[Bug 4018] New: StreamLocalBindMask ignores Host and Match conditions, and the last value wins

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4018

            Bug ID: 4018
           Summary: StreamLocalBindMask ignores Host and Match conditions,
                    and the last value wins
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Windows 10
            Status: NEW
          Severity: major
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: khush2792001 at gmail.com

`StreamLocalBindMask` is applied while parsing `ssh_config` even when
its enclosing `Host` or `Match` block does not match the destination.
Repeated declarations also use the last value, contrary to the
documented rule that the first obtained value is used.

For example, with `localhost` as the destination:

```console
$ cat > config <<'EOF'
Host nomatch
    StreamLocalBindMask 0077
EOF
$ ssh -G -F config localhost | grep '^streamlocalbindmask '
streamlocalbindmask 077
```

The block cannot match `localhost`, so the expected value is the
default:

```text
streamlocalbindmask 0177
```

The same problem occurs with a nonmatching `Match` block:

```console
$ cat > config <<'EOF'
Match host nomatch
    StreamLocalBindMask 0000
EOF
$ ssh -G -F config localhost | grep '^streamlocalbindmask '
streamlocalbindmask 00
```

Repeated unconditional values also demonstrate the precedence problem:

```console
$ cat > config <<'EOF'
StreamLocalBindMask 0077
StreamLocalBindMask 0022
EOF
$ ssh -G -F config localhost | grep '^streamlocalbindmask '
streamlocalbindmask 022
```

The expected value is `077`, because `ssh_config(5)` says that the
first obtained value is used.

In `readconf.c`, the `oStreamLocalBindMask` case assigns
`options->fwd_opts.streamlocal_bind_mask` without checking `*activep`
or whether the option is already set. Neighboring single-valued options
use both guards.

This value controls the umask used when `ssh` creates a listening
Unix-domain socket for stream-local forwarding. A permissive mask
placed in an unrelated host stanza can therefore affect other
destinations.

Expected: apply the assignment only when `*activep` is true and
`streamlocal_bind_mask` still has its unset sentinel value. The
attached standalone `repro.py` invokes `ssh -G` and exits 1 while the
defect is present.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.