Merge ~3v1n0/ubuntu/+source/openssh:ubuntu/jammy-devel into ubuntu/+source/openssh:ubuntu/jammy-devel

[Marco Trevisan (Treviño)]

Backport fix for https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2077576 to jammy

[Sebastien Bacher (seb128)]

I've sponsored the change now, whoever has access to change the MP status can mark is as merged

[Marco Trevisan (Treviño) (3v1n0)]

Ideally this should happen as soon as it actually gets merged in the devel branch, not sure if you can do it also through git ubuntu?

[Vladimir Petko (vpa1977)]

Claiming review slot to remove from the sponsoring queue.

review: Abstain

diff --git a/debian/changelog b/debian/changelog
index f4bf292..f2a65f0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+openssh (1:8.9p1-3ubuntu0.11) UNRELEASED; urgency=medium
+
+  * debian/patches: Properly notify keyboard interactive info and instructions.
+    Use notifier to send keyboard interactive info and instruction messages
+    to properly print non-ASCII chars when using PAM-based authentication.
+    (LP: #2077576)
+
+ -- Marco Trevisan (Treviño) <[e-mail]>  Wed, 21 Aug 2024 16:13:57 -0400
+
 openssh (1:8.9p1-3ubuntu0.10) jammy-security; urgency=medium
 
   * SECURITY UPDATE: remote code execution via signal handler race
diff --git a/debian/patches/series b/debian/patches/series
index ffa2662..a28e95f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -36,3 +36,4 @@ CVE-2023-28531.patch
 CVE-2023-51384.patch
 CVE-2023-51385.patch
 CVE-2024-6387.patch
+sshconnect2-Write-kbd-interactive-service-info-and-instru.patch
diff --git a/debian/patches/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch b/debian/patches/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch
new file mode 100644
index 0000000..497478d
--- /dev/null
+++ b/debian/patches/sshconnect2-Write-kbd-interactive-service-info-and-instru.patch
@@ -0,0 +1,108 @@
+From: =?utf-8?b?Ik1hcmNvIFRyZXZpc2FuIChUcmV2acOxbyki?= <[e-mail]>
+Date: Tue, 17 Oct 2023 06:12:03 +0200
+Subject: sshconnect2: Write kbd-interactive service,
+ info and instructions as utf-8
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+As per the previous server change now the keyboard-interactive service
+and instruction values could be reported as soon as they are available
+and so they're not prompts anymore and not parsed like them.
+
+While this was already supported by the SSH client, these messages were
+not properly written as the escaped sequences they contained were not
+correctly reported.
+
+So for example a message containing "\" was represented as "\\" and
+similarly for all the other C escape sequences.
+
+This was leading to more problems when it come to utf-8 chars, as they
+were only represented by their octal representation.
+
+This was easily testable by adding a line like the one below to the
+sshd PAM service:
+  auth    requisite pam_echo.so Hello SSHD! Want some 🍕?
+
+Which was causing this to be written instead:
+  Hello SSHD! Want some \360\237\215\225?
+
+To handle this, instead of simply using fmprintf, we're using the notifier
+in a way can be exposed to users in the proper format and UI.
+
+Origin: https://github.com/openssh/openssh-portable/pull/452/commits/cc14301ce05
+---
+ sshconnect2.c | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 87b74ff..ec46130 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -1243,6 +1243,7 @@ input_userauth_passwd_changereq(int type, u_int32_t seqnr, struct ssh *ssh)
+ 	char *info = NULL, *lang = NULL, *password = NULL, *retype = NULL;
+ 	char prompt[256];
+ 	const char *host;
++	size_t info_len;
+ 	int r;
+ 
+ 	debug2("input_userauth_passwd_changereq");
+@@ -1252,11 +1253,15 @@ input_userauth_passwd_changereq(int type, u_int32_t seqnr, struct ssh *ssh)
+ 		    "no authentication context");
+ 	host = options.host_key_alias ? options.host_key_alias : authctxt->host;
+ 
+-	if ((r = sshpkt_get_cstring(ssh, &info, NULL)) != 0 ||
++	if ((r = sshpkt_get_cstring(ssh, &info, &info_len)) != 0 ||
+ 	    (r = sshpkt_get_cstring(ssh, &lang, NULL)) != 0)
+ 		goto out;
+-	if (strlen(info) > 0)
+-		logit("%s", info);
++	if (info_len > 0) {
++		struct notifier_ctx *notifier = NULL;
++		debug_f("input_userauth_passwd_changereq info: %s", info);
++		notifier = notify_start(0, "%s", info);
++		notify_complete(notifier, NULL);
++	}
+ 	if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
+ 	    (r = sshpkt_put_cstring(ssh, authctxt->server_user)) != 0 ||
+ 	    (r = sshpkt_put_cstring(ssh, authctxt->service)) != 0 ||
+@@ -2095,8 +2100,10 @@ input_userauth_info_req(int type, u_int32_t seq, struct ssh *ssh)
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	char *name = NULL, *inst = NULL, *lang = NULL, *prompt = NULL;
+ 	char *display_prompt = NULL, *response = NULL;
++	struct notifier_ctx *notifier = NULL;
+ 	u_char echo = 0;
+ 	u_int num_prompts, i;
++	size_t name_len, inst_len;
+ 	int r;
+ 
+ 	debug2_f("entering");
+@@ -2106,14 +2113,22 @@ input_userauth_info_req(int type, u_int32_t seq, struct ssh *ssh)
+ 
+ 	authctxt->info_req_seen = 1;
+ 
+-	if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0 ||
+-	    (r = sshpkt_get_cstring(ssh, &inst, NULL)) != 0 ||
++	if ((r = sshpkt_get_cstring(ssh, &name, &name_len)) != 0 ||
++	    (r = sshpkt_get_cstring(ssh, &inst, &inst_len)) != 0 ||
+ 	    (r = sshpkt_get_cstring(ssh, &lang, NULL)) != 0)
+ 		goto out;
+-	if (strlen(name) > 0)
+-		logit("%s", name);
+-	if (strlen(inst) > 0)
+-		logit("%s", inst);
++	if (name_len > 0) {
++		debug_f("kbd int name: %s", name);
++		notifier = notify_start(0, "%s", name);
++		notify_complete(notifier, NULL);
++		notifier = NULL;
++	}
++	if (inst_len > 0) {
++		debug_f("kbd int inst: %s", inst);
++		notifier = notify_start(0, "%s", inst);
++		notify_complete(notifier, NULL);
++		notifier = NULL;
++	}
+ 
+ 	if ((r = sshpkt_get_u32(ssh, &num_prompts)) != 0)
+ 		goto out;