Skip to content

Split SFTP confinement from the start path #1167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ejohnstown wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Split SFTP confinement from the start path #1167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5b91bb5
Split SFTP confinement from the start path
ejohnstown Aug 13, 2026
b82a5ef
Build the confinement test fixture paths from the working directory
ejohnstown Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions examples/echoserver/echoserver.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2893,9 +2893,12 @@ static int wsUserAuth(byte authType,
*
* @param ssh WOLFSSH object to update
* @param defaultSftpPath command line provided default SFTP path
* @param confine when set, also confine the session to that path,
* rather than only starting it there
* @return 0 for success or error code
*/
static int SetDefaultSftpPath(WOLFSSH* ssh, const char* defaultSftpPath)
static int SetDefaultSftpPath(WOLFSSH* ssh, const char* defaultSftpPath,
int confine)
{
char path[WOLFSSH_MAX_FILENAME];
char realPath[WOLFSSH_MAX_FILENAME];
Expand Down Expand Up @@ -2936,6 +2939,12 @@ static int SetDefaultSftpPath(WOLFSSH* ssh, const char* defaultSftpPath)
ret = wolfSSH_SFTP_SetDefaultPath(ssh, realPath);
}

/* the echoserver does not drop privileges, so -D is the only thing that
* bounds a session */
if (ret == WS_SUCCESS && confine) {
ret = wolfSSH_SFTP_SetConfinePath(ssh, realPath);
}

return ret;
}
#endif
Expand All @@ -2956,6 +2965,8 @@ static void ShowUsage(void)
printf(" -N use non-blocking sockets\n");
#ifdef WOLFSSH_SFTP
printf(" -d <string> set the home directory for SFTP connections\n");
printf(" -D confine SFTP connections to the home directory,"
" rather than only starting them there\n");
#endif
printf(" -j <file> load in a SSH public key to accept from peer\n"
" (user assumed in comment)\n");
Expand Down Expand Up @@ -3091,6 +3102,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
word16 port = wolfSshPort;
char* readyFile = NULL;
const char* defaultSftpPath = NULL;
int confineSftpPath = 0;
char nonBlock = 0;
#ifndef NO_FILESYSTEM
char* userPubKey = NULL;
Expand All @@ -3108,7 +3120,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
#endif

if (argc > 0) {
const char* optlist = "?1a:d:efEp:R:Ni:j:i:I:J:K:P:k:b:x:m:c:s:G:H";
const char* optlist = "?1a:d:DefEp:R:Ni:j:i:I:J:K:P:k:b:x:m:c:s:G:H";
myoptind = 0;
while ((ch = mygetopt(argc, argv, optlist)) != -1) {
switch (ch) {
Expand Down Expand Up @@ -3171,6 +3183,10 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
defaultSftpPath = myoptarg;
break;

case 'D':
confineSftpPath = 1;
break;

#ifndef NO_FILESYSTEM
case 'j':
userPubKey = myoptarg;
Expand Down Expand Up @@ -3739,7 +3755,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
}

#ifdef WOLFSSH_SFTP
if (SetDefaultSftpPath(ssh, defaultSftpPath) != 0) {
if (SetDefaultSftpPath(ssh, defaultSftpPath, confineSftpPath) != 0) {
ES_ERROR("Couldn't store default sftp path.\n");
}
#endif
Expand Down Expand Up @@ -3838,6 +3854,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
#endif

(void)defaultSftpPath;
(void)confineSftpPath;
WOLFSSL_RETURN_FROM_THREAD(0);
}

Expand Down
4 changes: 4 additions & 0 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1791,6 +1791,10 @@ void SshResourceFree(WOLFSSH* ssh, void* heap)
WFREE(ssh->sftpDefaultPath, heap, DYNTYPE_STRING);
ssh->sftpDefaultPath = NULL;
}
if (ssh->sftpConfinePath) {
WFREE(ssh->sftpConfinePath, heap, DYNTYPE_STRING);
ssh->sftpConfinePath = NULL;
}
#endif
#ifdef WOLFSSH_TERM
if (ssh->modes) {
Expand Down
Loading
Loading