use proper free for cert store version, fix echoserver on mac os

Author: JacobBarthelmeh

examples/echoserver/echoserver.c

@@ -3027,29 +3027,6 @@ static void ShowUsage(void)
 }
 
 
-#ifdef WOLFSSH_WINDOWS_CERT_STORE
-/* Detects whether argv or the environment requests a host key from the
- * Windows certificate store, without doing the full option parse that
- * echoserver_test() does later. Used to decide, before any file-based
- * key lookup, whether the root directory search for PEM key files should
- * be skipped. */
-static int EchoserverUsingCertStore(int argc, char** argv)
-{
-    int i;
-    const char* spec;
-
-    for (i = 1; i < argc; i++) {
-        if (WSTRNCMP(argv[i], "-W", 2) == 0) {
-            return 1;
-        }
-    }
-
-    spec = getenv("WOLFSSH_CERT_STORE");
-    return (spec != NULL && spec[0] != '\0');
-}
-#endif /* WOLFSSH_WINDOWS_CERT_STORE */
-
-
 static INLINE void SignalTcpReady(tcp_ready* ready, word16 port)
 {
 #if defined(_POSIX_THREADS) && defined(NO_MAIN_DRIVER) && \
@@ -3332,6 +3309,18 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
         }
     #endif
 
+#if !defined(WOLFSSL_NUCLEUS) && !defined(INTEGRITY) && !defined(__INTEGRITY)
+    #ifdef WOLFSSH_WINDOWS_CERT_STORE
+    /* When using the Windows certificate store for host keys, no
+     * file-based keys are needed, so skip the root directory search
+     * that looks for ./keys/server-key-rsa.pem. */
+    if (certStoreSpec == NULL)
+    #endif
+    {
+        ChangeToWolfSshRoot();
+    }
+#endif
+
 #if defined(WOLFSSH_TPM) && defined(WOLFSSH_WINDOWS_CERT_STORE)
     /* Both register a host key on the same CTX; loading both would leave
      * which key the server presents up to algorithm negotiation. The SFTP
@@ -4015,19 +4004,10 @@ int wolfSSH_Echoserver(int argc, char** argv)
     #ifdef DEBUG_WOLFSSH
         wolfSSH_Debugging_ON();
     #endif
-#if !defined(WOLFSSL_NUCLEUS) && !defined(INTEGRITY) && !defined(__INTEGRITY)
-    #ifdef WOLFSSH_WINDOWS_CERT_STORE
-    /* When using the Windows certificate store for host keys, the
-     * echoserver does not need file-based keys, so skip the root
-     * directory search that looks for ./keys/server-key-rsa.pem. */
-    if (!EchoserverUsingCertStore(argc, argv))
-    #endif
-    {
-        ChangeToWolfSshRoot();
-    }
-#endif
 
 #ifndef NO_WOLFSSH_SERVER
+    /* echoserver_test() changes to the wolfSSH root directory itself,
+     * once it knows whether -W selected a Windows cert store host key. */
     echoserver_test(&args);
 #else
     printf("wolfSSH compiled without server support\n");

src/ssh.c

@@ -3389,7 +3389,7 @@ static int CertKeyCanSign(PCCERT_CONTEXT pCertContext)
      * later, so reject it here rather than misreport it as usable. */
     if (dwKeySpec != CERT_NCRYPT_KEY_SPEC) {
         if (fCallerFree) {
-            CryptReleaseContext(hKey, 0);
+            NCryptFreeObject(hKey);
         }
         return WS_CERT_KEY_NONE;
     }

tests/unit.c

@@ -12380,12 +12380,17 @@ static int test_IdentifyAsn1Key(void)
 
 /* Guard by the actual users -- the promote tests, the root-CA half of
  * test_SetCertManager(), and test_ParseECCPubKeyCert() -- to avoid
- * -Wunused-function. */
+ * -Wunused-function. The last disjunct matches test_ParseECCPubKeyCert()'s
+ * guard exactly, so this stays a superset regardless of WOLFSSH_TEST_INTERNAL
+ * or the linked wolfSSL version (relevant for ide/winvs, which never defines
+ * WOLFSSH_TEST_INTERNAL for unit-test). */
 #if defined(WOLFSSH_TEST_CERTMAN_PROMOTE) || \
     (defined(WOLFSSH_TEST_SET_CERTMAN) && \
      defined(WOLFSSH_TEST_CERTMAN_ROOTCA)) || \
     (defined(WOLFSSH_TEST_INTERNAL) && defined(WOLFSSH_CERTS) && \
-     !defined(NO_FILESYSTEM) && !defined(WOLFSSH_NO_ECDSA_SHA2_NISTP256))
+     !defined(NO_FILESYSTEM) && !defined(WOLFSSH_NO_ECDSA_SHA2_NISTP256)) || \
+    (defined(WOLFSSH_CERTS) && !defined(NO_FILESYSTEM) && \
+     !defined(WOLFSSH_NO_ECDSA_SHA2_NISTP256))
 
 /* Read a whole file into a freshly malloc'd buffer. Caller frees *buf. */
 static int certmanLoadFile(const char* fn, byte** buf, word32* bufSz)