Do not fail sshd-auth with gssapi-keyex and no hostkeys

With GSSAPI key exchange enabled, sshd must support
the "null" host key algorithm. This update make sure
that the server does not abort the connection if
no host key is provided.

0012-openssh-9.6p1-gssapi-keyex.patch

@@ -1,4 +1,4 @@
-From 754b023b92aa68742258c55243a6ae8f30ed5a17 Mon Sep 17 00:00:00 2001
+From f19e9dcf94b5d38c701626886cb4c71314fd026d Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <beldmit@gmail.com>
 Date: Thu, 15 May 2025 13:43:28 +0200
 Subject: [PATCH 12/50] openssh-9.6p1-gssapi-keyex
@@ -38,14 +38,14 @@ Subject: [PATCH 12/50] openssh-9.6p1-gssapi-keyex
  ssh_config      |   2 +
  ssh_config.5    |  58 ++++
  sshconnect2.c   | 154 ++++++++++-
- sshd-auth.c     |  53 ++++
+ sshd-auth.c     |  55 +++-
  sshd-session.c  |   9 +-
  sshd.c          |   3 +-
  sshd_config     |   2 +
  sshd_config.5   |  31 +++
  sshkey.c        |  72 ++++-
  sshkey.h        |   1 +
- 41 files changed, 2984 insertions(+), 76 deletions(-)
+ 41 files changed, 2985 insertions(+), 77 deletions(-)
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
 
@@ -4023,9 +4023,18 @@ index 1ee6000a..0af15bcc 100644
  
  static int
 diff --git a/sshd-auth.c b/sshd-auth.c
-index f957dc22..d51e4636 100644
+index f957dc22..e6f14dd0 100644
 --- a/sshd-auth.c
 +++ b/sshd-auth.c
+@@ -722,7 +722,7 @@ main(int ac, char **av)
+ 			break;
+ 		}
+ 	}
+-	if (!have_key)
++	if (!have_key && !options.gss_keyex)
+ 		fatal("internal error: received no hostkeys");
+ 
+ 	/* Ensure that umask disallows at least group and world write */
 @@ -844,6 +844,48 @@ do_ssh2_kex(struct ssh *ssh)
  
  	free(hkalgs);

openssh.spec

@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 5%{?dist}
+Release: 6%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -586,6 +586,9 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Wed Dec 10 2025 Pavol Žáčik <pzacik@redhat.com> - 10.0p1-6
+- Update gssapi-keyex patch to not abort KEX without hostkey
+
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 10.0p1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild