With -F a peer's direct-tcpip open is set up only for a loopback
destination. The new -L option replaces that default with a list of
allowed host or host:port entries. Any other open is refused, which
the library reports as administratively prohibited.
- Check the destination in the WOLFSSH_FWD_LOCAL_SETUP action
- Document -L in the usage text and README.md
- openssh-interop.test checks a non-loopback destination and one left
out of -L are refused, and that host and host:port entries connect
Issue: F-11935
The forwarding callback connects and binds with the server's own
credentials, so it is registered only with the new -F option. Without
it the library turns down every forwarding request.
- Bind a remote forward for localhost or 127.0.0.1 to the loopback
address, not INADDR_ANY
- Refuse a remote forward to a privileged port or one over 65535
- Pass -F in fwd.test and fwd-bulk.test; document it in README.md
- openssh-interop.test checks a remote forward fails without -F, works
with it, and is refused by the port check for port 80
Issue: F-11935
The forwarded agent socket now lives in a mkdtemp() directory, and the
session's end runs the agent cleanup, which the library never calls on
a server. The relay addresses the agent channel by its own id and
drains each agent reply in full.
- Set agentChannelId from ssh->agent once the agent channel is open
- Drop agent replies when no local agent client is connected
- Close the accepted agent client in WOLFSSH_AGENT_LOCAL_CLEANUP and
remove the socket and its directory
- Print the socket path; openssh-interop.test forwards ssh-agent
through the echoserver, lists a reply larger than the relay buffer,
and checks the directory is private and removed
Issue: F-10553, F-11936, F-14396
- openssh-interop.test fails at each skip point when
WOLFSSH_TEST_REQUIRE_OPENSSH=1, and skips through skip_rest() for
the sshd and ssh-agent parts.
- sanitizer.yml sets WOLFSSH_TEST_REQUIRE_OPENSSH=1 for make check.
- PrepareUserAuthRequestRsa() checks the agent-backed key blob's type
against the request, decodes it with GetOpenSshPublicKey(), and
reserves the signature name by sigNameSz.
- BuildUserAuthRequestRsa() sizes the agent's reply room from the
requested signature algorithm, requests the rsa-sha2-* hash the
request names, and refuses a signature made with another algorithm.
- GetOpenSshPublicKey() is built under WOLFSSH_AGENT too, decodes an
OpenSSH RSA certificate, and is documented in internal.h.
- api: run test_GetOpenSshPublicKey_type() in agent builds, with
truncated OpenSSH RSA certificate vectors.
- regress: share the agent user auth helpers across key types; the
mock agent checks the key blob it is asked to sign with. Add tests
for an RSA key against OpenSSH's and an rsa-sha2-256-only server,
a certificate against a wolfSSH server, a refusing agent, a
mismatched blob, and ignored flags and an oversize signature for
both the key and the certificate.
- openssh-interop.test: part 3 authenticates to sshd with an RSA key
held by ssh-agent, once per rsa-sha2 algorithm the client was built
with.
The example client chdirs up to the tree root before it opens the -i
and -j files, so the relative srcdir key path from an out-of-tree build
no longer resolved and make distcheck failed openssh-interop.test.
Resolve the keys directory to an absolute path up front.
Runs the OpenSSH client against the echoserver and the wolfSSH example
client against sshd, checking that each pairing negotiates the strict
KEX marker and that a session then runs over the connection.
- skip when ssh is missing or predates OpenSSH 9.6
- fall back from the ECC keys to RSA, then Ed25519, on a build without
them, and give sshd RSA and Ed25519 host keys beside the ECDSA one
- skip the sshd half alone when sshd or ssh-keygen is missing, or sshd
will not start unprivileged
- report the sequence number resets OpenSSH logs rather than test them,
the wording being no contract
- run from make check through dist_noinst_SCRIPTS
John Safranek
Yosuke Shimizu