From cd822cb77020c70656886fd1afd9a6e0bd683db5 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 19 Feb 2024 12:57:22 +0100 Subject: [PATCH] zkey: Fix convert command to accept only keys of type CCA-AESDATA Reject conversion of other key types with a proper error message. Also fix a typo in another error message of the convert command. Signed-off-by: Ingo Franzki Signed-off-by: Steffen Eiden --- zkey/zkey.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/zkey/zkey.c b/zkey/zkey.c index 843e5544..7c909ff0 100644 --- a/zkey/zkey.c +++ b/zkey/zkey.c @@ -2471,7 +2471,7 @@ static int command_convert_file(void) if (g.name != NULL) { warnx("Option '--name|-N' is not valid for " - "re-enciphering a key outside of the repository"); + "converting a key outside of the repository"); util_prg_print_parse_error(); return EXIT_FAILURE; } @@ -2504,6 +2504,15 @@ static int command_convert_file(void) if (secure_key == NULL) return EXIT_FAILURE; + if (!is_cca_aes_data_key(secure_key, secure_key_size)) { + warnx("Only secure keys of type %s can " + "be converted. The secure key '%s' is of type %s", + KEY_TYPE_CCA_AESDATA, g.pos_arg, + get_key_type(secure_key, secure_key_size)); + rc = EXIT_FAILURE; + goto out; + } + rc = validate_secure_key(g.pkey_fd, secure_key, secure_key_size, NULL, &is_old_mk, NULL, g.verbose); if (rc != 0) {