- store select()'s result in an int so an error is not read
as a large positive count
- retry on EINTR, bail out on any other error
- re-arm the descriptor sets on every pass
Issue: F-7508
- zero the response arrays and stop filling after the first
failed read, tracking only the slots populated
- release the previous round's responses on each INFO_REQUEST
- add auth.test coverage for EOF stdin and a second round
Issue: F-7515, F-7516
The loop condition already guarantees a want-read or want-write error,
so the select_ret arms of the retry test and the else chain could never
run. Retry unconditionally; tcp_select still throttles the loop. Same
change applied to the copy in apps/wolfssh/wolfssh.c.
Issue: CID-572884
Both loop exits in readInput() returned early, leaving the per-thread
ECC cache cleanup after the loop unreachable. Break out of the loop
instead.
wolfSSH_stream_send() reports a rekey in progress by returning
WS_FATAL_ERROR with the ssh error set to WS_REKEYING, so testing the
return value against WS_REKEYING never matches. Read the code with
wolfSSH_get_error() and resend the same buffer once the rekey
finishes, in both the app and the example client. Looping back to
read() instead would drop the input already taken from stdin.
Issue: CID-572833
- Gate header on new scpFileHeaderSent flag, not scpFileOffset==0
- A send callback returning 0 bytes first no longer re-sends header
- Skip zero-length SCP_SEND_FILE send to avoid empty CHANNEL_DATA
- Abort on a second consecutive 0-byte send callback return with file
data outstanding; skipping the send would otherwise spin
SCP_SEND_FILE -> SCP_TRANSFER with no socket I/O
- Reset offset/bufferedSz/flags in ScpSourceInit for connection reuse
- Document the WS_CallbackScpSend contract, including when a 0 return
is valid, next to the typedef
- Add test_wolfSSH_SCP_SendZeroFirst regression (func_args scp_send hook)
- Zero func_args in kex.c/testsuite.c so the new scp_send field is not read uninitialized
Issue: ZD-22176
The send at the end of the loop only ran when select() reported a
readable descriptor, but appBuffer can hold data across iterations.
Mask appFd out of the read set while the buffer is full, and fall
through the select() timeout to the send.
Issue: F-7207
- Track userPublicKey allocations with a userPublicKeyAlloc flag
- Free on that flag, not pubKeyName; -J with no -j leaked the cert
- Restore userPublicKeyBuf when a key load fails, not a stale pointer
- Tag load_der_file() allocations DYNTYPE_PRIVKEY to match the frees
- Free the CA cert in ClientLoadCA() with the heap it came from
- Pass the caller's heap into wolfSSH_TPM_InitKey() so the TPM public
key is allocated from the pool ClientFreeBuffers() frees it with
Issue: F-7210, F-7211
- Test wolfSSH_ReadKey_buffer() and wc_CertPemToDer() results and skip
the entry; a malformed file gave PwMapNew() a NULL buf and an
indeterminate length.
- NULL-check both WMALLOC() results, and guard the load_file() size so
a missing file no longer reaches WMALLOC(0).
- Fall through to the loop's existing WFREE()/advance so both buffers
are freed on every path.
Issue: F-7204
- wolfSSH_ChannelSend() can return fewer bytes than requested, but
appBufferUsed was decremented without moving the unsent tail to the
front of appBuffer, corrupting subsequent sends. Shift the remaining
data down with WMEMMOVE() when the send is short.
- Skip the recv() when appBuffer is full. The length argument would be
0, and a zero length recv() returns 0, which the loop read as the
peer closing; the buffered data was dropped and the forward torn
down.
Issue: F-7207
- ssh_worker() cached fwdCtx.listenFd at entry, while still -1
- The listener is only made later, from WOLFSSH_FWD_REMOTE_SETUP
- FD_SET() and accept() then got a bogus fd, failing with EBADF,
which broke the worker loop and dropped the session
- Read listenFd from the context at each use, guarded on validity
- agentListenFd has the same shape but is set up before ssh_worker()
Issue: ZD-21867
- Add wolfSSH_FwdRemoteSetup/Cancel to request tcpip-forward
- Add SendGlobalRequestFwd to frame the request per RFC 4254
- Add portfwd -r reverse mode, driven by the fwd and req-success cbs
- Wait for the peer's reply before -R reports ready, and take the
bound port from it; with -f 0 that reply is the only source
- Accept -f 0 in reverse mode, where it asks the peer to pick the port
- Cancel names the port the peer bound, not the one requested, so a
peer keyed on its listener's port can still find it
- Add a req-failure cb so a refused forward is reported, not waited on
Issue: ZD-21867
Keyboard-interactive was unusable in builds with
WOLFSSH_KEYBOARD_INTERACTIVE but no WOLFSSH_TERM, in two ways.
- ClientFreeBuffers declared 'entry' under TERM && KBI but used it
under KBI alone, so KBI-without-TERM failed to compile; widen the
declaration guard to match the use
- ClientUserAuth's keyboard-interactive branch is guarded on
TERM && KBI, so without TERM a keyboard-interactive request fell
past every branch and returned the initial WOLFSSH_USERAUTH_SUCCESS
with no responses populated. There is no terminal to prompt on, so
answer WOLFSSH_USERAUTH_FAILURE instead of claiming success.
- Reply to a port-0 (dynamic) tcpip-forward with the bound port.
- Add WS_FWD_PORT_CHECK (1024) as the status/port boundary in WS_FwdCbError.
- Callback returns a WS_FwdCbError status below it, the port at or above it.
- DoGlobalRequestFwd reports the port and rejects a port-0 setup with none.
- Map a callback rejection to WS_RESOURCE_E so a no-reply request keeps the link.
- Update the echoserver reference callbacks (examples and Espressif) to
recover the OS-chosen port with getsockname() and return it under the new
convention.
- Add regress coverage for the allocated-port and rejection paths.
Issue: F-5573
Co-authored-by: John Safranek <john@wolfssl.com>
1. Remove the check on authType, it is covered already.
2. Add Keyboard Setup to the existing check on authType.
3. Add a branch for User Auth None so it reaches its handler
in the map loop rather than the new error case.
4. Add else case for an error.
Fixes CID: 637345
Cleanup clang-tidy bugprone-signal-handler findings.
- wolfsshd: drop fprintf from interruptCatch; the main accept
loop logs "Closing down wolfSSHD" after seeing quit set.
- sftpclient: annotate wolfSSH_SFTP_Interrupt call in
sig_handler with NOLINT, since the function is only a single
byte store and is safe to call from a signal handler.
- Zero private key and password buffers in both apps/wolfssh
and examples client.
- Also zero keyboard-interactive response buffers in the
example client.
Issue: F-249
Refactor of the echoserver example only; library is unchanged.
1. Collapse FwdStates and AGENT_STATE_* into a single WS_AppState
(INIT/LISTEN/CONNECT/CONNECTED). FWD_STATE_DIRECT becomes an
isDirect flag, cleared after connect.
2. Hoist the fields shared by the forwarding, agent, and shell paths
into a common WS_AppCtx (privateData, listenFd, appFd, channelId,
state, buffer). Shell only uses buffer.
3. Feature-specific remainder stays in WS_AgentCbActionCtx (name) and
WS_FwdCbActionCtx (host/origin name+port, isDirect). Drop the unused
pid field; inline getpid() at the call site.
4. wolfSSH_AGENT_DefaultActions and wolfSSH_FwdDefaultActions now take
a WS_AppCtx* and reach feature-specific state via
appCtx->privateData. echoserver_test() is updated to register the
WS_AppCtx (not the old CbCtx) with wolfSSH_set_agent_cb_ctx and
wolfSSH_SetFwdCbCtx.
5. Reindent ssh_worker()'s #ifdef blocks and add /* WOLFSSH_xxx */
markers.
6. fwd.test.expect: redirect echoserver and portfwd output to log files
and sync on portfwd's -R ready file instead of matching "sampled" in
the pty. Under --enable-debug the WLOG volume fills the pty and
stalls portfwd in select() before channel-open.
macOS uses GCD for threading and semaphores, but they aren't quite like
POSIX semaphores. macOS allows the use of named POSIX semaphores.
1. Convert the semaphores to named POSIX semaphores.
2. Simplify all calls for semaphores into single function calls of the
wrapper API.
3. Update both examples/client/client.c and apps/wolfssh/wolfssh.c.
4. Update both to deregister the WINCH signal.
1. Separate the key type and signature type when handling user
authentication. ssh-rsa is a key type used with rsa-sha2-256 and
rsa-sha2-512 signatures, along with ssh-rsa signatures.
2. Allow rsa-sha2-512 to be used.
3. Fix bug where setting the key algorithm on the client command line
was setting the list to NULL.
4. Fix bug where adding rsa-sha2-512 to the list of canned algorithms
was terminating the list, rather that adding it.
Issue: ZD-21247
Yosuke Shimizu
Emma Stensland
Ruby Martin
John Safranek
Mark Atwood
aidan garske
Paul Adelsbach