[openssl/openssl] 02047e: apps: fail skeyutl -genkey on bad -skeyopt

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 02047ece21cf8f6126fdf4119a463ef4d950b1cc
      https://github.com/openssl/openssl/commit/02047ece21cf8f6126fdf4119a463ef4d950b1cc
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M apps/skeyutl.c

  Log Message:
  -----------
  apps: fail skeyutl -genkey on bad -skeyopt

app_params_new_from_opts() returns NULL when a key option cannot be
converted, either because the key management does not settle the
parameter or because the opt:value separator is missing.  skeyutl
ignored that and generated the key without the requested options, only
printing the parameter error to stderr and still exiting successfully.

Bail out instead, the way the mac, kdf and enc applications do.  A NULL
return is only an error when key options were actually given, as
app_params_new_from_opts() also returns NULL for an empty option list.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jul 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/32036)


  Commit: 22f58fd9cce68d32deb8a08ba54fcf2d2eaf0135
      https://github.com/openssl/openssl/commit/22f58fd9cce68d32deb8a08ba54fcf2d2eaf0135
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M test/fake_cipherprov.c

  Log Message:
  -----------
  test: support key options in the fake cipher provider

The fake cipher key management accepted a key name and raw key bytes on
generation and import, but did not advertise them as settable
parameters, so applications converting opt:value strings with
OSSL_PARAM_allocate_from_text() had nothing to look them up in.

Add the settable parameter table for both generation and import, and
report the key name as the key id, so that setting it has an observable
effect.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jul 27 09:06:05 2026
(Merged from https://github.com/openssl/openssl/pull/32036)


  Commit: 851a95ccfbcaf17eb84b4d63f107c76ec55c513b
      https://github.com/openssl/openssl/commit/851a95ccfbcaf17eb84b4d63f107c76ec55c513b
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M test/recipes/20-test_skeyutl.t

  Log Message:
  -----------
  apps: test skeyutl -skeyopt handling

Cover the -skeyopt option of skeyutl using the fake cipher provider: a
key name passed as a key option shows up in the reported key id, while
an option unknown to the key management and an option missing the
opt:value separator both make the command fail.

Assisted-by: Claude:claude-opus-4-8

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jul 27 09:06:06 2026
(Merged from https://github.com/openssl/openssl/pull/32036)


Compare: https://github.com/openssl/openssl/compare/74b1b8909e76...851a95ccfbca

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/74b1b8-851a95%40github.com.