开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 3

_service:tar_scm:openssh.spec Changed

@@ -6,10 +6,10 @@
 %{?no_gtk2:%global gtk2 0}
 
 %global sshd_uid    74
-%global openssh_release 15
+%global openssh_release 3
 
 Name:           openssh
-Version:        8.8p1
+Version:        9.1p1
 Release:        %{openssh_release}
 URL:            http://www.openssh.com/portable.html
 License:        BSD
@@ -18,19 +18,19 @@
 Source0:        https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1:        https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
 Source2:        sshd.pam
-Source4:        http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.4.tar.gz
-Source5:        pam_ssh_agent-rmheaders
-Source6:        ssh-keycat.pam
-Source7:        sshd.sysconfig
-Source9:        sshd@.service
-Source10:       sshd.socket
-Source11:       sshd.service
-Source12:       sshd-keygen@.service
-Source13:       sshd-keygen
-Source14:       sshd.tmpfiles
-Source15:       sshd-keygen.target
-Source16:       ssh-agent.service
-Source17:       ssh-keygen-bash-completion.sh
+Source3:        http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.4.tar.gz
+Source4:        pam_ssh_agent-rmheaders
+Source5:        ssh-keycat.pam
+Source6:        sshd.sysconfig
+Source7:        sshd@.service
+Source8:        sshd.socket
+Source9:        sshd.service
+Source10:       sshd-keygen@.service
+Source11:       sshd-keygen
+Source12:       sshd.tmpfiles
+Source13:       sshd-keygen.target
+Source14:       ssh-agent.service
+Source15:       ssh-keygen-bash-completion.sh
 Patch0:         openssh-6.7p1-coverity.patch
 Patch1:         openssh-7.6p1-audit.patch
 Patch2:         openssh-7.1p2-audit-race-condition.patch
@@ -48,12 +48,10 @@
 Patch15:        openssh-5.9p1-ipv6man.patch
 Patch16:        openssh-5.8p2-sigpipe.patch
 Patch17:        openssh-7.2p2-x11.patch
-Patch18:        openssh-7.7p1-fips.patch
 Patch19:        openssh-5.1p1-askpass-progress.patch
 Patch20:        openssh-4.3p2-askpass-grab-info.patch
 Patch21:        openssh-7.7p1.patch
 Patch22:        openssh-7.8p1-UsePAM-warning.patch
-Patch23:        openssh-6.3p1-ctr-evp-fast.patch
 Patch26:        openssh-8.0p1-gssapi-keyex.patch
 Patch27:        openssh-6.6p1-force_krb.patch
 Patch28:        openssh-6.6p1-GSSAPIEnablek5users.patch
@@ -82,27 +80,18 @@
 Patch52:        openssh-8.0p1-preserve-pam-errors.patch
 Patch53:        openssh-8.7p1-scp-kill-switch.patch
 Patch54:        bugfix-sftp-when-parse_user_host_path-empty-path-should-be-allowed.patch
-Patch55:        bugfix-openssh-6.6p1-log-usepam-no.patch
 Patch56:        bugfix-openssh-add-option-check-username-splash.patch
 Patch57:        feature-openssh-7.4-hima-sftpserver-oom-and-fix.patch
 Patch58:        bugfix-openssh-fix-sftpserver.patch
 Patch59:        set-sshd-config.patch
 Patch60:        feature-add-SMx-support.patch
-Patch61:        backport-upstream-a-little-extra-debugging.patch
-Patch62:        backport-upstream-better-debugging-for-connect_next.patch
 Patch63:        add-loongarch.patch
-Patch64:        backport-upstream-ssh-keygen-Y-check-novalidate-requires-name.patch
 Patch65:        openssh-Add-sw64-architecture.patch
-Patch66:        backport-upstream-if-sshpkt-functions-fail-then-password-is-n.patch
-Patch67:        backport-upstream-Make-sure-not-to-fclose-the-same-fd-twice-i.patch
-Patch68:        backport-upstream-Donot-attempt-to-fprintf-a-null-identity-co.patch
-Patch69:        backport-upstream-ignore-SIGPIPE-earlier-in-main-specifically.patch
-Patch70:        backport-upstream-Always-return-allocated-strings-from-the-ke.patch
-Patch71:        backport-Don-t-leak-the-strings-allocated-by-order_h.patch
-Patch72:        backport-Return-ERANGE-from-getcwd-if-buffer-size-is-1.patch
-Patch73:        backport-upstream-double-free-in-error-path-from-Eusgor-via-G.patch
 Patch74:        add-strict-scp-check-for-CVE-2020-15778.patch
-Patch75:        backport-upstream-avoid-integer-overflow-of-auth-attempts-har.patch
+Patch77:        skip-scp-test-if-there-is-no-scp-on-remote-path-as-s.patch
+Patch78:        skip-tests-for-C-if-there-is-no-openssl-on-local-pat.patch
+Patch79:        backport-upstream-CVE-2023-25136-fix-double-free-caused.patch
+Patch80:        set-ssh-config.patch
 
 Requires:       /sbin/nologin
 Requires:       libselinux >= 2.3-5 audit-libs >= 1.0.8
@@ -176,7 +165,7 @@
 %package_help
 
 %prep
-%setup -q -a 4
+%setup -q -a 3
 
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4
 %patch3 -p2 -b .psaa-build
@@ -186,14 +175,13 @@
 %patch6 -p2 -b .psaa-agent
 %patch8 -p2 -b .psaa-deref
 # Remove duplicate headers and library files
-rm -f $(cat %{SOURCE5})
+rm -f $(cat %{SOURCE4})
 popd
 
 %patch9 -p1 -b .role-mls
 %patch10 -p1 -b .privsep-selinux
 %patch12 -p1 -b .keycat
 %patch13 -p1 -b .ip-opts
-%patch14 -p1 -b .keyperm
 %patch15 -p1 -b .ipv6man
 %patch16 -p1 -b .sigpipe
 %patch17 -p1 -b .x11
@@ -201,7 +189,6 @@
 %patch20 -p1 -b .grab-info
 %patch21 -p1
 %patch22 -p1 -b .log-usepam-no
-%patch23 -p1 -b .evp-ctr
 %patch26 -p1 -b .gsskex
 %patch27 -p1 -b .force_krb
 %patch29 -p1 -b .ccache_name
@@ -231,31 +218,20 @@
 %patch53 -p1 -b .kill-scp
 %patch1 -p1 -b .audit
 %patch2 -p1 -b .audit-race
-%patch18 -p1 -b .fips
 %patch0 -p1 -b .coverity
-
 %patch54 -p1
-%patch55 -p1
 %patch56 -p1
 %patch57 -p1
 %patch58 -p1
 %patch59 -p1
 %patch60 -p1
-%patch61 -p1
-%patch62 -p1
 %patch63 -p1
-%patch64 -p1
 %patch65 -p1
-%patch66 -p1
-%patch67 -p1
-%patch68 -p1
-%patch69 -p1
-%patch70 -p1
-%patch71 -p1
-%patch72 -p1
-%patch73 -p1
 %patch74 -p1
-%patch75 -p1
+%patch77 -p1
+%patch78 -p1
+%patch79 -p1
+%patch80 -p1
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4
@@ -327,10 +303,7 @@
 popd
 
 %check
-#to run tests use "--with check"
-%if %{?_with_check:1}%{!?_with_check:0}
 make tests
-%endif
 
 %install
 mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
@@ -345,23 +318,22 @@
 install -d $RPM_BUILD_ROOT/etc/sysconfig/
 install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
 install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
-install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
-install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
-install -m644 ssh_config_redhat $RPM_BUILD_ROOT/etc/ssh/ssh_config.d/05-redhat.conf
+install -m644 %{SOURCE5} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
+install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/sysconfig/sshd
 install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
-install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
-install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
-install -m644 %{SOURCE11} $RPM_BUILD_ROOT/%{_unitdir}/sshd.service
-install -m644 %{SOURCE12} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen@.service
-install -m644 %{SOURCE15} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.target
+install -m644 %{SOURCE7} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
+install -m644 %{SOURCE8} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
+install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd.service
+install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen@.service
+install -m644 %{SOURCE13} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.target
 install -d -m755 $RPM_BUILD_ROOT/%{_userunitdir}
-install -m644 %{SOURCE16} $RPM_BUILD_ROOT/%{_userunitdir}/ssh-agent.service
-install -m744 %{SOURCE13} $RPM_BUILD_ROOT/%{_libexecdir}/openssh/sshd-keygen
+install -m644 %{SOURCE14} $RPM_BUILD_ROOT/%{_userunitdir}/ssh-agent.service
+install -m744 %{SOURCE11} $RPM_BUILD_ROOT/%{_libexecdir}/openssh/sshd-keygen
 install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
 install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
-install -m644 -D %{SOURCE14} $RPM_BUILD_ROOT%{_tmpfilesdir}/%{name}.conf
+install -m644 -D %{SOURCE12} $RPM_BUILD_ROOT%{_tmpfilesdir}/%{name}.conf

_service:tar_scm:backport-Don-t-leak-the-strings-allocated-by-order_h.patch Deleted

@@ -1,130 +0,0 @@
-From 6c31ba10e97b6953c4f325f526f3e846dfea647a Mon Sep 17 00:00:00 2001
-From: "dtucker@openbsd.org" <dtucker@openbsd.org>
-Date: Fri, 1 Jul 2022 03:39:44 +0000
-Subject: upstream: Don't leak the strings allocated by order_hostkeyalgs()
-
-and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of
-github PR#324 from ZoltanFridrich, ok djm@
-
-This is a roll-forward of the previous rollback now that the required
-changes in compat.c have been done.
-
-OpenBSD-Commit-ID: c7cd93730b3b9f53cdad3ae32462922834ef73eb
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=6c31ba10e97b6953c4f325f526f3e846dfea647a
-
----
- sshconnect2.c | 16 ++++++++++------
- sshd.c        | 17 +++++++++++------
- 2 files changed, 21 insertions(+), 12 deletions(-)
-
-diff --git a/sshconnect2.c b/sshconnect2.c
-index 150d419..eb0df92 100644
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: sshconnect2.c,v 1.351 2021/07/23 05:24:02 djm Exp $ */
-+/* $OpenBSD: sshconnect2.c,v 1.359 2022/07/01 03:39:44 dtucker Exp $ */
- /*
-  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
-  * Copyright (c) 2008 Damien Miller.  All rights reserved.
-@@ -218,6 +218,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
- {
- 	char *myproposalPROPOSAL_MAX = { KEX_CLIENT };
- 	char *s, *all_key;
-+	char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
- 	int r, use_known_hosts_order = 0;
- 
- #if defined(GSSAPI) && defined(WITH_OPENSSL)
-@@ -248,10 +249,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
- 
- 	if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
- 		fatal_f("kex_names_cat");
--	myproposalPROPOSAL_KEX_ALGS = compat_kex_proposal(ssh, s);
-+	myproposalPROPOSAL_KEX_ALGS = prop_kex = compat_kex_proposal(ssh, s);
- 	myproposalPROPOSAL_ENC_ALGS_CTOS =
--	    compat_cipher_proposal(ssh, options.ciphers);
--	myproposalPROPOSAL_ENC_ALGS_STOC =
-+	    myproposalPROPOSAL_ENC_ALGS_STOC = prop_enc =
- 	    compat_cipher_proposal(ssh, options.ciphers);
- 	myproposalPROPOSAL_COMP_ALGS_CTOS =
- 	    myproposalPROPOSAL_COMP_ALGS_STOC =
-@@ -260,12 +260,12 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
- 	    myproposalPROPOSAL_MAC_ALGS_STOC = options.macs;
- 	if (use_known_hosts_order) {
- 		/* Query known_hosts and prefer algorithms that appear there */
--		myproposalPROPOSAL_SERVER_HOST_KEY_ALGS =
-+		myproposalPROPOSAL_SERVER_HOST_KEY_ALGS = prop_hostkey =
- 		    compat_pkalg_proposal(ssh,
- 		    order_hostkeyalgs(host, hostaddr, port, cinfo));
- 	} else {
- 		/* Use specified HostkeyAlgorithms exactly */
--		myproposalPROPOSAL_SERVER_HOST_KEY_ALGS =
-+		myproposalPROPOSAL_SERVER_HOST_KEY_ALGS = prop_hostkey =
- 		    compat_pkalg_proposal(ssh, options.hostkeyalgorithms);
- 	}
- 
-@@ -380,6 +380,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
- 	    (r = ssh_packet_write_wait(ssh)) != 0)
- 		fatal_fr(r, "send packet");
- #endif
-+	/* Free only parts of proposal that were dynamically allocated here. */
-+	free(prop_kex);
-+	free(prop_enc);
-+	free(prop_hostkey);
- }
- 
- /*
-diff --git a/sshd.c b/sshd.c
-index 98a9754..6c77f07 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: sshd.c,v 1.578 2021/07/19 02:21:50 dtucker Exp $ */
-+/* $OpenBSD: sshd.c,v 1.589 2022/07/01 03:39:44 dtucker Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -2522,12 +2522,14 @@ do_ssh2_kex(struct ssh *ssh)
- {
- 	char *myproposalPROPOSAL_MAX = { KEX_SERVER };
- 	struct kex *kex;
-+	char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
- 	int r;
- 
--	myproposalPROPOSAL_KEX_ALGS = compat_kex_proposal(ssh,
-+	myproposalPROPOSAL_KEX_ALGS = prop_kex = compat_kex_proposal(ssh,
- 	    options.kex_algorithms);
--	myproposalPROPOSAL_ENC_ALGS_CTOS = compat_cipher_proposal(ssh,
--	    options.ciphers);
-+	myproposalPROPOSAL_ENC_ALGS_CTOS =
-+		myproposalPROPOSAL_ENC_ALGS_STOC = prop_enc =
-+		compat_cipher_proposal(ssh, options.ciphers);
- 	myproposalPROPOSAL_ENC_ALGS_STOC = compat_cipher_proposal(ssh,
- 	    options.ciphers);
- 	myproposalPROPOSAL_MAC_ALGS_CTOS =
-@@ -2542,8 +2544,8 @@ do_ssh2_kex(struct ssh *ssh)
- 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
- 		    options.rekey_interval);
- 	/* coverityleaked_storage : FALSE*/
--	myproposalPROPOSAL_SERVER_HOST_KEY_ALGS = compat_pkalg_proposal(
--	    ssh, list_hostkey_types());
-+	myproposalPROPOSAL_SERVER_HOST_KEY_ALGS = prop_hostkey =
-+		compat_pkalg_proposal(ssh, list_hostkey_types());
- 
- #if defined(GSSAPI) && defined(WITH_OPENSSL)
- 	{
-@@ -2639,6 +2641,9 @@ do_ssh2_kex(struct ssh *ssh)
- 	    (r = ssh_packet_write_wait(ssh)) != 0)
- 		fatal_fr(r, "send test");
- #endif
-+	free(prop_kex);
-+	free(prop_enc);
-+	free(prop_hostkey);
- 	debug("KEX done");
- }
- 
--- 
-2.33.0
-

_service:tar_scm:backport-Return-ERANGE-from-getcwd-if-buffer-size-is-1.patch Deleted

@@ -1,43 +0,0 @@
-From 527cb43fa1b4e55df661feabbac51b8e608b6519 Mon Sep 17 00:00:00 2001
-From: Darren Tucker <dtucker@dtucker.net>
-Date: Thu, 14 Jul 2022 11:22:08 +1000
-Subject: Return ERANGE from getcwd() if buffer size is 1.
-
-If getcwd() is supplied a buffer size of exactly 1 and a path of "/", it
-could result in a nul byte being written out of array bounds.  POSIX says
-it should return ERANGE if the path will not fit in the available buffer
-(with terminating nul). 1 byte cannot fit any possible path with its nul,
-so immediately return ERANGE in that case.
-
-OpenSSH never uses getcwd() with this buffer size, and all current
-(and even quite old) platforms that we are currently known to work
-on have a native getcwd() so this code is not used on those anyway.
-Reported by Qualys, ok djm@
-
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=527cb43fa1b4e55df661feabbac51b8e608b6519
-Conflict:NA
----
- openbsd-compat/getcwd.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/openbsd-compat/getcwd.c b/openbsd-compat/getcwd.c
-index e4f7f5a..a403a01 100644
---- a/openbsd-compat/getcwd.c
-+++ b/openbsd-compat/getcwd.c
-@@ -71,9 +71,12 @@ getcwd(char *pt, size_t size)
- 	 */
- 	if (pt) {
- 		ptsize = 0;
--		if (!size) {
-+		if (size == 0) {
- 			errno = EINVAL;
- 			return (NULL);
-+		} else if (size == 1) {
-+			errno = ERANGE;
-+			return (NULL);
- 		}
- 		ept = pt + size;
- 	} else {
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-Always-return-allocated-strings-from-the-ke.patch Deleted

@@ -1,88 +0,0 @@
-From 486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Mon Sep 17 00:00:00 2001
-From: "dtucker@openbsd.org" <dtucker@openbsd.org>
-Date: Fri, 1 Jul 2022 03:35:45 +0000
-Subject: upstream: Always return allocated strings from the kex filtering so
-
-that we can free them later.  Fix one leak in compat_kex_proposal.  Based on
-github PR#324 from ZoltanFridrich with some simplications by me. ok djm@
-
-OpenBSD-Commit-ID: 9171616da3307612d0ede086fd511142f91246e4
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=486c4dc3b83b4b67d663fb0fa62bc24138ec3946
----
- compat.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/compat.c b/compat.c
-index 9120bd2..1d50349 100644
---- a/compat.c
-+++ b/compat.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: compat.c,v 1.119 2021/09/10 05:46:09 djm Exp $ */
-+/* $OpenBSD: compat.c,v 1.120 2022/07/01 03:35:45 dtucker Exp $ */
- /*
-  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
-  *
-@@ -156,11 +156,12 @@ compat_banner(struct ssh *ssh, const char *version)
- 	debug_f("no match: %s", version);
- }
- 
-+/* Always returns pointer to allocated memory, caller must free. */
- char *
- compat_cipher_proposal(struct ssh *ssh, char *cipher_prop)
- {
- 	if (!(ssh->compat & SSH_BUG_BIGENDIANAES))
--		return cipher_prop;
-+		return xstrdup(cipher_prop);
- 	debug2_f("original cipher proposal: %s", cipher_prop);
- 	if ((cipher_prop = match_filter_denylist(cipher_prop, "aes*")) == NULL)
- 		fatal("match_filter_denylist failed");
-@@ -170,11 +171,12 @@ compat_cipher_proposal(struct ssh *ssh, char *cipher_prop)
- 	return cipher_prop;
- }
- 
-+/* Always returns pointer to allocated memory, caller must free. */
- char *
- compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
- {
- 	if (!(ssh->compat & SSH_BUG_RSASIGMD5))
--		return pkalg_prop;
-+		return xstrdup(pkalg_prop);
- 	debug2_f("original public key proposal: %s", pkalg_prop);
- 	if ((pkalg_prop = match_filter_denylist(pkalg_prop, "ssh-rsa")) == NULL)
- 		fatal("match_filter_denylist failed");
-@@ -184,11 +186,15 @@ compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
- 	return pkalg_prop;
- }
- 
-+/* Always returns pointer to allocated memory, caller must free. */
- char *
- compat_kex_proposal(struct ssh *ssh, char *p)
- {
-+	char *cp = NULL;
-+
-+
- 	if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
--		return p;
-+		return xstrdup(p);
- 	debug2_f("original KEX proposal: %s", p);
- 	if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
- 		/* coverityoverwrite_var : FALSE */
-@@ -196,11 +202,13 @@ compat_kex_proposal(struct ssh *ssh, char *p)
- 		    "curve25519-sha256@libssh.org")) == NULL)
- 			fatal("match_filter_denylist failed");
- 	if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
-+		cp = p;
- 		/* coverityoverwrite_var : FALSE */
- 		if ((p = match_filter_denylist(p,
- 		    "diffie-hellman-group-exchange-sha256,"
- 		    "diffie-hellman-group-exchange-sha1")) == NULL)
- 			fatal("match_filter_denylist failed");
-+		free(cp);
- 	}
- 	debug2_f("compat KEX proposal: %s", p);
- 	if (*p == '\0')
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-CVE-2023-25136-fix-double-free-caused.patch Added

@@ -0,0 +1,63 @@
+From 12da7823336434a403f25c7cc0c2c6aed0737a35 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 2 Feb 2023 12:10:05 +0000
+Subject: PATCH upstream: fix double-free caused by compat_kex_proposal();
+ bz3522
+
+by dtucker@, ok me
+
+OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80
+
+Reference:https://anongit.mindrot.org/openssh.git/patch/?id=12da7823336434a403f25c7cc0c2c6aed0737a35
+Conflict:NA 
+---
+ compat.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/compat.c b/compat.c
+index 46dfe3a9..478a9403 100644
+--- a/compat.c
++++ b/compat.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: compat.c,v 1.120 2022/07/01 03:35:45 dtucker Exp $ */
++/* $OpenBSD: compat.c,v 1.121 2023/02/02 12:10:05 djm Exp $ */
+ /*
+  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
+  *
+@@ -190,26 +190,26 @@ compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
+ char *
+ compat_kex_proposal(struct ssh *ssh, char *p)
+ {
+-	char *cp = NULL;
++	char *cp = NULL, *cp2 = NULL;
+ 
+ 	if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
+ 		return xstrdup(p);
+ 	debug2_f("original KEX proposal: %s", p);
+ 	if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
+-		if ((p = match_filter_denylist(p,
++		if ((cp = match_filter_denylist(p,
+ 		    "curve25519-sha256@libssh.org")) == NULL)
+ 			fatal("match_filter_denylist failed");
+ 	if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
+-		cp = p;
+-		if ((p = match_filter_denylist(p,
++		if ((cp2 = match_filter_denylist(cp ? cp : p,
+ 		    "diffie-hellman-group-exchange-sha256,"
+ 		    "diffie-hellman-group-exchange-sha1")) == NULL)
+ 			fatal("match_filter_denylist failed");
+ 		free(cp);
++		cp = cp2;
+ 	}
+-	debug2_f("compat KEX proposal: %s", p);
+-	if (*p == '\0')
++	if (cp == NULL || *cp == '\0')
+ 		fatal("No supported key exchange algorithms found");
+-	return p;
++	debug2_f("compat KEX proposal: %s", cp);
++	return cp;
+ }
+ 
+-- 
+2.23.0
+

_service:tar_scm:backport-upstream-Donot-attempt-to-fprintf-a-null-identity-co.patch Deleted

@@ -1,37 +0,0 @@
-From f29d6cf98c25bf044079032d22c1a57c63ab9d8e Mon Sep 17 00:00:00 2001
-From: "dtucker@openbsd.org" <dtucker@openbsd.org>
-Date: Sat, 18 Jun 2022 02:17:16 +0000
-Subject: upstream: Don't attempt to fprintf a null identity comment. From
-
-Martin Vahlensieck via tech@.
-
-OpenBSD-Commit-ID: 4c54d20a8e8e4e9912c38a7b4ef5bfc5ca2e05c2
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=f29d6cf98c25bf044079032d22c1a57c63ab9d8e
----
- ssh-add.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/ssh-add.c b/ssh-add.c
-index 29c0b17..d60bafc 100644
---- a/ssh-add.c
-+++ b/ssh-add.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: ssh-add.c,v 1.160 2021/04/03 06:18:41 djm Exp $ */
-+/* $OpenBSD: ssh-add.c,v 1.166 2022/06/18 02:17:16 dtucker Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -125,7 +125,7 @@ delete_one(int agent_fd, const struct sshkey *key, const char *comment,
- 	}
- 	if (!qflag) {
- 		fprintf(stderr, "Identity removed: %s %s (%s)\n", path,
--		    sshkey_type(key), comment);
-+		    sshkey_type(key), comment ? comment : "no comment");
- 	}
- 	return 0;
- }
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-Make-sure-not-to-fclose-the-same-fd-twice-i.patch Deleted

@@ -1,63 +0,0 @@
-From 17904f05802988d0bb9ed3c8d1d37411e8f459c3 Mon Sep 17 00:00:00 2001
-From: "tobhe@openbsd.org" <tobhe@openbsd.org>
-Date: Tue, 21 Jun 2022 14:52:13 +0000
-Subject: upstream: Make sure not to fclose() the same fd twice in case of an
-
-error.
-
-ok dtucker@
-
-OpenBSD-Commit-ID: e384c4e05d5521e7866b3d53ca59acd2a86eef99
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=17904f05802988d0bb9ed3c8d1d37411e8f459c3
-
----
- authfile.c | 19 ++++++++++++-------
- 1 file changed, 12 insertions(+), 7 deletions(-)
-
-diff --git a/authfile.c b/authfile.c
-index 8990137..dce1e84 100644
---- a/authfile.c
-+++ b/authfile.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: authfile.c,v 1.141 2020/06/18 23:33:38 djm Exp $ */
-+/* $OpenBSD: authfile.c,v 1.143 2022/06/21 14:52:13 tobhe Exp $ */
- /*
-  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
-  *
-@@ -515,20 +515,25 @@ sshkey_save_public(const struct sshkey *key, const char *path,
- 		return SSH_ERR_SYSTEM_ERROR;
- 	if ((f = fdopen(fd, "w")) == NULL) {
- 		r = SSH_ERR_SYSTEM_ERROR;
-+		close(fd);
- 		goto fail;
- 	}
- 	if ((r = sshkey_write(key, f)) != 0)
- 		goto fail;
- 	fprintf(f, " %s\n", comment);
--	if (ferror(f) || fclose(f) != 0) {
-+	if (ferror(f)) {
- 		r = SSH_ERR_SYSTEM_ERROR;
-+		goto fail;
-+	}
-+	if (fclose(f) != 0) {
-+		r = SSH_ERR_SYSTEM_ERROR;
-+		f = NULL;
-  fail:
--		oerrno = errno;
--		if (f != NULL)
-+		if (f != NULL) {
-+			oerrno = errno;
- 			fclose(f);
--		else
--			close(fd);
--		errno = oerrno;
-+			errno = oerrno;
-+		}
- 		return r;
- 	}
- 	return 0;
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-a-little-extra-debugging.patch Deleted

@@ -1,34 +0,0 @@
-From 940dc10729cb5a95b7ee82c10184e2b9621c8a1d Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Wed, 14 Sep 2022 00:13:13 +0000
-Subject: PATCH upstream: a little extra debugging
-
-OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a
-
-Reference:https://github.com/openssh/openssh-portable/commit/940dc10729cb5a95b7ee82c10184e2b9621c8a1d
-Conflict:NA
----
- ssh-agent.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/ssh-agent.c b/ssh-agent.c
-index ddda4d77..0aef07eb 100644
---- a/ssh-agent.c
-+++ b/ssh-agent.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: ssh-agent.c,v 1.278 2021/04/03 06:18:41 djm Exp $ */
-+/* $OpenBSD: ssh-agent.c,v 1.291 2022/09/14 00:13:13 djm Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -845,6 +845,7 @@ process_sign_request2(SocketEntry *e)
- 	/* Success */
- 	ok = 0;
-  send:
-+	debug_f("good signature");
- 	notify_complete(notifier, "User presence confirmed");
- 
- 	if (ok == 0) {
--- 
-2.23.0
-

_service:tar_scm:backport-upstream-avoid-integer-overflow-of-auth-attempts-har.patch Deleted

@@ -1,44 +0,0 @@
-From 32ebaa0dbca5d0bb86e384e72bebc153f48413e4 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Wed, 23 Feb 2022 11:18:13 +0000
-Subject: PATCH upstream: avoid integer overflow of auth attempts
-(harmless,caught by monitor)
-
-OpenBSD-Commit-ID: 488ad570b003b21e0cd9e7a00349cfc1003b4d86
-
-Reference:https://github.com/openssh/openssh-portable/commit/32ebaa0dbca5d0
-Conflict:NA
----
- auth2.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/auth2.c b/auth2.c
-index 7290d54..0de58e6 100644
---- a/auth2.c
-+++ b/auth2.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: auth2.c,v 1.161 2021/04/03 06:18:40 djm Exp $ */
-+/* $OpenBSD: auth2.c,v 1.164 2022/02/23 11:18:13 djm Exp $ */
- /*
-  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
-  *
-@@ -290,6 +290,8 @@ if (options.check_user_splash)
- 	if ((style = strchr(user, ':')) != NULL)
- 		*style++ = 0;
- 
-+	if (authctxt->attempt >= 1024)
-+		auth_maxtries_exceeded(ssh);
- 	if (authctxt->attempt++ == 0) {
- 		/* setup auth context */
- 		authctxt->pw = PRIVSEP(getpwnamallow(ssh, user));
-@@ -298,6 +300,7 @@ if (options.check_user_splash)
- 			authctxt->valid = 1;
- 			debug2_f("setting up authctxt for %s", user);
- 		} else {
-+           authctxt->valid = 0;
- 			/* Invalid user, fake password information */
- 			authctxt->pw = fakepw();
- 		}
--- 
-2.23.0
-

_service:tar_scm:backport-upstream-better-debugging-for-connect_next.patch Deleted

@@ -1,66 +0,0 @@
-From 231a346c0c67cc7ca098360f9a554fa7d4f1eddb Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Mon, 19 Sep 2022 08:49:50 +0000
-Subject: PATCH upstream: better debugging for connect_next()
-
-OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640
-
-Reference:https://github.com/openssh/openssh-portable/commit/231a346c0c67cc7ca098360f9a554fa7d4f1eddb
-Conflict:NA
----
- channels.c | 15 ++++++++-------
- 1 file changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/channels.c b/channels.c
-index 3ac51bac..6a78de9d 100644
---- a/channels.c
-+++ b/channels.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: channels.c,v 1.408 2021/09/14 11:04:21 mbuhl Exp $ */
-+/* $OpenBSD: channels.c,v 1.420 2022/09/19 08:49:50 djm Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -4403,13 +4403,15 @@ connect_next(struct channel_connect *cctx)
- 			if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen,
- 			    ntop, sizeof(ntop), strport, sizeof(strport),
- 			    NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
--				error("connect_next: getnameinfo failed");
-+				error_f("getnameinfo failed");
- 				continue;
- 			}
- 			break;
- 		default:
- 			continue;
- 		}
-+		debug_f("start for host %.100s (%.100s:%s)",
-+		    cctx->host, ntop, strport);
- 		if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
- 		    cctx->ai->ai_protocol)) == -1) {
- 			if (cctx->ai->ai_next == NULL)
-@@ -4422,9 +4424,8 @@ connect_next(struct channel_connect *cctx)
- 			fatal_f("set_nonblock(%d)", sock);
- 		if (connect(sock, cctx->ai->ai_addr,
- 		    cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) {
--			debug("connect_next: host %.100s (%.100s:%s): "
--			    "%.100s", cctx->host, ntop, strport,
--			    strerror(errno));
-+			debug_f("host %.100s (%.100s:%s): %.100s",
-+			    cctx->host, ntop, strport, strerror(errno));
- 			saved_errno = errno;
- 			close(sock);
- 			errno = saved_errno;
-@@ -4432,8 +4433,8 @@ connect_next(struct channel_connect *cctx)
- 		}
- 		if (cctx->ai->ai_family != AF_UNIX)
- 			set_nodelay(sock);
--		debug("connect_next: host %.100s (%.100s:%s) "
--		    "in progress, fd=%d", cctx->host, ntop, strport, sock);
-+		debug_f("connect host %.100s (%.100s:%s) in progress, fd=%d",
-+		    cctx->host, ntop, strport, sock);
- 		cctx->ai = cctx->ai->ai_next;
- 		return sock;
- 	}
--- 
-2.23.0
-

_service:tar_scm:backport-upstream-double-free-in-error-path-from-Eusgor-via-G.patch Deleted

@@ -1,56 +0,0 @@
-From 5062ad48814b06162511c4f5924a33d97b6b2566 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Fri, 19 Aug 2022 03:06:30 +0000
-Subject: upstream: double free() in error path; from Eusgor via GHPR333
-
-OpenBSD-Commit-ID: 39f35e16ba878c8d02b4d01d8826d9b321be26d4
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=5062ad48814b06162511c4f5924a33d97b6b2566
-
----
- sshsig.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/sshsig.c b/sshsig.c
-index 0e8abf1..58c7df4 100644
---- a/sshsig.c
-+++ b/sshsig.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: sshsig.c,v 1.21 2021/07/23 04:00:59 djm Exp $ */
-+/* $OpenBSD: sshsig.c,v 1.30 2022/08/19 03:06:30 djm Exp $ */
- /*
-  * Copyright (c) 2019 Google LLC
-  *
-@@ -491,7 +491,7 @@ hash_file(int fd, const char *hashalg, struct sshbuf **bp)
- {
- 	char *hex, rbuf8192, hashSSH_DIGEST_MAX_LENGTH;
- 	ssize_t n, total = 0;
--	struct ssh_digest_ctx *ctx;
-+	struct ssh_digest_ctx *ctx = NULL;
- 	int alg, oerrno, r = SSH_ERR_INTERNAL_ERROR;
- 	struct sshbuf *b = NULL;
- 
-@@ -514,7 +514,6 @@ hash_file(int fd, const char *hashalg, struct sshbuf **bp)
- 				continue;
- 			oerrno = errno;
- 			error_f("read: %s", strerror(errno));
--			ssh_digest_free(ctx);
- 			ctx = NULL;
- 			errno = oerrno;
- 			r = SSH_ERR_SYSTEM_ERROR;
-@@ -550,9 +549,11 @@ hash_file(int fd, const char *hashalg, struct sshbuf **bp)
- 	/* success */
- 	r = 0;
-  out:
-+	oerrno = errno;
- 	sshbuf_free(b);
- 	ssh_digest_free(ctx);
- 	explicit_bzero(hash, sizeof(hash));
-+	errno = oerrno;
- 	return r;
- }
- 
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-if-sshpkt-functions-fail-then-password-is-n.patch Deleted

@@ -1,54 +0,0 @@
-From 2c334fd36f80cb91cc42e4b978b10aa35e0df236 Mon Sep 17 00:00:00 2001
-From: "dtucker@openbsd.org" <dtucker@openbsd.org>
-Date: Fri, 27 May 2022 04:29:40 +0000
-Subject: upstream: f sshpkt functions fail, then password is not cleared
-
-with freezero. Unconditionally call freezero to guarantee that password is
-removed from RAM.
-
-From tobias@ and c3h2_ctf via github PR#286, ok djm@
-
-OpenBSD-Commit-ID: 6b093619c9515328e25b0f8093779c52402c89cd
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/commit?id=2c334fd36f80cb91cc42e4b978b10aa35e0df236
-
----
- auth2-passwd.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/auth2-passwd.c b/auth2-passwd.c
-index be4b860..1d80481 100644
---- a/auth2-passwd.c
-+++ b/auth2-passwd.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: auth2-passwd.c,v 1.19 2020/10/18 11:32:01 djm Exp $ */
-+/* $OpenBSD: auth2-passwd.c,v 1.21 2022/05/27 04:29:40 dtucker Exp $ */
- /*
-  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
-  *
-@@ -51,16 +51,18 @@ extern ServerOptions options;
- static int
- userauth_passwd(struct ssh *ssh)
- {
--	char *password;
-+	char *password = NULL;
- 	int authenticated = 0, r;
- 	u_char change;
--	size_t len;
-+	size_t len = 0;
- 
- 	if ((r = sshpkt_get_u8(ssh, &change)) != 0 ||
- 	    (r = sshpkt_get_cstring(ssh, &password, &len)) != 0 ||
- 	    (change && (r = sshpkt_get_cstring(ssh, NULL, NULL)) != 0) ||
--	    (r = sshpkt_get_end(ssh)) != 0)
-+	    (r = sshpkt_get_end(ssh)) != 0) {
-+		freezero(password, len);
- 		fatal_fr(r, "parse packet");
-+	}
- 
- 	if (change)
- 		logit("password change not supported");
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-ignore-SIGPIPE-earlier-in-main-specifically.patch Deleted

@@ -1,46 +0,0 @@
-From 96faa0de6c673a2ce84736eba37fc9fb723d9e5c Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Fri, 1 Jul 2022 00:36:30 +0000
-Subject: upstream: ignore SIGPIPE earlier in main(), specifically before
-
-muxclient() which performs operations that could cause one; Reported by Noam
-Lewis via bz3454, ok dtucker@
-
-OpenBSD-Commit-ID: 63d8e13276869eebac6d7a05d5a96307f9026e47
-
-Conflict:NA
-Reference:https://anongit.mindrot.org/openssh.git/patch/?id=96faa0de6c673a2ce84736eba37fc9fb723d9e5c
----
- ssh.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/ssh.c b/ssh.c
-index f55ff73..e987cd5 100644
---- a/ssh.c
-+++ b/ssh.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: ssh.c,v 1.569 2021/09/20 04:02:13 dtucker Exp $ */
-+/* $OpenBSD: ssh.c,v 1.575 2022/07/01 00:36:30 djm Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -1135,6 +1135,8 @@ main(int ac, char **av)
- 		}
- 	}
- 
-+	ssh_signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
-+
- 	/*
- 	 * Initialize "log" output.  Since we are the client all output
- 	 * goes to stderr unless otherwise specified by -y or -E.
-@@ -1660,7 +1662,6 @@ main(int ac, char **av)
- 	    options.num_system_hostfiles);
- 	tilde_expand_paths(options.user_hostfiles, options.num_user_hostfiles);
- 
--	ssh_signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
- 	ssh_signal(SIGCHLD, main_sigchld_handler);
- 
- 	/* Log into the remote system.  Never returns if the login fails. */
--- 
-2.33.0
-

_service:tar_scm:backport-upstream-ssh-keygen-Y-check-novalidate-requires-name.patch Deleted

@@ -1,41 +0,0 @@
-From a0b5816f8f1f645acdf74f7bc11b34455ec30bac Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Fri, 18 Mar 2022 02:31:25 +0000
-Subject: PATCH upstream: ssh-keygen -Y check-novalidate requires namespace
- or SEGV
-
-will ensue. Patch from Mateusz Adamowski via GHPR#307
-
-OpenBSD-Commit-ID: 99e8ec38f9feb38bce6de240335be34aedeba5fd
-Reference:https://github.com/openssh/openssh-portable/commit/a0b5816f8f1f645acdf74f7bc11b34455ec30bac
-Conflict:NA
----
- ssh-keygen.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/ssh-keygen.c b/ssh-keygen.c
-index 7fc616c..bd6ea16 100644
---- a/ssh-keygen.c
-+++ b/ssh-keygen.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: ssh-keygen.c,v 1.437 2021/09/08 03:23:44 djm Exp $ */
-+/* $OpenBSD: ssh-keygen.c,v 1.449 2022/03/18 02:31:25 djm Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -3489,6 +3489,12 @@ main(int argc, char **argv)
- 			return sig_sign(identity_file, cert_principals,
- 			    argc, argv);
- 		} else if (strncmp(sign_op, "check-novalidate", 16) == 0) {
-+            if (cert_principals == NULL ||
-+                *cert_principals == '\0') {
-+                error("Too few arguments for check-novalidate: "
-+                    "missing namespace");
-+                exit(1);
-+            }
- 			if (ca_key_path == NULL) {
- 				error("Too few arguments for check-novalidate: "
- 				    "missing signature file");
--- 
-2.23.0
-

_service:tar_scm:bugfix-openssh-add-option-check-username-splash.patch Changed

@@ -6,7 +6,6 @@
 add a check to inhibit username contains splash
 add an option 'CheckUserSplash' so that user can turn off
 this check
-
 ---
  auth2.c     | 4 +++-
  servconf.c  | 8 ++++++++
@@ -15,10 +14,10 @@
  4 files changed, 14 insertions(+), 1 deletion(-)
 
 diff --git a/auth2.c b/auth2.c
-index 4adc502..956b9cf 100644
+index 203ba01..284ea19 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -282,11 +282,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+@@ -281,11 +281,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
  	debug("userauth-request for user %s service %s method %s", user, service, method);
  	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -34,10 +33,10 @@
  		*style++ = 0;
  
 diff --git a/servconf.c b/servconf.c
-index 7001d56..76147f9 100644
+index d72fb62..6888971 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -195,6 +195,7 @@ initialize_server_options(ServerOptions *options)
+@@ -201,6 +201,7 @@ initialize_server_options(ServerOptions *options)
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->version_addendum = NULL;
@@ -45,7 +44,7 @@
  	options->fingerprint_hash = -1;
  	options->disable_forwarding = -1;
  	options->expose_userauth_info = -1;
-@@ -473,6 +474,8 @@ fill_default_server_options(ServerOptions *options)
+@@ -460,6 +461,8 @@ fill_default_server_options(ServerOptions *options)
  		options->ip_qos_bulk = IPTOS_DSCP_CS1;
  	if (options->version_addendum == NULL)
  		options->version_addendum = xstrdup("");
@@ -54,15 +53,15 @@
  	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
  		options->fwd_opts.streamlocal_bind_mask = 0177;
  	if (options->fwd_opts.streamlocal_bind_unlink == -1)
-@@ -574,6 +577,7 @@ typedef enum {
- 	sStreamLocalBindMask, sStreamLocalBindUnlink,
+@@ -553,6 +556,7 @@ typedef enum {
  	sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
  	sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider,
+ 	sRequiredRSASize,
 +	sCheckUserSplash,
  	sDeprecated, sIgnore, sUnsupported
  } ServerOpCodes;
  
-@@ -740,6 +744,7 @@ static struct {
+@@ -726,6 +730,7 @@ static struct {
  	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
  	{ "disableforwarding", sDisableForwarding, SSHCFG_ALL },
  	{ "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL },
@@ -70,7 +69,7 @@
  	{ "rdomain", sRDomain, SSHCFG_ALL },
  	{ "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
  	{ "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
-@@ -1360,6 +1365,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1384,6 +1389,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  	case sUsePAM:
  		intptr = &options->use_pam;
  		goto parse_flag;
@@ -81,30 +80,27 @@
  	/* Standard Options */
  	case sBadOption:
 diff --git a/servconf.h b/servconf.h
-index a3827e5..2c16b5a 100644
+index 77fd779..694addf 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -226,6 +226,7 @@ typedef struct {
+@@ -237,6 +237,7 @@ typedef struct {
  	int	fingerprint_hash;
  	int	expose_userauth_info;
  	u_int64_t timing_secret;
-+	int check_user_splash;      /* check whether splash exists in username, if exist, disable login */
++	int	check_user_splash;      /* check whether splash exists in username, if exist, disable login */
  	char   *sk_provider;
+ 	int	required_rsa_size;	/* minimum size of RSA keys */
  }       ServerOptions;
- 
 diff --git a/sshd_config b/sshd_config
-index ebc28b3..b121450 100644
+index 6d47368..973aecf 100644
 --- a/sshd_config
 +++ b/sshd_config
-@@ -125,6 +125,8 @@ Subsystem	sftp	/usr/libexec/sftp-server
- # Example of overriding settings on a per-user basis
- #Match User anoncvs
- #	X11Forwarding no
+@@ -128,3 +128,5 @@ Subsystem	sftp	/usr/libexec/sftp-server
  #	AllowTcpForwarding no
  #	PermitTTY no
  #	ForceCommand cvs server
 +#CheckUserSplash yes
 +
 -- 
-2.23.0
+2.27.0

_service:tar_scm:feature-add-SMx-support.patch Changed

@@ -18,12 +18,12 @@
  digest.h                              |   3 +-
  kex.c                                 |   1 +
  kex.h                                 |   3 +
- kexecdh.c                             |  22 ++-
+ kexecdh.c                             |  23 +-
  kexgen.c                              |   3 +
- kexsm2.c                              |  29 ++++
+ kexsm2.c                              | 406 ++++++++++++++++++++++++++
  mac.c                                 |   1 +
  pathnames.h                           |   1 +
- regress/agent.sh                      |   8 +
+ regress/agent.sh                      |   9 +
  regress/keytype.sh                    |   2 +
  regress/knownhosts-command.sh         |   1 +
  regress/misc/fuzz-harness/sig_fuzz.cc |   4 +
@@ -31,18 +31,18 @@
  ssh-ecdsa.c                           |   6 +-
  ssh-keygen.c                          |  12 +-
  ssh-keyscan.c                         |  12 +-
- ssh-sm2.c                             | 232 ++++++++++++++++++++++++++
+ ssh-sm2.c                             | 230 +++++++++++++++
  ssh_api.c                             |   2 +
  sshconnect2.c                         |   1 +
  sshd.c                                |   7 +
- sshkey.c                              |  62 ++++++-
+ sshkey.c                              |  62 +++-
  sshkey.h                              |   9 +
- 27 files changed, 417 insertions(+), 16 deletions(-)
+ 27 files changed, 794 insertions(+), 16 deletions(-)
  create mode 100644 kexsm2.c
  create mode 100644 ssh-sm2.c
 
 diff --git a/Makefile.in b/Makefile.in
-index 07bf440..fb8b006 100644
+index 07bf440..1393190 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -100,14 +100,14 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
@@ -50,7 +50,7 @@
  	readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \
  	atomicio.o dispatch.o mac.o misc.o utf8.o \
 -	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
-+	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o ssh-sm2.o \
++	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-sm2.o ssh-ecdsa-sk.o \
  	ssh-ed25519-sk.o ssh-rsa.o dh.o \
  	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
  	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
@@ -76,7 +76,7 @@
  	case KEY_ECDSA_SK_CERT:
  #endif
 diff --git a/authfile.c b/authfile.c
-index d7827ed..8990137 100644
+index 666730b..dce1e84 100644
 --- a/authfile.c
 +++ b/authfile.c
 @@ -343,6 +343,7 @@ sshkey_load_private_cert(int type, const char *filename, const char *passphrase,
@@ -88,31 +88,31 @@
  	case KEY_ED25519:
  	case KEY_XMSS:
 diff --git a/cipher.c b/cipher.c
-index b54b994..16bfdcb 100644
+index b54b994..039e414 100644
 --- a/cipher.c
 +++ b/cipher.c
 @@ -88,6 +88,7 @@ static const struct sshcipher ciphers = {
  #endif
  	{ "chacha20-poly1305@openssh.com",
  				8, 64, 0, 16, CFLAG_CHACHAPOLY, NULL },
-+	{ "sm4-ctr",		16, 16, 0, 0, 0, EVP_sm4_ctr },
++	{ "sm4-ctr",            16, 16, 0, 0, 0, EVP_sm4_ctr },
  	{ "none",		8, 0, 0, 0, CFLAG_NONE, NULL },
  
  	{ NULL,			0, 0, 0, 0, 0, NULL }
 diff --git a/digest-openssl.c b/digest-openssl.c
-index 94730e9..a93924b 100644
+index 94730e9..fa92360 100644
 --- a/digest-openssl.c
 +++ b/digest-openssl.c
 @@ -61,6 +61,7 @@ const struct ssh_digest digests = {
  	{ SSH_DIGEST_SHA256,	"SHA256",	32,	EVP_sha256 },
  	{ SSH_DIGEST_SHA384,	"SHA384",	48,	EVP_sha384 },
  	{ SSH_DIGEST_SHA512,	"SHA512",	64,	EVP_sha512 },
-+	{ SSH_DIGEST_SM3,	"SM3",		32,	EVP_sm3 },
++	{ SSH_DIGEST_SM3,       "SM3",          32,     EVP_sm3 },
  	{ -1,			NULL,		0,	NULL },
  };
  
 diff --git a/digest.h b/digest.h
-index c7ceeb3..e42affe 100644
+index c7ceeb3..520722c 100644
 --- a/digest.h
 +++ b/digest.h
 @@ -27,7 +27,8 @@
@@ -120,7 +120,7 @@
  #define SSH_DIGEST_SHA384	3
  #define SSH_DIGEST_SHA512	4
 -#define SSH_DIGEST_MAX		5
-+#define SSH_DIGEST_SM3		5
++#define SSH_DIGEST_SM3          5
 +#define SSH_DIGEST_MAX		6
  
  struct sshbuf;
@@ -159,7 +159,7 @@
  void	dump_digest(const char *, const u_char *, int);
  #endif
 diff --git a/kexecdh.c b/kexecdh.c
-index efb2e55..a780517 100644
+index efb2e55..69ec13b 100644
 --- a/kexecdh.c
 +++ b/kexecdh.c
 @@ -44,7 +44,7 @@
@@ -176,7 +176,7 @@
  		goto out;
  	if ((r = kex_ecdh_dec_key_group(kex, client_blob, server_key, group,
 -	    shared_secretp)) != 0)
-+	    shared_secretp, 0)) != 0)
++	    shared_secretp, 1)) != 0)
  		goto out;
  	*server_blobp = server_blob;
  	server_blob = NULL;
@@ -189,7 +189,7 @@
  {
  	struct sshbuf *buf = NULL;
  	BIGNUM *shared_secret = NULL;
-@@ -176,10 +176,18 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+@@ -176,11 +176,20 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
  		r = SSH_ERR_ALLOC_FAIL;
  		goto out;
  	}
@@ -209,14 +209,16 @@
 +			goto out;
 +		}
  	}
++
  #ifdef DEBUG_KEXECDH
  	dump_digest("shared secret", kbuf, klen);
-@@ -203,7 +211,7 @@ kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob,
+ #endif
+@@ -203,7 +212,7 @@ kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob,
  	int r;
  
  	r = kex_ecdh_dec_key_group(kex, server_blob, kex->ec_client_key,
 -	    kex->ec_group, shared_secretp);
-+	    kex->ec_group, shared_secretp, 1);
++	    kex->ec_group, shared_secretp, 0);
  	EC_KEY_free(kex->ec_client_key);
  	kex->ec_client_key = NULL;
  	return r;
@@ -250,17 +252,394 @@
  		break;
 diff --git a/kexsm2.c b/kexsm2.c
 new file mode 100644
-index 0000000..f9b8bb9
+index 0000000..f507557
 --- /dev/null
 +++ b/kexsm2.c
-@@ -0,0 +1,29 @@
+@@ -0,0 +1,406 @@
 +#include <openssl/err.h>
 +#include <openssl/evp.h>
 +#include <openssl/bn.h>
++#include <string.h>
 +#include <openssl/ecdh.h>
 +#include <openssl/ec.h>
-+#include <openssl/sm2.h>
-+#include <string.h>
++
++int sm2_compute_z_digest(uint8_t *out,
++                         const EVP_MD *digest,
++                         const uint8_t *id,
++                         const size_t id_len,
++                         const EC_KEY *key)
++{
++    int rc = 0;
++    const EC_GROUP *group = EC_KEY_get0_group(key);
++    BN_CTX *ctx = NULL;
++    EVP_MD_CTX *hash = NULL;
++    BIGNUM *p = NULL;
++    BIGNUM *a = NULL;
++    BIGNUM *b = NULL;
++    BIGNUM *xG = NULL;
++    BIGNUM *yG = NULL;
++    BIGNUM *xA = NULL;
++    BIGNUM *yA = NULL;
++    int p_bytes = 0;
++    uint8_t *buf = NULL;
++    uint16_t entl = 0;
++    uint8_t e_byte = 0;
++
++    hash = EVP_MD_CTX_new();
++    ctx = BN_CTX_new();
++    if (hash == NULL || ctx == NULL) {
++        goto done;
++    }
++
++    p = BN_CTX_get(ctx);
++    a = BN_CTX_get(ctx);
++    b = BN_CTX_get(ctx);
++    xG = BN_CTX_get(ctx);

_service:tar_scm:feature-openssh-7.4-hima-sftpserver-oom-and-fix.patch Changed

@@ -1,19 +1,20 @@
 From 6d98c61e18fe65a52e21df9cece74675f9c18125 Mon Sep 17 00:00:00 2001
-From: s00467541 <shenyining@huawei.com>
+From: shenyining <shenyining@huawei.com>
 Date: Thu, 16 Apr 2020 17:13:24 +0800
 Subject: PATCH sync patch, add new judgement and
  delete default sftp-put-check.cfg
 
-Signed-off-by: s00467541 <shenyining@huawei.com>
+Signed-off-by: shenyining <shenyining@huawei.com>
+
 ---
- sftp-server.c | 703 +++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 691 insertions(+), 12 deletions(-)
+ sftp-server.c | 702 +++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 690 insertions(+), 12 deletions(-)
 
 diff --git a/sftp-server.c b/sftp-server.c
-index 01d6f8f..682c19a 100644
+index 5677aa3..4eb06d1 100644
 --- a/sftp-server.c
 +++ b/sftp-server.c
-@@ -29,6 +29,12 @@
+@@ -30,6 +30,12 @@
  #include <sys/statvfs.h>
  #endif
  
@@ -26,7 +27,7 @@
  #include <dirent.h>
  #include <errno.h>
  #include <fcntl.h>
-@@ -51,6 +57,17 @@
+@@ -57,6 +63,17 @@
  #include "sftp.h"
  #include "sftp-common.h"
  
@@ -44,7 +45,7 @@
  char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
  
  /* Maximum data read that we are willing to accept */
-@@ -89,6 +106,452 @@ struct Stat {
+@@ -98,6 +115,452 @@ struct Stat {
  	Attrib attrib;
  };
  
@@ -497,7 +498,7 @@
  /* Packet handlers */
  static void process_open(u_int32_t id);
  static void process_close(u_int32_t id);
-@@ -695,6 +1158,15 @@ process_open(u_int32_t id)
+@@ -755,6 +1218,15 @@ process_open(u_int32_t id)
  	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
  	    (r = decode_attrib(iqueue, &a)) != 0)
  		fatal_fr(r, "parse");
@@ -513,7 +514,7 @@
  
  	debug3("request %u: open flags %d", id, pflags);
  	flags = flags_from_portable(pflags);
-@@ -728,6 +1200,8 @@ process_open(u_int32_t id)
+@@ -788,6 +1260,8 @@ process_open(u_int32_t id)
  		(void) umask(old_umask); /* restore umask to something sane */
  	if (status != SSH2_FX_OK)
  		send_status(id, status);
@@ -522,7 +523,7 @@
  	free(name);
  }
  
-@@ -759,6 +1233,17 @@ process_read(u_int32_t id)
+@@ -820,6 +1294,17 @@ process_read(u_int32_t id)
  	    (r = sshbuf_get_u32(iqueue, &len)) != 0)
  		fatal_fr(r, "parse");
  
@@ -540,7 +541,7 @@
  	debug("request %u: read \"%s\" (handle %d) off %llu len %u",
  	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
  	if ((fd = handle_to_fd(handle)) == -1)
-@@ -800,6 +1285,18 @@ process_write(u_int32_t id)
+@@ -874,6 +1359,18 @@ process_write(u_int32_t id)
  	    (r = sshbuf_get_string(iqueue, &data, &len)) != 0)
  		fatal_fr(r, "parse");
  
@@ -559,7 +560,7 @@
  	debug("request %u: write \"%s\" (handle %d) off %llu len %zu",
  	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
  	fd = handle_to_fd(handle);
-@@ -813,17 +1310,30 @@ process_write(u_int32_t id)
+@@ -888,17 +1385,30 @@ process_write(u_int32_t id)
  			    strerror(errno));
  		} else {
  /* XXX ATOMICIO ? */
@@ -600,7 +601,7 @@
  			}
  		}
  	}
-@@ -841,6 +1352,16 @@ process_do_stat(u_int32_t id, int do_lstat)
+@@ -917,6 +1427,16 @@ process_do_stat(u_int32_t id, int do_lstat)
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -617,7 +618,7 @@
  	debug3("request %u: %sstat", id, do_lstat ? "l" : "");
  	verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name);
  	r = do_lstat ? lstat(name, &st) : stat(name, &st);
-@@ -877,6 +1398,16 @@ process_fstat(u_int32_t id)
+@@ -953,6 +1473,16 @@ process_fstat(u_int32_t id)
  
  	if ((r = get_handle(iqueue, &handle)) != 0)
  		fatal_fr(r, "parse");
@@ -634,7 +635,7 @@
  	debug("request %u: fstat \"%s\" (handle %u)",
  	    id, handle_to_name(handle), handle);
  	fd = handle_to_fd(handle);
-@@ -929,6 +1460,14 @@ process_setstat(u_int32_t id)
+@@ -1005,6 +1535,14 @@ process_setstat(u_int32_t id)
  	    (r = decode_attrib(iqueue, &a)) != 0)
  		fatal_fr(r, "parse");
  
@@ -649,7 +650,7 @@
  	debug("request %u: setstat name \"%s\"", id, name);
  	if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
  		logit("set \"%s\" size %llu",
-@@ -983,6 +1522,13 @@ process_fsetstat(u_int32_t id)
+@@ -1059,6 +1597,13 @@ process_fsetstat(u_int32_t id)
  	else {
  		char *name = handle_to_name(handle);
  
@@ -663,7 +664,7 @@
  		if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
  			logit("set \"%s\" size %llu",
  			    name, (unsigned long long)a.size);
-@@ -1040,6 +1586,14 @@ process_opendir(u_int32_t id)
+@@ -1116,6 +1661,14 @@ process_opendir(u_int32_t id)
  	if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -678,18 +679,17 @@
  	debug3("request %u: opendir", id);
  	logit("opendir \"%s\"", path);
  	dirp = opendir(path);
-@@ -1094,6 +1648,10 @@ process_readdir(u_int32_t id)
+@@ -1170,6 +1723,9 @@ process_readdir(u_int32_t id)
  			    strcmp(path, "/") ? "/" : "", dp->d_name);
  			if (lstat(pathname, &st) == -1)
  				continue;
-+			if (RETURN_OK != path_permition_check(pathname,FLAG_PERMITOP))
-+                        {
-+                                continue;
-+                        }
++			if (RETURN_OK != path_permition_check(pathname,FLAG_PERMITOP)) {
++				continue;
++			}
  			stat_to_attrib(&st, &(statscount.attrib));
  			statscount.name = xstrdup(dp->d_name);
- 			statscount.long_name = ls_file(dp->d_name, &st, 0, 0);
-@@ -1125,6 +1683,14 @@ process_remove(u_int32_t id)
+ 			statscount.long_name = ls_file(dp->d_name, &st,
+@@ -1202,6 +1758,14 @@ process_remove(u_int32_t id)
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -704,7 +704,7 @@
  	debug3("request %u: remove", id);
  	logit("remove name \"%s\"", name);
  	r = unlink(name);
-@@ -1144,6 +1710,14 @@ process_mkdir(u_int32_t id)
+@@ -1221,6 +1785,14 @@ process_mkdir(u_int32_t id)
  	    (r = decode_attrib(iqueue, &a)) != 0)
  		fatal_fr(r, "parse");
  
@@ -719,7 +719,7 @@
  	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
  	    a.perm & 07777 : 0777;
  	debug3("request %u: mkdir", id);
-@@ -1163,6 +1737,14 @@ process_rmdir(u_int32_t id)
+@@ -1240,6 +1812,14 @@ process_rmdir(u_int32_t id)
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -734,7 +734,7 @@
  	debug3("request %u: rmdir", id);
  	logit("rmdir name \"%s\"", name);
  	r = rmdir(name);
-@@ -1187,8 +1769,12 @@ process_realpath(u_int32_t id)
+@@ -1264,8 +1844,12 @@ process_realpath(u_int32_t id)
  	}
  	debug3("request %u: realpath", id);
  	verbose("realpath \"%s\"", path);
@@ -749,7 +749,7 @@
  	} else {
  		Stat s;
  		attrib_clear(&s.attrib);
-@@ -1209,6 +1795,16 @@ process_rename(u_int32_t id)
+@@ -1286,6 +1870,16 @@ process_rename(u_int32_t id)
  	    (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -766,7 +766,7 @@
  	debug3("request %u: rename", id);
  	logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
  	status = SSH2_FX_FAILURE;

_service:tar_scm:openssh-5.8p2-sigpipe.patch Changed

_service:tar_scm:openssh-6.6.1p1-log-in-chroot.patch Changed

_service:tar_scm:openssh-6.6p1-keycat.patch Changed

@@ -1,3 +1,4 @@
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-6.6p1-keycat.patch
 diff -up openssh/misc.c.keycat openssh/misc.c
 --- openssh/misc.c.keycat	2015-06-24 10:57:50.158849606 +0200
 +++ openssh/misc.c	2015-06-24 11:04:23.989868638 +0200
@@ -61,13 +62,13 @@
  	ssh-xmss.o \
 @@ -190,6 +191,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
  ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
- 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
+ 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
  
 +ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
-+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
++	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS) $(CHANNELLIBS)
 +
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
  
 @@ -321,6 +325,7 @@ install-files:
  	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)

_service:tar_scm:openssh-6.7p1-coverity.patch Changed

@@ -1,41 +1,38 @@
-diff -up openssh-8.5p1/addr.c.coverity openssh-8.5p1/addr.c
---- openssh-8.5p1/addr.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/addr.c	2021-03-24 12:03:33.782968159 +0100
-@@ -312,8 +312,10 @@ addr_pton(const char *p, struct xaddr *n
- 	if (p == NULL || getaddrinfo(p, NULL, &hints, &ai) != 0)
- 		return -1;
- 
--	if (ai == NULL || ai->ai_addr == NULL)
-+	if (ai == NULL || ai->ai_addr == NULL) {
-+		freeaddrinfo(ai);
- 		return -1;
-+	}
- 
- 	if (n != NULL && addr_sa_to_xaddr(ai->ai_addr, ai->ai_addrlen,
- 	    n) == -1) {
-@@ -336,12 +338,16 @@ addr_sa_pton(const char *h, const char *
- 	if (h == NULL || getaddrinfo(h, s, &hints, &ai) != 0)
- 		return -1;
- 
--	if (ai == NULL || ai->ai_addr == NULL)
-+	if (ai == NULL || ai->ai_addr == NULL) {
-+		freeaddrinfo(ai);
- 		return -1;
-+	}
- 
- 	if (sa != NULL) {
--		if (slen < ai->ai_addrlen)
-+		if (slen < ai->ai_addrlen) {
-+			freeaddrinfo(ai);
- 			return -1;
-+		}
- 		memcpy(sa, &ai->ai_addr, ai->ai_addrlen);
- 	}
- 
-diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
---- openssh-8.5p1/auth-krb5.c.coverity	2021-03-24 12:03:33.724967756 +0100
-+++ openssh-8.5p1/auth-krb5.c	2021-03-24 12:03:33.782968159 +0100
-@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-6.7p1-coverity.patch
+
+---
+ auth-krb5.c                   | 2 ++
+ auth-options.c                | 1 +
+ channels.c                    | 6 ++++--
+ dns.c                         | 1 +
+ gss-genr.c                    | 3 ++-
+ kexgssc.c                     | 4 +++-
+ krl.c                         | 4 ++++
+ loginrec.c                    | 4 ++++
+ misc.c                        | 3 +++
+ moduli.c                      | 1 +
+ monitor.c                     | 4 ++--
+ monitor_wrap.c                | 6 +++---
+ openbsd-compat/bindresvport.c | 2 +-
+ openbsd-compat/bsd-pselect.c  | 8 ++++----
+ readconf.c                    | 1 +
+ scp.c                         | 4 ++--
+ servconf.c                    | 5 +++--
+ serverloop.c                  | 2 +-
+ session.c                     | 2 ++
+ sftp.c                        | 3 ++-
+ ssh-agent.c                   | 5 +++--
+ ssh-keygen.c                  | 7 +++++++
+ ssh.c                         | 1 +
+ sshd.c                        | 9 +++++++--
+ sshsig.c                      | 1 +
+ 25 files changed, 65 insertions(+), 24 deletions(-)
+
+diff --git a/auth-krb5.c b/auth-krb5.c
+index d80c3ab..71ea1e3 100644
+--- a/auth-krb5.c
++++ b/auth-krb5.c
+@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
  		umask(old_umask);
  		if (tmpfd == -1) {
  			logit("mkstemp(): %.100s", strerror(oerrno));
@@ -43,7 +40,7 @@
  			return oerrno;
  		}
  
-@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
+@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
  			oerrno = errno;
  			logit("fchmod(): %.100s", strerror(oerrno));
  			close(tmpfd);
@@ -51,10 +48,11 @@
  			return oerrno;
  		}
  		/* make sure the KRB5CCNAME is set for non-standard location */
-diff -up openssh-8.5p1/auth-options.c.coverity openssh-8.5p1/auth-options.c
---- openssh-8.5p1/auth-options.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/auth-options.c	2021-03-24 12:03:33.782968159 +0100
-@@ -706,6 +708,7 @@ serialise_array(struct sshbuf *m, char *
+diff --git a/auth-options.c b/auth-options.c
+index 7cb2a64..a4b1db4 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -723,6 +723,7 @@ serialise_array(struct sshbuf *m, char **a, size_t n)
  		return r;
  	}
  	/* success */
@@ -62,19 +60,11 @@
  	return 0;
  }
  
-diff -up openssh-7.4p1/channels.c.coverity openssh-7.4p1/channels.c
---- openssh-7.4p1/channels.c.coverity	2016-12-23 16:40:26.881788686 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 16:42:36.244818763 +0100
-@@ -1875,7 +1875,7 @@ channel_post_connecting(struct ssh *ssh,
- 		debug("channel %d: connection failed: %s",
- 		    c->self, strerror(err));
- 		/* Try next address, if any */
--		if ((sock = connect_next(&c->connect_ctx)) > 0) {
-+		if ((sock = connect_next(&c->connect_ctx)) >= 0) {
- 			close(c->sock);
- 			c->sock = c->rfd = c->wfd = sock;
- 			channel_find_maxfd(ssh->chanctxt);
-@@ -3804,7 +3804,7 @@ int
+diff --git a/channels.c b/channels.c
+index 300c753..ea4d8da 100644
+--- a/channels.c
++++ b/channels.c
+@@ -4081,7 +4081,7 @@ int
  channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  {
  	int r, success = 0, idx = -1;
@@ -83,7 +73,7 @@
  	int port_to_connect, listen_port;
  
  	/* Send the forward request to the remote side. */
-@@ -3832,7 +3832,6 @@ channel_request_remote_forwarding(struct
+@@ -4109,7 +4109,6 @@ channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  	success = 1;
  	if (success) {
  		/* Record that connection to this host/port is permitted. */
@@ -91,7 +81,7 @@
  		port_to_connect = listen_port = 0;
  		if (fwd->connect_path != NULL) {
  			host_to_connect = xstrdup(fwd->connect_path);
-@@ -3853,6 +3852,9 @@ channel_request_remote_forwarding(struct
+@@ -4130,6 +4129,9 @@ channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  		    host_to_connect, port_to_connect,
  		    listen_host, listen_path, listen_port, NULL);
  	}
@@ -101,37 +91,23 @@
  	return idx;
  }
  
-diff -up openssh-8.5p1/compat.c.coverity openssh-8.5p1/compat.c
---- openssh-8.5p1/compat.c.coverity	2021-03-24 12:03:33.768968062 +0100
-+++ openssh-8.5p1/compat.c	2021-03-24 12:03:33.783968166 +0100
-@@ -191,10 +191,12 @@ compat_kex_proposal(struct ssh *ssh, cha
- 		return p;
- 	debug2_f("original KEX proposal: %s", p);
- 	if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
-+		/* coverityoverwrite_var : FALSE */
- 		if ((p = match_filter_denylist(p,
- 		    "curve25519-sha256@libssh.org")) == NULL)
- 			fatal("match_filter_denylist failed");
- 	if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
-+		/* coverityoverwrite_var : FALSE */
- 		if ((p = match_filter_denylist(p,
- 		    "diffie-hellman-group-exchange-sha256,"
- 		    "diffie-hellman-group-exchange-sha1")) == NULL)
-diff -up openssh-8.5p1/dns.c.coverity openssh-8.5p1/dns.c
---- openssh-8.5p1/dns.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/dns.c	2021-03-24 12:03:33.783968166 +0100
-@@ -282,6 +282,7 @@ verify_host_key_dns(const char *hostname
-		    &hostkey_digest, &hostkey_digest_len, hostkey)) {
-			error("Error calculating key fingerprint.");
-			freerrset(fingerprints);
+diff --git a/dns.c b/dns.c
+index f2310be..15218f1 100644
+--- a/dns.c
++++ b/dns.c
+@@ -259,6 +259,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
+ 		    &hostkey_digest, &hostkey_digest_len, hostkey)) {
+ 			error("Error calculating key fingerprint.");
+ 			freerrset(fingerprints);
 +				free(dnskey_digest);
-			return -1;
-		}
-
-diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
---- openssh-8.5p1/gss-genr.c.coverity	2021-03-26 11:52:46.613942552 +0100
-+++ openssh-8.5p1/gss-genr.c	2021-03-26 11:54:37.881726318 +0100
-@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
+ 			return -1;
+ 		}
+ 
+diff --git a/gss-genr.c b/gss-genr.c
+index 9f9745b..810b382 100644
+--- a/gss-genr.c
++++ b/gss-genr.c
+@@ -168,8 +168,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
  			enclen = __b64_ntop(digest,
  			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
  			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
@@ -142,9 +118,10 @@

_service:tar_scm:openssh-7.3p1-x11-max-displays.patch Changed

@@ -1,7 +1,19 @@
-diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
---- openssh-7.4p1/channels.c.x11max	2016-12-23 15:46:32.071506625 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 15:46:32.139506636 +0100
-@@ -152,8 +152,8 @@ static int all_opens_permitted = 0;
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.3p1-x11-max-displays.patch
+
+---
+ channels.c    | 23 ++++++++++++++---------
+ channels.h    |  2 +-
+ servconf.c    | 12 +++++++++++-
+ servconf.h    |  2 ++
+ session.c     |  5 +++--
+ sshd_config.5 |  7 +++++++
+ 6 files changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/channels.c b/channels.c
+index 7230540..040a4c6 100644
+--- a/channels.c
++++ b/channels.c
+@@ -101,8 +101,8 @@
  #define FWD_PERMIT_ANY_HOST	"*"
  
  /* -- X11 forwarding */
@@ -10,9 +22,9 @@
 +/* Minimum port number for X11 forwarding */
 +#define X11_PORT_MIN 6000
  
- /* Per-channel callback for pre/post select() actions */
- typedef void chan_fn(struct ssh *, Channel *c,
-@@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
+ /* Per-channel callback for pre/post IO actions */
+ typedef void chan_fn(struct ssh *, Channel *c);
+@@ -4801,7 +4801,7 @@ rdynamic_connect_finish(struct ssh *ssh, Channel *c)
   */
  int
  x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
@@ -21,7 +33,7 @@
      u_int *display_numberp, int **chanids)
  {
  	Channel *nc = NULL;
-@@ -4240,10 +4241,15 @@ x11_create_display_inet(int x11_display_
+@@ -4814,10 +4814,15 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  	if (chanids == NULL)
  		return -1;
  
@@ -39,7 +51,7 @@
  		memset(&hints, 0, sizeof(hints));
  		hints.ai_family = ssh->chanctxt->IPv4or6;
  		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
-@@ -4295,7 +4301,7 @@ x11_create_display_inet(int x11_display_
+@@ -4870,7 +4875,7 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  		if (num_socks > 0)
  			break;
  	}
@@ -48,7 +60,7 @@
  		error("Failed to allocate internet-domain X11 display socket.");
  		return -1;
  	}
-@@ -4441,7 +4447,7 @@ x11_connect_display(void)
+@@ -5054,7 +5059,7 @@ x11_connect_display(struct ssh *ssh)
  	memset(&hints, 0, sizeof(hints));
  	hints.ai_family = ssh->chanctxt->IPv4or6;
  	hints.ai_socktype = SOCK_STREAM;
@@ -57,7 +69,7 @@
  	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
  		error("%.100s: unknown host. (%s)", buf,
  		ssh_gai_strerror(gaierr));
-@@ -4457,7 +4463,7 @@ x11_connect_display(void)
+@@ -5070,7 +5075,7 @@ x11_connect_display(struct ssh *ssh)
  		/* Connect it to the display. */
  		if (connect(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
  			debug2("connect %.100s port %u: %.100s", buf,
@@ -66,21 +78,20 @@
  			close(sock);
  			continue;
  		}
-@@ -4466,8 +4472,8 @@ x11_connect_display(void)
- 	}
+@@ -5080,7 +5085,7 @@ x11_connect_display(struct ssh *ssh)
  	freeaddrinfo(aitop);
  	if (!ai) {
--		error("connect %.100s port %u: %.100s", buf,
+ 		error("connect %.100s port %u: %.100s", buf,
 -		    6000 + display_number, strerror(errno));
-+		error("connect %.100s port %u: %.100s", buf,
 +		    X11_PORT_MIN + display_number, strerror(errno));
  		return -1;
  	}
  	set_nodelay(sock);
-diff -up openssh-7.4p1/channels.h.x11max openssh-7.4p1/channels.h
---- openssh-7.4p1/channels.h.x11max	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/channels.h	2016-12-23 15:46:32.139506636 +0100
-@@ -293,7 +293,7 @@ int	 permitopen_port(const char *);
+diff --git a/channels.h b/channels.h
+index 828c1b6..7d8a83e 100644
+--- a/channels.h
++++ b/channels.h
+@@ -361,7 +361,7 @@ int	 permitopen_port(const char *);
  
  void	 channel_set_x11_refuse_time(struct ssh *, u_int);
  int	 x11_connect_display(struct ssh *);
@@ -89,10 +100,11 @@
  void	 x11_request_forwarding_with_spoofing(struct ssh *, int,
  	    const char *, const char *, const char *, int);
  
-diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
---- openssh-7.4p1/servconf.c.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:47:27.320519121 +0100
-@@ -95,6 +95,7 @@ initialize_server_options(ServerOptions
+diff --git a/servconf.c b/servconf.c
+index 13c4a08..fdba127 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -115,6 +115,7 @@ initialize_server_options(ServerOptions *options)
  	options->print_lastlog = -1;
  	options->x11_forwarding = -1;
  	options->x11_display_offset = -1;
@@ -100,7 +112,7 @@
  	options->x11_use_localhost = -1;
  	options->permit_tty = -1;
  	options->permit_user_rc = -1;
-@@ -243,6 +244,8 @@ fill_default_server_options(ServerOption
+@@ -330,6 +331,8 @@ fill_default_server_options(ServerOptions *options)
  		options->x11_forwarding = 0;
  	if (options->x11_display_offset == -1)
  		options->x11_display_offset = 10;
@@ -109,7 +121,7 @@
  	if (options->x11_use_localhost == -1)
  		options->x11_use_localhost = 1;
  	if (options->xauth_location == NULL)
-@@ -419,7 +422,7 @@ typedef enum {
+@@ -518,7 +521,7 @@ typedef enum {
  	sPasswordAuthentication,
  	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
  	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
@@ -118,7 +130,7 @@
  	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
  	sPermitUserEnvironment, sAllowTcpForwarding, sCompression,
  	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
-@@ -540,6 +543,7 @@ static struct {
+@@ -652,6 +655,7 @@ static struct {
  	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
  	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
  	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
@@ -126,7 +138,7 @@
  	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
  	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
  	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
-@@ -1316,6 +1320,10 @@ process_server_config_line(ServerOptions
+@@ -1680,6 +1684,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  			*intptr = value;
  		break;
  
@@ -137,7 +149,7 @@
  	case sX11UseLocalhost:
  		intptr = &options->x11_use_localhost;
  		goto parse_flag;
-@@ -2063,6 +2071,7 @@ copy_set_server_options(ServerOptions *d
+@@ -2678,6 +2686,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
  	M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
  	M_CP_INTOPT(x11_display_offset);
  	M_CP_INTOPT(x11_forwarding);
@@ -145,7 +157,7 @@
  	M_CP_INTOPT(x11_use_localhost);
  	M_CP_INTOPT(permit_tty);
  	M_CP_INTOPT(permit_user_rc);
-@@ -2315,6 +2324,7 @@ dump_config(ServerOptions *o)
+@@ -2953,6 +2962,7 @@ dump_config(ServerOptions *o)
  #endif
  	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
  	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
@@ -153,10 +165,11 @@
  	dump_cfg_int(sMaxAuthTries, o->max_authtries);
  	dump_cfg_int(sMaxSessions, o->max_sessions);
  	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
-diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
---- openssh-7.4p1/servconf.h.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 15:46:32.140506636 +0100
-@@ -55,6 +55,7 @@
+diff --git a/servconf.h b/servconf.h
+index 37d3a6f..77fd779 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -45,6 +45,7 @@
  
  #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
  #define DEFAULT_SESSIONS_MAX	10	/* Default for MaxSessions */
@@ -164,7 +177,7 @@
  
  /* Magic name for internal sftp-server */
  #define INTERNAL_SFTP_NAME	"internal-sftp"
-@@ -85,6 +86,7 @@ typedef struct {
+@@ -105,6 +106,7 @@ typedef struct {
  	int     x11_forwarding;	/* If true, permit inet (spoofing) X11 fwd. */
  	int     x11_display_offset;	/* What DISPLAY number to start
  					 * searching at */
@@ -172,13 +185,14 @@
  	int     x11_use_localhost;	/* If true, use localhost for fake X11 server. */
  	char   *xauth_location;	/* Location of xauth program */

_service:tar_scm:openssh-7.4p1-systemd.patch Changed

@@ -1,16 +1,19 @@
-commit 0e22b79bfde45a7cf7a2e51a68ec11c4285f3b31
-Author: Jakub Jelen <jjelen@redhat.com>
-Date:   Mon Nov 21 15:04:06 2016 +0100
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.4p1-systemd.patch
 
-    systemd stuff
+---
+ configure.ac         | 24 ++++++++++++++++++++++++
+ contrib/sshd.service | 16 ++++++++++++++++
+ sshd.c               |  9 +++++++++
+ 3 files changed, 49 insertions(+)
+ create mode 100644 contrib/sshd.service
 
 diff --git a/configure.ac b/configure.ac
-index 2ffc369..162ce92 100644
+index bbe133e..6f7dc48 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4265,6 +4265,30 @@ AC_ARG_WITH(kerberos5,
- AC_SUBST(GSSLIBS)
+@@ -4822,6 +4822,29 @@ AC_SUBST(GSSLIBS)
  AC_SUBST(K5LIBS)
+ AC_SUBST(CHANNELLIBS)
  
 +# Check whether user wants systemd support
 +SYSTEMD_MSG="no"
@@ -35,11 +38,10 @@
 +	fi 
 +)
 +
-+
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -5097,6 +5121,7 @@ echo "                   libedit support: $LIBEDIT_MSG"
+@@ -5621,6 +5644,7 @@ echo "                   libldns support: $LDNS_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
  echo "         Solaris privilege support: $SPP_MSG"
@@ -70,10 +72,10 @@
 +WantedBy=multi-user.target
 +
 diff --git a/sshd.c b/sshd.c
-index 816611c..b8b9d13 100644
+index 0d4cfef..2a9b96d 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -85,6 +85,10 @@
+@@ -88,6 +88,10 @@
  #include <prot.h>
  #endif
  
@@ -84,7 +86,7 @@
  #include "xmalloc.h"
  #include "ssh.h"
  #include "ssh2.h"
-@@ -1888,6 +1892,11 @@ main(int ac, char **av)
+@@ -2121,6 +2125,11 @@ main(int ac, char **av)
  			}
  		}
  
@@ -96,3 +98,6 @@
  		/* Accept a connection and return in a forked child */
  		server_accept_loop(&sock_in, &sock_out,
  		    &newsock, config_s);
+-- 
+2.27.0
+

_service:tar_scm:openssh-7.6p1-audit.patch Changed

@@ -1,7 +1,55 @@
-diff -up openssh-8.6p1/audit-bsm.c.audit openssh-8.6p1/audit-bsm.c
---- openssh-8.6p1/audit-bsm.c.audit	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/audit-bsm.c	2021-04-19 16:47:35.753062106 +0200
-@@ -373,13 +373,26 @@ audit_connection_from(const char *host,
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.6p1-audit.patch
+
+---
+ Makefile.in       |   2 +-
+ audit-bsm.c       |  45 ++++++-
+ audit-linux.c     | 301 +++++++++++++++++++++++++++++++++++++++++++---
+ audit.c           | 129 ++++++++++++++++++--
+ audit.h           |  22 +++-
+ auditstub.c       |  52 ++++++++
+ auth.c            |   3 -
+ auth.h            |   5 +
+ auth2-hostbased.c |  16 ++-
+ auth2-pubkey.c    |  16 ++-
+ auth2.c           |   3 -
+ cipher.c          |  21 +---
+ cipher.h          |  20 ++-
+ kex.c             |  61 ++++++++--
+ kex.h             |   2 +
+ mac.c             |  14 +++
+ mac.h             |   1 +
+ monitor.c         | 194 ++++++++++++++++++++++++++++--
+ monitor.h         |   8 +-
+ monitor_wrap.c    | 130 +++++++++++++++++++-
+ monitor_wrap.h    |  11 +-
+ packet.c          |  98 +++++++++++++--
+ packet.h          |   1 +
+ session.c         |  84 +++++++++++--
+ session.h         |  10 +-
+ sshd.c            | 103 +++++++++++++---
+ sshkey.c          |  32 +++++
+ sshkey.h          |   1 +
+ 28 files changed, 1274 insertions(+), 111 deletions(-)
+ create mode 100644 auditstub.c
+
+diff --git a/Makefile.in b/Makefile.in
+index 45f7a93..9b4c06b 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -114,7 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	kexsntrup761x25519.o sntrup761.o kexgen.o \
+ 	kexgssc.o \
+ 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
+-	sshbuf-io.o
++	sshbuf-io.o auditstub.o
+ 
+ SKOBJS=	ssh-sk-client.o
+ 
+diff --git a/audit-bsm.c b/audit-bsm.c
+index ccfcf6f..a49abb9 100644
+--- a/audit-bsm.c
++++ b/audit-bsm.c
+@@ -373,12 +373,25 @@ audit_connection_from(const char *host, int port)
  #endif
  }
  
@@ -19,17 +67,16 @@
  	/* not implemented */
  }
  
- void
++void
 +audit_count_session_open(void)
 +{
 +	/* not necessary */
 +}
 +
-+void
+ void
  audit_session_open(struct logininfo *li)
  {
- 	/* not implemented */
-@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li
+@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li)
  	/* not implemented */
  }
  
@@ -42,7 +89,7 @@
  void
  audit_event(struct ssh *ssh, ssh_audit_event_t event)
  {
-@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
+@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_event_t event)
  		debug("%s: unhandled event %d", __func__, event);
  	}
  }
@@ -71,234 +118,10 @@
 +	/* not implemented */
 +}
  #endif /* BSM */
-diff -up openssh-8.6p1/audit.c.audit openssh-8.6p1/audit.c
---- openssh-8.6p1/audit.c.audit	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/audit.c	2021-04-19 16:47:35.753062106 +0200
-@@ -34,6 +34,12 @@
- #include "log.h"
- #include "hostfile.h"
- #include "auth.h"
-+#include "ssh-gss.h"
-+#include "monitor_wrap.h"
-+#include "xmalloc.h"
-+#include "misc.h"
-+#include "servconf.h"
-+#include "ssherr.h"
- 
- /*
-  * Care must be taken when using this since it WILL NOT be initialized when
-@@ -41,6 +47,7 @@
-  * audit_event(CONNECTION_ABANDON) is called.  Test for NULL before using.
-  */
- extern Authctxt *the_authctxt;
-+extern ServerOptions options;
- 
- /* Maybe add the audit class to struct Authmethod? */
- ssh_audit_event_t
-@@ -69,13 +76,10 @@ audit_classify_auth(const char *method)
- const char *
- audit_username(void)
- {
--	static const char unknownuser = "(unknown user)";
--	static const char invaliduser = "(invalid user)";
-+	static const char unknownuser = "(unknown)";
- 
--	if (the_authctxt == NULL || the_authctxt->user == NULL)
-+	if (the_authctxt == NULL || the_authctxt->user == NULL || !the_authctxt->valid)
- 		return (unknownuser);
--	if (!the_authctxt->valid)
--		return (invaliduser);
- 	return (the_authctxt->user);
- }
- 
-@@ -109,6 +113,35 @@ audit_event_lookup(ssh_audit_event_t ev)
- 	return(event_lookupi.name);
- }
- 
-+void
-+audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
-+{
-+	char *fp;
-+
-+	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
-+	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
-+		*rv = -SSH_ERR_INTERNAL_ERROR;
-+	free(fp);
-+}
-+
-+void
-+audit_unsupported(struct ssh *ssh, int what)
-+{
-+	PRIVSEP(audit_unsupported_body(ssh, what));
-+}
-+
-+void
-+audit_kex(struct ssh *ssh, int ctos, char *enc, char *mac, char *comp, char *pfs)
-+{
-+	PRIVSEP(audit_kex_body(ssh, ctos, enc, mac, comp, pfs, getpid(), getuid()));
-+}
-+
-+void
-+audit_session_key_free(struct ssh *ssh, int ctos)
-+{
-+	PRIVSEP(audit_session_key_free_body(ssh, ctos, getpid(), getuid()));
-+}
-+
- # ifndef CUSTOM_SSH_AUDIT_EVENTS
- /*
-  * Null implementations of audit functions.
-@@ -138,6 +171,17 @@ audit_event(struct ssh *ssh, ssh_audit_e
- }
- 
- /*
-+ * Called when a child process has called, or will soon call,
-+ * audit_session_open.
-+ */
-+void
-+audit_count_session_open(void)
-+{
-+	debug("audit count session open euid %d user %s", geteuid(),
-+	      audit_username());
-+}
-+
-+/*
-  * Called when a user session is started.  Argument is the tty allocated to
-  * the session, or NULL if no tty was allocated.
-  *
-@@ -172,13 +216,82 @@ audit_session_close(struct logininfo *li
- /*
-  * This will be called when a user runs a non-interactive command.  Note that
-  * it may be called multiple times for a single connection since SSH2 allows
-- * multiple sessions within a single connection.
-+ * multiple sessions within a single connection.  Returns a "handle" for
-+ * audit_end_command.
-  */
--void
--audit_run_command(const char *command)
-+int
-+audit_run_command(struct ssh *ssh, const char *command)

_service:tar_scm:openssh-7.7p1-fips.patch Changed

@@ -1,25 +1,21 @@
-diff -up openssh-8.6p1/cipher-ctr.c.fips openssh-8.6p1/cipher-ctr.c
---- openssh-8.6p1/cipher-ctr.c.fips	2021-04-19 16:53:02.994577324 +0200
-+++ openssh-8.6p1/cipher-ctr.c	2021-04-19 16:53:03.064577862 +0200
-@@ -179,7 +179,8 @@ evp_aes_128_ctr(void)
- 	aes_ctr.do_cipher = ssh_aes_ctr;
- #ifndef SSH_OLD_EVP
- 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
--	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
-+	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV |
-+	    EVP_CIPH_FLAG_FIPS;
- #endif
- 	return (&aes_ctr);
- }
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.7p1-fips.patch
 diff -up openssh-8.6p1/dh.c.fips openssh-8.6p1/dh.c
 --- openssh-8.6p1/dh.c.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/dh.c	2021-04-19 16:58:47.750263410 +0200
++++ openssh-8.6p1/dh.c	2021-05-06 12:12:10.107634472 +0200
+@@ -36,6 +36,7 @@
+ 
+ #include <openssl/bn.h>
+ #include <openssl/dh.h>
++#include <openssl/fips.h>
+ 
+ #include "dh.h"
+ #include "pathnames.h"
 @@ -164,6 +164,12 @@ choose_dh(int min, int wantbits, int max
  	int best, bestcount, which, linenum;
  	struct dhgroup dhg;
  
 +	if (FIPS_mode()) {
-+		logit("Using arbitrary primes is not allowed in FIPS mode."
++		verbose("Using arbitrary primes is not allowed in FIPS mode."
 +		    " Falling back to known groups.");
 +		return (dh_new_group_fallback(max));
 +	}
@@ -67,8 +63,8 @@
 +
  #endif /* WITH_OPENSSL */
 diff -up openssh-8.6p1/dh.h.fips openssh-8.6p1/dh.h
---- openssh-8.6p1/dh.h.fips	2021-04-19 16:53:03.064577862 +0200
-+++ openssh-8.6p1/dh.h	2021-04-19 16:59:31.951616078 +0200
+--- openssh-8.6p1/dh.h.fips	2021-05-06 12:08:36.498926877 +0200
++++ openssh-8.6p1/dh.h	2021-05-06 12:11:28.393298005 +0200
 @@ -45,6 +45,7 @@ DH	*dh_new_group_fallback(int);
  
  int	 dh_gen_key(DH *, int);
@@ -78,8 +74,16 @@
  u_int	 dh_estimate(int);
  void	 dh_set_moduli_file(const char *);
 diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c
---- openssh-8.6p1/kex.c.fips	2021-04-19 16:53:03.058577815 +0200
-+++ openssh-8.6p1/kex.c	2021-04-19 16:53:03.065577869 +0200
+--- openssh-8.6p1/kex.c.fips	2021-05-06 12:08:36.489926807 +0200
++++ openssh-8.6p1/kex.c	2021-05-06 12:08:36.498926877 +0200
+@@ -39,6 +39,7 @@
+ 
+ #ifdef WITH_OPENSSL
+ #include <openssl/crypto.h>
++#include <openssl/fips.h>
+ #include <openssl/dh.h>
+ # ifdef HAVE_EVP_KDF_CTX_NEW_ID
+ # include <openssl/kdf.h>
 @@ -203,7 +203,10 @@ kex_names_valid(const char *names)
  	for ((p = strsep(&cp, ",")); p && *p != '\0';
  	    (p = strsep(&cp, ","))) {
@@ -94,12 +98,12 @@
  		}
 diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c
 --- openssh-8.6p1/kexgexc.c.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/kexgexc.c	2021-04-19 16:53:03.065577869 +0200
++++ openssh-8.6p1/kexgexc.c	2021-05-06 12:08:36.498926877 +0200
 @@ -28,6 +28,7 @@
  
  #ifdef WITH_OPENSSL
  
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  #include <sys/types.h>
  
  #include <openssl/dh.h>
@@ -116,7 +120,7 @@
  	/* generate and send 'e', client DH public key */
 diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h
 --- openssh-8.6p1/myproposal.h.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/myproposal.h	2021-04-19 16:53:03.065577869 +0200
++++ openssh-8.6p1/myproposal.h	2021-05-06 12:08:36.498926877 +0200
 @@ -57,6 +57,18 @@
  	"rsa-sha2-512," \
  	"rsa-sha2-256"
@@ -131,7 +135,7 @@
 +	"ecdsa-sha2-nistp384," \
 +	"ecdsa-sha2-nistp521," \
 +	"rsa-sha2-512," \
-+	"rsa-sha2-256," \
++	"rsa-sha2-256"
 +
  #define	KEX_SERVER_ENCRYPT \
  	"chacha20-poly1305@openssh.com," \
@@ -165,8 +169,16 @@
  #define	SSH_ALLOWED_CA_SIGALGS	\
  	"ssh-ed25519," \
 diff -up openssh-8.6p1/readconf.c.fips openssh-8.6p1/readconf.c
---- openssh-8.6p1/readconf.c.fips	2021-04-19 16:53:02.999577362 +0200
-+++ openssh-8.6p1/readconf.c	2021-04-19 16:53:03.065577869 +0200
+--- openssh-8.6p1/readconf.c.fips	2021-05-06 12:08:36.428926336 +0200
++++ openssh-8.6p1/readconf.c	2021-05-06 12:08:36.499926885 +0200
+@@ -39,6 +39,7 @@
+ #include <string.h>
+ #include <stdarg.h>
+ #include <unistd.h>
++#include <openssl/fips.h>
+ #ifdef USE_SYSTEM_GLOB
+ # include <glob.h>
+ #else
 @@ -2538,11 +2538,16 @@ fill_default_options(Options * options)
  	all_key = sshkey_alg_list(0, 0, 1, ',');
  	all_sig = sshkey_alg_list(0, 1, 1, ',');
@@ -190,8 +202,8 @@
  	do { \
  		if ((r = kex_assemble_names(&options->what, \
 diff -up openssh-8.6p1/sandbox-seccomp-filter.c.fips openssh-8.6p1/sandbox-seccomp-filter.c
---- openssh-8.6p1/sandbox-seccomp-filter.c.fips	2021-04-19 16:53:03.034577631 +0200
-+++ openssh-8.6p1/sandbox-seccomp-filter.c	2021-04-19 16:53:03.065577869 +0200
+--- openssh-8.6p1/sandbox-seccomp-filter.c.fips	2021-05-06 12:08:36.463926606 +0200
++++ openssh-8.6p1/sandbox-seccomp-filter.c	2021-05-06 12:08:36.499926885 +0200
 @@ -160,6 +160,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_open
  	SC_DENY(__NR_open, EACCES),
@@ -203,8 +215,16 @@
  	SC_DENY(__NR_openat, EACCES),
  #endif
 diff -up openssh-8.6p1/servconf.c.fips openssh-8.6p1/servconf.c
---- openssh-8.6p1/servconf.c.fips	2021-04-19 16:53:03.027577577 +0200
-+++ openssh-8.6p1/servconf.c	2021-04-19 16:53:03.066577877 +0200
+--- openssh-8.6p1/servconf.c.fips	2021-05-06 12:08:36.455926545 +0200
++++ openssh-8.6p1/servconf.c	2021-05-06 12:08:36.500926893 +0200
+@@ -38,6 +38,7 @@
+ #include <limits.h>
+ #include <stdarg.h>
+ #include <errno.h>
++#include <openssl/fips.h>
+ #ifdef HAVE_UTIL_H
+ #include <util.h>
+ #endif
 @@ -226,11 +226,16 @@ assemble_algorithms(ServerOptions *o)
  	all_key = sshkey_alg_list(0, 0, 1, ',');
  	all_sig = sshkey_alg_list(0, 1, 1, ',');
@@ -228,13 +248,13 @@
  	do { \
  		if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
 diff -up openssh-8.6p1/ssh.c.fips openssh-8.6p1/ssh.c
---- openssh-8.6p1/ssh.c.fips	2021-04-19 16:53:03.038577662 +0200
-+++ openssh-8.6p1/ssh.c	2021-04-19 16:53:03.066577877 +0200
+--- openssh-8.6p1/ssh.c.fips	2021-05-06 12:08:36.467926637 +0200
++++ openssh-8.6p1/ssh.c	2021-05-06 12:08:36.500926893 +0200
 @@ -77,6 +77,7 @@
  #include <openssl/evp.h>
  #include <openssl/err.h>
  #endif
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  #include "openbsd-compat/openssl-compat.h"
  #include "openbsd-compat/sys-queue.h"
  
@@ -250,13 +270,13 @@
  	if (options.sk_provider != NULL && *options.sk_provider == '$' &&
  	    strlen(options.sk_provider) > 1) {
 diff -up openssh-8.6p1/sshconnect2.c.fips openssh-8.6p1/sshconnect2.c
---- openssh-8.6p1/sshconnect2.c.fips	2021-04-19 16:53:03.055577792 +0200
-+++ openssh-8.6p1/sshconnect2.c	2021-04-19 16:53:03.066577877 +0200
+--- openssh-8.6p1/sshconnect2.c.fips	2021-05-06 12:08:36.485926777 +0200
++++ openssh-8.6p1/sshconnect2.c	2021-05-06 12:08:36.501926900 +0200
 @@ -45,6 +45,8 @@
  #include <vis.h>
  #endif
  
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
 +
  #include "openbsd-compat/sys-queue.h"
  
@@ -331,10 +351,10 @@
  	}
  #endif
 diff -up openssh-8.6p1/sshd.c.fips openssh-8.6p1/sshd.c
---- openssh-8.6p1/sshd.c.fips	2021-04-19 16:53:03.060577831 +0200
-+++ openssh-8.6p1/sshd.c	2021-04-19 16:57:45.827769340 +0200
+--- openssh-8.6p1/sshd.c.fips	2021-05-06 12:08:36.493926838 +0200
++++ openssh-8.6p1/sshd.c	2021-05-06 12:13:56.501492639 +0200
 @@ -66,6 +66,7 @@
- #include <grp.h>
+ #endif
  #include <pwd.h>
  #include <signal.h>
 +#include <syslog.h>
@@ -345,7 +365,7 @@
  #include <openssl/dh.h>
  #include <openssl/bn.h>

_service:tar_scm:openssh-7.8p1-UsePAM-warning.patch Changed

@@ -1,13 +1,14 @@
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.8p1-UsePAM-warning.patch
 diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
 --- openssh-8.6p1/sshd.c.log-usepam-no	2021-04-19 14:00:45.099735129 +0200
 +++ openssh-8.6p1/sshd.c	2021-04-19 14:03:21.140920974 +0200
 @@ -1749,6 +1749,10 @@ main(int ac, char **av)
  	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL);
+ 	    cfg, &includes, NULL, rexeced_flag);
  
-+	/* 'UsePAM no' is not supported in Fedora */
++	/* 'UsePAM no' is not supported in openEuler */
 +	if (! options.use_pam)
-+		logit("WARNING: 'UsePAM no' is not supported in Fedora and may cause several problems.");
++		logit("WARNING: 'UsePAM no' is not supported in openEuler and may cause several problems.");
 +
  #ifdef WITH_OPENSSL
  	if (options.moduli_file != NULL)
@@ -19,7 +20,7 @@
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and KbdInteractiveAuthentication to 'no'.
-+# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
++# WARNING: 'UsePAM no' is not supported in openEuler and may cause several
 +# problems.
  #UsePAM no

_service:tar_scm:openssh-7.8p1-role-mls.patch Changed

_service:tar_scm:openssh-8.0p1-crypto-policies.patch Changed

@@ -1,13 +1,14 @@
-diff -up openssh-8.7p1/ssh_config.5.crypto-policies openssh-8.7p1/ssh_config.5
---- openssh-8.7p1/ssh_config.5.crypto-policies	2021-08-30 13:29:00.174292872 +0200
-+++ openssh-8.7p1/ssh_config.5	2021-08-30 13:31:32.009548808 +0200
-@@ -373,17 +373,13 @@ or
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-8.0p1-crypto-policies.patch
+diff --color -ru a/ssh_config.5 b/ssh_config.5
+--- a/ssh_config.5	2022-07-12 15:05:22.550013071 +0200
++++ b/ssh_config.5	2022-07-12 15:17:20.016704545 +0200
+@@ -373,17 +373,13 @@
  causes no CNAMEs to be considered for canonicalization.
  This is the default behaviour.
  .It Cm CASignatureAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies which algorithms are allowed for signing of certificates
@@ -24,13 +25,13 @@
  If the specified list begins with a
  .Sq +
  character, then the specified algorithms will be appended to the default set
-@@ -445,20 +441,25 @@ If the option is set to
+@@ -445,20 +441,25 @@
  (the default),
  the check will not be executed.
  .It Cm Ciphers
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the ciphers allowed and their order of preference.
@@ -54,7 +55,7 @@
  .Pp
  The supported ciphers are:
  .Bd -literal -offset indent
-@@ -474,13 +475,6 @@ aes256-gcm@openssh.com
+@@ -474,13 +475,6 @@
  chacha20-poly1305@openssh.com
  .Ed
  .Pp
@@ -68,19 +69,19 @@
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClearAllForwardings
-@@ -874,6 +868,11 @@ command line will be passed untouched to
+@@ -874,6 +868,11 @@
  The default is
  .Dq no .
  .It Cm GSSAPIKexAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -886,10 +885,8 @@ gss-nistp256-sha256-,
+@@ -886,10 +885,8 @@
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -92,13 +93,58 @@
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-@@ -1219,29 +1216,25 @@ it may be zero or more of:
+@@ -913,36 +910,25 @@
+ but may be manually hashed using
+ .Xr ssh-keygen 1 .
+ .It Cm HostbasedAcceptedAlgorithms
++The default is handled system-wide by
++.Xr crypto-policies 7 .
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
++.Xr update-crypto-policies 8 .
++.Pp
+ Specifies the signature algorithms that will be used for hostbased
+ authentication as a comma-separated list of patterns.
+ Alternately if the specified list begins with a
+ .Sq +
+ character, then the specified signature algorithms will be appended
+-to the default set instead of replacing them.
++to the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq -
+ character, then the specified signature algorithms (including wildcards)
+-will be removed from the default set instead of replacing them.
++will be removed from the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq ^
+ character, then the specified signature algorithms will be placed
+-at the head of the default set.
+-The default for this option is:
+-.Bd -literal -offset 3n
+-ssh-ed25519-cert-v01@openssh.com,
+-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-ecdsa-sha2-nistp384-cert-v01@openssh.com,
+-ecdsa-sha2-nistp521-cert-v01@openssh.com,
+-sk-ssh-ed25519-cert-v01@openssh.com,
+-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,
+-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-ed25519,
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-sk-ssh-ed25519@openssh.com,
+-sk-ecdsa-sha2-nistp256@openssh.com,
+-rsa-sha2-512,rsa-sha2-256
+-.Ed
++at the head of the built-in openssh default set.
+ .Pp
+ The
+ .Fl Q
+@@ -1219,30 +1216,25 @@
  and
  .Cm pam .
  .It Cm KexAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the available KEX (Key Exchange) algorithms.
@@ -107,7 +153,7 @@
  .Sq +
 -character, then the specified algorithms will be appended to the default set
 -instead of replacing them.
-+character, then the specified algorithms will be appended to the built-in
++character, then the specified methods will be appended to the built-in
 +openssh default set instead of replacing them.
  If the specified list begins with a
  .Sq -
@@ -120,6 +166,7 @@
 -default set.
 -The default is:
 -.Bd -literal -offset indent
+-sntrup761x25519-sha512@openssh.com,
 -curve25519-sha256,curve25519-sha256@libssh.org,
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
@@ -131,13 +178,13 @@
  .Pp
  The list of available key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
-@@ -1351,37 +1344,33 @@ function, and all code in the
+@@ -1351,37 +1344,33 @@
  file.
  This option is intended for debugging and no overrides are enabled by default.
  .It Cm MACs
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the MAC (message authentication code) algorithms
@@ -178,13 +225,13 @@
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
  .It Cm NoHostAuthenticationForLocalhost
-@@ -1553,36 +1542,25 @@ instead of continuing to execute and pas
+@@ -1553,36 +1542,25 @@
  The default is
  .Cm no .
  .It Cm PubkeyAcceptedAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the signature algorithms that will be used for public key
@@ -224,16 +271,27 @@
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
-diff -up openssh-8.7p1/sshd_config.5.crypto-policies openssh-8.7p1/sshd_config.5
---- openssh-8.7p1/sshd_config.5.crypto-policies	2021-08-30 13:29:00.157292731 +0200
-+++ openssh-8.7p1/sshd_config.5	2021-08-30 13:32:16.263918533 +0200
-@@ -373,17 +373,13 @@ If the argument is
+@@ -2237,7 +2207,9 @@ for those users who do not have a config
+ This file must be world-readable.
+ .El
+ .Sh SEE ALSO
+-.Xr ssh 1
++.Xr ssh 1 ,
++.Xr crypto-policies 7 ,
++.Xr update-crypto-policies 8
+ .Sh AUTHORS
+ .An -nosplit
+ OpenSSH is a derivative of the original and free
+diff --color -ru a/sshd_config.5 b/sshd_config.5
+--- a/sshd_config.5	2022-07-12 15:05:22.535012771 +0200
++++ b/sshd_config.5	2022-07-12 15:15:33.394809258 +0200

_service:tar_scm:openssh-8.0p1-gssapi-keyex.patch Changed

@@ -1,8 +1,52 @@
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-8.0p1-gssapi-keyex.patch
+
+---
+ Makefile.in     |   3 +-
+ auth.c          |  94 +-------
+ auth2-gss.c     |  56 ++++-
+ auth2.c         |   2 +
+ canohost.c      |  93 ++++++++
+ canohost.h      |   3 +
+ clientloop.c    |  11 +
+ configure.ac    |  24 ++
+ gss-genr.c      | 297 +++++++++++++++++++++++-
+ gss-serv-krb5.c |  97 +++++++-
+ gss-serv.c      | 205 +++++++++++++++--
+ kex.c           |  66 +++++-
+ kex.h           |  29 +++
+ kexdh.c         |  10 +
+ kexgen.c        |   2 +-
+ kexgssc.c       | 599 ++++++++++++++++++++++++++++++++++++++++++++++++
+ kexgsss.c       | 474 ++++++++++++++++++++++++++++++++++++++
+ monitor.c       | 138 ++++++++++-
+ monitor.h       |   2 +
+ monitor_wrap.c  |  57 ++++-
+ monitor_wrap.h  |   4 +-
+ readconf.c      |  70 ++++++
+ readconf.h      |   6 +
+ servconf.c      |  47 ++++
+ servconf.h      |   3 +
+ session.c       |  10 +-
+ ssh-gss.h       |  54 ++++-
+ ssh.1           |   8 +
+ ssh.c           |   6 +-
+ ssh_config      |   2 +
+ ssh_config.5    |  58 +++++
+ sshconnect2.c   | 156 ++++++++++++-
+ sshd.c          |  62 ++++-
+ sshd_config     |   2 +
+ sshd_config.5   |  31 +++
+ sshkey.c        |   3 +-
+ sshkey.h        |   1 +
+ 37 files changed, 2623 insertions(+), 162 deletions(-)
+ create mode 100644 kexgssc.c
+ create mode 100644 kexgsss.c
+
 diff --git a/Makefile.in b/Makefile.in
-index e7549470..b68c1710 100644
+index f4c7540..8229885 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -112,6 +112,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
  	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
  	kexgexc.o kexgexs.o \
  	kexsntrup761x25519.o sntrup761.o kexgen.o \
@@ -10,19 +54,20 @@
  	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
  	sshbuf-io.o
  
-@@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
+@@ -128,7 +129,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
  	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
- 	auth2-none.o auth2-passwd.o auth2-pubkey.o \
+ 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
  	monitor.o monitor_wrap.o auth-krb5.o \
 -	auth2-gss.o gss-serv.o gss-serv-krb5.o \
 +	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
+ 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
  	srclimit.o sftp-server.o sftp-common.o \
  	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
-diff -up a/auth.c.gsskex b/auth.c
---- a/auth.c.gsskex	2021-08-20 06:03:49.000000000 +0200
-+++ b/auth.c	2021-08-27 12:41:51.262788953 +0200
-@@ -402,7 +402,8 @@ auth_root_allowed(struct ssh *ssh, const
+diff --git a/auth.c b/auth.c
+index 13e8d79..a449f27 100644
+--- a/auth.c
++++ b/auth.c
+@@ -358,7 +358,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
  	case PERMIT_NO_PASSWD:
  		if (strcmp(method, "publickey") == 0 ||
  		    strcmp(method, "hostbased") == 0 ||
@@ -32,10 +77,11 @@
  			return 1;
  		break;
  	case PERMIT_FORCED_ONLY:
-@@ -730,97 +731,6 @@ fakepw(void)
+@@ -639,97 +640,6 @@ fakepw(void)
+ 	return (&fake);
  }
  
- /*
+-/*
 - * Returns the remote DNS hostname as a string. The returned string must not
 - * be freed. NB. this will usually trigger a DNS query the first time it is
 - * called.
@@ -126,16 +172,15 @@
 -	return xstrdup(name);
 -}
 -
--/*
+ /*
   * Return the canonical name of the host in the other side of the current
   * connection.  The host name is cached, so it is efficient to call this
-  * several times.
 diff --git a/auth2-gss.c b/auth2-gss.c
-index 9351e042..d6446c0c 100644
+index d9b192c..cd6487c 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.32 2021/01/27 10:15:08 djm Exp $ */
+ /* $OpenBSD: auth2-gss.c,v 1.33 2021/12/19 22:12:07 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -143,7 +188,7 @@
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
+@@ -55,6 +55,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
  
@@ -192,7 +237,7 @@
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+@@ -261,7 +303,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
  	if ((r = sshpkt_get_end(ssh)) != 0)
  		fatal_fr(r, "parse packet");
  
@@ -202,7 +247,7 @@
  
  	if ((!use_privsep || mm_is_monitor()) &&
  	    (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -314,7 +357,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  	gssbuf.length = sshbuf_len(b);
  
  	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
@@ -212,7 +257,7 @@
  	else
  		logit("GSSAPI MIC check failed");
  
-@@ -326,6 +370,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -336,6 +380,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  	return 0;
  }
  
@@ -224,12 +269,12 @@
 +
  Authmethod method_gssapi = {
  	"gssapi-with-mic",
- 	userauth_gssapi,
+ 	NULL,
 diff --git a/auth2.c b/auth2.c
-index 0e776224..1c217268 100644
+index 15ae306..7510c25 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -73,6 +73,7 @@ extern Authmethod method_passwd;
+@@ -71,6 +71,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -237,7 +282,7 @@
  extern Authmethod method_gssapi;
  #endif
  
-@@ -80,6 +81,7 @@ Authmethod *authmethods = {
+@@ -78,6 +79,7 @@ Authmethod *authmethods = {
  	&method_none,
  	&method_pubkey,
  #ifdef GSSAPI
@@ -246,7 +291,7 @@
  #endif
  	&method_passwd,
 diff --git a/canohost.c b/canohost.c
-index abea9c6e..8e81b519 100644
+index a810da0..fe337d7 100644
 --- a/canohost.c
 +++ b/canohost.c
 @@ -35,6 +35,99 @@
@@ -350,7 +395,7 @@
  ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
  {
 diff --git a/canohost.h b/canohost.h
-index 26d62855..0cadc9f1 100644
+index 26d6285..0cadc9f 100644
 --- a/canohost.h
 +++ b/canohost.h
 @@ -15,6 +15,9 @@
@@ -364,10 +409,10 @@
  int		 get_peer_port(int);
  char		*get_local_ipaddr(int);
 diff --git a/clientloop.c b/clientloop.c

_service:tar_scm:openssh-8.0p1-pkcs11-uri.patch Changed

@@ -1,7 +1,98 @@
-diff -up openssh-8.7p1/configure.ac.pkcs11-uri openssh-8.7p1/configure.ac
---- openssh-8.7p1/configure.ac.pkcs11-uri	2021-08-30 13:07:43.646699953 +0200
-+++ openssh-8.7p1/configure.ac	2021-08-30 13:07:43.662700088 +0200
-@@ -1985,12 +1985,14 @@ AC_LINK_IFELSE(
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-8.0p1-pkcs11-uri.patch
+
+---
+ Makefile.in                      |  20 +-
+ configure.ac                     |  37 ++
+ regress/agent-pkcs11.sh          |   2 +-
+ regress/pkcs11.sh                | 349 +++++++++++++++
+ regress/unittests/pkcs11/tests.c | 337 +++++++++++++++
+ ssh-add.c                        |  44 +-
+ ssh-agent.c                      | 101 ++++-
+ ssh-keygen.c                     |   7 +-
+ ssh-pkcs11-client.c              |   3 +
+ ssh-pkcs11-uri.c                 | 419 ++++++++++++++++++
+ ssh-pkcs11-uri.h                 |  42 ++
+ ssh-pkcs11.c                     | 715 +++++++++++++++++++++++--------
+ ssh-pkcs11.h                     |   4 +
+ ssh.c                            | 104 +++--
+ ssh_config.5                     |  15 +
+ 15 files changed, 1961 insertions(+), 238 deletions(-)
+ create mode 100644 regress/pkcs11.sh
+ create mode 100644 regress/unittests/pkcs11/tests.c
+ create mode 100644 ssh-pkcs11-uri.c
+ create mode 100644 ssh-pkcs11-uri.h
+
+diff --git a/Makefile.in b/Makefile.in
+index 8229885..45f7a93 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -105,7 +105,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
+ 	ssh-ed25519-sk.o ssh-rsa.o dh.o \
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+-	ssh-pkcs11.o smult_curve25519_ref.o \
++	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
+ 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
+ 	ssh-ed25519.o digest-openssl.o digest-libc.o \
+ 	hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
+@@ -299,6 +299,8 @@ clean:	regressclean
+ 	rm -f regress/unittests/sshsig/test_sshsig$(EXEEXT)
+ 	rm -f regress/unittests/utf8/*.o
+ 	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)
++	rm -f regress/unittests/pkcs11/*.o
++	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)
+ 	rm -f regress/misc/sk-dummy/*.o
+ 	rm -f regress/misc/sk-dummy/*.lo
+ 	rm -f regress/misc/sk-dummy/sk-dummy.so
+@@ -336,6 +338,8 @@ distclean:	regressclean
+ 	rm -f regress/unittests/sshsig/test_sshsig
+ 	rm -f regress/unittests/utf8/*.o
+ 	rm -f regress/unittests/utf8/test_utf8
++	rm -f regress/unittests/pkcs11/*.o
++	rm -f regress/unittests/pkcs11/test_pkcs11
+ 	rm -f regress/misc/sk-dummy/*.o
+ 	rm -f regress/misc/sk-dummy/*.lo
+ 	rm -f regress/misc/sk-dummy/sk-dummy.so
+@@ -513,6 +517,7 @@ regress-prep:
+ 	$(MKDIR_P) `pwd`/regress/unittests/sshkey
+ 	$(MKDIR_P) `pwd`/regress/unittests/sshsig
+ 	$(MKDIR_P) `pwd`/regress/unittests/utf8
++	$(MKDIR_P) `pwd`/regress/unittests/pkcs11
+ 	$(MKDIR_P) `pwd`/regress/misc/sk-dummy
+ 	 -f `pwd`/regress/Makefile  || \
+ 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
+@@ -679,6 +684,16 @@ regress/unittests/utf8/test_utf8$(EXEEXT): \
+ 	    regress/unittests/test_helper/libtest_helper.a \
+ 	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
+ 
++UNITTESTS_TEST_PKCS11_OBJS=\
++	regress/unittests/pkcs11/tests.o
++
++regress/unittests/pkcs11/test_pkcs11$(EXEEXT): \
++    ${UNITTESTS_TEST_PKCS11_OBJS} \
++    regress/unittests/test_helper/libtest_helper.a libssh.a
++	$(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_PKCS11_OBJS) \
++	    regress/unittests/test_helper/libtest_helper.a \
++	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
++
+ # These all need to be compiled -fPIC, so they are treated differently.
+ SK_DUMMY_OBJS=\
+ 	regress/misc/sk-dummy/sk-dummy.lo \
+@@ -713,7 +728,8 @@ regress-unit-binaries: regress-prep $(REGRESSLIBS) \
+ 	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
+ 	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
+ 	regress/unittests/sshsig/test_sshsig$(EXEEXT) \
+-	regress/unittests/utf8/test_utf8$(EXEEXT)
++	regress/unittests/utf8/test_utf8$(EXEEXT) \
++	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
+ 
+ tests:	file-tests t-exec interop-tests unit
+ 	echo all tests passed
+diff --git a/configure.ac b/configure.ac
+index 6f7dc48..b57d0a5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2035,12 +2035,14 @@ AC_LINK_IFELSE(
  	AC_DEFINE(HAVE_ISBLANK, 1, Define if you have isblank(3C).)
  )
  
@@ -16,7 +107,7 @@
  		fi
  	
  )
-@@ -2019,6 +2021,40 @@ AC_SEARCH_LIBS(dlopen, dl)
+@@ -2064,6 +2066,40 @@ AC_SEARCH_LIBS(dlopen, dl)
  AC_CHECK_FUNCS(dlopen)
  AC_CHECK_DECL(RTLD_NOW, , , #include <dlfcn.h>)
  
@@ -57,7 +148,7 @@
  # IRIX has a const char return value for gai_strerror()
  AC_CHECK_FUNCS(gai_strerror, 
  	AC_DEFINE(HAVE_GAI_STRERROR)
-@@ -5624,6 +5660,7 @@ echo "                  BSD Auth support
+@@ -5651,6 +5687,7 @@ echo "                  BSD Auth support: $BSD_AUTH_MSG"
  echo "              Random number source: $RAND_MSG"
  echo "             Privsep sandbox style: $SANDBOX_STYLE"
  echo "                   PKCS#11 support: $enable_pkcs11"
@@ -65,74 +156,10 @@
  echo "                  U2F/FIDO support: $enable_sk"
  
  echo ""
-diff -up openssh-8.7p1/Makefile.in.pkcs11-uri openssh-8.7p1/Makefile.in
---- openssh-8.7p1/Makefile.in.pkcs11-uri	2021-08-30 13:07:43.571699324 +0200
-+++ openssh-8.7p1/Makefile.in	2021-08-30 13:07:43.663700096 +0200
-@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
- 	ssh-ed25519-sk.o ssh-rsa.o dh.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
--	ssh-pkcs11.o smult_curve25519_ref.o \
-+	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
- 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
- 	ssh-ed25519.o digest-openssl.o digest-libc.o \
- 	hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
-@@ -302,6 +302,8 @@ clean:	regressclean
- 	rm -f regress/unittests/sshsig/test_sshsig$(EXEEXT)
- 	rm -f regress/unittests/utf8/*.o
- 	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)
-+	rm -f regress/unittests/pkcs11/*.o
-+	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)
- 	rm -f regress/misc/sk-dummy/*.o
- 	rm -f regress/misc/sk-dummy/*.lo
- 	rm -f regress/misc/sk-dummy/sk-dummy.so
-@@ -339,6 +341,8 @@ distclean:	regressclean
- 	rm -f regress/unittests/sshsig/test_sshsig
- 	rm -f regress/unittests/utf8/*.o
- 	rm -f regress/unittests/utf8/test_utf8
-+	rm -f regress/unittests/pkcs11/*.o
-+	rm -f regress/unittests/pkcs11/test_pkcs11
- 	(cd openbsd-compat && $(MAKE) distclean)
- 	if test -d pkg ; then \
- 		rm -fr pkg ; \
-@@ -513,6 +517,7 @@ regress-prep:
- 	$(MKDIR_P) `pwd`/regress/unittests/sshkey
- 	$(MKDIR_P) `pwd`/regress/unittests/sshsig
- 	$(MKDIR_P) `pwd`/regress/unittests/utf8
-+	$(MKDIR_P) `pwd`/regress/unittests/pkcs11
- 	$(MKDIR_P) `pwd`/regress/misc/sk-dummy
- 	 -f `pwd`/regress/Makefile  || \
- 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
-@@ -677,6 +682,16 @@ regress/unittests/utf8/test_utf8$(EXEEXT
- 	    regress/unittests/test_helper/libtest_helper.a \
- 	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
- 
-+UNITTESTS_TEST_PKCS11_OBJS=\
-+	regress/unittests/pkcs11/tests.o
-+
-+regress/unittests/pkcs11/test_pkcs11$(EXEEXT): \
-+    ${UNITTESTS_TEST_PKCS11_OBJS} \
-+    regress/unittests/test_helper/libtest_helper.a libssh.a
-+	$(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_PKCS11_OBJS) \
-+	    regress/unittests/test_helper/libtest_helper.a \
-+	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-+
- # These all need to be compiled -fPIC, so they are treated differently.
- SK_DUMMY_OBJS=\
- 	regress/misc/sk-dummy/sk-dummy.lo \
-@@ -711,7 +726,8 @@ regress-unit-binaries: regress-prep $(RE
- 	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
- 	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
- 	regress/unittests/sshsig/test_sshsig$(EXEEXT) \
--	regress/unittests/utf8/test_utf8$(EXEEXT)
-+	regress/unittests/utf8/test_utf8$(EXEEXT) \
-+	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
- 
- tests:	file-tests t-exec interop-tests unit
- 	echo all tests passed
-diff -up openssh-8.7p1/regress/agent-pkcs11.sh.pkcs11-uri openssh-8.7p1/regress/agent-pkcs11.sh
---- openssh-8.7p1/regress/agent-pkcs11.sh.pkcs11-uri	2021-08-20 06:03:49.000000000 +0200
-+++ openssh-8.7p1/regress/agent-pkcs11.sh	2021-08-30 13:07:43.663700096 +0200
+diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh
+index 268a70d..72efa3b 100644
+--- a/regress/agent-pkcs11.sh
++++ b/regress/agent-pkcs11.sh
 @@ -113,7 +113,7 @@ else
  	done

_service:tar_scm:set-ssh-config.patch Added

_service:tar_scm:skip-scp-test-if-there-is-no-scp-on-remote-path-as-s.patch Added

@@ -0,0 +1,38 @@
+From e32af8efd8d36f8349761615b73cb3174e52134a Mon Sep 17 00:00:00 2001
+From: chengyechun <chengyechun1@huawei.com>
+Date: Thu, 5 Jan 2023 22:45:10 +0800
+Subject: PATCH skip scp test if there is no scp on remote path as scp3.sh
+ did
+
+---
+ regress/multiplex.sh | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/regress/multiplex.sh b/regress/multiplex.sh
+index 4744fa3..8ab0f59 100644
+--- a/regress/multiplex.sh
++++ b/regress/multiplex.sh
+@@ -67,11 +67,15 @@ echo "get ${DATA} ${COPY}" | \
+ test -f ${COPY}			|| fail "sftp: failed copy ${DATA}" 
+ cmp ${DATA} ${COPY}		|| fail "sftp: corrupted copy of ${DATA}"
+ 
+-rm -f ${COPY}
+-trace "scp transfer over multiplexed connection and check result"
+-${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >>$TEST_REGRESS_LOGFILE 2>&1
+-test -f ${COPY}			|| fail "scp: failed copy ${DATA}" 
+-cmp ${DATA} ${COPY}		|| fail "scp: corrupted copy of ${DATA}"
++$SSH -F $OBJ/ssh_proxy somehost \
++    'IFS=":"; for i in $PATH;do  -x "$i/scp"  && exit 0; done; exit 1'
++if  $? -eq 0 ; then
++	rm -f ${COPY}
++	trace "scp transfer over multiplexed connection and check result"
++	${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >>$TEST_REGRESS_LOGFILE 2>&1
++	test -f ${COPY}			|| fail "scp: failed copy ${DATA}" 
++	cmp ${DATA} ${COPY}		|| fail "scp: corrupted copy of ${DATA}"
++fi
+ 
+ rm -f ${COPY}
+ verbose "test $tid: forward"
+-- 
+2.23.0
+

_service:tar_scm:skip-tests-for-C-if-there-is-no-openssl-on-local-pat.patch Added

@@ -0,0 +1,100 @@
+From a0772385f1b4086aacdc6d84a3daea4b2ef26f30 Mon Sep 17 00:00:00 2001
+From: chengyechun <chengyechun1@huawei.com>
+Date: Thu, 5 Jan 2023 23:43:22 +0800
+Subject: PATCH skip tests for '%C' if there is no openssl on local path
+
+---
+ regress/percent.sh                            | 24 +++++++++++----
+ ...t-if-there-is-no-openssl-on-local-pa.patch | 30 +++++++++++++++++++
+ 2 files changed, 48 insertions(+), 6 deletions(-)
+ create mode 100644 skip-percent-test-if-there-is-no-openssl-on-local-pa.patch
+
+diff --git a/regress/percent.sh b/regress/percent.sh
+index 7ed4184..9c112eb 100644
+--- a/regress/percent.sh
++++ b/regress/percent.sh
+@@ -13,6 +13,10 @@ USERID=`id -u`
+ HOST=`hostname | cut -f1 -d.`
+ HOSTNAME=`hostname`
+ 
++# Check if there is openssl in local PATH
++NOOPENSSL=0
++for i in $PATH;do  -x "$i/openssl"  && NOOPENSSL=1; done
++
+ # Localcommand is evaluated after connection because %T is not available
+ # until then.  Because of this we use a different method of exercising it,
+ # and we can't override the remote user otherwise authentication will fail.
+@@ -77,11 +81,14 @@ for i in matchexec localcommand remotecommand controlpath identityagent \
+ 	if  "$i" = "$localcommand" ; then
+ 		trial $i '%T' NONE
+ 	fi
+-	# Matches implementation in readconf.c:ssh_connection_hash()
+-	HASH=`printf "${HOSTNAME}127.0.0.1${PORT}$REMUSER" |
+-	    $OPENSSL_BIN sha1 | cut -f2 -d' '`
++    # skip tests for '%C' since no openssl in local PATH
++	if  $NOOPENSSL -eq 1 ; then
++	    # Matches implementation in readconf.c:ssh_connection_hash()	
++        HASH=`printf "${HOSTNAME}127.0.0.1${PORT}$REMUSER" |
++            $OPENSSL_BIN sha1 | cut -f2 -d' '`
++	fi
+ 	trial $i '%%' '%'
+-	trial $i '%C' $HASH
++	if  $NOOPENSSL -eq 1 ; then trial $i '%C' $HASH; fi
+ 	trial $i '%i' $USERID
+ 	trial $i '%h' 127.0.0.1
+ 	trial $i '%L' $HOST
+@@ -95,8 +102,13 @@ for i in matchexec localcommand remotecommand controlpath identityagent \
+ 	# containing %d for UserKnownHostsFile
+ 	if  "$i" != "userknownhostsfile" ; then
+ 		trial $i '%d' $HOME
+-		trial $i '%%/%C/%i/%h/%d/%L/%l/%n/%p/%r/%u' \
+-		    "%/$HASH/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
++        if  $NOOPENSSL -eq 0 ; then
++            trial $i '%%/%i/%h/%d/%L/%l/%n/%p/%r/%u' \
++                "%/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
++        else
++		    trial $i '%%/%C/%i/%h/%d/%L/%l/%n/%p/%r/%u' \
++		        "%/$HASH/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
++        fi
+ 	fi
+ done
+ 
+diff --git a/skip-percent-test-if-there-is-no-openssl-on-local-pa.patch b/skip-percent-test-if-there-is-no-openssl-on-local-pa.patch
+new file mode 100644
+index 0000000..c7af5d9
+--- /dev/null
++++ b/skip-percent-test-if-there-is-no-openssl-on-local-pa.patch
+@@ -0,0 +1,30 @@
++From 1da9e48b41ab6eca157d4fa3b74490510d9006ae Mon Sep 17 00:00:00 2001
++From: chengyechun <chengyechun1@huawei.com>
++Date: Thu, 5 Jan 2023 23:43:22 +0800
++Subject: PATCH skip percent test if there is no openssl on local path as
++ scp3 did
++
++---
++ regress/percent.sh | 6 ++++++
++ 1 file changed, 6 insertions(+)
++
++diff --git a/regress/percent.sh b/regress/percent.sh
++index 7ed4184..08afbc8 100644
++--- a/regress/percent.sh
+++++ b/regress/percent.sh
++@@ -8,6 +8,12 @@ if  -x "/usr/xpg4/bin/id" ; then
++ 	export PATH
++ fi
++ 
+++NOOPENSSL=0
+++for i in $PATH;do  -x "$i/openssl"  && $OPENSSL=1; done
+++if  $? -eq 0 ; then
+++	skip "No openssl on local path."
+++fi
+++
++ USER=`id -u -n`
++ USERID=`id -u`
++ HOST=`hostname | cut -f1 -d.`
++-- 
++2.23.0
++
+-- 
+2.23.0
+

_service:tar_scm:openssh-8.8p1.tar.gz.asc Deleted

_service:tar_scm:openssh-8.8p1.tar.gz -> _service:tar_scm:openssh-9.1p1.tar.gz Changed

_service:tar_scm:openssh-9.1p1.tar.gz.asc Added