Based on openssh-10.0p1-6.fc44

0001-openssh-7.8p1-role-mls.patch

@@ -1,46 +1,75 @@
-diff -up openssh/auth2.c.role-mls openssh/auth2.c
---- openssh/auth2.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/auth2.c	2018-08-22 11:14:56.815430916 +0200
-@@ -256,6 +256,9 @@ input_userauth_request(int type, u_int32
- 	Authctxt *authctxt = ssh->authctxt;
- 	Authmethod *m = NULL;
- 	char *user = NULL, *service = NULL, *method = NULL, *style = NULL;
+From 95f4e30195382c3df7104c2ad3e5e9953f8ad554 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 01/50] openssh-7.8p1-role-mls
+
+---
+ auth-pam.c                       |   2 +-
+ auth-pam.h                       |   2 +-
+ auth.h                           |   3 +
+ auth2-gss.c                      |  11 +-
+ auth2-hostbased.c                |   9 +
+ auth2-pubkey.c                   |  11 +-
+ auth2.c                          |  14 ++
+ misc.c                           |   8 +
+ monitor.c                        |  37 ++-
+ monitor.h                        |   4 +
+ monitor_wrap.c                   |  21 ++
+ monitor_wrap.h                   |   3 +
+ openbsd-compat/Makefile.in       |   3 +-
+ openbsd-compat/port-linux-sshd.c | 420 +++++++++++++++++++++++++++++++
+ openbsd-compat/port-linux.c      |  37 +--
+ openbsd-compat/port-linux.h      |   3 +-
+ platform.c                       |   2 +-
+ sshd-session.c                   |   3 +
+ 18 files changed, 551 insertions(+), 42 deletions(-)
+ create mode 100644 openbsd-compat/port-linux-sshd.c
+
+diff --git a/auth-pam.c b/auth-pam.c
+index 13c0a792..b4100ea1 100644
+--- a/auth-pam.c
++++ b/auth-pam.c
+@@ -1238,7 +1238,7 @@ is_pam_session_open(void)
+  * during the ssh authentication process.
+  */
+ int
+-do_pam_putenv(char *name, char *value)
++do_pam_putenv(char *name, const char *value)
+ {
+ 	int ret = 1;
+ 	char *compound;
+diff --git a/auth-pam.h b/auth-pam.h
+index 8d801c68..9dd7ae07 100644
+--- a/auth-pam.h
++++ b/auth-pam.h
+@@ -33,7 +33,7 @@ u_int do_pam_account(void);
+ void do_pam_session(struct ssh *);
+ void do_pam_setcred(void);
+ void do_pam_chauthtok(void);
+-int do_pam_putenv(char *, char *);
++int do_pam_putenv(char *, const char *);
+ char ** fetch_pam_environment(void);
+ char ** fetch_pam_child_environment(void);
+ void free_pam_environment(char **);
+diff --git a/auth.h b/auth.h
+index 98bb23d4..83d07ae8 100644
+--- a/auth.h
++++ b/auth.h
+@@ -65,6 +65,9 @@ struct Authctxt {
+ 	char		*service;
+ 	struct passwd	*pw;		/* set if 'valid' */
+ 	char		*style;
 +#ifdef WITH_SELINUX
-+	char *role = NULL;
++	char		*role;
 +#endif
- 	int r, authenticated = 0;
- 	double tstart = monotime_double();
  
-@@ -268,6 +271,11 @@ input_userauth_request(int type, u_int32
- 	debug("userauth-request for user %s service %s method %s", user, service, method);
- 	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
- 
-+#ifdef WITH_SELINUX
-+	if ((role = strchr(user, '/')) != NULL)
-+		*role++ = 0;
-+#endif
-+
- 	if ((style = strchr(user, ':')) != NULL)
- 		*style++ = 0;
- 
-@@ -314,7 +314,13 @@ input_userauth_request(int type, u_int32
- 		setproctitle("%s [net]", authctxt->valid ? user : "unknown");
- 		authctxt->service = xstrdup(service);
- 		authctxt->style = style ? xstrdup(style) : NULL;
-+#ifdef WITH_SELINUX
-+		authctxt->role = role ? xstrdup(role) : NULL;
-+#endif
- 		mm_inform_authserv(service, style);
-+#ifdef WITH_SELINUX
-+         	mm_inform_authrole(role);
-+#endif
- 		userauth_banner(ssh);
- 		if ((r = kex_server_update_ext_info(ssh)) != 0)
- 			fatal_fr(r, "kex_server_update_ext_info failed");
-diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
---- openssh/auth2-gss.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/auth2-gss.c	2018-08-22 11:15:42.459799171 +0200
-@@ -281,6 +281,7 @@ input_gssapi_mic(int type, u_int32_t ple
+ 	/* Method lists for multiple authentication */
+ 	char		**auth_methods;	/* modified from server config */
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 75eb4e3a..f7898ab3 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -284,6 +284,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  	Authctxt *authctxt = ssh->authctxt;
  	Gssctxt *gssctxt;
  	int r, authenticated = 0;
@@ -48,7 +77,7 @@ diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
  	struct sshbuf *b;
  	gss_buffer_desc mic, gssbuf;
  	u_char *p;
-@@ -298,7 +299,13 @@ input_gssapi_mic(int type, u_int32_t ple
+@@ -300,7 +301,13 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  		fatal_f("sshbuf_new failed");
  	mic.value = p;
  	mic.length = len;
@@ -63,7 +92,7 @@ diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
  	    "gssapi-with-mic", ssh->kex->session_id);
  
  	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
-@@ -311,6 +318,8 @@ input_gssapi_mic(int type, u_int32_t ple
+@@ -313,6 +320,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  		logit("GSSAPI MIC check failed");
  
  	sshbuf_free(b);
@@ -72,10 +101,11 @@ diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
  	free(mic.value);
  
  	authctxt->postponed = 0;
-diff -up openssh/auth2-hostbased.c.role-mls openssh/auth2-hostbased.c
---- openssh/auth2-hostbased.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/auth2-hostbased.c	2018-08-22 11:14:56.816430924 +0200
-@@ -123,7 +123,16 @@ userauth_hostbased(struct ssh *ssh)
+diff --git a/auth2-hostbased.c b/auth2-hostbased.c
+index eb21479a..a3be6e49 100644
+--- a/auth2-hostbased.c
++++ b/auth2-hostbased.c
+@@ -129,7 +129,16 @@ userauth_hostbased(struct ssh *ssh, const char *method)
  	/* reconstruct packet */
  	if ((r = sshbuf_put_stringb(b, ssh->kex->session_id)) != 0 ||
  	    (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
@@ -92,10 +122,11 @@ diff -up openssh/auth2-hostbased.c.role-mls openssh/auth2-hostbased.c
  	    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
  	    (r = sshbuf_put_cstring(b, method)) != 0 ||
  	    (r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
-diff -up openssh/auth2-pubkey.c.role-mls openssh/auth2-pubkey.c
---- openssh/auth2-pubkey.c.role-mls	2018-08-22 11:14:56.816430924 +0200
-+++ openssh/auth2-pubkey.c	2018-08-22 11:17:07.331483958 +0200
-@@ -169,9 +169,16 @@ userauth_pubkey(struct ssh *ssh)
+diff --git a/auth2-pubkey.c b/auth2-pubkey.c
+index aa24fda0..267a27d2 100644
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -206,9 +206,16 @@ userauth_pubkey(struct ssh *ssh, const char *method)
  			goto done;
  		}
  		/* reconstruct packet */
@@ -114,47 +145,51 @@ diff -up openssh/auth2-pubkey.c.role-mls openssh/auth2-pubkey.c
  		if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
  		    (r = sshbuf_put_cstring(b, userstyle)) != 0 ||
  		    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
-diff -up openssh/auth.h.role-mls openssh/auth.h
---- openssh/auth.h.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/auth.h	2018-08-22 11:14:56.816430924 +0200
-@@ -65,6 +65,9 @@ struct Authctxt {
- 	char		*service;
- 	struct passwd	*pw;		/* set if 'valid' */
- 	char		*style;
+diff --git a/auth2.c b/auth2.c
+index 82f6e621..5ba45c12 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -271,6 +271,9 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	Authmethod *m = NULL;
+ 	char *user = NULL, *service = NULL, *method = NULL, *style = NULL;
 +#ifdef WITH_SELINUX
-+	char		*role;
++	char *role = NULL;
 +#endif
+ 	int r, authenticated = 0;
+ 	double tstart = monotime_double();
  
- 	/* Method lists for multiple authentication */
- 	char		**auth_methods;	/* modified from server config */
-diff -up openssh/auth-pam.c.role-mls openssh/auth-pam.c
---- openssh/auth-pam.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/auth-pam.c	2018-08-22 11:14:56.816430924 +0200
-@@ -1172,7 +1172,7 @@ is_pam_session_open(void)
-  * during the ssh authentication process.
-  */
- int
--do_pam_putenv(char *name, char *value)
-+do_pam_putenv(char *name, const char *value)
- {
- 	int ret = 1;
- 	char *compound;
-diff -up openssh/auth-pam.h.role-mls openssh/auth-pam.h
---- openssh/auth-pam.h.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/auth-pam.h	2018-08-22 11:14:56.817430932 +0200
-@@ -33,7 +33,7 @@ u_int do_pam_account(void);
- void do_pam_session(struct ssh *);
- void do_pam_setcred(void);
- void do_pam_chauthtok(void);
--int do_pam_putenv(char *, char *);
-+int do_pam_putenv(char *, const char *);
- char ** fetch_pam_environment(void);
- char ** fetch_pam_child_environment(void);
- void free_pam_environment(char **);
-diff -up openssh/misc.c.role-mls openssh/misc.c
---- openssh/misc.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/misc.c	2018-08-22 11:14:56.817430932 +0200
-@@ -542,6 +542,7 @@ char *
+@@ -284,6 +287,11 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ 	debug("userauth-request for user %s service %s method %s", user, service, method);
+ 	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
+ 
++#ifdef WITH_SELINUX
++	if ((role = strchr(user, '/')) != NULL)
++		*role++ = 0;
++#endif
++
+ 	if ((style = strchr(user, ':')) != NULL)
+ 		*style++ = 0;
+ 
+@@ -313,7 +321,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ 		setproctitle("%s [net]", authctxt->valid ? user : "unknown");
+ 		authctxt->service = xstrdup(service);
+ 		authctxt->style = style ? xstrdup(style) : NULL;
++#ifdef WITH_SELINUX
++		authctxt->role = role ? xstrdup(role) : NULL;
++#endif
+ 		mm_inform_authserv(service, style);
++#ifdef WITH_SELINUX
++         	mm_inform_authrole(role);
++#endif
+ 		userauth_banner(ssh);
+ 		if ((r = kex_server_update_ext_info(ssh)) != 0)
+ 			fatal_fr(r, "kex_server_update_ext_info failed");
+diff --git a/misc.c b/misc.c
+index dd0bd032..c932f9bb 100644
+--- a/misc.c
++++ b/misc.c
+@@ -806,6 +806,7 @@ char *
  colon(char *cp)
  {
  	int flag = 0;
@@ -162,7 +197,7 @@ diff -up openssh/misc.c.role-mls openssh/misc.c
  
  	if (*cp == ':')		/* Leading colon is part of file name. */
  		return NULL;
-@@ -557,6 +558,13 @@ colon(char *cp)
+@@ -821,6 +822,13 @@ colon(char *cp)
  			return (cp);
  		if (*cp == '/')
  			return NULL;
@@ -176,10 +211,11 @@ diff -up openssh/misc.c.role-mls openssh/misc.c
  	}
  	return NULL;
  }
-diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
---- openssh-8.6p1/monitor.c.role-mls	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/monitor.c	2021-05-21 14:21:56.719414087 +0200
-@@ -117,6 +117,9 @@ int mm_answer_sign(struct ssh *, int, st
+diff --git a/monitor.c b/monitor.c
+index 2179553d..02b3eaaa 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -120,6 +120,9 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *);
  int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *);
  int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *);
  int mm_answer_authserv(struct ssh *, int, struct sshbuf *);
@@ -189,7 +225,7 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  int mm_answer_authpassword(struct ssh *, int, struct sshbuf *);
  int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *);
  int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *);
-@@ -195,6 +198,9 @@ struct mon_table mon_dispatch_proto20[]
+@@ -194,6 +197,9 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -199,7 +235,7 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -803,6 +809,9 @@ mm_answer_pwnamallow(struct ssh *ssh, in
+@@ -912,6 +918,9 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
  
  	/* Allow service/style information on the auth context */
  	monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -209,7 +245,7 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  	monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
  
  #ifdef USE_PAM
-@@ -877,6 +886,26 @@ key_base_type_match(const char *method,
+@@ -986,6 +995,26 @@ key_base_type_match(const char *method, const struct sshkey *key,
  	return found;
  }
  
@@ -236,16 +272,16 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  int
  mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m)
  {
-@@ -1251,7 +1280,7 @@ monitor_valid_userblob(struct ssh *ssh,
+@@ -1358,7 +1387,7 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
  	struct sshbuf *b;
-	struct sshkey *hostkey = NULL;
+ 	struct sshkey *hostkey = NULL;
  	const u_char *p;
 -	char *userstyle, *cp;
 +	char *userstyle, *s, *cp;
  	size_t len;
  	u_char type;
  	int hostbound = 0, r, fail = 0;
-@@ -1282,6 +1311,8 @@ monitor_valid_userblob(struct ssh *ssh,
+@@ -1389,6 +1418,8 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
  		fail++;
  	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
  		fatal_fr(r, "parse userstyle");
@@ -254,7 +290,7 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  	xasprintf(&userstyle, "%s%s%s", authctxt->user,
  	    authctxt->style ? ":" : "",
  	    authctxt->style ? authctxt->style : "");
-@@ -1317,7 +1348,7 @@ monitor_valid_hostbasedblob(const u_char
+@@ -1439,7 +1470,7 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
  {
  	struct sshbuf *b;
  	const u_char *p;
@@ -263,7 +299,7 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  	size_t len;
  	int r, fail = 0;
  	u_char type;
-@@ -1338,6 +1370,8 @@ monitor_valid_hostbasedblob(const u_char
+@@ -1460,6 +1491,8 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
  		fail++;
  	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
  		fatal_fr(r, "parse userstyle");
@@ -272,12 +308,13 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  	xasprintf(&userstyle, "%s%s%s", authctxt->user,
  	    authctxt->style ? ":" : "",
  	    authctxt->style ? authctxt->style : "");
-diff -up openssh/monitor.h.role-mls openssh/monitor.h
---- openssh/monitor.h.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/monitor.h	2018-08-22 11:14:56.818430941 +0200
-@@ -55,6 +55,10 @@ enum monitor_reqtype {
- 	MONITOR_REQ_GSSCHECKMIC = 48, MONITOR_ANS_GSSCHECKMIC = 49,
+diff --git a/monitor.h b/monitor.h
+index 3f8a9bea..9dcd9c29 100644
+--- a/monitor.h
++++ b/monitor.h
+@@ -56,6 +56,10 @@ enum monitor_reqtype {
  	MONITOR_REQ_TERM = 50,
+ 	MONITOR_REQ_STATE = 51, MONITOR_ANS_STATE = 52,
  
 +#ifdef WITH_SELINUX
 +	MONITOR_REQ_AUTHROLE = 80,
@@ -286,10 +323,11 @@ diff -up openssh/monitor.h.role-mls openssh/monitor.h
  	MONITOR_REQ_PAM_START = 100,
  	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
  	MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
-diff -up openssh/monitor_wrap.c.role-mls openssh/monitor_wrap.c
---- openssh/monitor_wrap.c.role-mls	2018-08-22 11:14:56.818430941 +0200
-+++ openssh/monitor_wrap.c	2018-08-22 11:21:47.938747968 +0200
-@@ -390,6 +390,27 @@ mm_inform_authserv(char *service, char *
+diff --git a/monitor_wrap.c b/monitor_wrap.c
+index bd900b2f..ef3ab1b1 100644
+--- a/monitor_wrap.c
++++ b/monitor_wrap.c
+@@ -442,6 +442,27 @@ mm_inform_authserv(char *service, char *style)
  	sshbuf_free(m);
  }
  
@@ -317,10 +355,11 @@ diff -up openssh/monitor_wrap.c.role-mls openssh/monitor_wrap.c
  /* Do the password authentication */
  int
  mm_auth_password(struct ssh *ssh, char *password)
-diff -up openssh/monitor_wrap.h.role-mls openssh/monitor_wrap.h
---- openssh/monitor_wrap.h.role-mls	2018-08-22 11:14:56.818430941 +0200
-+++ openssh/monitor_wrap.h	2018-08-22 11:22:10.439929513 +0200
-@@ -44,6 +44,9 @@ DH *mm_choose_dh(int, int, int);
+diff --git a/monitor_wrap.h b/monitor_wrap.h
+index 7134afee..38a280c8 100644
+--- a/monitor_wrap.h
++++ b/monitor_wrap.h
+@@ -46,6 +46,9 @@ int mm_sshkey_sign(struct ssh *, struct sshkey *, u_char **, size_t *,
      const u_char *, size_t, const char *, const char *,
      const char *, u_int compat);
  void mm_inform_authserv(char *, char *);
@@ -330,10 +369,11 @@ diff -up openssh/monitor_wrap.h.role-mls openssh/monitor_wrap.h
  struct passwd *mm_getpwnamallow(struct ssh *, const char *);
  char *mm_auth2_read_banner(void);
  int mm_auth_password(struct ssh *, char *);
-diff -up openssh/openbsd-compat/Makefile.in.role-mls openssh/openbsd-compat/Makefile.in
---- openssh/openbsd-compat/Makefile.in.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/openbsd-compat/Makefile.in	2018-08-22 11:14:56.819430949 +0200
-@@ -92,7 +92,8 @@ PORTS=	port-aix.o \
+diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
+index 1d549954..78e6fa5b 100644
+--- a/openbsd-compat/Makefile.in
++++ b/openbsd-compat/Makefile.in
+@@ -100,7 +100,8 @@ PORTS=	port-aix.o \
  	port-prngd.o \
  	port-solaris.o \
  	port-net.o \
@@ -343,78 +383,11 @@ diff -up openssh/openbsd-compat/Makefile.in.role-mls openssh/openbsd-compat/Make
  
  .c.o:
  	$(CC) $(CFLAGS_NOPIE) $(PICFLAG) $(CPPFLAGS) -c $<
-diff -up openssh/openbsd-compat/port-linux.c.role-mls openssh/openbsd-compat/port-linux.c
---- openssh/openbsd-compat/port-linux.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/openbsd-compat/port-linux.c	2018-08-22 11:14:56.819430949 +0200
-@@ -100,37 +100,6 @@ ssh_selinux_getctxbyname(char *pwname)
- 	return sc;
- }
- 
--/* Set the execution context to the default for the specified user */
--void
--ssh_selinux_setup_exec_context(char *pwname)
--{
--	char *user_ctx = NULL;
--
--	if (!ssh_selinux_enabled())
--		return;
--
--	debug3("%s: setting execution context", __func__);
--
--	user_ctx = ssh_selinux_getctxbyname(pwname);
--	if (setexeccon(user_ctx) != 0) {
--		switch (security_getenforce()) {
--		case -1:
--			fatal("%s: security_getenforce() failed", __func__);
--		case 0:
--			error("%s: Failed to set SELinux execution "
--			    "context for %s", __func__, pwname);
--			break;
--		default:
--			fatal("%s: Failed to set SELinux execution context "
--			    "for %s (in enforcing mode)", __func__, pwname);
--		}
--	}
--	if (user_ctx != NULL)
--		freecon(user_ctx);
--
--	debug3("%s: done", __func__);
--}
--
- /* Set the TTY context for the specified user */
- void
- ssh_selinux_setup_pty(char *pwname, const char *tty)
-@@ -145,7 +114,11 @@ ssh_selinux_setup_pty(char *pwname, cons
- 
- 	debug3("%s: setting TTY context on %s", __func__, tty);
- 
--	user_ctx = ssh_selinux_getctxbyname(pwname);
-+	if (getexeccon(&user_ctx) != 0) {
-+		error_f("getexeccon: %s", strerror(errno));
-+		goto out;
-+	}
-+
- 
- 	/* XXX: should these calls fatal() upon failure in enforcing mode? */
- 
-diff -up openssh/openbsd-compat/port-linux.h.role-mls openssh/openbsd-compat/port-linux.h
---- openssh/openbsd-compat/port-linux.h.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/openbsd-compat/port-linux.h	2018-08-22 11:14:56.819430949 +0200
-@@ -20,9 +20,10 @@
- #ifdef WITH_SELINUX
- int ssh_selinux_enabled(void);
- void ssh_selinux_setup_pty(char *, const char *);
--void ssh_selinux_setup_exec_context(char *);
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
-+
-+void sshd_selinux_setup_exec_context(char *);
- #endif
- 
- #ifdef LINUX_OOM_ADJUST
-diff -up openssh/openbsd-compat/port-linux-sshd.c.role-mls openssh/openbsd-compat/port-linux-sshd.c
---- openssh/openbsd-compat/port-linux-sshd.c.role-mls	2018-08-22 11:14:56.819430949 +0200
-+++ openssh/openbsd-compat/port-linux-sshd.c	2018-08-22 11:14:56.819430949 +0200
+diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
+new file mode 100644
+index 00000000..b9fbe38b
+--- /dev/null
++++ b/openbsd-compat/port-linux-sshd.c
 @@ -0,0 +1,420 @@
 +/*
 + * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
@@ -836,10 +809,82 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.role-mls openssh/openbsd-compa
 +#endif
 +#endif
 +
-diff -up openssh/platform.c.role-mls openssh/platform.c
---- openssh/platform.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/platform.c	2018-08-22 11:14:56.819430949 +0200
-@@ -183,7 +183,7 @@ platform_setusercontext_post_groups(stru
+diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
+index c1d54f38..7426f6f7 100644
+--- a/openbsd-compat/port-linux.c
++++ b/openbsd-compat/port-linux.c
+@@ -109,37 +109,6 @@ ssh_selinux_getctxbyname(char *pwname)
+ 	return sc;
+ }
+ 
+-/* Set the execution context to the default for the specified user */
+-void
+-ssh_selinux_setup_exec_context(char *pwname)
+-{
+-	char *user_ctx = NULL;
+-
+-	if (!ssh_selinux_enabled())
+-		return;
+-
+-	debug3("%s: setting execution context", __func__);
+-
+-	user_ctx = ssh_selinux_getctxbyname(pwname);
+-	if (setexeccon(user_ctx) != 0) {
+-		switch (security_getenforce()) {
+-		case -1:
+-			fatal("%s: security_getenforce() failed", __func__);
+-		case 0:
+-			error("%s: Failed to set SELinux execution "
+-			    "context for %s", __func__, pwname);
+-			break;
+-		default:
+-			fatal("%s: Failed to set SELinux execution context "
+-			    "for %s (in enforcing mode)", __func__, pwname);
+-		}
+-	}
+-	if (user_ctx != NULL)
+-		freecon(user_ctx);
+-
+-	debug3("%s: done", __func__);
+-}
+-
+ /* Set the TTY context for the specified user */
+ void
+ ssh_selinux_setup_pty(char *pwname, const char *tty)
+@@ -152,7 +121,11 @@ ssh_selinux_setup_pty(char *pwname, const char *tty)
+ 
+ 	debug3("%s: setting TTY context on %s", __func__, tty);
+ 
+-	user_ctx = ssh_selinux_getctxbyname(pwname);
++	if (getexeccon(&user_ctx) != 0) {
++		error_f("getexeccon: %s", strerror(errno));
++		goto out;
++	}
++
+ 
+ 	/* XXX: should these calls fatal() upon failure in enforcing mode? */
+ 
+diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
+index 959430de..055c825e 100644
+--- a/openbsd-compat/port-linux.h
++++ b/openbsd-compat/port-linux.h
+@@ -20,9 +20,10 @@
+ #ifdef WITH_SELINUX
+ int ssh_selinux_enabled(void);
+ void ssh_selinux_setup_pty(char *, const char *);
+-void ssh_selinux_setup_exec_context(char *);
+ void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
++
++void sshd_selinux_setup_exec_context(char *);
+ #endif
+ 
+ #ifdef LINUX_OOM_ADJUST
+diff --git a/platform.c b/platform.c
+index 4c4fe57e..1bfb4bea 100644
+--- a/platform.c
++++ b/platform.c
+@@ -140,7 +140,7 @@ platform_setusercontext_post_groups(struct passwd *pw)
  	}
  #endif /* HAVE_SETPCRED */
  #ifdef WITH_SELINUX
@@ -848,10 +893,11 @@ diff -up openssh/platform.c.role-mls openssh/platform.c
  #endif
  }
  
-diff -up openssh/sshd.c.role-mls openssh/sshd.c
---- openssh/sshd-session.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/sshd-session.c	2018-08-22 11:14:56.820430957 +0200
-@@ -2186,6 +2186,9 @@ main(int ac, char **av)
+diff --git a/sshd-session.c b/sshd-session.c
+index c64eb29f..74d2cbc7 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -1328,6 +1328,9 @@ main(int ac, char **av)
  		restore_uid();
  	}
  #endif
@@ -861,3 +907,6 @@ diff -up openssh/sshd.c.role-mls openssh/sshd.c
  #ifdef USE_PAM
  	if (options.use_pam) {
  		do_pam_setcred();
+-- 
+2.49.0
+

0002-openssh-6.6p1-privsep-selinux.patch

@@ -1,18 +1,21 @@
-diff -up openssh-7.4p1/openbsd-compat/port-linux.h.privsep-selinux openssh-7.4p1/openbsd-compat/port-linux.h
---- openssh-7.4p1/openbsd-compat/port-linux.h.privsep-selinux	2016-12-23 18:58:52.972122201 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux.h	2016-12-23 18:58:52.974122201 +0100
-@@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
- 
-+void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
- #endif
- 
-diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux openssh-7.4p1/openbsd-compat/port-linux-sshd.c
---- openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux-sshd.c	2016-12-23 18:58:52.974122201 +0100
-@@ -419,6 +419,28 @@ sshd_selinux_setup_exec_context(char *pw
+From 99d8e250514023d3b88a1c9eb724c4898aba9827 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 02/50] openssh-6.6p1-privsep-selinux
+
+---
+ openbsd-compat/port-linux-sshd.c | 22 ++++++++++++++++++++++
+ openbsd-compat/port-linux.h      |  1 +
+ session.c                        | 16 +++++++++-------
+ sshd-auth.c                      |  4 ++++
+ sshd-session.c                   |  2 +-
+ 5 files changed, 37 insertions(+), 8 deletions(-)
+
+diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
+index b9fbe38b..dfafc622 100644
+--- a/openbsd-compat/port-linux-sshd.c
++++ b/openbsd-compat/port-linux-sshd.c
+@@ -415,6 +415,28 @@ sshd_selinux_setup_exec_context(char *pwname)
  	debug3_f("done");
  }
  
@@ -41,10 +44,23 @@ diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux openssh-
  #endif
  #endif
  
-diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
---- openssh-7.4p1/session.c.privsep-selinux	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 18:58:52.974122201 +0100
-@@ -1331,7 +1331,7 @@ do_setusercontext(struct passwd *pw)
+diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
+index 055c825e..498d242a 100644
+--- a/openbsd-compat/port-linux.h
++++ b/openbsd-compat/port-linux.h
+@@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const char *);
+ void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
+ 
++void sshd_selinux_copy_context(void);
+ void sshd_selinux_setup_exec_context(char *);
+ #endif
+ 
+diff --git a/session.c b/session.c
+index 6444c77f..e4657cef 100644
+--- a/session.c
++++ b/session.c
+@@ -1350,7 +1350,7 @@ do_setusercontext(struct passwd *pw)
  
  	platform_setusercontext(pw);
  
@@ -53,17 +69,17 @@ diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
  #ifdef HAVE_LOGIN_CAP
  		if (setusercontext(lc, pw, pw->pw_uid,
  		    (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
-@@ -1361,6 +1361,9 @@ do_setusercontext(struct passwd *pw)
-			    (unsigned long long)pw->pw_uid);
-			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
-			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
+@@ -1382,6 +1382,9 @@ do_setusercontext(struct passwd *pw)
+ 			    (unsigned long long)pw->pw_uid);
+ 			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
+ 			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
 +#ifdef WITH_SELINUX
 +			sshd_selinux_copy_context();
 +#endif
  			safely_chroot(chroot_path, pw->pw_uid);
  			free(tmp);
  			free(chroot_path);
-@@ -1396,6 +1399,11 @@ do_setusercontext(struct passwd *pw)
+@@ -1417,6 +1420,11 @@ do_setusercontext(struct passwd *pw)
  		/* Permanently switch to the desired uid. */
  		permanently_set_uid(pw);
  #endif
@@ -75,17 +91,17 @@ diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
  	} else if (options.chroot_directory != NULL &&
  	    strcasecmp(options.chroot_directory, "none") != 0) {
  		fatal("server lacks privileges to chroot to ChrootDirectory");
-@@ -1413,9 +1421,6 @@ do_pwchange(Session *s)
+@@ -1434,9 +1442,6 @@ do_pwchange(Session *s)
  	if (s->ttyfd != -1) {
  		fprintf(stderr,
- 		    "You must change your password now and login again!\n");
+ 		    "You must change your password now and log in again!\n");
 -#ifdef WITH_SELINUX
 -		setexeccon(NULL);
 -#endif
  #ifdef PASSWD_NEEDS_USERNAME
  		execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
  		    (char *)NULL);
-@@ -1625,9 +1630,6 @@ do_child(Session *s, const char *command
+@@ -1649,9 +1654,6 @@ do_child(struct ssh *ssh, Session *s, const char *command)
  		argv[i] = NULL;
  		optind = optreset = 1;
  		__progname = argv[0];
@@ -95,13 +111,14 @@ diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
  		exit(sftp_server_main(i, argv, s->pw));
  	}
  
-diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
---- openssh-7.4p1/sshd-session.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
-+++ openssh-7.4p1/sshd-session.c	2016-12-23 18:59:13.808124269 +0100
-@@ -540,6 +540,10 @@ privsep_preauth_child(void)
- 	/* Demote the private keys to public keys. */
- 	demote_sensitive_data();
- 
+diff --git a/sshd-auth.c b/sshd-auth.c
+index 30eecd8a..f957dc22 100644
+--- a/sshd-auth.c
++++ b/sshd-auth.c
+@@ -187,6 +187,10 @@ privsep_child_demote(void)
+ 	if ((box = ssh_sandbox_init(pmonitor)) == NULL)
+ 		fatal_f("ssh_sandbox_init failed");
+ #endif
 +#ifdef WITH_SELINUX
 +	ssh_selinux_change_context("sshd_net_t");
 +#endif
@@ -109,7 +126,11 @@ diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
  	/* Demote the child */
  	if (privsep_chroot) {
  		/* Change our root directory */
-@@ -403,7 +403,7 @@ privsep_postauth(struct ssh *ssh, Authct
+diff --git a/sshd-session.c b/sshd-session.c
+index 74d2cbc7..4a148db4 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -432,7 +432,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
  	 * fd passing, as AFAIK PTY allocation on this platform doesn't require
  	 * special privileges to begin with.
  	 */
@@ -118,3 +139,6 @@ diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
  	skip_privdrop = 1;
  #endif
  
+-- 
+2.49.0
+

0003-openssh-6.6p1-keycat.patch

@@ -1,23 +1,26 @@
-diff -up openssh/misc.c.keycat openssh/misc.c
---- openssh/misc.c.keycat	2015-06-24 10:57:50.158849606 +0200
-+++ openssh/misc.c	2015-06-24 11:04:23.989868638 +0200
-@@ -966,6 +966,13 @@ subprocess(const char *tag, struct passw
- 			error("%s: dup2: %s", tag, strerror(errno));
- 			_exit(1);
- 		}
-+#ifdef WITH_SELINUX
-+		if (sshd_selinux_setup_env_variables() < 0) {
-+			error ("failed to copy environment:  %s",
-+			    strerror(errno));
-+			_exit(127);
-+		}
-+#endif
- 		if (env != NULL)
- 			execve(av[0], av, env);
- 		else
-diff -up openssh/HOWTO.ssh-keycat.keycat openssh/HOWTO.ssh-keycat
---- openssh/HOWTO.ssh-keycat.keycat	2015-06-24 10:57:50.157849608 +0200
-+++ openssh/HOWTO.ssh-keycat	2015-06-24 10:57:50.157849608 +0200
+From 5e35e18a419a5a66b6e1cb2b98beaaf4d9db0dc6 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 03/50] openssh-6.6p1-keycat
+
+---
+ HOWTO.ssh-keycat                 |  12 ++
+ Makefile.in                      |   8 +-
+ configure.ac                     |   6 +
+ misc.c                           |   7 +
+ openbsd-compat/port-linux-sshd.c |  44 +++++-
+ openbsd-compat/port-linux.h      |   2 +
+ platform.c                       |   2 +-
+ ssh-keycat.c                     | 241 +++++++++++++++++++++++++++++++
+ 8 files changed, 314 insertions(+), 8 deletions(-)
+ create mode 100644 HOWTO.ssh-keycat
+ create mode 100644 ssh-keycat.c
+
+diff --git a/HOWTO.ssh-keycat b/HOWTO.ssh-keycat
+new file mode 100644
+index 00000000..630ec628
+--- /dev/null
++++ b/HOWTO.ssh-keycat
 @@ -0,0 +1,12 @@
 +The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
 +of an user in any environment. This includes environments with
@@ -31,35 +34,36 @@ diff -up openssh/HOWTO.ssh-keycat.keycat openssh/HOWTO.ssh-keycat
 +        PubkeyAuthentication yes
 +
 +
-diff -up openssh/Makefile.in.keycat openssh/Makefile.in
---- openssh/Makefile.in.keycat	2015-06-24 10:57:50.152849621 +0200
-+++ openssh/Makefile.in	2015-06-24 10:57:50.157849608 +0200
-@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
+diff --git a/Makefile.in b/Makefile.in
+index 4617cebc..438efc51 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -23,6 +23,7 @@ SSH_PROGRAM=@bindir@/ssh
  ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
  SFTP_SERVER=$(libexecdir)/sftp-server
  SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 +SSH_KEYCAT=$(libexecdir)/ssh-keycat
  SSHD_SESSION=$(libexecdir)/sshd-session
+ SSHD_AUTH=$(libexecdir)/sshd-auth
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
-@@ -52,6 +52,7 @@ K5LIBS=@K5LIBS@
+@@ -57,6 +58,7 @@ CHANNELLIBS=@CHANNELLIBS@
  K5LIBS=@K5LIBS@
  GSSLIBS=@GSSLIBS@
  SSHDLIBS=@SSHDLIBS@
 +KEYCATLIBS=@KEYCATLIBS@
  LIBEDIT=@LIBEDIT@
  LIBFIDO2=@LIBFIDO2@
- AR=@AR@
-@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
+ LIBWTMPDB=@LIBWTMPDB@
+@@ -74,7 +76,7 @@ MKDIR_P=@MKDIR_P@
  
  .SUFFIXES: .lo
  
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) sshd-auth$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) $(SK_STANDALONE)
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) sshd-auth$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT) $(SK_STANDALONE)
  
  XMSS_OBJS=\
  	ssh-xmss.o \
-@@ -190,6 +191,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
+@@ -260,6 +262,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(P11HELPER_OBJS)
  ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
  	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
  
@@ -69,7 +73,7 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
  	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
  
-@@ -321,6 +325,7 @@ install-files:
+@@ -447,6 +452,7 @@ install-files:
  	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
@@ -77,24 +81,67 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh/openbsd-compat/port-linux.h.keycat openssh/openbsd-compat/port-linux.h
---- openssh/openbsd-compat/port-linux.h.keycat	2015-06-24 10:57:50.150849626 +0200
-+++ openssh/openbsd-compat/port-linux.h	2015-06-24 10:57:50.160849601 +0200
-@@ -25,8 +25,10 @@ void ssh_selinux_setup_pty(char *, const
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
+diff --git a/configure.ac b/configure.ac
+index ee77a048..d546788c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -3566,6 +3566,7 @@ AC_ARG_WITH([pam],
+ 			PAM_MSG="yes"
  
-+int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
-+int sshd_selinux_setup_env_variables(void);
- #endif
+ 			SSHDLIBS="$SSHDLIBS -lpam"
++			KEYCATLIBS="$KEYCATLIBS -lpam"
+ 			AC_DEFINE([USE_PAM], [1],
+ 				[Define if you want to enable PAM support])
  
- #ifdef LINUX_OOM_ADJUST
-diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/port-linux-sshd.c
---- openssh/openbsd-compat/port-linux-sshd.c.keycat	2015-06-24 10:57:50.150849626 +0200
-+++ openssh/openbsd-compat/port-linux-sshd.c	2015-06-24 10:57:50.159849603 +0200
-@@ -54,6 +54,20 @@ extern Authctxt *the_authctxt;
+@@ -3576,6 +3577,7 @@ AC_ARG_WITH([pam],
+ 					;;
+ 				*)
+ 					SSHDLIBS="$SSHDLIBS -ldl"
++					KEYCATLIBS="$KEYCATLIBS -ldl"
+ 					;;
+ 				esac
+ 			fi
+@@ -4801,6 +4803,7 @@ AC_ARG_WITH([selinux],
+ 	fi ]
+ )
+ AC_SUBST([SSHDLIBS])
++AC_SUBST([KEYCATLIBS])
+ 
+ # Check whether user wants Kerberos 5 support
+ KRB5_MSG="no"
+@@ -5812,6 +5815,9 @@ fi
+ if test ! -z "${SSHDLIBS}"; then
+ echo "         +for sshd: ${SSHDLIBS}"
+ fi
++if test ! -z "${KEYCATLIBS}"; then
++echo "   +for ssh-keycat: ${KEYCATLIBS}"
++fi
+ 
+ echo ""
+ 
+diff --git a/misc.c b/misc.c
+index c932f9bb..1e31acc9 100644
+--- a/misc.c
++++ b/misc.c
+@@ -2897,6 +2897,13 @@ subprocess(const char *tag, const char *command,
+ 			error("%s: dup2: %s", tag, strerror(errno));
+ 			_exit(1);
+ 		}
++#ifdef WITH_SELINUX
++		if (sshd_selinux_setup_env_variables() < 0) {
++			error ("failed to copy environment:  %s",
++			    strerror(errno));
++			_exit(127);
++		}
++#endif
+ 		if (env != NULL)
+ 			execve(av[0], av, env);
+ 		else
+diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
+index dfafc622..8c5fc1fe 100644
+--- a/openbsd-compat/port-linux-sshd.c
++++ b/openbsd-compat/port-linux-sshd.c
+@@ -52,6 +52,20 @@ extern ServerOptions options;
  extern Authctxt *the_authctxt;
  extern int inetd_flag;
  
@@ -115,7 +162,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
  /* Send audit message */
  static int
  sshd_selinux_send_audit_message(int success, security_context_t default_context,
-@@ -308,7 +322,7 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -317,7 +331,7 @@ sshd_selinux_getctxbyname(char *pwname,
  
  /* Setup environment variables for pam_selinux */
  static int
@@ -124,7 +171,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
  {
  	const char *reqlvl;
  	char *role;
-@@ -319,16 +333,16 @@ sshd_selinux_setup_pam_variables(void)
+@@ -328,16 +342,16 @@ sshd_selinux_setup_pam_variables(void)
  
  	ssh_selinux_get_role_level(&role, &reqlvl);
  
@@ -144,7 +191,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
  
  	if (role != NULL)
  		free(role);
-@@ -336,6 +350,24 @@ sshd_selinux_setup_pam_variables(void)
+@@ -345,6 +359,24 @@ sshd_selinux_setup_pam_variables(void)
  	return rv;
  }
  
@@ -169,7 +216,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
  /* Set the execution context to the default for the specified user */
  void
  sshd_selinux_setup_exec_context(char *pwname)
-@@ -344,7 +376,7 @@ sshd_selinux_setup_exec_context(char *pw
+@@ -353,7 +385,7 @@ sshd_selinux_setup_exec_context(char *pwname)
  	int r = 0;
  	security_context_t default_ctx = NULL;
  
@@ -178,7 +225,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
  		return;
  
  	if (options.use_pam) {
-@@ -415,7 +447,7 @@ sshd_selinux_copy_context(void)
+@@ -420,7 +452,7 @@ sshd_selinux_copy_context(void)
  {
  	security_context_t *ctx;
  
@@ -187,10 +234,26 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
  		return;
  
  	if (getexeccon((security_context_t *)&ctx) != 0) {
-diff -up openssh/platform.c.keycat openssh/platform.c
---- openssh/platform.c.keycat	2015-06-24 10:57:50.147849633 +0200
-+++ openssh/platform.c	2015-06-24 10:57:50.160849601 +0200
-@@ -103,7 +103,7 @@ platform_setusercontext(struct passwd *p
+diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
+index 498d242a..1b745a76 100644
+--- a/openbsd-compat/port-linux.h
++++ b/openbsd-compat/port-linux.h
+@@ -23,8 +23,10 @@ void ssh_selinux_setup_pty(char *, const char *);
+ void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
+ 
++int sshd_selinux_enabled(void);
+ void sshd_selinux_copy_context(void);
+ void sshd_selinux_setup_exec_context(char *);
++int sshd_selinux_setup_env_variables(void);
+ #endif
+ 
+ #ifdef LINUX_OOM_ADJUST
+diff --git a/platform.c b/platform.c
+index 1bfb4bea..0d12f311 100644
+--- a/platform.c
++++ b/platform.c
+@@ -55,7 +55,7 @@ platform_setusercontext(struct passwd *pw)
  {
  #ifdef WITH_SELINUX
  	/* Cache selinux status for later use */
@@ -199,9 +262,11 @@ diff -up openssh/platform.c.keycat openssh/platform.c
  #endif
  
  #ifdef USE_SOLARIS_PROJECTS
-diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
---- openssh/ssh-keycat.c.keycat	2015-06-24 10:57:50.161849599 +0200
-+++ openssh/ssh-keycat.c	2015-06-24 10:57:50.161849599 +0200
+diff --git a/ssh-keycat.c b/ssh-keycat.c
+new file mode 100644
+index 00000000..5678be07
+--- /dev/null
++++ b/ssh-keycat.c
 @@ -0,0 +1,241 @@
 +/*
 + * Redistribution and use in source and binary forms, with or without
@@ -444,41 +509,6 @@ diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
 +	}
 +	return ev;
 +}
-diff --git a/configure.ac b/configure.ac
-index 3bbccfd..6481f1f 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -2952,6 +2952,7 @@ AC_ARG_WITH([pam],
- 			PAM_MSG="yes"
- 
- 			SSHDLIBS="$SSHDLIBS -lpam"
-+			KEYCATLIBS="$KEYCATLIBS -lpam"
- 			AC_DEFINE([USE_PAM], [1],
- 				[Define if you want to enable PAM support])
- 
-@@ -3105,6 +3106,7 @@
- 					;;
- 				*)
- 					SSHDLIBS="$SSHDLIBS -ldl"
-+					KEYCATLIBS="$KEYCATLIBS -ldl"
- 					;;
- 				esac
- 			fi
-@@ -4042,6 +4044,7 @@ AC_ARG_WITH([selinux],
- 	fi ]
- )
- AC_SUBST([SSHDLIBS])
-+AC_SUBST([KEYCATLIBS])
- 
- # Check whether user wants Kerberos 5 support
- KRB5_MSG="no"
-@@ -5031,6 +5034,9 @@ fi
- if test ! -z "${SSHDLIBS}"; then
- echo "         +for sshd: ${SSHDLIBS}"
- fi
-+if test ! -z "${KEYCATLIBS}"; then
-+echo "   +for ssh-keycat: ${KEYCATLIBS}"
-+fi
- 
- echo ""
- 
+-- 
+2.49.0
+

0004-openssh-6.6p1-allow-ip-opts.patch

@@ -1,7 +1,17 @@
-diff -up openssh/sshd.c.ip-opts openssh/sshd.c
---- openssh/sshd-session.c.ip-opts	2016-07-25 13:58:48.998507834 +0200
-+++ openssh/sshd-session.c	2016-07-25 14:01:28.346469878 +0200
-@@ -1507,12 +1507,32 @@ check_ip_options(struct ssh *ssh)
+From 28333f1dfe68b0ffc80c2a4799759587b4c32d3e Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 04/50] openssh-6.6p1-allow-ip-opts
+
+---
+ sshd-session.c | 32 ++++++++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+diff --git a/sshd-session.c b/sshd-session.c
+index 4a148db4..a365f26f 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -778,12 +778,32 @@ check_ip_options(struct ssh *ssh)
  
  	if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts,
  	    &option_size) >= 0 && option_size != 0) {
@@ -40,3 +50,6 @@ diff -up openssh/sshd.c.ip-opts openssh/sshd.c
  	}
  #endif /* IP_OPTIONS */
  }
+-- 
+2.49.0
+

0005-openssh-5.9p1-ipv6man.patch

@@ -1,7 +1,18 @@
-diff -up openssh-5.9p0/ssh.1.ipv6man openssh-5.9p0/ssh.1
---- openssh-5.9p0/ssh.1.ipv6man	2011-08-05 22:17:32.000000000 +0200
-+++ openssh-5.9p0/ssh.1	2011-08-31 13:08:34.880024485 +0200
-@@ -1400,6 +1400,8 @@ manual page for more information.
+From 388be633842a9f3e4b0a76fe40cf7035912a913a Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 05/50] openssh-5.9p1-ipv6man
+
+---
+ ssh.1  | 2 ++
+ sshd.8 | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/ssh.1 b/ssh.1
+index 697f4e42..db92ac9a 100644
+--- a/ssh.1
++++ b/ssh.1
+@@ -1663,6 +1663,8 @@ manual page for more information.
  .Nm
  exits with the exit status of the remote command or with 255
  if an error occurred.
@@ -10,10 +21,11 @@ diff -up openssh-5.9p0/ssh.1.ipv6man openssh-5.9p0/ssh.1
  .Sh SEE ALSO
  .Xr scp 1 ,
  .Xr sftp 1 ,
-diff -up openssh-5.9p0/sshd.8.ipv6man openssh-5.9p0/sshd.8
---- openssh-5.9p0/sshd.8.ipv6man	2011-08-05 22:17:32.000000000 +0200
-+++ openssh-5.9p0/sshd.8	2011-08-31 13:10:34.129039094 +0200
-@@ -940,6 +940,8 @@ concurrently for different ports, this c
+diff --git a/sshd.8 b/sshd.8
+index 08ebf53a..2aa73271 100644
+--- a/sshd.8
++++ b/sshd.8
+@@ -1018,6 +1018,8 @@ concurrently for different ports, this contains the process ID of the one
  started last).
  The content of this file is not sensitive; it can be world-readable.
  .El
@@ -22,3 +34,6 @@ diff -up openssh-5.9p0/sshd.8.ipv6man openssh-5.9p0/sshd.8
  .Sh SEE ALSO
  .Xr scp 1 ,
  .Xr sftp 1 ,
+-- 
+2.49.0
+

0006-openssh-5.8p2-sigpipe.patch

@@ -0,0 +1,26 @@
+From 80359feb76fd8061b5ce18f73451d7b9db0c2477 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 06/50] openssh-5.8p2-sigpipe
+
+---
+ ssh-keyscan.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/ssh-keyscan.c b/ssh-keyscan.c
+index 3436c0b5..9f76ad22 100644
+--- a/ssh-keyscan.c
++++ b/ssh-keyscan.c
+@@ -798,6 +798,9 @@ main(int argc, char **argv)
+ 	if (maxfd > fdlim_get(0))
+ 		fdlim_set(maxfd);
+ 	fdcon = xcalloc(maxfd, sizeof(con));
++ 
++	signal(SIGPIPE, SIG_IGN);
++
+ 	read_wait = xcalloc(maxfd, sizeof(struct pollfd));
+ 	for (j = 0; j < maxfd; j++)
+ 		read_wait[j].fd = -1;
+-- 
+2.49.0
+

0007-openssh-7.2p2-x11.patch

@@ -1,22 +1,32 @@
-diff --git a/channels.c b/channels.c
---- a/channels.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/channels.c	(date 1703026069921)
-@@ -5075,11 +5075,13 @@
- }
+From cf6d48305cf6601448ea7a0d96ae825cbbbf0a2c Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 07/50] openssh-7.2p2-x11
 
+---
+ channels.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/channels.c b/channels.c
+index bfe2e3b2..d46531ce 100644
+--- a/channels.c
++++ b/channels.c
+@@ -5098,11 +5098,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+ }
+ 
  static int
 -connect_local_xsocket_path(const char *pathname)
 +connect_local_xsocket_path(const char *pathname, int len)
  {
  	int sock;
  	struct sockaddr_un addr;
-
+ 
 +	if (len <= 0)
 +		return -1;
  	sock = socket(AF_UNIX, SOCK_STREAM, 0);
  	if (sock == -1) {
  		error("socket: %.100s", strerror(errno));
-@@ -5087,11 +5089,12 @@
+@@ -5110,11 +5112,12 @@ connect_local_xsocket_path(const char *pathname)
  	}
  	memset(&addr, 0, sizeof(addr));
  	addr.sun_family = AF_UNIX;
@@ -31,8 +41,8 @@ diff --git a/channels.c b/channels.c
 -	error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
  	return -1;
  }
-
-@@ -5099,8 +5102,18 @@
+ 
+@@ -5122,8 +5125,18 @@ static int
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -53,3 +63,6 @@ diff --git a/channels.c b/channels.c
  }
  
  #ifdef __APPLE__
+-- 
+2.49.0
+

0008-openssh-5.1p1-askpass-progress.patch

@@ -1,7 +1,17 @@
-diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contrib/gnome-ssh-askpass2.c
---- openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/contrib/gnome-ssh-askpass2.c	2016-12-23 13:31:16.545211926 +0100
-@@ -53,6 +53,7 @@
+From 6b2a33044583e892badb9ac86cd2c6252b1a532f Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 08/50] openssh-5.1p1-askpass-progress
+
+---
+ contrib/gnome-ssh-askpass2.c | 39 +++++++++++++++++++++++++++++++++---
+ 1 file changed, 36 insertions(+), 3 deletions(-)
+
+diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c
+index a62f9815..cb7152dc 100644
+--- a/contrib/gnome-ssh-askpass2.c
++++ b/contrib/gnome-ssh-askpass2.c
+@@ -58,6 +58,7 @@
  #include <unistd.h>
  
  #include <X11/Xlib.h>
@@ -9,7 +19,7 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
  #include <gtk/gtk.h>
  #include <gdk/gdkx.h>
  #include <gdk/gdkkeysyms.h>
-@@ -81,14 +82,25 @@ ok_dialog(GtkWidget *entry, gpointer dia
+@@ -146,6 +147,17 @@ parse_env_hex_color(const char *env, GdkColor *c)
  	return 1;
  }
  
@@ -27,7 +37,7 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
  static int
  passphrase_dialog(char *message, int prompt_type)
  {
- 	const char *failed;
+@@ -153,7 +165,7 @@ passphrase_dialog(char *message, int prompt_type)
  	char *passphrase, *local;
  	int result, grab_tries, grab_server, grab_pointer;
  	int buttons, default_response;
@@ -36,7 +46,7 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
  	GdkGrabStatus status;
  	GdkColor fg, bg;
  	int fg_set = 0, bg_set = 0;
-@@ -104,14 +116,19 @@ passphrase_dialog(char *message)
+@@ -199,14 +211,19 @@ passphrase_dialog(char *message, int prompt_type)
  		gtk_widget_modify_bg(dialog, GTK_STATE_NORMAL, &bg);
  
  	if (prompt_type == PROMPT_ENTRY || prompt_type == PROMPT_NONE) {
@@ -45,12 +55,12 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
 +		    FALSE, 0);
 +		gtk_widget_show(hbox);
 +
-		entry = gtk_entry_new();
-		if (fg_set)
-			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
-		if (bg_set)
-			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
-		gtk_box_pack_start(
+ 		entry = gtk_entry_new();
+ 		if (fg_set)
+ 			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
+ 		if (bg_set)
+ 			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
+ 		gtk_box_pack_start(
 -		    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
 -		    entry, FALSE, FALSE, 0);
 +		    GTK_BOX(hbox), entry, TRUE, FALSE, 0);
@@ -58,7 +68,7 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
  		gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
  		gtk_widget_grab_focus(entry);
  		if (prompt_type == PROMPT_ENTRY) {
-@@ -130,6 +145,22 @@ passphrase_dialog(char *message)
+@@ -225,6 +242,22 @@ passphrase_dialog(char *message, int prompt_type)
  			g_signal_connect(G_OBJECT(entry), "key_press_event",
  			    G_CALLBACK(check_none), dialog);
  		}
@@ -81,3 +91,6 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
  	}
  
  	/* Grab focus */
+-- 
+2.49.0
+

0009-openssh-4.3p2-askpass-grab-info.patch

@@ -1,7 +1,17 @@
-diff -up openssh-8.6p1/contrib/gnome-ssh-askpass2.c.grab-info openssh-8.6p1/contrib/gnome-ssh-askpass2.c
---- openssh-8.6p1/contrib/gnome-ssh-askpass2.c.grab-info	2021-04-19 13:57:11.720113536 +0200
-+++ openssh-8.6p1/contrib/gnome-ssh-askpass2.c	2021-04-19 13:59:29.842163204 +0200
-@@ -70,8 +70,12 @@ report_failed_grab (GtkWidget *parent_wi
+From 710ce53fdf1d32a0629fce2e42fb49d407e2b06c Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 09/50] openssh-4.3p2-askpass-grab-info
+
+---
+ contrib/gnome-ssh-askpass2.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c
+index cb7152dc..bbe93d83 100644
+--- a/contrib/gnome-ssh-askpass2.c
++++ b/contrib/gnome-ssh-askpass2.c
+@@ -70,8 +70,12 @@ report_failed_grab (GtkWidget *parent_window, const char *what)
  
  	err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
  	    GTK_MESSAGE_ERROR, GTK_BUTTONS_CLOSE,
@@ -16,3 +26,6 @@ diff -up openssh-8.6p1/contrib/gnome-ssh-askpass2.c.grab-info openssh-8.6p1/cont
  	gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER);
  
  	gtk_dialog_run(GTK_DIALOG(err));
+-- 
+2.49.0
+

0010-openssh-8.7p1-redhat.patch

@@ -1,7 +1,26 @@
-diff -up openssh/ssh_config.redhat openssh/ssh_config
---- openssh/ssh_config.redhat	2020-02-11 23:28:35.000000000 +0100
-+++ openssh/ssh_config	2020-02-13 18:13:39.180641839 +0100
-@@ -43,3 +43,10 @@
+From 5f21983f6472b26693babea4d6ca6b95a7dc7b05 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 10/50] openssh-8.7p1-redhat
+
+---
+ ssh_config            |  7 +++++++
+ ssh_config_redhat     | 18 ++++++++++++++++++
+ sshd_config           |  8 ++++++++
+ sshd_config.0         |  6 +++---
+ sshd_config.5         |  2 +-
+ sshd_config_redhat    | 18 ++++++++++++++++++
+ sshd_config_redhat_cp |  7 +++++++
+ 7 files changed, 62 insertions(+), 4 deletions(-)
+ create mode 100644 ssh_config_redhat
+ create mode 100644 sshd_config_redhat
+ create mode 100644 sshd_config_redhat_cp
+
+diff --git a/ssh_config b/ssh_config
+index cc566356..18169187 100644
+--- a/ssh_config
++++ b/ssh_config
+@@ -44,3 +44,10 @@
  #   ProxyCommand ssh -q -W %h:%p gateway.example.com
  #   RekeyLimit 1G 1h
  #   UserKnownHostsFile ~/.ssh/known_hosts.d/%k
@@ -12,10 +31,12 @@ diff -up openssh/ssh_config.redhat openssh/ssh_config
 +# included below. For more information, see manual page for
 +#  update-crypto-policies(8)  and  ssh_config(5).
 +Include /etc/ssh/ssh_config.d/*.conf
-diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
---- openssh/ssh_config_redhat.redhat	2020-02-13 18:13:39.180641839 +0100
-+++ openssh/ssh_config_redhat	2020-02-13 18:13:39.180641839 +0100
-@@ -0,0 +1,15 @@
+diff --git a/ssh_config_redhat b/ssh_config_redhat
+new file mode 100644
+index 00000000..8b1b5902
+--- /dev/null
++++ b/ssh_config_redhat
+@@ -0,0 +1,18 @@
 +# The options here are in the "Match final block" to be applied as the last
 +# options and could be potentially overwritten by the user configuration
 +Match final all
@@ -29,12 +50,35 @@ diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
 +# mode correctly we set this to yes.
 +	ForwardX11Trusted yes
 +
++# rhbz#2352653 - export COLORTERM
++	SendEnv COLORTERM
++
 +# Uncomment this if you want to use .local domain
 +# Host *.local
-diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
---- openssh/sshd_config.0.redhat	2020-02-12 14:30:04.000000000 +0100
-+++ openssh/sshd_config.0	2020-02-13 18:13:39.181641855 +0100
-@@ -970,9 +970,9 @@ DESCRIPTION
+diff --git a/sshd_config b/sshd_config
+index 0f4a3a72..608203e4 100644
+--- a/sshd_config
++++ b/sshd_config
+@@ -10,6 +10,14 @@
+ # possible, but leave them commented.  Uncommented options override the
+ # default value.
+ 
++# To modify the system-wide sshd configuration, create a  *.conf  file under
++#  /etc/ssh/sshd_config.d/  which will be automatically included below
++Include /etc/ssh/sshd_config.d/*.conf
++
++# If you want to change the port on a SELinux system, you have to tell
++# SELinux about this change.
++# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
++#
+ #Port 22
+ #AddressFamily any
+ #ListenAddress 0.0.0.0
+diff --git a/sshd_config.0 b/sshd_config.0
+index 2f77b4f4..49349bb3 100644
+--- a/sshd_config.0
++++ b/sshd_config.0
+@@ -1219,9 +1219,9 @@ DESCRIPTION
  
       SyslogFacility
               Gives the facility code that is used when logging messages from
@@ -47,10 +91,11 @@ diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
  
       TCPKeepAlive
               Specifies whether the system should send TCP keepalive messages
-diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
---- openssh/sshd_config.5.redhat	2020-02-11 23:28:35.000000000 +0100
-+++ openssh/sshd_config.5	2020-02-13 18:13:39.181641855 +0100
-@@ -1614,7 +1614,7 @@ By default no subsystems are defined.
+diff --git a/sshd_config.5 b/sshd_config.5
+index c0771737..035a50c8 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -1942,7 +1942,7 @@ By default no subsystems are defined.
  .It Cm SyslogFacility
  Gives the facility code that is used when logging messages from
  .Xr sshd 8 .
@@ -59,28 +104,12 @@ diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
  LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
  The default is AUTH.
  .It Cm TCPKeepAlive
-diff -up openssh/sshd_config.redhat openssh/sshd_config
---- openssh/sshd_config.redhat	2020-02-11 23:28:35.000000000 +0100
-+++ openssh/sshd_config	2020-02-13 18:20:16.349913681 +0100
-@@ -10,6 +10,14 @@
- # possible, but leave them commented.  Uncommented options override the
- # default value.
-
-+# To modify the system-wide sshd configuration, create a  *.conf  file under
-+#  /etc/ssh/sshd_config.d/  which will be automatically included below
-+Include /etc/ssh/sshd_config.d/*.conf
-+
-+# If you want to change the port on a SELinux system, you have to tell
-+# SELinux about this change.
-+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
-+#
- #Port 22
- #AddressFamily any
- #ListenAddress 0.0.0.0
-diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
---- openssh/sshd_config_redhat.redhat	2020-02-13 18:14:02.268006439 +0100
-+++ openssh/sshd_config_redhat	2020-02-13 18:19:20.765035947 +0100
-@@ -0,0 +1,15 @@
+diff --git a/sshd_config_redhat b/sshd_config_redhat
+new file mode 100644
+index 00000000..993a28d5
+--- /dev/null
++++ b/sshd_config_redhat
+@@ -0,0 +1,18 @@
 +SyslogFacility AUTHPRIV
 +
 +KbdInteractiveAuthentication no
@@ -92,13 +121,18 @@ diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
 +
 +X11Forwarding yes
 +
++# rhbz#2352653 - accept COLORTERM
++	AcceptEnv COLORTERM
++
 +# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
 +# as it is more configurable and versatile than the built-in version.
 +PrintMotd no
 +
-diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
---- openssh/sshd_config_redhat_cp.redhat	2020-02-13 18:14:02.268006439 +0100
-+++ openssh/sshd_config_redhat_cp	2020-02-13 18:19:20.765035947 +0100
+diff --git a/sshd_config_redhat_cp b/sshd_config_redhat_cp
+new file mode 100644
+index 00000000..1d592d13
+--- /dev/null
++++ b/sshd_config_redhat_cp
 @@ -0,0 +1,7 @@
 +# This system is following system-wide crypto policy. The changes to
 +# crypto properties (Ciphers, MACs, ...) will not have any effect in
@@ -107,3 +141,6 @@ diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
 +# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
 +Include /etc/crypto-policies/back-ends/opensshserver.config
 +
+-- 
+2.49.0
+

0011-openssh-7.8p1-UsePAM-warning.patch

@@ -1,7 +1,18 @@
-diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
---- openssh-8.6p1/sshd-session.c.log-usepam-no	2021-04-19 14:00:45.099735129 +0200
-+++ openssh-8.6p1/sshd-session.c	2021-04-19 14:03:21.140920974 +0200
-@@ -1749,6 +1749,10 @@ main(int ac, char **av)
+From 56b8d082bc9e25a77b5227d576f27088446c6fb9 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 11/50] openssh-7.8p1-UsePAM-warning
+
+---
+ sshd-session.c | 4 ++++
+ sshd_config    | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/sshd-session.c b/sshd-session.c
+index a365f26f..a70b36c9 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -1127,6 +1127,10 @@ main(int ac, char **av)
  			    "enabled authentication methods");
  	}
  
@@ -12,10 +23,11 @@ diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
  #ifdef WITH_OPENSSL
  	if (options.moduli_file != NULL)
  		dh_set_moduli_file(options.moduli_file);
-diff -up openssh-8.6p1/sshd_config.log-usepam-no openssh-8.6p1/sshd_config
---- openssh-8.6p1/sshd_config.log-usepam-no	2021-04-19 14:00:45.098735121 +0200
-+++ openssh-8.6p1/sshd_config	2021-04-19 14:00:45.099735129 +0200
-@@ -87,6 +87,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
+diff --git a/sshd_config b/sshd_config
+index 608203e4..48af6321 100644
+--- a/sshd_config
++++ b/sshd_config
+@@ -89,6 +89,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and KbdInteractiveAuthentication to 'no'.
@@ -24,3 +36,6 @@ diff -up openssh-8.6p1/sshd_config.log-usepam-no openssh-8.6p1/sshd_config
  #UsePAM no
  
  #AllowAgentForwarding yes
+-- 
+2.49.0
+

0013-openssh-6.6p1-force_krb.patch

@@ -1,5 +1,17 @@
+From f5e5ee321def2a3674600714ad98fd1ca9b2cff1 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 13/50] openssh-6.6p1-force_krb
+
+---
+ gss-serv-krb5.c | 156 +++++++++++++++++++++++++++++++++++++++++++++++-
+ session.c       |  23 +++++++
+ ssh-gss.h       |   4 ++
+ sshd.8          |   7 +++
+ 4 files changed, 189 insertions(+), 1 deletion(-)
+
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 413b845..54dd383 100644
+index 8d2b677f..14502c5a 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
 @@ -32,7 +32,9 @@
@@ -12,7 +24,7 @@ index 413b845..54dd383 100644
  
  #include "xmalloc.h"
  #include "sshkey.h"
-@@ -45,6 +47,7 @@
+@@ -44,6 +46,7 @@
  
  #include "ssh-gss.h"
  
@@ -20,7 +32,7 @@ index 413b845..54dd383 100644
  extern ServerOptions options;
  
  #ifdef HEIMDAL
-@@ -56,6 +59,13 @@ extern ServerOptions options;
+@@ -55,6 +58,13 @@ extern ServerOptions options;
  # include <gssapi/gssapi_krb5.h>
  #endif
  
@@ -34,7 +46,7 @@ index 413b845..54dd383 100644
  static krb5_context krb_context = NULL;
  
  /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
-@@ -88,6 +98,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -87,6 +97,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  	krb5_principal princ;
  	int retval;
  	const char *errmsg;
@@ -42,7 +54,7 @@ index 413b845..54dd383 100644
  
  	if (ssh_gssapi_krb5_init() == 0)
  		return 0;
-@@ -99,10 +110,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -98,10 +109,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  		krb5_free_error_message(krb_context, errmsg);
  		return 0;
  	}
@@ -66,7 +78,7 @@ index 413b845..54dd383 100644
  	} else
  		retval = 0;
  
-@@ -110,6 +133,137 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -109,6 +132,137 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  	return retval;
  }
  
@@ -205,10 +217,10 @@ index 413b845..54dd383 100644
  /* This writes out any forwarded credentials from the structure populated
   * during userauth. Called after we have setuid to the user */
 diff --git a/session.c b/session.c
-index 28659ec..9c94d8e 100644
+index cbfbcee8..89b3a9cf 100644
 --- a/session.c
 +++ b/session.c
-@@ -789,6 +789,29 @@ do_exec(Session *s, const char *command)
+@@ -680,6 +680,29 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
  		command = auth_opts->force_command;
  		forced = "(key-option)";
  	}
@@ -239,7 +251,7 @@ index 28659ec..9c94d8e 100644
  	if (forced != NULL) {
  		s->forced = 1;
 diff --git a/ssh-gss.h b/ssh-gss.h
-index 0374c88..509109a 100644
+index 8ec45192..db34d77f 100644
 --- a/ssh-gss.h
 +++ b/ssh-gss.h
 @@ -49,6 +49,10 @@
@@ -254,10 +266,10 @@ index 0374c88..509109a 100644
  
  /* draft-ietf-secsh-gsskeyex-06 */
 diff --git a/sshd.8 b/sshd.8
-index adcaaf9..824163b 100644
+index 2aa73271..049d0a94 100644
 --- a/sshd.8
 +++ b/sshd.8
-@@ -324,6 +324,7 @@ Finally, the server and the client enter an authentication dialog.
+@@ -286,6 +286,7 @@ Finally, the server and the client enter an authentication dialog.
  The client tries to authenticate itself using
  host-based authentication,
  public key authentication,
@@ -265,7 +277,7 @@ index adcaaf9..824163b 100644
  challenge-response authentication,
  or password authentication.
  .Pp
-@@ -800,6 +801,12 @@ This file is used in exactly the same way as
+@@ -874,6 +875,12 @@ This file is used in exactly the same way as
  but allows host-based authentication without permitting login with
  rlogin/rsh.
  .Pp
@@ -278,3 +290,6 @@ index adcaaf9..824163b 100644
  .It Pa ~/.ssh/
  This directory is the default location for all user-specific configuration
  and authentication information.
+-- 
+2.49.0
+

0014-openssh-7.7p1-gssapi-new-unique.patch

@@ -1,26 +1,25 @@
-diff -up openssh-8.6p1/auth.h.ccache_name openssh-8.6p1/auth.h
---- openssh-8.6p1/auth.h.ccache_name	2021-04-19 14:05:10.820744325 +0200
-+++ openssh-8.6p1/auth.h	2021-04-19 14:05:10.853744569 +0200
-@@ -83,6 +83,7 @@ struct Authctxt {
- 	krb5_principal	 krb5_user;
- 	char		*krb5_ticket_file;
- 	char		*krb5_ccname;
-+	int		 krb5_set_env;
- #endif
- 	struct sshbuf	*loginmsg;
- 
-@@ -231,7 +232,7 @@ struct passwd *fakepw(void);
- int	 sys_auth_passwd(struct ssh *, const char *);
- 
- #if defined(KRB5) && !defined(HEIMDAL)
--krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
-+krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
- #endif
- 
- #endif /* AUTH_H */
-diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
---- openssh-8.6p1/auth-krb5.c.ccache_name	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/auth-krb5.c	2021-04-19 14:40:55.142832954 +0200
+From 5fca5946aa97dce23c6824c52b070a92532752a9 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 14/50] openssh-7.7p1-gssapi-new-unique
+
+---
+ auth-krb5.c     | 262 ++++++++++++++++++++++++++++++++++++++++++------
+ auth.h          |   3 +-
+ gss-serv-krb5.c |  42 +++-----
+ gss-serv.c      |  10 +-
+ servconf.c      |  12 ++-
+ servconf.h      |   2 +
+ session.c       |   5 +-
+ ssh-gss.h       |   4 +-
+ sshd-session.c  |   2 +-
+ sshd_config.5   |   8 ++
+ 10 files changed, 279 insertions(+), 71 deletions(-)
+
+diff --git a/auth-krb5.c b/auth-krb5.c
+index c99e4e43..77714e3d 100644
+--- a/auth-krb5.c
++++ b/auth-krb5.c
 @@ -51,6 +51,7 @@
  #include <unistd.h>
  #include <string.h>
@@ -29,7 +28,7 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
  
  extern ServerOptions	 options;
  
-@@ -77,7 +78,7 @@ auth_krb5_password(Authctxt *authctxt, c
+@@ -77,7 +78,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
  #endif
  	krb5_error_code problem;
  	krb5_ccache ccache = NULL;
@@ -38,7 +37,7 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
  	char *client, *platform_client;
  	const char *errmsg;
  
-@@ -163,8 +164,8 @@ auth_krb5_password(Authctxt *authctxt, c
+@@ -163,8 +164,8 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
  		goto out;
  	}
  
@@ -49,7 +48,7 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
  	if (problem)
  		goto out;
  
-@@ -179,15 +180,14 @@ auth_krb5_password(Authctxt *authctxt, c
+@@ -179,15 +180,14 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
  		goto out;
  #endif
  
@@ -70,7 +69,7 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
  		do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);
  #endif
  
-@@ -223,11 +223,54 @@ auth_krb5_password(Authctxt *authctxt, c
+@@ -223,11 +223,54 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
  void
  krb5_cleanup_proc(Authctxt *authctxt)
  {
@@ -126,12 +125,29 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
  	if (authctxt->krb5_user) {
  		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
  		authctxt->krb5_user = NULL;
-@@ -238,36 +281,188 @@ krb5_cleanup_proc(Authctxt *authctxt)
+@@ -238,36 +281,189 @@ krb5_cleanup_proc(Authctxt *authctxt)
  	}
  }
  
 -#ifndef HEIMDAL
-+
+-krb5_error_code
+-ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
+-	int tmpfd, ret, oerrno;
+-	char ccname[40];
+-	mode_t old_umask;
+ 
+-	ret = snprintf(ccname, sizeof(ccname),
+-	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
+-	if (ret < 0 || (size_t)ret >= sizeof(ccname))
+-		return ENOMEM;
+-
+-	old_umask = umask(0177);
+-	tmpfd = mkstemp(ccname + strlen("FILE:"));
+-	oerrno = errno;
+-	umask(old_umask);
+-	if (tmpfd == -1) {
+-		logit("mkstemp(): %.100s", strerror(oerrno));
+-		return oerrno;
 +#if !defined(HEIMDAL)
 +int
 +ssh_asprintf_append(char **dsc, const char *fmt, ...) {
@@ -149,7 +165,8 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
 +	old = *dsc;
 +
 +	i = asprintf(dsc, "%s%s", *dsc, src);
-+	if (i == -1 || src == NULL) {
++	if (i == -1) {
++		*dsc = old;
 +		free(src);
 +		return -1;
 +	}
@@ -196,8 +213,9 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
 +			/* unknown token, fallback to the default */
 +			goto cleanup;
 +		}
-+	}
-+
+ 	}
+ 
+-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
 +	if (ssh_asprintf_append(&r, "%s", p_o) == -1)
 +		goto cleanup;
 +
@@ -232,29 +250,13 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
 +	return ret;
 +}
 +
- krb5_error_code
--ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
--	int tmpfd, ret, oerrno;
--	char ccname[40];
++krb5_error_code
 +ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environment) {
 +	int tmpfd, ret, oerrno, type_len;
 +	char *ccname = NULL;
- 	mode_t old_umask;
++	mode_t old_umask;
 +	char *type = NULL, *colon = NULL;
- 
--	ret = snprintf(ccname, sizeof(ccname),
--	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
--	if (ret < 0 || (size_t)ret >= sizeof(ccname))
--		return ENOMEM;
--
--	old_umask = umask(0177);
--	tmpfd = mkstemp(ccname + strlen("FILE:"));
--	oerrno = errno;
--	umask(old_umask);
--	if (tmpfd == -1) {
--		logit("mkstemp(): %.100s", strerror(oerrno));
--		return oerrno;
--	}
++
 +	debug3_f("called");
 +	if (need_environment)
 +		*need_environment = 0;
@@ -269,8 +271,7 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
 +		    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
 +		if (ret < 0)
 +			return ENOMEM;
- 
--	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
++
 +		old_umask = umask(0177);
 +		tmpfd = mkstemp(ccname + strlen("FILE:"));
  		oerrno = errno;
@@ -337,42 +338,32 @@ diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
  }
  #endif /* !HEIMDAL */
  #endif /* KRB5 */
-diff -up openssh-8.6p1/gss-serv.c.ccache_name openssh-8.6p1/gss-serv.c
---- openssh-8.6p1/gss-serv.c.ccache_name	2021-04-19 14:05:10.844744503 +0200
-+++ openssh-8.6p1/gss-serv.c	2021-04-19 14:05:10.854744577 +0200
-@@ -413,13 +413,15 @@ ssh_gssapi_cleanup_creds(void)
- }
+diff --git a/auth.h b/auth.h
+index 83d07ae8..10e88e11 100644
+--- a/auth.h
++++ b/auth.h
+@@ -85,6 +85,7 @@ struct Authctxt {
+ 	krb5_principal	 krb5_user;
+ 	char		*krb5_ticket_file;
+ 	char		*krb5_ccname;
++	int		 krb5_set_env;
+ #endif
+ 	struct sshbuf	*loginmsg;
  
- /* As user */
--void
-+int
- ssh_gssapi_storecreds(void)
- {
- 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
--		(*gssapi_client.mech->storecreds)(&gssapi_client);
-+		return (*gssapi_client.mech->storecreds)(&gssapi_client);
- 	} else
- 		debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
-+
-+	return 0;
- }
+@@ -245,7 +246,7 @@ FILE	*auth_openprincipals(const char *, struct passwd *, int);
+ int	 sys_auth_passwd(struct ssh *, const char *);
  
- /* This allows GSSAPI methods to do things to the child's environment based
-@@ -499,9 +501,7 @@ ssh_gssapi_rekey_creds(void) {
- 	char *envstr;
+ #if defined(KRB5) && !defined(HEIMDAL)
+-krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
++krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
  #endif
  
--	if (gssapi_client.store.filename == NULL &&
--	    gssapi_client.store.envval == NULL &&
--	    gssapi_client.store.envvar == NULL)
-+	if (gssapi_client.store.envval == NULL)
- 		return;
- 
- 	ok = mm_ssh_gssapi_update_creds(&gssapi_client.store);
-diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
---- openssh-8.6p1/gss-serv-krb5.c.ccache_name	2021-04-19 14:05:10.852744562 +0200
-+++ openssh-8.6p1/gss-serv-krb5.c	2021-04-19 14:05:10.854744577 +0200
-@@ -267,7 +267,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
+ #endif /* AUTH_H */
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index 14502c5a..df55512d 100644
+--- a/gss-serv-krb5.c
++++ b/gss-serv-krb5.c
+@@ -267,7 +267,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
  /* This writes out any forwarded credentials from the structure populated
   * during userauth. Called after we have setuid to the user */
  
@@ -381,7 +372,7 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  {
  	krb5_ccache ccache;
-@@ -276,14 +276,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -276,14 +276,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  	OM_uint32 maj_status, min_status;
  	const char *new_ccname, *new_cctype;
  	const char *errmsg;
@@ -399,7 +390,7 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  
  #ifdef HEIMDAL
  # ifdef HAVE_KRB5_CC_NEW_UNIQUE
-@@ -297,14 +298,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -297,14 +298,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  		krb5_get_err_text(krb_context, problem));
  # endif
  		krb5_free_error_message(krb_context, errmsg);
@@ -418,7 +409,7 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  	}
  #endif	/* #ifdef HEIMDAL */
  
-@@ -313,7 +314,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -313,7 +314,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  		errmsg = krb5_get_error_message(krb_context, problem);
  		logit("krb5_parse_name(): %.100s", errmsg);
  		krb5_free_error_message(krb_context, errmsg);
@@ -427,7 +418,7 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  	}
  
  	if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
-@@ -322,7 +323,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -322,7 +323,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  		krb5_free_error_message(krb_context, errmsg);
  		krb5_free_principal(krb_context, princ);
  		krb5_cc_destroy(krb_context, ccache);
@@ -436,7 +427,7 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  	}
  
  	krb5_free_principal(krb_context, princ);
-@@ -331,32 +332,21 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -331,32 +332,21 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  	    client->creds, ccache))) {
  		logit("gss_krb5_copy_ccache() failed");
  		krb5_cc_destroy(krb_context, ccache);
@@ -474,7 +465,7 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  		do_pam_putenv(client->store.envvar, client->store.envval);
  #endif
  
-@@ -364,7 +354,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -364,7 +354,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
  
  	client->store.data = krb_context;
  
@@ -483,10 +474,44 @@ diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
  }
  
  int
-diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
---- openssh-8.6p1/servconf.c.ccache_name	2021-04-19 14:05:10.848744532 +0200
-+++ openssh-8.6p1/servconf.c	2021-04-19 14:05:10.854744577 +0200
-@@ -136,6 +136,7 @@ initialize_server_options(ServerOptions
+diff --git a/gss-serv.c b/gss-serv.c
+index a5cca797..9d5435ed 100644
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -414,13 +414,15 @@ ssh_gssapi_cleanup_creds(void)
+ }
+ 
+ /* As user */
+-void
++int
+ ssh_gssapi_storecreds(void)
+ {
+ 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
+-		(*gssapi_client.mech->storecreds)(&gssapi_client);
++		return (*gssapi_client.mech->storecreds)(&gssapi_client);
+ 	} else
+ 		debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
++
++	return 0;
+ }
+ 
+ /* This allows GSSAPI methods to do things to the child's environment based
+@@ -500,9 +502,7 @@ ssh_gssapi_rekey_creds(void) {
+ 	char *envstr;
+ #endif
+ 
+-	if (gssapi_client.store.filename == NULL &&
+-	    gssapi_client.store.envval == NULL &&
+-	    gssapi_client.store.envvar == NULL)
++	if (gssapi_client.store.envval == NULL)
+ 		return;
+ 
+ 	ok = mm_ssh_gssapi_update_creds(&gssapi_client.store);
+diff --git a/servconf.c b/servconf.c
+index d4f7fd66..55aa5bf0 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -138,6 +138,7 @@ initialize_server_options(ServerOptions *options)
  	options->kerberos_or_local_passwd = -1;
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
@@ -494,7 +519,7 @@ diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
  	options->gss_authentication=-1;
  	options->gss_keyex = -1;
  	options->gss_cleanup_creds = -1;
-@@ -359,6 +360,8 @@ fill_default_server_options(ServerOption
+@@ -382,6 +383,8 @@ fill_default_server_options(ServerOptions *options)
  		options->kerberos_ticket_cleanup = 1;
  	if (options->kerberos_get_afs_token == -1)
  		options->kerberos_get_afs_token = 0;
@@ -503,16 +528,16 @@ diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
  	if (options->gss_keyex == -1)
-@@ -506,7 +509,7 @@ typedef enum {
-	sPort, sHostKeyFile, sLoginGraceTime,
-	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
-	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
+@@ -564,7 +567,7 @@ typedef enum {
+ 	sPort, sHostKeyFile, sLoginGraceTime,
+ 	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
+ 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 -	sKerberosGetAFSToken, sPasswordAuthentication,
 +	sKerberosGetAFSToken, sKerberosUniqueCCache, sPasswordAuthentication,
-	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
-	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-@@ -593,11 +597,13 @@ static struct {
+ 	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
+ 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+ 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
+@@ -655,11 +658,13 @@ static struct {
  #else
  	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
  #endif
@@ -526,7 +551,7 @@ diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
  #endif
  	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
  	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1573,6 +1579,10 @@ process_server_config_line_depth(ServerO
+@@ -1668,6 +1673,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  		intptr = &options->kerberos_get_afs_token;
  		goto parse_flag;
  
@@ -537,7 +562,7 @@ diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
  	case sGssAuthentication:
  		intptr = &options->gss_authentication;
  		goto parse_flag;
-@@ -2891,6 +2901,7 @@ dump_config(ServerOptions *o)
+@@ -3293,6 +3302,7 @@ dump_config(ServerOptions *o)
  # ifdef USE_AFS
  	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
  # endif
@@ -545,10 +570,11 @@ diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
  #endif
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff -up openssh-8.6p1/servconf.h.ccache_name openssh-8.6p1/servconf.h
---- openssh-8.6p1/servconf.h.ccache_name	2021-04-19 14:05:10.848744532 +0200
-+++ openssh-8.6p1/servconf.h	2021-04-19 14:05:10.855744584 +0200
-@@ -140,6 +140,8 @@ typedef struct {
+diff --git a/servconf.h b/servconf.h
+index c3f50140..a4a38d6d 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -149,6 +149,8 @@ typedef struct {
  						 * file on logout. */
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
@@ -557,10 +583,11 @@ diff -up openssh-8.6p1/servconf.h.ccache_name openssh-8.6p1/servconf.h
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
  	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
  	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff -up openssh-8.6p1/session.c.ccache_name openssh-8.6p1/session.c
---- openssh-8.6p1/session.c.ccache_name	2021-04-19 14:05:10.852744562 +0200
-+++ openssh-8.6p1/session.c	2021-04-19 14:05:10.855744584 +0200
-@@ -1038,7 +1038,8 @@ do_setup_env(struct ssh *ssh, Session *s
+diff --git a/session.c b/session.c
+index 89b3a9cf..2620dd11 100644
+--- a/session.c
++++ b/session.c
+@@ -1025,7 +1025,8 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
  	/* Allow any GSSAPI methods that we've used to alter
  	 * the child's environment as they see fit
  	 */
@@ -570,7 +597,7 @@ diff -up openssh-8.6p1/session.c.ccache_name openssh-8.6p1/session.c
  #endif
  
  	/* Set basic environment. */
-@@ -1114,7 +1115,7 @@ do_setup_env(struct ssh *ssh, Session *s
+@@ -1101,7 +1102,7 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
  	}
  #endif
  #ifdef KRB5
@@ -579,10 +606,33 @@ diff -up openssh-8.6p1/session.c.ccache_name openssh-8.6p1/session.c
  		child_set_env(&env, &envsize, "KRB5CCNAME",
  		    s->authctxt->krb5_ccname);
  #endif
-diff -up openssh-8.6p1/sshd-session.c.ccache_name openssh-8.6p1/sshd-session.c
---- openssh-8.6p1/sshd-session.c.ccache_name	2021-04-19 14:05:10.849744540 +0200
-+++ openssh-8.6p1/sshd-session.c	2021-04-19 14:05:10.855744584 +0200
-@@ -2284,7 +2284,7 @@ main(int ac, char **av)
+diff --git a/ssh-gss.h b/ssh-gss.h
+index db34d77f..a894e23c 100644
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -116,7 +116,7 @@ typedef struct ssh_gssapi_mech_struct {
+ 	int (*dochild) (ssh_gssapi_client *);
+ 	int (*userok) (ssh_gssapi_client *, char *);
+ 	int (*localname) (ssh_gssapi_client *, char **);
+-	void (*storecreds) (ssh_gssapi_client *);
++	int (*storecreds) (ssh_gssapi_client *);
+ 	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
+ } ssh_gssapi_mech;
+ 
+@@ -186,7 +186,7 @@ int ssh_gssapi_userok(char *name, struct passwd *, int kex);
+ OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
+ void ssh_gssapi_do_child(char ***, u_int *);
+ void ssh_gssapi_cleanup_creds(void);
+-void ssh_gssapi_storecreds(void);
++int ssh_gssapi_storecreds(void);
+ const char *ssh_gssapi_displayname(void);
+ 
+ char *ssh_gssapi_server_mechanisms(void);
+diff --git a/sshd-session.c b/sshd-session.c
+index f8c8a797..478381db 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -1349,7 +1349,7 @@ main(int ac, char **av)
  #ifdef GSSAPI
  	if (options.gss_authentication) {
  		temporarily_use_uid(authctxt->pw);
@@ -591,10 +641,11 @@ diff -up openssh-8.6p1/sshd-session.c.ccache_name openssh-8.6p1/sshd-session.c
  		restore_uid();
  	}
  #endif
-diff -up openssh-8.6p1/sshd_config.5.ccache_name openssh-8.6p1/sshd_config.5
---- openssh-8.6p1/sshd_config.5.ccache_name	2021-04-19 14:05:10.849744540 +0200
-+++ openssh-8.6p1/sshd_config.5	2021-04-19 14:05:10.856744592 +0200
-@@ -939,6 +939,14 @@ Specifies whether to automatically destr
+diff --git a/sshd_config.5 b/sshd_config.5
+index 8bc6586e..1251d4d5 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -1033,6 +1033,14 @@ Specifies whether to automatically destroy the user's ticket cache
  file on logout.
  The default is
  .Cm yes .
@@ -609,24 +660,6 @@ diff -up openssh-8.6p1/sshd_config.5.ccache_name openssh-8.6p1/sshd_config.5
  .It Cm KexAlgorithms
  Specifies the permitted KEX (Key Exchange) algorithms that the server will
  offer to clients.
-diff -up openssh-8.6p1/ssh-gss.h.ccache_name openssh-8.6p1/ssh-gss.h
---- openssh-8.6p1/ssh-gss.h.ccache_name	2021-04-19 14:05:10.852744562 +0200
-+++ openssh-8.6p1/ssh-gss.h	2021-04-19 14:05:10.855744584 +0200
-@@ -114,7 +114,7 @@ typedef struct ssh_gssapi_mech_struct {
- 	int (*dochild) (ssh_gssapi_client *);
- 	int (*userok) (ssh_gssapi_client *, char *);
- 	int (*localname) (ssh_gssapi_client *, char **);
--	void (*storecreds) (ssh_gssapi_client *);
-+	int (*storecreds) (ssh_gssapi_client *);
- 	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
- } ssh_gssapi_mech;
- 
-@@ -175,7 +175,7 @@ int ssh_gssapi_userok(char *name, struct
- OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_do_child(char ***, u_int *);
- void ssh_gssapi_cleanup_creds(void);
--void ssh_gssapi_storecreds(void);
-+int ssh_gssapi_storecreds(void);
- const char *ssh_gssapi_displayname(void);
- 
- char *ssh_gssapi_server_mechanisms(void);
+-- 
+2.49.0
+

0015-openssh-7.2p2-k5login_directory.patch

@@ -1,8 +1,20 @@
+From 25540939422660b024b8832f67eab82267aa8df6 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 15/50] openssh-7.2p2-k5login_directory
+
+---
+ auth-krb5.c     | 16 ++++++++++++++++
+ auth.h          |  2 ++
+ gss-serv-krb5.c | 21 ++++++++++++++++++++-
+ sshd.8          |  4 ++++
+ 4 files changed, 42 insertions(+), 1 deletion(-)
+
 diff --git a/auth-krb5.c b/auth-krb5.c
-index 2b02a04..19b9364 100644
+index 77714e3d..74f56d47 100644
 --- a/auth-krb5.c
 +++ b/auth-krb5.c
-@@ -375,5 +375,21 @@ cleanup:
+@@ -465,5 +465,21 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
  		return (krb5_cc_resolve(ctx, ccname, ccache));
  	}
  }
@@ -25,10 +37,10 @@ index 2b02a04..19b9364 100644
  #endif /* !HEIMDAL */
  #endif /* KRB5 */
 diff --git a/auth.h b/auth.h
-index f9d191c..c432d2f 100644
+index 10e88e11..39163035 100644
 --- a/auth.h
 +++ b/auth.h
-@@ -222,6 +222,8 @@ int	 sys_auth_passwd(Authctxt *, const char *);
+@@ -247,6 +247,8 @@ int	 sys_auth_passwd(struct ssh *, const char *);
  
  #if defined(KRB5) && !defined(HEIMDAL)
  krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
@@ -38,10 +50,10 @@ index f9d191c..c432d2f 100644
  
  #endif /* AUTH_H */
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index a7c0c5f..df8cc9a 100644
+index df55512d..820f794c 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
-@@ -244,8 +244,27 @@ ssh_gssapi_k5login_exists()
+@@ -144,8 +144,27 @@ ssh_gssapi_k5login_exists()
  {
  	char file[MAXPATHLEN];
  	struct passwd *pw = the_authctxt->pw;
@@ -71,10 +83,10 @@ index a7c0c5f..df8cc9a 100644
  }
  
 diff --git a/sshd.8 b/sshd.8
-index 5c4f15b..135e290 100644
+index 049d0a94..6784286d 100644
 --- a/sshd.8
 +++ b/sshd.8
-@@ -806,6 +806,10 @@ rlogin/rsh.
+@@ -880,6 +880,10 @@ rlogin/rsh.
  These files enforce GSSAPI/Kerberos authentication access control.
  Further details are described in
  .Xr ksu 1 .
@@ -85,3 +97,6 @@ index 5c4f15b..135e290 100644
  .Pp
  .It Pa ~/.ssh/
  This directory is the default location for all user-specific configuration
+-- 
+2.49.0
+

0016-openssh-6.6p1-kuserok.patch

@@ -1,7 +1,22 @@
-diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c
---- openssh-7.4p1/auth-krb5.c.kuserok	2016-12-23 14:36:07.640465939 +0100
-+++ openssh-7.4p1/auth-krb5.c	2016-12-23 14:36:07.644465936 +0100
-@@ -56,6 +56,21 @@
+From bac7a9d1a654c8c2e0c71f979195e300b25d6232 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 16/50] openssh-6.6p1-kuserok
+
+---
+ auth-krb5.c     |  20 ++++++++-
+ gss-serv-krb5.c | 106 ++++++++++++++++++++++++++++++++++++++++++++++--
+ servconf.c      |  13 +++++-
+ servconf.h      |   1 +
+ sshd_config     |   1 +
+ sshd_config.5   |   5 +++
+ 6 files changed, 139 insertions(+), 7 deletions(-)
+
+diff --git a/auth-krb5.c b/auth-krb5.c
+index 74f56d47..bae153c9 100644
+--- a/auth-krb5.c
++++ b/auth-krb5.c
+@@ -55,6 +55,21 @@
  
  extern ServerOptions	 options;
  
@@ -23,7 +38,7 @@ diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c
  static int
  krb5_init(void *context)
  {
-@@ -160,8 +175,9 @@ auth_krb5_password(Authctxt *authctxt, c
+@@ -158,8 +173,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
  	if (problem)
  		goto out;
  
@@ -35,10 +50,11 @@ diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c
  		problem = -1;
  		goto out;
  	}
-diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
---- openssh-7.4p1/gss-serv-krb5.c.kuserok	2016-12-23 14:36:07.640465939 +0100
-+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 14:36:07.644465936 +0100
-@@ -67,6 +67,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index 820f794c..187faf92 100644
+--- a/gss-serv-krb5.c
++++ b/gss-serv-krb5.c
+@@ -66,6 +66,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_principal, const char *, const char *,
      int);
  
  static krb5_context krb_context = NULL;
@@ -46,7 +62,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
  
  /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
  
-@@ -92,6 +93,103 @@ ssh_gssapi_krb5_init(void)
+@@ -91,6 +92,103 @@ ssh_gssapi_krb5_init(void)
   * Returns true if the user is OK to log in, otherwise returns 0
   */
  
@@ -150,7 +166,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
  static int
  ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  {
-@@ -116,7 +214,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
+@@ -115,7 +213,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  	/* NOTE: .k5login and .k5users must opened as root, not the user,
  	 * because if they are on a krb5-protected filesystem, user credentials
  	 * to access these files aren't available yet. */
@@ -160,7 +176,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
  		retval = 1;
  		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
  		    name, (char *)client->displayname.value);
-@@ -190,9 +289,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
+@@ -190,9 +289,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
  	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
  	/* If both .k5login and .k5users DNE, self-login is ok. */
  	if (!k5login_exists && (access(file, F_OK) == -1)) {
@@ -172,18 +188,19 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
  	}
  	if ((fp = fopen(file, "r")) == NULL) {
  		int saved_errno = errno;
-diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
---- openssh-7.4p1/servconf.c.kuserok	2016-12-23 14:36:07.630465944 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:11:52.278133344 +0100
-@@ -116,6 +116,7 @@ initialize_server_options(ServerOptions
+diff --git a/servconf.c b/servconf.c
+index 55aa5bf0..5dd5ca21 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -145,6 +145,7 @@ initialize_server_options(ServerOptions *options)
  	options->gss_strict_acceptor = -1;
  	options->gss_store_rekey = -1;
  	options->gss_kex_algorithms = NULL;
 +	options->use_kuserok = -1;
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
-	options->permit_empty_passwd = -1;
-@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
+ 	options->permit_empty_passwd = -1;
+@@ -399,6 +400,8 @@ fill_default_server_options(ServerOptions *options)
  	if (options->gss_kex_algorithms == NULL)
  		options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
  #endif
@@ -192,16 +209,16 @@ diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -399,7 +402,7 @@ typedef enum {
-	sPort, sHostKeyFile, sLoginGraceTime,
-	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
-	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
+@@ -567,7 +570,7 @@ typedef enum {
+ 	sPort, sHostKeyFile, sLoginGraceTime,
+ 	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
+ 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 -	sKerberosGetAFSToken, sKerberosUniqueCCache, sPasswordAuthentication,
 +	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication,
-	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
-	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-@@ -478,12 +481,14 @@ static struct {
+ 	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
+ 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+ 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
+@@ -659,12 +662,14 @@ static struct {
  	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
  #endif
  	{ "kerberosuniqueccache", sKerberosUniqueCCache, SSHCFG_GLOBAL },
@@ -216,18 +233,18 @@ diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
  #endif
  	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
  	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1644,6 +1649,10 @@ process_server_config_line(ServerOptions
-		}
-		break;
-
+@@ -2441,6 +2446,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 		}
+ 		break;
+ 
 +	case sKerberosUseKuserok:
 +		intptr = &options->use_kuserok;
 +		goto parse_flag;
 +
-	case sMatch:
-		if (cmdline)
-			fatal("Match directive not supported as a command-line "
-@@ -2016,6 +2025,7 @@ copy_set_server_options(ServerOptions *d
+ 	case sMatch:
+ 		if (cmdline)
+ 			fatal("Match directive not supported as a command-line "
+@@ -2995,6 +3004,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
  	M_CP_INTOPT(client_alive_interval);
  	M_CP_INTOPT(ip_qos_interactive);
  	M_CP_INTOPT(ip_qos_bulk);
@@ -235,18 +252,19 @@ diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
  	M_CP_INTOPT(rekey_limit);
  	M_CP_INTOPT(rekey_interval);
  	M_CP_INTOPT(log_level);
-@@ -2309,6 +2319,7 @@ dump_config(ServerOptions *o)
+@@ -3303,6 +3313,7 @@ dump_config(ServerOptions *o)
  	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
  # endif
  	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
 +	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
  #endif
  #ifdef GSSAPI
-	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff -up openssh-7.4p1/servconf.h.kuserok openssh-7.4p1/servconf.h
---- openssh-7.4p1/servconf.h.kuserok	2016-12-23 14:36:07.630465944 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 14:36:07.645465936 +0100
-@@ -118,6 +118,7 @@ typedef struct {
+ 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
+diff --git a/servconf.h b/servconf.h
+index a4a38d6d..11de36a2 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -151,6 +151,7 @@ typedef struct {
  						 * authenticated with Kerberos. */
  	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
  						 * be stored in per-session ccache */
@@ -254,10 +272,23 @@ diff -up openssh-7.4p1/servconf.h.kuserok openssh-7.4p1/servconf.h
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
  	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
  	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5
---- openssh-7.4p1/sshd_config.5.kuserok	2016-12-23 14:36:07.637465940 +0100
-+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:14:03.117162222 +0100
-@@ -850,6 +850,10 @@ Specifies whether to automatically destr
+diff --git a/sshd_config b/sshd_config
+index 8db9f0fb..ea5a878e 100644
+--- a/sshd_config
++++ b/sshd_config
+@@ -75,6 +75,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ #KerberosOrLocalPasswd yes
+ #KerberosTicketCleanup yes
+ #KerberosGetAFSToken no
++#KerberosUseKuserok yes
+ 
+ # GSSAPI options
+ #GSSAPIAuthentication no
+diff --git a/sshd_config.5 b/sshd_config.5
+index 1251d4d5..0fcb409a 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -1041,6 +1041,10 @@ The default value
  .Cm no
  can lead to overwriting previous tickets by subseqent connections to the same
  user account.
@@ -268,7 +299,7 @@ diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5
  .It Cm KexAlgorithms
  Specifies the permitted KEX (Key Exchange) algorithms that the server will
  offer to clients.
-@@ -1078,6 +1082,7 @@ Available keywords are
+@@ -1355,6 +1359,7 @@ Available keywords are
  .Cm IPQoS ,
  .Cm KbdInteractiveAuthentication ,
  .Cm KerberosAuthentication ,
@@ -276,14 +307,6 @@ diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5
  .Cm LogLevel ,
  .Cm MaxAuthTries ,
  .Cm MaxSessions ,
-diff -up openssh-7.4p1/sshd_config.kuserok openssh-7.4p1/sshd_config
---- openssh-7.4p1/sshd_config.kuserok	2016-12-23 14:36:07.631465943 +0100
-+++ openssh-7.4p1/sshd_config	2016-12-23 14:36:07.646465935 +0100
-@@ -73,6 +73,7 @@ ChallengeResponseAuthentication no
- #KerberosOrLocalPasswd yes
- #KerberosTicketCleanup yes
- #KerberosGetAFSToken no
-+#KerberosUseKuserok yes
- 
- # GSSAPI options
- #GSSAPIAuthentication no
+-- 
+2.49.0
+

0017-openssh-6.4p1-fromto-remote.patch

@@ -0,0 +1,28 @@
+From 20aabb2c445e29d211266ce7434bb0273edf88b9 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 17/50] openssh-6.4p1-fromto-remote
+
+---
+ scp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/scp.c b/scp.c
+index 57c242ff..716ae386 100644
+--- a/scp.c
++++ b/scp.c
+@@ -1162,7 +1162,10 @@ toremote(int argc, char **argv, enum scp_mode_e mode, char *sftp_direct)
+ 			addargs(&alist, "%s", ssh_program);
+ 			addargs(&alist, "-x");
+ 			addargs(&alist, "-oClearAllForwardings=yes");
+-			addargs(&alist, "-n");
++			if (isatty(fileno(stdin)))
++				addargs(&alist, "-t");
++			else
++				addargs(&alist, "-n");
+ 			for (j = 0; j < remote_remote_args.num; j++) {
+ 				addargs(&alist, "%s",
+ 				    remote_remote_args.list[j]);
+-- 
+2.49.0
+

0018-openssh-6.6.1p1-selinux-contexts.patch

@@ -1,8 +1,20 @@
+From 6481ac7fbd0027a7038560e0f51dd0af056cc229 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 18/50] openssh-6.6.1p1-selinux-contexts
+
+---
+ openbsd-compat/port-linux-sshd.c | 69 +++++++++++++++++++++++++++++++-
+ openbsd-compat/port-linux.c      |  2 +-
+ openbsd-compat/port-linux.h      |  1 +
+ sshd-auth.c                      |  2 +-
+ 4 files changed, 71 insertions(+), 3 deletions(-)
+
 diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-index 8f32464..18a2ca4 100644
+index 8c5fc1fe..646f0887 100644
 --- a/openbsd-compat/port-linux-sshd.c
 +++ b/openbsd-compat/port-linux-sshd.c
-@@ -32,6 +32,7 @@
+@@ -33,6 +33,7 @@
  #include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
  #include "servconf.h"
  #include "port-linux.h"
@@ -10,7 +22,7 @@ index 8f32464..18a2ca4 100644
  #include "sshkey.h"
  #include "hostfile.h"
  #include "auth.h"
-@@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
+@@ -450,7 +451,7 @@ sshd_selinux_setup_exec_context(char *pwname)
  void
  sshd_selinux_copy_context(void)
  {
@@ -19,7 +31,7 @@ index 8f32464..18a2ca4 100644
  
  	if (!sshd_selinux_enabled())
  		return;
-@@ -461,6 +462,72 @@ sshd_selinux_copy_context(void)
+@@ -469,6 +470,72 @@ sshd_selinux_copy_context(void)
  	}
  }
  
@@ -93,22 +105,23 @@ index 8f32464..18a2ca4 100644
  #endif
  
 diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
---- a/openbsd-compat/port-linux.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/openbsd-compat/port-linux.c	(date 1703108053912)
-@@ -207,7 +207,7 @@
+index 7426f6f7..9a6b1d6e 100644
+--- a/openbsd-compat/port-linux.c
++++ b/openbsd-compat/port-linux.c
+@@ -188,7 +188,7 @@ ssh_selinux_change_context(const char *newname)
  	xasprintf(&newctx, "%.*s%s%s", (int)(cx - oldctx + 1), oldctx,
  	    newname, cx2 == NULL ? "" : cx2);
-
+ 
 -	debug3_f("setting context from '%s' to '%s'", oldctx, newctx);
 +	debug_f("setting context from '%s' to '%s'", oldctx, newctx);
  	if (setcon(newctx) < 0)
  		do_log2_f(log_level, "setcon %s from %s failed with %s",
  		    newctx, oldctx, strerror(errno));
 diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index cb51f99..8b7cda2 100644
+index 1b745a76..7f8ba200 100644
 --- a/openbsd-compat/port-linux.h
 +++ b/openbsd-compat/port-linux.h
-@@ -29,6 +29,7 @@ int sshd_selinux_enabled(void);
+@@ -27,6 +27,7 @@ int sshd_selinux_enabled(void);
  void sshd_selinux_copy_context(void);
  void sshd_selinux_setup_exec_context(char *);
  int sshd_selinux_setup_env_variables(void);
@@ -116,16 +129,19 @@ index cb51f99..8b7cda2 100644
  #endif
  
  #ifdef LINUX_OOM_ADJUST
-diff --git a/sshd-session.c b/sshd-session.c
-index 2871fe9..39b9c08 100644
---- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -629,7 +629,7 @@ privsep_preauth_child(void)
- 	demote_sensitive_data();
- 
+diff --git a/sshd-auth.c b/sshd-auth.c
+index d51e4636..e4a8edfd 100644
+--- a/sshd-auth.c
++++ b/sshd-auth.c
+@@ -188,7 +188,7 @@ privsep_child_demote(void)
+ 		fatal_f("ssh_sandbox_init failed");
+ #endif
  #ifdef WITH_SELINUX
 -	ssh_selinux_change_context("sshd_net_t");
 +	sshd_selinux_change_privsep_preauth_context();
  #endif
  
  	/* Demote the child */
+-- 
+2.49.0
+

0019-openssh-6.6.1p1-log-in-chroot.patch

@@ -1,7 +1,25 @@
-diff -up openssh-8.6p1/log.c.log-in-chroot openssh-8.6p1/log.c
---- openssh-8.6p1/log.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/log.c	2021-04-19 14:43:08.544843434 +0200
-@@ -194,6 +194,11 @@ void
+From 825018f5f2d892655f3d63167a0d1f3391cec678 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 19/50] openssh-6.6.1p1-log-in-chroot
+
+---
+ log.c              | 11 +++++++++--
+ log.h              |  1 +
+ monitor.c          | 17 +++++++++++++++--
+ monitor.h          |  2 +-
+ session.c          | 26 +++++++++++++++-----------
+ sftp-server-main.c |  2 +-
+ sftp-server.c      |  6 +++---
+ sftp.h             |  2 +-
+ sshd-session.c     |  7 ++++++-
+ 9 files changed, 52 insertions(+), 22 deletions(-)
+
+diff --git a/log.c b/log.c
+index 6617f267..9782cfb0 100644
+--- a/log.c
++++ b/log.c
+@@ -196,6 +196,11 @@ void
  log_init(const char *av0, LogLevel level, SyslogFacility facility,
      int on_stderr)
  {
@@ -13,7 +31,7 @@ diff -up openssh-8.6p1/log.c.log-in-chroot openssh-8.6p1/log.c
  #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
  	struct syslog_data sdata = SYSLOG_DATA_INIT;
  #endif
-@@ -206,8 +211,10 @@ log_init(const char *av0, LogLevel level
+@@ -208,8 +213,10 @@ log_init(const char *av0, LogLevel level, SyslogFacility facility,
  		exit(1);
  	}
  
@@ -26,9 +44,10 @@ diff -up openssh-8.6p1/log.c.log-in-chroot openssh-8.6p1/log.c
  
  	log_on_stderr = on_stderr;
  	if (on_stderr)
-diff -up openssh-8.6p1/log.h.log-in-chroot openssh-8.6p1/log.h
---- openssh-8.6p1/log.h.log-in-chroot	2021-04-19 14:43:08.544843434 +0200
-+++ openssh-8.6p1/log.h	2021-04-19 14:56:46.931042176 +0200
+diff --git a/log.h b/log.h
+index 8e8dfc23..70048a8a 100644
+--- a/log.h
++++ b/log.h
 @@ -52,6 +52,7 @@ typedef enum {
  typedef void (log_handler_fn)(LogLevel, int, const char *, void *);
  
@@ -37,43 +56,11 @@ diff -up openssh-8.6p1/log.h.log-in-chroot openssh-8.6p1/log.h
  LogLevel log_level_get(void);
  int      log_change_level(LogLevel);
  int      log_is_on_stderr(void);
-diff -up openssh-8.6p1/monitor.c.log-in-chroot openssh-8.6p1/monitor.c
---- openssh-8.6p1/monitor.c.log-in-chroot	2021-04-19 14:43:08.526843298 +0200
-+++ openssh-8.6p1/monitor.c	2021-04-19 14:55:25.286424043 +0200
-@@ -297,6 +297,8 @@ monitor_child_preauth(struct ssh *ssh, s
- 		close(pmonitor->m_log_sendfd);
- 	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
- 
-+	pmonitor->m_state = "preauth";
-+
- 	authctxt = (Authctxt *)ssh->authctxt;
- 	memset(authctxt, 0, sizeof(*authctxt));
- 	ssh->authctxt = authctxt;
-@@ -408,6 +410,8 @@ monitor_child_postauth(struct ssh *ssh,
- 	close(pmonitor->m_recvfd);
- 	pmonitor->m_recvfd = -1;
- 
-+	pmonitor->m_state = "postauth";
-+
- 	monitor_set_child_handler(pmonitor->m_pid);
- 	ssh_signal(SIGHUP, &monitor_child_handler);
- 	ssh_signal(SIGTERM, &monitor_child_handler);
-@@ -480,7 +484,7 @@ monitor_read_log(struct monitor *pmonito
- 	/* Log it */
- 	if (log_level_name(level) == NULL)
- 		fatal_f("invalid log level %u (corrupted message?)", level);
--	sshlogdirect(level, forced, "%s [preauth]", msg);
-+	sshlogdirect(level, forced, "%s [%s]", msg, pmonitor->m_state);
- 
- 	sshbuf_free(logmsg);
- 	free(msg);
-@@ -1868,13 +1872,28 @@ monitor_init(void)
- 	mon = xcalloc(1, sizeof(*mon));
- 	monitor_openfds(mon, 1);
- 
-+	mon->m_state = "";
-+
- 	return mon;
+diff --git a/monitor.c b/monitor.c
+index 2ef16cc8..43c10a4e 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -2001,9 +2001,22 @@ monitor_init(void)
  }
  
  void
@@ -98,14 +85,11 @@ diff -up openssh-8.6p1/monitor.c.log-in-chroot openssh-8.6p1/monitor.c
  }
  
  #ifdef GSSAPI
-diff -up openssh-8.6p1/monitor.h.log-in-chroot openssh-8.6p1/monitor.h
---- openssh-8.6p1/monitor.h.log-in-chroot	2021-04-19 14:43:08.527843305 +0200
-+++ openssh-8.6p1/monitor.h	2021-04-19 14:43:08.545843441 +0200
-@@ -80,10 +80,11 @@ struct monitor {
- 	int			 m_log_sendfd;
- 	struct kex		**m_pkex;
- 	pid_t			 m_pid;
-+	char		*m_state;
+diff --git a/monitor.h b/monitor.h
+index dbc7e003..d4d631dd 100644
+--- a/monitor.h
++++ b/monitor.h
+@@ -85,7 +85,7 @@ struct monitor {
  };
  
  struct monitor *monitor_init(void);
@@ -114,10 +98,11 @@ diff -up openssh-8.6p1/monitor.h.log-in-chroot openssh-8.6p1/monitor.h
  
  struct Authctxt;
  void monitor_child_preauth(struct ssh *, struct monitor *);
-diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
---- openssh-8.6p1/session.c.log-in-chroot	2021-04-19 14:43:08.534843358 +0200
-+++ openssh-8.6p1/session.c	2021-04-19 14:43:08.545843441 +0200
-@@ -160,6 +160,7 @@ login_cap_t *lc;
+diff --git a/session.c b/session.c
+index 2620dd11..54da09d5 100644
+--- a/session.c
++++ b/session.c
+@@ -169,6 +169,7 @@ login_cap_t *lc;
  
  static int is_child = 0;
  static int in_chroot = 0;
@@ -125,7 +110,7 @@ diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
  
  /* File containing userauth info, if ExposeAuthInfo set */
  static char *auth_info_file = NULL;
-@@ -661,6 +662,7 @@ do_exec(struct ssh *ssh, Session *s, con
+@@ -670,6 +671,7 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
  	int ret;
  	const char *forced = NULL, *tty = NULL;
  	char session_type[1024];
@@ -133,7 +118,7 @@ diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
  
  	if (options.adm_forced_command) {
  		original_command = command;
-@@ -720,6 +722,10 @@ do_exec(struct ssh *ssh, Session *s, con
+@@ -729,6 +731,10 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
  			tty += 5;
  	}
  
@@ -144,7 +129,7 @@ diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
  	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
  	    session_type,
  	    tty == NULL ? "" : " on ",
-@@ -1524,14 +1530,6 @@ child_close_fds(struct ssh *ssh)
+@@ -1512,14 +1518,6 @@ child_close_fds(struct ssh *ssh)
  
  	/* Stop directing logs to a high-numbered fd before we close it */
  	log_redirect_stderr_to(NULL);
@@ -159,7 +144,7 @@ diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
  }
  
  /*
-@@ -1665,8 +1663,6 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1652,8 +1650,6 @@ do_child(struct ssh *ssh, Session *s, const char *command)
  			exit(1);
  	}
  
@@ -168,7 +153,7 @@ diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
  	do_rc_files(ssh, s, shell);
  
  	/* restore SIGPIPE for child */
-@@ -1691,9 +1687,17 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1678,9 +1674,17 @@ do_child(struct ssh *ssh, Session *s, const char *command)
  		argv[i] = NULL;
  		optind = optreset = 1;
  		__progname = argv[0];
@@ -187,29 +172,31 @@ diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
  	fflush(NULL);
  
  	/* Get the last component of the shell name. */
-diff -up openssh-8.6p1/sftp.h.log-in-chroot openssh-8.6p1/sftp.h
---- openssh-8.6p1/sftp.h.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/sftp.h	2021-04-19 14:43:08.545843441 +0200
-@@ -97,5 +97,5 @@
+diff --git a/sftp-server-main.c b/sftp-server-main.c
+index 2c70f89b..bbb79f27 100644
+--- a/sftp-server-main.c
++++ b/sftp-server-main.c
+@@ -48,5 +48,5 @@ main(int argc, char **argv)
+ 		return 1;
+ 	}
  
- struct passwd;
- 
--int	sftp_server_main(int, char **, struct passwd *);
-+int	sftp_server_main(int, char **, struct passwd *, int);
- void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
-diff -up openssh-8.6p1/sftp-server.c.log-in-chroot openssh-8.6p1/sftp-server.c
---- openssh-8.6p1/sftp-server.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/sftp-server.c	2021-04-19 14:43:08.545843441 +0200
-@@ -1644,7 +1644,7 @@ sftp_server_usage(void)
+-	return (sftp_server_main(argc, argv, user_pw));
++	return (sftp_server_main(argc, argv, user_pw, 0));
+ }
+diff --git a/sftp-server.c b/sftp-server.c
+index a4abb9f7..4985da38 100644
+--- a/sftp-server.c
++++ b/sftp-server.c
+@@ -1901,7 +1901,7 @@ sftp_server_usage(void)
  }
  
  int
 -sftp_server_main(int argc, char **argv, struct passwd *user_pw)
 +sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
  {
-	int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
-	ssize_t len, olen;
-@@ -1657,7 +1657,7 @@ sftp_server_main(int argc, char **argv,
+ 	int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
+ 	ssize_t len, olen;
+@@ -1913,7 +1913,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
  	extern char *__progname;
  
  	__progname = ssh_get_progname(argv[0]);
@@ -218,7 +205,7 @@ diff -up openssh-8.6p1/sftp-server.c.log-in-chroot openssh-8.6p1/sftp-server.c
  
  	pw = pwcopy(user_pw);
  
-@@ -1730,7 +1730,7 @@ sftp_server_main(int argc, char **argv,
+@@ -1986,7 +1986,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
  		}
  	}
  
@@ -227,20 +214,22 @@ diff -up openssh-8.6p1/sftp-server.c.log-in-chroot openssh-8.6p1/sftp-server.c
  
  	/*
  	 * On platforms where we can, avoid making /proc/self/{mem,maps}
-diff -up openssh-8.6p1/sftp-server-main.c.log-in-chroot openssh-8.6p1/sftp-server-main.c
---- openssh-8.6p1/sftp-server-main.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/sftp-server-main.c	2021-04-19 14:43:08.545843441 +0200
-@@ -50,5 +50,5 @@ main(int argc, char **argv)
- 		return 1;
- 	}
+diff --git a/sftp.h b/sftp.h
+index 2bde8bb7..ddf1a396 100644
+--- a/sftp.h
++++ b/sftp.h
+@@ -97,5 +97,5 @@
  
--	return (sftp_server_main(argc, argv, user_pw));
-+	return (sftp_server_main(argc, argv, user_pw, 0));
- }
-diff -up openssh-8.6p1/sshd-session.c.log-in-chroot openssh-8.6p1/sshd-session.c
---- openssh-8.6p1/sshd-session.c.log-in-chroot	2021-04-19 14:43:08.543843426 +0200
-+++ openssh-8.6p1/sshd-session.c	2021-04-19 14:43:08.545843441 +0200
-@@ -559,7 +559,7 @@ privsep_postauth(struct ssh *ssh, Authct
+ struct passwd;
+ 
+-int	sftp_server_main(int, char **, struct passwd *);
++int	sftp_server_main(int, char **, struct passwd *, int);
+ void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
+diff --git a/sshd-session.c b/sshd-session.c
+index 478381db..9342e416 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -437,7 +437,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
  #endif
  
  	/* New socket pair */
@@ -249,7 +238,7 @@ diff -up openssh-8.6p1/sshd-session.c.log-in-chroot openssh-8.6p1/sshd-session.c
  
  	pmonitor->m_pid = fork();
  	if (pmonitor->m_pid == -1)
-@@ -578,6 +578,11 @@ privsep_postauth(struct ssh *ssh, Authct
+@@ -456,6 +456,11 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
  
  	close(pmonitor->m_sendfd);
  	pmonitor->m_sendfd = -1;
@@ -261,3 +250,6 @@ diff -up openssh-8.6p1/sshd-session.c.log-in-chroot openssh-8.6p1/sshd-session.c
  
  	/* Demote the private keys to public keys. */
  	demote_sensitive_data();
+-- 
+2.49.0
+

0020-openssh-6.6.1p1-scp-non-existing-directory.patch

@@ -0,0 +1,27 @@
+From 007ee98fa9100f7241985ac2a7eed71e17d89a9f Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 20/50] openssh-6.6.1p1-scp-non-existing-directory
+
+---
+ scp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scp.c b/scp.c
+index 716ae386..9554b188 100644
+--- a/scp.c
++++ b/scp.c
+@@ -1876,6 +1876,10 @@ sink(int argc, char **argv, const char *src)
+ 			free(vect[0]);
+ 			continue;
+ 		}
++		if (buf[0] == 'C' && ! exists && np[strlen(np)-1] == '/') {
++			errno = ENOTDIR;
++			goto bad;
++		}
+ 		omode = mode;
+ 		mode |= S_IWUSR;
+ 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) == -1) {
+-- 
+2.49.0
+

0021-openssh-6.6p1-GSSAPIEnablek5users.patch

@@ -1,7 +1,21 @@
-diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-serv-krb5.c
---- openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
-+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 15:18:40.628216102 +0100
-@@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
+From 9c75c175e3555377328fc5fc9b06e94f129b7cd7 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 21/50] openssh-6.6p1-GSSAPIEnablek5users
+
+---
+ gss-serv-krb5.c |  3 +--
+ servconf.c      | 13 ++++++++++++-
+ servconf.h      |  1 +
+ sshd_config     |  1 +
+ sshd_config.5   |  6 ++++++
+ 5 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index 187faf92..03188d9b 100644
+--- a/gss-serv-krb5.c
++++ b/gss-serv-krb5.c
+@@ -278,7 +278,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
  	FILE *fp;
  	char file[MAXPATHLEN];
  	char *line = NULL;
@@ -9,7 +23,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-ser
  	struct stat st;
  	struct passwd *pw = the_authctxt->pw;
  	int found_principal = 0;
-@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
+@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
  
  	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
  	/* If both .k5login and .k5users DNE, self-login is ok. */
@@ -18,18 +32,19 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-ser
                  return ssh_krb5_kuserok(krb_context, principal, luser,
                                          k5login_exists);
  	}
-diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
---- openssh-7.4p1/servconf.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:35:36.354401156 +0100
-@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions
+diff --git a/servconf.c b/servconf.c
+index 5dd5ca21..c0de7110 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -146,6 +146,7 @@ initialize_server_options(ServerOptions *options)
  	options->gss_store_rekey = -1;
  	options->gss_kex_algorithms = NULL;
  	options->use_kuserok = -1;
 +	options->enable_k5users = -1;
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
-	options->permit_empty_passwd = -1;
-@@ -345,6 +346,8 @@ fill_default_server_options(ServerOption
+ 	options->permit_empty_passwd = -1;
+@@ -402,6 +403,8 @@ fill_default_server_options(ServerOptions *options)
  #endif
  	if (options->use_kuserok == -1)
  		options->use_kuserok = 1;
@@ -38,7 +53,7 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -578,7 +578,7 @@ typedef enum {
+@@ -585,7 +588,7 @@ typedef enum {
  	sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
  	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
@@ -47,7 +62,7 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
  	sAcceptEnv, sSetEnv, sPermitTunnel,
  	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
-@@ -600,14 +600,16 @@ static struct {
+@@ -681,6 +684,7 @@ static struct {
  	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
  	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
  	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
@@ -55,8 +70,7 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  #else
  	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
+@@ -689,6 +693,7 @@ static struct {
  	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
  	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
  	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
@@ -64,7 +78,7 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  #endif
  	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
  	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
-@@ -1653,6 +1658,10 @@ process_server_config_line(ServerOptions
+@@ -2450,6 +2455,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  		intptr = &options->use_kuserok;
  		goto parse_flag;
  
@@ -72,10 +86,10 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
 +		intptr = &options->enable_k5users;
 +		goto parse_flag;
 +
-	case sMatch:
-		if (cmdline)
-			fatal("Match directive not supported as a command-line "
-@@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d
+ 	case sMatch:
+ 		if (cmdline)
+ 			fatal("Match directive not supported as a command-line "
+@@ -3005,6 +3014,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
  	M_CP_INTOPT(ip_qos_interactive);
  	M_CP_INTOPT(ip_qos_bulk);
  	M_CP_INTOPT(use_kuserok);
@@ -83,7 +97,7 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  	M_CP_INTOPT(rekey_limit);
  	M_CP_INTOPT(rekey_interval);
  	M_CP_INTOPT(log_level);
-@@ -2320,6 +2330,7 @@ dump_config(ServerOptions *o)
+@@ -3314,6 +3324,7 @@ dump_config(ServerOptions *o)
  # endif
  	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
  	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
@@ -91,21 +105,35 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  #endif
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff -up openssh-7.4p1/servconf.h.GSSAPIEnablek5users openssh-7.4p1/servconf.h
---- openssh-7.4p1/servconf.h.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 15:18:40.629216102 +0100
-@@ -174,6 +174,7 @@ typedef struct {
-	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
-						 * be stored in per-session ccache */
+diff --git a/servconf.h b/servconf.h
+index 11de36a2..c08cf6a7 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -152,6 +152,7 @@ typedef struct {
+ 	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
+ 						 * be stored in per-session ccache */
  	int	use_kuserok;
 +	int		enable_k5users;
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
  	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
  	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_config.5
---- openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users	2016-12-23 15:18:40.630216103 +0100
-+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:36:21.607408435 +0100
-@@ -628,6 +628,12 @@ Specifies whether to automatically destr
+diff --git a/sshd_config b/sshd_config
+index ea5a878e..33713c88 100644
+--- a/sshd_config
++++ b/sshd_config
+@@ -82,6 +82,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ #GSSAPICleanupCredentials yes
+ #GSSAPIStrictAcceptorCheck yes
+ #GSSAPIKeyExchange no
++#GSSAPIEnablek5users no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing,
+ # and session processing. If this is enabled, PAM authentication will
+diff --git a/sshd_config.5 b/sshd_config.5
+index 0fcb409a..fe246fc2 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -739,6 +739,12 @@ Specifies whether to automatically destroy the user's credentials cache
  on logout.
  The default is
  .Cm yes .
@@ -118,17 +146,6 @@ diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_conf
  .It Cm GSSAPIKeyExchange
  Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
  doesn't rely on ssh keys to verify host identity.
-diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
---- openssh-7.4p1/sshd_config.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
-+++ openssh-7.4p1/sshd_config	2016-12-23 15:18:40.631216103 +0100
-@@ -80,6 +80,7 @@ GSSAPIAuthentication yes
- #GSSAPICleanupCredentials yes
- #GSSAPIStrictAcceptorCheck yes
- #GSSAPIKeyExchange no
-+#GSSAPIEnablek5users no
- 
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
-diff -up openssh-9.8p1/servconf.c.xxx openssh-9.8p1/servconf.c
---- openssh-9.8p1/servconf.c.xxx	2024-07-11 13:51:19.969960781 +0200
-+++ openssh-9.8p1/servconf.c	2024-07-11 13:51:30.938231250 +0200
+-- 
+2.49.0
+

0022-openssh-6.8p1-sshdT-output.patch

@@ -0,0 +1,25 @@
+From 05b09904f431333e19cd24528ef66d1fd15e9efe Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 22/50] openssh-6.8p1-sshdT-output
+
+---
+ servconf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/servconf.c b/servconf.c
+index c0de7110..105e301d 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -3366,7 +3366,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_string(sXAuthLocation, o->xauth_location);
+ 	dump_cfg_string(sCiphers, o->ciphers);
+ 	dump_cfg_string(sMacs, o->macs);
+-	dump_cfg_string(sBanner, o->banner);
++	dump_cfg_string(sBanner, o->banner != NULL ? o->banner : "none");
+ 	dump_cfg_string(sForceCommand, o->adm_forced_command);
+ 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
+ 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
+-- 
+2.49.0
+

0023-openssh-6.7p1-sftp-force-permission.patch

@@ -1,6 +1,17 @@
-diff -up openssh-7.2p2/sftp-server.8.sftp-force-mode openssh-7.2p2/sftp-server.8
---- openssh-7.2p2/sftp-server.8.sftp-force-mode	2016-03-09 19:04:48.000000000 +0100
-+++ openssh-7.2p2/sftp-server.8	2016-06-23 16:18:20.463854117 +0200
+From 34b196198018059bed294fa7a08e70606b4cbc36 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 23/50] openssh-6.7p1-sftp-force-permission
+
+---
+ sftp-server.8 |  7 +++++++
+ sftp-server.c | 24 ++++++++++++++++++++++--
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+diff --git a/sftp-server.8 b/sftp-server.8
+index 5311bf92..5e6e3aa4 100644
+--- a/sftp-server.8
++++ b/sftp-server.8
 @@ -38,6 +38,7 @@
  .Op Fl P Ar denied_requests
  .Op Fl p Ar allowed_requests
@@ -22,10 +33,11 @@ diff -up openssh-7.2p2/sftp-server.8.sftp-force-mode openssh-7.2p2/sftp-server.8
  .El
  .Pp
  On some systems,
-diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
---- openssh-7.2p2/sftp-server.c.sftp-force-mode	2016-06-23 16:18:20.446854128 +0200
-+++ openssh-7.2p2/sftp-server.c	2016-06-23 16:20:37.950766082 +0200
-@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
+diff --git a/sftp-server.c b/sftp-server.c
+index 4985da38..6ed1c27f 100644
+--- a/sftp-server.c
++++ b/sftp-server.c
+@@ -76,6 +76,10 @@ struct sshbuf *oqueue;
  /* Version of client */
  static u_int version;
  
@@ -36,7 +48,7 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  /* SSH2_FXP_INIT received */
  static int init_done;
  
-@@ -683,6 +687,7 @@ process_open(u_int32_t id)
+@@ -745,6 +749,7 @@ process_open(u_int32_t id)
  	Attrib a;
  	char *name;
  	int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
@@ -44,7 +56,7 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
  	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
-@@ -692,6 +697,10 @@ process_open(u_int32_t id)
+@@ -754,6 +759,10 @@ process_open(u_int32_t id)
  	debug3("request %u: open flags %d", id, pflags);
  	flags = flags_from_portable(pflags);
  	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
@@ -55,7 +67,7 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  	logit("open \"%s\" flags %s mode 0%o",
  	    name, string_from_portable(pflags), mode);
  	if (readonly &&
-@@ -713,6 +722,8 @@ process_open(u_int32_t id)
+@@ -775,6 +784,8 @@ process_open(u_int32_t id)
  			}
  		}
  	}
@@ -64,7 +76,7 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  	if (status != SSH2_FX_OK)
  		send_status(id, status);
  	free(name);
-@@ -1494,7 +1505,7 @@ sftp_server_usage(void)
+@@ -1894,7 +1905,7 @@ sftp_server_usage(void)
  	fprintf(stderr,
  	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
  	    "[-l log_level]\n\t[-P denied_requests] "
@@ -73,7 +85,7 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  	    "       %s -Q protocol_feature\n",
  	    __progname, __progname);
  	exit(1);
-@@ -1520,7 +1531,7 @@ sftp_server_main(int argc, char **argv,
+@@ -1918,7 +1929,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handle
  	pw = pwcopy(user_pw);
  
  	while (!skipargs && (ch = getopt(argc, argv,
@@ -82,7 +94,7 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  		switch (ch) {
  		case 'Q':
  			if (strcasecmp(optarg, "requests") != 0) {
-@@ -1580,6 +1591,15 @@ sftp_server_main(int argc, char **argv,
+@@ -1980,6 +1991,15 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handle
  				fatal("Invalid umask \"%s\"", optarg);
  			(void)umask((mode_t)mask);
  			break;
@@ -98,3 +110,6 @@ diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
  		case 'h':
  		default:
  			sftp_server_usage();
+-- 
+2.49.0
+

0024-openssh-7.2p2-s390-closefrom.patch

@@ -1,21 +1,17 @@
-Zseries only: Leave the hardware filedescriptors open.
-
-All filedescriptors above 2 are getting closed when a new
-sshd process to handle a new client connection is
-spawned. As the process also chroot into an empty filesystem
-without any device nodes, there is no chance to reopen the
-files. This patch filters out the reqired fds in the
-closefrom function so these are skipped in the close loop.
-
-Author: Harald Freudenberger <freude@de.ibm.com>
+From 9bb31b63142adaaf949e20c2d86c97f9b787217b Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 24/50] openssh-7.2p2-s390-closefrom
 
 ---
- openbsd-compat/bsd-closefrom.c |   26 ++++++++++++++++++++++++++
+ openbsd-compat/bsd-closefrom.c | 26 ++++++++++++++++++++++++++
  1 file changed, 26 insertions(+)
 
+diff --git a/openbsd-compat/bsd-closefrom.c b/openbsd-compat/bsd-closefrom.c
+index 49a4f35f..f6112458 100644
 --- a/openbsd-compat/bsd-closefrom.c
 +++ b/openbsd-compat/bsd-closefrom.c
-@@ -82,7 +82,33 @@ closefrom(int lowfd)
+@@ -140,7 +140,33 @@ closefrom(int lowfd)
  	    fd = strtol(dent->d_name, &endp, 10);
  	    if (dent->d_name != endp && *endp == '\0' &&
  		fd >= 0 && fd < INT_MAX && fd >= lowfd && fd != dirfd(dirp))
@@ -49,4 +45,6 @@ Author: Harald Freudenberger <freude@de.ibm.com>
  	}
  	(void) closedir(dirp);
  	return;
+-- 
+2.49.0
 

0025-openssh-7.3p1-x11-max-displays.patch

@@ -1,18 +1,22 @@
-diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
---- openssh-7.4p1/channels.c.x11max	2016-12-23 15:46:32.071506625 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 15:46:32.139506636 +0100
-@@ -152,8 +152,8 @@ static int all_opens_permitted = 0;
- #define	NUM_SOCKS	10
- 
- /* -- X11 forwarding */
--/* Maximum number of fake X11 displays to try. */
--#define MAX_DISPLAYS  1000
-+/* Minimum port number for X11 forwarding */
-+#define X11_PORT_MIN 6000
- 
- /* Per-channel callback for pre/post IO actions */
- typedef void chan_fn(struct ssh *, Channel *c);
-@@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
+From 36e3430d1f81397d5f40600e075272a81f7effce Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 25/50] openssh-7.3p1-x11-max-displays
+
+---
+ channels.c    |  9 ++++++---
+ channels.h    |  2 +-
+ servconf.c    | 12 +++++++++++-
+ servconf.h    |  2 ++
+ session.c     |  5 +++--
+ sshd_config.5 |  7 +++++++
+ 6 files changed, 30 insertions(+), 7 deletions(-)
+
+diff --git a/channels.c b/channels.c
+index d46531ce..7438c1a5 100644
+--- a/channels.c
++++ b/channels.c
+@@ -4996,7 +4996,7 @@ rdynamic_connect_finish(struct ssh *ssh, Channel *c)
   */
  int
  x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
@@ -21,8 +25,8 @@ diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
      u_int *display_numberp, int **chanids)
  {
  	Channel *nc = NULL;
-@@ -4240,10 +4241,15 @@ x11_create_display_inet(int x11_display_
- 	if (chanids == NULL)
+@@ -5009,8 +5009,11 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+ 	    x11_display_offset > UINT16_MAX - X11_BASE_PORT - MAX_DISPLAYS)
  		return -1;
  
 +	/* Try to bind ports starting at 6000+X11DisplayOffset */
@@ -32,55 +36,22 @@ diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
 -	    display_number < MAX_DISPLAYS;
 +	    display_number < x11_max_displays;
  	    display_number++) {
--		port = 6000 + display_number;
-+		port = X11_PORT_MIN + display_number;
-+		if (port < X11_PORT_MIN) /* overflow */
-+			break;
+ 		port = X11_BASE_PORT + display_number;
  		memset(&hints, 0, sizeof(hints));
- 		hints.ai_family = ssh->chanctxt->IPv4or6;
- 		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
-@@ -4295,7 +4301,7 @@ x11_create_display_inet(int x11_display_
+@@ -5065,7 +5068,7 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  		if (num_socks > 0)
  			break;
  	}
 -	if (display_number >= MAX_DISPLAYS) {
-+	if (display_number >= x11_max_displays || port < X11_PORT_MIN ) {
++	if (display_number >= x11_max_displays || port < X11_BASE_PORT ) {
  		error("Failed to allocate internet-domain X11 display socket.");
  		return -1;
  	}
-@@ -4441,7 +4447,7 @@ x11_connect_display(void)
- 	memset(&hints, 0, sizeof(hints));
- 	hints.ai_family = ssh->chanctxt->IPv4or6;
- 	hints.ai_socktype = SOCK_STREAM;
--	snprintf(strport, sizeof strport, "%u", 6000 + display_number);
-+	snprintf(strport, sizeof strport, "%u", X11_PORT_MIN + display_number);
- 	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
- 		error("%.100s: unknown host. (%s)", buf,
- 		ssh_gai_strerror(gaierr));
-@@ -4457,7 +4463,7 @@ x11_connect_display(void)
- 		/* Connect it to the display. */
- 		if (connect(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
- 			debug2("connect %.100s port %u: %.100s", buf,
--			    6000 + display_number, strerror(errno));
-+			    X11_PORT_MIN + display_number, strerror(errno));
- 			close(sock);
- 			continue;
- 		}
-@@ -4466,8 +4472,8 @@ x11_connect_display(void)
- 	}
- 	freeaddrinfo(aitop);
- 	if (!ai) {
--		error("connect %.100s port %u: %.100s", buf,
--		    6000 + display_number, strerror(errno));
-+		error("connect %.100s port %u: %.100s", buf,
-+		    X11_PORT_MIN + display_number, strerror(errno));
- 		return -1;
- 	}
- 	set_nodelay(sock);
-diff -up openssh-7.4p1/channels.h.x11max openssh-7.4p1/channels.h
---- openssh-7.4p1/channels.h.x11max	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/channels.h	2016-12-23 15:46:32.139506636 +0100
-@@ -293,7 +293,7 @@ int	 permitopen_port(const char *);
+diff --git a/channels.h b/channels.h
+index 134528d5..8a09a820 100644
+--- a/channels.h
++++ b/channels.h
+@@ -379,7 +379,7 @@ int	 permitopen_port(const char *);
  
  void	 channel_set_x11_refuse_time(struct ssh *, time_t);
  int	 x11_connect_display(struct ssh *);
@@ -88,11 +59,12 @@ diff -up openssh-7.4p1/channels.h.x11max openssh-7.4p1/channels.h
 +int	 x11_create_display_inet(struct ssh *, int, int, int, int, u_int *, int **);
  void	 x11_request_forwarding_with_spoofing(struct ssh *, int,
  	    const char *, const char *, const char *, int);
- 
-diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
---- openssh-7.4p1/servconf.c.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:47:27.320519121 +0100
-@@ -95,6 +95,7 @@ initialize_server_options(ServerOptions
+ int      x11_channel_used_recently(struct ssh *ssh);
+diff --git a/servconf.c b/servconf.c
+index 105e301d..15c99b30 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -117,6 +117,7 @@ initialize_server_options(ServerOptions *options)
  	options->print_lastlog = -1;
  	options->x11_forwarding = -1;
  	options->x11_display_offset = -1;
@@ -100,7 +72,7 @@ diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
  	options->x11_use_localhost = -1;
  	options->permit_tty = -1;
  	options->permit_user_rc = -1;
-@@ -243,6 +244,8 @@ fill_default_server_options(ServerOption
+@@ -353,6 +354,8 @@ fill_default_server_options(ServerOptions *options)
  		options->x11_forwarding = 0;
  	if (options->x11_display_offset == -1)
  		options->x11_display_offset = 10;
@@ -109,16 +81,16 @@ diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
  	if (options->x11_use_localhost == -1)
  		options->x11_use_localhost = 1;
  	if (options->xauth_location == NULL)
-@@ -419,7 +422,7 @@ typedef enum {
-	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication,
-	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
-	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+@@ -576,7 +579,7 @@ typedef enum {
+ 	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication,
+ 	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
+ 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
 -	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 +	sX11Forwarding, sX11DisplayOffset, sX11MaxDisplays, sX11UseLocalhost,
  	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
  	sPermitUserEnvironment, sAllowTcpForwarding, sCompression,
  	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
-@@ -540,6 +543,7 @@ static struct {
+@@ -714,6 +717,7 @@ static struct {
  	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
  	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
  	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
@@ -126,7 +98,7 @@ diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
  	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
  	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
  	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
-@@ -1316,6 +1320,10 @@ process_server_config_line(ServerOptions
+@@ -1750,6 +1754,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  			*intptr = value;
  		break;
  
@@ -137,7 +109,7 @@ diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
  	case sX11UseLocalhost:
  		intptr = &options->x11_use_localhost;
  		goto parse_flag;
-@@ -2063,6 +2071,7 @@ copy_set_server_options(ServerOptions *d
+@@ -3004,6 +3012,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
  	M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
  	M_CP_INTOPT(x11_display_offset);
  	M_CP_INTOPT(x11_forwarding);
@@ -145,7 +117,7 @@ diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
  	M_CP_INTOPT(x11_use_localhost);
  	M_CP_INTOPT(permit_tty);
  	M_CP_INTOPT(permit_user_rc);
-@@ -2315,6 +2324,7 @@ dump_config(ServerOptions *o)
+@@ -3299,6 +3308,7 @@ dump_config(ServerOptions *o)
  #endif
  	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
  	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
@@ -153,10 +125,11 @@ diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
  	dump_cfg_int(sMaxAuthTries, o->max_authtries);
  	dump_cfg_int(sMaxSessions, o->max_sessions);
  	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
-diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
---- openssh-7.4p1/servconf.h.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 15:46:32.140506636 +0100
-@@ -55,6 +55,7 @@
+diff --git a/servconf.h b/servconf.h
+index c08cf6a7..7c7e5d43 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -38,6 +38,7 @@
  
  #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
  #define DEFAULT_SESSIONS_MAX	10	/* Default for MaxSessions */
@@ -164,7 +137,7 @@ diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
  
  /* Magic name for internal sftp-server */
  #define INTERNAL_SFTP_NAME	"internal-sftp"
-@@ -85,6 +86,7 @@ typedef struct {
+@@ -114,6 +115,7 @@ typedef struct {
  	int     x11_forwarding;	/* If true, permit inet (spoofing) X11 fwd. */
  	int     x11_display_offset;	/* What DISPLAY number to start
  					 * searching at */
@@ -172,13 +145,14 @@ diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
  	int     x11_use_localhost;	/* If true, use localhost for fake X11 server. */
  	char   *xauth_location;	/* Location of xauth program */
  	int	permit_tty;	/* If false, deny pty allocation */
-diff -up openssh-7.4p1/session.c.x11max openssh-7.4p1/session.c
---- openssh-7.4p1/session.c.x11max	2016-12-23 15:46:32.136506636 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 15:46:32.141506636 +0100
-@@ -2518,8 +2518,9 @@ session_setup_x11fwd(Session *s)
+diff --git a/session.c b/session.c
+index 54da09d5..28bbb8a7 100644
+--- a/session.c
++++ b/session.c
+@@ -2611,8 +2611,9 @@ session_setup_x11fwd(struct ssh *ssh, Session *s)
  		return 0;
  	}
-	if (x11_create_display_inet(ssh, options.x11_display_offset,
+ 	if (x11_create_display_inet(ssh, options.x11_display_offset,
 -	    options.x11_use_localhost, s->single_connection,
 -	    &s->display_number, &s->x11_chanids) == -1) {
 +	    options.x11_use_localhost, options.x11_max_displays,
@@ -187,10 +161,11 @@ diff -up openssh-7.4p1/session.c.x11max openssh-7.4p1/session.c
  		debug("x11_create_display_inet failed.");
  		return 0;
  	}
-diff -up openssh-7.4p1/sshd_config.5.x11max openssh-7.4p1/sshd_config.5
---- openssh-7.4p1/sshd_config.5.x11max	2016-12-23 15:46:32.134506635 +0100
-+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:46:32.141506636 +0100
-@@ -1133,6 +1133,7 @@ Available keywords are
+diff --git a/sshd_config.5 b/sshd_config.5
+index fe246fc2..26fcdc84 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -1391,6 +1391,7 @@ Available keywords are
  .Cm TrustedUserCAKeys ,
  .Cm UnusedConnectionTimeout ,
  .Cm X11DisplayOffset ,
@@ -198,7 +173,7 @@ diff -up openssh-7.4p1/sshd_config.5.x11max openssh-7.4p1/sshd_config.5
  .Cm X11Forwarding
  and
  .Cm X11UseLocalhost .
-@@ -1566,6 +1567,12 @@ Specifies the first display number avail
+@@ -2111,6 +2112,12 @@ Specifies the first display number available for
  X11 forwarding.
  This prevents sshd from interfering with real X11 servers.
  The default is 10.
@@ -211,3 +186,6 @@ diff -up openssh-7.4p1/sshd_config.5.x11max openssh-7.4p1/sshd_config.5
  .It Cm X11Forwarding
  Specifies whether X11 forwarding is permitted.
  The argument must be
+-- 
+2.49.0
+

0026-openssh-7.6p1-cleanup-selinux.patch

@@ -1,7 +1,25 @@
-diff -up openssh/auth2-pubkey.c.refactor openssh/auth2-pubkey.c
---- openssh/auth2-pubkey.c.refactor	2019-04-04 13:19:12.188821236 +0200
-+++ openssh/auth2-pubkey.c	2019-04-04 13:19:12.276822078 +0200
-@@ -72,6 +72,8 @@
+From 43320351b6f150167190aacc84f2f87030fef3d2 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 26/50] openssh-7.6p1-cleanup-selinux
+
+---
+ auth2-pubkey.c                   |  8 ++++--
+ misc.c                           |  5 ++--
+ misc.h                           |  2 +-
+ openbsd-compat/port-linux-sshd.c | 42 +++++++++++++++++---------------
+ openbsd-compat/port-linux.h      |  4 +--
+ platform.c                       |  6 ++++-
+ sshconnect.c                     |  2 +-
+ sshd-auth.c                      |  2 +-
+ sshd-session.c                   |  6 +++--
+ 9 files changed, 45 insertions(+), 32 deletions(-)
+
+diff --git a/auth2-pubkey.c b/auth2-pubkey.c
+index 267a27d2..0d5ae0df 100644
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -77,6 +77,8 @@
  
  /* import */
  extern ServerOptions options;
@@ -10,7 +28,7 @@ diff -up openssh/auth2-pubkey.c.refactor openssh/auth2-pubkey.c
  extern struct authmethod_cfg methodcfg_pubkey;
  
  static char *
-@@ -511,7 +514,8 @@ match_principals_command(struct ssh *ssh
+@@ -485,7 +487,8 @@ match_principals_command(struct passwd *user_pw, const struct sshkey *key,
  	if ((pid = subprocess("AuthorizedPrincipalsCommand", command,
  	    ac, av, &f,
  	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
@@ -20,20 +38,21 @@ diff -up openssh/auth2-pubkey.c.refactor openssh/auth2-pubkey.c
  		goto out;
  
  	uid_swapped = 1;
-@@ -981,7 +985,8 @@ user_key_command_allowed2(struct ssh *ss
+@@ -755,7 +758,8 @@ user_key_command_allowed2(struct passwd *user_pw, struct sshkey *key,
  	if ((pid = subprocess("AuthorizedKeysCommand", command,
  	    ac, av, &f,
-	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
+ 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
 -	    runas_pw, temporarily_use_uid, restore_uid)) == 0)
 +	    runas_pw, temporarily_use_uid, restore_uid,
 +	    inetd_flag, the_authctxt)) == 0)
  		goto out;
  
  	uid_swapped = 1;
-diff -up openssh/misc.c.refactor openssh/misc.c
---- openssh/misc.c.refactor	2019-04-04 13:19:12.235821686 +0200
-+++ openssh/misc.c	2019-04-04 13:19:12.276822078 +0200
-@@ -756,7 +756,8 @@ auth_get_canonical_hostname(struct ssh *
+diff --git a/misc.c b/misc.c
+index 1e31acc9..09722962 100644
+--- a/misc.c
++++ b/misc.c
+@@ -2764,7 +2764,8 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
  pid_t
  subprocess(const char *tag, const char *command,
      int ac, char **av, FILE **child, u_int flags,
@@ -43,7 +62,7 @@ diff -up openssh/misc.c.refactor openssh/misc.c
  {
  	FILE *f = NULL;
  	struct stat st;
-@@ -872,7 +873,7 @@ subprocess(const char *tag, struct passw
+@@ -2898,7 +2899,7 @@ subprocess(const char *tag, const char *command,
  			_exit(1);
  		}
  #ifdef WITH_SELINUX
@@ -52,10 +71,11 @@ diff -up openssh/misc.c.refactor openssh/misc.c
  			error ("failed to copy environment:  %s",
  			    strerror(errno));
  			_exit(127);
-diff -up openssh/misc.h.refactor openssh/misc.h
---- openssh/misc.h.refactor	2019-04-04 13:19:12.251821839 +0200
-+++ openssh/misc.h	2019-04-04 13:19:12.276822078 +0200
-@@ -235,7 +235,7 @@ struct passwd *fakepw(void);
+diff --git a/misc.h b/misc.h
+index efecdf1a..9efa9cf4 100644
+--- a/misc.h
++++ b/misc.h
+@@ -122,7 +122,7 @@ typedef void privrestore_fn(void);
  #define	SSH_SUBPROCESS_UNSAFE_PATH	(1<<3)	/* Don't check for safe cmd */
  #define	SSH_SUBPROCESS_PRESERVE_ENV	(1<<4)	/* Keep parent environment */
  pid_t subprocess(const char *, const char *, int, char **, FILE **, u_int,
@@ -64,23 +84,10 @@ diff -up openssh/misc.h.refactor openssh/misc.h
  
  typedef struct arglist arglist;
  struct arglist {
-diff -up openssh/openbsd-compat/port-linux.h.refactor openssh/openbsd-compat/port-linux.h
---- openssh/openbsd-compat/port-linux.h.refactor	2019-04-04 13:19:12.256821887 +0200
-+++ openssh/openbsd-compat/port-linux.h	2019-04-04 13:19:12.276822078 +0200
-@@ -26,8 +26,8 @@ void ssh_selinux_setfscreatecon(const ch
- 
- int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
--void sshd_selinux_setup_exec_context(char *);
--int sshd_selinux_setup_env_variables(void);
-+void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int);
-+int sshd_selinux_setup_env_variables(int inetd, void *);
- void sshd_selinux_change_privsep_preauth_context(void);
- #endif
- 
-diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compat/port-linux-sshd.c
---- openssh/openbsd-compat/port-linux-sshd.c.refactor	2019-04-04 13:19:12.256821887 +0200
-+++ openssh/openbsd-compat/port-linux-sshd.c	2019-04-04 13:19:12.276822078 +0200
+diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
+index 646f0887..291b569a 100644
+--- a/openbsd-compat/port-linux-sshd.c
++++ b/openbsd-compat/port-linux-sshd.c
 @@ -49,10 +49,6 @@
  #include <unistd.h>
  #endif
@@ -92,7 +99,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  /* Wrapper around is_selinux_enabled() to log its return value once only */
  int
  sshd_selinux_enabled(void)
-@@ -223,7 +218,8 @@ get_user_context(const char *sename, con
+@@ -222,7 +218,8 @@ get_user_context(const char *sename, const char *role, const char *lvl,
  }
  
  static void
@@ -102,7 +109,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  {
  	*role = NULL;
  	*level = NULL;
-@@ -241,8 +237,8 @@ ssh_selinux_get_role_level(char **role,
+@@ -240,8 +237,8 @@ ssh_selinux_get_role_level(char **role, const char **level)
  
  /* Return the default security context for the given username */
  static int
@@ -113,7 +120,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  {
  	char *sename, *lvl;
  	char *role;
-@@ -250,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -249,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname,
  	int r = 0;
  	context_t con = NULL;
  
@@ -122,7 +129,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  
  #ifdef HAVE_GETSEUSERBYNAME
  	if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
-@@ -272,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -271,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname,
  
  	if (r == 0) {
  		/* If launched from xinetd, we must use current level */
@@ -131,7 +138,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  			security_context_t sshdsc=NULL;
  
  			if (getcon_raw(&sshdsc) < 0)
-@@ -333,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -332,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname,
  
  /* Setup environment variables for pam_selinux */
  static int
@@ -141,7 +148,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  {
  	const char *reqlvl;
  	char *role;
-@@ -342,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it
+@@ -341,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
  
  	debug3_f("setting execution context");
  
@@ -155,7 +162,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  		use_current = "1";
  	} else {
  		use_current = "";
-@@ -362,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it
+@@ -361,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
  }
  
  static int
@@ -168,7 +175,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  }
  
  static int
-@@ -374,25 +372,28 @@ do_setenv(char *name, const char *value)
+@@ -373,25 +372,28 @@ do_setenv(char *name, const char *value)
  }
  
  int
@@ -202,7 +209,7 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  			switch (security_getenforce()) {
  			case -1:
  				fatal_f("security_getenforce() failed");
-@@ -410,7 +411,7 @@ sshd_selinux_setup_exec_context(char *pw
+@@ -407,7 +409,7 @@ sshd_selinux_setup_exec_context(char *pwname)
  
  	debug3_f("setting execution context");
  
@@ -211,10 +218,26 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compa
  	if (r >= 0) {
  		r = setexeccon(user_ctx);
  		if (r < 0) {
-diff -up openssh/platform.c.refactor openssh/platform.c
---- openssh/platform.c.refactor	2019-04-04 13:19:12.204821389 +0200
-+++ openssh/platform.c	2019-04-04 13:19:12.277822088 +0200
-@@ -32,6 +32,8 @@
+diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
+index 7f8ba200..3cd7da6a 100644
+--- a/openbsd-compat/port-linux.h
++++ b/openbsd-compat/port-linux.h
+@@ -25,8 +25,8 @@ void ssh_selinux_setfscreatecon(const char *);
+ 
+ int sshd_selinux_enabled(void);
+ void sshd_selinux_copy_context(void);
+-void sshd_selinux_setup_exec_context(char *);
+-int sshd_selinux_setup_env_variables(void);
++void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int);
++int sshd_selinux_setup_env_variables(int inetd, void *);
+ void sshd_selinux_change_privsep_preauth_context(void);
+ #endif
+ 
+diff --git a/platform.c b/platform.c
+index 0d12f311..f0800b1f 100644
+--- a/platform.c
++++ b/platform.c
+@@ -33,6 +33,8 @@
  #include "openbsd-compat/openbsd-compat.h"
  
  extern ServerOptions options;
@@ -223,7 +246,7 @@ diff -up openssh/platform.c.refactor openssh/platform.c
  
  /* return 1 if we are running with privilege to swap UIDs, 0 otherwise */
  int
-@@ -183,7 +186,9 @@ platform_setusercontext_post_groups(stru
+@@ -140,7 +142,9 @@ platform_setusercontext_post_groups(struct passwd *pw)
  	}
  #endif /* HAVE_SETPCRED */
  #ifdef WITH_SELINUX
@@ -234,10 +257,37 @@ diff -up openssh/platform.c.refactor openssh/platform.c
  #endif
  }
  
-diff -up openssh/sshd-session.c.refactor openssh/sshd-session.c
---- openssh/sshd-session.c.refactor	2019-04-04 13:19:12.275822068 +0200
-+++ openssh/sshd-session.c	2019-04-04 13:19:51.270195262 +0200
-@@ -158,7 +158,7 @@ int debug_flag = 0;
+diff --git a/sshconnect.c b/sshconnect.c
+index c86182d1..04084810 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -925,7 +925,7 @@ load_hostkeys_command(struct hostkeys *hostkeys, const char *command_template,
+ 
+ 	if ((pid = subprocess(tag, command, ac, av, &f,
+ 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_UNSAFE_PATH|
+-	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL)) == 0)
++	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL, 0, NULL)) == 0)
+ 		goto out;
+ 
+ 	load_hostkeys_file(hostkeys, hostfile_hostname, tag, f, 1);
+diff --git a/sshd-auth.c b/sshd-auth.c
+index e4a8edfd..897db9b4 100644
+--- a/sshd-auth.c
++++ b/sshd-auth.c
+@@ -122,7 +122,7 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE;
+ int debug_flag = 0;
+ 
+ /* Flag indicating that the daemon is being started from inetd. */
+-static int inetd_flag = 0;
++int inetd_flag = 0;
+ 
+ /* Saved arguments to main(). */
+ static char **saved_argv;
+diff --git a/sshd-session.c b/sshd-session.c
+index 9342e416..81d30152 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -136,7 +136,7 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE;
  int debug_flag = 0;
  
  /* Flag indicating that the daemon is being started from inetd. */
@@ -246,7 +296,7 @@ diff -up openssh/sshd-session.c.refactor openssh/sshd-session.c
  
  /* debug goes to stderr unless inetd_flag is set */
  static int log_stderr = 0;
-@@ -2192,7 +2192,9 @@ main(int ac, char **av)
+@@ -1359,7 +1359,9 @@ main(int ac, char **av)
  	}
  #endif
  #ifdef WITH_SELINUX
@@ -257,15 +307,6 @@ diff -up openssh/sshd-session.c.refactor openssh/sshd-session.c
  #endif
  #ifdef USE_PAM
  	if (options.use_pam) {
-diff -up openssh/sshconnect.c.refactor openssh/sshconnect.c
---- openssh/sshconnect.c.refactor	2021-02-24 00:12:03.065325046 +0100
-+++ openssh/sshconnect.c	2021-02-24 00:12:12.126449544 +0100
-@@ -892,7 +892,7 @@ load_hostkeys_command(struct hostkeys *h
- 
- 	if ((pid = subprocess(tag, command, ac, av, &f,
- 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_UNSAFE_PATH|
--	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL)) == 0)
-+	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL, 0, NULL)) == 0)
- 		goto out;
- 
- 	load_hostkeys_file(hostkeys, hostfile_hostname, tag, f, 1);
+-- 
+2.49.0
+

0027-openssh-7.5p1-sandbox.patch

@@ -0,0 +1,58 @@
+From 35205319dd71d8e61c1596b8f9479df91aff7756 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 27/50] openssh-7.5p1-sandbox
+
+---
+ sandbox-seccomp-filter.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index b31062c2..1fabf99d 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -277,6 +277,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_exit_group
+ 	SC_ALLOW(__NR_exit_group),
+ #endif
++#if defined(__NR_flock) && defined(__s390__)
++	SC_ALLOW(__NR_flock),
++#endif
+ #ifdef __NR_futex
+ 	SC_FUTEX(__NR_futex),
+ #endif
+@@ -295,6 +298,21 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_getpid
+ 	SC_ALLOW(__NR_getpid),
+ #endif
++#ifdef __NR_getuid
++	SC_ALLOW(__NR_getuid),
++#endif
++#ifdef __NR_getuid32
++	SC_ALLOW(__NR_getuid32),
++#endif
++#ifdef __NR_geteuid
++	SC_ALLOW(__NR_geteuid),
++#endif
++#ifdef __NR_geteuid32
++	SC_ALLOW(__NR_geteuid32),
++#endif
++#ifdef __NR_gettid
++	SC_ALLOW(__NR_gettid),
++#endif
+ #ifdef __NR_getrandom
+ 	SC_ALLOW(__NR_getrandom),
+ #endif
+@@ -304,6 +322,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_gettimeofday
+ 	SC_ALLOW(__NR_gettimeofday),
+ #endif
++#if defined(__NR_ipc) && defined(__s390__)
++	SC_ALLOW(__NR_ipc),
++#endif
+ #ifdef __NR_getuid
+ 	SC_ALLOW(__NR_getuid),
+ #endif
+-- 
+2.49.0
+

0029-openssh-7.8p1-scp-ipv6.patch

@@ -1,8 +1,17 @@
+From 507e6f245557ae7261806f7ecbd40697cb0dd389 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 29/50] openssh-7.8p1-scp-ipv6
+
+---
+ scp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
 diff --git a/scp.c b/scp.c
-index 60682c68..9344806e 100644
+index 9554b188..7f9795a5 100644
 --- a/scp.c
 +++ b/scp.c
-@@ -714,7 +714,9 @@ toremote(int argc, char **argv)
+@@ -1183,7 +1183,9 @@ toremote(int argc, char **argv, enum scp_mode_e mode, char *sftp_direct)
  			addargs(&alist, "%s", host);
  			addargs(&alist, "%s", cmd);
  			addargs(&alist, "%s", src);
@@ -13,4 +22,6 @@ index 60682c68..9344806e 100644
  			    tuser ? tuser : "", tuser ? "@" : "",
  			    thost, targ);
  			if (do_local_cmd(&alist) != 0)
+-- 
+2.49.0
 

0030-openssh-8.0p1-crypto-policies.patch

@@ -1,7 +1,18 @@
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh_config.5 openssh-9.3p1-patched/ssh_config.5
---- openssh-9.3p1/ssh_config.5	2023-06-07 10:26:48.284590156 +0200
-+++ openssh-9.3p1-patched/ssh_config.5	2023-06-07 10:26:00.623052194 +0200
-@@ -378,17 +378,13 @@
+From b436140fe3abd9f97f01f9af9f5da5cf6c5d7725 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 30/50] openssh-8.0p1-crypto-policies
+
+---
+ ssh_config.5  | 164 ++++++++++++++++++++-------------------------
+ sshd_config.5 | 179 +++++++++++++++++++-------------------------------
+ 2 files changed, 140 insertions(+), 203 deletions(-)
+
+diff --git a/ssh_config.5 b/ssh_config.5
+index 8d5d0722..a43b2a27 100644
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -438,17 +438,13 @@ A single argument of
  causes no CNAMEs to be considered for canonicalization.
  This is the default behaviour.
  .It Cm CASignatureAlgorithms
@@ -24,7 +35,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  If the specified list begins with a
  .Sq +
  character, then the specified algorithms will be appended to the default set
-@@ -450,20 +446,25 @@
+@@ -587,20 +583,25 @@ If the option is set to
  (the default),
  the check will not be executed.
  .It Cm Ciphers
@@ -54,21 +65,21 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The supported ciphers are:
  .Bd -literal -offset indent
-@@ -479,13 +480,6 @@
+@@ -616,13 +617,6 @@ aes256-gcm@openssh.com
  chacha20-poly1305@openssh.com
  .Ed
  .Pp
 -The default is:
 -.Bd -literal -offset indent
 -chacha20-poly1305@openssh.com,
--aes128-ctr,aes192-ctr,aes256-ctr,
--aes128-gcm@openssh.com,aes256-gcm@openssh.com
+-aes128-gcm@openssh.com,aes256-gcm@openssh.com,
+-aes128-ctr,aes192-ctr,aes256-ctr
 -.Ed
 -.Pp
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClearAllForwardings
-@@ -885,6 +879,11 @@
+@@ -1022,6 +1016,11 @@ command line will be passed untouched to the GSSAPI library.
  The default is
  .Dq no .
  .It Cm GSSAPIKexAlgorithms
@@ -80,7 +91,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -897,10 +896,8 @@
+@@ -1034,10 +1033,8 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -92,7 +103,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-@@ -919,36 +916,25 @@
+@@ -1056,36 +1053,25 @@ will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
  .It Cm HostbasedAcceptedAlgorithms
@@ -137,7 +148,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The
  .Fl Q
-@@ -1001,6 +987,17 @@
+@@ -1138,6 +1124,17 @@ to prefer their algorithms.
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q HostKeyAlgorithms .
@@ -155,7 +166,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .It Cm HostKeyAlias
  Specifies an alias that should be used instead of the
  real host name when looking up or saving the host key
-@@ -1330,6 +1330,11 @@ it may be zero or more of:
+@@ -1376,6 +1373,11 @@ it may be zero or more of:
  and
  .Cm pam .
  .It Cm KexAlgorithms
@@ -167,7 +178,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  Specifies the permitted KEX (Key Exchange) algorithms that will be used and
  their preference order.
  The selected algorithm will be the first algorithm in this list that
-@@ -1338,29 +1343,17 @@ Multiple algorithms must be comma-separa
+@@ -1384,29 +1386,17 @@ Multiple algorithms must be comma-separated.
  .Pp
  If the specified list begins with a
  .Sq +
@@ -187,8 +198,8 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 -.Pp
 -The default is:
 -.Bd -literal -offset indent
--sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,
 -mlkem768x25519-sha256,
+-sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,
 -curve25519-sha256,curve25519-sha256@libssh.org,
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
@@ -201,7 +212,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
  .It Cm KnownHostsCommand
-@@ -1365,37 +1357,33 @@
+@@ -1522,37 +1512,33 @@ function, and all code in the
  file.
  This option is intended for debugging and no overrides are enabled by default.
  .It Cm MACs
@@ -248,7 +259,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
  .It Cm NoHostAuthenticationForLocalhost
-@@ -1567,39 +1555,31 @@
+@@ -1741,39 +1727,31 @@ instead of continuing to execute and pass data.
  The default is
  .Cm no .
  .It Cm PubkeyAcceptedAlgorithms
@@ -300,7 +311,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .It Cm PubkeyAuthentication
  Specifies whether to try public key authentication.
  The argument to this keyword must be
-@@ -2265,7 +2245,9 @@
+@@ -2497,7 +2475,9 @@ for those users who do not have a configuration file.
  This file must be world-readable.
  .El
  .Sh SEE ALSO
@@ -311,10 +322,11 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Sh AUTHORS
  .An -nosplit
  OpenSSH is a derivative of the original and free
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/sshd_config.5 openssh-9.3p1-patched/sshd_config.5
---- openssh-9.3p1/sshd_config.5	2023-06-07 10:26:48.277590077 +0200
-+++ openssh-9.3p1-patched/sshd_config.5	2023-06-07 10:26:00.592051845 +0200
-@@ -379,17 +379,13 @@
+diff --git a/sshd_config.5 b/sshd_config.5
+index 26fcdc84..583a01cd 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -379,17 +379,13 @@ If the argument is
  then no banner is displayed.
  By default, no banner is displayed.
  .It Cm CASignatureAlgorithms
@@ -337,7 +349,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  If the specified list begins with a
  .Sq +
  character, then the specified algorithms will be appended to the default set
-@@ -525,20 +521,25 @@
+@@ -533,20 +529,25 @@ The default is
  indicating not to
  .Xr chroot 2 .
  .It Cm Ciphers
@@ -367,21 +379,21 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The supported ciphers are:
  .Pp
-@@ -565,13 +566,6 @@
+@@ -573,13 +574,6 @@ aes256-gcm@openssh.com
  chacha20-poly1305@openssh.com
  .El
  .Pp
 -The default is:
 -.Bd -literal -offset indent
 -chacha20-poly1305@openssh.com,
--aes128-ctr,aes192-ctr,aes256-ctr,
--aes128-gcm@openssh.com,aes256-gcm@openssh.com
+-aes128-gcm@openssh.com,aes256-gcm@openssh.com,
+-aes128-ctr,aes192-ctr,aes256-ctr
 -.Ed
 -.Pp
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClientAliveCountMax
-@@ -766,53 +760,43 @@
+@@ -774,53 +768,43 @@ For this to work
  .Cm GSSAPIKeyExchange
  needs to be enabled in the server and also used by the client.
  .It Cm GSSAPIKexAlgorithms
@@ -454,7 +466,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q HostbasedAcceptedAlgorithms .
-@@ -879,25 +863,14 @@
+@@ -887,25 +871,14 @@ is specified, the location of the socket will be read from the
  .Ev SSH_AUTH_SOCK
  environment variable.
  .It Cm HostKeyAlgorithms
@@ -485,7 +497,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q HostKeyAlgorithms .
  .It Cm IgnoreRhosts
-@@ -1025,6 +1025,11 @@ Specifies whether to look at .k5login fi
+@@ -1052,6 +1025,11 @@ Specifies whether to look at .k5login file for user's aliases.
  The default is
  .Cm yes .
  .It Cm KexAlgorithms
@@ -497,7 +509,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  Specifies the permitted KEX (Key Exchange) algorithms that the server will
  offer to clients.
  The ordering of this list is not important, as the client specifies the
-@@ -1033,16 +1038,16 @@ Multiple algorithms must be comma-separa
+@@ -1060,16 +1038,16 @@ Multiple algorithms must be comma-separated.
  .Pp
  If the specified list begins with a
  .Sq +
@@ -518,25 +530,22 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The supported algorithms are:
  .Pp
-@@ -1075,17 +1080,6 @@ ecdh-sha2-nistp521
+@@ -1106,14 +1084,6 @@ sntrup761x25519-sha512
  sntrup761x25519-sha512@openssh.com
  .El
  .Pp
 -The default is:
 -.Bd -literal -offset indent
--sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,
 -mlkem768x25519-sha256,
+-sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,
 -curve25519-sha256,curve25519-sha256@libssh.org,
--ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
--diffie-hellman-group-exchange-sha256,
--diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
--diffie-hellman-group14-sha256
+-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
 -.Ed
 -.Pp
  The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q KexAlgorithms .
  .It Cm ListenAddress
-@@ -1184,21 +1152,26 @@
+@@ -1200,21 +1170,26 @@ function, and all code in the
  file.
  This option is intended for debugging and no overrides are enabled by default.
  .It Cm MACs
@@ -567,7 +576,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The algorithms that contain
  .Qq -etm
-@@ -1241,15 +1214,6 @@
+@@ -1257,15 +1232,6 @@ umac-64-etm@openssh.com
  umac-128-etm@openssh.com
  .El
  .Pp
@@ -583,7 +592,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
  .It Cm Match
-@@ -1633,36 +1597,25 @@
+@@ -1753,36 +1719,25 @@ or equivalent.)
  The default is
  .Cm yes .
  .It Cm PubkeyAcceptedAlgorithms
@@ -629,7 +638,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
-@@ -2131,7 +2084,9 @@
+@@ -2289,7 +2244,9 @@ This file should be writable by root only, but it is recommended
  .El
  .Sh SEE ALSO
  .Xr sftp-server 8 ,
@@ -640,3 +649,6 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Sh AUTHORS
  .An -nosplit
  OpenSSH is a derivative of the original and free
+-- 
+2.49.0
+

0031-openssh-8.0p1-openssl-kdf.patch

@@ -1,14 +1,18 @@
-commit 2c3ef499bfffce3cfd315edeebf202850ba4e00a
-Author: Jakub Jelen <jjelen@redhat.com>
-Date:   Tue Apr 16 15:35:18 2019 +0200
+From 430bd33963725beb8ec01a1e581529ae6bf6bec0 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 31/50] openssh-8.0p1-openssl-kdf
 
-    Use the new OpenSSL KDF
+---
+ configure.ac |   1 +
+ kex.c        | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 108 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 2a455e4e..e01c3d43 100644
+index d9bd2f51..d92a8580 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2712,6 +2712,7 @@ if test "x$openssl" = "xyes" ; then
+@@ -3137,6 +3137,7 @@ if test "x$openssl" = "xyes" ; then
  		HMAC_CTX_init \
  		RSA_generate_key_ex \
  		RSA_get_default_method \
@@ -17,10 +21,10 @@ index 2a455e4e..e01c3d43 100644
  
  	# OpenSSL_add_all_algorithms may be a macro.
 diff --git a/kex.c b/kex.c
-index b6f041f4..1fbce2bb 100644
+index 19a56e8e..8b200ff4 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -38,6 +38,11 @@
+@@ -40,6 +40,11 @@
  #ifdef WITH_OPENSSL
  #include <openssl/crypto.h>
  #include <openssl/dh.h>
@@ -32,7 +36,7 @@ index b6f041f4..1fbce2bb 100644
  #endif
  
  #include "ssh.h"
-@@ -942,6 +945,107 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1078,6 +1083,107 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
  	return r;
  }
  
@@ -140,7 +144,7 @@ index b6f041f4..1fbce2bb 100644
  static int
  derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
      const struct sshbuf *shared_secret, u_char **keyp)
-@@ -1004,6 +1096,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
+@@ -1141,6 +1247,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
  	ssh_digest_free(hashctx);
  	return r;
  }
@@ -148,4 +152,6 @@ index b6f041f4..1fbce2bb 100644
  
  #define NKEYS	6
  int
+-- 
+2.49.0
 

0032-openssh-8.2p1-visibility.patch

@@ -1,8 +1,17 @@
+From 6aa231d9acfeca870ee87e3bf9c4a1239518706d Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 32/50] openssh-8.2p1-visibility
+
+---
+ regress/misc/sk-dummy/sk-dummy.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
 diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c
-index dca158de..afdcb1d2 100644
+index 347b2122..344f8a8a 100644
 --- a/regress/misc/sk-dummy/sk-dummy.c
 +++ b/regress/misc/sk-dummy/sk-dummy.c
-@@ -71,7 +71,7 @@ skdebug(const char *func, const char *fmt, ...)
+@@ -81,7 +81,7 @@ skdebug(const char *func, const char *fmt, ...)
  #endif
  }
  
@@ -11,7 +20,7 @@ index dca158de..afdcb1d2 100644
  sk_api_version(void)
  {
  	return SSH_SK_VERSION_MAJOR;
-@@ -220,7 +220,7 @@ check_options(struct sk_option **options)
+@@ -230,7 +230,7 @@ check_options(struct sk_option **options)
  	return 0;
  }
  
@@ -20,7 +29,7 @@ index dca158de..afdcb1d2 100644
  sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
      const char *application, uint8_t flags, const char *pin,
      struct sk_option **options, struct sk_enroll_response **enroll_response)
-@@ -467,7 +467,7 @@ sig_ed25519(const uint8_t *message, size_t message_len,
+@@ -478,7 +478,7 @@ sig_ed25519(const uint8_t *message, size_t message_len,
  	return ret;
  }
  
@@ -29,7 +38,7 @@ index dca158de..afdcb1d2 100644
  sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
      const char *application, const uint8_t *key_handle, size_t key_handle_len,
      uint8_t flags, const char *pin, struct sk_option **options,
-@@ -518,7 +518,7 @@ sk_sign(uint32_t alg, const uint8_t *message, size_t message_len,
+@@ -535,7 +535,7 @@ sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
  	return ret;
  }
  
@@ -38,3 +47,6 @@ index dca158de..afdcb1d2 100644
  sk_load_resident_keys(const char *pin, struct sk_option **options,
      struct sk_resident_key ***rks, size_t *nrks)
  {
+-- 
+2.49.0
+

0033-openssh-8.2p1-x11-without-ipv6.patch

@@ -1,12 +1,17 @@
+From cfe5a99d335eb57b8c08b4eb6b4535dd042d96e3 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:28 +0200
+Subject: [PATCH 33/50] openssh-8.2p1-x11-without-ipv6
+
+---
+ channels.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
 diff --git a/channels.c b/channels.c
+index 7438c1a5..95836d50 100644
 --- a/channels.c
 +++ b/channels.c
-@@ -3933,16 +3933,26 @@ x11_create_display_inet(int x11_display_
- 			if (ai->ai_family == AF_INET6)
- 				sock_set_v6only(sock);
- 			if (x11_use_localhost)
- 				set_reuseaddr(sock);
- 			if (bind(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
+@@ -5055,6 +5055,16 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  				debug2_f("bind port %d: %.100s", port,
  				    strerror(errno));
  				close(sock);
@@ -23,8 +28,6 @@ diff --git a/channels.c b/channels.c
  				for (n = 0; n < num_socks; n++)
  					close(socks[n]);
  				num_socks = 0;
- 				break;
- 			}
- 			socks[num_socks++] = sock;
- 			if (num_socks == NUM_SOCKS)
- 				break;
+-- 
+2.49.0
+

0034-openssh-8.0p1-preserve-pam-errors.patch

@@ -1,7 +1,17 @@
-diff -up openssh-8.0p1/auth-pam.c.preserve-pam-errors openssh-8.0p1/auth-pam.c
---- openssh-8.0p1/auth-pam.c.preserve-pam-errors	2021-03-31 17:03:15.618592347 +0200
-+++ openssh-8.0p1/auth-pam.c	2021-03-31 17:06:58.115220014 +0200
-@@ -511,7 +511,11 @@ sshpam_thread(void *ctxtp)
+From 8de0391e3b3eb75e23ee9f173f04a9c78f2b96c9 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 34/50] openssh-8.0p1-preserve-pam-errors
+
+---
+ auth-pam.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/auth-pam.c b/auth-pam.c
+index b4100ea1..a042c3c8 100644
+--- a/auth-pam.c
++++ b/auth-pam.c
+@@ -523,7 +523,11 @@ sshpam_thread(void *ctxtp)
  		goto auth_fail;
  
  	if (!do_pam_account()) {
@@ -14,7 +24,7 @@ diff -up openssh-8.0p1/auth-pam.c.preserve-pam-errors openssh-8.0p1/auth-pam.c
  		goto auth_fail;
  	}
  	if (sshpam_authctxt->force_pwchange) {
-@@ -568,8 +572,10 @@ sshpam_thread(void *ctxtp)
+@@ -580,8 +584,10 @@ sshpam_thread(void *ctxtp)
  	    pam_strerror(sshpam_handle, sshpam_err))) != 0)
  		fatal("%s: buffer error: %s", __func__, ssh_err(r));
  	/* XXX - can't do much about an error here */
@@ -27,17 +37,20 @@ diff -up openssh-8.0p1/auth-pam.c.preserve-pam-errors openssh-8.0p1/auth-pam.c
  	else if (sshpam_maxtries_reached)
  		ssh_msg_send(ctxt->pam_csock, PAM_MAXTRIES, buffer);
  	else
-@@ -856,9 +862,11 @@ sshpam_query(void *ctx, char **name, cha
+@@ -890,9 +896,11 @@ sshpam_query(void *ctx, char **name, char **info,
  			free(msg);
  			break;
  		case PAM_ACCT_EXPIRED:
 +			sshpam_account_status = 0;
 +			/* FALLTHROUGH */
  		case PAM_MAXTRIES:
-+		case PAM_USER_UNKNOWN:
-+		case PAM_PERM_DENIED:
 -			if (type == PAM_ACCT_EXPIRED)
 -				sshpam_account_status = 0;
++		case PAM_USER_UNKNOWN:
++		case PAM_PERM_DENIED:
  			if (type == PAM_MAXTRIES)
  				sshpam_set_maxtries_reached(1);
  			/* FALLTHROUGH */
+-- 
+2.49.0
+

0035-openssh-8.7p1-scp-kill-switch.patch

@@ -1,6 +1,18 @@
-diff -up openssh-8.7p1/pathnames.h.kill-scp openssh-8.7p1/pathnames.h
---- openssh-8.7p1/pathnames.h.kill-scp	2021-09-16 11:37:57.240171687 +0200
-+++ openssh-8.7p1/pathnames.h	2021-09-16 11:42:29.183427917 +0200
+From a68f3741fdc01bf6823a69d2442caba7de9835f9 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 35/50] openssh-8.7p1-scp-kill-switch
+
+---
+ pathnames.h | 1 +
+ scp.1       | 7 +++++++
+ scp.c       | 8 ++++++++
+ 3 files changed, 16 insertions(+)
+
+diff --git a/pathnames.h b/pathnames.h
+index 1158bec9..43f0c570 100644
+--- a/pathnames.h
++++ b/pathnames.h
 @@ -42,6 +42,7 @@
  #define _PATH_HOST_XMSS_KEY_FILE	SSHDIR "/ssh_host_xmss_key"
  #define _PATH_HOST_RSA_KEY_FILE		SSHDIR "/ssh_host_rsa_key"
@@ -9,10 +21,11 @@ diff -up openssh-8.7p1/pathnames.h.kill-scp openssh-8.7p1/pathnames.h
  
  #ifndef _PATH_SSH_PROGRAM
  #define _PATH_SSH_PROGRAM		"/usr/bin/ssh"
-diff -up openssh-8.7p1/scp.1.kill-scp openssh-8.7p1/scp.1
---- openssh-8.7p1/scp.1.kill-scp	2021-09-16 12:09:02.646714578 +0200
-+++ openssh-8.7p1/scp.1	2021-09-16 12:26:49.978628226 +0200
-@@ -278,6 +278,13 @@ to print debugging messages about their
+diff --git a/scp.1 b/scp.1
+index aa2e2d8b..373d7237 100644
+--- a/scp.1
++++ b/scp.1
+@@ -331,6 +331,13 @@ during download or upload.
  By default a 32KB buffer is used.
  .El
  .El
@@ -26,10 +39,11 @@ diff -up openssh-8.7p1/scp.1.kill-scp openssh-8.7p1/scp.1
  .Sh EXIT STATUS
  .Ex -std scp
  .Sh SEE ALSO
-diff -up openssh-8.7p1/scp.c.kill-scp openssh-8.7p1/scp.c
---- openssh-8.7p1/scp.c.kill-scp	2021-09-16 11:42:56.013650519 +0200
-+++ openssh-8.7p1/scp.c	2021-09-16 11:53:03.249713836 +0200
-@@ -596,6 +596,14 @@ main(int argc, char **argv)
+diff --git a/scp.c b/scp.c
+index 7f9795a5..7ed1a54c 100644
+--- a/scp.c
++++ b/scp.c
+@@ -649,6 +649,14 @@ main(int argc, char **argv)
  	if (iamremote)
  		mode = MODE_SCP;
  
@@ -44,3 +58,6 @@ diff -up openssh-8.7p1/scp.c.kill-scp openssh-8.7p1/scp.c
  	if ((pwd = getpwuid(userid = getuid())) == NULL)
  		fatal("unknown user %u", (u_int) userid);
  
+-- 
+2.49.0
+

0036-openssh-8.7p1-recursive-scp.patch

@@ -1,8 +1,21 @@
-diff --git a/scp.c b/scp.c
---- a/scp.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/scp.c	(date 1703111453316)
-@@ -1372,7 +1372,7 @@
+From 99e1e3af524376788e591ca73387f1ca37e6f5ef Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 36/50] openssh-8.7p1-recursive-scp
 
+---
+ scp.c         |  2 +-
+ sftp-client.c | 60 +++++++++++++++++++++++++++++++++++++++------------
+ sftp-client.h |  4 ++--
+ sftp.c        |  6 +++---
+ 4 files changed, 52 insertions(+), 20 deletions(-)
+
+diff --git a/scp.c b/scp.c
+index 7ed1a54c..0c87dd0e 100644
+--- a/scp.c
++++ b/scp.c
+@@ -1388,7 +1388,7 @@ source_sftp(int argc, char *src, char *targ, struct sftp_conn *conn)
+ 
  	if (src_is_dir && iamrecursive) {
  		if (sftp_upload_dir(conn, src, abs_dst, pflag,
 -		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1) != 0) {
@@ -11,10 +24,11 @@ diff --git a/scp.c b/scp.c
  			errs = 1;
  		}
 diff --git a/sftp-client.c b/sftp-client.c
---- a/sftp-client.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/sftp-client.c	(date 1703169614263)
-@@ -1003,7 +1003,7 @@
-
+index 9f8ab4af..873dec04 100644
+--- a/sftp-client.c
++++ b/sftp-client.c
+@@ -1003,7 +1003,7 @@ sftp_fsetstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
+ 
  /* Implements both the realpath and expand-path operations */
  static char *
 -sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
@@ -22,7 +36,7 @@ diff --git a/sftp-client.c b/sftp-client.c
  {
  	struct sshbuf *msg;
  	u_int expected_id, count, id;
-@@ -1049,11 +1049,43 @@
+@@ -1049,11 +1049,43 @@ sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
  		if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
  		    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
  			fatal_fr(r, "parse status");
@@ -71,9 +85,9 @@ diff --git a/sftp-client.c b/sftp-client.c
  	} else if (type != SSH2_FXP_NAME)
  		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
  		    SSH2_FXP_NAME, type);
-@@ -1078,9 +1110,9 @@
+@@ -1078,9 +1110,9 @@ sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
  }
-
+ 
  char *
 -sftp_realpath(struct sftp_conn *conn, const char *path)
 +sftp_realpath(struct sftp_conn *conn, const char *path, int create_dir)
@@ -81,9 +95,9 @@ diff --git a/sftp-client.c b/sftp-client.c
 -	return sftp_realpath_expand(conn, path, 0);
 +	return sftp_realpath_expand(conn, path, 0, create_dir);
  }
-
+ 
  int
-@@ -1094,9 +1126,9 @@
+@@ -1094,9 +1126,9 @@ sftp_expand_path(struct sftp_conn *conn, const char *path)
  {
  	if (!sftp_can_expand_path(conn)) {
  		debug3_f("no server support, fallback to realpath");
@@ -93,18 +107,18 @@ diff --git a/sftp-client.c b/sftp-client.c
 -	return sftp_realpath_expand(conn, path, 1);
 +	return sftp_realpath_expand(conn, path, 1, 0);
  }
-
+ 
  int
-@@ -2016,7 +2048,7 @@
+@@ -2016,7 +2048,7 @@ sftp_download_dir(struct sftp_conn *conn, const char *src, const char *dst,
  	char *src_canon;
  	int ret;
-
+ 
 -	if ((src_canon = sftp_realpath(conn, src)) == NULL) {
 +	if ((src_canon = sftp_realpath(conn, src, 0)) == NULL) {
  		error("download \"%s\": path canonicalization failed", src);
  		return -1;
  	}
-@@ -2365,12 +2397,12 @@
+@@ -2366,12 +2398,12 @@ upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
  int
  sftp_upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
      int preserve_flag, int print_flag, int resume, int fsync_flag,
@@ -113,47 +127,48 @@ diff --git a/sftp-client.c b/sftp-client.c
  {
  	char *dst_canon;
  	int ret;
-
+ 
 -	if ((dst_canon = sftp_realpath(conn, dst)) == NULL) {
 +	if ((dst_canon = sftp_realpath(conn, dst, create_dir)) == NULL) {
  		error("upload \"%s\": path canonicalization failed", dst);
  		return -1;
  	}
-@@ -2825,7 +2857,7 @@
+@@ -2826,7 +2858,7 @@ sftp_crossload_dir(struct sftp_conn *from, struct sftp_conn *to,
  	char *from_path_canon;
  	int ret;
-
+ 
 -	if ((from_path_canon = sftp_realpath(from, from_path)) == NULL) {
 +	if ((from_path_canon = sftp_realpath(from, from_path, 0)) == NULL) {
  		error("crossload \"%s\": path canonicalization failed",
  		    from_path);
  		return -1;
 diff --git a/sftp-client.h b/sftp-client.h
---- a/sftp-client.h	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/sftp-client.h	(date 1703111691284)
-@@ -111,7 +111,7 @@
+index 74cdae7d..00ed6630 100644
+--- a/sftp-client.h
++++ b/sftp-client.h
+@@ -111,7 +111,7 @@ int sftp_fsetstat(struct sftp_conn *, const u_char *, u_int, Attrib *);
  int sftp_lsetstat(struct sftp_conn *conn, const char *path, Attrib *a);
-
+ 
  /* Canonicalise 'path' - caller must free result */
 -char *sftp_realpath(struct sftp_conn *, const char *);
 +char *sftp_realpath(struct sftp_conn *, const char *, int);
-
+ 
  /* Canonicalisation with tilde expansion (requires server extension) */
  char *sftp_expand_path(struct sftp_conn *, const char *);
-@@ -163,7 +163,7 @@
+@@ -163,7 +163,7 @@ int sftp_upload(struct sftp_conn *, const char *, const char *,
   * times if 'pflag' is set
   */
  int sftp_upload_dir(struct sftp_conn *, const char *, const char *,
 -    int, int, int, int, int, int);
 +    int, int, int, int, int, int, int);
-
+ 
  /*
   * Download a 'from_path' from the 'from' connection and upload it to
-
 diff --git a/sftp.c b/sftp.c
---- a/sftp.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/sftp.c	(date 1703168795365)
-@@ -807,7 +807,7 @@
+index bdedd141..322e6d1f 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -809,7 +809,7 @@ process_put(struct sftp_conn *conn, const char *src, const char *dst,
  		    (rflag || global_rflag)) {
  			if (sftp_upload_dir(conn, g.gl_pathv[i], abs_dst,
  			    pflag || global_pflag, 1, resume,
@@ -162,7 +177,7 @@ diff --git a/sftp.c b/sftp.c
  				err = -1;
  		} else {
  			if (sftp_upload(conn, g.gl_pathv[i], abs_dst,
-@@ -1642,7 +1642,7 @@
+@@ -1644,7 +1644,7 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
  		if (path1 == NULL || *path1 == '\0')
  			path1 = xstrdup(startdir);
  		path1 = sftp_make_absolute(path1, *pwd);
@@ -171,12 +186,15 @@ diff --git a/sftp.c b/sftp.c
  			err = 1;
  			break;
  		}
-@@ -2247,7 +2247,7 @@
+@@ -2249,7 +2249,7 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
  	}
  #endif /* USE_LIBEDIT */
-
+ 
 -	if ((remote_path = sftp_realpath(conn, ".")) == NULL)
 +	if ((remote_path = sftp_realpath(conn, ".", 0)) == NULL)
  		fatal("Need cwd");
  	startdir = xstrdup(remote_path);
+ 
+-- 
+2.49.0
 

0037-openssh-8.7p1-minrsabits.patch

@@ -1,7 +1,18 @@
+From 286bc4a302b5130f732c857095ae665f7bea01dd Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 37/50] openssh-8.7p1-minrsabits
+
+---
+ readconf.c | 1 +
+ servconf.c | 1 +
+ 2 files changed, 2 insertions(+)
+
 diff --git a/readconf.c b/readconf.c
---- a/readconf.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/readconf.c	(date 1703169891147)
-@@ -326,6 +326,7 @@
+index 6c04ed43..f340bf50 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -343,6 +343,7 @@ static struct {
  	{ "securitykeyprovider", oSecurityKeyProvider },
  	{ "knownhostscommand", oKnownHostsCommand },
  	{ "requiredrsasize", oRequiredRSASize },
@@ -10,9 +21,10 @@ diff --git a/readconf.c b/readconf.c
  	{ "obscurekeystroketiming", oObscureKeystrokeTiming },
  	{ "channeltimeout", oChannelTimeout },
 diff --git a/servconf.c b/servconf.c
---- a/servconf.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/servconf.c	(date 1703169891148)
-@@ -691,6 +691,7 @@
+index 15c99b30..84891544 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -788,6 +788,7 @@ static struct {
  	{ "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
  	{ "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
  	{ "requiredrsasize", sRequiredRSASize, SSHCFG_ALL },
@@ -20,3 +32,6 @@ diff --git a/servconf.c b/servconf.c
  	{ "channeltimeout", sChannelTimeout, SSHCFG_ALL },
  	{ "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL },
  	{ "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL },
+-- 
+2.49.0
+

0038-openssh-8.7p1-ibmca.patch

@@ -0,0 +1,25 @@
+From 26af04432f6404eb03780265a5cce948ecfec8dc Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 38/50] openssh-8.7p1-ibmca
+
+---
+ openbsd-compat/bsd-closefrom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/openbsd-compat/bsd-closefrom.c b/openbsd-compat/bsd-closefrom.c
+index f6112458..417c2048 100644
+--- a/openbsd-compat/bsd-closefrom.c
++++ b/openbsd-compat/bsd-closefrom.c
+@@ -16,7 +16,7 @@
+ 
+ #include "includes.h"
+ 
+-#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM)
++#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM) || (defined __s390__)
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+-- 
+2.49.0
+

0040-openssh-7.1p2-audit-race-condition.patch

@@ -1,7 +1,19 @@
-diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
---- openssh-7.4p1/monitor_wrap.c.audit-race	2016-12-23 16:35:52.694685771 +0100
-+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:35:52.697685772 +0100
-@@ -1107,4 +1107,50 @@ mm_audit_destroy_sensitive_data(const ch
+From c288d4a26ad44dc481c9d18d2920c9d70474833c Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 40/50] openssh-7.1p2-audit-race-condition
+
+---
+ monitor_wrap.c | 46 +++++++++++++++++++++++++++++++++++++
+ monitor_wrap.h |  2 ++
+ session.c      | 61 ++++++++++++++++++++++++++++++++++++++++++++------
+ 3 files changed, 102 insertions(+), 7 deletions(-)
+
+diff --git a/monitor_wrap.c b/monitor_wrap.c
+index 1a079c15..768a59f9 100644
+--- a/monitor_wrap.c
++++ b/monitor_wrap.c
+@@ -1415,4 +1415,50 @@ mm_audit_destroy_sensitive_data(struct ssh *ssh, const char *fp, pid_t pid, uid_
  	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
  	sshbuf_free(m);
  }
@@ -52,10 +64,11 @@ diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
 +	pmonitor->m_recvfd = fd;
 +}
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-7.4p1/monitor_wrap.h.audit-race openssh-7.4p1/monitor_wrap.h
---- openssh-7.4p1/monitor_wrap.h.audit-race	2016-12-23 16:35:52.694685771 +0100
-+++ openssh-7.4p1/monitor_wrap.h	2016-12-23 16:35:52.698685772 +0100
-@@ -83,6 +83,8 @@ void mm_audit_unsupported_body(int);
+diff --git a/monitor_wrap.h b/monitor_wrap.h
+index 661ed63b..e957ba6e 100644
+--- a/monitor_wrap.h
++++ b/monitor_wrap.h
+@@ -93,6 +93,8 @@ void mm_audit_unsupported_body(struct ssh *, int);
  void mm_audit_kex_body(struct ssh *, int, char *, char *, char *, char *, pid_t, uid_t);
  void mm_audit_session_key_free_body(struct ssh *, int, pid_t, uid_t);
  void mm_audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
@@ -64,10 +77,11 @@ diff -up openssh-7.4p1/monitor_wrap.h.audit-race openssh-7.4p1/monitor_wrap.h
  #endif
  
  struct Session;
-diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
---- openssh-7.4p1/session.c.audit-race	2016-12-23 16:35:52.695685771 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 16:37:26.339730596 +0100
-@@ -162,6 +162,10 @@ static Session *sessions = NULL;
+diff --git a/session.c b/session.c
+index 83fc9418..b4753d93 100644
+--- a/session.c
++++ b/session.c
+@@ -167,6 +167,10 @@ static Session *sessions = NULL;
  login_cap_t *lc;
  #endif
  
@@ -78,7 +92,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  static int is_child = 0;
  static int in_chroot = 0;
  static int have_dev_log = 1;
-@@ -289,6 +293,8 @@ xauth_valid_string(const char *s)
+@@ -390,6 +394,8 @@ xauth_valid_string(const char *s)
  	return 1;
  }
  
@@ -87,7 +101,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  #define USE_PIPES 1
  /*
   * This is called to fork and execute a command when we have no tty.  This
-@@ -424,6 +430,8 @@ do_exec_no_pty(Session *s, const char *c
+@@ -513,6 +519,8 @@ do_exec_no_pty(struct ssh *ssh, Session *s, const char *command)
  		close(err[0]);
  #endif
  
@@ -96,7 +110,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  		/* Do processing for the child (exec command etc). */
  		do_child(ssh, s, command);
  		/* NOTREACHED */
-@@ -547,6 +555,9 @@ do_exec_pty(Session *s, const char *comm
+@@ -630,6 +638,9 @@ do_exec_pty(struct ssh *ssh, Session *s, const char *command)
  		/* Close the extra descriptor for the pseudo tty. */
  		close(ttyfd);
  
@@ -106,7 +120,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  		/* record login, etc. similar to login(1) */
  #ifndef HAVE_OSF_SIA
  		do_login(ssh, s, command);
-@@ -717,6 +728,8 @@ do_exec(Session *s, const char *command)
+@@ -766,6 +777,8 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
  	}
  	if (s->command != NULL && s->ptyfd == -1)
  		s->command_handle = mm_audit_run_command(ssh, s->command);
@@ -115,7 +129,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  #endif
  	if (s->ttyfd != -1)
  		ret = do_exec_pty(ssh, s, command);
-@@ -732,6 +745,20 @@ do_exec(Session *s, const char *command)
+@@ -781,6 +794,20 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
  	 */
  	sshbuf_reset(loginmsg);
  
@@ -136,7 +150,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  	return ret;
  }
  
-@@ -1538,6 +1565,33 @@ child_close_fds(void)
+@@ -1532,6 +1559,33 @@ child_close_fds(struct ssh *ssh)
  	log_redirect_stderr_to(NULL);
  }
  
@@ -151,7 +165,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
 +#endif
 +
 +	/* remove hostkey from the child's memory */
-+	destroy_sensitive_data(ssh);
++	/* FIXME beldmit destroy_sensitive_data(ssh); */
 +	/*
 +	 * We can audit this, because we hacked the pipe to direct the
 +	 * messages over postauth child. But this message requires answer
@@ -170,11 +184,11 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  /*
   * Performs common processing for the child, such as setting up the
   * environment, closing extra file descriptors, setting the user and group
-@@ -1554,13 +1608,6 @@ do_child(Session *s, const char *command
+@@ -1549,13 +1603,6 @@ do_child(struct ssh *ssh, Session *s, const char *command)
  
  	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
  
--	/* remove hostkey from the child's memory */
+-	/* remove keys from memory */
 -	destroy_sensitive_data(ssh);
 -	ssh_packet_clear_keys(ssh);
 -	/* Don't audit this - both us and the parent would be talking to the
@@ -184,3 +198,6 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  	/* Force a password change */
  	if (s->authctxt->force_pwchange) {
  		do_setusercontext(pw);
+-- 
+2.49.0
+

0041-openssh-9.0p1-audit-log.patch

@@ -1,7 +1,20 @@
-diff -up openssh-9.0p1/audit-bsm.c.patch openssh-9.0p1/audit-bsm.c
---- openssh-9.0p1/audit-bsm.c.patch	2022-10-24 15:02:16.544858331 +0200
-+++ openssh-9.0p1/audit-bsm.c	2022-10-24 14:51:43.685766639 +0200
-@@ -405,7 +405,7 @@ audit_session_close(struct logininfo *li
+From 80d967a18261156573e7385f8e534a89d2767d67 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 41/50] openssh-9.0p1-audit-log
+
+---
+ audit-bsm.c   |  2 +-
+ audit-linux.c | 76 +++++++++++++++++++++++++++++++++++++++++++--------
+ audit.c       | 18 +++++++++---
+ audit.h       |  2 +-
+ 4 files changed, 81 insertions(+), 17 deletions(-)
+
+diff --git a/audit-bsm.c b/audit-bsm.c
+index a49abb92..c6f56553 100644
+--- a/audit-bsm.c
++++ b/audit-bsm.c
+@@ -405,7 +405,7 @@ audit_session_close(struct logininfo *li)
  }
  
  int
@@ -10,51 +23,10 @@ diff -up openssh-9.0p1/audit-bsm.c.patch openssh-9.0p1/audit-bsm.c
  {
  	/* not implemented */
  }
-diff -up openssh-9.0p1/audit.c.patch openssh-9.0p1/audit.c
---- openssh-9.0p1/audit.c.patch	2022-10-24 15:02:16.544858331 +0200
-+++ openssh-9.0p1/audit.c	2022-10-24 15:20:38.854548226 +0200
-@@ -116,12 +116,22 @@ audit_event_lookup(ssh_audit_event_t ev)
- void
- audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
- {
--	char *fp;
-+	char *key_fp = NULL;
-+	char *issuer_fp = NULL;
-+	struct sshkey_cert *cert = NULL;
- 
--	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
--	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
-+	key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
-+	if (sshkey_is_cert(key) && key->cert != NULL && key->cert->signature_key != NULL) {
-+		cert = key->cert;
-+		issuer_fp = sshkey_fingerprint(cert->signature_key,
-+										options.fingerprint_hash, SSH_FP_DEFAULT);
-+	}
-+	if (audit_keyusage(ssh, host_user, key_fp, cert, issuer_fp, (*rv == 0)) == 0)
- 		*rv = -SSH_ERR_INTERNAL_ERROR;
--	free(fp);
-+	if (key_fp)
-+		free(key_fp);
-+	if (issuer_fp)
-+		free(issuer_fp);
- }
- 
- void
-diff -up openssh-9.0p1/audit.h.patch openssh-9.0p1/audit.h
---- openssh-9.0p1/audit.h.patch	2022-10-24 15:02:16.544858331 +0200
-+++ openssh-9.0p1/audit.h	2022-10-24 14:58:20.887565518 +0200
-@@ -64,7 +64,7 @@ void	audit_session_close(struct logininf
- int	audit_run_command(struct ssh *, const char *);
- void 	audit_end_command(struct ssh *, int, const char *);
- ssh_audit_event_t audit_classify_auth(const char *);
--int	audit_keyusage(struct ssh *, int, char *, int);
-+int	audit_keyusage(struct ssh *, int, const char *, const struct sshkey_cert *, const char *, int);
- void	audit_key(struct ssh *, int, int *, const struct sshkey *);
- void	audit_unsupported(struct ssh *, int);
- void	audit_kex(struct ssh *, int, char *, char *, char *, char *);
-diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
---- openssh-9.9p1/audit-linux.c.xxx	2024-10-15 11:49:48.092151974 +0200
-+++ openssh-9.9p1/audit-linux.c	2024-10-15 12:08:17.179158343 +0200
+diff --git a/audit-linux.c b/audit-linux.c
+index d484b82b..dcfde3a9 100644
+--- a/audit-linux.c
++++ b/audit-linux.c
 @@ -52,7 +52,7 @@ extern u_int utmp_len;
  const char *audit_username(void);
  
@@ -64,7 +36,7 @@ diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
      const char *ip, const char *ttyn, int success, int event)
  {
  	int audit_fd, rc, saved_errno;
-@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const c
+@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const char *username,
  	}
  	rc = audit_log_acct_message(audit_fd, event,
  	    NULL, "login", username ? username : "(unknown)",
@@ -87,7 +59,7 @@ diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
  
  	audit_fd = audit_open();
  	if (audit_fd < 0) {
-@@ -150,14 +152,44 @@ audit_keyusage(struct ssh *ssh, int host
+@@ -150,14 +152,44 @@ audit_keyusage(struct ssh *ssh, int host_user, char *fp, int rv)
  		else
  			return 0; /* Must prevent login */
  	}
@@ -135,7 +107,7 @@ diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
  out:
  	saved_errno = errno;
  	audit_close(audit_fd);
-@@ -179,26 +211,34 @@ audit_connection_from(const char *host,
+@@ -179,26 +211,34 @@ audit_connection_from(const char *host, int port)
  int
  audit_run_command(struct ssh *ssh, const char *command)
  {
@@ -217,7 +189,7 @@ diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
  			ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
  		break;
  	case SSH_AUTH_FAIL_PASSWD:
-@@ -255,9 +305,11 @@ audit_event(struct ssh *ssh, ssh_audit_e
+@@ -255,9 +305,11 @@ audit_event(struct ssh *ssh, ssh_audit_event_t event)
  		if (user_login_count) {
  			while (user_login_count--)
  				linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
@@ -229,7 +201,7 @@ diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
  			    ssh_remote_ipaddr(ssh),
  			    "ssh", 1, AUDIT_USER_LOGOUT);
  		}
-@@ -266,12 +318,14 @@ audit_event(struct ssh *ssh, ssh_audit_e
+@@ -266,12 +318,14 @@ audit_event(struct ssh *ssh, ssh_audit_event_t event)
  	case SSH_CONNECTION_ABANDON:
  	case SSH_INVALID_USER:
  		linux_audit_user_logxxx(-1, audit_username(),
@@ -244,3 +216,50 @@ diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
  }
  
  void
+diff --git a/audit.c b/audit.c
+index d0433c3a..28d51a14 100644
+--- a/audit.c
++++ b/audit.c
+@@ -116,12 +116,22 @@ audit_event_lookup(ssh_audit_event_t ev)
+ void
+ audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
+ {
+-	char *fp;
++	char *key_fp = NULL;
++	char *issuer_fp = NULL;
++	struct sshkey_cert *cert = NULL;
+ 
+-	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
+-	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
++	key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
++	if (sshkey_is_cert(key) && key->cert != NULL && key->cert->signature_key != NULL) {
++		cert = key->cert;
++		issuer_fp = sshkey_fingerprint(cert->signature_key,
++										options.fingerprint_hash, SSH_FP_DEFAULT);
++	}
++	if (audit_keyusage(ssh, host_user, key_fp, cert, issuer_fp, (*rv == 0)) == 0)
+ 		*rv = -SSH_ERR_INTERNAL_ERROR;
+-	free(fp);
++	if (key_fp)
++		free(key_fp);
++	if (issuer_fp)
++		free(issuer_fp);
+ }
+ 
+ void
+diff --git a/audit.h b/audit.h
+index 45d66ccf..05ac132c 100644
+--- a/audit.h
++++ b/audit.h
+@@ -64,7 +64,7 @@ void	audit_session_close(struct logininfo *);
+ int	audit_run_command(struct ssh *, const char *);
+ void 	audit_end_command(struct ssh *, int, const char *);
+ ssh_audit_event_t audit_classify_auth(const char *);
+-int	audit_keyusage(struct ssh *, int, char *, int);
++int	audit_keyusage(struct ssh *, int, const char *, const struct sshkey_cert *, const char *, int);
+ void	audit_key(struct ssh *, int, int *, const struct sshkey *);
+ void	audit_unsupported(struct ssh *, int);
+ void	audit_kex(struct ssh *, int, char *, char *, char *, char *);
+-- 
+2.49.0
+

0043-openssh-8.7p1-ssh-manpage.patch

@@ -0,0 +1,47 @@
+From 299a602802d7c7d121306eb2aeae1502871a35cb Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 43/50] openssh-8.7p1-ssh-manpage
+
+---
+ ssh.1 | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/ssh.1 b/ssh.1
+index 6a9fbdc5..755cdef2 100644
+--- a/ssh.1
++++ b/ssh.1
+@@ -510,12 +510,12 @@ For full details of the options listed below, and their possible values, see
+ .It BatchMode
+ .It BindAddress
+ .It BindInterface
+-.It CASignatureAlgorithms
+ .It CanonicalDomains
+ .It CanonicalizeFallbackLocal
+ .It CanonicalizeHostname
+ .It CanonicalizeMaxDots
+ .It CanonicalizePermittedCNAMEs
++.It CASignatureAlgorithms
+ .It CertificateFile
+ .It ChannelTimeout
+ .It CheckHostIP
+@@ -528,6 +528,7 @@ For full details of the options listed below, and their possible values, see
+ .It ControlPath
+ .It ControlPersist
+ .It DynamicForward
++.It EnableSSHKeysign
+ .It EnableEscapeCommandline
+ .It EnableSSHKeysign
+ .It EscapeChar
+@@ -588,6 +589,8 @@ For full details of the options listed below, and their possible values, see
+ .It RemoteCommand
+ .It RemoteForward
+ .It RequestTTY
++.It RevokedHostKeys
++.It SecurityKeyProvider
+ .It RequiredRSASize
+ .It RevokedHostKeys
+ .It SecurityKeyProvider
+-- 
+2.49.0
+

0044-openssh-8.7p1-negotiate-supported-algs.patch

@@ -1,6 +1,17 @@
-diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostkey-agent.sh
---- openssh-9.3p1/regress/hostkey-agent.sh.xxx	2023-05-29 18:15:56.311236887 +0200
-+++ openssh-9.3p1/regress/hostkey-agent.sh	2023-05-29 18:16:07.598503551 +0200
+From 5c92430c08ac392b5b2ace899cc043247c923734 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 44/50] openssh-8.7p1-negotiate-supported-algs
+
+---
+ regress/hostkey-agent.sh | 32 +++++++++++++++++++++++++-------
+ sshconnect2.c            | 17 +++++++++++++++--
+ 2 files changed, 40 insertions(+), 9 deletions(-)
+
+diff --git a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
+index 28dcfe17..b9e716dc 100644
+--- a/regress/hostkey-agent.sh
++++ b/regress/hostkey-agent.sh
 @@ -17,8 +17,21 @@ trace "make CA key"
  
  ${SSHKEYGEN} -qt ed25519 -f $OBJ/agent-ca -N '' || fatal "ssh-keygen CA"
@@ -24,7 +35,7 @@ diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostke
  	${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
  	${SSHKEYGEN} -s $OBJ/agent-ca -qh -n localhost-with-alias \
  		-I localhost-with-alias $OBJ/agent-key.$k.pub || \
-@@ -32,12 +48,16 @@ rm $OBJ/agent-ca # Don't need CA private
+@@ -32,12 +45,16 @@ rm $OBJ/agent-ca # Don't need CA private any more either
  
  unset SSH_AUTH_SOCK
  
@@ -44,10 +55,10 @@ diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostke
  	( printf 'localhost-with-alias,127.0.0.1,::1 ' ;
  	  cat $OBJ/agent-key.$k.pub) > $OBJ/known_hosts
  	SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
-@@ -50,15 +70,16 @@ for k in $SSH_KEYTYPES ; do
+@@ -50,15 +67,16 @@ for k in $SSH_KEYTYPES ; do
  done
  
- SSH_CERTTYPES=`ssh -Q key-sig | grep 'cert-v01@openssh.com'`
+ SSH_CERTTYPES=`ssh -Q key-sig | grep 'cert-v01@openssh.com' | maybe_filter_sk`
 +SSH_ACCEPTED_CERTTYPES=`echo "$SSH_CERTTYPES" | egrep "$PUBKEY_ACCEPTED_ALGOS"`
  
  # Prepare sshd_proxy for certificates.
@@ -63,7 +74,7 @@ diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostke
  	echo "Hostkey $OBJ/agent-key.${k}.pub" >> $OBJ/sshd_proxy
  	echo "HostCertificate $OBJ/agent-key.${k}-cert.pub" >> $OBJ/sshd_proxy
  	test -f $OBJ/agent-key.${k}.pub || fatal "no $k key"
-@@ -70,7 +93,7 @@ echo "HostKeyAlgorithms $HOSTKEYALGS" >>
+@@ -70,7 +88,7 @@ echo "HostKeyAlgorithms $HOSTKEYALGS" >> $OBJ/sshd_proxy
  ( printf '@cert-authority localhost-with-alias ' ;
    cat $OBJ/agent-ca.pub) > $OBJ/known_hosts
  
@@ -72,10 +83,11 @@ diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostke
  	verbose "cert type $k"
  	opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
  	SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
-diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
---- openssh-9.3p1/sshconnect2.c.xxx	2023-04-26 17:37:35.100827792 +0200
-+++ openssh-9.3p1/sshconnect2.c	2023-04-26 17:50:31.860748877 +0200
-@@ -221,7 +221,7 @@ ssh_kex2(struct ssh *ssh, char *host, st
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 14f7671a..ad3f560f 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -221,7 +221,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
      const struct ssh_conn_info *cinfo)
  {
  	char *myproposal[PROPOSAL_MAX];
@@ -84,7 +96,7 @@ diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
  	int r, use_known_hosts_order = 0;
  
  #if defined(GSSAPI) && defined(WITH_OPENSSL)
-@@ -260,10 +260,22 @@ ssh_kex2(struct ssh *ssh, char *host, st
+@@ -257,10 +257,22 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
  	if (use_known_hosts_order)
  		hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
  
@@ -108,7 +120,7 @@ diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
  
  #if defined(GSSAPI) && defined(WITH_OPENSSL)
  	if (options.gss_keyex) {
-@@ -303,6 +315,7 @@ ssh_kex2(struct ssh *ssh, char *host, st
+@@ -304,6 +316,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
  #endif
  
  	free(hkalgs);
@@ -116,3 +128,6 @@ diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
  
  	/* start key exchange */
  	if ((r = kex_setup(ssh, myproposal)) != 0)
+-- 
+2.49.0
+

0045-openssh-9.0p1-evp-fips-kex.patch

@@ -1,6 +1,20 @@
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/dh.c openssh-9.0p1-patched/dh.c
---- openssh-9.0p1/dh.c	2023-05-25 09:24:28.730868316 +0200
-+++ openssh-9.0p1-patched/dh.c	2023-05-25 09:23:44.841379532 +0200
+From be23afbab800c9b5ffea56b3f410a04156c08df2 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 45/50] openssh-9.0p1-evp-fips-kex
+
+---
+ dh.c      |  98 +++++++++++++++++++++++++++++++++-----
+ kex.c     | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ kex.h     |   6 +++
+ kexdh.c   |  52 ++++++++++++++++++--
+ kexecdh.c | 129 ++++++++++++++++++++++++++++++++++++++++----------
+ 5 files changed, 382 insertions(+), 42 deletions(-)
+
+diff --git a/dh.c b/dh.c
+index 8c9a29fa..ea0a0b09 100644
+--- a/dh.c
++++ b/dh.c
 @@ -37,6 +37,9 @@
  #include <openssl/bn.h>
  #include <openssl/dh.h>
@@ -11,7 +25,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  
  #include "dh.h"
  #include "pathnames.h"
-@@ -290,10 +293,15 @@
+@@ -290,10 +293,15 @@ dh_pub_is_valid(const DH *dh, const BIGNUM *dh_pub)
  int
  dh_gen_key(DH *dh, int need)
  {
@@ -30,7 +44,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  
  	if (need < 0 || dh_p == NULL ||
  	    (pbits = BN_num_bits(dh_p)) <= 0 ||
-@@ -301,19 +309,85 @@
+@@ -301,19 +309,85 @@ dh_gen_key(DH *dh, int need)
  		return SSH_ERR_INVALID_ARGUMENT;
  	if (need < 256)
  		need = 256;
@@ -125,10 +139,11 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  }
  
  DH *
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/kex.c openssh-9.0p1-patched/kex.c
---- openssh-9.0p1/kex.c	2023-05-25 09:24:28.731868327 +0200
-+++ openssh-9.0p1-patched/kex.c	2023-05-25 09:23:44.841379532 +0200
-@@ -1623,3 +1623,142 @@
+diff --git a/kex.c b/kex.c
+index 71fbe5cb..ce6a7b81 100644
+--- a/kex.c
++++ b/kex.c
+@@ -1614,3 +1614,142 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
  	return r;
  }
  
@@ -271,9 +286,34 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 +	return r;
 +}
 +#endif /* WITH_OPENSSL */
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/kexdh.c openssh-9.0p1-patched/kexdh.c
---- openssh-9.0p1/kexdh.c	2023-05-25 09:24:28.674867692 +0200
-+++ openssh-9.0p1-patched/kexdh.c	2023-05-25 09:25:28.494533889 +0200
+diff --git a/kex.h b/kex.h
+index 6a55aadf..48f3bb87 100644
+--- a/kex.h
++++ b/kex.h
+@@ -37,6 +37,9 @@
+ # include <openssl/bn.h>
+ # include <openssl/dh.h>
+ # include <openssl/ecdsa.h>
++# include <openssl/evp.h>
++# include <openssl/core_names.h>
++# include <openssl/param_build.h>
+ # ifdef OPENSSL_HAS_ECC
+ #  include <openssl/ec.h>
+ # else /* OPENSSL_HAS_ECC */
+@@ -311,6 +314,9 @@ int	kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
+     const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
+ 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+ 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
++int	kex_create_evp_dh(EVP_PKEY **, const BIGNUM *, const BIGNUM *,
++    const BIGNUM *, const BIGNUM *, const BIGNUM *);
++int    kex_create_evp_ec(EC_KEY *k, int ecdsa_nid, EVP_PKEY **pkey);
+ 
+ #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
+ void	dump_digest(const char *, const u_char *, int);
+diff --git a/kexdh.c b/kexdh.c
+index 0faab21b..32e1de51 100644
+--- a/kexdh.c
++++ b/kexdh.c
 @@ -35,6 +35,10 @@
  
  #include "openbsd-compat/openssl-compat.h"
@@ -285,7 +325,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  
  #include "sshkey.h"
  #include "kex.h"
-@@ -83,9 +87,12 @@
+@@ -83,9 +87,12 @@ int
  kex_dh_compute_key(struct kex *kex, BIGNUM *dh_pub, struct sshbuf *out)
  {
  	BIGNUM *shared_secret = NULL;
@@ -299,7 +339,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  
  #ifdef DEBUG_KEXDH
  	fprintf(stderr, "dh_pub= ");
-@@ -100,24 +107,59 @@
+@@ -100,24 +107,59 @@ kex_dh_compute_key(struct kex *kex, BIGNUM *dh_pub, struct sshbuf *out)
  		r = SSH_ERR_MESSAGE_INCOMPLETE;
  		goto out;
  	}
@@ -363,32 +403,10 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  	return r;
  }
  
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/kex.h openssh-9.0p1-patched/kex.h
---- openssh-9.0p1/kex.h	2023-05-25 09:24:28.725868260 +0200
-+++ openssh-9.0p1-patched/kex.h	2023-05-25 09:23:44.841379532 +0200
-@@ -33,6 +33,9 @@
- # include <openssl/bn.h>
- # include <openssl/dh.h>
- # include <openssl/ecdsa.h>
-+# include <openssl/evp.h>
-+# include <openssl/core_names.h>
-+# include <openssl/param_build.h>
- # ifdef OPENSSL_HAS_ECC
- #  include <openssl/ec.h>
- # else /* OPENSSL_HAS_ECC */
-@@ -283,6 +286,9@@
-     const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
- 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
- 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
-+int	kex_create_evp_dh(EVP_PKEY **, const BIGNUM *, const BIGNUM *,
-+    const BIGNUM *, const BIGNUM *, const BIGNUM *);
-+int    kex_create_evp_ec(EC_KEY *k, int ecdsa_nid, EVP_PKEY **pkey);
- 
- #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
- void	dump_digest(const char *, const u_char *, int);
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac ../openssh-8.7p1/kexecdh.c ./kexecdh.c
---- ../openssh-8.7p1/kexecdh.c	2021-08-20 06:03:49.000000000 +0200
-+++ ./kexecdh.c	2023-04-13 14:30:14.882449593 +0200
+diff --git a/kexecdh.c b/kexecdh.c
+index efb2e55a..d92ba54f 100644
+--- a/kexecdh.c
++++ b/kexecdh.c
 @@ -35,17 +35,57 @@
  #include <signal.h>
  
@@ -447,7 +465,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  int
  kex_ecdh_keypair(struct kex *kex)
  {
-@@ -55,11 +95,7 @@
+@@ -55,11 +95,7 @@ kex_ecdh_keypair(struct kex *kex)
  	struct sshbuf *buf = NULL;
  	int r;
  
@@ -460,7 +478,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  		r = SSH_ERR_LIBCRYPTO_ERROR;
  		goto out;
  	}
-@@ -101,11 +137,7 @@
+@@ -101,11 +137,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob,
  	*server_blobp = NULL;
  	*shared_secretp = NULL;
  
@@ -473,7 +491,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  		r = SSH_ERR_LIBCRYPTO_ERROR;
  		goto out;
  	}
-@@ -140,11 +172,21 @@
+@@ -140,11 +172,21 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
  {
  	struct sshbuf *buf = NULL;
  	BIGNUM *shared_secret = NULL;
@@ -498,7 +516,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  	*shared_secretp = NULL;
  
  	if ((buf = sshbuf_new()) == NULL) {
-@@ -153,45 +195,82 @@
+@@ -153,45 +195,82 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
  	}
  	if ((r = sshbuf_put_stringb(buf, ec_blob)) != 0)
  		goto out;
@@ -593,3 +611,6 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  	sshbuf_free(buf);
  	return r;
  }
+-- 
+2.49.0
+

0046-openssh-8.7p1-nohostsha1proof.patch

@@ -1,7 +1,27 @@
-diff -up openssh-8.7p1/compat.c.sshrsacheck openssh-8.7p1/compat.c
---- openssh-8.7p1/compat.c.sshrsacheck	2023-01-12 13:29:06.338710923 +0100
-+++ openssh-8.7p1/compat.c	2023-01-12 13:29:06.357711165 +0100
-@@ -43,6 +43,7 @@ void
+From e4ca3b9dba1cc832a9974493c91207d42e218a68 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 46/50] openssh-8.7p1-nohostsha1proof
+
+---
+ compat.c                               |  6 +++++
+ compat.h                               |  2 +-
+ monitor.c                              | 27 ++++++++++++++++------
+ regress/unittests/kex/test_kex.c       |  3 ++-
+ regress/unittests/sshkey/test_file.c   |  3 ++-
+ regress/unittests/sshkey/test_fuzz.c   |  3 ++-
+ regress/unittests/sshkey/test_sshkey.c | 32 +++++++++++++++++---------
+ serverloop.c                           |  6 ++++-
+ ssh-rsa.c                              |  3 ++-
+ sshconnect2.c                          |  8 +++++++
+ sshd-session.c                         | 21 +++++++++++++++++
+ 11 files changed, 90 insertions(+), 24 deletions(-)
+
+diff --git a/compat.c b/compat.c
+index b59f0bfc..4e611dc3 100644
+--- a/compat.c
++++ b/compat.c
+@@ -42,6 +42,7 @@ void
  compat_banner(struct ssh *ssh, const char *version)
  {
  	int i;
@@ -9,7 +29,7 @@ diff -up openssh-8.7p1/compat.c.sshrsacheck openssh-8.7p1/compat.c
  	static struct {
  		char	*pat;
  		int	bugs;
-@@ -145,16 +146,21 @@ compat_banner(struct ssh *ssh, const cha
+@@ -125,16 +126,21 @@ compat_banner(struct ssh *ssh, const char *version)
  	};
  
  	/* process table, return first match */
@@ -31,9 +51,10 @@ diff -up openssh-8.7p1/compat.c.sshrsacheck openssh-8.7p1/compat.c
  }
  
  /* Always returns pointer to allocated memory, caller must free. */
-diff -up openssh-8.7p1/compat.h.sshrsacheck openssh-8.7p1/compat.h
---- openssh-8.7p1/compat.h.sshrsacheck	2021-08-20 06:03:49.000000000 +0200
-+++ openssh-8.7p1/compat.h	2023-01-12 13:29:06.358711178 +0100
+diff --git a/compat.h b/compat.h
+index 1a19060f..2e6db5bf 100644
+--- a/compat.h
++++ b/compat.h
 @@ -30,7 +30,7 @@
  #define SSH_BUG_UTF8TTYMODE	0x00000001
  #define SSH_BUG_SIGTYPE		0x00000002
@@ -43,24 +64,28 @@ diff -up openssh-8.7p1/compat.h.sshrsacheck openssh-8.7p1/compat.h
  #define SSH_OLD_SESSIONID	0x00000010
  /* #define unused		0x00000020 */
  #define SSH_BUG_DEBUG		0x00000040
-diff -up openssh-8.7p1/monitor.c.sshrsacheck openssh-8.7p1/monitor.c
---- openssh-8.7p1/monitor.c.sshrsacheck	2023-01-20 13:07:54.279676981 +0100
-+++ openssh-8.7p1/monitor.c	2023-01-20 15:01:07.007821379 +0100
-@@ -660,11 +660,12 @@ mm_answer_sign(struct ssh *ssh, int sock
- 	struct sshkey *key;
+diff --git a/monitor.c b/monitor.c
+index fbc35782..19cb058e 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -747,11 +747,12 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
+ 	struct sshkey *pubkey, *key;
  	struct sshbuf *sigbuf = NULL;
  	u_char *p = NULL, *signature = NULL;
 -	char *alg = NULL;
+-	size_t datlen, siglen;
+-	int r, is_proof = 0, keyid;
+-	u_int compat;
 +	char *alg = NULL, *effective_alg;
- 	size_t datlen, siglen, alglen;
- 	int r, is_proof = 0;
- 	u_int keyid, compat;
++	size_t datlen, siglen, alglen;
++	int r, is_proof = 0;
++	u_int keyid, compat;
  	const char proof_req[] = "hostkeys-prove-00@openssh.com";
 +	const char safe_rsa[]  = "rsa-sha2-256";
  
  	debug3_f("entering");
  
-@@ -719,18 +720,30 @@ mm_answer_sign(struct ssh *ssh, int sock
+@@ -809,18 +810,30 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
  	}
  
  	if ((key = get_hostkey_by_index(keyid)) != NULL) {
@@ -94,10 +119,11 @@ diff -up openssh-8.7p1/monitor.c.sshrsacheck openssh-8.7p1/monitor.c
  	    is_proof ? "hostkey proof" : "KEX", siglen);
  
  	sshbuf_reset(m);
-diff -up openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-8.7p1/regress/unittests/kex/test_kex.c
---- openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck	2023-01-26 13:34:52.645743677 +0100
-+++ openssh-8.7p1/regress/unittests/kex/test_kex.c	2023-01-26 13:36:56.220745823 +0100
-@@ -97,7 +97,8 @@ do_kex_with_key(char *kex, int keytype,
+diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
+index caf8f57f..09016aea 100644
+--- a/regress/unittests/kex/test_kex.c
++++ b/regress/unittests/kex/test_kex.c
+@@ -97,7 +97,8 @@ do_kex_with_key(char *kex, int keytype, int bits)
  	memcpy(kex_params.proposal, myproposal, sizeof(myproposal));
  	if (kex != NULL)
  		kex_params.proposal[PROPOSAL_KEX_ALGS] = kex;
@@ -107,10 +133,11 @@ diff -up openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-8.7p
  	ASSERT_PTR_NE(keyname, NULL);
  	kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname;
  	ASSERT_INT_EQ(ssh_init(&client, 0, &kex_params), 0);
-diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_file.c
---- openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck	2023-01-26 12:04:55.946343408 +0100
-+++ openssh-8.7p1/regress/unittests/sshkey/test_file.c	2023-01-26 12:06:35.235164432 +0100
-@@ -110,6 +110,7 @@ sshkey_file_tests(void)
+diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
+index 3babe604..cc80fe97 100644
+--- a/regress/unittests/sshkey/test_file.c
++++ b/regress/unittests/sshkey/test_file.c
+@@ -109,6 +109,7 @@ sshkey_file_tests(void)
  	sshkey_free(k2);
  	TEST_DONE();
  
@@ -118,7 +145,7 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-
  	TEST_START("load RSA cert with SHA1 signature");
  	ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha1"), &k2), 0);
  	ASSERT_PTR_NE(k2, NULL);
-@@ -117,7 +118,7 @@ sshkey_file_tests(void)
+@@ -116,7 +117,7 @@ sshkey_file_tests(void)
  	ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
  	ASSERT_STRING_EQ(k2->cert->signature_type, "ssh-rsa");
  	sshkey_free(k2);
@@ -127,10 +154,11 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-
  
  	TEST_START("load RSA cert with SHA512 signature");
  	ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha512"), &k2), 0);
-diff -up openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c
---- openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck	2023-01-26 12:10:37.533168013 +0100
-+++ openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c	2023-01-26 12:15:35.637631860 +0100
-@@ -333,13 +333,14 @@ sshkey_fuzz_tests(void)
+diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
+index 0aff7c9b..951122e1 100644
+--- a/regress/unittests/sshkey/test_fuzz.c
++++ b/regress/unittests/sshkey/test_fuzz.c
+@@ -338,13 +338,14 @@ sshkey_fuzz_tests(void)
  	TEST_DONE();
  
  #ifdef WITH_OPENSSL
@@ -146,10 +174,11 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-
  
  	TEST_START("fuzz RSA SHA256 sig");
  	buf = load_file("rsa_1");
-diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c
---- openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck	2023-01-26 11:02:52.339413463 +0100
-+++ openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c	2023-01-26 11:58:42.324253896 +0100
-@@ -60,6 +60,9 @@ build_cert(struct sshbuf *b, struct sshk
+diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
+index 5bf4b65c..6d0a35bb 100644
+--- a/regress/unittests/sshkey/test_sshkey.c
++++ b/regress/unittests/sshkey/test_sshkey.c
+@@ -61,6 +61,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
  	u_char *sigblob;
  	size_t siglen;
  
@@ -159,7 +188,7 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openss
  	ca_buf = sshbuf_new();
  	ASSERT_PTR_NE(ca_buf, NULL);
  	ASSERT_INT_EQ(sshkey_putb(ca_key, ca_buf), 0);
-@@ -101,8 +104,9 @@ build_cert(struct sshbuf *b, struct sshk
+@@ -102,8 +105,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
  	ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */
  	ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */
  	ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen,
@@ -171,7 +200,7 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openss
  
  	free(sigblob);
  	sshbuf_free(ca_buf);
-@@ -119,16 +123,22 @@ signature_test(struct sshkey *k, struct
+@@ -120,16 +124,22 @@ signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg,
  {
  	size_t len;
  	u_char *sig;
@@ -202,7 +231,7 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openss
  	free(sig);
  }
  
-@@ -514,7 +524,7 @@ sshkey_tests(void)
+@@ -526,7 +536,7 @@ sshkey_tests(void)
  	ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
  	    NULL), 0);
  	k3 = get_private("rsa_1");
@@ -211,9 +240,10 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openss
  	ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
  	    SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
  	ASSERT_PTR_EQ(k4, NULL);
-diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
---- openssh-8.7p1/serverloop.c.sshrsacheck	2023-01-12 14:57:08.118400073 +0100
-+++ openssh-8.7p1/serverloop.c	2023-01-12 14:59:17.330470518 +0100
+diff --git a/serverloop.c b/serverloop.c
+index 40ddfb04..9c5b1567 100644
+--- a/serverloop.c
++++ b/serverloop.c
 @@ -80,6 +80,7 @@
  #include "auth-options.h"
  #include "serverloop.h"
@@ -222,10 +252,11 @@ diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
  
  extern ServerOptions options;
  
-@@ -737,6 +737,10 @@ server_input_hostkeys_prove(struct ssh *
+@@ -699,7 +700,10 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
  			else if (ssh->kex->flags & KEX_RSA_SHA2_256_SUPPORTED)
  				sigalg = "rsa-sha2-256";
  		}
+-
 +		if (ssh->compat & SSH_RH_RSASIGSHA && sigalg == NULL) {
 +			sigalg = "rsa-sha2-512";
 +			debug3_f("SHA1 signature is not supported, falling back to %s", sigalg);
@@ -233,10 +264,25 @@ diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
  		debug3_f("sign %s key (index %d) using sigalg %s",
  		    sshkey_type(key), ndx, sigalg == NULL ? "default" : sigalg);
  		if ((r = sshbuf_put_cstring(sigbuf,
-diff -up openssh-8.7p1/sshconnect2.c.sshrsacheck openssh-8.7p1/sshconnect2.c
---- openssh-8.7p1/sshconnect2.c.sshrsacheck	2023-01-25 15:33:29.140353651 +0100
-+++ openssh-8.7p1/sshconnect2.c	2023-01-25 15:59:34.225364883 +0100
-@@ -1461,6 +1464,14 @@ identity_sign(struct identity *id, u_cha
+diff --git a/ssh-rsa.c b/ssh-rsa.c
+index 6c2f771a..8dd4ab01 100644
+--- a/ssh-rsa.c
++++ b/ssh-rsa.c
+@@ -509,7 +509,8 @@ ssh_rsa_verify(const struct sshkey *key,
+ 			ret = SSH_ERR_INVALID_ARGUMENT;
+ 			goto out;
+ 		}
+-		if (hash_alg != want_alg) {
++		if (hash_alg != want_alg && want_alg != SSH_DIGEST_SHA1) {
++			debug_f("Unexpected digest algorithm: got %d, wanted %d", hash_alg, want_alg);
+ 			ret = SSH_ERR_SIGNATURE_INVALID;
+ 			goto out;
+ 		}
+diff --git a/sshconnect2.c b/sshconnect2.c
+index ad3f560f..3941e089 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -1434,6 +1434,14 @@ identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
  			retried = 1;
  			goto retry_pin;
  		}
@@ -251,23 +297,11 @@ diff -up openssh-8.7p1/sshconnect2.c.sshrsacheck openssh-8.7p1/sshconnect2.c
  		goto out;
  	}
  
-diff -up openssh-8.7p1/ssh-rsa.c.sshrsacheck openssh-8.7p1/ssh-rsa.c
---- openssh-8.7p1/ssh-rsa.c.sshrsacheck	2023-01-20 13:07:54.180676144 +0100
-+++ openssh-8.7p1/ssh-rsa.c	2023-01-20 13:07:54.290677074 +0100
-@@ -254,7 +254,8 @@ ssh_rsa_verify(const struct sshkey *key,
- 			ret = SSH_ERR_INVALID_ARGUMENT;
- 			goto out;
- 		}
--		if (hash_alg != want_alg) {
-+		if (hash_alg != want_alg && want_alg != SSH_DIGEST_SHA1) {
-+			debug_f("Unexpected digest algorithm: got %d, wanted %d", hash_alg, want_alg);
- 			ret = SSH_ERR_SIGNATURE_INVALID;
- 			goto out;
- 		}
-diff -up openssh-9.8p1/sshd-session.c.xxx openssh-9.8p1/sshd-session.c
---- openssh-9.8p1/sshd-session.c.xxx	2024-07-23 15:08:14.794350818 +0200
-+++ openssh-9.8p1/sshd-session.c	2024-07-23 15:40:21.658456636 +0200
-@@ -1305,6 +1305,27 @@ main(int ac, char **av)
+diff --git a/sshd-session.c b/sshd-session.c
+index a808ac9a..c3349a8a 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
+@@ -1316,6 +1316,27 @@ main(int ac, char **av)
  
  	check_ip_options(ssh);
  
@@ -295,3 +329,6 @@ diff -up openssh-9.8p1/sshd-session.c.xxx openssh-9.8p1/sshd-session.c
  	/* Prepare the channels layer */
  	channel_init_channels(ssh);
  	channel_set_af(ssh, options.address_family);
+-- 
+2.49.0
+

0047-openssh-9.6p1-pam-rhost.patch

@@ -0,0 +1,25 @@
+From 497de886faaddec60b7ad1013396c7d4f3145968 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 47/50] openssh-9.6p1-pam-rhost
+
+---
+ auth-pam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/auth-pam.c b/auth-pam.c
+index a042c3c8..a321e0d3 100644
+--- a/auth-pam.c
++++ b/auth-pam.c
+@@ -741,7 +741,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
+ 		sshpam_laddr = get_local_ipaddr(
+ 		    ssh_packet_get_connection_in(ssh));
+ 	}
+-	if (sshpam_rhost != NULL) {
++	if (sshpam_rhost != NULL && strcmp(sshpam_rhost, "UNKNOWN") != 0) {
+ 		debug("PAM: setting PAM_RHOST to \"%s\"", sshpam_rhost);
+ 		sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST,
+ 		    sshpam_rhost);
+-- 
+2.49.0
+

0048-openssh-9.9p1-separate-keysign.patch

@@ -0,0 +1,25 @@
+From b97b1040bc0918fe9be89cdb482d046270e92d9c Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 48/50] openssh-9.9p1-separate-keysign
+
+---
+ ssh_config.5 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ssh_config.5 b/ssh_config.5
+index a43b2a27..9d5da2a6 100644
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -797,7 +797,7 @@ or
+ This option should be placed in the non-hostspecific section.
+ See
+ .Xr ssh-keysign 8
+-for more information.
++for more information. ssh-keysign should be installed explicitly.
+ .It Cm EscapeChar
+ Sets the escape character (default:
+ .Ql ~ ) .
+-- 
+2.49.0
+

0049-openssh-9.9p1-openssl-mlkem.patch

@@ -0,0 +1,398 @@
+From 0a621a2ccb8444e4c6da906b0e112e0522658122 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 49/50] openssh-9.9p1-openssl-mlkem
+
+---
+ kex-names.c         |  20 +++
+ kexmlkem768x25519.c | 291 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 311 insertions(+)
+
+diff --git a/kex-names.c b/kex-names.c
+index cd3902ad..36a953ab 100644
+--- a/kex-names.c
++++ b/kex-names.c
+@@ -108,6 +108,19 @@ static const struct kexalg gss_kexalgs[] = {
+ 	{ NULL, 0, -1, -1},
+ };
+ 
++static int is_mlkem768_available()
++{
++	static int is_fetched = -1;
++
++	if (is_fetched == -1) {
++		EVP_KEM *mlkem768 = EVP_KEM_fetch(NULL, "mlkem768", NULL);
++		is_fetched = mlkem768 != NULL ? 1 : 0;
++		EVP_KEM_free(mlkem768);
++	}
++
++	return is_fetched;
++}
++
+ static char *
+ kex_alg_list_internal(char sep, const struct kexalg *algs)
+ {
+@@ -116,6 +129,9 @@ kex_alg_list_internal(char sep, const struct kexalg *algs)
+ 	const struct kexalg *k;
+ 
+ 	for (k = algs; k->name != NULL; k++) {
++		if (strcmp(k->name, KEX_MLKEM768X25519_SHA256) == 0
++			&& !is_mlkem768_available())
++			continue;
+ 		if (ret != NULL)
+ 			ret[rlen++] = sep;
+ 		nlen = strlen(k->name);
+@@ -147,6 +163,10 @@ kex_alg_by_name(const char *name)
+ {
+ 	const struct kexalg *k;
+ 
++	if (strcmp(name, KEX_MLKEM768X25519_SHA256) == 0
++		&& !is_mlkem768_available())
++	return NULL;
++
+ 	for (k = kexalgs; k->name != NULL; k++) {
+ 		if (strcmp(k->name, name) == 0)
+ 			return k;
+diff --git a/kexmlkem768x25519.c b/kexmlkem768x25519.c
+index 2b5d3960..670049dc 100644
+--- a/kexmlkem768x25519.c
++++ b/kexmlkem768x25519.c
+@@ -48,10 +48,127 @@
+ #ifdef USE_MLKEM768X25519
+ 
+ #include "libcrux_mlkem768_sha3.h"
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <stdio.h>
++
++static int
++mlkem768_keypair_gen(unsigned char *pubkeybuf, unsigned char *privkeybuf)
++{
++    EVP_PKEY_CTX *ctx = NULL;
++    EVP_PKEY *pkey = NULL;
++    int ret = SSH_ERR_INTERNAL_ERROR;
++    size_t pubkey_size = crypto_kem_mlkem768_PUBLICKEYBYTES, privkey_size = crypto_kem_mlkem768_SECRETKEYBYTES;
++
++    ctx = EVP_PKEY_CTX_new_from_name(NULL, "mlkem768", NULL);
++    if (ctx == NULL) {
++	ret = SSH_ERR_LIBCRYPTO_ERROR;
++	goto err;
++    }
++
++    if (EVP_PKEY_keygen_init(ctx) <= 0
++        || EVP_PKEY_keygen(ctx, &pkey) <= 0) {
++	ret = SSH_ERR_LIBCRYPTO_ERROR;
++        goto err;
++    }
++
++    if (EVP_PKEY_get_raw_public_key(pkey, pubkeybuf, &pubkey_size) <= 0
++	|| EVP_PKEY_get_raw_private_key(pkey, privkeybuf, &privkey_size) <= 0) {
++	ret = SSH_ERR_LIBCRYPTO_ERROR;
++        goto err;
++    }
++
++    if (privkey_size != crypto_kem_mlkem768_SECRETKEYBYTES
++	    || pubkey_size != crypto_kem_mlkem768_PUBLICKEYBYTES) {
++	ret = SSH_ERR_LIBCRYPTO_ERROR;
++        goto err;
++    }
++    ret = 0;
++
++ err:
++    EVP_PKEY_free(pkey);
++    EVP_PKEY_CTX_free(ctx);
++    if (ret == SSH_ERR_LIBCRYPTO_ERROR)
++	   ERR_print_errors_fp(stderr);
++    return ret;
++}
++
++static int
++mlkem768_encap_secret(const u_char *pubkeybuf, u_char *secret, u_char *out)
++{
++    EVP_PKEY *pkey = NULL;
++    EVP_PKEY_CTX *ctx = NULL;
++    int r = SSH_ERR_INTERNAL_ERROR;
++    size_t outlen = crypto_kem_mlkem768_CIPHERTEXTBYTES,
++	   secretlen = crypto_kem_mlkem768_BYTES;
++
++    pkey = EVP_PKEY_new_raw_public_key_ex(NULL, "mlkem768", NULL,
++		    pubkeybuf, crypto_kem_mlkem768_PUBLICKEYBYTES);
++    if (pkey == NULL) {
++	r = SSH_ERR_LIBCRYPTO_ERROR;
++	goto err;
++    }
++
++    ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL);
++    if (ctx == NULL
++	|| EVP_PKEY_encapsulate_init(ctx, NULL) <= 0
++        || EVP_PKEY_encapsulate(ctx, out, &outlen, secret, &secretlen) <= 0
++	|| secretlen != crypto_kem_mlkem768_BYTES
++	|| outlen != crypto_kem_mlkem768_CIPHERTEXTBYTES) {
++	r = SSH_ERR_LIBCRYPTO_ERROR;
++	goto err;
++    }
++    r = 0;
++
++ err:
++    EVP_PKEY_free(pkey);
++    EVP_PKEY_CTX_free(ctx);
++    if (r == SSH_ERR_LIBCRYPTO_ERROR)
++	   ERR_print_errors_fp(stderr);
++
++    return r;
++}
++
++static int
++mlkem768_decap_secret(const u_char *privkeybuf, const u_char *wrapped, u_char *secret)
++{
++    EVP_PKEY *pkey = NULL;
++    EVP_PKEY_CTX *ctx = NULL;
++    int r = SSH_ERR_INTERNAL_ERROR;
++    size_t wrappedlen = crypto_kem_mlkem768_CIPHERTEXTBYTES,
++	   secretlen = crypto_kem_mlkem768_BYTES;
++
++    pkey = EVP_PKEY_new_raw_private_key_ex(NULL, "mlkem768", NULL,
++		    privkeybuf, crypto_kem_mlkem768_SECRETKEYBYTES);
++    if (pkey == NULL) {
++	r = SSH_ERR_LIBCRYPTO_ERROR;
++	goto err;
++    }
++
++    ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL);
++    if (ctx == NULL
++	|| EVP_PKEY_decapsulate_init(ctx, NULL) <= 0
++        || EVP_PKEY_decapsulate(ctx, secret, &secretlen, wrapped, wrappedlen) <= 0
++	|| secretlen != crypto_kem_mlkem768_BYTES) {
++	r = SSH_ERR_LIBCRYPTO_ERROR;
++	goto err;
++    }
++    r = 0;
++
++ err:
++    EVP_PKEY_free(pkey);
++    EVP_PKEY_CTX_free(ctx);
++
++    if (r == SSH_ERR_LIBCRYPTO_ERROR)
++	   ERR_print_errors_fp(stderr);
++
++    return r;
++}
+ 
+ int
+ kex_kem_mlkem768x25519_keypair(struct kex *kex)
+ {
++#if 0
+ 	struct sshbuf *buf = NULL;
+ 	u_char rnd[LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN], *cp = NULL;
+ 	size_t need;
+@@ -86,6 +203,36 @@ kex_kem_mlkem768x25519_keypair(struct kex *kex)
+ 	explicit_bzero(rnd, sizeof(rnd));
+ 	sshbuf_free(buf);
+ 	return r;
++#else
++	struct sshbuf *buf = NULL;
++	u_char *cp = NULL;
++	size_t need;
++	int r = SSH_ERR_INTERNAL_ERROR;
++
++	if ((buf = sshbuf_new()) == NULL)
++		return SSH_ERR_ALLOC_FAIL;
++	need = crypto_kem_mlkem768_PUBLICKEYBYTES + CURVE25519_SIZE;
++	if ((r = sshbuf_reserve(buf, need, &cp)) != 0)
++		goto out;
++	if ((r = mlkem768_keypair_gen(cp, kex->mlkem768_client_key)) != 0)
++		goto out;
++#ifdef DEBUG_KEXECDH
++	dump_digest("client public key mlkem768:", cp,
++	    crypto_kem_mlkem768_PUBLICKEYBYTES);
++#endif
++	cp += crypto_kem_mlkem768_PUBLICKEYBYTES;
++	kexc25519_keygen(kex->c25519_client_key, cp);
++#ifdef DEBUG_KEXECDH
++	dump_digest("client public key c25519:", cp, CURVE25519_SIZE);
++#endif
++	/* success */
++	r = 0;
++	kex->client_pub = buf;
++	buf = NULL;
++ out:
++	sshbuf_free(buf);
++	return r;
++#endif
+ }
+ 
+ int
+@@ -93,6 +240,7 @@ kex_kem_mlkem768x25519_enc(struct kex *kex,
+    const struct sshbuf *client_blob, struct sshbuf **server_blobp,
+    struct sshbuf **shared_secretp)
+ {
++#if 0
+ 	struct sshbuf *server_blob = NULL;
+ 	struct sshbuf *buf = NULL;
+ 	const u_char *client_pub;
+@@ -185,12 +333,97 @@ kex_kem_mlkem768x25519_enc(struct kex *kex,
+ 	sshbuf_free(server_blob);
+ 	sshbuf_free(buf);
+ 	return r;
++#else
++	struct sshbuf *server_blob = NULL;
++	struct sshbuf *buf = NULL;
++	const u_char *client_pub;
++	u_char server_pub[CURVE25519_SIZE], server_key[CURVE25519_SIZE];
++	u_char hash[SSH_DIGEST_MAX_LENGTH];
++	size_t need;
++	int r = SSH_ERR_INTERNAL_ERROR;
++	struct libcrux_mlkem768_enc_result enc; /* FIXME */
++
++	*server_blobp = NULL;
++	*shared_secretp = NULL;
++
++	/* client_blob contains both KEM and ECDH client pubkeys */
++	need = crypto_kem_mlkem768_PUBLICKEYBYTES + CURVE25519_SIZE;
++	if (sshbuf_len(client_blob) != need) {
++		r = SSH_ERR_SIGNATURE_INVALID;
++		goto out;
++	}
++	client_pub = sshbuf_ptr(client_blob);
++#ifdef DEBUG_KEXECDH
++	dump_digest("client public key mlkem768:", client_pub,
++	    crypto_kem_mlkem768_PUBLICKEYBYTES);
++	dump_digest("client public key 25519:",
++	    client_pub + crypto_kem_mlkem768_PUBLICKEYBYTES,
++	    CURVE25519_SIZE);
++#endif
++
++	/* allocate buffer for concatenation of KEM key and ECDH shared key */
++	/* the buffer will be hashed and the result is the shared secret */
++	if ((buf = sshbuf_new()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
++		goto out;
++	}
++	/* allocate space for encrypted KEM key and ECDH pub key */
++	if ((server_blob = sshbuf_new()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
++		goto out;
++	}
++	if (mlkem768_encap_secret(client_pub, enc.snd, enc.fst.value) != 0)
++		goto out;
++
++	/* generate ECDH key pair, store server pubkey after ciphertext */
++	kexc25519_keygen(server_key, server_pub);
++	if ((r = sshbuf_put(buf, enc.snd, sizeof(enc.snd))) != 0 ||
++	    (r = sshbuf_put(server_blob, enc.fst.value, sizeof(enc.fst.value))) != 0 ||
++	    (r = sshbuf_put(server_blob, server_pub, sizeof(server_pub))) != 0)
++		goto out;
++	/* append ECDH shared key */
++	client_pub += crypto_kem_mlkem768_PUBLICKEYBYTES;
++	if ((r = kexc25519_shared_key_ext(server_key, client_pub, buf, 1)) < 0)
++		goto out;
++	if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0)
++		goto out;
++#ifdef DEBUG_KEXECDH
++	dump_digest("server public key 25519:", server_pub, CURVE25519_SIZE);
++	dump_digest("server cipher text:",
++	    enc.fst.value, sizeof(enc.fst.value));
++	dump_digest("server kem key:", enc.snd, sizeof(enc.snd));
++	dump_digest("concatenation of KEM key and ECDH shared key:",
++	    sshbuf_ptr(buf), sshbuf_len(buf));
++#endif
++	/* string-encoded hash is resulting shared secret */
++	sshbuf_reset(buf);
++	if ((r = sshbuf_put_string(buf, hash,
++	    ssh_digest_bytes(kex->hash_alg))) != 0)
++		goto out;
++#ifdef DEBUG_KEXECDH
++	dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
++#endif
++	/* success */
++	r = 0;
++	*server_blobp = server_blob;
++	*shared_secretp = buf;
++	server_blob = NULL;
++	buf = NULL;
++ out:
++	explicit_bzero(hash, sizeof(hash));
++	explicit_bzero(server_key, sizeof(server_key));
++	explicit_bzero(&enc, sizeof(enc));
++	sshbuf_free(server_blob);
++	sshbuf_free(buf);
++	return r;
++#endif
+ }
+ 
+ int
+ kex_kem_mlkem768x25519_dec(struct kex *kex,
+     const struct sshbuf *server_blob, struct sshbuf **shared_secretp)
+ {
++#if 0
+ 	struct sshbuf *buf = NULL;
+ 	u_char mlkem_key[crypto_kem_mlkem768_BYTES];
+ 	const u_char *ciphertext, *server_pub;
+@@ -258,6 +491,64 @@ kex_kem_mlkem768x25519_dec(struct kex *kex,
+ 	explicit_bzero(mlkem_key, sizeof(mlkem_key));
+ 	sshbuf_free(buf);
+ 	return r;
++#else
++	struct sshbuf *buf = NULL;
++	const u_char *ciphertext, *server_pub;
++	u_char hash[SSH_DIGEST_MAX_LENGTH];
++	u_char decap[crypto_kem_mlkem768_BYTES];
++	size_t need;
++	int r;
++
++	*shared_secretp = NULL;
++
++	need = crypto_kem_mlkem768_CIPHERTEXTBYTES + CURVE25519_SIZE;
++	if (sshbuf_len(server_blob) != need) {
++		r = SSH_ERR_SIGNATURE_INVALID;
++		goto out;
++	}
++	ciphertext = sshbuf_ptr(server_blob);
++	server_pub = ciphertext + crypto_kem_mlkem768_CIPHERTEXTBYTES;
++	/* hash concatenation of KEM key and ECDH shared key */
++	if ((buf = sshbuf_new()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
++		goto out;
++	}
++#ifdef DEBUG_KEXECDH
++	dump_digest("server cipher text:", ciphertext, crypto_kem_mlkem768_CIPHERTEXTBYTES);
++	dump_digest("server public key c25519:", server_pub, CURVE25519_SIZE);
++#endif
++	if ((r = mlkem768_decap_secret(kex->mlkem768_client_key, ciphertext, decap)) != 0)
++		goto out;
++	if ((r = sshbuf_put(buf, decap, sizeof(decap))) != 0)
++		goto out;
++	if ((r = kexc25519_shared_key_ext(kex->c25519_client_key, server_pub,
++	    buf, 1)) < 0)
++		goto out;
++	if ((r = ssh_digest_buffer(kex->hash_alg, buf,
++	    hash, sizeof(hash))) != 0)
++		goto out;
++#ifdef DEBUG_KEXECDH
++	dump_digest("client kem key:", decap, sizeof(decap));
++	dump_digest("concatenation of KEM key and ECDH shared key:",
++	    sshbuf_ptr(buf), sshbuf_len(buf));
++#endif
++	sshbuf_reset(buf);
++	if ((r = sshbuf_put_string(buf, hash,
++	    ssh_digest_bytes(kex->hash_alg))) != 0)
++		goto out;
++#ifdef DEBUG_KEXECDH
++	dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
++#endif
++	/* success */
++	r = 0;
++	*shared_secretp = buf;
++	buf = NULL;
++ out:
++	explicit_bzero(hash, sizeof(hash));
++	explicit_bzero(decap, sizeof(decap));
++	sshbuf_free(buf);
++	return r;
++#endif
+ }
+ #else /* USE_MLKEM768X25519 */
+ int
+-- 
+2.49.0
+

0050-openssh-9.9p2-error_processing.patch

@@ -0,0 +1,25 @@
+From fd32e753ae7f3b314712e6aa8b2bed3c1fca1ef5 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Fri, 16 May 2025 14:53:54 +0200
+Subject: [PATCH 50/51] openssh-9.9p2-error_processing
+
+---
+ ssh-agent.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ssh-agent.c b/ssh-agent.c
+index 798bf9b6..dfb6ac72 100644
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1377,6 +1377,8 @@ process_add_identity(SocketEntry *e)
+ 	if ((r = sshkey_private_deserialize(e->request, &k)) != 0 ||
+ 	    k == NULL ||
+ 	    (r = sshbuf_get_cstring(e->request, &comment, NULL)) != 0) {
++		if (!r) /* k == NULL */
++			r = SSH_ERR_INTERNAL_ERROR;
+ 		error_fr(r, "parse");
+ 		goto out;
+ 	}
+-- 
+2.49.0
+

0051-Provide-better-error-for-non-supported-private-keys.patch

@@ -0,0 +1,27 @@
+From 4965cdbc1ee1e6a0c665797bb8b944d96d3d411f Mon Sep 17 00:00:00 2001
+From: Zoltan Fridrich <zfridric@redhat.com>
+Date: Wed, 16 Apr 2025 15:11:59 +0200
+Subject: [PATCH 51/53] Provide better error for non-supported private keys
+
+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
+---
+ sshkey.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sshkey.c b/sshkey.c
+index ca1cdb642..aada474e0 100644
+--- a/sshkey.c
++++ b/sshkey.c
+@@ -3582,6 +3582,9 @@ translate_libcrypto_error(unsigned long pem_err)
+ 			return SSH_ERR_LIBCRYPTO_ERROR;
+ 		}
+ 	case ERR_LIB_ASN1:
++#ifdef ERR_LIB_OSSL_DECODER
++	case ERR_LIB_OSSL_DECODER:
++#endif
+ 		return SSH_ERR_INVALID_FORMAT;
+ 	}
+ 	return SSH_ERR_LIBCRYPTO_ERROR;
+-- 
+2.49.0
+

0052-Ignore-bad-hostkeys-in-known_hosts-file.patch

@@ -0,0 +1,86 @@
+From 9ed09ef158a113e21be7b3fefa7c5f932632749b Mon Sep 17 00:00:00 2001
+From: Zoltan Fridrich <zfridric@redhat.com>
+Date: Mon, 5 May 2025 11:52:25 +0200
+Subject: [PATCH 52/53] Ignore bad hostkeys in known_hosts file
+
+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
+---
+ hostfile.c | 15 +++++++++++++++
+ hostfile.h |  1 +
+ ssh.c      |  2 ++
+ 3 files changed, 18 insertions(+)
+
+diff --git a/hostfile.c b/hostfile.c
+index c5669c703..5c402f501 100644
+--- a/hostfile.c
++++ b/hostfile.c
+@@ -63,6 +63,14 @@
+ #include "hmac.h"
+ #include "sshbuf.h"
+ 
++static int required_rsa_size = SSH_RSA_MINIMUM_MODULUS_SIZE;
++
++void
++hostfile_set_minimum_rsa_size(int size)
++{
++	required_rsa_size = size;
++}
++
+ /* XXX hmac is too easy to dictionary attack; use bcrypt? */
+ 
+ static int
+@@ -233,6 +241,7 @@ record_hostkey(struct hostkey_foreach_line *l, void *_ctx)
+ 	struct load_callback_ctx *ctx = (struct load_callback_ctx *)_ctx;
+ 	struct hostkeys *hostkeys = ctx->hostkeys;
+ 	struct hostkey_entry *tmp;
++	int r = 0;
+ 
+ 	if (l->status == HKF_STATUS_INVALID) {
+ 		/* XXX make this verbose() in the future */
+@@ -241,6 +250,12 @@ record_hostkey(struct hostkey_foreach_line *l, void *_ctx)
+ 		return 0;
+ 	}
+ 
++	if ((r = sshkey_check_rsa_length(l->key, required_rsa_size)) != 0) {
++		debug2_f("%s:%ld: ignoring hostkey: %s",
++		    l->path, l->linenum, ssh_err(r));
++		return 0;
++	}
++
+ 	debug3_f("found %skey type %s in file %s:%lu",
+ 	    l->marker == MRK_NONE ? "" :
+ 	    (l->marker == MRK_CA ? "ca " : "revoked "),
+diff --git a/hostfile.h b/hostfile.h
+index a24a4e329..0e9b1a19a 100644
+--- a/hostfile.h
++++ b/hostfile.h
+@@ -119,5 +119,6 @@ int hostkeys_foreach_file(const char *path, FILE *f,
+     const char *host, const char *ip, u_int options, u_int note);
+ 
+ void hostfile_create_user_ssh_dir(const char *, int);
++void hostfile_set_minimum_rsa_size(int);
+ 
+ #endif
+diff --git a/ssh.c b/ssh.c
+index abc8b8439..33787a8d4 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -110,6 +110,7 @@
+ #include "ssherr.h"
+ #include "myproposal.h"
+ #include "utf8.h"
++#include "hostfile.h"
+ 
+ #ifdef ENABLE_PKCS11
+ #include "ssh-pkcs11.h"
+@@ -1397,6 +1398,7 @@ main(int ac, char **av)
+ 			options.update_hostkeys = 0;
+ 		}
+ 	}
++	hostfile_set_minimum_rsa_size(options.required_rsa_size);
+ 	if (options.connection_attempts <= 0)
+ 		fatal("Invalid number of ConnectionAttempts");
+ 
+-- 
+2.49.0
+

0053-support-authentication-indicators-in-GSSAPI.patch

@@ -0,0 +1,450 @@
+From 5d5a66e96ad03132f65371070f4fa475f10207d9 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Mon, 10 Jun 2024 23:00:03 +0300
+Subject: [PATCH] support authentication indicators in GSSAPI
+
+RFC 6680 defines a set of GSSAPI extensions to handle attributes
+associated with the GSSAPI names. MIT Kerberos and FreeIPA use
+name attributes to add information about pre-authentication methods used
+to acquire the initial Kerberos ticket. The attribute 'auth-indicators'
+may contain list of strings that KDC has associated with the ticket
+issuance process.
+
+Use authentication indicators to authorise or deny access to SSH server.
+GSSAPIIndicators setting allows to specify a list of possible indicators
+that a Kerberos ticket presented must or must not contain. More details
+on the syntax are provided in sshd_config(5) man page.
+
+Fixes: https://bugzilla.mindrot.org/show_bug.cgi?id=2696
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ configure.ac    |   1 +
+ gss-serv-krb5.c |  64 +++++++++++++++++++++++++++---
+ gss-serv.c      | 103 +++++++++++++++++++++++++++++++++++++++++++++++-
+ servconf.c      |  15 ++++++-
+ servconf.h      |   2 +
+ ssh-gss.h       |   7 ++++
+ sshd_config.5   |  44 +++++++++++++++++++++
+ 7 files changed, 228 insertions(+), 8 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index d92a85809..2cbe20bf3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -5004,6 +5004,7 @@ AC_ARG_WITH([kerberos5],
+ 		AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
+ 		AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
+ 		AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
++		AC_CHECK_HEADERS([gssapi_ext.h gssapi/gssapi_ext.h])
+ 
+ 		AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
+ 			[Define this if you want to use libkafs' AFS support])])
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index 03188d9b3..2c786ef14 100644
+--- a/gss-serv-krb5.c
++++ b/gss-serv-krb5.c
+@@ -43,6 +43,7 @@
+ #include "log.h"
+ #include "misc.h"
+ #include "servconf.h"
++#include "match.h"
+ 
+ #include "ssh-gss.h"
+ 
+@@ -87,6 +88,32 @@ ssh_gssapi_krb5_init(void)
+ 	return 1;
+ }
+ 
++/* Check if any of the indicators in the Kerberos ticket match
++ * one of indicators in the list of allowed/denied rules.
++ * In case of the match, apply the decision from the rule.
++ * In case of no indicator from the ticket matching the rule, deny
++ */
++
++static int
++ssh_gssapi_check_indicators(ssh_gssapi_client *client, int *matched)
++{
++	int ret;
++	u_int i;
++
++	/* Check indicators */
++	for (i = 0; client->indicators[i] != NULL; i++) {
++		ret = match_pattern_list(client->indicators[i],
++					 options.gss_indicators, 1);
++		/* negative or positive match */
++		if (ret != 0) {
++			*matched = i;
++			return ret;
++		}
++	}
++	/* No rule matched */
++	return 0;
++}
++
+ /* Check if this user is OK to login. This only works with krb5 - other
+  * GSSAPI mechanisms will need their own.
+  * Returns true if the user is OK to log in, otherwise returns 0
+@@ -193,7 +220,7 @@ static int
+ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+ {
+ 	krb5_principal princ;
+-	int retval;
++	int retval, matched;
+ 	const char *errmsg;
+ 	int k5login_exists;
+ 
+@@ -216,17 +243,42 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+ 	if (k5login_exists &&
+ 	    ssh_krb5_kuserok(krb_context, princ, name, k5login_exists)) {
+ 		retval = 1;
+-		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
+-		    name, (char *)client->displayname.value);
++	    errmsg = "krb5_kuserok";
+ 	} else if (ssh_gssapi_krb5_cmdok(princ, client->exportedname.value,
+ 		name, k5login_exists)) {
+ 		retval = 1;
+-		logit("Authorized to %s, krb5 principal %s "
+-		    "(ssh_gssapi_krb5_cmdok)",
+-		    name, (char *)client->displayname.value);
++		errmsg = "ssh_gssapi_krb5_cmdok";
+ 	} else
+ 		retval = 0;
+ 
++	if ((retval == 1) && (options.gss_indicators != NULL)) {
++		/* At this point the configuration enforces presence of indicators
++		 * so we drop the authorization result again */
++		retval = 0;
++		if (client->indicators) {
++			matched = -1;
++			retval = ssh_gssapi_check_indicators(client, &matched);
++			if (retval != 0) {
++				retval = (retval == 1);
++				logit("Ticket contains indicator %s, "
++					"krb5 principal %s is %s",
++					client->indicators[matched],
++					(char *)client->displayname.value,
++				        retval ? "allowed" : "denied");
++				goto cont;
++			}
++		}
++		if (retval == 0) {
++			logit("GSSAPI authentication indicators enforced "
++				"but not matched. krb5 principal %s denied",
++			(char *)client->displayname.value);
++		}
++	}
++cont:
++	if (retval == 1) {
++		logit("Authorized to %s, krb5 principal %s (%s)",
++		    name, (char *)client->displayname.value, errmsg);
++	}
+ 	krb5_free_principal(krb_context, princ);
+ 	return retval;
+ }
+diff --git a/gss-serv.c b/gss-serv.c
+index 9d5435eda..5c0491cf1 100644
+--- a/gss-serv.c
++++ b/gss-serv.c
+@@ -54,7 +54,7 @@ extern ServerOptions options;
+ 
+ static ssh_gssapi_client gssapi_client =
+     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
+-    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
++    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0, NULL};
+ 
+ ssh_gssapi_mech gssapi_null_mech =
+     { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
+@@ -296,6 +296,92 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
+ 	return GSS_S_COMPLETE;
+ }
+ 
++
++/* Extract authentication indicators from the Kerberos ticket. Authentication
++ * indicators are GSSAPI name attributes for the name "auth-indicators".
++ * Multiple indicators might be present in the ticket.
++ * Each indicator is a utf8 string. */
++
++#define AUTH_INDICATORS_TAG "auth-indicators"
++
++/* Privileged (called from accept_secure_ctx) */
++static OM_uint32
++ssh_gssapi_getindicators(Gssctxt *ctx, gss_name_t gss_name, ssh_gssapi_client *client)
++{
++	gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET;
++	gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
++	int is_mechname, authenticated, complete, more;
++	size_t count, i;
++
++	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
++				      &is_mechname, NULL, &attrs);
++	if (ctx->major != GSS_S_COMPLETE) {
++		return (ctx->major);
++	}
++
++	if (attrs == GSS_C_NO_BUFFER_SET) {
++		/* No indicators in the ticket */
++		return (0);
++	}
++
++	count = 0;
++	for (i = 0; i < attrs->count; i++) {
++		/* skip anything but auth-indicators */
++		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
++		    strncmp(AUTH_INDICATORS_TAG,
++			    attrs->elements[i].value,
++			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
++			continue;
++		count++;
++	}
++
++	if (count == 0) {
++		/* No auth-indicators in the ticket */
++		(void) gss_release_buffer_set(&ctx->minor, &attrs);
++		return (0);
++	}
++
++	client->indicators = recallocarray(NULL, 0, count + 1, sizeof(char*));
++	count = 0;
++	for (i = 0; i < attrs->count; i++) {
++		authenticated = 0;
++		complete = 0;
++		more = -1;
++		/* skip anything but auth-indicators */
++		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
++		    strncmp(AUTH_INDICATORS_TAG,
++			    attrs->elements[i].value,
++			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
++			continue;
++		/* retrieve all indicators */
++		while (more != 0) {
++			value.value = NULL;
++			display_value.value = NULL;
++			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
++					&attrs->elements[i], &authenticated,
++					&complete, &value, &display_value, &more);
++			if (ctx->major != GSS_S_COMPLETE) {
++				goto out;
++			}
++
++			if ((value.value != NULL) && authenticated) {
++				client->indicators[count] = xmalloc(value.length + 1);
++				memcpy(client->indicators[count], value.value, value.length);
++				client->indicators[count][value.length] = '\0';
++				count++;
++			}
++		}
++	}
++
++out:
++	(void) gss_release_buffer(&ctx->minor, &value);
++	(void) gss_release_buffer(&ctx->minor, &display_value);
++	(void) gss_release_buffer_set(&ctx->minor, &attrs);
++	return (ctx->major);
++}
++
++
+ /* Extract the client details from a given context. This can only reliably
+  * be called once for a context */
+ 
+@@ -385,6 +471,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+ 	}
+ 
+ 	gss_release_buffer(&ctx->minor, &ename);
++	/* Retrieve authentication indicators, if they exist */
++	if ((ctx->major = ssh_gssapi_getindicators(ctx,
++	    ctx->client, client))) {
++		ssh_gssapi_error(ctx);
++		return (ctx->major);
++	}
+ 
+ 	/* We can't copy this structure, so we just move the pointer to it */
+ 	client->creds = ctx->client_creds;
+@@ -447,6 +539,7 @@ int
+ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
+ {
+ 	OM_uint32 lmin;
++	size_t i;
+ 
+ 	(void) kex; /* used in privilege separation */
+ 
+@@ -465,6 +558,14 @@ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
+ 			gss_release_buffer(&lmin, &gssapi_client.displayname);
+ 			gss_release_buffer(&lmin, &gssapi_client.exportedname);
+ 			gss_release_cred(&lmin, &gssapi_client.creds);
++
++			if (gssapi_client.indicators != NULL) {
++				for(i = 0; gssapi_client.indicators[i] != NULL; i++) {
++					free(gssapi_client.indicators[i]);
++				}
++				free(gssapi_client.indicators);
++			}
++
+ 			explicit_bzero(&gssapi_client,
+ 			    sizeof(ssh_gssapi_client));
+ 			return 0;
+diff --git a/servconf.c b/servconf.c
+index e7e4ad046..aab653244 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -147,6 +147,7 @@ initialize_server_options(ServerOptions *options)
+ 	options->gss_strict_acceptor = -1;
+ 	options->gss_store_rekey = -1;
+ 	options->gss_kex_algorithms = NULL;
++	options->gss_indicators = NULL;
+ 	options->use_kuserok = -1;
+ 	options->enable_k5users = -1;
+ 	options->password_authentication = -1;
+@@ -598,7 +599,7 @@ typedef enum {
+ 	sPerSourcePenalties, sPerSourcePenaltyExemptList,
+ 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
+ 	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
+-	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
++	sGssKeyEx, sGssIndicators, sGssKexAlgorithms, sGssStoreRekey,
+ 	sAcceptEnv, sSetEnv, sPermitTunnel,
+ 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
+ 	sUsePrivilegeSeparation, sAllowAgentForwarding,
+@@ -694,6 +695,7 @@ static struct {
+ 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
+ 	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
+ 	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
++	{ "gssapiindicators", sGssIndicators, SSHCFG_ALL },
+ #else
+ 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
+ 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
+@@ -703,6 +705,7 @@ static struct {
+ 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
++	{ "gssapiindicators", sUnsupported, SSHCFG_ALL },
+ #endif
+ 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
+@@ -1730,6 +1733,15 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 			options->gss_kex_algorithms = xstrdup(arg);
+ 		break;
+ 
++	case sGssIndicators:
++		arg = argv_next(&ac, &av);
++		if (!arg || *arg == '\0')
++			fatal("%s line %d: %s missing argument.",
++			    filename, linenum, keyword);
++		if (options->gss_indicators == NULL)
++			options->gss_indicators = xstrdup(arg);
++		break;
++
+ 	case sPasswordAuthentication:
+ 		intptr = &options->password_authentication;
+ 		goto parse_flag;
+@@ -3351,6 +3363,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
+ 	dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
+ 	dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
++	dump_cfg_string(sGssIndicators, o->gss_indicators);
+ #endif
+ 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
+ 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
+diff --git a/servconf.h b/servconf.h
+index 7c7e5d434..7c41df417 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -181,6 +181,7 @@ typedef struct {
+ 	char   **allow_groups;
+ 	u_int num_deny_groups;
+ 	char   **deny_groups;
++	char   *gss_indicators;
+ 
+ 	u_int num_subsystems;
+ 	char   **subsystem_name;
+@@ -310,6 +311,7 @@ TAILQ_HEAD(include_list, include_item);
+ 		M_CP_STROPT(routing_domain); \
+ 		M_CP_STROPT(permit_user_env_allowlist); \
+ 		M_CP_STROPT(pam_service_name); \
++		M_CP_STROPT(gss_indicators); \
+ 		M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
+ 		M_CP_STRARRAYOPT(allow_users, num_allow_users); \
+ 		M_CP_STRARRAYOPT(deny_users, num_deny_users); \
+diff --git a/ssh-gss.h b/ssh-gss.h
+index a894e23c9..59cf46d47 100644
+--- a/ssh-gss.h
++++ b/ssh-gss.h
+@@ -34,6 +34,12 @@
+ #include <gssapi/gssapi.h>
+ #endif
+ 
++#ifdef HAVE_GSSAPI_EXT_H
++#include <gssapi_ext.h>
++#elif defined(HAVE_GSSAPI_GSSAPI_EXT_H)
++#include <gssapi/gssapi_ext.h>
++#endif
++
+ #ifdef KRB5
+ # ifndef HEIMDAL
+ #  ifdef HAVE_GSSAPI_GENERIC_H
+@@ -107,6 +113,7 @@ typedef struct {
+ 	ssh_gssapi_ccache store;
+ 	int used;
+ 	int updated;
++	char **indicators; /* auth indicators */
+ } ssh_gssapi_client;
+ 
+ typedef struct ssh_gssapi_mech_struct {
+diff --git a/sshd_config.5 b/sshd_config.5
+index 583a01cdb..90ab87edd 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -785,6 +785,50 @@ gss-nistp256-sha256-
+ gss-curve25519-sha256-
+ .Ed
+ This option only applies to connections using GSSAPI.
++.It Cm GSSAPIIndicators
++Specifies whether to accept or deny GSSAPI authenticated access if Kerberos
++mechanism is used and Kerberos ticket contains a particular set of
++authentication indicators. The values can be specified as a comma-separated list
++.Cm [!]name1,[!]name2,... .
++When indicator's name is prefixed with !, the authentication indicator 'name'
++will deny access to the system. Otherwise, one of non-negated authentication
++indicators must be present in the Kerberos ticket to allow access. If
++.Cm GSSAPIIndicators
++is defined, a Kerberos ticket that has indicators but does not match the
++policy will get denial. If at least one indicator is configured, whether for
++access or denial, tickets without authentication indicators will be explicitly
++rejected.
++.Pp
++By default systems using MIT Kerberos 1.17 or later will not assign any
++indicators. SPAKE and PKINIT methods add authentication indicators
++to all successful authentications. The SPAKE pre-authentication method is
++preferred over an encrypted timestamp pre-authentication when passwords used to
++authenticate user principals. Kerberos KDCs built with Heimdal Kerberos
++(including Samba AD DC built with Heimdal) do not add authentication
++indicators. However, OpenSSH built against Heimdal Kerberos library is able to
++inquire authentication indicators and thus can be used to check for their presence.
++.Pp
++Indicator name is case-sensitive and depends on the configuration of a
++particular Kerberos deployment. Indicators available in MIT Kerberos and
++FreeIPA environments:
++.Pp
++.Bl -tag -width XXXX -offset indent -compact
++.It Cm hardened
++SPAKE or encrypted timestamp pre-authentication mechanisms in MIT Kerberos and FreeIPA
++.It Cm pkinit
++smartcard or PKCS11 token-based pre-authentication in MIT Kerberos and FreeIPA
++.It Cm radius
++pre-authentication based on a RADIUS server in MIT Kerberos and FreeIPA
++.It Cm otp
++TOTP/HOTP-based two-factor pre-authentication in FreeIPA
++.It Cm idp
++OAuth2-based pre-authentication in FreeIPA using an external identity provider
++and device authorization grant flow
++.It Cm passkey
++FIDO2-based pre-authentication in FreeIPA, using FIDO2 USB and NFC tokens
++.El
++.Pp
++The default is to not use GSSAPI authentication indicators for access decisions.
+ .It Cm HostbasedAcceptedAlgorithms
+ The default is handled system-wide by
+ .Xr crypto-policies 7 .
+-- 
+2.49.0
+

1000-openssh-coverity.patch

@@ -0,0 +1,257 @@
+From 24c411970682dc67873c36bac05b4b460d68a628 Mon Sep 17 00:00:00 2001
+From: Dmitry Belyavskiy <beldmit@gmail.com>
+Date: Thu, 15 May 2025 13:43:29 +0200
+Subject: [PATCH 50/50] openssh-6.7p1-coverity
+
+---
+ auth-krb5.c                   | 2 ++
+ gss-genr.c                    | 3 ++-
+ krl.c                         | 3 +++
+ loginrec.c                    | 2 ++
+ misc.c                        | 3 +++
+ monitor.c                     | 4 ++--
+ openbsd-compat/bindresvport.c | 2 +-
+ openbsd-compat/bsd-pselect.c  | 8 ++++----
+ readconf.c                    | 1 +
+ servconf.c                    | 5 +++--
+ serverloop.c                  | 2 +-
+ ssh-agent.c                   | 1 +
+ ssh-keygen.c                  | 3 +++
+ 13 files changed, 28 insertions(+), 11 deletions(-)
+
+diff --git a/auth-krb5.c b/auth-krb5.c
+index bae153c9..209a3265 100644
+--- a/auth-krb5.c
++++ b/auth-krb5.c
+@@ -427,6 +427,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
+ 		umask(old_umask);
+ 		if (tmpfd == -1) {
+ 			logit("mkstemp(): %.100s", strerror(oerrno));
++			free(ccname);
+ 			return oerrno;
+ 		}
+ 
+@@ -434,6 +435,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
+ 			oerrno = errno;
+ 			logit("fchmod(): %.100s", strerror(oerrno));
+ 			close(tmpfd);
++			free(ccname);
+ 			return oerrno;
+ 		}
+ 		/* make sure the KRB5CCNAME is set for non-standard location */
+diff --git a/gss-genr.c b/gss-genr.c
+index 3034370c..c357e973 100644
+--- a/gss-genr.c
++++ b/gss-genr.c
+@@ -168,8 +168,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
+ 			enclen = __b64_ntop(digest,
+ 			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
+ 			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
+-
++#pragma GCC diagnostic ignored "-Wstringop-overflow"
+ 			cp = strncpy(s, kex, strlen(kex));
++#pragma GCC diagnostic pop
+ 			for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 				(p = strsep(&cp, ","))) {
+ 				if (sshbuf_len(buf) != 0 &&
+diff --git a/krl.c b/krl.c
+index 0d0f6953..d8517f12 100644
+--- a/krl.c
++++ b/krl.c
+@@ -1202,6 +1202,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
+ 		return r;
+ 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
+ 	free(rb.blob);
++	rb.blob = NULL; /* make coverity happy */
+ 	if (erb != NULL) {
+ 		KRL_DBG(("revoked by key SHA1"));
+ 		return SSH_ERR_KEY_REVOKED;
+@@ -1212,6 +1213,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
+ 		return r;
+ 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
+ 	free(rb.blob);
++	rb.blob = NULL; /* make coverity happy */
+ 	if (erb != NULL) {
+ 		KRL_DBG(("revoked by key SHA256"));
+ 		return SSH_ERR_KEY_REVOKED;
+@@ -1223,6 +1225,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
+ 		return r;
+ 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
+ 	free(rb.blob);
++	rb.blob = NULL; /* make coverity happy */
+ 	if (erb != NULL) {
+ 		KRL_DBG(("revoked by explicit key"));
+ 		return SSH_ERR_KEY_REVOKED;
+diff --git a/loginrec.c b/loginrec.c
+index c4a9bd48..2583612c 100644
+--- a/loginrec.c
++++ b/loginrec.c
+@@ -683,9 +683,11 @@ construct_utmp(struct logininfo *li,
+ 	 */
+ 
+ 	/* Use strncpy because we don't necessarily want null termination */
++	/* coverity[buffer_size_warning : FALSE] */
+ 	strncpy(ut->ut_name, li->username,
+ 	    MIN_SIZEOF(ut->ut_name, li->username));
+ # ifdef HAVE_HOST_IN_UTMP
++	/* coverity[buffer_size_warning : FALSE] */
+ 	strncpy(ut->ut_host, li->hostname,
+ 	    MIN_SIZEOF(ut->ut_host, li->hostname));
+ # endif
+diff --git a/misc.c b/misc.c
+index 09722962..cd71c1b2 100644
+--- a/misc.c
++++ b/misc.c
+@@ -1556,6 +1556,8 @@ sanitise_stdfd(void)
+ 	}
+ 	if (nullfd > STDERR_FILENO)
+ 		close(nullfd);
++	/* coverity[leaked_handle : FALSE]*/
++	/* coverity[leaked_handle : FALSE]*/
+ }
+ 
+ char *
+@@ -2749,6 +2751,7 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
+ 	}
+ 	if (devnull > STDERR_FILENO)
+ 		close(devnull);
++	/* coverity[leaked_handle : FALSE]*/
+ 	return ret;
+ }
+ 
+diff --git a/monitor.c b/monitor.c
+index 19cb058e..58fbac9d 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -415,7 +415,7 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
+ 	mm_get_keystate(ssh, pmonitor);
+ 
+ 	/* Drain any buffered messages from the child */
+-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
++	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
+ 		;
+ 
+ 	if (pmonitor->m_recvfd >= 0)
+@@ -1813,7 +1813,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
+ 	s->ptymaster = s->ptyfd;
+ 
+ 	debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
+-
++	/* coverity[leaked_handle : FALSE] */
+ 	return (0);
+ 
+  error:
+diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c
+index 346c7fe5..f42792fd 100644
+--- a/openbsd-compat/bindresvport.c
++++ b/openbsd-compat/bindresvport.c
+@@ -59,7 +59,7 @@ bindresvport_sa(int sd, struct sockaddr *sa)
+ 	struct sockaddr_in6 *in6;
+ 	u_int16_t *portp;
+ 	u_int16_t port;
+-	socklen_t salen;
++	socklen_t salen = sizeof(struct sockaddr_storage);
+ 	int i;
+ 
+ 	if (sa == NULL) {
+diff --git a/openbsd-compat/bsd-pselect.c b/openbsd-compat/bsd-pselect.c
+index 26bdc3e0..8e2939b9 100644
+--- a/openbsd-compat/bsd-pselect.c
++++ b/openbsd-compat/bsd-pselect.c
+@@ -85,13 +85,13 @@ pselect_notify_setup(void)
+ static void
+ pselect_notify_parent(void)
+ {
+-	if (notify_pipe[1] != -1)
++	if (notify_pipe[1] >= 0)
+ 		(void)write(notify_pipe[1], "", 1);
+ }
+ static void
+ pselect_notify_prepare(fd_set *readset)
+ {
+-	if (notify_pipe[0] != -1)
++	if (notify_pipe[0] >= 0)
+ 		FD_SET(notify_pipe[0], readset);
+ }
+ static void
+@@ -99,8 +99,8 @@ pselect_notify_done(fd_set *readset)
+ {
+ 	char c;
+ 
+-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
+-		while (read(notify_pipe[0], &c, 1) != -1)
++	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
++		while (read(notify_pipe[0], &c, 1) >= 0)
+ 			debug2_f("reading");
+ 		FD_CLR(notify_pipe[0], readset);
+ 	}
+diff --git a/readconf.c b/readconf.c
+index ea9d293c..9680c38c 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -2164,6 +2164,7 @@ parse_pubkey_algos:
+ 			} else if (r != 0) {
+ 				error("%.200s line %d: glob failed for %s.",
+ 				    filename, linenum, arg2);
++				free(arg2);
+ 				goto out;
+ 			}
+ 			free(arg2);
+diff --git a/servconf.c b/servconf.c
+index 8b708cbf..e7e4ad04 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -2293,8 +2293,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 		if (*activep && *charptr == NULL) {
+ 			*charptr = tilde_expand_filename(arg, getuid());
+ 			/* increase optional counter */
+-			if (intptr != NULL)
+-				*intptr = *intptr + 1;
++			/* DEAD CODE intptr is still NULL ;)
++  			 if (intptr != NULL)
++				*intptr = *intptr + 1; */
+ 		}
+ 		break;
+ 
+diff --git a/serverloop.c b/serverloop.c
+index 9c5b1567..768ee9fa 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -511,7 +511,7 @@ server_request_tun(struct ssh *ssh)
+ 		debug_f("invalid tun");
+ 		goto done;
+ 	}
+-	if (auth_opts->force_tun_device != -1) {
++	if (auth_opts->force_tun_device >= 0) {
+ 		if (tun != SSH_TUNID_ANY &&
+ 		    auth_opts->force_tun_device != (int)tun)
+ 			goto done;
+diff --git a/ssh-agent.c b/ssh-agent.c
+index 798bf9b6..0e39dff7 100644
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1593,6 +1593,7 @@ sanitize_pkcs11_provider(const char *provider)
+ 
+ 		if (pkcs11_uri_parse(provider, uri) != 0) {
+ 			error("Failed to parse PKCS#11 URI");
++			pkcs11_uri_cleanup(uri);
+ 			return NULL;
+ 		}
+ 		/* validate also provider from URI */
+diff --git a/ssh-keygen.c b/ssh-keygen.c
+index 792aafde..96b3474d 100644
+--- a/ssh-keygen.c
++++ b/ssh-keygen.c
+@@ -2424,6 +2424,9 @@ update_krl_from_file(struct passwd *pw, const char *file, int wild_ca,
+ 			r = ssh_krl_revoke_key_sha256(krl, blob, blen);
+ 			if (r != 0)
+ 				fatal_fr(r, "revoke key failed");
++			freezero(blob, blen);
++			blob = NULL;
++			blen = 0;
+ 		} else {
+ 			if (strncasecmp(cp, "key:", 4) == 0) {
+ 				cp += 4;
+-- 
+2.49.0
+

gsi-openssh.spec

@@ -23,13 +23,12 @@
 # Do we want libedit support
 %global libedit 1
 
-%global openssh_ver 9.9p1
-%global openssh_rel 4
+%global openssh_ver 10.0p1
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
 Version: %{openssh_ver}
-Release: %{openssh_rel}%{?dist}
+Release: 4%{?dist}
 Provides: gsissh = %{version}-%{release}
 Obsoletes: gsissh < 5.8p2-2
 URL: http://www.openssh.com/portable.html
@@ -49,157 +48,144 @@ Source20: gsissh-host-keys-migration.sh
 Source21: gsissh-host-keys-migration.service
 Source99: README.sshd-and-gsisshd
 
-#https://bugzilla.mindrot.org/show_bug.cgi?id=2581
-Patch100: openssh-6.7p1-coverity.patch
-
-#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
-# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
-# record pfs= field in CRYPTO_SESSION audit event
-Patch200: openssh-7.6p1-audit.patch
-# Audit race condition in forked child (#1310684)
-Patch201: openssh-7.1p2-audit-race-condition.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2049947
-Patch202: openssh-9.0p1-audit-log.patch
-
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
-Patch400: openssh-7.8p1-role-mls.patch
+Patch0001: 0001-openssh-7.8p1-role-mls.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=781634
-Patch404: openssh-6.6p1-privsep-selinux.patch
-#?
-Patch502: openssh-6.6p1-keycat.patch
-
+Patch0002: 0002-openssh-6.6p1-privsep-selinux.patch
+Patch0003: 0003-openssh-6.6p1-keycat.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1644
-Patch601: openssh-6.6p1-allow-ip-opts.patch
+Patch0004: 0004-openssh-6.6p1-allow-ip-opts.patch
 #(drop?) https://bugzilla.mindrot.org/show_bug.cgi?id=1925
-Patch606: openssh-5.9p1-ipv6man.patch
-#?
-Patch607: openssh-5.8p2-sigpipe.patch
+Patch0005: 0005-openssh-5.9p1-ipv6man.patch
+Patch0006: 0006-openssh-5.8p2-sigpipe.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1789
-Patch609: openssh-7.2p2-x11.patch
-
-#?
-Patch700: openssh-7.7p1-fips.patch
-#?
-Patch702: openssh-5.1p1-askpass-progress.patch
+Patch0007: 0007-openssh-7.2p2-x11.patch
+Patch0008: 0008-openssh-5.1p1-askpass-progress.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=198332
-Patch703: openssh-4.3p2-askpass-grab-info.patch
+Patch0009: 0009-openssh-4.3p2-askpass-grab-info.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
-Patch707: openssh-8.7p1-redhat.patch
+Patch0010: 0010-openssh-8.7p1-redhat.patch
 # warn users for unsupported UsePAM=no (#757545)
-Patch711: openssh-7.8p1-UsePAM-warning.patch
-
+Patch0011: 0011-openssh-7.8p1-UsePAM-warning.patch
 # GSSAPI Key Exchange (RFC 4462 + RFC 8732)
 # from https://github.com/openssh-gsskex/openssh-gsskex/tree/fedora/master
 # and
 # Reenable MONITOR_REQ_GSSCHECKMIC after gssapi-with-mic failures
 # upstream MR:
 # https://github.com/openssh-gsskex/openssh-gsskex/pull/21
-Patch800: openssh-9.6p1-gssapi-keyex.patch
+Patch0012: 0012-openssh-9.6p1-gssapi-keyex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
-Patch801: openssh-6.6p1-force_krb.patch
-# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
-# CVE-2014-9278
-Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch
+Patch0013: 0013-openssh-6.6p1-force_krb.patch
 # Improve ccache handling in openssh (#991186, #1199363, #1566494)
 # https://bugzilla.mindrot.org/show_bug.cgi?id=2775
-Patch804: openssh-7.7p1-gssapi-new-unique.patch
+Patch0014: 0014-openssh-7.7p1-gssapi-new-unique.patch
 # Respect k5login_directory option in krk5.conf (#1328243)
-Patch805: openssh-7.2p2-k5login_directory.patch
-
+Patch0015: 0015-openssh-7.2p2-k5login_directory.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1780
-Patch901: openssh-6.6p1-kuserok.patch
+Patch0016: 0016-openssh-6.6p1-kuserok.patch
 # Use tty allocation for a remote scp (#985650)
-Patch906: openssh-6.4p1-fromto-remote.patch
+Patch0017: 0017-openssh-6.4p1-fromto-remote.patch
 # privsep_preauth: use SELinux context from selinux-policy (#1008580)
-Patch916: openssh-6.6.1p1-selinux-contexts.patch
+Patch0018: 0018-openssh-6.6.1p1-selinux-contexts.patch
 # log via monitor in chroots without /dev/log (#2681)
-Patch918: openssh-6.6.1p1-log-in-chroot.patch
+Patch0019: 0019-openssh-6.6.1p1-log-in-chroot.patch
 # scp file into non-existing directory (#1142223)
-Patch919: openssh-6.6.1p1-scp-non-existing-directory.patch
+Patch0020: 0020-openssh-6.6.1p1-scp-non-existing-directory.patch
+# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
+# CVE-2014-9278
+Patch0021: 0021-openssh-6.6p1-GSSAPIEnablek5users.patch
 # apply upstream patch and make sshd -T more consistent (#1187521)
-Patch922: openssh-6.8p1-sshdT-output.patch
+Patch0022: 0022-openssh-6.8p1-sshdT-output.patch
 # Add sftp option to force mode of created files (#1191055)
-Patch926: openssh-6.7p1-sftp-force-permission.patch
+Patch0023: 0023-openssh-6.7p1-sftp-force-permission.patch
 # make s390 use /dev/ crypto devices -- ignore closefrom
-Patch939: openssh-7.2p2-s390-closefrom.patch
+Patch0024: 0024-openssh-7.2p2-s390-closefrom.patch
 # Move MAX_DISPLAYS to a configuration option (#1341302)
-Patch944: openssh-7.3p1-x11-max-displays.patch
+Patch0025: 0025-openssh-7.3p1-x11-max-displays.patch
 # Pass inetd flags for SELinux down to openbsd compat level
-Patch949: openssh-7.6p1-cleanup-selinux.patch
+Patch0026: 0026-openssh-7.6p1-cleanup-selinux.patch
 # Sandbox adjustments for s390 and audit
-Patch950: openssh-7.5p1-sandbox.patch
+Patch0027: 0027-openssh-7.5p1-sandbox.patch
 # PKCS#11 URIs (upstream #2817, 2nd iteration)
 # https://github.com/Jakuje/openssh-portable/commits/jjelen-pkcs11
 # git show > ~/devel/fedora/openssh/openssh-8.0p1-pkcs11-uri.patch
-Patch951: openssh-8.0p1-pkcs11-uri.patch
+Patch0028: 0028-openssh-8.0p1-pkcs11-uri.patch
 # Unbreak scp between two IPv6 hosts (#1620333)
-Patch953: openssh-7.8p1-scp-ipv6.patch
+Patch0029: 0029-openssh-7.8p1-scp-ipv6.patch
 # Mention crypto-policies in manual pages (#1668325)
 # clarify rhbz#2068423 on the man page of ssh_config
-Patch962: openssh-8.0p1-crypto-policies.patch
+Patch0030: 0030-openssh-8.0p1-crypto-policies.patch
 # Use OpenSSL KDF (#1631761)
-Patch964: openssh-8.0p1-openssl-kdf.patch
+Patch0031: 0031-openssh-8.0p1-openssl-kdf.patch
 # sk-dummy.so built with -fvisibility=hidden does not work
-Patch965: openssh-8.2p1-visibility.patch
+Patch0032: 0032-openssh-8.2p1-visibility.patch
 # Do not break X11 without IPv6
-Patch966: openssh-8.2p1-x11-without-ipv6.patch
-# ssh-keygen printing fingerprint issue with Windows keys (#1901518)
-Patch974: openssh-8.0p1-keygen-strip-doseol.patch
+Patch0033: 0033-openssh-8.2p1-x11-without-ipv6.patch
 # sshd provides PAM an incorrect error code (#1879503)
-Patch975: openssh-8.0p1-preserve-pam-errors.patch
+Patch0034: 0034-openssh-8.0p1-preserve-pam-errors.patch
 # Implement kill switch for SCP protocol
-Patch977: openssh-8.7p1-scp-kill-switch.patch
+Patch0035: 0035-openssh-8.7p1-scp-kill-switch.patch
 # Workaround for lack of sftp_realpath in older versions of RHEL
 # https://bugzilla.redhat.com/show_bug.cgi?id=2038854
 # https://github.com/openssh/openssh-portable/pull/299
 # downstream only
-Patch981: openssh-8.7p1-recursive-scp.patch
-# https://github.com/djmdjm/openssh-wip/pull/13
-Patch982: openssh-8.7p1-minrsabits.patch
+Patch0036: 0036-openssh-8.7p1-recursive-scp.patch
+# Downstream alias for MinRSABits
+Patch0037: 0037-openssh-8.7p1-minrsabits.patch
 # downstream only, IBMCA tentative fix
 # From https://bugzilla.redhat.com/show_bug.cgi?id=1976202#c14
-Patch984: openssh-8.7p1-ibmca.patch
-
+Patch0038: 0038-openssh-8.7p1-ibmca.patch
+#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
+# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
+# record pfs= field in CRYPTO_SESSION audit event
+Patch0039: 0039-openssh-7.6p1-audit.patch
+# Audit race condition in forked child (#1310684)
+Patch0040: 0040-openssh-7.1p2-audit-race-condition.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2049947
+Patch0041: 0041-openssh-9.0p1-audit-log.patch
+Patch0042: 0042-openssh-7.7p1-fips.patch
 # Add missing options from ssh_config into ssh manpage
 # upstream bug:
 # https://bugzilla.mindrot.org/show_bug.cgi?id=3455
-Patch1002: openssh-8.7p1-ssh-manpage.patch
+Patch0043: 0043-openssh-8.7p1-ssh-manpage.patch
 # Don't propose disallowed algorithms during hostkey negotiation
 # upstream MR:
 # https://github.com/openssh/openssh-portable/pull/323
-Patch1006: openssh-8.7p1-negotiate-supported-algs.patch
+Patch0044: 0044-openssh-8.7p1-negotiate-supported-algs.patch
+Patch0045: 0045-openssh-9.0p1-evp-fips-kex.patch
+Patch0046: 0046-openssh-8.7p1-nohostsha1proof.patch
+Patch0047: 0047-openssh-9.6p1-pam-rhost.patch
+Patch0048: 0048-openssh-9.9p1-separate-keysign.patch
+Patch0049: 0049-openssh-9.9p1-openssl-mlkem.patch
+# https://www.openwall.com/lists/oss-security/2025/02/22/1
+Patch0050: 0050-openssh-9.9p2-error_processing.patch
+# https://github.com/openssh/openssh-portable/pull/564
+Patch0051: 0051-Provide-better-error-for-non-supported-private-keys.patch
+# https://github.com/openssh/openssh-portable/pull/567
+Patch0052: 0052-Ignore-bad-hostkeys-in-known_hosts-file.patch
+# https://github.com/openssh/openssh-portable/pull/500
+Patch0053: 0053-support-authentication-indicators-in-GSSAPI.patch
 
-Patch1012: openssh-9.0p1-evp-fips-kex.patch
-Patch1014: openssh-8.7p1-nohostsha1proof.patch
-
-Patch1015: openssh-9.6p1-pam-rhost.patch
-Patch1016: openssh-9.9p1-separate-keysign.patch
-# upstream cf3e48ee8ba1beeccddd2f203b558fa102be67a2
-# upstream 0c3927c45f8a57b511c874c4d51a8c89414f74ef
-Patch1017: openssh-9.9p1-mlkembe.patch
-# upstream 3f02368e8e9121847727c46b280efc280e5eb615
-# upstream 67a115e7a56dbdc3f5a58c64b29231151f3670f5
-Patch1020: openssh-9.9p1-match-regression.patch
-# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
-# upstream 0832aac79517611dd4de93ad0a83577994d9c907
-Patch1021: openssh-9.9p2-error_processing.patch
+#https://bugzilla.mindrot.org/show_bug.cgi?id=2581
+Patch1000: 1000-openssh-coverity.patch
 
 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
-Patch98: openssh-9.9p1-gsissh.patch
+Patch2000: 2000-openssh-10.0p1-gsissh.patch
 
 # This is the HPN patch
-# Based on https://github.com/rapier1/hpn-ssh/ tag: hpn-18.6.0
-Patch99: openssh-9.9p1-hpn-18.6.0.patch
+# Based on https://github.com/rapier1/hpn-ssh/ tag: hpn-18.7.0
+Patch2001: 2001-openssh-10.0p1-hpn-18.7.0.patch
 
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
+Requires: openssl-libs >= 3.5.0
 
 BuildRequires: autoconf, automake, perl-interpreter, perl-generators, zlib-devel
 BuildRequires: audit-libs-devel >= 2.0.5
 BuildRequires: util-linux, groff
 BuildRequires: pam-devel
-BuildRequires: openssl-devel >= 0.9.8j
+BuildRequires: openssl-devel >= 3.5.0
 BuildRequires: systemd-devel
 BuildRequires: systemd-rpm-macros
 BuildRequires: gcc make
@@ -294,71 +280,7 @@ This version of OpenSSH has been modified to support GSI authentication.
 
 %prep
 gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
-%setup -q -n openssh-%{version}
-
-%patch -P 400 -p1 -b .role-mls
-%patch -P 404 -p1 -b .privsep-selinux
-
-%patch -P 502 -p1 -b .keycat
-
-%patch -P 601 -p1 -b .ip-opts
-%patch -P 606 -p1 -b .ipv6man
-%patch -P 607 -p1 -b .sigpipe
-%patch -P 609 -p1 -b .x11
-
-%patch -P 702 -p1 -b .progress
-%patch -P 703 -p1 -b .grab-info
-%patch -P 707 -p1 -b .redhat
-%patch -P 711 -p1 -b .log-usepam-no
-
-%patch -P 800 -p1 -b .gsskex
-%patch -P 801 -p1 -b .force_krb
-%patch -P 804 -p1 -b .ccache_name
-%patch -P 805 -p1 -b .k5login
-
-%patch -P 901 -p1 -b .kuserok
-%patch -P 906 -p1 -b .fromto-remote
-%patch -P 916 -p1 -b .contexts
-%patch -P 918 -p1 -b .log-in-chroot
-%patch -P 919 -p1 -b .scp
-%patch -P 802 -p1 -b .GSSAPIEnablek5users
-%patch -P 922 -p1 -b .sshdt
-%patch -P 926 -p1 -b .sftp-force-mode
-%patch -P 939 -p1 -b .s390-dev
-%patch -P 944 -p1 -b .x11max
-%patch -P 949 -p1 -b .refactor
-%patch -P 950 -p1 -b .sandbox
-%patch -P 951 -p1 -b .pkcs11-uri
-%patch -P 953 -p1 -b .scp-ipv6
-%patch -P 962 -p1 -b .crypto-policies
-%patch -P 964 -p1 -b .openssl-kdf
-%patch -P 965 -p1 -b .visibility
-%patch -P 966 -p1 -b .x11-ipv6
-%patch -P 974 -p1 -b .keygen-strip-doseol
-%patch -P 975 -p1 -b .preserve-pam-errors
-%patch -P 977 -p1 -b .kill-scp
-%patch -P 981 -p1 -b .scp-sftpdirs
-%patch -P 982 -p1 -b .minrsabits
-%patch -P 984 -p1 -b .ibmca
-
-%patch -P 200 -p1 -b .audit
-%patch -P 201 -p1 -b .audit-race
-%patch -P 202 -p1 -b .audit-log
-%patch -P 700 -p1 -b .fips
-
-%patch -P 1002 -p1 -b .ssh-manpage
-%patch -P 1006 -p1 -b .negotiate-supported-algs
-%patch -P 1012 -p1 -b .evp-fips-dh
-%patch -P 1014 -p1 -b .nosha1hostproof
-%patch -P 1015 -p1 -b .pam-rhost
-%patch -P 1016 -p1 -b .sep-keysign
-%patch -P 1017 -p1 -b .mlkembe
-%patch -P 1020 -p1 -b .match
-%patch -P 1021 -p1 -b .errcode_set
-
-%patch -P 100 -p1 -b .coverity
-%patch -P 98 -p1 -b .gsi
-%patch -P 99 -p1 -b .hpn
+%autosetup -T -b 0 -p1 -n openssh-%{version}
 
 sed 's/sshd.pid/gsisshd.pid/' -i pathnames.h
 sed 's!$(piddir)/sshd.pid!$(piddir)/gsisshd.pid!' -i Makefile.in
@@ -402,8 +324,8 @@ fi
 	--sysconfdir=%{_sysconfdir}/gsissh \
 	--libexecdir=%{_libexecdir}/gsissh \
 	--datadir=%{_datadir}/gsissh \
-	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \
-	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
+	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin \
+	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin \
 	--with-privsep-path=%{_datadir}/empty.sshd \
 	--disable-strip \
 	--without-zlib-version-check \
@@ -556,6 +478,7 @@ fi
 %dir %attr(0711,root,root) %{_datadir}/empty.sshd
 %attr(0755,root,root) %{_sbindir}/gsisshd
 %attr(0755,root,root) %{_libexecdir}/gsissh/sshd-session
+%attr(0755,root,root) %{_libexecdir}/gsissh/sshd-auth
 %attr(0755,root,root) %{_libexecdir}/gsissh/sftp-server
 %attr(0755,root,root) %{_libexecdir}/gsissh/sshd-keygen
 %attr(0644,root,root) %{_mandir}/man5/gsisshd_config.5*
@@ -579,6 +502,24 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Mon Sep 01 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-4
+- Based on openssh-10.0p1-6.fc44
+
+* Mon Sep 01 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-3
+- Based on openssh-10.0p1-4.fc43
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.0p1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Mon Jun 16 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-1
+- Based on openssh-10.0p1-3.fc43
+
+* Sun Apr 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-6
+- Based on openssh-9.9p1-15.fc43
+
+* Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-5
+- Based on openssh-9.9p1-11.fc43
+
 * Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-4
 - Based on openssh-9.9p1-9.fc42
 

gsisshd.sysconfig

@@ -8,3 +8,4 @@
 
 #SSH_RSA_BITS=3072
 #SSH_ECDSA_BITS=256
+OPTIONS=""

gsisshd@.service

@@ -13,4 +13,6 @@ Wants=gsissh-host-keys-migration.service
 Environment=OPTIONS=
 EnvironmentFile=-/etc/sysconfig/gsisshd
 ExecStart=-/usr/sbin/gsisshd -i $OPTIONS
+ExecStart=-/usr/sbin/gsisshd -i $OPTIONS -o "AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys"
 StandardInput=socket
+ImportCredential=ssh.ephemeral-authorized_keys-all

openssh-5.8p2-sigpipe.patch

@@ -1,14 +0,0 @@
-diff -up openssh-5.8p2/ssh-keyscan.c.sigpipe openssh-5.8p2/ssh-keyscan.c
---- openssh-5.8p2/ssh-keyscan.c.sigpipe	2011-08-23 18:30:33.873025916 +0200
-+++ openssh-5.8p2/ssh-keyscan.c	2011-08-23 18:32:24.574025362 +0200
-@@ -715,6 +715,9 @@ main(int argc, char **argv)
-	if (maxfd > fdlim_get(0))
- 		fdlim_set(maxfd);
- 	fdcon = xcalloc(maxfd, sizeof(con));
-+ 
-+	signal(SIGPIPE, SIG_IGN);
-+
-	read_wait = xcalloc(maxfd, sizeof(struct pollfd));
-	for (j = 0; j < maxfd; j++)
-		read_wait[j].fd = -1;
- 

openssh-6.4p1-fromto-remote.patch

@@ -1,16 +0,0 @@
-diff --git a/scp.c b/scp.c
-index d98fa67..25d347b 100644
---- a/scp.c
-+++ b/scp.c
-@@ -638,7 +638,10 @@ toremote(char *targ, int argc, char **argv)
- 			addargs(&alist, "%s", ssh_program);
- 			addargs(&alist, "-x");
- 			addargs(&alist, "-oClearAllForwardings=yes");
--			addargs(&alist, "-n");
-+			if (isatty(fileno(stdin)))
-+				addargs(&alist, "-t");
-+			else
-+				addargs(&alist, "-n");
- 			for (j = 0; j < remote_remote_args.num; j++) {
- 				addargs(&alist, "%s",
- 				    remote_remote_args.list[j]);

openssh-6.6.1p1-scp-non-existing-directory.patch

@@ -1,14 +0,0 @@
---- a/scp.c	
-+++ a/scp.c	
-@@ -1084,6 +1084,10 @@ sink(int argc, char **argv)
- 			free(vect[0]);
- 			continue;
- 		}
-+		if (buf[0] == 'C' && ! exists && np[strlen(np)-1] == '/') {
-+			errno = ENOTDIR;
-+			goto bad;
-+		}
- 		omode = mode;
- 		mode |= S_IWUSR;
- 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) == -1) {
--- 

openssh-6.7p1-coverity.patch

@@ -1,248 +0,0 @@
-diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
---- openssh-8.5p1/auth-krb5.c.coverity	2021-03-24 12:03:33.724967756 +0100
-+++ openssh-8.5p1/auth-krb5.c	2021-03-24 12:03:33.782968159 +0100
-@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
- 		umask(old_umask);
- 		if (tmpfd == -1) {
- 			logit("mkstemp(): %.100s", strerror(oerrno));
-+			free(ccname);
- 			return oerrno;
- 		}
- 
-@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
- 			oerrno = errno;
- 			logit("fchmod(): %.100s", strerror(oerrno));
- 			close(tmpfd);
-+			free(ccname);
- 			return oerrno;
- 		}
- 		/* make sure the KRB5CCNAME is set for non-standard location */
-diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
---- openssh-8.5p1/gss-genr.c.coverity	2021-03-26 11:52:46.613942552 +0100
-+++ openssh-8.5p1/gss-genr.c	2021-03-26 11:54:37.881726318 +0100
-@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
- 			enclen = __b64_ntop(digest,
- 			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
- 			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
--
-+#pragma GCC diagnostic ignored "-Wstringop-overflow"
- 			cp = strncpy(s, kex, strlen(kex));
-+#pragma GCC diagnostic pop
- 			for ((p = strsep(&cp, ",")); p && *p != '\0';
- 				(p = strsep(&cp, ","))) {
- 				if (sshbuf_len(buf) != 0 &&
-diff -up openssh-8.5p1/krl.c.coverity openssh-8.5p1/krl.c
---- openssh-8.5p1/krl.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/krl.c	2021-03-24 12:03:33.783968166 +0100
-@@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, cons
- 		return r;
- 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
- 	free(rb.blob);
-+	rb.blob = NULL; /* make coverity happy */
- 	if (erb != NULL) {
- 		KRL_DBG(("revoked by key SHA1"));
- 		return SSH_ERR_KEY_REVOKED;
-@@ -1271,6 +1273,7 @@ is_key_revoked(struct ssh_krl *krl, cons
- 		return r;
- 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
- 	free(rb.blob);
-+	rb.blob = NULL; /* make coverity happy */
- 	if (erb != NULL) {
- 		KRL_DBG(("revoked by key SHA256"));
- 		return SSH_ERR_KEY_REVOKED;
-@@ -1282,6 +1285,7 @@ is_key_revoked(struct ssh_krl *krl, cons
- 		return r;
- 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
- 	free(rb.blob);
-+	rb.blob = NULL; /* make coverity happy */
- 	if (erb != NULL) {
- 		KRL_DBG(("revoked by explicit key"));
- 		return SSH_ERR_KEY_REVOKED;
-diff -up openssh-8.5p1/loginrec.c.coverity openssh-8.5p1/loginrec.c
---- openssh-8.5p1/loginrec.c.coverity	2021-03-24 13:18:53.793225885 +0100
-+++ openssh-8.5p1/loginrec.c	2021-03-24 13:21:27.948404751 +0100
-@@ -690,9 +690,11 @@ construct_utmp(struct logininfo *li,
- 	 */
- 
- 	/* Use strncpy because we don't necessarily want null termination */
-+	/* coverity[buffer_size_warning : FALSE] */
- 	strncpy(ut->ut_name, li->username,
- 	    MIN_SIZEOF(ut->ut_name, li->username));
- # ifdef HAVE_HOST_IN_UTMP
-+	/* coverity[buffer_size_warning : FALSE] */
- 	strncpy(ut->ut_host, li->hostname,
- 	    MIN_SIZEOF(ut->ut_host, li->hostname));
- # endif
-diff -up openssh-8.5p1/misc.c.coverity openssh-8.5p1/misc.c
---- openssh-8.5p1/misc.c.coverity	2021-03-24 12:03:33.745967902 +0100
-+++ openssh-8.5p1/misc.c	2021-03-24 13:31:47.037079617 +0100
-@@ -1425,6 +1425,8 @@ sanitise_stdfd(void)
- 	}
- 	if (nullfd > STDERR_FILENO)
- 		close(nullfd);
-+	/* coverity[leaked_handle : FALSE]*/
-+	/* coverity[leaked_handle : FALSE]*/
- }
- 
- char *
-@@ -2511,6 +2513,7 @@ stdfd_devnull(int do_stdin, int do_stdou
- 	}
- 	if (devnull > STDERR_FILENO)
- 		close(devnull);
-+	/* coverity[leaked_handle : FALSE]*/
- 	return ret;
- }
- 
-diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
---- openssh-7.4p1/monitor.c.coverity	2016-12-23 16:40:26.888788688 +0100
-+++ openssh-7.4p1/monitor.c	2016-12-23 16:40:26.900788691 +0100
-@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx
- 	mm_get_keystate(ssh, pmonitor);
- 
- 	/* Drain any buffered messages from the child */
--	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
- 		;
- 
- 	if (pmonitor->m_recvfd >= 0)
-@@ -1678,7 +1678,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
- 	s->ptymaster = s->ptyfd;
- 
- 	debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
--
-+	/* coverity[leaked_handle : FALSE] */
- 	return (0);
- 
-  error:
-diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
---- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/openbsd-compat/bindresvport.c	2016-12-23 16:40:26.901788691 +0100
-@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
- 	struct sockaddr_in6 *in6;
- 	u_int16_t *portp;
- 	u_int16_t port;
--	socklen_t salen;
-+	socklen_t salen = sizeof(struct sockaddr_storage);
- 	int i;
- 
- 	if (sa == NULL) {
-diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openbsd-compat/bsd-pselect.c
---- openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity	2021-08-30 16:36:11.357288009 +0200
-+++ openssh-8.7p1/openbsd-compat/bsd-pselect.c	2021-08-30 16:37:21.791897976 +0200
-@@ -113,13 +113,13 @@ pselect_notify_setup(void)
- static void
- pselect_notify_parent(void)
- {
--	if (notify_pipe[1] != -1)
-+	if (notify_pipe[1] >= 0)
- 		(void)write(notify_pipe[1], "", 1);
- }
- static void
- pselect_notify_prepare(fd_set *readset)
- {
--	if (notify_pipe[0] != -1)
-+	if (notify_pipe[0] >= 0)
- 		FD_SET(notify_pipe[0], readset);
- }
- static void
-@@ -127,8 +127,8 @@ pselect_notify_done(fd_set *readset)
- {
- 	char c;
- 
--	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
--		while (read(notify_pipe[0], &c, 1) != -1)
-+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
-+		while (read(notify_pipe[0], &c, 1) >= 0)
- 			debug2_f("reading");
- 		FD_CLR(notify_pipe[0], readset);
- 	}
-diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
---- openssh-8.5p1/readconf.c.coverity	2021-03-24 12:03:33.778968131 +0100
-+++ openssh-8.5p1/readconf.c	2021-03-24 12:03:33.785968180 +0100
-@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
- 			} else if (r != 0) {
- 				error("%.200s line %d: glob failed for %s.",
- 				    filename, linenum, arg2);
-+				free(arg2);
- 				goto out;
- 			}
- 			free(arg2);
-diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
---- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
-@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
- 		if (*activep && *charptr == NULL) {
- 			*charptr = tilde_expand_filename(arg, getuid());
- 			/* increase optional counter */
--			if (intptr != NULL)
--				*intptr = *intptr + 1;
-+			/* DEAD CODE intptr is still NULL ;)
-+  			 if (intptr != NULL)
-+				*intptr = *intptr + 1; */
- 		}
- 		break;
- 
-diff -up openssh-8.7p1/serverloop.c.coverity openssh-8.7p1/serverloop.c
---- openssh-8.7p1/serverloop.c.coverity	2021-08-20 06:03:49.000000000 +0200
-+++ openssh-8.7p1/serverloop.c	2021-08-30 16:28:22.416226981 +0200
-@@ -547,7 +547,7 @@ server_request_tun(struct ssh *ssh)
- 		debug_f("invalid tun");
- 		goto done;
- 	}
--	if (auth_opts->force_tun_device != -1) {
-+	if (auth_opts->force_tun_device >= 0) {
- 		if (tun != SSH_TUNID_ANY &&
- 		    auth_opts->force_tun_device != (int)tun)
- 			goto done;
-diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
---- openssh-7.4p1/ssh-agent.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/ssh-agent.c	2016-12-23 16:40:26.903788691 +0100
-@@ -869,6 +869,7 @@ sanitize_pkcs11_provider(const char *pro
- 
- 		if (pkcs11_uri_parse(provider, uri) != 0) {
- 			error("Failed to parse PKCS#11 URI");
-+			pkcs11_uri_cleanup(uri);
- 			return NULL;
- 		}
- 		/* validate also provider from URI */
-diff -up openssh-7.4p1/sshd-session.c.coverity openssh-7.4p1/sshd-session.c
---- openssh-7.4p1/sshd-session.c.coverity	2016-12-23 16:40:26.897788690 +0100
-+++ openssh-7.4p1/sshd-session.c	2016-12-23 16:40:26.904788692 +0100
-@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
- 
- 		privsep_preauth_child(ssh);
- 		setproctitle("%s", "[net]");
--		if (box != NULL)
-+		if (box != NULL) {
- 			ssh_sandbox_child(box);
-+			free(box);
-+		}
- 
- 		return 0;
- 	}
-@@ -2519,8 +2524,11 @@ do_ssh2_kex(struct ssh *ssh)
- 
- 	if (newstr)
- 		myproposal[PROPOSAL_KEX_ALGS] = newstr;
--	else
-+	else {
- 		fatal("No supported key exchange algorithms");
-+		free(gss);
-+	     }
-+	     /* coverity[leaked_storage: FALSE]*/
- 	}
- #endif
- 
-diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
---- openssh-8.5p1/ssh-keygen.c.coverity	2021-03-24 12:03:33.780968145 +0100
-+++ openssh-8.5p1/ssh-keygen.c	2021-03-24 12:03:33.787968194 +0100
-@@ -2332,6 +2332,9 @@ update_krl_from_file(struct passwd *pw,
- 			r = ssh_krl_revoke_key_sha256(krl, blob, blen);
- 			if (r != 0)
- 				fatal_fr(r, "revoke key failed");
-+			freezero(blob, blen);
-+			blob = NULL;
-+			blen = 0;
- 		} else {
- 			if (strncasecmp(cp, "key:", 4) == 0) {
- 				cp += 4;

openssh-6.8p1-sshdT-output.patch

@@ -1,12 +0,0 @@
-diff -up openssh/servconf.c.sshdt openssh/servconf.c
---- openssh/servconf.c.sshdt	2015-06-24 11:42:29.041078704 +0200
-+++ openssh/servconf.c	2015-06-24 11:44:39.734745802 +0200
-@@ -2317,7 +2317,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_string(sXAuthLocation, o->xauth_location);
- 	dump_cfg_string(sCiphers, o->ciphers);
- 	dump_cfg_string(sMacs, o->macs);
--	dump_cfg_string(sBanner, o->banner);
-+	dump_cfg_string(sBanner, o->banner != NULL ? o->banner : "none");
- 	dump_cfg_string(sForceCommand, o->adm_forced_command);
- 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
- 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);

openssh-7.5p1-sandbox.patch

@@ -1,86 +0,0 @@
-In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
-and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
-implementation) which calls the libraries that will communicate with the
-crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
-this is only need on s390 architecture.
-
-Signed-off-by: Eduardo Barretto <ebarretto@xxxxxxxxxxxxxxxxxx>
----
- sandbox-seccomp-filter.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index ca75cc7..6e7de31 100644
---- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -166,6 +166,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_exit_group
- 	SC_ALLOW(__NR_exit_group),
- #endif
-+#if defined(__NR_flock) && defined(__s390__)
-+	SC_ALLOW(__NR_flock),
-+#endif
- #ifdef __NR_futex
- 	SC_FUTEX(__NR_futex),
- #endif
-@@ -178,6 +181,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_gettimeofday
- 	SC_ALLOW(__NR_gettimeofday),
- #endif
-+#if defined(__NR_ipc) && defined(__s390__)
-+	SC_ALLOW(__NR_ipc),
-+#endif
- #ifdef __NR_getuid
- 	SC_ALLOW(__NR_getuid),
- #endif
--- 
-1.9.1
-
-getuid and geteuid are needed when using an openssl engine that calls a
-crypto card, e.g. ICA (libica).
-Those syscalls are also needed by the distros for audit code.
-
-Signed-off-by: Eduardo Barretto <ebarretto@xxxxxxxxxxxxxxxxxx>
----
- sandbox-seccomp-filter.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index 6e7de31..e86aa2c 100644
---- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_getpid
- 	SC_ALLOW(__NR_getpid),
- #endif
-+#ifdef __NR_getuid
-+	SC_ALLOW(__NR_getuid),
-+#endif
-+#ifdef __NR_getuid32
-+	SC_ALLOW(__NR_getuid32),
-+#endif
-+#ifdef __NR_geteuid
-+	SC_ALLOW(__NR_geteuid),
-+#endif
-+#ifdef __NR_geteuid32
-+	SC_ALLOW(__NR_geteuid32),
-+#endif
- #ifdef __NR_getrandom
- 	SC_ALLOW(__NR_getrandom),
- #endif
--- 1.9.1
-1.9.1
-diff -up openssh-7.6p1/sandbox-seccomp-filter.c.sandbox openssh-7.6p1/sandbox-seccomp-filter.c
---- openssh-7.6p1/sandbox-seccomp-filter.c.sandbox	2017-12-12 13:59:30.563874059 +0100
-+++ openssh-7.6p1/sandbox-seccomp-filter.c	2017-12-12 13:59:14.842784083 +0100
-@@ -190,6 +190,9 @@ static const struct sock_filter preauth_
- #ifdef __NR_geteuid32
- 	SC_ALLOW(__NR_geteuid32),
- #endif
-+#ifdef __NR_gettid
-+	SC_ALLOW(__NR_gettid),
-+#endif
- #ifdef __NR_getrandom
- 	SC_ALLOW(__NR_getrandom),
- #endif
-

openssh-8.0p1-keygen-strip-doseol.patch

@@ -1,12 +0,0 @@
-diff -up openssh-8.0p1/ssh-keygen.c.strip-doseol openssh-8.0p1/ssh-keygen.c
---- openssh-8.0p1/ssh-keygen.c.strip-doseol	2021-03-18 17:41:34.472404994 +0100
-+++ openssh-8.0p1/ssh-keygen.c	2021-03-18 17:41:55.255538761 +0100
-@@ -901,7 +901,7 @@ do_fingerprint(struct passwd *pw)
- 	while (getline(&line, &linesize, f) != -1) {
- 		lnum++;
- 		cp = line;
--		cp[strcspn(cp, "\n")] = '\0';
-+		cp[strcspn(cp, "\r\n")] = '\0';
- 		/* Trim leading space and comments */
- 		cp = line + strspn(line, " \t");
- 		if (*cp == '#' || *cp == '\0')

openssh-8.7p1-ibmca.patch

@@ -1,11 +0,0 @@
---- openssh-8.7p1/openbsd-compat/bsd-closefrom.c.orig	2022-04-12 15:47:03.815044607 +0200
-+++ openssh-8.7p1/openbsd-compat/bsd-closefrom.c	2022-04-12 15:48:12.464963511 +0200
-@@ -16,7 +16,7 @@
- 
- #include "includes.h"
- 
--#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM)
-+#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM) || (defined __s390__)
- 
- #include <sys/types.h>
- #include <unistd.h>

openssh-8.7p1-ssh-manpage.patch

@@ -1,53 +0,0 @@
-diff --color -ru a/ssh.1 b/ssh.1
---- a/ssh.1	2022-07-12 11:47:51.307295880 +0200
-+++ b/ssh.1	2022-07-12 11:50:28.793363263 +0200
-@@ -493,6 +493,7 @@
- .It AddressFamily
- .It BatchMode
- .It BindAddress
-+.It BindInterface
- .It CanonicalDomains
- .It CanonicalizeFallbackLocal
- .It CanonicalizeHostname
-@@ -510,6 +511,7 @@
- .It ControlPath
- .It ControlPersist
- .It DynamicForward
-+.It EnableSSHKeysign
- .It EnableEscapeCommandline
- .It EscapeChar
- .It ExitOnForwardFailure
-@@ -538,6 +540,8 @@
- .It IdentitiesOnly
- .It IdentityAgent
- .It IdentityFile
-+.It IgnoreUnknown
-+.It Include
- .It IPQoS
- .It KbdInteractiveAuthentication
- .It KbdInteractiveDevices
-@@ -546,6 +550,7 @@
- .It LocalCommand
- .It LocalForward
- .It LogLevel
-+.It LogVerbose
- .It MACs
- .It Match
- .It NoHostAuthenticationForLocalhost
-@@ -566,6 +571,8 @@
- .It RemoteCommand
- .It RemoteForward
- .It RequestTTY
-+.It RevokedHostKeys
-+.It SecurityKeyProvider
- .It RequiredRSASize
- .It SendEnv
- .It ServerAliveInterval
-@@ -575,6 +582,7 @@
- .It StreamLocalBindMask
- .It StreamLocalBindUnlink
- .It StrictHostKeyChecking
-+.It SyslogFacility
- .It TCPKeepAlive
- .It Tunnel
- .It TunnelDevice

openssh-9.6p1-pam-rhost.patch

@@ -1,32 +0,0 @@
-From 26f366e263e575c4e1a18e2e64ba418f58878b37 Mon Sep 17 00:00:00 2001
-From: Daan De Meyer <daan.j.demeyer@gmail.com>
-Date: Mon, 20 Mar 2023 20:22:14 +0100
-Subject: [PATCH] Only set PAM_RHOST if the remote host is not "UNKNOWN"
-
-When using sshd's -i option with stdio that is not a AF_INET/AF_INET6
-socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then
-set as the value of PAM_RHOST, causing pam to try to do a reverse DNS
-query of "UNKNOWN", which times out multiple times, causing a
-substantial slowdown when logging in.
-
-To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".
----
- auth-pam.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/auth-pam.c b/auth-pam.c
-index e143304e3..39b4e4563 100644
---- a/auth-pam.c
-+++ b/auth-pam.c
-@@ -735,7 +735,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
- 		sshpam_laddr = get_local_ipaddr(
- 		    ssh_packet_get_connection_in(ssh));
- 	}
--	if (sshpam_rhost != NULL) {
-+	if (sshpam_rhost != NULL && strcmp(sshpam_rhost, "UNKNOWN") != 0) {
- 		debug("PAM: setting PAM_RHOST to \"%s\"", sshpam_rhost);
- 		sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST,
- 		    sshpam_rhost);
--- 
-2.44.0
-

openssh-9.9p1-match-regression.patch

@@ -1,471 +0,0 @@
-diff --git a/misc.c b/misc.c
-index afdf5142..1b4b55c5 100644
---- a/misc.c
-+++ b/misc.c
-@@ -107,6 +107,27 @@ rtrim(char *s)
- 	}
- }
- 
-+/*
-+ * returns pointer to character after 'prefix' in 's' or otherwise NULL
-+ * if the prefix is not present.
-+ */
-+const char *
-+strprefix(const char *s, const char *prefix, int ignorecase)
-+{
-+	size_t prefixlen;
-+
-+	if ((prefixlen = strlen(prefix)) == 0)
-+		return s;
-+	if (ignorecase) {
-+		if (strncasecmp(s, prefix, prefixlen) != 0)
-+			return NULL;
-+	} else {
-+		if (strncmp(s, prefix, prefixlen) != 0)
-+			return NULL;
-+	}
-+	return s + prefixlen;
-+}
-+
- /* set/unset filedescriptor to non-blocking */
- int
- set_nonblock(int fd)
-diff --git a/misc.h b/misc.h
-index 11340389..efecdf1a 100644
---- a/misc.h
-+++ b/misc.h
-@@ -56,6 +56,7 @@ struct ForwardOptions {
- char	*chop(char *);
- void	 rtrim(char *);
- void	skip_space(char **);
-+const char *strprefix(const char *, const char *, int);
- char	*strdelim(char **);
- char	*strdelimw(char **);
- int	 set_nonblock(int);
-diff --git a/readconf.c b/readconf.c
-index 3d9cc6db..9f559269 100644
---- a/readconf.c
-+++ b/readconf.c
-@@ -710,7 +710,7 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
-     struct passwd *pw, const char *host_arg, const char *original_host,
-     int final_pass, int *want_final_pass, const char *filename, int linenum)
- {
--	char *arg, *oattrib, *attrib, *cmd, *host, *criteria;
-+	char *arg, *oattrib = NULL, *attrib = NULL, *cmd, *host, *criteria;
- 	const char *ruser;
- 	int r, this_result, result = 1, attributes = 0, negate;
- 
-@@ -731,7 +731,8 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
- 
- 	debug2("checking match for '%s' host %s originally %s",
- 	    full_line, host, original_host);
--	while ((oattrib = attrib = argv_next(acp, avp)) != NULL) {
-+	while ((attrib = argv_next(acp, avp)) != NULL) {
-+		attrib = oattrib = xstrdup(attrib);
- 		/* Terminate on comment */
- 		if (*attrib == '#') {
- 			argv_consume(acp);
-@@ -777,9 +778,23 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
- 			    this_result ? "" : "not ", oattrib);
- 			continue;
- 		}
-+
-+		/* Keep this list in sync with below */
-+		if (strprefix(attrib, "host=", 1)  != NULL ||
-+		    strprefix(attrib, "originalhost=", 1) != NULL ||
-+		    strprefix(attrib, "user=", 1) != NULL ||
-+		    strprefix(attrib, "localuser=", 1) != NULL ||
-+		    strprefix(attrib, "localnetwork=", 1) != NULL ||
-+		    strprefix(attrib, "tagged=", 1) != NULL ||
-+		    strprefix(attrib, "exec=", 1) != NULL) {
-+			arg = strchr(attrib, '=');
-+			*(arg++) = '\0';
-+		} else {
-+			arg = argv_next(acp, avp);
-+		}
-+
- 		/* All other criteria require an argument */
--		if ((arg = argv_next(acp, avp)) == NULL ||
--		    *arg == '\0' || *arg == '#') {
-+		if (arg == NULL || *arg == '\0' || *arg == '#') {
- 			error("Missing Match criteria for %s", attrib);
- 			result = -1;
- 			goto out;
-@@ -856,6 +871,8 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
- 		    criteria == NULL ? "" : criteria,
- 		    criteria == NULL ? "" : "\"");
- 		free(criteria);
-+		free(oattrib);
-+		oattrib = attrib = NULL;
- 	}
- 	if (attributes == 0) {
- 		error("One or more attributes required for Match");
-@@ -865,6 +882,7 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
-  out:
- 	if (result != -1)
- 		debug2("match %sfound", result ? "" : "not ");
-+	free(oattrib);
- 	free(host);
- 	return result;
- }
-diff --git a/servconf.c b/servconf.c
-index 89b8413e..dd774f46 100644
---- a/servconf.c
-+++ b/servconf.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: servconf.c,v 1.418 2024/09/15 03:09:44 djm Exp $ */
-+/* $OpenBSD: servconf.c,v 1.419 2024/09/25 01:24:04 djm Exp $ */
- /*
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-  *                    All rights reserved
-@@ -1033,7 +1033,7 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
-     int line, struct connection_info *ci)
- {
- 	int result = 1, attributes = 0, port;
--	char *arg, *attrib;
-+	char *arg, *attrib = NULL, *oattrib;
- 
- 	if (ci == NULL)
- 		debug3("checking syntax for 'Match %s'", full_line);
-@@ -1047,7 +1047,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 		    ci->laddress ? ci->laddress : "(null)", ci->lport);
- 	}
- 
--	while ((attrib = argv_next(acp, avp)) != NULL) {
-+	while ((oattrib = argv_next(acp, avp)) != NULL) {
-+		attrib = xstrdup(oattrib);
- 		/* Terminate on comment */
- 		if (*attrib == '#') {
- 			argv_consume(acp); /* mark all arguments consumed */
-@@ -1062,16 +1063,20 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 			    *arg != '\0' && *arg != '#')) {
- 				error("'all' cannot be combined with other "
- 				    "Match attributes");
--				return -1;
-+				result = -1;
-+				goto out;
- 			}
- 			if (arg != NULL && *arg == '#')
- 				argv_consume(acp); /* consume remaining args */
--			return 1;
-+			result = 1;
-+			goto out;
- 		}
- 		/* Criterion "invalid-user" also has no argument */
- 		if (strcasecmp(attrib, "invalid-user") == 0) {
--			if (ci == NULL)
-+			if (ci == NULL) {
-+				result = 0;
- 				continue;
-+			}
- 			if (ci->user_invalid == 0)
- 				result = 0;
- 			else
-@@ -1078,11 +1081,26 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 				debug("matched invalid-user at line %d", line);
- 			continue;
- 		}
-+
-+		/* Keep this list in sync with below */
-+		if (strprefix(attrib, "user=", 1) != NULL ||
-+		    strprefix(attrib, "group=", 1) != NULL ||
-+		    strprefix(attrib, "host=", 1) != NULL ||
-+		    strprefix(attrib, "address=", 1) != NULL ||
-+		    strprefix(attrib, "localaddress=", 1) != NULL ||
-+		    strprefix(attrib, "localport=", 1) != NULL ||
-+		    strprefix(attrib, "rdomain=", 1) != NULL) {
-+			arg = strchr(attrib, '=');
-+			*(arg++) = '\0';
-+		} else {
-+			arg = argv_next(acp, avp);
-+		}
-+
- 		/* All other criteria require an argument */
--		if ((arg = argv_next(acp, avp)) == NULL ||
--		    *arg == '\0' || *arg == '#') {
-+		if (arg == NULL || *arg == '\0' || *arg == '#') {
- 			error("Missing Match criteria for %s", attrib);
--			return -1;
-+			result = -1;
-+			goto out;
- 		}
- 		if (strcasecmp(attrib, "user") == 0) {
- 			if (ci == NULL || (ci->test && ci->user == NULL)) {
-@@ -1105,7 +1123,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 				match_test_missing_fatal("Group", "user");
- 			switch (match_cfg_line_group(arg, line, ci->user)) {
- 			case -1:
--				return -1;
-+				result = -1;
-+				goto out;
- 			case 0:
- 				result = 0;
- 			}
-@@ -1141,7 +1160,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 				result = 0;
- 				break;
- 			case -2:
--				return -1;
-+				result = -1;
-+				goto out;
- 			}
- 		} else if (strcasecmp(attrib, "localaddress") == 0){
- 			if (ci == NULL || (ci->test && ci->laddress == NULL)) {
-@@ -1166,13 +1186,15 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 				result = 0;
- 				break;
- 			case -2:
--				return -1;
-+				result = -1;
-+				goto out;
- 			}
- 		} else if (strcasecmp(attrib, "localport") == 0) {
- 			if ((port = a2port(arg)) == -1) {
- 				error("Invalid LocalPort '%s' on Match line",
- 				    arg);
--				return -1;
-+				result = -1;
-+				goto out;
- 			}
- 			if (ci == NULL || (ci->test && ci->lport == -1)) {
- 				result = 0;
-@@ -1200,16 +1222,21 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
- 				debug("user %.100s matched 'RDomain %.100s' at "
- 				    "line %d", ci->rdomain, arg, line);
- 		} else {
--			error("Unsupported Match attribute %s", attrib);
--			return -1;
-+			error("Unsupported Match attribute %s", oattrib);
-+			result = -1;
-+			goto out;
- 		}
-+		free(attrib);
-+		attrib = NULL;
- 	}
- 	if (attributes == 0) {
- 		error("One or more attributes required for Match");
- 		return -1;
- 	}
--	if (ci != NULL)
-+ out:
-+	if (ci != NULL && result != -1)
- 		debug3("match %sfound", result ? "" : "not ");
-+	free(attrib);
- 	return result;
- }
- 
-diff --git a/regress/cfginclude.sh b/regress/cfginclude.sh
-index d442cdd6..97fd816f 100644
---- a/regress/cfginclude.sh
-+++ b/regress/cfginclude.sh
-@@ -1,4 +1,4 @@
--#	$OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $
-+#	$OpenBSD: cfginclude.sh,v 1.5 2024/09/27 01:05:54 djm Exp $
- #	Placed in the Public Domain.
- 
- tid="config include"
-@@ -10,7 +10,7 @@ cat > $OBJ/ssh_config.i << _EOF
- Match host a
- 	Hostname aa
- 
--Match host b # comment
-+Match host=b # comment
- 	Hostname bb
- 	Include $OBJ/ssh_config.i.*
- 
-@@ -18,7 +18,7 @@ Match host c
- 	Include $OBJ/ssh_config.i.*
- 	Hostname cc
- 
--Match host m
-+Match host=m !user xxxyfake
- 	Include $OBJ/ssh_config.i.* # comment
- 
- Host d
-@@ -41,7 +41,7 @@ Match host xxxxxx
- _EOF
- 
- cat > $OBJ/ssh_config.i.1 << _EOF
--Match host a
-+Match host=a
- 	Hostname aaa
- 
- Match host b
-@@ -64,10 +64,10 @@ cat > $OBJ/ssh_config.i.2 << _EOF
- Match host a
- 	Hostname aaaa
- 
--Match host b
-+Match host=b !user blahblahfake
- 	Hostname bbbb
- 
--Match host c
-+Match host=c
- 	Hostname cccc
- 
- Host d
-@@ -142,7 +142,7 @@ trial a aa
- 
- # cleanup
- rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out
--#	$OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $
-+#	$OpenBSD: cfginclude.sh,v 1.5 2024/09/27 01:05:54 djm Exp $
- #	Placed in the Public Domain.
- 
- tid="config include"
-diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
-index 05a66685..2737a5f9 100644
---- a/regress/cfgmatch.sh
-+++ b/regress/cfgmatch.sh
-@@ -1,4 +1,4 @@
--#	$OpenBSD: cfgmatch.sh,v 1.13 2021/06/08 06:52:43 djm Exp $
-+#	$OpenBSD: cfgmatch.sh,v 1.14 2024/09/27 01:05:54 djm Exp $
- #	Placed in the Public Domain.
- 
- tid="sshd_config match"
-@@ -26,7 +26,7 @@ start_client()
- 			kill $client_pid
- 			fatal "timeout waiting for background ssh"
- 		fi
--	done	
-+	done
- }
- 
- stop_client()
-@@ -119,40 +119,42 @@ stop_client
- # requires knowledge of actual group memberships user running the test).
- params="user:user:u1 host:host:h1 address:addr:1.2.3.4 \
-     localaddress:laddr:5.6.7.8 rdomain:rdomain:rdom1"
--cp $OBJ/sshd_proxy_bak $OBJ/sshd_config
--echo 'Banner /nomatch' >>$OBJ/sshd_config
--for i in $params; do
--	config=`echo $i | cut -f1 -d:`
--	criteria=`echo $i | cut -f2 -d:`
--	value=`echo $i | cut -f3 -d:`
--	cat >>$OBJ/sshd_config <<EOD
--	    Match $config $value
--	      Banner /$value
-+for separator in " " "=" ; do
-+	cp $OBJ/sshd_proxy_bak $OBJ/sshd_config
-+	echo 'Banner /nomatch' >>$OBJ/sshd_config
-+	for i in $params; do
-+		config=`echo $i | cut -f1 -d:`
-+		criteria=`echo $i | cut -f2 -d:`
-+		value=`echo $i | cut -f3 -d:`
-+		cat >>$OBJ/sshd_config <<EOD
-+		    Match ${config}${separator}${value}
-+		      Banner /$value
- EOD
--done
-+	done
- 
--${SUDO} ${SSHD} -f $OBJ/sshd_config -T >/dev/null || \
--    fail "validate config for w/out spec"
--
--# Test matching each criteria.
--for i in $params; do
--	testcriteria=`echo $i | cut -f2 -d:`
--	expected=/`echo $i | cut -f3 -d:`
--	spec=""
--	for j in $params; do
--		config=`echo $j | cut -f1 -d:`
--		criteria=`echo $j | cut -f2 -d:`
--		value=`echo $j | cut -f3 -d:`
--		if [ "$criteria" = "$testcriteria" ]; then
--			spec="$criteria=$value,$spec"
--		else
--			spec="$criteria=1$value,$spec"
-+	${SUDO} ${SSHD} -f $OBJ/sshd_config -T >/dev/null || \
-+	    fail "validate config for w/out spec"
-+
-+	# Test matching each criteria.
-+	for i in $params; do
-+		testcriteria=`echo $i | cut -f2 -d:`
-+		expected=/`echo $i | cut -f3 -d:`
-+		spec=""
-+		for j in $params; do
-+			config=`echo $j | cut -f1 -d:`
-+			criteria=`echo $j | cut -f2 -d:`
-+			value=`echo $j | cut -f3 -d:`
-+			if [ "$criteria" = "$testcriteria" ]; then
-+				spec="$criteria=$value,$spec"
-+			else
-+				spec="$criteria=1$value,$spec"
-+			fi
-+		done
-+		trace "test spec $spec"
-+		result=`${SUDO} ${SSHD} -f $OBJ/sshd_config -T -C "$spec" | \
-+		    awk '$1=="banner"{print $2}'`
-+		if [ "$result" != "$expected" ]; then
-+			fail "match $config expected $expected got $result"
- 		fi
- 	done
--	trace "test spec $spec"
--	result=`${SUDO} ${SSHD} -f $OBJ/sshd_config -T -C "$spec" | \
--	    awk '$1=="banner"{print $2}'`
--	if [ "$result" != "$expected" ]; then
--		fail "match $config expected $expected got $result"
--	fi
- done
-diff --git a/regress/servcfginclude.sh b/regress/servcfginclude.sh
-index 518a703d..f67c3caa 100644
---- a/regress/servcfginclude.sh
-+++ b/regress/servcfginclude.sh
-@@ -4,14 +4,14 @@ tid="server config include"
- 
- cat > $OBJ/sshd_config.i << _EOF
- HostKey $OBJ/host.ssh-ed25519
--Match host a
-+Match host=a
- 	Banner /aa
- 
- Match host b
- 	Banner /bb
- 	Include $OBJ/sshd_config.i.* # comment
- 
--Match host c
-+Match host=c
- 	Include $OBJ/sshd_config.i.* # comment
- 	Banner /cc
- 
-@@ -25,7 +25,7 @@ Match Host e
- 	Banner /ee
- 	Include $OBJ/sshd_config.i.*
- 
--Match Host f
-+Match Host=f
- 	Include $OBJ/sshd_config.i.*
- 	Banner /ff
- 
-@@ -47,13 +47,13 @@ Match host b
- Match host c
- 	Banner /ccc
- 
--Match Host d
-+Match Host=d
- 	Banner /ddd
- 
- Match Host e
- 	Banner /eee
- 
--Match Host f
-+Match Host=f
- 	Banner /fff
- _EOF
- 
-@@ -61,13 +61,13 @@ cat > $OBJ/sshd_config.i.2 << _EOF
- Match host a
- 	Banner /aaaa
- 
--Match host b
-+Match host=b
- 	Banner /bbbb
- 
- Match host c # comment
- 	Banner /cccc
- 
--Match Host d
-+Match Host=d
- 	Banner /dddd
- 
- Match Host e

openssh-9.9p1-mlkembe.patch

@@ -1,98 +0,0 @@
-diff --git a/kexmlkem768x25519.c b/kexmlkem768x25519.c
-index 679446e9..2b5d3960 100644
---- a/kexmlkem768x25519.c
-+++ b/kexmlkem768x25519.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: kexmlkem768x25519.c,v 1.1 2024/09/02 12:13:56 djm Exp $ */
-+/* $OpenBSD: kexmlkem768x25519.c,v 1.2 2024/10/27 02:06:59 djm Exp $ */
- /*
-  * Copyright (c) 2023 Markus Friedl.  All rights reserved.
-  *
-@@ -34,6 +34,9 @@
- #include <stdbool.h>
- #include <string.h>
- #include <signal.h>
-+#ifdef HAVE_ENDIAN_H
-+# include <endian.h>
-+#endif
- 
- #include "sshkey.h"
- #include "kex.h"
-diff --git a/libcrux_mlkem768_sha3.h b/libcrux_mlkem768_sha3.h
-index a82d60e8..b8ac1436 100644
---- a/libcrux_mlkem768_sha3.h
-+++ b/libcrux_mlkem768_sha3.h
-@@ -1,4 +1,5 @@
--/*  $OpenBSD: libcrux_mlkem768_sha3.h,v 1.1 2024/09/02 12:13:56 djm Exp $ */
-+/*  $OpenBSD: libcrux_mlkem768_sha3.h,v 1.2 2024/10/27 02:06:01 djm Exp $ */
-+
- /* Extracted from libcrux revision 84c5d87b3092c59294345aa269ceefe0eb97cc35 */
- 
- /*
-@@ -160,18 +161,19 @@ static inline void Eurydice_slice_to_array3(uint8_t *dst_tag, char *dst_ok,
- // CORE STUFF (conversions, endianness, ...)
- 
- static inline void core_num__u64_9__to_le_bytes(uint64_t v, uint8_t buf[8]) {
-+  v = htole64(v);
-   memcpy(buf, &v, sizeof(v));
- }
- static inline uint64_t core_num__u64_9__from_le_bytes(uint8_t buf[8]) {
-   uint64_t v;
-   memcpy(&v, buf, sizeof(v));
--  return v;
-+  return le64toh(v);
- }
- 
- static inline uint32_t core_num__u32_8__from_le_bytes(uint8_t buf[4]) {
-   uint32_t v;
-   memcpy(&v, buf, sizeof(v));
--  return v;
-+  return le32toh(v);
- }
- 
- static inline uint32_t core_num__u8_6__count_ones(uint8_t x0) {
-diff --git a/mlkem768.sh b/mlkem768.sh
-index 2fdc2831..3d12b2ed 100644
---- a/mlkem768.sh
-+++ b/mlkem768.sh
-@@ -1,9 +1,10 @@
- #!/bin/sh
--#       $OpenBSD: mlkem768.sh,v 1.2 2024/09/04 05:11:33 djm Exp $
-+#       $OpenBSD: mlkem768.sh,v 1.3 2024/10/27 02:06:01 djm Exp $
- #       Placed in the Public Domain.
- #
- 
--WANT_LIBCRUX_REVISION="origin/main"
-+#WANT_LIBCRUX_REVISION="origin/main"
-+WANT_LIBCRUX_REVISION="84c5d87b3092c59294345aa269ceefe0eb97cc35"
- 
- FILES="
- 	libcrux/libcrux-ml-kem/cg/eurydice_glue.h
-@@ -47,6 +48,7 @@ echo '#define KRML_NOINLINE __attribute__((noinline, unused))'
- echo '#define KRML_HOST_EPRINTF(...)'
- echo '#define KRML_HOST_EXIT(x) fatal_f("internal error")'
- echo
-+
- for i in $FILES; do
- 	echo "/* from $i */"
- 	# Changes to all files:
-@@ -56,11 +58,16 @@ for i in $FILES; do
- 	    -e 's/[	 ]*$//' \
- 	    $i | \
- 	case "$i" in
--	# XXX per-file handling goes here.
-+	*/libcrux-ml-kem/cg/eurydice_glue.h)
-+		# Replace endian functions with versions that work.
-+		perl -0777 -pe 's/(static inline void core_num__u64_9__to_le_bytes.*\n)([^}]*\n)/\1  v = htole64(v);\n\2/' |
-+		perl -0777 -pe 's/(static inline uint64_t core_num__u64_9__from_le_bytes.*?)return v;/\1return le64toh(v);/s' |
-+		perl -0777 -pe 's/(static inline uint32_t core_num__u32_8__from_le_bytes.*?)return v;/\1return le32toh(v);/s'
-+		;;
- 	# Default: pass through.
- 	*)
--	    cat
--	    ;;
-+		cat
-+		;;
- 	esac
- 	echo
- done

openssh-9.9p1-separate-keysign.patch

@@ -1,12 +0,0 @@
-diff -up openssh-9.9p1/ssh_config.5.xxx openssh-9.9p1/ssh_config.5
---- openssh-9.9p1/ssh_config.5.xxx	2024-10-11 12:01:14.260566303 +0200
-+++ openssh-9.9p1/ssh_config.5	2024-10-11 12:01:59.725654775 +0200
-@@ -759,7 +759,7 @@ or
- This option should be placed in the non-hostspecific section.
- See
- .Xr ssh-keysign 8
--for more information.
-+for more information. ssh-keysign should be installed explicitly.
- .It Cm EscapeChar
- Sets the escape character (default:
- .Ql ~ ) .

openssh-9.9p2-error_processing.patch

@@ -1,152 +0,0 @@
-diff --git a/krl.c b/krl.c
-index e2efdf06..0d0f6953 100644
---- a/krl.c
-+++ b/krl.c
-@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
- 			break;
- 		case KRL_SECTION_CERT_SERIAL_BITMAP:
- 			if (rs->lo - bitmap_start > INT_MAX) {
-+				r = SSH_ERR_INVALID_FORMAT;
- 				error_f("insane bitmap gap");
- 				goto out;
- 			}
-@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
- 	}
- 
- 	if ((krl = ssh_krl_init()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
- 		error_f("alloc failed");
- 		goto out;
- 	}
-diff --git a/packet.c b/packet.c
-index 486f8515..9dea2cfc 100644
---- a/packet.c
-+++ b/packet.c
-@@ -1864,6 +1864,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
- 			if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
- 				return r;
- 			DBG(debug("Received SSH2_MSG_PING len %zu", len));
-+			if (!ssh->state->after_authentication) {
-+				DBG(debug("Won't reply to PING in preauth"));
-+				break;
-+			}
-+			if (ssh_packet_is_rekeying(ssh)) {
-+				DBG(debug("Won't reply to PING during KEX"));
-+				break;
-+			}
- 			if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
- 			    (r = sshpkt_put_string(ssh, d, len)) != 0 ||
- 			    (r = sshpkt_send(ssh)) != 0)
-diff --git a/ssh-agent.c b/ssh-agent.c
-index 48973b2c..c27c5a95 100644
---- a/ssh-agent.c
-+++ b/ssh-agent.c
-@@ -1220,6 +1220,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
- 	    "restrict-destination-v00@openssh.com") == 0) {
- 		if (*dcsp != NULL) {
- 			error_f("%s already set", ext_name);
-+			r = SSH_ERR_INVALID_FORMAT;
- 			goto out;
- 		}
- 		if ((r = sshbuf_froms(m, &b)) != 0) {
-@@ -1229,6 +1230,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
- 		while (sshbuf_len(b) != 0) {
- 			if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) {
- 				error_f("too many %s constraints", ext_name);
-+				r = SSH_ERR_INVALID_FORMAT;
- 				goto out;
- 			}
- 			*dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1,
-@@ -1246,6 +1248,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
- 		}
- 		if (*certs != NULL) {
- 			error_f("%s already set", ext_name);
-+			r = SSH_ERR_INVALID_FORMAT;
- 			goto out;
- 		}
- 		if ((r = sshbuf_get_u8(m, &v)) != 0 ||
-@@ -1257,6 +1260,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
- 		while (sshbuf_len(b) != 0) {
- 			if (*ncerts >= AGENT_MAX_EXT_CERTS) {
- 				error_f("too many %s constraints", ext_name);
-+				r = SSH_ERR_INVALID_FORMAT;
- 				goto out;
- 			}
- 			*certs = xrecallocarray(*certs, *ncerts, *ncerts + 1,
-@@ -1757,6 +1761,7 @@ process_ext_session_bind(SocketEntry *e)
- 	/* record new key/sid */
- 	if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) {
- 		error_f("too many session IDs recorded");
-+		r = -1;
- 		goto out;
- 	}
- 	e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids,
-diff --git a/ssh-sk-client.c b/ssh-sk-client.c
-index 321fe53a..06fad221 100644
---- a/ssh-sk-client.c
-+++ b/ssh-sk-client.c
-@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
- 		}
- 		if ((srk = calloc(1, sizeof(*srk))) == NULL) {
- 			error_f("calloc failed");
-+			r = SSH_ERR_ALLOC_FAIL;
- 			goto out;
- 		}
- 		srk->key = key;
-@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
- 		if ((tmp = recallocarray(srks, nsrks, nsrks + 1,
- 		    sizeof(*srks))) == NULL) {
- 			error_f("recallocarray keys failed");
-+			r = SSH_ERR_ALLOC_FAIL;
- 			goto out;
- 		}
- 		debug_f("srks[%zu]: %s %s uidlen %zu", nsrks,
-diff --git a/sshconnect2.c b/sshconnect2.c
-index a69c4da1..1ee6000a 100644
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
- 	    options.required_rsa_size)) != 0)
- 		fatal_r(r, "Bad server host key");
- 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
--	    xxx_conn_info) == -1)
-+	    xxx_conn_info) != 0)
- 		fatal("Host key verification failed.");
- 	return 0;
- }
-@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
- 
- 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
- 		debug_f("server sent unknown pkalg %s", pkalg);
-+		r = SSH_ERR_INVALID_FORMAT;
- 		goto done;
- 	}
- 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
-@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
- 		error("input_userauth_pk_ok: type mismatch "
- 		    "for decoded key (received %d, expected %d)",
- 		    key->type, pktype);
-+		r = SSH_ERR_INVALID_FORMAT;
- 		goto done;
- 	}
- 
-@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
- 		    SSH_FP_DEFAULT);
- 		error_f("server replied with unknown key: %s %s",
- 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
-+		r = SSH_ERR_INVALID_FORMAT;
- 		goto done;
- 	}
- 	ident = format_identity(id);
-diff --git a/sshsig.c b/sshsig.c
-index 6e03c0b0..3da005d6 100644
---- a/sshsig.c
-+++ b/sshsig.c
-@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum,
- 	}
- 	if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
- 		error_f("buffer error");
-+		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
- 	}
- 	/* success */

sources

@@ -1,3 +1,3 @@
-SHA512 (openssh-9.9p1.tar.gz) = 3cc0ed97f3e29ecbd882eca79239f02eb5a1606fce4f3119ddc3c5e86128aa3ff12dc85000879fccc87b60e7d651cfe37376607ac66075fede2118deaa685d6d
-SHA512 (openssh-9.9p1.tar.gz.asc) = 916e975c54eb68c0b2f0b0006522b241cbe54c4caa88d31537a6278490c93d9d732c2ab3a080ac084bf75cbdd5402901ec68583cbe7c7cde4a8e40e7a8b78c28
+SHA512 (openssh-10.0p1.tar.gz) = 2daa1fcf95793b23810142077e68ddfabdf3732b207ef4f033a027f72d733d0e9bcdb6f757e7f3a5934b972de05bfaae3baae381cfc7a400cd8ab4d4e277a0ed
+SHA512 (openssh-10.0p1.tar.gz.asc) = 6ab9deb4233ff159e55a18c9fc07d5ff8a41723dad74aa3d803e1476b585f5662aba34f8a7a1f5fe1d248f3ff3cd663f2c2fb8e399c6a4723b6215b0eb423d13
 SHA512 (gpgkey-736060BA.gpg) = df44f3fdbcd1d596705348c7f5aed3f738c5f626a55955e0642f7c6c082995cf36a1b1891bb41b8715cb2aff34fef1c877e0eff0d3507dd00a055ba695757a21