apps: fail skeyutl -genkey on bad -skeyopt

app_params_new_from_opts() returns NULL when a key option cannot be
converted, either because the key management does not settle the
parameter or because the opt:value separator is missing.  skeyutl
ignored that and generated the key without the requested options, only
printing the parameter error to stderr and still exiting successfully.

Bail out instead, the way the mac, kdf and enc applications do.  A NULL
return is only an error when key options were actually given, as
app_params_new_from_opts() also returns NULL for an empty option list.

Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Mon Jul 27 09:06:03 2026
(Merged from https://github.com/openssl/openssl/pull/32036)

diff --git a/apps/skeyutl.c b/apps/skeyutl.c
index 46461781ff57cf8f6a179d46a38c69bf8fc27ca7..cb9a8131de0b807383fdee8cf1138285230a5f1a 100644 (file)
--- a/apps/skeyutl.c
+++ b/apps/skeyutl.c
@@ -102,6 +102,9 @@ int skeyutl_main(int argc, char **argv)
             goto end;
         params = app_params_new_from_opts(skeyopts,
             EVP_SKEYMGMT_get0_gen_settable_params(mgmt));
+        /* A NULL return is an error only if key options were given */
+        if (skeyopts != NULL && params == NULL)
+            goto end;
 
         skey = EVP_SKEY_generate(app_get0_libctx(),
             skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher),