- Keep a gated fallback, wolfSSH_ForceZero().
- Add macro WS_FORCEZERO gated between wc_ForceZero() or
wolfSSH_ForceZero().
- Use WS_FORCEZERO() in place of the local ForceZero().
- Change the fallback's length parameter from word32 to size_t to
match wc_ForceZero()'s signature.
- term size test: poll tmux output with retries instead of fixed sleeps,
re-sending the size query each pass in case the shell was not yet ready
- term close test: scope netstat checks to the test port so unrelated
host CLOSE_WAIT/TIME_WAIT sockets don't fail the test
- run_all_sshd_tests.sh: validate --match before starting wolfSSHd
- renewcerts.sh: build the per-user cert from a throwaway config copy so
the tracked renewcerts.cnf is never modified in place
HandleInclude built the wildcard include path with WSNPRINTF without
checking the result, silently truncating over-long paths (flagged by
GCC 12 as -Werror=format-truncation). Merge the duplicate WSNPRINTF
calls and return WS_INVALID_PATH_E when the path does not fit.
Cleanup clang-tidy misc-no-recursion finding.
- wolfSSHD_ConfigLoad: track depth on WOLFSSHD_CONFIG
and reject loads past WOLFSSHD_MAX_INCLUDE_DEPTH (16).
- HandleInclude, HandleConfigOption, ParseConfigLine,
wolfSSHD_ConfigLoad: annotate the call cycle with
NOLINTNEXTLINE pointing at the bound.
- Add a recursive configuration test.
Cleanup clang-tidy bugprone-signal-handler findings.
- wolfsshd: drop fprintf from interruptCatch; the main accept
loop logs "Closing down wolfSSHD" after seeing quit set.
- sftpclient: annotate wolfSSH_SFTP_Interrupt call in
sig_handler with NOLINT, since the function is only a single
byte store and is safe to call from a signal handler.
- Guard the retry against a negative cnt_w so a non-sentinel
send error cannot become a negative memmove offset.
- Clear windowFullExt at the stdout and childFd save sites so
stream ownership is set unconditionally.
ChannelIdSend / extended_data_send returning WS_WANT_WRITE set
wantWrite but didn't save cnt_r, so the next read overwrote the
held bytes. Store cnt_r in windowFull at all three read sites
(stderr, stdout, pty childFd); flag windowFullExt for stderr so
the retry routes through extended_data_send.
Stderr and stdout shared shellBuffer/windowFull, so a stderr hold
retried on stdout, and a stderr partial send let the stdout read
clobber the remainder. Tag the held bytes with windowFullExt;
retry via extended_data_send and skip the stdout read when set.
SIGCHLD from the exec child interrupts select(), returning -1 and
breaking the loop. Any windowFull data awaiting a peer window adjust
was then abandoned, causing intermittent 32 KB truncations on large
exec transfers. Continue on EINTR.
- Zero private key and password buffers in both apps/wolfssh
and examples client.
- Also zero keyboard-interactive response buffers in the
example client.
Issue: F-249
- Expose CheckAuthKeysLine under WOLFSSHD_UNIT_TEST so tests can link it.
- Add test_CheckAuthKeysLine covering match, different key, and same-length
key differing only in the last byte.
- Route the test Log() to stderr instead of an unused local buffer.
Issue: F-4107
ClientPublicKeyCheck() prompted to add an unknown server's key
to known_hosts but, if the user declined, left ret at 0 and
returned WS_SUCCESS, silently accepting the unverified host.
Set ret = -1 in the else branch to mirror the otherMatch case
and abort the handshake when the user does not confirm.
Issue: F-3444
Remove the errno check in the condition after execv(). If execv()
returns at all, it has failed, so checking ret alone is sufficient.
The errno check was flagged by clang scan-build as potentially
reading an undefined value (unix.Errno).
When wolfsshd is built with WOLFSSH_ALLOW_USERAUTH_NONE, the
DefaultUserAuth() function accepted WOLFSSH_USERAUTH_NONE as a valid
auth type and forwarded it to RequestAuthentication(). Since
RequestAuthentication() only gates credential checks on PASSWORD and
PUBLICKEY types, a none request for any existing system user returned
success without verifying any credential. Removed USERAUTH_NONE as an
accepted auth type in DefaultUserAuth() so it is treated as an invalid
auth type for wolfsshd.
Affected function: DefaultUserAuth.
Issue: F-3215
macOS uses GCD for threading and semaphores, but they aren't quite like
POSIX semaphores. macOS allows the use of named POSIX semaphores.
1. Convert the semaphores to named POSIX semaphores.
2. Simplify all calls for semaphores into single function calls of the
wrapper API.
3. Update both examples/client/client.c and apps/wolfssh/wolfssh.c.
4. Update both to deregister the WINCH signal.
In wolfSSHd, the comparisons of the password hash and public keys were
using memcmp(). Changed to use ConstantCompare().
Affected functions: CheckPasswordHashUnix, CheckPublicKeyUnix.
Issue: F-53
When a copy of the user's password is freed, it wasn't getting force
zeroed. It might still exist in the heap after getting freed. Added
a call to `ForceZero()`.
Affected function: CheckPasswordUnix.
Issue: F-56
After creating a new SSH context, the pointer returned wasn't checked;
the pointer to the pointer was checked. Changed to the correct pointer.
Affected function: SetupCTX.
In DoCheckUser, after calling auth->checkUserCb(usr) into rc, the
failure check on line 1063 compared ret instead of rc against
WSSHD_AUTH_FAILURE. Since ret is WOLFSSH_USERAUTH_SUCCESS at that
point, the condition was always false, causing callback failures to
fall through to the generic error branch with WOLFSSH_USERAUTH_FAILURE
instead of returning WOLFSSH_USERAUTH_INVALID_USER.
Historically, some systems have used <sys/errno.h> in place of <errno.h>, but the C standard,
all the way back to C89/Ansi C, specifies that the correct name is `errno.h` -
and most modern compilers create a sys/errno.h compatibility shim sys/errno.h -
but musl-gcc does not have this compatibility shim,
reasoning that sys/errno.h is non-standard, and fails to compile:
```
$ CC=musl-gcc ./configure --enable-static --disable-shared --enable-scp --enable-sftp --enable-shell --with-wolfssl=wolfssl/install-musl
(...)
$ make
make -j17 all-am
make[1]: Entering directory '/home/hans/projects/wolfssh'
CC examples/client/common.o
CC examples/client/client.o
CC src/libwolfssh_la-ssh.lo
CC src/libwolfssh_la-internal.lo
CC src/libwolfssh_la-log.lo
CC src/libwolfssh_la-port.lo
CC src/libwolfssh_la-io.lo
CC src/libwolfssh_la-wolfscp.lo
CC src/libwolfssh_la-wolfsftp.lo
CC examples/echoserver/echoserver.o
CC src/libwolfssh_la-wolfterm.lo
CC examples/sftpclient/sftpclient.o
CC examples/scpclient/scpclient.o
In file included from examples/echoserver/echoserver.c:91:
/usr/include/x86_64-linux-musl/sys/errno.h:1:2: error: #warning redirecting incorrect #include <sys/errno.h> to <errno.h> [-Werror=cpp]
1 | #warning redirecting incorrect #include <sys/errno.h> to <errno.h>
| ^~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:1452: examples/echoserver/echoserver.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make[1]: Leaving directory '/home/hans/projects/wolfssh'
make: *** [Makefile:1020: all] Error 2
```
so, unless we need to support pre-C89 (35+ year old C) compilers,
we can just replace sys/errno.h with errno.h.
1. Due to not checking the result of fseek(), it is possible to try to
malloc() -1 bytes of storage. Checking the return from fseek() and
erring if negative.
2. Changing the check between the result of fseek() and fread() to match
signedness. Adding some casting, as at that point the fseek() result
is always positive.
Fixes CIDs:
573009 572928 572868
1. Remove the default password from the wolfSSH client app main
function. It isn't set to anything. (It was originally an example
client option.)
2. Remove handling the default password from the wolfSSH client app's
user authentication callback.
3. Set the password size directly.
4. Changed a void typecast to WOLFSSH_UNUSED.
Fixes CID: 572898
1. Fix some resource leaks during error conditions where a socket or a
file descriptor doesn't get closed in all error cases.
2. In wolfSSH_SFTP_RecvOpen(), initialize the file descriptor.
3. For 572902, the error case resource leaks are fixed. There's still an
issue to resolve for storing the FD for use later.
Fixes CIDs:
572856 572902* 573012 573019 573021 573076
SCP on the server side would get an EAGAIN around the 128KB mark, which
would trigger an error. That error in-turn would cause two attempts to
close the file, which would segfault.
Also fix inverted error return status on scpclient.
1. Update the sshd test to use the newer actions.
2. Parameterize the test for macos and ubuntu.
3. Parameterize the version of wolfssl used.
4. Parameterize the wolfSSH options used.
5. Update a couple test scripts to output their $0 variable instead of
the wrong string.
1. Update scp.test to delete the empty test file.
2. In wolfSSHd, when coverting an IP address to a printable
representation, the destination needs to be able to handle IPv6
addresses potentially.
1. For the ASCII and Wide versions of types and functions, make sure
the wolfSSHd is being consistent using them.
2. In SFTP, use WSOCKETCLOSE to close the socket. Use the correct type
for the socket.
3. Add parens around part of a ternary operator check to clear up some
ambiguous order of operations.
4. Add a variable initializer for a COORD structure.
5. Add parameter checks to the Base16_Decode function.
6. Fix a double-freed handle.
7. Clean up a bunch of build warnings.
1. Initialize all the fds to -1.
2. Add flags for peerConnected and stdoutEmpty.
3. Remove the idle counter.
4. When the socket would block on write, set a flag to check the socket for
writing later to call the worker which will send pending data.
5. When reading the pipes, a 0 returns means the pipe is closed. Deal
with that.
6. If the ssh write fails, interrupt the subordinate process.
7. When waiting for the peer to close its channel and shutdown, sleep
for 100ms, rather than 1us. It takes a little while to tear down.
8. Shutdown the peer socket. Spin on receiving the peer socket until it
closes or has an error.
9. Fixed a few function wrappers; was using Xname instead of Wname.
1. Add getting the banner option from the configuration file. Per the
sshd_config(5) manpage, this is supposed to be a filename.
2. Load the banner file and set the banner into the CTX.
aidan garske
Emma Stensland
John Safranek
Yosuke Shimizu
Paul Adelsbach
JacobBarthelmeh
Andrew Hutchings
Daniel Pouzzner
hanshenrik
David Garske
Lealem Amedie
Eric Blankenhorn
Anthony Hu
Sean Parkinson