[openssh-commits] [openssh] 39/87: upstream: include the entire ProxyJump specification in the %j
git+noreply at mindrot.org
git+noreply at mindrot.org
Fri Oct 30 20:21:16 AEDT 2026
This is an automated email from the git hooks/post-receive script.
djm pushed a commit to branch master
in repository openssh.
commit d71cc75c9906da512aa430f73fce7d41e7caaf86
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 04:14:37 2026 +0000
upstream: include the entire ProxyJump specification in the %j
and %C TOKENS previously this just included the jump _host_ alone and dropped
the port, username and extra jump hops.
Anthropic ANT-2026-S9DT2E2E
OpenBSD-Commit-ID: b86afa16bef21053982ef84e61c782b6d697c7cb
---
readconf.c | 69 ++++++++++++++++++++++++++++++++++++++++----------------------
readconf.h | 3 ++-
ssh.c | 5 ++---
3 files changed, 49 insertions(+), 28 deletions(-)
diff --git a/readconf.c b/readconf.c
index 9b557dedf..2980687e3 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.419 2026/10/05 06:03:40 dtucker Exp $ */
+/* $OpenBSD: readconf.c,v 1.420 2026/10/30 04:14:37 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -360,6 +360,44 @@ ssh_connection_hash(const char *thishost, const char *host, const char *portstr,
return tohex(conn_hash, ssh_digest_bytes(SSH_DIGEST_SHA1));
}
+/*
+ * Returns the configured ProxyJump specification (all hops, including any
+ * user and port) in the form printed by "ssh -G" and expanded by the %j
+ * token, or an empty string if no jump host is set. Caller must free
+ * returned value.
+ */
+char *
+ssh_jump_spec(const Options *o)
+{
+ char *ret, portstr[NI_MAXSERV];
+ int i;
+
+ if (o->jump_host == NULL || (strcmp(o->jump_host, "none") == 0 &&
+ o->jump_port == 0 && o->jump_user == NULL))
+ return xstrdup("");
+ /* Check for numeric addresses */
+ i = strchr(o->jump_host, ':') != NULL ||
+ strspn(o->jump_host, "1234567890.") == strlen(o->jump_host);
+ snprintf(portstr, sizeof(portstr), "%d", o->jump_port);
+ xasprintf(&ret, "%s%s%s%s%s%s%s%s%s",
+ /* optional additional jump spec */
+ o->jump_extra == NULL ? "" : o->jump_extra,
+ o->jump_extra == NULL ? "" : ",",
+ /* optional user */
+ o->jump_user == NULL ? "" : o->jump_user,
+ o->jump_user == NULL ? "" : "@",
+ /* opening [ if hostname is numeric */
+ i ? "[" : "",
+ /* mandatory hostname */
+ o->jump_host,
+ /* closing ] if hostname is numeric */
+ i ? "]" : "",
+ /* optional port number */
+ o->jump_port <= 0 ? "" : ":",
+ o->jump_port <= 0 ? "" : portstr);
+ return ret;
+}
+
/*
* Adds a local TCP/IP port forward to options. Never returns if there is an
* error.
@@ -663,8 +701,7 @@ expand_match_exec_or_include_path(const char *path, Options *options,
}
if (gethostname(thishost, sizeof(thishost)) == -1)
fatal("gethostname: %s", strerror(errno));
- jmphost = option_clear_or_none(options->jump_host) ?
- "" : options->jump_host;
+ jmphost = ssh_jump_spec(options);
strlcpy(shorthost, thishost, sizeof(shorthost));
shorthost[strcspn(thishost, ".")] = '\0';
snprintf(portstr, sizeof(portstr), "%d", port);
@@ -689,6 +726,7 @@ expand_match_exec_or_include_path(const char *path, Options *options,
"j", jmphost,
(char *)NULL);
free(host);
+ free(jmphost);
free(conn_hash_hex);
return ret;
}
@@ -3739,7 +3777,7 @@ void
dump_client_config(Options *o, const char *host)
{
int i, r;
- char buf[8], *all_key;
+ char buf[8], *all_key, *jumpspec;
/*
* Expand HostKeyAlgorithms name lists. This isn't handled in
@@ -3944,25 +3982,8 @@ dump_client_config(Options *o, const char *host)
if (o->jump_host == NULL)
dump_cfg_string(oProxyCommand, o->proxy_command);
else {
- /* Check for numeric addresses */
- i = strchr(o->jump_host, ':') != NULL ||
- strspn(o->jump_host, "1234567890.") == strlen(o->jump_host);
- snprintf(buf, sizeof(buf), "%d", o->jump_port);
- printf("proxyjump %s%s%s%s%s%s%s%s%s\n",
- /* optional additional jump spec */
- o->jump_extra == NULL ? "" : o->jump_extra,
- o->jump_extra == NULL ? "" : ",",
- /* optional user */
- o->jump_user == NULL ? "" : o->jump_user,
- o->jump_user == NULL ? "" : "@",
- /* opening [ if hostname is numeric */
- i ? "[" : "",
- /* mandatory hostname */
- o->jump_host,
- /* closing ] if hostname is numeric */
- i ? "]" : "",
- /* optional port number */
- o->jump_port <= 0 ? "" : ":",
- o->jump_port <= 0 ? "" : buf);
+ jumpspec = ssh_jump_spec(o);
+ printf("proxyjump %s\n", jumpspec);
+ free(jumpspec);
}
}
diff --git a/readconf.h b/readconf.h
index 3a7dfc1ff..bbbb04f3a 100644
--- a/readconf.h
+++ b/readconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.h,v 1.164 2026/09/16 00:13:58 djm Exp $ */
+/* $OpenBSD: readconf.h,v 1.165 2026/10/30 04:14:37 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -242,6 +242,7 @@ typedef struct {
const char *kex_default_pk_alg(void);
char *ssh_connection_hash(const char *thishost, const char *host,
const char *portstr, const char *user, const char *jump_host);
+char *ssh_jump_spec(const Options *);
void initialize_options(Options *);
int fill_default_options(Options *);
void fill_default_options_for_canonicalization(Options *);
diff --git a/ssh.c b/ssh.c
index fe660efbd..d01398660 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.642 2026/09/23 21:42:39 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.643 2026/10/30 04:14:37 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1416,8 +1416,7 @@ main(int ac, char **av)
cinfo->remhost = xstrdup(host);
cinfo->homedir = xstrdup(pw->pw_dir);
cinfo->locuser = xstrdup(pw->pw_name);
- cinfo->jmphost = xstrdup(options.jump_host == NULL ?
- "" : options.jump_host);
+ cinfo->jmphost = ssh_jump_spec(&options);
/*
* If the user was specified via a configuration directive then attempt
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list