Gate both send-EOF calls on confirm and disconnect

wolfSSH_stream_send_eof() went straight to SendChannelEof(), which
resolves its argument by peer id. An unconfirmed head has peerChannel 0,
so the lookup lands on whichever channel holds peer id 0 -- itself, in the
single-channel case -- and an EOF naming recipient channel 0 goes out
while eofTxd latches on the live channel, silencing its send direction.

- Mirror the openConfirmed guard from wolfSSH_ChannelSendEof() into
  wolfSSH_stream_send_eof(), returning WS_CHANNEL_NOT_CONF.
- Add the SendAfterDisconnect() gate to both send-EOF entry points; they
  were the only public senders without it, against what ssh.h promises.
- Order it ahead of the channel-list test, as the other stream calls do,
  so a torn-down session reports the disconnect and not a bad argument.
- Name WS_DISCONNECT in the wolfSSH_ChannelSendEof() header contract.
- Cover the stream variant in test_SendEofUnconfirmedChannel() and add
  test_SendEofAfterDisconnect(); both fail without the fix.

Author: ejohnstown

src/ssh.c

@@ -1580,7 +1580,15 @@ int wolfSSH_stream_send_eof(WOLFSSH* ssh)
 
     WLOG(WS_LOG_DEBUG, "Entering wolfSSH_stream_send_eof()");
 
-    if (ssh == NULL || ssh->channelList == NULL)
+    if (ssh == NULL)
+        ret = WS_BAD_ARGUMENT;
+
+    /* Ahead of the channel-list test, like the other stream calls, so a
+     * torn-down session reports the disconnect and not a bad argument. */
+    if (ret == WS_SUCCESS && SendAfterDisconnect(ssh))
+        ret = WS_FATAL_ERROR;
+
+    if (ret == WS_SUCCESS && ssh->channelList == NULL)
         ret = WS_BAD_ARGUMENT;
 
     /* Only KEX traffic may go out mid-rekey, RFC 4253 section 7.1. */
@@ -1589,6 +1597,14 @@ int wolfSSH_stream_send_eof(WOLFSSH* ssh)
         ret = WS_REKEYING;
     }
 
+    /* Same peer-id lookup as wolfSSH_ChannelSendEof(), so the same guard.
+     * An unconfirmed head has peerChannel 0 and resolves to whichever
+     * channel holds peer id 0, itself included. */
+    if (ret == WS_SUCCESS && !ssh->channelList->openConfirmed) {
+        WLOG(WS_LOG_DEBUG, "Channel not confirmed yet.");
+        ret = WS_CHANNEL_NOT_CONF;
+    }
+
     if (ret == WS_SUCCESS)
         ret = SendChannelEof(ssh, ssh->channelList->peerChannel);
 
@@ -4379,6 +4395,10 @@ int wolfSSH_ChannelSendEof(WOLFSSH_CHANNEL* channel)
     if (channel == NULL)
         ret = WS_BAD_ARGUMENT;
 
+    if (ret == WS_SUCCESS && channel->ssh != NULL &&
+            SendAfterDisconnect(channel->ssh))
+        ret = WS_FATAL_ERROR;
+
     /* Only KEX traffic may go out mid-rekey, RFC 4253 section 7.1. */
     if (ret == WS_SUCCESS && channel->ssh->isKeying) {
         channel->ssh->error = WS_REKEYING;

tests/unit.c

@@ -7245,6 +7245,64 @@ static int test_SendEofApi(void)
     return result;
 }
 
+/* A disconnect, sent or received, ends the session, so neither send-EOF
+ * entry point may put a CHANNEL_EOF on the wire afterwards. RFC 4253
+ * section 11.1. */
+static int test_SendEofAfterDisconnect(void)
+{
+    WOLFSSH_CTX*     ctx  = NULL;
+    WOLFSSH*         ssh  = NULL;
+    WOLFSSH_CHANNEL* ch   = NULL;
+    int              result = 0;
+    int              ret;
+
+    ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_CLIENT, NULL);
+    if (ctx == NULL)
+        return -1660;
+    wolfSSH_SetIOSend(ctx, CountingIoSend);
+
+    ssh = wolfSSH_new(ctx);
+    if (ssh == NULL) { result = -1661; goto done; }
+    ssh->connectState = CONNECT_SERVER_USERAUTH_ACCEPT_DONE;
+
+    ch = ChannelNew(ssh, ID_CHANTYPE_SESSION,
+                    DEFAULT_WINDOW_SZ, DEFAULT_MAX_PACKET_SZ);
+    if (ch == NULL) { result = -1662; goto done; }
+    if (ChannelAppend(ssh, ch) != WS_SUCCESS) {
+        ChannelDelete(ch, ssh->ctx->heap);
+        result = -1663;
+        goto done;
+    }
+    ch->openConfirmed = 1;
+    ch->peerWindowSz = 1024;
+    ch->peerMaxPacketSz = 1024;
+
+    /* Our own disconnect is the last thing that may go out. */
+    ret = wolfSSH_SendDisconnect(ssh, WOLFSSH_DISCONNECT_BY_APPLICATION);
+    if (ret != WS_SUCCESS) { result = -1664; goto done; }
+    if (!ssh->disconnected) { result = -1665; goto done; }
+
+    s_ioSendCalls = 0;
+
+    ret = wolfSSH_stream_send_eof(ssh);
+    if (ret != WS_FATAL_ERROR) { result = -1666; goto done; }
+    if (wolfSSH_get_error(ssh) != WS_DISCONNECT) { result = -1667; goto done; }
+
+    ret = wolfSSH_ChannelSendEof(ch);
+    if (ret != WS_FATAL_ERROR) { result = -1668; goto done; }
+    if (wolfSSH_get_error(ssh) != WS_DISCONNECT) { result = -1669; goto done; }
+
+    /* Nothing reached the transport and the channel is unmarked, so a
+     * later drain cannot mistake it for a half-close of ours. */
+    if (s_ioSendCalls != 0) { result = -1670; goto done; }
+    if (ch->eofTxd) { result = -1671; goto done; }
+
+done:
+    wolfSSH_free(ssh);
+    wolfSSH_CTX_free(ctx);
+    return result;
+}
+
 /* SendChannelEof() addresses the channel by peer id, and peerChannel is 0
  * until the peer confirms the open. wolfSSH_ChannelSendEof() on a channel
  * still awaiting its confirmation must refuse rather than let the lookup land
@@ -7303,6 +7361,20 @@ static int test_SendEofUnconfirmedChannel(void)
     ret = wolfSSH_ChannelSend(sess, buf, (word32)sizeof(buf));
     if (ret != (int)sizeof(buf)) { result = -1639; goto done; }
 
+    /* wolfSSH_stream_send_eof() runs the same lookup on the head, so it
+     * needs the same guard. An unconfirmed head resolves to whichever
+     * channel holds peer id 0, itself included, and latching eofTxd there
+     * would silence the real channel's send direction for good. */
+    sess->openConfirmed = 0;
+    ret = wolfSSH_stream_send_eof(ssh);
+    if (ret != WS_CHANNEL_NOT_CONF) { result = -1650; goto done; }
+    if (sess->eofTxd || pend->eofTxd) { result = -1651; goto done; }
+
+    sess->openConfirmed = 1;
+    ret = wolfSSH_stream_send_eof(ssh);
+    if (ret != WS_SUCCESS) { result = -1652; goto done; }
+    if (!sess->eofTxd) { result = -1653; goto done; }
+
 done:
     wolfSSH_free(ssh);
     wolfSSH_CTX_free(ctx);
@@ -18374,6 +18446,11 @@ int wolfSSH_UnitTest(int argc, char** argv)
            (unitResult == 0 ? "SUCCESS" : "FAILED"));
     testResult = testResult || unitResult;
 
+    unitResult = test_SendEofAfterDisconnect();
+    printf("SendEofAfterDisconnect: %s\n",
+           (unitResult == 0 ? "SUCCESS" : "FAILED"));
+    testResult = testResult || unitResult;
+
     unitResult = test_SendChannelEofWantWrite();
     printf("SendChannelEofWantWrite: %s\n",
            (unitResult == 0 ? "SUCCESS" : "FAILED"));

wolfssh/ssh.h

@@ -329,7 +329,8 @@ WOLFSSH_API int wolfSSH_ChannelExit(WOLFSSH_CHANNEL* channel);
  *
  * Returns WS_SUCCESS, WS_BAD_ARGUMENT on a NULL channel,
  * WS_CHANNEL_NOT_CONF if the peer has not confirmed the channel open yet,
- * WS_REKEYING during a key exchange, or a send-path status such as
+ * WS_REKEYING during a key exchange, WS_FATAL_ERROR with WS_DISCONNECT
+ * latched once the session is over, or a send-path status such as
  * WS_WANT_WRITE. */
 WOLFSSH_API int wolfSSH_ChannelSendEof(WOLFSSH_CHANNEL* channel);
 WOLFSSH_API int wolfSSH_ChannelGetEof(WOLFSSH_CHANNEL* channel);