openssh bugs - Feb 2024 - [Bug 3667] New: Trailing space is added when parsing Subsystem in sshd_config

https://bugzilla.mindrot.org/show_bug.cgi?id=3667

            Bug ID: 3667
           Summary: Trailing space is added when parsing Subsystem in
                    sshd_config
           Product: Portable OpenSSH
           Version: 9.5p1
          Hardware: All
                OS: FreeBSD
            Status: NEW
          Severity: normal
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: furaisanjin at gmail.com

This is found in FreeBSD14.0 release which includes version 9.5p1.

Part of process_server_config_line_depth function on servconf.c is
something like this.

                options->subsystem_command[options->num_subsystems]       
xstrdup(arg);
                /* Collect arguments (separate to executable) */
                arg = argv_assemble(1, &arg); /* quote command
correctly */
                arg2 = argv_assemble(ac, av); /* rest of command */
               
xasprintf(&options->subsystem_args[options->num_subsystems],
                    "%s %s", arg, arg2);
                free(arg2);

Subsystem definion in sshd_config is defined like this.

# override default of no subsystems
Subsystem       sftp    /usr/libexec/sftp-server

In this case arg2 (rest of command) doesn't have anything but it is
appended followed by arg and put that on subsystem_args. The result
always has trailing space.

This may not be the problem in most case but I have command="..." in
~/.ssh/authorized_keys and the command checks the given input very
strictly. The command doesn't accept such input due to this.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3667

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org,
                   |                            |dtucker at dtucker.net
   Attachment #3789|                            |ok?(dtucker at dtucker.net)
              Flags|                            |

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
Created attachment 3789
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3789&action=edit
skip space if arguments are empty

Does this patch help?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3667

--- Comment #2 from furaisanjin at gmail.com ---
(In reply to Damien Miller from comment #1)
> Created attachment 3789 [details]
> skip space if arguments are empty
> 
> Does this patch help?
Yes, it does help. Thank you.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3667

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
Fixed in commit ee6d932acb and will be in openssh-9.7 - thanks!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.