openssh bugs - Jun 2021 - [Bug 3328] New: Issue with ForwardAgent value specified as an environment variable

https://bugzilla.mindrot.org/show_bug.cgi?id=3328

            Bug ID: 3328
           Summary: Issue with ForwardAgent value specified as an
                    environment variable
           Product: Portable OpenSSH
           Version: 8.6p1
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: goetze at dovetail.com

Created attachment 3530
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3530&action=edit
xstrdup() added for ForwardAgent env var

Beginning with OpenSSH 8.2, the ssh_config ForwardAgent option can
accept "an explicit path to an agent socket or the name of an
environment variable (beginning with ?$?) in which to find the path."

If an environment variable name is supplied, ssh.c uses getenv() to
capture the value, but fails to make a copy.  This is problematic on
systems where subsequent calls to getenv() clobber the last returned
value.

This problem exists as of OpenSSH release 8.6.

I've attached a proposed patch, based on the OpenSSH 8.6p1 ssh.c source
file.

On a related note, I don't understand why the $ENV_VAR_NAME (without
braces) syntax is supported for this option.  There is also support for
supplying the environment variable name via the ${ENV_VAR_NAME} (with
braces) syntax (see the code beginning at line 1415 in ssh.c).  

Is the non-brace syntax a legacy format that needs to be preserved?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3328

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |3302
                 CC|                            |dtucker at dtucker.net


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3302
[Bug 3302] Tracking bug for openssh-8.7
-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3328

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Stephen Goetze from comment #0)
[...]
> I've attached a proposed patch, based on the OpenSSH 8.6p1 ssh.c
> source file.
Thanks, I've added it to the list to do for the next release.
> On a related note, I don't understand why the $ENV_VAR_NAME (without
> braces) syntax is supported for this option.  There is also support
> for supplying the environment variable name via the ${ENV_VAR_NAME}
> (with braces) syntax (see the code beginning at line 1415 in ssh.c).
> 
> 
> Is the non-brace syntax a legacy format that needs to be preserved?
Yes, the non-brace syntax was existed only for this option prior to the
more generic brace support being added for many options.  The old
syntax is maintained for backward compatibility for any configs using
it (we try not to break working configs without advance warning).

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3328

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
This has been applied and will be in the next major release.

Thanks for the report.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3328

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
closing bugs resolved before openssh-8.9

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.