Repository navigation
client: harden password and prompt handling - #1339
Open
ejohnstown wants to merge 3 commits into
Open
ejohnstown wants to merge 3 commits into
ejohnstown wants to merge 3 commits into
Conversation
ejohnstown
force-pushed
the
client-auth
branch
from
October 22, 2026 21:45
30790ae to
97a8dad
Compare
ClientUserAuth() hands the library its static password buffer, and the library sends from it after the callback returns. The clients now wipe it, and the example's keyboard-interactive responses, as soon as connect returns instead of holding them for the whole session. - ClientClearPassword() in both common.c copies, called after connect in the wolfssh app, the example client and the sftp client - the password arm wipes before each prompt and on failure, so a retry keeps no tail of a longer password - the keyboard arm wipes its scratch copy after each response - tests: regress and auth cases for the retry tail, the wipe and a failed read Issue: F-8846
The password prompt reads stdin with fgets(), and a buffered stdin keeps its own copy of the line in libc for the life of the process. The clients make stdin unbuffered before any stdin I/O, so the typed password lands only in the buffer ClientUserAuth() wipes. - the wolfssh app, and the example client, sftp client and scp client whether or not -P was given, as keyboard-interactive reads stdin too - ClientUnbufferStdin() acts once per process and reports a failure - scripts/sshclient.test sends the session data right after the password, with no sleep Issue: F-15669
The example client prints the keyboard-interactive name, instruction and prompts through ClientPrintSafe(), which prints a '.' in place of each control character other than tab and newline, DEL, and each byte 0x80 and up, per RFC 4256 section 3.3 and RFC 4251 section 9.2. - tests: auth case capturing the printed strings Issue: F-15534
ejohnstown
force-pushed
the
client-auth
branch
from
October 22, 2026 21:54
97a8dad to
2a69602
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1339
Scan targets checked: wolfssh-src, wolfssh-bugs
Not reviewed (no scan target covers them): apps/wolfssh/common.h, examples/client/common.h, scripts/sshclient.test
Coverage: 5 of 8 in-scope changed file(s) opened by the reviewer; not opened: examples/scpclient/scpclient.c, examples/sftpclient/sftpclient.c, tests/auth.c
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The example clients and the wolfssh app wipe the password and the
keyboard-interactive responses once connect returns, read them from
an unbuffered stdin, and mask control bytes in server prompts.
wiped before each prompt.
keyboard-interactive strings.
server does not list publickey, as OpenSSH does. F-7640 will fix the
method order.
Issue: F-8846, F-15669, F-15534