openssh bugs - May 2018 - [Bug 2870] New: Support "%i" token expansion in the IdentityAgent option

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

            Bug ID: 2870
           Summary: Support "%i" token expansion in the IdentityAgent
                    option
           Product: Portable OpenSSH
           Version: 7.7p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: hristo at venev.name

It is very useful if someone wants the socket to live under
/run/user/$UID.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |djm at mindrot.org
           Assignee|unassigned-bugs at mindrot.org |djm at mindrot.org
   Attachment #3155|                            |ok?
              Flags|                            |

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
Created attachment 3155
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3155&action=edit
Support %U in sshd percent_expand for UID. Extend %i availability in
ssh

This patch adds a %U expansion to all the sshd_config directives that
accept a username (%u) token.

I would have used %i as is used in ssh, but unfortunately that's
already collided by the certificate key-ID token in sshd (sorry, my
fault).

This also expands the availability of %i in ssh to everywhere that
currenly supports %u too.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |2852


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=2852
[Bug 2852] Tracking bug for OpenSSH 7.8 release
-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net
   Attachment #3155|ok?                         |ok?(dtucker at dtucker.net)
              Flags|                            |

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
Comment on attachment 3155
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3155
Support %U in sshd percent_expand for UID. Extend %i availability in
ssh
> snprintf(uidstr, sizeof(uidstr), "%d", pw->pw_uid);
on some platforms uid_t is long not int?

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3155|0                           |1
        is obsolete|                            |
   Attachment #3155|ok?(dtucker at dtucker.net)    |
              Flags|                            |
   Attachment #3156|                            |ok?(dtucker at dtucker.net)
              Flags|                            |

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
Created attachment 3156
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3156&action=edit
Cast to safe integral value

POSIX says that uid_t can be any integral type, so cast to unsigned
long long. IMO this is safe wrt -ve values, whereas a signed type with
be undefined behaviour on a platform with unsigned uid_t and
sufficiently large UIDs.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3156|ok?(dtucker at dtucker.net)    |ok+
              Flags|                            |

--- Comment #4 from Darren Tucker <dtucker at dtucker.net> ---
Comment on attachment 3156
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3156
Cast to safe integral value
>+	snprintf(uidstr, sizeof(uidstr), "%llu",
>+	    (unsigned long long)pw->pw_uid);
check for truncation (or use xasprintf)?  shouldn't happen with 64bits,
but maybe someone will make them GUIDs or something one day.

otherwise ok.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
This has been committed and will be in OpenSSH 7.8 - thanks!

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Roumen Petrov <bugtrack at roumenpetrov.info> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |---
             Status|RESOLVED                    |REOPENED
                 CC|                            |bugtrack at roumenpetrov.info

--- Comment #6 from Roumen Petrov <bugtrack at roumenpetrov.info> ---
load_public_identity_files() expands %h and %i to same value. Please
check.

In addition I would like client to use %U instead %i, i.e. %i to be
considered as obsolete.
Of course for backward compatibility %i has to be available.
Using common TOKEN options (%U and %u) in client and daemon will
minimize configuration errors.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Damien Miller <djm at mindrot.org> ---
Thanks I've fixed the incorrect %i expansion.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2870

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Damien Miller <djm at mindrot.org> ---
closing resolved bugs as of 8.6p1 release

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.