From 609b8d4d8008729af2478029b8e25ae4359ad56b Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Tue, 15 Sep 2026 11:15:59 +0200 Subject: pki: T9323: give elliptic curve keys their own constructor create_private_key() took one "size" for every key type, but the number means entirely different things per type: for RSA and DSA it is a modulus size, for EC it selects a curve. CodeQL is not path sensitive across the key_type comparison, so it follows the 256 an EC caller passes into the RSA and DSA branches that caller can never reach, and reports pki.py as generating 256 bit RSA and DSA keys. Build elliptic curve keys in create_ec_private_key() instead and route the op mode generator and the OpenVPN smoketest there, so no curve size ever enters the function that also builds RSA and DSA keys. create_private_key() now refuses a key type it does not build rather than returning None, so a caller cannot drift back into the old shape unnoticed. --- smoketest/scripts/cli/test_interfaces_openvpn.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_interfaces_openvpn.py b/smoketest/scripts/cli/test_interfaces_openvpn.py index 4f1021a36..191fde970 100755 --- a/smoketest/scripts/cli/test_interfaces_openvpn.py +++ b/smoketest/scripts/cli/test_interfaces_openvpn.py @@ -33,7 +33,7 @@ from vyos.utils.process import is_systemd_service_running from vyos.utils.file import read_file from vyos.pki import create_certificate from vyos.pki import create_certificate_request -from vyos.pki import create_private_key +from vyos.pki import create_ec_private_key from vyos.pki import encode_certificate from vyos.pki import encode_private_key from vyos.utils.network import get_interface_config @@ -99,7 +99,7 @@ def generate_pki(): 'organization': 'VyOS', 'common_name': 'VyOS Test', } - key = create_private_key('ec', 256) + key = create_ec_private_key(256) request = create_certificate_request(subject, key) # is_ca gives it both CLIENT_AUTH and SERVER_AUTH, so one certificate # serves either end of a tunnel -- cgit v1.2.3