				pkcs12_config.options |= NOKEYS;
-			else if (!strcmp(*args, "-keyex"))
-				pkcs12_config.keytype = KEY_EX;
-			else if (!strcmp(*args, "-keysig"))
-				pkcs12_config.keytype = KEY_SIG;
-			else if (!strcmp(*args, "-nocerts"))
-				pkcs12_config.options |= NOCERTS;
-			else if (!strcmp(*args, "-clcerts"))
-				pkcs12_config.options |= CLCERTS;
-			else if (!strcmp(*args, "-cacerts"))
-				pkcs12_config.options |= CACERTS;
-			else if (!strcmp(*args, "-noout"))
-				pkcs12_config.options |= (NOKEYS | NOCERTS);
-			else if (!strcmp(*args, "-info"))
-				pkcs12_config.options |= INFO;
-			else if (!strcmp(*args, "-chain"))
-				pkcs12_config.chain = 1;
-			else if (!strcmp(*args, "-twopass"))
-				pkcs12_config.twopass = 1;
-			else if (!strcmp(*args, "-nomacver"))
-				pkcs12_config.macver = 0;
-			else if (!strcmp(*args, "-descert"))
-				pkcs12_config.cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-			else if (!strcmp(*args, "-export"))
-				pkcs12_config.export_cert = 1;
-			else if (!strcmp(*args, "-des"))
-				pkcs12_config.enc = EVP_des_cbc();
-			else if (!strcmp(*args, "-des3"))
-				pkcs12_config.enc = EVP_des_ede3_cbc();
-#ifndef OPENSSL_NO_IDEA
-			else if (!strcmp(*args, "-idea"))
-				pkcs12_config.enc = EVP_idea_cbc();
-#endif
-#ifndef OPENSSL_NO_AES
-			else if (!strcmp(*args, "-aes128"))
-				pkcs12_config.enc = EVP_aes_128_cbc();
-			else if (!strcmp(*args, "-aes192"))
-				pkcs12_config.enc = EVP_aes_192_cbc();
-			else if (!strcmp(*args, "-aes256"))
-				pkcs12_config.enc = EVP_aes_256_cbc();
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-			else if (!strcmp(*args, "-camellia128"))
-				pkcs12_config.enc = EVP_camellia_128_cbc();
-			else if (!strcmp(*args, "-camellia192"))
-				pkcs12_config.enc = EVP_camellia_192_cbc();
-			else if (!strcmp(*args, "-camellia256"))
-				pkcs12_config.enc = EVP_camellia_256_cbc();
-#endif
-			else if (!strcmp(*args, "-noiter"))
-				pkcs12_config.iter = 1;
-			else if (!strcmp(*args, "-maciter"))
-				pkcs12_config.maciter = PKCS12_DEFAULT_ITER;
-			else if (!strcmp(*args, "-nomaciter"))
-				pkcs12_config.maciter = 1;
-			else if (!strcmp(*args, "-nomac"))
-				pkcs12_config.maciter = -1;
-			else if (!strcmp(*args, "-macalg"))
-				if (args[1]) {
-					args++;
-					pkcs12_config.macalg = *args;
-				} else
-					badarg = 1;
-			else if (!strcmp(*args, "-nodes"))
-				pkcs12_config.enc = NULL;
-			else if (!strcmp(*args, "-certpbe")) {
-				if (!set_pbe(bio_err, &pkcs12_config.cert_pbe, *++args))
-					badarg = 1;
-			} else if (!strcmp(*args, "-keypbe")) {
-				if (!set_pbe(bio_err, &pkcs12_config.key_pbe, *++args))
-					badarg = 1;
-			} else if (!strcmp(*args, "-inkey")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.keyname = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-certfile")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.certfile = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-name")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.name = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-LMK"))
-				pkcs12_config.add_lmk = 1;
-			else if (!strcmp(*args, "-CSP")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.csp_name = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-caname")) {
-				if (args[1]) {
-					args++;
-					if (!pkcs12_config.canames)
-						pkcs12_config.canames = sk_OPENSSL_STRING_new_null();
-					sk_OPENSSL_STRING_push(pkcs12_config.canames, *args);
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-in")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.infile = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-out")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.outfile = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-passin")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.passargin = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-passout")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.passargout = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-password")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.passarg = *args;
-					pkcs12_config.noprompt = 1;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-CApath")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.CApath = *args;
-				} else
-					badarg = 1;
-			} else if (!strcmp(*args, "-CAfile")) {
-				if (args[1]) {
-					args++;
-					pkcs12_config.CAfile = *args;
-				} else
-					badarg = 1;
-			} else
-				badarg = 1;
-
-		} else
-			badarg = 1;
-		args++;
-	}
-
-	if (badarg) {
-		BIO_printf(bio_err, "Usage: pkcs12 [options]\n");
-		BIO_printf(bio_err, "where options are\n");
-		BIO_printf(bio_err, "-export       output PKCS12 file\n");
-		BIO_printf(bio_err, "-chain        add certificate chain\n");
-		BIO_printf(bio_err, "-inkey file   private key if not infile\n");
-		BIO_printf(bio_err, "-certfile f   add all certs in f\n");
-		BIO_printf(bio_err, "-CApath arg   - PEM format directory of CA's\n");
-		BIO_printf(bio_err, "-CAfile arg   - PEM format file of CA's\n");
-		BIO_printf(bio_err, "-name \"name\"  use name as friendly name\n");
-		BIO_printf(bio_err, "-caname \"nm\"  use nm as CA friendly name (can be used more than once).\n");
-		BIO_printf(bio_err, "-in  infile   input filename\n");
-		BIO_printf(bio_err, "-out outfile  output filename\n");
-		BIO_printf(bio_err, "-noout        don't output anything, just verify.\n");
-		BIO_printf(bio_err, "-nomacver     don't verify MAC.\n");
-		BIO_printf(bio_err, "-nocerts      don't output certificates.\n");
-		BIO_printf(bio_err, "-clcerts      only output client certificates.\n");
-		BIO_printf(bio_err, "-cacerts      only output CA certificates.\n");
-		BIO_printf(bio_err, "-nokeys       don't output private keys.\n");
-		BIO_printf(bio_err, "-info         give info about PKCS#12 structure.\n");
-		BIO_printf(bio_err, "-des          encrypt private keys with DES\n");
-		BIO_printf(bio_err, "-des3         encrypt private keys with triple DES (default)\n");
-#ifndef OPENSSL_NO_IDEA
-		BIO_printf(bio_err, "-idea         encrypt private keys with idea\n");
-#endif
-#ifndef OPENSSL_NO_AES
-		BIO_printf(bio_err, "-aes128, -aes192, -aes256\n");
-		BIO_printf(bio_err, "              encrypt PEM output with cbc aes\n");
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-		BIO_printf(bio_err, "-camellia128, -camellia192, -camellia256\n");
-		BIO_printf(bio_err, "              encrypt PEM output with cbc camellia\n");
-#endif
-		BIO_printf(bio_err, "-nodes        don't encrypt private keys\n");
-		BIO_printf(bio_err, "-noiter       don't use encryption iteration\n");
-		BIO_printf(bio_err, "-nomaciter    don't use MAC iteration\n");
-		BIO_printf(bio_err, "-maciter      use MAC iteration\n");
-		BIO_printf(bio_err, "-nomac        don't generate MAC\n");
-		BIO_printf(bio_err, "-twopass      separate MAC, encryption passwords\n");
-		BIO_printf(bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");
-		BIO_printf(bio_err, "-certpbe alg  specify certificate PBE algorithm (default RC2-40)\n");
-		BIO_printf(bio_err, "-keypbe alg   specify private key PBE algorithm (default 3DES)\n");
-		BIO_printf(bio_err, "-macalg alg   digest algorithm used in MAC (default SHA1)\n");
-		BIO_printf(bio_err, "-keyex        set MS key exchange type\n");
-		BIO_printf(bio_err, "-keysig       set MS key signature type\n");
-		BIO_printf(bio_err, "-password p   set import/export password source\n");
-		BIO_printf(bio_err, "-passin p     input file pass phrase source\n");
-		BIO_printf(bio_err, "-passout p    output file pass phrase source\n");
-		BIO_printf(bio_err, "-CSP name     Microsoft CSP name\n");
-		BIO_printf(bio_err, "-LMK          Add local machine keyset attribute to private key\n");
+	if (options_parse(argc, argv, pkcs12_options, NULL, NULL) != 0) {
+		pkcs12_usage();
 		goto end;
 	}