From b53cc0e98c36a24890c03a7622c368bc47433fd4 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Wed, 28 Feb 2024 21:47:45 +1000 Subject: [PATCH] SSL: Loading bad private key Fix ProcessBufferTryDecodeRsa and ProcessBufferTryDecodeEcc to only clear error when key format isn't known. --- src/ssl.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/ssl.c b/src/ssl.c index aae12f0b2..06e0cec21 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -6543,7 +6543,10 @@ static int ProcessBufferTryDecodeRsa(WOLFSSL_CTX* ctx, WOLFSSL* ssl, "not enabled to try"); ret = WOLFSSL_BAD_FILE; #else - ret = 0; /* continue trying other algorithms */ + if (*keyFormat == 0) { + /* Format unknown so keep trying. */ + ret = 0; /* continue trying other algorithms */ + } #endif } else { @@ -6616,7 +6619,10 @@ static int ProcessBufferTryDecodeRsa(WOLFSSL_CTX* ctx, WOLFSSL* ssl, "not enabled to try"); ret = WOLFSSL_BAD_FILE; #else - ret = 0; /* continue trying other algorithms */ + if (*keyFormat == 0) { + /* Format unknown so keep trying. */ + ret = 0; /* continue trying other algorithms */ + } #endif } else { @@ -6728,7 +6734,7 @@ static int ProcessBufferTryDecodeEcc(WOLFSSL_CTX* ctx, WOLFSSL* ssl, *resetSuites = 1; } } - else { + else if (*keyFormat == 0) { ret = 0; /* continue trying other algorithms */ } @@ -6809,7 +6815,7 @@ static int ProcessBufferTryDecodeEd25519(WOLFSSL_CTX* ctx, WOLFSSL* ssl, } } } - else { + else if (*keyFormat == 0) { ret = 0; /* continue trying other algorithms */ }