From 609b8d4d8008729af2478029b8e25ae4359ad56b Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Tue, 15 Sep 2026 11:15:59 +0200 Subject: pki: T9323: give elliptic curve keys their own constructor create_private_key() took one "size" for every key type, but the number means entirely different things per type: for RSA and DSA it is a modulus size, for EC it selects a curve. CodeQL is not path sensitive across the key_type comparison, so it follows the 256 an EC caller passes into the RSA and DSA branches that caller can never reach, and reports pki.py as generating 256 bit RSA and DSA keys. Build elliptic curve keys in create_ec_private_key() instead and route the op mode generator and the OpenVPN smoketest there, so no curve size ever enters the function that also builds RSA and DSA keys. create_private_key() now refuses a key type it does not build rather than returning None, so a caller cannot drift back into the old shape unnoticed. --- src/op_mode/pki.py | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src') diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index 575aa89e0..d53be1f92 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -41,6 +41,7 @@ from vyos.pki import create_certificate from vyos.pki import create_certificate_request from vyos.pki import create_certificate_revocation_list from vyos.pki import create_private_key +from vyos.pki import create_ec_private_key from vyos.pki import create_dh_parameters from vyos.pki import load_certificate from vyos.pki import load_certificate_request @@ -466,6 +467,12 @@ def generate_private_key(): valid_responses=size_valid, ) + # An elliptic curve key is picked by curve, not by modulus size, so it gets + # its own constructor - that keeps the number below out of the function that + # also builds RSA and DSA keys + if key_type == 'ec': + return create_ec_private_key(size), key_type + return create_private_key(key_type, size), key_type -- cgit v1.2.3