Skip to content

Commit c51f6f4

Browse files
JacobBarthelmehJacobBarthelmeh
committed
sanity check on input and refactor parse cert store spec function
1 parent f8fc0c9 commit c51f6f4

6 files changed

Lines changed: 106 additions & 94 deletions

File tree

‎examples/client/common.c‎

Lines changed: 0 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1223,92 +1223,5 @@ int ClientSetupCertStoreAuth(WOLFSSH_CTX* ctx)
12231223
fprintf(stderr, "No cert store key found in CTX\n");
12241224
return WS_BAD_ARGUMENT;
12251225
}
1226-
1227-
1228-
/* Parse a cert store spec string "store:subject:flags" into wide-string
1229-
* components. Allocates wStoreName and wSubjectName via WMALLOC; caller
1230-
* must WFREE them. dwFlags is set to the parsed flags value.
1231-
* Returns WS_SUCCESS on success. */
1232-
int ParseCertStoreSpec(const char* spec,
1233-
wchar_t** wStoreName, wchar_t** wSubjectName,
1234-
DWORD* dwFlags, void* heap)
1235-
{
1236-
char* specCopy = NULL;
1237-
char* storeName = NULL;
1238-
char* subjectName = NULL;
1239-
char* flagsStr = NULL;
1240-
int wStoreNameLen, wSubjectNameLen;
1241-
size_t specLen;
1242-
1243-
if (spec == NULL || wStoreName == NULL || wSubjectName == NULL ||
1244-
dwFlags == NULL) {
1245-
return WS_BAD_ARGUMENT;
1246-
}
1247-
1248-
*wStoreName = NULL;
1249-
*wSubjectName = NULL;
1250-
*dwFlags = CERT_SYSTEM_STORE_CURRENT_USER;
1251-
1252-
specLen = WSTRLEN(spec) + 1;
1253-
specCopy = (char*)WMALLOC(specLen, heap, DYNTYPE_TEMP);
1254-
if (specCopy == NULL)
1255-
return WS_MEMORY_E;
1256-
WSTRNCPY(specCopy, spec, specLen);
1257-
1258-
/* Parse "store:subject:flags" */
1259-
storeName = specCopy;
1260-
subjectName = WSTRCHR(storeName, ':');
1261-
if (subjectName != NULL) {
1262-
*subjectName++ = '\0';
1263-
flagsStr = WSTRCHR(subjectName, ':');
1264-
if (flagsStr != NULL) {
1265-
*flagsStr++ = '\0';
1266-
if (WSTRCMP(flagsStr, "CURRENT_USER") == 0) {
1267-
*dwFlags = CERT_SYSTEM_STORE_CURRENT_USER;
1268-
} else if (WSTRCMP(flagsStr, "LOCAL_MACHINE") == 0) {
1269-
*dwFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE;
1270-
} else {
1271-
*dwFlags = (DWORD)atoi(flagsStr);
1272-
}
1273-
}
1274-
}
1275-
1276-
if (storeName == NULL || subjectName == NULL || *storeName == '\0' ||
1277-
*subjectName == '\0') {
1278-
WFREE(specCopy, heap, DYNTYPE_TEMP);
1279-
return WS_BAD_ARGUMENT;
1280-
}
1281-
1282-
/* Convert to wide strings */
1283-
wStoreNameLen = MultiByteToWideChar(CP_UTF8, 0, storeName, -1, NULL, 0);
1284-
wSubjectNameLen = MultiByteToWideChar(CP_UTF8, 0, subjectName, -1,
1285-
NULL, 0);
1286-
1287-
*wStoreName = (wchar_t*)WMALLOC(wStoreNameLen * sizeof(wchar_t),
1288-
heap, DYNTYPE_TEMP);
1289-
*wSubjectName = (wchar_t*)WMALLOC(wSubjectNameLen * sizeof(wchar_t),
1290-
heap, DYNTYPE_TEMP);
1291-
1292-
if (*wStoreName == NULL || *wSubjectName == NULL) {
1293-
if (*wStoreName != NULL) {
1294-
WFREE(*wStoreName, heap, DYNTYPE_TEMP);
1295-
*wStoreName = NULL;
1296-
}
1297-
if (*wSubjectName != NULL) {
1298-
WFREE(*wSubjectName, heap, DYNTYPE_TEMP);
1299-
*wSubjectName = NULL;
1300-
}
1301-
WFREE(specCopy, heap, DYNTYPE_TEMP);
1302-
return WS_MEMORY_E;
1303-
}
1304-
1305-
MultiByteToWideChar(CP_UTF8, 0, storeName, -1,
1306-
*wStoreName, wStoreNameLen);
1307-
MultiByteToWideChar(CP_UTF8, 0, subjectName, -1,
1308-
*wSubjectName, wSubjectNameLen);
1309-
1310-
WFREE(specCopy, heap, DYNTYPE_TEMP);
1311-
return WS_SUCCESS;
1312-
}
13131226
#endif /* WOLFSSH_CERTS */
13141227
#endif /* USE_WINDOWS_API */

‎examples/client/common.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,6 @@ int ClientSetTpm(WOLFSSH* ssh);
4040
int ClientSetPrivateKeyFromStore(WOLFSSH_CTX* ctx,
4141
const wchar_t* storeName, DWORD dwFlags, const wchar_t* subjectName);
4242
int ClientSetupCertStoreAuth(WOLFSSH_CTX* ctx);
43-
int ParseCertStoreSpec(const char* spec,
44-
wchar_t** wStoreName, wchar_t** wSubjectName,
45-
DWORD* dwFlags, void* heap);
4643
#endif /* WOLFSSH_CERTS */
4744
#endif /* USE_WINDOWS_API */
4845

‎examples/echoserver/echoserver.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
#include <wolfssh/internal.h>
4242
#include <wolfssh/wolfsftp.h>
4343
#include <wolfssh/agent.h>
44+
#include <wolfssh/certman.h>
4445
#include <wolfssh/port.h>
4546
#include <wolfssh/test.h>
4647
#include <wolfssl/wolfcrypt/ecc.h>
@@ -2965,7 +2966,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
29652966
DWORD dwFlags = 0;
29662967
int ret;
29672968

2968-
ret = ParseCertStoreSpec(certStoreSpec, &wStoreName,
2969+
ret = wolfSSH_ParseCertStoreSpec(certStoreSpec, &wStoreName,
29692970
&wSubjectName, &dwFlags, NULL);
29702971
if (ret != WS_SUCCESS) {
29712972
ES_ERROR("Invalid cert store spec. Use: store:subject:flags\n");

‎examples/sftpclient/sftpclient.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
#include <wolfssh/ssh.h>
3434
#include <wolfssh/internal.h>
3535
#include <wolfssh/wolfsftp.h>
36+
#include <wolfssh/certman.h>
3637
#include <wolfssh/test.h>
3738
#include <wolfssh/port.h>
3839
#include <wolfssl/wolfcrypt/ecc.h>
@@ -1428,7 +1429,7 @@ THREAD_RETURN WOLFSSH_THREAD sftpclient_test(void* args)
14281429
wchar_t* wSubjectName = NULL;
14291430
DWORD dwFlags = 0;
14301431

1431-
ret = ParseCertStoreSpec(certStoreSpec, &wStoreName,
1432+
ret = wolfSSH_ParseCertStoreSpec(certStoreSpec, &wStoreName,
14321433
&wSubjectName, &dwFlags, NULL);
14331434
if (ret != WS_SUCCESS) {
14341435
err_sys("Invalid cert store spec. Use: store:subject:flags");

‎src/certman.c‎

Lines changed: 94 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,12 +88,12 @@ struct WOLFSSH_CERTMAN {
8888
*/
8989
int wolfSSH_SetCertManager(WOLFSSH_CTX* ctx, WOLFSSL_CERT_MANAGER* cm)
9090
{
91-
if (ctx == NULL || cm == NULL) {
91+
if (ctx == NULL || cm == NULL || ctx->certMan == NULL) {
9292
return WS_BAD_ARGUMENT;
9393
}
9494

9595
/* free up existing cm if present */
96-
if (ctx->certMan != NULL && ctx->certMan->cm != NULL) {
96+
if (ctx->certMan->cm != NULL) {
9797
wolfSSL_CertManagerFree(ctx->certMan->cm);
9898
}
9999
wolfSSL_CertManager_up_ref(cm);
@@ -565,4 +565,96 @@ static int CheckProfile(DecodedCert* cert, int profile)
565565
}
566566
#endif /* WOLFSSH_NO_FPKI */
567567

568+
569+
#if defined(USE_WINDOWS_API)
570+
/* Parse a cert store spec string "store:subject:flags" into wide-string
571+
* components. Allocates wStoreName and wSubjectName via WMALLOC; caller
572+
* must WFREE them. dwFlags is set to the parsed flags value.
573+
* Returns WS_SUCCESS on success. */
574+
int wolfSSH_ParseCertStoreSpec(const char* spec,
575+
wchar_t** wStoreName, wchar_t** wSubjectName,
576+
DWORD* dwFlags, void* heap)
577+
{
578+
char* specCopy = NULL;
579+
char* storeName = NULL;
580+
char* subjectName = NULL;
581+
char* flagsStr = NULL;
582+
int wStoreNameLen, wSubjectNameLen;
583+
size_t specLen;
584+
585+
if (spec == NULL || wStoreName == NULL || wSubjectName == NULL ||
586+
dwFlags == NULL) {
587+
return WS_BAD_ARGUMENT;
588+
}
589+
590+
*wStoreName = NULL;
591+
*wSubjectName = NULL;
592+
*dwFlags = CERT_SYSTEM_STORE_CURRENT_USER;
593+
594+
specLen = WSTRLEN(spec) + 1;
595+
specCopy = (char*)WMALLOC(specLen, heap, DYNTYPE_TEMP);
596+
if (specCopy == NULL)
597+
return WS_MEMORY_E;
598+
WSTRNCPY(specCopy, spec, specLen);
599+
600+
/* Parse "store:subject:flags" */
601+
storeName = specCopy;
602+
subjectName = WSTRCHR(storeName, ':');
603+
if (subjectName != NULL) {
604+
*subjectName++ = '\0';
605+
flagsStr = WSTRCHR(subjectName, ':');
606+
if (flagsStr != NULL) {
607+
*flagsStr++ = '\0';
608+
if (WSTRCMP(flagsStr, "CURRENT_USER") == 0) {
609+
*dwFlags = CERT_SYSTEM_STORE_CURRENT_USER;
610+
}
611+
else if (WSTRCMP(flagsStr, "LOCAL_MACHINE") == 0) {
612+
*dwFlags = CERT_SYSTEM_STORE_LOCAL_MACHINE;
613+
}
614+
else {
615+
*dwFlags = (DWORD)atoi(flagsStr);
616+
}
617+
}
618+
}
619+
620+
if (storeName == NULL || subjectName == NULL || *storeName == '\0' ||
621+
*subjectName == '\0') {
622+
WFREE(specCopy, heap, DYNTYPE_TEMP);
623+
return WS_BAD_ARGUMENT;
624+
}
625+
626+
/* Convert to wide strings */
627+
wStoreNameLen = MultiByteToWideChar(CP_UTF8, 0, storeName, -1, NULL, 0);
628+
wSubjectNameLen = MultiByteToWideChar(CP_UTF8, 0, subjectName, -1,
629+
NULL, 0);
630+
631+
*wStoreName = (wchar_t*)WMALLOC(wStoreNameLen * sizeof(wchar_t),
632+
heap, DYNTYPE_TEMP);
633+
*wSubjectName = (wchar_t*)WMALLOC(wSubjectNameLen * sizeof(wchar_t),
634+
heap, DYNTYPE_TEMP);
635+
636+
if (*wStoreName == NULL || *wSubjectName == NULL) {
637+
if (*wStoreName != NULL) {
638+
WFREE(*wStoreName, heap, DYNTYPE_TEMP);
639+
*wStoreName = NULL;
640+
}
641+
if (*wSubjectName != NULL) {
642+
WFREE(*wSubjectName, heap, DYNTYPE_TEMP);
643+
*wSubjectName = NULL;
644+
}
645+
WFREE(specCopy, heap, DYNTYPE_TEMP);
646+
return WS_MEMORY_E;
647+
}
648+
649+
MultiByteToWideChar(CP_UTF8, 0, storeName, -1,
650+
*wStoreName, wStoreNameLen);
651+
MultiByteToWideChar(CP_UTF8, 0, subjectName, -1,
652+
*wSubjectName, wSubjectNameLen);
653+
654+
WFREE(specCopy, heap, DYNTYPE_TEMP);
655+
return WS_SUCCESS;
656+
}
657+
#endif /* USE_WINDOWS_API */
658+
659+
568660
#endif /* WOLFSSH_CERTS */

‎wolfssh/certman.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ int wolfSSH_CERTMAN_VerifyCerts_buffer(WOLFSSH_CERTMAN* cm,
5959
const unsigned char* cert, word32 certSz, word32 certCount);
6060

6161

62+
#if defined(USE_WINDOWS_API)
63+
WOLFSSH_API
64+
int wolfSSH_ParseCertStoreSpec(const char* spec,
65+
wchar_t** wStoreName, wchar_t** wSubjectName,
66+
DWORD* dwFlags, void* heap);
67+
#endif /* USE_WINDOWS_API */
68+
69+
6270
#ifdef __cplusplus
6371
}
6472
#endif

0 commit comments

Comments
 (0)