pki: T9323: make the elliptic curve fallback reachable

The "default to SECP256R1" branch stored an instance where the other branch
stored the class, so the shared call at the end invoked the instance and
raised "'SECP256R1' object is not callable". Any curve size without a
matching SECP<size>R1 - the very case the default exists for - aborted
instead of falling back.

Take the default through getattr() so both paths carry the class.

1 files changed, 3 insertions, 5 deletions

diff --git a/python/vyos/pki.py b/python/vyos/pki.py
index e9f961911..b014c7234 100644
--- a/python/vyos/pki.py
+++ b/python/vyos/pki.py
@@ -112,12 +112,10 @@ def encode_dh_parameters(dh_parameters):
 # EC Helper
 
 def get_elliptic_curve(size):
-    curve_func = None
     name = f'SECP{size}R1'
-    if hasattr(ec, name):
-        curve_func = getattr(ec, name)
-    else:
-        curve_func = ec.SECP256R1() # Default to SECP256R1
+    # getattr() must yield the class, not an instance - the caller below is the
+    # one that instantiates it
+    curve_func = getattr(ec, name, ec.SECP256R1)  # Default to SECP256R1
     return curve_func()
 
 # Creation functions