Repository navigation
sftp: bound reply lengths before client allocs #3197
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: wolfSSHd Test | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**' ] | |
| pull_request: | |
| branches: [ '*' ] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| create_matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| versions: ${{ steps.json.outputs.versions }} | |
| steps: | |
| - name: Create wolfSSL version matrix | |
| id: json | |
| run: | | |
| current=`curl -s https://api.github.com/repos/wolfssl/wolfssl/releases | grep tag_name | cut -d : -f 2,3 | tr -d \" | tr -d , | tr -d ' ' | head -1` | |
| last=`curl -s https://api.github.com/repos/wolfssl/wolfssl/releases | grep tag_name | cut -d : -f 2,3 | tr -d \" | tr -d , | tr -d ' ' | head -2 | tail -1` | |
| VERSIONS=$(echo "[ \"master\", \"$current\", \"$last\" ]") | |
| echo "wolfSSL versions found: $VERSIONS" | |
| echo "versions=$VERSIONS" >> $GITHUB_OUTPUT | |
| build_wolfssl: | |
| needs: create_matrix | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ ubuntu-latest ] | |
| wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }} | |
| mldsa: [ 'yes', 'no' ] | |
| include: | |
| - mldsa: 'yes' | |
| mldsa_flag: '--enable-mldsa' | |
| - mldsa: 'no' | |
| mldsa_flag: '' | |
| name: Build wolfssl | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 4 | |
| steps: | |
| - name: Checking cache for wolfssl | |
| uses: actions/cache@v5 | |
| id: cache-wolfssl | |
| with: | |
| path: build-dir/ | |
| key: wolfssh-sshd-wolfssl-${{ matrix.wolfssl }}-${{ matrix.os }}-mldsa-${{ matrix.mldsa }}-v3 | |
| lookup-only: true | |
| - name: Checkout, build, and install wolfssl | |
| if: steps.cache-wolfssl.outputs.cache-hit != 'true' | |
| uses: wolfSSL/actions-build-autotools-project@v1 | |
| with: | |
| repository: wolfssl/wolfssl | |
| ref: ${{ matrix.wolfssl }} | |
| path: wolfssl | |
| configure: --enable-all ${{ matrix.mldsa_flag }} | |
| check: false | |
| install: true | |
| build_wolfssh: | |
| needs: | |
| - build_wolfssl | |
| - create_matrix | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ ubuntu-latest ] | |
| wolfssl: ${{ fromJson(needs.create_matrix.outputs['versions']) }} | |
| # The last two variants reuse the ML-DSA-enabled wolfSSL and build | |
| # wolfSSH with extra defines it has no configure option for: one | |
| # turns the composite algorithms off, one takes the small-stack | |
| # (heap-allocated) composite paths. Those legs stop after the sshd | |
| # tests; the later steps reconfigure without the extra define. | |
| mldsa: [ 'yes', 'no', 'yes-no-composites', 'yes-small-stack' ] | |
| include: | |
| - mldsa: 'yes' | |
| wolfssl_mldsa: 'yes' | |
| extra_flags: '' | |
| - mldsa: 'no' | |
| wolfssl_mldsa: 'no' | |
| extra_flags: '' | |
| - mldsa: 'yes-no-composites' | |
| wolfssl_mldsa: 'yes' | |
| extra_flags: ' -DWOLFSSH_NO_MLDSA_COMPOSITES' | |
| - mldsa: 'yes-small-stack' | |
| wolfssl_mldsa: 'yes' | |
| extra_flags: ' -DWOLFSSH_SMALL_STACK' | |
| name: Build and test the wolfsshd and wolfssh apps | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checking cache for wolfssl | |
| uses: actions/cache@v5 | |
| with: | |
| path: build-dir/ | |
| key: wolfssh-sshd-wolfssl-${{ matrix.wolfssl }}-${{ matrix.os }}-mldsa-${{ matrix.wolfssl_mldsa }}-v3 | |
| fail-on-cache-miss: true | |
| - uses: actions/checkout@v6 | |
| with: | |
| path: wolfssh/ | |
| - name: autogen | |
| working-directory: ./wolfssh/ | |
| run: ./autogen.sh | |
| - name: configure | |
| working-directory: ./wolfssh/ | |
| run : | | |
| ./configure --enable-all --enable-ossh-certs LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120${{ matrix.extra_flags }}" | |
| - name: make check | |
| working-directory: ./wolfssh/ | |
| run: make check | |
| # Sits before the later steps, which reconfigure over config.log. | |
| - name: Upload failure logs | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: wolfssh-sshd-logs-${{ matrix.wolfssl }}-${{ matrix.mldsa }} | |
| path: | | |
| wolfssh/test-suite.log | |
| wolfssh/tests/*.log | |
| wolfssh/scripts/*.log | |
| wolfssh/config.log | |
| retention-days: 5 | |
| # For sshd_channel_close_test.sh. The suite runs as root, which does not | |
| # see a per-user pip install, so use the distro package. | |
| - name: Install paramiko | |
| uses: ./wolfssh/.github/actions/install-apt-deps | |
| with: | |
| packages: python3-paramiko | |
| ghcr-debs-tag: ubuntu-24.04-tests | |
| - name: Run wolfSSHd tests | |
| working-directory: ./wolfssh/apps/wolfsshd/test | |
| run: | | |
| git log -3 | |
| sudo ./run_all_sshd_tests.sh | |
| - name: Install valgrind | |
| if: matrix.extra_flags == '' | |
| uses: ./wolfssh/.github/actions/install-apt-deps | |
| with: | |
| packages: valgrind | |
| ghcr-debs-tag: ubuntu-24.04-tests | |
| # The recommends (gdb, libc6-dbg) nearly double the download. | |
| no-install-recommends: true | |
| budget-seconds: 300 | |
| - name: Test memory after close down | |
| working-directory: ./wolfssh/ | |
| if: matrix.extra_flags == '' | |
| run: | | |
| touch sshd_config.txt | |
| ./configure --enable-all LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120" --enable-static --disable-shared && make | |
| # wolfSSHd loads the host key through the secure gate; the daemon runs | |
| # under sudo (euid 0) so make the key root-owned and 0600. | |
| sudo chmod 600 ./keys/server-key.pem | |
| sudo chown 0:0 ./keys/server-key.pem | |
| sudo timeout --preserve-status -s 2 5 valgrind --error-exitcode=1 --leak-check=full ./apps/wolfsshd/wolfsshd -D -f sshd_config -h ./keys/server-key.pem -d -p 22222 | |
| # regression test, check that cat command does not hang | |
| - name: Test cat command for hanging | |
| working-directory: ./wolfssh/ | |
| if: matrix.extra_flags == '' | |
| timeout-minutes: 1 | |
| run: | | |
| touch sshd_config.txt | |
| echo "AuthorizedKeysFile $PWD/authorized_keys_test" >> sshd_config.txt | |
| cat ./keys/hansel-*.pub > authorized_keys_test | |
| sed -i.bak "s/hansel/$USER/" ./authorized_keys_test | |
| ./configure --enable-all LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120" --enable-static --disable-shared && make | |
| # Host key must be root-owned and 0600 for the sudo-launched daemon's | |
| # secure gate to load it. | |
| sudo chmod 600 ./keys/server-key.pem | |
| sudo chown 0:0 ./keys/server-key.pem | |
| sudo ./apps/wolfsshd/wolfsshd -f sshd_config.txt -h ./keys/server-key.pem -p 22225 | |
| chmod 600 ./keys/hansel-key-rsa.pem | |
| tail -c 50000 /dev/urandom > test | |
| while ! nc -z 127.0.0.1 22225; do echo "waiting for wolfSSHd"; sleep 0.2; done | |
| cat test | ssh -vvv -T -i ./keys/hansel-key-rsa.pem -oStrictHostKeyChecking=no 127.0.0.1 -p 22225 'cat > test-file' | |
| diff test ~/test-file | |
| sudo pkill wolfsshd | |
| - name: configure with debug | |
| working-directory: ./wolfssh/ | |
| if: matrix.extra_flags == '' | |
| run : | | |
| ./configure --enable-all --enable-debug LDFLAGS="-L${{ github.workspace }}/build-dir/lib" CPPFLAGS="-I${{ github.workspace }}/build-dir/include -DWOLFSSH_NO_FPKI -DWOLFSSH_NO_SFTP_TIMEOUT -DWOLFSSH_MAX_SFTP_RW=4000000 -DMAX_PATH_SZ=120" | |
| - name: make | |
| working-directory: ./wolfssh/ | |
| if: matrix.extra_flags == '' | |
| run: make | |
| # ssh_kex_algos.sh requires debug output otherwise it is skipped | |
| - name: Run wolfSSHd tests with debug | |
| working-directory: ./wolfssh/apps/wolfsshd/test | |
| if: matrix.extra_flags == '' | |
| run: | | |
| git log -3 | |
| sudo ./run_all_sshd_tests.sh --match ssh_kex_algos.sh | |
| # The daemon writes log.txt as root, so make it readable to the upload. | |
| - name: Make wolfSSHd test logs readable | |
| if: failure() | |
| working-directory: ./wolfssh/apps/wolfsshd/test | |
| run: sudo chmod a+r log.txt stdout.txt || true | |
| - name: Upload wolfSSHd test logs | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: wolfsshd-test-logs-${{ matrix.wolfssl }}-${{ matrix.mldsa }} | |
| path: | | |
| wolfssh/apps/wolfsshd/test/log.txt | |
| wolfssh/apps/wolfsshd/test/stdout.txt | |
| if-no-files-found: ignore | |
| retention-days: 5 |