Merge ~sergiodj/ubuntu/+source/openssh:lp1966591-ssh-keygen-permission-focal into ubuntu/+source/openssh:ubuntu/devel

[Sergio Durigan Junior]

This MP fixes bug #1966591 on Focal.

From the SRU template:

When using "ssh-keygen -R" to remove a host from "known_hosts" the command changes permissions on the file. This can cause problems particularly when used on the global "known_hosts" file (/etc/ssh/ssh_known_hosts), because then only root can read it. Programs running non-interactively as non-root users suddenly fail to SSH and it's not immediately obvious why.

This bug has been fixed upstream (https://github.com/openssh/openssh-portable/commit/f2d84f1b3fa68d77c99238d4c645d0266fae2a74) and only impacts openssh on Bionic and Focal. The patch is simple and well contained.

The idea is to do a single SRU upload with this MP plus Athos' changes to fix bug #1903516.

There is a PPA with the proposed change here:

https://launchpad.net/~sergiodj/+archive/ubuntu/openssh-bugfix/+packages

autopkgtest is still running, but I don't expect any problems. I'll post the results when they're done.

Unmerged commits

ecd0f59... by Sergio Durigan Junior on 2022-03-31

changelog for 1:8.2p1-4ubuntu0.5

8a0766a... by Sergio Durigan Junior on 2022-03-30

  * d/p/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch:
    Preserve group/world read permissions on known_hosts. (LP: #1966591)

a68d4d2... by Chloé Smith on 2021-12-02

* Update d/ch for 1:8.2p1-4ubuntu0.4 release

e1bb56d... by Chloé Smith on 2021-12-02

* d/p/match-host-certs-w-public-keys.patch: Add patch
  to match host certificates against host public keys.
  (LP: #1952421)

c6fdf00... by Athos Ribeiro on 2021-07-23

Update changelog for 1:8.2p1-4ubuntu0.3 release

9a979e5... by Athos Ribeiro on 2021-07-05

d/systemd/ssh@.service: preserve runtime directory

Preserve the systemd managed runtime directory to ensure parallel
processes will not disrupt one another when halting (LP: #1905285)

f34a84f... by Marc Deslauriers on 2021-03-09

1:8.2p1-4ubuntu0.2 (patches unapplied)

Imported using git-ubuntu import.

1ebd6b9... by Christian Ehrhardt  on 2020-05-29

1:8.2p1-4ubuntu0.1 (patches unapplied)

Imported using git-ubuntu import.

diff --git a/debian/.gitignore b/debian/.gitignore
deleted file mode 100644
index 988323b..0000000
--- a/debian/.gitignore
+++ /dev/null
@@ -1,17 +0,0 @@
-/*.debhelper*
-/*substvars
-/build-deb
-/build-udeb
-/files
-/keygen-test/key1
-/keygen-test/key1.pub
-/keygen-test/key2
-/keygen-test/key2.pub
-/openssh-client
-/openssh-client-udeb
-/openssh-server
-/openssh-server-udeb
-/ssh
-/ssh-askpass-gnome
-/ssh-krb5
-/tmp
diff --git a/debian/changelog b/debian/changelog
index 9d6fadc..edf11ad 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,4 @@
+<<<<<<< debian/changelog
 openssh (1:8.9p1-3) unstable; urgency=medium
 
   * Allow ppoll_time64 in seccomp filter (closes: #1006445).
@@ -702,6 +703,46 @@ openssh (1:8.3p1-1) unstable; urgency=medium
     Include (closes: #962035, LP: #1876320).
 
  -- Colin Watson <[e-mail]>  Sun, 07 Jun 2020 13:44:04 +0100
+=======
+openssh (1:8.2p1-4ubuntu0.5) focal; urgency=medium
+
+  * d/p/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch:
+    Preserve group/world read permissions on known_hosts. (LP: #1966591)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 31 Mar 2022 16:56:00 -0400
+
+openssh (1:8.2p1-4ubuntu0.4) focal; urgency=medium
+
+  * d/p/match-host-certs-w-public-keys.patch: Add patch
+    to match host certificates agianst host public keys.
+    (LP: #1952421)
+
+ -- Chloé S <[e-mail]>  Thu, 02 Dec 2021 22:38:52 +0000
+
+openssh (1:8.2p1-4ubuntu0.3) focal; urgency=medium
+
+  * d/systemd/ssh@.service: preserve the systemd managed runtime directory to
+    ensure parallel processes will not disrupt one another when halting
+    (LP: #1905285)
+
+ -- Athos Ribeiro <[e-mail]>  Fri, 23 Jul 2021 09:55:12 -0300
+
+openssh (1:8.2p1-4ubuntu0.2) focal-security; urgency=medium
+
+  * SECURITY UPDATE: double-free memory corruption in ssh-agent
+    - debian/patches/CVE-2021-28041.patch: set ext_name to NULL after
+      freeing it so it doesn't get freed again later on in ssh-agent.c.
+    - CVE-2021-28041
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 09 Mar 2021 09:17:50 -0500
+
+openssh (1:8.2p1-4ubuntu0.1) focal; urgency=medium
+
+  * d/p/lp-1876320-*: avoid applying defaults for every include statement
+    (LP: #1876320)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 29 May 2020 09:37:09 +0200
+>>>>>>> debian/changelog
 
 openssh (1:8.2p1-4) unstable; urgency=medium
 
diff --git a/debian/control b/debian/control
index f9dc5f7..165faca 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,18 @@
 Source: openssh
 Section: net
 Priority: standard
+<<<<<<< debian/control
 Maintainer: Debian OpenSSH Maintainers <[e-mail]>
 Build-Depends: debhelper (>= 13.1~),
                debhelper-compat (= 13),
+=======
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian OpenSSH Maintainers <[e-mail]>
+Build-Depends: autotools-dev,
+               debhelper (>= 9.20160709~),
+               debhelper-compat (= 9),
+               dh-autoreconf,
+>>>>>>> debian/control
                dh-exec,
                dh-runit (>= 2.8.8),
                dpkg-dev (>= 1.16.1~),
diff --git a/debian/patches/CVE-2021-28041.patch b/debian/patches/CVE-2021-28041.patch
new file mode 100644
index 0000000..731b821
--- /dev/null
+++ b/debian/patches/CVE-2021-28041.patch
@@ -0,0 +1,14 @@
+Description: fix double-free memory corruption in ssh-agent
+Author: Marc Deslauriers <[e-mail]>
+Origin: minimal fix for https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db
+
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -496,6 +496,7 @@ process_add_identity(SocketEntry *e)
+ 				goto err;
+ 			}
+ 			free(ext_name);
++			ext_name = NULL;
+ 			break;
+ 		default:
+ 			error("%s: Unknown constraint %d", __func__, ctype);
diff --git a/debian/patches/lp-1876320-upstream-Do-not-call-process_queued_listen_addrs-for.patch b/debian/patches/lp-1876320-upstream-Do-not-call-process_queued_listen_addrs-for.patch
new file mode 100644
index 0000000..43865f5
--- /dev/null
+++ b/debian/patches/lp-1876320-upstream-Do-not-call-process_queued_listen_addrs-for.patch
@@ -0,0 +1,59 @@
+From 0a9a611619b0a1fecd0195ec86a9885f5d681c84 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Wed, 27 May 2020 21:59:11 +0000
+Subject: [PATCH] upstream: Do not call process_queued_listen_addrs() for every
+
+included file from sshd_config; patch from Jakub Jelen
+
+OpenBSD-Commit-ID: 0ff603d6f06a7fab4881f12503b53024799d0a49
+
+Backport-Note:
+  upstreams auto-tagging at the top of the file didn't
+  match, everything else applied as-is
+
+Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=0a9a611619b0a1fecd0195ec86a9885f5d681c84
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1876320
+Last-Update: 2020-05-29
+
+---
+ servconf.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/servconf.c
++++ b/servconf.c
+@@ -75,8 +75,8 @@ static void add_listen_addr(ServerOption
+     const char *, int);
+ static void add_one_listen_addr(ServerOptions *, const char *,
+     const char *, int);
+-void parse_server_config_depth(ServerOptions *options, const char *filename,
+-    struct sshbuf *conf, struct include_list *includes,
++static void parse_server_config_depth(ServerOptions *options,
++    const char *filename, struct sshbuf *conf, struct include_list *includes,
+     struct connection_info *connectinfo, int flags, int *activep, int depth);
+ 
+ /* Use of privilege separation or not */
+@@ -2611,7 +2611,7 @@ copy_set_server_options(ServerOptions *d
+ #undef M_CP_STRARRAYOPT
+ 
+ #define SERVCONF_MAX_DEPTH	16
+-void
++static void
+ parse_server_config_depth(ServerOptions *options, const char *filename,
+     struct sshbuf *conf, struct include_list *includes,
+     struct connection_info *connectinfo, int flags, int *activep, int depth)
+@@ -2637,7 +2637,6 @@ parse_server_config_depth(ServerOptions
+ 	if (bad_options > 0)
+ 		fatal("%s: terminating, %d bad configuration options",
+ 		    filename, bad_options);
+-	process_queued_listen_addrs(options);
+ }
+ 
+ void
+@@ -2648,6 +2647,7 @@ parse_server_config(ServerOptions *optio
+ 	int active = connectinfo ? 0 : 1;
+ 	parse_server_config_depth(options, filename, conf, includes,
+ 	    connectinfo, 0, &active, 0);
++	process_queued_listen_addrs(options);
+ }
+ 
+ static const char *
diff --git a/debian/patches/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch b/debian/patches/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch
new file mode 100644
index 0000000..433ebfb
--- /dev/null
+++ b/debian/patches/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch
@@ -0,0 +1,46 @@
+From: "[e-mail]" <[e-mail]>
+Date: Wed, 13 May 2020 09:55:57 +0000
+Subject: upstream: preserve group/world read permission on known_hosts
+
+file across runs of "ssh-keygen -Rf /path". The old behaviour was to remove
+all rights for group/other. bz#3146 ok dtucker@
+
+OpenBSD-Commit-ID: dc369d0e0b5dd826430c63fd5f4b269953448a8a
+
+Origin: backport, https://github.com/openssh/openssh-portable/commit/f2d84f1b3fa68d77c99238d4c645d0266fae2a74
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3146
+Bug-Ubuntu: https://bugs.launchpad.net/openssh/+bug/1966591
+Applied-Upstream: 8.4
+---
+ ssh-keygen.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/ssh-keygen.c b/ssh-keygen.c
+index 835f7d0..bfc5233 100644
+--- a/ssh-keygen.c
++++ b/ssh-keygen.c
+@@ -1235,6 +1235,7 @@ do_known_hosts(struct passwd *pw, const char *name)
+ 	int r, fd, oerrno, inplace = 0;
+ 	struct known_hosts_ctx ctx;
+ 	u_int foreach_options;
++	struct stat sb;
+ 
+ 	if (!have_identity) {
+ 		cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
+@@ -1244,6 +1245,8 @@ do_known_hosts(struct passwd *pw, const char *name)
+ 		free(cp);
+ 		have_identity = 1;
+ 	}
++	if (stat(identity_file, &sb) != 0)
++		fatal("Cannot stat %s: %s", identity_file, strerror(errno));
+ 
+ 	memset(&ctx, 0, sizeof(ctx));
+ 	ctx.out = stdout;
+@@ -1267,6 +1270,7 @@ do_known_hosts(struct passwd *pw, const char *name)
+ 			unlink(tmp);
+ 			fatal("fdopen: %s", strerror(oerrno));
+ 		}
++		fchmod(fd, sb.st_mode & 0644);
+ 		inplace = 1;
+ 	}
+ 
diff --git a/debian/patches/match-host-certs-w-public-keys.patch b/debian/patches/match-host-certs-w-public-keys.patch
new file mode 100644
index 0000000..2f4d509
--- /dev/null
+++ b/debian/patches/match-host-certs-w-public-keys.patch
@@ -0,0 +1,30 @@
+Description: Match host certificates against host public keys
+ not private keys. Allows use of certificates with private keys
+ held in a ssh-agent.
+Origin: upstream
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3254
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1952421
+Forwarded: not-needed
+Applied-Upstream: https://github.com/openssh/openssh-portable/commit/530739d4
+
+From 530739d42f6102668aecd699be0ce59815c1eceb Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Sun, 6 Jun 2021 11:34:16 +0000
+Reported by Miles Zhou in bz3524; ok dtucker@
+OpenBSD-Commit-ID: 25f5bf70003126d19162862d9eb380bf34bac22a
+
+---
+ sshd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sshd.c
++++ b/sshd.c
+@@ -1896,7 +1896,7 @@
+ 		/* Find matching private key */
+ 		for (j = 0; j < options.num_host_key_files; j++) {
+ 			if (sshkey_equal_public(key,
+-			    sensitive_data.host_keys[j])) {
++			    sensitive_data.host_pubkeys[j])) {
+ 				sensitive_data.host_certificates[j] = key;
+ 				break;
+ 			}
diff --git a/debian/patches/series b/debian/patches/series
index 580b919..f193587 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -22,7 +22,14 @@ systemd-readiness.patch
 debian-config.patch
 restore-authorized_keys2.patch
 revert-ipqos-defaults.patch
+<<<<<<< debian/patches/series
 maxhostnamelen.patch
 conch-ssh-rsa.patch
 improve-zero-call-used-regs-detection.patch
 sandbox-ppoll_time64.patch
+=======
+lp-1876320-upstream-Do-not-call-process_queued_listen_addrs-for.patch
+CVE-2021-28041.patch
+match-host-certs-w-public-keys.patch
+lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch
+>>>>>>> debian/patches/series