diff --git a/test/testcrypt.py b/test/testcrypt.py
index 0ebc5cd7..a20bc564 100644
--- a/test/testcrypt.py
+++ b/test/testcrypt.py
@@ -139,6 +139,10 @@ def make_argword(arg, argtype, fnname, argindex, to_preserve):
             fnname, argindex, typename, arg))
 
 def make_retval(rettype, word, unpack_strings):
+    if rettype.startswith("opt_"):
+        if word == "NULL":
+            return None
+        rettype = rettype[4:]
     if rettype == "val_string" and unpack_strings:
         retwords = childprocess.funcall("getstring", [word])
         childprocess.funcall("free", [word])
diff --git a/testcrypt.c b/testcrypt.c
index 507253ef..afc21e44 100644
--- a/testcrypt.c
+++ b/testcrypt.c
@@ -505,6 +505,14 @@ static void return_val_string_asciz(strbuf *out, char *s)
     return_val_string(out, sb);
 }
 
+static void return_opt_val_ssh2cipher(strbuf *out, ssh2_cipher *c)
+{
+    if (!c)
+        strbuf_catf(out, "NULL\n");
+    else
+        return_val_ssh2cipher(out, c);
+}
+
 static void handle_hello(BinarySource *in, strbuf *out)
 {
     strbuf_catf(out, "hello, world");
diff --git a/testcrypt.h b/testcrypt.h
index db5c83e8..277d0c5d 100644
--- a/testcrypt.h
+++ b/testcrypt.h
@@ -162,7 +162,7 @@ FUNC2(val_string, ssh1_cipher_decrypt, val_ssh1cipher, val_string_ptrlen)
 /*
  * The ssh2_cipher abstraction, with similar modifications.
  */
-FUNC1(val_ssh2cipher, ssh2_cipher_new, ssh2_cipheralg)
+FUNC1(opt_val_ssh2cipher, ssh2_cipher_new, ssh2_cipheralg)
 FUNC2(void, ssh2_cipher_setiv, val_ssh2cipher, val_string_ptrlen)
 FUNC2(void, ssh2_cipher_setkey, val_ssh2cipher, val_string_ptrlen)
 FUNC2(val_string, ssh2_cipher_encrypt, val_ssh2cipher, val_string_ptrlen)