[rpms/gsi-openssh] f43: Based on openssh-10.0p1-9.fc43

[Mattias Ellert <mattias.ellert@physics.uu.se>]

A new commit has been pushed.

Repo   : rpms/gsi-openssh
Branch : f43
Commit : c5f195e4fa968c35a5fda81d4a133c04a91203a1
Author : Mattias Ellert <mattias.ellert@physics.uu.se>
Date   : 2026-05-29T06:36:31+02:00
Stats  : +787/-10 in 8 file(s)
URL    : https://src.fedoraproject.org/rpms/gsi-openssh/c/c5f195e4fa968c35a5fda81d4a133c04a91203a1?branch=f43

Log:
Based on openssh-10.0p1-9.fc43

---
diff --git a/0054-openssh-9.9p1-scp-clear-setuid.patch b/0054-openssh-9.9p1-scp-clear-setuid.patch
new file mode 100644
index 0000000..1a848a1
--- /dev/null
+++ b/0054-openssh-9.9p1-scp-clear-setuid.patch
@@ -0,0 +1,15 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c	2026-04-07 15:54:11.193730842 +0200
++++ b/scp.c	2026-04-07 15:55:52.529425481 +0200
+@@ -1705,8 +1705,10 @@ sink(int argc, char **argv, const char *
+ 
+ 	setimes = targisdir = 0;
+ 	mask = umask(0);
+-	if (!pflag)
++	if (!pflag) {
++		mask |= 07000;
+ 		(void) umask(mask);
++	}
+ 	if (argc != 1) {
+ 		run_err("ambiguous target");
+ 		exit(1);

diff --git a/0055-openssh-9.9p1-mux-askpass-check.patch b/0055-openssh-9.9p1-mux-askpass-check.patch
new file mode 100644
index 0000000..2176243
--- /dev/null
+++ b/0055-openssh-9.9p1-mux-askpass-check.patch
@@ -0,0 +1,20 @@
+diff --color -ruNp a/mux.c b/mux.c
+--- a/mux.c	2024-09-20 00:20:48.000000000 +0200
++++ b/mux.c	2026-04-09 15:02:36.016198814 +0200
+@@ -1137,6 +1137,16 @@ mux_master_process_proxy(struct ssh *ssh
+ 
+ 	debug_f("channel %d: proxy request", c->self);
+ 
++	if (options.control_master == SSHCTL_MASTER_ASK ||
++	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
++		if (!ask_permission("Allow multiplex proxy connection?")) {
++			debug2_f("proxy refused by user");
++			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
++			    "Permission denied");
++			return 0;
++		}
++	}
++
+ 	c->mux_rcb = channel_proxy_downstream;
+ 	if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
+ 	    (r = sshbuf_put_u32(reply, rid)) != 0)

diff --git a/0056-openssh-9.9p1-ecdsa-incomplete-application.patch b/0056-openssh-9.9p1-ecdsa-incomplete-application.patch
new file mode 100644
index 0000000..3b93ca4
--- /dev/null
+++ b/0056-openssh-9.9p1-ecdsa-incomplete-application.patch
@@ -0,0 +1,103 @@
+diff --color -ruNp a/auth2-hostbased.c b/auth2-hostbased.c
+--- a/auth2-hostbased.c	2026-04-09 13:22:28.114045749 +0200
++++ b/auth2-hostbased.c	2026-04-09 14:34:44.876393822 +0200
+@@ -96,9 +96,10 @@ userauth_hostbased(struct ssh *ssh, cons
+ 		error_f("cannot decode key: %s", pkalg);
+ 		goto done;
+ 	}
+-	if (key->type != pktype) {
+-		error_f("type mismatch for decoded key "
+-		    "(received %d, expected %d)", key->type, pktype);
++	if (key->type != pktype || (sshkey_type_plain(pktype) == KEY_ECDSA &&
++	    sshkey_ecdsa_nid_from_name(pkalg) != key->ecdsa_nid)) {
++		error_f("key type mismatch for decoded key "
++		    "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
+ 		goto done;
+ 	}
+ 	if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
+diff --color -ruNp a/auth2-pubkey.c b/auth2-pubkey.c
+--- a/auth2-pubkey.c	2026-04-09 13:22:28.157194118 +0200
++++ b/auth2-pubkey.c	2026-04-09 14:35:48.997689347 +0200
+@@ -152,9 +152,10 @@ userauth_pubkey(struct ssh *ssh, const c
+ 		error_f("cannot decode key: %s", pkalg);
+ 		goto done;
+ 	}
+-	if (key->type != pktype) {
+-		error_f("type mismatch for decoded key "
+-		    "(received %d, expected %d)", key->type, pktype);
++	if (key->type != pktype || (sshkey_type_plain(pktype) == KEY_ECDSA &&
++	    sshkey_ecdsa_nid_from_name(pkalg) != key->ecdsa_nid)) {
++		error_f("key type mismatch for decoded key "
++		    "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
+ 		goto done;
+ 	}
+ 	if (auth2_key_already_used(authctxt, key)) {
+diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
+--- a/sshconnect2.c	2026-04-09 13:22:28.193412553 +0200
++++ b/sshconnect2.c	2026-04-09 14:42:37.644945762 +0200
+@@ -91,6 +91,7 @@ extern Options options;
+ static char *xxx_host;
+ static struct sockaddr *xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
++static int key_type_allowed(struct sshkey *, const char *);
+ 
+ static int
+ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+@@ -100,6 +101,10 @@ verify_host_key_callback(struct sshkey *
+ 	if ((r = sshkey_check_rsa_length(hostkey,
+ 	    options.required_rsa_size)) != 0)
+ 		fatal_r(r, "Bad server host key");
++	if (!key_type_allowed(hostkey, options.hostkeyalgorithms)) {
++		fatal("Server host key %s not in HostKeyAlgorithms",
++		    sshkey_ssh_name(hostkey));
++	}
+ 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+ 	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+@@ -1776,34 +1781,37 @@ load_identity_file(Identity *id)
+ }
+ 
+ static int
+-key_type_allowed_by_config(struct sshkey *key)
++key_type_allowed(struct sshkey *key, const char *allowlist)
+ {
+-	if (match_pattern_list(sshkey_ssh_name(key),
+-	    options.pubkey_accepted_algos, 0) == 1)
++	if (match_pattern_list(sshkey_ssh_name(key), allowlist, 0) == 1)
+ 		return 1;
+ 
+ 	/* RSA keys/certs might be allowed by alternate signature types */
+ 	switch (key->type) {
+ 	case KEY_RSA:
+-		if (match_pattern_list("rsa-sha2-512",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		if (match_pattern_list("rsa-sha2-512", allowlist, 0) == 1)
+ 			return 1;
+-		if (match_pattern_list("rsa-sha2-256",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		if (match_pattern_list("rsa-sha2-256", allowlist, 0) == 1)
+ 			return 1;
+ 		break;
+ 	case KEY_RSA_CERT:
+ 		if (match_pattern_list("rsa-sha2-512-cert-v01@openssh.com",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		    allowlist, 0) == 1)
+ 			return 1;
+ 		if (match_pattern_list("rsa-sha2-256-cert-v01@openssh.com",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		    allowlist, 0) == 1)
+ 			return 1;
+ 		break;
+ 	}
+ 	return 0;
+ }
+ 
++static int
++key_type_allowed_by_config(struct sshkey *key)
++{
++	return key_type_allowed(key, options.pubkey_accepted_algos);
++}
++
+ /* obtain a list of keys from the agent */
+ static int
+ get_agent_identities(struct ssh *ssh, int *agent_fdp,

diff --git a/0057-openssh-9.9p1-authorized-keys-principles-option.patch b/0057-openssh-9.9p1-authorized-keys-principles-option.patch
new file mode 100644
index 0000000..9bdd199
--- /dev/null
+++ b/0057-openssh-9.9p1-authorized-keys-principles-option.patch
@@ -0,0 +1,45 @@
+diff --color -ruNp a/auth2-pubkeyfile.c b/auth2-pubkeyfile.c
+--- a/auth2-pubkeyfile.c	2024-09-20 00:20:48.000000000 +0200
++++ b/auth2-pubkeyfile.c	2026-04-09 14:38:41.697178612 +0200
+@@ -50,6 +50,7 @@
+ #include "authfile.h"
+ #include "match.h"
+ #include "ssherr.h"
++#include "xmalloc.h"
+ 
+ int
+ auth_authorise_keyopts(struct passwd *pw, struct sshauthopt *opts,
+@@ -146,20 +147,23 @@ auth_authorise_keyopts(struct passwd *pw
+ static int
+ match_principals_option(const char *principal_list, struct sshkey_cert *cert)
+ {
+-	char *result;
++	char *list, *olist, *entry;
+ 	u_int i;
+ 
+-	/* XXX percent_expand() sequences for authorized_principals? */
+-
+-	for (i = 0; i < cert->nprincipals; i++) {
+-		if ((result = match_list(cert->principals[i],
+-		    principal_list, NULL)) != NULL) {
+-			debug3("matched principal from key options \"%.100s\"",
+-			    result);
+-			free(result);
+-			return 1;
++	olist = list = xstrdup(principal_list);
++	for (;;) {
++		if ((entry = strsep(&list, ",")) == NULL || *entry == '\0')
++			break;
++		for (i = 0; i < cert->nprincipals; i++) {
++			if (strcmp(entry, cert->principals[i]) == 0) {
++				debug3("matched principal from key i"
++				    "options \"%.100s\"", entry);
++				free(olist);
++				return 1;
++			}
+ 		}
+ 	}
++	free(olist);
+ 	return 0;
+ }
+ 

diff --git a/0058-openssh-9.9p1-reject-null-char-in-url-string.patch b/0058-openssh-9.9p1-reject-null-char-in-url-string.patch
new file mode 100644
index 0000000..9b2d378
--- /dev/null
+++ b/0058-openssh-9.9p1-reject-null-char-in-url-string.patch
@@ -0,0 +1,24 @@
+diff --color -ruNp a/misc.c b/misc.c
+--- a/misc.c	2025-12-03 16:19:11.255135131 +0100
++++ b/misc.c	2025-12-03 16:21:53.769590836 +0100
+@@ -998,7 +998,7 @@ urldecode(const char *src)
+ 	size_t srclen;
+ 
+ 	if ((srclen = strlen(src)) >= SIZE_MAX)
+-		fatal_f("input too large");
++		return NULL;
+ 	ret = xmalloc(srclen + 1);
+ 	for (dst = ret; *src != '\0'; src++) {
+ 		switch (*src) {
+@@ -1006,9 +1006,10 @@ urldecode(const char *src)
+ 			*dst++ = ' ';
+ 			break;
+ 		case '%':
++			/* note: don't allow \0 characters */
+ 			if (!isxdigit((unsigned char)src[1]) ||
+ 			    !isxdigit((unsigned char)src[2]) ||
+-			    (ch = hexchar(src + 1)) == -1) {
++			    (ch = hexchar(src + 1)) == -1 || ch == 0) {
+ 				free(ret);
+ 				return NULL;
+ 			}

diff --git a/0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch b/0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch
new file mode 100644
index 0000000..3c5aac7
--- /dev/null
+++ b/0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch
@@ -0,0 +1,555 @@
+diff --color -ruNp a/readconf.c b/readconf.c
+--- a/readconf.c	2026-04-17 16:59:36.623543521 +0200
++++ b/readconf.c	2026-04-20 09:56:46.826071665 +0200
+@@ -1578,9 +1578,6 @@ parse_char_array:
+ 
+ 	case oProxyCommand:
+ 		charptr = &options->proxy_command;
+-		/* Ignore ProxyCommand if ProxyJump already specified */
+-		if (options->jump_host != NULL)
+-			charptr = &options->jump_host; /* Skip below */
+ parse_command:
+ 		if (str == NULL) {
+ 			error("%.200s line %d: Missing argument.",
+@@ -1601,7 +1598,7 @@ parse_command:
+ 		}
+ 		len = strspn(str, WHITESPACE "=");
+ 		/* XXX use argv? */
+-		if (parse_jump(str + len, options, *activep) == -1) {
++		if (parse_jump(str + len, options, cmdline, *activep) == -1) {
+ 			error("%.200s line %d: Invalid ProxyJump \"%s\"",
+ 			    filename, linenum, str + len);
+ 			goto out;
+@@ -3438,65 +3435,116 @@ parse_forward(struct Forward *fwd, const
+ }
+ 
+ int
+-parse_jump(const char *s, Options *o, int active)
++ssh_valid_hostname(const char *s)
+ {
+-	char *orig, *sdup, *cp;
+-	char *host = NULL, *user = NULL;
+-	int r, ret = -1, port = -1, first;
++	size_t i;
+ 
+-	active &= o->proxy_command == NULL && o->jump_host == NULL;
++	if (*s == '-')
++		return 0;
++	for (i = 0; s[i] != 0; i++) {
++		if (strchr("'`\"$\\;&<>|(){},", s[i]) != NULL ||
++		    isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
++			return 0;
++	}
++	return 1;
++}
+ 
+-	orig = sdup = xstrdup(s);
++int
++ssh_valid_ruser(const char *s)
++{
++	size_t i;
++
++	if (*s == '-')
++		return 0;
++	for (i = 0; s[i] != 0; i++) {
++		if (iscntrl((u_char)s[i]))
++			return 0;
++		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
++			return 0;
++		/* Disallow '-' after whitespace */
++		if (isspace((u_char)s[i]) && s[i + 1] == '-')
++			return 0;
++		/* Disallow \ in last position */
++		if (s[i] == '\\' && s[i + 1] == '\0')
++			return 0;
++	}
++	return 1;
++}
++
++int
++parse_jump(const char *s, Options *o, int strict, int active)
++{
++	char *orig = NULL, *sdup = NULL, *cp;
++	char *tmp_user = NULL, *tmp_host = NULL, *host = NULL, *user = NULL;
++	int r, ret = -1, tmp_port = -1, port = -1, first = 1;
++
++	if (strcasecmp(s, "none") == 0) {
++		if (active && o->jump_host == NULL) {
++			o->jump_host = xstrdup("none");
++			o->jump_port = 0;
++		}
++		return 0;
++	}
+ 
+-	/* Remove comment and trailing whitespace */
++	orig = xstrdup(s);
+ 	if ((cp = strchr(orig, '#')) != NULL)
+ 		*cp = '\0';
+ 	rtrim(orig);
+ 
+-	first = active;
++	active &= o->proxy_command == NULL && o->jump_host == NULL;
++	sdup = xstrdup(orig);
+ 	do {
+-		if (strcasecmp(s, "none") == 0)
+-			break;
++		/* Work backwards through string */
+ 		if ((cp = strrchr(sdup, ',')) == NULL)
+ 			cp = sdup; /* last */
+ 		else
+ 			*cp++ = '\0';
+ 
+-		if (first) {
+-			/* First argument and configuration is active */
+-			r = parse_ssh_uri(cp, &user, &host, &port);
+-			if (r == -1 || (r == 1 &&
+-			    parse_user_host_port(cp, &user, &host, &port) != 0))
++		r = parse_ssh_uri(cp, &tmp_user, &tmp_host, &tmp_port);
++		if (r == -1 || (r == 1 && parse_user_host_port(cp,
++		    &tmp_user, &tmp_host, &tmp_port) != 0))
++			goto out; /* error already logged */
++		if (strict) {
++			if (!ssh_valid_hostname(tmp_host)) {
++				error_f("invalid hostname \"%s\"", tmp_host);
+ 				goto out;
+-		} else {
+-			/* Subsequent argument or inactive configuration */
+-			r = parse_ssh_uri(cp, NULL, NULL, NULL);
+-			if (r == -1 || (r == 1 &&
+-			    parse_user_host_port(cp, NULL, NULL, NULL) != 0))
++			}
++			if (tmp_user != NULL && !ssh_valid_ruser(tmp_user)) {
++				error_f("invalid username \"%s\"", tmp_user);
+ 				goto out;
++			}
++		}
++		if (first) {
++			user = tmp_user;
++			host = tmp_host;
++			port = tmp_port;
++			tmp_user = tmp_host = NULL; /* transferred */
+ 		}
+ 		first = 0; /* only check syntax for subsequent hosts */
++		free(tmp_user);
++		free(tmp_host);
++		tmp_user = tmp_host = NULL;
++		tmp_port = -1;
+ 	} while (cp != sdup);
++
+ 	/* success */
+ 	if (active) {
+-		if (strcasecmp(s, "none") == 0) {
+-			o->jump_host = xstrdup("none");
+-			o->jump_port = 0;
+-		} else {
+-			o->jump_user = user;
+-			o->jump_host = host;
+-			o->jump_port = port;
+-			o->proxy_command = xstrdup("none");
+-			user = host = NULL;
+-			if ((cp = strrchr(s, ',')) != NULL && cp != s) {
+-				o->jump_extra = xstrdup(s);
+-				o->jump_extra[cp - s] = '\0';
+-			}
++		o->jump_user = user;
++		o->jump_host = host;
++		o->jump_port = port;
++		o->proxy_command = xstrdup("none");
++		user = host = NULL; /* transferred */
++		if (orig != NULL && (cp = strrchr(orig, ',')) != NULL) {
++			o->jump_extra = xstrdup(orig);
++			o->jump_extra[cp - orig] = '\0';
+ 		}
+ 	}
+ 	ret = 0;
+  out:
+ 	free(orig);
++	free(sdup);
++	free(tmp_user);
++	free(tmp_host);
+ 	free(user);
+ 	free(host);
+ 	return ret;
+diff --color -ruNp a/readconf.h b/readconf.h
+--- a/readconf.h	2026-04-17 16:59:35.594780872 +0200
++++ b/readconf.h	2026-04-20 09:56:46.827163792 +0200
+@@ -250,7 +250,9 @@ int	 process_config_line(Options *, stru
+ int	 read_config_file(const char *, struct passwd *, const char *,
+     const char *, const char *, Options *, int, int *);
+ int	 parse_forward(struct Forward *, const char *, int, int);
+-int	 parse_jump(const char *, Options *, int);
++int	 ssh_valid_hostname(const char *);
++int	 ssh_valid_ruser(const char *);
++int	 parse_jump(const char *, Options *, int, int);
+ int	 parse_ssh_uri(const char *, char **, char **, int *);
+ int	 default_ssh_port(void);
+ int	 option_clear_or_none(const char *);
+diff --color -ruNp a/regress/Makefile b/regress/Makefile
+--- a/regress/Makefile	2026-04-17 16:59:35.947544294 +0200
++++ b/regress/Makefile	2026-04-20 09:56:46.827690959 +0200
+@@ -112,7 +112,8 @@ LTESTS= 	connect \
+ 		agent-pkcs11-restrict \
+ 		agent-pkcs11-cert \
+ 		penalty \
+-		penalty-expire
++		penalty-expire \
++		proxyjump
+ 
+ INTEROP_TESTS=	putty-transfer putty-ciphers putty-kex conch-ciphers
+ INTEROP_TESTS+=	dropbear-ciphers dropbear-kex
+diff --color -ruNp a/regress/percent.sh b/regress/percent.sh
+--- a/regress/percent.sh	2025-04-09 09:02:43.000000000 +0200
++++ b/regress/percent.sh	2026-04-20 12:27:21.300703477 +0200
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: percent.sh,v 1.21 2025/04/08 23:10:46 djm Exp $
++#	$OpenBSD: percent.sh,v 1.23 2026/04/02 07:52:15 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="percent expansions"
+@@ -33,14 +33,14 @@ trial()
+ 		if [ "$arg" = '%r' ] || [ "$arg" = '%C' ]; then
+ 			# User does not support %r, ie itself or %C.  Skip test.
+ 			got="$expect"
+-		elif [ "$i" = "user" ]; then
++		elif [ "$opt" = "user" ]; then
+ 			got=`${SSH} -F $OBJ/ssh_proxy -o $opt="$arg" -G \
+ 			    remuser@somehost | awk '$1=="'$opt'"{print $2}'`
+-		elif [ "$i" = "user-l" ]; then
++		elif [ "$opt" = "user-l" ]; then
+ 			# Also test ssh -l
+ 			got=`${SSH} -F $OBJ/ssh_proxy -l "$arg" -G \
+ 			    somehost | awk '$1=="'user'"{print $2}'`
+-		elif [ "$i" = "user-at" ]; then
++		elif [ "$opt" = "user-at" ]; then
+ 			# Also test user@host
+ 			got=`${SSH} -F $OBJ/ssh_proxy -G "$arg@somehost" | \
+ 			    awk '$1=="'user'"{print $2}'`
+@@ -91,7 +91,7 @@ trial()
+ 
+ for i in matchexec localcommand remotecommand controlpath identityagent \
+     forwardagent localforward remoteforward revokedhostkeys \
+-    user user-l user-at setenv userknownhostsfile; do
++    user setenv userknownhostsfile; do
+ 	verbose $tid $i percent
+ 	case "$i" in
+ 	localcommand|userknownhostsfile)
+@@ -137,11 +137,11 @@ done
+ 
+ # Subset of above since we don't expand shell-style variables on anything that
+ # runs a command because the shell will expand those.
++FOO=bar
++export FOO
+ for i in controlpath identityagent forwardagent localforward remoteforward \
+-    user user-l user-at setenv userknownhostsfile; do
++    setenv userknownhostsfile; do
+ 	verbose $tid $i dollar
+-	FOO=bar
+-	export FOO
+ 	trial $i '${FOO}' $FOO
+ done
+ 
+@@ -152,3 +152,32 @@ for i in controlpath identityagent forwa
+ 	trial $i '~' $HOME/
+ 	trial $i '~/.ssh' $HOME/.ssh
+ done
++
++for i in user-l user-at; do
++	verbose $tid $i noexpand
++	trial $i '%u' '%u'
++done
++
++# These should be not be expanded but rejected for containing shell characters.
++verbose $tid user-l noenv
++${SSH} -F $OBJ/ssh_proxy -l '${FOO}' -G somehost && fail "user-l expanded env"
++verbose $tid user-at noenv
++${SSH} -F $OBJ/ssh_proxy -G '${FOO}@somehost' && fail "user-at expanded env"
++
++FOO=`printf 'x\ay'`
++export FOO
++
++# These should be rejected as containing control characters.
++verbose $tid user-l badchar
++${SSH} -F $OBJ/ssh_proxy -l "${FOO}" -G somehost && fail "user-l expanded env"
++verbose $tid user-at badchar
++${SSH} -F $OBJ/ssh_proxy -G "${FOO}@somehost" && fail "user-at expanded env"
++
++# Literal control characters in config is acceptable
++verbose $tid user control-literal
++#trial user "$FOO" "$FOO"
++
++# Control characters expanded from config aren't.
++${SSH} -F $OBJ/ssh_proxy -G '-oUser=${FOO}' somehost && \
++    fail "user expanded ctrl"
++
+diff --color -ruNp a/regress/proxyjump.sh b/regress/proxyjump.sh
+--- a/regress/proxyjump.sh	1970-01-01 01:00:00.000000000 +0100
++++ b/regress/proxyjump.sh	2026-04-20 09:56:46.828041393 +0200
+@@ -0,0 +1,102 @@
++#	$OpenBSD: proxyjump.sh,v 1.1 2026/03/30 07:19:02 djm Exp $
++#	Placed in the Public Domain.
++
++tid="proxyjump"
++
++# Parsing tests
++verbose "basic parsing"
++for jspec in \
++	"jump1" \
++	"user@jump1" \
++	"jump1:2222" \
++	"user@jump1:2222" \
++	"jump1,jump2" \
++	"user1@jump1:2221,user2@jump2:2222" \
++	"ssh://user@host:2223" \
++	; do
++	case "$jspec" in
++	"jump1")		expected="jump1" ;;
++	"user@jump1")		expected="user@jump1" ;;
++	"jump1:2222")		expected="jump1:2222" ;;
++	"user@jump1:2222")	expected="user@jump1:2222" ;;
++	"jump1,jump2")		expected="jump1,jump2" ;;
++	"user1@jump1:2221,user2@jump2:2222")
++		expected="user1@jump1:2221,user2@jump2:2222" ;;
++	"ssh://user@host:2223")	expected="user@host:2223" ;;
++	esac
++	f=`${SSH} -GF /dev/null -oProxyJump="$jspec" somehost | \
++		awk '/^proxyjump /{print $2}'`
++	if [ "$f" != "$expected" ]; then
++		fail "ProxyJump $jspec: expected $expected, got $f"
++	fi
++	f=`${SSH} -GF /dev/null -J "$jspec" somehost | \
++		awk '/^proxyjump /{print $2}'`
++	if [ "$f" != "$expected" ]; then
++		fail "ssh -J $jspec: expected $expected, got $f"
++	fi
++done
++
++verbose "precedence"
++f=`${SSH} -GF /dev/null -oProxyJump=none -oProxyJump=jump1 somehost | \
++	grep "^proxyjump "`
++if [ -n "$f" ]; then
++	fail "ProxyJump=none first did not win"
++fi
++f=`${SSH} -GF /dev/null -oProxyJump=jump -oProxyCommand=foo somehost | \
++	grep "^proxyjump "`
++if [ "$f" != "proxyjump jump" ]; then
++	fail "ProxyJump first did not win over ProxyCommand"
++fi
++f=`${SSH} -GF /dev/null -oProxyCommand=foo -oProxyJump=jump somehost | \
++	grep "^proxycommand "`
++if [ "$f" != "proxycommand foo" ]; then
++	fail "ProxyCommand first did not win over ProxyJump"
++fi
++
++verbose "command-line -J invalid characters"
++cp $OBJ/ssh_config $OBJ/ssh_config.orig
++for jspec in \
++	"host;with;semicolon" \
++	"host'with'quote" \
++	"host\`with\`backtick" \
++	"host\$with\$dollar" \
++	"host(with)brace" \
++	"user;with;semicolon@host" \
++	"user'with'quote@host" \
++	"user\`with\`backtick@host" \
++	"user(with)brace@host" ; do
++	${SSH} -GF /dev/null -J "$jspec" somehost >/dev/null 2>&1
++	if [ $? -ne 255 ]; then
++		fail "ssh -J \"$jspec\" was not rejected"
++	fi
++	${SSH} -GF /dev/null -oProxyJump="$jspec" somehost >/dev/null 2>&1
++	if [ $? -ne 255 ]; then
++		fail "ssh -oProxyJump=\"$jspec\" was not rejected"
++	fi
++done
++# Special characters should be accepted in the config though.
++echo "ProxyJump user;with;semicolon@host;with;semicolon" >> $OBJ/ssh_config
++f=`${SSH} -GF $OBJ/ssh_config somehost | grep "^proxyjump "`
++if [ "$f" != "proxyjump user;with;semicolon@host;with;semicolon" ]; then
++	fail "ProxyJump did not allow special characters in config: $f"
++fi
++
++verbose "functional test"
++# Use different names to avoid the loop detection in ssh.c
++grep -iv HostKeyAlias $OBJ/ssh_config.orig > $OBJ/ssh_config
++cat << _EOF >> $OBJ/ssh_config
++Host jump-host
++	HostkeyAlias jump-host
++Host target-host
++	HostkeyAlias target-host
++_EOF
++cp $OBJ/known_hosts $OBJ/known_hosts.orig
++sed 's/^[^ ]* /jump-host /' < $OBJ/known_hosts.orig > $OBJ/known_hosts
++sed 's/^[^ ]* /target-host /' < $OBJ/known_hosts.orig >> $OBJ/known_hosts
++start_sshd
++
++verbose "functional ProxyJump"
++res=`${REAL_SSH} -F $OBJ/ssh_config -J jump-host target-host echo "SUCCESS" 2>/dev/null`
++if [ "$res" != "SUCCESS" ]; then
++	fail "functional test failed: expected SUCCESS, got $res"
++fi
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2026-04-17 16:59:36.459922052 +0200
++++ b/ssh.c	2026-04-20 12:39:35.114670069 +0200
+@@ -633,41 +633,6 @@ ssh_conn_info_free(struct ssh_conn_info
+ 	free(cinfo);
+ }
+ 
+-static int
+-valid_hostname(const char *s)
+-{
+-	size_t i;
+-
+-	if (*s == '-')
+-		return 0;
+-	for (i = 0; s[i] != 0; i++) {
+-		if (strchr("'`\"$\\;&<>|(){},", s[i]) != NULL ||
+-		    isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
+-			return 0;
+-	}
+-	return 1;
+-}
+-
+-static int
+-valid_ruser(const char *s)
+-{
+-	size_t i;
+-
+-	if (*s == '-')
+-		return 0;
+-	for (i = 0; s[i] != 0; i++) {
+-		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
+-			return 0;
+-		/* Disallow '-' after whitespace */
+-		if (isspace((u_char)s[i]) && s[i + 1] == '-')
+-			return 0;
+-		/* Disallow \ in last position */
+-		if (s[i] == '\\' && s[i + 1] == '\0')
+-			return 0;
+-	}
+-	return 1;
+-}
+-
+ /*
+  * Main program for the ssh client.
+  */
+@@ -677,6 +642,7 @@ main(int ac, char **av)
+ 	struct ssh *ssh = NULL;
+ 	int i, r, opt, exit_status, use_syslog, direct, timeout_ms;
+ 	int was_addr, config_test = 0, opt_terminated = 0, want_final_pass = 0;
++	int user_on_commandline = 0, user_was_default = 0, user_expanded = 0;
+ 	char *p, *cp, *line, *argv0, *logfile, *args;
+ 	char cname[NI_MAXHOST], thishost[NI_MAXHOST];
+ 	struct stat st;
+@@ -925,9 +891,8 @@ main(int ac, char **av)
+ 			}
+ 			if (options.proxy_command != NULL)
+ 				fatal("Cannot specify -J with ProxyCommand");
+-			if (parse_jump(optarg, &options, 1) == -1)
++			if (parse_jump(optarg, &options, 1, 1) == -1)
+ 				fatal("Invalid -J argument");
+-			options.proxy_command = xstrdup("none");
+ 			break;
+ 		case 't':
+ 			if (options.request_tty == REQUEST_TTY_YES)
+@@ -1036,8 +1001,10 @@ main(int ac, char **av)
+ 			}
+ 			break;
+ 		case 'l':
+-			if (options.user == NULL)
++			if (options.user == NULL) {
+ 				options.user = xstrdup(optarg);
++				user_on_commandline = 1;
++			}
+ 			break;
+ 
+ 		case 'L':
+@@ -1140,6 +1107,7 @@ main(int ac, char **av)
+ 			if (options.user == NULL) {
+ 				options.user = tuser;
+ 				tuser = NULL;
++				user_on_commandline = 1;
+ 			}
+ 			free(tuser);
+ 			if (options.port == -1 && tport != -1)
+@@ -1154,6 +1122,7 @@ main(int ac, char **av)
+ 				if (options.user == NULL) {
+ 					options.user = p;
+ 					p = NULL;
++					user_on_commandline = 1;
+ 				}
+ 				*cp++ = '\0';
+ 				host = xstrdup(cp);
+@@ -1173,8 +1142,15 @@ main(int ac, char **av)
+ 	if (!host)
+ 		usage();
+ 
+-	if (!valid_hostname(host))
++	/*
++	 * Validate commandline-specified values that end up in %tokens
++	 * before they are used in config parsing.
++	 */
++	if (options.user != NULL && !ssh_valid_ruser(options.user))
++		fatal("remote username contains invalid characters");
++	if (!ssh_valid_hostname(host))
+ 		fatal("hostname contains invalid characters");
++
+ 	options.host_arg = xstrdup(host);
+ 
+ 	/* Initialize the command to execute on remote host. */
+@@ -1313,8 +1289,10 @@ main(int ac, char **av)
+ 	if (fill_default_options(&options) != 0)
+ 		cleanup_exit(255);
+ 
+-	if (options.user == NULL)
++	if (options.user == NULL) {
++		user_was_default = 1;
+ 		options.user = xstrdup(pw->pw_name);
++	}
+ 
+ 	/*
+ 	 * If ProxyJump option specified, then construct a ProxyCommand now.
+@@ -1342,7 +1320,8 @@ main(int ac, char **av)
+ 			sshbin = "ssh";
+ 
+ 		/* Consistency check */
+-		if (options.proxy_command != NULL)
++		if (options.proxy_command != NULL &&
++		    strcasecmp(options.proxy_command, "none") != 0)
+ 			fatal("inconsistent options: ProxyCommand+ProxyJump");
+ 		/* Never use FD passing for ProxyJump */
+ 		options.proxy_use_fdpass = 0;
+@@ -1462,20 +1441,30 @@ main(int ac, char **av)
+ 	    "" : options.jump_host);
+ 
+ 	/*
+-	 * Expand User. It cannot contain %r (itself) or %C since User is
++	 * If the user was specified via a configuration directive then attempt
++	 * to expand it. It cannot contain %r (itself) or %C since User is
+ 	 * a component of the hash.
+ 	 */
+-	if (options.user != NULL) {
++	if (!user_on_commandline && !user_was_default) {
+ 		if ((p = percent_dollar_expand(options.user,
+ 		    DEFAULT_CLIENT_PERCENT_EXPAND_ARGS_NOUSER(cinfo),
+ 		    (char *)NULL)) == NULL)
+ 			fatal("invalid environment variable expansion");
++		user_expanded = strcmp(p, options.user) != 0;
+ 		free(options.user);
+ 		options.user = p;
+-		if (!valid_ruser(options.user))
+-			fatal("remote username contains invalid characters");
+ 	}
+ 
++	/*
++	 * Usernames specified on the commandline or expanded from the
++	 * configuration file must be validated.
++	 * Conversely, usernames from getpwnam(3) or specified as literals
++	 * via configuration (i.e. not expanded) are not subject to validation.
++	 */
++	if ((user_on_commandline || user_expanded) &&
++	    !ssh_valid_ruser(options.user))
++		fatal("remote username contains invalid characters");
++
+ 	/* Now User is expanded, store it and calculate hash. */
+ 	cinfo->remuser = xstrdup(options.user);
+ 	cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost,

diff --git a/2000-openssh-10.0p1-gsissh.patch b/2000-openssh-10.0p1-gsissh.patch
index 4a1a329..c77be99 100644
--- a/2000-openssh-10.0p1-gsissh.patch
+++ b/2000-openssh-10.0p1-gsissh.patch
@@ -2119,20 +2119,16 @@ diff -Nur openssh-10.0p1.orig/ssh.c openssh-10.0p1/ssh.c
  		r = snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir,
  		    _PATH_SSH_USER_CONFFILE);
  		if (r > 0 && (size_t)r < sizeof(buf))
-@@ -1313,8 +1345,12 @@
- 	if (fill_default_options(&options) != 0)
- 		cleanup_exit(255);
- 
--	if (options.user == NULL)
-+	if (options.user == NULL) {
+@@ -1313,6 +1345,9 @@
+ 	if (options.user == NULL) {
+ 		user_was_default = 1;
  		options.user = xstrdup(pw->pw_name);
 +		options.implicit = 1;
 +	} else {
 +		options.implicit = 0;
-+	}
+ 	}
  
  	/*
- 	 * If ProxyJump option specified, then construct a ProxyCommand now.
 diff -Nur openssh-10.0p1.orig/ssh_config openssh-10.0p1/ssh_config
 --- openssh-10.0p1.orig/ssh_config	2025-06-14 08:24:54.955694862 +0200
 +++ openssh-10.0p1/ssh_config	2025-06-14 08:25:50.334427503 +0200

diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 4451164..fc16180 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -28,7 +28,7 @@
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
 Version: %{openssh_ver}
-Release: 4%{?dist}
+Release: 5%{?dist}
 Provides: gsissh = %{version}-%{release}
 Obsoletes: gsissh < 5.8p2-2
 URL: http://www.openssh.com/portable.html
@@ -161,6 +161,22 @@ Patch0051: 0051-Provide-better-error-for-non-supported-private-keys.patch
 Patch0052: 0052-Ignore-bad-hostkeys-in-known_hosts-file.patch
 # https://github.com/openssh/openssh-portable/pull/500
 Patch0053: 0053-support-authentication-indicators-in-GSSAPI.patch
+# upstream 487e8ac146f7d6616f65c125d5edb210519b833a
+Patch0054: 0054-openssh-9.9p1-scp-clear-setuid.patch
+# upstream c805b97b67c774e0bf922ffb29dfbcda9d7b5add
+Patch0055: 0055-openssh-9.9p1-mux-askpass-check.patch
+# upstream fd1c7e131f331942d20f42f31e79912d570081fa
+Patch0056: 0056-openssh-9.9p1-ecdsa-incomplete-application.patch
+# upstream fd1c7e131f331942d20f42f31e79912d570081fa
+Patch0057: 0057-openssh-9.9p1-authorized-keys-principles-option.patch
+# upstream 43b3bff47bb029f2299bacb6a36057981b39fdb0
+Patch0058: 0058-openssh-9.9p1-reject-null-char-in-url-string.patch
+# upstream 35d5917652106aede47621bb3f64044604164043
+# upstream 76685c9b09a66435cd2ad8373246adf1c53976d3
+# upstream 0a0ef4515361143cad21afa072319823854c1cf6
+# upstream 607bd871ec029e9aa22e632a22547250f3cae223
+# upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
+Patch0059: 0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch1000: 1000-openssh-coverity.patch
@@ -173,7 +189,7 @@ Patch2000: 2000-openssh-10.0p1-gsissh.patch
 # Based on https://github.com/rapier1/hpn-ssh/ tag: hpn-18.7.0
 Patch2001: 2001-openssh-10.0p1-hpn-18.7.0.patch
 
-License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
+License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
 Requires: openssl-libs >= 3.5.0
 
@@ -498,6 +514,9 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Wed May 27 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-5
+- Based on openssh-10.0p1-9.fc43
+
 * Thu Mar 19 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-4
 - Based on openssh-10.0p1-7.fc43