Commander1024/ESP32_Serial_Swiss_Army_Knife
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden SSH parsing and add notice tooling

Browse Source 
- Enforce exact service and channel names with bounded failure parsing
- Add hash-pinned offline notice assembly and regression coverage
- Record advisory dispositions, provenance, integration evidence, and
  remaining gates
This commit is contained in:
Commander1024
2026-09-16 15:06:38 +02:00
parent bea33e1c95
commit 51f835c22f
29 changed files with 3332 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/wolfssh_parser_contract/pr902.patch
+55
View File
@@ -0,0 +1,55 @@
From ffa646a4b9d47d5d9d6127db140c433c58b1e276 Mon Sep 17 00:00:00 2001
From: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Date: Tue, 7 Apr 2026 08:51:55 -0700
Subject: [PATCH] Add validation for accept request and reply
---
src/internal.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/src/internal.c b/src/internal.c
index 77f165dbb..b9b795582 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -6539,6 +6539,20 @@ static int DoServiceRequest(WOLFSSH* ssh,
ret = GetString(name, &nameSz, buf, len, idx);
+ /* Requested service must be 'ssh-userauth' */
+ if (ret == WS_SUCCESS) {
+ const char* nameUserAuth = IdToName(ID_SERVICE_USERAUTH);
+ if (nameUserAuth == NULL
+ || nameSz != (word32)XSTRLEN(nameUserAuth)
+ || XMEMCMP(name, nameUserAuth, nameSz) != 0) {
+ WLOG(WS_LOG_DEBUG, "Requested unsupported service: %s", name);
+ /* Terminate session, ignore result of disconnect attempt */
+ (void)SendDisconnect(ssh,
+ WOLFSSH_DISCONNECT_SERVICE_NOT_AVAILABLE);
+ ret = WS_INVALID_STATE_E;
+ }
+ }
+
if (ret == WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Requesting service: %s", name);
ssh->clientState = CLIENT_USERAUTH_REQUEST_DONE;
@@ -6557,6 +6571,20 @@ static int DoServiceAccept(WOLFSSH* ssh,
ret = GetString(name, &nameSz, buf, len, idx);
+ /* Accepted service must be 'ssh-userauth' */
+ if (ret == WS_SUCCESS) {
+ const char* nameUserAuth = IdToName(ID_SERVICE_USERAUTH);
+ if (nameUserAuth == NULL
+ || nameSz != (word32)XSTRLEN(nameUserAuth)
+ || XMEMCMP(name, nameUserAuth, nameSz) != 0) {
+ WLOG(WS_LOG_DEBUG, "Accepted unexpected service: %s", name);
+ /* Terminate session, ignore result of disconnect attempt */
+ (void)SendDisconnect(ssh,
+ WOLFSSH_DISCONNECT_SERVICE_NOT_AVAILABLE);
+ ret = WS_INVALID_STATE_E;
+ }
+ }
+
if (ret == WS_SUCCESS) {
WLOG(WS_LOG_DEBUG, "Accepted service: %s", name);
ssh->serverState = SERVER_USERAUTH_REQUEST_DONE;