public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/openssh] rawhide: Rebase to OpenSSH 10.5p1
@ 2026-08-21 11:44 Dmitry Belyavskiy
0 siblings, 0 replies; only message in thread
From: Dmitry Belyavskiy @ 2026-08-21 11:44 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/openssh
Branch : rawhide
Commit : 221ba0f3358f3749c32afe8c51f6d67f2683c743
Author : Dmitry Belyavskiy <dbelyavs@redhat.com>
Date : 2026-08-21T13:43:34+02:00
Stats : +923/-971 in 58 file(s)
URL : https://src.fedoraproject.org/rpms/openssh/c/221ba0f3358f3749c32afe8c51f6d67f2683c743?branch=rawhide
Log:
Rebase to OpenSSH 10.5p1
---
diff --git a/.gitignore b/.gitignore
index 36d7adc..4a58f8c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -72,3 +72,5 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
/openssh-10.3p1.tar.gz.asc
/openssh-10.4p1.tar.gz
/openssh-10.4p1.tar.gz.asc
+/openssh-10.5p1.tar.gz
+/openssh-10.5p1.tar.gz.asc
diff --git a/0001-openssh-6.7p1-coverity.patch b/0001-openssh-6.7p1-coverity.patch
new file mode 100644
index 0000000..b2b01f5
--- /dev/null
+++ b/0001-openssh-6.7p1-coverity.patch
@@ -0,0 +1,192 @@
+From fa6f77d16574bf45434431c2fd60fcd34e9a0c8f Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Fri, 7 Aug 2026 17:25:07 +0200
+Subject: [PATCH 01/53] openssh-6.7p1-coverity
+
+---
+ krl.c | 3 +++
+ loginrec.c | 2 ++
+ misc.c | 3 +++
+ monitor.c | 4 ++--
+ openbsd-compat/bindresvport.c | 2 +-
+ openbsd-compat/bsd-pselect.c | 8 ++++----
+ readconf.c | 1 +
+ servconf.c | 5 +++--
+ serverloop.c | 2 +-
+ 9 files changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/krl.c b/krl.c
+index 0e2b5f155..f2d105f23 100644
+--- a/krl.c
++++ b/krl.c
+@@ -1202,6 +1202,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
+ return r;
+ erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
+ free(rb.blob);
++ rb.blob = NULL; /* make coverity happy */
+ if (erb != NULL) {
+ KRL_DBG(("revoked by key SHA1"));
+ return SSH_ERR_KEY_REVOKED;
+@@ -1212,6 +1213,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
+ return r;
+ erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
+ free(rb.blob);
++ rb.blob = NULL; /* make coverity happy */
+ if (erb != NULL) {
+ KRL_DBG(("revoked by key SHA256"));
+ return SSH_ERR_KEY_REVOKED;
+@@ -1223,6 +1225,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
+ return r;
+ erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
+ free(rb.blob);
++ rb.blob = NULL; /* make coverity happy */
+ if (erb != NULL) {
+ KRL_DBG(("revoked by explicit key"));
+ return SSH_ERR_KEY_REVOKED;
+diff --git a/loginrec.c b/loginrec.c
+index 7499aa975..2807cad4a 100644
+--- a/loginrec.c
++++ b/loginrec.c
+@@ -680,9 +680,11 @@ construct_utmp(struct logininfo *li,
+ */
+
+ /* Use strncpy because we don't necessarily want null termination */
++ /* coverity[buffer_size_warning : FALSE] */
+ strncpy(ut->ut_name, li->username,
+ MIN_SIZEOF(ut->ut_name, li->username));
+ # ifdef HAVE_HOST_IN_UTMP
++ /* coverity[buffer_size_warning : FALSE] */
+ strncpy(ut->ut_host, li->hostname,
+ MIN_SIZEOF(ut->ut_host, li->hostname));
+ # endif
+diff --git a/misc.c b/misc.c
+index 517fa7a97..88dc78821 100644
+--- a/misc.c
++++ b/misc.c
+@@ -1612,6 +1612,8 @@ sanitise_stdfd(void)
+ }
+ if (nullfd > STDERR_FILENO)
+ close(nullfd);
++ /* coverity[leaked_handle : FALSE]*/
++ /* coverity[leaked_handle : FALSE]*/
+ }
+
+ char *
+@@ -2815,6 +2817,7 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
+ }
+ if (devnull > STDERR_FILENO)
+ close(devnull);
++ /* coverity[leaked_handle : FALSE]*/
+ return ret;
+ }
+
+diff --git a/monitor.c b/monitor.c
+index 149671145..0e5871994 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -367,7 +367,7 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
+ mm_get_keystate(ssh, pmonitor);
+
+ /* Drain any buffered messages from the child */
+- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
++ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
+ ;
+
+ /* Wait for the child's exit status */
+@@ -1733,7 +1733,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
+ s->ptymaster = s->ptyfd;
+
+ debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
+-
++ /* coverity[leaked_handle : FALSE] */
+ return (0);
+
+ error:
+diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c
+index 346c7fe56..f42792fde 100644
+--- a/openbsd-compat/bindresvport.c
++++ b/openbsd-compat/bindresvport.c
+@@ -59,7 +59,7 @@ bindresvport_sa(int sd, struct sockaddr *sa)
+ struct sockaddr_in6 *in6;
+ u_int16_t *portp;
+ u_int16_t port;
+- socklen_t salen;
++ socklen_t salen = sizeof(struct sockaddr_storage);
+ int i;
+
+ if (sa == NULL) {
+diff --git a/openbsd-compat/bsd-pselect.c b/openbsd-compat/bsd-pselect.c
+index 26bdc3e08..8e2939b95 100644
+--- a/openbsd-compat/bsd-pselect.c
++++ b/openbsd-compat/bsd-pselect.c
+@@ -85,13 +85,13 @@ pselect_notify_setup(void)
+ static void
+ pselect_notify_parent(void)
+ {
+- if (notify_pipe[1] != -1)
++ if (notify_pipe[1] >= 0)
+ (void)write(notify_pipe[1], "", 1);
+ }
+ static void
+ pselect_notify_prepare(fd_set *readset)
+ {
+- if (notify_pipe[0] != -1)
++ if (notify_pipe[0] >= 0)
+ FD_SET(notify_pipe[0], readset);
+ }
+ static void
+@@ -99,8 +99,8 @@ pselect_notify_done(fd_set *readset)
+ {
+ char c;
+
+- if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
+- while (read(notify_pipe[0], &c, 1) != -1)
++ if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
++ while (read(notify_pipe[0], &c, 1) >= 0)
+ debug2_f("reading");
+ FD_CLR(notify_pipe[0], readset);
+ }
+diff --git a/readconf.c b/readconf.c
+index bc48b4f55..7465216f3 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -2111,6 +2111,7 @@ parse_pubkey_algos:
+ } else if (r != 0) {
+ error("%.200s line %d: glob failed for %s.",
+ filename, linenum, arg2);
++ free(arg2);
+ goto out;
+ }
+ free(arg2);
+diff --git a/servconf.c b/servconf.c
+index ac0c31d95..e7819d59a 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -2026,8 +2026,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ if (*activep && *charptr == NULL) {
+ *charptr = tilde_expand_filename(arg, getuid());
+ /* increase optional counter */
+- if (intptr != NULL)
+- *intptr = *intptr + 1;
++ /* DEAD CODE intptr is still NULL ;)
++ if (intptr != NULL)
++ *intptr = *intptr + 1; */
+ }
+ break;
+
+diff --git a/serverloop.c b/serverloop.c
+index 9d8a3429e..c22681483 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -536,7 +536,7 @@ server_request_tun(struct ssh *ssh)
+ debug_f("invalid tun");
+ goto done;
+ }
+- if (auth_opts->force_tun_device != -1) {
++ if (auth_opts->force_tun_device >= 0) {
+ if (tun != SSH_TUNID_ANY &&
+ auth_opts->force_tun_device != (int)tun)
+ goto done;
+--
+2.55.0
+
diff --git a/0001-upstream-fix-GSSAPI-option-names-that-I-somehow-scre.patch b/0001-upstream-fix-GSSAPI-option-names-that-I-somehow-scre.patch
deleted file mode 100644
index 21e2940..0000000
--- a/0001-upstream-fix-GSSAPI-option-names-that-I-somehow-scre.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 823ad00d14065ab932794be8d0a75a86b6277849 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Tue, 7 Jul 2026 01:00:22 +0000
-Subject: [PATCH 01/54] upstream: fix GSSAPI option names, that I somehow
- screwed up while
-
-refactoring servconf.c bz3974 patch from Colin Watson
-
-OpenBSD-Commit-ID: be39ad3dbe36d9ecdb86f3811da5dfbdc9bcb1e6
----
- servconf.c | 18 +++++++++---------
- servconf.h | 18 +++++++++---------
- 2 files changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/servconf.c b/servconf.c
-index ce388f1dd..9b443bea0 100644
---- a/servconf.c
-+++ b/servconf.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: servconf.c,v 1.450 2026/06/29 08:59:31 djm Exp $ */
-+/* $OpenBSD: servconf.c,v 1.451 2026/07/07 01:00:22 djm Exp $ */
- /*
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- * All rights reserved
-@@ -1433,19 +1433,19 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- #endif /* KRB5 */
-
- #ifdef GSSAPI
-- case sGssAuthentication:
-+ case sGSSAPIAuthentication:
- intptr = &options->gss_authentication;
- goto parse_flag;
-
-- case sGssCleanupCreds:
-+ case sGSSAPICleanupCredentials:
- intptr = &options->gss_cleanup_creds;
- goto parse_flag;
-
-- case sGssDelegateCreds:
-+ case sGSSAPIDelegateCredentials:
- intptr = &options->gss_deleg_creds;
- goto parse_flag;
-
-- case sGssStrictAcceptor:
-+ case sGSSAPIStrictAcceptorCheck:
- intptr = &options->gss_strict_acceptor;
- goto parse_flag;
- #endif /* GSSAPI */
-@@ -4215,10 +4215,10 @@ dump_config(ServerOptions *o)
- # endif
- #endif
- #ifdef GSSAPI
-- dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-- dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
-- dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds);
-- dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
-+ dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
-+ dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds);
-+ dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds);
-+ dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor);
- #endif
- dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
- dump_cfg_fmtint(sKbdInteractiveAuthentication,
-diff --git a/servconf.h b/servconf.h
-index 9e64e4673..a2345e88a 100644
---- a/servconf.h
-+++ b/servconf.h
-@@ -1,4 +1,4 @@
--/* $OpenBSD: servconf.h,v 1.177 2026/05/31 11:30:50 djm Exp $ */
-+/* $OpenBSD: servconf.h,v 1.179 2026/07/07 01:00:22 djm Exp $ */
-
- /*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
-@@ -314,16 +314,16 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB
-
- #ifdef GSSAPI
- #define SSHD_CONFIG_ENTRIES_GSS \
--SSHCONF_INTFLAG(gss_authentication, GssAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
--SSHCONF_INTFLAG(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
--SSHCONF_INTFLAG(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
--SSHCONF_INTFLAG(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
-+SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
-+SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
-+SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
-+SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
- #else /* GSSAPI */
- #define SSHD_CONFIG_ENTRIES_GSS \
--SSHCONF_UNSUPPORTED_INT(gss_authentication, GssAuthentication, SSHCFG_ALL) \
--SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL) \
--SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL) \
--SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL)
-+SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \
-+SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \
-+SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \
-+SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL)
- #endif /* GSSAPI */
-
- #define SSHD_CONFIG_ENTRIES \
---
-2.55.0
-
diff --git a/0002-Add-SELinux-role-and-MLS-Multi-Level-Security-suppor.patch b/0002-Add-SELinux-role-and-MLS-Multi-Level-Security-suppor.patch
index d68620a..a7f7030 100644
--- a/0002-Add-SELinux-role-and-MLS-Multi-Level-Security-suppor.patch
+++ b/0002-Add-SELinux-role-and-MLS-Multi-Level-Security-suppor.patch
@@ -1,7 +1,7 @@
-From 0ff113d55dffee623a622e081b426e5b7e57c571 Mon Sep 17 00:00:00 2001
+From 3c47f2bb223e4e400fac08c12bf36a2a88fa55ba Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon, 13 Apr 2026 14:06:32 +0200
-Subject: [PATCH 02/54] Add SELinux role and MLS (Multi-Level Security) support
+Subject: [PATCH 02/53] Add SELinux role and MLS (Multi-Level Security) support
openssh-7.8p1-role-mls
@@ -49,10 +49,10 @@ index 0f11458ca..efe819323 100644
/* Method lists for multiple authentication */
char **auth_methods; /* modified from server config */
diff --git a/auth2-gss.c b/auth2-gss.c
-index 85251b7d0..dfee5613e 100644
+index 9e9496e53..553fba328 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
-@@ -282,6 +282,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+@@ -280,6 +280,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
Authctxt *authctxt = ssh->authctxt;
Gssctxt *gssctxt;
int r, authenticated = 0;
@@ -60,7 +60,7 @@ index 85251b7d0..dfee5613e 100644
struct sshbuf *b;
gss_buffer_desc mic, gssbuf;
u_char *p;
-@@ -299,7 +300,13 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+@@ -297,7 +298,13 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
fatal_f("sshbuf_new failed");
mic.value = p;
mic.length = len;
@@ -75,7 +75,7 @@ index 85251b7d0..dfee5613e 100644
"gssapi-with-mic", ssh->kex->session_id);
if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
-@@ -312,6 +319,8 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+@@ -310,6 +317,8 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
logit("GSSAPI MIC check failed");
sshbuf_free(b);
@@ -85,10 +85,10 @@ index 85251b7d0..dfee5613e 100644
if (!authenticated)
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
-index 8a1acdec3..a287091ec 100644
+index 564a8d3cc..6a6704d93 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
-@@ -130,7 +130,16 @@ userauth_hostbased(struct ssh *ssh, const char *method)
+@@ -131,7 +131,16 @@ userauth_hostbased(struct ssh *ssh, const char *method)
/* reconstruct packet */
if ((r = sshbuf_put_stringb(b, ssh->kex->session_id)) != 0 ||
(r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
@@ -106,7 +106,7 @@ index 8a1acdec3..a287091ec 100644
(r = sshbuf_put_cstring(b, method)) != 0 ||
(r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
-index e446ef412..319e42b2b 100644
+index c15b1ba71..dc07faa92 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -71,6 +71,8 @@
@@ -204,7 +204,7 @@ index 3f353a719..497fa8ed2 100644
if ((r = kex_server_update_ext_info(ssh)) != 0)
fatal_fr(r, "kex_server_update_ext_info failed");
diff --git a/misc.c b/misc.c
-index 517fa7a97..c0e16437a 100644
+index 88dc78821..f5275d108 100644
--- a/misc.c
+++ b/misc.c
@@ -869,6 +869,7 @@ char *
@@ -229,7 +229,7 @@ index 517fa7a97..c0e16437a 100644
}
return NULL;
}
-@@ -2830,7 +2838,8 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
+@@ -2833,7 +2841,8 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
pid_t
subprocess(const char *tag, const char *command,
int ac, char **av, FILE **child, u_int flags,
@@ -239,7 +239,7 @@ index 517fa7a97..c0e16437a 100644
{
FILE *f = NULL;
struct stat st;
-@@ -2963,6 +2972,13 @@ subprocess(const char *tag, const char *command,
+@@ -2966,6 +2975,13 @@ subprocess(const char *tag, const char *command,
error("%s: dup2: %s", tag, strerror(errno));
_exit(1);
}
@@ -254,7 +254,7 @@ index 517fa7a97..c0e16437a 100644
execve(av[0], av, env);
else
diff --git a/monitor.c b/monitor.c
-index 73a85408e..6fe9f46fc 100644
+index 0e5871994..c659e99e0 100644
--- a/monitor.c
+++ b/monitor.c
@@ -111,6 +111,9 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *);
@@ -277,7 +277,7 @@ index 73a85408e..6fe9f46fc 100644
{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
#ifdef USE_PAM
-@@ -920,6 +926,9 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -932,6 +938,9 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
/* Allow service/style information on the auth context */
monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -287,7 +287,7 @@ index 73a85408e..6fe9f46fc 100644
monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
#ifdef USE_PAM
-@@ -994,6 +1003,26 @@ key_base_type_match(const char *method, const struct sshkey *key,
+@@ -1006,6 +1015,26 @@ key_base_type_match(const char *method, const struct sshkey *key,
return found;
}
@@ -314,7 +314,7 @@ index 73a85408e..6fe9f46fc 100644
int
mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m)
{
-@@ -1366,7 +1395,7 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
+@@ -1378,7 +1407,7 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
struct sshbuf *b;
struct sshkey *hostkey = NULL;
const u_char *p;
@@ -323,7 +323,7 @@ index 73a85408e..6fe9f46fc 100644
size_t len;
u_char type;
int hostbound = 0, r, fail = 0;
-@@ -1397,6 +1426,8 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
+@@ -1409,6 +1438,8 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
fail++;
if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
fatal_fr(r, "parse userstyle");
@@ -332,7 +332,7 @@ index 73a85408e..6fe9f46fc 100644
xasprintf(&userstyle, "%s%s%s", authctxt->user,
authctxt->style ? ":" : "",
authctxt->style ? authctxt->style : "");
-@@ -1447,7 +1478,7 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
+@@ -1459,7 +1490,7 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
{
struct sshbuf *b;
const u_char *p;
@@ -341,7 +341,7 @@ index 73a85408e..6fe9f46fc 100644
size_t len;
int r, fail = 0;
u_char type;
-@@ -1468,6 +1499,8 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
+@@ -1480,6 +1511,8 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
fail++;
if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
fatal_fr(r, "parse userstyle");
@@ -366,10 +366,10 @@ index fe0b00b2e..1b46e794e 100644
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
diff --git a/monitor_wrap.c b/monitor_wrap.c
-index e2b9a2802..b5aeb8b2c 100644
+index e9a771b34..af0252964 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
-@@ -438,6 +438,27 @@ mm_inform_authserv(char *service, char *style)
+@@ -440,6 +440,27 @@ mm_inform_authserv(char *service, char *style)
sshbuf_free(m);
}
diff --git a/0003-Implement-SELinux-environment-variable-setup-for-sub.patch b/0003-Implement-SELinux-environment-variable-setup-for-sub.patch
index 17abd68..62edf2c 100644
--- a/0003-Implement-SELinux-environment-variable-setup-for-sub.patch
+++ b/0003-Implement-SELinux-environment-variable-setup-for-sub.patch
@@ -1,7 +1,7 @@
-From f87a7cf01057bcf495974502de3e6f4bfc472a5d Mon Sep 17 00:00:00 2001
+From c5df0bfbb8de0b1536476f200a9af3ecf0c10485 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon, 13 Apr 2026 14:06:47 +0200
-Subject: [PATCH 03/54] Implement SELinux environment variable setup for
+Subject: [PATCH 03/53] Implement SELinux environment variable setup for
subprocess execution
openssh-6.6p1-selinux-env-setup
@@ -648,7 +648,7 @@ index fd1a7a7c2..66d0c2a6b 100644
}
diff --git a/sshd-session.c b/sshd-session.c
-index be30c8d70..d7d4f32c5 100644
+index 06a72daaf..1a40a43f1 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -123,7 +123,7 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE;
@@ -660,7 +660,7 @@ index be30c8d70..d7d4f32c5 100644
/* debug goes to stderr unless inetd_flag is set */
static int log_stderr = 0;
-@@ -1275,6 +1275,11 @@ main(int ac, char **av)
+@@ -1277,6 +1277,11 @@ main(int ac, char **av)
restore_uid();
}
#endif
diff --git a/0004-Pass-inetd-flags-and-auth-context-to-subprocess-call.patch b/0004-Pass-inetd-flags-and-auth-context-to-subprocess-call.patch
index 8a6555d..e77ac29 100644
--- a/0004-Pass-inetd-flags-and-auth-context-to-subprocess-call.patch
+++ b/0004-Pass-inetd-flags-and-auth-context-to-subprocess-call.patch
@@ -1,7 +1,7 @@
-From df67685c029a001ce4eed58aebd522c1dbf54cd5 Mon Sep 17 00:00:00 2001
+From e63a4ad30d07f0912f63360263985d7aef948565 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon, 13 Apr 2026 14:07:02 +0200
-Subject: [PATCH 04/54] Pass inetd flags and auth context to subprocess calls
+Subject: [PATCH 04/53] Pass inetd flags and auth context to subprocess calls
for SELinux
openssh-7.6p1-subprocess-selinux
@@ -57,7 +57,7 @@ index 0ddfc76b3..bdaade682 100644
load_hostkeys_file(hostkeys, hostfile_hostname, tag, f, 1);
diff --git a/sshd-auth.c b/sshd-auth.c
-index fb1bab66f..99359c718 100644
+index 4888c8e62..14109151c 100644
--- a/sshd-auth.c
+++ b/sshd-auth.c
@@ -119,7 +119,7 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE;
diff --git a/0005-openssh-6.6p1-keycat.patch b/0005-openssh-6.6p1-keycat.patch
index 7acb3c6..bd9a5ef 100644
--- a/0005-openssh-6.6p1-keycat.patch
+++ b/0005-openssh-6.6p1-keycat.patch
@@ -1,7 +1,7 @@
-From 9f85e1dff3539c5791634a361f3c696d87ef9beb Mon Sep 17 00:00:00 2001
+From 6164d9589be5125b95da999ed6615aa431a42e70 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 05/54] openssh-6.6p1-keycat
+Subject: [PATCH 05/53] openssh-6.6p1-keycat
---
.depend | 1 +
@@ -15,10 +15,10 @@ Subject: [PATCH 05/54] openssh-6.6p1-keycat
create mode 100644 ssh-keycat.c
diff --git a/.depend b/.depend
-index 03e8c423d..b6b1ad242 100644
+index 845fadceb..7d2d00bbf 100644
--- a/.depend
+++ b/.depend
-@@ -134,6 +134,7 @@ ssh-ed25519-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbs
+@@ -135,6 +135,7 @@ ssh-ed25519-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbs
ssh-ed25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h crypto_api.h log.h ssherr.h sshbuf.h sshkey.h
ssh-keygen.o: cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h
ssh-keygen.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshkey.h authfile.h sshbuf.h pathnames.h log.h ssherr.h misc.h match.h hostfile.h dns.h ssh.h ssh2.h atomicio.h krl.h digest.h utf8.h authfd.h sshsig.h ssh-sk.h sk-api.h cipher.h
@@ -57,7 +57,7 @@ index 000000000..630ec628c
+
+
diff --git a/Makefile.in b/Makefile.in
-index da59bcc10..c932373fc 100644
+index e9503e7b7..2a449680a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -23,6 +23,7 @@ SSH_PROGRAM=@bindir@/ssh
@@ -104,10 +104,10 @@ index da59bcc10..c932373fc 100644
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
diff --git a/configure.ac b/configure.ac
-index a4d544cc5..d7e911e81 100644
+index cb1711f6b..4b3cff38c 100644
--- a/configure.ac
+++ b/configure.ac
-@@ -3700,6 +3700,7 @@ AC_ARG_WITH([pam],
+@@ -3639,6 +3639,7 @@ AC_ARG_WITH([pam],
PAM_MSG="yes"
SSHDLIBS="$SSHDLIBS -lpam"
@@ -115,7 +115,7 @@ index a4d544cc5..d7e911e81 100644
AC_DEFINE([USE_PAM], [1],
[Define if you want to enable PAM support])
-@@ -3710,6 +3711,7 @@ AC_ARG_WITH([pam],
+@@ -3649,6 +3650,7 @@ AC_ARG_WITH([pam],
;;
*)
SSHDLIBS="$SSHDLIBS -ldl"
@@ -123,7 +123,7 @@ index a4d544cc5..d7e911e81 100644
;;
esac
fi
-@@ -4953,6 +4955,7 @@ AC_ARG_WITH([selinux],
+@@ -4892,6 +4894,7 @@ AC_ARG_WITH([selinux],
fi ]
)
AC_SUBST([SSHDLIBS])
@@ -131,7 +131,7 @@ index a4d544cc5..d7e911e81 100644
# Check whether user wants Kerberos 5 support
KRB5_MSG="no"
-@@ -5966,6 +5969,9 @@ fi
+@@ -5905,6 +5908,9 @@ fi
if test ! -z "${SSHDLIBS}"; then
echo " +for sshd: ${SSHDLIBS}"
fi
diff --git a/0006-openssh-6.6p1-allow-ip-opts.patch b/0006-openssh-6.6p1-allow-ip-opts.patch
index 392bec2..b9d390e 100644
--- a/0006-openssh-6.6p1-allow-ip-opts.patch
+++ b/0006-openssh-6.6p1-allow-ip-opts.patch
@@ -1,7 +1,7 @@
-From 87f6d5b0348b109074f77c8f6f9d2ae49d481f68 Mon Sep 17 00:00:00 2001
+From b7b287396f0792287ee4be08702ff70876cd401d Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 06/54] openssh-6.6p1-allow-ip-opts
+Subject: [PATCH 06/53] openssh-6.6p1-allow-ip-opts
#https://bugzilla.mindrot.org/show_bug.cgi?id=1644
---
@@ -9,7 +9,7 @@ Subject: [PATCH 06/54] openssh-6.6p1-allow-ip-opts
1 file changed, 26 insertions(+), 6 deletions(-)
diff --git a/sshd-session.c b/sshd-session.c
-index d7d4f32c5..fea94dc6c 100644
+index 1a40a43f1..0f41756ff 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -727,12 +727,32 @@ check_ip_options(struct ssh *ssh)
diff --git a/0007-openssh-5.9p1-ipv6man.patch b/0007-openssh-5.9p1-ipv6man.patch
index d7a5864..93f77c5 100644
--- a/0007-openssh-5.9p1-ipv6man.patch
+++ b/0007-openssh-5.9p1-ipv6man.patch
@@ -1,7 +1,7 @@
-From f0d07631a0b6312bf35aced2c9629b74d70d81e1 Mon Sep 17 00:00:00 2001
+From bf4e65b7335e516bae78a0bd0c085ab55f377973 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 07/54] openssh-5.9p1-ipv6man
+Subject: [PATCH 07/53] openssh-5.9p1-ipv6man
#(drop?) https://bugzilla.mindrot.org/show_bug.cgi?id=1925
---
@@ -10,10 +10,10 @@ Subject: [PATCH 07/54] openssh-5.9p1-ipv6man
2 files changed, 4 insertions(+)
diff --git a/ssh.1 b/ssh.1
-index 22f385f06..28eaeac2f 100644
+index 60ee3ab34..089bd348a 100644
--- a/ssh.1
+++ b/ssh.1
-@@ -1670,6 +1670,8 @@ manual page for more information.
+@@ -1579,6 +1579,8 @@ manual page for more information.
.Nm
exits with the exit status of the remote command or with 255
if an error occurred.
@@ -23,10 +23,10 @@ index 22f385f06..28eaeac2f 100644
.Xr scp 1 ,
.Xr sftp 1 ,
diff --git a/sshd.8 b/sshd.8
-index 7fbca776a..0226a8303 100644
+index a65aae75d..24e5639a3 100644
--- a/sshd.8
+++ b/sshd.8
-@@ -1018,6 +1018,8 @@ concurrently for different ports, this contains the process ID of the one
+@@ -1024,6 +1024,8 @@ concurrently for different ports, this contains the process ID of the one
started last).
The content of this file is not sensitive; it can be world-readable.
.El
diff --git a/0008-openssh-5.8p2-sigpipe.patch b/0008-openssh-5.8p2-sigpipe.patch
index 7ccfd8d..312da67 100644
--- a/0008-openssh-5.8p2-sigpipe.patch
+++ b/0008-openssh-5.8p2-sigpipe.patch
@@ -1,17 +1,17 @@
-From 4a68f641e71153c825f5cdc34d0b3a07022df638 Mon Sep 17 00:00:00 2001
+From dccd2a9aba5fa758cfd27c6de86fa73830aa7f6f Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 08/54] openssh-5.8p2-sigpipe
+Subject: [PATCH 08/53] openssh-5.8p2-sigpipe
---
ssh-keyscan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
-index ddaf8dfb1..c455ef532 100644
+index f093b0108..77b4341c9 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
-@@ -786,6 +786,9 @@ main(int argc, char **argv)
+@@ -797,6 +797,9 @@ main(int argc, char **argv)
if (maxfd > fdlim_get(0))
fdlim_set(maxfd);
fdcon = xcalloc(maxfd, sizeof(con));
diff --git a/0009-openssh-5.1p1-askpass-progress.patch b/0009-openssh-5.1p1-askpass-progress.patch
index c96a7d4..9c14332 100644
--- a/0009-openssh-5.1p1-askpass-progress.patch
+++ b/0009-openssh-5.1p1-askpass-progress.patch
@@ -1,7 +1,7 @@
-From fd8ad7a3a2b5d47aa989c619cb12c7f681853f9b Mon Sep 17 00:00:00 2001
+From 993767d6c9c2b2e9cfa6ff2cd3d7bc8c4869c2f6 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 09/54] openssh-5.1p1-askpass-progress
+Subject: [PATCH 09/53] openssh-5.1p1-askpass-progress
---
contrib/gnome-ssh-askpass2.c | 39 +++++++++++++++++++++++++++++++++---
diff --git a/0010-openssh-4.3p2-askpass-grab-info.patch b/0010-openssh-4.3p2-askpass-grab-info.patch
index 967cf3c..af4d057 100644
--- a/0010-openssh-4.3p2-askpass-grab-info.patch
+++ b/0010-openssh-4.3p2-askpass-grab-info.patch
@@ -1,7 +1,7 @@
-From cfdb0456fe83c0df2dacefa8cbe31cde96eca0cf Mon Sep 17 00:00:00 2001
+From 68609eb845515333fe86756dd0d0f1fe866943ef Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 10/54] openssh-4.3p2-askpass-grab-info
+Subject: [PATCH 10/53] openssh-4.3p2-askpass-grab-info
#https://bugzilla.redhat.com/show_bug.cgi?id=198332
---
diff --git a/0011-openssh-8.7p1-redhat.patch b/0011-openssh-8.7p1-redhat.patch
index 345160f..23c071d 100644
--- a/0011-openssh-8.7p1-redhat.patch
+++ b/0011-openssh-8.7p1-redhat.patch
@@ -1,7 +1,7 @@
-From 62cef37ebf112f4389a520e7277fd7cc30a7019c Mon Sep 17 00:00:00 2001
+From 313333f429aedd5f255643400669204a32e61023 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 11/54] openssh-8.7p1-redhat
+Subject: [PATCH 11/53] openssh-8.7p1-redhat
#https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
---
@@ -57,7 +57,7 @@ index 000000000..8b1b59021
+# Uncomment this if you want to use .local domain
+# Host *.local
diff --git a/sshd_config b/sshd_config
-index 0f4a3a724..608203e4b 100644
+index 57ecabb86..f43aa8093 100644
--- a/sshd_config
+++ b/sshd_config
@@ -10,6 +10,14 @@
@@ -76,10 +76,10 @@ index 0f4a3a724..608203e4b 100644
#AddressFamily any
#ListenAddress 0.0.0.0
diff --git a/sshd_config.0 b/sshd_config.0
-index 9bafd243e..dc685568a 100644
+index 2248006ea..91eda77f4 100644
--- a/sshd_config.0
+++ b/sshd_config.0
-@@ -1255,9 +1255,9 @@ DESCRIPTION
+@@ -1265,9 +1265,9 @@ DESCRIPTION
SyslogFacility
Gives the facility code that is used when logging messages from
@@ -93,10 +93,10 @@ index 9bafd243e..dc685568a 100644
TCPKeepAlive
Specifies whether the system should send TCP keepalive messages
diff --git a/sshd_config.5 b/sshd_config.5
-index 39a864dee..3896d21b0 100644
+index a7d300139..e85cca6eb 100644
--- a/sshd_config.5
+++ b/sshd_config.5
-@@ -1979,7 +1979,7 @@ By default no subsystems are defined.
+@@ -1989,7 +1989,7 @@ By default no subsystems are defined.
.It Cm SyslogFacility
Gives the facility code that is used when logging messages from
.Xr sshd 8 .
diff --git a/0012-openssh-7.8p1-UsePAM-warning.patch b/0012-openssh-7.8p1-UsePAM-warning.patch
index a8e0704..0d001bd 100644
--- a/0012-openssh-7.8p1-UsePAM-warning.patch
+++ b/0012-openssh-7.8p1-UsePAM-warning.patch
@@ -1,7 +1,7 @@
-From e0b43c6be9a94437c33239455815a70c287ca5f5 Mon Sep 17 00:00:00 2001
+From 10feee43540cbebad70f9903a6cbd59409f9f0c4 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 12/54] openssh-7.8p1-UsePAM-warning
+Subject: [PATCH 12/53] openssh-7.8p1-UsePAM-warning
# warn users for unsupported UsePAM=no (#757545)
---
@@ -10,7 +10,7 @@ Subject: [PATCH 12/54] openssh-7.8p1-UsePAM-warning
2 files changed, 6 insertions(+)
diff --git a/sshd-session.c b/sshd-session.c
-index fea94dc6c..8c6652152 100644
+index 0f41756ff..6e9b28dec 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -1076,6 +1076,10 @@ main(int ac, char **av)
@@ -25,10 +25,10 @@ index fea94dc6c..8c6652152 100644
if (options.moduli_file != NULL)
dh_set_moduli_file(options.moduli_file);
diff --git a/sshd_config b/sshd_config
-index 608203e4b..48af6321b 100644
+index f43aa8093..f626d5801 100644
--- a/sshd_config
+++ b/sshd_config
-@@ -89,6 +89,8 @@ AuthorizedKeysFile .ssh/authorized_keys
+@@ -90,6 +90,8 @@ AuthorizedKeysFile .ssh/authorized_keys
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
diff --git a/0013-openssh-9.6p1-gssapi-keyex.patch b/0013-openssh-9.6p1-gssapi-keyex.patch
index 93f31fa..de2cabf 100644
--- a/0013-openssh-9.6p1-gssapi-keyex.patch
+++ b/0013-openssh-9.6p1-gssapi-keyex.patch
@@ -1,7 +1,7 @@
-From 54d6489ff716f31a156edcd9a027756f1d9131ea Mon Sep 17 00:00:00 2001
+From 988b543e5a92109f08a6ef213c834eb82924178e Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 13/54] openssh-9.6p1-gssapi-keyex
+Subject: [PATCH 13/53] openssh-9.6p1-gssapi-keyex
---
.depend | 2 +
@@ -24,7 +24,7 @@ Subject: [PATCH 13/54] openssh-9.6p1-gssapi-keyex
kexgen.c | 2 +-
kexgssc.c | 706 ++++++++++++++++++++++++++++++++++++++++++++++++
kexgsss.c | 603 +++++++++++++++++++++++++++++++++++++++++
- monitor.c | 147 +++++++++-
+ monitor.c | 150 +++++++++-
monitor.h | 2 +
monitor_wrap.c | 57 +++-
monitor_wrap.h | 4 +-
@@ -34,29 +34,29 @@ Subject: [PATCH 13/54] openssh-9.6p1-gssapi-keyex
servconf.h | 11 +-
session.c | 10 +-
ssh-gss.h | 64 ++++-
- ssh.1 | 8 +
+ ssh.1 | 2 +
ssh.c | 7 +-
ssh_config | 2 +
ssh_config.5 | 61 +++++
sshconnect2.c | 154 ++++++++++-
- sshd-auth.c | 55 +++-
+ sshd-auth.c | 58 +++-
sshd-session.c | 9 +-
sshd.c | 3 +-
sshd_config | 2 +
sshd_config.5 | 43 ++-
sshkey.c | 72 ++++-
sshkey.h | 1 +
- 42 files changed, 3008 insertions(+), 80 deletions(-)
+ 42 files changed, 3004 insertions(+), 84 deletions(-)
create mode 100644 kexgssc.c
create mode 100644 kexgsss.c
diff --git a/.depend b/.depend
-index b6b1ad242..7e5f3dcd3 100644
+index 7d2d00bbf..45ad2bf4e 100644
--- a/.depend
+++ b/.depend
@@ -67,6 +67,8 @@ kexc25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-com
kexdh.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
- kexecdh.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h
+ kexecdh.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
kexgen.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshkey.h kex.h mac.h crypto_api.h log.h ssherr.h packet.h dispatch.h ssh2.h sshbuf.h digest.h
+kexgssc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
+kexgsss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
@@ -64,12 +64,12 @@ index b6b1ad242..7e5f3dcd3 100644
kexgexc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
kexgexs.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
diff --git a/Makefile.in b/Makefile.in
-index c932373fc..106306024 100644
+index 2a449680a..1eeb34cad 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
- kexgexc.o kexgexs.o \
+ kexgexc.o kexgexs.o kexmlkem768ecdh.o \
kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \
+ kexgssc.o \
sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
@@ -103,7 +103,7 @@ index c932373fc..106306024 100644
regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS)
$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \
diff --git a/auth.c b/auth.c
-index a0217a811..142ac5afd 100644
+index a4a37c11a..9d1307b76 100644
--- a/auth.c
+++ b/auth.c
@@ -354,7 +354,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
@@ -117,7 +117,7 @@ index a0217a811..142ac5afd 100644
break;
case PERMIT_FORCED_ONLY:
diff --git a/auth2-gss.c b/auth2-gss.c
-index dfee5613e..bb9c80bd4 100644
+index 553fba328..d110a4eac 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -51,6 +51,7 @@
@@ -177,7 +177,7 @@ index dfee5613e..bb9c80bd4 100644
/*
* We only support those mechanisms that we know about (ie ones that we know
* how to check local user kuserok and the like)
-@@ -263,7 +306,7 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh)
+@@ -261,7 +304,7 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh)
if ((r = sshpkt_get_end(ssh)) != 0)
fatal_fr(r, "parse packet");
@@ -186,7 +186,7 @@ index dfee5613e..bb9c80bd4 100644
if (!authenticated)
auth_failure_delay(authctxt, tstart);
-@@ -314,7 +357,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+@@ -312,7 +355,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
gssbuf.length = sshbuf_len(b);
if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))
@@ -195,7 +195,7 @@ index dfee5613e..bb9c80bd4 100644
else
logit("GSSAPI MIC check failed");
-@@ -335,6 +378,11 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+@@ -333,6 +376,11 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
return 0;
}
@@ -401,7 +401,7 @@ index 49950cecc..f076d1d56 100644
if (conn_in_ready)
client_process_net_input(ssh);
diff --git a/configure.ac b/configure.ac
-index d7e911e81..321adbab1 100644
+index 4b3cff38c..cb46903f4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -844,6 +844,30 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@@ -1271,7 +1271,7 @@ index f9ae303b5..8b4fa9cfe 100644
/* Privileged */
diff --git a/kex-names.c b/kex-names.c
-index 751f06cea..3bc38130b 100644
+index 116150316..2bc431223 100644
--- a/kex-names.c
+++ b/kex-names.c
@@ -36,6 +36,7 @@
@@ -1293,7 +1293,7 @@ index 751f06cea..3bc38130b 100644
struct kexalg {
char *name;
u_int type;
-@@ -88,9 +93,22 @@ static const struct kexalg kexalgs[] = {
+@@ -86,9 +91,22 @@ static const struct kexalg kexalgs[] = {
#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
{ NULL, 0, -1, -1, 0 },
};
@@ -1318,7 +1318,7 @@ index 751f06cea..3bc38130b 100644
{
char *ret = NULL;
const struct kexalg *k;
-@@ -102,6 +120,18 @@ kex_alg_list(char sep)
+@@ -100,6 +118,18 @@ kex_alg_list(char sep)
return ret;
}
@@ -1337,7 +1337,7 @@ index 751f06cea..3bc38130b 100644
static const struct kexalg *
kex_alg_by_name(const char *name)
{
-@@ -111,6 +141,10 @@ kex_alg_by_name(const char *name)
+@@ -109,6 +139,10 @@ kex_alg_by_name(const char *name)
if (strcmp(k->name, name) == 0)
return k;
}
@@ -1348,7 +1348,7 @@ index 751f06cea..3bc38130b 100644
return NULL;
}
-@@ -172,6 +206,12 @@ kex_names_valid(const char *names)
+@@ -170,6 +204,12 @@ kex_names_valid(const char *names)
return 0;
for ((p = strsep(&cp, ",")); p && *p != '\0';
(p = strsep(&cp, ","))) {
@@ -1361,7 +1361,7 @@ index 751f06cea..3bc38130b 100644
if (kex_alg_by_name(p) == NULL) {
error("Unsupported KEX algorithm \"%.100s\"", p);
free(s);
-@@ -334,3 +374,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
+@@ -332,3 +372,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
free(ret);
return r;
}
@@ -1389,7 +1389,7 @@ index 751f06cea..3bc38130b 100644
+ return 1;
+}
diff --git a/kex.c b/kex.c
-index 11b271d47..3701a40c0 100644
+index b2c3d9720..1b8f1c3c5 100644
--- a/kex.c
+++ b/kex.c
@@ -293,17 +293,37 @@ static int
@@ -1436,7 +1436,7 @@ index 11b271d47..3701a40c0 100644
(r = sshbuf_put_cstring(m, "0")) != 0 ||
(r = sshbuf_put_cstring(m, "agent-forward")) != 0 ||
(r = sshbuf_put_cstring(m, "0")) != 0) {
-@@ -746,6 +766,9 @@ kex_free(struct kex *kex)
+@@ -744,6 +764,9 @@ kex_free(struct kex *kex)
sshbuf_free(kex->server_version);
sshbuf_free(kex->client_pub);
sshbuf_free(kex->session_id);
@@ -1447,7 +1447,7 @@ index 11b271d47..3701a40c0 100644
sshkey_free(kex->initial_hostkey);
free(kex->failed_choice);
diff --git a/kex.h b/kex.h
-index a4d50f1a3..d229df7e6 100644
+index 9816b1d83..21919a9aa 100644
--- a/kex.h
+++ b/kex.h
@@ -29,6 +29,10 @@
@@ -1459,12 +1459,12 @@ index a4d50f1a3..d229df7e6 100644
+#endif
+
#ifdef WITH_OPENSSL
- # include <openssl/bn.h>
- # include <openssl/dh.h>
-@@ -103,6 +107,15 @@ enum kex_exchange {
- KEX_C25519_SHA256,
+ #include <openssl/bn.h>
+ #include <openssl/dh.h>
+@@ -98,6 +102,15 @@ enum kex_exchange {
KEX_KEM_SNTRUP761X25519_SHA512,
KEX_KEM_MLKEM768X25519_SHA256,
+ KEX_KEM_MLKEM768ECDH_SHA256,
+#ifdef GSSAPI
+ KEX_GSS_GRP1_SHA1,
+ KEX_GSS_GRP14_SHA1,
@@ -1477,7 +1477,7 @@ index a4d50f1a3..d229df7e6 100644
KEX_MAX
};
-@@ -171,6 +184,13 @@ struct kex {
+@@ -166,6 +179,13 @@ struct kex {
u_int flags;
int hash_alg;
int ec_nid;
@@ -1491,7 +1491,7 @@ index a4d50f1a3..d229df7e6 100644
char *failed_choice;
int (*verify_host_key)(struct sshkey *, struct ssh *);
struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
-@@ -198,8 +218,10 @@ int kex_nid_from_name(const char *);
+@@ -193,8 +213,10 @@ int kex_nid_from_name(const char *);
int kex_is_pq_from_name(const char *);
int kex_names_valid(const char *);
char *kex_alg_list(char);
@@ -1502,7 +1502,7 @@ index a4d50f1a3..d229df7e6 100644
int kex_assemble_names(char **, const char *, const char *);
void kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX],
const char *, const char *, const char *, const char *, const char *);
-@@ -233,6 +255,12 @@ int kexgex_client(struct ssh *);
+@@ -228,6 +250,12 @@ int kexgex_client(struct ssh *);
int kexgex_server(struct ssh *);
int kex_gen_client(struct ssh *);
int kex_gen_server(struct ssh *);
@@ -1515,7 +1515,7 @@ index a4d50f1a3..d229df7e6 100644
int kex_dh_keypair(struct kex *);
int kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
-@@ -271,6 +299,12 @@ int kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
+@@ -275,6 +303,12 @@ int kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
const BIGNUM *, const u_char *, size_t,
u_char *, size_t *);
@@ -1557,7 +1557,7 @@ index cbcb2d836..b63374b0e 100644
break;
case KEX_DH_GRP18_SHA512:
diff --git a/kexgen.c b/kexgen.c
-index 5643bc831..a2beb3f10 100644
+index d1f9d840a..ff504580f 100644
--- a/kexgen.c
+++ b/kexgen.c
@@ -44,7 +44,7 @@
@@ -2891,7 +2891,7 @@ index 000000000..98e9404df
+
+#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
diff --git a/monitor.c b/monitor.c
-index 6fe9f46fc..cddbc0a22 100644
+index c659e99e0..fa477899e 100644
--- a/monitor.c
+++ b/monitor.c
@@ -138,6 +138,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
@@ -2961,10 +2961,12 @@ index 6fe9f46fc..cddbc0a22 100644
if (auth_opts->permit_pty_flag) {
monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1898,6 +1922,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
- # ifdef OPENSSL_HAS_ECC
+@@ -1908,8 +1932,18 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+ kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+ kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
- # endif
+- kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server;
+-#endif
+# ifdef GSSAPI
+ if (options.gss_keyex) {
+ kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
@@ -2976,10 +2978,11 @@ index 6fe9f46fc..cddbc0a22 100644
+ kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
+ }
+# endif
- #endif /* WITH_OPENSSL */
++#endif /* WITH_OPENSSL */
kex->kex[KEX_C25519_SHA256] = kex_gen_server;
kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
-@@ -1996,8 +2031,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+ kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
+@@ -2007,8 +2041,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
u_char *p;
int r;
@@ -2990,7 +2993,7 @@ index 6fe9f46fc..cddbc0a22 100644
if ((r = sshbuf_get_string(m, &p, &len)) != 0)
fatal_fr(r, "parse");
-@@ -2029,8 +2064,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2040,8 +2074,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
OM_uint32 flags = 0; /* GSI needs this */
int r;
@@ -3001,7 +3004,7 @@ index 6fe9f46fc..cddbc0a22 100644
if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
fatal_fr(r, "ssh_gssapi_get_buffer_desc");
-@@ -2050,6 +2085,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2061,6 +2095,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -3009,7 +3012,7 @@ index 6fe9f46fc..cddbc0a22 100644
}
return (0);
}
-@@ -2061,8 +2097,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2072,8 +2107,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
OM_uint32 ret;
int r;
@@ -3020,7 +3023,7 @@ index 6fe9f46fc..cddbc0a22 100644
if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
(r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -2088,13 +2124,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2099,13 +2134,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
int
mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
{
@@ -3042,7 +3045,7 @@ index 6fe9f46fc..cddbc0a22 100644
sshbuf_reset(m);
if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -2103,7 +2143,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2114,7 +2153,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
debug3_f("sending result %d", authenticated);
mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
@@ -3055,7 +3058,7 @@ index 6fe9f46fc..cddbc0a22 100644
if ((displayname = ssh_gssapi_displayname()) != NULL)
auth2_record_info(authctxt, "%s", displayname);
-@@ -2111,5 +2155,84 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2122,5 +2165,84 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
/* Monitor loop will terminate if authenticated */
return (authenticated);
}
@@ -3154,10 +3157,10 @@ index 1b46e794e..75a0d6181 100644
struct ssh;
diff --git a/monitor_wrap.c b/monitor_wrap.c
-index b5aeb8b2c..2d905c16a 100644
+index af0252964..2b044f383 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
-@@ -1110,13 +1110,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+@@ -1112,13 +1112,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
}
int
@@ -3174,7 +3177,7 @@ index b5aeb8b2c..2d905c16a 100644
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
mm_request_receive_expect(pmonitor->m_recvfd,
-@@ -1129,6 +1131,59 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1131,6 +1133,59 @@ mm_ssh_gssapi_userok(char *user)
debug3_f("user %sauthenticated", authenticated ? "" : "not ");
return (authenticated);
}
@@ -3251,7 +3254,7 @@ index 30585187c..07b207d1d 100644
#ifdef USE_PAM
diff --git a/readconf.c b/readconf.c
-index 0218ed128..1b7d4ae4e 100644
+index 7465216f3..992c78866 100644
--- a/readconf.c
+++ b/readconf.c
@@ -57,6 +57,7 @@
@@ -3337,7 +3340,7 @@ index 0218ed128..1b7d4ae4e 100644
case oBatchMode:
intptr = &options->batch_mode;
goto parse_flag;
-@@ -2718,7 +2765,13 @@ initialize_options(Options * options)
+@@ -2719,7 +2766,13 @@ initialize_options(Options * options)
options->fwd_opts.streamlocal_bind_unlink = -1;
options->pubkey_authentication = -1;
options->gss_authentication = -1;
@@ -3351,7 +3354,7 @@ index 0218ed128..1b7d4ae4e 100644
options->password_authentication = -1;
options->kbd_interactive_authentication = -1;
options->kbd_interactive_devices = NULL;
-@@ -2884,8 +2937,18 @@ fill_default_options(Options * options)
+@@ -2885,8 +2938,18 @@ fill_default_options(Options * options)
options->pubkey_authentication = SSH_PUBKEY_AUTH_ALL;
if (options->gss_authentication == -1)
options->gss_authentication = 0;
@@ -3370,7 +3373,7 @@ index 0218ed128..1b7d4ae4e 100644
if (options->password_authentication == -1)
options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1)
-@@ -3765,7 +3828,14 @@ dump_client_config(Options *o, const char *host)
+@@ -3766,7 +3829,14 @@ dump_client_config(Options *o, const char *host)
dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
#ifdef GSSAPI
dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
@@ -3404,7 +3407,7 @@ index dbcb41725..8b0c98acf 100644
* authentication. */
int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
diff --git a/servconf.c b/servconf.c
-index 9b443bea0..6700f5d51 100644
+index e7819d59a..f28d19194 100644
--- a/servconf.c
+++ b/servconf.c
@@ -62,6 +62,7 @@
@@ -3415,7 +3418,7 @@ index 9b443bea0..6700f5d51 100644
#define SSHD_CONFIG_BLOB_VERSION 1
-@@ -337,6 +338,10 @@ fill_default_server_options(ServerOptions *options)
+@@ -335,6 +336,10 @@ fill_default_server_options(ServerOptions *options)
options->log_facility = SYSLOG_FACILITY_AUTH;
if (options->log_level == SYSLOG_LEVEL_NOT_SET)
options->log_level = SYSLOG_LEVEL_INFO;
@@ -3426,7 +3429,7 @@ index 9b443bea0..6700f5d51 100644
if (options->permit_user_env == -1) {
options->permit_user_env = 0;
options->permit_user_env_allowlist = NULL;
-@@ -1437,6 +1442,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1435,6 +1440,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
intptr = &options->gss_authentication;
goto parse_flag;
@@ -3437,7 +3440,7 @@ index 9b443bea0..6700f5d51 100644
case sGSSAPICleanupCredentials:
intptr = &options->gss_cleanup_creds;
goto parse_flag;
-@@ -1448,6 +1457,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1446,6 +1455,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
case sGSSAPIStrictAcceptorCheck:
intptr = &options->gss_strict_acceptor;
goto parse_flag;
@@ -3460,7 +3463,7 @@ index 9b443bea0..6700f5d51 100644
#endif /* GSSAPI */
case sPasswordAuthentication:
-@@ -4218,7 +4243,10 @@ dump_config(ServerOptions *o)
+@@ -4217,7 +4242,10 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds);
dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds);
@@ -3472,7 +3475,7 @@ index 9b443bea0..6700f5d51 100644
dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
dump_cfg_fmtint(sKbdInteractiveAuthentication,
diff --git a/servconf.h b/servconf.h
-index a2345e88a..ddb0f130a 100644
+index 3648e2be1..c6da79f53 100644
--- a/servconf.h
+++ b/servconf.h
@@ -316,14 +316,21 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB
@@ -3654,26 +3657,10 @@ index 7b14e74a8..8ec451926 100644
#endif /* _SSH_GSS_H */
diff --git a/ssh.1 b/ssh.1
-index 28eaeac2f..3aaf3fb16 100644
+index 089bd348a..a61b0abfa 100644
--- a/ssh.1
+++ b/ssh.1
-@@ -543,9 +543,15 @@ For full details of the options listed below, and their possible values, see
- .It ForwardX11Timeout
- .It ForwardX11Trusted
- .It GSSAPIAuthentication
-+.It GSSAPIKeyExchange
-+.It GSSAPIClientIdentity
- .It GSSAPIDelegateCredentials
- .It GatewayPorts
- .It GlobalKnownHostsFile
-+.It GSSAPIKexAlgorithms
-+.It GSSAPIRenewalForcesRekey
-+.It GSSAPIServerIdentity
-+.It GSSAPITrustDns
- .It HashKnownHosts
- .It HostKeyAlgorithms
- .It HostKeyAlias
-@@ -641,6 +647,8 @@ flag),
+@@ -539,6 +539,8 @@ flag),
(supported message integrity codes),
.Ar kex
(key exchange algorithms),
@@ -3683,10 +3670,10 @@ index 28eaeac2f..3aaf3fb16 100644
(key types),
.Ar key-ca-sign
diff --git a/ssh.c b/ssh.c
-index 7c644c23c..07bb1e38f 100644
+index e9f99c433..b9a59ca43 100644
--- a/ssh.c
+++ b/ssh.c
-@@ -786,6 +786,9 @@ main(int ac, char **av)
+@@ -790,6 +790,9 @@ main(int ac, char **av)
else if (strcmp(optarg, "kex") == 0 ||
strcasecmp(optarg, "KexAlgorithms") == 0)
cp = kex_alg_list('\n');
@@ -3696,7 +3683,7 @@ index 7c644c23c..07bb1e38f 100644
else if (strcmp(optarg, "key") == 0)
cp = sshkey_alg_list(0, 0, 0, '\n');
else if (strcmp(optarg, "key-cert") == 0)
-@@ -816,8 +819,8 @@ main(int ac, char **av)
+@@ -820,8 +823,8 @@ main(int ac, char **av)
} else if (strcmp(optarg, "help") == 0) {
cp = xstrdup(
"cipher\ncipher-auth\ncompression\nkex\n"
@@ -3721,10 +3708,10 @@ index d9324c957..ca7c5853b 100644
# CheckHostIP no
# AddressFamily any
diff --git a/ssh_config.5 b/ssh_config.5
-index 4ac0d3d45..0b5b8beab 100644
+index bdaa49c81..04797a1e9 100644
--- a/ssh_config.5
+++ b/ssh_config.5
-@@ -1013,10 +1013,71 @@ The default is
+@@ -1014,10 +1014,71 @@ The default is
Specifies whether user authentication based on GSSAPI is allowed.
The default is
.Cm no .
@@ -3797,7 +3784,7 @@ index 4ac0d3d45..0b5b8beab 100644
Indicates that
.Xr ssh 1
diff --git a/sshconnect2.c b/sshconnect2.c
-index d1555ee97..e1d4388ad 100644
+index 0d4888402..5459caa0c 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -223,6 +223,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
@@ -3812,7 +3799,7 @@ index d1555ee97..e1d4388ad 100644
xxx_host = xstrdup(host);
xxx_hostaddr = *hostaddr;
xxx_conn_info = ssh_conn_info_dup(cinfo);
-@@ -258,6 +263,42 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+@@ -257,6 +262,42 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
compression_alg_list(options.compression),
hkalgs ? hkalgs : options.hostkeyalgorithms);
@@ -3855,10 +3842,10 @@ index d1555ee97..e1d4388ad 100644
free(hkalgs);
/* start key exchange */
-@@ -274,15 +315,45 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
- # ifdef OPENSSL_HAS_ECC
+@@ -271,16 +312,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+ ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
+ ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
- # endif
-#endif
+# ifdef GSSAPI
+ if (options.gss_keyex) {
@@ -3875,6 +3862,7 @@ index d1555ee97..e1d4388ad 100644
ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client;
ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client;
+ ssh->kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_client;
ssh->kex->verify_host_key=&verify_host_key_callback;
+#if defined(GSSAPI) && defined(WITH_OPENSSL)
@@ -3902,7 +3890,7 @@ index d1555ee97..e1d4388ad 100644
#ifdef DEBUG_KEXDH
/* send 1st encrypted/maced/compressed message */
if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 ||
-@@ -372,6 +443,7 @@ static int input_gssapi_response(int type, uint32_t, struct ssh *);
+@@ -370,6 +441,7 @@ static int input_gssapi_response(int type, uint32_t, struct ssh *);
static int input_gssapi_token(int type, uint32_t, struct ssh *);
static int input_gssapi_error(int, uint32_t, struct ssh *);
static int input_gssapi_errtok(int, uint32_t, struct ssh *);
@@ -3910,7 +3898,7 @@ index d1555ee97..e1d4388ad 100644
#endif
void userauth(struct ssh *, char *);
-@@ -388,6 +460,11 @@ static char *authmethods_get(void);
+@@ -386,6 +458,11 @@ static char *authmethods_get(void);
Authmethod authmethods[] = {
#ifdef GSSAPI
@@ -3922,7 +3910,7 @@ index d1555ee97..e1d4388ad 100644
{"gssapi-with-mic",
userauth_gssapi,
userauth_gssapi_cleanup,
-@@ -762,12 +839,32 @@ userauth_gssapi(struct ssh *ssh)
+@@ -760,12 +837,32 @@ userauth_gssapi(struct ssh *ssh)
OM_uint32 min;
int r, ok = 0;
gss_OID mech = NULL;
@@ -3956,7 +3944,7 @@ index d1555ee97..e1d4388ad 100644
/* Check to see whether the mechanism is usable before we offer it */
while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
-@@ -776,13 +873,15 @@ userauth_gssapi(struct ssh *ssh)
+@@ -774,13 +871,15 @@ userauth_gssapi(struct ssh *ssh)
elements[authctxt->mech_tried];
/* My DER encoding requires length<128 */
if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
@@ -3973,7 +3961,7 @@ index d1555ee97..e1d4388ad 100644
if (!ok || mech == NULL)
return 0;
-@@ -1016,6 +1115,55 @@ input_gssapi_error(int type, uint32_t plen, struct ssh *ssh)
+@@ -1014,6 +1113,55 @@ input_gssapi_error(int type, uint32_t plen, struct ssh *ssh)
free(lang);
return r;
}
@@ -4030,7 +4018,7 @@ index d1555ee97..e1d4388ad 100644
static int
diff --git a/sshd-auth.c b/sshd-auth.c
-index 99359c718..6a5cd0c52 100644
+index 14109151c..079063f47 100644
--- a/sshd-auth.c
+++ b/sshd-auth.c
@@ -665,7 +665,7 @@ main(int ac, char **av)
@@ -4042,7 +4030,7 @@ index 99359c718..6a5cd0c52 100644
fatal("internal error: received no hostkeys");
/* Ensure that umask disallows at least group and world write */
-@@ -785,6 +785,48 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -784,6 +784,48 @@ do_ssh2_kex(struct ssh *ssh)
free(hkalgs);
@@ -4091,10 +4079,12 @@ index 99359c718..6a5cd0c52 100644
if ((r = kex_exchange_identification(ssh, -1,
options.version_addendum)) != 0)
sshpkt_fatal(ssh, r, "banner exchange");
-@@ -810,6 +852,17 @@ do_ssh2_kex(struct ssh *ssh)
- # ifdef OPENSSL_HAS_ECC
+@@ -807,8 +849,18 @@ do_ssh2_kex(struct ssh *ssh)
+ kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+ kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
- # endif /* OPENSSL_HAS_ECC */
+- kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server;
+-#endif
+# ifdef GSSAPI
+ if (options.gss_keyex) {
+ kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
@@ -4106,11 +4096,12 @@ index 99359c718..6a5cd0c52 100644
+ kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
+ }
+# endif
- #endif /* WITH_OPENSSL */
++#endif /* WITH_OPENSSL */
kex->kex[KEX_C25519_SHA256] = kex_gen_server;
kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
+ kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
diff --git a/sshd-session.c b/sshd-session.c
-index 8c6652152..352237474 100644
+index 6e9b28dec..cf6709f46 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -565,8 +565,8 @@ notify_hostkeys(struct ssh *ssh)
@@ -4151,10 +4142,10 @@ index 7d1466d97..f66e1f86f 100644
exit(1);
}
diff --git a/sshd_config b/sshd_config
-index 48af6321b..8db9f0fb1 100644
+index f626d5801..404aa1bbb 100644
--- a/sshd_config
+++ b/sshd_config
-@@ -79,6 +79,8 @@ AuthorizedKeysFile .ssh/authorized_keys
+@@ -80,6 +80,8 @@ AuthorizedKeysFile .ssh/authorized_keys
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
@@ -4164,10 +4155,10 @@ index 48af6321b..8db9f0fb1 100644
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
diff --git a/sshd_config.5 b/sshd_config.5
-index 3896d21b0..b719fc915 100644
+index e85cca6eb..625e6fdec 100644
--- a/sshd_config.5
+++ b/sshd_config.5
-@@ -759,9 +759,19 @@ on logout.
+@@ -760,9 +760,19 @@ on logout.
The default is
.Cm yes .
.It Cm GSSAPIDelegateCredentials
@@ -4189,7 +4180,7 @@ index 3896d21b0..b719fc915 100644
.It Cm GSSAPIStrictAcceptorCheck
Determines whether to be strict about the identity of the GSSAPI acceptor
a client authenticates against.
-@@ -777,6 +787,35 @@ This facility is provided to assist with operation on multi homed machines.
+@@ -778,6 +788,35 @@ This facility is provided to assist with operation on multi homed machines.
The default is
.Cm yes .
This option may not be effective in Windows Active Directory environments.
@@ -4226,10 +4217,10 @@ index 3896d21b0..b719fc915 100644
Specifies the signature algorithms that will be accepted for hostbased
authentication as a list of comma-separated patterns.
diff --git a/sshkey.c b/sshkey.c
-index 7f389daa9..6bb8feaa9 100644
+index a590529a0..7d1401a8f 100644
--- a/sshkey.c
+++ b/sshkey.c
-@@ -119,6 +119,75 @@ extern const struct sshkey_impl sshkey_rsa_sha512_impl;
+@@ -115,6 +115,75 @@ extern const struct sshkey_impl sshkey_rsa_sha512_impl;
extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl;
#endif /* WITH_OPENSSL */
@@ -4305,7 +4296,7 @@ index 7f389daa9..6bb8feaa9 100644
const struct sshkey_impl * const keyimpls[] = {
&sshkey_ed25519_impl,
&sshkey_ed25519_cert_impl,
-@@ -154,6 +223,7 @@ const struct sshkey_impl * const keyimpls[] = {
+@@ -146,6 +215,7 @@ const struct sshkey_impl * const keyimpls[] = {
&sshkey_rsa_sha512_impl,
&sshkey_rsa_sha512_cert_impl,
#endif /* WITH_OPENSSL */
@@ -4313,7 +4304,7 @@ index 7f389daa9..6bb8feaa9 100644
NULL
};
-@@ -335,7 +405,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
+@@ -327,7 +397,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
for (i = 0; keyimpls[i] != NULL; i++) {
impl = keyimpls[i];
@@ -4323,10 +4314,10 @@ index 7f389daa9..6bb8feaa9 100644
if (!include_sigonly && impl->sigonly)
continue;
diff --git a/sshkey.h b/sshkey.h
-index 9ad5583a2..58cb58981 100644
+index e4f84f16f..3e738f42c 100644
--- a/sshkey.h
+++ b/sshkey.h
-@@ -69,6 +69,7 @@ enum sshkey_types {
+@@ -63,6 +63,7 @@ enum sshkey_types {
KEY_ED25519_SK_CERT,
KEY_MLDSA44_ED25519,
KEY_MLDSA44_ED25519_CERT,
diff --git a/0014-openssh-6.6p1-force_krb.patch b/0014-openssh-6.6p1-force_krb.patch
index 99a2819..fdd0c85 100644
--- a/0014-openssh-6.6p1-force_krb.patch
+++ b/0014-openssh-6.6p1-force_krb.patch
@@ -1,7 +1,7 @@
-From 2f007272e169c885bf152a8fe7ddcac127b8bc07 Mon Sep 17 00:00:00 2001
+From 5d1debdaee7b6dc51c5f10530b4698a7a2f1bb80 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 14/54] openssh-6.6p1-force_krb
+Subject: [PATCH 14/53] openssh-6.6p1-force_krb
#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
---
@@ -267,10 +267,10 @@ index 8ec451926..db34d77f4 100644
/* draft-ietf-secsh-gsskeyex-06 */
diff --git a/sshd.8 b/sshd.8
-index 0226a8303..e2d8ff003 100644
+index 24e5639a3..8ef358cd5 100644
--- a/sshd.8
+++ b/sshd.8
-@@ -286,6 +286,7 @@ Finally, the server and the client enter an authentication dialog.
+@@ -287,6 +287,7 @@ Finally, the server and the client enter an authentication dialog.
The client tries to authenticate itself using
host-based authentication,
public key authentication,
@@ -278,7 +278,7 @@ index 0226a8303..e2d8ff003 100644
challenge-response authentication,
or password authentication.
.Pp
-@@ -874,6 +875,12 @@ This file is used in exactly the same way as
+@@ -878,6 +879,12 @@ This file is used in exactly the same way as
but allows host-based authentication without permitting login with
rlogin/rsh.
.Pp
diff --git a/0015-openssh-7.7p1-gssapi-new-unique.patch b/0015-openssh-7.7p1-gssapi-new-unique.patch
index 6c1df7d..55ebe93 100644
--- a/0015-openssh-7.7p1-gssapi-new-unique.patch
+++ b/0015-openssh-7.7p1-gssapi-new-unique.patch
@@ -1,7 +1,7 @@
-From bbff1e17bdb5d921ab8b8cc30891c5f29d04731e Mon Sep 17 00:00:00 2001
+From 9452875760b99fb538463f291fcedee75dee4a38 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 15/54] openssh-7.7p1-gssapi-new-unique
+Subject: [PATCH 15/53] openssh-7.7p1-gssapi-new-unique
---
auth-krb5.c | 264 ++++++++++++++++++++++++++++++++++++++++++------
@@ -516,10 +516,10 @@ index 8b4fa9cfe..6eb7d2163 100644
ok = mm_ssh_gssapi_update_creds(&gssapi_client.store);
diff --git a/servconf.c b/servconf.c
-index 6700f5d51..2d11e1d00 100644
+index f28d19194..ae18d56fd 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -1437,6 +1437,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1435,6 +1435,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
#endif /* USE_AFS */
#endif /* KRB5 */
@@ -530,7 +530,7 @@ index 6700f5d51..2d11e1d00 100644
#ifdef GSSAPI
case sGSSAPIAuthentication:
intptr = &options->gss_authentication;
-@@ -4238,6 +4242,7 @@ dump_config(ServerOptions *o)
+@@ -4237,6 +4241,7 @@ dump_config(ServerOptions *o)
# ifdef USE_AFS
dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
# endif
@@ -539,7 +539,7 @@ index 6700f5d51..2d11e1d00 100644
#ifdef GSSAPI
dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
diff --git a/servconf.h b/servconf.h
-index ddb0f130a..6ca89b24e 100644
+index c6da79f53..5f5672082 100644
--- a/servconf.h
+++ b/servconf.h
@@ -303,12 +303,14 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB
@@ -603,10 +603,10 @@ index db34d77f4..a894e23c9 100644
char *ssh_gssapi_server_mechanisms(void);
diff --git a/sshd-session.c b/sshd-session.c
-index 352237474..3d2672cfd 100644
+index cf6709f46..8a3121d01 100644
--- a/sshd-session.c
+++ b/sshd-session.c
-@@ -1296,7 +1296,7 @@ main(int ac, char **av)
+@@ -1298,7 +1298,7 @@ main(int ac, char **av)
#ifdef GSSAPI
if (options.gss_authentication) {
temporarily_use_uid(authctxt->pw);
@@ -616,10 +616,10 @@ index 352237474..3d2672cfd 100644
}
#endif
diff --git a/sshd_config.5 b/sshd_config.5
-index b719fc915..372af241b 100644
+index 625e6fdec..08a304cdc 100644
--- a/sshd_config.5
+++ b/sshd_config.5
-@@ -1068,6 +1068,14 @@ Specifies whether to automatically destroy the user's ticket cache
+@@ -1074,6 +1074,14 @@ Specifies whether to automatically destroy the user's ticket cache
file on logout.
The default is
.Cm yes .
diff --git a/0016-openssh-7.2p2-k5login_directory.patch b/0016-openssh-7.2p2-k5login_directory.patch
index d4a07cb..2cd743e 100644
--- a/0016-openssh-7.2p2-k5login_directory.patch
+++ b/0016-openssh-7.2p2-k5login_directory.patch
@@ -1,7 +1,7 @@
-From 9ef48ad3dc898461ee9577edc8e29401a13ee18e Mon Sep 17 00:00:00 2001
+From 76a46dc287ab78071242bbf8f31dd1dd2f805970 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 16/54] openssh-7.2p2-k5login_directory
+Subject: [PATCH 16/53] openssh-7.2p2-k5login_directory
# Respect k5login_directory option in krk5.conf (#1328243)
---
@@ -84,10 +84,10 @@ index 415fb1893..7df31c6af 100644
}
diff --git a/sshd.8 b/sshd.8
-index e2d8ff003..fa33f5232 100644
+index 8ef358cd5..ae22a9ea4 100644
--- a/sshd.8
+++ b/sshd.8
-@@ -880,6 +880,10 @@ rlogin/rsh.
+@@ -884,6 +884,10 @@ rlogin/rsh.
These files enforce GSSAPI/Kerberos authentication access control.
Further details are described in
.Xr ksu 1 .
diff --git a/0017-openssh-6.6p1-kuserok.patch b/0017-openssh-6.6p1-kuserok.patch
index 94d4a8b..f84381d 100644
--- a/0017-openssh-6.6p1-kuserok.patch
+++ b/0017-openssh-6.6p1-kuserok.patch
@@ -1,7 +1,7 @@
-From 1cf118c9a9f46b4ed0d0e5e6a7f70c4a450ed470 Mon Sep 17 00:00:00 2001
+From 4672febd5ff5082fe25b18069485f05491238dc2 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 17/54] openssh-6.6p1-kuserok
+Subject: [PATCH 17/53] openssh-6.6p1-kuserok
---
auth-krb5.c | 20 ++++++++-
@@ -189,10 +189,10 @@ index 7df31c6af..6f5826ce8 100644
if ((fp = fopen(file, "r")) == NULL) {
int saved_errno = errno;
diff --git a/servconf.c b/servconf.c
-index 2d11e1d00..fab3b4235 100644
+index ae18d56fd..5de03f3bf 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -2230,6 +2230,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -2229,6 +2229,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
}
break;
@@ -203,7 +203,7 @@ index 2d11e1d00..fab3b4235 100644
case sMatch:
if (cmdline)
fatal("Match directive not supported as a command-line "
-@@ -4243,6 +4247,7 @@ dump_config(ServerOptions *o)
+@@ -4242,6 +4246,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
# endif
dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
@@ -212,7 +212,7 @@ index 2d11e1d00..fab3b4235 100644
#ifdef GSSAPI
dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
diff --git a/servconf.h b/servconf.h
-index 6ca89b24e..59e98604a 100644
+index 5f5672082..7c003b8c5 100644
--- a/servconf.h
+++ b/servconf.h
@@ -304,6 +304,7 @@ SSHCONF_INTFLAG(kerberos_authentication, KerberosAuthentication, SSHCFG_ALL, 0,
@@ -232,10 +232,10 @@ index 6ca89b24e..59e98604a 100644
#endif /* KRB5 */
diff --git a/sshd_config b/sshd_config
-index 8db9f0fb1..ea5a878e6 100644
+index 404aa1bbb..76279d795 100644
--- a/sshd_config
+++ b/sshd_config
-@@ -75,6 +75,7 @@ AuthorizedKeysFile .ssh/authorized_keys
+@@ -76,6 +76,7 @@ AuthorizedKeysFile .ssh/authorized_keys
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
@@ -244,10 +244,10 @@ index 8db9f0fb1..ea5a878e6 100644
# GSSAPI options
#GSSAPIAuthentication no
diff --git a/sshd_config.5 b/sshd_config.5
-index 372af241b..c3a4806e0 100644
+index 08a304cdc..0077ee096 100644
--- a/sshd_config.5
+++ b/sshd_config.5
-@@ -1076,6 +1076,10 @@ The default value
+@@ -1082,6 +1082,10 @@ The default value
.Cm no
can lead to overwriting previous tickets by subseqent connections to the same
user account.
@@ -258,7 +258,7 @@ index 372af241b..c3a4806e0 100644
.It Cm KexAlgorithms
Specifies the permitted KEX (Key Exchange) algorithms that the server will
offer to clients.
-@@ -1390,6 +1394,7 @@ Available keywords are
+@@ -1398,6 +1402,7 @@ Available keywords are
.Cm IPQoS ,
.Cm KbdInteractiveAuthentication ,
.Cm KerberosAuthentication ,
diff --git a/0018-openssh-6.4p1-fromto-remote.patch b/0018-openssh-6.4p1-fromto-remote.patch
index 3229b2a..204c575 100644
--- a/0018-openssh-6.4p1-fromto-remote.patch
+++ b/0018-openssh-6.4p1-fromto-remote.patch
@@ -1,7 +1,7 @@
-From dd2ebdcbf7486fc9caf1f8f0edd52dbb372c19c6 Mon Sep 17 00:00:00 2001
+From e6388dfdb9cc60c505b7d2765ec0688de0820abb Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 18/54] openssh-6.4p1-fromto-remote
+Subject: [PATCH 18/53] openssh-6.4p1-fromto-remote
# Use tty allocation for a remote scp (#985650)
---
diff --git a/0019-openssh-6.6.1p1-log-in-chroot.patch b/0019-openssh-6.6.1p1-log-in-chroot.patch
index a66d8aa..2538ec2 100644
--- a/0019-openssh-6.6.1p1-log-in-chroot.patch
+++ b/0019-openssh-6.6.1p1-log-in-chroot.patch
@@ -1,7 +1,7 @@
-From 7eadf0e2a279538fa7e4b1bd5cbd2fc6917e4753 Mon Sep 17 00:00:00 2001
+From 2316543bf85035762d9aadf200067fcaf2d0e338 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 19/54] openssh-6.6.1p1-log-in-chroot
+Subject: [PATCH 19/53] openssh-6.6.1p1-log-in-chroot
---
log.c | 11 +++++++++--
@@ -57,10 +57,10 @@ index 8e8dfc23f..70048a8af 100644
int log_change_level(LogLevel);
int log_is_on_stderr(void);
diff --git a/monitor.c b/monitor.c
-index cddbc0a22..7e1c9061c 100644
+index fa477899e..14cdccf2f 100644
--- a/monitor.c
+++ b/monitor.c
-@@ -2004,9 +2004,22 @@ monitor_init(void)
+@@ -2014,9 +2014,22 @@ monitor_init(void)
}
void
@@ -226,7 +226,7 @@ index 2bde8bb7f..ddf1a3968 100644
+int sftp_server_main(int, char **, struct passwd *, int);
void sftp_server_cleanup_exit(int) __attribute__((noreturn));
diff --git a/sshd-session.c b/sshd-session.c
-index 3d2672cfd..6f07c843a 100644
+index 8a3121d01..8a06616fd 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -387,7 +387,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
diff --git a/0020-openssh-6.6.1p1-scp-non-existing-directory.patch b/0020-openssh-6.6.1p1-scp-non-existing-directory.patch
index 208229f..32d4b60 100644
--- a/0020-openssh-6.6.1p1-scp-non-existing-directory.patch
+++ b/0020-openssh-6.6.1p1-scp-non-existing-directory.patch
@@ -1,7 +1,7 @@
-From 3e67dc83e590c370c9bdbf32a5e9d8fcc769b25c Mon Sep 17 00:00:00 2001
+From cf8d9d0f602ac23fa35e4f8b638a0494564d7dc4 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 20/54] openssh-6.6.1p1-scp-non-existing-directory
+Subject: [PATCH 20/53] openssh-6.6.1p1-scp-non-existing-directory
# scp file into non-existing directory (#1142223)
---
diff --git a/0021-openssh-6.6p1-GSSAPIEnablek5users.patch b/0021-openssh-6.6p1-GSSAPIEnablek5users.patch
index a2bfe19..96eeff4 100644
--- a/0021-openssh-6.6p1-GSSAPIEnablek5users.patch
+++ b/0021-openssh-6.6p1-GSSAPIEnablek5users.patch
@@ -1,7 +1,7 @@
-From abea763fed511c64efaea276a6037fb7930dba8e Mon Sep 17 00:00:00 2001
+From dd1871972173c9f4836c4d8096411981d291ff85 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 21/54] openssh-6.6p1-GSSAPIEnablek5users
+Subject: [PATCH 21/53] openssh-6.6p1-GSSAPIEnablek5users
---
gss-serv-krb5.c | 3 +--
@@ -32,10 +32,10 @@ index 6f5826ce8..723509409 100644
k5login_exists);
}
diff --git a/servconf.c b/servconf.c
-index fab3b4235..1bfe6a016 100644
+index 5de03f3bf..3dbfccea8 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -2234,6 +2234,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -2233,6 +2233,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
intptr = &options->use_kuserok;
goto parse_flag;
@@ -46,7 +46,7 @@ index fab3b4235..1bfe6a016 100644
case sMatch:
if (cmdline)
fatal("Match directive not supported as a command-line "
-@@ -4248,6 +4252,7 @@ dump_config(ServerOptions *o)
+@@ -4247,6 +4251,7 @@ dump_config(ServerOptions *o)
# endif
dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
@@ -55,7 +55,7 @@ index fab3b4235..1bfe6a016 100644
#ifdef GSSAPI
dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
diff --git a/servconf.h b/servconf.h
-index 59e98604a..7e809cfff 100644
+index 7c003b8c5..c55b64c73 100644
--- a/servconf.h
+++ b/servconf.h
@@ -325,7 +325,8 @@ SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SS
@@ -79,10 +79,10 @@ index 59e98604a..7e809cfff 100644
#define SSHD_CONFIG_ENTRIES \
diff --git a/sshd_config b/sshd_config
-index ea5a878e6..33713c886 100644
+index 76279d795..d38d899a6 100644
--- a/sshd_config
+++ b/sshd_config
-@@ -82,6 +82,7 @@ AuthorizedKeysFile .ssh/authorized_keys
+@@ -83,6 +83,7 @@ AuthorizedKeysFile .ssh/authorized_keys
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
diff --git a/0022-openssh-6.8p1-sshdT-output.patch b/0022-openssh-6.8p1-sshdT-output.patch
index 49a189d..acfe3f8 100644
--- a/0022-openssh-6.8p1-sshdT-output.patch
+++ b/0022-openssh-6.8p1-sshdT-output.patch
@@ -1,7 +1,7 @@
-From 6c66287c50ba4d1aadf27bef9b2c5ca6e702b082 Mon Sep 17 00:00:00 2001
+From c5cc166ff9eeba6b346022aa1ee0e4d78a2e1fdd Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 22/54] openssh-6.8p1-sshdT-output
+Subject: [PATCH 22/53] openssh-6.8p1-sshdT-output
# apply upstream patch and make sshd -T more consistent (#1187521)
---
@@ -9,10 +9,10 @@ Subject: [PATCH 22/54] openssh-6.8p1-sshdT-output
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/servconf.c b/servconf.c
-index 1bfe6a016..8c1e9c253 100644
+index 3dbfccea8..27147a1e7 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -4295,7 +4295,7 @@ dump_config(ServerOptions *o)
+@@ -4294,7 +4294,7 @@ dump_config(ServerOptions *o)
dump_cfg_string(sXAuthLocation, o->xauth_location);
dump_cfg_string(sCiphers, o->ciphers);
dump_cfg_string(sMacs, o->macs);
diff --git a/0023-openssh-6.7p1-sftp-force-permission.patch b/0023-openssh-6.7p1-sftp-force-permission.patch
index 17aabe7..049b61e 100644
--- a/0023-openssh-6.7p1-sftp-force-permission.patch
+++ b/0023-openssh-6.7p1-sftp-force-permission.patch
@@ -1,7 +1,7 @@
-From 44beb498b44626a5b3896d832cd3a6ab63839253 Mon Sep 17 00:00:00 2001
+From 71b2ca7bbf39514e96da573758d157a7d52625bc Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 23/54] openssh-6.7p1-sftp-force-permission
+Subject: [PATCH 23/53] openssh-6.7p1-sftp-force-permission
# Add sftp option to force mode of created files (#1191055)
---
diff --git a/0024-openssh-7.2p2-s390-closefrom.patch b/0024-openssh-7.2p2-s390-closefrom.patch
index ed2a344..2c95518 100644
--- a/0024-openssh-7.2p2-s390-closefrom.patch
+++ b/0024-openssh-7.2p2-s390-closefrom.patch
@@ -1,7 +1,7 @@
-From 041006bcb50a819b4af2f49712a195cd89512dae Mon Sep 17 00:00:00 2001
+From dd953f0572ef6b53825afb50cc44d65b2047831e Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 24/54] openssh-7.2p2-s390-closefrom
+Subject: [PATCH 24/53] openssh-7.2p2-s390-closefrom
# make s390 use /dev/ crypto devices -- ignore closefrom
---
diff --git a/0025-openssh-7.5p1-sandbox.patch b/0025-openssh-7.5p1-sandbox.patch
index 0e34eac..d24685a 100644
--- a/0025-openssh-7.5p1-sandbox.patch
+++ b/0025-openssh-7.5p1-sandbox.patch
@@ -1,7 +1,7 @@
-From a1ad75cbcf9f01d521cd01f3c29219602cfd46da Mon Sep 17 00:00:00 2001
+From 4688280417e4ea28be7683b554f91e31f234136b Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 25/54] openssh-7.5p1-sandbox
+Subject: [PATCH 25/53] openssh-7.5p1-sandbox
# Sandbox adjustments for s390 and audit
---
diff --git a/0026-openssh-7.8p1-scp-ipv6.patch b/0026-openssh-7.8p1-scp-ipv6.patch
index 08772dc..7faacb0 100644
--- a/0026-openssh-7.8p1-scp-ipv6.patch
+++ b/0026-openssh-7.8p1-scp-ipv6.patch
@@ -1,7 +1,7 @@
-From a68d0c768bea17bfc1cc3133563e9dfa01124818 Mon Sep 17 00:00:00 2001
+From 46c63b52afa8136a46a9094a69b4c011f22b44ac Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 26/54] openssh-7.8p1-scp-ipv6
+Subject: [PATCH 26/53] openssh-7.8p1-scp-ipv6
# Unbreak scp between two IPv6 hosts (#1620333)
---
diff --git a/0027-openssh-8.0p1-crypto-policies.patch b/0027-openssh-8.0p1-crypto-policies.patch
index f2e501c..0145163 100644
--- a/0027-openssh-8.0p1-crypto-policies.patch
+++ b/0027-openssh-8.0p1-crypto-policies.patch
@@ -1,18 +1,18 @@
-From 7a1bb302fbabeee5f740acc33b0be3df9aa9ef4a Mon Sep 17 00:00:00 2001
+From 7a5ff8f728cfb98c90dcbe648723fb4d4ed02300 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 27/54] openssh-8.0p1-crypto-policies
+Subject: [PATCH 27/53] openssh-8.0p1-crypto-policies
---
- ssh_config.5 | 167 +++++++++++++++++++-------------------------
- sshd_config.5 | 186 ++++++++++++++++++--------------------------------
- 2 files changed, 139 insertions(+), 214 deletions(-)
+ ssh_config.5 | 172 +++++++++++++++++++-------------------------
+ sshd_config.5 | 193 ++++++++++++++++++--------------------------------
+ 2 files changed, 139 insertions(+), 226 deletions(-)
diff --git a/ssh_config.5 b/ssh_config.5
-index 0b5b8beab..0447c8c7e 100644
+index 04797a1e9..c4c72f587 100644
--- a/ssh_config.5
+++ b/ssh_config.5
-@@ -468,17 +468,13 @@ A single argument of
+@@ -468,18 +468,13 @@ A single argument of
causes no CNAMEs to be considered for canonicalization.
This is the default behaviour.
.It Cm CASignatureAlgorithms
@@ -29,13 +29,14 @@ index 0b5b8beab..0447c8c7e 100644
-ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
-.Pp
If the specified list begins with a
.Sq +
character, then the specified algorithms will be appended to the default set
-@@ -617,20 +613,25 @@ If the option is set to
+@@ -618,20 +613,25 @@ If the option is set to
(the default),
the check will not be executed.
.It Cm Ciphers
@@ -65,7 +66,7 @@ index 0b5b8beab..0447c8c7e 100644
.Pp
The supported ciphers are:
.Bd -literal -offset indent
-@@ -646,13 +647,6 @@ aes256-gcm@openssh.com
+@@ -647,13 +647,6 @@ aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
.Ed
.Pp
@@ -79,7 +80,7 @@ index 0b5b8beab..0447c8c7e 100644
The list of available ciphers may also be obtained using
.Qq ssh -Q cipher .
.It Cm ClearAllForwardings
-@@ -1059,6 +1053,11 @@ command line will be passed untouched to the GSSAPI library.
+@@ -1060,6 +1053,11 @@ command line will be passed untouched to the GSSAPI library.
The default is
.Dq no .
.It Cm GSSAPIKexAlgorithms
@@ -91,7 +92,7 @@ index 0b5b8beab..0447c8c7e 100644
The list of key exchange algorithms that are offered for GSSAPI
key exchange. Possible values are
.Bd -literal -offset 3n
-@@ -1071,9 +1070,6 @@ gss-nistp256-sha256-,
+@@ -1072,9 +1070,6 @@ gss-nistp256-sha256-,
gss-curve25519-sha256-
.Ed
.Pp
@@ -101,7 +102,7 @@ index 0b5b8beab..0447c8c7e 100644
This option only applies to connections using GSSAPI.
.Pp
The list of supported key exchange algorithms may also be obtained using
-@@ -1096,38 +1092,25 @@ will not be converted automatically,
+@@ -1097,40 +1092,25 @@ will not be converted automatically,
but may be manually hashed using
.Xr ssh-keygen 1 .
.It Cm HostbasedAcceptedAlgorithms
@@ -137,18 +138,20 @@ index 0b5b8beab..0447c8c7e 100644
-webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-mldsa44-ed25519-cert-v01@openssh.com,
-ssh-ed25519,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
-webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
+at the head of the built-in openssh default set.
.Pp
The
.Fl Q
-@@ -1182,6 +1165,17 @@ to prefer their algorithms.
+@@ -1187,6 +1167,17 @@ to prefer their algorithms.
.Pp
The list of available signature algorithms may also be obtained using
.Qq ssh -Q HostKeyAlgorithms .
@@ -166,7 +169,7 @@ index 0b5b8beab..0447c8c7e 100644
.It Cm HostKeyAlias
Specifies an alias that should be used instead of the
real host name when looking up or saving the host key
-@@ -1379,6 +1373,11 @@ it may be zero or more of:
+@@ -1385,6 +1376,11 @@ it may be zero or more of:
and
.Cm pam .
.It Cm KexAlgorithms
@@ -178,7 +181,7 @@ index 0b5b8beab..0447c8c7e 100644
Specifies the permitted KEX (Key Exchange) algorithms that will be used and
their preference order.
The selected algorithm will be the first algorithm in this list that
-@@ -1387,28 +1386,16 @@ Multiple algorithms must be comma-separated.
+@@ -1393,28 +1389,16 @@ Multiple algorithms must be comma-separated.
.Pp
If the specified list begins with a
.Sq +
@@ -211,7 +214,7 @@ index 0b5b8beab..0447c8c7e 100644
.Pp
The list of supported key exchange algorithms may also be obtained using
.Qq ssh -Q kex .
-@@ -1525,37 +1512,33 @@ function, and all code in the
+@@ -1531,37 +1515,33 @@ function, and all code in the
file.
This option is intended for debugging and no overrides are enabled by default.
.It Cm MACs
@@ -258,7 +261,7 @@ index 0b5b8beab..0447c8c7e 100644
The list of available MAC algorithms may also be obtained using
.Qq ssh -Q mac .
.It Cm NoHostAuthenticationForLocalhost
-@@ -1744,41 +1727,31 @@ instead of continuing to execute and pass data.
+@@ -1750,43 +1730,31 @@ instead of continuing to execute and pass data.
The default is
.Cm no .
.It Cm PubkeyAcceptedAlgorithms
@@ -295,12 +298,14 @@ index 0b5b8beab..0447c8c7e 100644
-webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-mldsa44-ed25519-cert-v01@openssh.com,
-ssh-ed25519,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
-webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
+built-in openssh default set.
.Pp
@@ -312,7 +317,7 @@ index 0b5b8beab..0447c8c7e 100644
.It Cm PubkeyAuthentication
Specifies whether to try public key authentication.
The argument to this keyword must be
-@@ -2532,7 +2505,9 @@ for those users who do not have a configuration file.
+@@ -2540,7 +2508,9 @@ for those users who do not have a configuration file.
This file must be world-readable.
.El
.Sh SEE ALSO
@@ -324,10 +329,10 @@ index 0b5b8beab..0447c8c7e 100644
.An -nosplit
OpenSSH is a derivative of the original and free
diff --git a/sshd_config.5 b/sshd_config.5
-index c3a4806e0..5998275d2 100644
+index 0077ee096..b72757895 100644
--- a/sshd_config.5
+++ b/sshd_config.5
-@@ -383,17 +383,13 @@ If the argument is
+@@ -383,18 +383,13 @@ If the argument is
then no banner is displayed.
By default, no banner is displayed.
.It Cm CASignatureAlgorithms
@@ -344,13 +349,14 @@ index c3a4806e0..5998275d2 100644
-ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
-.Pp
If the specified list begins with a
.Sq +
character, then the specified algorithms will be appended to the default set
-@@ -537,20 +533,25 @@ The default is
+@@ -538,20 +533,25 @@ The default is
indicating not to
.Xr chroot 2 .
.It Cm Ciphers
@@ -380,7 +386,7 @@ index c3a4806e0..5998275d2 100644
.Pp
The supported ciphers are:
.Pp
-@@ -577,13 +578,6 @@ aes256-gcm@openssh.com
+@@ -578,13 +578,6 @@ aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
.El
.Pp
@@ -394,7 +400,7 @@ index c3a4806e0..5998275d2 100644
The list of available ciphers may also be obtained using
.Qq ssh -Q cipher .
.It Cm ClientAliveCountMax
-@@ -797,58 +791,46 @@ For this to work
+@@ -798,60 +791,46 @@ For this to work
.Cm GSSAPIKeyExchange
needs to be enabled in the server and also used by the client.
.It Cm GSSAPIKexAlgorithms
@@ -461,18 +467,20 @@ index c3a4806e0..5998275d2 100644
-webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-mldsa44-ed25519-cert-v01@openssh.com,
-ssh-ed25519,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
-webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
+the head of the built-in openssh default set.
.Pp
The list of available signature algorithms may also be obtained using
.Qq ssh -Q HostbasedAcceptedAlgorithms .
-@@ -915,27 +897,13 @@ is specified, the location of the socket will be read from the
+@@ -919,29 +898,13 @@ is specified, the location of the socket will be read from the
.Ev SSH_AUTH_SOCK
environment variable.
.It Cm HostKeyAlgorithms
@@ -494,18 +502,20 @@ index c3a4806e0..5998275d2 100644
-webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-mldsa44-ed25519-cert-v01@openssh.com,
-ssh-ed25519,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
-webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
-.Pp
The list of available signature algorithms may also be obtained using
.Qq ssh -Q HostKeyAlgorithms .
.It Cm IgnoreRhosts
-@@ -1081,6 +1049,11 @@ Specifies whether to look at .k5login file for user's aliases.
+@@ -1087,6 +1050,11 @@ Specifies whether to look at .k5login file for user's aliases.
The default is
.Cm yes .
.It Cm KexAlgorithms
@@ -517,7 +527,7 @@ index c3a4806e0..5998275d2 100644
Specifies the permitted KEX (Key Exchange) algorithms that the server will
offer to clients.
The ordering of this list is not important, as the client specifies the
-@@ -1089,16 +1062,16 @@ Multiple algorithms must be comma-separated.
+@@ -1095,16 +1063,16 @@ Multiple algorithms must be comma-separated.
.Pp
If the specified list begins with a
.Sq +
@@ -538,7 +548,7 @@ index c3a4806e0..5998275d2 100644
.Pp
The supported algorithms are:
.Pp
-@@ -1135,14 +1108,6 @@ sntrup761x25519-sha512
+@@ -1143,14 +1111,6 @@ sntrup761x25519-sha512
sntrup761x25519-sha512@openssh.com
.El
.Pp
@@ -553,7 +563,7 @@ index c3a4806e0..5998275d2 100644
The list of supported key exchange algorithms may also be obtained using
.Qq ssh -Q KexAlgorithms .
.It Cm ListenAddress
-@@ -1229,21 +1194,26 @@ function, and all code in the
+@@ -1237,21 +1197,26 @@ function, and all code in the
file.
This option is intended for debugging and no overrides are enabled by default.
.It Cm MACs
@@ -584,7 +594,7 @@ index c3a4806e0..5998275d2 100644
.Pp
The algorithms that contain
.Qq -etm
-@@ -1286,15 +1256,6 @@ umac-64-etm@openssh.com
+@@ -1294,15 +1259,6 @@ umac-64-etm@openssh.com
umac-128-etm@openssh.com
.El
.Pp
@@ -600,7 +610,7 @@ index c3a4806e0..5998275d2 100644
The list of available MAC algorithms may also be obtained using
.Qq ssh -Q mac .
.It Cm Match
-@@ -1784,38 +1745,25 @@ or equivalent.)
+@@ -1792,40 +1748,25 @@ or equivalent.)
The default is
.Cm yes .
.It Cm PubkeyAcceptedAlgorithms
@@ -637,18 +647,20 @@ index c3a4806e0..5998275d2 100644
-webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-mldsa44-ed25519-cert-v01@openssh.com,
-ssh-ed25519,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ssh-ed25519@openssh.com,
-sk-ecdsa-sha2-nistp256@openssh.com,
-webauthn-sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256
+-rsa-sha2-512,rsa-sha2-256,
+-ssh-mldsa44-ed25519@openssh.com
-.Ed
+built-in openssh default set.
.Pp
The list of available signature algorithms may also be obtained using
.Qq ssh -Q PubkeyAcceptedAlgorithms .
-@@ -2328,7 +2276,9 @@ This file should be writable by root only, but it is recommended
+@@ -2338,7 +2279,9 @@ This file should be writable by root only, but it is recommended
.El
.Sh SEE ALSO
.Xr sftp-server 8 ,
diff --git a/0028-openssh-8.0p1-openssl-kdf.patch b/0028-openssh-8.0p1-openssl-kdf.patch
index c518d7c..9c3d58c 100644
--- a/0028-openssh-8.0p1-openssl-kdf.patch
+++ b/0028-openssh-8.0p1-openssl-kdf.patch
@@ -1,7 +1,7 @@
-From a7cce97da90aae29ee50dc223ac51e560640cde6 Mon Sep 17 00:00:00 2001
+From 1fdd8f9ddb1b2e1e0d4f7d97e5e7e17b74a85a6a Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 28/54] openssh-8.0p1-openssl-kdf
+Subject: [PATCH 28/53] openssh-8.0p1-openssl-kdf
# Use OpenSSL KDF (#1631761)
---
@@ -10,10 +10,10 @@ Subject: [PATCH 28/54] openssh-8.0p1-openssl-kdf
2 files changed, 108 insertions(+)
diff --git a/configure.ac b/configure.ac
-index 321adbab1..caa75f708 100644
+index cb46903f4..394acc3d8 100644
--- a/configure.ac
+++ b/configure.ac
-@@ -3248,6 +3248,7 @@ if test "x$openssl" = "xyes" ; then
+@@ -3261,6 +3261,7 @@ if test "x$openssl" = "xyes" ; then
HMAC_CTX_init \
RSA_generate_key_ex \
RSA_get_default_method \
@@ -22,7 +22,7 @@ index 321adbab1..caa75f708 100644
# LibreSSL/OpenSSL API differences
diff --git a/kex.c b/kex.c
-index 3701a40c0..5b6066169 100644
+index 1b8f1c3c5..6981b59f5 100644
--- a/kex.c
+++ b/kex.c
@@ -37,6 +37,11 @@
@@ -37,7 +37,7 @@ index 3701a40c0..5b6066169 100644
#endif
#include "ssh.h"
-@@ -1088,6 +1093,107 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
+@@ -1086,6 +1091,107 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
return r;
}
@@ -145,7 +145,7 @@ index 3701a40c0..5b6066169 100644
static int
derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
const struct sshbuf *shared_secret, u_char **keyp)
-@@ -1151,6 +1257,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
+@@ -1149,6 +1255,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
ssh_digest_free(hashctx);
return r;
}
diff --git a/0029-openssh-8.2p1-visibility.patch b/0029-openssh-8.2p1-visibility.patch
index 999c94d..4008c0c 100644
--- a/0029-openssh-8.2p1-visibility.patch
+++ b/0029-openssh-8.2p1-visibility.patch
@@ -1,7 +1,7 @@
-From 67b12f7fcdb4183c48195e90920cb80d2d538b34 Mon Sep 17 00:00:00 2001
+From 0c8380243aa47419186f12070b4115846bf9b425 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 29/54] openssh-8.2p1-visibility
+Subject: [PATCH 29/53] openssh-8.2p1-visibility
# sk-dummy.so built with -fvisibility=hidden does not work
---
@@ -9,7 +9,7 @@ Subject: [PATCH 29/54] openssh-8.2p1-visibility
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c
-index 4c96e8827..4af5209db 100644
+index cbbba7459..f1b3f060b 100644
--- a/regress/misc/sk-dummy/sk-dummy.c
+++ b/regress/misc/sk-dummy/sk-dummy.c
@@ -80,7 +80,7 @@ skdebug(const char *func, const char *fmt, ...)
diff --git a/0030-openssh-8.2p1-x11-without-ipv6.patch b/0030-openssh-8.2p1-x11-without-ipv6.patch
index 8b33c5f..373e889 100644
--- a/0030-openssh-8.2p1-x11-without-ipv6.patch
+++ b/0030-openssh-8.2p1-x11-without-ipv6.patch
@@ -1,7 +1,7 @@
-From 228a3b51fbf3025bb1401dd885423206c8763266 Mon Sep 17 00:00:00 2001
+From a29df25b1ed0d2945d0990bc7ca8918c16c7d264 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 30/54] openssh-8.2p1-x11-without-ipv6
+Subject: [PATCH 30/53] openssh-8.2p1-x11-without-ipv6
# Do not break X11 without IPv6
---
diff --git a/0031-openssh-8.0p1-preserve-pam-errors.patch b/0031-openssh-8.0p1-preserve-pam-errors.patch
index 1ea83da..ad8382c 100644
--- a/0031-openssh-8.0p1-preserve-pam-errors.patch
+++ b/0031-openssh-8.0p1-preserve-pam-errors.patch
@@ -1,7 +1,7 @@
-From 28bf794f131e07b0ffac3a91de30dc7784ab3d52 Mon Sep 17 00:00:00 2001
+From 74d160a951c390e2c690bf3462b643b7328e3b89 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 31/54] openssh-8.0p1-preserve-pam-errors
+Subject: [PATCH 31/53] openssh-8.0p1-preserve-pam-errors
# sshd provides PAM an incorrect error code (#1879503)
---
diff --git a/0032-openssh-8.7p1-scp-kill-switch.patch b/0032-openssh-8.7p1-scp-kill-switch.patch
index 3ae2ac3..6ba3100 100644
--- a/0032-openssh-8.7p1-scp-kill-switch.patch
+++ b/0032-openssh-8.7p1-scp-kill-switch.patch
@@ -1,7 +1,7 @@
-From ae8886678b214115dfca68b692bdf1a5f76be5d2 Mon Sep 17 00:00:00 2001
+From ee385dfe54142b1f8c03f20b8a63b9f8f1b52b3f Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 32/54] openssh-8.7p1-scp-kill-switch
+Subject: [PATCH 32/53] openssh-8.7p1-scp-kill-switch
# Implement kill switch for SCP protocol
---
diff --git a/0033-openssh-8.7p1-recursive-scp.patch b/0033-openssh-8.7p1-recursive-scp.patch
index 582c8c6..83ac8d3 100644
--- a/0033-openssh-8.7p1-recursive-scp.patch
+++ b/0033-openssh-8.7p1-recursive-scp.patch
@@ -1,7 +1,7 @@
-From 96429d71685df973ecd1681527e25f34225088b8 Mon Sep 17 00:00:00 2001
+From f21a7b168a25eca8ef2928eb546642974d2d2a31 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 33/54] openssh-8.7p1-recursive-scp
+Subject: [PATCH 33/53] openssh-8.7p1-recursive-scp
# Workaround for lack of sftp_realpath in older versions of RHEL
# https://bugzilla.redhat.com/show_bug.cgi?id=2038854
diff --git a/0034-openssh-8.7p1-ibmca.patch b/0034-openssh-8.7p1-ibmca.patch
index 31f560a..8ca4ccb 100644
--- a/0034-openssh-8.7p1-ibmca.patch
+++ b/0034-openssh-8.7p1-ibmca.patch
@@ -1,7 +1,7 @@
-From 3d79ab8466d8a615eb0ae22574c809abebc569cd Mon Sep 17 00:00:00 2001
+From 5330624d76a24557fb71d8852c6e5e1c8edce762 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 34/54] openssh-8.7p1-ibmca
+Subject: [PATCH 34/53] openssh-8.7p1-ibmca
# downstream only, IBMCA tentative fix
# From https://bugzilla.redhat.com/show_bug.cgi?id=1976202#c14
diff --git a/0035-openssh-7.6p1-audit.patch b/0035-openssh-7.6p1-audit.patch
index 064e6f5..51d7285 100644
--- a/0035-openssh-7.6p1-audit.patch
+++ b/0035-openssh-7.6p1-audit.patch
@@ -1,7 +1,7 @@
-From d75558f24f6f6eae7b404d66e7ccee758880f5d8 Mon Sep 17 00:00:00 2001
+From 6fefa768f29953c62f81f6e4e8e70e32f6c48dd9 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 35/54] openssh-7.6p1-audit
+Subject: [PATCH 35/53] openssh-7.6p1-audit
---
Makefile.in | 2 +-
@@ -35,7 +35,7 @@ Subject: [PATCH 35/54] openssh-7.6p1-audit
create mode 100644 auditstub.c
diff --git a/Makefile.in b/Makefile.in
-index 106306024..56c4c88cf 100644
+index 1eeb34cad..f61f89e4d 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -111,7 +111,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
@@ -782,10 +782,10 @@ index 000000000..639a798df
+{
+}
diff --git a/auth.c b/auth.c
-index 142ac5afd..1858bddab 100644
+index 9d1307b76..9851625cf 100644
--- a/auth.c
+++ b/auth.c
-@@ -499,9 +499,6 @@ getpwnamallow(struct ssh *ssh, const char *user)
+@@ -502,9 +502,6 @@ getpwnamallow(struct ssh *ssh, const char *user)
record_failed_login(ssh, user,
auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
#endif
@@ -818,10 +818,10 @@ index 9dd25f494..066f5effa 100644
FILE *auth_openprincipals(const char *, struct passwd *, int);
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
-index a287091ec..bc4775042 100644
+index 6a6704d93..d877471da 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
-@@ -158,7 +158,7 @@ userauth_hostbased(struct ssh *ssh, const char *method)
+@@ -159,7 +159,7 @@ userauth_hostbased(struct ssh *ssh, const char *method)
authenticated = 0;
if (mm_hostbased_key_allowed(ssh, authctxt->pw, cuser,
chost, key) &&
@@ -830,7 +830,7 @@ index a287091ec..bc4775042 100644
sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL) == 0)
authenticated = 1;
-@@ -175,6 +175,20 @@ done:
+@@ -176,6 +176,20 @@ done:
return authenticated;
}
@@ -852,7 +852,7 @@ index a287091ec..bc4775042 100644
int
hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
-index 319e42b2b..973810dc9 100644
+index dc07faa92..f2a4329e5 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -230,7 +230,7 @@ userauth_pubkey(struct ssh *ssh, const char *method)
@@ -970,7 +970,7 @@ index 32abdde22..e953dfc3c 100644
const struct sshcipher *cipher_by_name(const char *);
diff --git a/kex.c b/kex.c
-index 5b6066169..3fbf1dd43 100644
+index 6981b59f5..9ce2b7e12 100644
--- a/kex.c
+++ b/kex.c
@@ -64,6 +64,7 @@
@@ -981,7 +981,7 @@ index 5b6066169..3fbf1dd43 100644
/* prototype */
static int kex_choose_conf(struct ssh *, uint32_t seq);
-@@ -831,12 +832,16 @@ kex_start_rekex(struct ssh *ssh)
+@@ -829,12 +830,16 @@ kex_start_rekex(struct ssh *ssh)
}
static int
@@ -1000,7 +1000,7 @@ index 5b6066169..3fbf1dd43 100644
if ((enc->cipher = cipher_by_name(name)) == NULL) {
error_f("unsupported cipher %s", name);
free(name);
-@@ -857,8 +862,12 @@ choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server)
+@@ -855,8 +860,12 @@ choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -1014,7 +1014,7 @@ index 5b6066169..3fbf1dd43 100644
if (mac_setup(mac, name) < 0) {
error_f("unsupported MAC %s", name);
free(name);
-@@ -871,12 +880,16 @@ choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server)
+@@ -869,12 +878,16 @@ choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server)
}
static int
@@ -1033,7 +1033,7 @@ index 5b6066169..3fbf1dd43 100644
#ifdef WITH_ZLIB
if (strcmp(name, "zlib@openssh.com") == 0) {
comp->type = COMP_DELAYED;
-@@ -1040,7 +1053,7 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
+@@ -1038,7 +1051,7 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
@@ -1042,7 +1042,7 @@ index 5b6066169..3fbf1dd43 100644
sprop[nenc])) != 0) {
kex->failed_choice = peer[nenc];
peer[nenc] = NULL;
-@@ -1055,7 +1068,7 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
+@@ -1053,7 +1066,7 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
peer[nmac] = NULL;
goto out;
}
@@ -1051,7 +1051,7 @@ index 5b6066169..3fbf1dd43 100644
sprop[ncomp])) != 0) {
kex->failed_choice = peer[ncomp];
peer[ncomp] = NULL;
-@@ -1078,6 +1091,10 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
+@@ -1076,6 +1089,10 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
dh_need = MAXIMUM(dh_need, newkeys->enc.block_size);
dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len);
dh_need = MAXIMUM(dh_need, newkeys->mac.key_len);
@@ -1062,7 +1062,7 @@ index 5b6066169..3fbf1dd43 100644
}
/* XXX need runden? */
kex->we_need = need;
-@@ -1347,6 +1364,36 @@ dump_digest(const char *msg, const u_char *digest, int len)
+@@ -1345,6 +1362,36 @@ dump_digest(const char *msg, const u_char *digest, int len)
}
#endif
@@ -1100,10 +1100,10 @@ index 5b6066169..3fbf1dd43 100644
* Send a plaintext error message to the peer, suffixed by \r\n.
* Only used during banner exchange, and there only for the server.
diff --git a/kex.h b/kex.h
-index d229df7e6..692e28363 100644
+index 21919a9aa..8f9934899 100644
--- a/kex.h
+++ b/kex.h
-@@ -262,6 +262,8 @@ int kexgss_client(struct ssh *);
+@@ -257,6 +257,8 @@ int kexgss_client(struct ssh *);
int kexgss_server(struct ssh *);
#endif
@@ -1149,7 +1149,7 @@ index 04089f41b..6b5ebc44b 100644
#endif /* SSHMAC_H */
diff --git a/monitor.c b/monitor.c
-index 7e1c9061c..7dfc7976b 100644
+index 14cdccf2f..733a3460f 100644
--- a/monitor.c
+++ b/monitor.c
@@ -83,6 +83,7 @@
@@ -1204,7 +1204,7 @@ index 7e1c9061c..7dfc7976b 100644
#endif
{0, 0, NULL}
};
-@@ -1577,8 +1594,10 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1589,8 +1606,10 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
int r, ret, req_presence = 0, req_verify = 0, valid_data = 0;
int encoded_ret;
struct sshkey_sig_details *sig_details = NULL;
@@ -1216,7 +1216,7 @@ index 7e1c9061c..7dfc7976b 100644
(r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||
(r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||
(r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
-@@ -1587,6 +1606,8 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1599,6 +1618,8 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
if (hostbased_cuser == NULL || hostbased_chost == NULL ||
!monitor_allowed_key(blob, bloblen))
fatal_f("bad key, not previously allowed");
@@ -1225,7 +1225,7 @@ index 7e1c9061c..7dfc7976b 100644
/* Empty signature algorithm means NULL. */
if (*sigalg == '\0') {
-@@ -1602,14 +1623,19 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1614,14 +1635,19 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
case MM_USERKEY:
valid_data = monitor_valid_userblob(ssh, data, datalen);
auth_method = "publickey";
@@ -1245,7 +1245,7 @@ index 7e1c9061c..7dfc7976b 100644
break;
}
if (!valid_data)
-@@ -1621,8 +1647,6 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1633,8 +1659,6 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m)
SSH_FP_DEFAULT)) == NULL)
fatal_f("sshkey_fingerprint failed");
@@ -1254,7 +1254,7 @@ index 7e1c9061c..7dfc7976b 100644
debug3_f("%s %s signature using %s %s%s%s", auth_method,
sshkey_type(key), sigalg == NULL ? "default" : sigalg,
(ret == 0) ? "verified" : "unverified",
-@@ -1710,13 +1734,19 @@ mm_record_login(struct ssh *ssh, Session *s, struct passwd *pw)
+@@ -1722,13 +1746,19 @@ mm_record_login(struct ssh *ssh, Session *s, struct passwd *pw)
}
static void
@@ -1275,7 +1275,7 @@ index 7e1c9061c..7dfc7976b 100644
session_unused(s->self);
}
-@@ -1783,7 +1813,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1795,7 +1825,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
error:
if (s != NULL)
@@ -1284,7 +1284,7 @@ index 7e1c9061c..7dfc7976b 100644
if ((r = sshbuf_put_u32(m, 0)) != 0)
fatal_fr(r, "assemble 0");
mm_request_send(sock, MONITOR_ANS_PTY, m);
-@@ -1802,7 +1832,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1814,7 +1844,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, int sock, struct sshbuf *m)
if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0)
fatal_fr(r, "parse tty");
if ((s = session_by_tty(tty)) != NULL)
@@ -1293,7 +1293,7 @@ index 7e1c9061c..7dfc7976b 100644
sshbuf_reset(m);
free(tty);
return (0);
-@@ -1824,6 +1854,8 @@ mm_answer_term(struct ssh *ssh, int sock, struct sshbuf *req)
+@@ -1836,6 +1866,8 @@ mm_answer_term(struct ssh *ssh, int sock, struct sshbuf *req)
sshpam_cleanup();
#endif
@@ -1302,7 +1302,7 @@ index 7e1c9061c..7dfc7976b 100644
while (waitpid(pmonitor->m_pid, &status, 0) == -1)
if (errno != EINTR)
exit(1);
-@@ -1870,12 +1902,46 @@ mm_answer_audit_command(struct ssh *ssh, int socket, struct sshbuf *m)
+@@ -1882,12 +1914,46 @@ mm_answer_audit_command(struct ssh *ssh, int socket, struct sshbuf *m)
{
char *cmd;
int r;
@@ -1350,7 +1350,7 @@ index 7e1c9061c..7dfc7976b 100644
free(cmd);
return (0);
}
-@@ -1948,6 +2014,7 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+@@ -1958,6 +2024,7 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
void
mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
{
@@ -1358,7 +1358,7 @@ index 7e1c9061c..7dfc7976b 100644
debug3_f("Waiting for new keys");
if ((child_state = sshbuf_new()) == NULL)
-@@ -1955,6 +2022,19 @@ mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
+@@ -1965,6 +2032,19 @@ mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,
child_state);
debug3_f("GOT new keys");
@@ -1378,7 +1378,7 @@ index 7e1c9061c..7dfc7976b 100644
}
-@@ -2249,3 +2329,102 @@ mm_answer_gss_updatecreds(struct ssh *ssh, int socket, struct sshbuf *m) {
+@@ -2259,3 +2339,102 @@ mm_answer_gss_updatecreds(struct ssh *ssh, int socket, struct sshbuf *m) {
#endif /* GSSAPI */
@@ -1501,10 +1501,10 @@ index f4721c472..087addff5 100644
MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 2d905c16a..7ccf8729c 100644
+index 2b044f383..bdac7d3f9 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
-@@ -563,7 +563,7 @@ mm_key_allowed(enum mm_keytype type, const char *user, const char *host,
+@@ -565,7 +565,7 @@ mm_key_allowed(enum mm_keytype type, const char *user, const char *host,
*/
int
@@ -1513,7 +1513,7 @@ index 2d905c16a..7ccf8729c 100644
const u_char *data, size_t datalen, const char *sigalg, u_int compat,
struct sshkey_sig_details **sig_detailsp)
{
-@@ -579,7 +579,8 @@ mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen,
+@@ -581,7 +581,8 @@ mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen,
*sig_detailsp = NULL;
if ((m = sshbuf_new()) == NULL)
fatal_f("sshbuf_new failed");
@@ -1523,7 +1523,7 @@ index 2d905c16a..7ccf8729c 100644
(r = sshbuf_put_string(m, sig, siglen)) != 0 ||
(r = sshbuf_put_string(m, data, datalen)) != 0 ||
(r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
-@@ -612,6 +613,22 @@ mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen,
+@@ -614,6 +615,22 @@ mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen,
return 0;
}
@@ -1546,7 +1546,7 @@ index 2d905c16a..7ccf8729c 100644
void
mm_send_keystate(struct ssh *ssh, struct monitor *monitor)
{
-@@ -1011,11 +1028,12 @@ mm_audit_event(struct ssh *ssh, ssh_audit_event_t event)
+@@ -1013,11 +1030,12 @@ mm_audit_event(struct ssh *ssh, ssh_audit_event_t event)
sshbuf_free(m);
}
@@ -1561,7 +1561,7 @@ index 2d905c16a..7ccf8729c 100644
debug3_f("entering command %s", command);
-@@ -1025,6 +1043,30 @@ mm_audit_run_command(const char *command)
+@@ -1027,6 +1045,30 @@ mm_audit_run_command(const char *command)
fatal_fr(r, "buffer error");
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);
@@ -1592,7 +1592,7 @@ index 2d905c16a..7ccf8729c 100644
sshbuf_free(m);
}
#endif /* SSH_AUDIT_EVENTS */
-@@ -1273,3 +1315,83 @@ server_get_connection_info(struct ssh *ssh, int populate, int use_dns)
+@@ -1275,3 +1317,83 @@ server_get_connection_info(struct ssh *ssh, int populate, int use_dns)
return &ci;
}
@@ -1706,10 +1706,10 @@ index 07b207d1d..7f846f085 100644
struct Session;
diff --git a/packet.c b/packet.c
-index 4c89e60c5..5cf682b0e 100644
+index 63dcb5351..4c3c541ed 100644
--- a/packet.c
+++ b/packet.c
-@@ -77,6 +77,7 @@
+@@ -75,6 +75,7 @@
#endif
#include "xmalloc.h"
@@ -1717,7 +1717,7 @@ index 4c89e60c5..5cf682b0e 100644
#include "compat.h"
#include "ssh2.h"
#include "cipher.h"
-@@ -516,6 +517,13 @@ ssh_packet_get_connection_out(struct ssh *ssh)
+@@ -514,6 +515,13 @@ ssh_packet_get_connection_out(struct ssh *ssh)
return ssh->state->connection_out;
}
@@ -1731,7 +1731,7 @@ index 4c89e60c5..5cf682b0e 100644
/*
* Returns the IP-address of the remote host as a string. The returned
* string must not be freed.
-@@ -686,22 +694,19 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
+@@ -684,22 +692,19 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
struct session_state *state = ssh->state;
u_int mode;
struct packet *p;
@@ -1759,7 +1759,7 @@ index 4c89e60c5..5cf682b0e 100644
while ((p = TAILQ_FIRST(&state->outgoing))) {
sshbuf_free(p->payload);
TAILQ_REMOVE(&state->outgoing, p, next);
-@@ -742,8 +747,18 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
+@@ -740,8 +745,18 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close)
#endif /* WITH_ZLIB */
cipher_free(state->send_context);
cipher_free(state->receive_context);
@@ -1778,7 +1778,7 @@ index 4c89e60c5..5cf682b0e 100644
free(ssh->local_ipaddr);
ssh->local_ipaddr = NULL;
free(ssh->remote_ipaddr);
-@@ -1009,6 +1024,7 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+@@ -1007,6 +1022,7 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
(unsigned long long)state->p_send.bytes,
(unsigned long long)state->p_send.blocks);
kex_free_newkeys(state->newkeys[mode]);
@@ -1786,7 +1786,7 @@ index 4c89e60c5..5cf682b0e 100644
state->newkeys[mode] = NULL;
}
/* note that both bytes and the seqnr are not reset */
-@@ -2397,6 +2413,72 @@ ssh_packet_get_output(struct ssh *ssh)
+@@ -2398,6 +2414,72 @@ ssh_packet_get_output(struct ssh *ssh)
return (void *)ssh->state->output;
}
@@ -1860,12 +1860,12 @@ index 4c89e60c5..5cf682b0e 100644
static int
ssh_packet_set_postauth(struct ssh *ssh)
diff --git a/packet.h b/packet.h
-index 3e8acb2cd..e9aefdaad 100644
+index 442e38bb7..bfe481220 100644
--- a/packet.h
+++ b/packet.h
-@@ -225,4 +225,5 @@ char *connection_info_message(struct ssh *ssh);
- # undef EC_POINT
- #endif
+@@ -207,4 +207,5 @@ void sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l);
+ const u_char *sshpkt_ptr(struct ssh *, size_t *lenp);
+ char *connection_info_message(struct ssh *ssh);
+void packet_destroy_all(struct ssh *, int, int);
#endif /* PACKET_H */
@@ -2078,7 +2078,7 @@ index 344a1ddf9..a41c6efcd 100644
void session_close(struct ssh *, Session *);
void do_setusercontext(struct passwd *);
diff --git a/sshd-session.c b/sshd-session.c
-index 6f07c843a..fa1192c09 100644
+index 8a06616fd..0a9708d3a 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -181,8 +181,8 @@ struct include_list includes = TAILQ_HEAD_INITIALIZER(includes);
@@ -2221,7 +2221,7 @@ index 6f07c843a..fa1192c09 100644
reseed_prngs();
-@@ -1334,6 +1403,9 @@ main(int ac, char **av)
+@@ -1336,6 +1405,9 @@ main(int ac, char **av)
do_authenticated(ssh, authctxt);
/* The connection has been terminated. */
@@ -2231,7 +2231,7 @@ index 6f07c843a..fa1192c09 100644
ssh_packet_get_bytes(ssh, &ibytes, &obytes);
verbose("Transferred: sent %llu, received %llu bytes",
(unsigned long long)obytes, (unsigned long long)ibytes);
-@@ -1379,6 +1451,16 @@ sshd_hostkey_sign(struct ssh *ssh, struct sshkey *privkey,
+@@ -1381,6 +1453,16 @@ sshd_hostkey_sign(struct ssh *ssh, struct sshkey *privkey,
void
cleanup_exit(int i)
{
@@ -2248,7 +2248,7 @@ index 6f07c843a..fa1192c09 100644
if (the_active_state != NULL && the_authctxt != NULL) {
do_cleanup(the_active_state, the_authctxt);
if (privsep_is_preauth &&
-@@ -1393,7 +1475,9 @@ cleanup_exit(int i)
+@@ -1395,7 +1477,9 @@ cleanup_exit(int i)
}
#ifdef SSH_AUDIT_EVENTS
/* done after do_cleanup so it can cancel the PAM auth 'thread' */
diff --git a/0036-openssh-7.1p2-audit-race-condition.patch b/0036-openssh-7.1p2-audit-race-condition.patch
index 5865770..3fcbcce 100644
--- a/0036-openssh-7.1p2-audit-race-condition.patch
+++ b/0036-openssh-7.1p2-audit-race-condition.patch
@@ -1,7 +1,7 @@
-From eb15cb2fc5cb181c68b4056c1af3caf4c9aff551 Mon Sep 17 00:00:00 2001
+From 6991682335fb1dded7b50d903b7f9cc600535ba2 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 36/54] openssh-7.1p2-audit-race-condition
+Subject: [PATCH 36/53] openssh-7.1p2-audit-race-condition
# Audit race condition in forked child (#1310684)
---
@@ -11,10 +11,10 @@ Subject: [PATCH 36/54] openssh-7.1p2-audit-race-condition
3 files changed, 102 insertions(+), 7 deletions(-)
diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 7ccf8729c..cd70a4e12 100644
+index bdac7d3f9..4dc64857b 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
-@@ -1394,4 +1394,50 @@ mm_audit_destroy_sensitive_data(struct ssh *ssh, const char *fp, pid_t pid, uid_
+@@ -1396,4 +1396,50 @@ mm_audit_destroy_sensitive_data(struct ssh *ssh, const char *fp, pid_t pid, uid_
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
sshbuf_free(m);
}
diff --git a/0037-openssh-9.0p1-audit-log.patch b/0037-openssh-9.0p1-audit-log.patch
index 0e0b206..60cb439 100644
--- a/0037-openssh-9.0p1-audit-log.patch
+++ b/0037-openssh-9.0p1-audit-log.patch
@@ -1,7 +1,7 @@
-From 7c991a9d474fcd3eaf3fe5882f2bb9b5ffcf28d5 Mon Sep 17 00:00:00 2001
+From bb3f0efad18c45bc7c131c6898c9bc87bcb50f55 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 37/54] openssh-9.0p1-audit-log
+Subject: [PATCH 37/53] openssh-9.0p1-audit-log
# https://bugzilla.redhat.com/show_bug.cgi?id=2049947
---
diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index 6d1a005..04b6851 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -1,7 +1,7 @@
-From c52dd2530ff1ca90224cac3ecf9527b91f9b2b0a Mon Sep 17 00:00:00 2001
+From d57fef8fc7b2ad6426d58ab77fa5aa67172bdac0 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 28 Aug 2025 14:01:38 +0200
-Subject: [PATCH 38/54] openssh-7.7p1-fips
+Subject: [PATCH 38/53] openssh-7.7p1-fips
---
dh.c | 41 ++++++++++++++++++++++
@@ -102,7 +102,7 @@ index c6326a39d..e51e292b8 100644
u_int dh_estimate(int);
void dh_set_moduli_file(const char *);
diff --git a/kex-names.c b/kex-names.c
-index 3bc38130b..dcb6efc13 100644
+index 2bc431223..8e9c621bd 100644
--- a/kex-names.c
+++ b/kex-names.c
@@ -32,6 +32,7 @@
@@ -113,7 +113,7 @@ index 3bc38130b..dcb6efc13 100644
#include <openssl/evp.h>
#endif
-@@ -213,7 +214,10 @@ kex_names_valid(const char *names)
+@@ -211,7 +212,10 @@ kex_names_valid(const char *names)
return 0;
}
if (kex_alg_by_name(p) == NULL) {
@@ -126,7 +126,7 @@ index 3bc38130b..dcb6efc13 100644
return 0;
}
diff --git a/kex.c b/kex.c
-index 3fbf1dd43..abd13a0e2 100644
+index 9ce2b7e12..7e50f277f 100644
--- a/kex.c
+++ b/kex.c
@@ -37,6 +37,7 @@
@@ -147,7 +147,7 @@ index 3fbf1dd43..abd13a0e2 100644
"ext-info-s,kex-strict-s-v00@openssh.com" :
"ext-info-c,kex-strict-c-v00@openssh.com")) == NULL)
diff --git a/kexgen.c b/kexgen.c
-index a2beb3f10..2f8252488 100644
+index ff504580f..834073ef1 100644
--- a/kexgen.c
+++ b/kexgen.c
@@ -31,6 +31,7 @@
@@ -158,7 +158,7 @@ index a2beb3f10..2f8252488 100644
#include "sshkey.h"
#include "kex.h"
-@@ -115,13 +116,28 @@ kex_gen_client(struct ssh *ssh)
+@@ -118,13 +119,28 @@ kex_gen_client(struct ssh *ssh)
break;
#endif /* WITH_OPENSSL */
case KEX_C25519_SHA256:
@@ -190,7 +190,7 @@ index a2beb3f10..2f8252488 100644
break;
default:
r = SSH_ERR_INVALID_ARGUMENT;
-@@ -189,15 +205,30 @@ input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
+@@ -196,15 +212,30 @@ input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
break;
#endif /* WITH_OPENSSL */
case KEX_C25519_SHA256:
@@ -226,7 +226,7 @@ index a2beb3f10..2f8252488 100644
break;
default:
r = SSH_ERR_INVALID_ARGUMENT;
-@@ -312,16 +343,31 @@ input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
+@@ -323,16 +354,31 @@ input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
break;
#endif /* WITH_OPENSSL */
case KEX_C25519_SHA256:
@@ -289,12 +289,12 @@ index 1c2194a8f..2763e862a 100644
if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
goto out;
diff --git a/myproposal.h b/myproposal.h
-index d992d8b12..6433e0820 100644
+index a2a1f991e..f03293f35 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -60,6 +60,18 @@
"rsa-sha2-512," \
- "rsa-sha2-256"
+ "rsa-sha2-256" \
+#define KEX_FIPS_PK_ALG \
+ "ecdsa-sha2-nistp256-cert-v01@openssh.com," \
@@ -340,7 +340,7 @@ index d992d8b12..6433e0820 100644
#define SSH_ALLOWED_CA_SIGALGS \
"ssh-ed25519," \
diff --git a/readconf.c b/readconf.c
-index 1b7d4ae4e..e971ca5c4 100644
+index 992c78866..2cbf1fcbd 100644
--- a/readconf.c
+++ b/readconf.c
@@ -38,6 +38,12 @@
@@ -356,7 +356,7 @@ index 1b7d4ae4e..e971ca5c4 100644
#include <util.h>
#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
# include <vis.h>
-@@ -3098,11 +3104,16 @@ fill_default_options(Options * options)
+@@ -3099,11 +3105,16 @@ fill_default_options(Options * options)
all_key = sshkey_alg_list(0, 0, 1, ',');
all_sig = sshkey_alg_list(0, 1, 1, ',');
/* remove unsupported algos from default lists */
@@ -393,7 +393,7 @@ index b65413c95..17e1cea72 100644
SC_DENY(__NR_openat, EACCES),
#endif
diff --git a/servconf.c b/servconf.c
-index 8c1e9c253..bee75d486 100644
+index 27147a1e7..846f5d212 100644
--- a/servconf.c
+++ b/servconf.c
@@ -38,7 +38,15 @@
@@ -435,7 +435,7 @@ index 8c1e9c253..bee75d486 100644
do { \
if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
diff --git a/ssh-ed25519.c b/ssh-ed25519.c
-index 2369c3af0..af059d7f1 100644
+index 8228f2830..668823ed2 100644
--- a/ssh-ed25519.c
+++ b/ssh-ed25519.c
@@ -24,6 +24,7 @@
@@ -446,7 +446,7 @@ index 2369c3af0..af059d7f1 100644
#include "log.h"
#include "sshbuf.h"
-@@ -162,6 +163,10 @@ ssh_ed25519_sign(struct sshkey *key,
+@@ -163,6 +164,10 @@ ssh_ed25519_sign(struct sshkey *key,
key->ed25519_sk == NULL ||
datalen >= INT_MAX - crypto_sign_ed25519_BYTES)
return SSH_ERR_INVALID_ARGUMENT;
@@ -457,7 +457,7 @@ index 2369c3af0..af059d7f1 100644
smlen = slen = datalen + crypto_sign_ed25519_BYTES;
if ((sig = malloc(slen)) == NULL)
return SSH_ERR_ALLOC_FAIL;
-@@ -243,6 +248,10 @@ ssh_ed25519_verify(const struct sshkey *key,
+@@ -244,6 +249,10 @@ ssh_ed25519_verify(const struct sshkey *key,
dlen >= INT_MAX - crypto_sign_ed25519_BYTES ||
sig == NULL || siglen == 0)
return SSH_ERR_INVALID_ARGUMENT;
@@ -485,7 +485,7 @@ index a894e23c9..329dc9da0 100644
typedef struct {
diff --git a/ssh-keygen.c b/ssh-keygen.c
-index a62e5dc4a..eb880dbc0 100644
+index 6667a5c1b..ed1932ff0 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -22,6 +22,7 @@
@@ -515,7 +515,7 @@ index a62e5dc4a..eb880dbc0 100644
switch (type) {
case KEY_RSA:
if (*bitsp < SSH_RSA_MINIMUM_MODULUS_SIZE)
-@@ -248,7 +254,7 @@ ask_filename(struct passwd *pw, const char *prompt)
+@@ -243,7 +249,7 @@ ask_filename(struct passwd *pw, const char *prompt)
char *name = NULL;
if (key_type_name == NULL)
@@ -523,8 +523,8 @@ index a62e5dc4a..eb880dbc0 100644
+ name = FIPS_mode() ? _PATH_SSH_CLIENT_ID_RSA : _PATH_SSH_CLIENT_ID_ED25519;
else {
switch (sshkey_type_from_shortname(key_type_name)) {
- #ifdef OPENSSL_HAS_ECC
-@@ -1065,9 +1071,17 @@ do_gen_all_hostkeys(struct passwd *pw)
+ case KEY_ECDSA_CERT:
+@@ -1048,9 +1054,17 @@ do_gen_all_hostkeys(struct passwd *pw)
first = 1;
printf("%s: generating new host keys: ", __progname);
}
@@ -543,7 +543,7 @@ index a62e5dc4a..eb880dbc0 100644
if ((fd = mkstemp(prv_tmp)) == -1) {
error("Could not save your private key in %s: %s",
prv_tmp, strerror(errno));
-@@ -3776,7 +3790,7 @@ main(int argc, char **argv)
+@@ -3792,7 +3806,7 @@ main(int argc, char **argv)
}
if (key_type_name == NULL)
@@ -553,7 +553,7 @@ index a62e5dc4a..eb880dbc0 100644
type = sshkey_type_from_shortname(key_type_name);
type_bits_valid(type, key_type_name, &bits);
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
-index c455ef532..1f15f3077 100644
+index 77b4341c9..284d4deee 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -21,6 +21,7 @@
@@ -564,7 +564,7 @@ index c455ef532..1f15f3077 100644
#include <errno.h>
#include <limits.h>
-@@ -235,6 +236,14 @@ keygrab_ssh2(con *c)
+@@ -238,6 +239,14 @@ keygrab_ssh2(con *c)
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
int r;
@@ -609,7 +609,7 @@ index ccadb14ca..5af39bb39 100644
goto out;
}
diff --git a/ssh.c b/ssh.c
-index 07bb1e38f..4dee7849f 100644
+index b9a59ca43..00c0edefc 100644
--- a/ssh.c
+++ b/ssh.c
@@ -71,6 +71,7 @@
@@ -620,7 +620,7 @@ index 07bb1e38f..4dee7849f 100644
#include "openbsd-compat/openssl-compat.h"
#include "xmalloc.h"
-@@ -1613,6 +1614,10 @@ main(int ac, char **av)
+@@ -1617,6 +1618,10 @@ main(int ac, char **av)
exit(0);
}
@@ -632,7 +632,7 @@ index 07bb1e38f..4dee7849f 100644
if (options.sk_provider != NULL && *options.sk_provider == '$' &&
strlen(options.sk_provider) > 1) {
diff --git a/sshconnect2.c b/sshconnect2.c
-index e1d4388ad..ca9dc0e8a 100644
+index 5459caa0c..244c725f7 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -45,6 +45,10 @@
@@ -646,7 +646,7 @@ index e1d4388ad..ca9dc0e8a 100644
#include "xmalloc.h"
#include "ssh.h"
#include "ssh2.h"
-@@ -265,6 +269,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+@@ -264,6 +268,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
#if defined(GSSAPI) && defined(WITH_OPENSSL)
if (options.gss_keyex) {
@@ -656,7 +656,7 @@ index e1d4388ad..ca9dc0e8a 100644
/* Add the GSSAPI mechanisms currently supported on this
* client to the key exchange algorithm proposal */
orig = myproposal[PROPOSAL_KEX_ALGS];
-@@ -284,7 +291,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+@@ -283,7 +290,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
}
gss = ssh_gssapi_client_mechanisms(gss_host,
@@ -719,7 +719,7 @@ index 6b9847f67..ae26b10b3 100644
* Chdir to the root directory so that the current disk can be
* unmounted if desired.
diff --git a/sshkey.c b/sshkey.c
-index 6bb8feaa9..e3fb29e70 100644
+index 7d1401a8f..2380c8081 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -36,6 +36,7 @@
@@ -738,7 +738,7 @@ index 6bb8feaa9..e3fb29e70 100644
#include "ssh-sk.h"
#include "ssh-pkcs11.h"
-@@ -407,6 +409,18 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
+@@ -399,6 +401,18 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
impl = keyimpls[i];
if (impl->name == NULL || impl->type == KEY_NULL)
continue;
@@ -757,7 +757,7 @@ index 6bb8feaa9..e3fb29e70 100644
if (!include_sigonly && impl->sigonly)
continue;
if ((certs_only && !impl->cert) || (plain_only && impl->cert))
-@@ -1443,6 +1457,20 @@ sshkey_read(struct sshkey *ret, char **cpp)
+@@ -1427,6 +1441,20 @@ sshkey_read(struct sshkey *ret, char **cpp)
return SSH_ERR_EC_CURVE_MISMATCH;
}
@@ -778,7 +778,7 @@ index 6bb8feaa9..e3fb29e70 100644
/* Fill in ret from parsed key */
sshkey_free_contents(ret);
*ret = *k;
-@@ -2276,6 +2304,11 @@ sshkey_sign(struct sshkey *key,
+@@ -2260,6 +2288,11 @@ sshkey_sign(struct sshkey *key,
*lenp = 0;
if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE)
return SSH_ERR_INVALID_ARGUMENT;
@@ -790,7 +790,7 @@ index 6bb8feaa9..e3fb29e70 100644
if ((impl = sshkey_impl_from_key(key)) == NULL)
return SSH_ERR_KEY_TYPE_UNKNOWN;
if ((r = sshkey_unshield_private(key)) != 0)
-@@ -2315,6 +2348,10 @@ sshkey_verify(const struct sshkey *key,
+@@ -2299,6 +2332,10 @@ sshkey_verify(const struct sshkey *key,
*detailsp = NULL;
if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE)
return SSH_ERR_INVALID_ARGUMENT;
diff --git a/0039-openssh-8.7p1-negotiate-supported-algs.patch b/0039-openssh-8.7p1-negotiate-supported-algs.patch
index 2b91968..fbdd62d 100644
--- a/0039-openssh-8.7p1-negotiate-supported-algs.patch
+++ b/0039-openssh-8.7p1-negotiate-supported-algs.patch
@@ -1,7 +1,7 @@
-From d02ea85237706cc925f8c118d5ed6df86d30db99 Mon Sep 17 00:00:00 2001
+From 5e5ea62ca23bdce9f3cad2ea11c8f053faeb42ee Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 39/54] openssh-8.7p1-negotiate-supported-algs
+Subject: [PATCH 39/53] openssh-8.7p1-negotiate-supported-algs
# Don't propose disallowed algorithms during hostkey negotiation
# upstream MR:
@@ -113,7 +113,7 @@ index 58004b80e..036a7c2b9 100644
+ fail "ssh connect failed for keytype $keytype"
done
diff --git a/sshconnect2.c b/sshconnect2.c
-index ca9dc0e8a..2dc08b8a1 100644
+index 244c725f7..c21b3a11a 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -224,7 +224,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
@@ -125,7 +125,7 @@ index ca9dc0e8a..2dc08b8a1 100644
int r, use_known_hosts_order = 0;
#if defined(GSSAPI) && defined(WITH_OPENSSL)
-@@ -262,10 +262,22 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+@@ -261,10 +261,22 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
port, cinfo);
}
@@ -149,7 +149,7 @@ index ca9dc0e8a..2dc08b8a1 100644
#if defined(GSSAPI) && defined(WITH_OPENSSL)
if (options.gss_keyex) {
-@@ -309,6 +321,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+@@ -308,6 +320,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
#endif
free(hkalgs);
diff --git a/0040-openssh-9.0p1-evp-fips-kex.patch b/0040-openssh-9.0p1-evp-fips-kex.patch
index c69ac69..8ad50ff 100644
--- a/0040-openssh-9.0p1-evp-fips-kex.patch
+++ b/0040-openssh-9.0p1-evp-fips-kex.patch
@@ -1,15 +1,15 @@
-From 363c1f888af1f55bf6f06ff561117c538774e2c3 Mon Sep 17 00:00:00 2001
+From 162e99b9189796fad6327148d8c6817d5ee74c18 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 40/54] openssh-9.0p1-evp-fips-kex
+Subject: [PATCH 40/53] openssh-9.0p1-evp-fips-kex
---
dh.c | 98 +++++++++++++++++++++++++++++++++-----
kex.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
kex.h | 6 +++
kexdh.c | 52 ++++++++++++++++++--
- kexecdh.c | 129 ++++++++++++++++++++++++++++++++++++++++----------
- 5 files changed, 382 insertions(+), 42 deletions(-)
+ kexecdh.c | 127 ++++++++++++++++++++++++++++++++++++++-----------
+ 5 files changed, 378 insertions(+), 44 deletions(-)
diff --git a/dh.c b/dh.c
index 3efe0a69f..bf324309c 100644
@@ -140,10 +140,10 @@ index 3efe0a69f..bf324309c 100644
DH *
diff --git a/kex.c b/kex.c
-index abd13a0e2..a51e26398 100644
+index 7e50f277f..62cfa86cd 100644
--- a/kex.c
+++ b/kex.c
-@@ -1624,3 +1624,142 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+@@ -1622,3 +1622,142 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
return r;
}
@@ -287,20 +287,20 @@ index abd13a0e2..a51e26398 100644
+}
+#endif /* WITH_OPENSSL */
diff --git a/kex.h b/kex.h
-index 692e28363..d22f6deb3 100644
+index 8f9934899..1fe4bb29b 100644
--- a/kex.h
+++ b/kex.h
-@@ -37,6 +37,9 @@
- # include <openssl/bn.h>
- # include <openssl/dh.h>
- # include <openssl/ecdsa.h>
-+# include <openssl/evp.h>
-+# include <openssl/core_names.h>
-+# include <openssl/param_build.h>
- # ifdef OPENSSL_HAS_ECC
- # include <openssl/ec.h>
- # else /* OPENSSL_HAS_ECC */
-@@ -318,6 +321,9 @@ int kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
+@@ -38,6 +38,9 @@
+ #include <openssl/dh.h>
+ #include <openssl/ec.h>
+ #include <openssl/ecdsa.h>
++#include <openssl/evp.h>
++#include <openssl/core_names.h>
++#include <openssl/param_build.h>
+ #else /* OPENSSL */
+ #define BIGNUM void
+ #define DH void
+@@ -322,6 +325,9 @@ int kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
@@ -404,10 +404,10 @@ index b63374b0e..74afa1184 100644
}
diff --git a/kexecdh.c b/kexecdh.c
-index 6a9058cdc..b661e0705 100644
+index a9dbf5c4b..38d827b4c 100644
--- a/kexecdh.c
+++ b/kexecdh.c
-@@ -35,16 +35,56 @@
+@@ -35,11 +35,51 @@
#include <openssl/bn.h>
#include <openssl/ecdh.h>
@@ -421,11 +421,7 @@ index 6a9058cdc..b661e0705 100644
#include "sshbuf.h"
#include "ssherr.h"
+#include "log.h"
-
- static int
- kex_ecdh_dec_key_group(struct kex *, const struct sshbuf *, EC_KEY *key,
- const EC_GROUP *, struct sshbuf **);
-
++
+static EC_KEY *
+generate_ec_keys(int ec_nid)
+{
@@ -460,11 +456,10 @@ index 6a9058cdc..b661e0705 100644
+ OSSL_PARAM_free(params);
+ return client_key;
+}
-+
+
int
kex_ecdh_keypair(struct kex *kex)
- {
-@@ -54,11 +94,7 @@ kex_ecdh_keypair(struct kex *kex)
+@@ -50,11 +90,7 @@ kex_ecdh_keypair(struct kex *kex)
struct sshbuf *buf = NULL;
int r;
@@ -477,7 +472,7 @@ index 6a9058cdc..b661e0705 100644
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
}
-@@ -100,11 +136,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob,
+@@ -96,11 +132,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob,
*server_blobp = NULL;
*shared_secretp = NULL;
@@ -490,7 +485,7 @@ index 6a9058cdc..b661e0705 100644
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
}
-@@ -139,11 +171,21 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+@@ -135,11 +167,21 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
{
struct sshbuf *buf = NULL;
BIGNUM *shared_secret = NULL;
@@ -515,7 +510,7 @@ index 6a9058cdc..b661e0705 100644
*shared_secretp = NULL;
if ((buf = sshbuf_new()) == NULL) {
-@@ -152,45 +194,82 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+@@ -148,29 +190,58 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
}
if ((r = sshbuf_put_stringb(buf, ec_blob)) != 0)
goto out;
@@ -573,28 +568,32 @@ index 6a9058cdc..b661e0705 100644
goto out;
}
- klen = (EC_GROUP_get_degree(group) + 7) / 8;
-- if ((kbuf = malloc(klen)) == NULL ||
-- (shared_secret = BN_new()) == NULL) {
-+ if ((kbuf = malloc(klen)) == NULL) {
+ if ((kbuf = malloc(klen)) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
goto out;
}
-- if (ECDH_compute_key(kbuf, klen, dh_pub, key, NULL) != (int)klen ||
-- BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+- if (ECDH_compute_key(kbuf, klen, dh_pub, key, NULL) != (int)klen) {
+ if (EVP_PKEY_derive(ctx, kbuf, &klen) != 1) {
r = SSH_ERR_LIBCRYPTO_ERROR;
goto out;
}
- #ifdef DEBUG_KEXECDH
- dump_digest("shared secret", kbuf, klen);
- #endif
-+ if ((shared_secret = BN_new()) == NULL ||
-+ (BN_bin2bn(kbuf, klen, shared_secret) == NULL)) {
-+ r = SSH_ERR_ALLOC_FAIL;
-+ goto out;
-+ }
- if ((r = sshbuf_put_bignum2(buf, shared_secret)) != 0)
- goto out;
+@@ -181,23 +252,25 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+ if ((r = sshbuf_put(buf, kbuf, klen)) != 0)
+ goto out;
+ } else {
+- if ((shared_secret = BN_new()) == NULL) {
++ if ((shared_secret = BN_new()) == NULL ||
++ (BN_bin2bn(kbuf, klen, shared_secret) == NULL)) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+- if (BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+- r = SSH_ERR_LIBCRYPTO_ERROR;
+- goto out;
+- }
+ if ((r = sshbuf_put_bignum2(buf, shared_secret)) != 0)
+ goto out;
+ }
*shared_secretp = buf;
buf = NULL;
out:
diff --git a/0041-openssh-8.7p1-nohostsha1proof.patch b/0041-openssh-8.7p1-nohostsha1proof.patch
index b683f9b..dc39983 100644
--- a/0041-openssh-8.7p1-nohostsha1proof.patch
+++ b/0041-openssh-8.7p1-nohostsha1proof.patch
@@ -1,7 +1,7 @@
-From 0def8cfe7fc8b1b69ac7ae7d5889557f67833525 Mon Sep 17 00:00:00 2001
+From 8555dd3916d311cbef5bff785523cd27a193c720 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 41/54] openssh-8.7p1-nohostsha1proof
+Subject: [PATCH 41/53] openssh-8.7p1-nohostsha1proof
---
compat.c | 6 +++++
@@ -65,7 +65,7 @@ index 1a19060fc..2e6db5bf9 100644
/* #define unused 0x00000020 */
#define SSH_BUG_DEBUG 0x00000040
diff --git a/monitor.c b/monitor.c
-index 7dfc7976b..0393c71aa 100644
+index 733a3460f..8269e78c3 100644
--- a/monitor.c
+++ b/monitor.c
@@ -741,11 +741,18 @@ int
@@ -88,7 +88,7 @@ index 7dfc7976b..0393c71aa 100644
compat_set = 1;
return (0);
-@@ -759,10 +766,12 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -759,11 +766,13 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
struct sshbuf *sigbuf = NULL;
u_char *p = NULL, *signature = NULL;
char *alg = NULL;
@@ -99,11 +99,12 @@ index 7dfc7976b..0393c71aa 100644
+ int r, is_proof = 0;
+ int keyid, compat;
const char proof_req[] = "hostkeys-prove-00@openssh.com";
+ static int nhostkey_proofs_done, *hostkey_proofs_done;
+ const char safe_rsa[] = "rsa-sha2-256";
debug3_f("entering");
-@@ -824,18 +833,30 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -836,18 +845,30 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
}
if ((key = get_hostkey_by_index(keyid)) != NULL) {
@@ -138,7 +139,7 @@ index 7dfc7976b..0393c71aa 100644
sshbuf_reset(m);
diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
-index 16c2f2dff..f4700deeb 100644
+index 89376f115..db7cb418b 100644
--- a/regress/unittests/kex/test_kex.c
+++ b/regress/unittests/kex/test_kex.c
@@ -110,7 +110,8 @@ do_kex_with_key(char *kex, char *cipher, char *mac,
@@ -152,10 +153,10 @@ index 16c2f2dff..f4700deeb 100644
kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname;
ASSERT_INT_EQ(ssh_init(&client, 0, &kex_params), 0);
diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
-index 296e90e78..1d30cf22f 100644
+index f8fcc3abd..d4ab64cf0 100644
--- a/regress/unittests/sshkey/test_file.c
+++ b/regress/unittests/sshkey/test_file.c
-@@ -106,6 +106,7 @@ sshkey_file_tests(void)
+@@ -104,6 +104,7 @@ sshkey_file_tests(void)
sshkey_free(k2);
TEST_DONE();
@@ -163,7 +164,7 @@ index 296e90e78..1d30cf22f 100644
TEST_START("load RSA cert with SHA1 signature");
ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha1"), &k2), 0);
ASSERT_PTR_NE(k2, NULL);
-@@ -113,7 +114,7 @@ sshkey_file_tests(void)
+@@ -111,7 +112,7 @@ sshkey_file_tests(void)
ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
ASSERT_STRING_EQ(k2->cert->signature_type, "ssh-rsa");
sshkey_free(k2);
@@ -173,10 +174,10 @@ index 296e90e78..1d30cf22f 100644
TEST_START("load RSA cert with SHA512 signature");
ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha512"), &k2), 0);
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
-index fb178c1e4..6ecb5872d 100644
+index 0e5bdf748..3bdfde167 100644
--- a/regress/unittests/sshkey/test_fuzz.c
+++ b/regress/unittests/sshkey/test_fuzz.c
-@@ -317,13 +317,14 @@ sshkey_fuzz_tests(void)
+@@ -313,13 +313,14 @@ sshkey_fuzz_tests(void)
TEST_DONE();
#ifdef WITH_OPENSSL
@@ -193,10 +194,10 @@ index fb178c1e4..6ecb5872d 100644
TEST_START("fuzz RSA SHA256 sig");
buf = load_file("rsa_1");
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
-index ec0ce452c..db3e22277 100644
+index 59efbb28e..42198775f 100644
--- a/regress/unittests/sshkey/test_sshkey.c
+++ b/regress/unittests/sshkey/test_sshkey.c
-@@ -59,6 +59,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
+@@ -57,6 +57,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
u_char *sigblob;
size_t siglen;
@@ -206,7 +207,7 @@ index ec0ce452c..db3e22277 100644
ca_buf = sshbuf_new();
ASSERT_PTR_NE(ca_buf, NULL);
ASSERT_INT_EQ(sshkey_putb(ca_key, ca_buf), 0);
-@@ -100,8 +103,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
+@@ -98,8 +101,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */
ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */
ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen,
@@ -218,7 +219,7 @@ index ec0ce452c..db3e22277 100644
free(sigblob);
sshbuf_free(ca_buf);
-@@ -118,16 +122,20 @@ signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg,
+@@ -116,16 +120,20 @@ signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg,
{
size_t len;
u_char *sig;
@@ -247,7 +248,7 @@ index ec0ce452c..db3e22277 100644
free(sig);
}
-@@ -650,7 +658,7 @@ sshkey_tests(void)
+@@ -625,7 +633,7 @@ sshkey_tests(void)
ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
NULL), 0);
k3 = get_private("rsa_1");
@@ -257,7 +258,7 @@ index ec0ce452c..db3e22277 100644
SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
ASSERT_PTR_EQ(k4, NULL);
diff --git a/serverloop.c b/serverloop.c
-index 8a6e3db80..e50985e90 100644
+index c22681483..29445426b 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -76,6 +76,7 @@
@@ -268,7 +269,7 @@ index 8a6e3db80..e50985e90 100644
extern ServerOptions options;
-@@ -724,7 +725,10 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
+@@ -725,7 +726,10 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
else if (ssh->kex->flags & KEX_RSA_SHA2_256_SUPPORTED)
sigalg = "rsa-sha2-256";
}
@@ -295,10 +296,10 @@ index 5af39bb39..88232c6ed 100644
goto out;
}
diff --git a/sshconnect2.c b/sshconnect2.c
-index 2dc08b8a1..0c82c7782 100644
+index c21b3a11a..3660873a6 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
-@@ -1442,6 +1442,14 @@ identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
+@@ -1440,6 +1440,14 @@ identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
retried = 1;
goto retry_pin;
}
@@ -314,7 +315,7 @@ index 2dc08b8a1..0c82c7782 100644
}
diff --git a/sshd-session.c b/sshd-session.c
-index fa1192c09..0284c8e42 100644
+index 0a9708d3a..adf5b1b49 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -1261,6 +1261,27 @@ main(int ac, char **av)
diff --git a/0042-openssh-9.9p1-separate-keysign.patch b/0042-openssh-9.9p1-separate-keysign.patch
index 4eca3f8..c267e9e 100644
--- a/0042-openssh-9.9p1-separate-keysign.patch
+++ b/0042-openssh-9.9p1-separate-keysign.patch
@@ -1,14 +1,14 @@
-From 7f74e6176165e85858c1991b9f96d6da398c9e01 Mon Sep 17 00:00:00 2001
+From e9eba7f4adb59d308ff9dec4f8ec1a426cfe3e39 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 42/54] openssh-9.9p1-separate-keysign
+Subject: [PATCH 42/53] openssh-9.9p1-separate-keysign
---
ssh_config.5 | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ssh_config.5 b/ssh_config.5
-index 0447c8c7e..67d52d874 100644
+index c4c72f587..f2ff8585c 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -834,7 +834,7 @@ or
diff --git a/0043-openssh-9.9p1-openssl-mlkem.patch b/0043-openssh-9.9p1-openssl-mlkem.patch
index f6b653e..8ffc1c7 100644
--- a/0043-openssh-9.9p1-openssl-mlkem.patch
+++ b/0043-openssh-9.9p1-openssl-mlkem.patch
@@ -1,7 +1,7 @@
-From c6d1e29ac2f702560a2dc01fe88333d786850fc6 Mon Sep 17 00:00:00 2001
+From 648348f34e3f4279e030184a318a9c0326fd82a1 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 43/54] openssh-9.9p1-openssl-mlkem
+Subject: [PATCH 43/53] openssh-9.9p1-openssl-mlkem
---
kex-names.c | 23 +++-
@@ -9,10 +9,10 @@ Subject: [PATCH 43/54] openssh-9.9p1-openssl-mlkem
2 files changed, 314 insertions(+), 1 deletion(-)
diff --git a/kex-names.c b/kex-names.c
-index dcb6efc13..6cc8ab47c 100644
+index 8e9c621bd..cdd5db90e 100644
--- a/kex-names.c
+++ b/kex-names.c
-@@ -108,6 +108,19 @@ static const struct kexalg gss_kexalgs[] = {
+@@ -106,6 +106,19 @@ static const struct kexalg gss_kexalgs[] = {
{ NULL, 0, -1, -1, 0},
};
@@ -32,7 +32,7 @@ index dcb6efc13..6cc8ab47c 100644
static char *
kex_alg_list_internal(char sep, const struct kexalg *algs)
{
-@@ -115,8 +128,12 @@ kex_alg_list_internal(char sep, const struct kexalg *algs)
+@@ -113,8 +126,12 @@ kex_alg_list_internal(char sep, const struct kexalg *algs)
const struct kexalg *k;
char sep_str[2] = {sep, '\0'};
@@ -46,7 +46,7 @@ index dcb6efc13..6cc8ab47c 100644
return ret;
}
-@@ -138,6 +155,10 @@ kex_alg_by_name(const char *name)
+@@ -136,6 +153,10 @@ kex_alg_by_name(const char *name)
{
const struct kexalg *k;
diff --git a/0044-openssh-9.9p2-error_processing.patch b/0044-openssh-9.9p2-error_processing.patch
index a97f873..dc7f1eb 100644
--- a/0044-openssh-9.9p2-error_processing.patch
+++ b/0044-openssh-9.9p2-error_processing.patch
@@ -1,7 +1,7 @@
-From 8f8e0b77fceaf7ffd015a69b4071d2c43e1c533a Mon Sep 17 00:00:00 2001
+From 876a71d2fa9c9eea5b4263216413e9f3864956d2 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Fri, 16 May 2025 14:53:54 +0200
-Subject: [PATCH 44/54] openssh-9.9p2-error_processing
+Subject: [PATCH 44/53] openssh-9.9p2-error_processing
# https://www.openwall.com/lists/oss-security/2025/02/22/1
---
@@ -9,7 +9,7 @@ Subject: [PATCH 44/54] openssh-9.9p2-error_processing
1 file changed, 2 insertions(+)
diff --git a/ssh-agent.c b/ssh-agent.c
-index 5fc73d697..17b2a96c0 100644
+index 1604f540a..4c8e1a4da 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1359,6 +1359,8 @@ process_add_identity(SocketEntry *e)
diff --git a/0045-Ignore-bad-hostkeys-in-known_hosts-file.patch b/0045-Ignore-bad-hostkeys-in-known_hosts-file.patch
index 2694a20..e73e923 100644
--- a/0045-Ignore-bad-hostkeys-in-known_hosts-file.patch
+++ b/0045-Ignore-bad-hostkeys-in-known_hosts-file.patch
@@ -1,7 +1,7 @@
-From 5a6fdcd03c88dadadff28c078e8709a394332975 Mon Sep 17 00:00:00 2001
+From e864b54e074914b1bdc2a239d02b9cabc97e9ca4 Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Mon, 5 May 2025 11:52:25 +0200
-Subject: [PATCH 45/54] Ignore bad hostkeys in known_hosts file
+Subject: [PATCH 45/53] Ignore bad hostkeys in known_hosts file
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
@@ -64,7 +64,7 @@ index a24a4e329..0e9b1a19a 100644
#endif
diff --git a/ssh.c b/ssh.c
-index 4dee7849f..c319d08af 100644
+index 00c0edefc..0182cc567 100644
--- a/ssh.c
+++ b/ssh.c
@@ -97,6 +97,7 @@
@@ -75,7 +75,7 @@ index 4dee7849f..c319d08af 100644
#ifdef ENABLE_PKCS11
#include "ssh-pkcs11.h"
-@@ -1357,6 +1358,7 @@ main(int ac, char **av)
+@@ -1361,6 +1362,7 @@ main(int ac, char **av)
options.update_hostkeys = 0;
}
}
diff --git a/0046-support-authentication-indicators-in-GSSAPI.patch b/0046-support-authentication-indicators-in-GSSAPI.patch
index a175fea..01d460b 100644
--- a/0046-support-authentication-indicators-in-GSSAPI.patch
+++ b/0046-support-authentication-indicators-in-GSSAPI.patch
@@ -1,7 +1,7 @@
-From 37022658e4c96b4ffc883f677cc1587f9bab4d00 Mon Sep 17 00:00:00 2001
+From 5348ff4f4c59dac677b8348b1213c6ef1e530e31 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Sun, 12 Apr 2026 12:23:51 +0200
-Subject: [PATCH 46/54] support authentication indicators in GSSAPI
+Subject: [PATCH 46/53] support authentication indicators in GSSAPI
https://github.com/openssh/openssh-portable/pull/500
@@ -17,10 +17,10 @@ Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
7 files changed, 258 insertions(+), 14 deletions(-)
diff --git a/configure.ac b/configure.ac
-index caa75f708..4df1a3204 100644
+index 394acc3d8..d6274328b 100644
--- a/configure.ac
+++ b/configure.ac
-@@ -5120,6 +5120,7 @@ AC_ARG_WITH([kerberos5],
+@@ -5059,6 +5059,7 @@ AC_ARG_WITH([kerberos5],
AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
@@ -312,10 +312,10 @@ index 6eb7d2163..237a3c40a 100644
}
else
diff --git a/servconf.c b/servconf.c
-index bee75d486..90c5839a2 100644
+index 846f5d212..d9cccc17c 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -458,6 +458,7 @@ fill_default_server_options(ServerOptions *options)
+@@ -456,6 +456,7 @@ fill_default_server_options(ServerOptions *options)
CLEAR_ON_NONE(options->routing_domain);
CLEAR_ON_NONE(options->host_key_agent);
CLEAR_ON_NONE(options->per_source_penalty_exempt);
@@ -323,7 +323,7 @@ index bee75d486..90c5839a2 100644
for (i = 0; i < options->num_host_key_files; i++)
CLEAR_ON_NONE(options->host_key_files[i]);
-@@ -1490,6 +1491,15 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1488,6 +1489,15 @@ process_server_config_line_depth(ServerOptions *options, char *line,
if (*activep && options->gss_kex_algorithms == NULL)
options->gss_kex_algorithms = xstrdup(arg);
break;
@@ -339,7 +339,7 @@ index bee75d486..90c5839a2 100644
#endif /* GSSAPI */
case sPasswordAuthentication:
-@@ -4275,6 +4285,7 @@ dump_config(ServerOptions *o)
+@@ -4274,6 +4284,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor);
dump_cfg_fmtint(sGSSAPIStoreCredentialsOnRekey, o->gss_store_rekey);
dump_cfg_string(sGSSAPIKexAlgorithms, o->gss_kex_algorithms);
@@ -348,7 +348,7 @@ index bee75d486..90c5839a2 100644
dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
dump_cfg_fmtint(sKbdInteractiveAuthentication,
diff --git a/servconf.h b/servconf.h
-index 7e809cfff..a8e90e5a9 100644
+index c55b64c73..81e699655 100644
--- a/servconf.h
+++ b/servconf.h
@@ -326,7 +326,8 @@ SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1
@@ -397,7 +397,7 @@ index 329dc9da0..1506719a9 100644
typedef struct ssh_gssapi_mech_struct {
diff --git a/sshd_config.5 b/sshd_config.5
-index 5998275d2..8fed58d5c 100644
+index b72757895..2a8f3abea 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -811,6 +811,52 @@ This option only applies to connections using GSSAPI.
diff --git a/0047-NIST-curves-hybrid-KEX-implementation.patch b/0047-NIST-curves-hybrid-KEX-implementation.patch
index 7eba18a..6885241 100644
--- a/0047-NIST-curves-hybrid-KEX-implementation.patch
+++ b/0047-NIST-curves-hybrid-KEX-implementation.patch
@@ -1,25 +1,25 @@
-From 93504cc2625494b096134f478b851f140dbd8926 Mon Sep 17 00:00:00 2001
+From 111be4b2ba5e0e2549d21d1ed4c53fe9af90827a Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon, 20 Oct 2025 16:07:31 +0200
-Subject: [PATCH 47/54] NIST curves hybrid KEX implementation
+Subject: [PATCH 47/53] NIST curves hybrid KEX implementation
---
compat.c | 23 +-
compat.h | 1 +
crypto_api.h | 5 +
- kex-names.c | 89 +++-
+ kex-names.c | 91 ++++-
kex.c | 1 +
- kex.h | 19 +
- kexgen.c | 56 ++-
+ kex.h | 20 +-
+ kexgen.c | 67 ++-
kexmlkem768x25519.c | 680 +++++++++++++++++++++++++++++--
monitor.c | 2 +
myproposal.h | 4 +
regress/unittests/kex/test_kex.c | 4 +
- ssh-keyscan.c | 2 +
- ssh_api.c | 4 +
- sshconnect2.c | 2 +
+ ssh-keyscan.c | 3 +-
+ ssh_api.c | 6 +-
+ sshconnect2.c | 3 +-
sshd-auth.c | 2 +
- 15 files changed, 853 insertions(+), 41 deletions(-)
+ 15 files changed, 852 insertions(+), 60 deletions(-)
diff --git a/compat.c b/compat.c
index 4312510e5..e6c7935d4 100644
@@ -81,7 +81,7 @@ index 2e6db5bf9..b78e55b69 100644
+int is_mlkem768_available(void);
#endif
diff --git a/crypto_api.h b/crypto_api.h
-index 9095d8292..f91556b2d 100644
+index f8441ed6f..60ea24a3e 100644
--- a/crypto_api.h
+++ b/crypto_api.h
@@ -203,6 +203,11 @@ int crypto_sign_mldsa44_ed25519_verify(const uint8_t sig[MLDSA44_ED25519_SIG_SZ]
@@ -97,7 +97,7 @@ index 9095d8292..f91556b2d 100644
void sha3_256(uint8_t digest[32], const uint8_t *data, size_t len);
void sha3_512(uint8_t digest[64], const uint8_t *data, size_t len);
diff --git a/kex-names.c b/kex-names.c
-index 6cc8ab47c..aa4a5eaab 100644
+index cdd5db90e..f9c51429a 100644
--- a/kex-names.c
+++ b/kex-names.c
@@ -34,6 +34,7 @@
@@ -108,7 +108,16 @@ index 6cc8ab47c..aa4a5eaab 100644
#endif
#include "kex.h"
-@@ -90,6 +91,10 @@ static const struct kexalg kexalgs[] = {
+@@ -73,8 +74,6 @@ static const struct kexalg kexalgs[] = {
+ SSH_DIGEST_SHA384, KEX_NOT_PQ },
+ { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
+ SSH_DIGEST_SHA512, KEX_NOT_PQ },
+- { KEX_MLKEM768NISTP256_SHA256, KEX_KEM_MLKEM768ECDH_SHA256,
+- NID_X9_62_prime256v1, SSH_DIGEST_SHA256, KEX_IS_PQ },
+ #endif /* WITH_OPENSSL */
+ #if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL)
+ { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ },
+@@ -88,6 +87,10 @@ static const struct kexalg kexalgs[] = {
#ifdef USE_MLKEM768X25519
{ KEX_MLKEM768X25519_SHA256, KEX_KEM_MLKEM768X25519_SHA256, 0,
SSH_DIGEST_SHA256, KEX_IS_PQ },
@@ -119,7 +128,7 @@ index 6cc8ab47c..aa4a5eaab 100644
#endif
#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
{ NULL, 0, -1, -1, 0 },
-@@ -108,14 +113,27 @@ static const struct kexalg gss_kexalgs[] = {
+@@ -106,14 +109,27 @@ static const struct kexalg gss_kexalgs[] = {
{ NULL, 0, -1, -1, 0},
};
@@ -150,7 +159,7 @@ index 6cc8ab47c..aa4a5eaab 100644
}
return is_fetched;
-@@ -127,11 +145,32 @@ kex_alg_list_internal(char sep, const struct kexalg *algs)
+@@ -125,11 +141,32 @@ kex_alg_list_internal(char sep, const struct kexalg *algs)
char *ret = NULL;
const struct kexalg *k;
char sep_str[2] = {sep, '\0'};
@@ -186,7 +195,7 @@ index 6cc8ab47c..aa4a5eaab 100644
xextendf(&ret, sep_str, "%s", k->name);
}
-@@ -154,10 +193,30 @@ static const struct kexalg *
+@@ -152,10 +189,30 @@ static const struct kexalg *
kex_alg_by_name(const char *name)
{
const struct kexalg *k;
@@ -220,7 +229,7 @@ index 6cc8ab47c..aa4a5eaab 100644
for (k = kexalgs; k->name != NULL; k++) {
if (strcmp(k->name, name) == 0)
-@@ -235,8 +294,16 @@ kex_names_valid(const char *names)
+@@ -233,8 +290,16 @@ kex_names_valid(const char *names)
return 0;
}
if (kex_alg_by_name(p) == NULL) {
@@ -240,40 +249,42 @@ index 6cc8ab47c..aa4a5eaab 100644
error("Unsupported KEX algorithm \"%.100s\"", p);
free(s);
diff --git a/kex.c b/kex.c
-index a51e26398..136ba318e 100644
+index 62cfa86cd..1e0c29b91 100644
--- a/kex.c
+++ b/kex.c
-@@ -762,6 +762,7 @@ kex_free(struct kex *kex)
- #ifdef OPENSSL_HAS_ECC
+@@ -760,6 +760,7 @@ kex_free(struct kex *kex)
+ #ifdef WITH_OPENSSL
+ DH_free(kex->dh);
EC_KEY_free(kex->ec_client_key);
- #endif /* OPENSSL_HAS_ECC */
+ EVP_PKEY_free(kex->ec_hybrid_client_key);
#endif /* WITH_OPENSSL */
for (mode = 0; mode < MODE_MAX; mode++) {
kex_free_newkeys(kex->newkeys[mode]);
diff --git a/kex.h b/kex.h
-index d22f6deb3..9b5fe05c4 100644
+index 1fe4bb29b..4e1b2875e 100644
--- a/kex.h
+++ b/kex.h
-@@ -72,6 +72,8 @@
+@@ -65,7 +65,8 @@
#define KEX_SNTRUP761X25519_SHA512 "sntrup761x25519-sha512"
#define KEX_SNTRUP761X25519_SHA512_OLD "sntrup761x25519-sha512@openssh.com"
#define KEX_MLKEM768X25519_SHA256 "mlkem768x25519-sha256"
+-#define KEX_MLKEM768NISTP256_SHA256 "mlkem768nistp256-sha256"
+#define KEX_MLKEM768NISTP256_SHA256 "mlkem768nistp256-sha256"
+#define KEX_MLKEM1024NISTP384_SHA384 "mlkem1024nistp384-sha384"
#define COMP_NONE 0
#define COMP_DELAYED 2
-@@ -110,6 +112,8 @@ enum kex_exchange {
+@@ -104,7 +105,8 @@ enum kex_exchange {
KEX_C25519_SHA256,
KEX_KEM_SNTRUP761X25519_SHA512,
KEX_KEM_MLKEM768X25519_SHA256,
+- KEX_KEM_MLKEM768ECDH_SHA256,
+ KEX_KEM_MLKEM768NISTP256_SHA256,
+ KEX_KEM_MLKEM1024NISTP384_SHA384,
#ifdef GSSAPI
KEX_GSS_GRP1_SHA1,
KEX_GSS_GRP14_SHA1,
-@@ -212,6 +216,9 @@ struct kex {
+@@ -207,6 +209,9 @@ struct kex {
u_char sntrup761_client_key[crypto_kem_sntrup761_SECRETKEYBYTES]; /* KEM */
u_char mlkem768_client_key[crypto_kem_mlkem768_SECRETKEYBYTES]; /* KEM */
struct sshbuf *client_pub;
@@ -283,10 +294,10 @@ index d22f6deb3..9b5fe05c4 100644
};
int kex_name_valid(const char *);
-@@ -294,6 +301,18 @@ int kex_kem_mlkem768x25519_enc(struct kex *, const struct sshbuf *,
- int kex_kem_mlkem768x25519_dec(struct kex *, const struct sshbuf *,
+@@ -297,6 +302,17 @@ int kex_kem_mlkem768ecdh_enc(struct kex *, const struct sshbuf *,
+ struct sshbuf **, struct sshbuf **);
+ int kex_kem_mlkem768ecdh_dec(struct kex *, const struct sshbuf *,
struct sshbuf **);
-
+int kex_kem_mlkem768nistp256_keypair(struct kex *);
+int kex_kem_mlkem768nistp256_enc(struct kex *, const struct sshbuf *,
+ struct sshbuf **, struct sshbuf **);
@@ -298,15 +309,24 @@ index d22f6deb3..9b5fe05c4 100644
+ struct sshbuf **, struct sshbuf **);
+int kex_kem_mlkem1024nistp384_dec(struct kex *, const struct sshbuf *,
+ struct sshbuf **);
-+
+
int kex_dh_keygen(struct kex *);
int kex_dh_compute_key(struct kex *, BIGNUM *, struct sshbuf *);
-
diff --git a/kexgen.c b/kexgen.c
-index 2f8252488..9a356e298 100644
+index 834073ef1..79ddb5925 100644
--- a/kexgen.c
+++ b/kexgen.c
-@@ -133,12 +133,24 @@ kex_gen_client(struct ssh *ssh)
+@@ -114,9 +114,6 @@ kex_gen_client(struct ssh *ssh)
+ case KEX_ECDH_SHA2:
+ r = kex_ecdh_keypair(kex);
+ break;
+- case KEX_KEM_MLKEM768ECDH_SHA256:
+- r = kex_kem_mlkem768ecdh_keypair(kex);
+- break;
+ #endif /* WITH_OPENSSL */
+ case KEX_C25519_SHA256:
+ if (FIPS_mode()) {
+@@ -136,12 +133,24 @@ kex_gen_client(struct ssh *ssh)
break;
case KEX_KEM_MLKEM768X25519_SHA256:
if (FIPS_mode()) {
@@ -333,7 +353,18 @@ index 2f8252488..9a356e298 100644
default:
r = SSH_ERR_INVALID_ARGUMENT;
break;
-@@ -223,13 +235,28 @@ input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
+@@ -206,10 +215,6 @@ input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
+ case KEX_ECDH_SHA2:
+ r = kex_ecdh_dec(kex, server_blob, &shared_secret);
+ break;
+- case KEX_KEM_MLKEM768ECDH_SHA256:
+- r = kex_kem_mlkem768ecdh_dec(kex, server_blob,
+- &shared_secret);
+- break;
+ #endif /* WITH_OPENSSL */
+ case KEX_C25519_SHA256:
+ if (FIPS_mode()) {
+@@ -230,13 +235,28 @@ input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
break;
case KEX_KEM_MLKEM768X25519_SHA256:
if (FIPS_mode()) {
@@ -364,7 +395,7 @@ index 2f8252488..9a356e298 100644
default:
r = SSH_ERR_INVALID_ARGUMENT;
break;
-@@ -283,6 +310,8 @@ out:
+@@ -290,6 +310,8 @@ out:
sizeof(kex->sntrup761_client_key));
explicit_bzero(kex->mlkem768_client_key,
sizeof(kex->mlkem768_client_key));
@@ -373,7 +404,18 @@ index 2f8252488..9a356e298 100644
sshbuf_free(server_host_key_blob);
free(signature);
sshbuf_free(tmp);
-@@ -362,13 +391,28 @@ input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
+@@ -348,10 +370,6 @@ input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
+ r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
+ &shared_secret);
+ break;
+- case KEX_KEM_MLKEM768ECDH_SHA256:
+- r = kex_kem_mlkem768ecdh_enc(kex, client_pubkey,
+- &server_pubkey, &shared_secret);
+- break;
+ #endif /* WITH_OPENSSL */
+ case KEX_C25519_SHA256:
+ if (FIPS_mode()) {
+@@ -373,13 +391,28 @@ input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
break;
case KEX_KEM_MLKEM768X25519_SHA256:
if (FIPS_mode()) {
@@ -1185,10 +1227,10 @@ index 36658120f..03efb788f 100644
+
#endif /* USE_MLKEM768X25519 */
diff --git a/monitor.c b/monitor.c
-index 0393c71aa..63180e2a9 100644
+index 8269e78c3..87df3e9d7 100644
--- a/monitor.c
+++ b/monitor.c
-@@ -2024,6 +2024,8 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+@@ -2034,6 +2034,8 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
kex->kex[KEX_C25519_SHA256] = kex_gen_server;
kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
@@ -1198,7 +1240,7 @@ index 0393c71aa..63180e2a9 100644
kex->load_host_private_key=&get_hostkey_private_by_type;
kex->host_key_index=&get_hostkey_index;
diff --git a/myproposal.h b/myproposal.h
-index 6433e0820..51e3ef5c8 100644
+index f03293f35..db50c5b1c 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -26,6 +26,8 @@
@@ -1220,10 +1262,10 @@ index 6433e0820..51e3ef5c8 100644
"ecdh-sha2-nistp384," \
"ecdh-sha2-nistp521," \
diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
-index f4700deeb..99a8e3b46 100644
+index db7cb418b..fad9a634a 100644
--- a/regress/unittests/kex/test_kex.c
+++ b/regress/unittests/kex/test_kex.c
-@@ -171,6 +171,8 @@ do_kex_with_key(char *kex, char *cipher, char *mac,
+@@ -169,6 +169,8 @@ do_kex_with_key(char *kex, char *cipher, char *mac,
server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server;
server2->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
server2->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
@@ -1232,7 +1274,7 @@ index f4700deeb..99a8e3b46 100644
server2->kex->load_host_public_key = server->kex->load_host_public_key;
server2->kex->load_host_private_key = server->kex->load_host_private_key;
server2->kex->sign = server->kex->sign;
-@@ -248,6 +250,8 @@ kex_tests(void)
+@@ -242,6 +244,8 @@ kex_tests(void)
}
# ifdef USE_MLKEM768X25519
do_kex("mlkem768x25519-sha256");
@@ -1242,58 +1284,62 @@ index f4700deeb..99a8e3b46 100644
# ifdef USE_SNTRUP761X25519
do_kex("sntrup761x25519-sha512");
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
-index 1f15f3077..ece85c62f 100644
+index 284d4deee..405faf167 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
-@@ -306,6 +306,8 @@ keygrab_ssh2(con *c)
+@@ -307,7 +307,8 @@ keygrab_ssh2(con *c)
c->c_ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
c->c_ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client;
c->c_ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client;
+- c->c_ssh->kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_client;
+ c->c_ssh->kex->kex[KEX_KEM_MLKEM768NISTP256_SHA256] = kex_gen_client;
+ c->c_ssh->kex->kex[KEX_KEM_MLKEM1024NISTP384_SHA384] = kex_gen_client;
ssh_set_verify_host_key_callback(c->c_ssh, key_print_wrapper);
/*
* do the key-exchange until an error occurs or until
diff --git a/ssh_api.c b/ssh_api.c
-index 38ac17da1..b178582b3 100644
+index d01ac5483..f554b12cd 100644
--- a/ssh_api.c
+++ b/ssh_api.c
-@@ -135,6 +135,8 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
+@@ -133,7 +133,8 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_server;
ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
+- ssh->kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server;
+ ssh->kex->kex[KEX_KEM_MLKEM768NISTP256_SHA256] = kex_gen_server;
+ ssh->kex->kex[KEX_KEM_MLKEM1024NISTP384_SHA384] = kex_gen_server;
ssh->kex->load_host_public_key=&_ssh_host_public_key;
ssh->kex->load_host_private_key=&_ssh_host_private_key;
ssh->kex->sign=&_ssh_host_key_sign;
-@@ -154,6 +156,8 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
+@@ -151,7 +152,8 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client;
ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client;
+- ssh->kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_client;
+ ssh->kex->kex[KEX_KEM_MLKEM768NISTP256_SHA256] = kex_gen_client;
+ ssh->kex->kex[KEX_KEM_MLKEM1024NISTP384_SHA384] = kex_gen_client;
ssh->kex->verify_host_key =&_ssh_verify_host_key;
}
*sshp = ssh;
diff --git a/sshconnect2.c b/sshconnect2.c
-index 0c82c7782..75d13f54e 100644
+index 3660873a6..b5d63e599 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
-@@ -352,6 +352,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+@@ -349,7 +349,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client;
ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client;
+- ssh->kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_client;
+ ssh->kex->kex[KEX_KEM_MLKEM768NISTP256_SHA256] = kex_gen_client;
+ ssh->kex->kex[KEX_KEM_MLKEM1024NISTP384_SHA384] = kex_gen_client;
ssh->kex->verify_host_key=&verify_host_key_callback;
#if defined(GSSAPI) && defined(WITH_OPENSSL)
diff --git a/sshd-auth.c b/sshd-auth.c
-index 6a5cd0c52..c4df314ef 100644
+index 079063f47..6038758ce 100644
--- a/sshd-auth.c
+++ b/sshd-auth.c
-@@ -867,6 +867,8 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -864,6 +864,8 @@ do_ssh2_kex(struct ssh *ssh)
kex->kex[KEX_C25519_SHA256] = kex_gen_server;
kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
diff --git a/0048-openssh-7.3p1-x11-max-displays.patch b/0048-openssh-7.3p1-x11-max-displays.patch
index 569bde6..c385586 100644
--- a/0048-openssh-7.3p1-x11-max-displays.patch
+++ b/0048-openssh-7.3p1-x11-max-displays.patch
@@ -1,7 +1,7 @@
-From f442f305469242d587cdebc28e31ac5ad5252643 Mon Sep 17 00:00:00 2001
+From 9e952349b6b64ff2916199323b1db909c3f1d6f3 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Fri, 12 Dec 2025 15:35:14 +0100
-Subject: [PATCH 48/54] openssh-7.3p1-x11-max-displays
+Subject: [PATCH 48/53] openssh-7.3p1-x11-max-displays
Move MAX_DISPLAYS to a configuration option (#1341302)
---
@@ -62,10 +62,10 @@ index f69096498..bc3b52aa2 100644
const char *, const char *, const char *, int);
int x11_channel_used_recently(struct ssh *ssh);
diff --git a/servconf.c b/servconf.c
-index 90c5839a2..03b84ecb8 100644
+index d9cccc17c..8746a2417 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -1535,6 +1535,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1533,6 +1533,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
*intptr = value;
break;
@@ -76,7 +76,7 @@ index 90c5839a2..03b84ecb8 100644
case sX11UseLocalhost:
intptr = &options->x11_use_localhost;
goto parse_flag;
-@@ -4250,6 +4254,7 @@ dump_config(ServerOptions *o)
+@@ -4249,6 +4253,7 @@ dump_config(ServerOptions *o)
#endif
dump_cfg_int(sLoginGraceTime, o->login_grace_time);
dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
@@ -85,7 +85,7 @@ index 90c5839a2..03b84ecb8 100644
dump_cfg_int(sMaxSessions, o->max_sessions);
dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
diff --git a/servconf.h b/servconf.h
-index a8e90e5a9..c1bbd82b8 100644
+index 81e699655..4e5f7edc6 100644
--- a/servconf.h
+++ b/servconf.h
@@ -40,6 +40,7 @@ struct sshbuf;
@@ -121,10 +121,10 @@ index bd8dc808c..e2cf13bdc 100644
return 0;
}
diff --git a/sshd_config.5 b/sshd_config.5
-index 8fed58d5c..8cbe5ecba 100644
+index 2a8f3abea..bf9efc897 100644
--- a/sshd_config.5
+++ b/sshd_config.5
-@@ -1427,6 +1427,7 @@ Available keywords are
+@@ -1430,6 +1430,7 @@ Available keywords are
.Cm TrustedUserCAKeys ,
.Cm UnusedConnectionTimeout ,
.Cm X11DisplayOffset ,
@@ -132,7 +132,7 @@ index 8fed58d5c..8cbe5ecba 100644
.Cm X11Forwarding
and
.Cm X11UseLocalhost .
-@@ -2144,6 +2145,12 @@ Specifies the first display number available for
+@@ -2147,6 +2148,12 @@ Specifies the first display number available for
X11 forwarding.
This prevents sshd from interfering with real X11 servers.
The default is 10.
diff --git a/0049-Fix-ssh-pkcs11-client-helper-termination.patch b/0049-Fix-ssh-pkcs11-client-helper-termination.patch
index 446db4c..ba1d2d7 100644
--- a/0049-Fix-ssh-pkcs11-client-helper-termination.patch
+++ b/0049-Fix-ssh-pkcs11-client-helper-termination.patch
@@ -1,7 +1,7 @@
-From 7c4e22aaa8d7651e9ba3bc4030f5235ebadf6714 Mon Sep 17 00:00:00 2001
+From 3bb305e252bed53087559ccedfe631a09b870a9c Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon, 13 Apr 2026 14:59:26 +0200
-Subject: [PATCH 49/54] Fix ssh-pkcs11-client helper termination
+Subject: [PATCH 49/53] Fix ssh-pkcs11-client helper termination
Don't terminate the PKCS#11 helper when SSH2_AGENT_FAILURE is returned.
This is a legitimate response when a token requires PIN authentication.
diff --git a/0050-openssh-10.2p1-pam-auth.patch b/0050-openssh-10.2p1-pam-auth.patch
index 7e04b3e..85eb0e6 100644
--- a/0050-openssh-10.2p1-pam-auth.patch
+++ b/0050-openssh-10.2p1-pam-auth.patch
@@ -1,7 +1,7 @@
-From 3cdcd8d81220883814af4436b7443d0e755f7bae Mon Sep 17 00:00:00 2001
+From 4a9ecd9744225d274ec05a4aab66acef25498288 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Sun, 12 Apr 2026 12:25:04 +0200
-Subject: [PATCH 50/54] openssh-10.2p1-pam-auth
+Subject: [PATCH 50/53] openssh-10.2p1-pam-auth
https://bugzilla.redhat.com/show_bug.cgi?id=2423900
diff --git a/0051-gssapi-s4u.patch b/0051-gssapi-s4u.patch
index 100401d..9061918 100644
--- a/0051-gssapi-s4u.patch
+++ b/0051-gssapi-s4u.patch
@@ -1,7 +1,7 @@
-From 1002a35e98ba6d0ac275ccbce1a7352e01cdc0ed Mon Sep 17 00:00:00 2001
+From 13df14017a530856a20dcc0208a67e126178d392 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Sun, 12 Apr 2026 12:25:21 +0200
-Subject: [PATCH 51/54] gssapi-s4u
+Subject: [PATCH 51/53] gssapi-s4u
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
@@ -41,10 +41,10 @@ index 2e3c1c80f..9cd3618b2 100644
ret = krb5_cc_new_unique(ctx, type, NULL, ccache);
free(type);
diff --git a/configure.ac b/configure.ac
-index 4df1a3204..918ccd5df 100644
+index d6274328b..b2c959ff3 100644
--- a/configure.ac
+++ b/configure.ac
-@@ -5136,11 +5136,17 @@ AC_ARG_WITH([kerberos5],
+@@ -5075,11 +5075,17 @@ AC_ARG_WITH([kerberos5],
# include <gssapi_generic.h>
#elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
# include <gssapi/gssapi_generic.h>
@@ -712,10 +712,10 @@ index 237a3c40a..d7206499d 100644
/* As user */
int
diff --git a/servconf.c b/servconf.c
-index 03b84ecb8..ab7327a2a 100644
+index 8746a2417..667468590 100644
--- a/servconf.c
+++ b/servconf.c
-@@ -1500,6 +1500,43 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1498,6 +1498,43 @@ process_server_config_line_depth(ServerOptions *options, char *line,
if (options->gss_indicators == NULL)
options->gss_indicators = xstrdup(arg);
break;
@@ -759,7 +759,7 @@ index 03b84ecb8..ab7327a2a 100644
#endif /* GSSAPI */
case sPasswordAuthentication:
-@@ -4291,6 +4328,15 @@ dump_config(ServerOptions *o)
+@@ -4290,6 +4327,15 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sGSSAPIStoreCredentialsOnRekey, o->gss_store_rekey);
dump_cfg_string(sGSSAPIKexAlgorithms, o->gss_kex_algorithms);
dump_cfg_string(sGSSAPIIndicators, o->gss_indicators);
@@ -776,7 +776,7 @@ index 03b84ecb8..ab7327a2a 100644
dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
dump_cfg_fmtint(sKbdInteractiveAuthentication,
diff --git a/servconf.h b/servconf.h
-index c1bbd82b8..61565f0ae 100644
+index 4e5f7edc6..9ee4a089d 100644
--- a/servconf.h
+++ b/servconf.h
@@ -329,7 +329,9 @@ SSHCONF_INTFLAG(gss_keyex, GSSAPIKeyExchange, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE
@@ -833,10 +833,10 @@ index 1506719a9..a0d51c9be 100644
char *ssh_gssapi_server_mechanisms(void);
diff --git a/sshd-session.c b/sshd-session.c
-index 0284c8e42..29971dc70 100644
+index adf5b1b49..7d0e25ca1 100644
--- a/sshd-session.c
+++ b/sshd-session.c
-@@ -1394,6 +1394,104 @@ main(int ac, char **av)
+@@ -1396,6 +1396,104 @@ main(int ac, char **av)
authctxt->krb5_set_env = ssh_gssapi_storecreds();
restore_uid();
}
@@ -942,7 +942,7 @@ index 0284c8e42..29971dc70 100644
#ifdef WITH_SELINUX
sshd_selinux_setup_exec_context(authctxt->pw->pw_name,
diff --git a/sshd_config.5 b/sshd_config.5
-index 8cbe5ecba..c16d7f5b0 100644
+index bf9efc897..ca8a8131e 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -857,6 +857,76 @@ FIDO2-based pre-authentication in FreeIPA, using FIDO2 USB and NFC tokens
diff --git a/0052-openssh-10.2p1-pkcs11-uri.patch b/0052-openssh-10.2p1-pkcs11-uri.patch
index 12c4506..7e68251 100644
--- a/0052-openssh-10.2p1-pkcs11-uri.patch
+++ b/0052-openssh-10.2p1-pkcs11-uri.patch
@@ -1,7 +1,7 @@
-From 4580b0efc21a6965f304ae5e0ada4e8ce41eb7ae Mon Sep 17 00:00:00 2001
+From dc4d137cc79b3ec45ed7624c437e86409808438e Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon, 15 Dec 2025 14:24:07 +0100
-Subject: [PATCH 52/54] openssh-10.2p1-pkcs11-uri
+Subject: [PATCH 52/53] openssh-10.2p1-pkcs11-uri
---
.depend | 1 +
@@ -29,10 +29,10 @@ Subject: [PATCH 52/54] openssh-10.2p1-pkcs11-uri
create mode 100644 ssh-pkcs11-uri.h
diff --git a/.depend b/.depend
-index 7e5f3dcd3..9037c6ef6 100644
+index 45ad2bf4e..b430c7e77 100644
--- a/.depend
+++ b/.depend
-@@ -144,6 +144,7 @@ ssh-mldsa-eddsa.o: includes.h config.h defines.h platform.h openbsd-compat/openb
+@@ -145,6 +145,7 @@ ssh-mldsa-eddsa.o: includes.h config.h defines.h platform.h openbsd-compat/openb
ssh-pkcs11-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h pathnames.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h atomicio.h ssh-pkcs11.h
ssh-pkcs11-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h ssh-pkcs11.h
ssh-pkcs11.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshkey.h ssh-pkcs11.h
@@ -41,7 +41,7 @@ index 7e5f3dcd3..9037c6ef6 100644
ssh-sk-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshbuf.h sshkey.h msg.h pathnames.h ssh-sk.h misc.h
ssh-sk-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h sshkey.h authfd.h misc.h sshbuf.h msg.h uidswap.h ssh-sk.h ssh-pkcs11.h
diff --git a/Makefile.in b/Makefile.in
-index 56c4c88cf..23cf085a5 100644
+index f61f89e4d..23d5f908a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -113,12 +113,12 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
@@ -127,7 +127,7 @@ index 56c4c88cf..23cf085a5 100644
tests: file-tests t-exec interop-tests extra-tests unit
echo all tests passed
diff --git a/configure.ac b/configure.ac
-index 918ccd5df..8e679f770 100644
+index b2c959ff3..c37b02efb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2305,12 +2305,14 @@ AC_LINK_IFELSE(
@@ -186,7 +186,7 @@ index 918ccd5df..8e679f770 100644
# IRIX has a const char return value for gai_strerror()
AC_CHECK_FUNCS([gai_strerror], [
AC_DEFINE([HAVE_GAI_STRERROR])
-@@ -5982,6 +6018,7 @@ echo " BSD Auth support: $BSD_AUTH_MSG"
+@@ -5921,6 +5957,7 @@ echo " BSD Auth support: $BSD_AUTH_MSG"
echo " Random number source: $RAND_MSG"
echo " Privsep sandbox style: $SANDBOX_STYLE"
echo " PKCS#11 support: $enable_pkcs11"
@@ -195,7 +195,7 @@ index 918ccd5df..8e679f770 100644
echo ""
diff --git a/regress/Makefile b/regress/Makefile
-index a6f81bef4..98a653256 100644
+index fa19ada28..492112e80 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -118,6 +118,7 @@ LTESTS= connect \
@@ -1012,7 +1012,7 @@ index 000000000..89ba45c4e
+}
+
diff --git a/ssh-add.c b/ssh-add.c
-index 7ce451036..5eb564a7e 100644
+index 9231c5277..1b34baffa 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -70,6 +70,7 @@
@@ -1023,7 +1023,7 @@ index 7ce451036..5eb564a7e 100644
#define CERT_EXPIRY_GRACE (5*60)
-@@ -272,6 +273,38 @@ check_cert_lifetime(const struct sshkey *cert, int cert_lifetime)
+@@ -271,6 +272,38 @@ check_cert_lifetime(const struct sshkey *cert, int cert_lifetime)
return MINIMUM(cert_lifetime, (int)n);
}
@@ -1062,7 +1062,7 @@ index 7ce451036..5eb564a7e 100644
static int
add_file(int agent_fd, const char *filename, int key_only, int cert_only,
int qflag, int Nflag, const char *skprovider,
-@@ -462,15 +495,14 @@ static int
+@@ -461,15 +494,14 @@ static int
update_card(int agent_fd, int add, const char *id, int qflag,
int key_only, int cert_only,
struct dest_constraint **dest_constraints, size_t ndest_constraints,
@@ -1080,7 +1080,7 @@ index 7ce451036..5eb564a7e 100644
if ((pin = read_passphrase("Enter passphrase for PKCS#11: ",
RP_ALLOW_STDIN)) == NULL)
return -1;
-@@ -652,6 +684,14 @@ do_file(int agent_fd, int deleting, int key_only, int cert_only,
+@@ -651,6 +683,14 @@ do_file(int agent_fd, int deleting, int key_only, int cert_only,
char *file, int qflag, int Nflag, const char *skprovider,
struct dest_constraint **dest_constraints, size_t ndest_constraints)
{
@@ -1095,7 +1095,7 @@ index 7ce451036..5eb564a7e 100644
if (deleting) {
if (delete_file(agent_fd, file, key_only,
cert_only, qflag) == -1)
-@@ -1004,7 +1044,7 @@ main(int argc, char **argv)
+@@ -1003,7 +1043,7 @@ main(int argc, char **argv)
if (update_card(agent_fd, !deleting, pkcs11provider,
qflag, key_only, cert_only,
dest_constraints, ndest_constraints,
@@ -1105,7 +1105,7 @@ index 7ce451036..5eb564a7e 100644
for (n = 0; n < ncerts; n++)
sshkey_free(certs[n]);
diff --git a/ssh-agent.c b/ssh-agent.c
-index 17b2a96c0..1f1fc024d 100644
+index 4c8e1a4da..28f5c95f9 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1553,10 +1553,75 @@ add_p11_identity(struct sshkey *key, char *comment, const char *provider,
@@ -1299,10 +1299,10 @@ index 17b2a96c0..1f1fc024d 100644
}
#endif /* ENABLE_PKCS11 */
diff --git a/ssh-keygen.c b/ssh-keygen.c
-index eb880dbc0..25906f3c1 100644
+index ed1932ff0..342b0c57d 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
-@@ -835,8 +835,11 @@ do_download(struct passwd *pw)
+@@ -820,8 +820,11 @@ do_download(struct passwd *pw)
free(fp);
} else {
(void) sshkey_write(keys[i], stdout); /* XXX check */
@@ -1875,7 +1875,7 @@ index 000000000..bc758e760
+char *pkcs11_uri_get(struct pkcs11_uri *uri);
+#endif /* _SSH_PKCS11_URI_H */
diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
-index 7a7d3b8ea..6f23fc38b 100644
+index bd45ef090..2d308ed60 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -36,6 +36,7 @@
@@ -2248,7 +2248,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if ((siglen = EVP_PKEY_size(key->pkey)) <= 0)
return SSH_ERR_INVALID_ARGUMENT;
-@@ -658,8 +797,8 @@ pkcs11_sign_ecdsa(struct sshkey *key,
+@@ -657,8 +796,8 @@ pkcs11_sign_ecdsa(struct sshkey *key,
debug3_f("sign using provider %s slotidx %lu",
k11->provider->name, (u_long)k11->slotidx);
@@ -2259,7 +2259,7 @@ index 7a7d3b8ea..6f23fc38b 100644
/* Prepare digest to be signed */
if ((hashalg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
-@@ -743,8 +882,8 @@ pkcs11_sign_ed25519(struct sshkey *key,
+@@ -741,8 +880,8 @@ pkcs11_sign_ed25519(struct sshkey *key,
debug3_f("sign using provider %s slotidx %lu",
k11->provider->name, (u_long)k11->slotidx);
@@ -2270,7 +2270,7 @@ index 7a7d3b8ea..6f23fc38b 100644
xdata = xmalloc(datalen);
memcpy(xdata, data, datalen);
-@@ -772,7 +911,8 @@ pkcs11_sign_ed25519(struct sshkey *key,
+@@ -770,7 +909,8 @@ pkcs11_sign_ed25519(struct sshkey *key,
return ret;
}
@@ -2280,7 +2280,7 @@ index 7a7d3b8ea..6f23fc38b 100644
static char *
rmspace(u_char *buf, size_t len)
{
-@@ -804,8 +944,8 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
+@@ -802,8 +942,8 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
CK_SESSION_HANDLE session;
int login_required, ret;
@@ -2291,7 +2291,7 @@ index 7a7d3b8ea..6f23fc38b 100644
login_required = si->token.flags & CKF_LOGIN_REQUIRED;
-@@ -815,9 +955,9 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
+@@ -813,9 +953,9 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
error("pin required");
return (-SSH_PKCS11_ERR_PIN_REQUIRED);
}
@@ -2303,7 +2303,7 @@ index 7a7d3b8ea..6f23fc38b 100644
return (-1);
}
if (login_required && pin != NULL && strlen(pin) != 0) {
-@@ -854,7 +994,8 @@ static struct sshkey *
+@@ -851,7 +991,8 @@ static struct sshkey *
pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
CK_OBJECT_HANDLE *obj)
{
@@ -2313,7 +2313,7 @@ index 7a7d3b8ea..6f23fc38b 100644
CK_SESSION_HANDLE session;
CK_FUNCTION_LIST *f = NULL;
CK_RV rv;
-@@ -867,14 +1008,15 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -864,14 +1005,15 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
memset(&key_attr, 0, sizeof(key_attr));
key_attr[0].type = CKA_ID;
@@ -2334,7 +2334,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
return (NULL);
-@@ -885,19 +1027,19 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -882,19 +1024,19 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
* ensure that none of the others are zero length.
* XXX assumes CKA_ID is always first.
*/
@@ -2358,7 +2358,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
goto fail;
-@@ -909,8 +1051,8 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -906,8 +1048,8 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
goto fail;
}
@@ -2369,7 +2369,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (group == NULL) {
ossl_error("d2i_ECPKParameters failed");
goto fail;
-@@ -921,13 +1063,13 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -918,13 +1060,13 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
goto fail;
}
@@ -2386,7 +2386,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (octet == NULL) {
ossl_error("d2i_ASN1_OCTET_STRING failed");
goto fail;
-@@ -989,7 +1131,8 @@ static struct sshkey *
+@@ -985,7 +1127,8 @@ static struct sshkey *
pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
CK_OBJECT_HANDLE *obj)
{
@@ -2396,7 +2396,7 @@ index 7a7d3b8ea..6f23fc38b 100644
CK_SESSION_HANDLE session;
CK_FUNCTION_LIST *f = NULL;
CK_RV rv;
-@@ -1000,14 +1143,15 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -996,14 +1139,15 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
memset(&key_attr, 0, sizeof(key_attr));
key_attr[0].type = CKA_ID;
@@ -2417,7 +2417,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
return (NULL);
-@@ -1018,19 +1162,19 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1014,19 +1158,19 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
* ensure that none of the others are zero length.
* XXX assumes CKA_ID is always first.
*/
@@ -2441,7 +2441,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
goto fail;
-@@ -1042,8 +1186,8 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1038,8 +1182,8 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
goto fail;
}
@@ -2452,7 +2452,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rsa_n == NULL || rsa_e == NULL) {
error("BN_bin2bn failed");
goto fail;
-@@ -1075,7 +1219,7 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1071,7 +1215,7 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
/* success */
success = 0;
fail:
@@ -2461,7 +2461,7 @@ index 7a7d3b8ea..6f23fc38b 100644
free(key_attr[i].pValue);
RSA_free(rsa);
if (success != 0) {
-@@ -1090,7 +1234,8 @@ static struct sshkey *
+@@ -1086,7 +1230,8 @@ static struct sshkey *
pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
CK_OBJECT_HANDLE *obj)
{
@@ -2471,7 +2471,7 @@ index 7a7d3b8ea..6f23fc38b 100644
CK_SESSION_HANDLE session;
CK_FUNCTION_LIST *f = NULL;
CK_RV rv;
-@@ -1110,14 +1255,15 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1106,14 +1251,15 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
memset(&key_attr, 0, sizeof(key_attr));
key_attr[0].type = CKA_ID;
@@ -2492,7 +2492,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
return (NULL);
-@@ -1128,28 +1274,28 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1124,28 +1270,28 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
* ensure that none of the others are zero length.
* XXX assumes CKA_ID is always first.
*/
@@ -2527,7 +2527,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if ((len != sizeof(id1) || memcmp(d, id1, sizeof(id1)) != 0) &&
(len != sizeof(id2) || memcmp(d, id2, sizeof(id2)) != 0)) {
hex = tohex(d, len);
-@@ -1161,16 +1307,16 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1157,16 +1303,16 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
* Expect either a raw 32 byte pubkey or an OCTET STRING with
* a 32 byte pubkey in CKA_VALUE
*/
@@ -2548,7 +2548,7 @@ index 7a7d3b8ea..6f23fc38b 100644
goto fail;
}
-@@ -1190,7 +1336,7 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1186,7 +1332,7 @@ pkcs11_fetch_ed25519_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
key = NULL;
}
free(hex);
@@ -2557,7 +2557,7 @@ index 7a7d3b8ea..6f23fc38b 100644
free(key_attr[i].pValue);
return key;
}
-@@ -1200,7 +1346,8 @@ static int
+@@ -1196,7 +1342,8 @@ static int
pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
CK_OBJECT_HANDLE *obj, struct sshkey **keyp, char **labelp)
{
@@ -2567,7 +2567,7 @@ index 7a7d3b8ea..6f23fc38b 100644
CK_SESSION_HANDLE session;
CK_FUNCTION_LIST *f = NULL;
CK_RV rv;
-@@ -1226,14 +1373,15 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1218,14 +1365,15 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
memset(&cert_attr, 0, sizeof(cert_attr));
cert_attr[0].type = CKA_ID;
@@ -2588,7 +2588,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
return -1;
-@@ -1245,18 +1393,19 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1237,18 +1385,19 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
* XXX assumes CKA_ID is always first.
*/
if (cert_attr[1].ulValueLen == 0 ||
@@ -2611,7 +2611,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_GetAttributeValue failed: %lu", rv);
goto out;
-@@ -1270,8 +1419,8 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1262,8 +1411,8 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
subject = xstrdup("invalid subject");
X509_NAME_free(x509_name);
@@ -2622,7 +2622,7 @@ index 7a7d3b8ea..6f23fc38b 100644
error("d2i_x509 failed");
goto out;
}
-@@ -1381,7 +1530,7 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1371,7 +1520,7 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
goto out;
}
out:
@@ -2631,7 +2631,7 @@ index 7a7d3b8ea..6f23fc38b 100644
free(cert_attr[i].pValue);
X509_free(x509);
RSA_free(rsa);
-@@ -1424,11 +1573,12 @@ note_key(struct pkcs11_provider *p, CK_ULONG slotidx, const char *context,
+@@ -1412,11 +1561,12 @@ note_key(struct pkcs11_provider *p, CK_ULONG slotidx, const char *context,
*/
static int
pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
@@ -2646,7 +2646,7 @@ index 7a7d3b8ea..6f23fc38b 100644
CK_SESSION_HANDLE session;
CK_FUNCTION_LIST *f = NULL;
CK_RV rv;
-@@ -1445,10 +1595,23 @@ pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1433,10 +1583,23 @@ pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
key_attr[0].pValue = &key_class;
key_attr[0].ulValueLen = sizeof(key_class);
@@ -2673,7 +2673,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_FindObjectsInit failed: %lu", rv);
goto fail;
-@@ -1521,6 +1684,13 @@ fail:
+@@ -1509,6 +1672,13 @@ fail:
return (ret);
}
@@ -2687,7 +2687,7 @@ index 7a7d3b8ea..6f23fc38b 100644
#endif /* WITH_OPENSSL */
/*
-@@ -1530,11 +1700,12 @@ fail:
+@@ -1518,11 +1688,12 @@ fail:
*/
static int
pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
@@ -2702,7 +2702,7 @@ index 7a7d3b8ea..6f23fc38b 100644
CK_SESSION_HANDLE session;
CK_FUNCTION_LIST *f = NULL;
CK_RV rv;
-@@ -1550,10 +1721,23 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1538,10 +1709,23 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
key_attr[0].pValue = &key_class;
key_attr[0].ulValueLen = sizeof(key_class);
@@ -2729,7 +2729,7 @@ index 7a7d3b8ea..6f23fc38b 100644
if (rv != CKR_OK) {
error("C_FindObjectsInit failed: %lu", rv);
goto fail;
-@@ -1841,16 +2025,10 @@ pkcs11_ecdsa_generate_private_key(struct pkcs11_provider *p, CK_ULONG slotidx,
+@@ -1827,16 +2011,10 @@ pkcs11_ecdsa_generate_private_key(struct pkcs11_provider *p, CK_ULONG slotidx,
}
#endif /* WITH_PKCS11_KEYGEN */
@@ -2748,7 +2748,7 @@ index 7a7d3b8ea..6f23fc38b 100644
int ret = -1;
struct pkcs11_provider *p = NULL;
void *handle = NULL;
-@@ -1859,128 +2037,126 @@ pkcs11_register_provider(char *provider_id, char *pin,
+@@ -1845,128 +2023,126 @@ pkcs11_register_provider(char *provider_id, char *pin,
CK_FUNCTION_LIST *f = NULL;
CK_TOKEN_INFO *token;
CK_ULONG i;
@@ -2954,7 +2954,7 @@ index 7a7d3b8ea..6f23fc38b 100644
/* now owned by caller */
*providerp = p;
-@@ -1988,21 +2164,22 @@ pkcs11_register_provider(char *provider_id, char *pin,
+@@ -1974,21 +2150,22 @@ pkcs11_register_provider(char *provider_id, char *pin,
TAILQ_INSERT_TAIL(&pkcs11_providers, p, next);
p->refcount++; /* add to provider list */
@@ -2983,7 +2983,7 @@ index 7a7d3b8ea..6f23fc38b 100644
return (ret);
}
-@@ -2038,18 +2215,163 @@ pkcs11_terminate(void)
+@@ -2024,18 +2201,163 @@ pkcs11_terminate(void)
}
/*
@@ -3153,7 +3153,7 @@ index 7a7d3b8ea..6f23fc38b 100644
/* no keys found or some other error, de-register provider */
if (nkeys <= 0 && p != NULL) {
-@@ -2058,11 +2380,38 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp,
+@@ -2044,11 +2366,38 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp,
pkcs11_provider_unref(p);
}
if (nkeys == 0)
@@ -3215,10 +3215,10 @@ index 1d0277a6d..13459644c 100644
const u_char *, size_t, const char *, const char *,
const char *, u_int);
diff --git a/ssh.c b/ssh.c
-index c319d08af..c79d69ef0 100644
+index 0182cc567..c8f3545af 100644
--- a/ssh.c
+++ b/ssh.c
-@@ -844,6 +844,14 @@ main(int ac, char **av)
+@@ -848,6 +848,14 @@ main(int ac, char **av)
options.gss_deleg_creds = 1;
break;
case 'i':
@@ -3233,7 +3233,7 @@ index c319d08af..c79d69ef0 100644
p = tilde_expand_filename(optarg, getuid());
if (stat(p, &st) == -1)
fprintf(stderr, "Warning: Identity file %s "
-@@ -1823,6 +1831,7 @@ main(int ac, char **av)
+@@ -1832,6 +1840,7 @@ main(int ac, char **av)
#ifdef ENABLE_PKCS11
(void)pkcs11_del_provider(options.pkcs11_provider);
@@ -3241,7 +3241,7 @@ index c319d08af..c79d69ef0 100644
#endif
skip_connect:
-@@ -2334,6 +2343,45 @@ ssh_session2(struct ssh *ssh, const struct ssh_conn_info *cinfo)
+@@ -2356,6 +2365,45 @@ ssh_session2(struct ssh *ssh, const struct ssh_conn_info *cinfo)
options.escape_char : SSH_ESCAPECHAR_NONE, id);
}
@@ -3287,7 +3287,7 @@ index c319d08af..c79d69ef0 100644
/* Loads all IdentityFile and CertificateFile keys */
static void
load_public_identity_files(const struct ssh_conn_info *cinfo)
-@@ -2348,11 +2396,6 @@ load_public_identity_files(const struct ssh_conn_info *cinfo)
+@@ -2370,11 +2418,6 @@ load_public_identity_files(const struct ssh_conn_info *cinfo)
char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
int certificate_file_userprovided[SSH_MAX_CERTIFICATE_FILES];
@@ -3299,7 +3299,7 @@ index c319d08af..c79d69ef0 100644
n_ids = n_certs = 0;
memset(identity_files, 0, sizeof(identity_files));
-@@ -2365,33 +2408,46 @@ load_public_identity_files(const struct ssh_conn_info *cinfo)
+@@ -2387,33 +2430,46 @@ load_public_identity_files(const struct ssh_conn_info *cinfo)
sizeof(certificate_file_userprovided));
#ifdef ENABLE_PKCS11
@@ -3366,10 +3366,10 @@ index c319d08af..c79d69ef0 100644
free(cp);
check_load(sshkey_load_public(filename, &public, NULL),
diff --git a/ssh_config.5 b/ssh_config.5
-index 67d52d874..12cd3f7e1 100644
+index f2ff8585c..f16eb61ea 100644
--- a/ssh_config.5
+++ b/ssh_config.5
-@@ -1301,6 +1301,21 @@ may also be used in conjunction with
+@@ -1304,6 +1304,21 @@ may also be used in conjunction with
.Cm CertificateFile
in order to provide any certificate also needed for authentication with
the identity.
@@ -3392,10 +3392,10 @@ index 67d52d874..12cd3f7e1 100644
Specifies a pattern-list of unknown options to be ignored if they are
encountered in configuration parsing.
diff --git a/sshkey.c b/sshkey.c
-index e3fb29e70..82ef1c8da 100644
+index 2380c8081..084ff3b55 100644
--- a/sshkey.c
+++ b/sshkey.c
-@@ -868,8 +868,10 @@ sshkey_free_contents(struct sshkey *k)
+@@ -852,8 +852,10 @@ sshkey_free_contents(struct sshkey *k)
if (k == NULL)
return;
@@ -3406,7 +3406,7 @@ index e3fb29e70..82ef1c8da 100644
if ((impl = sshkey_impl_from_type(k->type)) != NULL &&
impl->funcs->cleanup != NULL)
impl->funcs->cleanup(k);
-@@ -2316,9 +2318,11 @@ sshkey_sign(struct sshkey *key,
+@@ -2300,9 +2302,11 @@ sshkey_sign(struct sshkey *key,
if (sshkey_is_sk(key)) {
r = sshsk_sign(sk_provider, key, sigp, lenp, data,
datalen, compat, sk_pin);
diff --git a/0053-gssapi-tests.patch b/0053-gssapi-tests.patch
index da21bbe..26fa784 100644
--- a/0053-gssapi-tests.patch
+++ b/0053-gssapi-tests.patch
@@ -1,7 +1,7 @@
-From ca19ae776b8ce786809f5778a7f08342ff87746d Mon Sep 17 00:00:00 2001
+From 90f47f37aa1b16d2039f3ed1a37ab418be09a2e1 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 53/54] gssapi-tests
+Subject: [PATCH 53/53] gssapi-tests
---
regress/Makefile | 1 +
@@ -10,7 +10,7 @@ Subject: [PATCH 53/54] gssapi-tests
create mode 100644 regress/gss-kex.sh
diff --git a/regress/Makefile b/regress/Makefile
-index 98a653256..6d050a4de 100644
+index 492112e80..2011f87a7 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -127,6 +127,7 @@ INTEROP_TESTS+= dropbear-ciphers dropbear-kex dropbear-server
diff --git a/1000-openssh-6.7p1-coverity.patch b/1000-openssh-6.7p1-coverity.patch
deleted file mode 100644
index 400c337..0000000
--- a/1000-openssh-6.7p1-coverity.patch
+++ /dev/null
@@ -1,192 +0,0 @@
-From 8a56ff00539091507c57a3218641c6d96fcb89d6 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Fri, 7 Aug 2026 17:25:07 +0200
-Subject: [PATCH 54/54] openssh-6.7p1-coverity
-
----
- krl.c | 3 +++
- loginrec.c | 2 ++
- misc.c | 3 +++
- monitor.c | 4 ++--
- openbsd-compat/bindresvport.c | 2 +-
- openbsd-compat/bsd-pselect.c | 8 ++++----
- readconf.c | 1 +
- servconf.c | 5 +++--
- serverloop.c | 2 +-
- 9 files changed, 20 insertions(+), 10 deletions(-)
-
-diff --git a/krl.c b/krl.c
-index 0e2b5f155..f2d105f23 100644
---- a/krl.c
-+++ b/krl.c
-@@ -1202,6 +1202,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
- return r;
- erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
- free(rb.blob);
-+ rb.blob = NULL; /* make coverity happy */
- if (erb != NULL) {
- KRL_DBG(("revoked by key SHA1"));
- return SSH_ERR_KEY_REVOKED;
-@@ -1212,6 +1213,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
- return r;
- erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
- free(rb.blob);
-+ rb.blob = NULL; /* make coverity happy */
- if (erb != NULL) {
- KRL_DBG(("revoked by key SHA256"));
- return SSH_ERR_KEY_REVOKED;
-@@ -1223,6 +1225,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
- return r;
- erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
- free(rb.blob);
-+ rb.blob = NULL; /* make coverity happy */
- if (erb != NULL) {
- KRL_DBG(("revoked by explicit key"));
- return SSH_ERR_KEY_REVOKED;
-diff --git a/loginrec.c b/loginrec.c
-index 7499aa975..2807cad4a 100644
---- a/loginrec.c
-+++ b/loginrec.c
-@@ -680,9 +680,11 @@ construct_utmp(struct logininfo *li,
- */
-
- /* Use strncpy because we don't necessarily want null termination */
-+ /* coverity[buffer_size_warning : FALSE] */
- strncpy(ut->ut_name, li->username,
- MIN_SIZEOF(ut->ut_name, li->username));
- # ifdef HAVE_HOST_IN_UTMP
-+ /* coverity[buffer_size_warning : FALSE] */
- strncpy(ut->ut_host, li->hostname,
- MIN_SIZEOF(ut->ut_host, li->hostname));
- # endif
-diff --git a/misc.c b/misc.c
-index c0e16437a..f5275d108 100644
---- a/misc.c
-+++ b/misc.c
-@@ -1620,6 +1620,8 @@ sanitise_stdfd(void)
- }
- if (nullfd > STDERR_FILENO)
- close(nullfd);
-+ /* coverity[leaked_handle : FALSE]*/
-+ /* coverity[leaked_handle : FALSE]*/
- }
-
- char *
-@@ -2823,6 +2825,7 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
- }
- if (devnull > STDERR_FILENO)
- close(devnull);
-+ /* coverity[leaked_handle : FALSE]*/
- return ret;
- }
-
-diff --git a/monitor.c b/monitor.c
-index 63180e2a9..be55a32f3 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -410,7 +410,7 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
- mm_get_keystate(ssh, pmonitor);
-
- /* Drain any buffered messages from the child */
-- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
- ;
-
- /* Wait for the child's exit status */
-@@ -1829,7 +1829,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
- s->ptymaster = s->ptyfd;
-
- debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
--
-+ /* coverity[leaked_handle : FALSE] */
- return (0);
-
- error:
-diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c
-index 346c7fe56..f42792fde 100644
---- a/openbsd-compat/bindresvport.c
-+++ b/openbsd-compat/bindresvport.c
-@@ -59,7 +59,7 @@ bindresvport_sa(int sd, struct sockaddr *sa)
- struct sockaddr_in6 *in6;
- u_int16_t *portp;
- u_int16_t port;
-- socklen_t salen;
-+ socklen_t salen = sizeof(struct sockaddr_storage);
- int i;
-
- if (sa == NULL) {
-diff --git a/openbsd-compat/bsd-pselect.c b/openbsd-compat/bsd-pselect.c
-index 26bdc3e08..8e2939b95 100644
---- a/openbsd-compat/bsd-pselect.c
-+++ b/openbsd-compat/bsd-pselect.c
-@@ -85,13 +85,13 @@ pselect_notify_setup(void)
- static void
- pselect_notify_parent(void)
- {
-- if (notify_pipe[1] != -1)
-+ if (notify_pipe[1] >= 0)
- (void)write(notify_pipe[1], "", 1);
- }
- static void
- pselect_notify_prepare(fd_set *readset)
- {
-- if (notify_pipe[0] != -1)
-+ if (notify_pipe[0] >= 0)
- FD_SET(notify_pipe[0], readset);
- }
- static void
-@@ -99,8 +99,8 @@ pselect_notify_done(fd_set *readset)
- {
- char c;
-
-- if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
-- while (read(notify_pipe[0], &c, 1) != -1)
-+ if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
-+ while (read(notify_pipe[0], &c, 1) >= 0)
- debug2_f("reading");
- FD_CLR(notify_pipe[0], readset);
- }
-diff --git a/readconf.c b/readconf.c
-index e971ca5c4..4baeb108d 100644
---- a/readconf.c
-+++ b/readconf.c
-@@ -2164,6 +2164,7 @@ parse_pubkey_algos:
- } else if (r != 0) {
- error("%.200s line %d: glob failed for %s.",
- filename, linenum, arg2);
-+ free(arg2);
- goto out;
- }
- free(arg2);
-diff --git a/servconf.c b/servconf.c
-index ab7327a2a..8480e9321 100644
---- a/servconf.c
-+++ b/servconf.c
-@@ -2121,8 +2121,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- if (*activep && *charptr == NULL) {
- *charptr = tilde_expand_filename(arg, getuid());
- /* increase optional counter */
-- if (intptr != NULL)
-- *intptr = *intptr + 1;
-+ /* DEAD CODE intptr is still NULL ;)
-+ if (intptr != NULL)
-+ *intptr = *intptr + 1; */
- }
- break;
-
-diff --git a/serverloop.c b/serverloop.c
-index e50985e90..de2dfeef9 100644
---- a/serverloop.c
-+++ b/serverloop.c
-@@ -536,7 +536,7 @@ server_request_tun(struct ssh *ssh)
- debug_f("invalid tun");
- goto done;
- }
-- if (auth_opts->force_tun_device != -1) {
-+ if (auth_opts->force_tun_device >= 0) {
- if (tun != SSH_TUNID_ANY &&
- auth_opts->force_tun_device != (int)tun)
- goto done;
---
-2.55.0
-
diff --git a/openssh.spec b/openssh.spec
index dfe7ed5..2ae9124 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -34,12 +34,12 @@
# rpm -ba|--rebuild --define 'no_gtk3 1'
%{?no_gtk3:%global gtk3 0}
-%global openssh_ver 10.4p1
+%global openssh_ver 10.5p1
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
-Release: 4%{?dist}
+Release: 1%{?dist}
URL: http://www.openssh.com/portable.html
Source0: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -61,60 +61,59 @@ Source21: ssh-host-keys-migration.service
Source22: parallel_test.sh
Source23: parallel_test.Makefile
-Patch0001: 0001-upstream-fix-GSSAPI-option-names-that-I-somehow-scre.patch
+Patch0001: 0001-openssh-6.7p1-coverity.patch
Patch0002: 0002-Add-SELinux-role-and-MLS-Multi-Level-Security-suppor.patch
Patch0003: 0003-Implement-SELinux-environment-variable-setup-for-sub.patch
Patch0004: 0004-Pass-inetd-flags-and-auth-context-to-subprocess-call.patch
Patch0005: 0005-openssh-6.6p1-keycat.patch
Patch0006: 0006-openssh-6.6p1-allow-ip-opts.patch
Patch0007: 0007-openssh-5.9p1-ipv6man.patch
-Patch0009: 0008-openssh-5.8p2-sigpipe.patch
-Patch0010: 0009-openssh-5.1p1-askpass-progress.patch
-Patch0011: 0010-openssh-4.3p2-askpass-grab-info.patch
-Patch0012: 0011-openssh-8.7p1-redhat.patch
-Patch0013: 0012-openssh-7.8p1-UsePAM-warning.patch
-Patch0014: 0013-openssh-9.6p1-gssapi-keyex.patch
-Patch0015: 0014-openssh-6.6p1-force_krb.patch
-Patch0016: 0015-openssh-7.7p1-gssapi-new-unique.patch
-Patch0017: 0016-openssh-7.2p2-k5login_directory.patch
-Patch0018: 0017-openssh-6.6p1-kuserok.patch
-Patch0019: 0018-openssh-6.4p1-fromto-remote.patch
-Patch0020: 0019-openssh-6.6.1p1-log-in-chroot.patch
-Patch0021: 0020-openssh-6.6.1p1-scp-non-existing-directory.patch
-Patch0022: 0021-openssh-6.6p1-GSSAPIEnablek5users.patch
-Patch0023: 0022-openssh-6.8p1-sshdT-output.patch
-Patch0024: 0023-openssh-6.7p1-sftp-force-permission.patch
-Patch0025: 0024-openssh-7.2p2-s390-closefrom.patch
-Patch0026: 0025-openssh-7.5p1-sandbox.patch
-Patch0027: 0026-openssh-7.8p1-scp-ipv6.patch
-Patch0028: 0027-openssh-8.0p1-crypto-policies.patch
-Patch0029: 0028-openssh-8.0p1-openssl-kdf.patch
-Patch0030: 0029-openssh-8.2p1-visibility.patch
-Patch0031: 0030-openssh-8.2p1-x11-without-ipv6.patch
-Patch0032: 0031-openssh-8.0p1-preserve-pam-errors.patch
-Patch0033: 0032-openssh-8.7p1-scp-kill-switch.patch
-Patch0034: 0033-openssh-8.7p1-recursive-scp.patch
-Patch0035: 0034-openssh-8.7p1-ibmca.patch
-Patch0036: 0035-openssh-7.6p1-audit.patch
-Patch0037: 0036-openssh-7.1p2-audit-race-condition.patch
-Patch0038: 0037-openssh-9.0p1-audit-log.patch
-Patch0039: 0038-openssh-7.7p1-fips.patch
-Patch0040: 0039-openssh-8.7p1-negotiate-supported-algs.patch
-Patch0041: 0040-openssh-9.0p1-evp-fips-kex.patch
-Patch0042: 0041-openssh-8.7p1-nohostsha1proof.patch
-Patch0043: 0042-openssh-9.9p1-separate-keysign.patch
-Patch0044: 0043-openssh-9.9p1-openssl-mlkem.patch
-Patch0045: 0044-openssh-9.9p2-error_processing.patch
-Patch0046: 0045-Ignore-bad-hostkeys-in-known_hosts-file.patch
-Patch0047: 0046-support-authentication-indicators-in-GSSAPI.patch
-Patch0048: 0047-NIST-curves-hybrid-KEX-implementation.patch
-Patch0049: 0048-openssh-7.3p1-x11-max-displays.patch
-Patch0050: 0049-Fix-ssh-pkcs11-client-helper-termination.patch
-Patch0051: 0050-openssh-10.2p1-pam-auth.patch
-Patch0052: 0051-gssapi-s4u.patch
-Patch0053: 0052-openssh-10.2p1-pkcs11-uri.patch
-Patch0054: 0053-gssapi-tests.patch
-Patch1000: 1000-openssh-6.7p1-coverity.patch
+Patch0008: 0008-openssh-5.8p2-sigpipe.patch
+Patch0009: 0009-openssh-5.1p1-askpass-progress.patch
+Patch0010: 0010-openssh-4.3p2-askpass-grab-info.patch
+Patch0011: 0011-openssh-8.7p1-redhat.patch
+Patch0012: 0012-openssh-7.8p1-UsePAM-warning.patch
+Patch0013: 0013-openssh-9.6p1-gssapi-keyex.patch
+Patch0014: 0014-openssh-6.6p1-force_krb.patch
+Patch0015: 0015-openssh-7.7p1-gssapi-new-unique.patch
+Patch0016: 0016-openssh-7.2p2-k5login_directory.patch
+Patch0017: 0017-openssh-6.6p1-kuserok.patch
+Patch0018: 0018-openssh-6.4p1-fromto-remote.patch
+Patch0019: 0019-openssh-6.6.1p1-log-in-chroot.patch
+Patch0020: 0020-openssh-6.6.1p1-scp-non-existing-directory.patch
+Patch0021: 0021-openssh-6.6p1-GSSAPIEnablek5users.patch
+Patch0022: 0022-openssh-6.8p1-sshdT-output.patch
+Patch0023: 0023-openssh-6.7p1-sftp-force-permission.patch
+Patch0024: 0024-openssh-7.2p2-s390-closefrom.patch
+Patch0025: 0025-openssh-7.5p1-sandbox.patch
+Patch0026: 0026-openssh-7.8p1-scp-ipv6.patch
+Patch0027: 0027-openssh-8.0p1-crypto-policies.patch
+Patch0028: 0028-openssh-8.0p1-openssl-kdf.patch
+Patch0029: 0029-openssh-8.2p1-visibility.patch
+Patch0030: 0030-openssh-8.2p1-x11-without-ipv6.patch
+Patch0031: 0031-openssh-8.0p1-preserve-pam-errors.patch
+Patch0032: 0032-openssh-8.7p1-scp-kill-switch.patch
+Patch0033: 0033-openssh-8.7p1-recursive-scp.patch
+Patch0034: 0034-openssh-8.7p1-ibmca.patch
+Patch0035: 0035-openssh-7.6p1-audit.patch
+Patch0036: 0036-openssh-7.1p2-audit-race-condition.patch
+Patch0037: 0037-openssh-9.0p1-audit-log.patch
+Patch0038: 0038-openssh-7.7p1-fips.patch
+Patch0039: 0039-openssh-8.7p1-negotiate-supported-algs.patch
+Patch0040: 0040-openssh-9.0p1-evp-fips-kex.patch
+Patch0041: 0041-openssh-8.7p1-nohostsha1proof.patch
+Patch0042: 0042-openssh-9.9p1-separate-keysign.patch
+Patch0043: 0043-openssh-9.9p1-openssl-mlkem.patch
+Patch0044: 0044-openssh-9.9p2-error_processing.patch
+Patch0045: 0045-Ignore-bad-hostkeys-in-known_hosts-file.patch
+Patch0046: 0046-support-authentication-indicators-in-GSSAPI.patch
+Patch0047: 0047-NIST-curves-hybrid-KEX-implementation.patch
+Patch0048: 0048-openssh-7.3p1-x11-max-displays.patch
+Patch0049: 0049-Fix-ssh-pkcs11-client-helper-termination.patch
+Patch0050: 0050-openssh-10.2p1-pam-auth.patch
+Patch0051: 0051-gssapi-s4u.patch
+Patch0052: 0052-openssh-10.2p1-pkcs11-uri.patch
+Patch0053: 0053-gssapi-tests.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: openssl-libs >= 1:3.5.0
@@ -443,7 +442,7 @@ test -f %{sysconfig_anaconda} && \
%files
%license LICENCE
-%doc CREDITS ChangeLog OVERVIEW PROTOCOL* README README.platform README.privsep README.tun README.dns TODO
+%doc CREDITS ChangeLog OVERVIEW PROTOCOL* README.md README.platform README.privsep README.dns TODO
%attr(0755,root,root) %dir %{_sysconfdir}/ssh
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
%attr(0755,root,root) %{_bindir}/ssh-keygen
@@ -523,6 +522,9 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
+* Fri Aug 21 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.5p1-1
+- Rebasing OpenSSH to 10.5p1
+
* Mon Aug 10 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.4p1-4
- Partially reduce the dependency between patches, avoiding patches to patches.
diff --git a/sources b/sources
index 256fec5..dc67a06 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (openssh-10.4p1.tar.gz) = c49600022a3a3f0f0ba4284072cccbe1088030cd175ea166e08251224712731f97cb1a3f039d19f71714c537ab88b177602be0932bc35a26f3227dc09c43f37c
-SHA512 (openssh-10.4p1.tar.gz.asc) = 604b8203088d71bee3a93ea644201f82eb1f049b08cf0b57b9f5dbcb9a9bae206283a30af15182e42e59ea63b8e1c9941c8b981a1d026b6a0f49b11ccd7007c4
+SHA512 (openssh-10.5p1.tar.gz) = 5336c1945527b29ed59cc500fa8bfbd918f5ba97e85512daad9ab7241418929bf7152d300e5f3c5f9a8c8d699dfde5a64c5faa4fc33b2758ab52dd04040d6284
+SHA512 (openssh-10.5p1.tar.gz.asc) = b31e61d98420598e40c9f7515e833c140415dd1f59391a558e3f48c878d1fa1defc8ec316a17a9737302cded54a216a95425a785e661adc86d70dd2c95014fe7
SHA512 (gpgkey-736060BA.gpg) = df44f3fdbcd1d596705348c7f5aed3f738c5f626a55955e0642f7c6c082995cf36a1b1891bb41b8715cb2aff34fef1c877e0eff0d3507dd00a055ba695757a21
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-21 11:44 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-21 11:44 [rpms/openssh] rawhide: Rebase to OpenSSH 10.5p1 Dmitry Belyavskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox