Build and configure with a C++ compiler

.github/workflows/cxx-check.yml

@@ -0,0 +1,103 @@
+name: C++ Build Test
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  WOLFSSL_REF: master
+
+jobs:
+  build_wolfssl:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest, macos-latest ]
+    name: Build wolfssl
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 6
+    steps:
+      - name: Checking cache for wolfssl
+        uses: actions/cache@v5
+        id: cache-wolfssl
+        with:
+          path: build-dir/
+          key: wolfssh-cxx-check-wolfssl-${{ env.WOLFSSL_REF }}-${{ matrix.os }}
+          lookup-only: true
+
+      - name: Checkout, build, and install wolfssl
+        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
+        uses: wolfSSL/actions-build-autotools-project@v1
+        with:
+          repository: wolfssl/wolfssl
+          ref: ${{ env.WOLFSSL_REF }}
+          path: wolfssl
+          configure: --enable-all
+          check: false
+          install: true
+
+  # wolfSSL is built as C above; only wolfSSH is compiled as C++, with the
+  # C++ compiler as CC so every .c file goes through it. clang++ warns that
+  # compiling a .c file as C++ is deprecated, so that one warning is
+  # turned off to keep -Werror.
+  build_wolfssh:
+    needs: build_wolfssl
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - { os: ubuntu-latest, cc: g++, cflags: -Werror }
+          - { os: ubuntu-latest, cc: clang++, cflags: -Werror -Wno-deprecated }
+          - { os: macos-latest, cc: clang++, cflags: -Werror -Wno-deprecated }
+        config: [ '', '--enable-all' ]
+    name: Build wolfssh (${{ matrix.target.os }}, ${{ matrix.target.cc }}, ${{ matrix.config }})
+    runs-on: ${{ matrix.target.os }}
+    timeout-minutes: 10
+    steps:
+      - name: Checking cache for wolfssl
+        uses: actions/cache@v5
+        with:
+          path: build-dir/
+          key: wolfssh-cxx-check-wolfssl-${{ env.WOLFSSL_REF }}-${{ matrix.target.os }}
+          fail-on-cache-miss: true
+
+      - uses: actions/checkout@v6
+        with:
+          path: wolfssh/
+
+      - name: Install autotools
+        if: runner.os == 'macOS'
+        run: brew install automake libtool
+
+      - name: autogen
+        working-directory: ./wolfssh/
+        run: ./autogen.sh
+
+      - name: configure
+        working-directory: ./wolfssh/
+        run: |
+          ./configure ${{ matrix.config }} \
+            --with-wolfssl=${{ github.workspace }}/build-dir \
+            CC=${{ matrix.target.cc }} CFLAGS="${{ matrix.target.cflags }}"
+
+      - name: make
+        working-directory: ./wolfssh/
+        run: make -j$(getconf _NPROCESSORS_ONLN)
+
+      - name: make check
+        working-directory: ./wolfssh/
+        run: make check
+
+      - name: Show logs on errors
+        if: failure()
+        working-directory: ./wolfssh/
+        run: |
+          cat config.log
+          cat test-suite.log || true

configure.ac

@@ -58,7 +58,24 @@ AC_TYPE_UINTPTR_T
 # Check headers/libs
 AC_CHECK_HEADERS([limits.h sys/select.h sys/time.h sys/ioctl.h pty.h util.h termios.h])
 AC_CHECK_LIB([network],[socket])
-AC_CHECK_LIB([util],[forkpty])
+
+# Probe forkpty through its header. AC_CHECK_LIB's bare declaration has no
+# extern "C", so the link fails under CC=g++.
+AC_MSG_CHECKING([for forkpty in -lutil])
+SAVED_LIBS="$LIBS"
+LIBS="-lutil $LIBS"
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM([[#include <stddef.h>
+                     #ifdef HAVE_PTY_H
+                     #include <pty.h>
+                     #endif
+                     #ifdef HAVE_UTIL_H
+                     #include <util.h>
+                     #endif]],
+                   [[int fd; return (int)forkpty(&fd, NULL, NULL, NULL);]])],
+  [AC_MSG_RESULT([yes])],
+  [AC_MSG_RESULT([no])
+   LIBS="$SAVED_LIBS"])
 
 #wolfssl
 AC_MSG_CHECKING([for wolfSSL])
@@ -86,8 +103,42 @@ AC_ARG_WITH(wolfssl,
   ]
 )
 
-AC_CHECK_LIB([wolfssl],[wolfCrypt_Init],,[AC_MSG_ERROR([libwolfssl is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])
-AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday inet_ntoa memset socket socketpair wc_ecc_set_rng])
+# Probe the wolfSSL functions through their headers. AC_CHECK_LIB and
+# AC_CHECK_FUNCS declare the symbol without extern "C", so with CC=g++ the
+# link looks for a mangled name and fails.
+# The cache variable keeps AC_CHECK_LIB's name so a preset
+# ac_cv_lib_wolfssl_wolfCrypt_Init=yes still skips the link test.
+LIBS="-lwolfssl $LIBS"
+AC_CACHE_CHECK([for wolfCrypt_Init in -lwolfssl],
+  [ac_cv_lib_wolfssl_wolfCrypt_Init],
+  [AC_LINK_IFELSE(
+    [AC_LANG_PROGRAM([[#ifdef WOLFSSL_USER_SETTINGS
+                       #include <wolfssl/wolfcrypt/settings.h>
+                       #else
+                       #include <wolfssl/options.h>
+                       #endif
+                       #include <wolfssl/wolfcrypt/wc_port.h>]],
+                     [[return wolfCrypt_Init();]])],
+    [ac_cv_lib_wolfssl_wolfCrypt_Init=yes],
+    [ac_cv_lib_wolfssl_wolfCrypt_Init=no])])
+AS_IF([test "x$ac_cv_lib_wolfssl_wolfCrypt_Init" != "xyes"],
+  [AC_MSG_ERROR([libwolfssl is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])
+
+AC_MSG_CHECKING([for wc_ecc_set_rng])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM([[#ifdef WOLFSSL_USER_SETTINGS
+                     #include <wolfssl/wolfcrypt/settings.h>
+                     #else
+                     #include <wolfssl/options.h>
+                     #endif
+                     #include <wolfssl/wolfcrypt/ecc.h>]],
+                   [[return wc_ecc_set_rng(NULL, NULL);]])],
+  [AC_DEFINE([HAVE_WC_ECC_SET_RNG], [1],
+             [Define to 1 if you have the `wc_ecc_set_rng' function.])
+   AC_MSG_RESULT([yes])],
+  [AC_MSG_RESULT([no])])
+
+AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday inet_ntoa memset socket socketpair])
 
 # Check if the wc_MlDsaKey_MakePublicKey API is available.
 # The declaration is ML-DSA config-gated, so probe through the real header.
@@ -411,7 +462,14 @@ AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],
           AC_MSG_ERROR([the SSH client app needs base64 encoding for host key fingerprints and known_hosts entries. Rebuild wolfSSL with --enable-base64encode, or leave out --enable-sshclient.])])])
 AS_IF([test "x$ENABLED_TPM" = "xyes"],
       [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_TPM"
-       AC_CHECK_LIB([wolftpm],[wolfTPM2_Init],,[AC_MSG_ERROR([libwolftpm is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])])
+       AC_MSG_CHECKING([for wolfTPM2_Init in -lwolftpm])
+       LIBS="-lwolftpm $LIBS"
+       AC_LINK_IFELSE(
+         [AC_LANG_PROGRAM([[#include <wolftpm/tpm2_wrap.h>]],
+                          [[return wolfTPM2_Init(NULL, NULL, NULL);]])],
+         [AC_MSG_RESULT([yes])],
+         [AC_MSG_RESULT([no])
+          AC_MSG_ERROR([libwolftpm is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])])
 AS_IF([test "x$ENABLED_SSHD" = "xyes"],[
   AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SSHD"
   AS_IF([test -n "$PAM_LIB"],[
@@ -433,9 +491,21 @@ AS_IF([test "x$ENABLED_SSHD" = "xyes"],[
           [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBLOGIN"; LIBS="$LIBS -llogin"],
           [AC_MSG_ERROR(liblogin not found)])],
       [*darwin*],[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBCRYPT"],
-      [AC_CHECK_LIB([crypt],[crypt],
-        [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBCRYPT"; LIBS="$LIBS -lcrypt"],
-        [AC_MSG_ERROR(libcrypt not found)])])
+      [AC_MSG_CHECKING([for crypt in -lcrypt])
+       LIBS="$LIBS -lcrypt"
+       AC_LINK_IFELSE(
+         [AC_LANG_PROGRAM([[#ifndef _XOPEN_SOURCE
+                            #define _XOPEN_SOURCE
+                            #endif
+                            #ifndef _GNU_SOURCE
+                            #define _GNU_SOURCE
+                            #endif
+                            #include <unistd.h>]],
+                          [[return crypt("x", "xx") == NULL;]])],
+         [AC_MSG_RESULT([yes])
+          AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBCRYPT"],
+         [AC_MSG_RESULT([no])
+          AC_MSG_ERROR(libcrypt not found)])])
   ])
 ])
 

examples/echoserver/echoserver.c

@@ -896,8 +896,9 @@ static int wsShellStartCb(WOLFSSH_CHANNEL* channel, void* ctx)
         #if defined(HAVE_SYS_IOCTL_H)
         wolfSSH_DoModes(ssh->modes, ssh->modesSz, threadCtx->shellCtx.appFd);
         {
-            struct winsize s = {0};
+            struct winsize s;
 
+            WMEMSET(&s, 0, sizeof(s));
             s.ws_col = ssh->widthChar;
             s.ws_row = ssh->heightRows;
             s.ws_xpixel = ssh->widthPixels;

src/certman.c

@@ -825,8 +825,9 @@ static int CheckProfile(DecodedCert* cert, int profile)
         const byte* date;
         int         dateSz;
         byte        dateFormat;
-        struct tm t = { 0 };
+        struct tm t;
 
+        WMEMSET(&t, 0, sizeof(t));
         dateFormat = cert->afterDate[0]; /* i.e ASN_UTC_TIME */
         dateSz     = cert->afterDate[1];
         date       = &cert->afterDate[2];

src/internal.c

@@ -6898,8 +6898,8 @@ static int DoKexInit(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
         /* Defensive, not a live fix: an empty list fails to match below, so
          * the guess is never read. list[] is reused across the fields, so
          * take ID_UNKNOWN over a stale ID if that ever changes. */
-        kexIdGuess = (listSz > 0) ? list[0] : ID_UNKNOWN;
-        kexIdFirst = (cannedListSz > 0) ? cannedList[0] : ID_UNKNOWN;
+        kexIdGuess = (listSz > 0) ? list[0] : (byte)ID_UNKNOWN;
+        kexIdFirst = (cannedListSz > 0) ? cannedList[0] : (byte)ID_UNKNOWN;
         algoId = MatchIdLists(side, list, listSz,
                 cannedList, cannedListSz);
         if (algoId == ID_UNKNOWN) {
@@ -6989,8 +6989,8 @@ static int DoKexInit(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
         }
     }
     if (ret == WS_SUCCESS) {
-        pubKeyIdGuess = (listSz > 0) ? list[0] : ID_UNKNOWN;
-        pubKeyIdFirst = (cannedListSz > 0) ? cannedList[0] : ID_UNKNOWN;
+        pubKeyIdGuess = (listSz > 0) ? list[0] : (byte)ID_UNKNOWN;
+        pubKeyIdFirst = (cannedListSz > 0) ? cannedList[0] : (byte)ID_UNKNOWN;
         algoId = MatchIdLists(side, list, listSz, cannedList, cannedListSz);
         if (algoId == ID_UNKNOWN) {
             WLOG(WS_LOG_DEBUG, "Unable to negotiate Server Host Key Algo");

src/keygen.c

@@ -278,9 +278,11 @@ int wolfSSH_MakeMlDsaKey(byte* out, word32 outSz, word32 level)
 {
 #if !defined(WOLFSSH_NO_MLDSA)
     int ret = WS_SUCCESS;
-    WC_RNG rng = {0};
+    WC_RNG rng;
     byte wc_level;
 
+    WMEMSET(&rng, 0, sizeof(rng));
+
     WLOG(WS_LOG_DEBUG, "Entering wolfSSH_MakeMlDsaKey()");
 
     if      (level == WOLFSSH_MLDSAKEY_44) wc_level = WC_ML_DSA_44;

src/ssh.c

@@ -634,8 +634,10 @@ static int DoReceiveHandshake(WOLFSSH* ssh)
 
 #ifndef NO_WOLFSSH_SERVER
 
+#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
 const char acceptError[] = "accept error: %s, %d";
 const char acceptState[] = "accept state: %s";
+#endif
 
 
 int wolfSSH_accept(WOLFSSH* ssh)
@@ -899,8 +901,10 @@ int wolfSSH_accept(WOLFSSH* ssh)
 
 #ifndef NO_WOLFSSH_CLIENT
 
+#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
 const char connectError[] = "connect error: %s, %d";
 const char connectState[] = "connect state: %s";
+#endif
 
 
 int wolfSSH_connect(WOLFSSH* ssh)