Commander1024
51f835c22f
- Enforce exact service and channel names with bounded failure parsing - Add hash-pinned offline notice assembly and regression coverage - Record advisory dispositions, provenance, integration evidence, and remaining gates
56 lines
2.1 KiB
Diff
56 lines
2.1 KiB
Diff
From ffa646a4b9d47d5d9d6127db140c433c58b1e276 Mon Sep 17 00:00:00 2001
|
|
From: Paul Adelsbach <paul.adelsbach@wolfssl.com>
|
|
Date: Tue, 7 Apr 2026 08:51:55 -0700
|
|
Subject: [PATCH] Add validation for accept request and reply
|
|
|
|
---
|
|
src/internal.c | 28 ++++++++++++++++++++++++++++
|
|
1 file changed, 28 insertions(+)
|
|
|
|
diff --git a/src/internal.c b/src/internal.c
|
|
index 77f165dbb..b9b795582 100644
|
|
--- a/src/internal.c
|
|
+++ b/src/internal.c
|
|
@@ -6539,6 +6539,20 @@ static int DoServiceRequest(WOLFSSH* ssh,
|
|
|
|
ret = GetString(name, &nameSz, buf, len, idx);
|
|
|
|
+ /* Requested service must be 'ssh-userauth' */
|
|
+ if (ret == WS_SUCCESS) {
|
|
+ const char* nameUserAuth = IdToName(ID_SERVICE_USERAUTH);
|
|
+ if (nameUserAuth == NULL
|
|
+ || nameSz != (word32)XSTRLEN(nameUserAuth)
|
|
+ || XMEMCMP(name, nameUserAuth, nameSz) != 0) {
|
|
+ WLOG(WS_LOG_DEBUG, "Requested unsupported service: %s", name);
|
|
+ /* Terminate session, ignore result of disconnect attempt */
|
|
+ (void)SendDisconnect(ssh,
|
|
+ WOLFSSH_DISCONNECT_SERVICE_NOT_AVAILABLE);
|
|
+ ret = WS_INVALID_STATE_E;
|
|
+ }
|
|
+ }
|
|
+
|
|
if (ret == WS_SUCCESS) {
|
|
WLOG(WS_LOG_DEBUG, "Requesting service: %s", name);
|
|
ssh->clientState = CLIENT_USERAUTH_REQUEST_DONE;
|
|
@@ -6557,6 +6571,20 @@ static int DoServiceAccept(WOLFSSH* ssh,
|
|
|
|
ret = GetString(name, &nameSz, buf, len, idx);
|
|
|
|
+ /* Accepted service must be 'ssh-userauth' */
|
|
+ if (ret == WS_SUCCESS) {
|
|
+ const char* nameUserAuth = IdToName(ID_SERVICE_USERAUTH);
|
|
+ if (nameUserAuth == NULL
|
|
+ || nameSz != (word32)XSTRLEN(nameUserAuth)
|
|
+ || XMEMCMP(name, nameUserAuth, nameSz) != 0) {
|
|
+ WLOG(WS_LOG_DEBUG, "Accepted unexpected service: %s", name);
|
|
+ /* Terminate session, ignore result of disconnect attempt */
|
|
+ (void)SendDisconnect(ssh,
|
|
+ WOLFSSH_DISCONNECT_SERVICE_NOT_AVAILABLE);
|
|
+ ret = WS_INVALID_STATE_E;
|
|
+ }
|
|
+ }
|
|
+
|
|
if (ret == WS_SUCCESS) {
|
|
WLOG(WS_LOG_DEBUG, "Accepted service: %s", name);
|
|
ssh->serverState = SERVER_USERAUTH_REQUEST_DONE;
|