The client wasn't validating the DH group parameters in the KEX DH GEX
Group message. This adds a function to perform the validation of the
prime `p` to verify it is safe. (Prime and that ((p - 1) / 2) is
prime.) Also adds a test to a known unsafe prime and known safe prime
to verify the validate function.
Affected function: DoKexDhGexGroup.
Issue: F-1688
The client-side KEXDH_REPLY path was parsing the signature blob name and
skipping over it without checking that it matched the negotiated host key
algorithm. That allowed an RSA server to negotiate rsa-sha2-256 or
rsa-sha2-512 but send a signature blob labeled ssh-rsa instead.
Fix this by comparing the signature blob name against the expected
signature type derived from handshake->pubKeyId before verifying the
signature bytes.
Add regress coverage that drives an in-memory client/server handshake,
rewrites the server's first KEXDH_REPLY on the wire, and verifies the
client rejects rsa-sha2-256 and rsa-sha2-512 replies whose signature blob
name is downgraded to ssh-rsa.
F-2077
Send SSH_MSG_CHANNEL_OPEN_FAILURE for unclassified channel open errors
instead of incorrectly falling back to SSH_MSG_REQUEST_FAILURE.
Normalize OPEN_OK error cases to an administrative-prohibited channel
open failure with a generic description, and add white-box regressions
covering callback rejection plus optional direct-tcpip and agent-null
paths.
F-2076
1. When disabling mlkem768nistp256-sha256, there's a crash when doing a
mlkem768x25519-sha256 KEX. It tries to do a DH key exchange instead
of x25519 with ML-KEM. Modified the check.
2. Fixed a guard where the build was treating not having
mlkem768nistp256-sha256 like a FIPS build disallowing using ML-KEM
when generating sesssion keys. It shouldn't make that check.
3. Added a test case to the KEM test.
When wolfSSH_SFTP_buffer_send() called wolfSSH_stream_send(), the data
would be consumed into the SSH output buffer even if the underlying
socket returned EWOULDBLOCK/EAGAIN. SendChannelData() returns the
positive dataSz on WS_WANT_WRITE, causing the SFTP layer to advance
its buffer index as if the data was sent. The SSH output buffer still
had pending data that was never flushed, leading to an indefinite hang.
Fix: At the start of wolfSSH_SFTP_buffer_send(), check if there's
pending data in ssh->outputBuffer from a previous WS_WANT_WRITE. If
so, attempt to flush it first and return WS_WANT_WRITE if the flush
fails. This ensures the caller retries until all pending data is sent.
Also expose WS_SFTP_BUFFER and wolfSSH_SFTP_buffer_send() as
WOLFSSH_LOCAL for unit testing, and add regression test that verifies
the fix catches the bug.
Fixes ZD 21157
1. Reorganize the KEX test to allow for testing any KEX algorithm. Add test
cases for the new algorithms to the KEX test.
2. Reorder the cannedKexAlgoNames with the ML-KEM algos first.
3. Add the new algos to wolfSSH_GetText().
4. Add comments and whitespace cleanup.
Handle receive-before-send in wolfSSH_worker so window-adjust packets
are processed when the send path is back-pressured, preventing SFTP
stalls with small-window clients.
Add regression that forces WANT_WRITE/WANT_READ paths without relying
on a TTY to guard against deadlock.
Fixed ZD 20958
Instantiate a wolfSSH_AGENT_CTX before invoking wolfSSH_AGENT_SignRequest so the regression tests exercise the intended paths instead of failing with WS_AGENT_NULL_E.
Exercise agent write failures, non-signature responses, oversized signatures, and the happy path to cover the recent wolfSSH_AGENT_SignRequest hardening.
Yosuke Shimizu
John Safranek
JacobBarthelmeh
David Garske
Paul Adelsbach
Andrew Hutchings
Eric Blankenhorn
aidan garske
gojimmypi
Timo Kokkonen