[rpms/openssh] f44: Improve GSS KEX algorithms documentation

[rpms/openssh] f44: Improve GSS KEX algorithms documentation

[Dmitry Belyavskiy]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f44
            Commit : 5157949345abe927f77ef06d15968c6bfd700f18
            Author : Dmitry Belyavskiy <dbelyavs@redhat.com>
            Date   : 2026-07-07T15:30:33+02:00
            Stats  : +49/-24 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/5157949345abe927f77ef06d15968c6bfd700f18?branch=f44

            Log:
            Improve GSS KEX algorithms documentation

Patches are submitted by xspielinbox+redhat@protonmail.com
Resolves: rhbz#2241564

---
diff --git a/0011-openssh-9.6p1-gssapi-keyex.patch b/0011-openssh-9.6p1-gssapi-keyex.patch
index 610e76e..0ec9c7c 100644
--- a/0011-openssh-9.6p1-gssapi-keyex.patch
+++ b/0011-openssh-9.6p1-gssapi-keyex.patch
@@ -1324,6 +1324,19 @@ index a20ce602a..31e395aa2 100644
  	return NULL;
  }
  
+@@ -174,6 +207,12 @@ kex_names_valid(const char *names)
+ 		return 0;
+ 	for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 	    (p = strsep(&cp, ","))) {
++		if (strncmp(p, "gss-", 4) == 0
++		  && kex_alg_by_name(p) != NULL) {
++			error("GSSAPI KEX algorithm \"%.100s\" is only allowed in GSSAPIKexAlgorithms", p);
++			free(s);
++			return 0;
++		}
+ 		if (kex_alg_by_name(p) == NULL) {
+ 			error("Unsupported KEX algorithm \"%.100s\"", p);
+ 			free(s);
 @@ -336,3 +369,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
  	free(ret);
  	return r;
@@ -1342,7 +1355,7 @@ index a20ce602a..31e395aa2 100644
 +	    (p = strsep(&cp, ","))) {
 +		if (strncmp(p, "gss-", 4) != 0
 +		  || kex_alg_by_name(p) == NULL) {
-+			error("Unsupported KEX algorithm \"%.100s\"", p);
++			error("Unsupported GSS KEX algorithm \"%.100s\"", p);
 +			free(s);
 +			return 0;
 +		}
@@ -3684,11 +3697,12 @@ diff --git a/ssh.c b/ssh.c
 index 3b03108db..8d27f6379 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -847,6 +847,8 @@ main(int ac, char **av)
+@@ -847,6 +847,9 @@ main(int ac, char **av)
  			else if (strcmp(optarg, "kex") == 0 ||
  			    strcasecmp(optarg, "KexAlgorithms") == 0)
  				cp = kex_alg_list('\n');
-+			else if (strcmp(optarg, "kex-gss") == 0)
++			else if (strcmp(optarg, "kex-gss") == 0 ||
++			    strcasecmp(optarg, "GSSAPIKexAlgorithms") == 0)
 +				cp = kex_gss_alg_list('\n');
  			else if (strcmp(optarg, "key") == 0)
  				cp = sshkey_alg_list(0, 0, 0, '\n');
@@ -3721,7 +3735,7 @@ diff --git a/ssh_config.5 b/ssh_config.5
 index f7066cbaa..8a4b469cf 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -976,10 +976,68 @@ The default is
+@@ -976,10 +976,71 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -3787,6 +3801,9 @@ index f7066cbaa..8a4b469cf 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
@@ -4173,7 +4190,7 @@ index aa9f0af76..b90068bf3 100644
  .It Cm GSSAPIStrictAcceptorCheck
  Determines whether to be strict about the identity of the GSSAPI acceptor
  a client authenticates against.
-@@ -753,6 +758,32 @@ machine's default store.
+@@ -753,6 +758,35 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
@@ -4203,6 +4220,9 @@ index aa9f0af76..b90068bf3 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
  Specifies the signature algorithms that will be accepted for hostbased
  authentication as a list of comma-separated patterns.

diff --git a/0026-openssh-8.0p1-crypto-policies.patch b/0026-openssh-8.0p1-crypto-policies.patch
index 5162ffa..59327a4 100644
--- a/0026-openssh-8.0p1-crypto-policies.patch
+++ b/0026-openssh-8.0p1-crypto-policies.patch
@@ -91,7 +91,7 @@ index 8a4b469cf..8ac5e1633 100644
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -1034,10 +1033,8 @@ gss-nistp256-sha256-,
+@@ -1034,9 +1033,6 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -99,10 +99,8 @@ index 8a4b469cf..8ac5e1633 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
-+.Pp
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
 @@ -1056,36 +1053,25 @@ will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
@@ -178,7 +176,7 @@ index 8a4b469cf..8ac5e1633 100644
  Specifies the permitted KEX (Key Exchange) algorithms that will be used and
  their preference order.
  The selected algorithm will be the first algorithm in this list that
-@@ -1368,29 +1370,17 @@ Multiple algorithms must be comma-separated.
+@@ -1371,28 +1372,16 @@ Multiple algorithms must be comma-separated.
  .Pp
  If the specified list begins with a
  .Sq +
@@ -207,11 +205,10 @@ index 8a4b469cf..8ac5e1633 100644
 -diffie-hellman-group18-sha512,
 -diffie-hellman-group14-sha256
 -.Ed
- .Pp
 +built-in openssh default set.
+ .Pp
  The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
- .It Cm KnownHostsCommand
 @@ -1506,37 +1496,33 @@ function, and all code in the
  file.
  This option is intended for debugging and no overrides are enabled by default.
@@ -307,7 +304,7 @@ index 8a4b469cf..8ac5e1633 100644
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
 +.Pp
 +This option affects also
-+.Cm HostKeyAlgorithms
++.Cm HostKeyAlgorithms .
  .It Cm PubkeyAuthentication
  Specifies whether to try public key authentication.
  The argument to this keyword must be
@@ -393,7 +390,7 @@ index a0fc6064f..c172d5aab 100644
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClientAliveCountMax
-@@ -774,53 +768,43 @@ For this to work
+@@ -774,56 +768,46 @@ For this to work
  .Cm GSSAPIKeyExchange
  needs to be enabled in the server and also used by the client.
  .It Cm GSSAPIKexAlgorithms
@@ -424,6 +421,9 @@ index a0fc6064f..c172d5aab 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .

diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index 8ef0722..dcce54f 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -113,8 +113,8 @@ index 31e395aa2..1360a4095 100644
  #endif
  
 @@ -208,7 +209,10 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			error("Unsupported KEX algorithm \"%.100s\"", p);
 +			if (FIPS_mode())

diff --git a/0048-support-authentication-indicators-in-GSSAPI.patch b/0048-support-authentication-indicators-in-GSSAPI.patch
index 19db102..3200fa8 100644
--- a/0048-support-authentication-indicators-in-GSSAPI.patch
+++ b/0048-support-authentication-indicators-in-GSSAPI.patch
@@ -441,10 +441,10 @@ diff --git a/sshd_config.5 b/sshd_config.5
 index c172d5aab..676d6d4d2 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -800,6 +800,52 @@ gss-nistp256-sha256-
- gss-curve25519-sha256-
- .Ed
- This option only applies to connections using GSSAPI.
+@@ -788,6 +788,52 @@ This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
 +.It Cm GSSAPIIndicators
 +Specifies whether to accept or deny GSSAPI authenticated access if Kerberos
 +mechanism is used and Kerberos ticket contains a particular set of

diff --git a/0049-NIST-curves-hybrid-KEX-implementation.patch b/0049-NIST-curves-hybrid-KEX-implementation.patch
index d0fb895..425f6f4 100644
--- a/0049-NIST-curves-hybrid-KEX-implementation.patch
+++ b/0049-NIST-curves-hybrid-KEX-implementation.patch
@@ -218,8 +218,8 @@ index 9c96e5cb0..d6e897301 100644
  	for (k = kexalgs; k->name != NULL; k++) {
  		if (strcmp(k->name, name) == 0)
 @@ -230,8 +289,16 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			if (FIPS_mode())
 -				error("\"%.100s\" is not allowed in FIPS mode", p);

diff --git a/openssh.spec b/openssh.spec
index 43f9acb..ffd8fc3 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 11%{?dist}
+Release: 12%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -588,6 +588,11 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Tue Jul 07 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.2p1-12
+- Improve GSS KEX algorithms documentation
+  Patches are submitted by xspielinbox+redhat@protonmail.com
+  Resolves: rhbz#2241564
+
 * Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.2p1-11
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
   FIPS known-group validation that leads to client-side denial of service