The password prompt reads stdin with fgets(), and a buffered stdin
keeps its own copy of the line in libc for the life of the process.
The clients make stdin unbuffered before any stdin I/O, so the typed
password lands only in the buffer ClientUserAuth() wipes.
- the wolfssh app, and the example client, sftp client and scp client
whether or not -P was given, as keyboard-interactive reads stdin too
- ClientUnbufferStdin() acts once per process and reports a failure
- scripts/sshclient.test sends the session data right after the
password, with no sleep
Issue: F-15669
ClientUserAuth() hands the library its static password buffer, and the
library sends from it after the callback returns. The clients now wipe
it, and the example's keyboard-interactive responses, as soon as
connect returns instead of holding them for the whole session.
- ClientClearPassword() in both common.c copies, called after connect
in the wolfssh app, the example client and the sftp client
- the password arm wipes before each prompt and on failure, so a retry
keeps no tail of a longer password
- the keyboard arm wipes its scratch copy after each response
- tests: regress and auth cases for the retry tail, the wipe and a
failed read
Issue: F-8846
The -p option of wolfssh, client, wolfscp, wolfsftp and echoserver now
goes through a strtol check, so a value that is not wholly a number in
range exits with an error instead of wrapping into a different port.
- apps/wolfssh: ClientParsePort(), shared with ClientParseDestination(),
which also rejects an empty "ssh://host:" port instead of defaulting
- examples: a ClientParsePort() in examples/client/common.c; port 0 is
rejected in every build, not only with a main driver
- echoserver: accepts 0 to 65535, keeping 0 for the test harness
- add TestClientParsePort and an empty URI port case to regress.test
Issue: F-14763, F-14767, F-14768, F-12552
The remaining teardown sites spun wolfSSH_worker() ten times after
wolfSSH_shutdown(), the loop the client and the echoserver just
replaced. The clients now send a disconnect and drain, and wolfsshd
half closes and drains like the echoserver.
- sftpclient.c, scpclient.c, portfwd.c and the wolfssh app call
SendDisconnectAndDrain() and treat either give-up as a clean close.
- scpclient.c and the wolfssh app report an unexpected shutdown result,
as the client does.
- the wolfssh app waits for the channel close before draining, as the
client does, and fails on an error that broke the wait.
- wolfsshd drained by hand after wolfSSH_free(), with no bound on a peer
that never hung up. HalfCloseAndDrain() bounds it at ten seconds, and
a peer that let the login grace time run out is not drained.
The "Unable to copy" message now carries the return code and the
session error with its name. The return alone is usually the generic
WS_FATAL_ERROR, which says nothing about the cause.
enable SHA1 with windows cert store test case
expand test cases, adjust to authorized key file, minor dead code adjustments
add more documentation, refactor duplicate code sections, clean up test cases, more adjustments to logging spamming protections
add Windows cert store test case
make windows cert feature default disabled and simplify macro guard
additional unit tests, advertise x509 and pubkey, use CN to match username, build check for WOLFSSL_SYS_CA_CERTS, fix for CM ref count
additional build test, uniform enum name, fail on unkown cert store ecc curve, tie in of loading whole cert store for sys CA's
Every in-tree caller of wolfSSH_worker() now recognises a peer half-close.
wolfsshd's shell loop and both echoservers need it: all three ladders end in
"else if (rc != WS_WANT_READ) break", and wolfsshd's reaches
kill(childPid, SIGKILL), so without it a client half-close kills the command
it just finished feeding.
- wolfsshd closes the child's stdin off the channel's own EOF state instead of
off a worker return of zero, which no longer happens on a half-close.
- The echoservers answer the half-close off wolfSSH_ChannelGetEof() rather
than the WS_EOF status: the flush inside wolfSSH_worker() can supersede that
status, and it is raised once. They hand back the backlog first, finish a
short send, and only send the EOF once the channel is empty. Answering is
not conditional on the shell build, where an echo session is the default.
- The SFTP loops peek before leaving, so a half-close with requests still
buffered is served rather than dropped, and they report an ordinary session
end as success.
- The clients -- examples/client, scpclient, sftpclient, apps/wolfssh -- treat
it as the graceful case instead of an error. apps/wolfssh counts it as a
finished flush as well, since one worker pass can drain the queue and
consume the peer's EOF together.
- portfwd relays it to the local socket with shutdown(SHUT_WR) so a local
reader waiting on end-of-input returns, once the backlog has genuinely been
handed over: a read cut short by a rekey leaves the half-close for a later
pass.
- The Windows half of wolfsshd does not answer with an EOF of its own. That
latches eofTxd and the child's remaining output would be refused, which is
the defect this series removes from the library.
- The mplabx port drains before tearing down, the way its SFTP read path
already did; its worker arm was unreachable for a half-close until now.
- sftpclient passes userEcc to ClientUsePubKey(), and scpclient to
both ClientSetPrivateKey() and ClientUsePubKey(), in place of a
hardcoded 0.
- scpclient gains a userEcc; it and client default it to 1 under
WOLFSSH_NO_RSA, as sftpclient already did.
- ClientSetPrivateKey() and ClientUsePubKey() name the missing
algorithm on stderr and return WS_NOT_COMPILED when the built-in
key they select is compiled out.
- Both skip the built-in load entirely when neither RSA nor ECC is
compiled in, clearing the key size and type and returning success
so password-only authentication still runs. ClientUsePubKey()'s
buffer pointer moves inside the guard so it is not left unused.
Issue: F-8829
Cleanup clang-tidy bugprone-signal-handler findings.
- wolfsshd: drop fprintf from interruptCatch; the main accept
loop logs "Closing down wolfSSHD" after seeing quit set.
- sftpclient: annotate wolfSSH_SFTP_Interrupt call in
sig_handler with NOLINT, since the function is only a single
byte store and is safe to call from a signal handler.
1. When cleaning the path, check that the path pointer is not null
before using it.
2. Move the strlen of path.
3. Remove the second check of path, and just loop over it.
Fixed CID: 572847
* Update myStatusCb to output once per second
Modified the myStatusCb function in sftpclient.c to only output status
updates once per second by tracking the last output time and comparing
it with the current time. This reduces the frequency of status updates
while maintaining all existing functionality.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Reset status output timer when starting new file transfer
When starting a new file transfer, reset the lastOutputTime to ensure
the first status update for the new file is shown immediately.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Fix Zephyr build by guarding lastOutputTime with WOLFSSH_NO_TIMESTAMP
The lastOutputTime variable is only used when timestamps are enabled,
so it should be guarded by the same macro to avoid unused variable
warnings in builds where timestamps are disabled.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Move elapsedTime declaration to function scope
Per wolfSSL coding standards, declare all variables at function scope.
Added comment explaining that modern compilers optimize variable access
regardless of declaration placement.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Fix timeout check to use elapsed time instead of current time
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Use elapsed time in timeout error message for consistency
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Move elapsedTime inside WOLFSSH_NO_TIMESTAMP guard
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Move currentTime outside WOLFSSH_NO_TIMESTAMP guard
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: andrew@wolfssl.com <andrew@wolfssl.com>
1. In the echoserver, change the names of the defines for the
static memory values.
2. Modify the client common functions for keys and certs to take a heap
value for their allocations.
3. Update the client's use of the common key and cert function calls to
pass NULL for the heap.
4. Add a static memory description for the sftp client code.
1. Fix an instance in the example sftpclient where the size of something
is treated as an int and may have caused trouble, per the pedantic
compiler settings.
2. Changed a check for snprintf where we checked the lengths of
everything before calling snprintf. Turned it around where we check
the return of snprintf and error if the process would have output too
much.
1. When putting a file with SFTP, the client should check that the
requested file is a regular file based on its attributes.
2. Add the attributes to check in the permissions.
3. Add server checking for non-regular files and not allowing them to
be opened for reading or writing.
1. When getting a file with SFTP, the client should check that the
requested file is a regular file based on its attributes.
2. Add the attributes to check in the permissions.
3. Add a new error for a non-regular file.
John Safranek
JacobBarthelmeh
Yosuke Shimizu
Mark Atwood
Paul Adelsbach
aidan garske
Andrew Hutchings
devin-ai-integration[bot]
Anthony Hu
Hideki Miyazaki
Juliusz Sosinowicz