Skip to content

Minor internal and wolfsshd fixes #1258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stenslae wants to merge 1 commit into
base: master
Choose a base branch
from
+56 −78
Open

Minor internal and wolfsshd fixes #1258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 33 additions & 13 deletions apps/wolfsshd/wolfsshd.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4091,19 +4091,34 @@ static void wolfSSHD_ServiceCb(DWORD CtrlCode)
}


static char* _convertHelper(WCHAR* in, void* heap) {
int retSz;
char* ret;

retSz = (int)wcslen(in) * 2;
ret = (char*)WMALLOC(retSz + 1, heap, DYNTYPE_SSHD);
if (ret != NULL) {
size_t numConv = 0;
if (wcstombs_s(&numConv, ret, retSz, in, retSz) != 0) {
WFREE(ret, heap, DYNTYPE_SSHD);
ret = NULL;
/* *err is only meaningful when NULL is returned: WS_MEMORY_E on alloc
* failure, WS_FATAL_ERROR on conversion failure. */
static char* _convertHelper(WCHAR* in, void* heap, int* err)
{
char* ret = NULL;
size_t needed = 0;

*err = WS_SUCCESS;

/* Query the exact size, including the null. An empty argument sized
* the buffer at 0, which made the convert below fail with EINVAL. */
if (wcstombs_s(&needed, NULL, 0, in, 0) == 0 && needed > 0) {
ret = (char*)WMALLOC(needed, heap, DYNTYPE_SSHD);
if (ret == NULL) {
*err = WS_MEMORY_E;
}
else {
size_t numConv = 0;
if (wcstombs_s(&numConv, ret, needed, in, needed) != 0) {
WFREE(ret, heap, DYNTYPE_SSHD);
ret = NULL;
*err = WS_FATAL_ERROR;
}
}
}
else {
*err = WS_FATAL_ERROR;
}
return ret;
}

Expand Down Expand Up @@ -4192,10 +4207,15 @@ static int StartSSHD(int argc, char** argv)
/* Zero first: _freeWinArgs() walks all argc slots. */
WMEMSET(argv, 0, argc * sizeof(char*));
for (z = 0; z < argc; z++) {
argv[z] = _convertHelper(cmdArgs[z], NULL);
int convErr = WS_FATAL_ERROR;

argv[z] = _convertHelper(cmdArgs[z], NULL, &convErr);
if (argv[z] == NULL) {
/* mygetopt() dereferences every entry it walks. */
ret = WS_MEMORY_E;
wolfSSH_Log(WS_LOG_ERROR,
"[SSHD] Unable to convert argument %u, ret = %d.",
z, convErr);
ret = convErr;
break;
}
}
Expand Down
88 changes: 23 additions & 65 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17977,7 +17977,7 @@ static int SignHEcdsa(WOLFSSH* ssh, byte* sig, word32* sigSz,
}

if (ret == WS_SUCCESS) {
word32 written;
word32 written = 0;

rPad = (r[0] & 0x80) ? 1 : 0;
sPad = (s[0] & 0x80) ? 1 : 0;
Expand Down Expand Up @@ -20936,44 +20936,23 @@ static int PrepareUserAuthRequestEccCert(WOLFSSH* ssh, word32* payloadSz,
}
else
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
{
#if 0
#ifdef WOLFSSH_AGENT
if (ssh->agentEnabled) {
word32 sz;
const byte* c =
(const byte*)authData->sf.publicKey.publicKey;

ato32(c + idx, &sz);
idx += LENGTH_SZ + sz;
ato32(c + idx, &sz);
idx += LENGTH_SZ + sz;
ato32(c + idx, &sz);
idx += LENGTH_SZ;
c += idx;
idx = 0;

ret = wc_ecc_import_x963(c, sz, &keySig->ks.ecc.key);
}
else
#endif
#endif
if (authData->sf.publicKey.privateKey == NULL ||
authData->sf.publicKey.privateKeySz == 0) {
/* A cert-store-only client has no in-memory key; a
* decode of the empty buffer would report a misleading
* wolfCrypt ASN error. */
WLOG(WS_LOG_DEBUG, "PrepareUserAuthRequestEccCert: No "
"private key; the offered certificate matched no "
"cert-store slot");
ret = WS_BAD_ARGUMENT;
}
else {
ret = wc_EccPrivateKeyDecode(
authData->sf.publicKey.privateKey,
&idx, &keySig->ks.ecc.key,
authData->sf.publicKey.privateKeySz);
}
/* No WOLFSSH_AGENT branch: among the certificate key types,
* only RSA implements agent signing. Plain ECDSA keys do use
* the agent, in the non-certificate ECC path. */
if (authData->sf.publicKey.privateKey == NULL ||
authData->sf.publicKey.privateKeySz == 0) {
/* Avoid misleading ASN error for cert-store-only clients
* without an in-memory key. */
WLOG(WS_LOG_DEBUG, "PrepareUserAuthRequestEccCert: No "
"private key available for the offered ECC "
"certificate");
ret = WS_BAD_ARGUMENT;
}
else {
ret = wc_EccPrivateKeyDecode(
authData->sf.publicKey.privateKey,
&idx, &keySig->ks.ecc.key,
authData->sf.publicKey.privateKeySz);
}
}

Expand Down Expand Up @@ -21055,31 +21034,7 @@ static int BuildUserAuthRequestEccCert(WOLFSSH* ssh,
WMEMCPY(checkData + i, sigStart, begin - sigStartIdx);
}

#if 0
#ifdef WOLFSSH_AGENT
if (ssh->agentEnabled) {
if (ret == WS_SUCCESS)
ret = wolfSSH_AGENT_SignRequest(ssh, checkData, checkDataSz,
sig, &sigSz,
authData->sf.publicKey.publicKey,
authData->sf.publicKey.publicKeySz, 0);
if (ret == WS_SUCCESS) {
/* begin indexes into output, whose capacity is outputSz. */
if (outputSz <= begin || outputSz - begin < LENGTH_SZ + sigSz) {
WLOG(WS_LOG_DEBUG, "SUAR: ECDSA agent sig doesn't fit output");
ret = WS_BUFFER_E;
}
}
if (ret == WS_SUCCESS) {
c32toa(sigSz, output + begin);
begin += LENGTH_SZ;
XMEMCPY(output + begin, sig, sigSz);
begin += sigSz;
}
}
else
#endif
#endif
/* Scope for cert-store pvtKey */
{
#ifdef WOLFSSH_WINDOWS_CERT_STORE
const WOLFSSH_PVT_KEY* pvtKey;
Expand Down Expand Up @@ -21138,6 +21093,9 @@ static int BuildUserAuthRequestEccCert(WOLFSSH* ssh,
}
else
#endif /* WOLFSSH_WINDOWS_CERT_STORE */
/* No WOLFSSH_AGENT branch: among the certificate key types,
* only RSA implements agent signing. Plain ECDSA keys do use
* the agent, in the non-certificate ECC path. */
{
if (ret == WS_SUCCESS) {
ret = wc_ecc_sign_hash(digest, digestSz, sig, &sigSz,
Expand Down Expand Up @@ -24634,7 +24592,7 @@ static int CompositeEccSign(void* key, WC_RNG* rng, void* heap,
/* RFC 5656 3.1.2: mpints with the top bit set need a zero pad. */
byte rPad = (rBuf[0] & 0x80) ? 1 : 0;
byte sPad = (sBuf[0] & 0x80) ? 1 : 0;
word32 written;
word32 written = 0;

if (EncodeEcdsaRsToMpints(wireSig, *wireSigSz, rBuf, rSz, rPad,
sBuf, sSz, sPad, &written) != WS_SUCCESS) {
Expand Down
Loading