Skip to content

Commit 227e6da

Browse files
kareem-wolfsslJacobBarthelmeh
kareem-wolfssl
authored and
JacobBarthelmeh
committed
Add support for loading user CA certs from a configurable Windows cert store.
1 parent fccb41f commit 227e6da

3 files changed

Lines changed: 168 additions & 6 deletions

File tree

‎apps/wolfsshd/configuration.c‎

Lines changed: 140 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ struct WOLFSSHD_CONFIG {
7777
char* authKeysFile;
7878
char* forceCmd;
7979
char* pidFile;
80+
char* winUserStores;
81+
char* winUserDwFlags;
82+
char* winUserPvPara;
8083
WOLFSSHD_CONFIG* next; /* next config in list */
8184
long loginTimer;
8285
word16 port;
@@ -88,6 +91,7 @@ struct WOLFSSHD_CONFIG {
8891
byte authKeysFileSet:1; /* if not set then no explicit authorized keys */
8992
byte strictModes:1; /* enforce file permission/ownership checks */
9093
byte useSystemCA:1;
94+
byte useUserCAStore:1;
9195
};
9296

9397
/* Maximum depth of nested Include directives. Bounds the recursion
@@ -360,6 +364,9 @@ void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf)
360364
FreeString(&current->forceCmd, heap);
361365
FreeString(&current->usrAppliesTo, heap);
362366
FreeString(&current->groupAppliesTo, heap);
367+
FreeString(&current->winUserStores, heap);
368+
FreeString(&current->winUserDwFlags, heap);
369+
FreeString(&current->winUserPvPara, heap);
363370

364371
WFREE(current, heap, DYNTYPE_SSHD);
365372
current = next;
@@ -401,9 +408,13 @@ enum {
401408
OPT_PUBKEY_AUTH = 24,
402409
OPT_STRICT_MODES = 25,
403410
OPT_TRUSTED_SYSTEM_CA_KEYS = 26,
411+
OPT_TRUSTED_USER_CA_STORE = 27,
412+
OPT_WIN_USER_STORES = 28,
413+
OPT_WIN_USER_DW_FLAGS = 29,
414+
OPT_WIN_USER_PV_PARA = 30
404415
};
405416
enum {
406-
NUM_OPTIONS = 27
417+
NUM_OPTIONS = 31
407418
};
408419

409420
static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -434,6 +445,10 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
434445
{OPT_PIDFILE, "PidFile"},
435446
{OPT_BANNER, "Banner"},
436447
{OPT_STRICT_MODES, "StrictModes"},
448+
{OPT_TRUSTED_USER_CA_STORE, "TrustedUserCaStore"},
449+
{OPT_WIN_USER_STORES, "WinUserStores"},
450+
{OPT_WIN_USER_DW_FLAGS, "WinUserDwFlags"},
451+
{OPT_WIN_USER_PV_PARA, "WinUserPvPara"},
437452
};
438453

439454
/* returns WS_SUCCESS on success */
@@ -1279,6 +1294,17 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
12791294
break;
12801295
case OPT_STRICT_MODES:
12811296
ret = HandleStrictModes(*conf, value);
1297+
case OPT_TRUSTED_USER_CA_STORE:
1298+
ret = wolfSSHD_ConfigSetUserCAStore(*conf, value);
1299+
break;
1300+
case OPT_WIN_USER_STORES:
1301+
ret = wolfSSHD_ConfigSetWinUserStores(*conf, value);
1302+
break;
1303+
case OPT_WIN_USER_DW_FLAGS:
1304+
ret = wolfSSHD_ConfigSetWinUserDwFlags(*conf, value);
1305+
break;
1306+
case OPT_WIN_USER_PV_PARA:
1307+
ret = wolfSSHD_ConfigSetWinUserPvPara(*conf, value);
12821308
break;
12831309
default:
12841310
break;
@@ -1661,6 +1687,119 @@ int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value)
16611687
return ret;
16621688
}
16631689

1690+
/* getter function for if using user CA store
1691+
* return 1 if true and 0 if false */
1692+
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf)
1693+
{
1694+
if (conf != NULL) {
1695+
return conf->useUserCAStore;
1696+
}
1697+
return 0;
1698+
}
1699+
1700+
1701+
/* setter function for if using user CA store
1702+
* 'yes' if true and 'no' if false
1703+
* returns WS_SUCCESS on success */
1704+
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value)
1705+
{
1706+
int ret = WS_SUCCESS;
1707+
1708+
if (conf != NULL) {
1709+
if (WSTRCMP(value, "yes") == 0) {
1710+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store enabled. Note this "
1711+
"is currently only supported on Windows.");
1712+
conf->useUserCAStore = 1;
1713+
}
1714+
else if (WSTRCMP(value, "no") == 0) {
1715+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store disabled");
1716+
conf->useUserCAStore = 0;
1717+
}
1718+
else {
1719+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store unexpected flag");
1720+
ret = WS_FATAL_ERROR;
1721+
}
1722+
}
1723+
1724+
return ret;
1725+
}
1726+
1727+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf) {
1728+
if (conf != NULL) {
1729+
if (conf->winUserStores == NULL) {
1730+
/* If no value was specified, default to CERT_STORE_PROV_SYSTEM */
1731+
CreateString(&conf->winUserStores, "CERT_STORE_PROV_SYSTEM",
1732+
(int)WSTRLEN("CERT_STORE_PROV_SYSTEM"), conf->heap);
1733+
}
1734+
1735+
return conf->winUserStores;
1736+
}
1737+
1738+
return NULL;
1739+
}
1740+
1741+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value) {
1742+
int ret = WS_SUCCESS;
1743+
1744+
if (conf == NULL) {
1745+
ret = WS_BAD_ARGUMENT;
1746+
}
1747+
1748+
ret = CreateString(&conf->winUserStores, value, (int)WSTRLEN(value), conf->heap);
1749+
1750+
return ret;
1751+
}
1752+
1753+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf) {
1754+
if (conf != NULL) {
1755+
if (conf->winUserDwFlags == NULL) {
1756+
/* If no value was specified, default to CERT_SYSTEM_STORE_CURRENT_USER */
1757+
CreateString(&conf->winUserDwFlags, "CERT_SYSTEM_STORE_CURRENT_USER",
1758+
(int)WSTRLEN("CERT_SYSTEM_STORE_CURRENT_USER"), conf->heap);
1759+
}
1760+
1761+
return conf->winUserDwFlags;
1762+
}
1763+
1764+
return NULL;
1765+
}
1766+
1767+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value) {
1768+
int ret = WS_SUCCESS;
1769+
1770+
if (conf == NULL) {
1771+
ret = WS_BAD_ARGUMENT;
1772+
}
1773+
1774+
ret = CreateString(&conf->winUserDwFlags, value, (int)WSTRLEN(value), conf->heap);
1775+
1776+
return ret;
1777+
}
1778+
1779+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf) {
1780+
if (conf != NULL) {
1781+
if (conf->winUserPvPara == NULL) {
1782+
/* If no value was specified, default to MY */
1783+
CreateString(&conf->winUserPvPara, "MY", (int)WSTRLEN("MY"), conf->heap);
1784+
}
1785+
1786+
return conf->winUserPvPara;
1787+
}
1788+
1789+
return NULL;
1790+
}
1791+
1792+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value) {
1793+
int ret = WS_SUCCESS;
1794+
1795+
if (conf == NULL) {
1796+
ret = WS_BAD_ARGUMENT;
1797+
}
1798+
1799+
ret = CreateString(&conf->winUserPvPara, value, (int)WSTRLEN(value), conf->heap);
1800+
1801+
return ret;
1802+
}
16641803

16651804
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf)
16661805
{

‎apps/wolfsshd/configuration.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,14 @@ int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file);
5353
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file);
5454
int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value);
5555
int wolfSSHD_ConfigGetSystemCA(const WOLFSSHD_CONFIG* conf);
56+
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value);
57+
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf);
58+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf);
59+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value);
60+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf);
61+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value);
62+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf);
63+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value);
5664
int wolfSSHD_ConfigSetUserCAKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
5765
word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf);
5866
char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf);

‎apps/wolfsshd/wolfsshd.c‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -475,9 +475,10 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
475475
#endif /* WOLFSSH_OSSH_CERTS || WOLFSSH_CERTS */
476476

477477
#ifdef WOLFSSH_CERTS
478-
/* check if loading in system CA certs */
478+
/* check if loading in system and/or user CA certs */
479479
#ifdef WOLFSSL_SYS_CA_CERTS
480-
if (ret == WS_SUCCESS && wolfSSHD_ConfigGetSystemCA(conf)) {
480+
if (ret == WS_SUCCESS && (wolfSSHD_ConfigGetSystemCA(conf)
481+
|| wolfSSHD_ConfigGetUserCAStore(conf))) {
481482
WOLFSSL_CTX* sslCtx;
482483

483484
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Using system CAs");
@@ -488,9 +489,23 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
488489
}
489490

490491
if (ret == WS_SUCCESS) {
491-
if (wolfSSL_CTX_load_system_CA_certs(sslCtx) != WOLFSSL_SUCCESS) {
492-
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading system CAs");
493-
ret = WS_FATAL_ERROR;
492+
if (wolfSSHD_ConfigGetSystemCA(conf)) {
493+
if (wolfSSL_CTX_load_system_CA_certs(sslCtx) != WOLFSSL_SUCCESS) {
494+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading system CAs");
495+
ret = WS_FATAL_ERROR;
496+
}
497+
}
498+
}
499+
500+
if (ret == WS_SUCCESS) {
501+
if (wolfSSHD_ConfigGetUserCAStore(conf)) {
502+
if (wolfSSL_CTX_load_windows_user_CA_certs(sslCtx,
503+
wolfSSHD_ConfigGetWinUserStores(conf),
504+
wolfSSHD_ConfigGetWinUserDwFlags(conf),
505+
wolfSSHD_ConfigGetWinUserPvPara(conf)) != WOLFSSL_SUCCESS) {
506+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading user CAs");
507+
ret = WS_FATAL_ERROR;
508+
}
494509
}
495510
}
496511

0 commit comments

Comments
 (0)