From 520e55a6fe1aebf7af0af6b7406a8f8106b799f5 Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Wed, 5 Mar 2025 16:50:43 +0100
Subject: [PATCH 1/2] Based on openssh-9.9p1-5.el10.1

---
 gsi-openssh.spec                     |  18 +-
 openssh-8.7p1-openssl-log.patch      | 112 +++++++
 openssh-8.7p1-redhat-help.patch      |  40 +++
 openssh-9.9p1-hpn-18.6.0.patch       | 280 ++++++++--------
 openssh-9.9p1-match-regression.patch | 463 +++++++++++++++++++++++++++
 5 files changed, 768 insertions(+), 145 deletions(-)
 create mode 100644 openssh-8.7p1-openssl-log.patch
 create mode 100644 openssh-8.7p1-redhat-help.patch
 create mode 100644 openssh-9.9p1-match-regression.patch

diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index 1060509..f37c40f 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -24,7 +24,7 @@
 %global libedit 1
 
 %global openssh_ver 9.9p1
-%global openssh_rel 1
+%global openssh_rel 2
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -174,9 +174,14 @@ Patch1014: openssh-8.7p1-nohostsha1proof.patch
 
 Patch1015: openssh-9.6p1-pam-rhost.patch
 Patch1016: openssh-9.9p1-separate-keysign.patch
+Patch1017: openssh-8.7p1-redhat-help.patch
+Patch1018: openssh-8.7p1-openssl-log.patch
 # upstream cf3e48ee8ba1beeccddd2f203b558fa102be67a2
 # upstream 0c3927c45f8a57b511c874c4d51a8c89414f74ef
-Patch1017: openssh-9.9p1-mlkembe.patch
+Patch1019: openssh-9.9p1-mlkembe.patch
+# upstream 3f02368e8e9121847727c46b280efc280e5eb615
+# upstream 67a115e7a56dbdc3f5a58c64b29231151f3670f5
+Patch1020: openssh-9.9p1-match-regression.patch
 
 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
@@ -345,7 +350,10 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1014 -p1 -b .nosha1hostproof
 %patch -P 1015 -p1 -b .pam-rhost
 %patch -P 1016 -p1 -b .sep-keysign
-%patch -P 1017 -p1 -b .mlkembe
+%patch -P 1017 -p1 -b .help
+%patch -P 1018 -p1 -b .openssl-log
+%patch -P 1019 -p1 -b .mlkembe
+%patch -P 1020 -p1 -b .match
 
 %patch -P 100 -p1 -b .coverity
 %patch -P 98 -p1 -b .gsi
@@ -361,7 +369,6 @@ autoreconf
 
 %build
 %set_build_flags
-CFLAGS="$CFLAGS"; export CFLAGS
 %if %{pie}
 %ifarch s390 s390x sparc sparcv9 sparc64
 CFLAGS="$CFLAGS -fPIC"
@@ -571,6 +578,9 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-2
+- Based on openssh-9.9p1-5.el10.1
+
 * Mon Jan 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-1
 - Based on openssh-9.9p1-5.fc42 / openssh-9.9p1-1.fc41
 
diff --git a/openssh-8.7p1-openssl-log.patch b/openssh-8.7p1-openssl-log.patch
new file mode 100644
index 0000000..35f444c
--- /dev/null
+++ b/openssh-8.7p1-openssl-log.patch
@@ -0,0 +1,112 @@
+diff -up openssh-9.9p1/log.c.xxx openssh-9.9p1/log.c
+--- openssh-9.9p1/log.c.xxx	2024-10-22 11:55:44.281939275 +0200
++++ openssh-9.9p1/log.c	2024-10-22 11:56:16.709676267 +0200
+@@ -52,6 +52,9 @@
+ 
+ #include "log.h"
+ #include "match.h"
++#ifdef WITH_OPENSSL
++#include <openssl/err.h>
++#endif
+ 
+ static LogLevel log_level = SYSLOG_LEVEL_INFO;
+ static int log_on_stderr = 1;
+@@ -438,6 +438,26 @@ sshlog(const char *file, const char *fun
+ 	va_end(args);
+ }
+ 
++#ifdef WITH_OPENSSL
++static int
++openssl_error_print_cb(const char *str, size_t len, void *u)
++{
++	sshlogdirect(SYSLOG_LEVEL_DEBUG1, 0, "openssl error %s", str);
++	return 0;
++}
++#endif
++
++void
++sshlog_openssl(int r)
++{
++#ifdef WITH_OPENSSL
++	if (r != SSH_ERR_LIBCRYPTO_ERROR) return;
++
++	ERR_print_errors_cb(openssl_error_print_cb, NULL);
++#endif
++	return;
++}
++
+ void
+ sshlogdie(const char *file, const char *func, int line, int showfunc,
+     LogLevel level, const char *suffix, const char *fmt, ...)
+diff -up openssh-8.7p1/log.h.xxx openssh-8.7p1/log.h
+--- openssh-8.7p1/log.h.xxx	2024-10-18 12:56:18.944971946 +0200
++++ openssh-8.7p1/log.h	2024-10-18 13:03:38.324351416 +0200
+@@ -71,6 +71,7 @@ void	 cleanup_exit(int) __attribute__((n
+ void	 sshlog(const char *, const char *, int, int,
+     LogLevel, const char *, const char *, ...)
+     __attribute__((format(printf, 7, 8)));
++void	 sshlog_openssl(int);
+ void	 sshlogv(const char *, const char *, int, int,
+     LogLevel, const char *, const char *, va_list);
+ void	 sshlogdie(const char *, const char *, int, int,
+diff -up openssh-8.7p1/auth2-pubkey.c.yyy openssh-8.7p1/auth2-pubkey.c
+--- openssh-8.7p1/auth2-pubkey.c.yyy	2024-10-18 13:27:00.709055845 +0200
++++ openssh-8.7p1/auth2-pubkey.c	2024-10-18 13:27:31.638784460 +0200
+@@ -131,6 +131,7 @@ userauth_pubkey(struct ssh *ssh)
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
++		sshlog_openssl(r);
+ 		error_fr(r, "parse key");
+ 		goto done;
+ 	}
+diff -up openssh-8.7p1/dispatch.c.yyy openssh-8.7p1/dispatch.c
+--- openssh-8.7p1/dispatch.c.yyy	2024-10-18 13:27:56.349366570 +0200
++++ openssh-8.7p1/dispatch.c	2024-10-18 13:28:17.921874757 +0200
+@@ -130,6 +130,8 @@ ssh_dispatch_run_fatal(struct ssh *ssh,
+ {
+ 	int r;
+ 
+-	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0)
++	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0) {
++		sshlog_openssl(r);
+ 		sshpkt_fatal(ssh, r, "%s", __func__);
++	}
+ }
+diff -up openssh-9.9p1/Makefile.in.xxx openssh-9.9p1/Makefile.in
+--- openssh-9.9p1/Makefile.in.xxx	2025-01-27 12:56:58.533623367 +0100
++++ openssh-9.9p1/Makefile.in	2025-01-27 12:57:41.635638843 +0100
+@@ -224,7 +224,7 @@ sshd-session$(EXEEXT): libssh.a	$(LIBCOM
+ 	$(LD) -o $@ $(SSHD_SESSION_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS)
+ 
+ scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS)
+-	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
++	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(LIBS)
+ 
+ ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHADD_OBJS)
+ 	$(LD) -o $@ $(SSHADD_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(CHANNELLIBS)
+@@ -245,20 +245,20 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
+ 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
+ 
+ ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
+-	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
++	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(KEYCATLIBS) $(LIBS)
+ 
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
+ 
+ sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
+-	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
++	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lcrypto $(LIBS)
+ 
+ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
+-	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
++	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(LIBS) $(LIBEDIT)
+ 
+ # test driver for the loginrec code - not built by default
+ logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
+-	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
++	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh -lcrypto $(LIBS)
+ 
+ $(MANPAGES): $(MANPAGES_IN)
+ 	if test "$(MANTYPE)" = "cat"; then \
diff --git a/openssh-8.7p1-redhat-help.patch b/openssh-8.7p1-redhat-help.patch
new file mode 100644
index 0000000..3ffb657
--- /dev/null
+++ b/openssh-8.7p1-redhat-help.patch
@@ -0,0 +1,40 @@
+diff -up openssh-8.7p1/ssh.c.xxx openssh-8.7p1/ssh.c
+--- openssh-8.7p1/ssh.c.xxx	2024-09-11 14:24:06.711088878 +0200
++++ openssh-8.7p1/ssh.c	2024-09-11 14:35:12.883765718 +0200
+@@ -175,6 +175,16 @@ extern int muxserver_sock;
+ extern u_int muxclient_command;
+ 
+ /* Prints a help message to the user.  This function never returns. */
++static void
++redhat_usage(void)
++{
++    if(isatty(fileno(stderr))) {
++	fprintf(stderr,
++"\nYou can find some explanations for typical errors at this link:\n"
++"	    https://red.ht/support_rhel_ssh\n"
++	);
++    }
++}
+ 
+ static void
+ usage(void)
+@@ -188,6 +196,7 @@ usage(void)
+ "           destination [command [argument ...]]\n"
+ "       ssh [-Q query_option]\n"
+ 	);
++	redhat_usage();
+ 	exit(255);
+ }
+ 
+@@ -1609,8 +1618,10 @@ main(int ac, char **av)
+ 	/* Open a connection to the remote host. */
+ 	if (ssh_connect(ssh, host, options.host_arg, addrs, &hostaddr,
+ 	    options.port, options.connection_attempts,
+-	    &timeout_ms, options.tcp_keep_alive) != 0)
++	    &timeout_ms, options.tcp_keep_alive) != 0) {
++		redhat_usage();
+ 		exit(255);
++	}
+ 
+ 	if (addrs != NULL)
+ 		freeaddrinfo(addrs);
diff --git a/openssh-9.9p1-hpn-18.6.0.patch b/openssh-9.9p1-hpn-18.6.0.patch
index da663c9..dc74b84 100644
--- a/openssh-9.9p1-hpn-18.6.0.patch
+++ b/openssh-9.9p1-hpn-18.6.0.patch
@@ -1,6 +1,6 @@
 diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
---- openssh-9.9p1.orig/auth2.c	2025-01-20 20:48:33.444582227 +0100
-+++ openssh-9.9p1/auth2.c	2025-01-20 21:54:08.570687857 +0100
+--- openssh-9.9p1.orig/auth2.c	2025-03-06 00:02:47.558862414 +0100
++++ openssh-9.9p1/auth2.c	2025-03-06 00:03:46.244472587 +0100
 @@ -52,6 +52,8 @@
  #include "dispatch.h"
  #include "pathnames.h"
@@ -43,7 +43,7 @@ diff -Nur openssh-9.9p1.orig/auth2.c openssh-9.9p1/auth2.c
  #ifdef WITH_SELINUX
 diff -Nur openssh-9.9p1.orig/binn.c openssh-9.9p1/binn.c
 --- openssh-9.9p1.orig/binn.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/binn.c	2025-01-20 20:50:04.564813761 +0100
++++ openssh-9.9p1/binn.c	2025-03-06 00:03:46.255472595 +0100
 @@ -0,0 +1,3541 @@
 +#include <stdio.h>
 +#include <stdlib.h>
@@ -3588,7 +3588,7 @@ diff -Nur openssh-9.9p1.orig/binn.c openssh-9.9p1/binn.c
 +/*************************************************************************************/
 diff -Nur openssh-9.9p1.orig/binn.h openssh-9.9p1/binn.h
 --- openssh-9.9p1.orig/binn.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/binn.h	2025-01-20 20:50:04.565813763 +0100
++++ openssh-9.9p1/binn.h	2025-03-06 00:03:46.257472597 +0100
 @@ -0,0 +1,945 @@
 +
 +// TO ENABLE INLINE FUNCTIONS:
@@ -4536,8 +4536,8 @@ diff -Nur openssh-9.9p1.orig/binn.h openssh-9.9p1/binn.h
 +
 +#endif //BINN_H
 diff -Nur openssh-9.9p1.orig/channels.c openssh-9.9p1/channels.c
---- openssh-9.9p1.orig/channels.c	2025-01-20 20:48:33.373582047 +0100
-+++ openssh-9.9p1/channels.c	2025-01-20 21:55:22.938880541 +0100
+--- openssh-9.9p1.orig/channels.c	2025-03-06 00:02:47.438427815 +0100
++++ openssh-9.9p1/channels.c	2025-03-06 00:03:46.261472600 +0100
 @@ -97,6 +97,11 @@
  /* Minimum port number for X11 forwarding */
  #define X11_PORT_MIN 6000
@@ -4687,8 +4687,8 @@ diff -Nur openssh-9.9p1.orig/channels.c openssh-9.9p1/channels.c
  channel_setup_fwd_listener_tcpip(struct ssh *ssh, int type,
      struct Forward *fwd, int *allocated_listen_port,
 diff -Nur openssh-9.9p1.orig/channels.h openssh-9.9p1/channels.h
---- openssh-9.9p1.orig/channels.h	2025-01-20 20:48:33.343581971 +0100
-+++ openssh-9.9p1/channels.h	2025-01-20 20:50:04.567813768 +0100
+--- openssh-9.9p1.orig/channels.h	2025-03-06 00:02:47.392951541 +0100
++++ openssh-9.9p1/channels.h	2025-03-06 00:03:46.264019621 +0100
 @@ -175,6 +175,7 @@
  	u_int	local_window_max;
  	u_int	local_consumed;
@@ -4714,8 +4714,8 @@ diff -Nur openssh-9.9p1.orig/channels.h openssh-9.9p1/channels.h
 +void     channel_set_hpn_disabled(int);
  #endif
 diff -Nur openssh-9.9p1.orig/cipher.c openssh-9.9p1/cipher.c
---- openssh-9.9p1.orig/cipher.c	2025-01-20 20:48:33.392582095 +0100
-+++ openssh-9.9p1/cipher.c	2025-01-20 21:56:16.253016900 +0100
+--- openssh-9.9p1.orig/cipher.c	2025-03-06 00:02:47.472465746 +0100
++++ openssh-9.9p1/cipher.c	2025-03-06 00:03:46.264472602 +0100
 @@ -48,23 +48,39 @@
  #include "sshbuf.h"
  #include "ssherr.h"
@@ -5013,7 +5013,7 @@ diff -Nur openssh-9.9p1.orig/cipher.c openssh-9.9p1/cipher.c
  }
 diff -Nur openssh-9.9p1.orig/cipher-chachapoly.c openssh-9.9p1/cipher-chachapoly.c
 --- openssh-9.9p1.orig/cipher-chachapoly.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/cipher-chachapoly.c	2025-01-20 20:50:04.569813773 +0100
++++ openssh-9.9p1/cipher-chachapoly.c	2025-03-06 00:03:46.266944464 +0100
 @@ -88,7 +88,7 @@
  	if (!do_encrypt) {
  		const u_char *tag = src + aadlen + len;
@@ -5034,7 +5034,7 @@ diff -Nur openssh-9.9p1.orig/cipher-chachapoly.c openssh-9.9p1/cipher-chachapoly
  	r = 0;
 diff -Nur openssh-9.9p1.orig/cipher-chachapoly-libcrypto.c openssh-9.9p1/cipher-chachapoly-libcrypto.c
 --- openssh-9.9p1.orig/cipher-chachapoly-libcrypto.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/cipher-chachapoly-libcrypto.c	2025-01-20 21:59:09.157459134 +0100
++++ openssh-9.9p1/cipher-chachapoly-libcrypto.c	2025-03-06 00:03:46.268029005 +0100
 @@ -34,8 +34,17 @@
  #include "ssherr.h"
  #include "cipher-chachapoly.h"
@@ -5099,7 +5099,7 @@ diff -Nur openssh-9.9p1.orig/cipher-chachapoly-libcrypto.c openssh-9.9p1/cipher-
  	r = 0;
 diff -Nur openssh-9.9p1.orig/cipher-chachapoly-libcrypto-mt.c openssh-9.9p1/cipher-chachapoly-libcrypto-mt.c
 --- openssh-9.9p1.orig/cipher-chachapoly-libcrypto-mt.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-chachapoly-libcrypto-mt.c	2025-01-20 20:50:04.570813776 +0100
++++ openssh-9.9p1/cipher-chachapoly-libcrypto-mt.c	2025-03-06 00:03:46.268472605 +0100
 @@ -0,0 +1,695 @@
 +/*
 + * Copyright (c) 2023 The Board of Trustees of Carnegie Mellon University.
@@ -5798,7 +5798,7 @@ diff -Nur openssh-9.9p1.orig/cipher-chachapoly-libcrypto-mt.c openssh-9.9p1/ciph
 +#endif /* defined(HAVE_EVP_CHACHA20) && !defined(HAVE_BROKEN_CHACHA20) */
 diff -Nur openssh-9.9p1.orig/cipher-chachapoly-libcrypto-mt.h openssh-9.9p1/cipher-chachapoly-libcrypto-mt.h
 --- openssh-9.9p1.orig/cipher-chachapoly-libcrypto-mt.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-chachapoly-libcrypto-mt.h	2025-01-20 20:50:04.571813779 +0100
++++ openssh-9.9p1/cipher-chachapoly-libcrypto-mt.h	2025-03-06 00:03:46.269694620 +0100
 @@ -0,0 +1,45 @@
 +/*
 + * Copyright (c) 2023 The Board of Trustees of Carnegie Mellon University.
@@ -5847,7 +5847,7 @@ diff -Nur openssh-9.9p1.orig/cipher-chachapoly-libcrypto-mt.h openssh-9.9p1/ciph
 +#endif /* CHACHA_POLY_LIBCRYPTO_MT_H */
 diff -Nur openssh-9.9p1.orig/cipher-ctr-mt.c openssh-9.9p1/cipher-ctr-mt.c
 --- openssh-9.9p1.orig/cipher-ctr-mt.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-ctr-mt.c	2025-01-20 20:50:04.571813779 +0100
++++ openssh-9.9p1/cipher-ctr-mt.c	2025-03-06 00:03:46.270435656 +0100
 @@ -0,0 +1,677 @@
 +/*
 + * OpenSSH Multi-threaded AES-CTR Cipher
@@ -6528,7 +6528,7 @@ diff -Nur openssh-9.9p1.orig/cipher-ctr-mt.c openssh-9.9p1/cipher-ctr-mt.c
 +#endif /* OSSL Check */
 diff -Nur openssh-9.9p1.orig/cipher-ctr-mt-functions.c openssh-9.9p1/cipher-ctr-mt-functions.c
 --- openssh-9.9p1.orig/cipher-ctr-mt-functions.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-ctr-mt-functions.c	2025-01-20 20:50:04.572813781 +0100
++++ openssh-9.9p1/cipher-ctr-mt-functions.c	2025-03-06 00:03:46.271282116 +0100
 @@ -0,0 +1,668 @@
 +/*
 + * OpenSSH Multi-threaded AES-CTR Cipher Provider for OpenSSL 3
@@ -7200,7 +7200,7 @@ diff -Nur openssh-9.9p1.orig/cipher-ctr-mt-functions.c openssh-9.9p1/cipher-ctr-
 +#endif /*WITH_OPENSSL3*/
 diff -Nur openssh-9.9p1.orig/cipher-ctr-mt-functions.h openssh-9.9p1/cipher-ctr-mt-functions.h
 --- openssh-9.9p1.orig/cipher-ctr-mt-functions.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-ctr-mt-functions.h	2025-01-20 20:50:04.572813781 +0100
++++ openssh-9.9p1/cipher-ctr-mt-functions.h	2025-03-06 00:03:46.271948081 +0100
 @@ -0,0 +1,142 @@
 +/*
 + * OpenSSH Multi-threaded AES-CTR Cipher Provider for OpenSSL 3
@@ -7346,7 +7346,7 @@ diff -Nur openssh-9.9p1.orig/cipher-ctr-mt-functions.h openssh-9.9p1/cipher-ctr-
 +#endif /* CTR_MT_FUNCS */
 diff -Nur openssh-9.9p1.orig/cipher-ctr-mt-provider.c openssh-9.9p1/cipher-ctr-mt-provider.c
 --- openssh-9.9p1.orig/cipher-ctr-mt-provider.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-ctr-mt-provider.c	2025-01-20 20:50:04.572813781 +0100
++++ openssh-9.9p1/cipher-ctr-mt-provider.c	2025-03-06 00:03:46.273037795 +0100
 @@ -0,0 +1,390 @@
 +/*
 + * OpenSSH Multi-threaded AES-CTR Cipher Provider for OpenSSL 3
@@ -7739,8 +7739,8 @@ diff -Nur openssh-9.9p1.orig/cipher-ctr-mt-provider.c openssh-9.9p1/cipher-ctr-m
 +
 +#endif /*WITH_OPENSSL3*/
 diff -Nur openssh-9.9p1.orig/cipher.h openssh-9.9p1/cipher.h
---- openssh-9.9p1.orig/cipher.h	2025-01-20 20:48:33.392582095 +0100
-+++ openssh-9.9p1/cipher.h	2025-01-20 20:59:21.957234646 +0100
+--- openssh-9.9p1.orig/cipher.h	2025-03-06 00:02:47.472692777 +0100
++++ openssh-9.9p1/cipher.h	2025-03-06 00:03:46.274674308 +0100
 @@ -42,11 +42,17 @@
  #include <openssl/evp.h>
  #endif
@@ -7799,7 +7799,7 @@ diff -Nur openssh-9.9p1.orig/cipher.h openssh-9.9p1/cipher.h
  
 diff -Nur openssh-9.9p1.orig/cipher-switch.c openssh-9.9p1/cipher-switch.c
 --- openssh-9.9p1.orig/cipher-switch.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-switch.c	2025-01-20 20:50:04.573813784 +0100
++++ openssh-9.9p1/cipher-switch.c	2025-03-06 00:03:46.275472610 +0100
 @@ -0,0 +1,73 @@
 +/*
 + * Copyright (c) 2023 The Board of Trustees of Carnegie Mellon University.
@@ -7876,7 +7876,7 @@ diff -Nur openssh-9.9p1.orig/cipher-switch.c openssh-9.9p1/cipher-switch.c
 +}
 diff -Nur openssh-9.9p1.orig/cipher-switch.h openssh-9.9p1/cipher-switch.h
 --- openssh-9.9p1.orig/cipher-switch.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/cipher-switch.h	2025-01-20 20:50:04.574813786 +0100
++++ openssh-9.9p1/cipher-switch.h	2025-03-06 00:03:46.276602664 +0100
 @@ -0,0 +1,18 @@
 +/*
 + * Copyright (c) 2015 The Board of Trustees of Carnegie Mellon University.
@@ -7897,8 +7897,8 @@ diff -Nur openssh-9.9p1.orig/cipher-switch.h openssh-9.9p1/cipher-switch.h
 +
 +void cipher_switch (struct ssh *);
 diff -Nur openssh-9.9p1.orig/clientloop.c openssh-9.9p1/clientloop.c
---- openssh-9.9p1.orig/clientloop.c	2025-01-20 20:48:33.290581837 +0100
-+++ openssh-9.9p1/clientloop.c	2025-01-20 20:50:04.575813789 +0100
+--- openssh-9.9p1.orig/clientloop.c	2025-03-06 00:02:47.319373879 +0100
++++ openssh-9.9p1/clientloop.c	2025-03-06 00:03:46.277472612 +0100
 @@ -114,6 +114,7 @@
  #include "msg.h"
  #include "ssherr.h"
@@ -8189,8 +8189,8 @@ diff -Nur openssh-9.9p1.orig/clientloop.c openssh-9.9p1/clientloop.c
  			len = 900;
  		if (want_subsystem) {
 diff -Nur openssh-9.9p1.orig/compat.c openssh-9.9p1/compat.c
---- openssh-9.9p1.orig/compat.c	2025-01-20 20:48:33.422582171 +0100
-+++ openssh-9.9p1/compat.c	2025-01-20 22:39:30.315877553 +0100
+--- openssh-9.9p1.orig/compat.c	2025-03-06 00:02:47.517601287 +0100
++++ openssh-9.9p1/compat.c	2025-03-06 00:03:46.279242089 +0100
 @@ -135,6 +135,35 @@
  			ssh->compat = check[i].bugs;
  	if (forbid_ssh_rsa)
@@ -8228,8 +8228,8 @@ diff -Nur openssh-9.9p1.orig/compat.c openssh-9.9p1/compat.c
  		}
  	}
 diff -Nur openssh-9.9p1.orig/compat.h openssh-9.9p1/compat.h
---- openssh-9.9p1.orig/compat.h	2025-01-20 20:48:33.423582174 +0100
-+++ openssh-9.9p1/compat.h	2025-01-20 22:36:35.778448062 +0100
+--- openssh-9.9p1.orig/compat.h	2025-03-06 00:02:47.517890963 +0100
++++ openssh-9.9p1/compat.h	2025-03-06 00:03:46.279861907 +0100
 @@ -46,12 +46,12 @@
  /* #define unused		0x00010000 */
  /* #define unused		0x00020000 */
@@ -8247,8 +8247,8 @@ diff -Nur openssh-9.9p1.orig/compat.h openssh-9.9p1/compat.h
  #define SSH_BUG_DYNAMIC_RPORT	0x08000000
  #define SSH_BUG_CURVE25519PAD	0x10000000
 diff -Nur openssh-9.9p1.orig/configure.ac openssh-9.9p1/configure.ac
---- openssh-9.9p1.orig/configure.ac	2025-01-20 20:48:33.447582234 +0100
-+++ openssh-9.9p1/configure.ac	2025-01-20 20:50:04.577813794 +0100
+--- openssh-9.9p1.orig/configure.ac	2025-03-06 00:02:47.565439463 +0100
++++ openssh-9.9p1/configure.ac	2025-03-06 00:03:46.280472614 +0100
 @@ -2945,8 +2945,8 @@
  			200*)   # LibreSSL
  				lver=`echo "$sslver" | sed 's/.*libressl-//'`
@@ -8301,7 +8301,7 @@ diff -Nur openssh-9.9p1.orig/configure.ac openssh-9.9p1/configure.ac
  		AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 diff -Nur openssh-9.9p1.orig/defines.h openssh-9.9p1/defines.h
 --- openssh-9.9p1.orig/defines.h	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/defines.h	2025-01-20 20:50:04.578813797 +0100
++++ openssh-9.9p1/defines.h	2025-03-06 00:03:46.282574554 +0100
 @@ -889,7 +889,7 @@
  #endif
  
@@ -8313,7 +8313,7 @@ diff -Nur openssh-9.9p1.orig/defines.h openssh-9.9p1/defines.h
  /*
 diff -Nur openssh-9.9p1.orig/digest.h openssh-9.9p1/digest.h
 --- openssh-9.9p1.orig/digest.h	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/digest.h	2025-01-20 20:50:04.578813797 +0100
++++ openssh-9.9p1/digest.h	2025-03-06 00:03:46.283074368 +0100
 @@ -27,7 +27,8 @@
  #define SSH_DIGEST_SHA256	2
  #define SSH_DIGEST_SHA384	3
@@ -8326,7 +8326,7 @@ diff -Nur openssh-9.9p1.orig/digest.h openssh-9.9p1/digest.h
  struct ssh_digest_ctx;
 diff -Nur openssh-9.9p1.orig/digest-openssl.c openssh-9.9p1/digest-openssl.c
 --- openssh-9.9p1.orig/digest-openssl.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/digest-openssl.c	2025-01-20 20:50:04.578813797 +0100
++++ openssh-9.9p1/digest-openssl.c	2025-03-06 00:03:46.283460143 +0100
 @@ -61,6 +61,7 @@
  	{ SSH_DIGEST_SHA256,	"SHA256",	32,	EVP_sha256 },
  	{ SSH_DIGEST_SHA384,	"SHA384",	48,	EVP_sha384 },
@@ -8337,7 +8337,7 @@ diff -Nur openssh-9.9p1.orig/digest-openssl.c openssh-9.9p1/digest-openssl.c
  
 diff -Nur openssh-9.9p1.orig/FUNDING.yml openssh-9.9p1/FUNDING.yml
 --- openssh-9.9p1.orig/FUNDING.yml	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/FUNDING.yml	2025-01-20 20:50:04.578813797 +0100
++++ openssh-9.9p1/FUNDING.yml	2025-03-06 00:03:46.283744812 +0100
 @@ -0,0 +1,12 @@
 +# These are supported funding model platforms
 +
@@ -8353,7 +8353,7 @@ diff -Nur openssh-9.9p1.orig/FUNDING.yml openssh-9.9p1/FUNDING.yml
 +#custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
 diff -Nur openssh-9.9p1.orig/HPN-README openssh-9.9p1/HPN-README
 --- openssh-9.9p1.orig/HPN-README	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/HPN-README	2025-01-20 20:50:04.578813797 +0100
++++ openssh-9.9p1/HPN-README	2025-03-06 00:03:46.284024116 +0100
 @@ -0,0 +1,170 @@
 +Notes:
 +
@@ -8527,7 +8527,7 @@ diff -Nur openssh-9.9p1.orig/HPN-README openssh-9.9p1/HPN-README
 +Edited: October 11, 2023
 diff -Nur openssh-9.9p1.orig/HPNSSHInstallation.txt openssh-9.9p1/HPNSSHInstallation.txt
 --- openssh-9.9p1.orig/HPNSSHInstallation.txt	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/HPNSSHInstallation.txt	2025-01-20 20:50:04.579813799 +0100
++++ openssh-9.9p1/HPNSSHInstallation.txt	2025-03-06 00:03:46.284407436 +0100
 @@ -0,0 +1,354 @@
 +HPN-SSH Installation
 +
@@ -8884,8 +8884,8 @@ diff -Nur openssh-9.9p1.orig/HPNSSHInstallation.txt openssh-9.9p1/HPNSSHInstalla
 +restorecon /usr/bin/hpnssh-keygen
 +restorecon /etc/pam.d/hpnsshd
 diff -Nur openssh-9.9p1.orig/kex.c openssh-9.9p1/kex.c
---- openssh-9.9p1.orig/kex.c	2025-01-20 20:48:33.420582166 +0100
-+++ openssh-9.9p1/kex.c	2025-01-20 20:50:04.579813799 +0100
+--- openssh-9.9p1.orig/kex.c	2025-03-06 00:02:47.510955696 +0100
++++ openssh-9.9p1/kex.c	2025-03-06 00:03:46.284781657 +0100
 @@ -67,6 +67,7 @@
  
  #include "ssherr.h"
@@ -9104,8 +9104,8 @@ diff -Nur openssh-9.9p1.orig/kex.c openssh-9.9p1/kex.c
  	mismatch = 0;
  	switch (remote_major) {
 diff -Nur openssh-9.9p1.orig/mac.c openssh-9.9p1/mac.c
---- openssh-9.9p1.orig/mac.c	2025-01-20 20:48:33.394582100 +0100
-+++ openssh-9.9p1/mac.c	2025-01-20 20:50:04.580813802 +0100
+--- openssh-9.9p1.orig/mac.c	2025-03-06 00:02:47.473662177 +0100
++++ openssh-9.9p1/mac.c	2025-03-06 00:03:46.285715098 +0100
 @@ -63,6 +63,7 @@
  	{ "hmac-sha2-512",			SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 },
  	{ "hmac-md5",				SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 0 },
@@ -9115,8 +9115,8 @@ diff -Nur openssh-9.9p1.orig/mac.c openssh-9.9p1/mac.c
  	{ "umac-128@openssh.com",		SSH_UMAC128, 0, 0, 128, 128, 0 },
  
 diff -Nur openssh-9.9p1.orig/Makefile.in openssh-9.9p1/Makefile.in
---- openssh-9.9p1.orig/Makefile.in	2025-01-20 20:48:33.449582239 +0100
-+++ openssh-9.9p1/Makefile.in	2025-01-20 21:02:30.432714955 +0100
+--- openssh-9.9p1.orig/Makefile.in	2025-03-06 00:02:47.569151796 +0100
++++ openssh-9.9p1/Makefile.in	2025-03-06 00:15:12.570995734 +0100
 @@ -51,7 +51,7 @@
  CFLAGS_NOPIE=@CFLAGS_NOPIE@
  CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
@@ -9172,14 +9172,14 @@ diff -Nur openssh-9.9p1.orig/Makefile.in openssh-9.9p1/Makefile.in
  	$(LD) -o $@ $(SSHD_SESSION_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS)
  
  scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS)
--	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(CHANNELLIBS)
+-	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(LIBS)
++	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(LIBS) $(CHANNELLIBS)
  
  ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHADD_OBJS)
  	$(LD) -o $@ $(SSHADD_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(CHANNELLIBS)
 diff -Nur openssh-9.9p1.orig/metrics.c openssh-9.9p1/metrics.c
 --- openssh-9.9p1.orig/metrics.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/metrics.c	2025-01-20 20:50:04.581813804 +0100
++++ openssh-9.9p1/metrics.c	2025-03-06 00:03:46.286472619 +0100
 @@ -0,0 +1,444 @@
 +/*
 + * Copyright (c) 2022 The Board of Trustees of Carnegie Mellon University.
@@ -9627,7 +9627,7 @@ diff -Nur openssh-9.9p1.orig/metrics.c openssh-9.9p1/metrics.c
 +}
 diff -Nur openssh-9.9p1.orig/metrics.h openssh-9.9p1/metrics.h
 --- openssh-9.9p1.orig/metrics.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/metrics.h	2025-01-20 20:50:04.581813804 +0100
++++ openssh-9.9p1/metrics.h	2025-03-06 00:03:46.287403100 +0100
 @@ -0,0 +1,45 @@
 +/*
 + * Copyright (c) 2022 The Board of Trustees of Carnegie Mellon University.
@@ -9675,8 +9675,8 @@ diff -Nur openssh-9.9p1.orig/metrics.h openssh-9.9p1/metrics.h
 +
 +#endif /* define metrics_h */
 diff -Nur openssh-9.9p1.orig/misc.c openssh-9.9p1/misc.c
---- openssh-9.9p1.orig/misc.c	2025-01-20 20:48:33.449582239 +0100
-+++ openssh-9.9p1/misc.c	2025-01-20 20:50:04.582813807 +0100
+--- openssh-9.9p1.orig/misc.c	2025-03-06 00:02:47.569564363 +0100
++++ openssh-9.9p1/misc.c	2025-03-06 00:03:46.287674841 +0100
 @@ -77,6 +77,29 @@
  #include "ssherr.h"
  #include "platform.h"
@@ -9707,7 +9707,7 @@ diff -Nur openssh-9.9p1.orig/misc.c openssh-9.9p1/misc.c
  /* remove newline at end of string */
  char *
  chop(char *s)
-@@ -1649,20 +1672,6 @@
+@@ -1670,20 +1693,6 @@
  	return (v);
  }
  
@@ -9728,7 +9728,7 @@ diff -Nur openssh-9.9p1.orig/misc.c openssh-9.9p1/misc.c
  u_int16_t
  get_u16(const void *vp)
  {
-@@ -1702,17 +1711,6 @@
+@@ -1723,17 +1732,6 @@
  }
  
  void
@@ -9747,9 +9747,9 @@ diff -Nur openssh-9.9p1.orig/misc.c openssh-9.9p1/misc.c
  {
  	u_char *p = (u_char *)vp;
 diff -Nur openssh-9.9p1.orig/misc.h openssh-9.9p1/misc.h
---- openssh-9.9p1.orig/misc.h	2025-01-20 20:48:33.450582242 +0100
-+++ openssh-9.9p1/misc.h	2025-01-20 20:50:04.582813807 +0100
-@@ -166,12 +166,6 @@
+--- openssh-9.9p1.orig/misc.h	2025-03-06 00:02:47.570052185 +0100
++++ openssh-9.9p1/misc.h	2025-03-06 00:03:46.288478447 +0100
+@@ -167,12 +167,6 @@
  void		put_u16(void *, u_int16_t)
      __attribute__((__bounded__( __minbytes__, 1, 2)));
  
@@ -9762,7 +9762,7 @@ diff -Nur openssh-9.9p1.orig/misc.h openssh-9.9p1/misc.h
  struct bwlimit {
  	size_t buflen;
  	u_int64_t rate;		/* desired rate in kbit/s */
-@@ -258,4 +252,16 @@
+@@ -259,4 +253,16 @@
  /* On OpenBSD time_t is int64_t which is long long. */
  /* #define SSH_TIME_T_MAX LLONG_MAX */
  
@@ -9780,8 +9780,8 @@ diff -Nur openssh-9.9p1.orig/misc.h openssh-9.9p1/misc.h
 +
  #endif /* _MISC_H */
 diff -Nur openssh-9.9p1.orig/myproposal.h openssh-9.9p1/myproposal.h
---- openssh-9.9p1.orig/myproposal.h	2025-01-20 20:48:33.407582133 +0100
-+++ openssh-9.9p1/myproposal.h	2025-01-20 20:50:04.583813809 +0100
+--- openssh-9.9p1.orig/myproposal.h	2025-03-06 00:02:47.492549025 +0100
++++ openssh-9.9p1/myproposal.h	2025-03-06 00:03:46.289049737 +0100
 @@ -71,7 +71,8 @@
  	"rsa-sha2-256"
  
@@ -9794,7 +9794,7 @@ diff -Nur openssh-9.9p1.orig/myproposal.h openssh-9.9p1/myproposal.h
  
 diff -Nur openssh-9.9p1.orig/num.c openssh-9.9p1/num.c
 --- openssh-9.9p1.orig/num.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/num.c	2025-01-20 20:50:04.583813809 +0100
++++ openssh-9.9p1/num.c	2025-03-06 00:03:46.289504958 +0100
 @@ -0,0 +1,156 @@
 +/* CC0 license applied, see LICENCE.md */
 +
@@ -9954,7 +9954,7 @@ diff -Nur openssh-9.9p1.orig/num.c openssh-9.9p1/num.c
 +#endif /* WITH_OPENSSL3 */
 diff -Nur openssh-9.9p1.orig/num.h openssh-9.9p1/num.h
 --- openssh-9.9p1.orig/num.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/num.h	2025-01-20 20:50:04.584813812 +0100
++++ openssh-9.9p1/num.h	2025-03-06 00:03:46.289787706 +0100
 @@ -0,0 +1,15 @@
 +/* CC0 license applied, see LICENCE.md */
 +
@@ -9973,7 +9973,7 @@ diff -Nur openssh-9.9p1.orig/num.h openssh-9.9p1/num.h
 +#endif /* WITH_OPENSSL3 */
 diff -Nur openssh-9.9p1.orig/ossl3-provider-err.c openssh-9.9p1/ossl3-provider-err.c
 --- openssh-9.9p1.orig/ossl3-provider-err.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/ossl3-provider-err.c	2025-01-20 20:50:04.584813812 +0100
++++ openssh-9.9p1/ossl3-provider-err.c	2025-03-06 00:03:46.290517654 +0100
 @@ -0,0 +1,108 @@
 +/* CC0 license applied, see LICENCE.md */
 +
@@ -10085,7 +10085,7 @@ diff -Nur openssh-9.9p1.orig/ossl3-provider-err.c openssh-9.9p1/ossl3-provider-e
 +#endif /* WITH_OPENSSL3 */
 diff -Nur openssh-9.9p1.orig/ossl3-provider-err.h openssh-9.9p1/ossl3-provider-err.h
 --- openssh-9.9p1.orig/ossl3-provider-err.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/ossl3-provider-err.h	2025-01-20 20:50:04.584813812 +0100
++++ openssh-9.9p1/ossl3-provider-err.h	2025-03-06 00:03:46.291399029 +0100
 @@ -0,0 +1,73 @@
 +/* CC0 license applied, see LICENCE.md */
 +
@@ -10161,8 +10161,8 @@ diff -Nur openssh-9.9p1.orig/ossl3-provider-err.h openssh-9.9p1/ossl3-provider-e
 +                       uint32_t reason, const char *fmt, ...);
 +#endif /* WITH_OPENSSL3 */
 diff -Nur openssh-9.9p1.orig/packet.c openssh-9.9p1/packet.c
---- openssh-9.9p1.orig/packet.c	2025-01-20 20:48:33.396582105 +0100
-+++ openssh-9.9p1/packet.c	2025-01-20 20:50:04.585813814 +0100
+--- openssh-9.9p1.orig/packet.c	2025-03-06 00:02:47.476047142 +0100
++++ openssh-9.9p1/packet.c	2025-03-06 00:03:46.292778473 +0100
 @@ -63,6 +63,9 @@
  #endif
  #include <signal.h>
@@ -10544,8 +10544,8 @@ diff -Nur openssh-9.9p1.orig/packet.c openssh-9.9p1/packet.c
 +        return ssh->state->receive_context;
 +}
 diff -Nur openssh-9.9p1.orig/packet.h openssh-9.9p1/packet.h
---- openssh-9.9p1.orig/packet.h	2025-01-20 20:48:33.397582108 +0100
-+++ openssh-9.9p1/packet.h	2025-01-20 20:50:04.585813814 +0100
+--- openssh-9.9p1.orig/packet.h	2025-03-06 00:02:47.476894520 +0100
++++ openssh-9.9p1/packet.h	2025-03-06 00:03:46.294844410 +0100
 @@ -88,6 +88,17 @@
  
  	/* APP data */
@@ -10589,7 +10589,7 @@ diff -Nur openssh-9.9p1.orig/packet.h openssh-9.9p1/packet.h
  int	sshpkt_start(struct ssh *ssh, u_char type);
 diff -Nur openssh-9.9p1.orig/poly1305.c openssh-9.9p1/poly1305.c
 --- openssh-9.9p1.orig/poly1305.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/poly1305.c	2025-01-20 20:50:04.586813817 +0100
++++ openssh-9.9p1/poly1305.c	2025-03-06 00:03:46.295372696 +0100
 @@ -13,6 +13,16 @@
  
  #include "poly1305.h"
@@ -10623,7 +10623,7 @@ diff -Nur openssh-9.9p1.orig/poly1305.c openssh-9.9p1/poly1305.c
 +#endif /* OPENSSL_HAVE_POLY_EVP */
 diff -Nur openssh-9.9p1.orig/poly1305.h openssh-9.9p1/poly1305.h
 --- openssh-9.9p1.orig/poly1305.h	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/poly1305.h	2025-01-20 20:50:04.586813817 +0100
++++ openssh-9.9p1/poly1305.h	2025-03-06 00:03:46.295740329 +0100
 @@ -13,8 +13,15 @@
  #define POLY1305_KEYLEN		32
  #define POLY1305_TAGLEN		16
@@ -10643,7 +10643,7 @@ diff -Nur openssh-9.9p1.orig/poly1305.h openssh-9.9p1/poly1305.h
      __attribute__((__bounded__(__minbytes__, 4, POLY1305_KEYLEN)));
 diff -Nur openssh-9.9p1.orig/progressmeter.c openssh-9.9p1/progressmeter.c
 --- openssh-9.9p1.orig/progressmeter.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/progressmeter.c	2025-01-20 20:50:04.586813817 +0100
++++ openssh-9.9p1/progressmeter.c	2025-03-06 00:03:46.296169377 +0100
 @@ -66,6 +66,8 @@
  static off_t start_pos;		/* initial position of transfer */
  static off_t end_pos;		/* ending position of transfer */
@@ -10703,8 +10703,8 @@ diff -Nur openssh-9.9p1.orig/progressmeter.c openssh-9.9p1/progressmeter.c
  
  static void
 diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
---- openssh-9.9p1.orig/readconf.c	2025-01-20 20:48:33.452582247 +0100
-+++ openssh-9.9p1/readconf.c	2025-01-20 21:03:08.963813150 +0100
+--- openssh-9.9p1.orig/readconf.c	2025-03-06 00:02:47.571947367 +0100
++++ openssh-9.9p1/readconf.c	2025-03-06 00:03:46.296928830 +0100
 @@ -72,6 +72,7 @@
  #include "myproposal.h"
  #include "digest.h"
@@ -10758,7 +10758,7 @@ diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
  	}
  	return port;
  }
-@@ -1317,6 +1333,63 @@
+@@ -1335,6 +1351,63 @@
  		intptr = &options->check_host_ip;
  		goto parse_flag;
  
@@ -10822,7 +10822,7 @@ diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
  	case oVerifyHostKeyDNS:
  		intptr = &options->verify_host_key_dns;
  		multistate_ptr = multistate_yesnoask;
-@@ -2712,6 +2785,17 @@
+@@ -2730,6 +2803,17 @@
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->request_tty = -1;
@@ -10840,7 +10840,7 @@ diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
  	options->session_type = -1;
  	options->stdin_null = -1;
  	options->fork_after_authentication = -1;
-@@ -2895,8 +2979,37 @@
+@@ -2913,8 +2997,37 @@
  		options->server_alive_interval = 0;
  	if (options->server_alive_count_max == -1)
  		options->server_alive_count_max = 3;
@@ -10879,8 +10879,8 @@ diff -Nur openssh-9.9p1.orig/readconf.c openssh-9.9p1/readconf.c
  		options->control_persist = 0;
  		options->control_persist_timeout = 0;
 diff -Nur openssh-9.9p1.orig/readconf.h openssh-9.9p1/readconf.h
---- openssh-9.9p1.orig/readconf.h	2025-01-20 20:48:33.452582247 +0100
-+++ openssh-9.9p1/readconf.h	2025-01-21 07:26:17.608445051 +0100
+--- openssh-9.9p1.orig/readconf.h	2025-03-06 00:02:47.572498872 +0100
++++ openssh-9.9p1/readconf.h	2025-03-06 00:03:46.298406263 +0100
 @@ -56,6 +56,8 @@
  	int     strict_host_key_checking;	/* Strict host key checking. */
  	int     compression;	/* Compress packets in both directions. */
@@ -10910,7 +10910,7 @@ diff -Nur openssh-9.9p1.orig/readconf.h openssh-9.9p1/readconf.h
  	int	server_alive_interval;
 diff -Nur openssh-9.9p1.orig/README.md openssh-9.9p1/README.md
 --- openssh-9.9p1.orig/README.md	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/README.md	2025-01-20 20:50:04.588813822 +0100
++++ openssh-9.9p1/README.md	2025-03-06 00:03:46.298977721 +0100
 @@ -1,12 +1,16 @@
 -# Portable OpenSSH
 +# HPNSSH: Based on Portable OpenSSH
@@ -10988,8 +10988,8 @@ diff -Nur openssh-9.9p1.orig/README.md openssh-9.9p1/README.md
  ## Development
  
 diff -Nur openssh-9.9p1.orig/sandbox-seccomp-filter.c openssh-9.9p1/sandbox-seccomp-filter.c
---- openssh-9.9p1.orig/sandbox-seccomp-filter.c	2025-01-20 20:48:33.408582135 +0100
-+++ openssh-9.9p1/sandbox-seccomp-filter.c	2025-01-20 20:50:04.589813825 +0100
+--- openssh-9.9p1.orig/sandbox-seccomp-filter.c	2025-03-06 00:02:47.494624114 +0100
++++ openssh-9.9p1/sandbox-seccomp-filter.c	2025-03-06 00:03:46.299287453 +0100
 @@ -295,6 +295,9 @@
  #ifdef __NR_geteuid32
  	SC_ALLOW(__NR_geteuid32),
@@ -11011,8 +11011,8 @@ diff -Nur openssh-9.9p1.orig/sandbox-seccomp-filter.c openssh-9.9p1/sandbox-secc
  	SC_ALLOW(__NR_time),
  #endif
 diff -Nur openssh-9.9p1.orig/scp.1 openssh-9.9p1/scp.1
---- openssh-9.9p1.orig/scp.1	2025-01-20 20:48:33.380582065 +0100
-+++ openssh-9.9p1/scp.1	2025-01-20 22:18:33.595608452 +0100
+--- openssh-9.9p1.orig/scp.1	2025-03-06 00:02:47.452547228 +0100
++++ openssh-9.9p1/scp.1	2025-03-06 00:03:46.299581622 +0100
 @@ -18,7 +18,7 @@
  .Nd OpenSSH secure file copy
  .Sh SYNOPSIS
@@ -11070,8 +11070,8 @@ diff -Nur openssh-9.9p1.orig/scp.1 openssh-9.9p1/scp.1
  The legacy SCP protocol (selected by the
  .Fl O
 diff -Nur openssh-9.9p1.orig/scp.c openssh-9.9p1/scp.c
---- openssh-9.9p1.orig/scp.c	2025-01-20 20:48:33.382582070 +0100
-+++ openssh-9.9p1/scp.c	2025-01-21 07:44:00.216159475 +0100
+--- openssh-9.9p1.orig/scp.c	2025-03-06 00:02:47.455427828 +0100
++++ openssh-9.9p1/scp.c	2025-03-06 00:03:46.299929309 +0100
 @@ -17,6 +17,7 @@
  /*
   * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
@@ -12041,8 +12041,8 @@ diff -Nur openssh-9.9p1.orig/scp.c openssh-9.9p1/scp.c
  cleanup_exit(int i)
  {
 diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
---- openssh-9.9p1.orig/servconf.c	2025-01-20 20:48:33.453582249 +0100
-+++ openssh-9.9p1/servconf.c	2025-01-20 22:27:14.328008145 +0100
+--- openssh-9.9p1.orig/servconf.c	2025-03-06 00:02:47.572857133 +0100
++++ openssh-9.9p1/servconf.c	2025-03-06 00:03:46.301235473 +0100
 @@ -215,6 +215,11 @@
  	options->authorized_principals_file = NULL;
  	options->authorized_principals_command = NULL;
@@ -12103,7 +12103,7 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
  			*flags = keywords[i].flags;
  			return keywords[i].opcode;
  		}
-@@ -1593,12 +1618,32 @@
+@@ -1620,12 +1645,32 @@
  		multistate_ptr = multistate_ignore_rhosts;
  		goto parse_multistate;
  
@@ -12137,8 +12137,8 @@ diff -Nur openssh-9.9p1.orig/servconf.c openssh-9.9p1/servconf.c
  		intptr = &options->hostbased_authentication;
  		goto parse_flag;
 diff -Nur openssh-9.9p1.orig/servconf.h openssh-9.9p1/servconf.h
---- openssh-9.9p1.orig/servconf.h	2025-01-20 20:48:33.453582249 +0100
-+++ openssh-9.9p1/servconf.h	2025-01-20 22:28:39.829229874 +0100
+--- openssh-9.9p1.orig/servconf.h	2025-03-06 00:02:47.573461068 +0100
++++ openssh-9.9p1/servconf.h	2025-03-06 00:03:46.302105841 +0100
 @@ -226,6 +226,12 @@
  	char   *pam_service_name;
  	int	permit_pam_user_change;	/* Allow PAM to change user name */
@@ -12153,8 +12153,8 @@ diff -Nur openssh-9.9p1.orig/servconf.h openssh-9.9p1/servconf.h
  
  	char   **permitted_opens;	/* May also be one of PERMITOPEN_* */
 diff -Nur openssh-9.9p1.orig/serverloop.c openssh-9.9p1/serverloop.c
---- openssh-9.9p1.orig/serverloop.c	2025-01-20 20:48:33.440582216 +0100
-+++ openssh-9.9p1/serverloop.c	2025-01-20 22:30:36.463532350 +0100
+--- openssh-9.9p1.orig/serverloop.c	2025-03-06 00:02:47.555664287 +0100
++++ openssh-9.9p1/serverloop.c	2025-03-06 00:03:46.302523774 +0100
 @@ -81,6 +81,8 @@
  #include "serverloop.h"
  #include "ssherr.h"
@@ -12277,8 +12277,8 @@ diff -Nur openssh-9.9p1.orig/serverloop.c openssh-9.9p1/serverloop.c
  	/* XXX sshpkt_get_end() */
  	if (want_reply) {
 diff -Nur openssh-9.9p1.orig/session.c openssh-9.9p1/session.c
---- openssh-9.9p1.orig/session.c	2025-01-20 20:48:33.402582120 +0100
-+++ openssh-9.9p1/session.c	2025-01-20 20:50:04.595813840 +0100
+--- openssh-9.9p1.orig/session.c	2025-03-06 00:02:47.485220859 +0100
++++ openssh-9.9p1/session.c	2025-03-06 00:03:46.303031230 +0100
 @@ -94,6 +94,7 @@
  #include "monitor_wrap.h"
  #include "sftp.h"
@@ -12317,7 +12317,7 @@ diff -Nur openssh-9.9p1.orig/session.c openssh-9.9p1/session.c
  
 diff -Nur openssh-9.9p1.orig/sftp.1 openssh-9.9p1/sftp.1
 --- openssh-9.9p1.orig/sftp.1	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/sftp.1	2025-01-20 20:50:04.595813840 +0100
++++ openssh-9.9p1/sftp.1	2025-03-06 00:03:46.303472864 +0100
 @@ -299,7 +299,8 @@
  Specify how many requests may be outstanding at any one time.
  Increasing this may slightly improve file transfer speed
@@ -12344,8 +12344,8 @@ diff -Nur openssh-9.9p1.orig/sftp.1 openssh-9.9p1/sftp.1
  .El
  .El
 diff -Nur openssh-9.9p1.orig/sftp.c openssh-9.9p1/sftp.c
---- openssh-9.9p1.orig/sftp.c	2025-01-20 20:48:33.383582072 +0100
-+++ openssh-9.9p1/sftp.c	2025-01-20 20:50:04.596813843 +0100
+--- openssh-9.9p1.orig/sftp.c	2025-03-06 00:02:47.457498062 +0100
++++ openssh-9.9p1/sftp.c	2025-03-06 00:03:46.303799747 +0100
 @@ -2569,20 +2569,25 @@
  			/* Please keep in sync with ssh.c -X */
  			if (strncmp(optarg, "buffer=", 7) == 0) {
@@ -12378,8 +12378,8 @@ diff -Nur openssh-9.9p1.orig/sftp.c openssh-9.9p1/sftp.c
  				}
  				num_requests = (size_t)llv;
 diff -Nur openssh-9.9p1.orig/sftp-client.c openssh-9.9p1/sftp-client.c
---- openssh-9.9p1.orig/sftp-client.c	2025-01-20 20:48:33.382582070 +0100
-+++ openssh-9.9p1/sftp-client.c	2025-01-20 20:50:04.596813843 +0100
+--- openssh-9.9p1.orig/sftp-client.c	2025-03-06 00:02:47.456913565 +0100
++++ openssh-9.9p1/sftp-client.c	2025-03-06 00:03:46.304241330 +0100
 @@ -72,7 +72,8 @@
  #define DEFAULT_COPY_BUFLEN	32768
  
@@ -12391,8 +12391,8 @@ diff -Nur openssh-9.9p1.orig/sftp-client.c openssh-9.9p1/sftp-client.c
  /* Minimum amount of data to read at a time */
  #define MIN_READ_SIZE	512
 diff -Nur openssh-9.9p1.orig/ssh.1 openssh-9.9p1/ssh.1
---- openssh-9.9p1.orig/ssh.1	2025-01-20 20:48:33.453582249 +0100
-+++ openssh-9.9p1/ssh.1	2025-01-20 21:06:00.112249282 +0100
+--- openssh-9.9p1.orig/ssh.1	2025-03-06 00:02:47.573721054 +0100
++++ openssh-9.9p1/ssh.1	2025-03-06 00:03:46.304641917 +0100
 @@ -77,6 +77,14 @@
  X11 connections, arbitrary TCP ports and
  .Ux Ns -domain
@@ -12485,7 +12485,7 @@ diff -Nur openssh-9.9p1.orig/ssh.1 openssh-9.9p1/ssh.1
 +Foundation.
 diff -Nur openssh-9.9p1.orig/ssh_api.c openssh-9.9p1/ssh_api.c
 --- openssh-9.9p1.orig/ssh_api.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/ssh_api.c	2025-01-20 20:50:04.598813848 +0100
++++ openssh-9.9p1/ssh_api.c	2025-03-06 00:03:46.304987518 +0100
 @@ -427,7 +427,7 @@
  	char *cp;
  	int r;
@@ -12497,7 +12497,7 @@ diff -Nur openssh-9.9p1.orig/ssh_api.c openssh-9.9p1/ssh_api.c
  		return r;
 diff -Nur openssh-9.9p1.orig/sshbuf.c openssh-9.9p1/sshbuf.c
 --- openssh-9.9p1.orig/sshbuf.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/sshbuf.c	2025-01-20 20:50:04.598813848 +0100
++++ openssh-9.9p1/sshbuf.c	2025-03-06 00:03:46.305297731 +0100
 @@ -27,6 +27,9 @@
  #define SSHBUF_INTERNAL
  #include "sshbuf.h"
@@ -12616,7 +12616,7 @@ diff -Nur openssh-9.9p1.orig/sshbuf.c openssh-9.9p1/sshbuf.c
  		SSHBUF_DBG(("realloc fail"));
 diff -Nur openssh-9.9p1.orig/sshbuf.h openssh-9.9p1/sshbuf.h
 --- openssh-9.9p1.orig/sshbuf.h	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/sshbuf.h	2025-01-20 20:50:04.598813848 +0100
++++ openssh-9.9p1/sshbuf.h	2025-03-06 00:03:46.305570694 +0100
 @@ -29,18 +29,49 @@
  # endif /* OPENSSL_HAS_ECC */
  #endif /* WITH_OPENSSL */
@@ -12696,8 +12696,8 @@ diff -Nur openssh-9.9p1.orig/sshbuf.h openssh-9.9p1/sshbuf.h
  #ifdef SSHBUF_INTERNAL
  
 diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
---- openssh-9.9p1.orig/ssh.c	2025-01-20 20:48:33.454582252 +0100
-+++ openssh-9.9p1/ssh.c	2025-01-20 20:50:04.599813850 +0100
+--- openssh-9.9p1.orig/ssh.c	2025-03-06 00:02:47.574118417 +0100
++++ openssh-9.9p1/ssh.c	2025-03-06 00:03:46.305952260 +0100
 @@ -109,6 +109,7 @@
  #include "ssherr.h"
  #include "myproposal.h"
@@ -12706,7 +12706,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  
  #ifdef ENABLE_PKCS11
  #include "ssh-pkcs11.h"
-@@ -1113,6 +1114,10 @@
+@@ -1124,6 +1125,10 @@
  			break;
  		case 'T':
  			options.request_tty = REQUEST_TTY_NO;
@@ -12717,7 +12717,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  			break;
  		case 'o':
  			line = xstrdup(optarg);
-@@ -1682,10 +1687,36 @@
+@@ -1693,9 +1698,35 @@
  	}
  
  	/* Open a connection to the remote host. */
@@ -12729,8 +12729,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
 +tryagain:
  	if (ssh_connect(ssh, host, options.host_arg, addrs, &hostaddr,
  	    options.port, options.connection_attempts,
--	    &timeout_ms, options.tcp_keep_alive) != 0)
-+	    &timeout_ms, options.tcp_keep_alive) != 0) {
+ 	    &timeout_ms, options.tcp_keep_alive) != 0) {
 +		/* could not connect. If the port requested is the same as
 +		 * hpnssh default port then fallback. Otherwise, exit */
 +		if ((options.port == default_ssh_port()) && options.fallback) {
@@ -12748,14 +12747,13 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
 +					     cname, sizeof(cname));
 +			goto tryagain;
 +		} else {
++			redhat_usage();
 +			exit(255);
 +		}
+ 		redhat_usage();
  		exit(255);
-+	}
- 
- 	if (addrs != NULL)
- 		freeaddrinfo(addrs);
-@@ -1896,7 +1927,7 @@
+ 	}
+@@ -1909,7 +1940,7 @@
  
  /* Do fork() after authentication. Used by "ssh -f" */
  static void
@@ -12764,7 +12762,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  {
  	if (need_controlpersist_detach)
  		control_persist_detach();
-@@ -1906,17 +1937,21 @@
+@@ -1919,17 +1950,21 @@
  		fatal("daemon() failed: %.200s", strerror(errno));
  	if (stdfd_devnull(1, 1, !(log_is_on_stderr() && debug_flag)) == -1)
  		error_f("stdfd_devnull failed");
@@ -12788,7 +12786,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  	} else {
  		debug2_f("%d expected forwarding replies remaining",
  		    forward_confirms_pending);
-@@ -1983,7 +2018,7 @@
+@@ -1996,7 +2031,7 @@
  				    "for listen port %d", rfwd->listen_port);
  		}
  	}
@@ -12797,7 +12795,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  }
  
  static void
-@@ -2010,7 +2045,7 @@
+@@ -2023,7 +2058,7 @@
  	}
  
  	debug_f("tunnel forward established, id=%d", id);
@@ -12806,7 +12804,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  }
  
  static void
-@@ -2211,6 +2246,15 @@
+@@ -2224,6 +2259,15 @@
  	    NULL, fileno(stdin), command, environ);
  }
  
@@ -12822,7 +12820,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  /* open new channel for a session */
  static int
  ssh_session2_open(struct ssh *ssh)
-@@ -2232,6 +2276,7 @@
+@@ -2245,6 +2289,7 @@
  	window = CHAN_SES_WINDOW_DEFAULT;
  	packetmax = CHAN_SES_PACKET_DEFAULT;
  	if (tty_flag) {
@@ -12830,7 +12828,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  		window >>= 1;
  		packetmax >>= 1;
  	}
-@@ -2240,6 +2285,12 @@
+@@ -2253,6 +2298,12 @@
  	    window, packetmax, CHAN_EXTENDED_WRITE,
  	    "client-session", CHANNEL_NONBLOCK_STDIO);
  
@@ -12843,7 +12841,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  	debug3_f("channel_new: %d", c->self);
  
  	channel_send_open(ssh, c->self);
-@@ -2256,6 +2307,13 @@
+@@ -2269,6 +2320,13 @@
  	int r, interactive, id = -1;
  	char *cp, *tun_fwd_ifname = NULL;
  
@@ -12857,7 +12855,7 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  	/* XXX should be pre-session */
  	if (!options.control_persist)
  		ssh_init_stdio_forwarding(ssh);
-@@ -2354,7 +2412,14 @@
+@@ -2367,7 +2425,14 @@
  			debug("deferring postauth fork until remote forward "
  			    "confirmation received");
  		} else
@@ -12874,8 +12872,8 @@ diff -Nur openssh-9.9p1.orig/ssh.c openssh-9.9p1/ssh.c
  
  	return client_loop(ssh, tty_flag, tty_flag ?
 diff -Nur openssh-9.9p1.orig/ssh_config.5 openssh-9.9p1/ssh_config.5
---- openssh-9.9p1.orig/ssh_config.5	2025-01-20 20:48:33.454582252 +0100
-+++ openssh-9.9p1/ssh_config.5	2025-01-20 20:50:04.600813853 +0100
+--- openssh-9.9p1.orig/ssh_config.5	2025-03-06 00:02:47.574702687 +0100
++++ openssh-9.9p1/ssh_config.5	2025-03-06 00:03:46.307757180 +0100
 @@ -62,6 +62,19 @@
  .Pq Pa /etc/ssh/ssh_config
  .El
@@ -13045,8 +13043,8 @@ diff -Nur openssh-9.9p1.orig/ssh_config.5 openssh-9.9p1/ssh_config.5
 +with grants from Cisco, the National Library of Medicine, and 
 +the National Science Foundation.
 diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
---- openssh-9.9p1.orig/sshconnect2.c	2025-01-20 20:48:33.455582254 +0100
-+++ openssh-9.9p1/sshconnect2.c	2025-01-20 20:50:04.601813855 +0100
+--- openssh-9.9p1.orig/sshconnect2.c	2025-03-06 00:02:47.575075435 +0100
++++ openssh-9.9p1/sshconnect2.c	2025-03-06 00:03:46.309944495 +0100
 @@ -76,6 +76,7 @@
  #include "utf8.h"
  #include "ssh-sk.h"
@@ -13113,8 +13111,8 @@ diff -Nur openssh-9.9p1.orig/sshconnect2.c openssh-9.9p1/sshconnect2.c
  		verbose("Authenticated to %s ([%s]:%d) using \"%s\".", host,
  		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
 diff -Nur openssh-9.9p1.orig/sshd.8 openssh-9.9p1/sshd.8
---- openssh-9.9p1.orig/sshd.8	2025-01-20 20:48:33.455582254 +0100
-+++ openssh-9.9p1/sshd.8	2025-01-20 20:50:04.601813855 +0100
+--- openssh-9.9p1.orig/sshd.8	2025-03-06 00:02:47.575467713 +0100
++++ openssh-9.9p1/sshd.8	2025-03-06 00:03:46.310931002 +0100
 @@ -1079,3 +1079,7 @@
  protocol versions 1.5 and 2.0.
  Niels Provos and Markus Friedl contributed support
@@ -13124,8 +13122,8 @@ diff -Nur openssh-9.9p1.orig/sshd.8 openssh-9.9p1/sshd.8
 +from Cisco, the National Library of Medicine, and the National Science
 +Foundation. 
 diff -Nur openssh-9.9p1.orig/sshd.c openssh-9.9p1/sshd.c
---- openssh-9.9p1.orig/sshd.c	2025-01-20 20:48:33.410582141 +0100
-+++ openssh-9.9p1/sshd.c	2025-01-20 20:50:04.602813858 +0100
+--- openssh-9.9p1.orig/sshd.c	2025-03-06 00:02:47.498532392 +0100
++++ openssh-9.9p1/sshd.c	2025-03-06 00:03:46.311364199 +0100
 @@ -760,6 +760,8 @@
  	int ret, listen_sock;
  	struct addrinfo *ai;
@@ -13167,8 +13165,8 @@ diff -Nur openssh-9.9p1.orig/sshd.c openssh-9.9p1/sshd.c
  	if (options.authorized_keys_command_user == NULL &&
  	    (options.authorized_keys_command != NULL &&
 diff -Nur openssh-9.9p1.orig/sshd_config openssh-9.9p1/sshd_config
---- openssh-9.9p1.orig/sshd_config	2025-01-20 20:48:33.456582257 +0100
-+++ openssh-9.9p1/sshd_config	2025-01-20 21:06:55.293389906 +0100
+--- openssh-9.9p1.orig/sshd_config	2025-03-06 00:02:47.575729549 +0100
++++ openssh-9.9p1/sshd_config	2025-03-06 00:03:46.311771393 +0100
 @@ -18,7 +18,7 @@
  # SELinux about this change.
  # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
@@ -13199,8 +13197,8 @@ diff -Nur openssh-9.9p1.orig/sshd_config openssh-9.9p1/sshd_config
  #Match User anoncvs
  #	X11Forwarding no
 diff -Nur openssh-9.9p1.orig/sshd_config.5 openssh-9.9p1/sshd_config.5
---- openssh-9.9p1.orig/sshd_config.5	2025-01-20 20:48:33.456582257 +0100
-+++ openssh-9.9p1/sshd_config.5	2025-01-20 20:50:04.604813863 +0100
+--- openssh-9.9p1.orig/sshd_config.5	2025-03-06 00:02:47.576117771 +0100
++++ openssh-9.9p1/sshd_config.5	2025-03-06 00:03:46.312158063 +0100
 @@ -56,6 +56,16 @@
  .Pq \&"
  in order to represent arguments containing spaces.
@@ -13288,8 +13286,8 @@ diff -Nur openssh-9.9p1.orig/sshd_config.5 openssh-9.9p1/sshd_config.5
 +with grants from Cisco, the National Library of Medicine, and 
 +the National Science Foundation. 
 diff -Nur openssh-9.9p1.orig/sshd-session.c openssh-9.9p1/sshd-session.c
---- openssh-9.9p1.orig/sshd-session.c	2025-01-20 20:48:33.457582259 +0100
-+++ openssh-9.9p1/sshd-session.c	2025-01-20 20:50:04.604813863 +0100
+--- openssh-9.9p1.orig/sshd-session.c	2025-03-06 00:02:47.578548500 +0100
++++ openssh-9.9p1/sshd-session.c	2025-03-06 00:03:46.312830269 +0100
 @@ -1196,6 +1196,20 @@
  	}
  	endpwent();
@@ -13335,7 +13333,7 @@ diff -Nur openssh-9.9p1.orig/sshd-session.c openssh-9.9p1/sshd-session.c
  		    options.rekey_interval);
 diff -Nur openssh-9.9p1.orig/ssh.h openssh-9.9p1/ssh.h
 --- openssh-9.9p1.orig/ssh.h	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/ssh.h	2025-01-20 20:50:04.605813865 +0100
++++ openssh-9.9p1/ssh.h	2025-03-06 00:03:46.313350852 +0100
 @@ -17,6 +17,7 @@
  
  /* Default port number. */
@@ -13354,8 +13352,8 @@ diff -Nur openssh-9.9p1.orig/ssh.h openssh-9.9p1/ssh.h
  /*
   * Name of the environment variable containing the process ID of the
 diff -Nur openssh-9.9p1.orig/sshkey.c openssh-9.9p1/sshkey.c
---- openssh-9.9p1.orig/sshkey.c	2025-01-20 20:48:33.411582143 +0100
-+++ openssh-9.9p1/sshkey.c	2025-01-20 20:50:04.606813868 +0100
+--- openssh-9.9p1.orig/sshkey.c	2025-03-06 00:02:47.499384834 +0100
++++ openssh-9.9p1/sshkey.c	2025-03-06 00:03:46.313728891 +0100
 @@ -1778,7 +1778,8 @@
  	    stderr);
  #endif
@@ -13419,7 +13417,7 @@ diff -Nur openssh-9.9p1.orig/sshkey.c openssh-9.9p1/sshkey.c
  	    encrypted_len, 0, authlen)) != 0) {
 diff -Nur openssh-9.9p1.orig/sshkey-xmss.c openssh-9.9p1/sshkey-xmss.c
 --- openssh-9.9p1.orig/sshkey-xmss.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/sshkey-xmss.c	2025-01-20 20:50:04.606813868 +0100
++++ openssh-9.9p1/sshkey-xmss.c	2025-03-06 00:03:46.314567857 +0100
 @@ -903,9 +903,29 @@
  	    state->enc_keyiv == NULL ||
  	    state->enc_ciphername == NULL)
@@ -13506,7 +13504,7 @@ diff -Nur openssh-9.9p1.orig/sshkey-xmss.c openssh-9.9p1/sshkey-xmss.c
  		goto out;
 diff -Nur openssh-9.9p1.orig/umac.c openssh-9.9p1/umac.c
 --- openssh-9.9p1.orig/umac.c	2024-09-20 00:20:48.000000000 +0200
-+++ openssh-9.9p1/umac.c	2025-01-20 20:50:04.607813871 +0100
++++ openssh-9.9p1/umac.c	2025-03-06 00:03:46.314996446 +0100
 @@ -134,15 +134,48 @@
  /* --- Endian Conversion --- Forcing assembly on some platforms           */
  /* ---------------------------------------------------------------------- */
@@ -13561,7 +13559,7 @@ diff -Nur openssh-9.9p1.orig/umac.c openssh-9.9p1/umac.c
  /* ---------------------------------------------------------------------- */
 diff -Nur openssh-9.9p1.orig/uthash.h openssh-9.9p1/uthash.h
 --- openssh-9.9p1.orig/uthash.h	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-9.9p1/uthash.h	2025-01-20 20:50:04.608813873 +0100
++++ openssh-9.9p1/uthash.h	2025-03-06 00:03:46.315743751 +0100
 @@ -0,0 +1,1140 @@
 +/*
 +Copyright (c) 2003-2022, Troy D. Hanson  https://troydhanson.github.io/uthash/
@@ -14704,8 +14702,8 @@ diff -Nur openssh-9.9p1.orig/uthash.h openssh-9.9p1/uthash.h
 +
 +#endif /* UTHASH_H */
 diff -Nur openssh-9.9p1.orig/version.h openssh-9.9p1/version.h
---- openssh-9.9p1.orig/version.h	2025-01-20 20:48:33.457582259 +0100
-+++ openssh-9.9p1/version.h	2025-01-20 21:09:18.648755010 +0100
+--- openssh-9.9p1.orig/version.h	2025-03-06 00:02:47.580790077 +0100
++++ openssh-9.9p1/version.h	2025-03-06 00:03:46.315977822 +0100
 @@ -16,5 +16,6 @@
  
  #define SSH_PORTABLE	"p1"
diff --git a/openssh-9.9p1-match-regression.patch b/openssh-9.9p1-match-regression.patch
new file mode 100644
index 0000000..d724401
--- /dev/null
+++ b/openssh-9.9p1-match-regression.patch
@@ -0,0 +1,463 @@
+diff --git a/misc.c b/misc.c
+index afdf5142..1b4b55c5 100644
+--- a/misc.c
++++ b/misc.c
+@@ -107,6 +107,27 @@ rtrim(char *s)
+ 	}
+ }
+ 
++/*
++ * returns pointer to character after 'prefix' in 's' or otherwise NULL
++ * if the prefix is not present.
++ */
++const char *
++strprefix(const char *s, const char *prefix, int ignorecase)
++{
++	size_t prefixlen;
++
++	if ((prefixlen = strlen(prefix)) == 0)
++		return s;
++	if (ignorecase) {
++		if (strncasecmp(s, prefix, prefixlen) != 0)
++			return NULL;
++	} else {
++		if (strncmp(s, prefix, prefixlen) != 0)
++			return NULL;
++	}
++	return s + prefixlen;
++}
++
+ /* set/unset filedescriptor to non-blocking */
+ int
+ set_nonblock(int fd)
+diff --git a/misc.h b/misc.h
+index 11340389..efecdf1a 100644
+--- a/misc.h
++++ b/misc.h
+@@ -56,6 +56,7 @@ struct ForwardOptions {
+ char	*chop(char *);
+ void	 rtrim(char *);
+ void	skip_space(char **);
++const char *strprefix(const char *, const char *, int);
+ char	*strdelim(char **);
+ char	*strdelimw(char **);
+ int	 set_nonblock(int);
+diff --git a/readconf.c b/readconf.c
+index 3d9cc6db..9f559269 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -710,7 +710,7 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+     struct passwd *pw, const char *host_arg, const char *original_host,
+     int final_pass, int *want_final_pass, const char *filename, int linenum)
+ {
+-	char *arg, *oattrib, *attrib, *cmd, *host, *criteria;
++	char *arg, *oattrib = NULL, *attrib = NULL, *cmd, *host, *criteria;
+ 	const char *ruser;
+ 	int r, this_result, result = 1, attributes = 0, negate;
+ 
+@@ -731,7 +731,8 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+ 
+ 	debug2("checking match for '%s' host %s originally %s",
+ 	    full_line, host, original_host);
+-	while ((oattrib = attrib = argv_next(acp, avp)) != NULL) {
++	while ((attrib = argv_next(acp, avp)) != NULL) {
++		attrib = oattrib = xstrdup(attrib);
+ 		/* Terminate on comment */
+ 		if (*attrib == '#') {
+ 			argv_consume(acp);
+@@ -777,9 +778,23 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+ 			    this_result ? "" : "not ", oattrib);
+ 			continue;
+ 		}
++
++		/* Keep this list in sync with below */
++		if (strprefix(attrib, "host=", 1)  != NULL ||
++		    strprefix(attrib, "originalhost=", 1) != NULL ||
++		    strprefix(attrib, "user=", 1) != NULL ||
++		    strprefix(attrib, "localuser=", 1) != NULL ||
++		    strprefix(attrib, "localnetwork=", 1) != NULL ||
++		    strprefix(attrib, "tagged=", 1) != NULL ||
++		    strprefix(attrib, "exec=", 1) != NULL) {
++			arg = strchr(attrib, '=');
++			*(arg++) = '\0';
++		} else {
++			arg = argv_next(acp, avp);
++		}
++
+ 		/* All other criteria require an argument */
+-		if ((arg = argv_next(acp, avp)) == NULL ||
+-		    *arg == '\0' || *arg == '#') {
++		if (arg == NULL || *arg == '\0' || *arg == '#') {
+ 			error("Missing Match criteria for %s", attrib);
+ 			result = -1;
+ 			goto out;
+@@ -856,6 +871,8 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+ 		    criteria == NULL ? "" : criteria,
+ 		    criteria == NULL ? "" : "\"");
+ 		free(criteria);
++		free(oattrib);
++		oattrib = attrib = NULL;
+ 	}
+ 	if (attributes == 0) {
+ 		error("One or more attributes required for Match");
+@@ -865,6 +882,7 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+  out:
+ 	if (result != -1)
+ 		debug2("match %sfound", result ? "" : "not ");
++	free(oattrib);
+ 	free(host);
+ 	return result;
+ }
+diff --git a/servconf.c b/servconf.c
+index 89b8413e..dd774f46 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.c,v 1.418 2024/09/15 03:09:44 djm Exp $ */
++/* $OpenBSD: servconf.c,v 1.419 2024/09/25 01:24:04 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1033,7 +1033,7 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+     int line, struct connection_info *ci)
+ {
+ 	int result = 1, attributes = 0, port;
+-	char *arg, *attrib;
++	char *arg, *attrib = NULL, *oattrib;
+ 
+ 	if (ci == NULL)
+ 		debug3("checking syntax for 'Match %s'", full_line);
+@@ -1047,7 +1047,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 		    ci->laddress ? ci->laddress : "(null)", ci->lport);
+ 	}
+ 
+-	while ((attrib = argv_next(acp, avp)) != NULL) {
++	while ((oattrib = argv_next(acp, avp)) != NULL) {
++		attrib = xstrdup(oattrib);
+ 		/* Terminate on comment */
+ 		if (*attrib == '#') {
+ 			argv_consume(acp); /* mark all arguments consumed */
+@@ -1062,11 +1063,13 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 			    *arg != '\0' && *arg != '#')) {
+ 				error("'all' cannot be combined with other "
+ 				    "Match attributes");
+-				return -1;
++				result = -1;
++				goto out;
+ 			}
+ 			if (arg != NULL && *arg == '#')
+ 				argv_consume(acp); /* consume remaining args */
+-			return 1;
++			result = 1;
++			goto out;
+ 		}
+ 		/* Criterion "invalid-user" also has no argument */
+ 		if (strcasecmp(attrib, "invalid-user") == 0) {
+@@ -1078,11 +1081,26 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				debug("matched invalid-user at line %d", line);
+ 			continue;
+ 		}
++
++		/* Keep this list in sync with below */
++		if (strprefix(attrib, "user=", 1) != NULL ||
++		    strprefix(attrib, "group=", 1) != NULL ||
++		    strprefix(attrib, "host=", 1) != NULL ||
++		    strprefix(attrib, "address=", 1) != NULL ||
++		    strprefix(attrib, "localaddress=", 1) != NULL ||
++		    strprefix(attrib, "localport=", 1) != NULL ||
++		    strprefix(attrib, "rdomain=", 1) != NULL) {
++			arg = strchr(attrib, '=');
++			*(arg++) = '\0';
++		} else {
++			arg = argv_next(acp, avp);
++		}
++
+ 		/* All other criteria require an argument */
+-		if ((arg = argv_next(acp, avp)) == NULL ||
+-		    *arg == '\0' || *arg == '#') {
++		if (arg == NULL || *arg == '\0' || *arg == '#') {
+ 			error("Missing Match criteria for %s", attrib);
+-			return -1;
++			result = -1;
++			goto out;
+ 		}
+ 		if (strcasecmp(attrib, "user") == 0) {
+ 			if (ci == NULL || (ci->test && ci->user == NULL)) {
+@@ -1105,7 +1123,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				match_test_missing_fatal("Group", "user");
+ 			switch (match_cfg_line_group(arg, line, ci->user)) {
+ 			case -1:
+-				return -1;
++				result = -1;
++				goto out;
+ 			case 0:
+ 				result = 0;
+ 			}
+@@ -1141,7 +1160,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				result = 0;
+ 				break;
+ 			case -2:
+-				return -1;
++				result = -1;
++				goto out;
+ 			}
+ 		} else if (strcasecmp(attrib, "localaddress") == 0){
+ 			if (ci == NULL || (ci->test && ci->laddress == NULL)) {
+@@ -1166,13 +1186,15 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				result = 0;
+ 				break;
+ 			case -2:
+-				return -1;
++				result = -1;
++				goto out;
+ 			}
+ 		} else if (strcasecmp(attrib, "localport") == 0) {
+ 			if ((port = a2port(arg)) == -1) {
+ 				error("Invalid LocalPort '%s' on Match line",
+ 				    arg);
+-				return -1;
++				result = -1;
++				goto out;
+ 			}
+ 			if (ci == NULL || (ci->test && ci->lport == -1)) {
+ 				result = 0;
+@@ -1200,16 +1222,21 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				debug("user %.100s matched 'RDomain %.100s' at "
+ 				    "line %d", ci->rdomain, arg, line);
+ 		} else {
+-			error("Unsupported Match attribute %s", attrib);
+-			return -1;
++			error("Unsupported Match attribute %s", oattrib);
++			result = -1;
++			goto out;
+ 		}
++		free(attrib);
++		attrib = NULL;
+ 	}
+ 	if (attributes == 0) {
+ 		error("One or more attributes required for Match");
+ 		return -1;
+ 	}
+-	if (ci != NULL)
++ out:
++	if (ci != NULL && result != -1)
+ 		debug3("match %sfound", result ? "" : "not ");
++	free(attrib);
+ 	return result;
+ }
+ 
+diff --git a/regress/cfginclude.sh b/regress/cfginclude.sh
+index d442cdd6..97fd816f 100644
+--- a/regress/cfginclude.sh
++++ b/regress/cfginclude.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $
++#	$OpenBSD: cfginclude.sh,v 1.5 2024/09/27 01:05:54 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="config include"
+@@ -10,7 +10,7 @@ cat > $OBJ/ssh_config.i << _EOF
+ Match host a
+ 	Hostname aa
+ 
+-Match host b # comment
++Match host=b # comment
+ 	Hostname bb
+ 	Include $OBJ/ssh_config.i.*
+ 
+@@ -18,7 +18,7 @@ Match host c
+ 	Include $OBJ/ssh_config.i.*
+ 	Hostname cc
+ 
+-Match host m
++Match host=m !user xxxyfake
+ 	Include $OBJ/ssh_config.i.* # comment
+ 
+ Host d
+@@ -41,7 +41,7 @@ Match host xxxxxx
+ _EOF
+ 
+ cat > $OBJ/ssh_config.i.1 << _EOF
+-Match host a
++Match host=a
+ 	Hostname aaa
+ 
+ Match host b
+@@ -64,10 +64,10 @@ cat > $OBJ/ssh_config.i.2 << _EOF
+ Match host a
+ 	Hostname aaaa
+ 
+-Match host b
++Match host=b !user blahblahfake
+ 	Hostname bbbb
+ 
+-Match host c
++Match host=c
+ 	Hostname cccc
+ 
+ Host d
+@@ -142,7 +142,7 @@ trial a aa
+ 
+ # cleanup
+ rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out
+-#	$OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $
++#	$OpenBSD: cfginclude.sh,v 1.5 2024/09/27 01:05:54 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="config include"
+diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
+index 05a66685..2737a5f9 100644
+--- a/regress/cfgmatch.sh
++++ b/regress/cfgmatch.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: cfgmatch.sh,v 1.13 2021/06/08 06:52:43 djm Exp $
++#	$OpenBSD: cfgmatch.sh,v 1.14 2024/09/27 01:05:54 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="sshd_config match"
+@@ -26,7 +26,7 @@ start_client()
+ 			kill $client_pid
+ 			fatal "timeout waiting for background ssh"
+ 		fi
+-	done	
++	done
+ }
+ 
+ stop_client()
+@@ -119,40 +119,42 @@ stop_client
+ # requires knowledge of actual group memberships user running the test).
+ params="user:user:u1 host:host:h1 address:addr:1.2.3.4 \
+     localaddress:laddr:5.6.7.8 rdomain:rdomain:rdom1"
+-cp $OBJ/sshd_proxy_bak $OBJ/sshd_config
+-echo 'Banner /nomatch' >>$OBJ/sshd_config
+-for i in $params; do
+-	config=`echo $i | cut -f1 -d:`
+-	criteria=`echo $i | cut -f2 -d:`
+-	value=`echo $i | cut -f3 -d:`
+-	cat >>$OBJ/sshd_config <<EOD
+-	    Match $config $value
+-	      Banner /$value
++for separator in " " "=" ; do
++	cp $OBJ/sshd_proxy_bak $OBJ/sshd_config
++	echo 'Banner /nomatch' >>$OBJ/sshd_config
++	for i in $params; do
++		config=`echo $i | cut -f1 -d:`
++		criteria=`echo $i | cut -f2 -d:`
++		value=`echo $i | cut -f3 -d:`
++		cat >>$OBJ/sshd_config <<EOD
++		    Match ${config}${separator}${value}
++		      Banner /$value
+ EOD
+-done
++	done
+ 
+-${SUDO} ${SSHD} -f $OBJ/sshd_config -T >/dev/null || \
+-    fail "validate config for w/out spec"
+-
+-# Test matching each criteria.
+-for i in $params; do
+-	testcriteria=`echo $i | cut -f2 -d:`
+-	expected=/`echo $i | cut -f3 -d:`
+-	spec=""
+-	for j in $params; do
+-		config=`echo $j | cut -f1 -d:`
+-		criteria=`echo $j | cut -f2 -d:`
+-		value=`echo $j | cut -f3 -d:`
+-		if [ "$criteria" = "$testcriteria" ]; then
+-			spec="$criteria=$value,$spec"
+-		else
+-			spec="$criteria=1$value,$spec"
++	${SUDO} ${SSHD} -f $OBJ/sshd_config -T >/dev/null || \
++	    fail "validate config for w/out spec"
++
++	# Test matching each criteria.
++	for i in $params; do
++		testcriteria=`echo $i | cut -f2 -d:`
++		expected=/`echo $i | cut -f3 -d:`
++		spec=""
++		for j in $params; do
++			config=`echo $j | cut -f1 -d:`
++			criteria=`echo $j | cut -f2 -d:`
++			value=`echo $j | cut -f3 -d:`
++			if [ "$criteria" = "$testcriteria" ]; then
++				spec="$criteria=$value,$spec"
++			else
++				spec="$criteria=1$value,$spec"
++			fi
++		done
++		trace "test spec $spec"
++		result=`${SUDO} ${SSHD} -f $OBJ/sshd_config -T -C "$spec" | \
++		    awk '$1=="banner"{print $2}'`
++		if [ "$result" != "$expected" ]; then
++			fail "match $config expected $expected got $result"
+ 		fi
+ 	done
+-	trace "test spec $spec"
+-	result=`${SUDO} ${SSHD} -f $OBJ/sshd_config -T -C "$spec" | \
+-	    awk '$1=="banner"{print $2}'`
+-	if [ "$result" != "$expected" ]; then
+-		fail "match $config expected $expected got $result"
+-	fi
+ done
+diff --git a/regress/servcfginclude.sh b/regress/servcfginclude.sh
+index 518a703d..f67c3caa 100644
+--- a/regress/servcfginclude.sh
++++ b/regress/servcfginclude.sh
+@@ -4,14 +4,14 @@ tid="server config include"
+ 
+ cat > $OBJ/sshd_config.i << _EOF
+ HostKey $OBJ/host.ssh-ed25519
+-Match host a
++Match host=a
+ 	Banner /aa
+ 
+ Match host b
+ 	Banner /bb
+ 	Include $OBJ/sshd_config.i.* # comment
+ 
+-Match host c
++Match host=c
+ 	Include $OBJ/sshd_config.i.* # comment
+ 	Banner /cc
+ 
+@@ -25,7 +25,7 @@ Match Host e
+ 	Banner /ee
+ 	Include $OBJ/sshd_config.i.*
+ 
+-Match Host f
++Match Host=f
+ 	Include $OBJ/sshd_config.i.*
+ 	Banner /ff
+ 
+@@ -47,13 +47,13 @@ Match host b
+ Match host c
+ 	Banner /ccc
+ 
+-Match Host d
++Match Host=d
+ 	Banner /ddd
+ 
+ Match Host e
+ 	Banner /eee
+ 
+-Match Host f
++Match Host=f
+ 	Banner /fff
+ _EOF
+ 
+@@ -61,13 +61,13 @@ cat > $OBJ/sshd_config.i.2 << _EOF
+ Match host a
+ 	Banner /aaaa
+ 
+-Match host b
++Match host=b
+ 	Banner /bbbb
+ 
+ Match host c # comment
+ 	Banner /cccc
+ 
+-Match Host d
++Match Host=d
+ 	Banner /dddd
+ 
+ Match Host e

From f17ff3f5499baeda2cf5ccaacc86da6f9e016f67 Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Sun, 20 Apr 2025 06:55:05 +0200
Subject: [PATCH 2/2] Based on openssh-9.9p1-7.el10

---
 gsi-openssh.spec                     |   9 +-
 openssh-9.9p1-match-regression.patch |  10 +-
 openssh-9.9p2-error_processing.patch | 152 +++++++++++++++++++++++++++
 3 files changed, 169 insertions(+), 2 deletions(-)
 create mode 100644 openssh-9.9p2-error_processing.patch

diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index f37c40f..ebb20e3 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -24,7 +24,7 @@
 %global libedit 1
 
 %global openssh_ver 9.9p1
-%global openssh_rel 2
+%global openssh_rel 3
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -182,6 +182,9 @@ Patch1019: openssh-9.9p1-mlkembe.patch
 # upstream 3f02368e8e9121847727c46b280efc280e5eb615
 # upstream 67a115e7a56dbdc3f5a58c64b29231151f3670f5
 Patch1020: openssh-9.9p1-match-regression.patch
+# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
+# upstream 0832aac79517611dd4de93ad0a83577994d9c907
+Patch1021: openssh-9.9p2-error_processing.patch
 
 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
@@ -354,6 +357,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1018 -p1 -b .openssl-log
 %patch -P 1019 -p1 -b .mlkembe
 %patch -P 1020 -p1 -b .match
+%patch -P 1021 -p1 -b .errcode_set
 
 %patch -P 100 -p1 -b .coverity
 %patch -P 98 -p1 -b .gsi
@@ -578,6 +582,9 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Sun Apr 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-
+- Based on openssh-9.9p1-7.el10
+
 * Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-2
 - Based on openssh-9.9p1-5.el10.1
 
diff --git a/openssh-9.9p1-match-regression.patch b/openssh-9.9p1-match-regression.patch
index d724401..73ea964 100644
--- a/openssh-9.9p1-match-regression.patch
+++ b/openssh-9.9p1-match-regression.patch
@@ -137,7 +137,7 @@ index 89b8413e..dd774f46 100644
  		/* Terminate on comment */
  		if (*attrib == '#') {
  			argv_consume(acp); /* mark all arguments consumed */
-@@ -1062,11 +1063,13 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+@@ -1062,16 +1063,20 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
  			    *arg != '\0' && *arg != '#')) {
  				error("'all' cannot be combined with other "
  				    "Match attributes");
@@ -153,6 +153,14 @@ index 89b8413e..dd774f46 100644
  		}
  		/* Criterion "invalid-user" also has no argument */
  		if (strcasecmp(attrib, "invalid-user") == 0) {
+-			if (ci == NULL)
++			if (ci == NULL) {
++				result = 0;
+ 				continue;
++			}
+ 			if (ci->user_invalid == 0)
+ 				result = 0;
+ 			else
 @@ -1078,11 +1081,26 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
  				debug("matched invalid-user at line %d", line);
  			continue;
diff --git a/openssh-9.9p2-error_processing.patch b/openssh-9.9p2-error_processing.patch
new file mode 100644
index 0000000..692c6ac
--- /dev/null
+++ b/openssh-9.9p2-error_processing.patch
@@ -0,0 +1,152 @@
+diff --git a/krl.c b/krl.c
+index e2efdf06..0d0f6953 100644
+--- a/krl.c
++++ b/krl.c
+@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
+ 			break;
+ 		case KRL_SECTION_CERT_SERIAL_BITMAP:
+ 			if (rs->lo - bitmap_start > INT_MAX) {
++				r = SSH_ERR_INVALID_FORMAT;
+ 				error_f("insane bitmap gap");
+ 				goto out;
+ 			}
+@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
+ 	}
+ 
+ 	if ((krl = ssh_krl_init()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
+ 		error_f("alloc failed");
+ 		goto out;
+ 	}
+diff --git a/packet.c b/packet.c
+index 486f8515..9dea2cfc 100644
+--- a/packet.c
++++ b/packet.c
+@@ -1864,6 +1864,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ 			if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
+ 				return r;
+ 			DBG(debug("Received SSH2_MSG_PING len %zu", len));
++			if (!ssh->state->after_authentication) {
++				DBG(debug("Won't reply to PING in preauth"));
++				break;
++			}
++			if (ssh_packet_is_rekeying(ssh)) {
++				DBG(debug("Won't reply to PING during KEX"));
++				break;
++			}
+ 			if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
+ 			    (r = sshpkt_put_string(ssh, d, len)) != 0 ||
+ 			    (r = sshpkt_send(ssh)) != 0)
+diff --git a/ssh-agent.c b/ssh-agent.c
+index 48973b2c..c27c5a95 100644
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1220,6 +1220,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 	    "restrict-destination-v00@openssh.com") == 0) {
+ 		if (*dcsp != NULL) {
+ 			error_f("%s already set", ext_name);
++			r = SSH_ERR_INVALID_FORMAT;
+ 			goto out;
+ 		}
+ 		if ((r = sshbuf_froms(m, &b)) != 0) {
+@@ -1229,6 +1230,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		while (sshbuf_len(b) != 0) {
+ 			if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) {
+ 				error_f("too many %s constraints", ext_name);
++				r = SSH_ERR_INVALID_FORMAT;
+ 				goto out;
+ 			}
+ 			*dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1,
+@@ -1246,6 +1248,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		}
+ 		if (*certs != NULL) {
+ 			error_f("%s already set", ext_name);
++			r = SSH_ERR_INVALID_FORMAT;
+ 			goto out;
+ 		}
+ 		if ((r = sshbuf_get_u8(m, &v)) != 0 ||
+@@ -1257,6 +1260,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		while (sshbuf_len(b) != 0) {
+ 			if (*ncerts >= AGENT_MAX_EXT_CERTS) {
+ 				error_f("too many %s constraints", ext_name);
++				r = SSH_ERR_INVALID_FORMAT;
+ 				goto out;
+ 			}
+ 			*certs = xrecallocarray(*certs, *ncerts, *ncerts + 1,
+@@ -1757,6 +1761,7 @@ process_ext_session_bind(SocketEntry *e)
+ 	/* record new key/sid */
+ 	if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) {
+ 		error_f("too many session IDs recorded");
++		r = -1;
+ 		goto out;
+ 	}
+ 	e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids,
+diff --git a/ssh-sk-client.c b/ssh-sk-client.c
+index 321fe53a..06fad221 100644
+--- a/ssh-sk-client.c
++++ b/ssh-sk-client.c
+@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ 		}
+ 		if ((srk = calloc(1, sizeof(*srk))) == NULL) {
+ 			error_f("calloc failed");
++			r = SSH_ERR_ALLOC_FAIL;
+ 			goto out;
+ 		}
+ 		srk->key = key;
+@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ 		if ((tmp = recallocarray(srks, nsrks, nsrks + 1,
+ 		    sizeof(*srks))) == NULL) {
+ 			error_f("recallocarray keys failed");
++			r = SSH_ERR_ALLOC_FAIL;
+ 			goto out;
+ 		}
+ 		debug_f("srks[%zu]: %s %s uidlen %zu", nsrks,
+diff --git a/sshconnect2.c b/sshconnect2.c
+index a69c4da1..1ee6000a 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ 	    options.required_rsa_size)) != 0)
+ 		fatal_r(r, "Bad server host key");
+ 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+-	    xxx_conn_info) == -1)
++	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+ }
+@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 
+ 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ 		debug_f("server sent unknown pkalg %s", pkalg);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		error("input_userauth_pk_ok: type mismatch "
+ 		    "for decoded key (received %d, expected %d)",
+ 		    key->type, pktype);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 
+@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		    SSH_FP_DEFAULT);
+ 		error_f("server replied with unknown key: %s %s",
+ 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	ident = format_identity(id);
+diff --git a/sshsig.c b/sshsig.c
+index 6e03c0b0..3da005d6 100644
+--- a/sshsig.c
++++ b/sshsig.c
+@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum,
+ 	}
+ 	if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
+ 		error_f("buffer error");
++		r = SSH_ERR_ALLOC_FAIL;
+ 		goto out;
+ 	}
+ 	/* success */