wolfsshd: refuse sessions it cannot serve

A shell, exec or subsystem request is answered as it arrives, through
the channel request callbacks, so a session this build cannot serve is
refused with CHANNEL_FAILURE rather than accepted and then dropped once
the session is up. What the daemon serves is unchanged.

- SessionRequestCb() takes a shell with WOLFSSH_SHELL, an exec with
  WOLFSSH_SHELL or an scp command with WOLFSSH_SCP, and the sftp
  subsystem with WOLFSSH_SFTP; anything else is refused and logged
- a request whose command did not fit is refused rather than read
  through a NULL
- sshd_bad_subsystem_test.sh asks for an unknown subsystem with the
  OpenSSH client and expects the refusal

Author: ejohnstown

apps/wolfsshd/test/run_all_sshd_tests.sh

@@ -9,6 +9,7 @@ test_cases=(
  "sshd_large_sftp_test.sh"
  "sshd_bad_sftp_test.sh"
  "sshd_sftp_idle_cpu_test.sh"
+ "sshd_bad_subsystem_test.sh"
  "sshd_scp_fail.sh"
  "sshd_term_close_test.sh"
  "sshd_stdin_eof_test.sh"

apps/wolfsshd/test/sshd_bad_subsystem_test.sh

@@ -0,0 +1,68 @@
+#!/bin/sh
+
+# sshd local test: a subsystem the daemon does not serve is refused at the
+# request, so the client sees CHANNEL_FAILURE rather than a session that
+# is accepted and then dropped. Uses the system OpenSSH client, since the
+# in-tree clients only ask for sftp.
+
+# Not named PWD: the shell rewrites that variable on every cd, so a saved
+# copy would not survive the cd to the repository root below.
+TESTDIR=`pwd`
+cd ../../..
+
+USER=`whoami`
+PRIVATE_KEY="./keys/hansel-key-ecc.pem"
+
+if [ -z "$1" ] || [ -z "$2" ]; then
+    echo "expecting host and port as arguments"
+    echo "./sshd_bad_subsystem_test.sh 127.0.0.1 22222"
+    exit 1
+fi
+
+if ! command -v ssh >/dev/null 2>&1; then
+    echo "OpenSSH client not found, skipping"
+    exit 77
+fi
+
+# OpenSSH refuses a key file other users can read.
+KEY=`mktemp`
+cat "$PRIVATE_KEY" > "$KEY"
+chmod 600 "$KEY"
+OUT=`mktemp`
+
+ssh_to_sshd() {
+    ssh -p "$2" -i "$KEY" -o IdentitiesOnly=yes -o StrictHostKeyChecking=no \
+        -o UserKnownHostsFile=/dev/null -o PreferredAuthentications=publickey \
+        -o BatchMode=yes -o ConnectTimeout=5 "$USER@$1" "$3" "$4"
+}
+
+# Control: the same client and key can run a command.
+ssh_to_sshd "$1" "$2" "echo ok" > "$OUT" 2>&1
+RESULT=$?
+if [ "$RESULT" != "0" ] || ! grep -q "^ok" "$OUT"; then
+    echo "Control exec through OpenSSH failed ($RESULT):"
+    cat "$OUT"
+    rm -f "$KEY" "$OUT"
+    exit 1
+fi
+
+# A subsystem nothing serves: the client reports the refusal and exits
+# non-zero.
+ssh_to_sshd "$1" "$2" -s no-such-subsystem > "$OUT" 2>&1
+RESULT=$?
+if [ "$RESULT" = "0" ]; then
+    echo "Expecting the unknown subsystem request to fail"
+    cat "$OUT"
+    rm -f "$KEY" "$OUT"
+    exit 1
+fi
+if ! grep -q "subsystem request failed" "$OUT"; then
+    echo "Expecting the client to report the refused subsystem request:"
+    cat "$OUT"
+    rm -f "$KEY" "$OUT"
+    exit 1
+fi
+
+rm -f "$KEY" "$OUT"
+cd "$TESTDIR"
+exit 0

apps/wolfsshd/wolfsshd.c

@@ -359,6 +359,80 @@ static void CleanupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
     (void)conf;
 }
 
+/* Answers a shell, exec or subsystem request as it arrives: a session this
+ * build cannot serve is refused with CHANNEL_FAILURE, rather than accepted
+ * and then dropped once the session is up. Returns 0 to accept and 1 to
+ * refuse. The command is NULL when the request carried none that fit. */
+static int SessionRequestCb(WOLFSSH_CHANNEL* channel, void* vCtx)
+{
+    WOLFSSHD_CONNECTION* conn = (WOLFSSHD_CONNECTION*)vCtx;
+    const char* cmd;
+    const char* reason = NULL;
+    int rej = 1;
+
+    if (conn == NULL || channel == NULL) {
+        return 1;
+    }
+
+    cmd = wolfSSH_ChannelGetSessionCommand(channel);
+    switch (wolfSSH_ChannelGetSessionType(channel)) {
+        case WOLFSSH_SESSION_SHELL:
+        #ifdef WOLFSSH_SHELL
+            rej = 0;
+        #else
+            reason = "shell support is disabled";
+        #endif
+            break;
+
+        case WOLFSSH_SESSION_EXEC:
+            if (cmd == NULL) {
+                reason = "exec request carried no command";
+                break;
+            }
+        #ifdef WOLFSSH_SCP
+            if (WSTRNCMP(cmd, "scp", 3) == 0) {
+                rej = 0;
+                break;
+            }
+        #endif
+        #ifdef WOLFSSH_SHELL
+            rej = 0;
+        #else
+            reason = "exec support is disabled";
+        #endif
+            break;
+
+        case WOLFSSH_SESSION_SUBSYSTEM:
+            if (cmd == NULL) {
+                reason = "subsystem request carried no name";
+            }
+        #ifdef WOLFSSH_SFTP
+            else if (WSTRCMP(cmd, "sftp") == 0) {
+                rej = 0;
+            }
+        #endif
+            else {
+                reason = "unknown or unsupported subsystem";
+            }
+            break;
+
+        case WOLFSSH_SESSION_UNKNOWN:
+        case WOLFSSH_SESSION_TERMINAL:
+        default:
+            reason = "unsupported session type";
+            break;
+    }
+
+    if (rej) {
+        wolfSSH_Log(WS_LOG_ERROR,
+            "[SSHD] Refusing session request from %s: %s [%s]",
+            conn->ip, reason, cmd != NULL ? cmd : "");
+    }
+
+    return rej;
+}
+
+
 /* Initializes and sets up the WOLFSSH_CTX struct based on the configure options
  * return WS_SUCCESS on success
  */
@@ -386,6 +460,9 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx,
     if (ret == WS_SUCCESS) {
         wolfSSH_SetUserAuth(*ctx, DefaultUserAuth);
         wolfSSH_SetUserAuthResult(*ctx, UserAuthResult);
+        wolfSSH_CTX_SetChannelReqShellCb(*ctx, SessionRequestCb);
+        wolfSSH_CTX_SetChannelReqExecCb(*ctx, SessionRequestCb);
+        wolfSSH_CTX_SetChannelReqSubsysCb(*ctx, SessionRequestCb);
     }
 
     /* set banner to display on connection */
@@ -2545,6 +2622,7 @@ static void* HandleConnection(void* arg)
         /* let UserAuthResult reach this connection to cancel the grace timer
          * and to reach conn->auth for the cert force-command */
         wolfSSH_SetUserAuthResultCtx(ssh, conn);
+        wolfSSH_SetChannelReqCtx(ssh, conn);
     #if defined(WOLFSSH_OSSH_CERTS) && !defined(_WIN32)
         /* Unix-only: each connection is a forked child with its own copy of the
          * auth struct. Windows does not enforce OpenSSH certs. */