WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

internal: allow PEM private-key decode without WOLFSSH_CERTS 

In wolfSSH_ProcessBuffer() the entire WOLFSSH_FORMAT_PEM branch, including the
private-key path, was inside #ifdef WOLFSSH_CERTS. A caller doing
wolfSSH_CTX_UsePrivateKey_buffer(..., WOLFSSH_FORMAT_PEM) on a build without
certificate support therefore got WS_UNIMPLEMENTED_E, even though decoding a PEM
private key has nothing to do with certificates.

Move the private-key PEM path (wc_KeyPemToDer) out of the guard. The certificate
PEM path (wc_CertPemToDer) stays guarded, and a certificate/CA PEM buffer on a
build without WOLFSSH_CERTS still returns WS_UNIMPLEMENTED_E.

Tested with an ML-DSA-65 PKCS#8 PEM key via UsePrivateKey_buffer(FORMAT_PEM):
without certs, -1017 (WS_UNIMPLEMENTED_E) before, 0 after; with --enable-certs, 0
before and after. Both configurations build warning-free.
pull/1101/head
shaunchokshi 2026-07-22 17:16:25 -04:00 committed by John Safranek
parent 65fdad2ffb
commit 722678df6a
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/internal.c
View File

@ -2959,17 +2959,29 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx,
WMEMCPY(der, in, inSz);
derSz = inSz;
}
#ifdef WOLFSSH_CERTS
else if (format == WOLFSSH_FORMAT_PEM) {
/* The der size will be smaller than the pem size. */
der = (byte*)WMALLOC(inSz, heap, dynamicType);
if (der == NULL)
return WS_MEMORY_E;
if (type == BUFTYPE_PRIVKEY)
if (type == BUFTYPE_PRIVKEY) {
/* Private-key PEM decoding does not depend on WOLFSSH_CERTS;
* gating it there rejected PEM private keys (e.g. a PKCS#8 ML-DSA
* host key) unless wolfSSH was built with certificate support. */
ret = wc_KeyPemToDer(in, inSz, der, inSz, NULL);
else
}
#ifdef WOLFSSH_CERTS
else {
ret = wc_CertPemToDer(in, inSz, der, inSz, wcType);
}
#else
else {
/* Certificate/CA PEM decoding still requires WOLFSSH_CERTS. */
WFREE(der, heap, dynamicType);
return WS_UNIMPLEMENTED_E;
}
#endif /* WOLFSSH_CERTS */
if (ret < 0) {
if (type == BUFTYPE_PRIVKEY) {
/* wc_KeyPemToDer may have written partial key material;
@ -2981,7 +2993,6 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx,
}
derSz = (word32)ret;
}
#endif /* WOLFSSH_CERTS */
else {
return WS_UNIMPLEMENTED_E;
}