Commander1024/ESP32_Serial_Swiss_Army_Knife
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add restricted wolfSSH ordering fix

Browse Source 
Apply hash-pinned generated edits for CVE-2025-14942 while keeping
wolfSSH 1.4.20 managed sources unchanged. Add the ABI header overlay,
provenance records, and real state-machine interoperability contracts.
This commit is contained in:
Commander1024
2026-09-16 14:04:34 +02:00
parent 4d3bb490c9
commit bea33e1c95
28 changed files with 4653 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ssh_protocol_policy/run.py
+33 -3
View File
@@ -117,6 +117,28 @@ def enum_containing(source, token):
return matches[0] + "\n"
def reviewed_order_function(name, original):
"""Independent, exact allowlist; do not accept an arbitrary generator delta."""
if name == 'SendExtInfo':
return ('int SendExtInfo(WOLFSSH* ssh)\n{\n'
' WOLFSSH_UNUSED(ssh);\n return WS_NOT_COMPILED;\n}\n')
if name == 'SendKexInit':
edits = (
(' ssh->isKeying = 1;',
' /* Set self is keying flag since we started sending the KEX init msg */\n'
' ssh->isKeying |= WOLFSSH_SELF_IS_KEYING;'),
(' if (ssh->ctx->side == WOLFSSH_ENDPOINT_CLIENT) {\n'
' kexAlgoNamesPlus = ",ext-info-c";\n'
' kexAlgoNamesPlusSz = (word32)WSTRLEN(kexAlgoNamesPlus);\n }\n\n', ''),
(' if (ret == WS_SUCCESS)\n ret = wolfSSH_SendPacket(ssh);',
' if (ret == WS_SUCCESS) {\n ret = wolfSSH_SendPacket(ssh);\n }'),
)
for old, new in edits:
assert original.count(old) == 1, name
original = original.replace(old, new)
return original
def main():
parser = argparse.ArgumentParser(description=__doc__)
databases = sorted((ROOT / ".pio/build").glob("*/compile_commands.json"))
@@ -182,15 +204,23 @@ def main():
functions = ("NameToId", "IdToName", "AlgoListSz", "CopyNameList",
"CopyNameListPlus", "BuildNameList", "SendKexInit", "SendExtInfo")
actual = "\n".join(extract(sources["ssh.c"], "wolfSSH_CTX_SetAlgoList" + field)
for field in FIELDS)
ssh_entry = next(e for e in ENTRIES if e.name == 'wolfssh_ssh')
_, generated_ssh = render_entry(ssh_entry, {'project': ROOT})
actual = ''
for field in FIELDS:
name = 'wolfSSH_CTX_SetAlgoList' + field
body = extract(generated_ssh.decode(), name)
assert body == extract(sources['ssh.c'], name), name
actual += body
for name in functions:
if extract(internal, name) != extract(sources["internal.c"], name):
if extract(internal, name) != reviewed_order_function(name, extract(sources["internal.c"], name)):
raise RuntimeError(f"Override changed reviewed protocol function: {name}")
actual += "\n".join(extract(internal, name) for name in functions)
# Preserve actual conditional enum values and feature-filtered name table.
types = "\n".join(enum_containing(resolved, token) for token in
("ID_NONE", "TYPE_KEX", "MSGID_KEXINIT", "WOLFSSH_ENDPOINT_SERVER"))
assert macros['WOLFSSH_SELF_IS_KEYING'] == '0x02'
types += '#define WOLFSSH_SELF_IS_KEYING 0x02\n'
types += "typedef struct { byte id; byte type; const char *name; } NameIdPair;\n" + mapping
assignments = []
for field in FIELDS: