Skip to content

Commit 09027ea

Browse files
kareem-wolfsslkareem-wolfssl
committed
Add support for loading user CA certs from a configurable Windows cert store.
1 parent 827087b commit 09027ea

File tree

3 files changed

+169
-6
lines changed

3 files changed

+169
-6
lines changed

‎apps/wolfsshd/configuration.c‎

Lines changed: 141 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,9 @@ struct WOLFSSHD_CONFIG {
8080
char* authKeysFile;
8181
char* forceCmd;
8282
char* pidFile;
83+
char* winUserStores;
84+
char* winUserDwFlags;
85+
char* winUserPvPara;
8386
WOLFSSHD_CONFIG* next; /* next config in list */
8487
long loginTimer;
8588
word16 port;
@@ -90,6 +93,7 @@ struct WOLFSSHD_CONFIG {
9093
byte permitEmptyPasswords:1;
9194
byte authKeysFileSet:1; /* if not set then no explicit authorized keys */
9295
byte useSystemCA:1;
96+
byte useUserCAStore:1;
9397
};
9498

9599
int CountWhitespace(const char* in, int inSz, byte inv);
@@ -313,6 +317,9 @@ void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf)
313317
FreeString(&current->hostKeyFile, heap);
314318
FreeString(&current->hostCertFile, heap);
315319
FreeString(&current->pidFile, heap);
320+
FreeString(&current->winUserStores, heap);
321+
FreeString(&current->winUserDwFlags, heap);
322+
FreeString(&current->winUserPvPara, heap);
316323

317324
WFREE(current, heap, DYNTYPE_SSHD);
318325
current = next;
@@ -351,9 +358,13 @@ enum {
351358
OPT_TRUSTED_USER_CA_KEYS = 21,
352359
OPT_TRUSTED_SYSTEM_CA_KEYS = 22,
353360
OPT_PIDFILE = 23,
361+
OPT_TRUSTED_USER_CA_STORE = 24,
362+
OPT_WIN_USER_STORES = 25,
363+
OPT_WIN_USER_DW_FLAGS = 26,
364+
OPT_WIN_USER_PV_PARA = 27,
354365
};
355366
enum {
356-
NUM_OPTIONS = 24
367+
NUM_OPTIONS = 28
357368
};
358369

359370
static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -381,6 +392,10 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
381392
{OPT_TRUSTED_USER_CA_KEYS, "TrustedUserCAKeys"},
382393
{OPT_TRUSTED_SYSTEM_CA_KEYS, "TrustedSystemCAKeys"},
383394
{OPT_PIDFILE, "PidFile"},
395+
{OPT_TRUSTED_USER_CA_STORE, "TrustedUserCaStore"},
396+
{OPT_WIN_USER_STORES, "WinUserStores"},
397+
{OPT_WIN_USER_DW_FLAGS, "WinUserDwFlags"},
398+
{OPT_WIN_USER_PV_PARA, "WinUserPvPara"},
384399
};
385400

386401
/* returns WS_SUCCESS on success */
@@ -1028,6 +1043,18 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
10281043
case OPT_PIDFILE:
10291044
ret = SetFileString(&(*conf)->pidFile, value, (*conf)->heap);
10301045
break;
1046+
case OPT_TRUSTED_USER_CA_STORE:
1047+
ret = wolfSSHD_ConfigSetUserCAStore(*conf, value);
1048+
break;
1049+
case OPT_WIN_USER_STORES:
1050+
ret = wolfSSHD_ConfigSetWinUserStores(*conf, value);
1051+
break;
1052+
case OPT_WIN_USER_DW_FLAGS:
1053+
ret = wolfSSHD_ConfigSetWinUserDwFlags(*conf, value);
1054+
break;
1055+
case OPT_WIN_USER_PV_PARA:
1056+
ret = wolfSSHD_ConfigSetWinUserPvPara(*conf, value);
1057+
break;
10311058
default:
10321059
break;
10331060
}
@@ -1347,6 +1374,119 @@ int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value)
13471374
return ret;
13481375
}
13491376

1377+
/* getter function for if using user CA store
1378+
* return 1 if true and 0 if false */
1379+
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf)
1380+
{
1381+
if (conf != NULL) {
1382+
return conf->useUserCAStore;
1383+
}
1384+
return 0;
1385+
}
1386+
1387+
1388+
/* setter function for if using user CA store
1389+
* 'yes' if true and 'no' if false
1390+
* returns WS_SUCCESS on success */
1391+
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value)
1392+
{
1393+
int ret = WS_SUCCESS;
1394+
1395+
if (conf != NULL) {
1396+
if (WSTRCMP(value, "yes") == 0) {
1397+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store enabled. Note this "
1398+
"is currently only supported on Windows.");
1399+
conf->useUserCAStore = 1;
1400+
}
1401+
else if (WSTRCMP(value, "no") == 0) {
1402+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store disabled");
1403+
conf->useUserCAStore = 0;
1404+
}
1405+
else {
1406+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] User CA store unexpected flag");
1407+
ret = WS_FATAL_ERROR;
1408+
}
1409+
}
1410+
1411+
return ret;
1412+
}
1413+
1414+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf) {
1415+
if (conf != NULL) {
1416+
if (conf->winUserStores == NULL) {
1417+
/* If no value was specified, default to CERT_STORE_PROV_SYSTEM */
1418+
CreateString(&conf->winUserStores, "CERT_STORE_PROV_SYSTEM",
1419+
(int)WSTRLEN("CERT_STORE_PROV_SYSTEM"), conf->heap);
1420+
}
1421+
1422+
return conf->winUserStores;
1423+
}
1424+
1425+
return NULL;
1426+
}
1427+
1428+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value) {
1429+
int ret = WS_SUCCESS;
1430+
1431+
if (conf == NULL) {
1432+
ret = WS_BAD_ARGUMENT;
1433+
}
1434+
1435+
ret = CreateString(&conf->winUserStores, value, (int)WSTRLEN(value), conf->heap);
1436+
1437+
return ret;
1438+
}
1439+
1440+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf) {
1441+
if (conf != NULL) {
1442+
if (conf->winUserDwFlags == NULL) {
1443+
/* If no value was specified, default to CERT_SYSTEM_STORE_CURRENT_USER */
1444+
CreateString(&conf->winUserDwFlags, "CERT_SYSTEM_STORE_CURRENT_USER",
1445+
(int)WSTRLEN("CERT_SYSTEM_STORE_CURRENT_USER"), conf->heap);
1446+
}
1447+
1448+
return conf->winUserDwFlags;
1449+
}
1450+
1451+
return NULL;
1452+
}
1453+
1454+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value) {
1455+
int ret = WS_SUCCESS;
1456+
1457+
if (conf == NULL) {
1458+
ret = WS_BAD_ARGUMENT;
1459+
}
1460+
1461+
ret = CreateString(&conf->winUserDwFlags, value, (int)WSTRLEN(value), conf->heap);
1462+
1463+
return ret;
1464+
}
1465+
1466+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf) {
1467+
if (conf != NULL) {
1468+
if (conf->winUserPvPara == NULL) {
1469+
/* If no value was specified, default to MY */
1470+
CreateString(&conf->winUserPvPara, "MY", (int)WSTRLEN("MY"), conf->heap);
1471+
}
1472+
1473+
return conf->winUserPvPara;
1474+
}
1475+
1476+
return NULL;
1477+
}
1478+
1479+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value) {
1480+
int ret = WS_SUCCESS;
1481+
1482+
if (conf == NULL) {
1483+
ret = WS_BAD_ARGUMENT;
1484+
}
1485+
1486+
ret = CreateString(&conf->winUserPvPara, value, (int)WSTRLEN(value), conf->heap);
1487+
1488+
return ret;
1489+
}
13501490

13511491
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf)
13521492
{

‎apps/wolfsshd/configuration.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,14 @@ int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file);
4444
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file);
4545
int wolfSSHD_ConfigSetSystemCA(WOLFSSHD_CONFIG* conf, const char* value);
4646
int wolfSSHD_ConfigGetSystemCA(const WOLFSSHD_CONFIG* conf);
47+
int wolfSSHD_ConfigSetUserCAStore(WOLFSSHD_CONFIG* conf, const char* value);
48+
int wolfSSHD_ConfigGetUserCAStore(const WOLFSSHD_CONFIG* conf);
49+
char* wolfSSHD_ConfigGetWinUserStores(WOLFSSHD_CONFIG* conf);
50+
int wolfSSHD_ConfigSetWinUserStores(WOLFSSHD_CONFIG* conf, const char* value);
51+
char* wolfSSHD_ConfigGetWinUserDwFlags(WOLFSSHD_CONFIG* conf);
52+
int wolfSSHD_ConfigSetWinUserDwFlags(WOLFSSHD_CONFIG* conf, const char* value);
53+
char* wolfSSHD_ConfigGetWinUserPvPara(WOLFSSHD_CONFIG* conf);
54+
int wolfSSHD_ConfigSetWinUserPvPara(WOLFSSHD_CONFIG* conf, const char* value);
4755
int wolfSSHD_ConfigSetUserCAKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
4856
word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf);
4957
char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf);

‎apps/wolfsshd/wolfsshd.c‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -406,9 +406,10 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx)
406406
#endif /* WOLFSSH_OSSH_CERTS || WOLFSSH_CERTS */
407407

408408
#ifdef WOLFSSH_CERTS
409-
/* check if loading in system CA certs */
409+
/* check if loading in system and/or user CA certs */
410410
#ifdef WOLFSSL_SYS_CA_CERTS
411-
if (ret == WS_SUCCESS && wolfSSHD_ConfigGetSystemCA(conf)) {
411+
if (ret == WS_SUCCESS && (wolfSSHD_ConfigGetSystemCA(conf)
412+
|| wolfSSHD_ConfigGetUserCAStore(conf))) {
412413
WOLFSSL_CTX* sslCtx;
413414

414415
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Using system CAs");
@@ -419,9 +420,23 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx)
419420
}
420421

421422
if (ret == WS_SUCCESS) {
422-
if (wolfSSL_CTX_load_system_CA_certs(sslCtx) != WOLFSSL_SUCCESS) {
423-
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading system CAs");
424-
ret = WS_FATAL_ERROR;
423+
if (wolfSSHD_ConfigGetSystemCA(conf)) {
424+
if (wolfSSL_CTX_load_system_CA_certs(sslCtx) != WOLFSSL_SUCCESS) {
425+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading system CAs");
426+
ret = WS_FATAL_ERROR;
427+
}
428+
}
429+
}
430+
431+
if (ret == WS_SUCCESS) {
432+
if (wolfSSHD_ConfigGetUserCAStore(conf)) {
433+
if (wolfSSL_CTX_load_windows_user_CA_certs(sslCtx,
434+
wolfSSHD_ConfigGetWinUserStores(conf),
435+
wolfSSHD_ConfigGetWinUserDwFlags(conf),
436+
wolfSSHD_ConfigGetWinUserPvPara(conf)) != WOLFSSL_SUCCESS) {
437+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Issue loading user CAs");
438+
ret = WS_FATAL_ERROR;
439+
}
425440
}
426441
}
427442

0 commit comments

Comments
 (0)