public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/gsi-openssh] epel9: Based on openssh-9.9p1-15.el9
@ 2026-09-22 20:00 Mattias Ellert
0 siblings, 0 replies; only message in thread
From: Mattias Ellert @ 2026-09-22 20:00 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/gsi-openssh
Branch : epel9
Commit : 5e2f0d114e81101e91936e396740c02e143e7166
Author : Mattias Ellert <mattias.ellert@physics.uu.se>
Date : 2026-09-22T10:51:41+02:00
Stats : +717/-119 in 10 file(s)
URL : https://src.fedoraproject.org/rpms/gsi-openssh/c/5e2f0d114e81101e91936e396740c02e143e7166?branch=epel9
Log:
Based on openssh-9.9p1-15.el9
---
diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 132cbc3..04fbdd7 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -24,7 +24,7 @@
%global libedit 1
%global openssh_ver 9.9p1
-%global openssh_rel 3
+%global openssh_rel 4
Summary: An implementation of the SSH protocol with GSI authentication
Name: gsi-openssh
@@ -215,6 +215,26 @@ Patch1044: openssh-9.9p1-authorized-keys-principles-option.patch
# upstream 607bd871ec029e9aa22e632a22547250f3cae223
# upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
Patch1045: openssh-9.9p1-proxyjump-username-validity-checks.patch
+# upstream 36480181fa22f98e180b4f9e10203480c0346c78
+Patch1046: openssh-9.9p1-scp-remote-glob.patch
+# upstream e8bdfb151a356d0171fea4194dd205fbb252be23
+Patch1047: openssh-9.9p1-cve-2026-60002.patch
+# upstream eddd1d2daa64a6ab1a915ca88436fa41aede44d4
+# upstream bc328144f149af07139a0f2c1329018cd85b86b7
+Patch1048: openssh-9.9p1-maxstartups-mistracking.patch
+# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
+Patch1049: openssh-10.4p1-CVE-2026-59995.patch
+# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
+# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
+# combines CVE-2026-59999 and CVE-2026-73283
+# downstream specific fix, drop on rebase
+Patch1050: openssh-10.4p1-CVE-2026-59999.patch
+# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
+Patch1051: openssh-10.5p1-CVE-2026-73281.patch
+# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
+Patch1052: openssh-10.5p1-CVE-2026-73282.patch
+# upstream d43ba60c91cb323ca921049b7d43b1908c318454
+Patch1053: openssh-9.9p1-CVE-2026-60001.patch
# This is the patch that adds GSI support
# Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
@@ -396,6 +416,14 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P1043 -p1 -b .ecdsa-incomplete-application
%patch -P1044 -p1 -b .authorized-keys-principles-option
%patch -P1045 -p1 -b .proxyjump-username-validity-checks
+%patch -P1046 -p1 -b .scp-remote-glob
+%patch -P1047 -p1 -b .cve-2026-60002
+%patch -P1048 -p1 -b .maxstartups-mistracking
+%patch -P1049 -p1 -b .CVE-2026-59995
+%patch -P1050 -p1 -b .CVE-2026-59999
+%patch -P1051 -p1 -b .CVE-2026-73281
+%patch -P1052 -p1 -b .CVE-2026-73282
+%patch -P1053 -p1 -b .CVE-2026-60001
%patch -P100 -p1 -b .coverity
@@ -603,6 +631,9 @@ fi
%attr(0644,root,root) %{_sysusersdir}/%{name}-server.conf
%changelog
+* Tue Sep 22 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-4
+- Based on openssh-9.9p1-15.el9
+
* Thu Jul 09 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-3
- Based on openssh-9.9p1-9.el9
diff --git a/openssh-10.4p1-CVE-2026-59995.patch b/openssh-10.4p1-CVE-2026-59995.patch
new file mode 100644
index 0000000..0ba8388
--- /dev/null
+++ b/openssh-10.4p1-CVE-2026-59995.patch
@@ -0,0 +1,20 @@
+diff --git a/sftp.c b/sftp.c
+index 0ab9206c2..0b57e0833 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2289,13 +2289,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ return (-1);
+ }
+ } else {
+- /* XXX this is wrong wrt quoting */
+- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+- global_aflag ? " -a" : "", dir,
+- file2 == NULL ? "" : " ",
+- file2 == NULL ? "" : file2);
+- err = parse_dispatch_command(conn, cmd,
+- &remote_path, startdir, 1, 0);
++ err = process_get(conn, dir, file2, remote_path, 0, 0,
++ global_aflag, 0);
+ free(dir);
+ free(startdir);
+ free(remote_path);
diff --git a/openssh-10.4p1-CVE-2026-59999.patch b/openssh-10.4p1-CVE-2026-59999.patch
new file mode 100644
index 0000000..b1bf58c
--- /dev/null
+++ b/openssh-10.4p1-CVE-2026-59999.patch
@@ -0,0 +1,78 @@
+diff --git a/auth-options.c b/auth-options.c
+index e15f600ab..c5fc4e59c 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void)
+ ret->permit_x11_forwarding_flag = 1;
+ ret->permit_pty_flag = 1;
+ ret->permit_user_rc = 1;
++ ret->permit_tun_flag = 1;
+ return ret;
+ }
+
+@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
+ ret->permit_x11_forwarding_flag = 0;
+ ret->permit_pty_flag = 0;
+ ret->permit_user_rc = 0;
++ ret->permit_tun_flag = 0;
+ } else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
+ ret->cert_authority = r;
+ } else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
+@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
+ OPTFLAG_AND(permit_x11_forwarding_flag);
+ OPTFLAG_AND(permit_pty_flag);
+ OPTFLAG_AND(permit_user_rc);
++ OPTFLAG_AND(permit_tun_flag);
+ OPTFLAG_AND(no_require_user_presence);
+ /* Restrictive flags are logical-OR (i.e. must be set in either) */
+ OPTFLAG_OR(require_verify);
+@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig)
+ OPTSCALAR(permit_x11_forwarding_flag);
+ OPTSCALAR(permit_pty_flag);
+ OPTSCALAR(permit_user_rc);
++ OPTSCALAR(permit_tun_flag);
+ OPTSCALAR(restricted);
+ OPTSCALAR(cert_authority);
+ OPTSCALAR(force_tun_device);
+@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
+ (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
++ (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
+@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
+ OPT_FLAG(permit_x11_forwarding_flag);
+ OPT_FLAG(permit_pty_flag);
+ OPT_FLAG(permit_user_rc);
++ OPT_FLAG(permit_tun_flag);
+ OPT_FLAG(restricted);
+ OPT_FLAG(cert_authority);
+ OPT_FLAG(no_require_user_presence);
+diff --git a/auth-options.h b/auth-options.h
+index 6e29b727c..191b9b249 100644
+--- a/auth-options.h
++++ b/auth-options.h
+@@ -39,6 +39,7 @@ struct sshauthopt {
+ int permit_x11_forwarding_flag;
+ int permit_pty_flag;
+ int permit_user_rc;
++ int permit_tun_flag;
+
+ /* "restrict" keyword was invoked */
+ int restricted;
+diff --git a/serverloop.c b/serverloop.c
+index 8a6e3db80..cf5243f80 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
+ ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ return NULL;
+ }
+- if ((options.permit_tun & mode) == 0) {
++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
++ !auth_opts->permit_tun_flag) {
+ ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ "forwarding");
+ return NULL;
diff --git a/openssh-10.5p1-CVE-2026-73281.patch b/openssh-10.5p1-CVE-2026-73281.patch
new file mode 100644
index 0000000..b59ec35
--- /dev/null
+++ b/openssh-10.5p1-CVE-2026-73281.patch
@@ -0,0 +1,42 @@
+diff --git a/ssh-agent.c b/ssh-agent.c
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e)
+ error_fr(r, "parse");
+ goto send;
+ }
++
++ /*
++ * This function can be called while the agent is locked to allow
++ * session binds to be processed for new channels.
++ * Other operations should be refused when locked.
++ */
++
+ if (strcmp(name, "session-bind@openssh.com") == 0)
+ success = process_ext_session_bind(e);
++ else if (locked)
++ debug_f("attempt to use extension \"%s\" while locked", name);
+ else
+ debug_f("unsupported extension \"%s\"", name);
+ free(name);
+@@ -1892,16 +1901,19 @@ process_message(u_int socknum)
+
+ /* check whether agent is locked */
+ if (locked && type != SSH_AGENTC_UNLOCK) {
+- sshbuf_reset(e->request);
+ switch (type) {
+ case SSH2_AGENTC_REQUEST_IDENTITIES:
+ /* send empty lists */
+ no_identities(e);
+ break;
++ case SSH_AGENTC_EXTENSION:
++ process_extension(e);
++ break;
+ default:
+ /* send a fail message for all other request types */
+ send_status(e, 0);
+ }
++ sshbuf_reset(e->request);
+ return 1;
+ }
+
diff --git a/openssh-10.5p1-CVE-2026-73282.patch b/openssh-10.5p1-CVE-2026-73282.patch
new file mode 100644
index 0000000..a4c4973
--- /dev/null
+++ b/openssh-10.5p1-CVE-2026-73282.patch
@@ -0,0 +1,51 @@
+diff --git a/ssh.c b/ssh.c
+--- a/ssh.c
++++ b/ssh.c
+@@ -1862,14 +1862,24 @@
+ }
+ }
+
++struct rfwd_confirm_ctx {
++ int fid;
++};
++
+ /* Callback for remote forward global requests */
+ static void
+ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
+ {
+- struct Forward *rfwd = (struct Forward *)ctxt;
++ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
++ struct Forward *rfwd;
+ u_int port;
+ int r;
+
++ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
++ fatal_f("invalid forwarding ID %d", rctx->fid);
++ rfwd = &options.remote_forwards[rctx->fid];
++ freezero(rctx, sizeof(*rctx));
++
+ /* XXX verbose() on failure? */
+ debug("remote forward %s for: listen %s%s%d, connect %s:%d",
+ type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
+@@ -2047,6 +2057,8 @@
+
+ /* Initiate remote TCP/IP port forwardings. */
+ for (i = 0; i < options.num_remote_forwards; i++) {
++ struct rfwd_confirm_ctx *rctx;
++
+ debug("Remote connections from %.200s:%d forwarded to "
+ "local address %.200s:%d",
+ (options.remote_forwards[i].listen_path != NULL) ?
+@@ -2061,9 +2073,10 @@
+ if ((options.remote_forwards[i].handle =
+ channel_request_remote_forwarding(ssh,
+ &options.remote_forwards[i])) >= 0) {
++ rctx = xcalloc(1, sizeof(*rctx));
++ rctx->fid = i;
+ client_register_global_confirm(
+- ssh_confirm_remote_forward,
+- &options.remote_forwards[i]);
++ ssh_confirm_remote_forward, rctx);
+ forward_confirms_pending++;
+ } else if (options.exit_on_forward_failure)
+ fatal("Could not request remote forwarding.");
diff --git a/openssh-9.9p1-CVE-2026-60001.patch b/openssh-9.9p1-CVE-2026-60001.patch
new file mode 100644
index 0000000..27eecc8
--- /dev/null
+++ b/openssh-9.9p1-CVE-2026-60001.patch
@@ -0,0 +1,97 @@
+diff --color -ruNp a/auth2.c b/auth2.c
+--- a/auth2.c 2026-09-17 15:21:59.317492134 +0200
++++ b/auth2.c 2026-09-17 15:29:58.698877649 +0200
+@@ -267,6 +267,12 @@ ensure_minimum_time_since(double start,
+ nanosleep(&ts, NULL);
+ }
+
++void
++auth_failure_delay(Authctxt *authctxt, double tstart)
++{
++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user));
++}
++
+ static int
+ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ {
+@@ -359,8 +365,8 @@ input_userauth_request(int type, u_int32
+ authenticated = m->userauth(ssh, method);
+ }
+ if (!authctxt->authenticated && strcmp(method, "none") != 0)
+- ensure_minimum_time_since(tstart,
+- user_specific_delay(authctxt->user));
++ auth_failure_delay(authctxt, tstart);
++
+ userauth_finish(ssh, authenticated, method, NULL);
+ r = 0;
+ out:
+diff --color -ruNp a/auth2-chall.c b/auth2-chall.c
+--- a/auth2-chall.c 2024-09-20 00:20:48.000000000 +0200
++++ b/auth2-chall.c 2026-09-17 15:24:34.321075436 +0200
+@@ -296,6 +296,7 @@ input_userauth_info_response(int type, u
+ u_int i, nresp;
+ const char *devicename = NULL;
+ char **response = NULL;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal_f("no authctxt");
+@@ -354,6 +355,9 @@ input_userauth_info_response(int type, u
+ auth2_challenge_start(ssh);
+ }
+ }
++
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+ userauth_finish(ssh, authenticated, "keyboard-interactive",
+ devicename);
+ return 0;
+diff --color -ruNp a/auth2-gss.c b/auth2-gss.c
+--- a/auth2-gss.c 2026-09-17 15:21:59.236281062 +0200
++++ b/auth2-gss.c 2026-09-17 15:27:33.902644227 +0200
+@@ -298,6 +298,7 @@ input_gssapi_exchange_complete(int type,
+ {
+ Authctxt *authctxt = ssh->authctxt;
+ int r, authenticated;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+@@ -311,6 +312,8 @@ input_gssapi_exchange_complete(int type,
+ fatal_fr(r, "parse packet");
+
+ authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 1);
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+@@ -332,6 +335,7 @@ input_gssapi_mic(int type, u_int32_t ple
+ gss_buffer_desc mic, gssbuf;
+ u_char *p;
+ size_t len;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+@@ -367,6 +371,9 @@ input_gssapi_mic(int type, u_int32_t ple
+ free(micuser);
+ free(mic.value);
+
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
++
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+diff --color -ruNp a/auth.h b/auth.h
+--- a/auth.h 2026-09-17 15:21:59.318365032 +0200
++++ b/auth.h 2026-09-17 15:23:03.388812848 +0200
+@@ -179,6 +179,7 @@ void auth_log(struct ssh *, int, int, co
+ void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn));
+ void userauth_finish(struct ssh *, int, const char *, const char *);
+ int auth_root_allowed(struct ssh *, const char *);
++void auth_failure_delay(Authctxt *, double);
+
+ char *auth2_read_banner(void);
+ int auth2_methods_valid(const char *, int);
diff --git a/openssh-9.9p1-cve-2026-60002.patch b/openssh-9.9p1-cve-2026-60002.patch
new file mode 100644
index 0000000..ab16479
--- /dev/null
+++ b/openssh-9.9p1-cve-2026-60002.patch
@@ -0,0 +1,191 @@
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c 2026-07-14 11:58:09.036496915 +0200
++++ b/ssh.c 2026-07-14 12:00:55.044542741 +0200
+@@ -619,26 +619,6 @@ set_addrinfo_port(struct addrinfo *addrs
+ }
+ }
+
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+- if (cinfo == NULL)
+- return;
+- free(cinfo->conn_hash_hex);
+- free(cinfo->shorthost);
+- free(cinfo->uidstr);
+- free(cinfo->keyalias);
+- free(cinfo->thishost);
+- free(cinfo->host_arg);
+- free(cinfo->portstr);
+- free(cinfo->remhost);
+- free(cinfo->remuser);
+- free(cinfo->homedir);
+- free(cinfo->locuser);
+- free(cinfo->jmphost);
+- free(cinfo);
+-}
+-
+ /*
+ * Main program for the ssh client.
+ */
+@@ -1765,8 +1745,8 @@ main(int ac, char **av)
+ ssh_signal(SIGCHLD, main_sigchld_handler);
+
+ /* Log into the remote system. Never returns if the login fails. */
+- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+- options.port, pw, timeout_ms, cinfo);
++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++ pw, timeout_ms, cinfo);
+
+ /* We no longer need the private host keys. Clear them now. */
+ if (sensitive_data.nkeys != 0) {
+diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
+--- a/sshconnect2.c 2026-07-14 11:58:09.031477028 +0200
++++ b/sshconnect2.c 2026-07-14 12:01:56.374803123 +0200
+@@ -89,7 +89,7 @@ extern Options options;
+ */
+
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+
+@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *
+ fatal("Server host key %s not in HostKeyAlgorithms",
+ sshkey_ssh_name(hostkey));
+ }
+- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ xxx_conn_info) != 0)
+ fatal("Host key verification failed.");
+ return 0;
+@@ -222,8 +222,8 @@ order_hostkeyalgs(char *host, struct soc
+ }
+
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+- const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++ u_short port, const struct ssh_conn_info *cinfo)
+ {
+ char *myproposal[PROPOSAL_MAX];
+ char *all_key, *hkalgs = NULL, *filtered_algs = NULL;
+@@ -234,9 +234,9 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ char *gss_host = NULL;
+ #endif
+
+- xxx_host = host;
+- xxx_hostaddr = hostaddr;
+- xxx_conn_info = cinfo;
++ xxx_host = xstrdup(host);
++ xxx_hostaddr = *hostaddr;
++ xxx_conn_info = ssh_conn_info_dup(cinfo);
+
+ if (options.rekey_limit || options.rekey_interval)
+ ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -259,8 +259,10 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ fatal_fr(r, "kex_assemble_namelist");
+ free(all_key);
+
+- if (use_known_hosts_order)
+- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++ if (use_known_hosts_order) {
++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++ port, cinfo);
++ }
+
+ filtered_algs = hkalgs ? match_filter_allowlist(hkalgs, options.pubkey_accepted_algos)
+ : match_filter_allowlist(options.hostkeyalgorithms,
+diff --color -ruNp a/sshconnect.c b/sshconnect.c
+--- a/sshconnect.c 2026-07-14 11:58:08.892659011 +0200
++++ b/sshconnect.c 2026-07-14 12:00:55.045767462 +0200
+@@ -84,6 +84,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++ if (cinfo == NULL)
++ return;
++ free(cinfo->conn_hash_hex);
++ free(cinfo->shorthost);
++ free(cinfo->uidstr);
++ free(cinfo->keyalias);
++ free(cinfo->thishost);
++ free(cinfo->host_arg);
++ free(cinfo->portstr);
++ free(cinfo->remhost);
++ free(cinfo->remuser);
++ free(cinfo->homedir);
++ free(cinfo->locuser);
++ free(cinfo->jmphost);
++ freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++ struct ssh_conn_info *ret;
++
++ if (cinfo == NULL)
++ return NULL;
++ ret = xcalloc(1, sizeof(*ret));
++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++ ret->shorthost = xstrdup(cinfo->shorthost);
++ ret->uidstr = xstrdup(cinfo->uidstr);
++ ret->keyalias = xstrdup(cinfo->keyalias);
++ ret->thishost = xstrdup(cinfo->thishost);
++ ret->host_arg = xstrdup(cinfo->host_arg);
++ ret->portstr = xstrdup(cinfo->portstr);
++ ret->remhost = xstrdup(cinfo->remhost);
++ ret->remuser = xstrdup(cinfo->remuser);
++ ret->homedir = xstrdup(cinfo->homedir);
++ ret->locuser = xstrdup(cinfo->locuser);
++ ret->jmphost = xstrdup(cinfo->jmphost);
++ return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1589,8 +1632,8 @@ out:
+ */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+- const struct ssh_conn_info *cinfo)
++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++ int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ char *host;
+ char *server_user, *local_user;
+diff --color -ruNp a/sshconnect.h b/sshconnect.h
+--- a/sshconnect.h 2024-09-20 00:20:48.000000000 +0200
++++ b/sshconnect.h 2026-07-14 12:00:55.045948953 +0200
+@@ -73,7 +73,7 @@ int ssh_connect(struct ssh *, const cha
+ void ssh_kill_proxy_command(void);
+
+ void ssh_login(struct ssh *, Sensitive *, const char *,
+- struct sockaddr *, u_short, struct passwd *, int,
++ struct sockaddr_storage *, u_short, struct passwd *, int,
+ const struct ssh_conn_info *);
+
+ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -82,7 +82,7 @@ int verify_host_key(char *, struct sock
+ void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+ char **, char **);
+
+-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+ const struct ssh_conn_info *);
+
+ void ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -98,3 +98,6 @@ void load_hostkeys_command(struct hostk
+ const struct sshkey *, const char *);
+
+ int hostkey_accepted_by_hostkeyalgs(const struct sshkey *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);
diff --git a/openssh-9.9p1-gsissh.patch b/openssh-9.9p1-gsissh.patch
index 77afa49..4cbca4a 100644
--- a/openssh-9.9p1-gsissh.patch
+++ b/openssh-9.9p1-gsissh.patch
@@ -1,7 +1,7 @@
diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
---- openssh-9.9p1.orig/auth2.c 2026-03-25 05:45:24.656587802 +0100
-+++ openssh-9.9p1/auth2.c 2026-03-25 05:46:32.221641522 +0100
-@@ -286,7 +286,28 @@
+--- openssh-9.9p1.orig/auth2.c 2026-09-22 10:35:00.467700577 +0200
++++ openssh-9.9p1/auth2.c 2026-09-22 10:36:32.381109475 +0200
+@@ -292,7 +292,28 @@
(r = sshpkt_get_cstring(ssh, &service, NULL)) != 0 ||
(r = sshpkt_get_cstring(ssh, &method, NULL)) != 0)
goto out;
@@ -31,7 +31,7 @@ diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
#ifdef WITH_SELINUX
-@@ -299,11 +320,33 @@
+@@ -305,11 +326,33 @@
if (authctxt->attempt >= 1024)
auth_maxtries_exceeded(ssh);
@@ -69,7 +69,7 @@ diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
authctxt->valid = 1;
debug2_f("setting up authctxt for %s", user);
} else {
-@@ -311,6 +354,9 @@
+@@ -317,6 +360,9 @@
/* Invalid user, fake password information */
authctxt->pw = fakepw();
}
@@ -79,7 +79,7 @@ diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
#ifdef USE_PAM
if (options.use_pam)
mm_start_pam(ssh);
-@@ -318,6 +364,7 @@
+@@ -324,6 +370,7 @@
ssh_packet_set_log_preamble(ssh, "%suser %s",
authctxt->valid ? "authenticating " : "invalid ", user);
setproctitle("%s [net]", authctxt->valid ? user : "unknown");
@@ -87,7 +87,7 @@ diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
authctxt->service = xstrdup(service);
authctxt->style = style ? xstrdup(style) : NULL;
#ifdef WITH_SELINUX
-@@ -333,9 +380,10 @@
+@@ -339,9 +386,10 @@
if (auth2_setup_methods_lists(authctxt) != 0)
ssh_packet_disconnect(ssh,
"no authentication methods enabled");
@@ -102,8 +102,8 @@ diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
authctxt->user, authctxt->service, user, service);
}
diff -Nur openssh-9.9p1.orig/auth2-gss.c openssh-9.9p1/auth2-gss.c
---- openssh-9.9p1.orig/auth2-gss.c 2026-03-25 05:45:24.555985592 +0100
-+++ openssh-9.9p1/auth2-gss.c 2026-03-25 05:46:32.222185307 +0100
+--- openssh-9.9p1.orig/auth2-gss.c 2026-09-22 10:35:00.468285489 +0200
++++ openssh-9.9p1/auth2-gss.c 2026-09-22 10:44:45.861318703 +0200
@@ -54,6 +54,7 @@
extern struct authmethod_cfg methodcfg_gsskeyex;
extern struct authmethod_cfg methodcfg_gssapi;
@@ -228,12 +228,13 @@ diff -Nur openssh-9.9p1.orig/auth2-gss.c openssh-9.9p1/auth2-gss.c
/*
* This is called when the client thinks we've completed authentication.
* It should only be enabled in the dispatch handler by the function above,
-@@ -297,11 +347,13 @@
+@@ -297,12 +347,14 @@
input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
{
Authctxt *authctxt = ssh->authctxt;
- int r, authenticated;
+ int r, authenticated = 0;
+ double tstart = monotime_double();
if (authctxt == NULL)
fatal("No authentication or GSSAPI context");
@@ -243,7 +244,7 @@ diff -Nur openssh-9.9p1.orig/auth2-gss.c openssh-9.9p1/auth2-gss.c
/*
* We don't need to check the status, because we're only enabled in
* the dispatcher once the exchange is complete
-@@ -310,7 +362,11 @@
+@@ -311,7 +363,11 @@
if ((r = sshpkt_get_end(ssh)) != 0)
fatal_fr(r, "parse packet");
@@ -253,10 +254,10 @@ diff -Nur openssh-9.9p1.orig/auth2-gss.c openssh-9.9p1/auth2-gss.c
+ authenticated = mm_ssh_gssapi_userok(authctxt->user,
+ authctxt->pw, 1);
+ }
+ if (!authenticated)
+ auth_failure_delay(authctxt, tstart);
- authctxt->postponed = 0;
- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
-@@ -357,10 +413,16 @@
+@@ -361,10 +417,16 @@
fatal_f("sshbuf_mutable_ptr failed");
gssbuf.length = sshbuf_len(b);
@@ -276,7 +277,7 @@ diff -Nur openssh-9.9p1.orig/auth2-gss.c openssh-9.9p1/auth2-gss.c
sshbuf_free(b);
if (micuser != authctxt->user)
-@@ -376,6 +438,26 @@
+@@ -383,6 +445,26 @@
return 0;
}
@@ -304,8 +305,8 @@ diff -Nur openssh-9.9p1.orig/auth2-gss.c openssh-9.9p1/auth2-gss.c
&methodcfg_gsskeyex,
userauth_gsskeyex,
diff -Nur openssh-9.9p1.orig/auth.c openssh-9.9p1/auth.c
---- openssh-9.9p1.orig/auth.c 2026-03-25 05:45:24.743724919 +0100
-+++ openssh-9.9p1/auth.c 2026-03-25 05:46:32.222572369 +0100
+--- openssh-9.9p1.orig/auth.c 2026-09-22 10:35:00.428649656 +0200
++++ openssh-9.9p1/auth.c 2026-09-22 10:36:32.382884997 +0200
@@ -298,7 +298,8 @@
method,
submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod,
@@ -337,8 +338,8 @@ diff -Nur openssh-9.9p1.orig/auth.c openssh-9.9p1/auth.c
record_failed_login(ssh, user,
auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
diff -Nur openssh-9.9p1.orig/auth.h openssh-9.9p1/auth.h
---- openssh-9.9p1.orig/auth.h 2026-03-25 05:45:24.657959558 +0100
-+++ openssh-9.9p1/auth.h 2026-03-25 05:46:32.223193330 +0100
+--- openssh-9.9p1.orig/auth.h 2026-09-22 10:35:00.468695838 +0200
++++ openssh-9.9p1/auth.h 2026-09-22 10:36:32.383979431 +0200
@@ -85,6 +85,8 @@
krb5_principal krb5_user;
char *krb5_ticket_file;
@@ -349,8 +350,8 @@ diff -Nur openssh-9.9p1.orig/auth.h openssh-9.9p1/auth.h
#endif
struct sshbuf *loginmsg;
diff -Nur openssh-9.9p1.orig/auth-pam.c openssh-9.9p1/auth-pam.c
---- openssh-9.9p1.orig/auth-pam.c 2026-03-25 05:45:24.701369542 +0100
-+++ openssh-9.9p1/auth-pam.c 2026-03-25 05:46:32.223546728 +0100
+--- openssh-9.9p1.orig/auth-pam.c 2026-09-22 10:35:00.385186770 +0200
++++ openssh-9.9p1/auth-pam.c 2026-09-22 10:36:32.384612963 +0200
@@ -248,6 +248,7 @@
static const char *sshpam_password = NULL;
static char *sshpam_rhost = NULL;
@@ -512,8 +513,8 @@ diff -Nur openssh-9.9p1.orig/auth-pam.c openssh-9.9p1/auth-pam.c
free(fake);
if (sshpam_err == PAM_MAXTRIES)
diff -Nur openssh-9.9p1.orig/auth-pam.h openssh-9.9p1/auth-pam.h
---- openssh-9.9p1.orig/auth-pam.h 2026-03-25 05:45:24.525064037 +0100
-+++ openssh-9.9p1/auth-pam.h 2026-03-25 05:46:32.224017669 +0100
+--- openssh-9.9p1.orig/auth-pam.h 2026-09-22 10:35:00.210537974 +0200
++++ openssh-9.9p1/auth-pam.h 2026-09-22 10:36:32.385566463 +0200
@@ -43,5 +43,6 @@
int sshpam_get_maxtries_reached(void);
void sshpam_set_maxtries_reached(int);
@@ -522,8 +523,8 @@ diff -Nur openssh-9.9p1.orig/auth-pam.h openssh-9.9p1/auth-pam.h
#endif /* USE_PAM */
diff -Nur openssh-9.9p1.orig/canohost.c openssh-9.9p1/canohost.c
---- openssh-9.9p1.orig/canohost.c 2026-03-25 05:45:24.556883754 +0100
-+++ openssh-9.9p1/canohost.c 2026-03-25 05:46:32.224305905 +0100
+--- openssh-9.9p1.orig/canohost.c 2026-09-22 10:35:00.248334422 +0200
++++ openssh-9.9p1/canohost.c 2026-09-22 10:36:32.385972161 +0200
@@ -17,6 +17,7 @@
#include <sys/types.h>
#include <sys/socket.h>
@@ -567,8 +568,8 @@ diff -Nur openssh-9.9p1.orig/canohost.c openssh-9.9p1/canohost.c
+ }
+}
diff -Nur openssh-9.9p1.orig/canohost.h openssh-9.9p1/canohost.h
---- openssh-9.9p1.orig/canohost.h 2026-03-25 05:45:24.557147615 +0100
-+++ openssh-9.9p1/canohost.h 2026-03-25 05:46:32.224594560 +0100
+--- openssh-9.9p1.orig/canohost.h 2026-09-22 10:35:00.248665337 +0200
++++ openssh-9.9p1/canohost.h 2026-09-22 10:36:32.386472202 +0200
@@ -26,4 +26,6 @@
#endif /* _CANOHOST_H */
@@ -577,8 +578,8 @@ diff -Nur openssh-9.9p1.orig/canohost.h openssh-9.9p1/canohost.h
+
void ipv64_normalise_mapped(struct sockaddr_storage *, socklen_t *);
diff -Nur openssh-9.9p1.orig/configure.ac openssh-9.9p1/configure.ac
---- openssh-9.9p1.orig/configure.ac 2026-03-25 05:45:24.733671584 +0100
-+++ openssh-9.9p1/configure.ac 2026-03-25 05:46:32.225187025 +0100
+--- openssh-9.9p1.orig/configure.ac 2026-09-22 10:35:00.416577443 +0200
++++ openssh-9.9p1/configure.ac 2026-09-22 10:36:32.387299437 +0200
@@ -4920,6 +4920,14 @@
AC_CHECK_HEADER([gssapi_krb5.h], ,
[ CPPFLAGS="$oldCPP" ])
@@ -636,8 +637,8 @@ diff -Nur openssh-9.9p1.orig/configure.ac openssh-9.9p1/configure.ac
PRIVSEP_PATH=/var/empty
diff -Nur openssh-9.9p1.orig/gss-genr.c openssh-9.9p1/gss-genr.c
---- openssh-9.9p1.orig/gss-genr.c 2026-03-25 05:45:24.738890281 +0100
-+++ openssh-9.9p1/gss-genr.c 2026-03-25 05:46:32.226225219 +0100
+--- openssh-9.9p1.orig/gss-genr.c 2026-09-22 10:35:00.470596014 +0200
++++ openssh-9.9p1/gss-genr.c 2026-09-22 10:36:32.389905240 +0200
@@ -41,6 +41,7 @@
#include "ssherr.h"
#include "sshbuf.h"
@@ -675,8 +676,8 @@ diff -Nur openssh-9.9p1.orig/gss-genr.c openssh-9.9p1/gss-genr.c
return (ctx->major);
}
diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
---- openssh-9.9p1.orig/gss-serv.c 2026-03-25 05:45:24.734906801 +0100
-+++ openssh-9.9p1/gss-serv.c 2026-03-25 06:47:39.143530216 +0100
+--- openssh-9.9p1.orig/gss-serv.c 2026-09-22 10:35:00.418723456 +0200
++++ openssh-9.9p1/gss-serv.c 2026-09-22 10:36:32.390658564 +0200
@@ -50,10 +50,12 @@
#include "monitor_wrap.h"
@@ -759,7 +760,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
/* Extract authentication indicators from the Kerberos ticket. Authentication
* indicators are GSSAPI name attributes for the name "auth-indicators".
* Multiple indicators might be present in the ticket.
-@@ -379,6 +412,7 @@
+@@ -387,6 +420,7 @@
gss_release_buffer_set(&ctx->minor, &attrs);
return ctx->major;
}
@@ -767,7 +768,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
/* Extract the client details from a given context. This can only reliably
* be called once for a context */
-@@ -394,21 +428,24 @@
+@@ -401,21 +435,24 @@
gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;
if (options.gss_store_rekey && client->used && ctx->client_creds) {
@@ -797,7 +798,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
new_name, &equal);
if (GSS_ERROR(ctx->major)) {
-@@ -423,9 +460,9 @@
+@@ -430,9 +467,9 @@
debug("Marking rekeyed credentials for export");
@@ -809,7 +810,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
client->creds = ctx->client_creds;
ctx->client_creds = GSS_C_NO_CREDENTIAL;
client->updated = 1;
-@@ -442,12 +479,17 @@
+@@ -449,12 +486,17 @@
i++;
}
@@ -829,7 +830,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
ssh_gssapi_error(ctx);
return (ctx->major);
}
-@@ -464,22 +506,33 @@
+@@ -471,22 +513,33 @@
return (ctx->major);
}
@@ -864,7 +865,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
return (ctx->major);
}
-@@ -487,6 +540,7 @@
+@@ -494,6 +547,7 @@
void
ssh_gssapi_cleanup_creds(void)
{
@@ -872,7 +873,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
krb5_ccache ccache = NULL;
krb5_error_code problem;
-@@ -502,6 +556,14 @@
+@@ -509,6 +563,14 @@
gssapi_client.store.data = NULL;
}
}
@@ -887,7 +888,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
}
/* As user */
-@@ -509,6 +571,11 @@
+@@ -516,6 +578,11 @@
ssh_gssapi_storecreds(void)
{
if (gssapi_client.mech && gssapi_client.mech->storecreds) {
@@ -899,7 +900,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
return (*gssapi_client.mech->storecreds)(&gssapi_client);
} else
debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
-@@ -542,11 +609,13 @@
+@@ -549,11 +616,13 @@
(void) kex; /* used in privilege separation */
@@ -916,7 +917,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
if (gssapi_client.mech && gssapi_client.mech->userok)
if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
gssapi_client.used = 1;
-@@ -557,6 +626,7 @@
+@@ -564,6 +633,7 @@
gss_release_buffer(&lmin, &gssapi_client.displayname);
gss_release_buffer(&lmin, &gssapi_client.exportedname);
gss_release_cred(&lmin, &gssapi_client.creds);
@@ -924,7 +925,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
if (gssapi_client.indicators != NULL) {
for (i = 0; gssapi_client.indicators[i] != NULL; i++)
-@@ -574,6 +644,24 @@
+@@ -579,6 +649,24 @@
return (0);
}
@@ -949,7 +950,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
/* These bits are only used for rekeying. The unpriviledged child is running
* as the user, the monitor is root.
*
-@@ -600,9 +688,11 @@
+@@ -605,9 +693,11 @@
pam_handle_t *pamh = NULL;
struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
char *envstr;
@@ -962,7 +963,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
return;
ok = mm_ssh_gssapi_update_creds(&gssapi_client.store);
-@@ -622,6 +712,18 @@
+@@ -627,6 +717,18 @@
if (ret)
return;
@@ -983,7 +984,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv.c openssh-9.9p1/gss-serv.c
diff -Nur openssh-9.9p1.orig/gss-serv-gsi.c openssh-9.9p1/gss-serv-gsi.c
--- openssh-9.9p1.orig/gss-serv-gsi.c 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/gss-serv-gsi.c 2026-03-25 05:46:32.227882209 +0100
++++ openssh-9.9p1/gss-serv-gsi.c 2026-09-22 10:36:32.391524363 +0200
@@ -0,0 +1,328 @@
+/*
+ * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -1314,9 +1315,9 @@ diff -Nur openssh-9.9p1.orig/gss-serv-gsi.c openssh-9.9p1/gss-serv-gsi.c
+#endif /* GSI */
+#endif /* GSSAPI */
diff -Nur openssh-9.9p1.orig/gss-serv-krb5.c openssh-9.9p1/gss-serv-krb5.c
---- openssh-9.9p1.orig/gss-serv-krb5.c 2026-03-25 05:45:24.734657886 +0100
-+++ openssh-9.9p1/gss-serv-krb5.c 2026-03-25 05:46:32.228136432 +0100
-@@ -431,6 +431,34 @@
+--- openssh-9.9p1.orig/gss-serv-krb5.c 2026-09-22 10:35:00.419119225 +0200
++++ openssh-9.9p1/gss-serv-krb5.c 2026-09-22 10:36:32.391806345 +0200
+@@ -450,6 +450,34 @@
return found_principal;
}
@@ -1351,7 +1352,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv-krb5.c openssh-9.9p1/gss-serv-krb5.c
/* This writes out any forwarded credentials from the structure populated
* during userauth. Called after we have setuid to the user */
-@@ -525,7 +553,7 @@
+@@ -544,7 +572,7 @@
return set_env;
}
@@ -1360,7 +1361,7 @@ diff -Nur openssh-9.9p1.orig/gss-serv-krb5.c openssh-9.9p1/gss-serv-krb5.c
ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store,
ssh_gssapi_client *client)
{
-@@ -596,7 +624,7 @@
+@@ -615,7 +643,7 @@
{9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"},
NULL,
&ssh_gssapi_krb5_userok,
@@ -1370,8 +1371,8 @@ diff -Nur openssh-9.9p1.orig/gss-serv-krb5.c openssh-9.9p1/gss-serv-krb5.c
&ssh_gssapi_krb5_updatecreds
};
diff -Nur openssh-9.9p1.orig/kexgsss.c openssh-9.9p1/kexgsss.c
---- openssh-9.9p1.orig/kexgsss.c 2026-03-25 05:45:24.561664754 +0100
-+++ openssh-9.9p1/kexgsss.c 2026-03-25 05:46:32.228767100 +0100
+--- openssh-9.9p1.orig/kexgsss.c 2026-09-22 10:35:00.252945775 +0200
++++ openssh-9.9p1/kexgsss.c 2026-09-22 10:36:32.392421893 +0200
@@ -48,6 +48,7 @@
#include "digest.h"
#include "ssherr.h"
@@ -1436,8 +1437,8 @@ diff -Nur openssh-9.9p1.orig/kexgsss.c openssh-9.9p1/kexgsss.c
+
#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
diff -Nur openssh-9.9p1.orig/Makefile.in openssh-9.9p1/Makefile.in
---- openssh-9.9p1.orig/Makefile.in 2026-03-25 05:45:24.705971678 +0100
-+++ openssh-9.9p1/Makefile.in 2026-03-25 05:46:32.229390017 +0100
+--- openssh-9.9p1.orig/Makefile.in 2026-09-22 10:35:00.390529465 +0200
++++ openssh-9.9p1/Makefile.in 2026-09-22 10:36:32.393134705 +0200
@@ -138,6 +138,7 @@
auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
monitor.o monitor_wrap.o auth-krb5.o kexgsss.o \
@@ -1447,8 +1448,8 @@ diff -Nur openssh-9.9p1.orig/Makefile.in openssh-9.9p1/Makefile.in
sftp-server.o sftp-common.o \
sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
diff -Nur openssh-9.9p1.orig/misc.c openssh-9.9p1/misc.c
---- openssh-9.9p1.orig/misc.c 2026-03-25 05:45:24.748815316 +0100
-+++ openssh-9.9p1/misc.c 2026-03-25 05:46:32.229864660 +0100
+--- openssh-9.9p1.orig/misc.c 2026-09-22 10:35:00.471783745 +0200
++++ openssh-9.9p1/misc.c 2026-09-22 10:36:32.394146045 +0200
@@ -440,11 +440,14 @@
#define WHITESPACE " \t\r\n"
#define QUOTE "\""
@@ -1509,8 +1510,8 @@ diff -Nur openssh-9.9p1.orig/misc.c openssh-9.9p1/misc.c
* Convert ASCII string to TCP/IP port number.
* Port must be >=0 and <=65535.
diff -Nur openssh-9.9p1.orig/misc.h openssh-9.9p1/misc.h
---- openssh-9.9p1.orig/misc.h 2026-03-25 05:45:24.716396359 +0100
-+++ openssh-9.9p1/misc.h 2026-03-25 05:46:32.230678104 +0100
+--- openssh-9.9p1.orig/misc.h 2026-09-22 10:35:00.402551820 +0200
++++ openssh-9.9p1/misc.h 2026-09-22 10:36:32.395624967 +0200
@@ -112,6 +112,7 @@
void sock_set_v6only(int);
@@ -1520,8 +1521,8 @@ diff -Nur openssh-9.9p1.orig/misc.h openssh-9.9p1/misc.h
typedef void privdrop_fn(struct passwd *);
diff -Nur openssh-9.9p1.orig/monitor.c openssh-9.9p1/monitor.c
---- openssh-9.9p1.orig/monitor.c 2026-03-25 05:45:24.693744387 +0100
-+++ openssh-9.9p1/monitor.c 2026-03-25 05:46:32.231324137 +0100
+--- openssh-9.9p1.orig/monitor.c 2026-09-22 10:35:00.472289472 +0200
++++ openssh-9.9p1/monitor.c 2026-09-22 10:36:32.396528414 +0200
@@ -148,6 +148,9 @@
int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
@@ -1692,8 +1693,8 @@ diff -Nur openssh-9.9p1.orig/monitor.c openssh-9.9p1/monitor.c
{
gss_buffer_desc data;
diff -Nur openssh-9.9p1.orig/monitor.h openssh-9.9p1/monitor.h
---- openssh-9.9p1.orig/monitor.h 2026-03-25 05:45:24.661382281 +0100
-+++ openssh-9.9p1/monitor.h 2026-03-25 05:46:32.231879238 +0100
+--- openssh-9.9p1.orig/monitor.h 2026-09-22 10:35:00.354983345 +0200
++++ openssh-9.9p1/monitor.h 2026-09-22 10:36:32.398215203 +0200
@@ -75,6 +75,10 @@
MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
@@ -1706,8 +1707,8 @@ diff -Nur openssh-9.9p1.orig/monitor.h openssh-9.9p1/monitor.h
struct ssh;
diff -Nur openssh-9.9p1.orig/monitor_wrap.c openssh-9.9p1/monitor_wrap.c
---- openssh-9.9p1.orig/monitor_wrap.c 2026-03-25 05:45:24.666672216 +0100
-+++ openssh-9.9p1/monitor_wrap.c 2026-03-25 05:46:32.232584567 +0100
+--- openssh-9.9p1.orig/monitor_wrap.c 2026-09-22 10:35:00.359893507 +0200
++++ openssh-9.9p1/monitor_wrap.c 2026-09-22 10:36:32.399041138 +0200
@@ -1139,6 +1139,94 @@
return (authenticated);
}
@@ -1804,8 +1805,8 @@ diff -Nur openssh-9.9p1.orig/monitor_wrap.c openssh-9.9p1/monitor_wrap.c
mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
{
diff -Nur openssh-9.9p1.orig/monitor_wrap.h openssh-9.9p1/monitor_wrap.h
---- openssh-9.9p1.orig/monitor_wrap.h 2026-03-25 05:45:24.667372307 +0100
-+++ openssh-9.9p1/monitor_wrap.h 2026-03-25 05:46:32.232986086 +0100
+--- openssh-9.9p1.orig/monitor_wrap.h 2026-09-22 10:35:00.360207939 +0200
++++ openssh-9.9p1/monitor_wrap.h 2026-09-22 10:36:32.399953806 +0200
@@ -72,6 +72,10 @@
int mm_ssh_gssapi_userok(char *user, struct passwd *, int kex);
OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
@@ -1818,9 +1819,9 @@ diff -Nur openssh-9.9p1.orig/monitor_wrap.h openssh-9.9p1/monitor_wrap.h
#endif
diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
---- openssh-9.9p1.orig/readconf.c 2026-03-25 05:45:24.723671679 +0100
-+++ openssh-9.9p1/readconf.c 2026-03-25 05:46:32.233035673 +0100
-@@ -2812,11 +2812,11 @@
+--- openssh-9.9p1.orig/readconf.c 2026-09-22 10:35:00.473388302 +0200
++++ openssh-9.9p1/readconf.c 2026-09-22 10:36:32.401066267 +0200
+@@ -2810,11 +2810,11 @@
if (options->pubkey_authentication == -1)
options->pubkey_authentication = SSH_PUBKEY_AUTH_ALL;
if (options->gss_authentication == -1)
@@ -1836,8 +1837,8 @@ diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
options->gss_trust_dns = 0;
if (options->gss_renewal_rekey == -1)
diff -Nur openssh-9.9p1.orig/readconf.h openssh-9.9p1/readconf.h
---- openssh-9.9p1.orig/readconf.h 2026-03-25 05:45:24.565619808 +0100
-+++ openssh-9.9p1/readconf.h 2026-03-25 05:46:32.234788974 +0100
+--- openssh-9.9p1.orig/readconf.h 2026-09-22 10:35:00.449764298 +0200
++++ openssh-9.9p1/readconf.h 2026-09-22 10:36:32.401999998 +0200
@@ -80,6 +80,8 @@
char *host_key_alias; /* hostname alias for .ssh/known_hosts */
char *proxy_command; /* Proxy command for connecting the host. */
@@ -1848,8 +1849,8 @@ diff -Nur openssh-9.9p1.orig/readconf.h openssh-9.9p1/readconf.h
u_int num_system_hostfiles; /* Paths for /etc/ssh/ssh_known_hosts */
diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
---- openssh-9.9p1.orig/servconf.c 2026-03-25 05:45:24.744273594 +0100
-+++ openssh-9.9p1/servconf.c 2026-03-25 05:46:32.235281007 +0100
+--- openssh-9.9p1.orig/servconf.c 2026-09-22 10:35:00.474064879 +0200
++++ openssh-9.9p1/servconf.c 2026-09-22 10:36:32.402669347 +0200
@@ -95,6 +95,7 @@
/* Portable-specific options */
options->use_pam = -1;
@@ -1899,7 +1900,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
if (options->gss_store_rekey == -1)
options->gss_store_rekey = 0;
#ifdef GSSAPI
-@@ -577,7 +586,7 @@
+@@ -578,7 +587,7 @@
typedef enum {
sBadOption, /* == unknown option */
/* Portable-specific options */
@@ -1908,7 +1909,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
/* Standard Options */
sPort, sHostKeyFile, sLoginGraceTime,
sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
-@@ -597,6 +606,9 @@
+@@ -598,6 +607,9 @@
sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
sPerSourcePenalties, sPerSourcePenaltyExemptList,
sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
@@ -1918,7 +1919,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
sGssKeyEx, sGssIndicators, sGssKexAlgorithms, sGssStoreRekey,
sAcceptEnv, sSetEnv, sPermitTunnel,
-@@ -632,9 +644,11 @@
+@@ -633,9 +645,11 @@
#ifdef USE_PAM
{ "usepam", sUsePAM, SSHCFG_GLOBAL },
{ "pamservicename", sPAMServiceName, SSHCFG_ALL },
@@ -1930,7 +1931,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
#endif
{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
/* Standard Options */
-@@ -687,8 +701,15 @@
+@@ -688,8 +702,15 @@
{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
#ifdef GSSAPI
{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
@@ -1946,7 +1947,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
-@@ -697,8 +718,11 @@
+@@ -698,8 +719,11 @@
{ "gssapiindicators", sGssIndicators, SSHCFG_ALL },
#else
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
@@ -1958,7 +1959,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
-@@ -773,6 +797,8 @@
+@@ -774,6 +798,8 @@
{ "permitlisten", sPermitListen, SSHCFG_ALL },
{ "forcecommand", sForceCommand, SSHCFG_ALL },
{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
@@ -1967,7 +1968,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
-@@ -1443,6 +1469,10 @@
+@@ -1445,6 +1471,10 @@
*charptr = xstrdup(arg);
break;
@@ -1978,7 +1979,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
/* Standard Options */
case sBadOption:
goto out;
-@@ -1694,6 +1724,10 @@
+@@ -1696,6 +1726,10 @@
intptr = &options->gss_authentication;
goto parse_flag;
@@ -1989,7 +1990,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
case sGssKeyEx:
intptr = &options->gss_keyex;
goto parse_flag;
-@@ -1702,6 +1736,10 @@
+@@ -1704,6 +1738,10 @@
intptr = &options->gss_cleanup_creds;
goto parse_flag;
@@ -2000,7 +2001,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
case sGssStrictAcceptor:
intptr = &options->gss_strict_acceptor;
goto parse_flag;
-@@ -1731,6 +1769,12 @@
+@@ -1733,6 +1771,12 @@
options->gss_indicators = xstrdup(arg);
break;
@@ -2013,7 +2014,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
case sPasswordAuthentication:
intptr = &options->password_authentication;
goto parse_flag;
-@@ -3000,6 +3044,7 @@
+@@ -3002,6 +3046,7 @@
M_CP_INTOPT(password_authentication);
M_CP_INTOPT(gss_authentication);
@@ -2022,8 +2023,8 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
M_CP_INTOPT(pubkey_auth_options);
M_CP_INTOPT(kerberos_authentication);
diff -Nur openssh-9.9p1.orig/servconf.h openssh-9.9p1/servconf.h
---- openssh-9.9p1.orig/servconf.h 2026-03-25 05:45:24.744906777 +0100
-+++ openssh-9.9p1/servconf.h 2026-03-25 05:46:32.236424941 +0100
+--- openssh-9.9p1.orig/servconf.h 2026-09-22 10:35:00.430067256 +0200
++++ openssh-9.9p1/servconf.h 2026-09-22 10:36:32.403493856 +0200
@@ -155,9 +155,12 @@
* be stored in per-session ccache */
int use_kuserok;
@@ -2046,8 +2047,8 @@ diff -Nur openssh-9.9p1.orig/servconf.h openssh-9.9p1/servconf.h
int permit_tun;
diff -Nur openssh-9.9p1.orig/ssh.1 openssh-9.9p1/ssh.1
---- openssh-9.9p1.orig/ssh.1 2026-03-25 05:45:24.681204765 +0100
-+++ openssh-9.9p1/ssh.1 2026-03-25 05:46:32.237060220 +0100
+--- openssh-9.9p1.orig/ssh.1 2026-09-22 10:35:00.373020473 +0200
++++ openssh-9.9p1/ssh.1 2026-09-22 10:36:32.404129333 +0200
@@ -1523,6 +1523,18 @@
on to new connections).
.It Ev USER
@@ -2068,8 +2069,8 @@ diff -Nur openssh-9.9p1.orig/ssh.1 openssh-9.9p1/ssh.1
.Pp
Additionally,
diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
---- openssh-9.9p1.orig/ssh.c 2026-03-25 05:45:24.746671462 +0100
-+++ openssh-9.9p1/ssh.c 2026-03-25 05:46:32.237568037 +0100
+--- openssh-9.9p1.orig/ssh.c 2026-09-22 10:35:00.465873324 +0200
++++ openssh-9.9p1/ssh.c 2026-09-22 10:36:32.405302583 +0200
@@ -585,6 +585,38 @@
fatal("Can't open user config file %.100s: "
"%.100s", config, strerror(errno));
@@ -2109,7 +2110,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
r = snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir,
_PATH_SSH_USER_CONFFILE);
if (r > 0 && (size_t)r < sizeof(buf))
-@@ -1318,8 +1350,12 @@
+@@ -1266,8 +1298,12 @@
if (fill_default_options(&options) != 0)
cleanup_exit(255);
@@ -2124,8 +2125,8 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
/*
* If ProxyJump option specified, then construct a ProxyCommand now.
diff -Nur openssh-9.9p1.orig/ssh_config openssh-9.9p1/ssh_config
---- openssh-9.9p1.orig/ssh_config 2026-03-25 05:45:24.568558459 +0100
-+++ openssh-9.9p1/ssh_config 2026-03-25 05:46:32.238303608 +0100
+--- openssh-9.9p1.orig/ssh_config 2026-09-22 10:35:00.258380515 +0200
++++ openssh-9.9p1/ssh_config 2026-09-22 10:36:32.405885719 +0200
@@ -22,9 +22,9 @@
# ForwardX11 no
# PasswordAuthentication yes
@@ -2140,8 +2141,8 @@ diff -Nur openssh-9.9p1.orig/ssh_config openssh-9.9p1/ssh_config
# BatchMode no
# CheckHostIP no
diff -Nur openssh-9.9p1.orig/ssh_config.5 openssh-9.9p1/ssh_config.5
---- openssh-9.9p1.orig/ssh_config.5 2026-03-25 05:45:24.632759139 +0100
-+++ openssh-9.9p1/ssh_config.5 2026-03-25 05:46:32.238678517 +0100
+--- openssh-9.9p1.orig/ssh_config.5 2026-09-22 10:35:00.325039340 +0200
++++ openssh-9.9p1/ssh_config.5 2026-09-22 10:36:32.406327570 +0200
@@ -52,6 +52,12 @@
user's configuration file
.Pq Pa ~/.ssh/config
@@ -2189,9 +2190,9 @@ diff -Nur openssh-9.9p1.orig/ssh_config.5 openssh-9.9p1/ssh_config.5
.Ed
.It Cm ProxyCommand
diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
---- openssh-9.9p1.orig/sshconnect2.c 2026-03-25 05:45:24.709018862 +0100
-+++ openssh-9.9p1/sshconnect2.c 2026-03-25 05:46:32.239292075 +0100
-@@ -858,6 +858,11 @@
+--- openssh-9.9p1.orig/sshconnect2.c 2026-09-22 10:35:00.454883178 +0200
++++ openssh-9.9p1/sshconnect2.c 2026-09-22 10:36:32.407911809 +0200
+@@ -865,6 +865,11 @@
gss_OID mech = NULL;
char *gss_host = NULL;
@@ -2203,7 +2204,7 @@ diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
if (options.gss_server_identity) {
gss_host = xstrdup(options.gss_server_identity);
} else if (options.gss_trust_dns) {
-@@ -966,7 +971,8 @@
+@@ -973,7 +978,8 @@
if (status == GSS_S_COMPLETE) {
/* send either complete or MIC, depending on mechanism */
@@ -2213,7 +2214,7 @@ diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
if ((r = sshpkt_start(ssh,
SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE)) != 0 ||
(r = sshpkt_send(ssh)) != 0)
-@@ -1133,6 +1139,20 @@
+@@ -1140,6 +1146,20 @@
return r;
}
@@ -2234,7 +2235,7 @@ diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
int
userauth_gsskeyex(struct ssh *ssh)
{
-@@ -1155,6 +1175,12 @@
+@@ -1162,6 +1182,12 @@
if ((b = sshbuf_new()) == NULL)
fatal_f("sshbuf_new failed");
@@ -2247,7 +2248,7 @@ diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
ssh_gssapi_buildmic(b, authctxt->server_user, authctxt->service,
"gssapi-keyex", ssh->kex->session_id);
-@@ -1168,7 +1194,9 @@
+@@ -1175,7 +1201,9 @@
}
if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
@@ -2259,8 +2260,8 @@ diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
(r = sshpkt_put_cstring(ssh, authctxt->method->name)) != 0 ||
(r = sshpkt_put_string(ssh, mic.value, mic.length)) != 0 ||
diff -Nur openssh-9.9p1.orig/sshd.8 openssh-9.9p1/sshd.8
---- openssh-9.9p1.orig/sshd.8 2026-03-25 05:45:24.583613143 +0100
-+++ openssh-9.9p1/sshd.8 2026-03-25 05:46:32.240124096 +0100
+--- openssh-9.9p1.orig/sshd.8 2026-09-22 10:35:00.273226464 +0200
++++ openssh-9.9p1/sshd.8 2026-09-22 10:36:32.408728776 +0200
@@ -840,6 +840,29 @@
# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org
@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W...
@@ -2292,8 +2293,8 @@ diff -Nur openssh-9.9p1.orig/sshd.8 openssh-9.9p1/sshd.8
.Bl -tag -width Ds -compact
.It Pa ~/.hushlogin
diff -Nur openssh-9.9p1.orig/sshd_config openssh-9.9p1/sshd_config
---- openssh-9.9p1.orig/sshd_config 2026-03-25 05:45:24.602230652 +0100
-+++ openssh-9.9p1/sshd_config 2026-03-25 05:46:32.240501031 +0100
+--- openssh-9.9p1.orig/sshd_config 2026-09-22 10:35:00.293301506 +0200
++++ openssh-9.9p1/sshd_config 2026-09-22 10:36:32.409465872 +0200
@@ -76,10 +76,11 @@
#KerberosUseKuserok yes
@@ -2320,8 +2321,8 @@ diff -Nur openssh-9.9p1.orig/sshd_config openssh-9.9p1/sshd_config
#AllowTcpForwarding yes
#GatewayPorts no
diff -Nur openssh-9.9p1.orig/sshd_config.5 openssh-9.9p1/sshd_config.5
---- openssh-9.9p1.orig/sshd_config.5 2026-03-25 05:45:24.745290695 +0100
-+++ openssh-9.9p1/sshd_config.5 2026-03-25 05:46:32.240869026 +0100
+--- openssh-9.9p1.orig/sshd_config.5 2026-09-22 10:35:00.430488484 +0200
++++ openssh-9.9p1/sshd_config.5 2026-09-22 10:36:32.409874232 +0200
@@ -724,15 +724,34 @@
to allow the client to select the address to which the forwarding is bound.
The default is
@@ -2367,7 +2368,7 @@ diff -Nur openssh-9.9p1.orig/sshd_config.5 openssh-9.9p1/sshd_config.5
.It Cm GSSAPIStrictAcceptorCheck
Determines whether to be strict about the identity of the GSSAPI acceptor
a client authenticates against.
-@@ -2093,6 +2112,12 @@
+@@ -2095,6 +2114,12 @@
as a non-root user.
The default is
.Cm no .
@@ -2381,8 +2382,8 @@ diff -Nur openssh-9.9p1.orig/sshd_config.5 openssh-9.9p1/sshd_config.5
Optionally specifies additional text to append to the SSH protocol banner
sent by the server upon connection.
diff -Nur openssh-9.9p1.orig/sshd_config_redhat openssh-9.9p1/sshd_config_redhat
---- openssh-9.9p1.orig/sshd_config_redhat 2026-03-25 05:45:24.552298241 +0100
-+++ openssh-9.9p1/sshd_config_redhat 2026-03-25 05:46:32.241587835 +0100
+--- openssh-9.9p1.orig/sshd_config_redhat 2026-09-22 10:35:00.243522524 +0200
++++ openssh-9.9p1/sshd_config_redhat 2026-09-22 10:36:32.410433088 +0200
@@ -9,9 +9,6 @@
ChallengeResponseAuthentication no
@@ -2394,8 +2395,8 @@ diff -Nur openssh-9.9p1.orig/sshd_config_redhat openssh-9.9p1/sshd_config_redhat
X11Forwarding yes
diff -Nur openssh-9.9p1.orig/sshd-session.c openssh-9.9p1/sshd-session.c
---- openssh-9.9p1.orig/sshd-session.c 2026-03-25 05:45:24.696797019 +0100
-+++ openssh-9.9p1/sshd-session.c 2026-03-25 05:46:32.242311742 +0100
+--- openssh-9.9p1.orig/sshd-session.c 2026-09-22 10:35:00.475567746 +0200
++++ openssh-9.9p1/sshd-session.c 2026-09-22 10:36:32.410778977 +0200
@@ -1487,7 +1487,7 @@
#endif
@@ -2406,8 +2407,8 @@ diff -Nur openssh-9.9p1.orig/sshd-session.c openssh-9.9p1/sshd-session.c
authctxt->krb5_set_env = ssh_gssapi_storecreds();
restore_uid();
diff -Nur openssh-9.9p1.orig/ssh-gss.h openssh-9.9p1/ssh-gss.h
---- openssh-9.9p1.orig/ssh-gss.h 2026-03-25 05:45:24.736140062 +0100
-+++ openssh-9.9p1/ssh-gss.h 2026-03-25 05:46:32.242762918 +0100
+--- openssh-9.9p1.orig/ssh-gss.h 2026-09-22 10:35:00.421098920 +0200
++++ openssh-9.9p1/ssh-gss.h 2026-09-22 10:36:32.411660181 +0200
@@ -110,12 +110,14 @@
} ssh_gssapi_ccache;
@@ -2445,7 +2446,7 @@ diff -Nur openssh-9.9p1.orig/ssh-gss.h openssh-9.9p1/ssh-gss.h
const char *);
diff -Nur openssh-9.9p1.orig/version.h openssh-9.9p1/version.h
--- openssh-9.9p1.orig/version.h 2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/version.h 2026-03-25 05:46:32.243322907 +0100
++++ openssh-9.9p1/version.h 2026-09-22 10:36:32.412003215 +0200
@@ -2,5 +2,19 @@
#define SSH_VERSION "OpenSSH_9.9"
diff --git a/openssh-9.9p1-maxstartups-mistracking.patch b/openssh-9.9p1-maxstartups-mistracking.patch
new file mode 100644
index 0000000..0e92903
--- /dev/null
+++ b/openssh-9.9p1-maxstartups-mistracking.patch
@@ -0,0 +1,73 @@
+diff --color -ruNp a/srclimit.c b/srclimit.c
+--- a/srclimit.c 2024-09-20 00:20:48.000000000 +0200
++++ b/srclimit.c 2026-03-06 13:30:48.408309619 +0100
+@@ -427,7 +427,9 @@ srclimit_penalise(struct xaddr *addr, in
+ penalty->active = 1;
+ if (RB_INSERT(penalties_by_expiry, by_expiry, penalty) != NULL)
+ fatal_f("internal error: %s penalty tables corrupt", t);
+- verbose_f("%s: new %s %s penalty of %d seconds for %s", t,
++ do_log2_f(penalty->active ?
++ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE,
++ "%s: new %s %s penalty of %d seconds for %s", t,
+ addrnetmask, penalty->active ? "active" : "deferred",
+ penalty_secs, reason);
+ if (++(*npenaltiesp) > (size_t)max_sources)
+@@ -446,7 +448,7 @@ srclimit_penalise(struct xaddr *addr, in
+ existing->expiry = now + penalty_cfg.penalty_max;
+ if (existing->expiry - now > penalty_cfg.penalty_min &&
+ !existing->active) {
+- verbose_f("%s: activating %s penalty of %lld seconds for %s",
++ logit_f("%s: activating %s penalty of %lld seconds for %s",
+ addrnetmask, t, (long long)(existing->expiry - now),
+ reason);
+ existing->active = 1;
+diff --color -ruNp a/sshd.c b/sshd.c
+--- a/sshd.c 2026-03-06 13:10:52.653617548 +0100
++++ b/sshd.c 2026-03-06 13:24:50.865079998 +0100
+@@ -291,8 +291,10 @@ child_finish(struct early_child *child)
+ {
+ if (children_active == 0)
+ fatal_f("internal error: children_active underflow");
+- if (child->pipefd != -1)
++ if (child->pipefd != -1) {
++ srclimit_done(child->pipefd);
+ close(child->pipefd);
++ }
+ free(child->id);
+ memset(child, '\0', sizeof(*child));
+ child->pipefd = -1;
+@@ -311,6 +313,7 @@ child_close(struct early_child *child, i
+ if (!quiet)
+ debug_f("enter%s", force_final ? " (forcing)" : "");
+ if (child->pipefd != -1) {
++ srclimit_done(child->pipefd);
+ close(child->pipefd);
+ child->pipefd = -1;
+ }
+@@ -978,10 +981,11 @@ server_accept_loop(int *sock_in, int *so
+ }
+ /* FALLTHROUGH */
+ case 0:
+- /* child exited preauth */
++ /* child closed pipe */
+ if (children[i].early)
+ listening--;
+- srclimit_done(children[i].pipefd);
++ debug3_f("child %lu for %s closed pipe",
++ (long)children[i].pid, children[i].id);
+ child_close(&(children[i]), 0, 0);
+ break;
+ case 1:
+@@ -1003,6 +1007,12 @@ server_accept_loop(int *sock_in, int *so
+ "child %ld for %s in state %d",
+ (int)c, (long)children[i].pid,
+ children[i].id, children[i].early);
++
++ if (children[i].early)
++ listening--;
++ if (children[i].pid > 0)
++ kill(children[i].pid, SIGTERM);
++ child_close(&(children[i]), 0, 0);
+ }
+ break;
+ }
diff --git a/openssh-9.9p1-scp-remote-glob.patch b/openssh-9.9p1-scp-remote-glob.patch
new file mode 100644
index 0000000..c08101e
--- /dev/null
+++ b/openssh-9.9p1-scp-remote-glob.patch
@@ -0,0 +1,14 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c 2026-07-14 11:40:47.754600847 +0200
++++ b/scp.c 2026-07-14 11:43:04.077524517 +0200
+@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
+ goto out;
+ }
+
++ /* Special handling for source of '..' */
++ if (strcmp(filename, "..") == 0)
++ filename = "."; /* Download to dest, not dest/.. */
++
+ if (targetisdir)
+ abs_dst = sftp_path_append(target, filename);
+ else
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-22 20:00 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-22 20:00 [rpms/gsi-openssh] epel9: Based on openssh-9.9p1-15.el9 Mattias Ellert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox