examples: use the selected algorithm for the default public key

[yosuke-wolfssl]

Problem

examples/sftpclient/sftpclient.c passed a literal 0 for ClientUsePubKey()'s userEcc argument while passing the real userEcc to ClientSetPrivateKey(). With no -i given, that argument selects between the two compiled-in default keys. Under WOLFSSH_NO_RSA the RSA branch is compiled out entirely, so ret stays at its initial 0 and the call reports success having loaded nothing — the client then offers an ECC private key with no matching public key and public-key auth fails.

Two adjacent instances of the same class: examples/scpclient/scpclient.c hardcoded 0 on both calls with no WOLFSSH_NO_RSA fallback, and examples/client/client.c had no fallback either.

Client, WOLFSSH_NO_RSA	Before	After
wolfsftp	public key not loaded	ECC default
wolfscp	neither key loaded	ECC default
client	private key not loaded	ECC default

Fix (examples/client/common.c)

• ClientSetPrivateKey() / ClientUsePubKey() — all four built-in key selections gain an #else that names the missing algorithm on stderr and returns WS_NOT_COMPILED, so a compiled-out default fails at startup instead of silently. Only the privKeyName/pubKeyName == NULL path reaches these arms, so -i and -j are unaffected.
• sftpclient.c passes userEcc instead of 0.
• scpclient.c gains a userEcc and passes it to both calls.
• client.c and scpclient.c default userEcc = 1 under WOLFSSH_NO_RSA, as sftpclient already did. Required, not cosmetic: without it the new WS_NOT_COMPILED converts their silent no-key-loaded into err_sys() at startup.

Closes f-8829.

Tests

scripts/sftp.test and scripts/scp.test authenticate with -u jill -P upthehill, so the built-in public-key path has no coverage today. Verified with an out-of-tree harness driving each client at echoserver with -u hansel and no -i: both clients fail before the fix under WOLFSSH_NO_RSA, pass after, and pass throughout with RSA enabled. Not added to the repo — CI runs no WOLFSSH_NO_RSA job for it to execute under. Happy to add both if a job is wanted.

Verification

• gcc-13 -O2 -Werror, 7 configs (--enable-all, Zephyr defines, sftp-only, scp-only, sshd, smallstack, -DWOLFSSH_NO_RSA): clean.
• make check default config: 11 passed, 1 skipped, 0 failed.
• make check under -DWOLFSSH_NO_RSA: 10 passed, 1 skipped, 1 failed. The failure is apps/wolfsshd/test/test_configuration, pre-existing and unrelated — its BuildAuthKeysLine() hardcodes "ssh-rsa", and that binary links only apps/wolfsshd/*.c.

[Copilot]

Pull request overview

This PR fixes the example clients’ default key-selection logic so that, when RSA support is compiled out (WOLFSSH_NO_RSA), the clients select the ECC built-in defaults (or fail explicitly) rather than silently succeeding without loading any key material. This aligns the private/public key selection paths and avoids public-key auth failures caused by mismatched or missing default keys.

Changes:

• Update example clients to pass the selected userEcc algorithm choice consistently to ClientUsePubKey() (and default to ECC under WOLFSSH_NO_RSA where needed).
• Harden ClientSetPrivateKey() and ClientUsePubKey() to return WS_NOT_COMPILED (with a clear stderr message) when a requested built-in default algorithm is compiled out.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
examples/sftpclient/sftpclient.c	Passes userEcc (instead of literal 0) to ClientUsePubKey() to keep default pubkey selection consistent with the selected algorithm.
examples/scpclient/scpclient.c	Introduces userEcc, defaults it to ECC under WOLFSSH_NO_RSA, and threads it through both private/public key selection calls.
examples/client/common.c	Adds explicit #else error handling for missing compiled-in RSA/ECC default keys, returning WS_NOT_COMPILED instead of silently succeeding.
examples/client/client.c	Defaults userEcc = 1 under WOLFSSH_NO_RSA before loading keys so startup fails less confusingly and uses ECC defaults where appropriate.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1170

Scan targets checked: wolfssh-bugs, wolfssh-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

examples/client/common.c:1090

• Similarly, in ClientUsePubKey() under WOLFSSH_NO_RSA && WOLFSSH_NO_ECC, only the size/type are cleared. If a previous test case loaded a public key/cert (setting userPublicKeyAlloc/pubKeyLoaded), this branch can leave stale state behind and still bias ClientUserAuth() toward public-key auth or leak heap memory.

    #if defined(WOLFSSH_NO_RSA) && defined(WOLFSSH_NO_ECC)
        /* No built-in key to load. Leave the client to authenticate
         * some other way rather than failing here. */
        userPublicKeySz = 0;
        userPublicKeyType = NULL;
        (void)userEcc;
        (void)heap;
    #else

examples/client/common.c:1018

• In the WOLFSSH_NO_RSA && WOLFSSH_NO_ECC branch, the code clears only size/type but leaves other global key state (e.g., userPrivateKey pointer, userPrivateKeyAlloc, userPrivateKeyTypeSz, isPrivate) unchanged. In a long-lived process running multiple test cases, this can leave stale/heap-allocated key pointers around (and ClientFreeBuffers() won’t free them when privKeyName is NULL), causing leaks or confusing auth behavior.

This issue also appears on line 1083 of the same file.

    #if defined(WOLFSSH_NO_RSA) && defined(WOLFSSH_NO_ECC)
        /* No built-in key to load. Leave the client to authenticate
         * some other way rather than failing here. */
        userPrivateKeySz = 0;
        userPrivateKeyType = NULL;
        (void)userEcc;
        (void)heap;
    #else

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1170

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅