Skip to content

Commit de28863

Browse files
JacobBarthelmehJacobBarthelmeh
committed
make windows cert feature default disabled and simplify macro guard
1 parent f3d29c6 commit de28863

15 files changed

Lines changed: 107 additions & 149 deletions

File tree

‎.github/workflows/windows-cert-store-test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ jobs:
5252
run: |
5353
# Enable SSHD, SFTP, and X509 support (including WOLFSSH_NO_FPKI)
5454
sed -i 's/#if 0/#if 1/g' ${{env.USER_SETTINGS_H_NEW}}
55+
# Enable Windows cert store API (not in repo user_settings.h).
56+
# Must be appended to wolfssh/ide/winvs/user_settings.h: VS projects put ide/winvs on the
57+
printf '\n/* Appended by windows-cert-store-test CI */\n#define WOLFSSH_WINDOWS_CERT_STORE\n' >> ${{env.USER_SETTINGS_H_NEW}}
5558
cp ${{env.USER_SETTINGS_H_NEW}} ${{env.USER_SETTINGS_H}}
5659
# Verify WOLFSSH_NO_FPKI will be defined
5760
if grep -q "WOLFSSH_NO_FPKI" ${{env.USER_SETTINGS_H}}; then

‎apps/wolfsshd/configuration.c‎

Lines changed: 16 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,11 @@ struct WOLFSSHD_CONFIG {
7171
char* hostKeyFile;
7272
char* hostCertFile;
7373
char* userCAKeysFile;
74-
#ifdef USE_WINDOWS_API
75-
#ifdef WOLFSSH_CERTS
74+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
7675
char* hostKeyStore;
7776
char* hostKeyStoreSubject;
7877
char* hostKeyStoreFlags;
79-
#endif /* WOLFSSH_CERTS */
80-
#endif /* USE_WINDOWS_API */
78+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
8179
char* hostKeyAlgos;
8280
char* kekAlgos;
8381
char* listenAddress;
@@ -373,12 +371,12 @@ void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf)
373371
FreeString(&current->forceCmd, heap);
374372
FreeString(&current->usrAppliesTo, heap);
375373
FreeString(&current->groupAppliesTo, heap);
376-
#ifdef USE_WINDOWS_API
377-
#ifdef WOLFSSH_CERTS
374+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
378375
FreeString(&current->hostKeyStore, heap);
379376
FreeString(&current->hostKeyStoreSubject, heap);
380377
FreeString(&current->hostKeyStoreFlags, heap);
381-
#endif /* WOLFSSH_CERTS */
378+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
379+
#ifdef USE_WINDOWS_API
382380
FreeString(&current->winUserStores, heap);
383381
FreeString(&current->winUserDwFlags, heap);
384382
FreeString(&current->winUserPvPara, heap);
@@ -409,13 +407,11 @@ enum {
409407
OPT_PROTOCOL = 9,
410408
OPT_LOGIN_GRACE_TIME = 10,
411409
OPT_HOST_KEY = 11,
412-
#ifdef USE_WINDOWS_API
413-
#ifdef WOLFSSH_CERTS
410+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
414411
OPT_HOST_KEY_STORE = 50,
415412
OPT_HOST_KEY_STORE_SUBJECT = 51,
416413
OPT_HOST_KEY_STORE_FLAGS = 52,
417-
#endif /* WOLFSSH_CERTS */
418-
#endif /* USE_WINDOWS_API */
414+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
419415
OPT_PASSWORD_AUTH = 12,
420416
OPT_PORT = 13,
421417
OPT_PERMIT_ROOT = 14,
@@ -442,10 +438,10 @@ enum {
442438
NUM_OPTIONS = 31
443439
#ifdef USE_WINDOWS_API
444440
+ 3
445-
#ifdef WOLFSSH_CERTS
446-
+ 3
447-
#endif /* WOLFSSH_CERTS */
448441
#endif /* USE_WINDOWS_API */
442+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
443+
+ 3
444+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
449445
};
450446

451447
static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -464,13 +460,11 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
464460
* option names that share a common prefix MUST appear before the shorter
465461
* one. HostKeyStoreSubject/HostKeyStoreFlags before HostKeyStore,
466462
* and all HostKeyStore* before HostKey. */
467-
#ifdef USE_WINDOWS_API
468-
#ifdef WOLFSSH_CERTS
463+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
469464
{OPT_HOST_KEY_STORE_SUBJECT, "HostKeyStoreSubject"},
470465
{OPT_HOST_KEY_STORE_FLAGS, "HostKeyStoreFlags"},
471466
{OPT_HOST_KEY_STORE, "HostKeyStore"},
472-
#endif /* WOLFSSH_CERTS */
473-
#endif /* USE_WINDOWS_API */
467+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
474468
{OPT_HOST_KEY, "HostKey"},
475469
{OPT_PASSWORD_AUTH, "PasswordAuthentication"},
476470
{OPT_PUBKEY_AUTH, "PubkeyAuthentication"},
@@ -1352,8 +1346,7 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
13521346
ret = wolfSSHD_ConfigSetWinUserPvPara(*conf, value);
13531347
break;
13541348
#endif /* USE_WINDOWS_API */
1355-
#ifdef USE_WINDOWS_API
1356-
#ifdef WOLFSSH_CERTS
1349+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
13571350
case OPT_HOST_KEY_STORE:
13581351
wolfSSH_Log(WS_LOG_INFO,
13591352
"[SSHD] Parsed HostKeyStore = '%s'", value);
@@ -1371,8 +1364,7 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
13711364
ret = SetFileString(&(*conf)->hostKeyStoreFlags, value,
13721365
(*conf)->heap);
13731366
break;
1374-
#endif /* WOLFSSH_CERTS */
1375-
#endif /* USE_WINDOWS_API */
1367+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
13761368
default:
13771369
break;
13781370
}
@@ -1922,8 +1914,7 @@ static int SetFileString(char** dst, const char* src, void* heap)
19221914
return ret;
19231915
}
19241916

1925-
#ifdef USE_WINDOWS_API
1926-
#ifdef WOLFSSH_CERTS
1917+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
19271918
char* wolfSSHD_ConfigGetHostKeyStore(const WOLFSSHD_CONFIG* conf)
19281919
{
19291920
char* ret = NULL;
@@ -1958,8 +1949,7 @@ char* wolfSSHD_ConfigGetHostKeyStoreFlags(const WOLFSSHD_CONFIG* conf)
19581949

19591950
return ret;
19601951
}
1961-
#endif /* WOLFSSH_CERTS */
1962-
#endif /* USE_WINDOWS_API */
1952+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
19631953

19641954
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file)
19651955
{

‎apps/wolfsshd/configuration.h‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,11 @@ char* wolfSSHD_ConfigGetHostCertFile(const WOLFSSHD_CONFIG* conf);
5151
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf);
5252
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file);
5353
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file);
54-
#ifdef USE_WINDOWS_API
55-
#ifdef WOLFSSH_CERTS
54+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
5655
char* wolfSSHD_ConfigGetHostKeyStore(const WOLFSSHD_CONFIG* conf);
5756
char* wolfSSHD_ConfigGetHostKeyStoreSubject(const WOLFSSHD_CONFIG* conf);
5857
char* wolfSSHD_ConfigGetHostKeyStoreFlags(const WOLFSSHD_CONFIG* conf);
59-
#endif /* WOLFSSH_CERTS */
60-
#endif /* USE_WINDOWS_API */
58+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
6159
int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value);
6260
int wolfSSHD_ConfigGetSystemCA(const WOLFSSHD_CONFIG* conf);
6361
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value);

‎apps/wolfsshd/wolfsshd.c‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,7 @@
3838
#include <wolfssl/wolfcrypt/logging.h>
3939
#include <wolfssl/wolfcrypt/asn_public.h>
4040

41-
#ifdef USE_WINDOWS_API
42-
#ifdef WOLFSSH_CERTS
41+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
4342
#include <windows.h>
4443
#include <wincrypt.h>
4544
#include <ncrypt.h>
@@ -49,8 +48,7 @@
4948
#ifndef CERT_SYSTEM_STORE_LOCAL_MACHINE
5049
#define CERT_SYSTEM_STORE_LOCAL_MACHINE 0x00020000
5150
#endif
52-
#endif /* WOLFSSH_CERTS */
53-
#endif /* USE_WINDOWS_API */
51+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
5452

5553
#define WOLFSSH_TEST_SERVER
5654
#include <wolfssh/test.h>
@@ -386,8 +384,7 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
386384

387385
/* Load in host private key */
388386
if (ret == WS_SUCCESS) {
389-
#ifdef USE_WINDOWS_API
390-
#ifdef WOLFSSH_CERTS
387+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
391388
char* hostKeyStore = wolfSSHD_ConfigGetHostKeyStore(conf);
392389
char* hostKeyStoreSubject = wolfSSHD_ConfigGetHostKeyStoreSubject(conf);
393390
char* hostKeyStoreFlags = wolfSSHD_ConfigGetHostKeyStoreFlags(conf);
@@ -440,14 +437,13 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
440437
WFREE(wSubjectName, heap, DYNTYPE_SSHD);
441438
}
442439
} else
443-
#else
440+
#elif defined(WOLFSSH_CERTS)
444441
wolfSSH_Log(WS_LOG_INFO,
445-
"[SSHD] WOLFSSH_CERTS not defined - cert store support disabled");
446-
#endif /* WOLFSSH_CERTS */
442+
"[SSHD] WOLFSSH_WINDOWS_CERT_STORE not defined - cert store support disabled");
447443
#else
448444
wolfSSH_Log(WS_LOG_INFO,
449-
"[SSHD] USE_WINDOWS_API not defined - cert store support disabled");
450-
#endif /* USE_WINDOWS_API */
445+
"[SSHD] WOLFSSH_CERTS not defined - cert store support disabled");
446+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
451447
{
452448
char* hostKey = wolfSSHD_ConfigGetHostKeyFile(conf);
453449

‎configure.ac‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,12 @@ AC_ARG_ENABLE([certs],
215215
[AS_HELP_STRING([--enable-certs],[Enable X.509 cert support (default: disabled)])],
216216
[ENABLED_CERTS=$enableval],[ENABLED_CERTS=no])
217217

218+
# Windows certificate store (host/client keys)
219+
AC_ARG_ENABLE([windows-cert-store],
220+
[AS_HELP_STRING([--enable-windows-cert-store],[Enable Windows certificate store integration for keys (default: disabled)])],
221+
[ENABLED_WINDOWS_CERT_STORE=$enableval],
222+
[ENABLED_WINDOWS_CERT_STORE=no])
223+
218224
# TPM 2.0 Support
219225
AC_ARG_ENABLE([tpm],
220226
[AS_HELP_STRING([--enable-tpm],[Enable TPM 2.0 support (default: disabled)])],
@@ -276,6 +282,10 @@ AS_IF([test "x$ENABLED_AGENT" = "xyes"],
276282
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_AGENT"])
277283
AS_IF([test "x$ENABLED_CERTS" = "xyes"],
278284
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_CERTS"])
285+
AS_IF([test "x$ENABLED_WINDOWS_CERT_STORE" = "xyes"],
286+
[AS_IF([test "x$ENABLED_CERTS" != "xyes"],
287+
[AC_MSG_ERROR([--enable-windows-cert-store requires X.509 cert support (--enable-certs)])])
288+
AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_WINDOWS_CERT_STORE"])
279289
AS_IF([test "x$ENABLED_SMALLSTACK" = "xyes"],
280290
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SMALL_STACK"])
281291
AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],
@@ -380,4 +390,5 @@ AS_ECHO([" * agent: $ENABLED_AGENT"])
380390
AS_ECHO([" * TPM 2.0 support: $ENABLED_TPM"])
381391
AS_ECHO([" * TCP/IP Forwarding: $ENABLED_FWD"])
382392
AS_ECHO([" * X.509 Certs: $ENABLED_CERTS"])
393+
AS_ECHO([" * Windows cert store: $ENABLED_WINDOWS_CERT_STORE"])
383394
AS_ECHO([" * Examples: $ENABLED_EXAMPLES"])

‎examples/client/common.c‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,11 @@
4848

4949
#ifdef WOLFSSH_CERTS
5050
#include <wolfssl/wolfcrypt/asn.h>
51-
#ifdef USE_WINDOWS_API
51+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
5252
#include <windows.h>
5353
#include <wincrypt.h>
5454
#include <ncrypt.h>
55-
#endif /* USE_WINDOWS_API */
55+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
5656
#endif
5757

5858
static byte userPublicKeyBuf[512];
@@ -1168,8 +1168,7 @@ void ClientFreeBuffers(const char* pubKeyName, const char* privKeyName,
11681168
wc_ForceZero(userPassword, sizeof(userPassword));
11691169
}
11701170

1171-
#ifdef USE_WINDOWS_API
1172-
#ifdef WOLFSSH_CERTS
1171+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
11731172
int ClientSetPrivateKeyFromStore(WOLFSSH_CTX* ctx,
11741173
const wchar_t* storeName, DWORD dwFlags, const wchar_t* subjectName)
11751174
{
@@ -1247,5 +1246,4 @@ int ClientSetupCertStoreAuth(WOLFSSH_CTX* ctx)
12471246
fprintf(stderr, "No cert store key found in CTX\n");
12481247
return WS_BAD_ARGUMENT;
12491248
}
1250-
#endif /* WOLFSSH_CERTS */
1251-
#endif /* USE_WINDOWS_API */
1249+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */

‎examples/client/common.h‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,11 @@ void ClientFreeBuffers(const char* pubKeyName, const char* privKeyName,
3535
#ifdef WOLFSSH_TPM
3636
int ClientSetTpm(WOLFSSH* ssh);
3737
#endif
38-
#ifdef USE_WINDOWS_API
39-
#ifdef WOLFSSH_CERTS
38+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
4039
int ClientSetPrivateKeyFromStore(WOLFSSH_CTX* ctx,
4140
const wchar_t* storeName, DWORD dwFlags, const wchar_t* subjectName);
4241
int ClientSetupCertStoreAuth(WOLFSSH_CTX* ctx);
43-
#endif /* WOLFSSH_CERTS */
44-
#endif /* USE_WINDOWS_API */
42+
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
4543

4644
#endif /* WOLFSSH_COMMON_H */
4745

‎examples/echoserver/echoserver.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@
119119
#define SOCKET_EWOULDBLOCK WSAEWOULDBLOCK
120120
#endif
121121

122-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
122+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
123123
#include <windows.h>
124124
#include <wincrypt.h>
125125
#ifndef CERT_SYSTEM_STORE_CURRENT_USER
@@ -2722,7 +2722,7 @@ static void ShowUsage(void)
27222722
printf(" -x <list> set the comma separated list of key exchange algos "
27232723
"to use\n");
27242724
printf(" -m <list> set the comma separated list of mac algos to use\n");
2725-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
2725+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
27262726
printf(" -W <spec> Windows cert store: \"store:subject:flags\" (e.g. My:CN=Server:CURRENT_USER)\n");
27272727
#endif
27282728
printf(" -b <num> test user auth would block\n");
@@ -2833,7 +2833,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
28332833
#ifdef WOLFSSH_CERTS
28342834
char* caCert = NULL;
28352835
#endif
2836-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
2836+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
28372837
const char* certStoreSpec = NULL;
28382838
#endif
28392839

@@ -2844,7 +2844,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
28442844
kbAuthData.promptCount = 0;
28452845
#endif
28462846

2847-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
2847+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
28482848
certStoreSpec = getenv("WOLFSSH_CERT_STORE");
28492849
#endif
28502850
if (argc > 0) {
@@ -2973,7 +2973,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
29732973
useCustomHighWaterCb = 1;
29742974
break;
29752975

2976-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
2976+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
29772977
case 'W':
29782978
certStoreSpec = myoptarg;
29792979
break;
@@ -3170,7 +3170,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
31703170
}
31713171
#endif
31723172

3173-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
3173+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
31743174
if (certStoreSpec != NULL) {
31753175
/* Load host key from Windows certificate store */
31763176
wchar_t* wStoreName = NULL;
@@ -3541,7 +3541,7 @@ int wolfSSH_Echoserver(int argc, char** argv)
35413541
#if !defined(WOLFSSL_NUCLEUS) && !defined(INTEGRITY) && !defined(__INTEGRITY)
35423542
{
35433543
int useStore = 0;
3544-
#if defined(USE_WINDOWS_API) && defined(WOLFSSH_CERTS)
3544+
#ifdef WOLFSSH_WINDOWS_CERT_STORE
35453545
/* When using the Windows certificate store for host keys, the
35463546
* echoserver does not need file-based keys, so skip the root
35473547
* directory search that looks for ./keys/server-key-rsa.pem. */

0 commit comments

Comments
 (0)