Skip to content

Fail closed in the Linux lwIP example #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidangarske wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Fail closed in the Linux lwIP example #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d613214
F-4706 - https://fenrir.wolfssl.com/finding/4706 - Propagate wolfSent…
aidangarske Oct 21, 2026
d833205
F-5706 - https://fenrir.wolfssl.com/finding/5706 - Deny TCP connectio…
aidangarske Oct 21, 2026
bcb8cde
F-5705 - https://fenrir.wolfssl.com/finding/5705 - Deny ICMP packet w…
aidangarske Oct 21, 2026
632e5ee
F-5704 - https://fenrir.wolfssl.com/finding/5704 - Deny Ethernet fram…
aidangarske Oct 21, 2026
a52d12e
F-4822 - https://fenrir.wolfssl.com/finding/4822 - Halt echo init and…
aidangarske Oct 21, 2026
c5950bb
F-4823 - https://fenrir.wolfssl.com/finding/4823 - Halt ping init whe…
aidangarske Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 20 additions & 4 deletions examples/Linux-LWIP/echo.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,16 +95,32 @@ static err_t echo_msgaccept(void *arg, struct tcp_pcb *pcb, err_t err)
int echo_init(void)
{
struct tcp_pcb *pcb;
struct tcp_pcb *listen_pcb;
int r;

/* Create lwIP TCP instance */
pcb = tcp_new();
LWIP_DEBUGF(ECHO_DEBUG, ("echo_init: pcb: %x\n", pcb));
if (pcb == NULL)
return -1;
/* Bind port 11111 */
int r = tcp_bind(pcb, IP_ADDR_ANY, 11111);
r = tcp_bind(pcb, IP_ADDR_ANY, 11111);
LWIP_DEBUGF(ECHO_DEBUG, ("echo_init: tcp_bind: %d\n", r));
/* Enable listening */
pcb = tcp_listen(pcb);
LWIP_DEBUGF(ECHO_DEBUG, ("echo_init: listen-pcb: %x\n", pcb));
if (r != ERR_OK) {
if (tcp_close(pcb) != ERR_OK)
tcp_abort(pcb);
return -1;
}
/* Enable listening. tcp_listen() frees the original pcb only on success;
* on failure it returns NULL and leaves the original allocated. */
listen_pcb = tcp_listen(pcb);
LWIP_DEBUGF(ECHO_DEBUG, ("echo_init: listen-pcb: %x\n", listen_pcb));
if (listen_pcb == NULL) {
if (tcp_close(pcb) != ERR_OK)
tcp_abort(pcb);
return -1;
}
pcb = listen_pcb;
/* Set accept connection callback */
tcp_accept(pcb, echo_msgaccept);

Expand Down
3 changes: 2 additions & 1 deletion examples/Linux-LWIP/ping.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,8 @@ int ping_init(void)
struct raw_pcb *ping_pcb;
/* Create a new listener instance for ICMP messages */
ping_pcb = raw_new(IP_PROTO_ICMP);
LWIP_ASSERT("ping_pcb != NULL", ping_pcb != NULL);
if (ping_pcb == NULL)
return -1;

/* Callback to ping_recv in ICMP message received */
raw_recv(ping_pcb, ping_recv, NULL);
Expand Down
207 changes: 125 additions & 82 deletions examples/Linux-LWIP/sentry.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,113 +45,143 @@ static wolfsentry_errcode_t test_action(
int sentry_init()
{
wolfsentry_errcode_t ret;
wolfsentry_errcode_t fini_ret;
wolfsentry_ent_id_t id;

char buf[512], err_buf[512];
struct wolfsentry_json_process_state *jps = NULL;
FILE *f = NULL;
size_t n;
struct wolfsentry_eventconfig config = { .route_private_data_size = 32, .route_private_data_alignment = 16 };

ret = wolfsentry_init(wolfsentry_build_settings, WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(NULL /* hpi */, NULL /* thread */), &config,
&wolfsentry);
if (ret < 0) {
fprintf(stderr, "wolfsentry_init() returned " WOLFSENTRY_ERROR_FMT "\n",
WOLFSENTRY_ERROR_FMT_ARGS(ret));
fprintf(stderr, "unable to initialize wolfSentry");
return ret;
}

/* Insert the possible actions into wolfSentry */
wolfsentry_action_insert( WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-insert",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);

wolfsentry_action_insert( WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-delete",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);

wolfsentry_action_insert( WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-match",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);

wolfsentry_action_insert( WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"notify-on-match",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);

wolfsentry_action_insert( WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-connect",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);

wolfsentry_action_insert( WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-connect2",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);


char buf[512], err_buf[512];
struct wolfsentry_json_process_state *jps;
/* Insert the possible actions into wolfSentry. On any failure fall through
* to the cleanup path at the bottom so the context is not leaked. */
if (ret >= 0)
ret = wolfsentry_action_insert(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-insert",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);
if (ret >= 0)
ret = wolfsentry_action_insert(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-delete",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);
if (ret >= 0)
ret = wolfsentry_action_insert(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-match",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);
if (ret >= 0)
ret = wolfsentry_action_insert(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"notify-on-match",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);
if (ret >= 0)
ret = wolfsentry_action_insert(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-connect",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);
if (ret >= 0)
ret = wolfsentry_action_insert(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
"handle-connect2",
WOLFSENTRY_LENGTH_NULL_TERMINATED,
WOLFSENTRY_ACTION_FLAG_NONE,
test_action,
NULL,
&id);

/* Open the config file */
FILE *f = fopen(wolfsentry_config_path, "r");

if (f == NULL) {
fprintf(stderr, "fopen(%s): %s\n",wolfsentry_config_path,strerror(errno));
fprintf(stderr, "unable to open wolfSentry config file");
if (ret >= 0) {
f = fopen(wolfsentry_config_path, "r");
if (f == NULL) {
fprintf(stderr, "fopen(%s): %s\n",wolfsentry_config_path,strerror(errno));
fprintf(stderr, "unable to open wolfSentry config file");
ret = -1;
}
}

/* Initalize the wolfSentry JSON parser */
if ((ret = wolfsentry_config_json_init(
WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
WOLFSENTRY_CONFIG_LOAD_FLAG_NONE,
&jps)) < 0) {
fprintf(stderr, "wolfsentry_config_json_init() returned "
WOLFSENTRY_ERROR_FMT "\n",
WOLFSENTRY_ERROR_FMT_ARGS(ret));
fprintf(stderr, "error while initializing wolfSentry config parser");
if (ret >= 0) {
ret = wolfsentry_config_json_init(
WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(wolfsentry, NULL),
WOLFSENTRY_CONFIG_LOAD_FLAG_NONE,
&jps);
if (ret < 0) {
fprintf(stderr, "wolfsentry_config_json_init() returned "
WOLFSENTRY_ERROR_FMT "\n",
WOLFSENTRY_ERROR_FMT_ARGS(ret));
fprintf(stderr, "error while initializing wolfSentry config parser");
}
}

/* wolfSentry uses a streaming reader/parser for the config file */
for (;;) {
/* Read some data from the config file */
size_t n = fread(buf, 1, sizeof buf, f);
if ((n < sizeof buf) && ferror(f)) {
fprintf(stderr, "fread(%s): %s\n",wolfsentry_config_path, strerror(errno));
fprintf(stderr, "error while reading wolfSentry config file");
if (ret >= 0) {
for (;;) {
/* Read some data from the config file */
n = fread(buf, 1, sizeof buf, f);
if ((n < sizeof buf) && ferror(f)) {
fprintf(stderr, "fread(%s): %s\n",wolfsentry_config_path, strerror(errno));
fprintf(stderr, "error while reading wolfSentry config file");
ret = -1;
break;
}

/* Send the read data into the JSON parser */
ret = wolfsentry_config_json_feed(jps, buf, n, err_buf, sizeof err_buf);
if (ret < 0) {
fprintf(stderr, "%.*s\n", (int)sizeof err_buf, err_buf);
fprintf(stderr, "error while loading wolfSentry config file");
break;
}
if ((n < sizeof buf) && feof(f))
break;
}
}

/* Send the read data into the JSON parser */
ret = wolfsentry_config_json_feed(jps, buf, n, err_buf, sizeof err_buf);
if (ret < 0) {
/* Clean up the JSON parser. This also commits the parsed config, so its
* result matters on the success path. */
if (jps != NULL) {
fini_ret = wolfsentry_config_json_fini(&jps, err_buf, sizeof err_buf);
if (fini_ret < 0) {
fprintf(stderr, "%.*s\n", (int)sizeof err_buf, err_buf);
fprintf(stderr, "error while loading wolfSentry config file");
if (ret >= 0)
ret = fini_ret;
}
if ((n < sizeof buf) && feof(f))
break;
}
fclose(f);

/* Clean up the JSON parser */
if ((ret = wolfsentry_config_json_fini(&jps, err_buf, sizeof err_buf)) < 0) {
fprintf(stderr, "%.*s\n", (int)sizeof err_buf, err_buf);
fprintf(stderr, "error while loading wolfSentry config file");
if (f != NULL)
fclose(f);

/* Any failure after wolfsentry_init() must release the context. wolfSentry
* success codes are nonnegative but not necessarily zero, so normalize. */
if (ret < 0) {
if (wolfsentry != NULL)
(void)wolfsentry_shutdown(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(&wolfsentry, NULL));
return ret;
}

return 0;
Expand Down Expand Up @@ -218,6 +248,11 @@ int sentry_action(ip_addr_t *local_ip, ip_addr_t *remote_ip, uint16_t local_port
fprintf(stderr, "TCP Sentry action returned " WOLFSENTRY_ERROR_FMT "\n",
WOLFSENTRY_ERROR_FMT_ARGS(ret));

/* Fail closed: any dispatch error denies the connection */
if (WOLFSENTRY_ERROR_DECODE_ERROR_CODE(ret) < 0) {
return -1;
}

/* Check the result, if it contains "reject" then notify the caller */
if (WOLFSENTRY_ERROR_DECODE_ERROR_CODE(ret) >= 0) {
if (WOLFSENTRY_MASKIN_BITS(action_results, WOLFSENTRY_ACTION_RES_REJECT)) {
Expand Down Expand Up @@ -261,6 +296,10 @@ int sentry_action_ping(const ip_addr_t *addr, u8_t type)
&action_results);
fprintf(stderr, "PING Sentry action returned " WOLFSENTRY_ERROR_FMT "\n",
WOLFSENTRY_ERROR_FMT_ARGS(ret));
/* Fail closed: any dispatch error denies the packet */
if (WOLFSENTRY_ERROR_DECODE_ERROR_CODE(ret) < 0) {
return -1;
}
if (WOLFSENTRY_ERROR_DECODE_ERROR_CODE(ret) >= 0) {
if (WOLFSENTRY_MASKIN_BITS(action_results, WOLFSENTRY_ACTION_RES_REJECT)) {
return -1;
Expand Down Expand Up @@ -302,6 +341,10 @@ int sentry_action_mac(struct eth_addr *addr)

fprintf(stderr, "MAC Sentry action returned " WOLFSENTRY_ERROR_FMT "\n",
WOLFSENTRY_ERROR_FMT_ARGS(ret));
/* Fail closed: any dispatch error denies the frame */
if (WOLFSENTRY_ERROR_DECODE_ERROR_CODE(ret) < 0) {
return -1;
}
if (WOLFSENTRY_ERROR_DECODE_ERROR_CODE(ret) >= 0) {
if (WOLFSENTRY_MASKIN_BITS(action_results, WOLFSENTRY_ACTION_RES_REJECT)) {
return -1;
Expand Down
Loading