Repository navigation
Tags: casablanque-code/khm
Tags
doctor: audit wildcard patterns + markers; fix normalize silently dro… …pping @cert-authority/@Revoked lines While adding the marker audit, found something worse than a missing check: @cert-authority/@Revoked lines were being parsed exactly like a blank line or comment and thrown away completely. They were never stored anywhere in khm_db_t, which meant "khm normalize --write" — already flagged as the most dangerous command in this codebase — silently deleted every marker line in the file on a routine rewrite. A CA trust anchor or an explicit revocation could vanish without any warning, error, or trace. That's fixed as part of this patch, not filed separately, since a "marker audit" check is close to pointless if the very next command anyone runs erases what it just audited. - parser.h/parser.c: added khm_marker_t (line_number + verbatim raw line) and markers/marker_count/marker_capacity on khm_db_t. khm_parse_file() now captures "@..." lines into this array instead of dropping them — detected the same way parse_line() used to (leading whitespace then '@'), so behavior for everything else is unchanged. parse_line()'s own '@' check is now unreachable via khm_parse_file() and left as a documented defensive fallback for any other caller. - commands/normalize.c: markers are re-emitted verbatim (in original order) at the top of the file on --write and in the stdout preview, before the normalized entries. Reported in the summary line so it's visible that they were preserved, not just silently included. - commands/doctor.c: two new info-severity checks (never fail the run, same policy as the existing mixed_algorithms check) — wildcard_pattern flags a hostname field containing '*' or '?' (a pattern trusts a whole class of hosts under one key, materially different from a literal hostname, even though it's often intentional); marker_line reports each @cert-authority/@Revoked line present, so a marker's existence is visible in the checklist rather than just hoped-for. - README.md: documented both new doctor checks, the marker- preservation guarantee in normalize, and (pre-existing gap from the earlier normalize-backup patch) the --no-backup flag that was never written up. - tests/test_markers.c: cert-authority and revoked lines are captured and don't appear as regular entries, leading-whitespace-before-'@' is still recognized, and multi-marker ordering is preserved. Manually verified the fix: a file with @cert-authority + @Revoked lines put through "khm normalize --write --no-backup" — before this patch the lines would be gone from the output; after, both survive verbatim while the plain entries still get deduped/merged normally. doctor's new checks tested against wildcard hostnames and both marker types, correctly non-fatal (exit 0) when they're the only findings.
v0.2.3 - Security fix: keydata_b64 buffer overflow in parse_kex_ecdh_reply (base64 expansion wasn't accounted for in the buffer size) — a malicious/compromised SSH server could overflow the struct with a large host key blob. - Hardening: normalize --write now preserves original file permissions instead of resetting them via umask. - New: libFuzzer harnesses for the SSH wire-format parser and the known_hosts line parser, with a seed corpus and a dedicated (non-blocking, scheduled) CI fuzzing workflow. - Unit test suite extended to cover the buffer sizing fix; CLI smoke test extended for the permissions fix.
v0.2.2 - Security fix: integer underflow in SSH packet length parsing could cause a heap out-of-bounds read when talking to a malicious or compromised host. - Added unit test suite (parser, json, packet validation) — none existed before this release. - CI now runs unit tests in addition to smoke tests. - Cosmetic: SSH client banner version bumped to match release.