Merge ~kajiya/ubuntu/+source/openssh:lp1952421-sshd-matching-certs into ubuntu/+source/openssh:ubuntu/hirsute-devel

[Chloé Smith]

This fixes LP: #1952421, as requested by one of the cloud partners. This has already been fixed upstream and is just a trivial backport of the same.

## Tests ##

sbuild results

+------------------------------------------------------------------------------+
| Summary |
+------------------------------------------------------------------------------+

Build Architecture: amd64
Build Type: full
Build-Space: 127248
Build-Time: 349
Distribution: hirsute
Host Architecture: amd64
Install-Time: 85
Job: ../openssh_8.4p1-5ubuntu1.2.dsc
Lintian: warn
Machine Architecture: amd64
Package: openssh
Package-Time: 517
Source-Version: 1:8.4p1-5ubuntu1.2
Space: 127248
Status: successful
Version: 1:8.4p1-5ubuntu1.2
--------------------------------------------------------------------------------

``autopkgtest results``

Removing files ...
Removing user `openssh-tests' ...
Warning: group `openssh-tests' has no more members.
Done.
autopkgtest [22:58:41]: test regress: -----------------------]
autopkgtest [22:58:42]: test regress: - - - - - - - - - - results - - - - - - - - - -
regress PASS
autopkgtest [22:58:43]: @@@@@@@@@@@@@@@@@@@@ summary
regress PASS

[Utkarsh Gupta (utkarsh)]

Hello,

This looks great! Thank you very much! Just two comments and I can sponsor this upload! :D

review: Needs Information

[Chloé Smith (kajiya)]

@utkarsh thanks for the tips :D Would you like me to squash the last 2 commits?

[Utkarsh Gupta (utkarsh)]

Hey,

All looks good now, thank you!

As for squashing: that's up to you, really. It's not a necessity but maybe a good idea, I guess? We generally try to keep the commits precise and try to squash the similar ones. But it's a personal preference, too. So your call. :D

Let me know about this and I can sponsor this directly.

review: Approve

[Chloé Smith (kajiya)]

Hey @utkarsh!

In that case then I won't squash if that's okay :)
IMHO squashing isn't always the best purely because you sometimes loose the flow of the conversation/workflow. I only offered on the off chance you guys find it mandatory - so feel free to sponsor straight away :D

[Utkarsh Gupta (utkarsh)]

Thank you, Chloe. Sponsored the upload as-is:

$ dput ubuntu ../openssh_8.4p1-5ubuntu1.2_source.changes
Checking signature on .changes
gpg: ../openssh_8.4p1-5ubuntu1.2_source.changes: Valid signature from 823E967606C34B96
Checking signature on .dsc
gpg: ../openssh_8.4p1-5ubuntu1.2.dsc: Valid signature from 823E967606C34B96
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openssh_8.4p1-5ubuntu1.2.dsc: done.
  Uploading openssh_8.4p1.orig.tar.gz: done.
  Uploading openssh_8.4p1-5ubuntu1.2.debian.tar.xz: done.
  Uploading openssh_8.4p1-5ubuntu1.2_source.buildinfo: done.
  Uploading openssh_8.4p1-5ubuntu1.2_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 25b1143..48ea7e6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openssh (1:8.4p1-5ubuntu1.2) hirsute; urgency=medium
+
+  * d/p/match-host-certs-w-public-keys.patch: Add patch
+    to match host certificates agianst host public keys.
+    (LP: #1952421)
+
+ -- Chloé S <[e-mail]>  Wed, 01 Dec 2021 14:12:42 +0000
+
 openssh (1:8.4p1-5ubuntu1.1) hirsute; urgency=medium
 
   * d/systemd/ssh@.service: preserve the systemd managed runtime directory to
diff --git a/debian/patches/match-host-certs-w-public-keys.patch b/debian/patches/match-host-certs-w-public-keys.patch
new file mode 100644
index 0000000..98c1f04
--- /dev/null
+++ b/debian/patches/match-host-certs-w-public-keys.patch
@@ -0,0 +1,30 @@
+Description: Match host certificates against host public keys
+ not private keys. Allows use of certificates with private keys
+ held in a ssh-agent.
+Origin: upstream
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3254
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1952421
+Forwarded: not-needed
+Applied-Upstream: https://github.com/openssh/openssh-portable/commit/530739d4
+
+From 530739d42f6102668aecd699be0ce59815c1eceb Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Sun, 6 Jun 2021 11:34:16 +0000
+Reported by Miles Zhou in bz3524; ok dtucker@
+OpenBSD-Commit-ID: 25f5bf70003126d19162862d9eb380bf34bac22a
+
+---
+ sshd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sshd.c
++++ b/sshd.c
+@@ -1945,7 +1945,7 @@
+ 		/* Find matching private key */
+ 		for (j = 0; j < options.num_host_key_files; j++) {
+ 			if (sshkey_equal_public(key,
+-			    sensitive_data.host_keys[j])) {
++			    sensitive_data.host_pubkeys[j])) {
+ 				sensitive_data.host_certificates[j] = key;
+ 				break;
+ 			}
diff --git a/debian/patches/series b/debian/patches/series
index 9566a01..639825f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -29,3 +29,4 @@ ssh-agent-double-free.patch
 0f90440ca70abab947acbd77795e9f130967956c.patch
 2e0beff67def2120f4b051b1016d7fbf84823e78.patch
 1bb130ed34721d46452529d094d9bbf045607d79.patch
+match-host-certs-w-public-keys.patch