[rpms/openssh] rawhide: Improve GSS KEX algorithms documentation

[Dmitry Belyavskiy <dbelyavs@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : rawhide
            Commit : eba6246f724790c17a895e9c9151cd89caf6c84b
            Author : Dmitry Belyavskiy <dbelyavs@redhat.com>
            Date   : 2026-07-07T15:07:26+02:00
            Stats  : +50/-25 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/eba6246f724790c17a895e9c9151cd89caf6c84b?branch=rawhide

            Log:
            Improve GSS KEX algorithms documentation

Patches are submitted by xspielinbox+redhat@protonmail.com
Resolves: rhbz#2241564

---
diff --git a/0013-openssh-9.6p1-gssapi-keyex.patch b/0013-openssh-9.6p1-gssapi-keyex.patch
index 92eabd9..f2106a4 100644
--- a/0013-openssh-9.6p1-gssapi-keyex.patch
+++ b/0013-openssh-9.6p1-gssapi-keyex.patch
@@ -1333,6 +1333,19 @@ index 751f06cea..769a36810 100644
  	return NULL;
  }
  
+@@ -172,6 +206,12 @@ kex_names_valid(const char *names)
+ 		return 0;
+ 	for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 	    (p = strsep(&cp, ","))) {
++		if (strncmp(p, "gss-", 4) == 0
++		  && kex_alg_by_name(p) != NULL) {
++			error("GSSAPI KEX algorithm \"%.100s\" is only allowed in GSSAPIKexAlgorithms", p);
++			free(s);
++			return 0;
++		}
+ 		if (kex_alg_by_name(p) == NULL) {
+ 			error("Unsupported KEX algorithm \"%.100s\"", p);
+ 			free(s);
 @@ -334,3 +368,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
  	free(ret);
  	return r;
@@ -1351,7 +1364,7 @@ index 751f06cea..769a36810 100644
 +	    (p = strsep(&cp, ","))) {
 +		if (strncmp(p, "gss-", 4) != 0
 +		  || kex_alg_by_name(p) == NULL) {
-+			error("Unsupported KEX algorithm \"%.100s\"", p);
++			error("Unsupported GSS KEX algorithm \"%.100s\"", p);
 +			free(s);
 +			return 0;
 +		}
@@ -3703,11 +3716,12 @@ diff --git a/ssh.c b/ssh.c
 index 531f28eb2..bc3be8f8e 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -805,6 +805,8 @@ main(int ac, char **av)
+@@ -805,6 +805,9 @@ main(int ac, char **av)
  			else if (strcmp(optarg, "kex") == 0 ||
  			    strcasecmp(optarg, "KexAlgorithms") == 0)
  				cp = kex_alg_list('\n');
-+			else if (strcmp(optarg, "kex-gss") == 0)
++			else if (strcmp(optarg, "kex-gss") == 0 ||
++			    strcasecmp(optarg, "GSSAPIKexAlgorithms") == 0)
 +				cp = kex_gss_alg_list('\n');
  			else if (strcmp(optarg, "key") == 0)
  				cp = sshkey_alg_list(0, 0, 0, '\n');
@@ -3740,7 +3754,7 @@ diff --git a/ssh_config.5 b/ssh_config.5
 index b459b0449..9e5163774 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -976,10 +976,68 @@ The default is
+@@ -976,10 +976,71 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -3806,6 +3820,9 @@ index b459b0449..9e5163774 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
@@ -4202,7 +4219,7 @@ index ca425a8da..5928b6cd2 100644
  .It Cm GSSAPIStrictAcceptorCheck
  Determines whether to be strict about the identity of the GSSAPI acceptor
  a client authenticates against.
-@@ -769,6 +779,32 @@ machine's default store.
+@@ -769,6 +779,35 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
@@ -4232,6 +4249,9 @@ index ca425a8da..5928b6cd2 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
  Specifies the signature algorithms that will be accepted for hostbased
  authentication as a list of comma-separated patterns.

diff --git a/0027-openssh-8.0p1-crypto-policies.patch b/0027-openssh-8.0p1-crypto-policies.patch
index 375fad4..8596ce5 100644
--- a/0027-openssh-8.0p1-crypto-policies.patch
+++ b/0027-openssh-8.0p1-crypto-policies.patch
@@ -91,7 +91,7 @@ index 9e5163774..306fa1d8a 100644
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -1034,10 +1033,8 @@ gss-nistp256-sha256-,
+@@ -1034,9 +1033,6 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -99,11 +99,9 @@ index 9e5163774..306fa1d8a 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
-+.Pp
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
-@@ -1056,38 +1053,25 @@ will not be converted automatically,
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+@ -1056,38 +1053,25 @@ will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
  .It Cm HostbasedAcceptedAlgorithms
@@ -180,7 +178,7 @@ index 9e5163774..306fa1d8a 100644
  Specifies the permitted KEX (Key Exchange) algorithms that will be used and
  their preference order.
  The selected algorithm will be the first algorithm in this list that
-@@ -1372,29 +1372,17 @@ Multiple algorithms must be comma-separated.
+@@ -1375,28 +1374,16 @@ Multiple algorithms must be comma-separated.
  .Pp
  If the specified list begins with a
  .Sq +
@@ -209,11 +207,10 @@ index 9e5163774..306fa1d8a 100644
 -diffie-hellman-group18-sha512,
 -diffie-hellman-group14-sha256
 -.Ed
- .Pp
 +built-in openssh default set.
+ .Pp
  The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
- .It Cm KnownHostsCommand
 @@ -1510,37 +1498,33 @@ function, and all code in the
  file.
  This option is intended for debugging and no overrides are enabled by default.
@@ -311,7 +308,7 @@ index 9e5163774..306fa1d8a 100644
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
 +.Pp
 +This option affects also
-+.Cm HostKeyAlgorithms
++.Cm HostKeyAlgorithms .
  .It Cm PubkeyAuthentication
  Specifies whether to try public key authentication.
  The argument to this keyword must be
@@ -397,7 +394,7 @@ index 1762874c4..1d16dabaf 100644
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClientAliveCountMax
-@@ -789,55 +783,43 @@ For this to work
+@@ -789,58 +783,46 @@ For this to work
  .Cm GSSAPIKeyExchange
  needs to be enabled in the server and also used by the client.
  .It Cm GSSAPIKexAlgorithms
@@ -428,6 +425,9 @@ index 1762874c4..1d16dabaf 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .

diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index fa61658..19c1b21 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -114,8 +114,8 @@ index 769a36810..c0761ae8f 100644
  #endif
  
 @@ -207,7 +208,10 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			error("Unsupported KEX algorithm \"%.100s\"", p);
 +			if (FIPS_mode())

diff --git a/0047-support-authentication-indicators-in-GSSAPI.patch b/0047-support-authentication-indicators-in-GSSAPI.patch
index e875ef4..fd06bdf 100644
--- a/0047-support-authentication-indicators-in-GSSAPI.patch
+++ b/0047-support-authentication-indicators-in-GSSAPI.patch
@@ -429,10 +429,10 @@ diff --git a/sshd_config.5 b/sshd_config.5
 index 1d16dabaf..4ca80016c 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -800,6 +800,52 @@ gss-nistp256-sha256-
- gss-curve25519-sha256-
- .Ed
- This option only applies to connections using GSSAPI.
+@@ -803,6 +803,52 @@ This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
 +.It Cm GSSAPIIndicators
 +Specifies whether to accept or deny GSSAPI authenticated access if Kerberos
 +mechanism is used and Kerberos ticket contains a particular set of

diff --git a/0048-NIST-curves-hybrid-KEX-implementation.patch b/0048-NIST-curves-hybrid-KEX-implementation.patch
index 5810cfe..c7ab711 100644
--- a/0048-NIST-curves-hybrid-KEX-implementation.patch
+++ b/0048-NIST-curves-hybrid-KEX-implementation.patch
@@ -218,8 +218,8 @@ index 882f2905b..60fc487b0 100644
  	for (k = kexalgs; k->name != NULL; k++) {
  		if (strcmp(k->name, name) == 0)
 @@ -229,8 +288,16 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			if (FIPS_mode())
 -				error("\"%.100s\" is not allowed in FIPS mode", p);

diff --git a/openssh.spec b/openssh.spec
index 5986a53..f82c907 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -39,7 +39,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -514,6 +514,11 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Tue Jul 07 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.3p1-6
+- Improve GSS KEX algorithms documentation
+  Patches are submitted by xspielinbox+redhat@protonmail.com
+  Resolves: rhbz#2241564
+
 * Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.3p1-5
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
   FIPS known-group validation that leads to client-side denial of service