Based on openssh-9.6p1-2.fc40

gsi-openssh.spec

@@ -24,7 +24,7 @@
 %global libedit 1
 
 %global openssh_ver 9.6p1
-%global openssh_rel 1
+%global openssh_rel 3
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -181,6 +181,9 @@ Patch1014: openssh-8.7p1-nohostsha1proof.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2294879
 # Merged in OpenSSH 9.8
 Patch1016: openssh-9.6p1-cve-2024-6387.patch
+# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
+# upstream 0832aac79517611dd4de93ad0a83577994d9c907
+Patch1021: openssh-9.9p2-error_processing.patch
 
 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
@@ -246,6 +249,8 @@ Requires(pre): /usr/sbin/useradd
 Requires: pam >= 1.0.1-3
 Requires: crypto-policies >= 20220824-1
 %{?systemd_requires}
+Requires(pre): policycoreutils-python-utils
+Requires(postun): policycoreutils-python-utils
 
 %description
 SSH (Secure SHell) is a program for logging into and executing
@@ -340,6 +345,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1013 -p1 -b .evp-fips-ecdh
 %patch -P 1014 -p1 -b .nosha1hostproof
 %patch -P 1016 -p1 -b .cve-2024-6387
+%patch -P 1021 -p1 -b .errcode_set
 
 %patch -P 100 -p1 -b .coverity
 
@@ -348,8 +354,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 
 sed 's/sshd.pid/gsisshd.pid/' -i pathnames.h
 sed 's!$(piddir)/sshd.pid!$(piddir)/gsisshd.pid!' -i Makefile.in
-sed 's!/etc/sysconfig/sshd!/etc/sysconfig/gsisshd!' -i sshd_config
-sed 's!/etc/pam.d/sshd!/etc/pam.d/gsisshd!' -i sshd_config
+sed 's!/etc/pam.d/sshd!/etc/pam.d/gsisshd!' -i sshd_config_redhat
 
 cp -p %{SOURCE99} .
 
@@ -357,7 +362,6 @@ autoreconf
 
 %build
 %set_build_flags
-CFLAGS="$CFLAGS"; export CFLAGS
 %if %{pie}
 %ifarch s390 s390x sparc sparcv9 sparc64
 CFLAGS="$CFLAGS -fPIC"
@@ -390,8 +394,8 @@ fi
 	--sysconfdir=%{_sysconfdir}/gsissh \
 	--libexecdir=%{_libexecdir}/gsissh \
 	--datadir=%{_datadir}/gsissh \
-	--with-default-path=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \
-	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
+	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \
+	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_datadir}/empty.sshd \
 	--disable-strip \
 	--without-zlib-version-check \
@@ -464,12 +468,10 @@ rm $RPM_BUILD_ROOT%{_bindir}/ssh-agent
 rm $RPM_BUILD_ROOT%{_bindir}/ssh-keyscan
 rm $RPM_BUILD_ROOT%{_libexecdir}/gsissh/ssh-keycat
 rm $RPM_BUILD_ROOT%{_libexecdir}/gsissh/ssh-pkcs11-helper
-rm $RPM_BUILD_ROOT%{_libexecdir}/gsissh/ssh-sk-helper
 rm $RPM_BUILD_ROOT%{_mandir}/man1/ssh-add.1*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/ssh-agent.1*
 rm $RPM_BUILD_ROOT%{_mandir}/man1/ssh-keyscan.1*
 rm $RPM_BUILD_ROOT%{_mandir}/man8/ssh-pkcs11-helper.8*
-rm $RPM_BUILD_ROOT%{_mandir}/man8/ssh-sk-helper.8*
 
 for f in $RPM_BUILD_ROOT%{_bindir}/* \
 	 $RPM_BUILD_ROOT%{_sbindir}/* \
@@ -477,13 +479,18 @@ for f in $RPM_BUILD_ROOT%{_bindir}/* \
     mv $f `dirname $f`/gsi`basename $f`
 done
 
-# Add symlink with alternative name for scp binary
-ln -s gsiscp $RPM_BUILD_ROOT%{_bindir}/hpnscp
+# Add scp and hpnscp symlinks in gsisshd's path
+mkdir $RPM_BUILD_ROOT%{_libexecdir}/gsissh/bin
+ln -nrs $RPM_BUILD_ROOT%{_bindir}/gsiscp \
+	$RPM_BUILD_ROOT%{_libexecdir}/gsissh/bin/scp
+ln -nrs $RPM_BUILD_ROOT%{_bindir}/gsiscp \
+	$RPM_BUILD_ROOT%{_libexecdir}/gsissh/bin/hpnscp
 
 perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*
 
 %pre server
 %sysusers_create_compat %{SOURCE19}
+semanage port -a -t ssh_port_t -p tcp 2222 2>/dev/null || :
 
 %post server
 if [ $1 -gt 1 ]; then
@@ -501,6 +508,9 @@ fi
 
 %postun server
 %systemd_postun_with_restart gsisshd.service
+if [ $1 -eq 0 ]; then
+    semanage port -d -t ssh_port_t -p tcp 2222 2>/dev/null || :
+fi
 
 %files
 %license LICENCE
@@ -510,21 +520,25 @@ fi
 %attr(0755,root,root) %{_bindir}/gsissh-keygen
 %attr(0644,root,root) %{_mandir}/man1/gsissh-keygen.1*
 %attr(0755,root,root) %dir %{_libexecdir}/gsissh
-%attr(4755,root,root) %{_libexecdir}/gsissh/ssh-keysign
+%attr(4555,root,root) %{_libexecdir}/gsissh/ssh-keysign
 %attr(0644,root,root) %{_mandir}/man8/gsissh-keysign.8*
 
 %files clients
 %attr(0755,root,root) %{_bindir}/gsissh
 %attr(0644,root,root) %{_mandir}/man1/gsissh.1*
 %attr(0755,root,root) %{_bindir}/gsiscp
-%{_bindir}/hpnscp
 %attr(0644,root,root) %{_mandir}/man1/gsiscp.1*
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/gsissh/ssh_config
 %dir %attr(0755,root,root) %{_sysconfdir}/gsissh/ssh_config.d/
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/gsissh/ssh_config.d/50-redhat.conf
 %attr(0644,root,root) %{_mandir}/man5/gsissh_config.5*
 %attr(0755,root,root) %{_bindir}/gsisftp
+%attr(0755,root,root) %{_libexecdir}/gsissh/ssh-sk-helper
 %attr(0644,root,root) %{_mandir}/man1/gsisftp.1*
+%attr(0644,root,root) %{_mandir}/man8/gsissh-sk-helper.8*
+%attr(0755,root,root) %dir %{_libexecdir}/gsissh/bin
+%{_libexecdir}/gsissh/bin/scp
+%{_libexecdir}/gsissh/bin/hpnscp
 
 %files server
 %dir %attr(0711,root,root) %{_datadir}/empty.sshd
@@ -552,6 +566,12 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.6p1-3
+- Based on openssh-9.6p1-2.fc40
+
+* Fri Jul 12 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.6p1-2
+- Add scp and hpnscp symlinks in gsisshd's path
+
 * Sat Jul 06 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.6p1-1
 - Based on openssh-9.6p1-1.fc40.4
 

openssh-9.6p1-hpn-18.3.1.patch

@@ -8177,8 +8177,8 @@ diff -Nur openssh-9.6p1.orig/clientloop.c openssh-9.6p1/clientloop.c
  		if (want_subsystem) {
 diff -Nur openssh-9.6p1.orig/compat.c openssh-9.6p1/compat.c
 --- openssh-9.6p1.orig/compat.c	2024-07-10 13:32:39.574111737 +0200
-+++ openssh-9.6p1/compat.c	2024-07-10 13:34:02.716358582 +0200
-@@ -135,6 +135,36 @@
++++ openssh-9.6p1/compat.c	2024-07-14 11:29:56.093866627 +0200
+@@ -135,6 +135,35 @@
  			ssh->compat = check[i].bugs;
  	if (forbid_ssh_rsa)
  		ssh->compat |= SSH_RH_RSASIGSHA;
@@ -8188,27 +8188,26 @@ diff -Nur openssh-9.6p1.orig/compat.c openssh-9.6p1/compat.c
 +				if (strstr(version, "hpn")) {
 +					ssh->compat |= SSH_HPNSSH;
 +					debug("Remote is HPN enabled");
-+				}
-+				/* this checks to see if the remote
-+				 * version string indicates that we
-+				 * have access to hpn prefixed binaries
-+				 * You'll need to change this to include
-+				 * new major version numbers. Which is
-+				 * why we should figure out how to make
-+				 * the match pattern list work
-+				 */
-+				if ((strstr(version, "hpn16") != NULL) ||
-+				    (strstr(version, "hpn17") != NULL) ||
-+				    (strstr(version, "hpn18") != NULL)) {
-+					ssh->compat |= SSH_HPNSSH_PREFIX;
-+					debug("Remote uses HPNSSH prefixes.");
-+					break;
++					/* this checks to see if the remote
++					 * version string indicates that we
++					 * have access to hpn prefixed binaries
++					 * You'll need to change this to include
++					 * new major version numbers. Which is
++					 * why we should figure out how to make
++					 * the match pattern list work
++					 */
++					if ((strstr(version, "hpn16") != NULL) ||
++					    (strstr(version, "hpn17") != NULL) ||
++					    (strstr(version, "hpn18") != NULL)) {
++						ssh->compat |= SSH_HPNSSH_PREFIX;
++						debug("Remote uses HPNSSH prefixes.");
++					}
 +				}
 +				/* if it's openssh and not hpn */
-+				if ((strstr(version, "OpenSSH_8.9") != NULL) ||
-+				    (strstr(version, "OpenSSH_9") != NULL)) {
++				else if ((strstr(version, "OpenSSH_8.9") != NULL) ||
++					 (strstr(version, "OpenSSH_9") != NULL)) {
 +					ssh->compat |= SSH_RESTRICT_WINDOW;
-+					debug("Restricting adverstised window size.");
++					debug("Restricting advertised window size.");
 +				}
 +			}
 +			debug("ssh->compat is %u", ssh->compat);
@@ -8217,7 +8216,7 @@ diff -Nur openssh-9.6p1.orig/compat.c openssh-9.6p1/compat.c
  	}
 diff -Nur openssh-9.6p1.orig/compat.h openssh-9.6p1/compat.h
 --- openssh-9.6p1.orig/compat.h	2024-07-10 13:32:39.574111737 +0200
-+++ openssh-9.6p1/compat.h	2024-07-10 13:34:02.716358582 +0200
++++ openssh-9.6p1/compat.h	2024-07-14 11:29:56.093866627 +0200
 @@ -46,12 +46,12 @@
  /* #define unused		0x00010000 */
  /* #define unused		0x00020000 */
@@ -8227,7 +8226,7 @@ diff -Nur openssh-9.6p1.orig/compat.h openssh-9.6p1/compat.h
  #define SSH_BUG_EXTEOF		0x00200000
  #define SSH_BUG_PROBE		0x00400000
 -/* #define unused		0x00800000 */
-+#define SSH_RESTRICT_WINDOW	0x00800000 /* restrict adverstised window to OpenSSH clients */
++#define SSH_RESTRICT_WINDOW	0x00800000 /* restrict advertised window to OpenSSH clients */
  #define SSH_OLD_FORWARD_ADDR	0x01000000
 -/* #define unused		0x02000000 */
 +#define SSH_HPNSSH_PREFIX	0x02000000 /* indicates that we have hpn prefixes binaries */
@@ -13533,7 +13532,7 @@ diff -Nur openssh-9.6p1.orig/umac.c openssh-9.6p1/umac.c
 +        return (v);
 +}
 +
-+#if (! __LITTLE_ENDIAN__) /* compile time warning thrown otherwise */
++#if 0 /* compile time warning thrown otherwise */
 +static __attribute__((__bounded__(__minbytes__, 1, 4)));
 +void umac_put_u32_le(void *vp, u_int32_t v)
 +{

openssh-9.9p2-error_processing.patch

@@ -0,0 +1,152 @@
+diff --git a/krl.c b/krl.c
+index e2efdf06..0d0f6953 100644
+--- a/krl.c
++++ b/krl.c
+@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
+ 			break;
+ 		case KRL_SECTION_CERT_SERIAL_BITMAP:
+ 			if (rs->lo - bitmap_start > INT_MAX) {
++				r = SSH_ERR_INVALID_FORMAT;
+ 				error_f("insane bitmap gap");
+ 				goto out;
+ 			}
+@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
+ 	}
+ 
+ 	if ((krl = ssh_krl_init()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
+ 		error_f("alloc failed");
+ 		goto out;
+ 	}
+diff --git a/packet.c b/packet.c
+index 486f8515..9dea2cfc 100644
+--- a/packet.c
++++ b/packet.c
+@@ -1864,6 +1864,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ 			if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
+ 				return r;
+ 			DBG(debug("Received SSH2_MSG_PING len %zu", len));
++			if (!ssh->state->after_authentication) {
++				DBG(debug("Won't reply to PING in preauth"));
++				break;
++			}
++			if (ssh_packet_is_rekeying(ssh)) {
++				DBG(debug("Won't reply to PING during KEX"));
++				break;
++			}
+ 			if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
+ 			    (r = sshpkt_put_string(ssh, d, len)) != 0 ||
+ 			    (r = sshpkt_send(ssh)) != 0)
+diff --git a/ssh-agent.c b/ssh-agent.c
+index 48973b2c..c27c5a95 100644
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1220,6 +1220,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 	    "restrict-destination-v00@openssh.com") == 0) {
+ 		if (*dcsp != NULL) {
+ 			error_f("%s already set", ext_name);
++			r = SSH_ERR_INVALID_FORMAT;
+ 			goto out;
+ 		}
+ 		if ((r = sshbuf_froms(m, &b)) != 0) {
+@@ -1229,6 +1230,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		while (sshbuf_len(b) != 0) {
+ 			if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) {
+ 				error_f("too many %s constraints", ext_name);
++				r = SSH_ERR_INVALID_FORMAT;
+ 				goto out;
+ 			}
+ 			*dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1,
+@@ -1246,6 +1248,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		}
+ 		if (*certs != NULL) {
+ 			error_f("%s already set", ext_name);
++			r = SSH_ERR_INVALID_FORMAT;
+ 			goto out;
+ 		}
+ 		if ((r = sshbuf_get_u8(m, &v)) != 0 ||
+@@ -1257,6 +1260,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		while (sshbuf_len(b) != 0) {
+ 			if (*ncerts >= AGENT_MAX_EXT_CERTS) {
+ 				error_f("too many %s constraints", ext_name);
++				r = SSH_ERR_INVALID_FORMAT;
+ 				goto out;
+ 			}
+ 			*certs = xrecallocarray(*certs, *ncerts, *ncerts + 1,
+@@ -1757,6 +1761,7 @@ process_ext_session_bind(SocketEntry *e)
+ 	/* record new key/sid */
+ 	if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) {
+ 		error_f("too many session IDs recorded");
++		r = -1;
+ 		goto out;
+ 	}
+ 	e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids,
+diff --git a/ssh-sk-client.c b/ssh-sk-client.c
+index 321fe53a..06fad221 100644
+--- a/ssh-sk-client.c
++++ b/ssh-sk-client.c
+@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ 		}
+ 		if ((srk = calloc(1, sizeof(*srk))) == NULL) {
+ 			error_f("calloc failed");
++			r = SSH_ERR_ALLOC_FAIL;
+ 			goto out;
+ 		}
+ 		srk->key = key;
+@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ 		if ((tmp = recallocarray(srks, nsrks, nsrks + 1,
+ 		    sizeof(*srks))) == NULL) {
+ 			error_f("recallocarray keys failed");
++			r = SSH_ERR_ALLOC_FAIL;
+ 			goto out;
+ 		}
+ 		debug_f("srks[%zu]: %s %s uidlen %zu", nsrks,
+diff --git a/sshconnect2.c b/sshconnect2.c
+index a69c4da1..1ee6000a 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ 	    options.required_rsa_size)) != 0)
+ 		fatal_r(r, "Bad server host key");
+ 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+-	    xxx_conn_info) == -1)
++	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+ }
+@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 
+ 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ 		debug_f("server sent unknown pkalg %s", pkalg);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		error("input_userauth_pk_ok: type mismatch "
+ 		    "for decoded key (received %d, expected %d)",
+ 		    key->type, pktype);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 
+@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		    SSH_FP_DEFAULT);
+ 		error_f("server replied with unknown key: %s %s",
+ 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	ident = format_identity(id);
+diff --git a/sshsig.c b/sshsig.c
+index 6e03c0b0..3da005d6 100644
+--- a/sshsig.c
++++ b/sshsig.c
+@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum,
+ 	}
+ 	if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
+ 		error_f("buffer error");
++		r = SSH_ERR_ALLOC_FAIL;
+ 		goto out;
+ 	}
+ 	/* success */