Refuse a session channel open on a client - #1224
Conversation
RFC 4254 6.1 has a session open travelling client-to-server, so DoChannelOpen refuses one on a client endpoint in the type switch, ahead of ChannelNew and any channelOpenCb. OpenSSH and Dropbear refuse it outright too, with no application opt-in. - Answer OPEN_ADMINISTRATIVELY_PROHIBITED, as the forwarded-tcpip direction gate below it does. - Widen the client harness guard in regress.c so it builds without WOLFSSH_FWD, and hoist AcceptChannelOpenCb out of the forwarding block. - Cover the refusal, and the gate outranking an accepting channelOpenCb. Issue: F-8836
There was a problem hiding this comment.
🟢 Approval recommended
The change is small, RFC-aligned, and is backed by targeted regression tests that validate both the new refusal behavior and its precedence over callbacks.
Pull request overview
This PR updates wolfSSH’s channel-open handling to refuse inbound session channel open requests when running as a client endpoint, matching RFC 4254 §6.1 directionality and aligning behavior with OpenSSH/Dropbear.
Changes:
- Add an explicit direction gate in
DoChannelOpen()to rejectsessionopens received by a client and respond withOPEN_ADMINISTRATIVELY_PROHIBITED. - Broaden the client-side channel-open harness guard in
tests/regress.cso it builds withoutWOLFSSH_FWD. - Add regression coverage to ensure the refusal occurs and that it outranks an accepting
channelOpenCb.
File summaries
| File | Description |
|---|---|
tests/regress.c |
Expands client harness availability and adds tests covering client-side refusal of inbound session opens and precedence over channelOpenCb. |
src/internal.c |
Adds client-side direction check for session channel opens, returning an administrative-prohibited open-failure response. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1224
Scan targets checked: wolfssh-bugs, wolfssh-src
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
DoChannelOpen refuses a session open on a client endpoint, per RFC 4254
6.1, ahead of ChannelNew and any channelOpenCb. OpenSSH and Dropbear
refuse it outright too, with no application opt-in.
direction gate below it does.
WOLFSSH_FWD.
Issue: F-8836