[PATCH] keytoc: fix env provided keyspec handling

[PATCH] keytoc: fix env provided keyspec handling

[Marco Felsch]

Currently the env provided keyspec is resolved during the gen_key() step
by making use of the try_resolve_env(). This is wrong because it will
set the complete <hint>:<key> string for the 'keyname' and 'path'.

To fix this the resolve step must happen during the main-loop as first step
because the main-loop is doing the 'keyname' and 'path' split already.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
---
 scripts/keytoc.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/scripts/keytoc.c b/scripts/keytoc.c
index c92465707f65..c1e8c51d7a7e 100644
--- a/scripts/keytoc.c
+++ b/scripts/keytoc.c
@@ -615,10 +615,6 @@ static int gen_key(const char *keyname, const char *path)
 	char *tmp, *key_name_c;
 
 	/* key name handling */
-	keyname = try_resolve_env(keyname);
-	if (!keyname)
-		exit(1);
-
 	tmp = key_name_c = strdup(keyname);
 
 	while (*tmp) {
@@ -628,10 +624,6 @@ static int gen_key(const char *keyname, const char *path)
 	}
 
 	/* path/URI handling */
-	path = try_resolve_env(path);
-	if (!path)
-		exit(1);
-
 	if (!strncmp(path, "pkcs11:", 7)) {
 		ret = engine_get_pub_key(path, &key);
 		if (ret)
@@ -709,6 +701,11 @@ int main(int argc, char *argv[])
 		char *keyname = NULL;
 		char *path, *freep = NULL;
 
+		/* Check if the keyspec is provided by the ENV first */
+		keyspec = try_resolve_env(keyspec);
+		if (!keyspec)
+			exit(1);
+
 		if (!strncmp(keyspec, "pkcs11:", 7)) {
 			path = keyspec;
 		} else {
-- 
2.39.5

Re: [PATCH] keytoc: fix env provided keyspec handling

[Marco Felsch]

On 25-07-23, Marco Felsch wrote:
> Currently the env provided keyspec is resolved during the gen_key() step
> by making use of the try_resolve_env(). This is wrong because it will
> set the complete <hint>:<key> string for the 'keyname' and 'path'.
> 
> To fix this the resolve step must happen during the main-loop as first step
> because the main-loop is doing the 'keyname' and 'path' split already.
> 
> Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
> ---
>  scripts/keytoc.c | 13 +++++--------
>  1 file changed, 5 insertions(+), 8 deletions(-)
> 
> diff --git a/scripts/keytoc.c b/scripts/keytoc.c
> index c92465707f65..c1e8c51d7a7e 100644
> --- a/scripts/keytoc.c
> +++ b/scripts/keytoc.c
> @@ -615,10 +615,6 @@ static int gen_key(const char *keyname, const char *path)
>  	char *tmp, *key_name_c;
>  
>  	/* key name handling */
> -	keyname = try_resolve_env(keyname);
> -	if (!keyname)
> -		exit(1);
> -
>  	tmp = key_name_c = strdup(keyname);
>  
>  	while (*tmp) {
> @@ -628,10 +624,6 @@ static int gen_key(const char *keyname, const char *path)
>  	}
>  
>  	/* path/URI handling */
> -	path = try_resolve_env(path);
> -	if (!path)
> -		exit(1);
> -
>  	if (!strncmp(path, "pkcs11:", 7)) {
>  		ret = engine_get_pub_key(path, &key);
>  		if (ret)
> @@ -709,6 +701,11 @@ int main(int argc, char *argv[])
>  		char *keyname = NULL;
>  		char *path, *freep = NULL;
>  
> +		/* Check if the keyspec is provided by the ENV first */
> +		keyspec = try_resolve_env(keyspec);

This throws a warning which I didn't noticed.. I will send a v2.

Regards,
  Marco


> +		if (!keyspec)
> +			exit(1);
> +
>  		if (!strncmp(keyspec, "pkcs11:", 7)) {
>  			path = keyspec;
>  		} else {
> -- 
> 2.39.5
> 
> 
>