Skip to content

Commit e5df6ac

Browse files
kareem-wolfsslkareem-wolfssl
committed
Add support for loading user CA certs from a configurable Windows cert store.
1 parent 935cfb7 commit e5df6ac

File tree

3 files changed

+169
-6
lines changed

3 files changed

+169
-6
lines changed

‎apps/wolfsshd/configuration.c‎

Lines changed: 141 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,9 @@ struct WOLFSSHD_CONFIG {
8080
char* authKeysFile;
8181
char* forceCmd;
8282
char* pidFile;
83+
char* winUserStores;
84+
char* winUserDwFlags;
85+
char* winUserPvPara;
8386
WOLFSSHD_CONFIG* next; /* next config in list */
8487
long loginTimer;
8588
word16 port;
@@ -90,6 +93,7 @@ struct WOLFSSHD_CONFIG {
9093
byte permitEmptyPasswords:1;
9194
byte authKeysFileSet:1; /* if not set then no explicit authorized keys */
9295
byte useSystemCA:1;
96+
byte useUserCAStore:1;
9397
};
9498

9599
int CountWhitespace(const char* in, int inSz, byte inv);
@@ -313,6 +317,9 @@ void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf)
313317
FreeString(&current->hostKeyFile, heap);
314318
FreeString(&current->hostCertFile, heap);
315319
FreeString(&current->pidFile, heap);
320+
FreeString(&current->winUserStores, heap);
321+
FreeString(&current->winUserDwFlags, heap);
322+
FreeString(&current->winUserPvPara, heap);
316323

317324
WFREE(current, heap, DYNTYPE_SSHD);
318325
current = next;
@@ -352,9 +359,13 @@ enum {
352359
OPT_PIDFILE = 22,
353360
OPT_BANNER = 23,
354361
OPT_TRUSTED_SYSTEM_CA_KEYS = 24,
362+
OPT_TRUSTED_USER_CA_STORE = 25,
363+
OPT_WIN_USER_STORES = 26,
364+
OPT_WIN_USER_DW_FLAGS = 27,
365+
OPT_WIN_USER_PV_PARA = 28
355366
};
356367
enum {
357-
NUM_OPTIONS = 24
368+
NUM_OPTIONS = 29
358369
};
359370

360371
static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -383,6 +394,10 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
383394
{OPT_TRUSTED_SYSTEM_CA_KEYS, "TrustedSystemCAKeys"},
384395
{OPT_PIDFILE, "PidFile"},
385396
{OPT_BANNER, "Banner"},
397+
{OPT_TRUSTED_USER_CA_STORE, "TrustedUserCaStore"},
398+
{OPT_WIN_USER_STORES, "WinUserStores"},
399+
{OPT_WIN_USER_DW_FLAGS, "WinUserDwFlags"},
400+
{OPT_WIN_USER_PV_PARA, "WinUserPvPara"},
386401
};
387402

388403
/* returns WS_SUCCESS on success */
@@ -1033,6 +1048,18 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
10331048
case OPT_BANNER:
10341049
ret = SetFileString(&(*conf)->banner, value, (*conf)->heap);
10351050
break;
1051+
case OPT_TRUSTED_USER_CA_STORE:
1052+
ret = wolfSSHD_ConfigSetUserCAStore(*conf, value);
1053+
break;
1054+
case OPT_WIN_USER_STORES:
1055+
ret = wolfSSHD_ConfigSetWinUserStores(*conf, value);
1056+
break;
1057+
case OPT_WIN_USER_DW_FLAGS:
1058+
ret = wolfSSHD_ConfigSetWinUserDwFlags(*conf, value);
1059+
break;
1060+
case OPT_WIN_USER_PV_PARA:
1061+
ret = wolfSSHD_ConfigSetWinUserPvPara(*conf, value);
1062+
break;
10361063
default:
10371064
break;
10381065
}
@@ -1352,6 +1379,119 @@ int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value)
13521379
return ret;
13531380
}
13541381

1382+
/* getter function for if using user CA store
1383+
* return 1 if true and 0 if false */
1384+
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf)
1385+
{
1386+
if (conf != NULL) {
1387+
return conf->useUserCAStore;
1388+
}
1389+
return 0;
1390+
}
1391+
1392+
1393+
/* setter function for if using user CA store
1394+
* 'yes' if true and 'no' if false
1395+
* returns WS_SUCCESS on success */
1396+
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value)
1397+
{
1398+
int ret = WS_SUCCESS;
1399+
1400+
if (conf != NULL) {
1401+
if (WSTRCMP(value, "yes") == 0) {
1402+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store enabled. Note this "
1403+
"is currently only supported on Windows.");
1404+
conf->useUserCAStore = 1;
1405+
}
1406+
else if (WSTRCMP(value, "no") == 0) {
1407+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store disabled");
1408+
conf->useUserCAStore = 0;
1409+
}
1410+
else {
1411+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store unexpected flag");
1412+
ret = WS_FATAL_ERROR;
1413+
}
1414+
}
1415+
1416+
return ret;
1417+
}
1418+
1419+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf) {
1420+
if (conf != NULL) {
1421+
if (conf->winUserStores == NULL) {
1422+
/* If no value was specified, default to CERT_STORE_PROV_SYSTEM */
1423+
CreateString(&conf->winUserStores, "CERT_STORE_PROV_SYSTEM",
1424+
(int)WSTRLEN("CERT_STORE_PROV_SYSTEM"), conf->heap);
1425+
}
1426+
1427+
return conf->winUserStores;
1428+
}
1429+
1430+
return NULL;
1431+
}
1432+
1433+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value) {
1434+
int ret = WS_SUCCESS;
1435+
1436+
if (conf == NULL) {
1437+
ret = WS_BAD_ARGUMENT;
1438+
}
1439+
1440+
ret = CreateString(&conf->winUserStores, value, (int)WSTRLEN(value), conf->heap);
1441+
1442+
return ret;
1443+
}
1444+
1445+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf) {
1446+
if (conf != NULL) {
1447+
if (conf->winUserDwFlags == NULL) {
1448+
/* If no value was specified, default to CERT_SYSTEM_STORE_CURRENT_USER */
1449+
CreateString(&conf->winUserDwFlags, "CERT_SYSTEM_STORE_CURRENT_USER",
1450+
(int)WSTRLEN("CERT_SYSTEM_STORE_CURRENT_USER"), conf->heap);
1451+
}
1452+
1453+
return conf->winUserDwFlags;
1454+
}
1455+
1456+
return NULL;
1457+
}
1458+
1459+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value) {
1460+
int ret = WS_SUCCESS;
1461+
1462+
if (conf == NULL) {
1463+
ret = WS_BAD_ARGUMENT;
1464+
}
1465+
1466+
ret = CreateString(&conf->winUserDwFlags, value, (int)WSTRLEN(value), conf->heap);
1467+
1468+
return ret;
1469+
}
1470+
1471+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf) {
1472+
if (conf != NULL) {
1473+
if (conf->winUserPvPara == NULL) {
1474+
/* If no value was specified, default to MY */
1475+
CreateString(&conf->winUserPvPara, "MY", (int)WSTRLEN("MY"), conf->heap);
1476+
}
1477+
1478+
return conf->winUserPvPara;
1479+
}
1480+
1481+
return NULL;
1482+
}
1483+
1484+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value) {
1485+
int ret = WS_SUCCESS;
1486+
1487+
if (conf == NULL) {
1488+
ret = WS_BAD_ARGUMENT;
1489+
}
1490+
1491+
ret = CreateString(&conf->winUserPvPara, value, (int)WSTRLEN(value), conf->heap);
1492+
1493+
return ret;
1494+
}
13551495

13561496
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf)
13571497
{

‎apps/wolfsshd/configuration.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,14 @@ int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file);
4444
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file);
4545
int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value);
4646
int wolfSSHD_ConfigGetSystemCA(const WOLFSSHD_CONFIG* conf);
47+
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value);
48+
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf);
49+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf);
50+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value);
51+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf);
52+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value);
53+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf);
54+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value);
4755
int wolfSSHD_ConfigSetUserCAKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
4856
word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf);
4957
char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf);

‎apps/wolfsshd/wolfsshd.c‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -423,9 +423,10 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
423423
#endif /* WOLFSSH_OSSH_CERTS || WOLFSSH_CERTS */
424424

425425
#ifdef WOLFSSH_CERTS
426-
/* check if loading in system CA certs */
426+
/* check if loading in system and/or user CA certs */
427427
#ifdef WOLFSSL_SYS_CA_CERTS
428-
if (ret == WS_SUCCESS && wolfSSHD_ConfigGetSystemCA(conf)) {
428+
if (ret == WS_SUCCESS && (wolfSSHD_ConfigGetSystemCA(conf)
429+
|| wolfSSHD_ConfigGetUserCAStore(conf))) {
429430
WOLFSSL_CTX* sslCtx;
430431

431432
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Using system CAs");
@@ -436,9 +437,23 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
436437
}
437438

438439
if (ret == WS_SUCCESS) {
439-
if (wolfSSL_CTX_load_system_CA_certs(sslCtx) != WOLFSSL_SUCCESS) {
440-
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading system CAs");
441-
ret = WS_FATAL_ERROR;
440+
if (wolfSSHD_ConfigGetSystemCA(conf)) {
441+
if (wolfSSL_CTX_load_system_CA_certs(sslCtx) != WOLFSSL_SUCCESS) {
442+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading system CAs");
443+
ret = WS_FATAL_ERROR;
444+
}
445+
}
446+
}
447+
448+
if (ret == WS_SUCCESS) {
449+
if (wolfSSHD_ConfigGetUserCAStore(conf)) {
450+
if (wolfSSL_CTX_load_windows_user_CA_certs(sslCtx,
451+
wolfSSHD_ConfigGetWinUserStores(conf),
452+
wolfSSHD_ConfigGetWinUserDwFlags(conf),
453+
wolfSSHD_ConfigGetWinUserPvPara(conf)) != WOLFSSL_SUCCESS) {
454+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading user CAs");
455+
ret = WS_FATAL_ERROR;
456+
}
442457
}
443458
}
444459

0 commit comments

Comments
 (0)