Skip to content

Commit 7963acc

Browse files
committed
Userauth none bypasses wolfSSHd credential check
When wolfsshd is built with WOLFSSH_ALLOW_USERAUTH_NONE, the DefaultUserAuth() function accepted WOLFSSH_USERAUTH_NONE as a valid auth type and forwarded it to RequestAuthentication(). Since RequestAuthentication() only gates credential checks on PASSWORD and PUBLICKEY types, a none request for any existing system user returned success without verifying any credential. Removed USERAUTH_NONE as an accepted auth type in DefaultUserAuth() so it is treated as an invalid auth type for wolfsshd. Affected function: DefaultUserAuth. Issue: F-3215
1 parent 2568b26 commit 7963acc

1 file changed

Lines changed: 5 additions & 5 deletions

File tree

apps/wolfsshd/auth.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1078,8 +1078,11 @@ static int DoCheckUser(const char* usr, WOLFSSHD_AUTH* auth)
10781078
}
10791079

10801080

1081-
/* @TODO this will take in a pipe or equivalent to talk to a privileged thread
1082-
* rather than having WOLFSSHD_AUTH directly with privilege separation */
1081+
/*
1082+
* @TODO this will take in a pipe or equivalent to talk to a privileged thread
1083+
* rather than having WOLFSSHD_AUTH directly with privilege separation.
1084+
* Note: authData->type of WOLFSSH_USERAUTH_NONE is not valid for wolfsshd.
1085+
*/
10831086
static int RequestAuthentication(WS_UserAuthData* authData,
10841087
WOLFSSHD_AUTH* authCtx)
10851088
{
@@ -1291,9 +1294,6 @@ int DefaultUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
12911294
}
12921295

12931296
if (authType != WOLFSSH_USERAUTH_PASSWORD &&
1294-
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
1295-
authType != WOLFSSH_USERAUTH_NONE &&
1296-
#endif
12971297
authType != WOLFSSH_USERAUTH_PUBLICKEY) {
12981298

12991299
ret = WOLFSSH_USERAUTH_INVALID_AUTHTYPE;

0 commit comments

Comments
 (0)