examples/echoserver: hold what a channel send did not take

[yosuke-wolfssl]

Problem

ssh_worker() treated every positive write(), send() and wolfSSH_ChannelIdSend()
as a complete transfer. SendChannelData() clamps each send to
min(peerWindowSz, peerMaxPacketSz), so short sends are routine and seven sites
discarded the unsent suffix — the forwarding path reset its buffer index on any
positive return. Not confined to small windows: a 4 MB echo at the default window
loses 98 KiB. Closes f-10544 (High).

Fix (examples/echoserver/echoserver.c)

WS_AppCtx gains bufferIdx/bufferOff, so each direction keeps the tail its sink
would not take.

• app_drain_to_channel() advances bufferOff by what the send took and holds the
  rest on WS_WANT_WRITE, WS_WINDOW_FULL, WS_REKEYING, WS_CHANNEL_NOT_CONF and
  WS_CHAN_RXD — restoring the entry error code for the latter four, so an "owed"
  status is not read as fatal on the next pass.
• app_echo_pump() reads and echoes the shell channel, replacing the EOF drain
  (eofBuffer, eofOff, eofRead are gone). It runs every pass, since data already
  buffered inside the library draws no second data report.
• app_write_all() writes whole buffers to the pty, agent and forward descriptors.

A descriptor leaves the read set while its buffer is non-empty, and a context clears
its staging as it enters a connection. Holds are retired by existing wakes:
wolfSSH_OutputPending() arms the write set, and inbound traffic arrives on a socket
already in the read set.

Verification

Manual, since the tests are deferred. Same client and constrained window, master vs
this branch:

Case	master	branch
Echo 4 MiB, default window	98 KiB lost	complete
Forward, 2 MB target→client	truncated at 3000	byte-identical
pty shell, 1500 lines, slow reader	1478 lines lost	none lost

make check 13/13 (incl. fwd.test, fwd-bulk.test); GCC -Werror clean on 6
configurations; ASan + UBSan clean; Zephyr qemu_x86 3/3.

Not in this PR

• Regression tests. Withdrawn: they force a rekey mid-transfer in small-highwater
  builds, hitting a separate defect that reproduces on master — the echo path treats
  a rekey-blocked send as fatal. They land with that fix.
• dump_stats() has the same flaw: a short wolfSSH_stream_send() truncates the
  statistics blob. It is left alone on purpose. A plain retry is worse than the
  truncation — the second send finds the window exhausted, returns WS_WINDOW_FULL,
  and the caller's <= 0 check ends the session. Doing it properly means staging the
  blob and resuming across passes, which is out of proportion for debug output behind
  a control byte.
• The ESP-IDF copy, deferred: its ssh_worker() has diverged by ~580 lines and has
  no select() write set, which this fix depends on.

[Copilot]

🟡 Changes recommended

Critical EOF flushing and forwarding teardown issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Reworks echo-server buffering to preserve unsent data during short channel and descriptor writes, with regression tests for flow control and half-close behavior.

Changes:

• Adds persistent staging and reliable drain helpers.
• Updates echo, agent, and forwarding paths.
• Adds 8,000-byte round-trip regression tests.

File summaries

File	Summary
tests/api.c	Adds flow-control, refill, and half-close tests.
examples/echoserver/echoserver.c	Preserves partial transfers across worker passes.

Review details

Suppressed comments (1)

examples/echoserver/echoserver.c:1760

• When the local forwarding socket reaches EOF, this path changes fwdCtx to APP_STATE_LISTEN and continues without resetting bufferIdx/bufferOff. Any staged tail left by an earlier channel send therefore survives into the next accepted connection and is sent on its channel. Reset the staging fields on this EOF/reset teardown as well (and do the same for the analogous agent-socket close paths).

                    if (cnt_r == 0) {
                        /* Read zero-returned. Socket is closed. Go back
                           to listening. */
                        WCLOSESOCKET(fwdFd);
                        fwdFd = -1;
                        threadCtx->fwdCtx.appFd = -1;
                        if (threadCtx->fwdCbCtx.hostName != NULL) {
                            WFREE(threadCtx->fwdCbCtx.hostName, NULL, 0);
                            threadCtx->fwdCbCtx.hostName = NULL;
                        }
                        threadCtx->fwdCtx.state = APP_STATE_LISTEN;
                        continue;

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1261

Scan targets checked: wolfssh-src, wolfssh-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1261

Scan targets checked: wolfssh-src, wolfssh-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1261

Scan targets checked: wolfssh-src, wolfssh-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.