Repository navigation
wolfsshd: apply ForceCommand to SFTP and SCP - #1344
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1344
Scan targets checked: wolfssh-src, wolfssh-bugs
Not reviewed (no scan target covers them): apps/wolfsshd/configuration.h, apps/wolfsshd/test/sshd_forcedcmd_test.sh, apps/wolfsshd/test/sshd_ossh_cert_test.sh
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: apps/wolfsshd/test/test_configuration.c
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
ebc74c2 to
9e31a12
Compare
A ForceCommand other than a bare "internal-sftp" now denies the SFTP subsystem, and any ForceCommand denies SCP, as sshd_config(5) describes it: a forced command applies to shell, command, and subsystem execution. The session dispatch checks the configured command alongside a certificate's, so either one on its own confines the session. - the subsystem arm and both SCP arms consult the configured ForceCommand, not only a certificate's force-command - "internal-sftp" followed by options denies SFTP, since no option is applied, while the shell still refuses it as "internal-sftp" - every site testing for "internal-sftp" now shares one predicate - root's transfer refusal no longer points at ForceCommand internal-sftp, which does not permit SCP - tests require a ForceCommand to deny SFTP and SCP, read the daemon's decisions from its log, and pair a configured internal-sftp with a cert Issue: ZD-22623 Issue: F-10597
ConfigLoad() reports a line too long for its buffer and fails the load. A cut line used to take effect with whatever fitted, since what is left of it is read as a line of its own and a leftover of two bytes or less is skipped as blank. The buffer is 1024 bytes now, so a long path or forced command still loads. - one byte is read past a full buffer, so a line that ends exactly there, at a newline or the end of the file, is not taken for a cut one - the size is WOLFSSHD_MAX_LINE_SIZE in configuration.h, shared with the test - test_configuration covers a long line, lines that exactly fill the buffer, and a line cut to leave a blank-looking remainder Issue: ZD-22623
9e31a12 to
7aa31f3
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1344
Scan targets checked: none
Unchanged since last review (not re-run): wolfssh-src, wolfssh-bugs
Not reviewed (no scan target covers them): apps/wolfsshd/configuration.h, apps/wolfsshd/test/sshd_forcedcmd_test.sh, apps/wolfsshd/test/sshd_ossh_cert_test.sh
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
wolfsshd applied a configured ForceCommand only to shell and exec
sessions. It now confines SFTP and SCP too, as sshd_config(5) describes,
and refuses a config line too long for its buffer.
subsystem, and any ForceCommand denies SCP. Options after
internal-sftp are refused, since none is applied.
instead of taking effect cut short.
Issues: ZD-22623, F-10597