sftp: report missing and refused paths by errno

STAT, LSTAT, OPEN, REMOVE, RENAME and OPENDIR take the status for a
failed call from errno, as OpenSSH's sftp-server does: ENOENT and
ENOTDIR answer SSH_FX_NO_SUCH_FILE, EACCES and EPERM
SSH_FX_PERMISSION_DENIED, anything else SSH_FX_FAILURE. Only the
default POSIX file system sets errno; other ports keep their old status.

- OPENDIR on POSIX no longer reports every failure as NO_SUCH_FILE

Issue: F-16081

Author: ejohnstown

src/wolfsftp.c

@@ -2138,6 +2138,33 @@ static int SFTP_SendStatus(WOLFSSH* ssh, byte type, int reqId, const char* msg)
 }
 
 
+/* Status code for a file system call that just failed, from errno where the
+ * file system sets it: NO_SUCH_FILE for a missing path, PERMISSION_DENIED for
+ * a refused one, FAILURE otherwise. Without errno it is fallback. Call it
+ * before anything else, a log line included, can change errno. */
+static byte SFTP_FailStatus(byte fallback)
+{
+    byte type = fallback;
+
+#ifdef WOLFSSH_SFTP_ERRNO
+    switch (errno) {
+        case ENOENT:
+        case ENOTDIR:
+            type = WOLFSSH_FTP_NOFILE;
+            break;
+        case EACCES:
+        case EPERM:
+            type = WOLFSSH_FTP_PERMISSION;
+            break;
+        default:
+            type = WOLFSSH_FTP_FAILURE;
+            break;
+    }
+#endif
+    return type;
+}
+
+
 /* Handles packet to remove a directory
  *
  * returns WS_SUCCESS on success
@@ -2472,6 +2499,7 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
     char  naf[] = "Not A File";
     char  per[] = "Permission denied";
     char  tmf[] = "Too Many Open File Handles";
+    byte  type = WOLFSSH_FTP_FAILURE;
     int handleStored = 0;
 
     if (ssh == NULL) {
@@ -2601,9 +2629,10 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         fd = WOPEN(ssh->fs, dir, m, WOLFSSH_SFTP_SAFE_MODE(atr.per));
     #endif
         if (fd < 0) {
+            type = SFTP_FailStatus(WOLFSSH_FTP_FAILURE);
             WLOG(WS_LOG_SFTP, "Error opening file %s", dir);
             res = oer;
-            if (wolfSSH_SFTP_CreateStatus(ssh, WOLFSSH_FTP_FAILURE, reqId, res,
+            if (wolfSSH_SFTP_CreateStatus(ssh, type, reqId, res,
                     "English", NULL, &outSz) != WS_SIZE_ONLY) {
                 ret = WS_FATAL_ERROR;
                 goto cleanup;
@@ -2651,7 +2680,7 @@ int wolfSSH_SFTP_RecvOpen(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         }
     }
     else {
-        if (wolfSSH_SFTP_CreateStatus(ssh, WOLFSSH_FTP_FAILURE, reqId, res,
+        if (wolfSSH_SFTP_CreateStatus(ssh, type, reqId, res,
                 "English", out, &outSz) != WS_SUCCESS) {
             ret = WS_FATAL_ERROR;
             goto cleanup;
@@ -2962,9 +2991,10 @@ int wolfSSH_SFTP_RecvOpenDir(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
     }
 
     if (WOPENDIR(ssh->fs, ssh->ctx->heap, &ctx, dir) != 0) {
+        byte type = SFTP_FailStatus(WOLFSSH_FTP_NOFILE);
+
         WLOG(WS_LOG_SFTP, "Error with opening directory: %s", dir);
-        rc = SFTP_SendStatus(ssh, WOLFSSH_FTP_NOFILE, reqId,
-                "Unable To Open Directory");
+        rc = SFTP_SendStatus(ssh, type, reqId, "Unable To Open Directory");
         return (rc == WS_SUCCESS) ? WS_BAD_FILE_E : rc;
     }
 
@@ -4981,6 +5011,7 @@ int wolfSSH_SFTP_RecvRemove(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         if (WS_DeleteFileA(name, ssh->ctx->heap) == 0)
     #endif /* USE_WINDOWS_API */
         {
+            type = SFTP_FailStatus(WOLFSSH_FTP_FAILURE);
             WLOG(WS_LOG_SFTP, "Error removing file");
         #if defined(WOLFSSL_NUCLEUS) && defined(DEBUG_WOLFSSH)
             if (ret == NUF_ACCES)
@@ -5007,7 +5038,9 @@ int wolfSSH_SFTP_RecvRemove(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
     }
     else if (ret != WS_SUCCESS) {
         res  = err;
-        type = WOLFSSH_FTP_FAILURE;
+        if (type == WOLFSSH_FTP_OK) {
+            type = WOLFSSH_FTP_FAILURE;
+        }
     }
 
     /* keep the operation result on success; on a send failure propagate it so
@@ -5073,6 +5106,7 @@ int wolfSSH_SFTP_RecvRename(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         if (WS_MoveFileA(old, name, ssh->ctx->heap) == 0)
     #endif /* USE_WINDOWS_API */
         {
+            type = SFTP_FailStatus(WOLFSSH_FTP_FAILURE);
             WLOG(WS_LOG_SFTP, "Error renaming file");
             ret = WS_BAD_FILE_E;
         }
@@ -5085,7 +5119,9 @@ int wolfSSH_SFTP_RecvRename(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         ret  = WS_BAD_FILE_E;
     }
     else if (ret != WS_SUCCESS) {
-        type = WOLFSSH_FTP_FAILURE;
+        if (type == WOLFSSH_FTP_OK) {
+            type = WOLFSSH_FTP_FAILURE;
+        }
         res  = err;
     }
 
@@ -6030,8 +6066,9 @@ int wolfSSH_SFTP_RecvSTAT(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         WMEMSET((byte*)&atr, 0, sizeof(WS_SFTP_FILEATRB));
         if (SFTP_GetAttributes(ssh->fs, name, &atr, 0, ssh->ctx->heap)
             != WS_SUCCESS) {
+            statusType = SFTP_FailStatus(WOLFSSH_FTP_FAILURE);
             WLOG(WS_LOG_SFTP, "Unable to get stat of file/directory");
-            if (wolfSSH_SFTP_CreateStatus(ssh, WOLFSSH_FTP_FAILURE, reqId,
+            if (wolfSSH_SFTP_CreateStatus(ssh, statusType, reqId,
                     ser, "English", NULL, &outSz) != WS_SIZE_ONLY) {
                 return WS_FATAL_ERROR;
             }
@@ -6124,8 +6161,9 @@ int wolfSSH_SFTP_RecvLSTAT(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
         if ((ret = SFTP_GetAttributes(ssh->fs, name, &atr, 1, ssh->ctx->heap))
                 != WS_SUCCESS) {
             /* tell peer that was not ok */
+            statusType = SFTP_FailStatus(WOLFSSH_FTP_FAILURE);
             WLOG(WS_LOG_SFTP, "Unable to get lstat of file/directory");
-            if (wolfSSH_SFTP_CreateStatus(ssh, WOLFSSH_FTP_FAILURE, reqId,
+            if (wolfSSH_SFTP_CreateStatus(ssh, statusType, reqId,
                     ser, "English", NULL, &outSz) != WS_SIZE_ONLY) {
                 return WS_FATAL_ERROR;
             }

tests/regress.c

@@ -17459,6 +17459,158 @@ static void TestSftpOpenDirAllocFailure(void)
 #endif /* !WOLFSSL_STATIC_MEMORY && !WOLFSSL_DEBUG_MEMORY */
 #endif /* NO_WOLFSSH_DIR */
 
+#ifdef WOLFSSH_SFTP_ERRNO
+/* FXP_REMOVE, FXP_STAT, FXP_LSTAT or FXP_OPENDIR path, by type. */
+static int SftpPathRequest(WOLFSSH* ssh, byte type, int reqId,
+        const char* path)
+{
+    byte pkt[WOLFSSH_MAX_FILENAME + UINT32_SZ];
+    word32 idx = 0;
+    word32 pathSz = (word32)WSTRLEN(path);
+
+    SftpPutU32(pathSz, pkt + idx); idx += UINT32_SZ;
+    WMEMCPY(pkt + idx, path, pathSz); idx += pathSz;
+
+    switch (type) {
+        case WOLFSSH_FTP_REMOVE:
+            return wolfSSH_SFTP_RecvRemove(ssh, reqId, pkt, idx);
+        case WOLFSSH_FTP_STAT:
+            return wolfSSH_SFTP_RecvSTAT(ssh, reqId, pkt, idx);
+        case WOLFSSH_FTP_LSTAT:
+            return wolfSSH_SFTP_RecvLSTAT(ssh, reqId, pkt, idx);
+    #ifndef NO_WOLFSSH_DIR
+        case WOLFSSH_FTP_OPENDIR:
+            return wolfSSH_SFTP_RecvOpenDir(ssh, reqId, pkt, idx);
+    #endif
+        default:
+            return WS_BAD_ARGUMENT;
+    }
+}
+
+/* FXP_RENAME from to. */
+static int SftpRenamePath(WOLFSSH* ssh, int reqId, const char* from,
+        const char* to)
+{
+    byte pkt[2 * (WOLFSSH_MAX_FILENAME + UINT32_SZ)];
+    word32 idx = 0;
+    word32 sz;
+
+    sz = (word32)WSTRLEN(from);
+    SftpPutU32(sz, pkt + idx); idx += UINT32_SZ;
+    WMEMCPY(pkt + idx, from, sz); idx += sz;
+    sz = (word32)WSTRLEN(to);
+    SftpPutU32(sz, pkt + idx); idx += UINT32_SZ;
+    WMEMCPY(pkt + idx, to, sz); idx += sz;
+
+    return wolfSSH_SFTP_RecvRename(ssh, reqId, pkt, idx);
+}
+
+/* A request naming a file that does not exist answers NO_SUCH_FILE, one the
+ * server may not reach answers PERMISSION_DENIED, and anything else stays
+ * FAILURE (draft-ietf-secsh-filexfer-02 Section 7). The cause comes from
+ * errno, so this runs on the POSIX file system only. */
+static void TestSftpMissingFileStatus(void)
+{
+    static const byte pathTypes[] = {
+        WOLFSSH_FTP_STAT, WOLFSSH_FTP_LSTAT, WOLFSSH_FTP_REMOVE,
+    #ifndef NO_WOLFSSH_DIR
+        WOLFSSH_FTP_OPENDIR,
+    #endif
+    };
+    WOLFSSH_CTX* ctx;
+    WOLFSSH* ssh;
+    int rid = 1000;
+    int reqId;
+    word32 i;
+    byte handle[WOLFSSH_HANDLE_ID_SZ];
+    char cwd[WOLFSSH_MAX_FILENAME];
+    char dir[64];
+    char missing[96];
+    char locked[96];
+    char present[96];
+    char inLocked[128];
+    FILE* f;
+
+    ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_SERVER, NULL);
+    AssertNotNull(ctx);
+    ssh = wolfSSH_new(ctx);
+    AssertNotNull(ssh);
+    AssertIntEQ(wolfSSH_SFTP_TestRecvStateInit(ssh), WS_SUCCESS);
+
+    WMEMSET(cwd, 0, sizeof(cwd));
+    AssertNotNull(WGETCWD(ssh->fs, cwd, sizeof(cwd) - 1));
+    AssertIntEQ(wolfSSH_SFTP_SetDefaultPath(ssh, cwd), WS_SUCCESS);
+    AssertIntEQ(wolfSSH_SFTP_SetConfinePath(ssh, cwd), WS_SUCCESS);
+
+    WSNPRINTF(dir, sizeof(dir), "wolfssh_nofile_%d", (int)getpid());
+    WSNPRINTF(missing, sizeof(missing), "%s/missing", dir);
+    WSNPRINTF(present, sizeof(present), "%s/present", dir);
+    WSNPRINTF(locked, sizeof(locked), "%s/locked", dir);
+    WSNPRINTF(inLocked, sizeof(inLocked), "%s/locked/x", dir);
+    AssertIntEQ(mkdir(dir, 0700), 0);
+    AssertIntEQ(mkdir(locked, 0700), 0);
+    f = fopen(present, "wb");
+    AssertNotNull(f);
+    fclose(f);
+
+    /* missing file */
+    for (i = 0; i < sizeof(pathTypes); i++) {
+        reqId = rid++;
+        AssertTrue(SftpPathRequest(ssh, pathTypes[i], reqId, missing)
+                != WS_SUCCESS);
+        AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_NOFILE);
+    }
+    reqId = rid++;
+    AssertTrue(SftpOpenPath(ssh, reqId, missing, WOLFSSH_FXF_READ, handle)
+            != WS_SUCCESS);
+    AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_NOFILE);
+    reqId = rid++;
+    AssertTrue(SftpRenamePath(ssh, reqId, missing, present) != WS_SUCCESS);
+    AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_NOFILE);
+
+#ifndef NO_WOLFSSH_DIR
+    /* ENOTDIR counts as missing, as in OpenSSH's sftp-server */
+    reqId = rid++;
+    AssertTrue(SftpPathRequest(ssh, WOLFSSH_FTP_OPENDIR, reqId, present)
+            != WS_SUCCESS);
+    AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_NOFILE);
+#endif
+    /* present but not removable, a non-empty directory: FAILURE */
+    reqId = rid++;
+    AssertTrue(SftpPathRequest(ssh, WOLFSSH_FTP_REMOVE, reqId, dir)
+            != WS_SUCCESS);
+    AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_FAILURE);
+
+    /* a search-permission failure on the way: PERMISSION_DENIED. Root
+     * passes the permission check, so only an unprivileged run sees it. */
+    AssertIntEQ(chmod(locked, 0), 0);
+    if (geteuid() != 0) {
+        for (i = 0; i < sizeof(pathTypes); i++) {
+            reqId = rid++;
+            AssertTrue(SftpPathRequest(ssh, pathTypes[i], reqId, inLocked)
+                    != WS_SUCCESS);
+            AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_PERMISSION);
+        }
+        reqId = rid++;
+        AssertTrue(SftpOpenPath(ssh, reqId, inLocked, WOLFSSH_FXF_READ,
+                handle) != WS_SUCCESS);
+        AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_PERMISSION);
+        reqId = rid++;
+        AssertTrue(SftpRenamePath(ssh, reqId, inLocked, present)
+                != WS_SUCCESS);
+        AssertSftpStatusReply(ssh, reqId, WOLFSSH_FTP_PERMISSION);
+    }
+    AssertIntEQ(chmod(locked, 0700), 0);
+
+    (void)remove(present);
+    (void)rmdir(locked);
+    (void)rmdir(dir);
+    wolfSSH_SFTP_TestRecvStateFree(ssh);
+    wolfSSH_free(ssh);
+    wolfSSH_CTX_free(ctx);
+}
+#endif /* WOLFSSH_SFTP_ERRNO */
+
 /* A failed close() must still drop the handle from the session tracking list;
  * otherwise the stale descriptor lingers and is closed a second time when the
  * session is torn down. Open a file, invalidate its descriptor out of band so
@@ -21712,6 +21864,10 @@ int main(int argc, char** argv)
     TestSftpOpenDirAllocFailure();
     #endif
     #endif
+    #ifdef WOLFSSH_SFTP_ERRNO
+    /* a missing file answers NO_SUCH_FILE, a blocked one PERMISSION_DENIED */
+    TestSftpMissingFileStatus();
+    #endif
     /* a failed close still drops the handle from the tracking list */
     TestSftpCloseFailureRemovesHandle();
     /* confinement follows the confine root, not the start path */