- term size test: poll tmux output with retries instead of fixed sleeps,
re-sending the size query each pass in case the shell was not yet ready
- term close test: scope netstat checks to the test port so unrelated
host CLOSE_WAIT/TIME_WAIT sockets don't fail the test
- run_all_sshd_tests.sh: validate --match before starting wolfSSHd
- renewcerts.sh: build the per-user cert from a throwaway config copy so
the tracked renewcerts.cnf is never modified in place
HandleInclude built the wildcard include path with WSNPRINTF without
checking the result, silently truncating over-long paths (flagged by
GCC 12 as -Werror=format-truncation). Merge the duplicate WSNPRINTF
calls and return WS_INVALID_PATH_E when the path does not fit.
Cleanup clang-tidy misc-no-recursion finding.
- wolfSSHD_ConfigLoad: track depth on WOLFSSHD_CONFIG
and reject loads past WOLFSSHD_MAX_INCLUDE_DEPTH (16).
- HandleInclude, HandleConfigOption, ParseConfigLine,
wolfSSHD_ConfigLoad: annotate the call cycle with
NOLINTNEXTLINE pointing at the bound.
- Add a recursive configuration test.
Cleanup clang-tidy bugprone-signal-handler findings.
- wolfsshd: drop fprintf from interruptCatch; the main accept
loop logs "Closing down wolfSSHD" after seeing quit set.
- sftpclient: annotate wolfSSH_SFTP_Interrupt call in
sig_handler with NOLINT, since the function is only a single
byte store and is safe to call from a signal handler.
- Guard the retry against a negative cnt_w so a non-sentinel
send error cannot become a negative memmove offset.
- Clear windowFullExt at the stdout and childFd save sites so
stream ownership is set unconditionally.
ChannelIdSend / extended_data_send returning WS_WANT_WRITE set
wantWrite but didn't save cnt_r, so the next read overwrote the
held bytes. Store cnt_r in windowFull at all three read sites
(stderr, stdout, pty childFd); flag windowFullExt for stderr so
the retry routes through extended_data_send.
Stderr and stdout shared shellBuffer/windowFull, so a stderr hold
retried on stdout, and a stderr partial send let the stdout read
clobber the remainder. Tag the held bytes with windowFullExt;
retry via extended_data_send and skip the stdout read when set.
SIGCHLD from the exec child interrupts select(), returning -1 and
breaking the loop. Any windowFull data awaiting a peer window adjust
was then abandoned, causing intermittent 32 KB truncations on large
exec transfers. Continue on EINTR.
- Zero private key and password buffers in both apps/wolfssh
and examples client.
- Also zero keyboard-interactive response buffers in the
example client.
Issue: F-249
- Expose CheckAuthKeysLine under WOLFSSHD_UNIT_TEST so tests can link it.
- Add test_CheckAuthKeysLine covering match, different key, and same-length
key differing only in the last byte.
- Route the test Log() to stderr instead of an unused local buffer.
Issue: F-4107
ClientPublicKeyCheck() prompted to add an unknown server's key
to known_hosts but, if the user declined, left ret at 0 and
returned WS_SUCCESS, silently accepting the unverified host.
Set ret = -1 in the else branch to mirror the otherMatch case
and abort the handshake when the user does not confirm.
Issue: F-3444
Remove the errno check in the condition after execv(). If execv()
returns at all, it has failed, so checking ret alone is sufficient.
The errno check was flagged by clang scan-build as potentially
reading an undefined value (unix.Errno).
When wolfsshd is built with WOLFSSH_ALLOW_USERAUTH_NONE, the
DefaultUserAuth() function accepted WOLFSSH_USERAUTH_NONE as a valid
auth type and forwarded it to RequestAuthentication(). Since
RequestAuthentication() only gates credential checks on PASSWORD and
PUBLICKEY types, a none request for any existing system user returned
success without verifying any credential. Removed USERAUTH_NONE as an
accepted auth type in DefaultUserAuth() so it is treated as an invalid
auth type for wolfsshd.
Affected function: DefaultUserAuth.
Issue: F-3215
macOS uses GCD for threading and semaphores, but they aren't quite like
POSIX semaphores. macOS allows the use of named POSIX semaphores.
1. Convert the semaphores to named POSIX semaphores.
2. Simplify all calls for semaphores into single function calls of the
wrapper API.
3. Update both examples/client/client.c and apps/wolfssh/wolfssh.c.
4. Update both to deregister the WINCH signal.
In wolfSSHd, the comparisons of the password hash and public keys were
using memcmp(). Changed to use ConstantCompare().
Affected functions: CheckPasswordHashUnix, CheckPublicKeyUnix.
Issue: F-53
When a copy of the user's password is freed, it wasn't getting force
zeroed. It might still exist in the heap after getting freed. Added
a call to `ForceZero()`.
Affected function: CheckPasswordUnix.
Issue: F-56
Yosuke Shimizu
John Safranek
Paul Adelsbach
JacobBarthelmeh