Repository navigation
wolfsshd: apply ForceCommand to SFTP and SCP - #1344
Open
ejohnstown wants to merge 2 commits into
Open
ejohnstown wants to merge 2 commits into
ejohnstown wants to merge 2 commits into
Conversation
A ForceCommand other than a bare "internal-sftp" now denies the SFTP subsystem, and any ForceCommand denies SCP, as sshd_config(5) describes it: a forced command applies to shell, command, and subsystem execution. The session dispatch checks the configured command alongside a certificate's, so either one on its own confines the session. - the subsystem arm and both SCP arms consult the configured ForceCommand, not only a certificate's force-command - "internal-sftp" followed by options denies SFTP, since no option is applied, while the shell still refuses it as "internal-sftp" - every site testing for "internal-sftp" now shares one predicate - root's transfer refusal no longer points at ForceCommand internal-sftp, which does not permit SCP - tests require a ForceCommand to deny SFTP and SCP, read the daemon's decisions from its log, and pair a configured internal-sftp with a cert Issue: ZD-22623
ConfigLoad() reports a line too long for its buffer and fails the load. A cut line used to take effect with whatever fitted, since what is left of it is read as a line of its own and a leftover of two bytes or less is skipped as blank. The buffer is 1024 bytes now, so a long path or forced command still loads. - one byte is read past a full buffer, so a line that ends exactly there, at a newline or the end of the file, is not taken for a cut one - the size is WOLFSSHD_MAX_LINE_SIZE in configuration.h, shared with the test - test_configuration covers a long line, lines that exactly fill the buffer, and a line cut to leave a blank-looking remainder Issue: ZD-22623
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1344
Scan targets checked: wolfssh-src, wolfssh-bugs
Not reviewed (no scan target covers them): apps/wolfsshd/configuration.h, apps/wolfsshd/test/sshd_forcedcmd_test.sh, apps/wolfsshd/test/sshd_ossh_cert_test.sh
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: apps/wolfsshd/test/test_configuration.c
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
wolfsshd applied a configured ForceCommand only to shell and exec
sessions. It now confines SFTP and SCP too, as sshd_config(5) describes,
and refuses a config line too long for its buffer.
subsystem, and any ForceCommand denies SCP. Options after
internal-sftp are refused, since none is applied.
instead of taking effect cut short.
Issue: ZD-22623