From 583a61b97b30c0bdfc3e1ecceda185b66fe3be41 Mon Sep 17 00:00:00 2001 From: shaunchokshi Date: Wed, 22 Jul 2026 17:16:25 -0400 Subject: [PATCH] internal: allow PEM private-key decode without WOLFSSH_CERTS In wolfSSH_ProcessBuffer() the entire WOLFSSH_FORMAT_PEM branch, including the private-key path, was inside #ifdef WOLFSSH_CERTS. A caller doing wolfSSH_CTX_UsePrivateKey_buffer(..., WOLFSSH_FORMAT_PEM) on a build without certificate support therefore got WS_UNIMPLEMENTED_E, even though decoding a PEM private key has nothing to do with certificates. Move the private-key PEM path (wc_KeyPemToDer) out of the guard. The certificate PEM path (wc_CertPemToDer) stays guarded, and a certificate/CA PEM buffer on a build without WOLFSSH_CERTS still returns WS_UNIMPLEMENTED_E. Tested with an ML-DSA-65 PKCS#8 PEM key via UsePrivateKey_buffer(FORMAT_PEM): without certs, -1017 (WS_UNIMPLEMENTED_E) before, 0 after; with --enable-certs, 0 before and after. Both configurations build warning-free. --- src/internal.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/src/internal.c b/src/internal.c index a5fa0ee3b..ee3336017 100644 --- a/src/internal.c +++ b/src/internal.c @@ -2954,17 +2954,29 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx, WMEMCPY(der, in, inSz); derSz = inSz; } - #ifdef WOLFSSH_CERTS else if (format == WOLFSSH_FORMAT_PEM) { /* The der size will be smaller than the pem size. */ der = (byte*)WMALLOC(inSz, heap, dynamicType); if (der == NULL) return WS_MEMORY_E; - if (type == BUFTYPE_PRIVKEY) + if (type == BUFTYPE_PRIVKEY) { + /* Private-key PEM decoding does not depend on WOLFSSH_CERTS; + * gating it there rejected PEM private keys (e.g. a PKCS#8 ML-DSA + * host key) unless wolfSSH was built with certificate support. */ ret = wc_KeyPemToDer(in, inSz, der, inSz, NULL); - else + } + #ifdef WOLFSSH_CERTS + else { ret = wc_CertPemToDer(in, inSz, der, inSz, wcType); + } + #else + else { + /* Certificate/CA PEM decoding still requires WOLFSSH_CERTS. */ + WFREE(der, heap, dynamicType); + return WS_UNIMPLEMENTED_E; + } + #endif /* WOLFSSH_CERTS */ if (ret < 0) { if (type == BUFTYPE_PRIVKEY) { /* wc_KeyPemToDer may have written partial key material; @@ -2976,7 +2988,6 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx, } derSz = (word32)ret; } - #endif /* WOLFSSH_CERTS */ else { return WS_UNIMPLEMENTED_E; }