WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity
2,678 Commits
1 Branch
32 Tags
65 MiB
Commit Graph

2678 Commits (8d97ee9250d4b83fefa0479a99516da45e31ad45)

Author SHA1 Message Date
JacobBarthelmeh 6638054582
Merge pull request #932 from yosuke-wolfssl/f_2075 
Fix FingerprintKey
 2026-04-17 09:36:25 -06:00
Yosuke Shimizu 2608f90fa1 Fix FingerprintKey 2026-04-17 17:52:30 +09:00
Yosuke Shimizu 97a0c7b5b7 Fix wolfSSHD_ConfigCopy and wolfSSHD_ConfigFree, and Add the regression test 2026-04-17 17:31:40 +09:00
Yosuke Shimizu 5bb1260466 Add wc_Sha256Free after the final use 2026-04-17 11:17:12 +09:00
JacobBarthelmeh 6013f122b4 check on return value of get digest size and remove old ret reset code 2026-04-16 17:27:59 -06:00
JacobBarthelmeh 8a945c7b35 fixes for c++ error on missing enum cast and warning on MlKemKey initialization 2026-04-16 16:31:43 -06:00
John Safranek 91cbb647d1
Merge pull request #926 from JacobBarthelmeh/dist 
fixes for make distcheck
 2026-04-16 15:14:37 -07:00
JacobBarthelmeh 422d4ed53a add example ecc keys also to ac config link for out of tree builds 2026-04-16 15:57:28 -06:00
JacobBarthelmeh 9e80de70a5 fixes for make distcheck 2026-04-16 15:50:54 -06:00
JacobBarthelmeh f4b7786b0b
Merge pull request #922 from ejohnstown/check-dhgroup 
Validate server's group
 2026-04-16 14:56:30 -06:00
John Safranek 16ddcd9764 Validate server's group 
The client wasn't validating the DH group parameters in the KEX DH GEX
Group message. This adds a function to perform the validation of the
prime `p` to verify it is safe. (Prime and that ((p - 1) / 2) is
prime.) Also adds a test to a known unsafe prime and known safe prime
to verify the validate function.

Affected function: DoKexDhGexGroup.
Issue: F-1688
 2026-04-16 13:42:24 -07:00
JacobBarthelmeh bf85bab6fb
Merge pull request #918 from yosuke-wolfssl/f_2867 
Fix DoGlobalRequestFwd() so that it rejects the port forwarding if no fwdCb is set.
 2026-04-16 09:30:30 -06:00
Yosuke Shimizu 651e4cae8a Add kex integration test for ed25519 server key 2026-04-16 15:14:42 +09:00
Yosuke Shimizu fd82a4bcf5 Fix DoGlobalRequestFwd and Add the regress tests 2026-04-16 13:11:29 +09:00
Yosuke Shimizu 7beec434db Add regress test for DoKexDhReply 2026-04-16 10:10:50 +09:00
JacobBarthelmeh 85cf3e7c25
Merge pull request #921 from ejohnstown/expect-newkeys 
Fix server NEWKEYS message expectation
 2026-04-15 16:59:13 -06:00
JacobBarthelmeh cdd6df0c38
Merge pull request #919 from yosuke-wolfssl/f_2871 
Fix DoChannelOpen() and Add the regress test
 2026-04-15 15:33:01 -06:00
JacobBarthelmeh f291d99e6f
Merge pull request #917 from yosuke-wolfssl/f_2471 
Fix DoKexDhReply() to reject the server's pub key if no PublicKeyCheck callback is registered
 2026-04-15 15:29:53 -06:00
JacobBarthelmeh 53ae73b14e
Merge pull request #920 from yosuke-wolfssl/f_2880 
Fix DoChannelOpenConf
 2026-04-15 15:25:19 -06:00
JacobBarthelmeh 346c5c11cc
Merge pull request #916 from yosuke-wolfssl/f_2861 
Fix PostSignRequest
 2026-04-15 14:59:02 -06:00
John Safranek 543a6c2a2f
Merge pull request #915 from padelsbach/const-time-auth 
Replace WMEMCMP in CheckAuthKeysLine
 2026-04-15 09:20:46 -07:00
Yosuke Shimizu e72022acc0 Fix DoChannelOpenConf 2026-04-15 16:58:56 +09:00
Yosuke Shimizu 0317c40fc1 Fix DoChannelOpen() and Add regress test 2026-04-15 13:52:23 +09:00
Yosuke Shimizu 9e3eee1276 Fix existing tests 2026-04-15 11:04:09 +09:00
Yosuke Shimizu 367dd5a8f2 Add regress test for DoKexDhReply 2026-04-15 10:44:29 +09:00
Yosuke Shimizu c9b8d19ff1 Fix DoKexDhReply to reject the pubkey without the callback 2026-04-15 10:44:29 +09:00
David Garske 9c8b4e8a2c
Merge pull request #913 from yosuke-wolfssl/f_2483 
Add an integration test where a client authenticates using public key
 2026-04-14 09:13:55 -07:00
David Garske b6652e6365
Merge pull request #912 from yosuke-wolfssl/f_2482 
Add unit test for VerifyMac
 2026-04-14 09:12:59 -07:00
Yosuke Shimizu c0f1a1f80b Fix PostSignRequest 2026-04-14 14:50:29 +09:00
Yosuke Shimizu aa4c9ff9a0 Add unit test for VerifyMac 2026-04-14 09:23:14 +09:00
Yosuke Shimizu 22f9ef8ddb Add an integration test where a client authenticates using public key 2026-04-14 09:16:21 +09:00
John Safranek e9d288ec60 Server Does Not Set expectMsgId to MSGID_NEWKEYS 
In the server code, the server is not setting the expectedMsgId to
MSGID_NEWKEYS before sending its new keys message. Update DoKexDhReply()
to set expectMsgId to MSGID_NEWKEYS.

Affected function: DoKeyDhReply.
Issue: F-1275
 2026-04-13 15:05:48 -07:00
John Safranek b71670f797
Merge pull request #909 from padelsbach/lls-lcd-commands 
Add lcd and lls commands
 2026-04-13 14:54:15 -07:00
David Garske eb49029a7f
Merge pull request #910 from yosuke-wolfssl/f_2072 
Fix SendUserAuthKeyboardResponse() and add regress tests
 2026-04-13 10:38:57 -07:00
Paul Adelsbach 854a36248e Replace WMEMCMP in CheckAuthKeysLine 2026-04-13 10:19:24 -07:00
David Garske aaf3e5574e
Merge pull request #908 from LinuxJedi/f-fixes 
Static code analysis fixes
 2026-04-10 14:33:06 -07:00
Paul Adelsbach 453371f953 Add lcd and lls commands 2026-04-10 12:51:58 -07:00
John Safranek 5272cc4603
Merge pull request #911 from padelsbach/sftp-command-underflow 
Sftp command underflow
 2026-04-10 09:13:18 -07:00
Andrew Hutchings 841f050b61 Fix Nucleus hour 2026-04-10 11:15:09 +01:00
Yosuke Shimizu 6d81c9da1e Fix SendUserAuthKeyboardResponse and add regress test 2026-04-10 10:29:11 +09:00
Paul Adelsbach 94b82715a4 Cleanup sftp test artifacts at start of test 2026-04-09 14:41:19 -07:00
Paul Adelsbach d854f03570 Move sftp test cases into a table for stronger linkage to expected behavior 2026-04-09 12:06:16 -07:00
Paul Adelsbach e74fd71473 Fix underflow in sftp example with empty args 2026-04-09 11:54:58 -07:00
David Garske 4ed01d3d5a
Merge pull request #905 from yosuke-wolfssl/f_1678 
Fix the resources management
 2026-04-08 14:29:53 -07:00
David Garske a0e501b1f9
Merge pull request #904 from yosuke-wolfssl/f_1272 
Add a bounds check on ff_close, ff_pwrite and ff_pread
 2026-04-08 14:29:25 -07:00
John Safranek 3075b72061
Merge pull request #902 from padelsbach/request-validation 
Add validation for accept request and reply
 2026-04-08 08:26:59 -07:00
Andrew Hutchings 64de7a210f Fix gating 2026-04-08 14:57:29 +01:00
Andrew Hutchings d4a6cf80f9 Add more tests 2026-04-08 14:42:30 +01:00
Andrew Hutchings 0c5d8d31ae Fix type mismatch and harness bug 2026-04-08 14:04:44 +01:00
Andrew Hutchings a6861d993a Validate the host key signature algorithm name in DoKexDhReply(). 
The client-side KEXDH_REPLY path was parsing the signature blob name and
skipping over it without checking that it matched the negotiated host key
algorithm. That allowed an RSA server to negotiate rsa-sha2-256 or
rsa-sha2-512 but send a signature blob labeled ssh-rsa instead.

Fix this by comparing the signature blob name against the expected
signature type derived from handshake->pubKeyId before verifying the
signature bytes.

Add regress coverage that drives an in-memory client/server handshake,
rewrites the server's first KEXDH_REPLY on the wire, and verifies the
client rejects rsa-sha2-256 and rsa-sha2-512 replies whose signature blob
name is downgraded to ssh-rsa.

F-2077
 2026-04-08 13:33:42 +01:00