enable SHA1 with windows cert store test case
expand test cases, adjust to authorized key file, minor dead code adjustments
add more documentation, refactor duplicate code sections, clean up test cases, more adjustments to logging spamming protections
add Windows cert store test case
make windows cert feature default disabled and simplify macro guard
additional unit tests, advertise x509 and pubkey, use CN to match username, build check for WOLFSSL_SYS_CA_CERTS, fix for CM ref count
additional build test, uniform enum name, fail on unkown cert store ecc curve, tie in of loading whole cert store for sys CA's
When a test is configured out, its entry function compiles down to
"return 77", the automake skip code, and the main() that forwards to it
inlines to the same two instructions. Apple's ld folds the two identical
bodies together and then writes LC_MAIN entryoff 0, so the binary starts
executing at the Mach-O header and dies with SIGILL instead of skipping.
tests/kex.test, tests/api.test and tests/auth.test all hit this under
--enable-all CPPFLAGS=-DWOLFSSH_TEST_BLOCK, and kex.test hits it again
under --disable-server.
Probe for -Wl,-no_deduplicate and add it to AM_LDFLAGS when the linker
takes it. GNU ld rejects the flag, so the check leaves Linux alone.
Making the skipped body differ does not help: anything added to the entry
function inlines into main() and the two fold again.
- Include AM_CPPFLAGS and config.h in the options snapshot so the
configured feature set (WOLFSSH_SCP/SFTP/NO_WOLFSSH_SERVER/...)
appears in the SBOM instead of being empty.
- Discover static (.a), Mach-O (.dylib) and Windows (.dll/.lib)
artifacts, not just a versioned .so.
- Set SOURCE_DATE_EPOCH from the last git commit for reproducible output.
- Clean staging tree and temp defines file via trap even on failure.
- Record wolfssl as an SBOM dependency (--dep-wolfssl), version
auto-detected from WOLFSSL_DIR/wolfssl/version.h.
- configure.ac: detect git; drop unused version-info split + comment.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Adds sbom, install-sbom, and uninstall-sbom targets.
Runs gen-sbom to produce CDX and SPDX outputs.
Requires WOLFSSL_DIR pointing to a wolfssl tree with
the feat/sbom-embedded branch (includes gen-sbom).
The client runs every session's I/O on threads, so it needs a threaded
wolfSSL. configure probes for SINGLE_THREADED when the client app is
enabled. Asking for the app with --enable-sshclient is an error, getting
it from --enable-all drops the app instead, so --enable-all still
configures against a single threaded wolfSSL.
The compile time check stays for the builds that never run configure.
That leaves the SINGLE_THREADED terms in the app's own guards
unreachable, so drop them.
- Setters stored caller string verbatim; "none" cipher/MAC risked cleartext
- Add CheckAlgoList()/NameToIdType() to validate each token by category
- Set* now returns WS_INVALID_ALGO_ID on bad/NULL input, list unchanged
- "none" is rejected in the key list, and allowed for cipher/MAC only under
WOLFSSH_ALLOW_NONE_CIPHER
- Names unknown to the build are skipped rather than rejected, so a portable
superset list still works; a known name in the wrong category fails
- Reject empty list elements apart from one trailing comma, which would
otherwise reach KEXINIT as a zero-length name
- Give ID_NONE a block size so the none cipher no longer divides by zero in
BundlePacket(), and skip the zero-length key derivations it implies
- Treat an empty peer server-sig-algs as no extension rather than a fatal
parse error
- The "at least one X" guards checked the implementation macros but not the
soft-disable macros that gate joining the canned default list, so a build
whose only survivors are soft-disabled got an empty default list: KEXINIT
advertised nothing and CheckAlgoList() rejected it. Reachable as
-DWOLFSSH_NO_HMAC_SHA2_256 -DWOLFSSH_NO_HMAC_SHA2_512 and as
-DWOLFSSH_NO_AES_GCM -DWOLFSSH_NO_AES_CTR; both now fail at compile time
naming the soft-disable macro to define
- Zero MAC algorithms is already a hard #error, so assert the queried MAC
list in test_wolfSSH_SetAlgoList() rather than returning early, which was
hiding the KEX/KEY/CIPHER coverage behind an unreachable guard
Issue: 2474
1. Adds --disable-server and --disable-client configure flags. Allows for
compile-time exclusion of server or client code.
2. Add check to internal.h for both NO_WOLFSSH_SERVER and
NO_WOLFSSH_CLIENT being set and errors.
3. In ports.h, add check for not-NO_WOLFSSH_CLIENT so SFTP/SCP
filesystrem types are also available in client-only builds.
4. Update the NO_WOLFSSH_SERVER and NO_WOLFSSH_DIR guards around
wolfsftp.c. Update wolfSSH_SFTP_free() to skip directory cleanup
when server code is disabled.
ZD #21261
1. Update the version requirements of libtool, automake, and autoconf to
version contemporary to the first release of wolfSSH.
2. Group all checks of `ENABLED_TPM` into one `AS_IF`.
3. Group all checks of `ENABLED_SSHD` into one `AS_IF`.
4. Replace `if` and `case` with `AS_IF` and `AS_CASE`.
1. Add a check for limits.h to configure.ac.
2. In wolfSSHd's configuration.c file, add an include of limits.h if
available. It is including the header indirectly while using it
directly.
1. Remove the grace period wolfSSHd test. It asks for a password, and
when running as an action it doesn't have stdin, so it fails. The
test works when stdin is available.
2. Remove the check for __uint128_t from configure. wolfSSL exports this
value, if present, in its options.h. After wolfSSL v5.6.4, wolfSSL
also exports this to options.h when building it with CMake. The check
in wolfSSH isn't necessary now.
1. Changed gathering the PTY window size from being OS dependent to
availability of ioctl.h so both Linux and MacOS would start with the
correct size.
2. Added a check to configure for sys/ioctl.h.
3. Changed GetTerminalSize() so it returns the pix width and height as
well.
1. For the new X.509 user certificate support, add a new stub source
file for the wrapper code around wolfSSL's CertManager.
2. Update the makefile includes to use the new source file and header.
3. Update configure with the `--enable-certs` option.
JacobBarthelmeh
John Safranek
Sameeh Jubran
Mark Atwood
Paul Adelsbach
Yosuke Shimizu
Andrew Hutchings
aidan garske
Anthony Hu
Andrew Hutchings