remove legacy support and address review items

Author: JacobBarthelmeh

apps/wolfsshd/wolfsshd.c

@@ -466,51 +466,51 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
                 ret = WS_BAD_ARGUMENT;
             }
             else {
-            byte* data;
-            word32 dataSz = 0;
+                byte* data;
+                word32 dataSz = 0;
+
+                /* The host private key is a secret trust anchor: refuse a symlink,
+                 * an unsafe owner or path, or a group/world readable/writable
+                 * file. */
+                data = getBufferFromFile(hostKey, &dataSz, heap,
+                    WOLFSSHD_LOAD_SECRET);
+                if (data == NULL) {
+                    /* NULL means the secure gate rejected the file (bad owner,
+                     * symlink, group/world writable/readable; reason already
+                     * logged) or the read failed, so report a file error rather
+                     * than a memory error. */
+                    wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Error reading host key file.");
+                    ret = WS_BAD_FILE_E;
 
-            /* The host private key is a secret trust anchor: refuse a symlink,
-             * an unsafe owner or path, or a group/world readable/writable
-             * file. */
-            data = getBufferFromFile(hostKey, &dataSz, heap,
-                WOLFSSHD_LOAD_SECRET);
-            if (data == NULL) {
-                /* NULL means the secure gate rejected the file (bad owner,
-                 * symlink, group/world writable/readable; reason already
-                 * logged) or the read failed, so report a file error rather
-                 * than a memory error. */
-                wolfSSH_Log(WS_LOG_ERROR,
-                    "[SSHD] Error reading host key file.");
-                ret = WS_BAD_FILE_E;
+                }
 
-            }
+                if (ret == WS_SUCCESS) {
+                    if (wc_PemToDer(data, dataSz, PRIVATEKEY_TYPE, &der, NULL,
+                                    NULL, NULL) != 0) {
+                        wolfSSH_Log(WS_LOG_DEBUG, "[SSHD] Failed to convert host "
+                                    "private key from PEM. Assuming key in DER "
+                                    "format.");
+                        privBuf = data;
+                        privBufSz = dataSz;
+                    }
+                    else {
+                        privBuf = der->buffer;
+                        privBufSz = der->length;
+                    }
 
-            if (ret == WS_SUCCESS) {
-                if (wc_PemToDer(data, dataSz, PRIVATEKEY_TYPE, &der, NULL,
-                                NULL, NULL) != 0) {
-                    wolfSSH_Log(WS_LOG_DEBUG, "[SSHD] Failed to convert host "
-                                "private key from PEM. Assuming key in DER "
-                                "format.");
-                    privBuf = data;
-                    privBufSz = dataSz;
-                }
-                else {
-                    privBuf = der->buffer;
-                    privBufSz = der->length;
-                }
+                    if (wolfSSH_CTX_UsePrivateKey_buffer(*ctx, privBuf, privBufSz,
+                                                         WOLFSSH_FORMAT_ASN1) < 0) {
+                        wolfSSH_Log(WS_LOG_ERROR,
+                            "[SSHD] Failed to use host private key.");
+                        ret = WS_BAD_ARGUMENT;
+                    }
 
-                if (wolfSSH_CTX_UsePrivateKey_buffer(*ctx, privBuf, privBufSz,
-                                                     WOLFSSH_FORMAT_ASN1) < 0) {
-                    wolfSSH_Log(WS_LOG_ERROR,
-                        "[SSHD] Failed to use host private key.");
-                    ret = WS_BAD_ARGUMENT;
+                    freeBufferFromFile(data, heap);
+                    wc_FreeDer(&der);
                 }
-
-                freeBufferFromFile(data, heap);
-                wc_FreeDer(&der);
             }
         }
-        }
     }
 
 #if defined(WOLFSSH_OSSH_CERTS) || defined(WOLFSSH_CERTS)
@@ -615,6 +615,16 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
             wolfSSL_CTX_free(sslCtx);
         }
     }
+    #else
+    /* The system/user CA-store directives are parsed unconditionally, so warn
+     * if they were set but wolfSSL was built without WOLFSSL_SYS_CA_CERTS,
+     * rather than silently ignoring them. */
+    if (ret == WS_SUCCESS && (wolfSSHD_ConfigGetSystemCA(conf)
+                              || wolfSSHD_ConfigGetUserCAStore(conf))) {
+        wolfSSH_Log(WS_LOG_ERROR,
+            "[SSHD] wolfSSH_TrustedSystemCAKeys/wolfSSH_TrustedUserCaStore set "
+            "but wolfSSL was built without WOLFSSL_SYS_CA_CERTS; ignoring.");
+    }
     #endif
 
     /* load in CA certs from file set */