Based on openssh-9.9p1-11.fc42

gsi-openssh.spec

@@ -24,12 +24,11 @@
 %global libedit 1
 
 %global openssh_ver 9.9p1
-%global openssh_rel 4
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
 Version: %{openssh_ver}
-Release: %{openssh_rel}%{?dist}
+Release: 6%{?dist}
 Provides: gsissh = %{version}-%{release}
 Obsoletes: gsissh < 5.8p2-2
 URL: http://www.openssh.com/portable.html
@@ -183,6 +182,8 @@ Patch1020: openssh-9.9p1-match-regression.patch
 # upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
 # upstream 0832aac79517611dd4de93ad0a83577994d9c907
 Patch1021: openssh-9.9p2-error_processing.patch
+# upstream fc86875e6acb36401dfc1dfb6b628a9d1460f367
+Patch1022: openssh-9.9p1-disable-forwarding.patch
 
 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
@@ -355,6 +356,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1017 -p1 -b .mlkembe
 %patch -P 1020 -p1 -b .match
 %patch -P 1021 -p1 -b .errcode_set
+%patch -P 1022 -p1 -b .disable-forwarding
 
 %patch -P 100 -p1 -b .coverity
 %patch -P 98 -p1 -b .gsi
@@ -402,8 +404,8 @@ fi
 	--sysconfdir=%{_sysconfdir}/gsissh \
 	--libexecdir=%{_libexecdir}/gsissh \
 	--datadir=%{_datadir}/gsissh \
-	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \
-	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
+	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin \
+	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin \
 	--with-privsep-path=%{_datadir}/empty.sshd \
 	--disable-strip \
 	--without-zlib-version-check \
@@ -579,6 +581,12 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration
 
 %changelog
+* Thu Jun 12 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-6
+- Based on openssh-9.9p1-11.fc42
+
+* Sun Apr 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-5
+- Based on openssh-9.9p1-10.fc42
+
 * Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-4
 - Based on openssh-9.9p1-9.fc42
 

openssh-9.9p1-disable-forwarding.patch

@@ -0,0 +1,22 @@
+diff --color -ruNp a/session.c b/session.c
+--- a/session.c	2025-04-29 11:20:59.475107377 +0200
++++ b/session.c	2025-04-29 11:23:16.638538968 +0200
+@@ -2284,7 +2284,8 @@ session_auth_agent_req(struct ssh *ssh,
+ 	if ((r = sshpkt_get_end(ssh)) != 0)
+ 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
+ 	if (!auth_opts->permit_agent_forwarding_flag ||
+-	    !options.allow_agent_forwarding) {
++	    !options.allow_agent_forwarding ||
++	    options.disable_forwarding) {
+ 		debug_f("agent forwarding disabled");
+ 		return 0;
+ 	}
+@@ -2709,7 +2710,7 @@ session_setup_x11fwd(struct ssh *ssh, Se
+ 		ssh_packet_send_debug(ssh, "X11 forwarding disabled by key options.");
+ 		return 0;
+ 	}
+-	if (!options.x11_forwarding) {
++	if (!options.x11_forwarding || options.disable_forwarding) {
+ 		debug("X11 forwarding disabled in server configuration file.");
+ 		return 0;
+ 	}