From 406ca9a6f92c92a7a6f236b4fbb60aab0ab9bdb9 Mon Sep 17 00:00:00 2001
From: Yosuke Shimizu <yosuke@wolfssl.com>
Date: Thu, 20 Aug 2026 13:40:09 +0900
Subject: [PATCH] internal: gate public-key auth on every compiled signing
 algorithm

- wolfssh/internal.h derives WOLFSSH_NO_PUBKEY_AUTH when RSA, ECDSA,
  Ed25519, and ML-DSA are all disabled.
- DoUserAuthRequestPublicKey(), the publickey dispatch in
  DoUserAuthRequest(), the ID_USERAUTH_PUBLICKEY case in
  DoUserAuthFailure(), Prepare/BuildUserAuthRequestPublicKey(), and
  GetAllowedAuth() are all guarded by that macro.
- The DoUserAuthFailure() and GetAllowedAuth() guards previously
  omitted Ed25519 and ML-DSA; the DoUserAuthFailure() guard also
  carried a WOLFSSH_TPM term, which is dropped.

Issue: F-10542
---
 src/internal.c     | 18 +++++++-----------
 wolfssh/internal.h |  5 +++++
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/src/internal.c b/src/internal.c
index ed530c940..6295bb6bb 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -9798,8 +9798,7 @@ static int DoUserAuthRequestEd25519(WOLFSSH* ssh,
 }
 #endif /* !WOLFSSH_NO_ED25519 */
 
-#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) \
-    || !defined(WOLFSSH_NO_ED25519) || !defined(WOLFSSH_NO_MLDSA)
+#ifndef WOLFSSH_NO_PUBKEY_AUTH
 /* Utility for DoUserAuthRequest() */
 static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
                                       byte* buf, word32 len, word32* idx)
@@ -10342,7 +10341,7 @@ static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
     WLOG(WS_LOG_DEBUG, "Leaving DoUserAuthRequestPublicKey(), ret = %d", ret);
     return ret;
 }
-#endif /* !WOLFSSH_NO_RSA/ECDSA/ED25519/MLDSA */
+#endif /* !WOLFSSH_NO_PUBKEY_AUTH */
 
 
 static int DoUserAuthRequest(WOLFSSH* ssh,
@@ -10437,8 +10436,7 @@ static int DoUserAuthRequest(WOLFSSH* ssh,
             ret = SendUserAuthKeyboardRequest(ssh, &authData);
         }
 #endif
-#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) \
-    || !defined(WOLFSSH_NO_ED25519) || !defined(WOLFSSH_NO_MLDSA)
+#ifndef WOLFSSH_NO_PUBKEY_AUTH
         else if (authNameId == ID_USERAUTH_PUBLICKEY) {
             authData.sf.publicKey.dataToSign = buf + *idx;
             ret = DoUserAuthRequestPublicKey(ssh, &authData, buf, len, &begin);
@@ -10515,8 +10513,7 @@ static int DoUserAuthFailure(WOLFSSH* ssh,
                             }
                             break;
 #endif
-#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) || \
-    defined(WOLFSSH_TPM)
+#ifndef WOLFSSH_NO_PUBKEY_AUTH
                         case ID_USERAUTH_PUBLICKEY:
                             authType |= WOLFSSH_USERAUTH_PUBLICKEY;
                             break;
@@ -18816,8 +18813,7 @@ static int BuildUserAuthRequestMlDsa(WOLFSSH* ssh,
 #endif /* !WOLFSSH_NO_MLDSA */
 
 
-#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) \
-    || !defined(WOLFSSH_NO_ED25519) || !defined(WOLFSSH_NO_MLDSA)
+#ifndef WOLFSSH_NO_PUBKEY_AUTH
 static int PrepareUserAuthRequestPublicKey(WOLFSSH* ssh, word32* payloadSz,
         WS_UserAuthData* authData, WS_KeySignature* keySig)
 {
@@ -19181,7 +19177,7 @@ static int BuildUserAuthRequestPublicKey(WOLFSSH* ssh,
 }
 
 
-#endif /* !WOLFSSH_NO_RSA/ECDSA/ED25519/MLDSA */
+#endif /* !WOLFSSH_NO_PUBKEY_AUTH */
 
 #ifdef WOLFSSH_KEYBOARD_INTERACTIVE
 int SendUserAuthKeyboardResponse(WOLFSSH* ssh)
@@ -19527,7 +19523,7 @@ static int GetAllowedAuth(WOLFSSH* ssh, char* authStr)
 #ifdef WOLFSSH_KEYBOARD_INTERACTIVE
     typeAllowed |= WOLFSSH_USERAUTH_KEYBOARD;
 #endif
-#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA)
+#ifndef WOLFSSH_NO_PUBKEY_AUTH
     typeAllowed |= WOLFSSH_USERAUTH_PUBLICKEY;
 #endif
 
diff --git a/wolfssh/internal.h b/wolfssh/internal.h
index 2afa59892..2135148de 100644
--- a/wolfssh/internal.h
+++ b/wolfssh/internal.h
@@ -365,6 +365,11 @@ extern "C" {
     #undef WOLFSSH_NO_ECDSA
     #define WOLFSSH_NO_ECDSA
 #endif
+#if defined(WOLFSSH_NO_RSA) && defined(WOLFSSH_NO_ECDSA) && \
+    defined(WOLFSSH_NO_ED25519) && defined(WOLFSSH_NO_MLDSA)
+    #undef WOLFSSH_NO_PUBKEY_AUTH
+    #define WOLFSSH_NO_PUBKEY_AUTH
+#endif
 #if defined(WOLFSSH_NO_RSA) || \
     (defined(WOLFSSH_NO_RSA_SHA2_256) && defined(WOLFSSH_NO_RSA_SHA2_512))
     #undef WOLFSSH_NO_OSSH_CERT_RSA