1. Due to not checking the result of fseek(), it is possible to try to
malloc() -1 bytes of storage. Checking the return from fseek() and
erring if negative.
2. Changing the check between the result of fseek() and fread() to match
signedness. Adding some casting, as at that point the fseek() result
is always positive.
Fixes CIDs:
573009 572928 572868
1. When cleaning the path, check that the path pointer is not null
before using it.
2. Move the strlen of path.
3. Remove the second check of path, and just loop over it.
Fixed CID: 572847
1. Modify all the test executable `CPPFLAGS` to only have
`-DNO_MAIN_LOOP` and `AM_CPPFLAGS`. This removes a lot of duplicate
setup of flags for each of the tests.
2. Delete the echoserver's `CFLAGS`. It is just setting the `CFLAGS` for
its compile to `AM_CFLAGS` and `AM_CPPFLAGS` which are included by
default.
3. Add the macro WS_MAYBE_UNUSED that may be the unused attribute.
4. If INLINE isn't set to some form of inline, set it to
WS_MAYBE_UNUSED.
5. Remove redundant ThreadStartNoJoin() macros from the testing header.
1. By default, soft disable AES-CBC. It isn't offered as a default
encrypt algorithm, but may be set at runtime.
2. Add guard where AES-CBC can be added back as a default.
3. Add option to example client to run it with a custom encrypt
algorithm list.
4. In the client, add macro to add items to the arg lists while checking
the number of items in the list.
* Update myStatusCb to output once per second
Modified the myStatusCb function in sftpclient.c to only output status
updates once per second by tracking the last output time and comparing
it with the current time. This reduces the frequency of status updates
while maintaining all existing functionality.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Reset status output timer when starting new file transfer
When starting a new file transfer, reset the lastOutputTime to ensure
the first status update for the new file is shown immediately.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Fix Zephyr build by guarding lastOutputTime with WOLFSSH_NO_TIMESTAMP
The lastOutputTime variable is only used when timestamps are enabled,
so it should be guarded by the same macro to avoid unused variable
warnings in builds where timestamps are disabled.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Move elapsedTime declaration to function scope
Per wolfSSL coding standards, declare all variables at function scope.
Added comment explaining that modern compilers optimize variable access
regardless of declaration placement.
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Fix timeout check to use elapsed time instead of current time
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Use elapsed time in timeout error message for consistency
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Move elapsedTime inside WOLFSSH_NO_TIMESTAMP guard
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
* Move currentTime outside WOLFSSH_NO_TIMESTAMP guard
Co-Authored-By: andrew@wolfssl.com <andrew@wolfssl.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: andrew@wolfssl.com <andrew@wolfssl.com>
SCP on the server side would get an EAGAIN around the 128KB mark, which
would trigger an error. That error in-turn would cause two attempts to
close the file, which would segfault.
Also fix inverted error return status on scpclient.
This adds the `diffie-hellman-group16-sha512` key exchange and
`hmac-sha2-512` mac support.
Echoserver can now take `-x` for key exchange and `-m` for mac setting,
and `-c` for cipher so that this can be used in the test suite.
This implements Keyboard-Interactive authentication.
Adds an additional callback set by `wolfSSH_KeyboarAuthPrompts()` which
will set a callback in the server to ask the application to provide the
prompt details for the client.
1. Fix echoserver's load_file function. Could potentially dereference
null if a file size is passed in, but using a null buf to get the
file's size only.
1. Add the code from wolfsshd that initially sets up the terminal
settings to the echoserver.
2. Add the WOLFSSH_TERM flag to the build of the echoserver.
1. In the echoserver, change the names of the defines for the
static memory values.
2. Modify the client common functions for keys and certs to take a heap
value for their allocations.
3. Update the client's use of the common key and cert function calls to
pass NULL for the heap.
4. Add a static memory description for the sftp client code.
1. Modify the echoserver to use a static memory pool when using the flag
WOLFSSH_STATIC_MEMORY. Uses NULL otherwise. The WOLFSSH_CTX is
created with the pool and subsequent allocations for the WOLFSSH
server use the same pool.
2. Add a configuration for the memory pool. Only works with SFTP
enabled.
3. Add the memory pool use statistics to the echoserver.
1. Remove the continue from the SFTP worker loop when there's a timeout
on the select and when there's a want_read from the wolfSSH_worker.
2. When the select has receive data ready, check it. Don't make it
conditional on want read as well.
The goal is that when there isn't data waiting on the socket, check and
process the data in the SFTP channel's buffer, always.
1. Modified SignalTcpReady() to test.h. Matched its prototype to the
other functions for TcpReady.
2. Add a timeout in WaitTcpReady() specifically for Zephyr builds.
3. Misc few cleanups.
The example server was never used. All new behaviors were added to the
echoserver only. Now with wolfSSHd, the server example can finally be
removed.
1. Remove the example server from the build.
2. Remove the file notes.md.
3. Update the readme.
1. Fix an instance in the example sftpclient where the size of something
is treated as an int and may have caused trouble, per the pedantic
compiler settings.
2. Changed a check for snprintf where we checked the lengths of
everything before calling snprintf. Turned it around where we check
the return of snprintf and error if the process would have output too
much.
1. When putting a file with SFTP, the client should check that the
requested file is a regular file based on its attributes.
2. Add the attributes to check in the permissions.
3. Add server checking for non-regular files and not allowing them to
be opened for reading or writing.
1. When getting a file with SFTP, the client should check that the
requested file is a regular file based on its attributes.
2. Add the attributes to check in the permissions.
3. Add a new error for a non-regular file.
A couple changes to keep the echoserver from spin-locking.
1. The SFTP worker should wait for data if the channel window is full.
If the client isn't sending a window adjust, it might be because of a
human time scale issue. New timeout is 60 seconds.
2. When the echoserver is waiting for something from the user and the
select times out, wait a second instead.
1. Change GetTerminalSize() to GetTerminalInfo().
2. Add the term variable to the things GetTerminalInfo() looks up.
3. Return the actual value of the environment variable TERM to the
server. If one isn't present, default to "xterm".
4. Clean up the whitespace in SendChannelTerminalRequest().
Misc other changes:
1. Cleanup whitespace in the recently added function
SendChannelOpenFail().
2. Add labels to the parameters in the prototype for
SendChannelOpenFail().
3. Remove the CR addition for Windows in the example client. Causes the
enter key to double-strike.
1. Add quit parameter to the example client's thread_args structure.
This will be used to let the windowMonitor thread know the
application is quitting.
2. If the windowMonitor's quit flag is set, it will exit and not call
wait again.
3. Join the windowMonitor thread rather than cancel it.
When the example client is using non-blocking sockets, sometimes they
don't block. The monitor thread on the socket wasn't handling
WS_WANT_READ explicitly, and treated it as a fatal error. It should be
reset to WS_SUCCESS.
1. In the API test for SFTP, change the amount of the file requested to
the limit WOLFSSH_MAX_SFTP_RW.
2. The check for want read on the exit of the server worker should clear
ret if it is want read.
With the previous change for speed and timing, rekeying started having
trouble in SFTP. Each file block travels as two messages, and the
rekeying starts, but the messages are sent and lost. The client would
terminate the connection.
1. Tweak the timeout in the echoserver's SFTP loop.
2. Better checking for rekeying.
3. Returning that rekeying is happening.
wolfSSH has a reach too deep into the wolfSSH internals. SFTP should
be more like an application running on top of wolfSSH. We prefer to
keep it all in one application, so it will work well in an embedded
environment, but there needs more separation.
1. The sftp_worker loop in the echoserver should prioritize reading
the socket and processing the SSH layer messages. Next it should
ensure the transmit buffer for the SFTP channel is being written.
Last it should check the receive buffer for the SFTP for new
messages from the peer. wolfSSH_worker() will ensure data is read
from the socket, and distributed to the appropriate channel
receieve buffers, and will make sure the SSH bookkeeping is
performed.
2. SendChannelData() should also bound the send data amount by the
local maxPacketSz.
3. wolfSSH_SFTP_buffer_send() should send only one chunk of data, not
looping until everything is gone. Need to send, but cannot flood
the output.
4. Remove the call to wolfSSH_worker() from the buffer send.
5. The wolfSSH_SFTP_read() state machine should check the return
status from the call to buffer send, and if it isn't an error,
don't clear the state, allow for a want-write write again later.
6. Do not limit the file chunk size to send to WOLFSSH_MAX_SFTP_RW.
This limit is provided during SFTP negotiation. If the peer
requests that much data, send it.
6. Modify the select wrapper to have a very small microseconds value
in addition to the requested seconds.
1. Found a few cases where disabling RSA made some things either not
build or run correctly.
2. Hushed a few unused variables in gated-disabled situations.
3. Moved a temp variable closer to where it is used.
1. Update README for the change in the default channel receive window size.
2. In the SFTP client, add rekeying as a error that's OK to ignore.
3. In wolfSSH_stream_read(), clear the SSH object's error register.
1. Update the release date in the ChangeLog.
2. Move some compiler guards around to hush warnings depending on the
build options.
3. Fix a string name for ECDSA P521 algo.
4. Fix a stray static function definition.
5. For FIPSv5 builds, add CAST tests to the API test and testsuite.
6. Add the wolfSSH_Init() and wolfSSH_Cleanup() to the unit test.
1. There were a couple spots during a large file transfer where the
client rekeying the session would interrupt the transfer and/or
reset the amount of file data transfered. Fixed that with a check
for WS_CHAN_RXD.
2. Added a build option to interrupt a file transfer after 2 minutes.
Large files will take longer.
1. Leave out the setup of the tcp_ready record when not using threading.
2. Don't change the echoserver directory when building for Integrity.
3. Change WEXIT to be a return(0) when building for Integrity.
4. The echoserver shouldn't call exit directly, it should save the
return_code server args and then return to the caller.
5. When using forwarding, don't exit if the address is IPv6, return an
error.
6. When exiting, close the listen file descriptor.
7. Reset myoptind to 0 before processing the options list.
1. For Integrity builds, err_sys should only printf.
2. For Integrity builds, WEXIT should be a return.
3. In the echoserver, add explicit WEXITs for the err_sys statements.
1. In the echoserver's user authentication function, the summary check was
refactored and the old code wasn't removed. A more strict compiler
noticed the code was never executed.
2. Moved the ret check variable to the section of the function where it
is used.
1. Move the test threading types and macros to the conditional threading
section of test.h and make them conditional on wolfSSL v5.5.1.
2. Alias WOLFSSL_THREAD as WOLFSSH_THREAD.
3. Update the THREAD_FUNC typdef to look more like a function pointer.
4. Add the user_settings.h/options.h include that is missing from
examples.
1. Remove the DISTCLEANFILES variables from automake scripts. The items
they clean are already cleaned appropriately.
2. For application targets, move the local headers to the SOURCES lists
for the apps.
1. Allow user to add multiple server keys to the CTX up to a limit.
2. Clear the list of server's keys when releasing the CTX.
3. Update the API test case.
4. Server key algo list based on keys loaded.
5. Server uses key requested by client.
6. Change echoserver to load ECC and RSA key, -E option to select order.
7. Added a function to identify keys, and another to identify certs.
8. Added a function to add keys or certs to the list of keys and certs.
9. Fix return value for MAC Algo C2S match fail to the correct value.
1. Update wolfSSH_SFTPNAME_readdir() to have a special case getting
the drive letters at root in Windows.
2. The Win32 APIs can use forward slashes, but cannot have one at the
beginning of the path before the drive letter. Add a trim function
to remove the leading slash in the SFTP paths.
3. Update echoserver to always set the default SFTP path to either the
provided command line option or to the CWD for the echoserver run.
4. Get the RealPath for the default path
5. Tweak wolfSSH_RealPath() to handle some Windows cases.
6. Added more test cases.
1. Fix build error when building without certificates.
2. Add the root CA option to the echoserver usage.
3. Update the readme file to include the new certificate option.
4. Added command line option to load a CA cert into the echoserver.
JacobBarthelmeh
John Safranek
Andrew Hutchings
Anthony Hu
aidan garske
devin-ai-integration[bot]
David Garske
Juliusz Sosinowicz
Hideki Miyazaki
Daniele Lacamera
Fabio Alemagna
Eric Blankenhorn
Kareem
Hayden Roche
Hayden Roche