WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity
2,504 Commits
1 Branch
32 Tags
65 MiB
Commit Graph

2504 Commits (bfbf0edbb979603ce165a65a0f7101467647a3f2)

Author SHA1 Message Date
Yosuke Shimizu 367dd5a8f2 Add regress test for DoKexDhReply 2026-04-15 10:44:29 +09:00
Yosuke Shimizu c9b8d19ff1 Fix DoKexDhReply to reject the pubkey without the callback 2026-04-15 10:44:29 +09:00
David Garske 9c8b4e8a2c
Merge pull request #913 from yosuke-wolfssl/f_2483 
Add an integration test where a client authenticates using public key
 2026-04-14 09:13:55 -07:00
David Garske b6652e6365
Merge pull request #912 from yosuke-wolfssl/f_2482 
Add unit test for VerifyMac
 2026-04-14 09:12:59 -07:00
Yosuke Shimizu c0f1a1f80b Fix PostSignRequest 2026-04-14 14:50:29 +09:00
Yosuke Shimizu aa4c9ff9a0 Add unit test for VerifyMac 2026-04-14 09:23:14 +09:00
Yosuke Shimizu 22f9ef8ddb Add an integration test where a client authenticates using public key 2026-04-14 09:16:21 +09:00
John Safranek e9d288ec60 Server Does Not Set expectMsgId to MSGID_NEWKEYS 
In the server code, the server is not setting the expectedMsgId to
MSGID_NEWKEYS before sending its new keys message. Update DoKexDhReply()
to set expectMsgId to MSGID_NEWKEYS.

Affected function: DoKeyDhReply.
Issue: F-1275
 2026-04-13 15:05:48 -07:00
John Safranek b71670f797
Merge pull request #909 from padelsbach/lls-lcd-commands 
Add lcd and lls commands
 2026-04-13 14:54:15 -07:00
David Garske eb49029a7f
Merge pull request #910 from yosuke-wolfssl/f_2072 
Fix SendUserAuthKeyboardResponse() and add regress tests
 2026-04-13 10:38:57 -07:00
Paul Adelsbach 854a36248e Replace WMEMCMP in CheckAuthKeysLine 2026-04-13 10:19:24 -07:00
David Garske aaf3e5574e
Merge pull request #908 from LinuxJedi/f-fixes 
Static code analysis fixes
 2026-04-10 14:33:06 -07:00
Paul Adelsbach 453371f953 Add lcd and lls commands 2026-04-10 12:51:58 -07:00
John Safranek 5272cc4603
Merge pull request #911 from padelsbach/sftp-command-underflow 
Sftp command underflow
 2026-04-10 09:13:18 -07:00
Andrew Hutchings 841f050b61 Fix Nucleus hour 2026-04-10 11:15:09 +01:00
Yosuke Shimizu 6d81c9da1e Fix SendUserAuthKeyboardResponse and add regress test 2026-04-10 10:29:11 +09:00
Paul Adelsbach 94b82715a4 Cleanup sftp test artifacts at start of test 2026-04-09 14:41:19 -07:00
Paul Adelsbach d854f03570 Move sftp test cases into a table for stronger linkage to expected behavior 2026-04-09 12:06:16 -07:00
Paul Adelsbach e74fd71473 Fix underflow in sftp example with empty args 2026-04-09 11:54:58 -07:00
David Garske 4ed01d3d5a
Merge pull request #905 from yosuke-wolfssl/f_1678 
Fix the resources management
 2026-04-08 14:29:53 -07:00
David Garske a0e501b1f9
Merge pull request #904 from yosuke-wolfssl/f_1272 
Add a bounds check on ff_close, ff_pwrite and ff_pread
 2026-04-08 14:29:25 -07:00
John Safranek 3075b72061
Merge pull request #902 from padelsbach/request-validation 
Add validation for accept request and reply
 2026-04-08 08:26:59 -07:00
Andrew Hutchings 64de7a210f Fix gating 2026-04-08 14:57:29 +01:00
Andrew Hutchings d4a6cf80f9 Add more tests 2026-04-08 14:42:30 +01:00
Andrew Hutchings 0c5d8d31ae Fix type mismatch and harness bug 2026-04-08 14:04:44 +01:00
Andrew Hutchings a6861d993a Validate the host key signature algorithm name in DoKexDhReply(). 
The client-side KEXDH_REPLY path was parsing the signature blob name and
skipping over it without checking that it matched the negotiated host key
algorithm. That allowed an RSA server to negotiate rsa-sha2-256 or
rsa-sha2-512 but send a signature blob labeled ssh-rsa instead.

Fix this by comparing the signature blob name against the expected
signature type derived from handshake->pubKeyId before verifying the
signature bytes.

Add regress coverage that drives an in-memory client/server handshake,
rewrites the server's first KEXDH_REPLY on the wire, and verifies the
client rejects rsa-sha2-256 and rsa-sha2-512 replies whose signature blob
name is downgraded to ssh-rsa.

F-2077
 2026-04-08 13:33:42 +01:00
Andrew Hutchings 98e3b638c0 fix DoChannelOpen failure response and add regression test 
Send SSH_MSG_CHANNEL_OPEN_FAILURE for unclassified channel open errors
instead of incorrectly falling back to SSH_MSG_REQUEST_FAILURE.

Normalize OPEN_OK error cases to an administrative-prohibited channel
open failure with a generic description, and add white-box regressions
covering callback rejection plus optional direct-tcpip and agent-null
paths.

F-2076
 2026-04-08 13:11:35 +01:00
Andrew Hutchings 4ff4fac6c4 Fix DoDisconnect to signal connection termination 
DoDisconnect was returning WS_SUCCESS after receiving
SSH_MSG_DISCONNECT, allowing the session to continue
processing packets. Per RFC 4253 §11.1, no further data
should be accepted after a disconnect message. Add new
WS_DISCONNECT error code and return it from DoDisconnect
so callers tear down the connection immediately.

F-605
 2026-04-08 12:47:46 +01:00
Andrew Hutchings 16902b0d57 Fix Nucleus month handling 
F-2071
 2026-04-08 12:37:43 +01:00
Andrew Hutchings 1441cb89b8 Fix leak in linked-list 
F-2070
 2026-04-08 12:34:41 +01:00
Andrew Hutchings 2abd046148 Fix oct2dec typo 
F-2069
 2026-04-08 12:30:48 +01:00
John Safranek b318bc95aa
Merge pull request #906 from embhorn/zd21548 
Customer reported issues
 2026-04-07 14:32:47 -07:00
Paul Adelsbach ffa646a4b9 Add validation for accept request and reply 2026-04-07 08:51:55 -07:00
Eric Blankenhorn 31a06d356d Fix from review 2026-04-06 16:26:26 -05:00
Eric Blankenhorn 9dfa93f4b9 Fix from review 2026-04-06 16:23:25 -05:00
Eric Blankenhorn 0bb1d1b5b7 Add test case test_wolfSSH_CTX_UsePrivateKey_buffer_pem 2026-04-06 16:13:41 -05:00
Eric Blankenhorn a89783e378 Fix DoUserAuthRequestRsa() and DoUserAuthRequestRsaCert() to accept ssh-rsa, rsa-sha2-256, and rsa-sha2-512 2026-04-06 15:57:38 -05:00
Eric Blankenhorn 37117df684 In SendKexDhReply, handle when WOLFSSH_CERTS is not defined 2026-04-06 15:54:34 -05:00
Eric Blankenhorn 0b0c05abb6 Fix wolfSSH_ProcessBuffer to check type 2026-04-06 15:52:30 -05:00
Yosuke Shimizu 494b1da1eb Add test for non-existing file 2026-04-03 10:48:59 +09:00
Yosuke Shimizu 2276d94609 Move out buffer allocation and Add cleanup phase for resource management 2026-04-03 09:44:38 +09:00
Yosuke Shimizu 96b6724cbb Add a bounds check on ff_close, ff_pwrite and ff_pread 2026-04-03 08:06:44 +09:00
John Safranek e8f54ae3d0
Merge pull request #899 from yosuke-wolfssl/f_fix 
Fix f_518, f_519, f_871, f_1270
 2026-04-02 14:51:33 -07:00
John Safranek d9db2a635c
Merge pull request #898 from yosuke-wolfssl/f_404_405 
Fix f_404 and f_405
 2026-04-02 14:44:20 -07:00
John Safranek 2f15238c18
Merge pull request #894 from JacobBarthelmeh/sftp 
Simplify and fix for AddAssign64 when WOLFSSL_MAX_32BIT is not defined
 2026-04-02 14:43:54 -07:00
John Safranek a18adff705
Merge pull request #903 from yosuke-wolfssl/fix_1677 
Fix f_1677
 2026-04-02 14:31:30 -07:00
Yosuke Shimizu 24b2846839 Fix f_1677 2026-04-02 17:28:56 +09:00
JacobBarthelmeh 47834894fa simplify and fix for AddAssign64 when WOLFSSL_MAX_32BIT is not defined 2026-04-01 00:02:25 -06:00
Yosuke Shimizu d2eeec5e26 Fix minor issues 2026-03-27 08:27:54 +09:00
Yosuke Shimizu d0aad2be69 Fix f_405 2026-03-27 08:24:23 +09:00