[rpms/gsi-openssh] rawhide: Based on openssh-10.3p1-8.fc45

[rpms/gsi-openssh] rawhide: Based on openssh-10.3p1-8.fc45

[Mattias Ellert]

A new commit has been pushed.

Repo   : rpms/gsi-openssh
Branch : rawhide
Commit : 5c1e298b4ba96cca6523a7982761167ca4cf66e3
Author : Mattias Ellert <mattias.ellert@physics.uu.se>
Date   : 2026-07-09T09:30:13+02:00
Stats  : +93/-134 in 8 file(s)
URL    : https://src.fedoraproject.org/rpms/gsi-openssh/c/5c1e298b4ba96cca6523a7982761167ca4cf66e3?branch=rawhide

Log:
Based on openssh-10.3p1-8.fc45

---
diff --git a/0008-openssh-7.2p2-x11.patch b/0008-openssh-7.2p2-x11.patch
deleted file mode 100644
index 8f92375..0000000
--- a/0008-openssh-7.2p2-x11.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 7c3ca5470c00d96996e40f449cb0a0465e81da95 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 08/54] openssh-7.2p2-x11
-
----
- channels.c | 25 +++++++++++++++++++------
- 1 file changed, 19 insertions(+), 6 deletions(-)
-
-diff --git a/channels.c b/channels.c
-index d7c55fc89..71cc67d17 100644
---- a/channels.c
-+++ b/channels.c
-@@ -5178,11 +5178,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
- }
- 
- static int
--connect_local_xsocket_path(const char *pathname)
-+connect_local_xsocket_path(const char *pathname, int len)
- {
- 	int sock;
- 	struct sockaddr_un addr;
- 
-+	if (len <= 0)
-+		return -1;
- 	sock = socket(AF_UNIX, SOCK_STREAM, 0);
- 	if (sock == -1) {
- 		error("socket: %.100s", strerror(errno));
-@@ -5190,11 +5192,12 @@ connect_local_xsocket_path(const char *pathname)
- 	}
- 	memset(&addr, 0, sizeof(addr));
- 	addr.sun_family = AF_UNIX;
--	strlcpy(addr.sun_path, pathname, sizeof addr.sun_path);
--	if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0)
-+	if (len > sizeof addr.sun_path)
-+		len = sizeof addr.sun_path;
-+	memcpy(addr.sun_path, pathname, len);
-+	if (connect(sock, (struct sockaddr *)&addr, sizeof addr - (sizeof addr.sun_path - len) ) == 0)
- 		return sock;
- 	close(sock);
--	error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
- 	return -1;
- }
- 
-@@ -5202,8 +5205,18 @@ static int
- connect_local_xsocket(u_int dnr)
- {
- 	char buf[1024];
--	snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr);
--	return connect_local_xsocket_path(buf);
-+	int len, ret;
-+	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
-+#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
-+#endif
-+	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
-+		return ret;
-+	error("connect %.100s: %.100s", buf + 1, strerror(errno));
-+	return -1;
- }
- 
- #ifdef __APPLE__
--- 
-2.53.0
-

diff --git a/0013-openssh-9.6p1-gssapi-keyex.patch b/0013-openssh-9.6p1-gssapi-keyex.patch
index 92eabd9..f2106a4 100644
--- a/0013-openssh-9.6p1-gssapi-keyex.patch
+++ b/0013-openssh-9.6p1-gssapi-keyex.patch
@@ -1333,6 +1333,19 @@ index 751f06cea..769a36810 100644
  	return NULL;
  }
  
+@@ -172,6 +206,12 @@ kex_names_valid(const char *names)
+ 		return 0;
+ 	for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 	    (p = strsep(&cp, ","))) {
++		if (strncmp(p, "gss-", 4) == 0
++		  && kex_alg_by_name(p) != NULL) {
++			error("GSSAPI KEX algorithm \"%.100s\" is only allowed in GSSAPIKexAlgorithms", p);
++			free(s);
++			return 0;
++		}
+ 		if (kex_alg_by_name(p) == NULL) {
+ 			error("Unsupported KEX algorithm \"%.100s\"", p);
+ 			free(s);
 @@ -334,3 +368,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
  	free(ret);
  	return r;
@@ -1351,7 +1364,7 @@ index 751f06cea..769a36810 100644
 +	    (p = strsep(&cp, ","))) {
 +		if (strncmp(p, "gss-", 4) != 0
 +		  || kex_alg_by_name(p) == NULL) {
-+			error("Unsupported KEX algorithm \"%.100s\"", p);
++			error("Unsupported GSS KEX algorithm \"%.100s\"", p);
 +			free(s);
 +			return 0;
 +		}
@@ -3703,11 +3716,12 @@ diff --git a/ssh.c b/ssh.c
 index 531f28eb2..bc3be8f8e 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -805,6 +805,8 @@ main(int ac, char **av)
+@@ -805,6 +805,9 @@ main(int ac, char **av)
  			else if (strcmp(optarg, "kex") == 0 ||
  			    strcasecmp(optarg, "KexAlgorithms") == 0)
  				cp = kex_alg_list('\n');
-+			else if (strcmp(optarg, "kex-gss") == 0)
++			else if (strcmp(optarg, "kex-gss") == 0 ||
++			    strcasecmp(optarg, "GSSAPIKexAlgorithms") == 0)
 +				cp = kex_gss_alg_list('\n');
  			else if (strcmp(optarg, "key") == 0)
  				cp = sshkey_alg_list(0, 0, 0, '\n');
@@ -3740,7 +3754,7 @@ diff --git a/ssh_config.5 b/ssh_config.5
 index b459b0449..9e5163774 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -976,10 +976,68 @@ The default is
+@@ -976,10 +976,71 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -3806,6 +3820,9 @@ index b459b0449..9e5163774 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
@@ -4202,7 +4219,7 @@ index ca425a8da..5928b6cd2 100644
  .It Cm GSSAPIStrictAcceptorCheck
  Determines whether to be strict about the identity of the GSSAPI acceptor
  a client authenticates against.
-@@ -769,6 +779,32 @@ machine's default store.
+@@ -769,6 +779,35 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
@@ -4232,6 +4249,9 @@ index ca425a8da..5928b6cd2 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
  Specifies the signature algorithms that will be accepted for hostbased
  authentication as a list of comma-separated patterns.

diff --git a/0027-openssh-8.0p1-crypto-policies.patch b/0027-openssh-8.0p1-crypto-policies.patch
index 375fad4..8a1b7d4 100644
--- a/0027-openssh-8.0p1-crypto-policies.patch
+++ b/0027-openssh-8.0p1-crypto-policies.patch
@@ -91,7 +91,7 @@ index 9e5163774..306fa1d8a 100644
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -1034,10 +1033,8 @@ gss-nistp256-sha256-,
+@@ -1034,9 +1033,6 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -99,10 +99,8 @@ index 9e5163774..306fa1d8a 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
-+.Pp
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
 @@ -1056,38 +1053,25 @@ will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
@@ -180,7 +178,7 @@ index 9e5163774..306fa1d8a 100644
  Specifies the permitted KEX (Key Exchange) algorithms that will be used and
  their preference order.
  The selected algorithm will be the first algorithm in this list that
-@@ -1372,29 +1372,17 @@ Multiple algorithms must be comma-separated.
+@@ -1375,28 +1374,16 @@ Multiple algorithms must be comma-separated.
  .Pp
  If the specified list begins with a
  .Sq +
@@ -209,11 +207,10 @@ index 9e5163774..306fa1d8a 100644
 -diffie-hellman-group18-sha512,
 -diffie-hellman-group14-sha256
 -.Ed
- .Pp
 +built-in openssh default set.
+ .Pp
  The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
- .It Cm KnownHostsCommand
 @@ -1510,37 +1498,33 @@ function, and all code in the
  file.
  This option is intended for debugging and no overrides are enabled by default.
@@ -311,7 +308,7 @@ index 9e5163774..306fa1d8a 100644
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
 +.Pp
 +This option affects also
-+.Cm HostKeyAlgorithms
++.Cm HostKeyAlgorithms .
  .It Cm PubkeyAuthentication
  Specifies whether to try public key authentication.
  The argument to this keyword must be
@@ -397,7 +394,7 @@ index 1762874c4..1d16dabaf 100644
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClientAliveCountMax
-@@ -789,55 +783,43 @@ For this to work
+@@ -789,58 +783,46 @@ For this to work
  .Cm GSSAPIKeyExchange
  needs to be enabled in the server and also used by the client.
  .It Cm GSSAPIKexAlgorithms
@@ -428,6 +425,9 @@ index 1762874c4..1d16dabaf 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .

diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index cbc9c5e..19c1b21 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -114,8 +114,8 @@ index 769a36810..c0761ae8f 100644
  #endif
  
 @@ -207,7 +208,10 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			error("Unsupported KEX algorithm \"%.100s\"", p);
 +			if (FIPS_mode())
@@ -276,17 +276,18 @@ index 1c2194a8f..f9a58b955 100644
  #include <sys/types.h>
  
  #include <openssl/bn.h>
-@@ -114,6 +115,10 @@ input_kex_dh_gex_group(int type, uint32_t seq, struct ssh *ssh)
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff --git a/myproposal.h b/myproposal.h
 index d992d8b12..6433e0820 100644
 --- a/myproposal.h

diff --git a/0047-support-authentication-indicators-in-GSSAPI.patch b/0047-support-authentication-indicators-in-GSSAPI.patch
index 1016890..fd06bdf 100644
--- a/0047-support-authentication-indicators-in-GSSAPI.patch
+++ b/0047-support-authentication-indicators-in-GSSAPI.patch
@@ -173,7 +173,7 @@ index 6eb7d2163..686ac4eb3 100644
  
  ssh_gssapi_mech gssapi_null_mech =
      { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
-@@ -297,6 +297,95 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
+@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
  	return GSS_S_COMPLETE;
  }
  
@@ -196,63 +196,67 @@ index 6eb7d2163..686ac4eb3 100644
 +	int is_mechname, authenticated, complete, more;
 +	size_t count, i;
 +
++	/* always initialize client->indicators */
++	client->indicators = NULL;
++
 +	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
 +				      &is_mechname, NULL, &attrs);
-+	if (ctx->major != GSS_S_COMPLETE) {
-+		return (ctx->major);
-+	}
++	if (ctx->major != GSS_S_COMPLETE)
++		return ctx->major;
 +
 +	if (attrs == GSS_C_NO_BUFFER_SET) {
-+		/* No indicators in the ticket */
-+		return (0);
++		/* no indicators in the ticket */
++		return GSS_S_COMPLETE;
 +	}
 +
-+	client->indicators = NULL;
++	/* client->indicators is NULL terminated */
 +	count = 0;
++	client->indicators = xcalloc(count + 1, sizeof(char *));
++
 +	for (i = 0; i < attrs->count; i++) {
 +		authenticated = 0;
 +		complete = 0;
 +		more = -1;
++
 +		/* skip anything but auth-indicators */
 +		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    memcmp(AUTH_INDICATORS_TAG,
-+			   attrs->elements[i].value,
++		    memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value,
 +			   sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
 +			continue;
++
 +		/* retrieve all indicators */
 +		while (more != 0) {
 +			value.value = NULL;
 +			display_value.value = NULL;
++
 +			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
-+							    &attrs->elements[i], &authenticated,
-+							    &complete, &value, &display_value, &more);
++							    &attrs->elements[i],
++							    &authenticated, &complete,
++							    &value, &display_value, &more);
 +			if (ctx->major != GSS_S_COMPLETE)
 +				goto out;
 +
-+			if ((value.value != NULL) && authenticated) {
-+				if (count >= SSH_GSSAPI_MAX_INDICATORS) {
-+					logit("ssh_gssapi_getindicators: too many "
-+					    "indicators, truncating at %d",
-+					    SSH_GSSAPI_MAX_INDICATORS);
-+					/* value/display_value released at out: */
-+					goto done;
-+				}
++			if (value.value == NULL || !authenticated)
++				continue;
 +
-+				client->indicators = xrecallocarray(client->indicators, count, count + 1, sizeof(char*));
-+				if (client->indicators == NULL) {
-+					fatal("ssh_gssapi_getindicators failed to allocate memory");
-+				}
-+				client->indicators[count] = xmalloc(value.length + 1);
-+				memcpy(client->indicators[count], value.value, value.length);
-+				client->indicators[count][value.length] = '\0';
-+				count++;
++			if (count >= SSH_GSSAPI_MAX_INDICATORS) {
++				logit("ssh_gssapi_getindicators:"
++				      " too many indicators, truncating at %d",
++				      SSH_GSSAPI_MAX_INDICATORS);
++				goto out;
 +			}
++
++			client->indicators[count] = xmalloc(value.length + 1);
++			memcpy(client->indicators[count], value.value, value.length);
++			client->indicators[count][value.length] = '\0';
++			count++;
++
++			/* add NULL terminator */
++			client->indicators = xrecallocarray(client->indicators, count,
++							    count + 1, sizeof(char *));
 +		}
 +	}
 +
-+done:
-+	/* slot [count] is zeroed by recallocarray, serves as NULL sentinel */
-+
 +out:
 +	if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) {
 +		for (i = 0; i < count; i++)
@@ -260,10 +264,10 @@ index 6eb7d2163..686ac4eb3 100644
 +		free(client->indicators);
 +		client->indicators = NULL;
 +	}
-+	(void) gss_release_buffer(&ctx->minor, &value);
-+	(void) gss_release_buffer(&ctx->minor, &display_value);
-+	(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+	return (ctx->major);
++	gss_release_buffer(&ctx->minor, &value);
++	gss_release_buffer(&ctx->minor, &display_value);
++	gss_release_buffer_set(&ctx->minor, &attrs);
++	return ctx->major;
 +}
 +
  /* Extract the client details from a given context. This can only reliably
@@ -425,10 +429,10 @@ diff --git a/sshd_config.5 b/sshd_config.5
 index 1d16dabaf..4ca80016c 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -800,6 +800,52 @@ gss-nistp256-sha256-
- gss-curve25519-sha256-
- .Ed
- This option only applies to connections using GSSAPI.
+@@ -803,6 +803,52 @@ This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
 +.It Cm GSSAPIIndicators
 +Specifies whether to accept or deny GSSAPI authenticated access if Kerberos
 +mechanism is used and Kerberos ticket contains a particular set of

diff --git a/0048-NIST-curves-hybrid-KEX-implementation.patch b/0048-NIST-curves-hybrid-KEX-implementation.patch
index 5810cfe..c7ab711 100644
--- a/0048-NIST-curves-hybrid-KEX-implementation.patch
+++ b/0048-NIST-curves-hybrid-KEX-implementation.patch
@@ -218,8 +218,8 @@ index 882f2905b..60fc487b0 100644
  	for (k = kexalgs; k->name != NULL; k++) {
  		if (strcmp(k->name, name) == 0)
 @@ -229,8 +288,16 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			if (FIPS_mode())
 -				error("\"%.100s\" is not allowed in FIPS mode", p);

diff --git a/2000-openssh-10.3p1-gsissh.patch b/2000-openssh-10.3p1-gsissh.patch
index 8214c14..c500089 100644
--- a/2000-openssh-10.3p1-gsissh.patch
+++ b/2000-openssh-10.3p1-gsissh.patch
@@ -765,8 +765,8 @@ diff -Nur openssh-10.3p1.orig/gss-serv.c openssh-10.3p1/gss-serv.c
   * indicators are GSSAPI name attributes for the name "auth-indicators".
   * Multiple indicators might be present in the ticket.
 @@ -385,6 +418,7 @@
- 	(void) gss_release_buffer_set(&ctx->minor, &attrs);
- 	return (ctx->major);
+ 	gss_release_buffer_set(&ctx->minor, &attrs);
+ 	return ctx->major;
  }
 +#endif
  

diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 774ff58..ce70fcb 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -28,7 +28,7 @@
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
 Version: %{openssh_ver}
-Release: 1%{?dist}
+Release: 2%{?dist}
 Provides: gsissh = %{version}-%{release}
 Obsoletes: gsissh < 5.8p2-2
 URL: http://www.openssh.com/portable.html
@@ -55,7 +55,6 @@ Patch0004: 0004-openssh-6.6p1-keycat.patch
 Patch0005: 0005-openssh-6.6p1-allow-ip-opts.patch
 Patch0006: 0006-openssh-5.9p1-ipv6man.patch
 Patch0007: 0007-openssh-5.8p2-sigpipe.patch
-Patch0008: 0008-openssh-7.2p2-x11.patch
 Patch0009: 0009-openssh-5.1p1-askpass-progress.patch
 Patch0010: 0010-openssh-4.3p2-askpass-grab-info.patch
 Patch0011: 0011-openssh-8.7p1-redhat.patch
@@ -438,6 +437,9 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Thu Jul 09 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.3p1-2
+- Based on openssh-10.3p1-8.fc45
+
 * Wed Jul 01 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.3p1-1
 - Based on openssh-10.3p1-4.fc45