openssh-portable icon indicating copy to clipboard operation
openssh-portable copied to clipboard

fix carriage-return in key files

Open obezpalko opened this issue 4 years ago • 6 comments

if header starts with "-----BEGIN OPENSSH PRIVATE KEY-----\r\n" - it will not break the key loading the same for the end marker. even for the case "-----BEGIN OPENSSH PRIVATE KEY-----\EOF" both \r & \n are ignoring on the key loading

obezpalko avatar Dec 26 '21 14:12 obezpalko

Wouldn't your suggestion print the mark and the first line of the key on the same line? This is the code I'm refering to:

	/* assemble uuencoded key */
	if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0 ||
	    (r = sshbuf_dtob64(encoded, blob, 1)) != 0 ||
	    (r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0)
		goto out;

kalvdans avatar Sep 05 '23 22:09 kalvdans

Wouldn't your suggestion print the mark and the first line of the key on the same line? This is the code I'm refering to:

	/* assemble uuencoded key */
	if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0 ||
	    (r = sshbuf_dtob64(encoded, blob, 1)) != 0 ||
	    (r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0)
		goto out;

The problem is not in assembling keys, but in parsing. In case if You upload key with http-form all \n will be converted to \r\n and reading parser will not catch the key blok boundaries.

obezpalko avatar Sep 06 '23 09:09 obezpalko

The problem is not in assembling keys, but in parsing.

Ah true. I just wanted to clarify that we shouldn't merge your PR in its current form.

kalvdans avatar Sep 06 '23 13:09 kalvdans

I just wanted to clarify that we shouldn't merge your PR in its current form.

is something wrong with it?

obezpalko avatar Sep 06 '23 16:09 obezpalko

is something wrong with it?

Yes, printing out a key no longer adds newline between the header and the first row of base64 data.

kalvdans avatar Sep 06 '23 17:09 kalvdans

@kalvdans

It seems I got the point.

~~printing is ok~~ ~~but this is not about printing.~~ ~~\r\n can appear in file if You edit it in windows-mode or upload via http form.~~ ~~This is OK for base64 section, but after this edit/upload key file becomes not valid and it's hard to detect why~~

obezpalko avatar Sep 07 '23 09:09 obezpalko