SFTP path confinement and status-reply refactor

Author: yosuke-wolfssl

.github/workflows/network-contention-test.yml

@@ -111,13 +111,13 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y expect
 
       - name: Create large test files
+        working-directory: ./wolfssh/
         run: |
-          dd if=/dev/urandom of=/tmp/test_1kb.dat bs=1K count=1
-          dd if=/dev/urandom of=/tmp/test_2mb.dat bs=1M count=2
-          dd if=/dev/urandom of=/tmp/test_10mb.dat bs=1M count=10
-          md5sum /tmp/test_*.dat > /tmp/test_checksums.md5
+          dd if=/dev/urandom of=test_1kb.dat bs=1K count=1
+          dd if=/dev/urandom of=test_2mb.dat bs=1M count=2
+          dd if=/dev/urandom of=test_10mb.dat bs=1M count=10
           echo "Test files created:"
-          ls -la /tmp/test_*.dat
+          ls -la test_*.dat
 
       - name: Run extended SFTP file transfer tests
         working-directory: ./wolfssh/
@@ -148,8 +148,8 @@ jobs:
 
           # Test 1KB file transfer
           echo "Testing 1KB file transfer..."
-          /tmp/sftp_test.exp /tmp/test_1kb.dat /tmp/recv_1kb.dat
-          if ! cmp -s /tmp/test_1kb.dat /tmp/recv_1kb.dat; then
+          /tmp/sftp_test.exp test_1kb.dat /tmp/recv_1kb.dat
+          if ! cmp -s test_1kb.dat /tmp/recv_1kb.dat; then
             echo "FAILED: 1KB file integrity check"
             kill $SERVER_PID 2>/dev/null || true
             exit 1
@@ -158,8 +158,8 @@ jobs:
 
           # Test 2MB file transfer
           echo "Testing 2MB file transfer..."
-          /tmp/sftp_test.exp /tmp/test_2mb.dat /tmp/recv_2mb.dat
-          if ! cmp -s /tmp/test_2mb.dat /tmp/recv_2mb.dat; then
+          /tmp/sftp_test.exp test_2mb.dat /tmp/recv_2mb.dat
+          if ! cmp -s test_2mb.dat /tmp/recv_2mb.dat; then
             echo "FAILED: 2MB file integrity check"
             kill $SERVER_PID 2>/dev/null || true
             exit 1
@@ -168,8 +168,8 @@ jobs:
 
           # Test 10MB file transfer
           echo "Testing 10MB file transfer..."
-          /tmp/sftp_test.exp /tmp/test_10mb.dat /tmp/recv_10mb.dat
-          if ! cmp -s /tmp/test_10mb.dat /tmp/recv_10mb.dat; then
+          /tmp/sftp_test.exp test_10mb.dat /tmp/recv_10mb.dat
+          if ! cmp -s test_10mb.dat /tmp/recv_10mb.dat; then
             echo "FAILED: 10MB file integrity check"
             kill $SERVER_PID 2>/dev/null || true
             exit 1

.github/workflows/paramiko-sftp-test.yml

@@ -167,17 +167,19 @@ jobs:
               print("Opening SFTP session...")
               sftp = ssh.open_sftp()
 
+              remote_path = 'test_upload.dat'
+
               # Upload test
               print("Uploading 20MB test file...")
               start_time = time.time()
-              sftp.put('/tmp/sftp_upload/test_upload.dat', '/tmp/test_upload.dat')
+              sftp.put('/tmp/sftp_upload/test_upload.dat', remote_path)
               upload_time = time.time() - start_time
               print(f"Upload completed in {upload_time:.2f} seconds")
 
               # Download test
               print("Downloading 20MB test file...")
               start_time = time.time()
-              sftp.get('/tmp/test_upload.dat', '/tmp/sftp_download/test_download.dat')
+              sftp.get(remote_path, '/tmp/sftp_download/test_download.dat')
               download_time = time.time() - start_time
               print(f"Download completed in {download_time:.2f} seconds")
 
@@ -197,7 +199,7 @@ jobs:
                       download_path = f'/tmp/sftp_download/stress_test_{i}.dat'
                       start_time = time.time()
                       # Paramiko uses prefetch by default for get()
-                      sftp.get('/tmp/test_upload.dat', download_path)
+                      sftp.get(remote_path, download_path)
                       elapsed = time.time() - start_time
 
                       # Verify integrity

.github/workflows/sftp-test.yml

@@ -109,7 +109,6 @@ jobs:
       - name: Run SFTP test
         working-directory: ./wolfssh/
         run: |
-          mkdir -p /tmp/sftp_test_dir
           # Create expect script to automate the SFTP client interaction
           cat > /tmp/sftp_test.exp << 'EOF'
           #!/usr/bin/expect -f
@@ -118,7 +117,7 @@ jobs:
           expect "Password:"
           send "upthehill\r"
           expect "wolfSSH sftp>"
-          send "put /tmp/test.dat /tmp/sftp_test_dir/test_received.dat\r"
+          send "put /tmp/test.dat test_received.dat\r"
           expect "wolfSSH sftp>"
           send "exit\r"
           expect eof
@@ -131,9 +130,9 @@ jobs:
           # Run the expect script
           /tmp/sftp_test.exp
 
-          # Verify the files match
+          # Verify the files match (echoserver's CWD is ./wolfssh/)
           echo "Verifying file integrity..."
-          if cmp -s /tmp/test.dat /tmp/sftp_test_dir/test_received.dat; then
+          if cmp -s /tmp/test.dat test_received.dat; then
             echo "SFTP Test PASSED: Files match"
           else
             echo "SFTP Test FAILED: Files do not match"

apps/wolfsshd/test/sshd_large_sftp_test.sh

@@ -16,22 +16,37 @@ if [ -z "$1" ] || [ -z "$2" ]; then
     exit 1
 fi
 
+# wolfSSHd confines SFTP access to the user's home directory, so the remote
+# file must live under it.  Resolve the same home directory wolfSSHd uses
+# (the passwd entry), falling back to $HOME.
+HOME_DIR=`getent passwd "$USER" 2>/dev/null | cut -d: -f6`
+if [ -z "$HOME_DIR" ]; then
+    HOME_DIR="$HOME"
+fi
+# Fail fast with a clear message rather than silently targeting "/" (which the
+# now-active SFTP confinement would reject with a non-obvious error) if neither
+# the passwd entry nor $HOME yields a usable home directory.
+if [ -z "$HOME_DIR" ] || [ "$HOME_DIR" = "/" ]; then
+    echo "could not resolve a usable home directory for user '$USER'"
+    exit 1
+fi
+REMOTE_FILE="$HOME_DIR/large-random-2.txt"
 
 # create a large file with random data (larger than word32 max value)
 head -c 4400000010 < /dev/random > large-random.txt
 
 set -e
-echo "$TEST_SFTP_CLIENT -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -g -l large-random.txt -r `pwd`/large-random-2.txt -h \"$1\" -p \"$2\""
-$TEST_SFTP_CLIENT -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -g -l large-random.txt -r `pwd`/large-random-2.txt -h "$1" -p "$2"
+echo "$TEST_SFTP_CLIENT -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -g -l large-random.txt -r $REMOTE_FILE -h \"$1\" -p \"$2\""
+$TEST_SFTP_CLIENT -u $USER -i $PRIVATE_KEY -j $PUBLIC_KEY -g -l large-random.txt -r "$REMOTE_FILE" -h "$1" -p "$2"
 
-cmp large-random.txt large-random-2.txt
+cmp large-random.txt "$REMOTE_FILE"
 RESULT=$?
 if [ "$RESULT" != "0" ]; then
     echo "files did not match when compared"
     exit 1
 fi
 rm -f large-random.txt
-rm -f large-random-2.txt
+rm -f "$REMOTE_FILE"
 
 set +e