openssh bugs - Jan 2016 - [Bug 2520] New: ssh-keygen: sanitize ANSI escape sequences in key comment

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

            Bug ID: 2520
           Summary: ssh-keygen: sanitize ANSI escape sequences in key
                    comment
           Product: Portable OpenSSH
           Version: 7.1p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: minor
          Priority: P5
         Component: ssh-keygen
          Assignee: unassigned-bugs at mindrot.org
          Reporter: rohieb+bugzillamindrotorg at rohieb.name

Created attachment 2775
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2775&action=edit
public key with ANSI escape sequences

I noticed that ssh-keygen prints most non-printable characters in the
comment as-is when showing the fingerprint of a key. This can lead to
confusing output on the terminal when the comment contains ANSI escape
characters which are interpreted by the terminal. The attached public
key file serves as an example, which, when fingerprinted on my Linux
terminal, looks like this:

$ ssh-keygen -E sha256 -lf test.pub
1024 MD5:de:ad:be:ef:00:7h:15:15:af:0r:6e:d0:ha:5h:00:00
nobody at example.org (RSA)

... in nice rainbow colors (see attached screenshot). Also note that a
SHA256 hash was requested whereas the output is an MD5 hash (which also
contains invalid characters, so it cannot really be an MD5 hash...),
but you get the point that, in general, this technique can be used to
suppress the real fingerprint of a key and let the user see a different
one.

For this reason, I suggest applying the attached patch (based on commit
271df81 from the OpenSSH Portable GitHub repository), which emplys
strvis() to escape possibly dangerous characters in the comment prior
to printing it to the terminal.  This should serve as a sufficient
workaround for the obfuscating escape behaviour of the underlying
terminal emulator.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

--- Comment #1 from Roland Hieber <rohieb+bugzillamindrotorg at
rohieb.name> ---
Created attachment 2776
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2776&action=edit
screenshot showing the output from ssh-keygen on the public key

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

--- Comment #2 from Roland Hieber <rohieb+bugzillamindrotorg at
rohieb.name> ---
Created attachment 2777
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2777&action=edit
proposed patch

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
This is not going to be popular with users who have UTF-8 or other
non-ASCII characters in their comments. We need something like that
proposed for bug #2058

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #2777|0                           |1
        is obsolete|                            |
                 CC|                            |dtucker at zip.com.au
             Status|NEW                         |ASSIGNED
           Assignee|unassigned-bugs at mindrot.org |djm at mindrot.org
   Attachment #2940|                            |ok?(dtucker at zip.com.au)
              Flags|                            |

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
Created attachment 2940
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2940&action=edit
sanitise escape sequences but not valid UTF-8 when the locale supports
it

This patch uses Ingo's recent mprintf API to safely render strings
while preserving UTF-8 characters when the locale supports them.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |2647


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=2647
[Bug 2647] Tracking bug for OpenSSH 7.5 release
-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #2940|ok?(dtucker at zip.com.au)     |ok+
              Flags|                            |

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
Fix applied. This will be in OpenSSH 7.5

commit a287c5ad1e0bf9811c7b9221979b969255076019
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Fri Feb 10 03:36:40 2017 +0000

    upstream commit

    Sanitise escape sequences in key comments sent to printf
    but preserve valid UTF-8 when the locale supports it; bz#2520 ok
dtucker@

    Upstream-ID: e8eed28712ba7b22d49be534237eed019875bd1e

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2520

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #6 from Damien Miller <djm at mindrot.org> ---
Close all resolved bugs after release of OpenSSH 7.7.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.