From 8ffa347690740d7082fc41617147f6750f5486a3 Mon Sep 17 00:00:00 2001 From: Yosuke Shimizu Date: Fri, 14 Aug 2026 13:23:02 +0900 Subject: [PATCH] examples: use the selected algorithm for the default public key - sftpclient passes userEcc to ClientUsePubKey(), and scpclient to both ClientSetPrivateKey() and ClientUsePubKey(), in place of a hardcoded 0. - scpclient gains a userEcc; it and client default it to 1 under WOLFSSH_NO_RSA, as sftpclient already did. - ClientSetPrivateKey() and ClientUsePubKey() name the missing algorithm on stderr and return WS_NOT_COMPILED when the built-in key they select is compiled out. - Both skip the built-in load entirely when neither RSA nor ECC is compiled in, clearing the key size and type and returning success so password-only authentication still runs. ClientUsePubKey()'s buffer pointer moves inside the guard so it is not left unused. Issue: F-8829 --- examples/client/client.c | 4 ++++ examples/client/common.c | 30 ++++++++++++++++++++++++++++++ examples/scpclient/scpclient.c | 9 +++++++-- examples/sftpclient/sftpclient.c | 2 +- 4 files changed, 42 insertions(+), 3 deletions(-) diff --git a/examples/client/client.c b/examples/client/client.c index 76638f05d..f9321bda3 100644 --- a/examples/client/client.c +++ b/examples/client/client.c @@ -895,6 +895,10 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args) err_sys("You must specify a password for the TPM key"); } #endif +#ifdef WOLFSSH_NO_RSA + userEcc = 1; +#endif + ret = ClientSetPrivateKey(privKeyName, userEcc, NULL, tpmKeyAuth); if (ret != 0) { err_sys("Error setting private key"); diff --git a/examples/client/common.c b/examples/client/common.c index 818b94f74..23ce3896f 100644 --- a/examples/client/common.c +++ b/examples/client/common.c @@ -1008,12 +1008,23 @@ int ClientSetPrivateKey(const char* privKeyName, int userEcc, (void)tpmKeyAuth; /* Not used */ if (privKeyName == NULL) { + #if defined(WOLFSSH_NO_RSA) && defined(WOLFSSH_NO_ECC) + /* No built-in key to load. Leave the client to authenticate + * some other way rather than failing here. */ + userPrivateKeySz = 0; + userPrivateKeyType = NULL; + (void)userEcc; + (void)heap; + #else if (userEcc) { #ifndef WOLFSSH_NO_ECC userPrivateKeySz = sizeof(userPrivateKeyBuf); ret = wolfSSH_ReadKey_buffer(hanselPrivateEcc, hanselPrivateEccSz, WOLFSSH_FORMAT_ASN1, &userPrivateKey, &userPrivateKeySz, &userPrivateKeyType, &userPrivateKeyTypeSz, heap); + #else + fprintf(stderr, "ECC not compiled in, no default private key\n"); + ret = WS_NOT_COMPILED; #endif } else { @@ -1022,9 +1033,13 @@ int ClientSetPrivateKey(const char* privKeyName, int userEcc, ret = wolfSSH_ReadKey_buffer(hanselPrivateRsa, hanselPrivateRsaSz, WOLFSSH_FORMAT_ASN1, &userPrivateKey, &userPrivateKeySz, &userPrivateKeyType, &userPrivateKeyTypeSz, heap); + #else + fprintf(stderr, "RSA not compiled in, no default private key\n"); + ret = WS_NOT_COMPILED; #endif } isPrivate = 1; + #endif } else { #if defined(WOLFSSH_TPM) @@ -1065,6 +1080,14 @@ int ClientUsePubKey(const char* pubKeyName, int userEcc, void* heap) int ret = 0; if (pubKeyName == NULL) { + #if defined(WOLFSSH_NO_RSA) && defined(WOLFSSH_NO_ECC) + /* No built-in key to load. Leave the client to authenticate + * some other way rather than failing here. */ + userPublicKeySz = 0; + userPublicKeyType = NULL; + (void)userEcc; + (void)heap; + #else byte* p = userPublicKey; userPublicKeySz = sizeof(userPublicKeyBuf); @@ -1074,6 +1097,9 @@ int ClientUsePubKey(const char* pubKeyName, int userEcc, void* heap) (word32)strlen(hanselPublicEcc), WOLFSSH_FORMAT_SSH, &p, &userPublicKeySz, &userPublicKeyType, &userPublicKeyTypeSz, heap); + #else + fprintf(stderr, "ECC not compiled in, no default public key\n"); + ret = WS_NOT_COMPILED; #endif } else { @@ -1082,9 +1108,13 @@ int ClientUsePubKey(const char* pubKeyName, int userEcc, void* heap) (word32)strlen(hanselPublicRsa), WOLFSSH_FORMAT_SSH, &p, &userPublicKeySz, &userPublicKeyType, &userPublicKeyTypeSz, heap); + #else + fprintf(stderr, "RSA not compiled in, no default public key\n"); + ret = WS_NOT_COMPILED; #endif } isPrivate = 1; + #endif } else { #if !defined(NO_FILESYSTEM) && !defined(WOLFSSH_USER_FILESYSTEM) diff --git a/examples/scpclient/scpclient.c b/examples/scpclient/scpclient.c index 08ee73f10..8b817ad5f 100644 --- a/examples/scpclient/scpclient.c +++ b/examples/scpclient/scpclient.c @@ -112,6 +112,7 @@ THREAD_RETURN WOLFSSH_THREAD scp_client(void* args) byte nonBlock = 0; enum copyDir dir = copyNone; int ch; + int userEcc = 0; char* pubKeyName = NULL; char* privKeyName = NULL; char* certName = NULL; @@ -218,7 +219,11 @@ THREAD_RETURN WOLFSSH_THREAD scp_client(void* args) err_sys("Empty path values"); } - ret = ClientSetPrivateKey(privKeyName, 0, NULL, NULL); +#ifdef WOLFSSH_NO_RSA + userEcc = 1; +#endif + + ret = ClientSetPrivateKey(privKeyName, userEcc, NULL, NULL); if (ret != 0) { err_sys("Error setting private key"); } @@ -231,7 +236,7 @@ THREAD_RETURN WOLFSSH_THREAD scp_client(void* args) else #endif { - ret = ClientUsePubKey(pubKeyName, 0, NULL); + ret = ClientUsePubKey(pubKeyName, userEcc, NULL); } if (ret != 0) { err_sys("Error setting public key"); diff --git a/examples/sftpclient/sftpclient.c b/examples/sftpclient/sftpclient.c index e892a71e1..f78c3306d 100644 --- a/examples/sftpclient/sftpclient.c +++ b/examples/sftpclient/sftpclient.c @@ -1709,7 +1709,7 @@ THREAD_RETURN WOLFSSH_THREAD sftpclient_test(void* args) else #endif { - ret = ClientUsePubKey(pubKeyName, 0, heap); + ret = ClientUsePubKey(pubKeyName, userEcc, heap); } if (ret != 0) { err_sys("Error setting public key");