From 41f7da6633d3270468027ab387e3bfbcab4157c6 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Tue, 15 Sep 2026 11:15:48 +0200 Subject: pki: T9323: make the elliptic curve fallback reachable The "default to SECP256R1" branch stored an instance where the other branch stored the class, so the shared call at the end invoked the instance and raised "'SECP256R1' object is not callable". Any curve size without a matching SECPR1 - the very case the default exists for - aborted instead of falling back. Take the default through getattr() so both paths carry the class. --- python/vyos/pki.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'python') diff --git a/python/vyos/pki.py b/python/vyos/pki.py index e9f961911..b014c7234 100644 --- a/python/vyos/pki.py +++ b/python/vyos/pki.py @@ -112,12 +112,10 @@ def encode_dh_parameters(dh_parameters): # EC Helper def get_elliptic_curve(size): - curve_func = None name = f'SECP{size}R1' - if hasattr(ec, name): - curve_func = getattr(ec, name) - else: - curve_func = ec.SECP256R1() # Default to SECP256R1 + # getattr() must yield the class, not an instance - the caller below is the + # one that instantiates it + curve_func = getattr(ec, name, ec.SECP256R1) # Default to SECP256R1 return curve_func() # Creation functions -- cgit v1.2.3