Based on openssh-9.9p1-7.el10

Based on openssh-9.9p1-5.el10.1
2025-04-20 06:55:05 +02:00 · 2025-03-05 16:50:43 +01:00
76 changed files with 7263 additions and 8422 deletions
--- a/0006-openssh-5.8p2-sigpipe.patch
+++ b/0006-openssh-5.8p2-sigpipe.patch
@ -1,26 +0,0 @@
-From 80359feb76fd8061b5ce18f73451d7b9db0c2477 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 06/50] openssh-5.8p2-sigpipe
-
---
- ssh-keyscan.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/ssh-keyscan.c b/ssh-keyscan.c
-index 3436c0b5..9f76ad22 100644
--- a/ssh-keyscan.c
-+++ b/ssh-keyscan.c
-@@ -798,6 +798,9 @@ main(int argc, char **argv)
- 	if (maxfd > fdlim_get(0))
- 		fdlim_set(maxfd);
- 	fdcon = xcalloc(maxfd, sizeof(con));
-+ 
-+	signal(SIGPIPE, SIG_IGN);
-+
- 	read_wait = xcalloc(maxfd, sizeof(struct pollfd));
- 	for (j = 0; j < maxfd; j++)
- 		read_wait[j].fd = -1;
-- 
-2.49.0
-
--- a/0017-openssh-6.4p1-fromto-remote.patch
+++ b/0017-openssh-6.4p1-fromto-remote.patch
@ -1,28 +0,0 @@
-From 20aabb2c445e29d211266ce7434bb0273edf88b9 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 17/50] openssh-6.4p1-fromto-remote
-
---
- scp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/scp.c b/scp.c
-index 57c242ff..716ae386 100644
--- a/scp.c
-+++ b/scp.c
-@@ -1162,7 +1162,10 @@ toremote(int argc, char **argv, enum scp_mode_e mode, char *sftp_direct)
- 			addargs(&alist, "%s", ssh_program);
- 			addargs(&alist, "-x");
- 			addargs(&alist, "-oClearAllForwardings=yes");
-			addargs(&alist, "-n");
-+			if (isatty(fileno(stdin)))
-+				addargs(&alist, "-t");
-+			else
-+				addargs(&alist, "-n");
- 			for (j = 0; j < remote_remote_args.num; j++) {
- 				addargs(&alist, "%s",
- 				    remote_remote_args.list[j]);
-- 
-2.49.0
-
--- a/0020-openssh-6.6.1p1-scp-non-existing-directory.patch
+++ b/0020-openssh-6.6.1p1-scp-non-existing-directory.patch
@ -1,27 +0,0 @@
-From 007ee98fa9100f7241985ac2a7eed71e17d89a9f Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 20/50] openssh-6.6.1p1-scp-non-existing-directory
-
---
- scp.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/scp.c b/scp.c
-index 716ae386..9554b188 100644
--- a/scp.c
-+++ b/scp.c
-@@ -1876,6 +1876,10 @@ sink(int argc, char **argv, const char *src)
- 			free(vect[0]);
- 			continue;
- 		}
-+		if (buf[0] == 'C' && ! exists && np[strlen(np)-1] == '/') {
-+			errno = ENOTDIR;
-+			goto bad;
-+		}
- 		omode = mode;
- 		mode |= S_IWUSR;
- 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) == -1) {
-- 
-2.49.0
-
--- a/0022-openssh-6.8p1-sshdT-output.patch
+++ b/0022-openssh-6.8p1-sshdT-output.patch
@ -1,25 +0,0 @@
-From 05b09904f431333e19cd24528ef66d1fd15e9efe Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 22/50] openssh-6.8p1-sshdT-output
-
---
- servconf.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/servconf.c b/servconf.c
-index c0de7110..105e301d 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -3366,7 +3366,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_string(sXAuthLocation, o->xauth_location);
- 	dump_cfg_string(sCiphers, o->ciphers);
- 	dump_cfg_string(sMacs, o->macs);
-	dump_cfg_string(sBanner, o->banner);
-+	dump_cfg_string(sBanner, o->banner != NULL ? o->banner : "none");
- 	dump_cfg_string(sForceCommand, o->adm_forced_command);
- 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
- 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
-- 
-2.49.0
-
--- a/0027-openssh-7.5p1-sandbox.patch
+++ b/0027-openssh-7.5p1-sandbox.patch
@ -1,58 +0,0 @@
-From 35205319dd71d8e61c1596b8f9479df91aff7756 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 27/50] openssh-7.5p1-sandbox
-
---
- sandbox-seccomp-filter.c | 21 +++++++++++++++++++++
- 1 file changed, 21 insertions(+)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index b31062c2..1fabf99d 100644
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -277,6 +277,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_exit_group
- 	SC_ALLOW(__NR_exit_group),
- #endif
-+#if defined(__NR_flock) && defined(__s390__)
-+	SC_ALLOW(__NR_flock),
-+#endif
- #ifdef __NR_futex
- 	SC_FUTEX(__NR_futex),
- #endif
-@@ -295,6 +298,21 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_getpid
- 	SC_ALLOW(__NR_getpid),
- #endif
-+#ifdef __NR_getuid
-+	SC_ALLOW(__NR_getuid),
-+#endif
-+#ifdef __NR_getuid32
-+	SC_ALLOW(__NR_getuid32),
-+#endif
-+#ifdef __NR_geteuid
-+	SC_ALLOW(__NR_geteuid),
-+#endif
-+#ifdef __NR_geteuid32
-+	SC_ALLOW(__NR_geteuid32),
-+#endif
-+#ifdef __NR_gettid
-+	SC_ALLOW(__NR_gettid),
-+#endif
- #ifdef __NR_getrandom
- 	SC_ALLOW(__NR_getrandom),
- #endif
-@@ -304,6 +322,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_gettimeofday
- 	SC_ALLOW(__NR_gettimeofday),
- #endif
-+#if defined(__NR_ipc) && defined(__s390__)
-+	SC_ALLOW(__NR_ipc),
-+#endif
- #ifdef __NR_getuid
- 	SC_ALLOW(__NR_getuid),
- #endif
-- 
-2.49.0
-
--- a/0038-openssh-8.7p1-ibmca.patch
+++ b/0038-openssh-8.7p1-ibmca.patch
@ -1,25 +0,0 @@
-From 26af04432f6404eb03780265a5cce948ecfec8dc Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 38/50] openssh-8.7p1-ibmca
-
---
- openbsd-compat/bsd-closefrom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/openbsd-compat/bsd-closefrom.c b/openbsd-compat/bsd-closefrom.c
-index f6112458..417c2048 100644
--- a/openbsd-compat/bsd-closefrom.c
-+++ b/openbsd-compat/bsd-closefrom.c
-@@ -16,7 +16,7 @@
- 
- #include "includes.h"
- 
-#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM)
-+#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM) || (defined __s390__)
- 
- #include <sys/types.h>
- #include <unistd.h>
-- 
-2.49.0
-
--- a/0043-openssh-8.7p1-ssh-manpage.patch
+++ b/0043-openssh-8.7p1-ssh-manpage.patch
@ -1,47 +0,0 @@
-From 299a602802d7c7d121306eb2aeae1502871a35cb Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 43/50] openssh-8.7p1-ssh-manpage
-
---
- ssh.1 | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/ssh.1 b/ssh.1
-index 6a9fbdc5..755cdef2 100644
--- a/ssh.1
-+++ b/ssh.1
-@@ -510,12 +510,12 @@ For full details of the options listed below, and their possible values, see
- .It BatchMode
- .It BindAddress
- .It BindInterface
-.It CASignatureAlgorithms
- .It CanonicalDomains
- .It CanonicalizeFallbackLocal
- .It CanonicalizeHostname
- .It CanonicalizeMaxDots
- .It CanonicalizePermittedCNAMEs
-+.It CASignatureAlgorithms
- .It CertificateFile
- .It ChannelTimeout
- .It CheckHostIP
-@@ -528,6 +528,7 @@ For full details of the options listed below, and their possible values, see
- .It ControlPath
- .It ControlPersist
- .It DynamicForward
-+.It EnableSSHKeysign
- .It EnableEscapeCommandline
- .It EnableSSHKeysign
- .It EscapeChar
-@@ -588,6 +589,8 @@ For full details of the options listed below, and their possible values, see
- .It RemoteCommand
- .It RemoteForward
- .It RequestTTY
-+.It RevokedHostKeys
-+.It SecurityKeyProvider
- .It RequiredRSASize
- .It RevokedHostKeys
- .It SecurityKeyProvider
-- 
-2.49.0
-
--- a/0047-openssh-9.6p1-pam-rhost.patch
+++ b/0047-openssh-9.6p1-pam-rhost.patch
@ -1,25 +0,0 @@
-From 497de886faaddec60b7ad1013396c7d4f3145968 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 47/50] openssh-9.6p1-pam-rhost
-
---
- auth-pam.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/auth-pam.c b/auth-pam.c
-index a042c3c8..a321e0d3 100644
--- a/auth-pam.c
-+++ b/auth-pam.c
-@@ -741,7 +741,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
- 		sshpam_laddr = get_local_ipaddr(
- 		    ssh_packet_get_connection_in(ssh));
- 	}
-	if (sshpam_rhost != NULL) {
-+	if (sshpam_rhost != NULL && strcmp(sshpam_rhost, "UNKNOWN") != 0) {
- 		debug("PAM: setting PAM_RHOST to \"%s\"", sshpam_rhost);
- 		sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST,
- 		    sshpam_rhost);
-- 
-2.49.0
-
--- a/0048-openssh-9.9p1-separate-keysign.patch
+++ b/0048-openssh-9.9p1-separate-keysign.patch
@ -1,25 +0,0 @@
-From b97b1040bc0918fe9be89cdb482d046270e92d9c Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 48/50] openssh-9.9p1-separate-keysign
-
---
- ssh_config.5 | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ssh_config.5 b/ssh_config.5
-index a43b2a27..9d5da2a6 100644
--- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -797,7 +797,7 @@ or
- This option should be placed in the non-hostspecific section.
- See
- .Xr ssh-keysign 8
-for more information.
-+for more information. ssh-keysign should be installed explicitly.
- .It Cm EscapeChar
- Sets the escape character (default:
- .Ql ~ ) .
-- 
-2.49.0
-
--- a/0049-openssh-9.9p1-openssl-mlkem.patch
+++ b/0049-openssh-9.9p1-openssl-mlkem.patch
@ -1,398 +0,0 @@
-From 0a621a2ccb8444e4c6da906b0e112e0522658122 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 49/50] openssh-9.9p1-openssl-mlkem
-
---
- kex-names.c         |  20 +++
- kexmlkem768x25519.c | 291 ++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 311 insertions(+)
-
-diff --git a/kex-names.c b/kex-names.c
-index cd3902ad..36a953ab 100644
--- a/kex-names.c
-+++ b/kex-names.c
-@@ -108,6 +108,19 @@ static const struct kexalg gss_kexalgs[] = {
- 	{ NULL, 0, -1, -1},
- };
- 
-+static int is_mlkem768_available()
-+{
-+	static int is_fetched = -1;
-+
-+	if (is_fetched == -1) {
-+		EVP_KEM *mlkem768 = EVP_KEM_fetch(NULL, "mlkem768", NULL);
-+		is_fetched = mlkem768 != NULL ? 1 : 0;
-+		EVP_KEM_free(mlkem768);
-+	}
-+
-+	return is_fetched;
-+}
-+
- static char *
- kex_alg_list_internal(char sep, const struct kexalg *algs)
- {
-@@ -116,6 +129,9 @@ kex_alg_list_internal(char sep, const struct kexalg *algs)
- 	const struct kexalg *k;
- 
- 	for (k = algs; k->name != NULL; k++) {
-+		if (strcmp(k->name, KEX_MLKEM768X25519_SHA256) == 0
-+			&& !is_mlkem768_available())
-+			continue;
- 		if (ret != NULL)
- 			ret[rlen++] = sep;
- 		nlen = strlen(k->name);
-@@ -147,6 +163,10 @@ kex_alg_by_name(const char *name)
- {
- 	const struct kexalg *k;
- 
-+	if (strcmp(name, KEX_MLKEM768X25519_SHA256) == 0
-+		&& !is_mlkem768_available())
-+	return NULL;
-+
- 	for (k = kexalgs; k->name != NULL; k++) {
- 		if (strcmp(k->name, name) == 0)
- 			return k;
-diff --git a/kexmlkem768x25519.c b/kexmlkem768x25519.c
-index 2b5d3960..670049dc 100644
--- a/kexmlkem768x25519.c
-+++ b/kexmlkem768x25519.c
-@@ -48,10 +48,127 @@
- #ifdef USE_MLKEM768X25519
- 
- #include "libcrux_mlkem768_sha3.h"
-+#include <openssl/err.h>
-+#include <openssl/evp.h>
-+#include <stdio.h>
-+
-+static int
-+mlkem768_keypair_gen(unsigned char *pubkeybuf, unsigned char *privkeybuf)
-+{
-+    EVP_PKEY_CTX *ctx = NULL;
-+    EVP_PKEY *pkey = NULL;
-+    int ret = SSH_ERR_INTERNAL_ERROR;
-+    size_t pubkey_size = crypto_kem_mlkem768_PUBLICKEYBYTES, privkey_size = crypto_kem_mlkem768_SECRETKEYBYTES;
-+
-+    ctx = EVP_PKEY_CTX_new_from_name(NULL, "mlkem768", NULL);
-+    if (ctx == NULL) {
-+	ret = SSH_ERR_LIBCRYPTO_ERROR;
-+	goto err;
-+    }
-+
-+    if (EVP_PKEY_keygen_init(ctx) <= 0
-+        || EVP_PKEY_keygen(ctx, &pkey) <= 0) {
-+	ret = SSH_ERR_LIBCRYPTO_ERROR;
-+        goto err;
-+    }
-+
-+    if (EVP_PKEY_get_raw_public_key(pkey, pubkeybuf, &pubkey_size) <= 0
-+	|| EVP_PKEY_get_raw_private_key(pkey, privkeybuf, &privkey_size) <= 0) {
-+	ret = SSH_ERR_LIBCRYPTO_ERROR;
-+        goto err;
-+    }
-+
-+    if (privkey_size != crypto_kem_mlkem768_SECRETKEYBYTES
-+	    || pubkey_size != crypto_kem_mlkem768_PUBLICKEYBYTES) {
-+	ret = SSH_ERR_LIBCRYPTO_ERROR;
-+        goto err;
-+    }
-+    ret = 0;
-+
-+ err:
-+    EVP_PKEY_free(pkey);
-+    EVP_PKEY_CTX_free(ctx);
-+    if (ret == SSH_ERR_LIBCRYPTO_ERROR)
-+	   ERR_print_errors_fp(stderr);
-+    return ret;
-+}
-+
-+static int
-+mlkem768_encap_secret(const u_char *pubkeybuf, u_char *secret, u_char *out)
-+{
-+    EVP_PKEY *pkey = NULL;
-+    EVP_PKEY_CTX *ctx = NULL;
-+    int r = SSH_ERR_INTERNAL_ERROR;
-+    size_t outlen = crypto_kem_mlkem768_CIPHERTEXTBYTES,
-+	   secretlen = crypto_kem_mlkem768_BYTES;
-+
-+    pkey = EVP_PKEY_new_raw_public_key_ex(NULL, "mlkem768", NULL,
-+		    pubkeybuf, crypto_kem_mlkem768_PUBLICKEYBYTES);
-+    if (pkey == NULL) {
-+	r = SSH_ERR_LIBCRYPTO_ERROR;
-+	goto err;
-+    }
-+
-+    ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL);
-+    if (ctx == NULL
-+	|| EVP_PKEY_encapsulate_init(ctx, NULL) <= 0
-+        || EVP_PKEY_encapsulate(ctx, out, &outlen, secret, &secretlen) <= 0
-+	|| secretlen != crypto_kem_mlkem768_BYTES
-+	|| outlen != crypto_kem_mlkem768_CIPHERTEXTBYTES) {
-+	r = SSH_ERR_LIBCRYPTO_ERROR;
-+	goto err;
-+    }
-+    r = 0;
-+
-+ err:
-+    EVP_PKEY_free(pkey);
-+    EVP_PKEY_CTX_free(ctx);
-+    if (r == SSH_ERR_LIBCRYPTO_ERROR)
-+	   ERR_print_errors_fp(stderr);
-+
-+    return r;
-+}
-+
-+static int
-+mlkem768_decap_secret(const u_char *privkeybuf, const u_char *wrapped, u_char *secret)
-+{
-+    EVP_PKEY *pkey = NULL;
-+    EVP_PKEY_CTX *ctx = NULL;
-+    int r = SSH_ERR_INTERNAL_ERROR;
-+    size_t wrappedlen = crypto_kem_mlkem768_CIPHERTEXTBYTES,
-+	   secretlen = crypto_kem_mlkem768_BYTES;
-+
-+    pkey = EVP_PKEY_new_raw_private_key_ex(NULL, "mlkem768", NULL,
-+		    privkeybuf, crypto_kem_mlkem768_SECRETKEYBYTES);
-+    if (pkey == NULL) {
-+	r = SSH_ERR_LIBCRYPTO_ERROR;
-+	goto err;
-+    }
-+
-+    ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL);
-+    if (ctx == NULL
-+	|| EVP_PKEY_decapsulate_init(ctx, NULL) <= 0
-+        || EVP_PKEY_decapsulate(ctx, secret, &secretlen, wrapped, wrappedlen) <= 0
-+	|| secretlen != crypto_kem_mlkem768_BYTES) {
-+	r = SSH_ERR_LIBCRYPTO_ERROR;
-+	goto err;
-+    }
-+    r = 0;
-+
-+ err:
-+    EVP_PKEY_free(pkey);
-+    EVP_PKEY_CTX_free(ctx);
-+
-+    if (r == SSH_ERR_LIBCRYPTO_ERROR)
-+	   ERR_print_errors_fp(stderr);
-+
-+    return r;
-+}
- 
- int
- kex_kem_mlkem768x25519_keypair(struct kex *kex)
- {
-+#if 0
- 	struct sshbuf *buf = NULL;
- 	u_char rnd[LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN], *cp = NULL;
- 	size_t need;
-@@ -86,6 +203,36 @@ kex_kem_mlkem768x25519_keypair(struct kex *kex)
- 	explicit_bzero(rnd, sizeof(rnd));
- 	sshbuf_free(buf);
- 	return r;
-+#else
-+	struct sshbuf *buf = NULL;
-+	u_char *cp = NULL;
-+	size_t need;
-+	int r = SSH_ERR_INTERNAL_ERROR;
-+
-+	if ((buf = sshbuf_new()) == NULL)
-+		return SSH_ERR_ALLOC_FAIL;
-+	need = crypto_kem_mlkem768_PUBLICKEYBYTES + CURVE25519_SIZE;
-+	if ((r = sshbuf_reserve(buf, need, &cp)) != 0)
-+		goto out;
-+	if ((r = mlkem768_keypair_gen(cp, kex->mlkem768_client_key)) != 0)
-+		goto out;
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("client public key mlkem768:", cp,
-+	    crypto_kem_mlkem768_PUBLICKEYBYTES);
-+#endif
-+	cp += crypto_kem_mlkem768_PUBLICKEYBYTES;
-+	kexc25519_keygen(kex->c25519_client_key, cp);
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("client public key c25519:", cp, CURVE25519_SIZE);
-+#endif
-+	/* success */
-+	r = 0;
-+	kex->client_pub = buf;
-+	buf = NULL;
-+ out:
-+	sshbuf_free(buf);
-+	return r;
-+#endif
- }
- 
- int
-@@ -93,6 +240,7 @@ kex_kem_mlkem768x25519_enc(struct kex *kex,
-    const struct sshbuf *client_blob, struct sshbuf **server_blobp,
-    struct sshbuf **shared_secretp)
- {
-+#if 0
- 	struct sshbuf *server_blob = NULL;
- 	struct sshbuf *buf = NULL;
- 	const u_char *client_pub;
-@@ -185,12 +333,97 @@ kex_kem_mlkem768x25519_enc(struct kex *kex,
- 	sshbuf_free(server_blob);
- 	sshbuf_free(buf);
- 	return r;
-+#else
-+	struct sshbuf *server_blob = NULL;
-+	struct sshbuf *buf = NULL;
-+	const u_char *client_pub;
-+	u_char server_pub[CURVE25519_SIZE], server_key[CURVE25519_SIZE];
-+	u_char hash[SSH_DIGEST_MAX_LENGTH];
-+	size_t need;
-+	int r = SSH_ERR_INTERNAL_ERROR;
-+	struct libcrux_mlkem768_enc_result enc; /* FIXME */
-+
-+	*server_blobp = NULL;
-+	*shared_secretp = NULL;
-+
-+	/* client_blob contains both KEM and ECDH client pubkeys */
-+	need = crypto_kem_mlkem768_PUBLICKEYBYTES + CURVE25519_SIZE;
-+	if (sshbuf_len(client_blob) != need) {
-+		r = SSH_ERR_SIGNATURE_INVALID;
-+		goto out;
-+	}
-+	client_pub = sshbuf_ptr(client_blob);
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("client public key mlkem768:", client_pub,
-+	    crypto_kem_mlkem768_PUBLICKEYBYTES);
-+	dump_digest("client public key 25519:",
-+	    client_pub + crypto_kem_mlkem768_PUBLICKEYBYTES,
-+	    CURVE25519_SIZE);
-+#endif
-+
-+	/* allocate buffer for concatenation of KEM key and ECDH shared key */
-+	/* the buffer will be hashed and the result is the shared secret */
-+	if ((buf = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+	/* allocate space for encrypted KEM key and ECDH pub key */
-+	if ((server_blob = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+	if (mlkem768_encap_secret(client_pub, enc.snd, enc.fst.value) != 0)
-+		goto out;
-+
-+	/* generate ECDH key pair, store server pubkey after ciphertext */
-+	kexc25519_keygen(server_key, server_pub);
-+	if ((r = sshbuf_put(buf, enc.snd, sizeof(enc.snd))) != 0 ||
-+	    (r = sshbuf_put(server_blob, enc.fst.value, sizeof(enc.fst.value))) != 0 ||
-+	    (r = sshbuf_put(server_blob, server_pub, sizeof(server_pub))) != 0)
-+		goto out;
-+	/* append ECDH shared key */
-+	client_pub += crypto_kem_mlkem768_PUBLICKEYBYTES;
-+	if ((r = kexc25519_shared_key_ext(server_key, client_pub, buf, 1)) < 0)
-+		goto out;
-+	if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0)
-+		goto out;
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("server public key 25519:", server_pub, CURVE25519_SIZE);
-+	dump_digest("server cipher text:",
-+	    enc.fst.value, sizeof(enc.fst.value));
-+	dump_digest("server kem key:", enc.snd, sizeof(enc.snd));
-+	dump_digest("concatenation of KEM key and ECDH shared key:",
-+	    sshbuf_ptr(buf), sshbuf_len(buf));
-+#endif
-+	/* string-encoded hash is resulting shared secret */
-+	sshbuf_reset(buf);
-+	if ((r = sshbuf_put_string(buf, hash,
-+	    ssh_digest_bytes(kex->hash_alg))) != 0)
-+		goto out;
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
-+#endif
-+	/* success */
-+	r = 0;
-+	*server_blobp = server_blob;
-+	*shared_secretp = buf;
-+	server_blob = NULL;
-+	buf = NULL;
-+ out:
-+	explicit_bzero(hash, sizeof(hash));
-+	explicit_bzero(server_key, sizeof(server_key));
-+	explicit_bzero(&enc, sizeof(enc));
-+	sshbuf_free(server_blob);
-+	sshbuf_free(buf);
-+	return r;
-+#endif
- }
- 
- int
- kex_kem_mlkem768x25519_dec(struct kex *kex,
-     const struct sshbuf *server_blob, struct sshbuf **shared_secretp)
- {
-+#if 0
- 	struct sshbuf *buf = NULL;
- 	u_char mlkem_key[crypto_kem_mlkem768_BYTES];
- 	const u_char *ciphertext, *server_pub;
-@@ -258,6 +491,64 @@ kex_kem_mlkem768x25519_dec(struct kex *kex,
- 	explicit_bzero(mlkem_key, sizeof(mlkem_key));
- 	sshbuf_free(buf);
- 	return r;
-+#else
-+	struct sshbuf *buf = NULL;
-+	const u_char *ciphertext, *server_pub;
-+	u_char hash[SSH_DIGEST_MAX_LENGTH];
-+	u_char decap[crypto_kem_mlkem768_BYTES];
-+	size_t need;
-+	int r;
-+
-+	*shared_secretp = NULL;
-+
-+	need = crypto_kem_mlkem768_CIPHERTEXTBYTES + CURVE25519_SIZE;
-+	if (sshbuf_len(server_blob) != need) {
-+		r = SSH_ERR_SIGNATURE_INVALID;
-+		goto out;
-+	}
-+	ciphertext = sshbuf_ptr(server_blob);
-+	server_pub = ciphertext + crypto_kem_mlkem768_CIPHERTEXTBYTES;
-+	/* hash concatenation of KEM key and ECDH shared key */
-+	if ((buf = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("server cipher text:", ciphertext, crypto_kem_mlkem768_CIPHERTEXTBYTES);
-+	dump_digest("server public key c25519:", server_pub, CURVE25519_SIZE);
-+#endif
-+	if ((r = mlkem768_decap_secret(kex->mlkem768_client_key, ciphertext, decap)) != 0)
-+		goto out;
-+	if ((r = sshbuf_put(buf, decap, sizeof(decap))) != 0)
-+		goto out;
-+	if ((r = kexc25519_shared_key_ext(kex->c25519_client_key, server_pub,
-+	    buf, 1)) < 0)
-+		goto out;
-+	if ((r = ssh_digest_buffer(kex->hash_alg, buf,
-+	    hash, sizeof(hash))) != 0)
-+		goto out;
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("client kem key:", decap, sizeof(decap));
-+	dump_digest("concatenation of KEM key and ECDH shared key:",
-+	    sshbuf_ptr(buf), sshbuf_len(buf));
-+#endif
-+	sshbuf_reset(buf);
-+	if ((r = sshbuf_put_string(buf, hash,
-+	    ssh_digest_bytes(kex->hash_alg))) != 0)
-+		goto out;
-+#ifdef DEBUG_KEXECDH
-+	dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
-+#endif
-+	/* success */
-+	r = 0;
-+	*shared_secretp = buf;
-+	buf = NULL;
-+ out:
-+	explicit_bzero(hash, sizeof(hash));
-+	explicit_bzero(decap, sizeof(decap));
-+	sshbuf_free(buf);
-+	return r;
-+#endif
- }
- #else /* USE_MLKEM768X25519 */
- int
-- 
-2.49.0
-
--- a/0050-openssh-9.9p2-error_processing.patch
+++ b/0050-openssh-9.9p2-error_processing.patch
@ -1,25 +0,0 @@
-From fd32e753ae7f3b314712e6aa8b2bed3c1fca1ef5 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Fri, 16 May 2025 14:53:54 +0200
-Subject: [PATCH 50/51] openssh-9.9p2-error_processing
-
---
- ssh-agent.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/ssh-agent.c b/ssh-agent.c
-index 798bf9b6..dfb6ac72 100644
--- a/ssh-agent.c
-+++ b/ssh-agent.c
-@@ -1377,6 +1377,8 @@ process_add_identity(SocketEntry *e)
- 	if ((r = sshkey_private_deserialize(e->request, &k)) != 0 ||
- 	    k == NULL ||
- 	    (r = sshbuf_get_cstring(e->request, &comment, NULL)) != 0) {
-+		if (!r) /* k == NULL */
-+			r = SSH_ERR_INTERNAL_ERROR;
- 		error_fr(r, "parse");
- 		goto out;
- 	}
-- 
-2.49.0
-
--- a/0051-Provide-better-error-for-non-supported-private-keys.patch
+++ b/0051-Provide-better-error-for-non-supported-private-keys.patch
@ -1,27 +0,0 @@
-From 4965cdbc1ee1e6a0c665797bb8b944d96d3d411f Mon Sep 17 00:00:00 2001
-From: Zoltan Fridrich <zfridric@redhat.com>
-Date: Wed, 16 Apr 2025 15:11:59 +0200
-Subject: [PATCH 51/53] Provide better error for non-supported private keys
-
-Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
- sshkey.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/sshkey.c b/sshkey.c
-index ca1cdb642..aada474e0 100644
--- a/sshkey.c
-+++ b/sshkey.c
-@@ -3582,6 +3582,9 @@ translate_libcrypto_error(unsigned long pem_err)
- 			return SSH_ERR_LIBCRYPTO_ERROR;
- 		}
- 	case ERR_LIB_ASN1:
-+#ifdef ERR_LIB_OSSL_DECODER
-+	case ERR_LIB_OSSL_DECODER:
-+#endif
- 		return SSH_ERR_INVALID_FORMAT;
- 	}
- 	return SSH_ERR_LIBCRYPTO_ERROR;
-- 
-2.49.0
-
--- a/0052-Ignore-bad-hostkeys-in-known_hosts-file.patch
+++ b/0052-Ignore-bad-hostkeys-in-known_hosts-file.patch
@ -1,86 +0,0 @@
-From 9ed09ef158a113e21be7b3fefa7c5f932632749b Mon Sep 17 00:00:00 2001
-From: Zoltan Fridrich <zfridric@redhat.com>
-Date: Mon, 5 May 2025 11:52:25 +0200
-Subject: [PATCH 52/53] Ignore bad hostkeys in known_hosts file
-
-Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
- hostfile.c | 15 +++++++++++++++
- hostfile.h |  1 +
- ssh.c      |  2 ++
- 3 files changed, 18 insertions(+)
-
-diff --git a/hostfile.c b/hostfile.c
-index c5669c703..5c402f501 100644
--- a/hostfile.c
-+++ b/hostfile.c
-@@ -63,6 +63,14 @@
- #include "hmac.h"
- #include "sshbuf.h"
- 
-+static int required_rsa_size = SSH_RSA_MINIMUM_MODULUS_SIZE;
-+
-+void
-+hostfile_set_minimum_rsa_size(int size)
-+{
-+	required_rsa_size = size;
-+}
-+
- /* XXX hmac is too easy to dictionary attack; use bcrypt? */
- 
- static int
-@@ -233,6 +241,7 @@ record_hostkey(struct hostkey_foreach_line *l, void *_ctx)
- 	struct load_callback_ctx *ctx = (struct load_callback_ctx *)_ctx;
- 	struct hostkeys *hostkeys = ctx->hostkeys;
- 	struct hostkey_entry *tmp;
-+	int r = 0;
- 
- 	if (l->status == HKF_STATUS_INVALID) {
- 		/* XXX make this verbose() in the future */
-@@ -241,6 +250,12 @@ record_hostkey(struct hostkey_foreach_line *l, void *_ctx)
- 		return 0;
- 	}
- 
-+	if ((r = sshkey_check_rsa_length(l->key, required_rsa_size)) != 0) {
-+		debug2_f("%s:%ld: ignoring hostkey: %s",
-+		    l->path, l->linenum, ssh_err(r));
-+		return 0;
-+	}
-+
- 	debug3_f("found %skey type %s in file %s:%lu",
- 	    l->marker == MRK_NONE ? "" :
- 	    (l->marker == MRK_CA ? "ca " : "revoked "),
-diff --git a/hostfile.h b/hostfile.h
-index a24a4e329..0e9b1a19a 100644
--- a/hostfile.h
-+++ b/hostfile.h
-@@ -119,5 +119,6 @@ int hostkeys_foreach_file(const char *path, FILE *f,
-     const char *host, const char *ip, u_int options, u_int note);
- 
- void hostfile_create_user_ssh_dir(const char *, int);
-+void hostfile_set_minimum_rsa_size(int);
- 
- #endif
-diff --git a/ssh.c b/ssh.c
-index abc8b8439..33787a8d4 100644
--- a/ssh.c
-+++ b/ssh.c
-@@ -110,6 +110,7 @@
- #include "ssherr.h"
- #include "myproposal.h"
- #include "utf8.h"
-+#include "hostfile.h"
- 
- #ifdef ENABLE_PKCS11
- #include "ssh-pkcs11.h"
-@@ -1397,6 +1398,7 @@ main(int ac, char **av)
- 			options.update_hostkeys = 0;
- 		}
- 	}
-+	hostfile_set_minimum_rsa_size(options.required_rsa_size);
- 	if (options.connection_attempts <= 0)
- 		fatal("Invalid number of ConnectionAttempts");
- 
-- 
-2.49.0
-
--- a/0053-support-authentication-indicators-in-GSSAPI.patch
+++ b/0053-support-authentication-indicators-in-GSSAPI.patch
@ -1,450 +0,0 @@
-From 5d5a66e96ad03132f65371070f4fa475f10207d9 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Mon, 10 Jun 2024 23:00:03 +0300
-Subject: [PATCH] support authentication indicators in GSSAPI
-
-RFC 6680 defines a set of GSSAPI extensions to handle attributes
-associated with the GSSAPI names. MIT Kerberos and FreeIPA use
-name attributes to add information about pre-authentication methods used
-to acquire the initial Kerberos ticket. The attribute 'auth-indicators'
-may contain list of strings that KDC has associated with the ticket
-issuance process.
-
-Use authentication indicators to authorise or deny access to SSH server.
-GSSAPIIndicators setting allows to specify a list of possible indicators
-that a Kerberos ticket presented must or must not contain. More details
-on the syntax are provided in sshd_config(5) man page.
-
-Fixes: https://bugzilla.mindrot.org/show_bug.cgi?id=2696
-
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
- configure.ac    |   1 +
- gss-serv-krb5.c |  64 +++++++++++++++++++++++++++---
- gss-serv.c      | 103 +++++++++++++++++++++++++++++++++++++++++++++++-
- servconf.c      |  15 ++++++-
- servconf.h      |   2 +
- ssh-gss.h       |   7 ++++
- sshd_config.5   |  44 +++++++++++++++++++++
- 7 files changed, 228 insertions(+), 8 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index d92a85809..2cbe20bf3 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -5004,6 +5004,7 @@ AC_ARG_WITH([kerberos5],
- 		AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
- 		AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
- 		AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
-+		AC_CHECK_HEADERS([gssapi_ext.h gssapi/gssapi_ext.h])
- 
- 		AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
- 			[Define this if you want to use libkafs' AFS support])])
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 03188d9b3..2c786ef14 100644
--- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -43,6 +43,7 @@
- #include "log.h"
- #include "misc.h"
- #include "servconf.h"
-+#include "match.h"
- 
- #include "ssh-gss.h"
- 
-@@ -87,6 +88,32 @@ ssh_gssapi_krb5_init(void)
- 	return 1;
- }
- 
-+/* Check if any of the indicators in the Kerberos ticket match
-+ * one of indicators in the list of allowed/denied rules.
-+ * In case of the match, apply the decision from the rule.
-+ * In case of no indicator from the ticket matching the rule, deny
-+ */
-+
-+static int
-+ssh_gssapi_check_indicators(ssh_gssapi_client *client, int *matched)
-+{
-+	int ret;
-+	u_int i;
-+
-+	/* Check indicators */
-+	for (i = 0; client->indicators[i] != NULL; i++) {
-+		ret = match_pattern_list(client->indicators[i],
-+					 options.gss_indicators, 1);
-+		/* negative or positive match */
-+		if (ret != 0) {
-+			*matched = i;
-+			return ret;
-+		}
-+	}
-+	/* No rule matched */
-+	return 0;
-+}
-+
- /* Check if this user is OK to login. This only works with krb5 - other
-  * GSSAPI mechanisms will need their own.
-  * Returns true if the user is OK to log in, otherwise returns 0
-@@ -193,7 +220,7 @@ static int
- ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
- {
- 	krb5_principal princ;
-	int retval;
-+	int retval, matched;
- 	const char *errmsg;
- 	int k5login_exists;
- 
-@@ -216,17 +243,42 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
- 	if (k5login_exists &&
- 	    ssh_krb5_kuserok(krb_context, princ, name, k5login_exists)) {
- 		retval = 1;
-		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
-		    name, (char *)client->displayname.value);
-+	    errmsg = "krb5_kuserok";
- 	} else if (ssh_gssapi_krb5_cmdok(princ, client->exportedname.value,
- 		name, k5login_exists)) {
- 		retval = 1;
-		logit("Authorized to %s, krb5 principal %s "
-		    "(ssh_gssapi_krb5_cmdok)",
-		    name, (char *)client->displayname.value);
-+		errmsg = "ssh_gssapi_krb5_cmdok";
- 	} else
- 		retval = 0;
- 
-+	if ((retval == 1) && (options.gss_indicators != NULL)) {
-+		/* At this point the configuration enforces presence of indicators
-+		 * so we drop the authorization result again */
-+		retval = 0;
-+		if (client->indicators) {
-+			matched = -1;
-+			retval = ssh_gssapi_check_indicators(client, &matched);
-+			if (retval != 0) {
-+				retval = (retval == 1);
-+				logit("Ticket contains indicator %s, "
-+					"krb5 principal %s is %s",
-+					client->indicators[matched],
-+					(char *)client->displayname.value,
-+				        retval ? "allowed" : "denied");
-+				goto cont;
-+			}
-+		}
-+		if (retval == 0) {
-+			logit("GSSAPI authentication indicators enforced "
-+				"but not matched. krb5 principal %s denied",
-+			(char *)client->displayname.value);
-+		}
-+	}
-+cont:
-+	if (retval == 1) {
-+		logit("Authorized to %s, krb5 principal %s (%s)",
-+		    name, (char *)client->displayname.value, errmsg);
-+	}
- 	krb5_free_principal(krb_context, princ);
- 	return retval;
- }
-diff --git a/gss-serv.c b/gss-serv.c
-index 9d5435eda..5c0491cf1 100644
--- a/gss-serv.c
-+++ b/gss-serv.c
-@@ -54,7 +54,7 @@ extern ServerOptions options;
- 
- static ssh_gssapi_client gssapi_client =
-     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
-    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
-+    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0, NULL};
- 
- ssh_gssapi_mech gssapi_null_mech =
-     { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
-@@ -296,6 +296,92 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
- 	return GSS_S_COMPLETE;
- }
- 
-+
-+/* Extract authentication indicators from the Kerberos ticket. Authentication
-+ * indicators are GSSAPI name attributes for the name "auth-indicators".
-+ * Multiple indicators might be present in the ticket.
-+ * Each indicator is a utf8 string. */
-+
-+#define AUTH_INDICATORS_TAG "auth-indicators"
-+
-+/* Privileged (called from accept_secure_ctx) */
-+static OM_uint32
-+ssh_gssapi_getindicators(Gssctxt *ctx, gss_name_t gss_name, ssh_gssapi_client *client)
-+{
-+	gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET;
-+	gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
-+	gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
-+	int is_mechname, authenticated, complete, more;
-+	size_t count, i;
-+
-+	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
-+				      &is_mechname, NULL, &attrs);
-+	if (ctx->major != GSS_S_COMPLETE) {
-+		return (ctx->major);
-+	}
-+
-+	if (attrs == GSS_C_NO_BUFFER_SET) {
-+		/* No indicators in the ticket */
-+		return (0);
-+	}
-+
-+	count = 0;
-+	for (i = 0; i < attrs->count; i++) {
-+		/* skip anything but auth-indicators */
-+		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    strncmp(AUTH_INDICATORS_TAG,
-+			    attrs->elements[i].value,
-+			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
-+			continue;
-+		count++;
-+	}
-+
-+	if (count == 0) {
-+		/* No auth-indicators in the ticket */
-+		(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+		return (0);
-+	}
-+
-+	client->indicators = recallocarray(NULL, 0, count + 1, sizeof(char*));
-+	count = 0;
-+	for (i = 0; i < attrs->count; i++) {
-+		authenticated = 0;
-+		complete = 0;
-+		more = -1;
-+		/* skip anything but auth-indicators */
-+		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    strncmp(AUTH_INDICATORS_TAG,
-+			    attrs->elements[i].value,
-+			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
-+			continue;
-+		/* retrieve all indicators */
-+		while (more != 0) {
-+			value.value = NULL;
-+			display_value.value = NULL;
-+			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
-+					&attrs->elements[i], &authenticated,
-+					&complete, &value, &display_value, &more);
-+			if (ctx->major != GSS_S_COMPLETE) {
-+				goto out;
-+			}
-+
-+			if ((value.value != NULL) && authenticated) {
-+				client->indicators[count] = xmalloc(value.length + 1);
-+				memcpy(client->indicators[count], value.value, value.length);
-+				client->indicators[count][value.length] = '\0';
-+				count++;
-+			}
-+		}
-+	}
-+
-+out:
-+	(void) gss_release_buffer(&ctx->minor, &value);
-+	(void) gss_release_buffer(&ctx->minor, &display_value);
-+	(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+	return (ctx->major);
-+}
-+
-+
- /* Extract the client details from a given context. This can only reliably
-  * be called once for a context */
- 
-@@ -385,6 +471,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- 	}
- 
- 	gss_release_buffer(&ctx->minor, &ename);
-+	/* Retrieve authentication indicators, if they exist */
-+	if ((ctx->major = ssh_gssapi_getindicators(ctx,
-+	    ctx->client, client))) {
-+		ssh_gssapi_error(ctx);
-+		return (ctx->major);
-+	}
- 
- 	/* We can't copy this structure, so we just move the pointer to it */
- 	client->creds = ctx->client_creds;
-@@ -447,6 +539,7 @@ int
- ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
- {
- 	OM_uint32 lmin;
-+	size_t i;
- 
- 	(void) kex; /* used in privilege separation */
- 
-@@ -465,6 +558,14 @@ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
- 			gss_release_buffer(&lmin, &gssapi_client.displayname);
- 			gss_release_buffer(&lmin, &gssapi_client.exportedname);
- 			gss_release_cred(&lmin, &gssapi_client.creds);
-+
-+			if (gssapi_client.indicators != NULL) {
-+				for(i = 0; gssapi_client.indicators[i] != NULL; i++) {
-+					free(gssapi_client.indicators[i]);
-+				}
-+				free(gssapi_client.indicators);
-+			}
-+
- 			explicit_bzero(&gssapi_client,
- 			    sizeof(ssh_gssapi_client));
- 			return 0;
-diff --git a/servconf.c b/servconf.c
-index e7e4ad046..aab653244 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -147,6 +147,7 @@ initialize_server_options(ServerOptions *options)
- 	options->gss_strict_acceptor = -1;
- 	options->gss_store_rekey = -1;
- 	options->gss_kex_algorithms = NULL;
-+	options->gss_indicators = NULL;
- 	options->use_kuserok = -1;
- 	options->enable_k5users = -1;
- 	options->password_authentication = -1;
-@@ -598,7 +599,7 @@ typedef enum {
- 	sPerSourcePenalties, sPerSourcePenaltyExemptList,
- 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
- 	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
-	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
-+	sGssKeyEx, sGssIndicators, sGssKexAlgorithms, sGssStoreRekey,
- 	sAcceptEnv, sSetEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
- 	sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -694,6 +695,7 @@ static struct {
- 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
- 	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
- 	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
-+	{ "gssapiindicators", sGssIndicators, SSHCFG_ALL },
- #else
- 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
- 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
-@@ -703,6 +705,7 @@ static struct {
- 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
-+	{ "gssapiindicators", sUnsupported, SSHCFG_ALL },
- #endif
- 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
-@@ -1730,6 +1733,15 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- 			options->gss_kex_algorithms = xstrdup(arg);
- 		break;
- 
-+	case sGssIndicators:
-+		arg = argv_next(&ac, &av);
-+		if (!arg || *arg == '\0')
-+			fatal("%s line %d: %s missing argument.",
-+			    filename, linenum, keyword);
-+		if (options->gss_indicators == NULL)
-+			options->gss_indicators = xstrdup(arg);
-+		break;
-+
- 	case sPasswordAuthentication:
- 		intptr = &options->password_authentication;
- 		goto parse_flag;
-@@ -3351,6 +3363,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
- 	dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
- 	dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
-+	dump_cfg_string(sGssIndicators, o->gss_indicators);
- #endif
- 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
- 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
-diff --git a/servconf.h b/servconf.h
-index 7c7e5d434..7c41df417 100644
--- a/servconf.h
-+++ b/servconf.h
-@@ -181,6 +181,7 @@ typedef struct {
- 	char   **allow_groups;
- 	u_int num_deny_groups;
- 	char   **deny_groups;
-+	char   *gss_indicators;
- 
- 	u_int num_subsystems;
- 	char   **subsystem_name;
-@@ -310,6 +311,7 @@ TAILQ_HEAD(include_list, include_item);
- 		M_CP_STROPT(routing_domain); \
- 		M_CP_STROPT(permit_user_env_allowlist); \
- 		M_CP_STROPT(pam_service_name); \
-+		M_CP_STROPT(gss_indicators); \
- 		M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
- 		M_CP_STRARRAYOPT(allow_users, num_allow_users); \
- 		M_CP_STRARRAYOPT(deny_users, num_deny_users); \
-diff --git a/ssh-gss.h b/ssh-gss.h
-index a894e23c9..59cf46d47 100644
--- a/ssh-gss.h
-+++ b/ssh-gss.h
-@@ -34,6 +34,12 @@
- #include <gssapi/gssapi.h>
- #endif
- 
-+#ifdef HAVE_GSSAPI_EXT_H
-+#include <gssapi_ext.h>
-+#elif defined(HAVE_GSSAPI_GSSAPI_EXT_H)
-+#include <gssapi/gssapi_ext.h>
-+#endif
-+
- #ifdef KRB5
- # ifndef HEIMDAL
- #  ifdef HAVE_GSSAPI_GENERIC_H
-@@ -107,6 +113,7 @@ typedef struct {
- 	ssh_gssapi_ccache store;
- 	int used;
- 	int updated;
-+	char **indicators; /* auth indicators */
- } ssh_gssapi_client;
- 
- typedef struct ssh_gssapi_mech_struct {
-diff --git a/sshd_config.5 b/sshd_config.5
-index 583a01cdb..90ab87edd 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -785,6 +785,50 @@ gss-nistp256-sha256-
- gss-curve25519-sha256-
- .Ed
- This option only applies to connections using GSSAPI.
-+.It Cm GSSAPIIndicators
-+Specifies whether to accept or deny GSSAPI authenticated access if Kerberos
-+mechanism is used and Kerberos ticket contains a particular set of
-+authentication indicators. The values can be specified as a comma-separated list
-+.Cm [!]name1,[!]name2,... .
-+When indicator's name is prefixed with !, the authentication indicator 'name'
-+will deny access to the system. Otherwise, one of non-negated authentication
-+indicators must be present in the Kerberos ticket to allow access. If
-+.Cm GSSAPIIndicators
-+is defined, a Kerberos ticket that has indicators but does not match the
-+policy will get denial. If at least one indicator is configured, whether for
-+access or denial, tickets without authentication indicators will be explicitly
-+rejected.
-+.Pp
-+By default systems using MIT Kerberos 1.17 or later will not assign any
-+indicators. SPAKE and PKINIT methods add authentication indicators
-+to all successful authentications. The SPAKE pre-authentication method is
-+preferred over an encrypted timestamp pre-authentication when passwords used to
-+authenticate user principals. Kerberos KDCs built with Heimdal Kerberos
-+(including Samba AD DC built with Heimdal) do not add authentication
-+indicators. However, OpenSSH built against Heimdal Kerberos library is able to
-+inquire authentication indicators and thus can be used to check for their presence.
-+.Pp
-+Indicator name is case-sensitive and depends on the configuration of a
-+particular Kerberos deployment. Indicators available in MIT Kerberos and
-+FreeIPA environments:
-+.Pp
-+.Bl -tag -width XXXX -offset indent -compact
-+.It Cm hardened
-+SPAKE or encrypted timestamp pre-authentication mechanisms in MIT Kerberos and FreeIPA
-+.It Cm pkinit
-+smartcard or PKCS11 token-based pre-authentication in MIT Kerberos and FreeIPA
-+.It Cm radius
-+pre-authentication based on a RADIUS server in MIT Kerberos and FreeIPA
-+.It Cm otp
-+TOTP/HOTP-based two-factor pre-authentication in FreeIPA
-+.It Cm idp
-+OAuth2-based pre-authentication in FreeIPA using an external identity provider
-+and device authorization grant flow
-+.It Cm passkey
-+FIDO2-based pre-authentication in FreeIPA, using FIDO2 USB and NFC tokens
-+.El
-+.Pp
-+The default is to not use GSSAPI authentication indicators for access decisions.
- .It Cm HostbasedAcceptedAlgorithms
- The default is handled system-wide by
- .Xr crypto-policies 7 .
-- 
-2.49.0
-
--- a/1000-openssh-coverity.patch
+++ b/1000-openssh-coverity.patch
@ -1,257 +0,0 @@
-From 24c411970682dc67873c36bac05b4b460d68a628 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 50/50] openssh-6.7p1-coverity
-
---
- auth-krb5.c                   | 2 ++
- gss-genr.c                    | 3 ++-
- krl.c                         | 3 +++
- loginrec.c                    | 2 ++
- misc.c                        | 3 +++
- monitor.c                     | 4 ++--
- openbsd-compat/bindresvport.c | 2 +-
- openbsd-compat/bsd-pselect.c  | 8 ++++----
- readconf.c                    | 1 +
- servconf.c                    | 5 +++--
- serverloop.c                  | 2 +-
- ssh-agent.c                   | 1 +
- ssh-keygen.c                  | 3 +++
- 13 files changed, 28 insertions(+), 11 deletions(-)
-
-diff --git a/auth-krb5.c b/auth-krb5.c
-index bae153c9..209a3265 100644
--- a/auth-krb5.c
-+++ b/auth-krb5.c
-@@ -427,6 +427,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
- 		umask(old_umask);
- 		if (tmpfd == -1) {
- 			logit("mkstemp(): %.100s", strerror(oerrno));
-+			free(ccname);
- 			return oerrno;
- 		}
- 
-@@ -434,6 +435,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
- 			oerrno = errno;
- 			logit("fchmod(): %.100s", strerror(oerrno));
- 			close(tmpfd);
-+			free(ccname);
- 			return oerrno;
- 		}
- 		/* make sure the KRB5CCNAME is set for non-standard location */
-diff --git a/gss-genr.c b/gss-genr.c
-index 3034370c..c357e973 100644
--- a/gss-genr.c
-+++ b/gss-genr.c
-@@ -168,8 +168,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
- 			enclen = __b64_ntop(digest,
- 			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
- 			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
-
-+#pragma GCC diagnostic ignored "-Wstringop-overflow"
- 			cp = strncpy(s, kex, strlen(kex));
-+#pragma GCC diagnostic pop
- 			for ((p = strsep(&cp, ",")); p && *p != '\0';
- 				(p = strsep(&cp, ","))) {
- 				if (sshbuf_len(buf) != 0 &&
-diff --git a/krl.c b/krl.c
-index 0d0f6953..d8517f12 100644
--- a/krl.c
-+++ b/krl.c
-@@ -1202,6 +1202,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
- 		return r;
- 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
- 	free(rb.blob);
-+	rb.blob = NULL; /* make coverity happy */
- 	if (erb != NULL) {
- 		KRL_DBG(("revoked by key SHA1"));
- 		return SSH_ERR_KEY_REVOKED;
-@@ -1212,6 +1213,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
- 		return r;
- 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
- 	free(rb.blob);
-+	rb.blob = NULL; /* make coverity happy */
- 	if (erb != NULL) {
- 		KRL_DBG(("revoked by key SHA256"));
- 		return SSH_ERR_KEY_REVOKED;
-@@ -1223,6 +1225,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
- 		return r;
- 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
- 	free(rb.blob);
-+	rb.blob = NULL; /* make coverity happy */
- 	if (erb != NULL) {
- 		KRL_DBG(("revoked by explicit key"));
- 		return SSH_ERR_KEY_REVOKED;
-diff --git a/loginrec.c b/loginrec.c
-index c4a9bd48..2583612c 100644
--- a/loginrec.c
-+++ b/loginrec.c
-@@ -683,9 +683,11 @@ construct_utmp(struct logininfo *li,
- 	 */
- 
- 	/* Use strncpy because we don't necessarily want null termination */
-+	/* coverity[buffer_size_warning : FALSE] */
- 	strncpy(ut->ut_name, li->username,
- 	    MIN_SIZEOF(ut->ut_name, li->username));
- # ifdef HAVE_HOST_IN_UTMP
-+	/* coverity[buffer_size_warning : FALSE] */
- 	strncpy(ut->ut_host, li->hostname,
- 	    MIN_SIZEOF(ut->ut_host, li->hostname));
- # endif
-diff --git a/misc.c b/misc.c
-index 09722962..cd71c1b2 100644
--- a/misc.c
-+++ b/misc.c
-@@ -1556,6 +1556,8 @@ sanitise_stdfd(void)
- 	}
- 	if (nullfd > STDERR_FILENO)
- 		close(nullfd);
-+	/* coverity[leaked_handle : FALSE]*/
-+	/* coverity[leaked_handle : FALSE]*/
- }
- 
- char *
-@@ -2749,6 +2751,7 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
- 	}
- 	if (devnull > STDERR_FILENO)
- 		close(devnull);
-+	/* coverity[leaked_handle : FALSE]*/
- 	return ret;
- }
- 
-diff --git a/monitor.c b/monitor.c
-index 19cb058e..58fbac9d 100644
--- a/monitor.c
-+++ b/monitor.c
-@@ -415,7 +415,7 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
- 	mm_get_keystate(ssh, pmonitor);
- 
- 	/* Drain any buffered messages from the child */
-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
- 		;
- 
- 	if (pmonitor->m_recvfd >= 0)
-@@ -1813,7 +1813,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
- 	s->ptymaster = s->ptyfd;
- 
- 	debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
-
-+	/* coverity[leaked_handle : FALSE] */
- 	return (0);
- 
-  error:
-diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c
-index 346c7fe5..f42792fd 100644
--- a/openbsd-compat/bindresvport.c
-+++ b/openbsd-compat/bindresvport.c
-@@ -59,7 +59,7 @@ bindresvport_sa(int sd, struct sockaddr *sa)
- 	struct sockaddr_in6 *in6;
- 	u_int16_t *portp;
- 	u_int16_t port;
-	socklen_t salen;
-+	socklen_t salen = sizeof(struct sockaddr_storage);
- 	int i;
- 
- 	if (sa == NULL) {
-diff --git a/openbsd-compat/bsd-pselect.c b/openbsd-compat/bsd-pselect.c
-index 26bdc3e0..8e2939b9 100644
--- a/openbsd-compat/bsd-pselect.c
-+++ b/openbsd-compat/bsd-pselect.c
-@@ -85,13 +85,13 @@ pselect_notify_setup(void)
- static void
- pselect_notify_parent(void)
- {
-	if (notify_pipe[1] != -1)
-+	if (notify_pipe[1] >= 0)
- 		(void)write(notify_pipe[1], "", 1);
- }
- static void
- pselect_notify_prepare(fd_set *readset)
- {
-	if (notify_pipe[0] != -1)
-+	if (notify_pipe[0] >= 0)
- 		FD_SET(notify_pipe[0], readset);
- }
- static void
-@@ -99,8 +99,8 @@ pselect_notify_done(fd_set *readset)
- {
- 	char c;
- 
-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
-		while (read(notify_pipe[0], &c, 1) != -1)
-+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
-+		while (read(notify_pipe[0], &c, 1) >= 0)
- 			debug2_f("reading");
- 		FD_CLR(notify_pipe[0], readset);
- 	}
-diff --git a/readconf.c b/readconf.c
-index ea9d293c..9680c38c 100644
--- a/readconf.c
-+++ b/readconf.c
-@@ -2164,6 +2164,7 @@ parse_pubkey_algos:
- 			} else if (r != 0) {
- 				error("%.200s line %d: glob failed for %s.",
- 				    filename, linenum, arg2);
-+				free(arg2);
- 				goto out;
- 			}
- 			free(arg2);
-diff --git a/servconf.c b/servconf.c
-index 8b708cbf..e7e4ad04 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -2293,8 +2293,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- 		if (*activep && *charptr == NULL) {
- 			*charptr = tilde_expand_filename(arg, getuid());
- 			/* increase optional counter */
-			if (intptr != NULL)
-				*intptr = *intptr + 1;
-+			/* DEAD CODE intptr is still NULL ;)
-+  			 if (intptr != NULL)
-+				*intptr = *intptr + 1; */
- 		}
- 		break;
- 
-diff --git a/serverloop.c b/serverloop.c
-index 9c5b1567..768ee9fa 100644
--- a/serverloop.c
-+++ b/serverloop.c
-@@ -511,7 +511,7 @@ server_request_tun(struct ssh *ssh)
- 		debug_f("invalid tun");
- 		goto done;
- 	}
-	if (auth_opts->force_tun_device != -1) {
-+	if (auth_opts->force_tun_device >= 0) {
- 		if (tun != SSH_TUNID_ANY &&
- 		    auth_opts->force_tun_device != (int)tun)
- 			goto done;
-diff --git a/ssh-agent.c b/ssh-agent.c
-index 798bf9b6..0e39dff7 100644
--- a/ssh-agent.c
-+++ b/ssh-agent.c
-@@ -1593,6 +1593,7 @@ sanitize_pkcs11_provider(const char *provider)
- 
- 		if (pkcs11_uri_parse(provider, uri) != 0) {
- 			error("Failed to parse PKCS#11 URI");
-+			pkcs11_uri_cleanup(uri);
- 			return NULL;
- 		}
- 		/* validate also provider from URI */
-diff --git a/ssh-keygen.c b/ssh-keygen.c
-index 792aafde..96b3474d 100644
--- a/ssh-keygen.c
-+++ b/ssh-keygen.c
-@@ -2424,6 +2424,9 @@ update_krl_from_file(struct passwd *pw, const char *file, int wild_ca,
- 			r = ssh_krl_revoke_key_sha256(krl, blob, blen);
- 			if (r != 0)
- 				fatal_fr(r, "revoke key failed");
-+			freezero(blob, blen);
-+			blob = NULL;
-+			blen = 0;
- 		} else {
- 			if (strncasecmp(cp, "key:", 4) == 0) {
- 				cp += 4;
-- 
-2.49.0
-
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@ -23,12 +23,13 @@
 # Do we want libedit support
 %global libedit 1

-%global openssh_ver 10.0p1
+%global openssh_ver 9.9p1
+%global openssh_rel 3

 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
 Version: %{openssh_ver}
-Release: 4%{?dist}
+Release: %{openssh_rel}%{?dist}
 Provides: gsissh = %{version}-%{release}
 Obsoletes: gsissh < 5.8p2-2
 URL: http://www.openssh.com/portable.html
@ -48,150 +49,164 @@ Source20: gsissh-host-keys-migration.sh
 Source21: gsissh-host-keys-migration.service
 Source99: README.sshd-and-gsisshd

+#https://bugzilla.mindrot.org/show_bug.cgi?id=2581
+Patch100: openssh-6.7p1-coverity.patch
+
+#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
+# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
+# record pfs= field in CRYPTO_SESSION audit event
+Patch200: openssh-7.6p1-audit.patch
+# Audit race condition in forked child (#1310684)
+Patch201: openssh-7.1p2-audit-race-condition.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2049947
+Patch202: openssh-9.0p1-audit-log.patch
+
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
-Patch0001: 0001-openssh-7.8p1-role-mls.patch
+Patch400: openssh-7.8p1-role-mls.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=781634
-Patch0002: 0002-openssh-6.6p1-privsep-selinux.patch
-Patch0003: 0003-openssh-6.6p1-keycat.patch
+Patch404: openssh-6.6p1-privsep-selinux.patch
+#?
+Patch502: openssh-6.6p1-keycat.patch
+
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1644
-Patch0004: 0004-openssh-6.6p1-allow-ip-opts.patch
+Patch601: openssh-6.6p1-allow-ip-opts.patch
 #(drop?) https://bugzilla.mindrot.org/show_bug.cgi?id=1925
-Patch0005: 0005-openssh-5.9p1-ipv6man.patch
-Patch0006: 0006-openssh-5.8p2-sigpipe.patch
+Patch606: openssh-5.9p1-ipv6man.patch
+#?
+Patch607: openssh-5.8p2-sigpipe.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1789
-Patch0007: 0007-openssh-7.2p2-x11.patch
-Patch0008: 0008-openssh-5.1p1-askpass-progress.patch
+Patch609: openssh-7.2p2-x11.patch
+
+#?
+Patch700: openssh-7.7p1-fips.patch
+#?
+Patch702: openssh-5.1p1-askpass-progress.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=198332
-Patch0009: 0009-openssh-4.3p2-askpass-grab-info.patch
+Patch703: openssh-4.3p2-askpass-grab-info.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
-Patch0010: 0010-openssh-8.7p1-redhat.patch
+Patch707: openssh-7.7p1-redhat.patch
 # warn users for unsupported UsePAM=no (#757545)
-Patch0011: 0011-openssh-7.8p1-UsePAM-warning.patch
+Patch711: openssh-7.8p1-UsePAM-warning.patch
+
 # GSSAPI Key Exchange (RFC 4462 + RFC 8732)
 # from https://github.com/openssh-gsskex/openssh-gsskex/tree/fedora/master
 # and
 # Reenable MONITOR_REQ_GSSCHECKMIC after gssapi-with-mic failures
 # upstream MR:
 # https://github.com/openssh-gsskex/openssh-gsskex/pull/21
-Patch0012: 0012-openssh-9.6p1-gssapi-keyex.patch
+Patch800: openssh-9.6p1-gssapi-keyex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
-Patch0013: 0013-openssh-6.6p1-force_krb.patch
-# Improve ccache handling in openssh (#991186, #1199363, #1566494)
-# https://bugzilla.mindrot.org/show_bug.cgi?id=2775
-Patch0014: 0014-openssh-7.7p1-gssapi-new-unique.patch
-# Respect k5login_directory option in krk5.conf (#1328243)
-Patch0015: 0015-openssh-7.2p2-k5login_directory.patch
-#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
-Patch0016: 0016-openssh-6.6p1-kuserok.patch
-# Use tty allocation for a remote scp (#985650)
-Patch0017: 0017-openssh-6.4p1-fromto-remote.patch
-# privsep_preauth: use SELinux context from selinux-policy (#1008580)
-Patch0018: 0018-openssh-6.6.1p1-selinux-contexts.patch
-# log via monitor in chroots without /dev/log (#2681)
-Patch0019: 0019-openssh-6.6.1p1-log-in-chroot.patch
-# scp file into non-existing directory (#1142223)
-Patch0020: 0020-openssh-6.6.1p1-scp-non-existing-directory.patch
+Patch801: openssh-6.6p1-force_krb.patch
 # add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
 # CVE-2014-9278
-Patch0021: 0021-openssh-6.6p1-GSSAPIEnablek5users.patch
+Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch
+# Improve ccache handling in openssh (#991186, #1199363, #1566494)
+# https://bugzilla.mindrot.org/show_bug.cgi?id=2775
+Patch804: openssh-7.7p1-gssapi-new-unique.patch
+# Respect k5login_directory option in krk5.conf (#1328243)
+Patch805: openssh-7.2p2-k5login_directory.patch
+
+#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
+Patch901: openssh-6.6p1-kuserok.patch
+# Use tty allocation for a remote scp (#985650)
+Patch906: openssh-6.4p1-fromto-remote.patch
+# privsep_preauth: use SELinux context from selinux-policy (#1008580)
+Patch916: openssh-6.6.1p1-selinux-contexts.patch
+# log via monitor in chroots without /dev/log (#2681)
+Patch918: openssh-6.6.1p1-log-in-chroot.patch
+# scp file into non-existing directory (#1142223)
+Patch919: openssh-6.6.1p1-scp-non-existing-directory.patch
 # apply upstream patch and make sshd -T more consistent (#1187521)
-Patch0022: 0022-openssh-6.8p1-sshdT-output.patch
+Patch922: openssh-6.8p1-sshdT-output.patch
 # Add sftp option to force mode of created files (#1191055)
-Patch0023: 0023-openssh-6.7p1-sftp-force-permission.patch
+Patch926: openssh-6.7p1-sftp-force-permission.patch
 # make s390 use /dev/ crypto devices -- ignore closefrom
-Patch0024: 0024-openssh-7.2p2-s390-closefrom.patch
+Patch939: openssh-7.2p2-s390-closefrom.patch
 # Move MAX_DISPLAYS to a configuration option (#1341302)
-Patch0025: 0025-openssh-7.3p1-x11-max-displays.patch
+Patch944: openssh-7.3p1-x11-max-displays.patch
 # Pass inetd flags for SELinux down to openbsd compat level
-Patch0026: 0026-openssh-7.6p1-cleanup-selinux.patch
+Patch949: openssh-7.6p1-cleanup-selinux.patch
 # Sandbox adjustments for s390 and audit
-Patch0027: 0027-openssh-7.5p1-sandbox.patch
+Patch950: openssh-7.5p1-sandbox.patch
 # PKCS#11 URIs (upstream #2817, 2nd iteration)
 # https://github.com/Jakuje/openssh-portable/commits/jjelen-pkcs11
 # git show > ~/devel/fedora/openssh/openssh-8.0p1-pkcs11-uri.patch
-Patch0028: 0028-openssh-8.0p1-pkcs11-uri.patch
+Patch951: openssh-8.0p1-pkcs11-uri.patch
 # Unbreak scp between two IPv6 hosts (#1620333)
-Patch0029: 0029-openssh-7.8p1-scp-ipv6.patch
+Patch953: openssh-7.8p1-scp-ipv6.patch
 # Mention crypto-policies in manual pages (#1668325)
 # clarify rhbz#2068423 on the man page of ssh_config
-Patch0030: 0030-openssh-8.0p1-crypto-policies.patch
+Patch962: openssh-8.0p1-crypto-policies.patch
 # Use OpenSSL KDF (#1631761)
-Patch0031: 0031-openssh-8.0p1-openssl-kdf.patch
+Patch964: openssh-8.0p1-openssl-kdf.patch
 # sk-dummy.so built with -fvisibility=hidden does not work
-Patch0032: 0032-openssh-8.2p1-visibility.patch
+Patch965: openssh-8.2p1-visibility.patch
 # Do not break X11 without IPv6
-Patch0033: 0033-openssh-8.2p1-x11-without-ipv6.patch
+Patch966: openssh-8.2p1-x11-without-ipv6.patch
+# ssh-keygen printing fingerprint issue with Windows keys (#1901518)
+Patch974: openssh-8.0p1-keygen-strip-doseol.patch
 # sshd provides PAM an incorrect error code (#1879503)
-Patch0034: 0034-openssh-8.0p1-preserve-pam-errors.patch
+Patch975: openssh-8.0p1-preserve-pam-errors.patch
 # Implement kill switch for SCP protocol
-Patch0035: 0035-openssh-8.7p1-scp-kill-switch.patch
+Patch977: openssh-8.7p1-scp-kill-switch.patch
 # Workaround for lack of sftp_realpath in older versions of RHEL
 # https://bugzilla.redhat.com/show_bug.cgi?id=2038854
 # https://github.com/openssh/openssh-portable/pull/299
 # downstream only
-Patch0036: 0036-openssh-8.7p1-recursive-scp.patch
-# Downstream alias for MinRSABits
-Patch0037: 0037-openssh-8.7p1-minrsabits.patch
+Patch981: openssh-8.7p1-recursive-scp.patch
+# https://github.com/djmdjm/openssh-wip/pull/13
+Patch982: openssh-8.7p1-minrsabits.patch
 # downstream only, IBMCA tentative fix
 # From https://bugzilla.redhat.com/show_bug.cgi?id=1976202#c14
-Patch0038: 0038-openssh-8.7p1-ibmca.patch
-#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
-# https://bugzilla.redhat.com/show_bug.cgi?id=1171248
-# record pfs= field in CRYPTO_SESSION audit event
-Patch0039: 0039-openssh-7.6p1-audit.patch
-# Audit race condition in forked child (#1310684)
-Patch0040: 0040-openssh-7.1p2-audit-race-condition.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2049947
-Patch0041: 0041-openssh-9.0p1-audit-log.patch
-Patch0042: 0042-openssh-7.7p1-fips.patch
+Patch984: openssh-8.7p1-ibmca.patch
+
 # Add missing options from ssh_config into ssh manpage
 # upstream bug:
 # https://bugzilla.mindrot.org/show_bug.cgi?id=3455
-Patch0043: 0043-openssh-8.7p1-ssh-manpage.patch
+Patch1002: openssh-8.7p1-ssh-manpage.patch
 # Don't propose disallowed algorithms during hostkey negotiation
 # upstream MR:
 # https://github.com/openssh/openssh-portable/pull/323
-Patch0044: 0044-openssh-8.7p1-negotiate-supported-algs.patch
-Patch0045: 0045-openssh-9.0p1-evp-fips-kex.patch
-Patch0046: 0046-openssh-8.7p1-nohostsha1proof.patch
-Patch0047: 0047-openssh-9.6p1-pam-rhost.patch
-Patch0048: 0048-openssh-9.9p1-separate-keysign.patch
-Patch0049: 0049-openssh-9.9p1-openssl-mlkem.patch
-# https://www.openwall.com/lists/oss-security/2025/02/22/1
-Patch0050: 0050-openssh-9.9p2-error_processing.patch
-# https://github.com/openssh/openssh-portable/pull/564
-Patch0051: 0051-Provide-better-error-for-non-supported-private-keys.patch
-# https://github.com/openssh/openssh-portable/pull/567
-Patch0052: 0052-Ignore-bad-hostkeys-in-known_hosts-file.patch
-# https://github.com/openssh/openssh-portable/pull/500
-Patch0053: 0053-support-authentication-indicators-in-GSSAPI.patch
+Patch1006: openssh-8.7p1-negotiate-supported-algs.patch

-#https://bugzilla.mindrot.org/show_bug.cgi?id=2581
-Patch1000: 1000-openssh-coverity.patch
+Patch1012: openssh-9.0p1-evp-fips-kex.patch
+Patch1014: openssh-8.7p1-nohostsha1proof.patch
+
+Patch1015: openssh-9.6p1-pam-rhost.patch
+Patch1016: openssh-9.9p1-separate-keysign.patch
+Patch1017: openssh-8.7p1-redhat-help.patch
+Patch1018: openssh-8.7p1-openssl-log.patch
+# upstream cf3e48ee8ba1beeccddd2f203b558fa102be67a2
+# upstream 0c3927c45f8a57b511c874c4d51a8c89414f74ef
+Patch1019: openssh-9.9p1-mlkembe.patch
+# upstream 3f02368e8e9121847727c46b280efc280e5eb615
+# upstream 67a115e7a56dbdc3f5a58c64b29231151f3670f5
+Patch1020: openssh-9.9p1-match-regression.patch
+# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
+# upstream 0832aac79517611dd4de93ad0a83577994d9c907
+Patch1021: openssh-9.9p2-error_processing.patch

 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
-Patch2000: 2000-openssh-10.0p1-gsissh.patch
+Patch98: openssh-9.9p1-gsissh.patch

 # This is the HPN patch
-# Based on https://github.com/rapier1/hpn-ssh/ tag: hpn-18.7.0
-Patch2001: 2001-openssh-10.0p1-hpn-18.7.0.patch
+# Based on https://github.com/rapier1/hpn-ssh/ tag: hpn-18.6.0
+Patch99: openssh-9.9p1-hpn-18.6.0.patch

 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
-Requires: openssl-libs >= 3.5.0

 BuildRequires: autoconf, automake, perl-interpreter, perl-generators, zlib-devel
 BuildRequires: audit-libs-devel >= 2.0.5
 BuildRequires: util-linux, groff
 BuildRequires: pam-devel
-BuildRequires: openssl-devel >= 3.5.0
+BuildRequires: openssl-devel >= 0.9.8j
 BuildRequires: systemd-devel
 BuildRequires: systemd-rpm-macros
 BuildRequires: gcc make
 BuildRequires: p11-kit-devel
 BuildRequires: libfido2-devel
-BuildRequires: libxcrypt-devel
 Recommends: p11-kit

 %if %{kerberos5}
@ -280,7 +295,73 @@ This version of OpenSSH has been modified to support GSI authentication.

 %prep
 gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
-%autosetup -T -b 0 -p1 -n openssh-%{version}
+%setup -q -n openssh-%{version}
+
+%patch -P 400 -p1 -b .role-mls
+%patch -P 404 -p1 -b .privsep-selinux
+
+%patch -P 502 -p1 -b .keycat
+
+%patch -P 601 -p1 -b .ip-opts
+%patch -P 606 -p1 -b .ipv6man
+%patch -P 607 -p1 -b .sigpipe
+%patch -P 609 -p1 -b .x11
+
+%patch -P 702 -p1 -b .progress
+%patch -P 703 -p1 -b .grab-info
+%patch -P 707 -p1 -b .redhat
+%patch -P 711 -p1 -b .log-usepam-no
+
+%patch -P 800 -p1 -b .gsskex
+%patch -P 801 -p1 -b .force_krb
+%patch -P 804 -p1 -b .ccache_name
+%patch -P 805 -p1 -b .k5login
+
+%patch -P 901 -p1 -b .kuserok
+%patch -P 906 -p1 -b .fromto-remote
+%patch -P 916 -p1 -b .contexts
+%patch -P 918 -p1 -b .log-in-chroot
+%patch -P 919 -p1 -b .scp
+%patch -P 802 -p1 -b .GSSAPIEnablek5users
+%patch -P 922 -p1 -b .sshdt
+%patch -P 926 -p1 -b .sftp-force-mode
+%patch -P 939 -p1 -b .s390-dev
+%patch -P 944 -p1 -b .x11max
+%patch -P 949 -p1 -b .refactor
+%patch -P 950 -p1 -b .sandbox
+%patch -P 951 -p1 -b .pkcs11-uri
+%patch -P 953 -p1 -b .scp-ipv6
+%patch -P 962 -p1 -b .crypto-policies
+%patch -P 964 -p1 -b .openssl-kdf
+%patch -P 965 -p1 -b .visibility
+%patch -P 966 -p1 -b .x11-ipv6
+%patch -P 974 -p1 -b .keygen-strip-doseol
+%patch -P 975 -p1 -b .preserve-pam-errors
+%patch -P 977 -p1 -b .kill-scp
+%patch -P 981 -p1 -b .scp-sftpdirs
+%patch -P 982 -p1 -b .minrsabits
+%patch -P 984 -p1 -b .ibmca
+
+%patch -P 200 -p1 -b .audit
+%patch -P 201 -p1 -b .audit-race
+%patch -P 202 -p1 -b .audit-log
+%patch -P 700 -p1 -b .fips
+
+%patch -P 1002 -p1 -b .ssh-manpage
+%patch -P 1006 -p1 -b .negotiate-supported-algs
+%patch -P 1012 -p1 -b .evp-fips-dh
+%patch -P 1014 -p1 -b .nosha1hostproof
+%patch -P 1015 -p1 -b .pam-rhost
+%patch -P 1016 -p1 -b .sep-keysign
+%patch -P 1017 -p1 -b .help
+%patch -P 1018 -p1 -b .openssl-log
+%patch -P 1019 -p1 -b .mlkembe
+%patch -P 1020 -p1 -b .match
+%patch -P 1021 -p1 -b .errcode_set
+
+%patch -P 100 -p1 -b .coverity
+%patch -P 98 -p1 -b .gsi
+%patch -P 99 -p1 -b .hpn

 sed 's/sshd.pid/gsisshd.pid/' -i pathnames.h
 sed 's!$(piddir)/sshd.pid!$(piddir)/gsisshd.pid!' -i Makefile.in
@ -324,8 +405,8 @@ fi
 	--sysconfdir=%{_sysconfdir}/gsissh \
 	--libexecdir=%{_libexecdir}/gsissh \
 	--datadir=%{_datadir}/gsissh \
-	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin \
-	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin \
+	--with-default-path=%{_libexecdir}/gsissh/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \
+	--with-superuser-path=%{_libexecdir}/gsissh/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_datadir}/empty.sshd \
 	--disable-strip \
 	--without-zlib-version-check \
@ -478,7 +559,6 @@ fi
 %dir %attr(0711,root,root) %{_datadir}/empty.sshd
 %attr(0755,root,root) %{_sbindir}/gsisshd
 %attr(0755,root,root) %{_libexecdir}/gsissh/sshd-session
-%attr(0755,root,root) %{_libexecdir}/gsissh/sshd-auth
 %attr(0755,root,root) %{_libexecdir}/gsissh/sftp-server
 %attr(0755,root,root) %{_libexecdir}/gsissh/sshd-keygen
 %attr(0644,root,root) %{_mandir}/man5/gsisshd_config.5*
@ -502,35 +582,11 @@ fi
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.gsissh-host-keys-migration

 %changelog
-* Mon Sep 01 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-4
- Based on openssh-10.0p1-6.fc44
+* Sun Apr 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-
+- Based on openssh-9.9p1-7.el10

-* Mon Sep 01 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-3
- Based on openssh-10.0p1-4.fc43
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.0p1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Jun 16 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 10.0p1-1
- Based on openssh-10.0p1-3.fc43
-
-* Sun Apr 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-6
- Based on openssh-9.9p1-15.fc43
-
-* Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-5
- Based on openssh-9.9p1-11.fc43
-
-* Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-4
- Based on openssh-9.9p1-9.fc42
-
-* Wed Feb 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-3
- Based on openssh-9.9p1-8.fc42
-
-* Wed Feb 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-2
- Based on openssh-9.9p1-7.fc42 / openssh-9.9p1-2.fc41
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 9.9p1-1.1
- Add explicit BR: libxcrypt-devel
+* Wed Mar 05 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-2
+- Based on openssh-9.9p1-5.el10.1

 * Mon Jan 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 9.9p1-1
 - Based on openssh-9.9p1-5.fc42 / openssh-9.9p1-1.fc41
--- a/gsisshd.sysconfig
+++ b/gsisshd.sysconfig
@ -8,4 +8,3 @@

 #SSH_RSA_BITS=3072
 #SSH_ECDSA_BITS=256
-OPTIONS=""
--- a/gsisshd@.service
+++ b/gsisshd@.service
@ -13,6 +13,4 @@ Wants=gsissh-host-keys-migration.service
 Environment=OPTIONS=
 EnvironmentFile=-/etc/sysconfig/gsisshd
 ExecStart=-/usr/sbin/gsisshd -i $OPTIONS
-ExecStart=-/usr/sbin/gsisshd -i $OPTIONS -o "AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys"
 StandardInput=socket
-ImportCredential=ssh.ephemeral-authorized_keys-all
--- a/0009-openssh-4.3p2-askpass-grab-info.patch
+++ b/0009-openssh-4.3p2-askpass-grab-info.patch
@ -1,17 +1,7 @@
-From 710ce53fdf1d32a0629fce2e42fb49d407e2b06c Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 09/50] openssh-4.3p2-askpass-grab-info
-
---
- contrib/gnome-ssh-askpass2.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c
-index cb7152dc..bbe93d83 100644
--- a/contrib/gnome-ssh-askpass2.c
-+++ b/contrib/gnome-ssh-askpass2.c
-@@ -70,8 +70,12 @@ report_failed_grab (GtkWidget *parent_window, const char *what)
+diff -up openssh-8.6p1/contrib/gnome-ssh-askpass2.c.grab-info openssh-8.6p1/contrib/gnome-ssh-askpass2.c
+--- openssh-8.6p1/contrib/gnome-ssh-askpass2.c.grab-info	2021-04-19 13:57:11.720113536 +0200
+++ openssh-8.6p1/contrib/gnome-ssh-askpass2.c	2021-04-19 13:59:29.842163204 +0200
+@@ -70,8 +70,12 @@ report_failed_grab (GtkWidget *parent_wi
 
 	err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
 	    GTK_MESSAGE_ERROR, GTK_BUTTONS_CLOSE,
@ -26,6 +16,3 @@ index cb7152dc..bbe93d83 100644
 	gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER);
 
 	gtk_dialog_run(GTK_DIALOG(err));
-- 
-2.49.0
-
--- a/0008-openssh-5.1p1-askpass-progress.patch
+++ b/0008-openssh-5.1p1-askpass-progress.patch
@ -1,17 +1,7 @@
-From 6b2a33044583e892badb9ac86cd2c6252b1a532f Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 08/50] openssh-5.1p1-askpass-progress
-
---
- contrib/gnome-ssh-askpass2.c | 39 +++++++++++++++++++++++++++++++++---
- 1 file changed, 36 insertions(+), 3 deletions(-)
-
-diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c
-index a62f9815..cb7152dc 100644
--- a/contrib/gnome-ssh-askpass2.c
-+++ b/contrib/gnome-ssh-askpass2.c
-@@ -58,6 +58,7 @@
+diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contrib/gnome-ssh-askpass2.c
+--- openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress	2016-12-19 05:59:41.000000000 +0100
+++ openssh-7.4p1/contrib/gnome-ssh-askpass2.c	2016-12-23 13:31:16.545211926 +0100
+@@ -53,6 +53,7 @@
 #include <unistd.h>
 
 #include <X11/Xlib.h>
@ -19,7 +9,7 @@ index a62f9815..cb7152dc 100644
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
 #include <gdk/gdkkeysyms.h>
-@@ -146,6 +147,17 @@ parse_env_hex_color(const char *env, GdkColor *c)
+@@ -81,14 +82,25 @@ ok_dialog(GtkWidget *entry, gpointer dia
 	return 1;
 }
 
@ -37,7 +27,7 @@ index a62f9815..cb7152dc 100644
 static int
 passphrase_dialog(char *message, int prompt_type)
 {
-@@ -153,7 +165,7 @@ passphrase_dialog(char *message, int prompt_type)
+ 	const char *failed;
 	char *passphrase, *local;
 	int result, grab_tries, grab_server, grab_pointer;
 	int buttons, default_response;
@ -46,7 +36,7 @@ index a62f9815..cb7152dc 100644
 	GdkGrabStatus status;
 	GdkColor fg, bg;
 	int fg_set = 0, bg_set = 0;
-@@ -199,14 +211,19 @@ passphrase_dialog(char *message, int prompt_type)
+@@ -104,14 +116,19 @@ passphrase_dialog(char *message)
 		gtk_widget_modify_bg(dialog, GTK_STATE_NORMAL, &bg);
 
 	if (prompt_type == PROMPT_ENTRY || prompt_type == PROMPT_NONE) {
@ -55,12 +45,12 @@ index a62f9815..cb7152dc 100644
 +		    FALSE, 0);
 +		gtk_widget_show(hbox);
 +
- 		entry = gtk_entry_new();
- 		if (fg_set)
- 			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
- 		if (bg_set)
- 			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
- 		gtk_box_pack_start(
+		entry = gtk_entry_new();
+		if (fg_set)
+			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
+		if (bg_set)
+			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
+		gtk_box_pack_start(
 -		    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
 -		    entry, FALSE, FALSE, 0);
 +		    GTK_BOX(hbox), entry, TRUE, FALSE, 0);
@ -68,7 +58,7 @@ index a62f9815..cb7152dc 100644
 		gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
 		gtk_widget_grab_focus(entry);
 		if (prompt_type == PROMPT_ENTRY) {
-@@ -225,6 +242,22 @@ passphrase_dialog(char *message, int prompt_type)
+@@ -130,6 +145,22 @@ passphrase_dialog(char *message)
 			g_signal_connect(G_OBJECT(entry), "key_press_event",
 			    G_CALLBACK(check_none), dialog);
 		}
@ -91,6 +81,3 @@ index a62f9815..cb7152dc 100644
 	}
 
 	/* Grab focus */
-- 
-2.49.0
-
--- a/openssh-5.8p2-sigpipe.patch
+++ b/openssh-5.8p2-sigpipe.patch
@ -0,0 +1,14 @@
+diff -up openssh-5.8p2/ssh-keyscan.c.sigpipe openssh-5.8p2/ssh-keyscan.c
+--- openssh-5.8p2/ssh-keyscan.c.sigpipe	2011-08-23 18:30:33.873025916 +0200
+++ openssh-5.8p2/ssh-keyscan.c	2011-08-23 18:32:24.574025362 +0200
+@@ -715,6 +715,9 @@ main(int argc, char **argv)
+	if (maxfd > fdlim_get(0))
+ 		fdlim_set(maxfd);
+ 	fdcon = xcalloc(maxfd, sizeof(con));
+ 
+	signal(SIGPIPE, SIG_IGN);
+
+	read_wait = xcalloc(maxfd, sizeof(struct pollfd));
+	for (j = 0; j < maxfd; j++)
+		read_wait[j].fd = -1;
+ 
--- a/0005-openssh-5.9p1-ipv6man.patch
+++ b/0005-openssh-5.9p1-ipv6man.patch
@ -1,18 +1,7 @@
-From 388be633842a9f3e4b0a76fe40cf7035912a913a Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 05/50] openssh-5.9p1-ipv6man
-
---
- ssh.1  | 2 ++
- sshd.8 | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/ssh.1 b/ssh.1
-index 697f4e42..db92ac9a 100644
--- a/ssh.1
-+++ b/ssh.1
-@@ -1663,6 +1663,8 @@ manual page for more information.
+diff -up openssh-5.9p0/ssh.1.ipv6man openssh-5.9p0/ssh.1
+--- openssh-5.9p0/ssh.1.ipv6man	2011-08-05 22:17:32.000000000 +0200
+++ openssh-5.9p0/ssh.1	2011-08-31 13:08:34.880024485 +0200
+@@ -1400,6 +1400,8 @@ manual page for more information.
 .Nm
 exits with the exit status of the remote command or with 255
 if an error occurred.
@ -21,11 +10,10 @@ index 697f4e42..db92ac9a 100644
 .Sh SEE ALSO
 .Xr scp 1 ,
 .Xr sftp 1 ,
-diff --git a/sshd.8 b/sshd.8
-index 08ebf53a..2aa73271 100644
--- a/sshd.8
-+++ b/sshd.8
-@@ -1018,6 +1018,8 @@ concurrently for different ports, this contains the process ID of the one
+diff -up openssh-5.9p0/sshd.8.ipv6man openssh-5.9p0/sshd.8
+--- openssh-5.9p0/sshd.8.ipv6man	2011-08-05 22:17:32.000000000 +0200
+++ openssh-5.9p0/sshd.8	2011-08-31 13:10:34.129039094 +0200
+@@ -940,6 +940,8 @@ concurrently for different ports, this c
 started last).
 The content of this file is not sensitive; it can be world-readable.
 .El
@ -34,6 +22,3 @@ index 08ebf53a..2aa73271 100644
 .Sh SEE ALSO
 .Xr scp 1 ,
 .Xr sftp 1 ,
-- 
-2.49.0
-
--- a/openssh-6.4p1-fromto-remote.patch
+++ b/openssh-6.4p1-fromto-remote.patch
@ -0,0 +1,16 @@
+diff --git a/scp.c b/scp.c
+index d98fa67..25d347b 100644
+--- a/scp.c
+++ b/scp.c
+@@ -638,7 +638,10 @@ toremote(char *targ, int argc, char **argv)
+ 			addargs(&alist, "%s", ssh_program);
+ 			addargs(&alist, "-x");
+ 			addargs(&alist, "-oClearAllForwardings=yes");
+-			addargs(&alist, "-n");
+			if (isatty(fileno(stdin)))
+				addargs(&alist, "-t");
+			else
+				addargs(&alist, "-n");
+ 			for (j = 0; j < remote_remote_args.num; j++) {
+ 				addargs(&alist, "%s",
+ 				    remote_remote_args.list[j]);
--- a/0019-openssh-6.6.1p1-log-in-chroot.patch
+++ b/0019-openssh-6.6.1p1-log-in-chroot.patch
@ -1,25 +1,7 @@
-From 825018f5f2d892655f3d63167a0d1f3391cec678 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 19/50] openssh-6.6.1p1-log-in-chroot
-
---
- log.c              | 11 +++++++++--
- log.h              |  1 +
- monitor.c          | 17 +++++++++++++++--
- monitor.h          |  2 +-
- session.c          | 26 +++++++++++++++-----------
- sftp-server-main.c |  2 +-
- sftp-server.c      |  6 +++---
- sftp.h             |  2 +-
- sshd-session.c     |  7 ++++++-
- 9 files changed, 52 insertions(+), 22 deletions(-)
-
-diff --git a/log.c b/log.c
-index 6617f267..9782cfb0 100644
--- a/log.c
-+++ b/log.c
-@@ -196,6 +196,11 @@ void
+diff -up openssh-8.6p1/log.c.log-in-chroot openssh-8.6p1/log.c
+--- openssh-8.6p1/log.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/log.c	2021-04-19 14:43:08.544843434 +0200
+@@ -194,6 +194,11 @@ void
 log_init(const char *av0, LogLevel level, SyslogFacility facility,
     int on_stderr)
 {
@ -31,7 +13,7 @@ index 6617f267..9782cfb0 100644
 #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
 	struct syslog_data sdata = SYSLOG_DATA_INIT;
 #endif
-@@ -208,8 +213,10 @@ log_init(const char *av0, LogLevel level, SyslogFacility facility,
+@@ -206,8 +211,10 @@ log_init(const char *av0, LogLevel level
 		exit(1);
 	}
 
@ -44,10 +26,9 @@ index 6617f267..9782cfb0 100644
 
 	log_on_stderr = on_stderr;
 	if (on_stderr)
-diff --git a/log.h b/log.h
-index 8e8dfc23..70048a8a 100644
--- a/log.h
-+++ b/log.h
+diff -up openssh-8.6p1/log.h.log-in-chroot openssh-8.6p1/log.h
+--- openssh-8.6p1/log.h.log-in-chroot	2021-04-19 14:43:08.544843434 +0200
+++ openssh-8.6p1/log.h	2021-04-19 14:56:46.931042176 +0200
@@ -52,6 +52,7 @@ typedef enum {
 typedef void (log_handler_fn)(LogLevel, int, const char *, void *);
 
@ -56,11 +37,43 @@ index 8e8dfc23..70048a8a 100644
 LogLevel log_level_get(void);
 int      log_change_level(LogLevel);
 int      log_is_on_stderr(void);
-diff --git a/monitor.c b/monitor.c
-index 2ef16cc8..43c10a4e 100644
--- a/monitor.c
-+++ b/monitor.c
-@@ -2001,9 +2001,22 @@ monitor_init(void)
+diff -up openssh-8.6p1/monitor.c.log-in-chroot openssh-8.6p1/monitor.c
+--- openssh-8.6p1/monitor.c.log-in-chroot	2021-04-19 14:43:08.526843298 +0200
+++ openssh-8.6p1/monitor.c	2021-04-19 14:55:25.286424043 +0200
+@@ -297,6 +297,8 @@ monitor_child_preauth(struct ssh *ssh, s
+ 		close(pmonitor->m_log_sendfd);
+ 	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
+ 
+	pmonitor->m_state = "preauth";
+
+ 	authctxt = (Authctxt *)ssh->authctxt;
+ 	memset(authctxt, 0, sizeof(*authctxt));
+ 	ssh->authctxt = authctxt;
+@@ -408,6 +410,8 @@ monitor_child_postauth(struct ssh *ssh,
+ 	close(pmonitor->m_recvfd);
+ 	pmonitor->m_recvfd = -1;
+ 
+	pmonitor->m_state = "postauth";
+
+ 	monitor_set_child_handler(pmonitor->m_pid);
+ 	ssh_signal(SIGHUP, &monitor_child_handler);
+ 	ssh_signal(SIGTERM, &monitor_child_handler);
+@@ -480,7 +484,7 @@ monitor_read_log(struct monitor *pmonito
+ 	/* Log it */
+ 	if (log_level_name(level) == NULL)
+ 		fatal_f("invalid log level %u (corrupted message?)", level);
+-	sshlogdirect(level, forced, "%s [preauth]", msg);
+	sshlogdirect(level, forced, "%s [%s]", msg, pmonitor->m_state);
+ 
+ 	sshbuf_free(logmsg);
+ 	free(msg);
+@@ -1868,13 +1872,28 @@ monitor_init(void)
+ 	mon = xcalloc(1, sizeof(*mon));
+ 	monitor_openfds(mon, 1);
+ 
+	mon->m_state = "";
+
+ 	return mon;
 }
 
 void
@ -85,11 +98,14 @@ index 2ef16cc8..43c10a4e 100644
 }
 
 #ifdef GSSAPI
-diff --git a/monitor.h b/monitor.h
-index dbc7e003..d4d631dd 100644
--- a/monitor.h
-+++ b/monitor.h
-@@ -85,7 +85,7 @@ struct monitor {
+diff -up openssh-8.6p1/monitor.h.log-in-chroot openssh-8.6p1/monitor.h
+--- openssh-8.6p1/monitor.h.log-in-chroot	2021-04-19 14:43:08.527843305 +0200
+++ openssh-8.6p1/monitor.h	2021-04-19 14:43:08.545843441 +0200
+@@ -80,10 +80,11 @@ struct monitor {
+ 	int			 m_log_sendfd;
+ 	struct kex		**m_pkex;
+ 	pid_t			 m_pid;
+	char		*m_state;
 };
 
 struct monitor *monitor_init(void);
@ -98,11 +114,10 @@ index dbc7e003..d4d631dd 100644
 
 struct Authctxt;
 void monitor_child_preauth(struct ssh *, struct monitor *);
-diff --git a/session.c b/session.c
-index 2620dd11..54da09d5 100644
--- a/session.c
-+++ b/session.c
-@@ -169,6 +169,7 @@ login_cap_t *lc;
+diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
+--- openssh-8.6p1/session.c.log-in-chroot	2021-04-19 14:43:08.534843358 +0200
+++ openssh-8.6p1/session.c	2021-04-19 14:43:08.545843441 +0200
+@@ -160,6 +160,7 @@ login_cap_t *lc;
 
 static int is_child = 0;
 static int in_chroot = 0;
@ -110,7 +125,7 @@ index 2620dd11..54da09d5 100644
 
 /* File containing userauth info, if ExposeAuthInfo set */
 static char *auth_info_file = NULL;
-@@ -670,6 +671,7 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
+@@ -661,6 +662,7 @@ do_exec(struct ssh *ssh, Session *s, con
 	int ret;
 	const char *forced = NULL, *tty = NULL;
 	char session_type[1024];
@ -118,7 +133,7 @@ index 2620dd11..54da09d5 100644
 
 	if (options.adm_forced_command) {
 		original_command = command;
-@@ -729,6 +731,10 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
+@@ -720,6 +722,10 @@ do_exec(struct ssh *ssh, Session *s, con
 			tty += 5;
 	}
 
@ -129,7 +144,7 @@ index 2620dd11..54da09d5 100644
 	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
 	    session_type,
 	    tty == NULL ? "" : " on ",
-@@ -1512,14 +1518,6 @@ child_close_fds(struct ssh *ssh)
+@@ -1524,14 +1530,6 @@ child_close_fds(struct ssh *ssh)
 
 	/* Stop directing logs to a high-numbered fd before we close it */
 	log_redirect_stderr_to(NULL);
@ -144,7 +159,7 @@ index 2620dd11..54da09d5 100644
 }
 
 /*
-@@ -1652,8 +1650,6 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+@@ -1665,8 +1663,6 @@ do_child(struct ssh *ssh, Session *s, co
 			exit(1);
 	}
 
@ -153,7 +168,7 @@ index 2620dd11..54da09d5 100644
 	do_rc_files(ssh, s, shell);
 
 	/* restore SIGPIPE for child */
-@@ -1678,9 +1674,17 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+@@ -1691,9 +1687,17 @@ do_child(struct ssh *ssh, Session *s, co
 		argv[i] = NULL;
 		optind = optreset = 1;
 		__progname = argv[0];
@ -172,31 +187,29 @@ index 2620dd11..54da09d5 100644
 	fflush(NULL);
 
 	/* Get the last component of the shell name. */
-diff --git a/sftp-server-main.c b/sftp-server-main.c
-index 2c70f89b..bbb79f27 100644
--- a/sftp-server-main.c
-+++ b/sftp-server-main.c
-@@ -48,5 +48,5 @@ main(int argc, char **argv)
- 		return 1;
- 	}
+diff -up openssh-8.6p1/sftp.h.log-in-chroot openssh-8.6p1/sftp.h
+--- openssh-8.6p1/sftp.h.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/sftp.h	2021-04-19 14:43:08.545843441 +0200
+@@ -97,5 +97,5 @@
 
-	return (sftp_server_main(argc, argv, user_pw));
-+	return (sftp_server_main(argc, argv, user_pw, 0));
- }
-diff --git a/sftp-server.c b/sftp-server.c
-index a4abb9f7..4985da38 100644
--- a/sftp-server.c
-+++ b/sftp-server.c
-@@ -1901,7 +1901,7 @@ sftp_server_usage(void)
+ struct passwd;
+ 
+-int	sftp_server_main(int, char **, struct passwd *);
+int	sftp_server_main(int, char **, struct passwd *, int);
+ void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
+diff -up openssh-8.6p1/sftp-server.c.log-in-chroot openssh-8.6p1/sftp-server.c
+--- openssh-8.6p1/sftp-server.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/sftp-server.c	2021-04-19 14:43:08.545843441 +0200
+@@ -1644,7 +1644,7 @@ sftp_server_usage(void)
 }
 
 int
 -sftp_server_main(int argc, char **argv, struct passwd *user_pw)
 +sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
 {
- 	int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
- 	ssize_t len, olen;
-@@ -1913,7 +1913,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
+	int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
+	ssize_t len, olen;
+@@ -1657,7 +1657,7 @@ sftp_server_main(int argc, char **argv,
 	extern char *__progname;
 
 	__progname = ssh_get_progname(argv[0]);
@ -205,7 +218,7 @@ index a4abb9f7..4985da38 100644
 
 	pw = pwcopy(user_pw);
 
-@@ -1986,7 +1986,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
+@@ -1730,7 +1730,7 @@ sftp_server_main(int argc, char **argv,
 		}
 	}
 
@ -214,22 +227,20 @@ index a4abb9f7..4985da38 100644
 
 	/*
 	 * On platforms where we can, avoid making /proc/self/{mem,maps}
-diff --git a/sftp.h b/sftp.h
-index 2bde8bb7..ddf1a396 100644
--- a/sftp.h
-+++ b/sftp.h
-@@ -97,5 +97,5 @@
+diff -up openssh-8.6p1/sftp-server-main.c.log-in-chroot openssh-8.6p1/sftp-server-main.c
+--- openssh-8.6p1/sftp-server-main.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/sftp-server-main.c	2021-04-19 14:43:08.545843441 +0200
+@@ -50,5 +50,5 @@ main(int argc, char **argv)
+ 		return 1;
+ 	}
 
- struct passwd;
- 
-int	sftp_server_main(int, char **, struct passwd *);
-+int	sftp_server_main(int, char **, struct passwd *, int);
- void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
-diff --git a/sshd-session.c b/sshd-session.c
-index 478381db..9342e416 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -437,7 +437,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
+-	return (sftp_server_main(argc, argv, user_pw));
+	return (sftp_server_main(argc, argv, user_pw, 0));
+ }
+diff -up openssh-8.6p1/sshd-session.c.log-in-chroot openssh-8.6p1/sshd-session.c
+--- openssh-8.6p1/sshd-session.c.log-in-chroot	2021-04-19 14:43:08.543843426 +0200
+++ openssh-8.6p1/sshd-session.c	2021-04-19 14:43:08.545843441 +0200
+@@ -559,7 +559,7 @@ privsep_postauth(struct ssh *ssh, Authct
 #endif
 
 	/* New socket pair */
@ -238,7 +249,7 @@ index 478381db..9342e416 100644
 
 	pmonitor->m_pid = fork();
 	if (pmonitor->m_pid == -1)
-@@ -456,6 +456,11 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
+@@ -578,6 +578,11 @@ privsep_postauth(struct ssh *ssh, Authct
 
 	close(pmonitor->m_sendfd);
 	pmonitor->m_sendfd = -1;
@ -250,6 +261,3 @@ index 478381db..9342e416 100644
 
 	/* Demote the private keys to public keys. */
 	demote_sensitive_data();
-- 
-2.49.0
-
--- a/openssh-6.6.1p1-scp-non-existing-directory.patch
+++ b/openssh-6.6.1p1-scp-non-existing-directory.patch
@ -0,0 +1,14 @@
+--- a/scp.c	
+++ a/scp.c	
+@@ -1084,6 +1084,10 @@ sink(int argc, char **argv)
+ 			free(vect[0]);
+ 			continue;
+ 		}
+		if (buf[0] == 'C' && ! exists && np[strlen(np)-1] == '/') {
+			errno = ENOTDIR;
+			goto bad;
+		}
+ 		omode = mode;
+ 		mode |= S_IWUSR;
+ 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) == -1) {
+-- 
--- a/0018-openssh-6.6.1p1-selinux-contexts.patch
+++ b/0018-openssh-6.6.1p1-selinux-contexts.patch
@ -1,20 +1,8 @@
-From 6481ac7fbd0027a7038560e0f51dd0af056cc229 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 18/50] openssh-6.6.1p1-selinux-contexts
-
---
- openbsd-compat/port-linux-sshd.c | 69 +++++++++++++++++++++++++++++++-
- openbsd-compat/port-linux.c      |  2 +-
- openbsd-compat/port-linux.h      |  1 +
- sshd-auth.c                      |  2 +-
- 4 files changed, 71 insertions(+), 3 deletions(-)
-
 diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-index 8c5fc1fe..646f0887 100644
+index 8f32464..18a2ca4 100644
 --- a/openbsd-compat/port-linux-sshd.c
 +++ b/openbsd-compat/port-linux-sshd.c
-@@ -33,6 +33,7 @@
+@@ -32,6 +32,7 @@
 #include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
 #include "servconf.h"
 #include "port-linux.h"
@ -22,7 +10,7 @@ index 8c5fc1fe..646f0887 100644
 #include "sshkey.h"
 #include "hostfile.h"
 #include "auth.h"
-@@ -450,7 +451,7 @@ sshd_selinux_setup_exec_context(char *pwname)
+@@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
 void
 sshd_selinux_copy_context(void)
 {
@ -31,7 +19,7 @@ index 8c5fc1fe..646f0887 100644
 
 	if (!sshd_selinux_enabled())
 		return;
-@@ -469,6 +470,72 @@ sshd_selinux_copy_context(void)
+@@ -461,6 +462,72 @@ sshd_selinux_copy_context(void)
 	}
 }
 
@ -105,23 +93,22 @@ index 8c5fc1fe..646f0887 100644
 #endif
 
 diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index 7426f6f7..9a6b1d6e 100644
--- a/openbsd-compat/port-linux.c
-+++ b/openbsd-compat/port-linux.c
-@@ -188,7 +188,7 @@ ssh_selinux_change_context(const char *newname)
+--- a/openbsd-compat/port-linux.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/openbsd-compat/port-linux.c	(date 1703108053912)
+@@ -207,7 +207,7 @@
 	xasprintf(&newctx, "%.*s%s%s", (int)(cx - oldctx + 1), oldctx,
 	    newname, cx2 == NULL ? "" : cx2);
- 
+
 -	debug3_f("setting context from '%s' to '%s'", oldctx, newctx);
 +	debug_f("setting context from '%s' to '%s'", oldctx, newctx);
 	if (setcon(newctx) < 0)
 		do_log2_f(log_level, "setcon %s from %s failed with %s",
 		    newctx, oldctx, strerror(errno));
 diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 1b745a76..7f8ba200 100644
+index cb51f99..8b7cda2 100644
 --- a/openbsd-compat/port-linux.h
 +++ b/openbsd-compat/port-linux.h
-@@ -27,6 +27,7 @@ int sshd_selinux_enabled(void);
+@@ -29,6 +29,7 @@ int sshd_selinux_enabled(void);
 void sshd_selinux_copy_context(void);
 void sshd_selinux_setup_exec_context(char *);
 int sshd_selinux_setup_env_variables(void);
@ -129,19 +116,16 @@ index 1b745a76..7f8ba200 100644
 #endif
 
 #ifdef LINUX_OOM_ADJUST
-diff --git a/sshd-auth.c b/sshd-auth.c
-index d51e4636..e4a8edfd 100644
--- a/sshd-auth.c
-+++ b/sshd-auth.c
-@@ -188,7 +188,7 @@ privsep_child_demote(void)
- 		fatal_f("ssh_sandbox_init failed");
- #endif
+diff --git a/sshd-session.c b/sshd-session.c
+index 2871fe9..39b9c08 100644
+--- a/sshd-session.c
+++ b/sshd-session.c
+@@ -629,7 +629,7 @@ privsep_preauth_child(void)
+ 	demote_sensitive_data();
+ 
 #ifdef WITH_SELINUX
 -	ssh_selinux_change_context("sshd_net_t");
 +	sshd_selinux_change_privsep_preauth_context();
 #endif
 
 	/* Demote the child */
-- 
-2.49.0
-
--- a/0021-openssh-6.6p1-GSSAPIEnablek5users.patch
+++ b/0021-openssh-6.6p1-GSSAPIEnablek5users.patch
@ -1,21 +1,7 @@
-From 9c75c175e3555377328fc5fc9b06e94f129b7cd7 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 21/50] openssh-6.6p1-GSSAPIEnablek5users
-
---
- gss-serv-krb5.c |  3 +--
- servconf.c      | 13 ++++++++++++-
- servconf.h      |  1 +
- sshd_config     |  1 +
- sshd_config.5   |  6 ++++++
- 5 files changed, 21 insertions(+), 3 deletions(-)
-
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 187faf92..03188d9b 100644
--- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -278,7 +278,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-serv-krb5.c
+--- openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 15:18:40.628216102 +0100
+@@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
 	FILE *fp;
 	char file[MAXPATHLEN];
 	char *line = NULL;
@ -23,7 +9,7 @@ index 187faf92..03188d9b 100644
 	struct stat st;
 	struct passwd *pw = the_authctxt->pw;
 	int found_principal = 0;
-@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
 
 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
 	/* If both .k5login and .k5users DNE, self-login is ok. */
@ -32,19 +18,18 @@ index 187faf92..03188d9b 100644
                 return ssh_krb5_kuserok(krb_context, principal, luser,
                                         k5login_exists);
 	}
-diff --git a/servconf.c b/servconf.c
-index 5dd5ca21..c0de7110 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -146,6 +146,7 @@ initialize_server_options(ServerOptions *options)
+diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
+--- openssh-7.4p1/servconf.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
+++ openssh-7.4p1/servconf.c	2016-12-23 15:35:36.354401156 +0100
+@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions
 	options->gss_store_rekey = -1;
 	options->gss_kex_algorithms = NULL;
 	options->use_kuserok = -1;
 +	options->enable_k5users = -1;
 	options->password_authentication = -1;
 	options->kbd_interactive_authentication = -1;
- 	options->permit_empty_passwd = -1;
-@@ -402,6 +403,8 @@ fill_default_server_options(ServerOptions *options)
+	options->permit_empty_passwd = -1;
+@@ -345,6 +346,8 @@ fill_default_server_options(ServerOption
 #endif
 	if (options->use_kuserok == -1)
 		options->use_kuserok = 1;
@ -53,7 +38,7 @@ index 5dd5ca21..c0de7110 100644
 	if (options->password_authentication == -1)
 		options->password_authentication = 1;
 	if (options->kbd_interactive_authentication == -1)
-@@ -585,7 +588,7 @@ typedef enum {
+@@ -578,7 +578,7 @@ typedef enum {
 	sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
 	sPerSourcePenalties, sPerSourcePenaltyExemptList,
 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
@ -62,7 +47,7 @@ index 5dd5ca21..c0de7110 100644
 	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
 	sAcceptEnv, sSetEnv, sPermitTunnel,
 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
-@@ -681,6 +684,7 @@ static struct {
+@@ -600,14 +600,16 @@ static struct {
 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
 	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
@ -70,7 +55,8 @@ index 5dd5ca21..c0de7110 100644
 #else
 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
-@@ -689,6 +693,7 @@ static struct {
+ 	{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
@ -78,7 +64,7 @@ index 5dd5ca21..c0de7110 100644
 #endif
 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
-@@ -2450,6 +2455,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1653,6 +1658,10 @@ process_server_config_line(ServerOptions
 		intptr = &options->use_kuserok;
 		goto parse_flag;
 
@ -86,10 +72,10 @@ index 5dd5ca21..c0de7110 100644
 +		intptr = &options->enable_k5users;
 +		goto parse_flag;
 +
- 	case sMatch:
- 		if (cmdline)
- 			fatal("Match directive not supported as a command-line "
-@@ -3005,6 +3014,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+	case sMatch:
+		if (cmdline)
+			fatal("Match directive not supported as a command-line "
+@@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d
 	M_CP_INTOPT(ip_qos_interactive);
 	M_CP_INTOPT(ip_qos_bulk);
 	M_CP_INTOPT(use_kuserok);
@ -97,7 +83,7 @@ index 5dd5ca21..c0de7110 100644
 	M_CP_INTOPT(rekey_limit);
 	M_CP_INTOPT(rekey_interval);
 	M_CP_INTOPT(log_level);
-@@ -3314,6 +3324,7 @@ dump_config(ServerOptions *o)
+@@ -2320,6 +2330,7 @@ dump_config(ServerOptions *o)
 # endif
 	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
@ -105,35 +91,21 @@ index 5dd5ca21..c0de7110 100644
 #endif
 #ifdef GSSAPI
 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff --git a/servconf.h b/servconf.h
-index 11de36a2..c08cf6a7 100644
--- a/servconf.h
-+++ b/servconf.h
-@@ -152,6 +152,7 @@ typedef struct {
- 	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
- 						 * be stored in per-session ccache */
+diff -up openssh-7.4p1/servconf.h.GSSAPIEnablek5users openssh-7.4p1/servconf.h
+--- openssh-7.4p1/servconf.h.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
+++ openssh-7.4p1/servconf.h	2016-12-23 15:18:40.629216102 +0100
+@@ -174,6 +174,7 @@ typedef struct {
+	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
+						 * be stored in per-session ccache */
 	int	use_kuserok;
 +	int		enable_k5users;
 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff --git a/sshd_config b/sshd_config
-index ea5a878e..33713c88 100644
--- a/sshd_config
-+++ b/sshd_config
-@@ -82,6 +82,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
- #GSSAPICleanupCredentials yes
- #GSSAPIStrictAcceptorCheck yes
- #GSSAPIKeyExchange no
-+#GSSAPIEnablek5users no
- 
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
-diff --git a/sshd_config.5 b/sshd_config.5
-index 0fcb409a..fe246fc2 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -739,6 +739,12 @@ Specifies whether to automatically destroy the user's credentials cache
+diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_config.5
+--- openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users	2016-12-23 15:18:40.630216103 +0100
+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:36:21.607408435 +0100
+@@ -628,6 +628,12 @@ Specifies whether to automatically destr
 on logout.
 The default is
 .Cm yes .
@ -146,6 +118,17 @@ index 0fcb409a..fe246fc2 100644
 .It Cm GSSAPIKeyExchange
 Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
 doesn't rely on ssh keys to verify host identity.
-- 
-2.49.0
-
+diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
+--- openssh-7.4p1/sshd_config.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
+++ openssh-7.4p1/sshd_config	2016-12-23 15:18:40.631216103 +0100
+@@ -80,6 +80,7 @@ GSSAPIAuthentication yes
+ #GSSAPICleanupCredentials yes
+ #GSSAPIStrictAcceptorCheck yes
+ #GSSAPIKeyExchange no
+#GSSAPIEnablek5users no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing,
+ # and session processing. If this is enabled, PAM authentication will
+diff -up openssh-9.8p1/servconf.c.xxx openssh-9.8p1/servconf.c
+--- openssh-9.8p1/servconf.c.xxx	2024-07-11 13:51:19.969960781 +0200
+++ openssh-9.8p1/servconf.c	2024-07-11 13:51:30.938231250 +0200
--- a/0004-openssh-6.6p1-allow-ip-opts.patch
+++ b/0004-openssh-6.6p1-allow-ip-opts.patch
@ -1,17 +1,7 @@
-From 28333f1dfe68b0ffc80c2a4799759587b4c32d3e Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 04/50] openssh-6.6p1-allow-ip-opts
-
---
- sshd-session.c | 32 ++++++++++++++++++++++++++------
- 1 file changed, 26 insertions(+), 6 deletions(-)
-
-diff --git a/sshd-session.c b/sshd-session.c
-index 4a148db4..a365f26f 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -778,12 +778,32 @@ check_ip_options(struct ssh *ssh)
+diff -up openssh/sshd.c.ip-opts openssh/sshd.c
+--- openssh/sshd-session.c.ip-opts	2016-07-25 13:58:48.998507834 +0200
+++ openssh/sshd-session.c	2016-07-25 14:01:28.346469878 +0200
+@@ -1507,12 +1507,32 @@ check_ip_options(struct ssh *ssh)
 
 	if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts,
 	    &option_size) >= 0 && option_size != 0) {
@ -50,6 +40,3 @@ index 4a148db4..a365f26f 100644
 	}
 #endif /* IP_OPTIONS */
 }
-- 
-2.49.0
-
--- a/0013-openssh-6.6p1-force_krb.patch
+++ b/0013-openssh-6.6p1-force_krb.patch
@ -1,17 +1,5 @@
-From f5e5ee321def2a3674600714ad98fd1ca9b2cff1 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 13/50] openssh-6.6p1-force_krb
-
---
- gss-serv-krb5.c | 156 +++++++++++++++++++++++++++++++++++++++++++++++-
- session.c       |  23 +++++++
- ssh-gss.h       |   4 ++
- sshd.8          |   7 +++
- 4 files changed, 189 insertions(+), 1 deletion(-)
-
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 8d2b677f..14502c5a 100644
+index 413b845..54dd383 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
@@ -32,7 +32,9 @@
@ -24,7 +12,7 @@ index 8d2b677f..14502c5a 100644
 
 #include "xmalloc.h"
 #include "sshkey.h"
-@@ -44,6 +46,7 @@
+@@ -45,6 +47,7 @@
 
 #include "ssh-gss.h"
 
@ -32,7 +20,7 @@ index 8d2b677f..14502c5a 100644
 extern ServerOptions options;
 
 #ifdef HEIMDAL
-@@ -55,6 +58,13 @@ extern ServerOptions options;
+@@ -56,6 +59,13 @@ extern ServerOptions options;
 # include <gssapi/gssapi_krb5.h>
 #endif
 
@ -46,7 +34,7 @@ index 8d2b677f..14502c5a 100644
 static krb5_context krb_context = NULL;
 
 /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
-@@ -87,6 +97,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -88,6 +98,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
 	krb5_principal princ;
 	int retval;
 	const char *errmsg;
@ -54,7 +42,7 @@ index 8d2b677f..14502c5a 100644
 
 	if (ssh_gssapi_krb5_init() == 0)
 		return 0;
-@@ -98,10 +109,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -99,10 +110,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
 		krb5_free_error_message(krb_context, errmsg);
 		return 0;
 	}
@ -78,7 +66,7 @@ index 8d2b677f..14502c5a 100644
 	} else
 		retval = 0;
 
-@@ -109,6 +132,137 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -110,6 +133,137 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
 	return retval;
 }
 
@ -217,10 +205,10 @@ index 8d2b677f..14502c5a 100644
 /* This writes out any forwarded credentials from the structure populated
  * during userauth. Called after we have setuid to the user */
 diff --git a/session.c b/session.c
-index cbfbcee8..89b3a9cf 100644
+index 28659ec..9c94d8e 100644
 --- a/session.c
 +++ b/session.c
-@@ -680,6 +680,29 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
+@@ -789,6 +789,29 @@ do_exec(Session *s, const char *command)
 		command = auth_opts->force_command;
 		forced = "(key-option)";
 	}
@ -251,7 +239,7 @@ index cbfbcee8..89b3a9cf 100644
 	if (forced != NULL) {
 		s->forced = 1;
 diff --git a/ssh-gss.h b/ssh-gss.h
-index 8ec45192..db34d77f 100644
+index 0374c88..509109a 100644
 --- a/ssh-gss.h
 +++ b/ssh-gss.h
@@ -49,6 +49,10 @@
@ -266,10 +254,10 @@ index 8ec45192..db34d77f 100644
 
 /* draft-ietf-secsh-gsskeyex-06 */
 diff --git a/sshd.8 b/sshd.8
-index 2aa73271..049d0a94 100644
+index adcaaf9..824163b 100644
 --- a/sshd.8
 +++ b/sshd.8
-@@ -286,6 +286,7 @@ Finally, the server and the client enter an authentication dialog.
+@@ -324,6 +324,7 @@ Finally, the server and the client enter an authentication dialog.
 The client tries to authenticate itself using
 host-based authentication,
 public key authentication,
@ -277,7 +265,7 @@ index 2aa73271..049d0a94 100644
 challenge-response authentication,
 or password authentication.
 .Pp
-@@ -874,6 +875,12 @@ This file is used in exactly the same way as
+@@ -800,6 +801,12 @@ This file is used in exactly the same way as
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp
@ -290,6 +278,3 @@ index 2aa73271..049d0a94 100644
 .It Pa ~/.ssh/
 This directory is the default location for all user-specific configuration
 and authentication information.
-- 
-2.49.0
-
--- a/0003-openssh-6.6p1-keycat.patch
+++ b/0003-openssh-6.6p1-keycat.patch
@ -1,129 +1,7 @@
-From 5e35e18a419a5a66b6e1cb2b98beaaf4d9db0dc6 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 03/50] openssh-6.6p1-keycat
-
---
- HOWTO.ssh-keycat                 |  12 ++
- Makefile.in                      |   8 +-
- configure.ac                     |   6 +
- misc.c                           |   7 +
- openbsd-compat/port-linux-sshd.c |  44 +++++-
- openbsd-compat/port-linux.h      |   2 +
- platform.c                       |   2 +-
- ssh-keycat.c                     | 241 +++++++++++++++++++++++++++++++
- 8 files changed, 314 insertions(+), 8 deletions(-)
- create mode 100644 HOWTO.ssh-keycat
- create mode 100644 ssh-keycat.c
-
-diff --git a/HOWTO.ssh-keycat b/HOWTO.ssh-keycat
-new file mode 100644
-index 00000000..630ec628
--- /dev/null
-+++ b/HOWTO.ssh-keycat
-@@ -0,0 +1,12 @@
-+The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
-+of an user in any environment. This includes environments with
-+polyinstantiation of home directories and SELinux MLS policy enabled.
-+
-+To use ssh-keycat, set these options in /etc/ssh/sshd_config file:
-+        AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat
-+        AuthorizedKeysCommandUser root
-+
-+Do not forget to enable public key authentication:
-+        PubkeyAuthentication yes
-+
-+
-diff --git a/Makefile.in b/Makefile.in
-index 4617cebc..438efc51 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -23,6 +23,7 @@ SSH_PROGRAM=@bindir@/ssh
- ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
- SFTP_SERVER=$(libexecdir)/sftp-server
- SSH_KEYSIGN=$(libexecdir)/ssh-keysign
-+SSH_KEYCAT=$(libexecdir)/ssh-keycat
- SSHD_SESSION=$(libexecdir)/sshd-session
- SSHD_AUTH=$(libexecdir)/sshd-auth
- SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
-@@ -57,6 +58,7 @@ CHANNELLIBS=@CHANNELLIBS@
- K5LIBS=@K5LIBS@
- GSSLIBS=@GSSLIBS@
- SSHDLIBS=@SSHDLIBS@
-+KEYCATLIBS=@KEYCATLIBS@
- LIBEDIT=@LIBEDIT@
- LIBFIDO2=@LIBFIDO2@
- LIBWTMPDB=@LIBWTMPDB@
-@@ -74,7 +76,7 @@ MKDIR_P=@MKDIR_P@
- 
- .SUFFIXES: .lo
- 
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) sshd-auth$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) $(SK_STANDALONE)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) sshd-auth$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT) $(SK_STANDALONE)
- 
- XMSS_OBJS=\
- 	ssh-xmss.o \
-@@ -260,6 +262,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(P11HELPER_OBJS)
- ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
- 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
- 
-+ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
-+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
-+
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
- 
-@@ -447,6 +452,7 @@ install-files:
- 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
- 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff --git a/configure.ac b/configure.ac
-index ee77a048..d546788c 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -3566,6 +3566,7 @@ AC_ARG_WITH([pam],
- 			PAM_MSG="yes"
- 
- 			SSHDLIBS="$SSHDLIBS -lpam"
-+			KEYCATLIBS="$KEYCATLIBS -lpam"
- 			AC_DEFINE([USE_PAM], [1],
- 				[Define if you want to enable PAM support])
- 
-@@ -3576,6 +3577,7 @@ AC_ARG_WITH([pam],
- 					;;
- 				*)
- 					SSHDLIBS="$SSHDLIBS -ldl"
-+					KEYCATLIBS="$KEYCATLIBS -ldl"
- 					;;
- 				esac
- 			fi
-@@ -4801,6 +4803,7 @@ AC_ARG_WITH([selinux],
- 	fi ]
- )
- AC_SUBST([SSHDLIBS])
-+AC_SUBST([KEYCATLIBS])
- 
- # Check whether user wants Kerberos 5 support
- KRB5_MSG="no"
-@@ -5812,6 +5815,9 @@ fi
- if test ! -z "${SSHDLIBS}"; then
- echo "         +for sshd: ${SSHDLIBS}"
- fi
-+if test ! -z "${KEYCATLIBS}"; then
-+echo "   +for ssh-keycat: ${KEYCATLIBS}"
-+fi
- 
- echo ""
- 
-diff --git a/misc.c b/misc.c
-index c932f9bb..1e31acc9 100644
--- a/misc.c
-+++ b/misc.c
-@@ -2897,6 +2897,13 @@ subprocess(const char *tag, const char *command,
+diff -up openssh/misc.c.keycat openssh/misc.c
+--- openssh/misc.c.keycat	2015-06-24 10:57:50.158849606 +0200
+++ openssh/misc.c	2015-06-24 11:04:23.989868638 +0200
+@@ -966,6 +966,13 @@ subprocess(const char *tag, struct passw
 			error("%s: dup2: %s", tag, strerror(errno));
 			_exit(1);
 		}
@ -137,11 +15,86 @@ index c932f9bb..1e31acc9 100644
 		if (env != NULL)
 			execve(av[0], av, env);
 		else
-diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-index dfafc622..8c5fc1fe 100644
--- a/openbsd-compat/port-linux-sshd.c
-+++ b/openbsd-compat/port-linux-sshd.c
-@@ -52,6 +52,20 @@ extern ServerOptions options;
+diff -up openssh/HOWTO.ssh-keycat.keycat openssh/HOWTO.ssh-keycat
+--- openssh/HOWTO.ssh-keycat.keycat	2015-06-24 10:57:50.157849608 +0200
+++ openssh/HOWTO.ssh-keycat	2015-06-24 10:57:50.157849608 +0200
+@@ -0,0 +1,12 @@
+The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
+of an user in any environment. This includes environments with
+polyinstantiation of home directories and SELinux MLS policy enabled.
+
+To use ssh-keycat, set these options in /etc/ssh/sshd_config file:
+        AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat
+        AuthorizedKeysCommandUser root
+
+Do not forget to enable public key authentication:
+        PubkeyAuthentication yes
+
+
+diff -up openssh/Makefile.in.keycat openssh/Makefile.in
+--- openssh/Makefile.in.keycat	2015-06-24 10:57:50.152849621 +0200
+++ openssh/Makefile.in	2015-06-24 10:57:50.157849608 +0200
+@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
+ ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
+ SFTP_SERVER=$(libexecdir)/sftp-server
+ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
+SSH_KEYCAT=$(libexecdir)/ssh-keycat
+ SSHD_SESSION=$(libexecdir)/sshd-session
+ SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
+ SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
+@@ -52,6 +52,7 @@ K5LIBS=@K5LIBS@
+ K5LIBS=@K5LIBS@
+ GSSLIBS=@GSSLIBS@
+ SSHDLIBS=@SSHDLIBS@
+KEYCATLIBS=@KEYCATLIBS@
+ LIBEDIT=@LIBEDIT@
+ LIBFIDO2=@LIBFIDO2@
+ AR=@AR@
+@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
+ 
+ .SUFFIXES: .lo
+ 
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+ 
+ XMSS_OBJS=\
+ 	ssh-xmss.o \
+@@ -190,6 +191,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
+ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
+ 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
+ 
+ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
+
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
+ 
+@@ -321,6 +325,7 @@ install-files:
+ 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
+ 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
+diff -up openssh/openbsd-compat/port-linux.h.keycat openssh/openbsd-compat/port-linux.h
+--- openssh/openbsd-compat/port-linux.h.keycat	2015-06-24 10:57:50.150849626 +0200
+++ openssh/openbsd-compat/port-linux.h	2015-06-24 10:57:50.160849601 +0200
+@@ -25,8 +25,10 @@ void ssh_selinux_setup_pty(char *, const
+ void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
+ 
+int sshd_selinux_enabled(void);
+ void sshd_selinux_copy_context(void);
+ void sshd_selinux_setup_exec_context(char *);
+int sshd_selinux_setup_env_variables(void);
+ #endif
+ 
+ #ifdef LINUX_OOM_ADJUST
+diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/port-linux-sshd.c
+--- openssh/openbsd-compat/port-linux-sshd.c.keycat	2015-06-24 10:57:50.150849626 +0200
+++ openssh/openbsd-compat/port-linux-sshd.c	2015-06-24 10:57:50.159849603 +0200
+@@ -54,6 +54,20 @@ extern Authctxt *the_authctxt;
 extern Authctxt *the_authctxt;
 extern int inetd_flag;
 
@ -162,7 +115,7 @@ index dfafc622..8c5fc1fe 100644
 /* Send audit message */
 static int
 sshd_selinux_send_audit_message(int success, security_context_t default_context,
-@@ -317,7 +331,7 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -308,7 +322,7 @@ sshd_selinux_getctxbyname(char *pwname,
 
 /* Setup environment variables for pam_selinux */
 static int
@ -171,7 +124,7 @@ index dfafc622..8c5fc1fe 100644
 {
 	const char *reqlvl;
 	char *role;
-@@ -328,16 +342,16 @@ sshd_selinux_setup_pam_variables(void)
+@@ -319,16 +333,16 @@ sshd_selinux_setup_pam_variables(void)
 
 	ssh_selinux_get_role_level(&role, &reqlvl);
 
@ -191,7 +144,7 @@ index dfafc622..8c5fc1fe 100644
 
 	if (role != NULL)
 		free(role);
-@@ -345,6 +359,24 @@ sshd_selinux_setup_pam_variables(void)
+@@ -336,6 +350,24 @@ sshd_selinux_setup_pam_variables(void)
 	return rv;
 }
 
@ -216,7 +169,7 @@ index dfafc622..8c5fc1fe 100644
 /* Set the execution context to the default for the specified user */
 void
 sshd_selinux_setup_exec_context(char *pwname)
-@@ -353,7 +385,7 @@ sshd_selinux_setup_exec_context(char *pwname)
+@@ -344,7 +376,7 @@ sshd_selinux_setup_exec_context(char *pw
 	int r = 0;
 	security_context_t default_ctx = NULL;
 
@ -225,7 +178,7 @@ index dfafc622..8c5fc1fe 100644
 		return;
 
 	if (options.use_pam) {
-@@ -420,7 +452,7 @@ sshd_selinux_copy_context(void)
+@@ -415,7 +447,7 @@ sshd_selinux_copy_context(void)
 {
 	security_context_t *ctx;
 
@ -234,26 +187,10 @@ index dfafc622..8c5fc1fe 100644
 		return;
 
 	if (getexeccon((security_context_t *)&ctx) != 0) {
-diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 498d242a..1b745a76 100644
--- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -23,8 +23,10 @@ void ssh_selinux_setup_pty(char *, const char *);
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
- 
-+int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
-+int sshd_selinux_setup_env_variables(void);
- #endif
- 
- #ifdef LINUX_OOM_ADJUST
-diff --git a/platform.c b/platform.c
-index 1bfb4bea..0d12f311 100644
--- a/platform.c
-+++ b/platform.c
-@@ -55,7 +55,7 @@ platform_setusercontext(struct passwd *pw)
+diff -up openssh/platform.c.keycat openssh/platform.c
+--- openssh/platform.c.keycat	2015-06-24 10:57:50.147849633 +0200
+++ openssh/platform.c	2015-06-24 10:57:50.160849601 +0200
+@@ -103,7 +103,7 @@ platform_setusercontext(struct passwd *p
 {
 #ifdef WITH_SELINUX
 	/* Cache selinux status for later use */
@ -262,11 +199,9 @@ index 1bfb4bea..0d12f311 100644
 #endif
 
 #ifdef USE_SOLARIS_PROJECTS
-diff --git a/ssh-keycat.c b/ssh-keycat.c
-new file mode 100644
-index 00000000..5678be07
--- /dev/null
-+++ b/ssh-keycat.c
+diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
+--- openssh/ssh-keycat.c.keycat	2015-06-24 10:57:50.161849599 +0200
+++ openssh/ssh-keycat.c	2015-06-24 10:57:50.161849599 +0200
@@ -0,0 +1,241 @@
 +/*
 + * Redistribution and use in source and binary forms, with or without
@ -509,6 +444,41 @@ index 00000000..5678be07
 +	}
 +	return ev;
 +}
-- 
-2.49.0
-
+diff --git a/configure.ac b/configure.ac
+index 3bbccfd..6481f1f 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -2952,6 +2952,7 @@ AC_ARG_WITH([pam],
+ 			PAM_MSG="yes"
+ 
+ 			SSHDLIBS="$SSHDLIBS -lpam"
+			KEYCATLIBS="$KEYCATLIBS -lpam"
+ 			AC_DEFINE([USE_PAM], [1],
+ 				[Define if you want to enable PAM support])
+ 
+@@ -3105,6 +3106,7 @@
+ 					;;
+ 				*)
+ 					SSHDLIBS="$SSHDLIBS -ldl"
+					KEYCATLIBS="$KEYCATLIBS -ldl"
+ 					;;
+ 				esac
+ 			fi
+@@ -4042,6 +4044,7 @@ AC_ARG_WITH([selinux],
+ 	fi ]
+ )
+ AC_SUBST([SSHDLIBS])
+AC_SUBST([KEYCATLIBS])
+ 
+ # Check whether user wants Kerberos 5 support
+ KRB5_MSG="no"
+@@ -5031,6 +5034,9 @@ fi
+ if test ! -z "${SSHDLIBS}"; then
+ echo "         +for sshd: ${SSHDLIBS}"
+ fi
+if test ! -z "${KEYCATLIBS}"; then
+echo "   +for ssh-keycat: ${KEYCATLIBS}"
+fi
+ 
+ echo ""
+ 
--- a/0016-openssh-6.6p1-kuserok.patch
+++ b/0016-openssh-6.6p1-kuserok.patch
@ -1,22 +1,7 @@
-From bac7a9d1a654c8c2e0c71f979195e300b25d6232 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 16/50] openssh-6.6p1-kuserok
-
---
- auth-krb5.c     |  20 ++++++++-
- gss-serv-krb5.c | 106 ++++++++++++++++++++++++++++++++++++++++++++++--
- servconf.c      |  13 +++++-
- servconf.h      |   1 +
- sshd_config     |   1 +
- sshd_config.5   |   5 +++
- 6 files changed, 139 insertions(+), 7 deletions(-)
-
-diff --git a/auth-krb5.c b/auth-krb5.c
-index 74f56d47..bae153c9 100644
--- a/auth-krb5.c
-+++ b/auth-krb5.c
-@@ -55,6 +55,21 @@
+diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c
+--- openssh-7.4p1/auth-krb5.c.kuserok	2016-12-23 14:36:07.640465939 +0100
+++ openssh-7.4p1/auth-krb5.c	2016-12-23 14:36:07.644465936 +0100
+@@ -56,6 +56,21 @@
 
 extern ServerOptions	 options;
 
@ -38,7 +23,7 @@ index 74f56d47..bae153c9 100644
 static int
 krb5_init(void *context)
 {
-@@ -158,8 +173,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
+@@ -160,8 +175,9 @@ auth_krb5_password(Authctxt *authctxt, c
 	if (problem)
 		goto out;
 
@ -50,11 +35,10 @@ index 74f56d47..bae153c9 100644
 		problem = -1;
 		goto out;
 	}
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 820f794c..187faf92 100644
--- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -66,6 +66,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_principal, const char *, const char *,
+diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
+--- openssh-7.4p1/gss-serv-krb5.c.kuserok	2016-12-23 14:36:07.640465939 +0100
+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 14:36:07.644465936 +0100
+@@ -67,6 +67,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr
     int);
 
 static krb5_context krb_context = NULL;
@ -62,7 +46,7 @@ index 820f794c..187faf92 100644
 
 /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
 
-@@ -91,6 +92,103 @@ ssh_gssapi_krb5_init(void)
+@@ -92,6 +93,103 @@ ssh_gssapi_krb5_init(void)
  * Returns true if the user is OK to log in, otherwise returns 0
  */
 
@ -166,7 +150,7 @@ index 820f794c..187faf92 100644
 static int
 ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
 {
-@@ -115,7 +213,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -116,7 +214,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
 	/* NOTE: .k5login and .k5users must opened as root, not the user,
 	 * because if they are on a krb5-protected filesystem, user credentials
 	 * to access these files aren't available yet. */
@ -176,7 +160,7 @@ index 820f794c..187faf92 100644
 		retval = 1;
 		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
 		    name, (char *)client->displayname.value);
-@@ -190,9 +289,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+@@ -190,9 +289,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
 	/* If both .k5login and .k5users DNE, self-login is ok. */
 	if (!k5login_exists && (access(file, F_OK) == -1)) {
@ -188,19 +172,18 @@ index 820f794c..187faf92 100644
 	}
 	if ((fp = fopen(file, "r")) == NULL) {
 		int saved_errno = errno;
-diff --git a/servconf.c b/servconf.c
-index 55aa5bf0..5dd5ca21 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -145,6 +145,7 @@ initialize_server_options(ServerOptions *options)
+diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
+--- openssh-7.4p1/servconf.c.kuserok	2016-12-23 14:36:07.630465944 +0100
+++ openssh-7.4p1/servconf.c	2016-12-23 15:11:52.278133344 +0100
+@@ -116,6 +116,7 @@ initialize_server_options(ServerOptions
 	options->gss_strict_acceptor = -1;
 	options->gss_store_rekey = -1;
 	options->gss_kex_algorithms = NULL;
 +	options->use_kuserok = -1;
 	options->password_authentication = -1;
 	options->kbd_interactive_authentication = -1;
- 	options->permit_empty_passwd = -1;
-@@ -399,6 +400,8 @@ fill_default_server_options(ServerOptions *options)
+	options->permit_empty_passwd = -1;
+@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
 	if (options->gss_kex_algorithms == NULL)
 		options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
 #endif
@ -209,16 +192,16 @@ index 55aa5bf0..5dd5ca21 100644
 	if (options->password_authentication == -1)
 		options->password_authentication = 1;
 	if (options->kbd_interactive_authentication == -1)
-@@ -567,7 +570,7 @@ typedef enum {
- 	sPort, sHostKeyFile, sLoginGraceTime,
- 	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
- 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
+@@ -399,7 +402,7 @@ typedef enum {
+	sPort, sHostKeyFile, sLoginGraceTime,
+	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
+	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 -	sKerberosGetAFSToken, sKerberosUniqueCCache, sPasswordAuthentication,
 +	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication,
- 	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
- 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
- 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-@@ -659,12 +662,14 @@ static struct {
+	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
+	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
+@@ -478,12 +481,14 @@ static struct {
 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 #endif
 	{ "kerberosuniqueccache", sKerberosUniqueCCache, SSHCFG_GLOBAL },
@ -233,18 +216,18 @@ index 55aa5bf0..5dd5ca21 100644
 #endif
 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -2441,6 +2446,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- 		}
- 		break;
- 
+@@ -1644,6 +1649,10 @@ process_server_config_line(ServerOptions
+		}
+		break;
+
 +	case sKerberosUseKuserok:
 +		intptr = &options->use_kuserok;
 +		goto parse_flag;
 +
- 	case sMatch:
- 		if (cmdline)
- 			fatal("Match directive not supported as a command-line "
-@@ -2995,6 +3004,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+	case sMatch:
+		if (cmdline)
+			fatal("Match directive not supported as a command-line "
+@@ -2016,6 +2025,7 @@ copy_set_server_options(ServerOptions *d
 	M_CP_INTOPT(client_alive_interval);
 	M_CP_INTOPT(ip_qos_interactive);
 	M_CP_INTOPT(ip_qos_bulk);
@ -252,19 +235,18 @@ index 55aa5bf0..5dd5ca21 100644
 	M_CP_INTOPT(rekey_limit);
 	M_CP_INTOPT(rekey_interval);
 	M_CP_INTOPT(log_level);
-@@ -3303,6 +3313,7 @@ dump_config(ServerOptions *o)
+@@ -2309,6 +2319,7 @@ dump_config(ServerOptions *o)
 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
 # endif
 	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
 +	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
 #endif
 #ifdef GSSAPI
- 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff --git a/servconf.h b/servconf.h
-index a4a38d6d..11de36a2 100644
--- a/servconf.h
-+++ b/servconf.h
-@@ -151,6 +151,7 @@ typedef struct {
+	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
+diff -up openssh-7.4p1/servconf.h.kuserok openssh-7.4p1/servconf.h
+--- openssh-7.4p1/servconf.h.kuserok	2016-12-23 14:36:07.630465944 +0100
+++ openssh-7.4p1/servconf.h	2016-12-23 14:36:07.645465936 +0100
+@@ -118,6 +118,7 @@ typedef struct {
 						 * authenticated with Kerberos. */
 	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
 						 * be stored in per-session ccache */
@ -272,23 +254,10 @@ index a4a38d6d..11de36a2 100644
 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff --git a/sshd_config b/sshd_config
-index 8db9f0fb..ea5a878e 100644
--- a/sshd_config
-+++ b/sshd_config
-@@ -75,6 +75,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
- #KerberosOrLocalPasswd yes
- #KerberosTicketCleanup yes
- #KerberosGetAFSToken no
-+#KerberosUseKuserok yes
- 
- # GSSAPI options
- #GSSAPIAuthentication no
-diff --git a/sshd_config.5 b/sshd_config.5
-index 1251d4d5..0fcb409a 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -1041,6 +1041,10 @@ The default value
+diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5
+--- openssh-7.4p1/sshd_config.5.kuserok	2016-12-23 14:36:07.637465940 +0100
+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:14:03.117162222 +0100
+@@ -850,6 +850,10 @@ Specifies whether to automatically destr
 .Cm no
 can lead to overwriting previous tickets by subseqent connections to the same
 user account.
@ -299,7 +268,7 @@ index 1251d4d5..0fcb409a 100644
 .It Cm KexAlgorithms
 Specifies the permitted KEX (Key Exchange) algorithms that the server will
 offer to clients.
-@@ -1355,6 +1359,7 @@ Available keywords are
+@@ -1078,6 +1082,7 @@ Available keywords are
 .Cm IPQoS ,
 .Cm KbdInteractiveAuthentication ,
 .Cm KerberosAuthentication ,
@ -307,6 +276,14 @@ index 1251d4d5..0fcb409a 100644
 .Cm LogLevel ,
 .Cm MaxAuthTries ,
 .Cm MaxSessions ,
-- 
-2.49.0
-
+diff -up openssh-7.4p1/sshd_config.kuserok openssh-7.4p1/sshd_config
+--- openssh-7.4p1/sshd_config.kuserok	2016-12-23 14:36:07.631465943 +0100
+++ openssh-7.4p1/sshd_config	2016-12-23 14:36:07.646465935 +0100
+@@ -73,6 +73,7 @@ ChallengeResponseAuthentication no
+ #KerberosOrLocalPasswd yes
+ #KerberosTicketCleanup yes
+ #KerberosGetAFSToken no
+#KerberosUseKuserok yes
+ 
+ # GSSAPI options
+ #GSSAPIAuthentication no
--- a/0002-openssh-6.6p1-privsep-selinux.patch
+++ b/0002-openssh-6.6p1-privsep-selinux.patch
@ -1,21 +1,18 @@
-From 99d8e250514023d3b88a1c9eb724c4898aba9827 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 02/50] openssh-6.6p1-privsep-selinux
-
---
- openbsd-compat/port-linux-sshd.c | 22 ++++++++++++++++++++++
- openbsd-compat/port-linux.h      |  1 +
- session.c                        | 16 +++++++++-------
- sshd-auth.c                      |  4 ++++
- sshd-session.c                   |  2 +-
- 5 files changed, 37 insertions(+), 8 deletions(-)
-
-diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-index b9fbe38b..dfafc622 100644
--- a/openbsd-compat/port-linux-sshd.c
-+++ b/openbsd-compat/port-linux-sshd.c
-@@ -415,6 +415,28 @@ sshd_selinux_setup_exec_context(char *pwname)
+diff -up openssh-7.4p1/openbsd-compat/port-linux.h.privsep-selinux openssh-7.4p1/openbsd-compat/port-linux.h
+--- openssh-7.4p1/openbsd-compat/port-linux.h.privsep-selinux	2016-12-23 18:58:52.972122201 +0100
+++ openssh-7.4p1/openbsd-compat/port-linux.h	2016-12-23 18:58:52.974122201 +0100
+@@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const
+ void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
+ 
+void sshd_selinux_copy_context(void);
+ void sshd_selinux_setup_exec_context(char *);
+ #endif
+ 
+diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux openssh-7.4p1/openbsd-compat/port-linux-sshd.c
+--- openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
+++ openssh-7.4p1/openbsd-compat/port-linux-sshd.c	2016-12-23 18:58:52.974122201 +0100
+@@ -419,6 +419,28 @@ sshd_selinux_setup_exec_context(char *pw
 	debug3_f("done");
 }
 
@ -44,23 +41,10 @@ index b9fbe38b..dfafc622 100644
 #endif
 #endif
 
-diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 055c825e..498d242a 100644
--- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const char *);
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
- 
-+void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
- #endif
- 
-diff --git a/session.c b/session.c
-index 6444c77f..e4657cef 100644
--- a/session.c
-+++ b/session.c
-@@ -1350,7 +1350,7 @@ do_setusercontext(struct passwd *pw)
+diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
+--- openssh-7.4p1/session.c.privsep-selinux	2016-12-19 05:59:41.000000000 +0100
+++ openssh-7.4p1/session.c	2016-12-23 18:58:52.974122201 +0100
+@@ -1331,7 +1331,7 @@ do_setusercontext(struct passwd *pw)
 
 	platform_setusercontext(pw);
 
@ -69,17 +53,17 @@ index 6444c77f..e4657cef 100644
 #ifdef HAVE_LOGIN_CAP
 		if (setusercontext(lc, pw, pw->pw_uid,
 		    (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
-@@ -1382,6 +1382,9 @@ do_setusercontext(struct passwd *pw)
- 			    (unsigned long long)pw->pw_uid);
- 			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
- 			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
+@@ -1361,6 +1361,9 @@ do_setusercontext(struct passwd *pw)
+			    (unsigned long long)pw->pw_uid);
+			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
+			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
 +#ifdef WITH_SELINUX
 +			sshd_selinux_copy_context();
 +#endif
 			safely_chroot(chroot_path, pw->pw_uid);
 			free(tmp);
 			free(chroot_path);
-@@ -1417,6 +1420,11 @@ do_setusercontext(struct passwd *pw)
+@@ -1396,6 +1399,11 @@ do_setusercontext(struct passwd *pw)
 		/* Permanently switch to the desired uid. */
 		permanently_set_uid(pw);
 #endif
@ -91,17 +75,17 @@ index 6444c77f..e4657cef 100644
 	} else if (options.chroot_directory != NULL &&
 	    strcasecmp(options.chroot_directory, "none") != 0) {
 		fatal("server lacks privileges to chroot to ChrootDirectory");
-@@ -1434,9 +1442,6 @@ do_pwchange(Session *s)
+@@ -1413,9 +1421,6 @@ do_pwchange(Session *s)
 	if (s->ttyfd != -1) {
 		fprintf(stderr,
- 		    "You must change your password now and log in again!\n");
+ 		    "You must change your password now and login again!\n");
 -#ifdef WITH_SELINUX
 -		setexeccon(NULL);
 -#endif
 #ifdef PASSWD_NEEDS_USERNAME
 		execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
 		    (char *)NULL);
-@@ -1649,9 +1654,6 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+@@ -1625,9 +1630,6 @@ do_child(Session *s, const char *command
 		argv[i] = NULL;
 		optind = optreset = 1;
 		__progname = argv[0];
@ -111,14 +95,13 @@ index 6444c77f..e4657cef 100644
 		exit(sftp_server_main(i, argv, s->pw));
 	}
 
-diff --git a/sshd-auth.c b/sshd-auth.c
-index 30eecd8a..f957dc22 100644
--- a/sshd-auth.c
-+++ b/sshd-auth.c
-@@ -187,6 +187,10 @@ privsep_child_demote(void)
- 	if ((box = ssh_sandbox_init(pmonitor)) == NULL)
- 		fatal_f("ssh_sandbox_init failed");
- #endif
+diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
+--- openssh-7.4p1/sshd-session.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
+++ openssh-7.4p1/sshd-session.c	2016-12-23 18:59:13.808124269 +0100
+@@ -540,6 +540,10 @@ privsep_preauth_child(void)
+ 	/* Demote the private keys to public keys. */
+ 	demote_sensitive_data();
+ 
 +#ifdef WITH_SELINUX
 +	ssh_selinux_change_context("sshd_net_t");
 +#endif
@ -126,11 +109,7 @@ index 30eecd8a..f957dc22 100644
 	/* Demote the child */
 	if (privsep_chroot) {
 		/* Change our root directory */
-diff --git a/sshd-session.c b/sshd-session.c
-index 74d2cbc7..4a148db4 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -432,7 +432,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
+@@ -403,7 +403,7 @@ privsep_postauth(struct ssh *ssh, Authct
 	 * fd passing, as AFAIK PTY allocation on this platform doesn't require
 	 * special privileges to begin with.
 	 */
@ -139,6 +118,3 @@ index 74d2cbc7..4a148db4 100644
 	skip_privdrop = 1;
 #endif
 
-- 
-2.49.0
-
--- a/openssh-6.7p1-coverity.patch
+++ b/openssh-6.7p1-coverity.patch
@ -0,0 +1,248 @@
+diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
+--- openssh-8.5p1/auth-krb5.c.coverity	2021-03-24 12:03:33.724967756 +0100
+++ openssh-8.5p1/auth-krb5.c	2021-03-24 12:03:33.782968159 +0100
+@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
+ 		umask(old_umask);
+ 		if (tmpfd == -1) {
+ 			logit("mkstemp(): %.100s", strerror(oerrno));
+			free(ccname);
+ 			return oerrno;
+ 		}
+ 
+@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
+ 			oerrno = errno;
+ 			logit("fchmod(): %.100s", strerror(oerrno));
+ 			close(tmpfd);
+			free(ccname);
+ 			return oerrno;
+ 		}
+ 		/* make sure the KRB5CCNAME is set for non-standard location */
+diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
+--- openssh-8.5p1/gss-genr.c.coverity	2021-03-26 11:52:46.613942552 +0100
+++ openssh-8.5p1/gss-genr.c	2021-03-26 11:54:37.881726318 +0100
+@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
+ 			enclen = __b64_ntop(digest,
+ 			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
+ 			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
+-
+#pragma GCC diagnostic ignored "-Wstringop-overflow"
+ 			cp = strncpy(s, kex, strlen(kex));
+#pragma GCC diagnostic pop
+ 			for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 				(p = strsep(&cp, ","))) {
+ 				if (sshbuf_len(buf) != 0 &&
+diff -up openssh-8.5p1/krl.c.coverity openssh-8.5p1/krl.c
+--- openssh-8.5p1/krl.c.coverity	2021-03-02 11:31:47.000000000 +0100
+++ openssh-8.5p1/krl.c	2021-03-24 12:03:33.783968166 +0100
+@@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, cons
+ 		return r;
+ 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
+ 	free(rb.blob);
+	rb.blob = NULL; /* make coverity happy */
+ 	if (erb != NULL) {
+ 		KRL_DBG(("revoked by key SHA1"));
+ 		return SSH_ERR_KEY_REVOKED;
+@@ -1271,6 +1273,7 @@ is_key_revoked(struct ssh_krl *krl, cons
+ 		return r;
+ 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
+ 	free(rb.blob);
+	rb.blob = NULL; /* make coverity happy */
+ 	if (erb != NULL) {
+ 		KRL_DBG(("revoked by key SHA256"));
+ 		return SSH_ERR_KEY_REVOKED;
+@@ -1282,6 +1285,7 @@ is_key_revoked(struct ssh_krl *krl, cons
+ 		return r;
+ 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
+ 	free(rb.blob);
+	rb.blob = NULL; /* make coverity happy */
+ 	if (erb != NULL) {
+ 		KRL_DBG(("revoked by explicit key"));
+ 		return SSH_ERR_KEY_REVOKED;
+diff -up openssh-8.5p1/loginrec.c.coverity openssh-8.5p1/loginrec.c
+--- openssh-8.5p1/loginrec.c.coverity	2021-03-24 13:18:53.793225885 +0100
+++ openssh-8.5p1/loginrec.c	2021-03-24 13:21:27.948404751 +0100
+@@ -690,9 +690,11 @@ construct_utmp(struct logininfo *li,
+ 	 */
+ 
+ 	/* Use strncpy because we don't necessarily want null termination */
+	/* coverity[buffer_size_warning : FALSE] */
+ 	strncpy(ut->ut_name, li->username,
+ 	    MIN_SIZEOF(ut->ut_name, li->username));
+ # ifdef HAVE_HOST_IN_UTMP
+	/* coverity[buffer_size_warning : FALSE] */
+ 	strncpy(ut->ut_host, li->hostname,
+ 	    MIN_SIZEOF(ut->ut_host, li->hostname));
+ # endif
+diff -up openssh-8.5p1/misc.c.coverity openssh-8.5p1/misc.c
+--- openssh-8.5p1/misc.c.coverity	2021-03-24 12:03:33.745967902 +0100
+++ openssh-8.5p1/misc.c	2021-03-24 13:31:47.037079617 +0100
+@@ -1425,6 +1425,8 @@ sanitise_stdfd(void)
+ 	}
+ 	if (nullfd > STDERR_FILENO)
+ 		close(nullfd);
+	/* coverity[leaked_handle : FALSE]*/
+	/* coverity[leaked_handle : FALSE]*/
+ }
+ 
+ char *
+@@ -2511,6 +2513,7 @@ stdfd_devnull(int do_stdin, int do_stdou
+ 	}
+ 	if (devnull > STDERR_FILENO)
+ 		close(devnull);
+	/* coverity[leaked_handle : FALSE]*/
+ 	return ret;
+ }
+ 
+diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
+--- openssh-7.4p1/monitor.c.coverity	2016-12-23 16:40:26.888788688 +0100
+++ openssh-7.4p1/monitor.c	2016-12-23 16:40:26.900788691 +0100
+@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx
+ 	mm_get_keystate(ssh, pmonitor);
+ 
+ 	/* Drain any buffered messages from the child */
+-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
+ 		;
+ 
+ 	if (pmonitor->m_recvfd >= 0)
+@@ -1678,7 +1678,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
+ 	s->ptymaster = s->ptyfd;
+ 
+ 	debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
+-
+	/* coverity[leaked_handle : FALSE] */
+ 	return (0);
+ 
+  error:
+diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
+--- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity	2016-12-19 05:59:41.000000000 +0100
+++ openssh-7.4p1/openbsd-compat/bindresvport.c	2016-12-23 16:40:26.901788691 +0100
+@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
+ 	struct sockaddr_in6 *in6;
+ 	u_int16_t *portp;
+ 	u_int16_t port;
+-	socklen_t salen;
+	socklen_t salen = sizeof(struct sockaddr_storage);
+ 	int i;
+ 
+ 	if (sa == NULL) {
+diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openbsd-compat/bsd-pselect.c
+--- openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity	2021-08-30 16:36:11.357288009 +0200
+++ openssh-8.7p1/openbsd-compat/bsd-pselect.c	2021-08-30 16:37:21.791897976 +0200
+@@ -113,13 +113,13 @@ pselect_notify_setup(void)
+ static void
+ pselect_notify_parent(void)
+ {
+-	if (notify_pipe[1] != -1)
+	if (notify_pipe[1] >= 0)
+ 		(void)write(notify_pipe[1], "", 1);
+ }
+ static void
+ pselect_notify_prepare(fd_set *readset)
+ {
+-	if (notify_pipe[0] != -1)
+	if (notify_pipe[0] >= 0)
+ 		FD_SET(notify_pipe[0], readset);
+ }
+ static void
+@@ -127,8 +127,8 @@ pselect_notify_done(fd_set *readset)
+ {
+ 	char c;
+ 
+-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
+-		while (read(notify_pipe[0], &c, 1) != -1)
+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
+		while (read(notify_pipe[0], &c, 1) >= 0)
+ 			debug2_f("reading");
+ 		FD_CLR(notify_pipe[0], readset);
+ 	}
+diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
+--- openssh-8.5p1/readconf.c.coverity	2021-03-24 12:03:33.778968131 +0100
+++ openssh-8.5p1/readconf.c	2021-03-24 12:03:33.785968180 +0100
+@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
+ 			} else if (r != 0) {
+ 				error("%.200s line %d: glob failed for %s.",
+ 				    filename, linenum, arg2);
+				free(arg2);
+ 				goto out;
+ 			}
+ 			free(arg2);
+diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
+--- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
+++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
+@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
+ 		if (*activep && *charptr == NULL) {
+ 			*charptr = tilde_expand_filename(arg, getuid());
+ 			/* increase optional counter */
+-			if (intptr != NULL)
+-				*intptr = *intptr + 1;
+			/* DEAD CODE intptr is still NULL ;)
+  			 if (intptr != NULL)
+				*intptr = *intptr + 1; */
+ 		}
+ 		break;
+ 
+diff -up openssh-8.7p1/serverloop.c.coverity openssh-8.7p1/serverloop.c
+--- openssh-8.7p1/serverloop.c.coverity	2021-08-20 06:03:49.000000000 +0200
+++ openssh-8.7p1/serverloop.c	2021-08-30 16:28:22.416226981 +0200
+@@ -547,7 +547,7 @@ server_request_tun(struct ssh *ssh)
+ 		debug_f("invalid tun");
+ 		goto done;
+ 	}
+-	if (auth_opts->force_tun_device != -1) {
+	if (auth_opts->force_tun_device >= 0) {
+ 		if (tun != SSH_TUNID_ANY &&
+ 		    auth_opts->force_tun_device != (int)tun)
+ 			goto done;
+diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
+--- openssh-7.4p1/ssh-agent.c.coverity	2016-12-19 05:59:41.000000000 +0100
+++ openssh-7.4p1/ssh-agent.c	2016-12-23 16:40:26.903788691 +0100
+@@ -869,6 +869,7 @@ sanitize_pkcs11_provider(const char *pro
+ 
+ 		if (pkcs11_uri_parse(provider, uri) != 0) {
+ 			error("Failed to parse PKCS#11 URI");
+			pkcs11_uri_cleanup(uri);
+ 			return NULL;
+ 		}
+ 		/* validate also provider from URI */
+diff -up openssh-7.4p1/sshd-session.c.coverity openssh-7.4p1/sshd-session.c
+--- openssh-7.4p1/sshd-session.c.coverity	2016-12-23 16:40:26.897788690 +0100
+++ openssh-7.4p1/sshd-session.c	2016-12-23 16:40:26.904788692 +0100
+@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
+ 
+ 		privsep_preauth_child(ssh);
+ 		setproctitle("%s", "[net]");
+-		if (box != NULL)
+		if (box != NULL) {
+ 			ssh_sandbox_child(box);
+			free(box);
+		}
+ 
+ 		return 0;
+ 	}
+@@ -2519,8 +2524,11 @@ do_ssh2_kex(struct ssh *ssh)
+ 
+ 	if (newstr)
+ 		myproposal[PROPOSAL_KEX_ALGS] = newstr;
+-	else
+	else {
+ 		fatal("No supported key exchange algorithms");
+		free(gss);
+	     }
+	     /* coverity[leaked_storage: FALSE]*/
+ 	}
+ #endif
+ 
+diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
+--- openssh-8.5p1/ssh-keygen.c.coverity	2021-03-24 12:03:33.780968145 +0100
+++ openssh-8.5p1/ssh-keygen.c	2021-03-24 12:03:33.787968194 +0100
+@@ -2332,6 +2332,9 @@ update_krl_from_file(struct passwd *pw,
+ 			r = ssh_krl_revoke_key_sha256(krl, blob, blen);
+ 			if (r != 0)
+ 				fatal_fr(r, "revoke key failed");
+			freezero(blob, blen);
+			blob = NULL;
+			blen = 0;
+ 		} else {
+ 			if (strncasecmp(cp, "key:", 4) == 0) {
+ 				cp += 4;
--- a/0023-openssh-6.7p1-sftp-force-permission.patch
+++ b/0023-openssh-6.7p1-sftp-force-permission.patch
@ -1,17 +1,6 @@
-From 34b196198018059bed294fa7a08e70606b4cbc36 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 23/50] openssh-6.7p1-sftp-force-permission
-
---
- sftp-server.8 |  7 +++++++
- sftp-server.c | 24 ++++++++++++++++++++++--
- 2 files changed, 29 insertions(+), 2 deletions(-)
-
-diff --git a/sftp-server.8 b/sftp-server.8
-index 5311bf92..5e6e3aa4 100644
--- a/sftp-server.8
-+++ b/sftp-server.8
+diff -up openssh-7.2p2/sftp-server.8.sftp-force-mode openssh-7.2p2/sftp-server.8
+--- openssh-7.2p2/sftp-server.8.sftp-force-mode	2016-03-09 19:04:48.000000000 +0100
+++ openssh-7.2p2/sftp-server.8	2016-06-23 16:18:20.463854117 +0200
@@ -38,6 +38,7 @@
 .Op Fl P Ar denied_requests
 .Op Fl p Ar allowed_requests
@ -33,11 +22,10 @@ index 5311bf92..5e6e3aa4 100644
 .El
 .Pp
 On some systems,
-diff --git a/sftp-server.c b/sftp-server.c
-index 4985da38..6ed1c27f 100644
--- a/sftp-server.c
-+++ b/sftp-server.c
-@@ -76,6 +76,10 @@ struct sshbuf *oqueue;
+diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
+--- openssh-7.2p2/sftp-server.c.sftp-force-mode	2016-06-23 16:18:20.446854128 +0200
+++ openssh-7.2p2/sftp-server.c	2016-06-23 16:20:37.950766082 +0200
+@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
 /* Version of client */
 static u_int version;
 
@ -48,7 +36,7 @@ index 4985da38..6ed1c27f 100644
 /* SSH2_FXP_INIT received */
 static int init_done;
 
-@@ -745,6 +749,7 @@ process_open(u_int32_t id)
+@@ -683,6 +687,7 @@ process_open(u_int32_t id)
 	Attrib a;
 	char *name;
 	int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
@ -56,7 +44,7 @@ index 4985da38..6ed1c27f 100644
 
 	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
 	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
-@@ -754,6 +759,10 @@ process_open(u_int32_t id)
+@@ -692,6 +697,10 @@ process_open(u_int32_t id)
 	debug3("request %u: open flags %d", id, pflags);
 	flags = flags_from_portable(pflags);
 	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
@ -67,7 +55,7 @@ index 4985da38..6ed1c27f 100644
 	logit("open \"%s\" flags %s mode 0%o",
 	    name, string_from_portable(pflags), mode);
 	if (readonly &&
-@@ -775,6 +784,8 @@ process_open(u_int32_t id)
+@@ -713,6 +722,8 @@ process_open(u_int32_t id)
 			}
 		}
 	}
@ -76,7 +64,7 @@ index 4985da38..6ed1c27f 100644
 	if (status != SSH2_FX_OK)
 		send_status(id, status);
 	free(name);
-@@ -1894,7 +1905,7 @@ sftp_server_usage(void)
+@@ -1494,7 +1505,7 @@ sftp_server_usage(void)
 	fprintf(stderr,
 	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
 	    "[-l log_level]\n\t[-P denied_requests] "
@ -85,7 +73,7 @@ index 4985da38..6ed1c27f 100644
 	    "       %s -Q protocol_feature\n",
 	    __progname, __progname);
 	exit(1);
-@@ -1918,7 +1929,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handle
+@@ -1520,7 +1531,7 @@ sftp_server_main(int argc, char **argv,
 	pw = pwcopy(user_pw);
 
 	while (!skipargs && (ch = getopt(argc, argv,
@ -94,7 +82,7 @@ index 4985da38..6ed1c27f 100644
 		switch (ch) {
 		case 'Q':
 			if (strcasecmp(optarg, "requests") != 0) {
-@@ -1980,6 +1991,15 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handle
+@@ -1580,6 +1591,15 @@ sftp_server_main(int argc, char **argv,
 				fatal("Invalid umask \"%s\"", optarg);
 			(void)umask((mode_t)mask);
 			break;
@ -110,6 +98,3 @@ index 4985da38..6ed1c27f 100644
 		case 'h':
 		default:
 			sftp_server_usage();
-- 
-2.49.0
-
--- a/openssh-6.8p1-sshdT-output.patch
+++ b/openssh-6.8p1-sshdT-output.patch
@ -0,0 +1,12 @@
+diff -up openssh/servconf.c.sshdt openssh/servconf.c
+--- openssh/servconf.c.sshdt	2015-06-24 11:42:29.041078704 +0200
+++ openssh/servconf.c	2015-06-24 11:44:39.734745802 +0200
+@@ -2317,7 +2317,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_string(sXAuthLocation, o->xauth_location);
+ 	dump_cfg_string(sCiphers, o->ciphers);
+ 	dump_cfg_string(sMacs, o->macs);
+-	dump_cfg_string(sBanner, o->banner);
+	dump_cfg_string(sBanner, o->banner != NULL ? o->banner : "none");
+ 	dump_cfg_string(sForceCommand, o->adm_forced_command);
+ 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
+ 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
--- a/0040-openssh-7.1p2-audit-race-condition.patch
+++ b/0040-openssh-7.1p2-audit-race-condition.patch
@ -1,19 +1,7 @@
-From c288d4a26ad44dc481c9d18d2920c9d70474833c Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 40/50] openssh-7.1p2-audit-race-condition
-
---
- monitor_wrap.c | 46 +++++++++++++++++++++++++++++++++++++
- monitor_wrap.h |  2 ++
- session.c      | 61 ++++++++++++++++++++++++++++++++++++++++++++------
- 3 files changed, 102 insertions(+), 7 deletions(-)
-
-diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 1a079c15..768a59f9 100644
--- a/monitor_wrap.c
-+++ b/monitor_wrap.c
-@@ -1415,4 +1415,50 @@ mm_audit_destroy_sensitive_data(struct ssh *ssh, const char *fp, pid_t pid, uid_
+diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
+--- openssh-7.4p1/monitor_wrap.c.audit-race	2016-12-23 16:35:52.694685771 +0100
+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:35:52.697685772 +0100
+@@ -1107,4 +1107,50 @@ mm_audit_destroy_sensitive_data(const ch
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
 	sshbuf_free(m);
 }
@ -64,11 +52,10 @@ index 1a079c15..768a59f9 100644
 +	pmonitor->m_recvfd = fd;
 +}
 #endif /* SSH_AUDIT_EVENTS */
-diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 661ed63b..e957ba6e 100644
--- a/monitor_wrap.h
-+++ b/monitor_wrap.h
-@@ -93,6 +93,8 @@ void mm_audit_unsupported_body(struct ssh *, int);
+diff -up openssh-7.4p1/monitor_wrap.h.audit-race openssh-7.4p1/monitor_wrap.h
+--- openssh-7.4p1/monitor_wrap.h.audit-race	2016-12-23 16:35:52.694685771 +0100
+++ openssh-7.4p1/monitor_wrap.h	2016-12-23 16:35:52.698685772 +0100
+@@ -83,6 +83,8 @@ void mm_audit_unsupported_body(int);
 void mm_audit_kex_body(struct ssh *, int, char *, char *, char *, char *, pid_t, uid_t);
 void mm_audit_session_key_free_body(struct ssh *, int, pid_t, uid_t);
 void mm_audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
@ -77,11 +64,10 @@ index 661ed63b..e957ba6e 100644
 #endif
 
 struct Session;
-diff --git a/session.c b/session.c
-index 83fc9418..b4753d93 100644
--- a/session.c
-+++ b/session.c
-@@ -167,6 +167,10 @@ static Session *sessions = NULL;
+diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
+--- openssh-7.4p1/session.c.audit-race	2016-12-23 16:35:52.695685771 +0100
+++ openssh-7.4p1/session.c	2016-12-23 16:37:26.339730596 +0100
+@@ -162,6 +162,10 @@ static Session *sessions = NULL;
 login_cap_t *lc;
 #endif
 
@ -92,7 +78,7 @@ index 83fc9418..b4753d93 100644
 static int is_child = 0;
 static int in_chroot = 0;
 static int have_dev_log = 1;
-@@ -390,6 +394,8 @@ xauth_valid_string(const char *s)
+@@ -289,6 +293,8 @@ xauth_valid_string(const char *s)
 	return 1;
 }
 
@ -101,7 +87,7 @@ index 83fc9418..b4753d93 100644
 #define USE_PIPES 1
 /*
  * This is called to fork and execute a command when we have no tty.  This
-@@ -513,6 +519,8 @@ do_exec_no_pty(struct ssh *ssh, Session *s, const char *command)
+@@ -424,6 +430,8 @@ do_exec_no_pty(Session *s, const char *c
 		close(err[0]);
 #endif
 
@ -110,7 +96,7 @@ index 83fc9418..b4753d93 100644
 		/* Do processing for the child (exec command etc). */
 		do_child(ssh, s, command);
 		/* NOTREACHED */
-@@ -630,6 +638,9 @@ do_exec_pty(struct ssh *ssh, Session *s, const char *command)
+@@ -547,6 +555,9 @@ do_exec_pty(Session *s, const char *comm
 		/* Close the extra descriptor for the pseudo tty. */
 		close(ttyfd);
 
@ -120,7 +106,7 @@ index 83fc9418..b4753d93 100644
 		/* record login, etc. similar to login(1) */
 #ifndef HAVE_OSF_SIA
 		do_login(ssh, s, command);
-@@ -766,6 +777,8 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
+@@ -717,6 +728,8 @@ do_exec(Session *s, const char *command)
 	}
 	if (s->command != NULL && s->ptyfd == -1)
 		s->command_handle = mm_audit_run_command(ssh, s->command);
@ -129,7 +115,7 @@ index 83fc9418..b4753d93 100644
 #endif
 	if (s->ttyfd != -1)
 		ret = do_exec_pty(ssh, s, command);
-@@ -781,6 +794,20 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
+@@ -732,6 +745,20 @@ do_exec(Session *s, const char *command)
 	 */
 	sshbuf_reset(loginmsg);
 
@ -150,7 +136,7 @@ index 83fc9418..b4753d93 100644
 	return ret;
 }
 
-@@ -1532,6 +1559,33 @@ child_close_fds(struct ssh *ssh)
+@@ -1538,6 +1565,33 @@ child_close_fds(void)
 	log_redirect_stderr_to(NULL);
 }
 
@ -165,7 +151,7 @@ index 83fc9418..b4753d93 100644
 +#endif
 +
 +	/* remove hostkey from the child's memory */
-+	/* FIXME beldmit destroy_sensitive_data(ssh); */
+	destroy_sensitive_data(ssh);
 +	/*
 +	 * We can audit this, because we hacked the pipe to direct the
 +	 * messages over postauth child. But this message requires answer
@ -184,11 +170,11 @@ index 83fc9418..b4753d93 100644
 /*
  * Performs common processing for the child, such as setting up the
  * environment, closing extra file descriptors, setting the user and group
-@@ -1549,13 +1603,6 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+@@ -1554,13 +1608,6 @@ do_child(Session *s, const char *command
 
 	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
 
-	/* remove keys from memory */
+-	/* remove hostkey from the child's memory */
 -	destroy_sensitive_data(ssh);
 -	ssh_packet_clear_keys(ssh);
 -	/* Don't audit this - both us and the parent would be talking to the
@ -198,6 +184,3 @@ index 83fc9418..b4753d93 100644
 	/* Force a password change */
 	if (s->authctxt->force_pwchange) {
 		do_setusercontext(pw);
-- 
-2.49.0
-
--- a/0015-openssh-7.2p2-k5login_directory.patch
+++ b/0015-openssh-7.2p2-k5login_directory.patch
@ -1,20 +1,8 @@
-From 25540939422660b024b8832f67eab82267aa8df6 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 15/50] openssh-7.2p2-k5login_directory
-
---
- auth-krb5.c     | 16 ++++++++++++++++
- auth.h          |  2 ++
- gss-serv-krb5.c | 21 ++++++++++++++++++++-
- sshd.8          |  4 ++++
- 4 files changed, 42 insertions(+), 1 deletion(-)
-
 diff --git a/auth-krb5.c b/auth-krb5.c
-index 77714e3d..74f56d47 100644
+index 2b02a04..19b9364 100644
 --- a/auth-krb5.c
 +++ b/auth-krb5.c
-@@ -465,5 +465,21 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
+@@ -375,5 +375,21 @@ cleanup:
 		return (krb5_cc_resolve(ctx, ccname, ccache));
 	}
 }
@ -37,10 +25,10 @@ index 77714e3d..74f56d47 100644
 #endif /* !HEIMDAL */
 #endif /* KRB5 */
 diff --git a/auth.h b/auth.h
-index 10e88e11..39163035 100644
+index f9d191c..c432d2f 100644
 --- a/auth.h
 +++ b/auth.h
-@@ -247,6 +247,8 @@ int	 sys_auth_passwd(struct ssh *, const char *);
+@@ -222,6 +222,8 @@ int	 sys_auth_passwd(Authctxt *, const char *);
 
 #if defined(KRB5) && !defined(HEIMDAL)
 krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
@ -50,10 +38,10 @@ index 10e88e11..39163035 100644
 
 #endif /* AUTH_H */
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index df55512d..820f794c 100644
+index a7c0c5f..df8cc9a 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
-@@ -144,8 +144,27 @@ ssh_gssapi_k5login_exists()
+@@ -244,8 +244,27 @@ ssh_gssapi_k5login_exists()
 {
 	char file[MAXPATHLEN];
 	struct passwd *pw = the_authctxt->pw;
@ -83,10 +71,10 @@ index df55512d..820f794c 100644
 }
 
 diff --git a/sshd.8 b/sshd.8
-index 049d0a94..6784286d 100644
+index 5c4f15b..135e290 100644
 --- a/sshd.8
 +++ b/sshd.8
-@@ -880,6 +880,10 @@ rlogin/rsh.
+@@ -806,6 +806,10 @@ rlogin/rsh.
 These files enforce GSSAPI/Kerberos authentication access control.
 Further details are described in
 .Xr ksu 1 .
@ -97,6 +85,3 @@ index 049d0a94..6784286d 100644
 .Pp
 .It Pa ~/.ssh/
 This directory is the default location for all user-specific configuration
-- 
-2.49.0
-
--- a/0024-openssh-7.2p2-s390-closefrom.patch
+++ b/0024-openssh-7.2p2-s390-closefrom.patch
@ -1,17 +1,21 @@
-From 9bb31b63142adaaf949e20c2d86c97f9b787217b Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 24/50] openssh-7.2p2-s390-closefrom
+Zseries only: Leave the hardware filedescriptors open.
+
+All filedescriptors above 2 are getting closed when a new
+sshd process to handle a new client connection is
+spawned. As the process also chroot into an empty filesystem
+without any device nodes, there is no chance to reopen the
+files. This patch filters out the reqired fds in the
+closefrom function so these are skipped in the close loop.
+
+Author: Harald Freudenberger <freude@de.ibm.com>

 ---
- openbsd-compat/bsd-closefrom.c | 26 ++++++++++++++++++++++++++
+ openbsd-compat/bsd-closefrom.c |   26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

-diff --git a/openbsd-compat/bsd-closefrom.c b/openbsd-compat/bsd-closefrom.c
-index 49a4f35f..f6112458 100644
 --- a/openbsd-compat/bsd-closefrom.c
 +++ b/openbsd-compat/bsd-closefrom.c
-@@ -140,7 +140,33 @@ closefrom(int lowfd)
+@@ -82,7 +82,33 @@ closefrom(int lowfd)
 	    fd = strtol(dent->d_name, &endp, 10);
 	    if (dent->d_name != endp && *endp == '\0' &&
 		fd >= 0 && fd < INT_MAX && fd >= lowfd && fd != dirfd(dirp))
@ -45,6 +49,4 @@ index 49a4f35f..f6112458 100644
 	}
 	(void) closedir(dirp);
 	return;
-- 
-2.49.0

--- a/0007-openssh-7.2p2-x11.patch
+++ b/0007-openssh-7.2p2-x11.patch
@ -1,32 +1,22 @@
-From cf6d48305cf6601448ea7a0d96ae825cbbbf0a2c Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 07/50] openssh-7.2p2-x11
-
---
- channels.c | 25 +++++++++++++++++++------
- 1 file changed, 19 insertions(+), 6 deletions(-)
-
 diff --git a/channels.c b/channels.c
-index bfe2e3b2..d46531ce 100644
--- a/channels.c
-+++ b/channels.c
-@@ -5098,11 +5098,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+--- a/channels.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/channels.c	(date 1703026069921)
+@@ -5075,11 +5075,13 @@
 }
- 
+
 static int
 -connect_local_xsocket_path(const char *pathname)
 +connect_local_xsocket_path(const char *pathname, int len)
 {
 	int sock;
 	struct sockaddr_un addr;
- 
+
 +	if (len <= 0)
 +		return -1;
 	sock = socket(AF_UNIX, SOCK_STREAM, 0);
 	if (sock == -1) {
 		error("socket: %.100s", strerror(errno));
-@@ -5110,11 +5112,12 @@ connect_local_xsocket_path(const char *pathname)
+@@ -5087,11 +5089,12 @@
 	}
 	memset(&addr, 0, sizeof(addr));
 	addr.sun_family = AF_UNIX;
@ -41,8 +31,8 @@ index bfe2e3b2..d46531ce 100644
 -	error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
 	return -1;
 }
- 
-@@ -5122,8 +5125,18 @@ static int
+
+@@ -5099,8 +5102,18 @@
 connect_local_xsocket(u_int dnr)
 {
 	char buf[1024];
@ -63,6 +53,3 @@ index bfe2e3b2..d46531ce 100644
 }
 
 #ifdef __APPLE__
-- 
-2.49.0
-
--- a/0025-openssh-7.3p1-x11-max-displays.patch
+++ b/0025-openssh-7.3p1-x11-max-displays.patch
@ -1,22 +1,18 @@
-From 36e3430d1f81397d5f40600e075272a81f7effce Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 25/50] openssh-7.3p1-x11-max-displays
-
---
- channels.c    |  9 ++++++---
- channels.h    |  2 +-
- servconf.c    | 12 +++++++++++-
- servconf.h    |  2 ++
- session.c     |  5 +++--
- sshd_config.5 |  7 +++++++
- 6 files changed, 30 insertions(+), 7 deletions(-)
-
-diff --git a/channels.c b/channels.c
-index d46531ce..7438c1a5 100644
--- a/channels.c
-+++ b/channels.c
-@@ -4996,7 +4996,7 @@ rdynamic_connect_finish(struct ssh *ssh, Channel *c)
+diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
+--- openssh-7.4p1/channels.c.x11max	2016-12-23 15:46:32.071506625 +0100
+++ openssh-7.4p1/channels.c	2016-12-23 15:46:32.139506636 +0100
+@@ -152,8 +152,8 @@ static int all_opens_permitted = 0;
+ #define	NUM_SOCKS	10
+ 
+ /* -- X11 forwarding */
+-/* Maximum number of fake X11 displays to try. */
+-#define MAX_DISPLAYS  1000
+/* Minimum port number for X11 forwarding */
+#define X11_PORT_MIN 6000
+ 
+ /* Per-channel callback for pre/post IO actions */
+ typedef void chan_fn(struct ssh *, Channel *c);
+@@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
  */
 int
 x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
@ -25,8 +21,8 @@ index d46531ce..7438c1a5 100644
     u_int *display_numberp, int **chanids)
 {
 	Channel *nc = NULL;
-@@ -5009,8 +5009,11 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
- 	    x11_display_offset > UINT16_MAX - X11_BASE_PORT - MAX_DISPLAYS)
+@@ -4240,10 +4241,15 @@ x11_create_display_inet(int x11_display_
+ 	if (chanids == NULL)
 		return -1;
 
 +	/* Try to bind ports starting at 6000+X11DisplayOffset */
@ -36,22 +32,55 @@ index d46531ce..7438c1a5 100644
 -	    display_number < MAX_DISPLAYS;
 +	    display_number < x11_max_displays;
 	    display_number++) {
- 		port = X11_BASE_PORT + display_number;
+-		port = 6000 + display_number;
+		port = X11_PORT_MIN + display_number;
+		if (port < X11_PORT_MIN) /* overflow */
+			break;
 		memset(&hints, 0, sizeof(hints));
-@@ -5065,7 +5068,7 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+ 		hints.ai_family = ssh->chanctxt->IPv4or6;
+ 		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
+@@ -4295,7 +4301,7 @@ x11_create_display_inet(int x11_display_
 		if (num_socks > 0)
 			break;
 	}
 -	if (display_number >= MAX_DISPLAYS) {
-+	if (display_number >= x11_max_displays || port < X11_BASE_PORT ) {
+	if (display_number >= x11_max_displays || port < X11_PORT_MIN ) {
 		error("Failed to allocate internet-domain X11 display socket.");
 		return -1;
 	}
-diff --git a/channels.h b/channels.h
-index 134528d5..8a09a820 100644
--- a/channels.h
-+++ b/channels.h
-@@ -379,7 +379,7 @@ int	 permitopen_port(const char *);
+@@ -4441,7 +4447,7 @@ x11_connect_display(void)
+ 	memset(&hints, 0, sizeof(hints));
+ 	hints.ai_family = ssh->chanctxt->IPv4or6;
+ 	hints.ai_socktype = SOCK_STREAM;
+-	snprintf(strport, sizeof strport, "%u", 6000 + display_number);
+	snprintf(strport, sizeof strport, "%u", X11_PORT_MIN + display_number);
+ 	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
+ 		error("%.100s: unknown host. (%s)", buf,
+ 		ssh_gai_strerror(gaierr));
+@@ -4457,7 +4463,7 @@ x11_connect_display(void)
+ 		/* Connect it to the display. */
+ 		if (connect(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
+ 			debug2("connect %.100s port %u: %.100s", buf,
+-			    6000 + display_number, strerror(errno));
+			    X11_PORT_MIN + display_number, strerror(errno));
+ 			close(sock);
+ 			continue;
+ 		}
+@@ -4466,8 +4472,8 @@ x11_connect_display(void)
+ 	}
+ 	freeaddrinfo(aitop);
+ 	if (!ai) {
+-		error("connect %.100s port %u: %.100s", buf,
+-		    6000 + display_number, strerror(errno));
+		error("connect %.100s port %u: %.100s", buf,
+		    X11_PORT_MIN + display_number, strerror(errno));
+ 		return -1;
+ 	}
+ 	set_nodelay(sock);
+diff -up openssh-7.4p1/channels.h.x11max openssh-7.4p1/channels.h
+--- openssh-7.4p1/channels.h.x11max	2016-12-19 05:59:41.000000000 +0100
+++ openssh-7.4p1/channels.h	2016-12-23 15:46:32.139506636 +0100
+@@ -293,7 +293,7 @@ int	 permitopen_port(const char *);
 
 void	 channel_set_x11_refuse_time(struct ssh *, time_t);
 int	 x11_connect_display(struct ssh *);
@ -59,12 +88,11 @@ index 134528d5..8a09a820 100644
 +int	 x11_create_display_inet(struct ssh *, int, int, int, int, u_int *, int **);
 void	 x11_request_forwarding_with_spoofing(struct ssh *, int,
 	    const char *, const char *, const char *, int);
- int      x11_channel_used_recently(struct ssh *ssh);
-diff --git a/servconf.c b/servconf.c
-index 105e301d..15c99b30 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -117,6 +117,7 @@ initialize_server_options(ServerOptions *options)
+ 
+diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
+--- openssh-7.4p1/servconf.c.x11max	2016-12-23 15:46:32.133506635 +0100
+++ openssh-7.4p1/servconf.c	2016-12-23 15:47:27.320519121 +0100
+@@ -95,6 +95,7 @@ initialize_server_options(ServerOptions
 	options->print_lastlog = -1;
 	options->x11_forwarding = -1;
 	options->x11_display_offset = -1;
@ -72,7 +100,7 @@ index 105e301d..15c99b30 100644
 	options->x11_use_localhost = -1;
 	options->permit_tty = -1;
 	options->permit_user_rc = -1;
-@@ -353,6 +354,8 @@ fill_default_server_options(ServerOptions *options)
+@@ -243,6 +244,8 @@ fill_default_server_options(ServerOption
 		options->x11_forwarding = 0;
 	if (options->x11_display_offset == -1)
 		options->x11_display_offset = 10;
@ -81,16 +109,16 @@ index 105e301d..15c99b30 100644
 	if (options->x11_use_localhost == -1)
 		options->x11_use_localhost = 1;
 	if (options->xauth_location == NULL)
-@@ -576,7 +579,7 @@ typedef enum {
- 	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication,
- 	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
- 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+@@ -419,7 +422,7 @@ typedef enum {
+	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok, sPasswordAuthentication,
+	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
+	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
 -	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 +	sX11Forwarding, sX11DisplayOffset, sX11MaxDisplays, sX11UseLocalhost,
 	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 	sPermitUserEnvironment, sAllowTcpForwarding, sCompression,
 	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
-@@ -714,6 +717,7 @@ static struct {
+@@ -540,6 +543,7 @@ static struct {
 	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
 	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
 	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
@ -98,7 +126,7 @@ index 105e301d..15c99b30 100644
 	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
 	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
 	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
-@@ -1750,6 +1754,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1316,6 +1320,10 @@ process_server_config_line(ServerOptions
 			*intptr = value;
 		break;
 
@ -109,7 +137,7 @@ index 105e301d..15c99b30 100644
 	case sX11UseLocalhost:
 		intptr = &options->x11_use_localhost;
 		goto parse_flag;
-@@ -3004,6 +3012,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+@@ -2063,6 +2071,7 @@ copy_set_server_options(ServerOptions *d
 	M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
 	M_CP_INTOPT(x11_display_offset);
 	M_CP_INTOPT(x11_forwarding);
@ -117,7 +145,7 @@ index 105e301d..15c99b30 100644
 	M_CP_INTOPT(x11_use_localhost);
 	M_CP_INTOPT(permit_tty);
 	M_CP_INTOPT(permit_user_rc);
-@@ -3299,6 +3308,7 @@ dump_config(ServerOptions *o)
+@@ -2315,6 +2324,7 @@ dump_config(ServerOptions *o)
 #endif
 	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
 	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
@ -125,11 +153,10 @@ index 105e301d..15c99b30 100644
 	dump_cfg_int(sMaxAuthTries, o->max_authtries);
 	dump_cfg_int(sMaxSessions, o->max_sessions);
 	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
-diff --git a/servconf.h b/servconf.h
-index c08cf6a7..7c7e5d43 100644
--- a/servconf.h
-+++ b/servconf.h
-@@ -38,6 +38,7 @@
+diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
+--- openssh-7.4p1/servconf.h.x11max	2016-12-23 15:46:32.133506635 +0100
+++ openssh-7.4p1/servconf.h	2016-12-23 15:46:32.140506636 +0100
+@@ -55,6 +55,7 @@
 
 #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
 #define DEFAULT_SESSIONS_MAX	10	/* Default for MaxSessions */
@ -137,7 +164,7 @@ index c08cf6a7..7c7e5d43 100644
 
 /* Magic name for internal sftp-server */
 #define INTERNAL_SFTP_NAME	"internal-sftp"
-@@ -114,6 +115,7 @@ typedef struct {
+@@ -85,6 +86,7 @@ typedef struct {
 	int     x11_forwarding;	/* If true, permit inet (spoofing) X11 fwd. */
 	int     x11_display_offset;	/* What DISPLAY number to start
 					 * searching at */
@ -145,14 +172,13 @@ index c08cf6a7..7c7e5d43 100644
 	int     x11_use_localhost;	/* If true, use localhost for fake X11 server. */
 	char   *xauth_location;	/* Location of xauth program */
 	int	permit_tty;	/* If false, deny pty allocation */
-diff --git a/session.c b/session.c
-index 54da09d5..28bbb8a7 100644
--- a/session.c
-+++ b/session.c
-@@ -2611,8 +2611,9 @@ session_setup_x11fwd(struct ssh *ssh, Session *s)
+diff -up openssh-7.4p1/session.c.x11max openssh-7.4p1/session.c
+--- openssh-7.4p1/session.c.x11max	2016-12-23 15:46:32.136506636 +0100
+++ openssh-7.4p1/session.c	2016-12-23 15:46:32.141506636 +0100
+@@ -2518,8 +2518,9 @@ session_setup_x11fwd(Session *s)
 		return 0;
 	}
- 	if (x11_create_display_inet(ssh, options.x11_display_offset,
+	if (x11_create_display_inet(ssh, options.x11_display_offset,
 -	    options.x11_use_localhost, s->single_connection,
 -	    &s->display_number, &s->x11_chanids) == -1) {
 +	    options.x11_use_localhost, options.x11_max_displays,
@ -161,11 +187,10 @@ index 54da09d5..28bbb8a7 100644
 		debug("x11_create_display_inet failed.");
 		return 0;
 	}
-diff --git a/sshd_config.5 b/sshd_config.5
-index fe246fc2..26fcdc84 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -1391,6 +1391,7 @@ Available keywords are
+diff -up openssh-7.4p1/sshd_config.5.x11max openssh-7.4p1/sshd_config.5
+--- openssh-7.4p1/sshd_config.5.x11max	2016-12-23 15:46:32.134506635 +0100
+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:46:32.141506636 +0100
+@@ -1133,6 +1133,7 @@ Available keywords are
 .Cm TrustedUserCAKeys ,
 .Cm UnusedConnectionTimeout ,
 .Cm X11DisplayOffset ,
@ -173,7 +198,7 @@ index fe246fc2..26fcdc84 100644
 .Cm X11Forwarding
 and
 .Cm X11UseLocalhost .
-@@ -2111,6 +2112,12 @@ Specifies the first display number available for
+@@ -1566,6 +1567,12 @@ Specifies the first display number avail
 X11 forwarding.
 This prevents sshd from interfering with real X11 servers.
 The default is 10.
@ -186,6 +211,3 @@ index fe246fc2..26fcdc84 100644
 .It Cm X11Forwarding
 Specifies whether X11 forwarding is permitted.
 The argument must be
-- 
-2.49.0
-
--- a/openssh-7.5p1-sandbox.patch
+++ b/openssh-7.5p1-sandbox.patch
@ -0,0 +1,86 @@
+In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
+and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
+implementation) which calls the libraries that will communicate with the
+crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
+this is only need on s390 architecture.
+
+Signed-off-by: Eduardo Barretto <ebarretto@xxxxxxxxxxxxxxxxxx>
+---
+ sandbox-seccomp-filter.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index ca75cc7..6e7de31 100644
+--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
+@@ -166,6 +166,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_exit_group
+ 	SC_ALLOW(__NR_exit_group),
+ #endif
+#if defined(__NR_flock) && defined(__s390__)
+	SC_ALLOW(__NR_flock),
+#endif
+ #ifdef __NR_futex
+ 	SC_FUTEX(__NR_futex),
+ #endif
+@@ -178,6 +181,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_gettimeofday
+ 	SC_ALLOW(__NR_gettimeofday),
+ #endif
+#if defined(__NR_ipc) && defined(__s390__)
+	SC_ALLOW(__NR_ipc),
+#endif
+ #ifdef __NR_getuid
+ 	SC_ALLOW(__NR_getuid),
+ #endif
+-- 
+1.9.1
+
+getuid and geteuid are needed when using an openssl engine that calls a
+crypto card, e.g. ICA (libica).
+Those syscalls are also needed by the distros for audit code.
+
+Signed-off-by: Eduardo Barretto <ebarretto@xxxxxxxxxxxxxxxxxx>
+---
+ sandbox-seccomp-filter.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index 6e7de31..e86aa2c 100644
+--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
+@@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_getpid
+ 	SC_ALLOW(__NR_getpid),
+ #endif
+#ifdef __NR_getuid
+	SC_ALLOW(__NR_getuid),
+#endif
+#ifdef __NR_getuid32
+	SC_ALLOW(__NR_getuid32),
+#endif
+#ifdef __NR_geteuid
+	SC_ALLOW(__NR_geteuid),
+#endif
+#ifdef __NR_geteuid32
+	SC_ALLOW(__NR_geteuid32),
+#endif
+ #ifdef __NR_getrandom
+ 	SC_ALLOW(__NR_getrandom),
+ #endif
+-- 1.9.1
+1.9.1
+diff -up openssh-7.6p1/sandbox-seccomp-filter.c.sandbox openssh-7.6p1/sandbox-seccomp-filter.c
+--- openssh-7.6p1/sandbox-seccomp-filter.c.sandbox	2017-12-12 13:59:30.563874059 +0100
+++ openssh-7.6p1/sandbox-seccomp-filter.c	2017-12-12 13:59:14.842784083 +0100
+@@ -190,6 +190,9 @@ static const struct sock_filter preauth_
+ #ifdef __NR_geteuid32
+ 	SC_ALLOW(__NR_geteuid32),
+ #endif
+#ifdef __NR_gettid
+	SC_ALLOW(__NR_gettid),
+#endif
+ #ifdef __NR_getrandom
+ 	SC_ALLOW(__NR_getrandom),
+ #endif
+
--- a/0039-openssh-7.6p1-audit.patch
+++ b/0039-openssh-7.6p1-audit.patch
--- a/0026-openssh-7.6p1-cleanup-selinux.patch
+++ b/0026-openssh-7.6p1-cleanup-selinux.patch
@ -1,25 +1,7 @@
-From 43320351b6f150167190aacc84f2f87030fef3d2 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 26/50] openssh-7.6p1-cleanup-selinux
-
---
- auth2-pubkey.c                   |  8 ++++--
- misc.c                           |  5 ++--
- misc.h                           |  2 +-
- openbsd-compat/port-linux-sshd.c | 42 +++++++++++++++++---------------
- openbsd-compat/port-linux.h      |  4 +--
- platform.c                       |  6 ++++-
- sshconnect.c                     |  2 +-
- sshd-auth.c                      |  2 +-
- sshd-session.c                   |  6 +++--
- 9 files changed, 45 insertions(+), 32 deletions(-)
-
-diff --git a/auth2-pubkey.c b/auth2-pubkey.c
-index 267a27d2..0d5ae0df 100644
--- a/auth2-pubkey.c
-+++ b/auth2-pubkey.c
-@@ -77,6 +77,8 @@
+diff -up openssh/auth2-pubkey.c.refactor openssh/auth2-pubkey.c
+--- openssh/auth2-pubkey.c.refactor	2019-04-04 13:19:12.188821236 +0200
+++ openssh/auth2-pubkey.c	2019-04-04 13:19:12.276822078 +0200
+@@ -72,6 +72,8 @@
 
 /* import */
 extern ServerOptions options;
@ -28,7 +10,7 @@ index 267a27d2..0d5ae0df 100644
 extern struct authmethod_cfg methodcfg_pubkey;
 
 static char *
-@@ -485,7 +487,8 @@ match_principals_command(struct passwd *user_pw, const struct sshkey *key,
+@@ -511,7 +514,8 @@ match_principals_command(struct ssh *ssh
 	if ((pid = subprocess("AuthorizedPrincipalsCommand", command,
 	    ac, av, &f,
 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
@ -38,21 +20,20 @@ index 267a27d2..0d5ae0df 100644
 		goto out;
 
 	uid_swapped = 1;
-@@ -755,7 +758,8 @@ user_key_command_allowed2(struct passwd *user_pw, struct sshkey *key,
+@@ -981,7 +985,8 @@ user_key_command_allowed2(struct ssh *ss
 	if ((pid = subprocess("AuthorizedKeysCommand", command,
 	    ac, av, &f,
- 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
+	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
 -	    runas_pw, temporarily_use_uid, restore_uid)) == 0)
 +	    runas_pw, temporarily_use_uid, restore_uid,
 +	    inetd_flag, the_authctxt)) == 0)
 		goto out;
 
 	uid_swapped = 1;
-diff --git a/misc.c b/misc.c
-index 1e31acc9..09722962 100644
--- a/misc.c
-+++ b/misc.c
-@@ -2764,7 +2764,8 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
+diff -up openssh/misc.c.refactor openssh/misc.c
+--- openssh/misc.c.refactor	2019-04-04 13:19:12.235821686 +0200
+++ openssh/misc.c	2019-04-04 13:19:12.276822078 +0200
+@@ -756,7 +756,8 @@ auth_get_canonical_hostname(struct ssh *
 pid_t
 subprocess(const char *tag, const char *command,
     int ac, char **av, FILE **child, u_int flags,
@ -62,7 +43,7 @@ index 1e31acc9..09722962 100644
 {
 	FILE *f = NULL;
 	struct stat st;
-@@ -2898,7 +2899,7 @@ subprocess(const char *tag, const char *command,
+@@ -872,7 +873,7 @@ subprocess(const char *tag, struct passw
 			_exit(1);
 		}
 #ifdef WITH_SELINUX
@ -71,11 +52,10 @@ index 1e31acc9..09722962 100644
 			error ("failed to copy environment:  %s",
 			    strerror(errno));
 			_exit(127);
-diff --git a/misc.h b/misc.h
-index efecdf1a..9efa9cf4 100644
--- a/misc.h
-+++ b/misc.h
-@@ -122,7 +122,7 @@ typedef void privrestore_fn(void);
+diff -up openssh/misc.h.refactor openssh/misc.h
+--- openssh/misc.h.refactor	2019-04-04 13:19:12.251821839 +0200
+++ openssh/misc.h	2019-04-04 13:19:12.276822078 +0200
+@@ -235,7 +235,7 @@ struct passwd *fakepw(void);
 #define	SSH_SUBPROCESS_UNSAFE_PATH	(1<<3)	/* Don't check for safe cmd */
 #define	SSH_SUBPROCESS_PRESERVE_ENV	(1<<4)	/* Keep parent environment */
 pid_t subprocess(const char *, const char *, int, char **, FILE **, u_int,
@ -84,10 +64,23 @@ index efecdf1a..9efa9cf4 100644
 
 typedef struct arglist arglist;
 struct arglist {
-diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-index 646f0887..291b569a 100644
--- a/openbsd-compat/port-linux-sshd.c
-+++ b/openbsd-compat/port-linux-sshd.c
+diff -up openssh/openbsd-compat/port-linux.h.refactor openssh/openbsd-compat/port-linux.h
+--- openssh/openbsd-compat/port-linux.h.refactor	2019-04-04 13:19:12.256821887 +0200
+++ openssh/openbsd-compat/port-linux.h	2019-04-04 13:19:12.276822078 +0200
+@@ -26,8 +26,8 @@ void ssh_selinux_setfscreatecon(const ch
+ 
+ int sshd_selinux_enabled(void);
+ void sshd_selinux_copy_context(void);
+-void sshd_selinux_setup_exec_context(char *);
+-int sshd_selinux_setup_env_variables(void);
+void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int);
+int sshd_selinux_setup_env_variables(int inetd, void *);
+ void sshd_selinux_change_privsep_preauth_context(void);
+ #endif
+ 
+diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compat/port-linux-sshd.c
+--- openssh/openbsd-compat/port-linux-sshd.c.refactor	2019-04-04 13:19:12.256821887 +0200
+++ openssh/openbsd-compat/port-linux-sshd.c	2019-04-04 13:19:12.276822078 +0200
@@ -49,10 +49,6 @@
 #include <unistd.h>
 #endif
@ -99,7 +92,7 @@ index 646f0887..291b569a 100644
 /* Wrapper around is_selinux_enabled() to log its return value once only */
 int
 sshd_selinux_enabled(void)
-@@ -222,7 +218,8 @@ get_user_context(const char *sename, const char *role, const char *lvl,
+@@ -223,7 +218,8 @@ get_user_context(const char *sename, con
 }
 
 static void
@ -109,7 +102,7 @@ index 646f0887..291b569a 100644
 {
 	*role = NULL;
 	*level = NULL;
-@@ -240,8 +237,8 @@ ssh_selinux_get_role_level(char **role, const char **level)
+@@ -241,8 +237,8 @@ ssh_selinux_get_role_level(char **role,
 
 /* Return the default security context for the given username */
 static int
@ -120,7 +113,7 @@ index 646f0887..291b569a 100644
 {
 	char *sename, *lvl;
 	char *role;
-@@ -249,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -250,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname,
 	int r = 0;
 	context_t con = NULL;
 
@ -129,7 +122,7 @@ index 646f0887..291b569a 100644
 
 #ifdef HAVE_GETSEUSERBYNAME
 	if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
-@@ -271,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -272,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname,
 
 	if (r == 0) {
 		/* If launched from xinetd, we must use current level */
@ -138,7 +131,7 @@ index 646f0887..291b569a 100644
 			security_context_t sshdsc=NULL;
 
 			if (getcon_raw(&sshdsc) < 0)
-@@ -332,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname,
+@@ -333,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname,
 
 /* Setup environment variables for pam_selinux */
 static int
@ -148,7 +141,7 @@ index 646f0887..291b569a 100644
 {
 	const char *reqlvl;
 	char *role;
-@@ -341,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
+@@ -342,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it
 
 	debug3_f("setting execution context");
 
@ -162,7 +155,7 @@ index 646f0887..291b569a 100644
 		use_current = "1";
 	} else {
 		use_current = "";
-@@ -361,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
+@@ -362,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it
 }
 
 static int
@ -175,7 +168,7 @@ index 646f0887..291b569a 100644
 }
 
 static int
-@@ -373,25 +372,28 @@ do_setenv(char *name, const char *value)
+@@ -374,25 +372,28 @@ do_setenv(char *name, const char *value)
 }
 
 int
@ -209,7 +202,7 @@ index 646f0887..291b569a 100644
 			switch (security_getenforce()) {
 			case -1:
 				fatal_f("security_getenforce() failed");
-@@ -407,7 +409,7 @@ sshd_selinux_setup_exec_context(char *pwname)
+@@ -410,7 +411,7 @@ sshd_selinux_setup_exec_context(char *pw
 
 	debug3_f("setting execution context");
 
@ -218,26 +211,10 @@ index 646f0887..291b569a 100644
 	if (r >= 0) {
 		r = setexeccon(user_ctx);
 		if (r < 0) {
-diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 7f8ba200..3cd7da6a 100644
--- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -25,8 +25,8 @@ void ssh_selinux_setfscreatecon(const char *);
- 
- int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
-void sshd_selinux_setup_exec_context(char *);
-int sshd_selinux_setup_env_variables(void);
-+void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int);
-+int sshd_selinux_setup_env_variables(int inetd, void *);
- void sshd_selinux_change_privsep_preauth_context(void);
- #endif
- 
-diff --git a/platform.c b/platform.c
-index 0d12f311..f0800b1f 100644
--- a/platform.c
-+++ b/platform.c
-@@ -33,6 +33,8 @@
+diff -up openssh/platform.c.refactor openssh/platform.c
+--- openssh/platform.c.refactor	2019-04-04 13:19:12.204821389 +0200
+++ openssh/platform.c	2019-04-04 13:19:12.277822088 +0200
+@@ -32,6 +32,8 @@
 #include "openbsd-compat/openbsd-compat.h"
 
 extern ServerOptions options;
@ -246,7 +223,7 @@ index 0d12f311..f0800b1f 100644
 
 /* return 1 if we are running with privilege to swap UIDs, 0 otherwise */
 int
-@@ -140,7 +142,9 @@ platform_setusercontext_post_groups(struct passwd *pw)
+@@ -183,7 +186,9 @@ platform_setusercontext_post_groups(stru
 	}
 #endif /* HAVE_SETPCRED */
 #ifdef WITH_SELINUX
@ -257,37 +234,10 @@ index 0d12f311..f0800b1f 100644
 #endif
 }
 
-diff --git a/sshconnect.c b/sshconnect.c
-index c86182d1..04084810 100644
--- a/sshconnect.c
-+++ b/sshconnect.c
-@@ -925,7 +925,7 @@ load_hostkeys_command(struct hostkeys *hostkeys, const char *command_template,
- 
- 	if ((pid = subprocess(tag, command, ac, av, &f,
- 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_UNSAFE_PATH|
-	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL)) == 0)
-+	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL, 0, NULL)) == 0)
- 		goto out;
- 
- 	load_hostkeys_file(hostkeys, hostfile_hostname, tag, f, 1);
-diff --git a/sshd-auth.c b/sshd-auth.c
-index e4a8edfd..897db9b4 100644
--- a/sshd-auth.c
-+++ b/sshd-auth.c
-@@ -122,7 +122,7 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE;
- int debug_flag = 0;
- 
- /* Flag indicating that the daemon is being started from inetd. */
-static int inetd_flag = 0;
-+int inetd_flag = 0;
- 
- /* Saved arguments to main(). */
- static char **saved_argv;
-diff --git a/sshd-session.c b/sshd-session.c
-index 9342e416..81d30152 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -136,7 +136,7 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE;
+diff -up openssh/sshd-session.c.refactor openssh/sshd-session.c
+--- openssh/sshd-session.c.refactor	2019-04-04 13:19:12.275822068 +0200
+++ openssh/sshd-session.c	2019-04-04 13:19:51.270195262 +0200
+@@ -158,7 +158,7 @@ int debug_flag = 0;
 int debug_flag = 0;
 
 /* Flag indicating that the daemon is being started from inetd. */
@ -296,7 +246,7 @@ index 9342e416..81d30152 100644
 
 /* debug goes to stderr unless inetd_flag is set */
 static int log_stderr = 0;
-@@ -1359,7 +1359,9 @@ main(int ac, char **av)
+@@ -2192,7 +2192,9 @@ main(int ac, char **av)
 	}
 #endif
 #ifdef WITH_SELINUX
@ -307,6 +257,15 @@ index 9342e416..81d30152 100644
 #endif
 #ifdef USE_PAM
 	if (options.use_pam) {
-- 
-2.49.0
-
+diff -up openssh/sshconnect.c.refactor openssh/sshconnect.c
+--- openssh/sshconnect.c.refactor	2021-02-24 00:12:03.065325046 +0100
+++ openssh/sshconnect.c	2021-02-24 00:12:12.126449544 +0100
+@@ -892,7 +892,7 @@ load_hostkeys_command(struct hostkeys *h
+ 
+ 	if ((pid = subprocess(tag, command, ac, av, &f,
+ 	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_UNSAFE_PATH|
+-	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL)) == 0)
+	    SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL, 0, NULL)) == 0)
+ 		goto out;
+ 
+ 	load_hostkeys_file(hostkeys, hostfile_hostname, tag, f, 1);
--- a/0042-openssh-7.7p1-fips.patch
+++ b/0042-openssh-7.7p1-fips.patch
--- a/0014-openssh-7.7p1-gssapi-new-unique.patch
+++ b/0014-openssh-7.7p1-gssapi-new-unique.patch
@ -1,25 +1,26 @@
-From 5fca5946aa97dce23c6824c52b070a92532752a9 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 14/50] openssh-7.7p1-gssapi-new-unique
-
---
- auth-krb5.c     | 262 ++++++++++++++++++++++++++++++++++++++++++------
- auth.h          |   3 +-
- gss-serv-krb5.c |  42 +++-----
- gss-serv.c      |  10 +-
- servconf.c      |  12 ++-
- servconf.h      |   2 +
- session.c       |   5 +-
- ssh-gss.h       |   4 +-
- sshd-session.c  |   2 +-
- sshd_config.5   |   8 ++
- 10 files changed, 279 insertions(+), 71 deletions(-)
-
-diff --git a/auth-krb5.c b/auth-krb5.c
-index c99e4e43..77714e3d 100644
--- a/auth-krb5.c
-+++ b/auth-krb5.c
+diff -up openssh-8.6p1/auth.h.ccache_name openssh-8.6p1/auth.h
+--- openssh-8.6p1/auth.h.ccache_name	2021-04-19 14:05:10.820744325 +0200
+++ openssh-8.6p1/auth.h	2021-04-19 14:05:10.853744569 +0200
+@@ -83,6 +83,7 @@ struct Authctxt {
+ 	krb5_principal	 krb5_user;
+ 	char		*krb5_ticket_file;
+ 	char		*krb5_ccname;
+	int		 krb5_set_env;
+ #endif
+ 	struct sshbuf	*loginmsg;
+ 
+@@ -231,7 +232,7 @@ struct passwd *fakepw(void);
+ int	 sys_auth_passwd(struct ssh *, const char *);
+ 
+ #if defined(KRB5) && !defined(HEIMDAL)
+-krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
+krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
+ #endif
+ 
+ #endif /* AUTH_H */
+diff -up openssh-8.6p1/auth-krb5.c.ccache_name openssh-8.6p1/auth-krb5.c
+--- openssh-8.6p1/auth-krb5.c.ccache_name	2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/auth-krb5.c	2021-04-19 14:40:55.142832954 +0200
@@ -51,6 +51,7 @@
 #include <unistd.h>
 #include <string.h>
@ -28,7 +29,7 @@ index c99e4e43..77714e3d 100644
 
 extern ServerOptions	 options;
 
-@@ -77,7 +78,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
+@@ -77,7 +78,7 @@ auth_krb5_password(Authctxt *authctxt, c
 #endif
 	krb5_error_code problem;
 	krb5_ccache ccache = NULL;
@ -37,7 +38,7 @@ index c99e4e43..77714e3d 100644
 	char *client, *platform_client;
 	const char *errmsg;
 
-@@ -163,8 +164,8 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
+@@ -163,8 +164,8 @@ auth_krb5_password(Authctxt *authctxt, c
 		goto out;
 	}
 
@ -48,7 +49,7 @@ index c99e4e43..77714e3d 100644
 	if (problem)
 		goto out;
 
-@@ -179,15 +180,14 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
+@@ -179,15 +180,14 @@ auth_krb5_password(Authctxt *authctxt, c
 		goto out;
 #endif
 
@ -69,7 +70,7 @@ index c99e4e43..77714e3d 100644
 		do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);
 #endif
 
-@@ -223,11 +223,54 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
+@@ -223,11 +223,54 @@ auth_krb5_password(Authctxt *authctxt, c
 void
 krb5_cleanup_proc(Authctxt *authctxt)
 {
@ -125,29 +126,12 @@ index c99e4e43..77714e3d 100644
 	if (authctxt->krb5_user) {
 		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
 		authctxt->krb5_user = NULL;
-@@ -238,36 +281,189 @@ krb5_cleanup_proc(Authctxt *authctxt)
+@@ -238,36 +281,188 @@ krb5_cleanup_proc(Authctxt *authctxt)
 	}
 }
 
 -#ifndef HEIMDAL
-krb5_error_code
-ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
-	int tmpfd, ret, oerrno;
-	char ccname[40];
-	mode_t old_umask;
- 
-	ret = snprintf(ccname, sizeof(ccname),
-	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
-	if (ret < 0 || (size_t)ret >= sizeof(ccname))
-		return ENOMEM;
-
-	old_umask = umask(0177);
-	tmpfd = mkstemp(ccname + strlen("FILE:"));
-	oerrno = errno;
-	umask(old_umask);
-	if (tmpfd == -1) {
-		logit("mkstemp(): %.100s", strerror(oerrno));
-		return oerrno;
+
 +#if !defined(HEIMDAL)
 +int
 +ssh_asprintf_append(char **dsc, const char *fmt, ...) {
@ -165,8 +149,7 @@ index c99e4e43..77714e3d 100644
 +	old = *dsc;
 +
 +	i = asprintf(dsc, "%s%s", *dsc, src);
-+	if (i == -1) {
-+		*dsc = old;
+	if (i == -1 || src == NULL) {
 +		free(src);
 +		return -1;
 +	}
@ -213,9 +196,8 @@ index c99e4e43..77714e3d 100644
 +			/* unknown token, fallback to the default */
 +			goto cleanup;
 +		}
- 	}
- 
-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
+	}
+
 +	if (ssh_asprintf_append(&r, "%s", p_o) == -1)
 +		goto cleanup;
 +
@ -250,13 +232,29 @@ index c99e4e43..77714e3d 100644
 +	return ret;
 +}
 +
-+krb5_error_code
+ krb5_error_code
+-ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
+-	int tmpfd, ret, oerrno;
+-	char ccname[40];
 +ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environment) {
 +	int tmpfd, ret, oerrno, type_len;
 +	char *ccname = NULL;
-+	mode_t old_umask;
+ 	mode_t old_umask;
 +	char *type = NULL, *colon = NULL;
-+
+ 
+-	ret = snprintf(ccname, sizeof(ccname),
+-	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
+-	if (ret < 0 || (size_t)ret >= sizeof(ccname))
+-		return ENOMEM;
+-
+-	old_umask = umask(0177);
+-	tmpfd = mkstemp(ccname + strlen("FILE:"));
+-	oerrno = errno;
+-	umask(old_umask);
+-	if (tmpfd == -1) {
+-		logit("mkstemp(): %.100s", strerror(oerrno));
+-		return oerrno;
+-	}
 +	debug3_f("called");
 +	if (need_environment)
 +		*need_environment = 0;
@ -271,7 +269,8 @@ index c99e4e43..77714e3d 100644
 +		    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
 +		if (ret < 0)
 +			return ENOMEM;
-+
+ 
+-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
 +		old_umask = umask(0177);
 +		tmpfd = mkstemp(ccname + strlen("FILE:"));
 		oerrno = errno;
@ -338,32 +337,42 @@ index c99e4e43..77714e3d 100644
 }
 #endif /* !HEIMDAL */
 #endif /* KRB5 */
-diff --git a/auth.h b/auth.h
-index 83d07ae8..10e88e11 100644
--- a/auth.h
-+++ b/auth.h
-@@ -85,6 +85,7 @@ struct Authctxt {
- 	krb5_principal	 krb5_user;
- 	char		*krb5_ticket_file;
- 	char		*krb5_ccname;
-+	int		 krb5_set_env;
- #endif
- 	struct sshbuf	*loginmsg;
+diff -up openssh-8.6p1/gss-serv.c.ccache_name openssh-8.6p1/gss-serv.c
+--- openssh-8.6p1/gss-serv.c.ccache_name	2021-04-19 14:05:10.844744503 +0200
+++ openssh-8.6p1/gss-serv.c	2021-04-19 14:05:10.854744577 +0200
+@@ -413,13 +413,15 @@ ssh_gssapi_cleanup_creds(void)
+ }
 
-@@ -245,7 +246,7 @@ FILE	*auth_openprincipals(const char *, struct passwd *, int);
- int	 sys_auth_passwd(struct ssh *, const char *);
+ /* As user */
+-void
+int
+ ssh_gssapi_storecreds(void)
+ {
+ 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
+-		(*gssapi_client.mech->storecreds)(&gssapi_client);
+		return (*gssapi_client.mech->storecreds)(&gssapi_client);
+ 	} else
+ 		debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
+
+	return 0;
+ }
 
- #if defined(KRB5) && !defined(HEIMDAL)
-krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
-+krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
+ /* This allows GSSAPI methods to do things to the child's environment based
+@@ -499,9 +501,7 @@ ssh_gssapi_rekey_creds(void) {
+ 	char *envstr;
 #endif
 
- #endif /* AUTH_H */
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 14502c5a..df55512d 100644
--- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -267,7 +267,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+-	if (gssapi_client.store.filename == NULL &&
+-	    gssapi_client.store.envval == NULL &&
+-	    gssapi_client.store.envvar == NULL)
+	if (gssapi_client.store.envval == NULL)
+ 		return;
+ 
+ 	ok = mm_ssh_gssapi_update_creds(&gssapi_client.store);
+diff -up openssh-8.6p1/gss-serv-krb5.c.ccache_name openssh-8.6p1/gss-serv-krb5.c
+--- openssh-8.6p1/gss-serv-krb5.c.ccache_name	2021-04-19 14:05:10.852744562 +0200
+++ openssh-8.6p1/gss-serv-krb5.c	2021-04-19 14:05:10.854744577 +0200
+@@ -267,7 +267,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
 /* This writes out any forwarded credentials from the structure populated
  * during userauth. Called after we have setuid to the user */
 
@ -372,7 +381,7 @@ index 14502c5a..df55512d 100644
 ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
 {
 	krb5_ccache ccache;
-@@ -276,14 +276,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
+@@ -276,14 +276,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
 	OM_uint32 maj_status, min_status;
 	const char *new_ccname, *new_cctype;
 	const char *errmsg;
@ -390,7 +399,7 @@ index 14502c5a..df55512d 100644
 
 #ifdef HEIMDAL
 # ifdef HAVE_KRB5_CC_NEW_UNIQUE
-@@ -297,14 +298,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
+@@ -297,14 +298,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
 		krb5_get_err_text(krb_context, problem));
 # endif
 		krb5_free_error_message(krb_context, errmsg);
@ -409,7 +418,7 @@ index 14502c5a..df55512d 100644
 	}
 #endif	/* #ifdef HEIMDAL */
 
-@@ -313,7 +314,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
+@@ -313,7 +314,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
 		errmsg = krb5_get_error_message(krb_context, problem);
 		logit("krb5_parse_name(): %.100s", errmsg);
 		krb5_free_error_message(krb_context, errmsg);
@ -418,7 +427,7 @@ index 14502c5a..df55512d 100644
 	}
 
 	if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
-@@ -322,7 +323,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
+@@ -322,7 +323,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
 		krb5_free_error_message(krb_context, errmsg);
 		krb5_free_principal(krb_context, princ);
 		krb5_cc_destroy(krb_context, ccache);
@ -427,7 +436,7 @@ index 14502c5a..df55512d 100644
 	}
 
 	krb5_free_principal(krb_context, princ);
-@@ -331,32 +332,21 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
+@@ -331,32 +332,21 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
 	    client->creds, ccache))) {
 		logit("gss_krb5_copy_ccache() failed");
 		krb5_cc_destroy(krb_context, ccache);
@ -465,7 +474,7 @@ index 14502c5a..df55512d 100644
 		do_pam_putenv(client->store.envvar, client->store.envval);
 #endif
 
-@@ -364,7 +354,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
+@@ -364,7 +354,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
 
 	client->store.data = krb_context;
 
@ -474,44 +483,10 @@ index 14502c5a..df55512d 100644
 }
 
 int
-diff --git a/gss-serv.c b/gss-serv.c
-index a5cca797..9d5435ed 100644
--- a/gss-serv.c
-+++ b/gss-serv.c
-@@ -414,13 +414,15 @@ ssh_gssapi_cleanup_creds(void)
- }
- 
- /* As user */
-void
-+int
- ssh_gssapi_storecreds(void)
- {
- 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
-		(*gssapi_client.mech->storecreds)(&gssapi_client);
-+		return (*gssapi_client.mech->storecreds)(&gssapi_client);
- 	} else
- 		debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
-+
-+	return 0;
- }
- 
- /* This allows GSSAPI methods to do things to the child's environment based
-@@ -500,9 +502,7 @@ ssh_gssapi_rekey_creds(void) {
- 	char *envstr;
- #endif
- 
-	if (gssapi_client.store.filename == NULL &&
-	    gssapi_client.store.envval == NULL &&
-	    gssapi_client.store.envvar == NULL)
-+	if (gssapi_client.store.envval == NULL)
- 		return;
- 
- 	ok = mm_ssh_gssapi_update_creds(&gssapi_client.store);
-diff --git a/servconf.c b/servconf.c
-index d4f7fd66..55aa5bf0 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -138,6 +138,7 @@ initialize_server_options(ServerOptions *options)
+diff -up openssh-8.6p1/servconf.c.ccache_name openssh-8.6p1/servconf.c
+--- openssh-8.6p1/servconf.c.ccache_name	2021-04-19 14:05:10.848744532 +0200
+++ openssh-8.6p1/servconf.c	2021-04-19 14:05:10.854744577 +0200
+@@ -136,6 +136,7 @@ initialize_server_options(ServerOptions
 	options->kerberos_or_local_passwd = -1;
 	options->kerberos_ticket_cleanup = -1;
 	options->kerberos_get_afs_token = -1;
@ -519,7 +494,7 @@ index d4f7fd66..55aa5bf0 100644
 	options->gss_authentication=-1;
 	options->gss_keyex = -1;
 	options->gss_cleanup_creds = -1;
-@@ -382,6 +383,8 @@ fill_default_server_options(ServerOptions *options)
+@@ -359,6 +360,8 @@ fill_default_server_options(ServerOption
 		options->kerberos_ticket_cleanup = 1;
 	if (options->kerberos_get_afs_token == -1)
 		options->kerberos_get_afs_token = 0;
@ -528,16 +503,16 @@ index d4f7fd66..55aa5bf0 100644
 	if (options->gss_authentication == -1)
 		options->gss_authentication = 0;
 	if (options->gss_keyex == -1)
-@@ -564,7 +567,7 @@ typedef enum {
- 	sPort, sHostKeyFile, sLoginGraceTime,
- 	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
- 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
+@@ -506,7 +509,7 @@ typedef enum {
+	sPort, sHostKeyFile, sLoginGraceTime,
+	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
+	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 -	sKerberosGetAFSToken, sPasswordAuthentication,
 +	sKerberosGetAFSToken, sKerberosUniqueCCache, sPasswordAuthentication,
- 	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
- 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
- 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-@@ -655,11 +658,13 @@ static struct {
+	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
+	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
+	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
+@@ -593,11 +597,13 @@ static struct {
 #else
 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 #endif
@ -551,7 +526,7 @@ index d4f7fd66..55aa5bf0 100644
 #endif
 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1668,6 +1673,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1573,6 +1579,10 @@ process_server_config_line_depth(ServerO
 		intptr = &options->kerberos_get_afs_token;
 		goto parse_flag;
 
@ -562,7 +537,7 @@ index d4f7fd66..55aa5bf0 100644
 	case sGssAuthentication:
 		intptr = &options->gss_authentication;
 		goto parse_flag;
-@@ -3293,6 +3302,7 @@ dump_config(ServerOptions *o)
+@@ -2891,6 +2901,7 @@ dump_config(ServerOptions *o)
 # ifdef USE_AFS
 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
 # endif
@ -570,11 +545,10 @@ index d4f7fd66..55aa5bf0 100644
 #endif
 #ifdef GSSAPI
 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff --git a/servconf.h b/servconf.h
-index c3f50140..a4a38d6d 100644
--- a/servconf.h
-+++ b/servconf.h
-@@ -149,6 +149,8 @@ typedef struct {
+diff -up openssh-8.6p1/servconf.h.ccache_name openssh-8.6p1/servconf.h
+--- openssh-8.6p1/servconf.h.ccache_name	2021-04-19 14:05:10.848744532 +0200
+++ openssh-8.6p1/servconf.h	2021-04-19 14:05:10.855744584 +0200
+@@ -140,6 +140,8 @@ typedef struct {
 						 * file on logout. */
 	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
 						 * authenticated with Kerberos. */
@ -583,11 +557,10 @@ index c3f50140..a4a38d6d 100644
 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff --git a/session.c b/session.c
-index 89b3a9cf..2620dd11 100644
--- a/session.c
-+++ b/session.c
-@@ -1025,7 +1025,8 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
+diff -up openssh-8.6p1/session.c.ccache_name openssh-8.6p1/session.c
+--- openssh-8.6p1/session.c.ccache_name	2021-04-19 14:05:10.852744562 +0200
+++ openssh-8.6p1/session.c	2021-04-19 14:05:10.855744584 +0200
+@@ -1038,7 +1038,8 @@ do_setup_env(struct ssh *ssh, Session *s
 	/* Allow any GSSAPI methods that we've used to alter
 	 * the child's environment as they see fit
 	 */
@ -597,7 +570,7 @@ index 89b3a9cf..2620dd11 100644
 #endif
 
 	/* Set basic environment. */
-@@ -1101,7 +1102,7 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
+@@ -1114,7 +1115,7 @@ do_setup_env(struct ssh *ssh, Session *s
 	}
 #endif
 #ifdef KRB5
@ -606,33 +579,10 @@ index 89b3a9cf..2620dd11 100644
 		child_set_env(&env, &envsize, "KRB5CCNAME",
 		    s->authctxt->krb5_ccname);
 #endif
-diff --git a/ssh-gss.h b/ssh-gss.h
-index db34d77f..a894e23c 100644
--- a/ssh-gss.h
-+++ b/ssh-gss.h
-@@ -116,7 +116,7 @@ typedef struct ssh_gssapi_mech_struct {
- 	int (*dochild) (ssh_gssapi_client *);
- 	int (*userok) (ssh_gssapi_client *, char *);
- 	int (*localname) (ssh_gssapi_client *, char **);
-	void (*storecreds) (ssh_gssapi_client *);
-+	int (*storecreds) (ssh_gssapi_client *);
- 	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
- } ssh_gssapi_mech;
- 
-@@ -186,7 +186,7 @@ int ssh_gssapi_userok(char *name, struct passwd *, int kex);
- OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_do_child(char ***, u_int *);
- void ssh_gssapi_cleanup_creds(void);
-void ssh_gssapi_storecreds(void);
-+int ssh_gssapi_storecreds(void);
- const char *ssh_gssapi_displayname(void);
- 
- char *ssh_gssapi_server_mechanisms(void);
-diff --git a/sshd-session.c b/sshd-session.c
-index f8c8a797..478381db 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -1349,7 +1349,7 @@ main(int ac, char **av)
+diff -up openssh-8.6p1/sshd-session.c.ccache_name openssh-8.6p1/sshd-session.c
+--- openssh-8.6p1/sshd-session.c.ccache_name	2021-04-19 14:05:10.849744540 +0200
+++ openssh-8.6p1/sshd-session.c	2021-04-19 14:05:10.855744584 +0200
+@@ -2284,7 +2284,7 @@ main(int ac, char **av)
 #ifdef GSSAPI
 	if (options.gss_authentication) {
 		temporarily_use_uid(authctxt->pw);
@ -641,11 +591,10 @@ index f8c8a797..478381db 100644
 		restore_uid();
 	}
 #endif
-diff --git a/sshd_config.5 b/sshd_config.5
-index 8bc6586e..1251d4d5 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -1033,6 +1033,14 @@ Specifies whether to automatically destroy the user's ticket cache
+diff -up openssh-8.6p1/sshd_config.5.ccache_name openssh-8.6p1/sshd_config.5
+--- openssh-8.6p1/sshd_config.5.ccache_name	2021-04-19 14:05:10.849744540 +0200
+++ openssh-8.6p1/sshd_config.5	2021-04-19 14:05:10.856744592 +0200
+@@ -939,6 +939,14 @@ Specifies whether to automatically destr
 file on logout.
 The default is
 .Cm yes .
@ -660,6 +609,24 @@ index 8bc6586e..1251d4d5 100644
 .It Cm KexAlgorithms
 Specifies the permitted KEX (Key Exchange) algorithms that the server will
 offer to clients.
-- 
-2.49.0
-
+diff -up openssh-8.6p1/ssh-gss.h.ccache_name openssh-8.6p1/ssh-gss.h
+--- openssh-8.6p1/ssh-gss.h.ccache_name	2021-04-19 14:05:10.852744562 +0200
+++ openssh-8.6p1/ssh-gss.h	2021-04-19 14:05:10.855744584 +0200
+@@ -114,7 +114,7 @@ typedef struct ssh_gssapi_mech_struct {
+ 	int (*dochild) (ssh_gssapi_client *);
+ 	int (*userok) (ssh_gssapi_client *, char *);
+ 	int (*localname) (ssh_gssapi_client *, char **);
+-	void (*storecreds) (ssh_gssapi_client *);
+	int (*storecreds) (ssh_gssapi_client *);
+ 	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
+ } ssh_gssapi_mech;
+ 
+@@ -175,7 +175,7 @@ int ssh_gssapi_userok(char *name, struct
+ OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
+ void ssh_gssapi_do_child(char ***, u_int *);
+ void ssh_gssapi_cleanup_creds(void);
+-void ssh_gssapi_storecreds(void);
+int ssh_gssapi_storecreds(void);
+ const char *ssh_gssapi_displayname(void);
+ 
+ char *ssh_gssapi_server_mechanisms(void);
--- a/0010-openssh-8.7p1-redhat.patch
+++ b/0010-openssh-8.7p1-redhat.patch
@ -1,26 +1,7 @@
-From 5f21983f6472b26693babea4d6ca6b95a7dc7b05 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 10/50] openssh-8.7p1-redhat
-
---
- ssh_config            |  7 +++++++
- ssh_config_redhat     | 18 ++++++++++++++++++
- sshd_config           |  8 ++++++++
- sshd_config.0         |  6 +++---
- sshd_config.5         |  2 +-
- sshd_config_redhat    | 18 ++++++++++++++++++
- sshd_config_redhat_cp |  7 +++++++
- 7 files changed, 62 insertions(+), 4 deletions(-)
- create mode 100644 ssh_config_redhat
- create mode 100644 sshd_config_redhat
- create mode 100644 sshd_config_redhat_cp
-
-diff --git a/ssh_config b/ssh_config
-index cc566356..18169187 100644
--- a/ssh_config
-+++ b/ssh_config
-@@ -44,3 +44,10 @@
+diff -up openssh/ssh_config.redhat openssh/ssh_config
+--- openssh/ssh_config.redhat	2020-02-11 23:28:35.000000000 +0100
+++ openssh/ssh_config	2020-02-13 18:13:39.180641839 +0100
+@@ -43,3 +43,10 @@
 #   ProxyCommand ssh -q -W %h:%p gateway.example.com
 #   RekeyLimit 1G 1h
 #   UserKnownHostsFile ~/.ssh/known_hosts.d/%k
@ -31,12 +12,10 @@ index cc566356..18169187 100644
 +# included below. For more information, see manual page for
 +#  update-crypto-policies(8)  and  ssh_config(5).
 +Include /etc/ssh/ssh_config.d/*.conf
-diff --git a/ssh_config_redhat b/ssh_config_redhat
-new file mode 100644
-index 00000000..8b1b5902
--- /dev/null
-+++ b/ssh_config_redhat
-@@ -0,0 +1,18 @@
+diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
+--- openssh/ssh_config_redhat.redhat	2020-02-13 18:13:39.180641839 +0100
+++ openssh/ssh_config_redhat	2020-02-13 18:13:39.180641839 +0100
+@@ -0,0 +1,15 @@
 +# The options here are in the "Match final block" to be applied as the last
 +# options and could be potentially overwritten by the user configuration
 +Match final all
@ -50,35 +29,12 @@ index 00000000..8b1b5902
 +# mode correctly we set this to yes.
 +	ForwardX11Trusted yes
 +
-+# rhbz#2352653 - export COLORTERM
-+	SendEnv COLORTERM
-+
 +# Uncomment this if you want to use .local domain
 +# Host *.local
-diff --git a/sshd_config b/sshd_config
-index 0f4a3a72..608203e4 100644
--- a/sshd_config
-+++ b/sshd_config
-@@ -10,6 +10,14 @@
- # possible, but leave them commented.  Uncommented options override the
- # default value.
- 
-+# To modify the system-wide sshd configuration, create a  *.conf  file under
-+#  /etc/ssh/sshd_config.d/  which will be automatically included below
-+Include /etc/ssh/sshd_config.d/*.conf
-+
-+# If you want to change the port on a SELinux system, you have to tell
-+# SELinux about this change.
-+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
-+#
- #Port 22
- #AddressFamily any
- #ListenAddress 0.0.0.0
-diff --git a/sshd_config.0 b/sshd_config.0
-index 2f77b4f4..49349bb3 100644
--- a/sshd_config.0
-+++ b/sshd_config.0
-@@ -1219,9 +1219,9 @@ DESCRIPTION
+diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
+--- openssh/sshd_config.0.redhat	2020-02-12 14:30:04.000000000 +0100
+++ openssh/sshd_config.0	2020-02-13 18:13:39.181641855 +0100
+@@ -970,9 +970,9 @@ DESCRIPTION
 
      SyslogFacility
              Gives the facility code that is used when logging messages from
@ -91,11 +47,10 @@ index 2f77b4f4..49349bb3 100644
 
      TCPKeepAlive
              Specifies whether the system should send TCP keepalive messages
-diff --git a/sshd_config.5 b/sshd_config.5
-index c0771737..035a50c8 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -1942,7 +1942,7 @@ By default no subsystems are defined.
+diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
+--- openssh/sshd_config.5.redhat	2020-02-11 23:28:35.000000000 +0100
+++ openssh/sshd_config.5	2020-02-13 18:13:39.181641855 +0100
+@@ -1614,7 +1614,7 @@ By default no subsystems are defined.
 .It Cm SyslogFacility
 Gives the facility code that is used when logging messages from
 .Xr sshd 8 .
@ -104,15 +59,31 @@ index c0771737..035a50c8 100644
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
 The default is AUTH.
 .It Cm TCPKeepAlive
-diff --git a/sshd_config_redhat b/sshd_config_redhat
-new file mode 100644
-index 00000000..993a28d5
--- /dev/null
-+++ b/sshd_config_redhat
-@@ -0,0 +1,18 @@
+diff -up openssh/sshd_config.redhat openssh/sshd_config
+--- openssh/sshd_config.redhat	2020-02-11 23:28:35.000000000 +0100
+++ openssh/sshd_config	2020-02-13 18:20:16.349913681 +0100
+@@ -10,6 +10,14 @@
+ # possible, but leave them commented.  Uncommented options override the
+ # default value.
+
+# To modify the system-wide sshd configuration, create a  *.conf  file under
+#  /etc/ssh/sshd_config.d/  which will be automatically included below
+Include /etc/ssh/sshd_config.d/*.conf
+
+# If you want to change the port on a SELinux system, you have to tell
+# SELinux about this change.
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
+#
+ #Port 22
+ #AddressFamily any
+ #ListenAddress 0.0.0.0
+diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
+--- openssh/sshd_config_redhat.redhat	2020-02-13 18:14:02.268006439 +0100
+++ openssh/sshd_config_redhat	2020-02-13 18:19:20.765035947 +0100
+@@ -0,0 +1,15 @@
 +SyslogFacility AUTHPRIV
 +
-+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
 +
 +GSSAPIAuthentication yes
 +GSSAPICleanupCredentials no
@ -121,18 +92,13 @@ index 00000000..993a28d5
 +
 +X11Forwarding yes
 +
-+# rhbz#2352653 - accept COLORTERM
-+	AcceptEnv COLORTERM
-+
 +# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
 +# as it is more configurable and versatile than the built-in version.
 +PrintMotd no
 +
-diff --git a/sshd_config_redhat_cp b/sshd_config_redhat_cp
-new file mode 100644
-index 00000000..1d592d13
--- /dev/null
-+++ b/sshd_config_redhat_cp
+diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
+--- openssh/sshd_config_redhat_cp.redhat	2020-02-13 18:14:02.268006439 +0100
+++ openssh/sshd_config_redhat_cp	2020-02-13 18:19:20.765035947 +0100
@@ -0,0 +1,7 @@
 +# This system is following system-wide crypto policy. The changes to
 +# crypto properties (Ciphers, MACs, ...) will not have any effect in
@ -141,6 +107,3 @@ index 00000000..1d592d13
 +# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
 +Include /etc/crypto-policies/back-ends/opensshserver.config
 +
-- 
-2.49.0
-
--- a/0011-openssh-7.8p1-UsePAM-warning.patch
+++ b/0011-openssh-7.8p1-UsePAM-warning.patch
@ -1,18 +1,7 @@
-From 56b8d082bc9e25a77b5227d576f27088446c6fb9 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 11/50] openssh-7.8p1-UsePAM-warning
-
---
- sshd-session.c | 4 ++++
- sshd_config    | 2 ++
- 2 files changed, 6 insertions(+)
-
-diff --git a/sshd-session.c b/sshd-session.c
-index a365f26f..a70b36c9 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -1127,6 +1127,10 @@ main(int ac, char **av)
+diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
+--- openssh-8.6p1/sshd-session.c.log-usepam-no	2021-04-19 14:00:45.099735129 +0200
+++ openssh-8.6p1/sshd-session.c	2021-04-19 14:03:21.140920974 +0200
+@@ -1749,6 +1749,10 @@ main(int ac, char **av)
 			    "enabled authentication methods");
 	}
 
@ -23,11 +12,10 @@ index a365f26f..a70b36c9 100644
 #ifdef WITH_OPENSSL
 	if (options.moduli_file != NULL)
 		dh_set_moduli_file(options.moduli_file);
-diff --git a/sshd_config b/sshd_config
-index 608203e4..48af6321 100644
--- a/sshd_config
-+++ b/sshd_config
-@@ -89,6 +89,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
+diff -up openssh-8.6p1/sshd_config.log-usepam-no openssh-8.6p1/sshd_config
+--- openssh-8.6p1/sshd_config.log-usepam-no	2021-04-19 14:00:45.098735121 +0200
+++ openssh-8.6p1/sshd_config	2021-04-19 14:00:45.099735129 +0200
+@@ -87,6 +87,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and KbdInteractiveAuthentication to 'no'.
@ -36,6 +24,3 @@ index 608203e4..48af6321 100644
 #UsePAM no
 
 #AllowAgentForwarding yes
-- 
-2.49.0
-
--- a/0001-openssh-7.8p1-role-mls.patch
+++ b/0001-openssh-7.8p1-role-mls.patch
@ -1,75 +1,46 @@
-From 95f4e30195382c3df7104c2ad3e5e9953f8ad554 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 01/50] openssh-7.8p1-role-mls
-
---
- auth-pam.c                       |   2 +-
- auth-pam.h                       |   2 +-
- auth.h                           |   3 +
- auth2-gss.c                      |  11 +-
- auth2-hostbased.c                |   9 +
- auth2-pubkey.c                   |  11 +-
- auth2.c                          |  14 ++
- misc.c                           |   8 +
- monitor.c                        |  37 ++-
- monitor.h                        |   4 +
- monitor_wrap.c                   |  21 ++
- monitor_wrap.h                   |   3 +
- openbsd-compat/Makefile.in       |   3 +-
- openbsd-compat/port-linux-sshd.c | 420 +++++++++++++++++++++++++++++++
- openbsd-compat/port-linux.c      |  37 +--
- openbsd-compat/port-linux.h      |   3 +-
- platform.c                       |   2 +-
- sshd-session.c                   |   3 +
- 18 files changed, 551 insertions(+), 42 deletions(-)
- create mode 100644 openbsd-compat/port-linux-sshd.c
-
-diff --git a/auth-pam.c b/auth-pam.c
-index 13c0a792..b4100ea1 100644
--- a/auth-pam.c
-+++ b/auth-pam.c
-@@ -1238,7 +1238,7 @@ is_pam_session_open(void)
-  * during the ssh authentication process.
-  */
- int
-do_pam_putenv(char *name, char *value)
-+do_pam_putenv(char *name, const char *value)
- {
- 	int ret = 1;
- 	char *compound;
-diff --git a/auth-pam.h b/auth-pam.h
-index 8d801c68..9dd7ae07 100644
--- a/auth-pam.h
-+++ b/auth-pam.h
-@@ -33,7 +33,7 @@ u_int do_pam_account(void);
- void do_pam_session(struct ssh *);
- void do_pam_setcred(void);
- void do_pam_chauthtok(void);
-int do_pam_putenv(char *, char *);
-+int do_pam_putenv(char *, const char *);
- char ** fetch_pam_environment(void);
- char ** fetch_pam_child_environment(void);
- void free_pam_environment(char **);
-diff --git a/auth.h b/auth.h
-index 98bb23d4..83d07ae8 100644
--- a/auth.h
-+++ b/auth.h
-@@ -65,6 +65,9 @@ struct Authctxt {
- 	char		*service;
- 	struct passwd	*pw;		/* set if 'valid' */
- 	char		*style;
+diff -up openssh/auth2.c.role-mls openssh/auth2.c
+--- openssh/auth2.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/auth2.c	2018-08-22 11:14:56.815430916 +0200
+@@ -256,6 +256,9 @@ input_userauth_request(int type, u_int32
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	Authmethod *m = NULL;
+ 	char *user = NULL, *service = NULL, *method = NULL, *style = NULL;
 +#ifdef WITH_SELINUX
-+	char		*role;
+	char *role = NULL;
 +#endif
+ 	int r, authenticated = 0;
+ 	double tstart = monotime_double();
 
- 	/* Method lists for multiple authentication */
- 	char		**auth_methods;	/* modified from server config */
-diff --git a/auth2-gss.c b/auth2-gss.c
-index 75eb4e3a..f7898ab3 100644
--- a/auth2-gss.c
-+++ b/auth2-gss.c
-@@ -284,6 +284,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -268,6 +271,11 @@ input_userauth_request(int type, u_int32
+ 	debug("userauth-request for user %s service %s method %s", user, service, method);
+ 	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
+ 
+#ifdef WITH_SELINUX
+	if ((role = strchr(user, '/')) != NULL)
+		*role++ = 0;
+#endif
+
+ 	if ((style = strchr(user, ':')) != NULL)
+ 		*style++ = 0;
+ 
+@@ -314,7 +314,13 @@ input_userauth_request(int type, u_int32
+ 		setproctitle("%s [net]", authctxt->valid ? user : "unknown");
+ 		authctxt->service = xstrdup(service);
+ 		authctxt->style = style ? xstrdup(style) : NULL;
+#ifdef WITH_SELINUX
+		authctxt->role = role ? xstrdup(role) : NULL;
+#endif
+ 		mm_inform_authserv(service, style);
+#ifdef WITH_SELINUX
+         	mm_inform_authrole(role);
+#endif
+ 		userauth_banner(ssh);
+ 		if ((r = kex_server_update_ext_info(ssh)) != 0)
+ 			fatal_fr(r, "kex_server_update_ext_info failed");
+diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
+--- openssh/auth2-gss.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/auth2-gss.c	2018-08-22 11:15:42.459799171 +0200
+@@ -281,6 +281,7 @@ input_gssapi_mic(int type, u_int32_t ple
 	Authctxt *authctxt = ssh->authctxt;
 	Gssctxt *gssctxt;
 	int r, authenticated = 0;
@ -77,7 +48,7 @@ index 75eb4e3a..f7898ab3 100644
 	struct sshbuf *b;
 	gss_buffer_desc mic, gssbuf;
 	u_char *p;
-@@ -300,7 +301,13 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -298,7 +299,13 @@ input_gssapi_mic(int type, u_int32_t ple
 		fatal_f("sshbuf_new failed");
 	mic.value = p;
 	mic.length = len;
@ -92,7 +63,7 @@ index 75eb4e3a..f7898ab3 100644
 	    "gssapi-with-mic", ssh->kex->session_id);
 
 	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
-@@ -313,6 +320,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -311,6 +318,8 @@ input_gssapi_mic(int type, u_int32_t ple
 		logit("GSSAPI MIC check failed");
 
 	sshbuf_free(b);
@ -101,11 +72,10 @@ index 75eb4e3a..f7898ab3 100644
 	free(mic.value);
 
 	authctxt->postponed = 0;
-diff --git a/auth2-hostbased.c b/auth2-hostbased.c
-index eb21479a..a3be6e49 100644
--- a/auth2-hostbased.c
-+++ b/auth2-hostbased.c
-@@ -129,7 +129,16 @@ userauth_hostbased(struct ssh *ssh, const char *method)
+diff -up openssh/auth2-hostbased.c.role-mls openssh/auth2-hostbased.c
+--- openssh/auth2-hostbased.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/auth2-hostbased.c	2018-08-22 11:14:56.816430924 +0200
+@@ -123,7 +123,16 @@ userauth_hostbased(struct ssh *ssh)
 	/* reconstruct packet */
 	if ((r = sshbuf_put_stringb(b, ssh->kex->session_id)) != 0 ||
 	    (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
@ -122,11 +92,10 @@ index eb21479a..a3be6e49 100644
 	    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
 	    (r = sshbuf_put_cstring(b, method)) != 0 ||
 	    (r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
-diff --git a/auth2-pubkey.c b/auth2-pubkey.c
-index aa24fda0..267a27d2 100644
--- a/auth2-pubkey.c
-+++ b/auth2-pubkey.c
-@@ -206,9 +206,16 @@ userauth_pubkey(struct ssh *ssh, const char *method)
+diff -up openssh/auth2-pubkey.c.role-mls openssh/auth2-pubkey.c
+--- openssh/auth2-pubkey.c.role-mls	2018-08-22 11:14:56.816430924 +0200
+++ openssh/auth2-pubkey.c	2018-08-22 11:17:07.331483958 +0200
+@@ -169,9 +169,16 @@ userauth_pubkey(struct ssh *ssh)
 			goto done;
 		}
 		/* reconstruct packet */
@ -145,51 +114,47 @@ index aa24fda0..267a27d2 100644
 		if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
 		    (r = sshbuf_put_cstring(b, userstyle)) != 0 ||
 		    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
-diff --git a/auth2.c b/auth2.c
-index 82f6e621..5ba45c12 100644
--- a/auth2.c
-+++ b/auth2.c
-@@ -271,6 +271,9 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
- 	Authctxt *authctxt = ssh->authctxt;
- 	Authmethod *m = NULL;
- 	char *user = NULL, *service = NULL, *method = NULL, *style = NULL;
+diff -up openssh/auth.h.role-mls openssh/auth.h
+--- openssh/auth.h.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/auth.h	2018-08-22 11:14:56.816430924 +0200
+@@ -65,6 +65,9 @@ struct Authctxt {
+ 	char		*service;
+ 	struct passwd	*pw;		/* set if 'valid' */
+ 	char		*style;
 +#ifdef WITH_SELINUX
-+	char *role = NULL;
+	char		*role;
 +#endif
- 	int r, authenticated = 0;
- 	double tstart = monotime_double();
 
-@@ -284,6 +287,11 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
- 	debug("userauth-request for user %s service %s method %s", user, service, method);
- 	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
- 
-+#ifdef WITH_SELINUX
-+	if ((role = strchr(user, '/')) != NULL)
-+		*role++ = 0;
-+#endif
-+
- 	if ((style = strchr(user, ':')) != NULL)
- 		*style++ = 0;
- 
-@@ -313,7 +321,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
- 		setproctitle("%s [net]", authctxt->valid ? user : "unknown");
- 		authctxt->service = xstrdup(service);
- 		authctxt->style = style ? xstrdup(style) : NULL;
-+#ifdef WITH_SELINUX
-+		authctxt->role = role ? xstrdup(role) : NULL;
-+#endif
- 		mm_inform_authserv(service, style);
-+#ifdef WITH_SELINUX
-+         	mm_inform_authrole(role);
-+#endif
- 		userauth_banner(ssh);
- 		if ((r = kex_server_update_ext_info(ssh)) != 0)
- 			fatal_fr(r, "kex_server_update_ext_info failed");
-diff --git a/misc.c b/misc.c
-index dd0bd032..c932f9bb 100644
--- a/misc.c
-+++ b/misc.c
-@@ -806,6 +806,7 @@ char *
+ 	/* Method lists for multiple authentication */
+ 	char		**auth_methods;	/* modified from server config */
+diff -up openssh/auth-pam.c.role-mls openssh/auth-pam.c
+--- openssh/auth-pam.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/auth-pam.c	2018-08-22 11:14:56.816430924 +0200
+@@ -1172,7 +1172,7 @@ is_pam_session_open(void)
+  * during the ssh authentication process.
+  */
+ int
+-do_pam_putenv(char *name, char *value)
+do_pam_putenv(char *name, const char *value)
+ {
+ 	int ret = 1;
+ 	char *compound;
+diff -up openssh/auth-pam.h.role-mls openssh/auth-pam.h
+--- openssh/auth-pam.h.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/auth-pam.h	2018-08-22 11:14:56.817430932 +0200
+@@ -33,7 +33,7 @@ u_int do_pam_account(void);
+ void do_pam_session(struct ssh *);
+ void do_pam_setcred(void);
+ void do_pam_chauthtok(void);
+-int do_pam_putenv(char *, char *);
+int do_pam_putenv(char *, const char *);
+ char ** fetch_pam_environment(void);
+ char ** fetch_pam_child_environment(void);
+ void free_pam_environment(char **);
+diff -up openssh/misc.c.role-mls openssh/misc.c
+--- openssh/misc.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/misc.c	2018-08-22 11:14:56.817430932 +0200
+@@ -542,6 +542,7 @@ char *
 colon(char *cp)
 {
 	int flag = 0;
@ -197,7 +162,7 @@ index dd0bd032..c932f9bb 100644
 
 	if (*cp == ':')		/* Leading colon is part of file name. */
 		return NULL;
-@@ -821,6 +822,13 @@ colon(char *cp)
+@@ -557,6 +558,13 @@ colon(char *cp)
 			return (cp);
 		if (*cp == '/')
 			return NULL;
@ -211,11 +176,10 @@ index dd0bd032..c932f9bb 100644
 	}
 	return NULL;
 }
-diff --git a/monitor.c b/monitor.c
-index 2179553d..02b3eaaa 100644
--- a/monitor.c
-+++ b/monitor.c
-@@ -120,6 +120,9 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *);
+diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
+--- openssh-8.6p1/monitor.c.role-mls	2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/monitor.c	2021-05-21 14:21:56.719414087 +0200
+@@ -117,6 +117,9 @@ int mm_answer_sign(struct ssh *, int, st
 int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *);
 int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *);
 int mm_answer_authserv(struct ssh *, int, struct sshbuf *);
@ -225,7 +189,7 @@ index 2179553d..02b3eaaa 100644
 int mm_answer_authpassword(struct ssh *, int, struct sshbuf *);
 int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *);
 int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *);
-@@ -194,6 +197,9 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -195,6 +198,9 @@ struct mon_table mon_dispatch_proto20[]
     {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
     {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
     {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@ -235,7 +199,7 @@ index 2179553d..02b3eaaa 100644
     {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
     {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
 #ifdef USE_PAM
-@@ -912,6 +918,9 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -803,6 +809,9 @@ mm_answer_pwnamallow(struct ssh *ssh, in
 
 	/* Allow service/style information on the auth context */
 	monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@ -245,7 +209,7 @@ index 2179553d..02b3eaaa 100644
 	monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
 
 #ifdef USE_PAM
-@@ -986,6 +995,26 @@ key_base_type_match(const char *method, const struct sshkey *key,
+@@ -877,6 +886,26 @@ key_base_type_match(const char *method,
 	return found;
 }
 
@ -272,16 +236,16 @@ index 2179553d..02b3eaaa 100644
 int
 mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m)
 {
-@@ -1358,7 +1387,7 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
+@@ -1251,7 +1280,7 @@ monitor_valid_userblob(struct ssh *ssh,
 	struct sshbuf *b;
- 	struct sshkey *hostkey = NULL;
+	struct sshkey *hostkey = NULL;
 	const u_char *p;
 -	char *userstyle, *cp;
 +	char *userstyle, *s, *cp;
 	size_t len;
 	u_char type;
 	int hostbound = 0, r, fail = 0;
-@@ -1389,6 +1418,8 @@ monitor_valid_userblob(struct ssh *ssh, const u_char *data, u_int datalen)
+@@ -1282,6 +1311,8 @@ monitor_valid_userblob(struct ssh *ssh,
 		fail++;
 	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
 		fatal_fr(r, "parse userstyle");
@ -290,7 +254,7 @@ index 2179553d..02b3eaaa 100644
 	xasprintf(&userstyle, "%s%s%s", authctxt->user,
 	    authctxt->style ? ":" : "",
 	    authctxt->style ? authctxt->style : "");
-@@ -1439,7 +1470,7 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
+@@ -1317,7 +1348,7 @@ monitor_valid_hostbasedblob(const u_char
 {
 	struct sshbuf *b;
 	const u_char *p;
@ -299,7 +263,7 @@ index 2179553d..02b3eaaa 100644
 	size_t len;
 	int r, fail = 0;
 	u_char type;
-@@ -1460,6 +1491,8 @@ monitor_valid_hostbasedblob(const u_char *data, u_int datalen,
+@@ -1338,6 +1370,8 @@ monitor_valid_hostbasedblob(const u_char
 		fail++;
 	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
 		fatal_fr(r, "parse userstyle");
@ -308,13 +272,12 @@ index 2179553d..02b3eaaa 100644
 	xasprintf(&userstyle, "%s%s%s", authctxt->user,
 	    authctxt->style ? ":" : "",
 	    authctxt->style ? authctxt->style : "");
-diff --git a/monitor.h b/monitor.h
-index 3f8a9bea..9dcd9c29 100644
--- a/monitor.h
-+++ b/monitor.h
-@@ -56,6 +56,10 @@ enum monitor_reqtype {
+diff -up openssh/monitor.h.role-mls openssh/monitor.h
+--- openssh/monitor.h.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/monitor.h	2018-08-22 11:14:56.818430941 +0200
+@@ -55,6 +55,10 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_GSSCHECKMIC = 48, MONITOR_ANS_GSSCHECKMIC = 49,
 	MONITOR_REQ_TERM = 50,
- 	MONITOR_REQ_STATE = 51, MONITOR_ANS_STATE = 52,
 
 +#ifdef WITH_SELINUX
 +	MONITOR_REQ_AUTHROLE = 80,
@ -323,11 +286,10 @@ index 3f8a9bea..9dcd9c29 100644
 	MONITOR_REQ_PAM_START = 100,
 	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
 	MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
-diff --git a/monitor_wrap.c b/monitor_wrap.c
-index bd900b2f..ef3ab1b1 100644
--- a/monitor_wrap.c
-+++ b/monitor_wrap.c
-@@ -442,6 +442,27 @@ mm_inform_authserv(char *service, char *style)
+diff -up openssh/monitor_wrap.c.role-mls openssh/monitor_wrap.c
+--- openssh/monitor_wrap.c.role-mls	2018-08-22 11:14:56.818430941 +0200
+++ openssh/monitor_wrap.c	2018-08-22 11:21:47.938747968 +0200
+@@ -390,6 +390,27 @@ mm_inform_authserv(char *service, char *
 	sshbuf_free(m);
 }
 
@ -355,11 +317,10 @@ index bd900b2f..ef3ab1b1 100644
 /* Do the password authentication */
 int
 mm_auth_password(struct ssh *ssh, char *password)
-diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 7134afee..38a280c8 100644
--- a/monitor_wrap.h
-+++ b/monitor_wrap.h
-@@ -46,6 +46,9 @@ int mm_sshkey_sign(struct ssh *, struct sshkey *, u_char **, size_t *,
+diff -up openssh/monitor_wrap.h.role-mls openssh/monitor_wrap.h
+--- openssh/monitor_wrap.h.role-mls	2018-08-22 11:14:56.818430941 +0200
+++ openssh/monitor_wrap.h	2018-08-22 11:22:10.439929513 +0200
+@@ -44,6 +44,9 @@ DH *mm_choose_dh(int, int, int);
     const u_char *, size_t, const char *, const char *,
     const char *, u_int compat);
 void mm_inform_authserv(char *, char *);
@ -369,11 +330,10 @@ index 7134afee..38a280c8 100644
 struct passwd *mm_getpwnamallow(struct ssh *, const char *);
 char *mm_auth2_read_banner(void);
 int mm_auth_password(struct ssh *, char *);
-diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
-index 1d549954..78e6fa5b 100644
--- a/openbsd-compat/Makefile.in
-+++ b/openbsd-compat/Makefile.in
-@@ -100,7 +100,8 @@ PORTS=	port-aix.o \
+diff -up openssh/openbsd-compat/Makefile.in.role-mls openssh/openbsd-compat/Makefile.in
+--- openssh/openbsd-compat/Makefile.in.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/openbsd-compat/Makefile.in	2018-08-22 11:14:56.819430949 +0200
+@@ -92,7 +92,8 @@ PORTS=	port-aix.o \
 	port-prngd.o \
 	port-solaris.o \
 	port-net.o \
@ -383,11 +343,78 @@ index 1d549954..78e6fa5b 100644
 
 .c.o:
 	$(CC) $(CFLAGS_NOPIE) $(PICFLAG) $(CPPFLAGS) -c $<
-diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-new file mode 100644
-index 00000000..b9fbe38b
--- /dev/null
-+++ b/openbsd-compat/port-linux-sshd.c
+diff -up openssh/openbsd-compat/port-linux.c.role-mls openssh/openbsd-compat/port-linux.c
+--- openssh/openbsd-compat/port-linux.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/openbsd-compat/port-linux.c	2018-08-22 11:14:56.819430949 +0200
+@@ -100,37 +100,6 @@ ssh_selinux_getctxbyname(char *pwname)
+ 	return sc;
+ }
+ 
+-/* Set the execution context to the default for the specified user */
+-void
+-ssh_selinux_setup_exec_context(char *pwname)
+-{
+-	char *user_ctx = NULL;
+-
+-	if (!ssh_selinux_enabled())
+-		return;
+-
+-	debug3("%s: setting execution context", __func__);
+-
+-	user_ctx = ssh_selinux_getctxbyname(pwname);
+-	if (setexeccon(user_ctx) != 0) {
+-		switch (security_getenforce()) {
+-		case -1:
+-			fatal("%s: security_getenforce() failed", __func__);
+-		case 0:
+-			error("%s: Failed to set SELinux execution "
+-			    "context for %s", __func__, pwname);
+-			break;
+-		default:
+-			fatal("%s: Failed to set SELinux execution context "
+-			    "for %s (in enforcing mode)", __func__, pwname);
+-		}
+-	}
+-	if (user_ctx != NULL)
+-		freecon(user_ctx);
+-
+-	debug3("%s: done", __func__);
+-}
+-
+ /* Set the TTY context for the specified user */
+ void
+ ssh_selinux_setup_pty(char *pwname, const char *tty)
+@@ -145,7 +114,11 @@ ssh_selinux_setup_pty(char *pwname, cons
+ 
+ 	debug3("%s: setting TTY context on %s", __func__, tty);
+ 
+-	user_ctx = ssh_selinux_getctxbyname(pwname);
+	if (getexeccon(&user_ctx) != 0) {
+		error_f("getexeccon: %s", strerror(errno));
+		goto out;
+	}
+
+ 
+ 	/* XXX: should these calls fatal() upon failure in enforcing mode? */
+ 
+diff -up openssh/openbsd-compat/port-linux.h.role-mls openssh/openbsd-compat/port-linux.h
+--- openssh/openbsd-compat/port-linux.h.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/openbsd-compat/port-linux.h	2018-08-22 11:14:56.819430949 +0200
+@@ -20,9 +20,10 @@
+ #ifdef WITH_SELINUX
+ int ssh_selinux_enabled(void);
+ void ssh_selinux_setup_pty(char *, const char *);
+-void ssh_selinux_setup_exec_context(char *);
+ void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
+
+void sshd_selinux_setup_exec_context(char *);
+ #endif
+ 
+ #ifdef LINUX_OOM_ADJUST
+diff -up openssh/openbsd-compat/port-linux-sshd.c.role-mls openssh/openbsd-compat/port-linux-sshd.c
+--- openssh/openbsd-compat/port-linux-sshd.c.role-mls	2018-08-22 11:14:56.819430949 +0200
+++ openssh/openbsd-compat/port-linux-sshd.c	2018-08-22 11:14:56.819430949 +0200
@@ -0,0 +1,420 @@
 +/*
 + * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
@ -809,82 +836,10 @@ index 00000000..b9fbe38b
 +#endif
 +#endif
 +
-diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index c1d54f38..7426f6f7 100644
--- a/openbsd-compat/port-linux.c
-+++ b/openbsd-compat/port-linux.c
-@@ -109,37 +109,6 @@ ssh_selinux_getctxbyname(char *pwname)
- 	return sc;
- }
- 
-/* Set the execution context to the default for the specified user */
-void
-ssh_selinux_setup_exec_context(char *pwname)
-{
-	char *user_ctx = NULL;
-
-	if (!ssh_selinux_enabled())
-		return;
-
-	debug3("%s: setting execution context", __func__);
-
-	user_ctx = ssh_selinux_getctxbyname(pwname);
-	if (setexeccon(user_ctx) != 0) {
-		switch (security_getenforce()) {
-		case -1:
-			fatal("%s: security_getenforce() failed", __func__);
-		case 0:
-			error("%s: Failed to set SELinux execution "
-			    "context for %s", __func__, pwname);
-			break;
-		default:
-			fatal("%s: Failed to set SELinux execution context "
-			    "for %s (in enforcing mode)", __func__, pwname);
-		}
-	}
-	if (user_ctx != NULL)
-		freecon(user_ctx);
-
-	debug3("%s: done", __func__);
-}
-
- /* Set the TTY context for the specified user */
- void
- ssh_selinux_setup_pty(char *pwname, const char *tty)
-@@ -152,7 +121,11 @@ ssh_selinux_setup_pty(char *pwname, const char *tty)
- 
- 	debug3("%s: setting TTY context on %s", __func__, tty);
- 
-	user_ctx = ssh_selinux_getctxbyname(pwname);
-+	if (getexeccon(&user_ctx) != 0) {
-+		error_f("getexeccon: %s", strerror(errno));
-+		goto out;
-+	}
-+
- 
- 	/* XXX: should these calls fatal() upon failure in enforcing mode? */
- 
-diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 959430de..055c825e 100644
--- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -20,9 +20,10 @@
- #ifdef WITH_SELINUX
- int ssh_selinux_enabled(void);
- void ssh_selinux_setup_pty(char *, const char *);
-void ssh_selinux_setup_exec_context(char *);
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
-+
-+void sshd_selinux_setup_exec_context(char *);
- #endif
- 
- #ifdef LINUX_OOM_ADJUST
-diff --git a/platform.c b/platform.c
-index 4c4fe57e..1bfb4bea 100644
--- a/platform.c
-+++ b/platform.c
-@@ -140,7 +140,7 @@ platform_setusercontext_post_groups(struct passwd *pw)
+diff -up openssh/platform.c.role-mls openssh/platform.c
+--- openssh/platform.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/platform.c	2018-08-22 11:14:56.819430949 +0200
+@@ -183,7 +183,7 @@ platform_setusercontext_post_groups(stru
 	}
 #endif /* HAVE_SETPCRED */
 #ifdef WITH_SELINUX
@ -893,11 +848,10 @@ index 4c4fe57e..1bfb4bea 100644
 #endif
 }
 
-diff --git a/sshd-session.c b/sshd-session.c
-index c64eb29f..74d2cbc7 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -1328,6 +1328,9 @@ main(int ac, char **av)
+diff -up openssh/sshd.c.role-mls openssh/sshd.c
+--- openssh/sshd-session.c.role-mls	2018-08-20 07:57:29.000000000 +0200
+++ openssh/sshd-session.c	2018-08-22 11:14:56.820430957 +0200
+@@ -2186,6 +2186,9 @@ main(int ac, char **av)
 		restore_uid();
 	}
 #endif
@ -907,6 +861,3 @@ index c64eb29f..74d2cbc7 100644
 #ifdef USE_PAM
 	if (options.use_pam) {
 		do_pam_setcred();
-- 
-2.49.0
-
--- a/0029-openssh-7.8p1-scp-ipv6.patch
+++ b/0029-openssh-7.8p1-scp-ipv6.patch
@ -1,17 +1,8 @@
-From 507e6f245557ae7261806f7ecbd40697cb0dd389 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 29/50] openssh-7.8p1-scp-ipv6
-
---
- scp.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
 diff --git a/scp.c b/scp.c
-index 9554b188..7f9795a5 100644
+index 60682c68..9344806e 100644
 --- a/scp.c
 +++ b/scp.c
-@@ -1183,7 +1183,9 @@ toremote(int argc, char **argv, enum scp_mode_e mode, char *sftp_direct)
+@@ -714,7 +714,9 @@ toremote(int argc, char **argv)
 			addargs(&alist, "%s", host);
 			addargs(&alist, "%s", cmd);
 			addargs(&alist, "%s", src);
@ -22,6 +13,4 @@ index 9554b188..7f9795a5 100644
 			    tuser ? tuser : "", tuser ? "@" : "",
 			    thost, targ);
 			if (do_local_cmd(&alist) != 0)
-- 
-2.49.0

--- a/0030-openssh-8.0p1-crypto-policies.patch
+++ b/0030-openssh-8.0p1-crypto-policies.patch
@ -1,18 +1,7 @@
-From b436140fe3abd9f97f01f9af9f5da5cf6c5d7725 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 30/50] openssh-8.0p1-crypto-policies
-
---
- ssh_config.5  | 164 ++++++++++++++++++++-------------------------
- sshd_config.5 | 179 +++++++++++++++++++-------------------------------
- 2 files changed, 140 insertions(+), 203 deletions(-)
-
-diff --git a/ssh_config.5 b/ssh_config.5
-index 8d5d0722..a43b2a27 100644
--- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -438,17 +438,13 @@ A single argument of
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh_config.5 openssh-9.3p1-patched/ssh_config.5
+--- openssh-9.3p1/ssh_config.5	2023-06-07 10:26:48.284590156 +0200
+++ openssh-9.3p1-patched/ssh_config.5	2023-06-07 10:26:00.623052194 +0200
+@@ -378,17 +378,13 @@
 causes no CNAMEs to be considered for canonicalization.
 This is the default behaviour.
 .It Cm CASignatureAlgorithms
@ -35,7 +24,7 @@ index 8d5d0722..a43b2a27 100644
 If the specified list begins with a
 .Sq +
 character, then the specified algorithms will be appended to the default set
-@@ -587,20 +583,25 @@ If the option is set to
+@@ -450,20 +446,25 @@
 (the default),
 the check will not be executed.
 .It Cm Ciphers
@ -65,21 +54,21 @@ index 8d5d0722..a43b2a27 100644
 .Pp
 The supported ciphers are:
 .Bd -literal -offset indent
-@@ -616,13 +617,6 @@ aes256-gcm@openssh.com
+@@ -479,13 +480,6 @@
 chacha20-poly1305@openssh.com
 .Ed
 .Pp
 -The default is:
 -.Bd -literal -offset indent
 -chacha20-poly1305@openssh.com,
-aes128-gcm@openssh.com,aes256-gcm@openssh.com,
-aes128-ctr,aes192-ctr,aes256-ctr
+-aes128-ctr,aes192-ctr,aes256-ctr,
+-aes128-gcm@openssh.com,aes256-gcm@openssh.com
 -.Ed
 -.Pp
 The list of available ciphers may also be obtained using
 .Qq ssh -Q cipher .
 .It Cm ClearAllForwardings
-@@ -1022,6 +1016,11 @@ command line will be passed untouched to the GSSAPI library.
+@@ -885,6 +879,11 @@
 The default is
 .Dq no .
 .It Cm GSSAPIKexAlgorithms
@ -91,7 +80,7 @@ index 8d5d0722..a43b2a27 100644
 The list of key exchange algorithms that are offered for GSSAPI
 key exchange. Possible values are
 .Bd -literal -offset 3n
-@@ -1034,10 +1033,8 @@ gss-nistp256-sha256-,
+@@ -897,10 +896,8 @@
 gss-curve25519-sha256-
 .Ed
 .Pp
@ -103,7 +92,7 @@ index 8d5d0722..a43b2a27 100644
 .It Cm HashKnownHosts
 Indicates that
 .Xr ssh 1
-@@ -1056,36 +1053,25 @@ will not be converted automatically,
+@@ -919,36 +916,25 @@
 but may be manually hashed using
 .Xr ssh-keygen 1 .
 .It Cm HostbasedAcceptedAlgorithms
@ -148,7 +137,7 @@ index 8d5d0722..a43b2a27 100644
 .Pp
 The
 .Fl Q
-@@ -1138,6 +1124,17 @@ to prefer their algorithms.
+@@ -1001,6 +987,17 @@
 .Pp
 The list of available signature algorithms may also be obtained using
 .Qq ssh -Q HostKeyAlgorithms .
@ -166,7 +155,7 @@ index 8d5d0722..a43b2a27 100644
 .It Cm HostKeyAlias
 Specifies an alias that should be used instead of the
 real host name when looking up or saving the host key
-@@ -1376,6 +1373,11 @@ it may be zero or more of:
+@@ -1330,6 +1330,11 @@ it may be zero or more of:
 and
 .Cm pam .
 .It Cm KexAlgorithms
@ -178,7 +167,7 @@ index 8d5d0722..a43b2a27 100644
 Specifies the permitted KEX (Key Exchange) algorithms that will be used and
 their preference order.
 The selected algorithm will be the first algorithm in this list that
-@@ -1384,29 +1386,17 @@ Multiple algorithms must be comma-separated.
+@@ -1338,29 +1343,17 @@ Multiple algorithms must be comma-separa
 .Pp
 If the specified list begins with a
 .Sq +
@ -198,8 +187,8 @@ index 8d5d0722..a43b2a27 100644
 -.Pp
 -The default is:
 -.Bd -literal -offset indent
-mlkem768x25519-sha256,
 -sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,
+-mlkem768x25519-sha256,
 -curve25519-sha256,curve25519-sha256@libssh.org,
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
@ -212,7 +201,7 @@ index 8d5d0722..a43b2a27 100644
 The list of supported key exchange algorithms may also be obtained using
 .Qq ssh -Q kex .
 .It Cm KnownHostsCommand
-@@ -1522,37 +1512,33 @@ function, and all code in the
+@@ -1365,37 +1357,33 @@
 file.
 This option is intended for debugging and no overrides are enabled by default.
 .It Cm MACs
@ -259,7 +248,7 @@ index 8d5d0722..a43b2a27 100644
 The list of available MAC algorithms may also be obtained using
 .Qq ssh -Q mac .
 .It Cm NoHostAuthenticationForLocalhost
-@@ -1741,39 +1727,31 @@ instead of continuing to execute and pass data.
+@@ -1567,39 +1555,31 @@
 The default is
 .Cm no .
 .It Cm PubkeyAcceptedAlgorithms
@ -311,7 +300,7 @@ index 8d5d0722..a43b2a27 100644
 .It Cm PubkeyAuthentication
 Specifies whether to try public key authentication.
 The argument to this keyword must be
-@@ -2497,7 +2475,9 @@ for those users who do not have a configuration file.
+@@ -2265,7 +2245,9 @@
 This file must be world-readable.
 .El
 .Sh SEE ALSO
@ -322,11 +311,10 @@ index 8d5d0722..a43b2a27 100644
 .Sh AUTHORS
 .An -nosplit
 OpenSSH is a derivative of the original and free
-diff --git a/sshd_config.5 b/sshd_config.5
-index 26fcdc84..583a01cd 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -379,17 +379,13 @@ If the argument is
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/sshd_config.5 openssh-9.3p1-patched/sshd_config.5
+--- openssh-9.3p1/sshd_config.5	2023-06-07 10:26:48.277590077 +0200
+++ openssh-9.3p1-patched/sshd_config.5	2023-06-07 10:26:00.592051845 +0200
+@@ -379,17 +379,13 @@
 then no banner is displayed.
 By default, no banner is displayed.
 .It Cm CASignatureAlgorithms
@ -349,7 +337,7 @@ index 26fcdc84..583a01cd 100644
 If the specified list begins with a
 .Sq +
 character, then the specified algorithms will be appended to the default set
-@@ -533,20 +529,25 @@ The default is
+@@ -525,20 +521,25 @@
 indicating not to
 .Xr chroot 2 .
 .It Cm Ciphers
@ -379,21 +367,21 @@ index 26fcdc84..583a01cd 100644
 .Pp
 The supported ciphers are:
 .Pp
-@@ -573,13 +574,6 @@ aes256-gcm@openssh.com
+@@ -565,13 +566,6 @@
 chacha20-poly1305@openssh.com
 .El
 .Pp
 -The default is:
 -.Bd -literal -offset indent
 -chacha20-poly1305@openssh.com,
-aes128-gcm@openssh.com,aes256-gcm@openssh.com,
-aes128-ctr,aes192-ctr,aes256-ctr
+-aes128-ctr,aes192-ctr,aes256-ctr,
+-aes128-gcm@openssh.com,aes256-gcm@openssh.com
 -.Ed
 -.Pp
 The list of available ciphers may also be obtained using
 .Qq ssh -Q cipher .
 .It Cm ClientAliveCountMax
-@@ -774,53 +768,43 @@ For this to work
+@@ -766,53 +760,43 @@
 .Cm GSSAPIKeyExchange
 needs to be enabled in the server and also used by the client.
 .It Cm GSSAPIKexAlgorithms
@ -466,7 +454,7 @@ index 26fcdc84..583a01cd 100644
 .Pp
 The list of available signature algorithms may also be obtained using
 .Qq ssh -Q HostbasedAcceptedAlgorithms .
-@@ -887,25 +871,14 @@ is specified, the location of the socket will be read from the
+@@ -879,25 +863,14 @@
 .Ev SSH_AUTH_SOCK
 environment variable.
 .It Cm HostKeyAlgorithms
@ -497,7 +485,7 @@ index 26fcdc84..583a01cd 100644
 The list of available signature algorithms may also be obtained using
 .Qq ssh -Q HostKeyAlgorithms .
 .It Cm IgnoreRhosts
-@@ -1052,6 +1025,11 @@ Specifies whether to look at .k5login file for user's aliases.
+@@ -1025,6 +1025,11 @@ Specifies whether to look at .k5login fi
 The default is
 .Cm yes .
 .It Cm KexAlgorithms
@ -509,7 +497,7 @@ index 26fcdc84..583a01cd 100644
 Specifies the permitted KEX (Key Exchange) algorithms that the server will
 offer to clients.
 The ordering of this list is not important, as the client specifies the
-@@ -1060,16 +1038,16 @@ Multiple algorithms must be comma-separated.
+@@ -1033,16 +1038,16 @@ Multiple algorithms must be comma-separa
 .Pp
 If the specified list begins with a
 .Sq +
@ -530,22 +518,25 @@ index 26fcdc84..583a01cd 100644
 .Pp
 The supported algorithms are:
 .Pp
-@@ -1106,14 +1084,6 @@ sntrup761x25519-sha512
+@@ -1075,17 +1080,6 @@ ecdh-sha2-nistp521
 sntrup761x25519-sha512@openssh.com
 .El
 .Pp
 -The default is:
 -.Bd -literal -offset indent
-mlkem768x25519-sha256,
 -sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,
+-mlkem768x25519-sha256,
 -curve25519-sha256,curve25519-sha256@libssh.org,
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
+-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
+-diffie-hellman-group-exchange-sha256,
+-diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
+-diffie-hellman-group14-sha256
 -.Ed
 -.Pp
 The list of supported key exchange algorithms may also be obtained using
 .Qq ssh -Q KexAlgorithms .
 .It Cm ListenAddress
-@@ -1200,21 +1170,26 @@ function, and all code in the
+@@ -1184,21 +1152,26 @@
 file.
 This option is intended for debugging and no overrides are enabled by default.
 .It Cm MACs
@ -576,7 +567,7 @@ index 26fcdc84..583a01cd 100644
 .Pp
 The algorithms that contain
 .Qq -etm
-@@ -1257,15 +1232,6 @@ umac-64-etm@openssh.com
+@@ -1241,15 +1214,6 @@
 umac-128-etm@openssh.com
 .El
 .Pp
@ -592,7 +583,7 @@ index 26fcdc84..583a01cd 100644
 The list of available MAC algorithms may also be obtained using
 .Qq ssh -Q mac .
 .It Cm Match
-@@ -1753,36 +1719,25 @@ or equivalent.)
+@@ -1633,36 +1597,25 @@
 The default is
 .Cm yes .
 .It Cm PubkeyAcceptedAlgorithms
@ -638,7 +629,7 @@ index 26fcdc84..583a01cd 100644
 .Pp
 The list of available signature algorithms may also be obtained using
 .Qq ssh -Q PubkeyAcceptedAlgorithms .
-@@ -2289,7 +2244,9 @@ This file should be writable by root only, but it is recommended
+@@ -2131,7 +2084,9 @@
 .El
 .Sh SEE ALSO
 .Xr sftp-server 8 ,
@ -649,6 +640,3 @@ index 26fcdc84..583a01cd 100644
 .Sh AUTHORS
 .An -nosplit
 OpenSSH is a derivative of the original and free
-- 
-2.49.0
-
--- a/openssh-8.0p1-keygen-strip-doseol.patch
+++ b/openssh-8.0p1-keygen-strip-doseol.patch
@ -0,0 +1,12 @@
+diff -up openssh-8.0p1/ssh-keygen.c.strip-doseol openssh-8.0p1/ssh-keygen.c
+--- openssh-8.0p1/ssh-keygen.c.strip-doseol	2021-03-18 17:41:34.472404994 +0100
+++ openssh-8.0p1/ssh-keygen.c	2021-03-18 17:41:55.255538761 +0100
+@@ -901,7 +901,7 @@ do_fingerprint(struct passwd *pw)
+ 	while (getline(&line, &linesize, f) != -1) {
+ 		lnum++;
+ 		cp = line;
+-		cp[strcspn(cp, "\n")] = '\0';
+		cp[strcspn(cp, "\r\n")] = '\0';
+ 		/* Trim leading space and comments */
+ 		cp = line + strspn(line, " \t");
+ 		if (*cp == '#' || *cp == '\0')
--- a/0031-openssh-8.0p1-openssl-kdf.patch
+++ b/0031-openssh-8.0p1-openssl-kdf.patch
@ -1,18 +1,14 @@
-From 430bd33963725beb8ec01a1e581529ae6bf6bec0 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 31/50] openssh-8.0p1-openssl-kdf
+commit 2c3ef499bfffce3cfd315edeebf202850ba4e00a
+Author: Jakub Jelen <jjelen@redhat.com>
+Date:   Tue Apr 16 15:35:18 2019 +0200

---
- configure.ac |   1 +
- kex.c        | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 108 insertions(+)
+    Use the new OpenSSL KDF

 diff --git a/configure.ac b/configure.ac
-index d9bd2f51..d92a8580 100644
+index 2a455e4e..e01c3d43 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3137,6 +3137,7 @@ if test "x$openssl" = "xyes" ; then
+@@ -2712,6 +2712,7 @@ if test "x$openssl" = "xyes" ; then
 		HMAC_CTX_init \
 		RSA_generate_key_ex \
 		RSA_get_default_method \
@ -21,10 +17,10 @@ index d9bd2f51..d92a8580 100644
 
 	# OpenSSL_add_all_algorithms may be a macro.
 diff --git a/kex.c b/kex.c
-index 19a56e8e..8b200ff4 100644
+index b6f041f4..1fbce2bb 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -40,6 +40,11 @@
+@@ -38,6 +38,11 @@
 #ifdef WITH_OPENSSL
 #include <openssl/crypto.h>
 #include <openssl/dh.h>
@ -36,7 +32,7 @@ index 19a56e8e..8b200ff4 100644
 #endif
 
 #include "ssh.h"
-@@ -1078,6 +1083,107 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq)
+@@ -942,6 +945,107 @@ kex_choose_conf(struct ssh *ssh)
 	return r;
 }
 
@ -144,7 +140,7 @@ index 19a56e8e..8b200ff4 100644
 static int
 derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
     const struct sshbuf *shared_secret, u_char **keyp)
-@@ -1141,6 +1247,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
+@@ -1004,6 +1096,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
 	ssh_digest_free(hashctx);
 	return r;
 }
@ -152,6 +148,4 @@ index 19a56e8e..8b200ff4 100644
 
 #define NKEYS	6
 int
-- 
-2.49.0

--- a/0028-openssh-8.0p1-pkcs11-uri.patch
+++ b/0028-openssh-8.0p1-pkcs11-uri.patch
--- a/0034-openssh-8.0p1-preserve-pam-errors.patch
+++ b/0034-openssh-8.0p1-preserve-pam-errors.patch
@ -1,17 +1,7 @@
-From 8de0391e3b3eb75e23ee9f173f04a9c78f2b96c9 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 34/50] openssh-8.0p1-preserve-pam-errors
-
---
- auth-pam.c | 18 +++++++++++++-----
- 1 file changed, 13 insertions(+), 5 deletions(-)
-
-diff --git a/auth-pam.c b/auth-pam.c
-index b4100ea1..a042c3c8 100644
--- a/auth-pam.c
-+++ b/auth-pam.c
-@@ -523,7 +523,11 @@ sshpam_thread(void *ctxtp)
+diff -up openssh-8.0p1/auth-pam.c.preserve-pam-errors openssh-8.0p1/auth-pam.c
+--- openssh-8.0p1/auth-pam.c.preserve-pam-errors	2021-03-31 17:03:15.618592347 +0200
+++ openssh-8.0p1/auth-pam.c	2021-03-31 17:06:58.115220014 +0200
+@@ -511,7 +511,11 @@ sshpam_thread(void *ctxtp)
 		goto auth_fail;
 
 	if (!do_pam_account()) {
@ -24,7 +14,7 @@ index b4100ea1..a042c3c8 100644
 		goto auth_fail;
 	}
 	if (sshpam_authctxt->force_pwchange) {
-@@ -580,8 +584,10 @@ sshpam_thread(void *ctxtp)
+@@ -568,8 +572,10 @@ sshpam_thread(void *ctxtp)
 	    pam_strerror(sshpam_handle, sshpam_err))) != 0)
 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 	/* XXX - can't do much about an error here */
@ -37,20 +27,17 @@ index b4100ea1..a042c3c8 100644
 	else if (sshpam_maxtries_reached)
 		ssh_msg_send(ctxt->pam_csock, PAM_MAXTRIES, buffer);
 	else
-@@ -890,9 +896,11 @@ sshpam_query(void *ctx, char **name, char **info,
+@@ -856,9 +862,11 @@ sshpam_query(void *ctx, char **name, cha
 			free(msg);
 			break;
 		case PAM_ACCT_EXPIRED:
 +			sshpam_account_status = 0;
 +			/* FALLTHROUGH */
 		case PAM_MAXTRIES:
-			if (type == PAM_ACCT_EXPIRED)
-				sshpam_account_status = 0;
 +		case PAM_USER_UNKNOWN:
 +		case PAM_PERM_DENIED:
+-			if (type == PAM_ACCT_EXPIRED)
+-				sshpam_account_status = 0;
 			if (type == PAM_MAXTRIES)
 				sshpam_set_maxtries_reached(1);
 			/* FALLTHROUGH */
-- 
-2.49.0
-
--- a/0032-openssh-8.2p1-visibility.patch
+++ b/0032-openssh-8.2p1-visibility.patch
@ -1,17 +1,8 @@
-From 6aa231d9acfeca870ee87e3bf9c4a1239518706d Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 32/50] openssh-8.2p1-visibility
-
---
- regress/misc/sk-dummy/sk-dummy.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
 diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c
-index 347b2122..344f8a8a 100644
+index dca158de..afdcb1d2 100644
 --- a/regress/misc/sk-dummy/sk-dummy.c
 +++ b/regress/misc/sk-dummy/sk-dummy.c
-@@ -81,7 +81,7 @@ skdebug(const char *func, const char *fmt, ...)
+@@ -71,7 +71,7 @@ skdebug(const char *func, const char *fmt, ...)
 #endif
 }
 
@ -20,7 +11,7 @@ index 347b2122..344f8a8a 100644
 sk_api_version(void)
 {
 	return SSH_SK_VERSION_MAJOR;
-@@ -230,7 +230,7 @@ check_options(struct sk_option **options)
+@@ -220,7 +220,7 @@ check_options(struct sk_option **options)
 	return 0;
 }
 
@ -29,7 +20,7 @@ index 347b2122..344f8a8a 100644
 sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
     const char *application, uint8_t flags, const char *pin,
     struct sk_option **options, struct sk_enroll_response **enroll_response)
-@@ -478,7 +478,7 @@ sig_ed25519(const uint8_t *message, size_t message_len,
+@@ -467,7 +467,7 @@ sig_ed25519(const uint8_t *message, size_t message_len,
 	return ret;
 }
 
@ -38,7 +29,7 @@ index 347b2122..344f8a8a 100644
 sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
     const char *application, const uint8_t *key_handle, size_t key_handle_len,
     uint8_t flags, const char *pin, struct sk_option **options,
-@@ -535,7 +535,7 @@ sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
+@@ -518,7 +518,7 @@ sk_sign(uint32_t alg, const uint8_t *message, size_t message_len,
 	return ret;
 }
 
@ -47,6 +38,3 @@ index 347b2122..344f8a8a 100644
 sk_load_resident_keys(const char *pin, struct sk_option **options,
     struct sk_resident_key ***rks, size_t *nrks)
 {
-- 
-2.49.0
-
--- a/0033-openssh-8.2p1-x11-without-ipv6.patch
+++ b/0033-openssh-8.2p1-x11-without-ipv6.patch
@ -1,17 +1,12 @@
-From cfe5a99d335eb57b8c08b4eb6b4535dd042d96e3 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:28 +0200
-Subject: [PATCH 33/50] openssh-8.2p1-x11-without-ipv6
-
---
- channels.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
 diff --git a/channels.c b/channels.c
-index 7438c1a5..95836d50 100644
 --- a/channels.c
 +++ b/channels.c
-@@ -5055,6 +5055,16 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+@@ -3933,16 +3933,26 @@ x11_create_display_inet(int x11_display_
+ 			if (ai->ai_family == AF_INET6)
+ 				sock_set_v6only(sock);
+ 			if (x11_use_localhost)
+ 				set_reuseaddr(sock);
+ 			if (bind(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
 				debug2_f("bind port %d: %.100s", port,
 				    strerror(errno));
 				close(sock);
@ -28,6 +23,8 @@ index 7438c1a5..95836d50 100644
 				for (n = 0; n < num_socks; n++)
 					close(socks[n]);
 				num_socks = 0;
-- 
-2.49.0
-
+ 				break;
+ 			}
+ 			socks[num_socks++] = sock;
+ 			if (num_socks == NUM_SOCKS)
+ 				break;
--- a/openssh-8.7p1-ibmca.patch
+++ b/openssh-8.7p1-ibmca.patch
@ -0,0 +1,11 @@
+--- openssh-8.7p1/openbsd-compat/bsd-closefrom.c.orig	2022-04-12 15:47:03.815044607 +0200
+++ openssh-8.7p1/openbsd-compat/bsd-closefrom.c	2022-04-12 15:48:12.464963511 +0200
+@@ -16,7 +16,7 @@
+ 
+ #include "includes.h"
+ 
+-#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM)
+#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM) || (defined __s390__)
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
--- a/0037-openssh-8.7p1-minrsabits.patch
+++ b/0037-openssh-8.7p1-minrsabits.patch
@ -1,18 +1,7 @@
-From 286bc4a302b5130f732c857095ae665f7bea01dd Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 37/50] openssh-8.7p1-minrsabits
-
---
- readconf.c | 1 +
- servconf.c | 1 +
- 2 files changed, 2 insertions(+)
-
 diff --git a/readconf.c b/readconf.c
-index 6c04ed43..f340bf50 100644
--- a/readconf.c
-+++ b/readconf.c
-@@ -343,6 +343,7 @@ static struct {
+--- a/readconf.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/readconf.c	(date 1703169891147)
+@@ -326,6 +326,7 @@
 	{ "securitykeyprovider", oSecurityKeyProvider },
 	{ "knownhostscommand", oKnownHostsCommand },
 	{ "requiredrsasize", oRequiredRSASize },
@ -21,10 +10,9 @@ index 6c04ed43..f340bf50 100644
 	{ "obscurekeystroketiming", oObscureKeystrokeTiming },
 	{ "channeltimeout", oChannelTimeout },
 diff --git a/servconf.c b/servconf.c
-index 15c99b30..84891544 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -788,6 +788,7 @@ static struct {
+--- a/servconf.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/servconf.c	(date 1703169891148)
+@@ -691,6 +691,7 @@
 	{ "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
 	{ "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
 	{ "requiredrsasize", sRequiredRSASize, SSHCFG_ALL },
@ -32,6 +20,3 @@ index 15c99b30..84891544 100644
 	{ "channeltimeout", sChannelTimeout, SSHCFG_ALL },
 	{ "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL },
 	{ "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL },
-- 
-2.49.0
-
--- a/0044-openssh-8.7p1-negotiate-supported-algs.patch
+++ b/0044-openssh-8.7p1-negotiate-supported-algs.patch
@ -1,17 +1,6 @@
-From 5c92430c08ac392b5b2ace899cc043247c923734 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 44/50] openssh-8.7p1-negotiate-supported-algs
-
---
- regress/hostkey-agent.sh | 32 +++++++++++++++++++++++++-------
- sshconnect2.c            | 17 +++++++++++++++--
- 2 files changed, 40 insertions(+), 9 deletions(-)
-
-diff --git a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
-index 28dcfe17..b9e716dc 100644
--- a/regress/hostkey-agent.sh
-+++ b/regress/hostkey-agent.sh
+diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostkey-agent.sh
+--- openssh-9.3p1/regress/hostkey-agent.sh.xxx	2023-05-29 18:15:56.311236887 +0200
+++ openssh-9.3p1/regress/hostkey-agent.sh	2023-05-29 18:16:07.598503551 +0200
@@ -17,8 +17,21 @@ trace "make CA key"
 
 ${SSHKEYGEN} -qt ed25519 -f $OBJ/agent-ca -N '' || fatal "ssh-keygen CA"
@ -35,7 +24,7 @@ index 28dcfe17..b9e716dc 100644
 	${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
 	${SSHKEYGEN} -s $OBJ/agent-ca -qh -n localhost-with-alias \
 		-I localhost-with-alias $OBJ/agent-key.$k.pub || \
-@@ -32,12 +45,16 @@ rm $OBJ/agent-ca # Don't need CA private any more either
+@@ -32,12 +48,16 @@ rm $OBJ/agent-ca # Don't need CA private
 
 unset SSH_AUTH_SOCK
 
@ -55,10 +44,10 @@ index 28dcfe17..b9e716dc 100644
 	( printf 'localhost-with-alias,127.0.0.1,::1 ' ;
 	  cat $OBJ/agent-key.$k.pub) > $OBJ/known_hosts
 	SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
-@@ -50,15 +67,16 @@ for k in $SSH_KEYTYPES ; do
+@@ -50,15 +70,16 @@ for k in $SSH_KEYTYPES ; do
 done
 
- SSH_CERTTYPES=`ssh -Q key-sig | grep 'cert-v01@openssh.com' | maybe_filter_sk`
+ SSH_CERTTYPES=`ssh -Q key-sig | grep 'cert-v01@openssh.com'`
 +SSH_ACCEPTED_CERTTYPES=`echo "$SSH_CERTTYPES" | egrep "$PUBKEY_ACCEPTED_ALGOS"`
 
 # Prepare sshd_proxy for certificates.
@ -74,7 +63,7 @@ index 28dcfe17..b9e716dc 100644
 	echo "Hostkey $OBJ/agent-key.${k}.pub" >> $OBJ/sshd_proxy
 	echo "HostCertificate $OBJ/agent-key.${k}-cert.pub" >> $OBJ/sshd_proxy
 	test -f $OBJ/agent-key.${k}.pub || fatal "no $k key"
-@@ -70,7 +88,7 @@ echo "HostKeyAlgorithms $HOSTKEYALGS" >> $OBJ/sshd_proxy
+@@ -70,7 +93,7 @@ echo "HostKeyAlgorithms $HOSTKEYALGS" >>
 ( printf '@cert-authority localhost-with-alias ' ;
   cat $OBJ/agent-ca.pub) > $OBJ/known_hosts
 
@ -83,11 +72,10 @@ index 28dcfe17..b9e716dc 100644
 	verbose "cert type $k"
 	opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
 	SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
-diff --git a/sshconnect2.c b/sshconnect2.c
-index 14f7671a..ad3f560f 100644
--- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -221,7 +221,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
+--- openssh-9.3p1/sshconnect2.c.xxx	2023-04-26 17:37:35.100827792 +0200
+++ openssh-9.3p1/sshconnect2.c	2023-04-26 17:50:31.860748877 +0200
+@@ -221,7 +221,7 @@ ssh_kex2(struct ssh *ssh, char *host, st
     const struct ssh_conn_info *cinfo)
 {
 	char *myproposal[PROPOSAL_MAX];
@ -96,7 +84,7 @@ index 14f7671a..ad3f560f 100644
 	int r, use_known_hosts_order = 0;
 
 #if defined(GSSAPI) && defined(WITH_OPENSSL)
-@@ -257,10 +257,22 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+@@ -260,10 +260,22 @@ ssh_kex2(struct ssh *ssh, char *host, st
 	if (use_known_hosts_order)
 		hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
 
@ -120,7 +108,7 @@ index 14f7671a..ad3f560f 100644
 
 #if defined(GSSAPI) && defined(WITH_OPENSSL)
 	if (options.gss_keyex) {
-@@ -304,6 +316,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+@@ -303,6 +315,7 @@ ssh_kex2(struct ssh *ssh, char *host, st
 #endif
 
 	free(hkalgs);
@ -128,6 +116,3 @@ index 14f7671a..ad3f560f 100644
 
 	/* start key exchange */
 	if ((r = kex_setup(ssh, myproposal)) != 0)
-- 
-2.49.0
-
--- a/0046-openssh-8.7p1-nohostsha1proof.patch
+++ b/0046-openssh-8.7p1-nohostsha1proof.patch
@ -1,27 +1,7 @@
-From e4ca3b9dba1cc832a9974493c91207d42e218a68 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 46/50] openssh-8.7p1-nohostsha1proof
-
---
- compat.c                               |  6 +++++
- compat.h                               |  2 +-
- monitor.c                              | 27 ++++++++++++++++------
- regress/unittests/kex/test_kex.c       |  3 ++-
- regress/unittests/sshkey/test_file.c   |  3 ++-
- regress/unittests/sshkey/test_fuzz.c   |  3 ++-
- regress/unittests/sshkey/test_sshkey.c | 32 +++++++++++++++++---------
- serverloop.c                           |  6 ++++-
- ssh-rsa.c                              |  3 ++-
- sshconnect2.c                          |  8 +++++++
- sshd-session.c                         | 21 +++++++++++++++++
- 11 files changed, 90 insertions(+), 24 deletions(-)
-
-diff --git a/compat.c b/compat.c
-index b59f0bfc..4e611dc3 100644
--- a/compat.c
-+++ b/compat.c
-@@ -42,6 +42,7 @@ void
+diff -up openssh-8.7p1/compat.c.sshrsacheck openssh-8.7p1/compat.c
+--- openssh-8.7p1/compat.c.sshrsacheck	2023-01-12 13:29:06.338710923 +0100
+++ openssh-8.7p1/compat.c	2023-01-12 13:29:06.357711165 +0100
+@@ -43,6 +43,7 @@ void
 compat_banner(struct ssh *ssh, const char *version)
 {
 	int i;
@ -29,7 +9,7 @@ index b59f0bfc..4e611dc3 100644
 	static struct {
 		char	*pat;
 		int	bugs;
-@@ -125,16 +126,21 @@ compat_banner(struct ssh *ssh, const char *version)
+@@ -145,16 +146,21 @@ compat_banner(struct ssh *ssh, const cha
 	};
 
 	/* process table, return first match */
@ -51,10 +31,9 @@ index b59f0bfc..4e611dc3 100644
 }
 
 /* Always returns pointer to allocated memory, caller must free. */
-diff --git a/compat.h b/compat.h
-index 1a19060f..2e6db5bf 100644
--- a/compat.h
-+++ b/compat.h
+diff -up openssh-8.7p1/compat.h.sshrsacheck openssh-8.7p1/compat.h
+--- openssh-8.7p1/compat.h.sshrsacheck	2021-08-20 06:03:49.000000000 +0200
+++ openssh-8.7p1/compat.h	2023-01-12 13:29:06.358711178 +0100
@@ -30,7 +30,7 @@
 #define SSH_BUG_UTF8TTYMODE	0x00000001
 #define SSH_BUG_SIGTYPE		0x00000002
@ -64,28 +43,24 @@ index 1a19060f..2e6db5bf 100644
 #define SSH_OLD_SESSIONID	0x00000010
 /* #define unused		0x00000020 */
 #define SSH_BUG_DEBUG		0x00000040
-diff --git a/monitor.c b/monitor.c
-index fbc35782..19cb058e 100644
--- a/monitor.c
-+++ b/monitor.c
-@@ -747,11 +747,12 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
- 	struct sshkey *pubkey, *key;
+diff -up openssh-8.7p1/monitor.c.sshrsacheck openssh-8.7p1/monitor.c
+--- openssh-8.7p1/monitor.c.sshrsacheck	2023-01-20 13:07:54.279676981 +0100
+++ openssh-8.7p1/monitor.c	2023-01-20 15:01:07.007821379 +0100
+@@ -660,11 +660,12 @@ mm_answer_sign(struct ssh *ssh, int sock
+ 	struct sshkey *key;
 	struct sshbuf *sigbuf = NULL;
 	u_char *p = NULL, *signature = NULL;
 -	char *alg = NULL;
-	size_t datlen, siglen;
-	int r, is_proof = 0, keyid;
-	u_int compat;
 +	char *alg = NULL, *effective_alg;
-+	size_t datlen, siglen, alglen;
-+	int r, is_proof = 0;
-+	u_int keyid, compat;
+ 	size_t datlen, siglen, alglen;
+ 	int r, is_proof = 0;
+ 	u_int keyid, compat;
 	const char proof_req[] = "hostkeys-prove-00@openssh.com";
 +	const char safe_rsa[]  = "rsa-sha2-256";
 
 	debug3_f("entering");
 
-@@ -809,18 +810,30 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -719,18 +720,30 @@ mm_answer_sign(struct ssh *ssh, int sock
 	}
 
 	if ((key = get_hostkey_by_index(keyid)) != NULL) {
@ -119,11 +94,10 @@ index fbc35782..19cb058e 100644
 	    is_proof ? "hostkey proof" : "KEX", siglen);
 
 	sshbuf_reset(m);
-diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
-index caf8f57f..09016aea 100644
--- a/regress/unittests/kex/test_kex.c
-+++ b/regress/unittests/kex/test_kex.c
-@@ -97,7 +97,8 @@ do_kex_with_key(char *kex, int keytype, int bits)
+diff -up openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-8.7p1/regress/unittests/kex/test_kex.c
+--- openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck	2023-01-26 13:34:52.645743677 +0100
+++ openssh-8.7p1/regress/unittests/kex/test_kex.c	2023-01-26 13:36:56.220745823 +0100
+@@ -97,7 +97,8 @@ do_kex_with_key(char *kex, int keytype,
 	memcpy(kex_params.proposal, myproposal, sizeof(myproposal));
 	if (kex != NULL)
 		kex_params.proposal[PROPOSAL_KEX_ALGS] = kex;
@ -133,11 +107,10 @@ index caf8f57f..09016aea 100644
 	ASSERT_PTR_NE(keyname, NULL);
 	kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname;
 	ASSERT_INT_EQ(ssh_init(&client, 0, &kex_params), 0);
-diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
-index 3babe604..cc80fe97 100644
--- a/regress/unittests/sshkey/test_file.c
-+++ b/regress/unittests/sshkey/test_file.c
-@@ -109,6 +109,7 @@ sshkey_file_tests(void)
+diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_file.c
+--- openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck	2023-01-26 12:04:55.946343408 +0100
+++ openssh-8.7p1/regress/unittests/sshkey/test_file.c	2023-01-26 12:06:35.235164432 +0100
+@@ -110,6 +110,7 @@ sshkey_file_tests(void)
 	sshkey_free(k2);
 	TEST_DONE();
 
@ -145,7 +118,7 @@ index 3babe604..cc80fe97 100644
 	TEST_START("load RSA cert with SHA1 signature");
 	ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha1"), &k2), 0);
 	ASSERT_PTR_NE(k2, NULL);
-@@ -116,7 +117,7 @@ sshkey_file_tests(void)
+@@ -117,7 +118,7 @@ sshkey_file_tests(void)
 	ASSERT_INT_EQ(sshkey_equal_public(k1, k2), 1);
 	ASSERT_STRING_EQ(k2->cert->signature_type, "ssh-rsa");
 	sshkey_free(k2);
@ -154,11 +127,10 @@ index 3babe604..cc80fe97 100644
 
 	TEST_START("load RSA cert with SHA512 signature");
 	ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha512"), &k2), 0);
-diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
-index 0aff7c9b..951122e1 100644
--- a/regress/unittests/sshkey/test_fuzz.c
-+++ b/regress/unittests/sshkey/test_fuzz.c
-@@ -338,13 +338,14 @@ sshkey_fuzz_tests(void)
+diff -up openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c
+--- openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck	2023-01-26 12:10:37.533168013 +0100
+++ openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c	2023-01-26 12:15:35.637631860 +0100
+@@ -333,13 +333,14 @@ sshkey_fuzz_tests(void)
 	TEST_DONE();
 
 #ifdef WITH_OPENSSL
@ -174,11 +146,10 @@ index 0aff7c9b..951122e1 100644
 
 	TEST_START("fuzz RSA SHA256 sig");
 	buf = load_file("rsa_1");
-diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
-index 5bf4b65c..6d0a35bb 100644
--- a/regress/unittests/sshkey/test_sshkey.c
-+++ b/regress/unittests/sshkey/test_sshkey.c
-@@ -61,6 +61,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
+diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c
+--- openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck	2023-01-26 11:02:52.339413463 +0100
+++ openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c	2023-01-26 11:58:42.324253896 +0100
+@@ -60,6 +60,9 @@ build_cert(struct sshbuf *b, struct sshk
 	u_char *sigblob;
 	size_t siglen;
 
@ -188,7 +159,7 @@ index 5bf4b65c..6d0a35bb 100644
 	ca_buf = sshbuf_new();
 	ASSERT_PTR_NE(ca_buf, NULL);
 	ASSERT_INT_EQ(sshkey_putb(ca_key, ca_buf), 0);
-@@ -102,8 +105,9 @@ build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
+@@ -101,8 +104,9 @@ build_cert(struct sshbuf *b, struct sshk
 	ASSERT_INT_EQ(sshbuf_put_string(b, NULL, 0), 0); /* reserved */
 	ASSERT_INT_EQ(sshbuf_put_stringb(b, ca_buf), 0); /* signature key */
 	ASSERT_INT_EQ(sshkey_sign(sign_key, &sigblob, &siglen,
@ -200,7 +171,7 @@ index 5bf4b65c..6d0a35bb 100644
 
 	free(sigblob);
 	sshbuf_free(ca_buf);
-@@ -120,16 +124,22 @@ signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg,
+@@ -119,16 +123,22 @@ signature_test(struct sshkey *k, struct
 {
 	size_t len;
 	u_char *sig;
@ -231,7 +202,7 @@ index 5bf4b65c..6d0a35bb 100644
 	free(sig);
 }
 
-@@ -526,7 +536,7 @@ sshkey_tests(void)
+@@ -514,7 +524,7 @@ sshkey_tests(void)
 	ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
 	    NULL), 0);
 	k3 = get_private("rsa_1");
@ -240,10 +211,9 @@ index 5bf4b65c..6d0a35bb 100644
 	ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
 	    SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
 	ASSERT_PTR_EQ(k4, NULL);
-diff --git a/serverloop.c b/serverloop.c
-index 40ddfb04..9c5b1567 100644
--- a/serverloop.c
-+++ b/serverloop.c
+diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
+--- openssh-8.7p1/serverloop.c.sshrsacheck	2023-01-12 14:57:08.118400073 +0100
+++ openssh-8.7p1/serverloop.c	2023-01-12 14:59:17.330470518 +0100
@@ -80,6 +80,7 @@
 #include "auth-options.h"
 #include "serverloop.h"
@ -252,11 +222,10 @@ index 40ddfb04..9c5b1567 100644
 
 extern ServerOptions options;
 
-@@ -699,7 +700,10 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
+@@ -737,6 +737,10 @@ server_input_hostkeys_prove(struct ssh *
 			else if (ssh->kex->flags & KEX_RSA_SHA2_256_SUPPORTED)
 				sigalg = "rsa-sha2-256";
 		}
-
 +		if (ssh->compat & SSH_RH_RSASIGSHA && sigalg == NULL) {
 +			sigalg = "rsa-sha2-512";
 +			debug3_f("SHA1 signature is not supported, falling back to %s", sigalg);
@ -264,25 +233,10 @@ index 40ddfb04..9c5b1567 100644
 		debug3_f("sign %s key (index %d) using sigalg %s",
 		    sshkey_type(key), ndx, sigalg == NULL ? "default" : sigalg);
 		if ((r = sshbuf_put_cstring(sigbuf,
-diff --git a/ssh-rsa.c b/ssh-rsa.c
-index 6c2f771a..8dd4ab01 100644
--- a/ssh-rsa.c
-+++ b/ssh-rsa.c
-@@ -509,7 +509,8 @@ ssh_rsa_verify(const struct sshkey *key,
- 			ret = SSH_ERR_INVALID_ARGUMENT;
- 			goto out;
- 		}
-		if (hash_alg != want_alg) {
-+		if (hash_alg != want_alg && want_alg != SSH_DIGEST_SHA1) {
-+			debug_f("Unexpected digest algorithm: got %d, wanted %d", hash_alg, want_alg);
- 			ret = SSH_ERR_SIGNATURE_INVALID;
- 			goto out;
- 		}
-diff --git a/sshconnect2.c b/sshconnect2.c
-index ad3f560f..3941e089 100644
--- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -1434,6 +1434,14 @@ identity_sign(struct identity *id, u_char **sigp, size_t *lenp,
+diff -up openssh-8.7p1/sshconnect2.c.sshrsacheck openssh-8.7p1/sshconnect2.c
+--- openssh-8.7p1/sshconnect2.c.sshrsacheck	2023-01-25 15:33:29.140353651 +0100
+++ openssh-8.7p1/sshconnect2.c	2023-01-25 15:59:34.225364883 +0100
+@@ -1461,6 +1464,14 @@ identity_sign(struct identity *id, u_cha
 			retried = 1;
 			goto retry_pin;
 		}
@ -297,11 +251,23 @@ index ad3f560f..3941e089 100644
 		goto out;
 	}
 
-diff --git a/sshd-session.c b/sshd-session.c
-index a808ac9a..c3349a8a 100644
--- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -1316,6 +1316,27 @@ main(int ac, char **av)
+diff -up openssh-8.7p1/ssh-rsa.c.sshrsacheck openssh-8.7p1/ssh-rsa.c
+--- openssh-8.7p1/ssh-rsa.c.sshrsacheck	2023-01-20 13:07:54.180676144 +0100
+++ openssh-8.7p1/ssh-rsa.c	2023-01-20 13:07:54.290677074 +0100
+@@ -254,7 +254,8 @@ ssh_rsa_verify(const struct sshkey *key,
+ 			ret = SSH_ERR_INVALID_ARGUMENT;
+ 			goto out;
+ 		}
+-		if (hash_alg != want_alg) {
+		if (hash_alg != want_alg && want_alg != SSH_DIGEST_SHA1) {
+			debug_f("Unexpected digest algorithm: got %d, wanted %d", hash_alg, want_alg);
+ 			ret = SSH_ERR_SIGNATURE_INVALID;
+ 			goto out;
+ 		}
+diff -up openssh-9.8p1/sshd-session.c.xxx openssh-9.8p1/sshd-session.c
+--- openssh-9.8p1/sshd-session.c.xxx	2024-07-23 15:08:14.794350818 +0200
+++ openssh-9.8p1/sshd-session.c	2024-07-23 15:40:21.658456636 +0200
+@@ -1305,6 +1305,27 @@ main(int ac, char **av)
 
 	check_ip_options(ssh);
 
@ -329,6 +295,3 @@ index a808ac9a..c3349a8a 100644
 	/* Prepare the channels layer */
 	channel_init_channels(ssh);
 	channel_set_af(ssh, options.address_family);
-- 
-2.49.0
-
--- a/openssh-8.7p1-openssl-log.patch
+++ b/openssh-8.7p1-openssl-log.patch
@ -0,0 +1,112 @@
+diff -up openssh-9.9p1/log.c.xxx openssh-9.9p1/log.c
+--- openssh-9.9p1/log.c.xxx	2024-10-22 11:55:44.281939275 +0200
+++ openssh-9.9p1/log.c	2024-10-22 11:56:16.709676267 +0200
+@@ -52,6 +52,9 @@
+ 
+ #include "log.h"
+ #include "match.h"
+#ifdef WITH_OPENSSL
+#include <openssl/err.h>
+#endif
+ 
+ static LogLevel log_level = SYSLOG_LEVEL_INFO;
+ static int log_on_stderr = 1;
+@@ -438,6 +438,26 @@ sshlog(const char *file, const char *fun
+ 	va_end(args);
+ }
+ 
+#ifdef WITH_OPENSSL
+static int
+openssl_error_print_cb(const char *str, size_t len, void *u)
+{
+	sshlogdirect(SYSLOG_LEVEL_DEBUG1, 0, "openssl error %s", str);
+	return 0;
+}
+#endif
+
+void
+sshlog_openssl(int r)
+{
+#ifdef WITH_OPENSSL
+	if (r != SSH_ERR_LIBCRYPTO_ERROR) return;
+
+	ERR_print_errors_cb(openssl_error_print_cb, NULL);
+#endif
+	return;
+}
+
+ void
+ sshlogdie(const char *file, const char *func, int line, int showfunc,
+     LogLevel level, const char *suffix, const char *fmt, ...)
+diff -up openssh-8.7p1/log.h.xxx openssh-8.7p1/log.h
+--- openssh-8.7p1/log.h.xxx	2024-10-18 12:56:18.944971946 +0200
+++ openssh-8.7p1/log.h	2024-10-18 13:03:38.324351416 +0200
+@@ -71,6 +71,7 @@ void	 cleanup_exit(int) __attribute__((n
+ void	 sshlog(const char *, const char *, int, int,
+     LogLevel, const char *, const char *, ...)
+     __attribute__((format(printf, 7, 8)));
+void	 sshlog_openssl(int);
+ void	 sshlogv(const char *, const char *, int, int,
+     LogLevel, const char *, const char *, va_list);
+ void	 sshlogdie(const char *, const char *, int, int,
+diff -up openssh-8.7p1/auth2-pubkey.c.yyy openssh-8.7p1/auth2-pubkey.c
+--- openssh-8.7p1/auth2-pubkey.c.yyy	2024-10-18 13:27:00.709055845 +0200
+++ openssh-8.7p1/auth2-pubkey.c	2024-10-18 13:27:31.638784460 +0200
+@@ -131,6 +131,7 @@ userauth_pubkey(struct ssh *ssh)
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+		sshlog_openssl(r);
+ 		error_fr(r, "parse key");
+ 		goto done;
+ 	}
+diff -up openssh-8.7p1/dispatch.c.yyy openssh-8.7p1/dispatch.c
+--- openssh-8.7p1/dispatch.c.yyy	2024-10-18 13:27:56.349366570 +0200
+++ openssh-8.7p1/dispatch.c	2024-10-18 13:28:17.921874757 +0200
+@@ -130,6 +130,8 @@ ssh_dispatch_run_fatal(struct ssh *ssh,
+ {
+ 	int r;
+ 
+-	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0)
+	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0) {
+		sshlog_openssl(r);
+ 		sshpkt_fatal(ssh, r, "%s", __func__);
+	}
+ }
+diff -up openssh-9.9p1/Makefile.in.xxx openssh-9.9p1/Makefile.in
+--- openssh-9.9p1/Makefile.in.xxx	2025-01-27 12:56:58.533623367 +0100
+++ openssh-9.9p1/Makefile.in	2025-01-27 12:57:41.635638843 +0100
+@@ -224,7 +224,7 @@ sshd-session$(EXEEXT): libssh.a	$(LIBCOM
+ 	$(LD) -o $@ $(SSHD_SESSION_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS)
+ 
+ scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS)
+-	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(LIBS)
+ 
+ ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHADD_OBJS)
+ 	$(LD) -o $@ $(SSHADD_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(CHANNELLIBS)
+@@ -245,20 +245,20 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
+ 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
+ 
+ ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
+-	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(KEYCATLIBS) $(LIBS)
+ 
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
+ 
+ sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
+-	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lcrypto $(LIBS)
+ 
+ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
+-	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
+	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lcrypto $(LIBS) $(LIBEDIT)
+ 
+ # test driver for the loginrec code - not built by default
+ logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
+-	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
+	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh -lcrypto $(LIBS)
+ 
+ $(MANPAGES): $(MANPAGES_IN)
+ 	if test "$(MANTYPE)" = "cat"; then \
--- a/0036-openssh-8.7p1-recursive-scp.patch
+++ b/0036-openssh-8.7p1-recursive-scp.patch
@ -1,21 +1,8 @@
-From 99e1e3af524376788e591ca73387f1ca37e6f5ef Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 36/50] openssh-8.7p1-recursive-scp
-
---
- scp.c         |  2 +-
- sftp-client.c | 60 +++++++++++++++++++++++++++++++++++++++------------
- sftp-client.h |  4 ++--
- sftp.c        |  6 +++---
- 4 files changed, 52 insertions(+), 20 deletions(-)
-
 diff --git a/scp.c b/scp.c
-index 7ed1a54c..0c87dd0e 100644
--- a/scp.c
-+++ b/scp.c
-@@ -1388,7 +1388,7 @@ source_sftp(int argc, char *src, char *targ, struct sftp_conn *conn)
- 
+--- a/scp.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/scp.c	(date 1703111453316)
+@@ -1372,7 +1372,7 @@
+
 	if (src_is_dir && iamrecursive) {
 		if (sftp_upload_dir(conn, src, abs_dst, pflag,
 -		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1) != 0) {
@ -24,11 +11,10 @@ index 7ed1a54c..0c87dd0e 100644
 			errs = 1;
 		}
 diff --git a/sftp-client.c b/sftp-client.c
-index 9f8ab4af..873dec04 100644
--- a/sftp-client.c
-+++ b/sftp-client.c
-@@ -1003,7 +1003,7 @@ sftp_fsetstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
- 
+--- a/sftp-client.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/sftp-client.c	(date 1703169614263)
+@@ -1003,7 +1003,7 @@
+
 /* Implements both the realpath and expand-path operations */
 static char *
 -sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
@ -36,7 +22,7 @@ index 9f8ab4af..873dec04 100644
 {
 	struct sshbuf *msg;
 	u_int expected_id, count, id;
-@@ -1049,11 +1049,43 @@ sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
+@@ -1049,11 +1049,43 @@
 		if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
 		    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
 			fatal_fr(r, "parse status");
@ -85,9 +71,9 @@ index 9f8ab4af..873dec04 100644
 	} else if (type != SSH2_FXP_NAME)
 		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
 		    SSH2_FXP_NAME, type);
-@@ -1078,9 +1110,9 @@ sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
+@@ -1078,9 +1110,9 @@
 }
- 
+
 char *
 -sftp_realpath(struct sftp_conn *conn, const char *path)
 +sftp_realpath(struct sftp_conn *conn, const char *path, int create_dir)
@ -95,9 +81,9 @@ index 9f8ab4af..873dec04 100644
 -	return sftp_realpath_expand(conn, path, 0);
 +	return sftp_realpath_expand(conn, path, 0, create_dir);
 }
- 
+
 int
-@@ -1094,9 +1126,9 @@ sftp_expand_path(struct sftp_conn *conn, const char *path)
+@@ -1094,9 +1126,9 @@
 {
 	if (!sftp_can_expand_path(conn)) {
 		debug3_f("no server support, fallback to realpath");
@ -107,18 +93,18 @@ index 9f8ab4af..873dec04 100644
 -	return sftp_realpath_expand(conn, path, 1);
 +	return sftp_realpath_expand(conn, path, 1, 0);
 }
- 
+
 int
-@@ -2016,7 +2048,7 @@ sftp_download_dir(struct sftp_conn *conn, const char *src, const char *dst,
+@@ -2016,7 +2048,7 @@
 	char *src_canon;
 	int ret;
- 
+
 -	if ((src_canon = sftp_realpath(conn, src)) == NULL) {
 +	if ((src_canon = sftp_realpath(conn, src, 0)) == NULL) {
 		error("download \"%s\": path canonicalization failed", src);
 		return -1;
 	}
-@@ -2366,12 +2398,12 @@ upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+@@ -2365,12 +2397,12 @@
 int
 sftp_upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
     int preserve_flag, int print_flag, int resume, int fsync_flag,
@ -127,48 +113,47 @@ index 9f8ab4af..873dec04 100644
 {
 	char *dst_canon;
 	int ret;
- 
+
 -	if ((dst_canon = sftp_realpath(conn, dst)) == NULL) {
 +	if ((dst_canon = sftp_realpath(conn, dst, create_dir)) == NULL) {
 		error("upload \"%s\": path canonicalization failed", dst);
 		return -1;
 	}
-@@ -2826,7 +2858,7 @@ sftp_crossload_dir(struct sftp_conn *from, struct sftp_conn *to,
+@@ -2825,7 +2857,7 @@
 	char *from_path_canon;
 	int ret;
- 
+
 -	if ((from_path_canon = sftp_realpath(from, from_path)) == NULL) {
 +	if ((from_path_canon = sftp_realpath(from, from_path, 0)) == NULL) {
 		error("crossload \"%s\": path canonicalization failed",
 		    from_path);
 		return -1;
 diff --git a/sftp-client.h b/sftp-client.h
-index 74cdae7d..00ed6630 100644
--- a/sftp-client.h
-+++ b/sftp-client.h
-@@ -111,7 +111,7 @@ int sftp_fsetstat(struct sftp_conn *, const u_char *, u_int, Attrib *);
+--- a/sftp-client.h	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/sftp-client.h	(date 1703111691284)
+@@ -111,7 +111,7 @@
 int sftp_lsetstat(struct sftp_conn *conn, const char *path, Attrib *a);
- 
+
 /* Canonicalise 'path' - caller must free result */
 -char *sftp_realpath(struct sftp_conn *, const char *);
 +char *sftp_realpath(struct sftp_conn *, const char *, int);
- 
+
 /* Canonicalisation with tilde expansion (requires server extension) */
 char *sftp_expand_path(struct sftp_conn *, const char *);
-@@ -163,7 +163,7 @@ int sftp_upload(struct sftp_conn *, const char *, const char *,
+@@ -163,7 +163,7 @@
  * times if 'pflag' is set
  */
 int sftp_upload_dir(struct sftp_conn *, const char *, const char *,
 -    int, int, int, int, int, int);
 +    int, int, int, int, int, int, int);
- 
+
 /*
  * Download a 'from_path' from the 'from' connection and upload it to
+
 diff --git a/sftp.c b/sftp.c
-index bdedd141..322e6d1f 100644
--- a/sftp.c
-+++ b/sftp.c
-@@ -809,7 +809,7 @@ process_put(struct sftp_conn *conn, const char *src, const char *dst,
+--- a/sftp.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
+++ b/sftp.c	(date 1703168795365)
+@@ -807,7 +807,7 @@
 		    (rflag || global_rflag)) {
 			if (sftp_upload_dir(conn, g.gl_pathv[i], abs_dst,
 			    pflag || global_pflag, 1, resume,
@ -177,7 +162,7 @@ index bdedd141..322e6d1f 100644
 				err = -1;
 		} else {
 			if (sftp_upload(conn, g.gl_pathv[i], abs_dst,
-@@ -1644,7 +1644,7 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
+@@ -1642,7 +1642,7 @@
 		if (path1 == NULL || *path1 == '\0')
 			path1 = xstrdup(startdir);
 		path1 = sftp_make_absolute(path1, *pwd);
@ -186,15 +171,12 @@ index bdedd141..322e6d1f 100644
 			err = 1;
 			break;
 		}
-@@ -2249,7 +2249,7 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+@@ -2247,7 +2247,7 @@
 	}
 #endif /* USE_LIBEDIT */
- 
+
 -	if ((remote_path = sftp_realpath(conn, ".")) == NULL)
 +	if ((remote_path = sftp_realpath(conn, ".", 0)) == NULL)
 		fatal("Need cwd");
 	startdir = xstrdup(remote_path);
- 
-- 
-2.49.0

--- a/openssh-8.7p1-redhat-help.patch
+++ b/openssh-8.7p1-redhat-help.patch
@ -0,0 +1,40 @@
+diff -up openssh-8.7p1/ssh.c.xxx openssh-8.7p1/ssh.c
+--- openssh-8.7p1/ssh.c.xxx	2024-09-11 14:24:06.711088878 +0200
+++ openssh-8.7p1/ssh.c	2024-09-11 14:35:12.883765718 +0200
+@@ -175,6 +175,16 @@ extern int muxserver_sock;
+ extern u_int muxclient_command;
+ 
+ /* Prints a help message to the user.  This function never returns. */
+static void
+redhat_usage(void)
+{
+    if(isatty(fileno(stderr))) {
+	fprintf(stderr,
+"\nYou can find some explanations for typical errors at this link:\n"
+"	    https://red.ht/support_rhel_ssh\n"
+	);
+    }
+}
+ 
+ static void
+ usage(void)
+@@ -188,6 +196,7 @@ usage(void)
+ "           destination [command [argument ...]]\n"
+ "       ssh [-Q query_option]\n"
+ 	);
+	redhat_usage();
+ 	exit(255);
+ }
+ 
+@@ -1609,8 +1618,10 @@ main(int ac, char **av)
+ 	/* Open a connection to the remote host. */
+ 	if (ssh_connect(ssh, host, options.host_arg, addrs, &hostaddr,
+ 	    options.port, options.connection_attempts,
+-	    &timeout_ms, options.tcp_keep_alive) != 0)
+	    &timeout_ms, options.tcp_keep_alive) != 0) {
+		redhat_usage();
+ 		exit(255);
+	}
+ 
+ 	if (addrs != NULL)
+ 		freeaddrinfo(addrs);
--- a/0035-openssh-8.7p1-scp-kill-switch.patch
+++ b/0035-openssh-8.7p1-scp-kill-switch.patch
@ -1,18 +1,6 @@
-From a68f3741fdc01bf6823a69d2442caba7de9835f9 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 35/50] openssh-8.7p1-scp-kill-switch
-
---
- pathnames.h | 1 +
- scp.1       | 7 +++++++
- scp.c       | 8 ++++++++
- 3 files changed, 16 insertions(+)
-
-diff --git a/pathnames.h b/pathnames.h
-index 1158bec9..43f0c570 100644
--- a/pathnames.h
-+++ b/pathnames.h
+diff -up openssh-8.7p1/pathnames.h.kill-scp openssh-8.7p1/pathnames.h
+--- openssh-8.7p1/pathnames.h.kill-scp	2021-09-16 11:37:57.240171687 +0200
+++ openssh-8.7p1/pathnames.h	2021-09-16 11:42:29.183427917 +0200
@@ -42,6 +42,7 @@
 #define _PATH_HOST_XMSS_KEY_FILE	SSHDIR "/ssh_host_xmss_key"
 #define _PATH_HOST_RSA_KEY_FILE		SSHDIR "/ssh_host_rsa_key"
@ -21,11 +9,10 @@ index 1158bec9..43f0c570 100644
 
 #ifndef _PATH_SSH_PROGRAM
 #define _PATH_SSH_PROGRAM		"/usr/bin/ssh"
-diff --git a/scp.1 b/scp.1
-index aa2e2d8b..373d7237 100644
--- a/scp.1
-+++ b/scp.1
-@@ -331,6 +331,13 @@ during download or upload.
+diff -up openssh-8.7p1/scp.1.kill-scp openssh-8.7p1/scp.1
+--- openssh-8.7p1/scp.1.kill-scp	2021-09-16 12:09:02.646714578 +0200
+++ openssh-8.7p1/scp.1	2021-09-16 12:26:49.978628226 +0200
+@@ -278,6 +278,13 @@ to print debugging messages about their
 By default a 32KB buffer is used.
 .El
 .El
@ -39,11 +26,10 @@ index aa2e2d8b..373d7237 100644
 .Sh EXIT STATUS
 .Ex -std scp
 .Sh SEE ALSO
-diff --git a/scp.c b/scp.c
-index 7f9795a5..7ed1a54c 100644
--- a/scp.c
-+++ b/scp.c
-@@ -649,6 +649,14 @@ main(int argc, char **argv)
+diff -up openssh-8.7p1/scp.c.kill-scp openssh-8.7p1/scp.c
+--- openssh-8.7p1/scp.c.kill-scp	2021-09-16 11:42:56.013650519 +0200
+++ openssh-8.7p1/scp.c	2021-09-16 11:53:03.249713836 +0200
+@@ -596,6 +596,14 @@ main(int argc, char **argv)
 	if (iamremote)
 		mode = MODE_SCP;
 
@ -58,6 +44,3 @@ index 7f9795a5..7ed1a54c 100644
 	if ((pwd = getpwuid(userid = getuid())) == NULL)
 		fatal("unknown user %u", (u_int) userid);
 
-- 
-2.49.0
-
--- a/openssh-8.7p1-ssh-manpage.patch
+++ b/openssh-8.7p1-ssh-manpage.patch
@ -0,0 +1,53 @@
+diff --color -ru a/ssh.1 b/ssh.1
+--- a/ssh.1	2022-07-12 11:47:51.307295880 +0200
+++ b/ssh.1	2022-07-12 11:50:28.793363263 +0200
+@@ -493,6 +493,7 @@
+ .It AddressFamily
+ .It BatchMode
+ .It BindAddress
+.It BindInterface
+ .It CanonicalDomains
+ .It CanonicalizeFallbackLocal
+ .It CanonicalizeHostname
+@@ -510,6 +511,7 @@
+ .It ControlPath
+ .It ControlPersist
+ .It DynamicForward
+.It EnableSSHKeysign
+ .It EnableEscapeCommandline
+ .It EscapeChar
+ .It ExitOnForwardFailure
+@@ -538,6 +540,8 @@
+ .It IdentitiesOnly
+ .It IdentityAgent
+ .It IdentityFile
+.It IgnoreUnknown
+.It Include
+ .It IPQoS
+ .It KbdInteractiveAuthentication
+ .It KbdInteractiveDevices
+@@ -546,6 +550,7 @@
+ .It LocalCommand
+ .It LocalForward
+ .It LogLevel
+.It LogVerbose
+ .It MACs
+ .It Match
+ .It NoHostAuthenticationForLocalhost
+@@ -566,6 +571,8 @@
+ .It RemoteCommand
+ .It RemoteForward
+ .It RequestTTY
+.It RevokedHostKeys
+.It SecurityKeyProvider
+ .It RequiredRSASize
+ .It SendEnv
+ .It ServerAliveInterval
+@@ -575,6 +582,7 @@
+ .It StreamLocalBindMask
+ .It StreamLocalBindUnlink
+ .It StrictHostKeyChecking
+.It SyslogFacility
+ .It TCPKeepAlive
+ .It Tunnel
+ .It TunnelDevice
--- a/0041-openssh-9.0p1-audit-log.patch
+++ b/0041-openssh-9.0p1-audit-log.patch
@ -1,20 +1,7 @@
-From 80d967a18261156573e7385f8e534a89d2767d67 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 41/50] openssh-9.0p1-audit-log
-
---
- audit-bsm.c   |  2 +-
- audit-linux.c | 76 +++++++++++++++++++++++++++++++++++++++++++--------
- audit.c       | 18 +++++++++---
- audit.h       |  2 +-
- 4 files changed, 81 insertions(+), 17 deletions(-)
-
-diff --git a/audit-bsm.c b/audit-bsm.c
-index a49abb92..c6f56553 100644
--- a/audit-bsm.c
-+++ b/audit-bsm.c
-@@ -405,7 +405,7 @@ audit_session_close(struct logininfo *li)
+diff -up openssh-9.0p1/audit-bsm.c.patch openssh-9.0p1/audit-bsm.c
+--- openssh-9.0p1/audit-bsm.c.patch	2022-10-24 15:02:16.544858331 +0200
+++ openssh-9.0p1/audit-bsm.c	2022-10-24 14:51:43.685766639 +0200
+@@ -405,7 +405,7 @@ audit_session_close(struct logininfo *li
 }
 
 int
@ -23,10 +10,51 @@ index a49abb92..c6f56553 100644
 {
 	/* not implemented */
 }
-diff --git a/audit-linux.c b/audit-linux.c
-index d484b82b..dcfde3a9 100644
--- a/audit-linux.c
-+++ b/audit-linux.c
+diff -up openssh-9.0p1/audit.c.patch openssh-9.0p1/audit.c
+--- openssh-9.0p1/audit.c.patch	2022-10-24 15:02:16.544858331 +0200
+++ openssh-9.0p1/audit.c	2022-10-24 15:20:38.854548226 +0200
+@@ -116,12 +116,22 @@ audit_event_lookup(ssh_audit_event_t ev)
+ void
+ audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
+ {
+-	char *fp;
+	char *key_fp = NULL;
+	char *issuer_fp = NULL;
+	struct sshkey_cert *cert = NULL;
+ 
+-	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
+-	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
+	key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
+	if (sshkey_is_cert(key) && key->cert != NULL && key->cert->signature_key != NULL) {
+		cert = key->cert;
+		issuer_fp = sshkey_fingerprint(cert->signature_key,
+										options.fingerprint_hash, SSH_FP_DEFAULT);
+	}
+	if (audit_keyusage(ssh, host_user, key_fp, cert, issuer_fp, (*rv == 0)) == 0)
+ 		*rv = -SSH_ERR_INTERNAL_ERROR;
+-	free(fp);
+	if (key_fp)
+		free(key_fp);
+	if (issuer_fp)
+		free(issuer_fp);
+ }
+ 
+ void
+diff -up openssh-9.0p1/audit.h.patch openssh-9.0p1/audit.h
+--- openssh-9.0p1/audit.h.patch	2022-10-24 15:02:16.544858331 +0200
+++ openssh-9.0p1/audit.h	2022-10-24 14:58:20.887565518 +0200
+@@ -64,7 +64,7 @@ void	audit_session_close(struct logininf
+ int	audit_run_command(struct ssh *, const char *);
+ void 	audit_end_command(struct ssh *, int, const char *);
+ ssh_audit_event_t audit_classify_auth(const char *);
+-int	audit_keyusage(struct ssh *, int, char *, int);
+int	audit_keyusage(struct ssh *, int, const char *, const struct sshkey_cert *, const char *, int);
+ void	audit_key(struct ssh *, int, int *, const struct sshkey *);
+ void	audit_unsupported(struct ssh *, int);
+ void	audit_kex(struct ssh *, int, char *, char *, char *, char *);
+diff -up openssh-9.9p1/audit-linux.c.xxx openssh-9.9p1/audit-linux.c
+--- openssh-9.9p1/audit-linux.c.xxx	2024-10-15 11:49:48.092151974 +0200
+++ openssh-9.9p1/audit-linux.c	2024-10-15 12:08:17.179158343 +0200
@@ -52,7 +52,7 @@ extern u_int utmp_len;
 const char *audit_username(void);
 
@ -36,7 +64,7 @@ index d484b82b..dcfde3a9 100644
     const char *ip, const char *ttyn, int success, int event)
 {
 	int audit_fd, rc, saved_errno;
-@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const char *username,
+@@ -66,7 +66,7 @@ linux_audit_user_logxxx(int uid, const c
 	}
 	rc = audit_log_acct_message(audit_fd, event,
 	    NULL, "login", username ? username : "(unknown)",
@ -59,7 +87,7 @@ index d484b82b..dcfde3a9 100644
 
 	audit_fd = audit_open();
 	if (audit_fd < 0) {
-@@ -150,14 +152,44 @@ audit_keyusage(struct ssh *ssh, int host_user, char *fp, int rv)
+@@ -150,14 +152,44 @@ audit_keyusage(struct ssh *ssh, int host
 		else
 			return 0; /* Must prevent login */
 	}
@ -107,7 +135,7 @@ index d484b82b..dcfde3a9 100644
 out:
 	saved_errno = errno;
 	audit_close(audit_fd);
-@@ -179,26 +211,34 @@ audit_connection_from(const char *host, int port)
+@@ -179,26 +211,34 @@ audit_connection_from(const char *host,
 int
 audit_run_command(struct ssh *ssh, const char *command)
 {
@ -189,7 +217,7 @@ index d484b82b..dcfde3a9 100644
 			ssh_remote_ipaddr(ssh), "ssh", 0, AUDIT_USER_LOGIN);
 		break;
 	case SSH_AUTH_FAIL_PASSWD:
-@@ -255,9 +305,11 @@ audit_event(struct ssh *ssh, ssh_audit_event_t event)
+@@ -255,9 +305,11 @@ audit_event(struct ssh *ssh, ssh_audit_e
 		if (user_login_count) {
 			while (user_login_count--)
 				linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL,
@ -201,7 +229,7 @@ index d484b82b..dcfde3a9 100644
 			    ssh_remote_ipaddr(ssh),
 			    "ssh", 1, AUDIT_USER_LOGOUT);
 		}
-@@ -266,12 +318,14 @@ audit_event(struct ssh *ssh, ssh_audit_event_t event)
+@@ -266,12 +318,14 @@ audit_event(struct ssh *ssh, ssh_audit_e
 	case SSH_CONNECTION_ABANDON:
 	case SSH_INVALID_USER:
 		linux_audit_user_logxxx(-1, audit_username(),
@ -216,50 +244,3 @@ index d484b82b..dcfde3a9 100644
 }
 
 void
-diff --git a/audit.c b/audit.c
-index d0433c3a..28d51a14 100644
--- a/audit.c
-+++ b/audit.c
-@@ -116,12 +116,22 @@ audit_event_lookup(ssh_audit_event_t ev)
- void
- audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
- {
-	char *fp;
-+	char *key_fp = NULL;
-+	char *issuer_fp = NULL;
-+	struct sshkey_cert *cert = NULL;
- 
-	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
-	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
-+	key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
-+	if (sshkey_is_cert(key) && key->cert != NULL && key->cert->signature_key != NULL) {
-+		cert = key->cert;
-+		issuer_fp = sshkey_fingerprint(cert->signature_key,
-+										options.fingerprint_hash, SSH_FP_DEFAULT);
-+	}
-+	if (audit_keyusage(ssh, host_user, key_fp, cert, issuer_fp, (*rv == 0)) == 0)
- 		*rv = -SSH_ERR_INTERNAL_ERROR;
-	free(fp);
-+	if (key_fp)
-+		free(key_fp);
-+	if (issuer_fp)
-+		free(issuer_fp);
- }
- 
- void
-diff --git a/audit.h b/audit.h
-index 45d66ccf..05ac132c 100644
--- a/audit.h
-+++ b/audit.h
-@@ -64,7 +64,7 @@ void	audit_session_close(struct logininfo *);
- int	audit_run_command(struct ssh *, const char *);
- void 	audit_end_command(struct ssh *, int, const char *);
- ssh_audit_event_t audit_classify_auth(const char *);
-int	audit_keyusage(struct ssh *, int, char *, int);
-+int	audit_keyusage(struct ssh *, int, const char *, const struct sshkey_cert *, const char *, int);
- void	audit_key(struct ssh *, int, int *, const struct sshkey *);
- void	audit_unsupported(struct ssh *, int);
- void	audit_kex(struct ssh *, int, char *, char *, char *, char *);
-- 
-2.49.0
-
--- a/0045-openssh-9.0p1-evp-fips-kex.patch
+++ b/0045-openssh-9.0p1-evp-fips-kex.patch
@ -1,20 +1,6 @@
-From be23afbab800c9b5ffea56b3f410a04156c08df2 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Thu, 15 May 2025 13:43:29 +0200
-Subject: [PATCH 45/50] openssh-9.0p1-evp-fips-kex
-
---
- dh.c      |  98 +++++++++++++++++++++++++++++++++-----
- kex.c     | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
- kex.h     |   6 +++
- kexdh.c   |  52 ++++++++++++++++++--
- kexecdh.c | 129 ++++++++++++++++++++++++++++++++++++++++----------
- 5 files changed, 382 insertions(+), 42 deletions(-)
-
-diff --git a/dh.c b/dh.c
-index 8c9a29fa..ea0a0b09 100644
--- a/dh.c
-+++ b/dh.c
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/dh.c openssh-9.0p1-patched/dh.c
+--- openssh-9.0p1/dh.c	2023-05-25 09:24:28.730868316 +0200
+++ openssh-9.0p1-patched/dh.c	2023-05-25 09:23:44.841379532 +0200
@@ -37,6 +37,9 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
@ -25,7 +11,7 @@ index 8c9a29fa..ea0a0b09 100644
 
 #include "dh.h"
 #include "pathnames.h"
-@@ -290,10 +293,15 @@ dh_pub_is_valid(const DH *dh, const BIGNUM *dh_pub)
+@@ -290,10 +293,15 @@
 int
 dh_gen_key(DH *dh, int need)
 {
@ -44,7 +30,7 @@ index 8c9a29fa..ea0a0b09 100644
 
 	if (need < 0 || dh_p == NULL ||
 	    (pbits = BN_num_bits(dh_p)) <= 0 ||
-@@ -301,19 +309,85 @@ dh_gen_key(DH *dh, int need)
+@@ -301,19 +309,85 @@
 		return SSH_ERR_INVALID_ARGUMENT;
 	if (need < 256)
 		need = 256;
@ -139,11 +125,10 @@ index 8c9a29fa..ea0a0b09 100644
 }
 
 DH *
-diff --git a/kex.c b/kex.c
-index 71fbe5cb..ce6a7b81 100644
--- a/kex.c
-+++ b/kex.c
-@@ -1614,3 +1614,142 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/kex.c openssh-9.0p1-patched/kex.c
+--- openssh-9.0p1/kex.c	2023-05-25 09:24:28.731868327 +0200
+++ openssh-9.0p1-patched/kex.c	2023-05-25 09:23:44.841379532 +0200
+@@ -1623,3 +1623,142 @@
 	return r;
 }
 
@ -286,34 +271,9 @@ index 71fbe5cb..ce6a7b81 100644
 +	return r;
 +}
 +#endif /* WITH_OPENSSL */
-diff --git a/kex.h b/kex.h
-index 6a55aadf..48f3bb87 100644
--- a/kex.h
-+++ b/kex.h
-@@ -37,6 +37,9 @@
- # include <openssl/bn.h>
- # include <openssl/dh.h>
- # include <openssl/ecdsa.h>
-+# include <openssl/evp.h>
-+# include <openssl/core_names.h>
-+# include <openssl/param_build.h>
- # ifdef OPENSSL_HAS_ECC
- #  include <openssl/ec.h>
- # else /* OPENSSL_HAS_ECC */
-@@ -311,6 +314,9 @@ int	kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
-     const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
- 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
- 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
-+int	kex_create_evp_dh(EVP_PKEY **, const BIGNUM *, const BIGNUM *,
-+    const BIGNUM *, const BIGNUM *, const BIGNUM *);
-+int    kex_create_evp_ec(EC_KEY *k, int ecdsa_nid, EVP_PKEY **pkey);
- 
- #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
- void	dump_digest(const char *, const u_char *, int);
-diff --git a/kexdh.c b/kexdh.c
-index 0faab21b..32e1de51 100644
--- a/kexdh.c
-+++ b/kexdh.c
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/kexdh.c openssh-9.0p1-patched/kexdh.c
+--- openssh-9.0p1/kexdh.c	2023-05-25 09:24:28.674867692 +0200
+++ openssh-9.0p1-patched/kexdh.c	2023-05-25 09:25:28.494533889 +0200
@@ -35,6 +35,10 @@
 
 #include "openbsd-compat/openssl-compat.h"
@ -325,7 +285,7 @@ index 0faab21b..32e1de51 100644
 
 #include "sshkey.h"
 #include "kex.h"
-@@ -83,9 +87,12 @@ int
+@@ -83,9 +87,12 @@
 kex_dh_compute_key(struct kex *kex, BIGNUM *dh_pub, struct sshbuf *out)
 {
 	BIGNUM *shared_secret = NULL;
@ -339,7 +299,7 @@ index 0faab21b..32e1de51 100644
 
 #ifdef DEBUG_KEXDH
 	fprintf(stderr, "dh_pub= ");
-@@ -100,24 +107,59 @@ kex_dh_compute_key(struct kex *kex, BIGNUM *dh_pub, struct sshbuf *out)
+@@ -100,24 +107,59 @@
 		r = SSH_ERR_MESSAGE_INCOMPLETE;
 		goto out;
 	}
@ -403,10 +363,32 @@ index 0faab21b..32e1de51 100644
 	return r;
 }
 
-diff --git a/kexecdh.c b/kexecdh.c
-index efb2e55a..d92ba54f 100644
--- a/kexecdh.c
-+++ b/kexecdh.c
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.0p1/kex.h openssh-9.0p1-patched/kex.h
+--- openssh-9.0p1/kex.h	2023-05-25 09:24:28.725868260 +0200
+++ openssh-9.0p1-patched/kex.h	2023-05-25 09:23:44.841379532 +0200
+@@ -33,6 +33,9 @@
+ # include <openssl/bn.h>
+ # include <openssl/dh.h>
+ # include <openssl/ecdsa.h>
+# include <openssl/evp.h>
+# include <openssl/core_names.h>
+# include <openssl/param_build.h>
+ # ifdef OPENSSL_HAS_ECC
+ #  include <openssl/ec.h>
+ # else /* OPENSSL_HAS_ECC */
+@@ -283,6 +286,9@@
+     const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
+ 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+ 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+int	kex_create_evp_dh(EVP_PKEY **, const BIGNUM *, const BIGNUM *,
+    const BIGNUM *, const BIGNUM *, const BIGNUM *);
+int    kex_create_evp_ec(EC_KEY *k, int ecdsa_nid, EVP_PKEY **pkey);
+ 
+ #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
+ void	dump_digest(const char *, const u_char *, int);
+diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac ../openssh-8.7p1/kexecdh.c ./kexecdh.c
+--- ../openssh-8.7p1/kexecdh.c	2021-08-20 06:03:49.000000000 +0200
+++ ./kexecdh.c	2023-04-13 14:30:14.882449593 +0200
@@ -35,17 +35,57 @@
 #include <signal.h>
 
@ -465,7 +447,7 @@ index efb2e55a..d92ba54f 100644
 int
 kex_ecdh_keypair(struct kex *kex)
 {
-@@ -55,11 +95,7 @@ kex_ecdh_keypair(struct kex *kex)
+@@ -55,11 +95,7 @@
 	struct sshbuf *buf = NULL;
 	int r;
 
@ -478,7 +460,7 @@ index efb2e55a..d92ba54f 100644
 		r = SSH_ERR_LIBCRYPTO_ERROR;
 		goto out;
 	}
-@@ -101,11 +137,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob,
+@@ -101,11 +137,7 @@
 	*server_blobp = NULL;
 	*shared_secretp = NULL;
 
@ -491,7 +473,7 @@ index efb2e55a..d92ba54f 100644
 		r = SSH_ERR_LIBCRYPTO_ERROR;
 		goto out;
 	}
-@@ -140,11 +172,21 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+@@ -140,11 +172,21 @@
 {
 	struct sshbuf *buf = NULL;
 	BIGNUM *shared_secret = NULL;
@ -516,7 +498,7 @@ index efb2e55a..d92ba54f 100644
 	*shared_secretp = NULL;
 
 	if ((buf = sshbuf_new()) == NULL) {
-@@ -153,45 +195,82 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+@@ -153,45 +195,82 @@
 	}
 	if ((r = sshbuf_put_stringb(buf, ec_blob)) != 0)
 		goto out;
@ -611,6 +593,3 @@ index efb2e55a..d92ba54f 100644
 	sshbuf_free(buf);
 	return r;
 }
-- 
-2.49.0
-
--- a/0012-openssh-9.6p1-gssapi-keyex.patch
+++ b/0012-openssh-9.6p1-gssapi-keyex.patch
--- a/openssh-9.6p1-pam-rhost.patch
+++ b/openssh-9.6p1-pam-rhost.patch
@ -0,0 +1,32 @@
+From 26f366e263e575c4e1a18e2e64ba418f58878b37 Mon Sep 17 00:00:00 2001
+From: Daan De Meyer <daan.j.demeyer@gmail.com>
+Date: Mon, 20 Mar 2023 20:22:14 +0100
+Subject: [PATCH] Only set PAM_RHOST if the remote host is not "UNKNOWN"
+
+When using sshd's -i option with stdio that is not a AF_INET/AF_INET6
+socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then
+set as the value of PAM_RHOST, causing pam to try to do a reverse DNS
+query of "UNKNOWN", which times out multiple times, causing a
+substantial slowdown when logging in.
+
+To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".
+---
+ auth-pam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/auth-pam.c b/auth-pam.c
+index e143304e3..39b4e4563 100644
+--- a/auth-pam.c
+++ b/auth-pam.c
+@@ -735,7 +735,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
+ 		sshpam_laddr = get_local_ipaddr(
+ 		    ssh_packet_get_connection_in(ssh));
+ 	}
+-	if (sshpam_rhost != NULL) {
+	if (sshpam_rhost != NULL && strcmp(sshpam_rhost, "UNKNOWN") != 0) {
+ 		debug("PAM: setting PAM_RHOST to \"%s\"", sshpam_rhost);
+ 		sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST,
+ 		    sshpam_rhost);
+-- 
+2.44.0
+
--- a/2000-openssh-10.0p1-gsissh.patch
+++ b/2000-openssh-10.0p1-gsissh.patch
--- a/2001-openssh-10.0p1-hpn-18.7.0.patch
+++ b/2001-openssh-10.0p1-hpn-18.7.0.patch
--- a/openssh-9.9p1-match-regression.patch
+++ b/openssh-9.9p1-match-regression.patch
@ -0,0 +1,471 @@
+diff --git a/misc.c b/misc.c
+index afdf5142..1b4b55c5 100644
+--- a/misc.c
+++ b/misc.c
+@@ -107,6 +107,27 @@ rtrim(char *s)
+ 	}
+ }
+ 
+/*
+ * returns pointer to character after 'prefix' in 's' or otherwise NULL
+ * if the prefix is not present.
+ */
+const char *
+strprefix(const char *s, const char *prefix, int ignorecase)
+{
+	size_t prefixlen;
+
+	if ((prefixlen = strlen(prefix)) == 0)
+		return s;
+	if (ignorecase) {
+		if (strncasecmp(s, prefix, prefixlen) != 0)
+			return NULL;
+	} else {
+		if (strncmp(s, prefix, prefixlen) != 0)
+			return NULL;
+	}
+	return s + prefixlen;
+}
+
+ /* set/unset filedescriptor to non-blocking */
+ int
+ set_nonblock(int fd)
+diff --git a/misc.h b/misc.h
+index 11340389..efecdf1a 100644
+--- a/misc.h
+++ b/misc.h
+@@ -56,6 +56,7 @@ struct ForwardOptions {
+ char	*chop(char *);
+ void	 rtrim(char *);
+ void	skip_space(char **);
+const char *strprefix(const char *, const char *, int);
+ char	*strdelim(char **);
+ char	*strdelimw(char **);
+ int	 set_nonblock(int);
+diff --git a/readconf.c b/readconf.c
+index 3d9cc6db..9f559269 100644
+--- a/readconf.c
+++ b/readconf.c
+@@ -710,7 +710,7 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+     struct passwd *pw, const char *host_arg, const char *original_host,
+     int final_pass, int *want_final_pass, const char *filename, int linenum)
+ {
+-	char *arg, *oattrib, *attrib, *cmd, *host, *criteria;
+	char *arg, *oattrib = NULL, *attrib = NULL, *cmd, *host, *criteria;
+ 	const char *ruser;
+ 	int r, this_result, result = 1, attributes = 0, negate;
+ 
+@@ -731,7 +731,8 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+ 
+ 	debug2("checking match for '%s' host %s originally %s",
+ 	    full_line, host, original_host);
+-	while ((oattrib = attrib = argv_next(acp, avp)) != NULL) {
+	while ((attrib = argv_next(acp, avp)) != NULL) {
+		attrib = oattrib = xstrdup(attrib);
+ 		/* Terminate on comment */
+ 		if (*attrib == '#') {
+ 			argv_consume(acp);
+@@ -777,9 +778,23 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+ 			    this_result ? "" : "not ", oattrib);
+ 			continue;
+ 		}
+
+		/* Keep this list in sync with below */
+		if (strprefix(attrib, "host=", 1)  != NULL ||
+		    strprefix(attrib, "originalhost=", 1) != NULL ||
+		    strprefix(attrib, "user=", 1) != NULL ||
+		    strprefix(attrib, "localuser=", 1) != NULL ||
+		    strprefix(attrib, "localnetwork=", 1) != NULL ||
+		    strprefix(attrib, "tagged=", 1) != NULL ||
+		    strprefix(attrib, "exec=", 1) != NULL) {
+			arg = strchr(attrib, '=');
+			*(arg++) = '\0';
+		} else {
+			arg = argv_next(acp, avp);
+		}
+
+ 		/* All other criteria require an argument */
+-		if ((arg = argv_next(acp, avp)) == NULL ||
+-		    *arg == '\0' || *arg == '#') {
+		if (arg == NULL || *arg == '\0' || *arg == '#') {
+ 			error("Missing Match criteria for %s", attrib);
+ 			result = -1;
+ 			goto out;
+@@ -856,6 +871,8 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+ 		    criteria == NULL ? "" : criteria,
+ 		    criteria == NULL ? "" : "\"");
+ 		free(criteria);
+		free(oattrib);
+		oattrib = attrib = NULL;
+ 	}
+ 	if (attributes == 0) {
+ 		error("One or more attributes required for Match");
+@@ -865,6 +882,7 @@ match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp,
+  out:
+ 	if (result != -1)
+ 		debug2("match %sfound", result ? "" : "not ");
+	free(oattrib);
+ 	free(host);
+ 	return result;
+ }
+diff --git a/servconf.c b/servconf.c
+index 89b8413e..dd774f46 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.c,v 1.418 2024/09/15 03:09:44 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.419 2024/09/25 01:24:04 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1033,7 +1033,7 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+     int line, struct connection_info *ci)
+ {
+ 	int result = 1, attributes = 0, port;
+-	char *arg, *attrib;
+	char *arg, *attrib = NULL, *oattrib;
+ 
+ 	if (ci == NULL)
+ 		debug3("checking syntax for 'Match %s'", full_line);
+@@ -1047,7 +1047,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 		    ci->laddress ? ci->laddress : "(null)", ci->lport);
+ 	}
+ 
+-	while ((attrib = argv_next(acp, avp)) != NULL) {
+	while ((oattrib = argv_next(acp, avp)) != NULL) {
+		attrib = xstrdup(oattrib);
+ 		/* Terminate on comment */
+ 		if (*attrib == '#') {
+ 			argv_consume(acp); /* mark all arguments consumed */
+@@ -1062,16 +1063,20 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 			    *arg != '\0' && *arg != '#')) {
+ 				error("'all' cannot be combined with other "
+ 				    "Match attributes");
+-				return -1;
+				result = -1;
+				goto out;
+ 			}
+ 			if (arg != NULL && *arg == '#')
+ 				argv_consume(acp); /* consume remaining args */
+-			return 1;
+			result = 1;
+			goto out;
+ 		}
+ 		/* Criterion "invalid-user" also has no argument */
+ 		if (strcasecmp(attrib, "invalid-user") == 0) {
+-			if (ci == NULL)
+			if (ci == NULL) {
+				result = 0;
+ 				continue;
+			}
+ 			if (ci->user_invalid == 0)
+ 				result = 0;
+ 			else
+@@ -1078,11 +1081,26 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				debug("matched invalid-user at line %d", line);
+ 			continue;
+ 		}
+
+		/* Keep this list in sync with below */
+		if (strprefix(attrib, "user=", 1) != NULL ||
+		    strprefix(attrib, "group=", 1) != NULL ||
+		    strprefix(attrib, "host=", 1) != NULL ||
+		    strprefix(attrib, "address=", 1) != NULL ||
+		    strprefix(attrib, "localaddress=", 1) != NULL ||
+		    strprefix(attrib, "localport=", 1) != NULL ||
+		    strprefix(attrib, "rdomain=", 1) != NULL) {
+			arg = strchr(attrib, '=');
+			*(arg++) = '\0';
+		} else {
+			arg = argv_next(acp, avp);
+		}
+
+ 		/* All other criteria require an argument */
+-		if ((arg = argv_next(acp, avp)) == NULL ||
+-		    *arg == '\0' || *arg == '#') {
+		if (arg == NULL || *arg == '\0' || *arg == '#') {
+ 			error("Missing Match criteria for %s", attrib);
+-			return -1;
+			result = -1;
+			goto out;
+ 		}
+ 		if (strcasecmp(attrib, "user") == 0) {
+ 			if (ci == NULL || (ci->test && ci->user == NULL)) {
+@@ -1105,7 +1123,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				match_test_missing_fatal("Group", "user");
+ 			switch (match_cfg_line_group(arg, line, ci->user)) {
+ 			case -1:
+-				return -1;
+				result = -1;
+				goto out;
+ 			case 0:
+ 				result = 0;
+ 			}
+@@ -1141,7 +1160,8 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				result = 0;
+ 				break;
+ 			case -2:
+-				return -1;
+				result = -1;
+				goto out;
+ 			}
+ 		} else if (strcasecmp(attrib, "localaddress") == 0){
+ 			if (ci == NULL || (ci->test && ci->laddress == NULL)) {
+@@ -1166,13 +1186,15 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				result = 0;
+ 				break;
+ 			case -2:
+-				return -1;
+				result = -1;
+				goto out;
+ 			}
+ 		} else if (strcasecmp(attrib, "localport") == 0) {
+ 			if ((port = a2port(arg)) == -1) {
+ 				error("Invalid LocalPort '%s' on Match line",
+ 				    arg);
+-				return -1;
+				result = -1;
+				goto out;
+ 			}
+ 			if (ci == NULL || (ci->test && ci->lport == -1)) {
+ 				result = 0;
+@@ -1200,16 +1222,21 @@ match_cfg_line(const char *full_line, int *acp, char ***avp,
+ 				debug("user %.100s matched 'RDomain %.100s' at "
+ 				    "line %d", ci->rdomain, arg, line);
+ 		} else {
+-			error("Unsupported Match attribute %s", attrib);
+-			return -1;
+			error("Unsupported Match attribute %s", oattrib);
+			result = -1;
+			goto out;
+ 		}
+		free(attrib);
+		attrib = NULL;
+ 	}
+ 	if (attributes == 0) {
+ 		error("One or more attributes required for Match");
+ 		return -1;
+ 	}
+-	if (ci != NULL)
+ out:
+	if (ci != NULL && result != -1)
+ 		debug3("match %sfound", result ? "" : "not ");
+	free(attrib);
+ 	return result;
+ }
+ 
+diff --git a/regress/cfginclude.sh b/regress/cfginclude.sh
+index d442cdd6..97fd816f 100644
+--- a/regress/cfginclude.sh
+++ b/regress/cfginclude.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $
+#	$OpenBSD: cfginclude.sh,v 1.5 2024/09/27 01:05:54 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="config include"
+@@ -10,7 +10,7 @@ cat > $OBJ/ssh_config.i << _EOF
+ Match host a
+ 	Hostname aa
+ 
+-Match host b # comment
+Match host=b # comment
+ 	Hostname bb
+ 	Include $OBJ/ssh_config.i.*
+ 
+@@ -18,7 +18,7 @@ Match host c
+ 	Include $OBJ/ssh_config.i.*
+ 	Hostname cc
+ 
+-Match host m
+Match host=m !user xxxyfake
+ 	Include $OBJ/ssh_config.i.* # comment
+ 
+ Host d
+@@ -41,7 +41,7 @@ Match host xxxxxx
+ _EOF
+ 
+ cat > $OBJ/ssh_config.i.1 << _EOF
+-Match host a
+Match host=a
+ 	Hostname aaa
+ 
+ Match host b
+@@ -64,10 +64,10 @@ cat > $OBJ/ssh_config.i.2 << _EOF
+ Match host a
+ 	Hostname aaaa
+ 
+-Match host b
+Match host=b !user blahblahfake
+ 	Hostname bbbb
+ 
+-Match host c
+Match host=c
+ 	Hostname cccc
+ 
+ Host d
+@@ -142,7 +142,7 @@ trial a aa
+ 
+ # cleanup
+ rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out
+-#	$OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $
+#	$OpenBSD: cfginclude.sh,v 1.5 2024/09/27 01:05:54 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="config include"
+diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
+index 05a66685..2737a5f9 100644
+--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: cfgmatch.sh,v 1.13 2021/06/08 06:52:43 djm Exp $
+#	$OpenBSD: cfgmatch.sh,v 1.14 2024/09/27 01:05:54 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="sshd_config match"
+@@ -26,7 +26,7 @@ start_client()
+ 			kill $client_pid
+ 			fatal "timeout waiting for background ssh"
+ 		fi
+-	done	
+	done
+ }
+ 
+ stop_client()
+@@ -119,40 +119,42 @@ stop_client
+ # requires knowledge of actual group memberships user running the test).
+ params="user:user:u1 host:host:h1 address:addr:1.2.3.4 \
+     localaddress:laddr:5.6.7.8 rdomain:rdomain:rdom1"
+-cp $OBJ/sshd_proxy_bak $OBJ/sshd_config
+-echo 'Banner /nomatch' >>$OBJ/sshd_config
+-for i in $params; do
+-	config=`echo $i | cut -f1 -d:`
+-	criteria=`echo $i | cut -f2 -d:`
+-	value=`echo $i | cut -f3 -d:`
+-	cat >>$OBJ/sshd_config <<EOD
+-	    Match $config $value
+-	      Banner /$value
+for separator in " " "=" ; do
+	cp $OBJ/sshd_proxy_bak $OBJ/sshd_config
+	echo 'Banner /nomatch' >>$OBJ/sshd_config
+	for i in $params; do
+		config=`echo $i | cut -f1 -d:`
+		criteria=`echo $i | cut -f2 -d:`
+		value=`echo $i | cut -f3 -d:`
+		cat >>$OBJ/sshd_config <<EOD
+		    Match ${config}${separator}${value}
+		      Banner /$value
+ EOD
+-done
+	done
+ 
+-${SUDO} ${SSHD} -f $OBJ/sshd_config -T >/dev/null || \
+-    fail "validate config for w/out spec"
+-
+-# Test matching each criteria.
+-for i in $params; do
+-	testcriteria=`echo $i | cut -f2 -d:`
+-	expected=/`echo $i | cut -f3 -d:`
+-	spec=""
+-	for j in $params; do
+-		config=`echo $j | cut -f1 -d:`
+-		criteria=`echo $j | cut -f2 -d:`
+-		value=`echo $j | cut -f3 -d:`
+-		if [ "$criteria" = "$testcriteria" ]; then
+-			spec="$criteria=$value,$spec"
+-		else
+-			spec="$criteria=1$value,$spec"
+	${SUDO} ${SSHD} -f $OBJ/sshd_config -T >/dev/null || \
+	    fail "validate config for w/out spec"
+
+	# Test matching each criteria.
+	for i in $params; do
+		testcriteria=`echo $i | cut -f2 -d:`
+		expected=/`echo $i | cut -f3 -d:`
+		spec=""
+		for j in $params; do
+			config=`echo $j | cut -f1 -d:`
+			criteria=`echo $j | cut -f2 -d:`
+			value=`echo $j | cut -f3 -d:`
+			if [ "$criteria" = "$testcriteria" ]; then
+				spec="$criteria=$value,$spec"
+			else
+				spec="$criteria=1$value,$spec"
+			fi
+		done
+		trace "test spec $spec"
+		result=`${SUDO} ${SSHD} -f $OBJ/sshd_config -T -C "$spec" | \
+		    awk '$1=="banner"{print $2}'`
+		if [ "$result" != "$expected" ]; then
+			fail "match $config expected $expected got $result"
+ 		fi
+ 	done
+-	trace "test spec $spec"
+-	result=`${SUDO} ${SSHD} -f $OBJ/sshd_config -T -C "$spec" | \
+-	    awk '$1=="banner"{print $2}'`
+-	if [ "$result" != "$expected" ]; then
+-		fail "match $config expected $expected got $result"
+-	fi
+ done
+diff --git a/regress/servcfginclude.sh b/regress/servcfginclude.sh
+index 518a703d..f67c3caa 100644
+--- a/regress/servcfginclude.sh
+++ b/regress/servcfginclude.sh
+@@ -4,14 +4,14 @@ tid="server config include"
+ 
+ cat > $OBJ/sshd_config.i << _EOF
+ HostKey $OBJ/host.ssh-ed25519
+-Match host a
+Match host=a
+ 	Banner /aa
+ 
+ Match host b
+ 	Banner /bb
+ 	Include $OBJ/sshd_config.i.* # comment
+ 
+-Match host c
+Match host=c
+ 	Include $OBJ/sshd_config.i.* # comment
+ 	Banner /cc
+ 
+@@ -25,7 +25,7 @@ Match Host e
+ 	Banner /ee
+ 	Include $OBJ/sshd_config.i.*
+ 
+-Match Host f
+Match Host=f
+ 	Include $OBJ/sshd_config.i.*
+ 	Banner /ff
+ 
+@@ -47,13 +47,13 @@ Match host b
+ Match host c
+ 	Banner /ccc
+ 
+-Match Host d
+Match Host=d
+ 	Banner /ddd
+ 
+ Match Host e
+ 	Banner /eee
+ 
+-Match Host f
+Match Host=f
+ 	Banner /fff
+ _EOF
+ 
+@@ -61,13 +61,13 @@ cat > $OBJ/sshd_config.i.2 << _EOF
+ Match host a
+ 	Banner /aaaa
+ 
+-Match host b
+Match host=b
+ 	Banner /bbbb
+ 
+ Match host c # comment
+ 	Banner /cccc
+ 
+-Match Host d
+Match Host=d
+ 	Banner /dddd
+ 
+ Match Host e
--- a/openssh-9.9p1-mlkembe.patch
+++ b/openssh-9.9p1-mlkembe.patch
@ -0,0 +1,98 @@
+diff --git a/kexmlkem768x25519.c b/kexmlkem768x25519.c
+index 679446e9..2b5d3960 100644
+--- a/kexmlkem768x25519.c
+++ b/kexmlkem768x25519.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: kexmlkem768x25519.c,v 1.1 2024/09/02 12:13:56 djm Exp $ */
+/* $OpenBSD: kexmlkem768x25519.c,v 1.2 2024/10/27 02:06:59 djm Exp $ */
+ /*
+  * Copyright (c) 2023 Markus Friedl.  All rights reserved.
+  *
+@@ -34,6 +34,9 @@
+ #include <stdbool.h>
+ #include <string.h>
+ #include <signal.h>
+#ifdef HAVE_ENDIAN_H
+# include <endian.h>
+#endif
+ 
+ #include "sshkey.h"
+ #include "kex.h"
+diff --git a/libcrux_mlkem768_sha3.h b/libcrux_mlkem768_sha3.h
+index a82d60e8..b8ac1436 100644
+--- a/libcrux_mlkem768_sha3.h
+++ b/libcrux_mlkem768_sha3.h
+@@ -1,4 +1,5 @@
+-/*  $OpenBSD: libcrux_mlkem768_sha3.h,v 1.1 2024/09/02 12:13:56 djm Exp $ */
+/*  $OpenBSD: libcrux_mlkem768_sha3.h,v 1.2 2024/10/27 02:06:01 djm Exp $ */
+
+ /* Extracted from libcrux revision 84c5d87b3092c59294345aa269ceefe0eb97cc35 */
+ 
+ /*
+@@ -160,18 +161,19 @@ static inline void Eurydice_slice_to_array3(uint8_t *dst_tag, char *dst_ok,
+ // CORE STUFF (conversions, endianness, ...)
+ 
+ static inline void core_num__u64_9__to_le_bytes(uint64_t v, uint8_t buf[8]) {
+  v = htole64(v);
+   memcpy(buf, &v, sizeof(v));
+ }
+ static inline uint64_t core_num__u64_9__from_le_bytes(uint8_t buf[8]) {
+   uint64_t v;
+   memcpy(&v, buf, sizeof(v));
+-  return v;
+  return le64toh(v);
+ }
+ 
+ static inline uint32_t core_num__u32_8__from_le_bytes(uint8_t buf[4]) {
+   uint32_t v;
+   memcpy(&v, buf, sizeof(v));
+-  return v;
+  return le32toh(v);
+ }
+ 
+ static inline uint32_t core_num__u8_6__count_ones(uint8_t x0) {
+diff --git a/mlkem768.sh b/mlkem768.sh
+index 2fdc2831..3d12b2ed 100644
+--- a/mlkem768.sh
+++ b/mlkem768.sh
+@@ -1,9 +1,10 @@
+ #!/bin/sh
+-#       $OpenBSD: mlkem768.sh,v 1.2 2024/09/04 05:11:33 djm Exp $
+#       $OpenBSD: mlkem768.sh,v 1.3 2024/10/27 02:06:01 djm Exp $
+ #       Placed in the Public Domain.
+ #
+ 
+-WANT_LIBCRUX_REVISION="origin/main"
+#WANT_LIBCRUX_REVISION="origin/main"
+WANT_LIBCRUX_REVISION="84c5d87b3092c59294345aa269ceefe0eb97cc35"
+ 
+ FILES="
+ 	libcrux/libcrux-ml-kem/cg/eurydice_glue.h
+@@ -47,6 +48,7 @@ echo '#define KRML_NOINLINE __attribute__((noinline, unused))'
+ echo '#define KRML_HOST_EPRINTF(...)'
+ echo '#define KRML_HOST_EXIT(x) fatal_f("internal error")'
+ echo
+
+ for i in $FILES; do
+ 	echo "/* from $i */"
+ 	# Changes to all files:
+@@ -56,11 +58,16 @@ for i in $FILES; do
+ 	    -e 's/[	 ]*$//' \
+ 	    $i | \
+ 	case "$i" in
+-	# XXX per-file handling goes here.
+	*/libcrux-ml-kem/cg/eurydice_glue.h)
+		# Replace endian functions with versions that work.
+		perl -0777 -pe 's/(static inline void core_num__u64_9__to_le_bytes.*\n)([^}]*\n)/\1  v = htole64(v);\n\2/' |
+		perl -0777 -pe 's/(static inline uint64_t core_num__u64_9__from_le_bytes.*?)return v;/\1return le64toh(v);/s' |
+		perl -0777 -pe 's/(static inline uint32_t core_num__u32_8__from_le_bytes.*?)return v;/\1return le32toh(v);/s'
+		;;
+ 	# Default: pass through.
+ 	*)
+-	    cat
+-	    ;;
+		cat
+		;;
+ 	esac
+ 	echo
+ done
--- a/openssh-9.9p1-separate-keysign.patch
+++ b/openssh-9.9p1-separate-keysign.patch
@ -0,0 +1,12 @@
+diff -up openssh-9.9p1/ssh_config.5.xxx openssh-9.9p1/ssh_config.5
+--- openssh-9.9p1/ssh_config.5.xxx	2024-10-11 12:01:14.260566303 +0200
+++ openssh-9.9p1/ssh_config.5	2024-10-11 12:01:59.725654775 +0200
+@@ -759,7 +759,7 @@ or
+ This option should be placed in the non-hostspecific section.
+ See
+ .Xr ssh-keysign 8
+-for more information.
+for more information. ssh-keysign should be installed explicitly.
+ .It Cm EscapeChar
+ Sets the escape character (default:
+ .Ql ~ ) .
--- a/openssh-9.9p2-error_processing.patch
+++ b/openssh-9.9p2-error_processing.patch
@ -0,0 +1,152 @@
+diff --git a/krl.c b/krl.c
+index e2efdf06..0d0f6953 100644
+--- a/krl.c
+++ b/krl.c
+@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
+ 			break;
+ 		case KRL_SECTION_CERT_SERIAL_BITMAP:
+ 			if (rs->lo - bitmap_start > INT_MAX) {
+				r = SSH_ERR_INVALID_FORMAT;
+ 				error_f("insane bitmap gap");
+ 				goto out;
+ 			}
+@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
+ 	}
+ 
+ 	if ((krl = ssh_krl_init()) == NULL) {
+		r = SSH_ERR_ALLOC_FAIL;
+ 		error_f("alloc failed");
+ 		goto out;
+ 	}
+diff --git a/packet.c b/packet.c
+index 486f8515..9dea2cfc 100644
+--- a/packet.c
+++ b/packet.c
+@@ -1864,6 +1864,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ 			if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
+ 				return r;
+ 			DBG(debug("Received SSH2_MSG_PING len %zu", len));
+			if (!ssh->state->after_authentication) {
+				DBG(debug("Won't reply to PING in preauth"));
+				break;
+			}
+			if (ssh_packet_is_rekeying(ssh)) {
+				DBG(debug("Won't reply to PING during KEX"));
+				break;
+			}
+ 			if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
+ 			    (r = sshpkt_put_string(ssh, d, len)) != 0 ||
+ 			    (r = sshpkt_send(ssh)) != 0)
+diff --git a/ssh-agent.c b/ssh-agent.c
+index 48973b2c..c27c5a95 100644
+--- a/ssh-agent.c
+++ b/ssh-agent.c
+@@ -1220,6 +1220,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 	    "restrict-destination-v00@openssh.com") == 0) {
+ 		if (*dcsp != NULL) {
+ 			error_f("%s already set", ext_name);
+			r = SSH_ERR_INVALID_FORMAT;
+ 			goto out;
+ 		}
+ 		if ((r = sshbuf_froms(m, &b)) != 0) {
+@@ -1229,6 +1230,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		while (sshbuf_len(b) != 0) {
+ 			if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) {
+ 				error_f("too many %s constraints", ext_name);
+				r = SSH_ERR_INVALID_FORMAT;
+ 				goto out;
+ 			}
+ 			*dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1,
+@@ -1246,6 +1248,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		}
+ 		if (*certs != NULL) {
+ 			error_f("%s already set", ext_name);
+			r = SSH_ERR_INVALID_FORMAT;
+ 			goto out;
+ 		}
+ 		if ((r = sshbuf_get_u8(m, &v)) != 0 ||
+@@ -1257,6 +1260,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ 		while (sshbuf_len(b) != 0) {
+ 			if (*ncerts >= AGENT_MAX_EXT_CERTS) {
+ 				error_f("too many %s constraints", ext_name);
+				r = SSH_ERR_INVALID_FORMAT;
+ 				goto out;
+ 			}
+ 			*certs = xrecallocarray(*certs, *ncerts, *ncerts + 1,
+@@ -1757,6 +1761,7 @@ process_ext_session_bind(SocketEntry *e)
+ 	/* record new key/sid */
+ 	if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) {
+ 		error_f("too many session IDs recorded");
+		r = -1;
+ 		goto out;
+ 	}
+ 	e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids,
+diff --git a/ssh-sk-client.c b/ssh-sk-client.c
+index 321fe53a..06fad221 100644
+--- a/ssh-sk-client.c
+++ b/ssh-sk-client.c
+@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ 		}
+ 		if ((srk = calloc(1, sizeof(*srk))) == NULL) {
+ 			error_f("calloc failed");
+			r = SSH_ERR_ALLOC_FAIL;
+ 			goto out;
+ 		}
+ 		srk->key = key;
+@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ 		if ((tmp = recallocarray(srks, nsrks, nsrks + 1,
+ 		    sizeof(*srks))) == NULL) {
+ 			error_f("recallocarray keys failed");
+			r = SSH_ERR_ALLOC_FAIL;
+ 			goto out;
+ 		}
+ 		debug_f("srks[%zu]: %s %s uidlen %zu", nsrks,
+diff --git a/sshconnect2.c b/sshconnect2.c
+index a69c4da1..1ee6000a 100644
+--- a/sshconnect2.c
+++ b/sshconnect2.c
+@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ 	    options.required_rsa_size)) != 0)
+ 		fatal_r(r, "Bad server host key");
+ 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+-	    xxx_conn_info) == -1)
+	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+ }
+@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 
+ 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ 		debug_f("server sent unknown pkalg %s", pkalg);
+		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		error("input_userauth_pk_ok: type mismatch "
+ 		    "for decoded key (received %d, expected %d)",
+ 		    key->type, pktype);
+		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 
+@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		    SSH_FP_DEFAULT);
+ 		error_f("server replied with unknown key: %s %s",
+ 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
+		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	ident = format_identity(id);
+diff --git a/sshsig.c b/sshsig.c
+index 6e03c0b0..3da005d6 100644
+--- a/sshsig.c
+++ b/sshsig.c
+@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum,
+ 	}
+ 	if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
+ 		error_f("buffer error");
+		r = SSH_ERR_ALLOC_FAIL;
+ 		goto out;
+ 	}
+ 	/* success */
--- a/4
+++ b/4
@ -1,3 +1,3 @@
-SHA512 (openssh-10.0p1.tar.gz) = 2daa1fcf95793b23810142077e68ddfabdf3732b207ef4f033a027f72d733d0e9bcdb6f757e7f3a5934b972de05bfaae3baae381cfc7a400cd8ab4d4e277a0ed
-SHA512 (openssh-10.0p1.tar.gz.asc) = 6ab9deb4233ff159e55a18c9fc07d5ff8a41723dad74aa3d803e1476b585f5662aba34f8a7a1f5fe1d248f3ff3cd663f2c2fb8e399c6a4723b6215b0eb423d13
+SHA512 (openssh-9.9p1.tar.gz) = 3cc0ed97f3e29ecbd882eca79239f02eb5a1606fce4f3119ddc3c5e86128aa3ff12dc85000879fccc87b60e7d651cfe37376607ac66075fede2118deaa685d6d
+SHA512 (openssh-9.9p1.tar.gz.asc) = 916e975c54eb68c0b2f0b0006522b241cbe54c4caa88d31537a6278490c93d9d732c2ab3a080ac084bf75cbdd5402901ec68583cbe7c7cde4a8e40e7a8b78c28
 SHA512 (gpgkey-736060BA.gpg) = df44f3fdbcd1d596705348c7f5aed3f738c5f626a55955e0642f7c6c082995cf36a1b1891bb41b8715cb2aff34fef1c877e0eff0d3507dd00a055ba695757a21
Author	SHA1	Message	Date
Mattias Ellert	f17ff3f549	Based on openssh-9.9p1-7.el10	2025-04-20 06:55:05 +02:00
Mattias Ellert	520e55a6fe	Based on openssh-9.9p1-5.el10.1	2025-03-05 16:50:43 +01:00