[Bug 4010] New: ssh-keygen -s accepts repeated certificate options and signs certificates that sshd rejects ("multiple force-command options")

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4010

            Bug ID: 4010
           Summary: ssh-keygen -s accepts repeated certificate options and
                    signs certificates that sshd rejects ("multiple
                    force-command options")
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: critical
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: khush2792001 at gmail.com

`ssh-keygen -s` does not check whether a critical option or extension
is already present
before adding it (`cert_ext_add()` in `ssh-keygen.c` appends
unconditionally, and
`finalise_cert_exts()` adds the default `permit-*` extensions after the
user's `-O` options and
then only sorts them). As a result:

- `-O force-command=/bin/a -O critical:force-command=/bin/b` produces a
certificate with two
  `force-command` critical options. `ssh-keygen` reports success, but
`sshd` refuses the
  certificate: `cert_option_list()` in `auth-options.c` logs
"Certificate has multiple
  force-command options" and authentication fails.
- `-O extension:permit-pty` (the documented "arbitrary extension" form,
naming an extension
  that is on by default) produces a certificate that lists `permit-pty`
twice.

The certificate format allows each named option only once, and `sshd`
enforces that for the
critical options it knows, so `ssh-keygen` can sign certificates that
its own server rejects.

### Steps to reproduce

```
$ ssh-keygen -q -t ed25519 -N '' -f ca && ssh-keygen -q -t ed25519 -N
'' -f user
$ ssh-keygen -s ca -I id -O force-command=/bin/a -O
critical:force-command=/bin/b user.pub; echo $?
Signed user key user-cert.pub: id "id" serial 0 valid forever
0
$ ssh-keygen -L -f user-cert.pub | sed -n '/Critical
Options/,/Extensions/p'
        Critical Options:
                force-command /bin/a
                force-command /bin/b
        Extensions:
$ rm user-cert.pub
$ ssh-keygen -q -s ca -I id -O extension:permit-pty user.pub
$ ssh-keygen -L -f user-cert.pub | sed -n '/Extensions/,$p'
        Extensions:
                permit-X11-forwarding
                permit-agent-forwarding
                permit-port-forwarding
                permit-pty
                permit-pty
                permit-user-rc
```

Expected

`ssh-keygen` rejects a repeated critical option with an error (or lets
the later one replace
the earlier), and does not emit a default extension twice when it is
also given with
`-O extension:`.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.