[rpms/gsi-openssh] f44: Based on openssh-10.2p1-12.fc44

[Mattias Ellert <mattias.ellert@physics.uu.se>]

A new commit has been pushed.

Repo   : rpms/gsi-openssh
Branch : f44
Commit : 3cef0d08e2f3e9a3ebd2194b19cf8bcb9494ee6a
Author : Mattias Ellert <mattias.ellert@physics.uu.se>
Date   : 2026-07-09T14:08:22+02:00
Stats  : +195/-173 in 10 file(s)
URL    : https://src.fedoraproject.org/rpms/gsi-openssh/c/3cef0d08e2f3e9a3ebd2194b19cf8bcb9494ee6a?branch=f44

Log:
Based on openssh-10.2p1-12.fc44

---
diff --git a/0006-openssh-7.2p2-x11.patch b/0006-openssh-7.2p2-x11.patch
index dceef7b..7591be5 100644
--- a/0006-openssh-7.2p2-x11.patch
+++ b/0006-openssh-7.2p2-x11.patch
@@ -11,7 +11,7 @@ diff --git a/channels.c b/channels.c
 index 80014ff34..5ce6bd400 100644
 --- a/channels.c
 +++ b/channels.c
-@@ -5169,11 +5169,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+@@ -5178,11 +5178,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  }
  
  static int
@@ -26,7 +26,7 @@ index 80014ff34..5ce6bd400 100644
  	sock = socket(AF_UNIX, SOCK_STREAM, 0);
  	if (sock == -1) {
  		error("socket: %.100s", strerror(errno));
-@@ -5181,11 +5183,12 @@ connect_local_xsocket_path(const char *pathname)
+@@ -5190,11 +5192,12 @@ connect_local_xsocket_path(const char *pathname)
  	}
  	memset(&addr, 0, sizeof(addr));
  	addr.sun_family = AF_UNIX;
@@ -42,7 +42,7 @@ index 80014ff34..5ce6bd400 100644
  	return -1;
  }
  
-@@ -5193,8 +5196,18 @@ static int
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -51,10 +51,11 @@ index 80014ff34..5ce6bd400 100644
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;

diff --git a/0011-openssh-9.6p1-gssapi-keyex.patch b/0011-openssh-9.6p1-gssapi-keyex.patch
index 610e76e..0ec9c7c 100644
--- a/0011-openssh-9.6p1-gssapi-keyex.patch
+++ b/0011-openssh-9.6p1-gssapi-keyex.patch
@@ -1324,6 +1324,19 @@ index a20ce602a..31e395aa2 100644
  	return NULL;
  }
  
+@@ -174,6 +207,12 @@ kex_names_valid(const char *names)
+ 		return 0;
+ 	for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 	    (p = strsep(&cp, ","))) {
++		if (strncmp(p, "gss-", 4) == 0
++		  && kex_alg_by_name(p) != NULL) {
++			error("GSSAPI KEX algorithm \"%.100s\" is only allowed in GSSAPIKexAlgorithms", p);
++			free(s);
++			return 0;
++		}
+ 		if (kex_alg_by_name(p) == NULL) {
+ 			error("Unsupported KEX algorithm \"%.100s\"", p);
+ 			free(s);
 @@ -336,3 +369,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
  	free(ret);
  	return r;
@@ -1342,7 +1355,7 @@ index a20ce602a..31e395aa2 100644
 +	    (p = strsep(&cp, ","))) {
 +		if (strncmp(p, "gss-", 4) != 0
 +		  || kex_alg_by_name(p) == NULL) {
-+			error("Unsupported KEX algorithm \"%.100s\"", p);
++			error("Unsupported GSS KEX algorithm \"%.100s\"", p);
 +			free(s);
 +			return 0;
 +		}
@@ -3684,11 +3697,12 @@ diff --git a/ssh.c b/ssh.c
 index 3b03108db..8d27f6379 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -847,6 +847,8 @@ main(int ac, char **av)
+@@ -847,6 +847,9 @@ main(int ac, char **av)
  			else if (strcmp(optarg, "kex") == 0 ||
  			    strcasecmp(optarg, "KexAlgorithms") == 0)
  				cp = kex_alg_list('\n');
-+			else if (strcmp(optarg, "kex-gss") == 0)
++			else if (strcmp(optarg, "kex-gss") == 0 ||
++			    strcasecmp(optarg, "GSSAPIKexAlgorithms") == 0)
 +				cp = kex_gss_alg_list('\n');
  			else if (strcmp(optarg, "key") == 0)
  				cp = sshkey_alg_list(0, 0, 0, '\n');
@@ -3721,7 +3735,7 @@ diff --git a/ssh_config.5 b/ssh_config.5
 index f7066cbaa..8a4b469cf 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -976,10 +976,68 @@ The default is
+@@ -976,10 +976,71 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -3787,6 +3801,9 @@ index f7066cbaa..8a4b469cf 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
@@ -4173,7 +4190,7 @@ index aa9f0af76..b90068bf3 100644
  .It Cm GSSAPIStrictAcceptorCheck
  Determines whether to be strict about the identity of the GSSAPI acceptor
  a client authenticates against.
-@@ -753,6 +758,32 @@ machine's default store.
+@@ -753,6 +758,35 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
@@ -4203,6 +4220,9 @@ index aa9f0af76..b90068bf3 100644
 +.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 +gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
 +This option only applies to connections using GSSAPI.
++.Pp
++The list of supported key exchange algorithms may also be obtained using
++.Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
  Specifies the signature algorithms that will be accepted for hostbased
  authentication as a list of comma-separated patterns.

diff --git a/0026-openssh-8.0p1-crypto-policies.patch b/0026-openssh-8.0p1-crypto-policies.patch
index 5162ffa..59327a4 100644
--- a/0026-openssh-8.0p1-crypto-policies.patch
+++ b/0026-openssh-8.0p1-crypto-policies.patch
@@ -91,7 +91,7 @@ index 8a4b469cf..8ac5e1633 100644
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -1034,10 +1033,8 @@ gss-nistp256-sha256-,
+@@ -1034,9 +1033,6 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -99,10 +99,8 @@ index 8a4b469cf..8ac5e1633 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
-+.Pp
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
 @@ -1056,36 +1053,25 @@ will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
@@ -178,7 +176,7 @@ index 8a4b469cf..8ac5e1633 100644
  Specifies the permitted KEX (Key Exchange) algorithms that will be used and
  their preference order.
  The selected algorithm will be the first algorithm in this list that
-@@ -1368,29 +1370,17 @@ Multiple algorithms must be comma-separated.
+@@ -1371,28 +1372,16 @@ Multiple algorithms must be comma-separated.
  .Pp
  If the specified list begins with a
  .Sq +
@@ -207,11 +205,10 @@ index 8a4b469cf..8ac5e1633 100644
 -diffie-hellman-group18-sha512,
 -diffie-hellman-group14-sha256
 -.Ed
- .Pp
 +built-in openssh default set.
+ .Pp
  The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
- .It Cm KnownHostsCommand
 @@ -1506,37 +1496,33 @@ function, and all code in the
  file.
  This option is intended for debugging and no overrides are enabled by default.
@@ -307,7 +304,7 @@ index 8a4b469cf..8ac5e1633 100644
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
 +.Pp
 +This option affects also
-+.Cm HostKeyAlgorithms
++.Cm HostKeyAlgorithms .
  .It Cm PubkeyAuthentication
  Specifies whether to try public key authentication.
  The argument to this keyword must be
@@ -393,7 +390,7 @@ index a0fc6064f..c172d5aab 100644
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClientAliveCountMax
-@@ -774,53 +768,43 @@ For this to work
+@@ -774,56 +768,46 @@ For this to work
  .Cm GSSAPIKeyExchange
  needs to be enabled in the server and also used by the client.
  .It Cm GSSAPIKexAlgorithms
@@ -424,6 +421,9 @@ index a0fc6064f..c172d5aab 100644
 -.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
  .It Cm HostbasedAcceptedAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .

diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index 18ebed3..dcce54f 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -113,8 +113,8 @@ index 31e395aa2..1360a4095 100644
  #endif
  
 @@ -208,7 +209,10 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			error("Unsupported KEX algorithm \"%.100s\"", p);
 +			if (FIPS_mode())
@@ -275,17 +275,18 @@ index 097d83f30..ccbb9b580 100644
  #include <sys/types.h>
  
  #include "openbsd-compat/openssl-compat.h"
-@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32_t seq, struct ssh *ssh)
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff --git a/myproposal.h b/myproposal.h
 index 8fe9276c2..3e0ec6826 100644
 --- a/myproposal.h

diff --git a/0039-openssh-8.7p1-ssh-manpage.patch b/0039-openssh-8.7p1-ssh-manpage.patch
deleted file mode 100644
index d0e984d..0000000
--- a/0039-openssh-8.7p1-ssh-manpage.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 7167a191776dacf7e31cf8a8a2ed89887e49f4ee Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 39/53] openssh-8.7p1-ssh-manpage
-
----
- ssh.1 | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/ssh.1 b/ssh.1
-index 6a9fbdc5b..755cdef2b 100644
---- a/ssh.1
-+++ b/ssh.1
-@@ -510,12 +510,12 @@ For full details of the options listed below, and their possible values, see
- .It BatchMode
- .It BindAddress
- .It BindInterface
--.It CASignatureAlgorithms
- .It CanonicalDomains
- .It CanonicalizeFallbackLocal
- .It CanonicalizeHostname
- .It CanonicalizeMaxDots
- .It CanonicalizePermittedCNAMEs
-+.It CASignatureAlgorithms
- .It CertificateFile
- .It ChannelTimeout
- .It CheckHostIP
-@@ -528,6 +528,7 @@ For full details of the options listed below, and their possible values, see
- .It ControlPath
- .It ControlPersist
- .It DynamicForward
-+.It EnableSSHKeysign
- .It EnableEscapeCommandline
- .It EnableSSHKeysign
- .It EscapeChar
-@@ -588,6 +589,8 @@ For full details of the options listed below, and their possible values, see
- .It RemoteCommand
- .It RemoteForward
- .It RequestTTY
-+.It RevokedHostKeys
-+.It SecurityKeyProvider
- .It RequiredRSASize
- .It RevokedHostKeys
- .It SecurityKeyProvider
--- 
-2.52.0
-

diff --git a/0048-support-authentication-indicators-in-GSSAPI.patch b/0048-support-authentication-indicators-in-GSSAPI.patch
index 664a006..3200fa8 100644
--- a/0048-support-authentication-indicators-in-GSSAPI.patch
+++ b/0048-support-authentication-indicators-in-GSSAPI.patch
@@ -52,7 +52,7 @@ index 03188d9b3..2c786ef14 100644
  
  #include "ssh-gss.h"
  
-@@ -87,6 +88,32 @@ ssh_gssapi_krb5_init(void)
+@@ -87,6 +88,33 @@ ssh_gssapi_krb5_init(void)
  	return 1;
  }
  
@@ -67,6 +67,7 @@ index 03188d9b3..2c786ef14 100644
 +{
 +	int ret;
 +	u_int i;
++	*matched = -1;
 +
 +	/* Check indicators */
 +	for (i = 0; client->indicators[i] != NULL; i++) {
@@ -85,68 +86,97 @@ index 03188d9b3..2c786ef14 100644
  /* Check if this user is OK to login. This only works with krb5 - other
   * GSSAPI mechanisms will need their own.
   * Returns true if the user is OK to log in, otherwise returns 0
-@@ -193,7 +220,7 @@ static int
+@@ -193,15 +221,15 @@ static int
  ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  {
  	krb5_principal princ;
 -	int retval;
-+	int retval, matched;
++	int retval, matched, success;
  	const char *errmsg;
  	int k5login_exists;
  
-@@ -216,17 +243,42 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+ 	if (ssh_gssapi_krb5_init() == 0)
+ 		return 0;
+ 
+-	if ((retval = krb5_parse_name(krb_context, client->exportedname.value,
+-	    &princ))) {
++	retval = krb5_parse_name(krb_context, client->exportedname.value, &princ);
++	if (retval) {
+ 		errmsg = krb5_get_error_message(krb_context, retval);
+ 		logit("krb5_parse_name(): %.100s", errmsg);
+ 		krb5_free_error_message(krb_context, errmsg);
+@@ -216,17 +244,60 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  	if (k5login_exists &&
  	    ssh_krb5_kuserok(krb_context, princ, name, k5login_exists)) {
  		retval = 1;
 -		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
 -		    name, (char *)client->displayname.value);
-+	    errmsg = "krb5_kuserok";
++		errmsg = "krb5_kuserok";
  	} else if (ssh_gssapi_krb5_cmdok(princ, client->exportedname.value,
  		name, k5login_exists)) {
  		retval = 1;
 -		logit("Authorized to %s, krb5 principal %s "
 -		    "(ssh_gssapi_krb5_cmdok)",
 -		    name, (char *)client->displayname.value);
+-	} else
 +		errmsg = "ssh_gssapi_krb5_cmdok";
- 	} else
++	} else {
  		retval = 0;
++		goto out;
++	}
  
-+	if ((retval == 1) && (options.gss_indicators != NULL)) {
-+		/* At this point the configuration enforces presence of indicators
-+		 * so we drop the authorization result again */
++	/* At this point we are good if no indicators were defined */
++	if (options.gss_indicators == NULL) {
++		retval = 1;
++		goto out;
++	}
++
++	/* At this point we have indicators defined in the configuration,
++	 * if clientt did not provide any indicators, we reject */
++	if (!client->indicators) {
 +		retval = 0;
-+		if (client->indicators) {
-+			matched = -1;
-+			retval = ssh_gssapi_check_indicators(client, &matched);
-+			if (retval != 0) {
-+				retval = (retval == 1);
-+				logit("Ticket contains indicator %s, "
-+					"krb5 principal %s is %s",
-+					client->indicators[matched],
-+					(char *)client->displayname.value,
-+				        retval ? "allowed" : "denied");
-+				goto cont;
-+			}
-+		}
-+		if (retval == 0) {
-+			logit("GSSAPI authentication indicators enforced "
-+				"but not matched. krb5 principal %s denied",
-+			(char *)client->displayname.value);
-+		}
++		logit("GSSAPI authentication indicators enforced "
++		      "but indicators not provided by the client. "
++		      "krb5 principal %s denied",
++		      (char *)client->displayname.value);
++		goto out;
++	}
++
++	/* At this point the configuration enforces presence of indicators
++	 * check the match */
++	matched = -1;
++	success = ssh_gssapi_check_indicators(client, &matched);
++
++	switch (success) {
++	case 1:
++		logit("Provided indicator %s allowed by the configuration",
++		      client->indicators[matched]);
++		retval = 1;
++		break;
++	case -1:
++		logit("Provided indicator %s rejected by the configuration",
++		      client->indicators[matched]);
++		retval = 0;
++		break;
++	default:
++		logit("Provided indicators do not match the configuration");
++		retval = 0;
++		break;
 +	}
-+cont:
++
++out:
 +	if (retval == 1) {
 +		logit("Authorized to %s, krb5 principal %s (%s)",
-+		    name, (char *)client->displayname.value, errmsg);
++		      name, (char *)client->displayname.value, errmsg);
 +	}
  	krb5_free_principal(krb_context, princ);
  	return retval;
  }
 diff --git a/gss-serv.c b/gss-serv.c
-index d2bc03486..be80e17ca 100644
+index 6eb7d2163..686ac4eb3 100644
 --- a/gss-serv.c
 +++ b/gss-serv.c
-@@ -54,7 +54,7 @@ extern ServerOptions options;
+@@ -55,7 +55,7 @@ extern ServerOptions options;
  
  static ssh_gssapi_client gssapi_client =
      { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
@@ -155,7 +185,7 @@ index d2bc03486..be80e17ca 100644
  
  ssh_gssapi_mech gssapi_null_mech =
      { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
-@@ -296,6 +296,92 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
+@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
  	return GSS_S_COMPLETE;
  }
  
@@ -163,9 +193,10 @@ index d2bc03486..be80e17ca 100644
 +/* Extract authentication indicators from the Kerberos ticket. Authentication
 + * indicators are GSSAPI name attributes for the name "auth-indicators".
 + * Multiple indicators might be present in the ticket.
-+ * Each indicator is a utf8 string. */
++ * Each indicator is an utf8 string. */
 +
 +#define AUTH_INDICATORS_TAG "auth-indicators"
++#define SSH_GSSAPI_MAX_INDICATORS 64
 +
 +/* Privileged (called from accept_secure_ctx) */
 +static OM_uint32
@@ -177,78 +208,84 @@ index d2bc03486..be80e17ca 100644
 +	int is_mechname, authenticated, complete, more;
 +	size_t count, i;
 +
++	/* always initialize client->indicators */
++	client->indicators = NULL;
++
 +	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
 +				      &is_mechname, NULL, &attrs);
-+	if (ctx->major != GSS_S_COMPLETE) {
-+		return (ctx->major);
-+	}
++	if (ctx->major != GSS_S_COMPLETE)
++		return ctx->major;
 +
 +	if (attrs == GSS_C_NO_BUFFER_SET) {
-+		/* No indicators in the ticket */
-+		return (0);
++		/* no indicators in the ticket */
++		return GSS_S_COMPLETE;
 +	}
 +
++	/* client->indicators is NULL terminated */
 +	count = 0;
-+	for (i = 0; i < attrs->count; i++) {
-+		/* skip anything but auth-indicators */
-+		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    strncmp(AUTH_INDICATORS_TAG,
-+			    attrs->elements[i].value,
-+			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
-+			continue;
-+		count++;
-+	}
++	client->indicators = xcalloc(count + 1, sizeof(char *));
 +
-+	if (count == 0) {
-+		/* No auth-indicators in the ticket */
-+		(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+		return (0);
-+	}
-+
-+	client->indicators = recallocarray(NULL, 0, count + 1, sizeof(char*));
-+	count = 0;
 +	for (i = 0; i < attrs->count; i++) {
 +		authenticated = 0;
 +		complete = 0;
 +		more = -1;
++
 +		/* skip anything but auth-indicators */
 +		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    strncmp(AUTH_INDICATORS_TAG,
-+			    attrs->elements[i].value,
-+			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
++		    memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value,
++			   sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
 +			continue;
++
 +		/* retrieve all indicators */
 +		while (more != 0) {
 +			value.value = NULL;
 +			display_value.value = NULL;
++
 +			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
-+					&attrs->elements[i], &authenticated,
-+					&complete, &value, &display_value, &more);
-+			if (ctx->major != GSS_S_COMPLETE) {
++							    &attrs->elements[i],
++							    &authenticated, &complete,
++							    &value, &display_value, &more);
++			if (ctx->major != GSS_S_COMPLETE)
 +				goto out;
-+			}
 +
-+			if ((value.value != NULL) && authenticated) {
-+				client->indicators[count] = xmalloc(value.length + 1);
-+				memcpy(client->indicators[count], value.value, value.length);
-+				client->indicators[count][value.length] = '\0';
-+				count++;
++			if (value.value == NULL || !authenticated)
++				continue;
++
++			if (count >= SSH_GSSAPI_MAX_INDICATORS) {
++				logit("ssh_gssapi_getindicators:"
++				      " too many indicators, truncating at %d",
++				      SSH_GSSAPI_MAX_INDICATORS);
++				goto out;
 +			}
++
++			client->indicators[count] = xmalloc(value.length + 1);
++			memcpy(client->indicators[count], value.value, value.length);
++			client->indicators[count][value.length] = '\0';
++			count++;
++
++			/* add NULL terminator */
++			client->indicators = xrecallocarray(client->indicators, count,
++							    count + 1, sizeof(char *));
 +		}
 +	}
 +
 +out:
-+	(void) gss_release_buffer(&ctx->minor, &value);
-+	(void) gss_release_buffer(&ctx->minor, &display_value);
-+	(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+	return (ctx->major);
++	if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) {
++		for (i = 0; i < count; i++)
++			free(client->indicators[i]);
++		free(client->indicators);
++		client->indicators = NULL;
++	}
++	gss_release_buffer(&ctx->minor, &value);
++	gss_release_buffer(&ctx->minor, &display_value);
++	gss_release_buffer_set(&ctx->minor, &attrs);
++	return ctx->major;
 +}
 +
-+
  /* Extract the client details from a given context. This can only reliably
   * be called once for a context */
  
-@@ -385,6 +471,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -386,6 +475,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  	}
  
  	gss_release_buffer(&ctx->minor, &ename);
@@ -261,7 +298,7 @@ index d2bc03486..be80e17ca 100644
  
  	/* We can't copy this structure, so we just move the pointer to it */
  	client->creds = ctx->client_creds;
-@@ -447,6 +539,7 @@ int
+@@ -453,6 +548,7 @@ int
  ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  {
  	OM_uint32 lmin;
@@ -269,21 +306,23 @@ index d2bc03486..be80e17ca 100644
  
  	(void) kex; /* used in privilege separation */
  
-@@ -465,6 +558,14 @@ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
+@@ -471,8 +567,14 @@ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  			gss_release_buffer(&lmin, &gssapi_client.displayname);
  			gss_release_buffer(&lmin, &gssapi_client.exportedname);
  			gss_release_cred(&lmin, &gssapi_client.creds);
+-			explicit_bzero(&gssapi_client,
+-			    sizeof(ssh_gssapi_client));
 +
 +			if (gssapi_client.indicators != NULL) {
-+				for(i = 0; gssapi_client.indicators[i] != NULL; i++) {
++				for (i = 0; gssapi_client.indicators[i] != NULL; i++)
 +					free(gssapi_client.indicators[i]);
-+				}
 +				free(gssapi_client.indicators);
 +			}
 +
- 			explicit_bzero(&gssapi_client,
- 			    sizeof(ssh_gssapi_client));
++			explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client));
  			return 0;
+ 		}
+ 	else
 diff --git a/servconf.c b/servconf.c
 index f78615c28..e53e8ea30 100644
 --- a/servconf.c
@@ -296,6 +335,14 @@ index f78615c28..e53e8ea30 100644
  	options->use_kuserok = -1;
  	options->enable_k5users = -1;
  	options->password_authentication = -1;
+@@ -560,6 +561,7 @@ fill_default_server_options(ServerOptions *options)
+ 	CLEAR_ON_NONE(options->routing_domain);
+ 	CLEAR_ON_NONE(options->host_key_agent);
+ 	CLEAR_ON_NONE(options->per_source_penalty_exempt);
++	CLEAR_ON_NONE(options->gss_indicators);
+ 
+ 	for (i = 0; i < options->num_host_key_files; i++)
+ 		CLEAR_ON_NONE(options->host_key_files[i]);
 @@ -591,7 +592,7 @@ typedef enum {
  	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
@@ -394,10 +441,10 @@ diff --git a/sshd_config.5 b/sshd_config.5
 index c172d5aab..676d6d4d2 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -785,6 +785,50 @@ gss-nistp256-sha256-
- gss-curve25519-sha256-
- .Ed
- This option only applies to connections using GSSAPI.
+@@ -788,6 +788,52 @@ This option only applies to connections using GSSAPI.
+ .Pp
+ The list of supported key exchange algorithms may also be obtained using
+ .Qq ssh -Q GSSAPIKexAlgorithms .
 +.It Cm GSSAPIIndicators
 +Specifies whether to accept or deny GSSAPI authenticated access if Kerberos
 +mechanism is used and Kerberos ticket contains a particular set of
@@ -441,7 +488,9 @@ index c172d5aab..676d6d4d2 100644
 +FIDO2-based pre-authentication in FreeIPA, using FIDO2 USB and NFC tokens
 +.El
 +.Pp
-+The default is to not use GSSAPI authentication indicators for access decisions.
++The default
++.Dq none
++is to not use GSSAPI authentication indicators for access decisions.
  .It Cm HostbasedAcceptedAlgorithms
  The default is handled system-wide by
  .Xr crypto-policies 7 .

diff --git a/0049-NIST-curves-hybrid-KEX-implementation.patch b/0049-NIST-curves-hybrid-KEX-implementation.patch
index d0fb895..425f6f4 100644
--- a/0049-NIST-curves-hybrid-KEX-implementation.patch
+++ b/0049-NIST-curves-hybrid-KEX-implementation.patch
@@ -218,8 +218,8 @@ index 9c96e5cb0..d6e897301 100644
  	for (k = kexalgs; k->name != NULL; k++) {
  		if (strcmp(k->name, name) == 0)
 @@ -230,8 +289,16 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
+ 			return 0;
+ 		}
  		if (kex_alg_by_name(p) == NULL) {
 -			if (FIPS_mode())
 -				error("\"%.100s\" is not allowed in FIPS mode", p);

diff --git a/2000-openssh-10.2p1-gsissh.patch b/2000-openssh-10.2p1-gsissh.patch
index f9a028c..c6e7f01 100644
--- a/2000-openssh-10.2p1-gsissh.patch
+++ b/2000-openssh-10.2p1-gsissh.patch
@@ -760,13 +760,13 @@ diff -Nur openssh-10.2p1.orig/gss-serv.c openssh-10.2p1/gss-serv.c
   * indicators are GSSAPI name attributes for the name "auth-indicators".
   * Multiple indicators might be present in the ticket.
 @@ -380,6 +413,7 @@
- 	(void) gss_release_buffer_set(&ctx->minor, &attrs);
- 	return (ctx->major);
+ 	gss_release_buffer_set(&ctx->minor, &attrs);
+ 	return ctx->major;
  }
 +#endif
  
- 
  /* Extract the client details from a given context. This can only reliably
+  * be called once for a context */
 @@ -395,21 +429,24 @@
  	gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;
  
@@ -923,7 +923,7 @@ diff -Nur openssh-10.2p1.orig/gss-serv.c openssh-10.2p1/gss-serv.c
 +			gss_release_name(&lmin, &gssapi_client.ctx_name);
  
  			if (gssapi_client.indicators != NULL) {
- 				for(i = 0; gssapi_client.indicators[i] != NULL; i++) {
+ 				for (i = 0; gssapi_client.indicators[i] != NULL; i++)
 @@ -580,6 +650,24 @@
  	return (0);
  }

diff --git a/2001-openssh-10.2p1-hpn-18.8.0.patch b/2001-openssh-10.2p1-hpn-18.8.0.patch
index 3c82648..aac87b2 100644
--- a/2001-openssh-10.2p1-hpn-18.8.0.patch
+++ b/2001-openssh-10.2p1-hpn-18.8.0.patch
@@ -13115,13 +13115,12 @@ diff -Nur openssh-10.2p1.orig/ssh.1 openssh-10.2p1/ssh.1
  .Pp
  .Nm
  connects and logs into the specified
-@@ -527,12 +535,14 @@
+@@ -527,11 +535,13 @@
  .It ControlMaster
  .It ControlPath
  .It ControlPersist
 +.It DisableMTAES*
  .It DynamicForward
- .It EnableSSHKeysign
  .It EnableEscapeCommandline
  .It EnableSSHKeysign
  .It EscapeChar

diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 7879e89..386b477 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -28,7 +28,7 @@
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
 Version: %{openssh_ver}
-Release: 2%{?dist}
+Release: 3%{?dist}
 Provides: gsissh = %{version}-%{release}
 Obsoletes: gsissh < 5.8p2-2
 URL: http://www.openssh.com/portable.html
@@ -128,10 +128,6 @@ Patch0036: 0036-openssh-7.1p2-audit-race-condition.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2049947
 Patch0037: 0037-openssh-9.0p1-audit-log.patch
 Patch0038: 0038-openssh-7.7p1-fips.patch
-# Add missing options from ssh_config into ssh manpage
-# upstream bug:
-# https://bugzilla.mindrot.org/show_bug.cgi?id=3455
-Patch0039: 0039-openssh-8.7p1-ssh-manpage.patch
 # Don't propose disallowed algorithms during hostkey negotiation
 # upstream MR:
 # https://github.com/openssh/openssh-portable/pull/323
@@ -508,6 +504,9 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Thu Jul 09 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.2p1-3
+- Based on openssh-10.2p1-12.fc44
+
 * Tue May 26 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.2p1-2
 - Based on openssh-10.2p1-10.fc44