开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:openssh.spec Changed

@@ -9,7 +9,7 @@
 %global openssh_release 4
 
 Name:           openssh
-Version:        8.8p1
+Version:        9.1p1
 Release:        %{openssh_release}
 URL:            http://www.openssh.com/portable.html
 License:        BSD
@@ -18,18 +18,19 @@
 Source0:        https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1:        https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
 Source2:        sshd.pam
-Source4:        http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.4.tar.gz
-Source5:        pam_ssh_agent-rmheaders
-Source6:        ssh-keycat.pam
-Source7:        sshd.sysconfig
-Source9:        sshd@.service
-Source10:       sshd.socket
-Source11:       sshd.service
-Source12:       sshd-keygen@.service
-Source13:       sshd-keygen
-Source14:	sshd.tmpfiles
-Source15:       sshd-keygen.target
-Source16:	ssh-agent.service
+Source3:        http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.4.tar.gz
+Source4:        pam_ssh_agent-rmheaders
+Source5:        ssh-keycat.pam
+Source6:        sshd.sysconfig
+Source7:        sshd@.service
+Source8:        sshd.socket
+Source9:        sshd.service
+Source10:       sshd-keygen@.service
+Source11:       sshd-keygen
+Source12:       sshd.tmpfiles
+Source13:       sshd-keygen.target
+Source14:       ssh-agent.service
+Source15:       ssh-keygen-bash-completion.sh
 Patch0:         openssh-6.7p1-coverity.patch
 Patch1:         openssh-7.6p1-audit.patch
 Patch2:         openssh-7.1p2-audit-race-condition.patch
@@ -43,16 +44,13 @@
 Patch10:        openssh-6.6p1-privsep-selinux.patch
 Patch12:        openssh-6.6p1-keycat.patch
 Patch13:        openssh-6.6p1-allow-ip-opts.patch
-Patch14:        openssh-6.6p1-keyperm.patch
 Patch15:        openssh-5.9p1-ipv6man.patch
 Patch16:        openssh-5.8p2-sigpipe.patch
 Patch17:        openssh-7.2p2-x11.patch
-Patch18:        openssh-7.7p1-fips.patch
 Patch19:        openssh-5.1p1-askpass-progress.patch
 Patch20:        openssh-4.3p2-askpass-grab-info.patch
 Patch21:        openssh-7.7p1.patch
 Patch22:        openssh-7.8p1-UsePAM-warning.patch
-Patch23:        openssh-6.3p1-ctr-evp-fast.patch
 Patch26:        openssh-8.0p1-gssapi-keyex.patch
 Patch27:        openssh-6.6p1-force_krb.patch
 Patch28:        openssh-6.6p1-GSSAPIEnablek5users.patch
@@ -76,17 +74,43 @@
 Patch47:        openssh-8.0p1-openssl-evp.patch
 Patch48:        openssh-8.0p1-openssl-kdf.patch
 Patch49:        openssh-8.2p1-visibility.patch
-Patch50:	openssh-8.2p1-x11-without-ipv6.patch
-Patch51:	openssh-8.0p1-keygen-strip-doseol.patch
-Patch52:	openssh-8.0p1-preserve-pam-errors.patch
-Patch53:	openssh-8.7p1-scp-kill-switch.patch
-
+Patch50:        openssh-8.2p1-x11-without-ipv6.patch
+Patch51:        openssh-8.0p1-keygen-strip-doseol.patch
+Patch52:        openssh-8.0p1-preserve-pam-errors.patch
+Patch53:        openssh-8.7p1-scp-kill-switch.patch
 Patch54:        bugfix-sftp-when-parse_user_host_path-empty-path-should-be-allowed.patch
-Patch55:        bugfix-openssh-6.6p1-log-usepam-no.patch
 Patch56:        bugfix-openssh-add-option-check-username-splash.patch
 Patch57:        feature-openssh-7.4-hima-sftpserver-oom-and-fix.patch
 Patch58:        bugfix-openssh-fix-sftpserver.patch
 Patch59:        set-sshd-config.patch
+Patch60:        feature-add-SMx-support.patch
+Patch63:        add-loongarch.patch
+Patch65:        openssh-Add-sw64-architecture.patch
+Patch74:        add-strict-scp-check-for-CVE-2020-15778.patch
+Patch77:        skip-scp-test-if-there-is-no-scp-on-remote-path-as-s.patch
+Patch78:        backport-upstream-CVE-2023-25136-fix-double-free-caused.patch
+Patch79:        set-ssh-config.patch
+Patch80:        backport-upstream-honour-user-s-umask-if-it-is-more-restricti.patch
+Patch81:        backport-upstream-use-correct-type-with-sizeof-ok-djm.patch
+Patch82:        backport-Defer-seed_rng-until-after-closefrom-call.patch
+Patch83:        backport-upstream-Handle-dynamic-remote-port-forwarding-in-es.patch
+Patch84:        backport-upstream-The-idiomatic-way-of-coping-with-signed-cha.patch
+Patch85:        backport-upstream-Clear-signal-mask-early-in-main-sshd-may-ha.patch
+Patch86:        backport-upstream-fix-bug-in-PermitRemoteOpen-which-caused-it.patch
+Patch87:        backport-upstream-regression-test-for-PermitRemoteOpen.patch
+Patch88:        backport-upstream-Copy-bytes-from-the_banana-rather-than-bana.patch
+Patch89:        backport-upstream-When-OpenSSL-is-not-available-skip-parts-of.patch
+Patch90:        backport-don-t-test-IPv6-addresses-if-platform-lacks-support.patch
+Patch91:        backport-upstream-avoid-printf-s-NULL-if-using-ssh.patch
+Patch92:        backport-upstream-Add-scp-s-path-to-test-sshd-s-PATH.patch
+Patch93:        backport-upstream-Instead-of-skipping-the-all-tokens-test-if-.patch
+Patch94:        backport-upstream-Shell-syntax-fix.-From-ren-mingshuai-vi-git.patch
+Patch95:        backport-Allow-writev-is-seccomp-sandbox.patch
+Patch96:        backport-upstream-Ensure-that-there-is-a-terminating-newline-.patch
+Patch97:        backport-upstream-when-restoring-non-blocking-mode-to-stdio-f.patch
+Patch98:        backport-upstream-test-compat_kex_proposal-by-dtucker.patch
+Patch99:        backport-adapt-compat_kex_proposal-test-to-portable.patch
+Patch100:       backport-upstream-Move-scp-path-setting-to-a-helper-function.patch
 
 Requires:       /sbin/nologin
 Requires:       libselinux >= 2.3-5 audit-libs >= 1.0.8
@@ -160,7 +184,7 @@
 %package_help
 
 %prep
-%setup -q -a 4
+%setup -q -a 3
 
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4
 %patch3 -p2 -b .psaa-build
@@ -170,14 +194,13 @@
 %patch6 -p2 -b .psaa-agent
 %patch8 -p2 -b .psaa-deref
 # Remove duplicate headers and library files
-rm -f $(cat %{SOURCE5})
+rm -f $(cat %{SOURCE4})
 popd
 
 %patch9 -p1 -b .role-mls
 %patch10 -p1 -b .privsep-selinux
 %patch12 -p1 -b .keycat
 %patch13 -p1 -b .ip-opts
-%patch14 -p1 -b .keyperm
 %patch15 -p1 -b .ipv6man
 %patch16 -p1 -b .sigpipe
 %patch17 -p1 -b .x11
@@ -185,7 +208,6 @@
 %patch20 -p1 -b .grab-info
 %patch21 -p1
 %patch22 -p1 -b .log-usepam-no
-%patch23 -p1 -b .evp-ctr
 %patch26 -p1 -b .gsskex
 %patch27 -p1 -b .force_krb
 %patch29 -p1 -b .ccache_name
@@ -215,15 +237,40 @@
 %patch53 -p1 -b .kill-scp
 %patch1 -p1 -b .audit
 %patch2 -p1 -b .audit-race
-%patch18 -p1 -b .fips
 %patch0 -p1 -b .coverity
-
 %patch54 -p1
-%patch55 -p1
 %patch56 -p1
 %patch57 -p1
 %patch58 -p1
 %patch59 -p1
+%patch60 -p1
+%patch63 -p1
+%patch65 -p1
+%patch74 -p1
+%patch77 -p1
+%patch78 -p1
+%patch79 -p1
+%patch80 -p1
+%patch81 -p1
+%patch82 -p1
+%patch83 -p1
+%patch84 -p1
+%patch85 -p1
+%patch86 -p1
+%patch87 -p1
+%patch88 -p1
+%patch89 -p1
+%patch90 -p1
+%patch91 -p1
+%patch92 -p1
+%patch93 -p1
+%patch94 -p1
+%patch95 -p1
+%patch96 -p1
+%patch97 -p1
+%patch98 -p1
+%patch99 -p1
+%patch100 -p1
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4
@@ -267,7 +314,7 @@
     --without-zlib-version-check --with-ssl-engine --with-ipaddr-display \
     --with-pie=no --without-hardening --with-systemd --with-default-pkcs11-provider=yes \
     --with-pam --with-selinux --with-audit=linux --with-security-key-buildin=yes \
-%ifnarch riscv64	
+%ifnarch riscv64 loongarch64 sw_64
      --with-sandbox=seccomp_filter \
 %endif
     --with-kerberos5${krb5_prefix:+=${krb5_prefix}} --with-libedit
@@ -295,16 +342,14 @@
 popd
 
 %check
-#to run tests use "--with check"
-%if %{?_with_check:1}%{!?_with_check:0}

_service:tar_scm:add-loongarch.patch Added

_service:tar_scm:add-strict-scp-check-for-CVE-2020-15778.patch Added

@@ -0,0 +1,160 @@
+From 2e0b74242220a97926d006719d1ac6e113918e2b Mon Sep 17 00:00:00 2001
+From: seuzw <930zhaowei@163.com>
+Date: Thu, 20 May 2021 20:23:30 +0800
+Subject: PATCH add strict-scp-check for CVE-2020-15778
+
+---
+ servconf.c | 12 ++++++++++++
+ servconf.h |  1 +
+ session.c  | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 64 insertions(+)
+
+diff --git a/servconf.c b/servconf.c
+index 333b802..0a7cfa4 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -91,6 +91,7 @@ initialize_server_options(ServerOptions *options)
+ {
+ 	memset(options, 0, sizeof(*options));
+ 
++	options->strict_scp_check = -1;
+ 	/* Portable-specific options */
+ 	options->use_pam = -1;
+ 
+@@ -309,6 +310,8 @@ fill_default_server_options(ServerOptions *options)
+ 		    _PATH_HOST_XMSS_KEY_FILE, 0);
+ #endif /* WITH_XMSS */
+ 	}
++	if (options->strict_scp_check == -1)
++		options->strict_scp_check = 0;
+ 	/* No certificates by default */
+ 	if (options->num_ports == 0)
+ 		options->portsoptions->num_ports++ = SSH_DEFAULT_PORT;
+@@ -516,6 +519,7 @@ fill_default_server_options(ServerOptions *options)
+ /* Keyword tokens. */
+ typedef enum {
+ 	sBadOption,		/* == unknown option */
++	sStrictScpCheck,
+ 	/* Portable-specific options */
+ 	sUsePAM,
+ 	/* Standard Options */
+@@ -573,6 +577,7 @@ static struct {
+ #else
+ 	{ "usepam", sUnsupported, SSHCFG_GLOBAL },
+ #endif
++	{ "strictscpcheck", sStrictScpCheck, SSHCFG_GLOBAL },
+ 	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
+ 	/* Standard Options */
+ 	{ "port", sPort, SSHCFG_GLOBAL },
+@@ -1391,6 +1396,11 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 	/* Standard Options */
+ 	case sBadOption:
+ 		goto out;
++
++	case sStrictScpCheck:
++		intptr = &options->strict_scp_check;
++		goto parse_flag;
++
+ 	case sPort:
+ 		/* ignore ports from configfile if cmdline specifies ports */
+ 		if (options->ports_from_cmdline) {
+@@ -2666,6 +2676,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+ 		dst->n = src->n; \
+ } while (0)
+ 
++	M_CP_INTOPT(strict_scp_check);
+ 	M_CP_INTOPT(password_authentication);
+ 	M_CP_INTOPT(gss_authentication);
+ 	M_CP_INTOPT(pubkey_authentication);
+@@ -2960,6 +2971,7 @@ dump_config(ServerOptions *o)
+ #ifdef USE_PAM
+ 	dump_cfg_fmtint(sUsePAM, o->use_pam);
+ #endif
++	dump_cfg_fmtint(sStrictScpCheck, o->strict_scp_check);
+ 	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
+ 	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
+ 	dump_cfg_int(sX11MaxDisplays, o->x11_max_displays);
+diff --git a/servconf.h b/servconf.h
+index cb73d2d..12c2053 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -203,6 +203,7 @@ typedef struct {
+ 					 * disconnect the session
+ 					 */
+ 
++	int     strict_scp_check;
+ 	u_int	num_authkeys_files;	/* Files containing public keys */
+ 	char   **authorized_keys_files;
+ 
+diff --git a/session.c b/session.c
+index dfbebba..1b67393 100644
+--- a/session.c
++++ b/session.c
+@@ -175,6 +175,51 @@ static char *auth_sock_dir = NULL;
+ 
+ /* removes the agent forwarding socket */
+ 
++
++int scp_check(const char *command)
++{
++	debug("Entering scp check");
++	int check = 0;
++	if (command == NULL) {
++		debug("scp check succeeded for shell mode");
++		return check;
++	}
++	int lc = strlen(command);
++	char special_characters = "|;&$><`\\!\n";
++	int ls = strlen(special_characters);
++	int count_char128 = {0};
++
++	for (int i = 0; i < ls; i++) {
++		count_charspecial_charactersi = 1;
++	}
++
++	char scp_prefix6 = "scp -";
++	int lp = 5;
++
++	if (lc <= lp) {
++		debug("scp check succeeded for length");
++		return check;
++	}
++
++	for (int i = 0; i < lp; i++) {
++		if (commandi - scp_prefixi) {
++			debug("scp check succeeded for prefix");
++		return check;
++		}
++	}
++
++	for (int i = lp; i < lc; i++) {
++		if (commandi > 0 && commandi < 128) {
++			if (count_charcommandi) {
++				check = 1;
++				debug("scp check failed at %d: %c", i, commandi);
++				break;
++			}
++		}
++	}
++	return check;
++}
++
+ static void
+ auth_sock_cleanup_proc(struct passwd *pw)
+ {
+@@ -692,6 +737,12 @@ do_exec(struct ssh *ssh, Session *s, const char *command)
+ 		command = auth_opts->force_command;
+ 		forced = "(key-option)";
+ 	}
++
++	if (options.strict_scp_check && scp_check(command)) {
++		verbose("Special characters not allowed in scp");
++		return 1;
++	}
++
+ #ifdef GSSAPI
+ #ifdef KRB5 /* k5users_allowed_cmds only available w/ GSSAPI+KRB5 */
+ 	else if (k5users_allowed_cmds) {
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Allow-writev-is-seccomp-sandbox.patch Added

_service:tar_scm:backport-Defer-seed_rng-until-after-closefrom-call.patch Added

@@ -0,0 +1,39 @@
+From cf1a9852d7fc93e4abc4168aed09529a57427cdc Mon Sep 17 00:00:00 2001
+From: Darren Tucker <dtucker@dtucker.net>
+Date: Wed, 9 Nov 2022 09:23:47 +1100
+Subject: PATCH Defer seed_rng until after closefrom call.
+
+seed_rng will initialize OpenSSL, and some engine providers (eg Intel's
+QAT) will open descriptors for their own use.  bz#3483, patch from
+joel.d.schuetze at intel.com, ok djm@
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=cf1a9852d7fc93e4abc4168aed09529a57427cdc
+---
+ sshd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sshd.c b/sshd.c
+index b4bb7d65..808d91ef 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -1580,8 +1580,6 @@ main(int ac, char **av)
+ 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+ 	sanitise_stdfd();
+ 
+-	seed_rng();
+-
+ 	/* Initialize configuration options to their default values. */
+ 	initialize_server_options(&options);
+ 
+@@ -1703,6 +1701,8 @@ main(int ac, char **av)
+ 	else
+ 		closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
+ 
++	seed_rng();
++
+ 	/* If requested, redirect the logs to the specified logfile. */
+ 	if (logfile != NULL)
+ 		log_redirect_stderr_to(logfile);
+-- 
+2.27.0
+

_service:tar_scm:backport-adapt-compat_kex_proposal-test-to-portable.patch Added

@@ -0,0 +1,51 @@
+From 9fe207565b4ab0fe5d1ac5bb85e39188d96fb214 Mon Sep 17 00:00:00 2001
+From: Damien Miller <djm@mindrot.org>
+Date: Thu, 2 Feb 2023 23:17:49 +1100
+Subject: PATCH adapt compat_kex_proposal() test to portable
+
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=9fe207565b4ab0fe5d1ac5bb85e39188d96fb214
+---
+ Makefile.in                           | 1 +
+ regress/unittests/kex/test_proposal.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile.in b/Makefile.in
+index 18f6ac9e..c0ebfa04 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -616,6 +616,7 @@ regress/unittests/conversion/test_conversion$(EXEEXT): \
+ UNITTESTS_TEST_KEX_OBJS=\
+ 	regress/unittests/kex/tests.o \
+ 	regress/unittests/kex/test_kex.o \
++	regress/unittests/kex/test_proposal.o \
+ 	$(SKOBJS)
+ 
+ regress/unittests/kex/test_kex$(EXEEXT): ${UNITTESTS_TEST_KEX_OBJS} \
+diff --git a/regress/unittests/kex/test_proposal.c b/regress/unittests/kex/test_proposal.c
+index b89ff59b..d6cf0f5d 100644
+--- a/regress/unittests/kex/test_proposal.c
++++ b/regress/unittests/kex/test_proposal.c
+@@ -5,14 +5,18 @@
+  * Placed in the public domain
+  */
+ 
++#include "includes.h"
++
+ #include <sys/types.h>
+ #include <signal.h>
+ #include <stdio.h>
++#ifdef HAVE_STDINT_H
+ #include <stdint.h>
++#endif
+ #include <stdlib.h>
+ #include <string.h>
+ 
+-#include "test_helper.h"
++#include "../test_helper/test_helper.h"
+ 
+ #include "compat.h"
+ #include "ssherr.h"
+-- 
+2.27.0
+

_service:tar_scm:backport-don-t-test-IPv6-addresses-if-platform-lacks-support.patch Added

@@ -0,0 +1,52 @@
+From dd1249bd5c45128a908395c61b26996a70f82205 Mon Sep 17 00:00:00 2001
+From: Damien Miller <djm@mindrot.org>
+Date: Sun, 8 Jan 2023 12:08:59 +1100
+Subject: PATCH don't test IPv6 addresses if platform lacks support
+
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=dd1249bd5c45128a908395c61b26996a70f82205
+
+---
+ regress/dynamic-forward.sh | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
+index f6c2393..1bfe05a 100644
+--- a/regress/dynamic-forward.sh
++++ b/regress/dynamic-forward.sh
+@@ -17,6 +17,11 @@ else
+ fi
+ trace "will use ProxyCommand $proxycmd"
+ 
++# This is a reasonable proxy for IPv6 support.
++if ! config_defined HAVE_STRUCT_IN6_ADDR ; then
++       SKIP_IPV6=yes
++fi
++
+ start_ssh() {
+ 	direction="$1"
+ 	arg="$2"
+@@ -96,14 +101,16 @@ for d in D R; do
+ 	stop_ssh
+ 
+ 	verbose "PermitRemoteOpen=explicit"
+-	start_ssh $d \
+-	    PermitRemoteOpen="127.0.0.1:$PORT ::1:$PORT localhost:$PORT"
++	permit="127.0.0.1:$PORT ::1:$PORT localhost:$PORT"
++	test -z "$SKIP_IPV6" || permit="127.0.0.1:$PORT localhost:$PORT"
++	start_ssh $d PermitRemoteOpen="$permit"
+ 	check_socks $d Y
+ 	stop_ssh
+ 
+ 	verbose "PermitRemoteOpen=disallowed"
+-	start_ssh $d \
+-	    PermitRemoteOpen="127.0.0.1:1 ::1:1 localhost:1"
++	permit="127.0.0.1:1 ::1:1 localhost:1"
++	test -z "$SKIP_IPV6" || permit="127.0.0.1:1 localhost:1"
++	start_ssh $d PermitRemoteOpen="$permit"
+ 	check_socks $d N
+ 	stop_ssh
+ done
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-Add-scp-s-path-to-test-sshd-s-PATH.patch Added

@@ -0,0 +1,37 @@
+From 6e6f88647042b3cde54a628545c2f5fb656a9327 Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Fri, 13 Jan 2023 04:23:00 +0000
+Subject: PATCH upstream: Add scp's path to test sshd's PATH.
+
+If the scp we're testing is fully qualified (eg it's not in the system
+PATH) then add its path to the under-test sshd's PATH so we can find
+it. Prompted by bz#3518.
+
+OpenBSD-Regress-ID: 7df4f5a0be3aa135495b7e5a6719d3cbc26cc4c0
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=6e6f88647042b3cde54a628545c2f5fb656a9327
+---
+ regress/test-exec.sh | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/regress/test-exec.sh b/regress/test-exec.sh
+index c51f8eac..5a6afac5 100644
+--- a/regress/test-exec.sh
++++ b/regress/test-exec.sh
+@@ -529,6 +529,13 @@ cat << EOF > $OBJ/sshd_config
+ 	Subsystem	sftp	$SFTPSERVER
+ EOF
+ 
++# If we're testing a non-installed scp, add its directory to sshd's PATH
++# so we can test it.
++case "$SCP" in
++/*)	PATH_WITH_SCP="`dirname $SCP`:$PATH"
++	echo "	SetEnv PATH='$PATH_WITH_SCP'" >>$OBJ/sshd_config ;;
++esac
++
+ # This may be necessary if /usr/src and/or /usr/obj are group-writable,
+ # but if you aren't careful with permissions then the unit tests could
+ # be abused to locally escalate privileges.
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-CVE-2023-25136-fix-double-free-caused.patch Added

@@ -0,0 +1,63 @@
+From 12da7823336434a403f25c7cc0c2c6aed0737a35 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 2 Feb 2023 12:10:05 +0000
+Subject: PATCH upstream: fix double-free caused by compat_kex_proposal();
+ bz3522
+
+by dtucker@, ok me
+
+OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80
+
+Reference:https://anongit.mindrot.org/openssh.git/patch/?id=12da7823336434a403f25c7cc0c2c6aed0737a35
+Conflict:NA 
+---
+ compat.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/compat.c b/compat.c
+index 46dfe3a9..478a9403 100644
+--- a/compat.c
++++ b/compat.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: compat.c,v 1.120 2022/07/01 03:35:45 dtucker Exp $ */
++/* $OpenBSD: compat.c,v 1.121 2023/02/02 12:10:05 djm Exp $ */
+ /*
+  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
+  *
+@@ -190,26 +190,26 @@ compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
+ char *
+ compat_kex_proposal(struct ssh *ssh, char *p)
+ {
+-	char *cp = NULL;
++	char *cp = NULL, *cp2 = NULL;
+ 
+ 	if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
+ 		return xstrdup(p);
+ 	debug2_f("original KEX proposal: %s", p);
+ 	if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
+-		if ((p = match_filter_denylist(p,
++		if ((cp = match_filter_denylist(p,
+ 		    "curve25519-sha256@libssh.org")) == NULL)
+ 			fatal("match_filter_denylist failed");
+ 	if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
+-		cp = p;
+-		if ((p = match_filter_denylist(p,
++		if ((cp2 = match_filter_denylist(cp ? cp : p,
+ 		    "diffie-hellman-group-exchange-sha256,"
+ 		    "diffie-hellman-group-exchange-sha1")) == NULL)
+ 			fatal("match_filter_denylist failed");
+ 		free(cp);
++		cp = cp2;
+ 	}
+-	debug2_f("compat KEX proposal: %s", p);
+-	if (*p == '\0')
++	if (cp == NULL || *cp == '\0')
+ 		fatal("No supported key exchange algorithms found");
+-	return p;
++	debug2_f("compat KEX proposal: %s", cp);
++	return cp;
+ }
+ 
+-- 
+2.23.0
+

_service:tar_scm:backport-upstream-Clear-signal-mask-early-in-main-sshd-may-ha.patch Added

@@ -0,0 +1,52 @@
+From 93f2ce8c050a7a2a628646c00b40b9b53fef93ef Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 16 Dec 2022 06:56:47 +0000
+Subject: PATCH upstream: Clear signal mask early in main(); sshd may have
+ been
+
+started with one or more signals masked (sigprocmask(2) is not cleared
+on fork/exec) and this could interfere with various things, e.g. the
+login grace timer.
+
+Execution environments that fail to clear the signal mask before running
+sshd are clearly broken, but apparently they do exist.
+
+Reported by Sreedhar Balasubramanian; ok dtucker@
+
+OpenBSD-Commit-ID: 77078c0b1c53c780269fc0c416f121d05e3010ae
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=93f2ce8c050a7a2a628646c00b40b9b53fef93ef
+---
+ sshd.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sshd.c b/sshd.c
+index cd42bd5..da39226 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: sshd.c,v 1.591 2022/09/17 10:34:29 djm Exp $ */
++/* $OpenBSD: sshd.c,v 1.594 2022/12/16 06:56:47 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -1650,12 +1650,16 @@ main(int ac, char **av)
+ 	int keytype;
+ 	Authctxt *authctxt;
+ 	struct connection_info *connection_info = NULL;
++    sigset_t sigmask;
+ 
+ #ifdef HAVE_SECUREWARE
+ 	(void)set_auth_parameters(ac, av);
+ #endif
+ 	__progname = ssh_get_progname(av0);
+ 
++	sigemptyset(&sigmask);
++	sigprocmask(SIG_SETMASK, &sigmask, NULL);
++
+ 	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
+ 	saved_argc = ac;
+ 	rexec_argc = ac;
+-- 
+2.23.0
+

_service:tar_scm:backport-upstream-Copy-bytes-from-the_banana-rather-than-bana.patch Added

@@ -0,0 +1,32 @@
+From 018d671d78145f03d6f07ae9d64d51321da70325 Mon Sep 17 00:00:00 2001
+From: "tb@openbsd.org" <tb@openbsd.org>
+Date: Wed, 4 Jan 2023 22:48:57 +0000
+Subject: PATCH upstream: Copy bytes from the_banana rather than banana()
+
+Fixes test failure due to segfault seen on arm64 with xonly snap.
+
+ok djm
+
+OpenBSD-Regress-ID: 86e2aa4bbd1dff1bc4ebb2969c0d6474485be046
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=018d671d78145f03d6f07ae9d64d51321da70325
+---
+ regress/unittests/sshkey/test_sshkey.c | 2 +-
+ 1 file changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
+index 982907ce..cc359aea 100644
+--- a/regress/unittests/sshkey/test_sshkey.c
++++ b/regress/unittests/sshkey/test_sshkey.c
+@@ -144,7 +144,7 @@ banana(u_char *s, size_t l)
+ 			memcpy(s + o, "nanananana", l - o);
+ 			break;
+ 		}
+-		memcpy(s + o, banana, sizeof(the_banana));
++		memcpy(s + o, the_banana, sizeof(the_banana));
+ 	}
+ }
+ 
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-Ensure-that-there-is-a-terminating-newline-.patch Added

@@ -0,0 +1,48 @@
+From 3c379c9a849a635cc7f05cbe49fe473ccf469ef9 Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Thu, 9 Feb 2023 09:54:11 +0000
+Subject: PATCH upstream: Ensure that there is a terminating newline when
+ adding a new
+
+entry to known_hosts.  bz#3529, with git+openssh at limpsquid.nl, ok deraadt@
+markus@
+
+OpenBSD-Commit-ID: fa8d90698da1886570512b96f051e266eac105e0
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=3c379c9a849a635cc7f05cbe49fe473ccf469ef9
+---
+ hostfile.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/hostfile.c b/hostfile.c
+index bd49e3ac..f5fa8084 100644
+--- a/hostfile.c
++++ b/hostfile.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: hostfile.c,v 1.93 2022/01/06 22:02:52 djm Exp $ */
++/* $OpenBSD: hostfile.c,v 1.94 2023/02/09 09:54:11 dtucker Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -520,9 +520,17 @@ add_host_to_hostfile(const char *filename, const char *host,
+ 	if (key == NULL)
+ 		return 1;	/* XXX ? */
+ 	hostfile_create_user_ssh_dir(filename, 0);
+-	f = fopen(filename, "a");
++	f = fopen(filename, "a+");
+ 	if (!f)
+ 		return 0;
++	/* Make sure we have a terminating newline. */
++	if (fseek(f, -1L, SEEK_END) == 0 && fgetc(f) != '\n')
++		if (fputc('\n', f) != '\n') {
++			error("Failed to add terminating newline to %s: %s",
++			   filename, strerror(errno));
++			fclose(f);
++			return 0;
++		}
+ 	success = write_host_entry(f, host, NULL, key, store_hash);
+ 	fclose(f);
+ 	return success;
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-Handle-dynamic-remote-port-forwarding-in-es.patch Added

@@ -0,0 +1,46 @@
+From 650de7ecd3567b5a5dbf16dd1eb598bd8c20bca8 Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Thu, 10 Nov 2022 23:03:10 +0000
+Subject: PATCH upstream: Handle dynamic remote port forwarding in escape
+ commandline's
+
+-R processing. bz#3499, ok djm@
+
+OpenBSD-Commit-ID: 194ee4cfe7ed0e2b8ad0727f493c798a50454208
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=650de7ecd3567b5a5dbf16dd1eb598bd8c20bca8
+---
+ clientloop.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/clientloop.c b/clientloop.c
+index 289d0b68..02349ccb 100644
+--- a/clientloop.c
++++ b/clientloop.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: clientloop.c,v 1.380 2022/06/03 04:30:46 djm Exp $ */
++/* $OpenBSD: clientloop.c,v 1.382 2022/11/10 23:03:10 dtucker Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -846,8 +846,15 @@ process_cmdline(struct ssh *ssh)
+ 		}
+ 		logit("Canceled forwarding.");
+ 	} else {
+-		if (!parse_forward(&fwd, s, dynamic, remote)) {
+-			logit("Bad forwarding specification.");
++		/* -R specs can be both dynamic or not, so check both. */
++		if (remote) {
++			if (!parse_forward(&fwd, s, 0, remote) &&
++			    !parse_forward(&fwd, s, 1, remote)) {
++				logit("Bad remote forwarding specification.");
++				goto out;
++			}
++		} else if (!parse_forward(&fwd, s, dynamic, remote)) {
++			logit("Bad local forwarding specification.");
+ 			goto out;
+ 		}
+ 		if (local || dynamic) {
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-Instead-of-skipping-the-all-tokens-test-if-.patch Added

@@ -0,0 +1,44 @@
+From 4d87a00f704e0365e11c3c38b170c1275ec461fc Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Sat, 14 Jan 2023 09:57:08 +0000
+Subject: PATCH upstream: Instead of skipping the all-tokens test if we don't
+ have
+
+OpenSSL (since we use it to compute the hash), put the hash at the end and
+just omit it if we don't have it.  Prompted by bz#3521.
+
+OpenBSD-Regress-ID: c79ecba64250ed3b6417294b6c965e6b12ca5eea
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=4d87a00f704e0365e11c3c38b170c1275ec461fc
+---
+diff --git a/regress/percent.sh b/regress/percent.sh
+index ed5c604d..3dfa8d2d 100644
+--- a/regress/percent.sh
++++ b/regress/percent.sh
+@@ -12,6 +12,7 @@ USER=`id -u -n`
+ USERID=`id -u`
+ HOST=`hostname | cut -f1 -d.`
+ HOSTNAME=`hostname`
++HASH=""
+ 
+ # Localcommand is evaluated after connection because %T is not available
+ # until then.  Because of this we use a different method of exercising it,
+@@ -98,10 +99,13 @@ for i in matchexec localcommand remotecommand controlpath identityagent \
+ 	# containing %d for UserKnownHostsFile
+ 	if  "$i" != "userknownhostsfile" ; then
+ 		trial $i '%d' $HOME
++		in='%%/%i/%h/%d/%L/%l/%n/%p/%r/%u'
++		out="%/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
+ 		if  ! -z "${HASH}" ; then
+-			trial $i '%%/%C/%i/%h/%d/%L/%l/%n/%p/%r/%u' \
+-			    "%/$HASH/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
++			in="$in/%C"
++			out="$out/$HASH"
+ 		fi
++		trial $i "$in" "$out"
+ 	fi
+ done
+ 
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-Move-scp-path-setting-to-a-helper-function.patch Added

@@ -0,0 +1,150 @@
+From 625f6bc39840167dafb3bf5b6a3e18503ac986e8 Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Fri, 13 Jan 2023 04:47:34 +0000
+Subject: PATCH upstream: Move scp path setting to a helper function.
+The
+ previous
+
+commit to add scp to the test sshd's path causes the t-envpass test to
+fail
+when the test scp is given using a fully qualified path.  Put this in a
+helper function and only call it from the scp tests.
+
+OpenBSD-Regress-ID: 7533dc1c4265c1de716abb062957994195b36df4
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=625f6bc39840167dafb3bf5b6a3e18503ac986e8
+---
+ regress/multiplex.sh |  3 ++-
+ regress/scp-uri.sh   |  4 +++-
+ regress/scp.sh       |  4 +++-
+ regress/scp3.sh      |  6 ++++--
+ regress/test-exec.sh | 21 +++++++++++++--------
+ 5 files changed, 25 insertions(+), 13 deletions(-)
+
+diff --git a/regress/multiplex.sh b/regress/multiplex.sh
+index 6317099..046194c 100644
+--- a/regress/multiplex.sh
++++ b/regress/multiplex.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: multiplex.sh,v 1.34 2022/06/03 04:31:54 djm Exp $
++#	$OpenBSD: multiplex.sh,v 1.35 2023/01/13 04:47:34 dtucker Exp $
+ #	Placed in the Public Domain.
+ 
+ make_tmpdir
+@@ -24,6 +24,7 @@ wait_for_mux_master_ready()
+ 	fatal "mux master never becomes ready"
+ }
+ 
++maybe_add_scp_path_to_sshd
+ start_sshd
+ 
+ start_mux_master()
+diff --git a/regress/scp-uri.sh b/regress/scp-uri.sh
+index 20ac3c8..eacbd45 100644
+--- a/regress/scp-uri.sh
++++ b/regress/scp-uri.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: scp-uri.sh,v 1.4 2021/08/10 03:35:45 djm Exp $
++#	$OpenBSD: scp-uri.sh,v 1.5 2023/01/13 04:47:34 dtucker Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="scp-uri"
+@@ -9,6 +9,8 @@ COPY2=${OBJ}/copy2
+ DIR=${COPY}.dd
+ DIR2=${COPY}.dd2
+ 
++maybe_add_scp_path_to_sshd
++
+ SRC=`dirname ${SCRIPT}`
+ cp ${SRC}/scp-ssh-wrapper.sh ${OBJ}/scp-ssh-wrapper.scp
+ chmod 755 ${OBJ}/scp-ssh-wrapper.scp
+diff --git a/regress/scp.sh b/regress/scp.sh
+index f47c594..ef4399e 100644
+--- a/regress/scp.sh
++++ b/regress/scp.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: scp.sh,v 1.14 2022/05/15 23:48:07 djm Exp $
++#   $OpenBSD: scp.sh,v 1.18 2023/01/13 04:47:34 dtucker Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="scp"
+@@ -16,6 +16,8 @@ COPY2=${OBJ}/copy2
+ DIR=${COPY}.dd
+ DIR2=${COPY}.dd2
+ 
++maybe_add_scp_path_to_sshd
++
+ SRC=`dirname ${SCRIPT}`
+ cp ${SRC}/scp-ssh-wrapper.sh ${OBJ}/scp-ssh-wrapper.scp
+ chmod 755 ${OBJ}/scp-ssh-wrapper.scp
+diff --git a/regress/scp3.sh b/regress/scp3.sh
+index 47db47c..dfb2d2f 100644
+--- a/regress/scp3.sh
++++ b/regress/scp3.sh
+@@ -1,9 +1,9 @@
+-#	$OpenBSD: scp3.sh,v 1.3 2021/08/10 03:35:45 djm Exp $
++#	$OpenBSD: scp3.sh,v 1.4 2023/01/13 04:47:34 dtucker Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="scp3"
+ 
+-#set -x
++set -x
+ 
+ COPY2=${OBJ}/copy2
+ DIR=${COPY}.dd
+@@ -15,6 +15,8 @@ if  $? -eq 1 ; then
+ 	skip "No scp on remote path."
+ fi
+ 
++maybe_add_scp_path_to_sshd
++
+ SRC=`dirname ${SCRIPT}`
+ cp ${SRC}/scp-ssh-wrapper.sh ${OBJ}/scp-ssh-wrapper.scp
+ chmod 755 ${OBJ}/scp-ssh-wrapper.scp
+diff --git a/regress/test-exec.sh b/regress/test-exec.sh
+index 7e311e8..df43f02 100644
+--- a/regress/test-exec.sh
++++ b/regress/test-exec.sh
+@@ -1,4 +1,4 @@
+-#	$OpenBSD: test-exec.sh,v 1.92 2022/07/25 07:12:45 dtucker Exp $
++#	$OpenBSD: test-exec.sh,v 1.94 2023/01/13 04:47:34 dtucker Exp $
+ #	Placed in the Public Domain.
+ 
+ #SUDO=sudo
+@@ -509,6 +509,18 @@ skip ()
+ 	exit $RESULT
+ }
+ 
++maybe_add_scp_path_to_sshd ()
++{
++	# If we're testing a non-installed scp, add its directory to sshd's
++	# PATH so we can test it.  We don't do this for all tests as it
++	# breaks the SetEnv tests.
++	case "$SCP" in
++	/*)	PATH_WITH_SCP="`dirname $SCP`:$PATH"
++		echo "	SetEnv PATH='$PATH_WITH_SCP'" >>$OBJ/sshd_config
++		echo "	SetEnv PATH='$PATH_WITH_SCP'" >>$OBJ/sshd_proxy ;;
++	esac
++}
++
+ RESULT=0
+ PIDFILE=$OBJ/pidfile
+ 
+@@ -529,13 +541,6 @@ cat << EOF > $OBJ/sshd_config
+ 	Subsystem	sftp	$SFTPSERVER
+ EOF
+ 
+-# If we're testing a non-installed scp, add its directory to sshd's PATH
+-# so we can test it.
+-case "$SCP" in
+-/*)	PATH_WITH_SCP="`dirname $SCP`:$PATH"
+-	echo "	SetEnv PATH='$PATH_WITH_SCP'" >>$OBJ/sshd_config ;;
+-esac
+-
+ # This may be necessary if /usr/src and/or /usr/obj are group-writable,
+ # but if you aren't careful with permissions then the unit tests could
+ # be abused to locally escalate privileges.
+-- 
+2.23.0
+

_service:tar_scm:backport-upstream-Shell-syntax-fix.-From-ren-mingshuai-vi-git.patch Added

_service:tar_scm:backport-upstream-The-idiomatic-way-of-coping-with-signed-cha.patch Added

@@ -0,0 +1,40 @@
+From 5a7a7acab2f466dc1d7467b5d05d35268c3137aa Mon Sep 17 00:00:00 2001
+From: "deraadt@openbsd.org" <deraadt@openbsd.org>
+Date: Thu, 15 Dec 2022 18:20:39 +0000
+Subject: PATCH upstream: The idiomatic way of coping with signed char vs
+ unsigned
+
+char (which did not come from stdio read functions) in the presence of
+ctype macros, is to always cast to (unsigned char).  casting to (int)
+for a "macro" which is documented to take int, is weird.  And sadly wrong,
+because of the sing extension risk.. same diff from florian
+
+OpenBSD-Commit-ID: 65b9a49a68e22ff3a0ebd593f363e9f22dd73fea
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=5a7a7acab2f466dc1d7467b5d05d35268c3137aa
+---
+ misc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/misc.c b/misc.c
+index 977c097e..41244da9 100644
+--- a/misc.c
++++ b/misc.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: misc.c,v 1.177 2022/08/11 01:56:51 djm Exp $ */
++/* $OpenBSD: misc.c,v 1.179 2022/12/15 18:20:39 deraadt Exp $ */
+ /*
+  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+  * Copyright (c) 2005-2020 Damien Miller.  All rights reserved.
+@@ -95,7 +95,7 @@ rtrim(char *s)
+ 	if ((i = strlen(s)) == 0)
+ 		return;
+ 	for (i--; i > 0; i--) {
+-		if (isspace((int)si))
++		if (isspace((unsigned char)si))
+ 			si = '\0';
+ 	}
+ }
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-When-OpenSSL-is-not-available-skip-parts-of.patch Added

@@ -0,0 +1,51 @@
+From d77fc611a62f2dfee0b654c31a50a814b13310dd Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Fri, 6 Jan 2023 12:33:33 +0000
+Subject: PATCH upstream: When OpenSSL is not available, skip parts of
+ percent test
+
+that require it. Based on github pr#368 from ren mingshuai.
+
+OpenBSD-Regress-ID: 49a375b2cf61ccb95b52e75e2e025cd10988ebb2
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=d77fc611a62f2dfee0b654c31a50a814b13310dd
+---
+ regress/percent.sh | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/regress/percent.sh b/regress/percent.sh
+index bb81779a..ed5c604d 100644
+--- a/regress/percent.sh
++++ b/regress/percent.sh
+@@ -79,10 +79,12 @@ for i in matchexec localcommand remotecommand controlpath identityagent \
+ 		trial $i '%T' NONE
+ 	fi
+ 	# Matches implementation in readconf.c:ssh_connection_hash()
+-	HASH=`printf "${HOSTNAME}127.0.0.1${PORT}$REMUSER" |
+-	    $OPENSSL_BIN sha1 | cut -f2 -d' '`
++	if  ! -z "${OPENSSL_BIN}" ; then
++		HASH=`printf "${HOSTNAME}127.0.0.1${PORT}$REMUSER" |
++		    $OPENSSL_BIN sha1 | cut -f2 -d' '`
++		trial $i '%C' $HASH
++	fi
+ 	trial $i '%%' '%'
+-	trial $i '%C' $HASH
+ 	trial $i '%i' $USERID
+ 	trial $i '%h' 127.0.0.1
+ 	trial $i '%L' $HOST
+@@ -96,8 +98,10 @@ for i in matchexec localcommand remotecommand controlpath identityagent \
+ 	# containing %d for UserKnownHostsFile
+ 	if  "$i" != "userknownhostsfile" ; then
+ 		trial $i '%d' $HOME
+-		trial $i '%%/%C/%i/%h/%d/%L/%l/%n/%p/%r/%u' \
+-		    "%/$HASH/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
++		if  ! -z "${HASH}" ; then
++			trial $i '%%/%C/%i/%h/%d/%L/%l/%n/%p/%r/%u' \
++			    "%/$HASH/$USERID/127.0.0.1/$HOME/$HOST/$HOSTNAME/somehost/$PORT/$REMUSER/$USER"
++		fi
+ 	fi
+ done
+ 
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-avoid-printf-s-NULL-if-using-ssh.patch Added

@@ -0,0 +1,42 @@
+From f673b49f3be3eb51074fbb8a405beb6cd0f7d93e Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 13 Jan 2023 02:44:02 +0000
+Subject: PATCH upstream: avoid printf("%s", NULL) if using ssh
+
+-oUserKnownHostsFile=none and a hostkey in one of the system known hosts file
+changes; ok dtucker@
+
+OpenBSD-Commit-ID: 7ca87614bfc6da491315536a7f2301434a9fe614
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=f673b49f3be3eb51074fbb8a405beb6cd0f7d93e
+---
+ sshconnect.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/sshconnect.c b/sshconnect.c
+index 0fca52b2..792bc34b 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: sshconnect.c,v 1.358 2022/08/26 08:16:27 djm Exp $ */
++/* $OpenBSD: sshconnect.c,v 1.361 2023/01/13 02:44:02 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -1276,8 +1276,11 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo,
+ 		}
+ 		/* The host key has changed. */
+ 		warn_changed_key(host_key);
+-		error("Add correct host key in %.100s to get rid of this message.",
+-		    user_hostfiles0);
++		if (num_user_hostfiles > 0 || num_system_hostfiles > 0) {
++			error("Add correct host key in %.100s to get rid "
++			    "of this message.", num_user_hostfiles > 0 ?
++			    user_hostfiles0 : system_hostfiles0);
++		}
+ 		error("Offending %s key in %s:%lu",
+ 		    sshkey_type(host_found->key),
+ 		    host_found->file, host_found->line);
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-fix-bug-in-PermitRemoteOpen-which-caused-it.patch Added

@@ -0,0 +1,113 @@
+From b3daa8dc582348d6ab8150bc1e571b7aa08c5388 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 2 Jan 2023 07:03:30 +0000
+Subject: PATCH upstream: fix bug in PermitRemoteOpen which caused it
+to
+ ignore its
+
+first argument unless it was one of the special keywords "any" or
+"none".
+
+Reported by Georges Chaudy in bz3515; ok dtucker@
+
+OpenBSD-Commit-ID: c5678a39f1ff79993d5ae3cfac5746a4ae148ea5
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=b3daa8dc582348d6ab8150bc1e571b7aa08c5388
+---
+ readconf.c | 67 +++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 36 insertions(+), 31 deletions(-)
+
+diff --git a/readconf.c b/readconf.c
+index 284da26..ccac632 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: readconf.c,v 1.369 2022/09/17 10:33:18 djm Exp $ */
++/* $OpenBSD: readconf.c,v 1.371 2023/01/02 07:03:30 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -1613,45 +1613,50 @@ parse_pubkey_algos:
+ 	case oPermitRemoteOpen:
+ 		uintptr = &options->num_permitted_remote_opens;
+ 		cppptr = &options->permitted_remote_opens;
+-		arg = argv_next(&ac, &av);
+-		if (!arg || *arg == '\0')
+-			fatal("%s line %d: missing %s specification",
+-			    filename, linenum, lookup_opcode_name(opcode));
+ 		uvalue = *uintptr;	/* modified later */
+-		if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
+-			if (*activep && uvalue == 0) {
+-				*uintptr = 1;
+-				*cppptr = xcalloc(1, sizeof(**cppptr));
+-				(*cppptr)0 = xstrdup(arg);
+-			}
+-			break;
+-		}
++		i = 0;
+ 		while ((arg = argv_next(&ac, &av)) != NULL) {
+ 			arg2 = xstrdup(arg);
+-			p = hpdelim(&arg);
+-			if (p == NULL) {
+-				fatal("%s line %d: missing host in %s",
+-				    filename, linenum,
+-				    lookup_opcode_name(opcode));
+-			}
+-			p = cleanhostname(p);
+-			/*
+-			 * don't want to use permitopen_port to avoid
+-			 * dependency on channels.ch here.
+-			 */
+-			if (arg == NULL ||
+-			    (strcmp(arg, "*") != 0 && a2port(arg) <= 0)) {
+-				fatal("%s line %d: bad port number in %s",
+-				    filename, linenum,
+-				    lookup_opcode_name(opcode));
+-			}
+-			if (*activep && uvalue == 0) {
++			/* Allow any/none only in first position */
++			if (strcasecmp(arg, "none") == 0 ||
++			    strcasecmp(arg, "any") == 0) {
++				if (i > 0 || ac > 0) {
++					error("%s line %d: keyword %s \"%s\" "
++					    "argument must appear alone.",
++					    filename, linenum, keyword, arg);
++					goto out;
++				}
++			} else {
++				p = hpdelim(&arg);
++				if (p == NULL) {
++					fatal("%s line %d: missing host in %s",
++					    filename, linenum,
++					    lookup_opcode_name(opcode));
++				}
++				p = cleanhostname(p);
++				/*
++				 * don't want to use permitopen_port to avoid
++				 * dependency on channels.ch here.
++				 */
++				if (arg == NULL || (strcmp(arg, "*") != 0 &&
++				    a2port(arg) <= 0)) {
++					fatal("%s line %d: bad port number "
++					    "in %s", filename, linenum,
++					    lookup_opcode_name(opcode));
++				}
++ 			}
++			
++            if (*activep && uvalue == 0) {
+ 				opt_array_append(filename, linenum,
+ 				    lookup_opcode_name(opcode),
+ 				    cppptr, uintptr, arg2);
+ 			}
+ 			free(arg2);
++			i++;
+ 		}
++		if (i == 0)
++			fatal("%s line %d: missing %s specification",
++			    filename, linenum, lookup_opcode_name(opcode));
+ 		break;
+ 
+ 	case oClearAllForwardings:
+-- 
+2.23.0
+

_service:tar_scm:backport-upstream-honour-user-s-umask-if-it-is-more-restricti.patch Added

@@ -0,0 +1,37 @@
+From 5ee2b8ccfcf4b606f450eb0ff2305e311f68b0be Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 6 Oct 2022 22:42:37 +0000
+Subject: PATCH upstream: honour user's umask if it is more restrictive then
+ the ssh
+
+default (022); based on patch from Alex Henrie, ok dtucker@ deraadt@
+
+OpenBSD-Commit-ID: fe1b9e15fc9a4f49fc338e848ce14d8727abe82d
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=5ee2b8ccfcf4b606f450eb0ff2305e311f68b0be
+---
+ ssh.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index 25be53d5..e711dbd2 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: ssh.c,v 1.576 2022/09/17 10:33:18 djm Exp $ */
++/* $OpenBSD: ssh.c,v 1.577 2022/10/06 22:42:37 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -679,7 +679,7 @@ main(int ac, char **av)
+ 	 * writable only by the owner, which is ok for all files for which we
+ 	 * don't set the modes explicitly.
+ 	 */
+-	umask(022);
++	umask(022 | umask(077));
+ 
+ 	msetlocale();
+ 
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-regression-test-for-PermitRemoteOpen.patch Added

@@ -0,0 +1,138 @@
+From 845ceecea2ac311b0c267f9ecbd34862e1876fc6 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 2 Jan 2023 07:03:57 +0000
+Subject: PATCH upstream: regression test for PermitRemoteOpen
+
+OpenBSD-Regress-ID: 8271aafbf5c21950cd5bf966f08e585cebfe630c
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=845ceecea2ac311b0c267f9ecbd34862e1876fc6
+---
+ regress/dynamic-forward.sh | 84 ++++++++++++++++++++++++++++++--------
+ 1 file changed, 66 insertions(+), 18 deletions(-)
+
+diff --git a/regress/dynamic-forward.sh b/regress/dynamic-forward.sh
+index 84f8ee19..f6c2393d 100644
+--- a/regress/dynamic-forward.sh
++++ b/regress/dynamic-forward.sh
+@@ -1,10 +1,12 @@
+-#	$OpenBSD: dynamic-forward.sh,v 1.13 2017/09/21 19:18:12 markus Exp $
++#	$OpenBSD: dynamic-forward.sh,v 1.14 2023/01/02 07:03:57 djm Exp $
+ #	Placed in the Public Domain.
+ 
+ tid="dynamic forwarding"
+ 
+ FWDPORT=`expr $PORT + 1`
+ 
++cp $OBJ/ssh_config $OBJ/ssh_config.orig
++
+ if have_prog nc && nc -h 2>&1 | grep "proxy address" >/dev/null; then
+ 	proxycmd="nc -x 127.0.0.1:$FWDPORT -X"
+ elif have_prog connect; then
+@@ -15,16 +17,16 @@ else
+ fi
+ trace "will use ProxyCommand $proxycmd"
+ 
+-start_sshd
+-
+-for d in D R; do
++start_ssh() {
++	direction="$1"
++	arg="$2"
+ 	n=0
+ 	error="1"
+-	trace "start dynamic forwarding, fork to background"
+-
++	trace "start dynamic -$direction forwarding, fork to background"
++	(cat $OBJ/ssh_config.orig ; echo "$arg") > $OBJ/ssh_config
+ 	while  "$error" -ne 0 -a "$n" -lt 3 ; do
+ 		n=`expr $n + 1`
+-		${SSH} -F $OBJ/ssh_config -f -$d $FWDPORT -q \
++		${SSH} -F $OBJ/ssh_config -f -$direction $FWDPORT -q \
+ 		    -oExitOnForwardFailure=yes somehost exec sh -c \
+ 			\'"echo \$\$ > $OBJ/remote_pid; exec sleep 444"\'
+ 		error=$?
+@@ -36,18 +38,9 @@ for d in D R; do
+ 	if  "$error" -ne 0 ; then
+ 		fatal "failed to start dynamic forwarding"
+ 	fi
++}
+ 
+-	for s in 4 5; do
+-	    for h in 127.0.0.1 localhost; do
+-		trace "testing ssh socks version $s host $h (-$d)"
+-		${SSH} -F $OBJ/ssh_config \
+-			-o "ProxyCommand ${proxycmd}${s} $h $PORT" \
+-			somehost cat ${DATA} > ${COPY}
+-		test -f ${COPY}	 || fail "failed copy ${DATA}"
+-		cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
+-	    done
+-	done
+-
++stop_ssh() {
+ 	if  -f $OBJ/remote_pid ; then
+ 		remote=`cat $OBJ/remote_pid`
+ 		trace "terminate remote shell, pid $remote"
+@@ -57,5 +50,60 @@ for d in D R; do
+ 	else
+ 		fail "no pid file: $OBJ/remote_pid"
+ 	fi
++}
++
++check_socks() {
++	direction=$1
++	expect_success=$2
++	for s in 4 5; do
++	    for h in 127.0.0.1 localhost; do
++		trace "testing ssh socks version $s host $h (-$direction)"
++		${SSH} -F $OBJ/ssh_config \
++			-o "ProxyCommand ${proxycmd}${s} $h $PORT 2>/dev/null" \
++			somehost cat ${DATA} > ${COPY}
++		r=$?
++		if  "x$expect_success" = "xY"  ; then
++			if  $r -ne 0  ; then
++				fail "ssh failed with exit status $r"
++			fi
++			test -f ${COPY}	 || fail "failed copy ${DATA}"
++			cmp ${DATA} ${COPY} || fail "corrupted copy of ${DATA}"
++		elif  $r -eq 0  ; then
++			fail "ssh unexpectedly succeeded"
++		fi
++	    done
++	done
++}
++
++start_sshd
++
++for d in D R; do
++	verbose "test -$d forwarding"
++	start_ssh $d
++	check_socks $d Y
++	stop_ssh
++	test "x$d" = "xR" || continue
++	
++	# Test PermitRemoteOpen
++	verbose "PermitRemoteOpen=any"
++	start_ssh $d PermitRemoteOpen=any
++	check_socks $d Y
++	stop_ssh
++
++	verbose "PermitRemoteOpen=none"
++	start_ssh $d PermitRemoteOpen=none
++	check_socks $d N
++	stop_ssh
++
++	verbose "PermitRemoteOpen=explicit"
++	start_ssh $d \
++	    PermitRemoteOpen="127.0.0.1:$PORT ::1:$PORT localhost:$PORT"
++	check_socks $d Y
++	stop_ssh
+ 
++	verbose "PermitRemoteOpen=disallowed"
++	start_ssh $d \
++	    PermitRemoteOpen="127.0.0.1:1 ::1:1 localhost:1"
++	check_socks $d N
++	stop_ssh
+ done
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-test-compat_kex_proposal-by-dtucker.patch Added

@@ -0,0 +1,125 @@
+From 903c556b938fff2d7bff8da2cc460254430963c5 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 2 Feb 2023 12:12:52 +0000
+Subject: PATCH upstream: test compat_kex_proposal(); by dtucker@
+
+OpenBSD-Regress-ID: 0e404ee264db546f9fdbf53390689ab5f8d38bf2
+
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=903c556b938fff2d7bff8da2cc460254430963c5
+---
+ regress/unittests/kex/test_proposal.c | 79 +++++++++++++++++++++++++++
+ regress/unittests/kex/tests.c         |  4 +-
+ 2 files changed, 82 insertions(+), 1 deletion(-)
+ create mode 100644 regress/unittests/kex/test_proposal.c
+
+diff --git a/regress/unittests/kex/test_proposal.c b/regress/unittests/kex/test_proposal.c
+new file mode 100644
+index 0000000..b89ff59
+--- /dev/null
++++ b/regress/unittests/kex/test_proposal.c
+@@ -0,0 +1,79 @@
++/* 	$OpenBSD: test_proposal.c,v 1.1 2023/02/02 12:12:52 djm Exp $ */
++/*
++ * Regress test KEX
++ *
++ * Placed in the public domain
++ */
++
++#include <sys/types.h>
++#include <signal.h>
++#include <stdio.h>
++#include <stdint.h>
++#include <stdlib.h>
++#include <string.h>
++
++#include "test_helper.h"
++
++#include "compat.h"
++#include "ssherr.h"
++#include "sshbuf.h"
++#include "kex.h"
++#include "packet.h"
++#include "xmalloc.h"
++
++void kex_proposal(void);
++
++#define CURVE25519 "curve25519-sha256@libssh.org"
++#define DHGEX1 "diffie-hellman-group-exchange-sha1"
++#define DHGEX256 "diffie-hellman-group-exchange-sha256"
++#define KEXALGOS CURVE25519","DHGEX256","DHGEX1
++void
++kex_proposal(void)
++{
++	size_t i;
++	struct ssh ssh;
++	char *result, *out, *in;
++	struct {
++		char *in;	/* TODO: make this const */
++		char *out;
++		int compat;
++	} tests = {
++		{ KEXALGOS, KEXALGOS, 0},
++		{ KEXALGOS, DHGEX256","DHGEX1, SSH_BUG_CURVE25519PAD },
++		{ KEXALGOS, CURVE25519, SSH_OLD_DHGEX },
++		{ "a,"KEXALGOS, "a", SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX },
++		/* TODO: enable once compat_kex_proposal doesn't fatal() */
++		/* { KEXALGOS, "", SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX }, */
++	};
++
++	TEST_START("compat_kex_proposal");
++	for (i = 0; i < sizeof(tests) / sizeof(*tests); i++) {
++		ssh.compat = testsi.compat;
++		/* match entire string */
++		result = compat_kex_proposal(&ssh, testsi.in);
++		ASSERT_STRING_EQ(result, testsi.out);
++		free(result);
++		/* match at end */
++		in = kex_names_cat("a", testsi.in);
++		out = kex_names_cat("a", testsi.out);
++		result = compat_kex_proposal(&ssh, in);
++		ASSERT_STRING_EQ(result, out);
++		free(result); free(in); free(out);
++		/* match at start */
++		in = kex_names_cat(testsi.in, "a");
++		out = kex_names_cat(testsi.out, "a");
++		result = compat_kex_proposal(&ssh, in);
++		ASSERT_STRING_EQ(result, out);
++		free(result); free(in); free(out);
++		/* match in middle */
++		xasprintf(&in, "a,%s,b", testsi.in);
++		if (*(testsi.out) == '\0')
++			out = xstrdup("a,b");
++		else
++			xasprintf(&out, "a,%s,b", testsi.out);
++		result = compat_kex_proposal(&ssh, in);
++		ASSERT_STRING_EQ(result, out);
++		free(result); free(in); free(out);
++	}
++	TEST_DONE();
++}
+diff --git a/regress/unittests/kex/tests.c b/regress/unittests/kex/tests.c
+index e7036ec..2a83daf 100644
+--- a/regress/unittests/kex/tests.c
++++ b/regress/unittests/kex/tests.c
+@@ -1,4 +1,4 @@
+-/* 	$OpenBSD: tests.c,v 1.1 2015/01/15 23:41:29 markus Exp $ */
++/* 	$OpenBSD: tests.c,v 1.2 2023/02/02 12:12:52 djm Exp $ */
+ /*
+  * Placed in the public domain
+  */
+@@ -6,9 +6,11 @@
+ #include "../test_helper/test_helper.h"
+ 
+ void kex_tests(void);
++void kex_proposal(void);
+ 
+ void
+ tests(void)
+ {
+ 	kex_tests();
++	kex_proposal();
+ }
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-use-correct-type-with-sizeof-ok-djm.patch Added

@@ -0,0 +1,34 @@
+From 18376847b8043ba967eabbe23692ef74c9a3fddc Mon Sep 17 00:00:00 2001
+From: "jsg@openbsd.org" <jsg@openbsd.org>
+Date: Thu, 13 Oct 2022 09:09:28 +0000
+Subject: PATCH upstream: use correct type with sizeof ok djm@
+
+OpenBSD-Commit-ID: d6c882c2e8a42ff831a5b3cbc2c961ecb2dd6143
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=18376847b8043ba967eabbe23692ef74c9a3fddc
+---
+ ssh.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index e711dbd2..21cbd7c3 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: ssh.c,v 1.577 2022/10/06 22:42:37 djm Exp $ */
++/* $OpenBSD: ssh.c,v 1.578 2022/10/13 09:09:28 jsg Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -1579,7 +1579,7 @@ main(int ac, char **av)
+ 	if (options.hostbased_authentication) {
+ 		sensitive_data.nkeys = 10;
+ 		sensitive_data.keys = xcalloc(sensitive_data.nkeys,
+-		    sizeof(struct sshkey));
++		    sizeof(*sensitive_data.keys));
+ 
+ 		/* XXX check errors? */
+ #define L_PUBKEY(p,o) do { \
+-- 
+2.27.0
+

_service:tar_scm:backport-upstream-when-restoring-non-blocking-mode-to-stdio-f.patch Added

@@ -0,0 +1,92 @@
+From 35253af01d8c0ab444c8377402121816e71c71f5 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 18 Jan 2023 02:00:10 +0000
+Subject: PATCH upstream: when restoring non-blocking mode to stdio
+fds,
+ restore
+ 
+exactly the flags that ssh started with and don't just clobber them with
+zero, as this could also remove the append flag from the set;
+
+bz3523; ok dtucker@
+
+OpenBSD-Commit-ID: 1336b03e881db7564a4b66014eb24c5230e9a0c0
+Conflict:NA
+Reference:https://anongit.mindrot.org/openssh.git/commit?id=35253af01d8c0ab444c8377402121816e71c71f5
+---
+ channels.c | 19 ++++++++++++++-----
+ channels.h |  3 ++-
+ 2 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/channels.c b/channels.c
+index ea4d8da..cee4d2c 100644
+--- a/channels.c
++++ b/channels.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: channels.c,v 1.420 2022/09/19 08:49:50 djm Exp $ */
++/* $OpenBSD: channels.c,v 1.427 2023/01/18 02:00:10 djm Exp $ */
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+@@ -337,16 +337,19 @@ channel_register_fds(struct ssh *ssh, Channel *c, int rfd, int wfd, int efd,
+ 		 */
+ 		if (rfd != -1 && !isatty(rfd) &&
+ 		    (val = fcntl(rfd, F_GETFL)) != -1 && !(val & O_NONBLOCK)) {
++			c->restore_flags0 = val;
+ 			c->restore_block |= CHANNEL_RESTORE_RFD;
+ 			set_nonblock(rfd);
+ 		}
+ 		if (wfd != -1 && !isatty(wfd) &&
+ 		    (val = fcntl(wfd, F_GETFL)) != -1 && !(val & O_NONBLOCK)) {
++			c->restore_flags1 = val;
+ 			c->restore_block |= CHANNEL_RESTORE_WFD;
+ 			set_nonblock(wfd);
+ 		}
+ 		if (efd != -1 && !isatty(efd) &&
+ 		    (val = fcntl(efd, F_GETFL)) != -1 && !(val & O_NONBLOCK)) {
++			c->restore_flags2 = val;
+ 			c->restore_block |= CHANNEL_RESTORE_EFD;
+ 			set_nonblock(efd);
+ 		}
+@@ -428,10 +431,16 @@ channel_close_fd(struct ssh *ssh, Channel *c, int *fdp)
+ 	if (fd == -1)
+ 		return 0;
+ 
+-	if ((*fdp == c->rfd && (c->restore_block & CHANNEL_RESTORE_RFD) != 0) ||
+-	   (*fdp == c->wfd && (c->restore_block & CHANNEL_RESTORE_WFD) != 0) ||
+-	   (*fdp == c->efd && (c->restore_block & CHANNEL_RESTORE_EFD) != 0))
+-		(void)fcntl(*fdp, F_SETFL, 0);	/* restore blocking */
++	/* restore blocking */
++	if (*fdp == c->rfd &&
++	    (c->restore_block & CHANNEL_RESTORE_RFD) != 0)
++		(void)fcntl(*fdp, F_SETFL, c->restore_flags0);
++	else if (*fdp == c->wfd &&
++	    (c->restore_block & CHANNEL_RESTORE_WFD) != 0)
++		(void)fcntl(*fdp, F_SETFL, c->restore_flags1);
++	else if (*fdp == c->efd &&
++	    (c->restore_block & CHANNEL_RESTORE_EFD) != 0)
++		(void)fcntl(*fdp, F_SETFL, c->restore_flags2);
+ 
+ 	if (*fdp == c->rfd) {
+ 		c->io_want &= ~SSH_CHAN_IO_RFD;
+diff --git a/channels.h b/channels.h
+index 7d8a83e..9b1b11e 100644
+--- a/channels.h
++++ b/channels.h
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: channels.h,v 1.143 2022/05/05 00:56:58 djm Exp $ */
++/* $OpenBSD: channels.h,v 1.148 2023/01/18 02:00:10 djm Exp $ */
+ 
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+@@ -153,6 +153,7 @@ struct Channel {
+ 				 * this way post-IO handlers are not
+ 				 * accidentally called if a FD gets reused */
+ 	int	restore_block;	/* fd mask to restore blocking status */
++    int restore_flags3;	/* flags to restore */
+ 	struct sshbuf *input;	/* data read from socket, to be sent over
+ 				 * encrypted connection */
+ 	struct sshbuf *output;	/* data received over encrypted connection for
+-- 
+2.23.0
+

_service:tar_scm:bugfix-openssh-6.6p1-log-usepam-no.patch Deleted

@@ -1,42 +0,0 @@
-From 31883f21eff4265b68bb36f67b254adb524db6ae Mon Sep 17 00:00:00 2001
-From: guoxiaoqi <guoxiaoqi2@huawei.com>
-Date: Thu, 16 Apr 2020 14:51:44 +0800
-Subject: PATCH bugfix-openssh-6.6p1-log-usepam-no
-
----
- sshd.c      | 4 ++--
- sshd_config | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/sshd.c b/sshd.c
-index c6c03ae..c291a5e 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -1812,9 +1812,9 @@ main(int ac, char **av)
- 	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL);
- 
--	/* 'UsePAM no' is not supported in Fedora */
-+	/* 'UsePAM no' is not supported in openEuler */
- 	if (! options.use_pam)
--		logit("WARNING: 'UsePAM no' is not supported in Fedora and may cause several problems.");
-+		logit("WARNING: 'UsePAM no' is not supported in openEuler and may cause several problems.");
- 
- #ifdef WITH_OPENSSL
- 	if (options.moduli_file != NULL)
-diff --git a/sshd_config b/sshd_config
-index e125992..ebc28b3 100644
---- a/sshd_config
-+++ b/sshd_config
-@@ -87,7 +87,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
- # If you just want the PAM account and session checks to run without
- # PAM authentication, then enable this but set PasswordAuthentication
- # and KbdInteractiveAuthentication to 'no'.
--# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
-+# WARNING: 'UsePAM no' is not supported in openEuler and may cause several
- # problems.
- #UsePAM no
- 
--- 
-2.23.0
-

_service:tar_scm:bugfix-openssh-add-option-check-username-splash.patch Changed

@@ -6,7 +6,6 @@
 add a check to inhibit username contains splash
 add an option 'CheckUserSplash' so that user can turn off
 this check
-
 ---
  auth2.c     | 4 +++-
  servconf.c  | 8 ++++++++
@@ -15,10 +14,10 @@
  4 files changed, 14 insertions(+), 1 deletion(-)
 
 diff --git a/auth2.c b/auth2.c
-index 4adc502..956b9cf 100644
+index 203ba01..284ea19 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -282,11 +282,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+@@ -281,11 +281,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
  	debug("userauth-request for user %s service %s method %s", user, service, method);
  	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -34,10 +33,10 @@
  		*style++ = 0;
  
 diff --git a/servconf.c b/servconf.c
-index 7001d56..76147f9 100644
+index d72fb62..6888971 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -195,6 +195,7 @@ initialize_server_options(ServerOptions *options)
+@@ -201,6 +201,7 @@ initialize_server_options(ServerOptions *options)
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->version_addendum = NULL;
@@ -45,7 +44,7 @@
  	options->fingerprint_hash = -1;
  	options->disable_forwarding = -1;
  	options->expose_userauth_info = -1;
-@@ -473,6 +474,8 @@ fill_default_server_options(ServerOptions *options)
+@@ -460,6 +461,8 @@ fill_default_server_options(ServerOptions *options)
  		options->ip_qos_bulk = IPTOS_DSCP_CS1;
  	if (options->version_addendum == NULL)
  		options->version_addendum = xstrdup("");
@@ -54,15 +53,15 @@
  	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
  		options->fwd_opts.streamlocal_bind_mask = 0177;
  	if (options->fwd_opts.streamlocal_bind_unlink == -1)
-@@ -574,6 +577,7 @@ typedef enum {
- 	sStreamLocalBindMask, sStreamLocalBindUnlink,
+@@ -553,6 +556,7 @@ typedef enum {
  	sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
  	sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider,
+ 	sRequiredRSASize,
 +	sCheckUserSplash,
  	sDeprecated, sIgnore, sUnsupported
  } ServerOpCodes;
  
-@@ -740,6 +744,7 @@ static struct {
+@@ -726,6 +730,7 @@ static struct {
  	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
  	{ "disableforwarding", sDisableForwarding, SSHCFG_ALL },
  	{ "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL },
@@ -70,7 +69,7 @@
  	{ "rdomain", sRDomain, SSHCFG_ALL },
  	{ "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
  	{ "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
-@@ -1360,6 +1365,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1384,6 +1389,9 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  	case sUsePAM:
  		intptr = &options->use_pam;
  		goto parse_flag;
@@ -81,30 +80,27 @@
  	/* Standard Options */
  	case sBadOption:
 diff --git a/servconf.h b/servconf.h
-index a3827e5..2c16b5a 100644
+index 77fd779..694addf 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -226,6 +226,7 @@ typedef struct {
+@@ -237,6 +237,7 @@ typedef struct {
  	int	fingerprint_hash;
  	int	expose_userauth_info;
  	u_int64_t timing_secret;
-+	int check_user_splash;      /* check whether splash exists in username, if exist, disable login */
++	int	check_user_splash;      /* check whether splash exists in username, if exist, disable login */
  	char   *sk_provider;
+ 	int	required_rsa_size;	/* minimum size of RSA keys */
  }       ServerOptions;
- 
 diff --git a/sshd_config b/sshd_config
-index ebc28b3..b121450 100644
+index 6d47368..973aecf 100644
 --- a/sshd_config
 +++ b/sshd_config
-@@ -125,6 +125,8 @@ Subsystem	sftp	/usr/libexec/sftp-server
- # Example of overriding settings on a per-user basis
- #Match User anoncvs
- #	X11Forwarding no
+@@ -128,3 +128,5 @@ Subsystem	sftp	/usr/libexec/sftp-server
  #	AllowTcpForwarding no
  #	PermitTTY no
  #	ForceCommand cvs server
 +#CheckUserSplash yes
 +
 -- 
-2.23.0
+2.27.0

_service:tar_scm:feature-add-SMx-support.patch Added

@@ -0,0 +1,1561 @@
+From 93b312c0263cbf40f66448ff7ddbea7a2def1953 Mon Sep 17 00:00:00 2001
+From: kircher <majun65@huawei.com>
+Date: Fri, 29 Jul 2022 10:45:08 +0800
+Subject: PATCH add SMx support in openssh
+HostKeyAlgorithms sm2
+KexAlgorithms sm2-sm3
+MACs hmac-sm3
+Ciphers sm4-ctr
+PubkeyAcceptedAlgorithms sm2
+FingerprintHash sm3
+
+---
+ Makefile.in                           |   4 +-
+ authfd.c                              |   2 +
+ authfile.c                            |   1 +
+ cipher.c                              |   1 +
+ digest-openssl.c                      |   1 +
+ digest.h                              |   3 +-
+ kex.c                                 |   1 +
+ kex.h                                 |   3 +
+ kexecdh.c                             |  23 +-
+ kexgen.c                              |   3 +
+ kexsm2.c                              | 406 ++++++++++++++++++++++++++
+ mac.c                                 |   1 +
+ pathnames.h                           |   1 +
+ regress/agent.sh                      |   9 +
+ regress/keytype.sh                    |   2 +
+ regress/knownhosts-command.sh         |   1 +
+ regress/misc/fuzz-harness/sig_fuzz.cc |   4 +
+ regress/unittests/kex/test_kex.c      |   3 +
+ ssh-ecdsa.c                           |   6 +-
+ ssh-keygen.c                          |  12 +-
+ ssh-keyscan.c                         |  12 +-
+ ssh-sm2.c                             | 230 +++++++++++++++
+ ssh_api.c                             |   2 +
+ sshconnect2.c                         |   1 +
+ sshd.c                                |   7 +
+ sshkey.c                              |  62 +++-
+ sshkey.h                              |   9 +
+ 27 files changed, 794 insertions(+), 16 deletions(-)
+ create mode 100644 kexsm2.c
+ create mode 100644 ssh-sm2.c
+
+diff --git a/Makefile.in b/Makefile.in
+index 07bf440..1393190 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -100,14 +100,14 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	log.o match.o moduli.o nchan.o packet.o \
+ 	readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \
+ 	atomicio.o dispatch.o mac.o misc.o utf8.o \
+-	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
++	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-sm2.o ssh-ecdsa-sk.o \
+ 	ssh-ed25519-sk.o ssh-rsa.o dh.o \
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+ 	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
+ 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
+ 	ssh-ed25519.o digest-openssl.o digest-libc.o \
+ 	hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
+-	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
++	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o kexsm2.o \
+ 	kexgexc.o kexgexs.o \
+ 	kexsntrup761x25519.o sntrup761.o kexgen.o \
+ 	kexgssc.o \
+diff --git a/authfd.c b/authfd.c
+index 9f092f7..163b4b5 100644
+--- a/authfd.c
++++ b/authfd.c
+@@ -512,6 +512,8 @@ ssh_add_identity_constrained(int sock, struct sshkey *key,
+ 	case KEY_DSA_CERT:
+ 	case KEY_ECDSA:
+ 	case KEY_ECDSA_CERT:
++	case KEY_SM2:
++	case KEY_SM2_CERT:
+ 	case KEY_ECDSA_SK:
+ 	case KEY_ECDSA_SK_CERT:
+ #endif
+diff --git a/authfile.c b/authfile.c
+index 666730b..dce1e84 100644
+--- a/authfile.c
++++ b/authfile.c
+@@ -343,6 +343,7 @@ sshkey_load_private_cert(int type, const char *filename, const char *passphrase,
+ 	case KEY_RSA:
+ 	case KEY_DSA:
+ 	case KEY_ECDSA:
++	case KEY_SM2:
+ #endif /* WITH_OPENSSL */
+ 	case KEY_ED25519:
+ 	case KEY_XMSS:
+diff --git a/cipher.c b/cipher.c
+index b54b994..039e414 100644
+--- a/cipher.c
++++ b/cipher.c
+@@ -88,6 +88,7 @@ static const struct sshcipher ciphers = {
+ #endif
+ 	{ "chacha20-poly1305@openssh.com",
+ 				8, 64, 0, 16, CFLAG_CHACHAPOLY, NULL },
++	{ "sm4-ctr",            16, 16, 0, 0, 0, EVP_sm4_ctr },
+ 	{ "none",		8, 0, 0, 0, CFLAG_NONE, NULL },
+ 
+ 	{ NULL,			0, 0, 0, 0, 0, NULL }
+diff --git a/digest-openssl.c b/digest-openssl.c
+index 94730e9..fa92360 100644
+--- a/digest-openssl.c
++++ b/digest-openssl.c
+@@ -61,6 +61,7 @@ const struct ssh_digest digests = {
+ 	{ SSH_DIGEST_SHA256,	"SHA256",	32,	EVP_sha256 },
+ 	{ SSH_DIGEST_SHA384,	"SHA384",	48,	EVP_sha384 },
+ 	{ SSH_DIGEST_SHA512,	"SHA512",	64,	EVP_sha512 },
++	{ SSH_DIGEST_SM3,       "SM3",          32,     EVP_sm3 },
+ 	{ -1,			NULL,		0,	NULL },
+ };
+ 
+diff --git a/digest.h b/digest.h
+index c7ceeb3..520722c 100644
+--- a/digest.h
++++ b/digest.h
+@@ -27,7 +27,8 @@
+ #define SSH_DIGEST_SHA256	2
+ #define SSH_DIGEST_SHA384	3
+ #define SSH_DIGEST_SHA512	4
+-#define SSH_DIGEST_MAX		5
++#define SSH_DIGEST_SM3          5
++#define SSH_DIGEST_MAX		6
+ 
+ struct sshbuf;
+ struct ssh_digest_ctx;
+diff --git a/kex.c b/kex.c
+index d0a9dee..6284f90 100644
+--- a/kex.c
++++ b/kex.c
+@@ -124,6 +124,7 @@ static const struct kexalg kexalgs = {
+ 	    SSH_DIGEST_SHA512 },
+ #endif
+ #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
++	{ "sm2-sm3", KEX_SM2_SM3, NID_sm2, SSH_DIGEST_SM3 },
+ 	{ NULL, 0, -1, -1},
+ };
+ static const struct kexalg gss_kexalgs = {
+diff --git a/kex.h b/kex.h
+index d26ba26..8b95227 100644
+--- a/kex.h
++++ b/kex.h
+@@ -102,6 +102,7 @@ enum kex_exchange {
+ 	KEX_ECDH_SHA2,
+ 	KEX_C25519_SHA256,
+ 	KEX_KEM_SNTRUP761X25519_SHA512,
++	KEX_SM2_SM3,
+ #ifdef GSSAPI
+ 	KEX_GSS_GRP1_SHA1,
+ 	KEX_GSS_GRP14_SHA1,
+@@ -277,6 +278,8 @@ int	kexc25519_shared_key_ext(const u_char keyCURVE25519_SIZE,
+ 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+ 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+ 
++int SM2KAP_compute_key(void *out, size_t outlen, const EC_POINT *pub_key, const EC_KEY *eckey, int server);
++
+ #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
+ void	dump_digest(const char *, const u_char *, int);
+ #endif
+diff --git a/kexecdh.c b/kexecdh.c
+index efb2e55..69ec13b 100644
+--- a/kexecdh.c
++++ b/kexecdh.c
+@@ -44,7 +44,7 @@
+ 
+ static int
+ kex_ecdh_dec_key_group(struct kex *, const struct sshbuf *, EC_KEY *key,
+-    const EC_GROUP *, struct sshbuf **);
++    const EC_GROUP *, struct sshbuf **, int server);
+ 
+ int
+ kex_ecdh_keypair(struct kex *kex)
+@@ -124,7 +124,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob,
+ 	    (r = sshbuf_get_u32(server_blob, NULL)) != 0)
+ 		goto out;
+ 	if ((r = kex_ecdh_dec_key_group(kex, client_blob, server_key, group,
+-	    shared_secretp)) != 0)
++	    shared_secretp, 1)) != 0)
+ 		goto out;
+ 	*server_blobp = server_blob;
+ 	server_blob = NULL;
+@@ -136,7 +136,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob,
+ 
+ static int
+ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+-    EC_KEY *key, const EC_GROUP *group, struct sshbuf **shared_secretp)
++    EC_KEY *key, const EC_GROUP *group, struct sshbuf **shared_secretp, int server)
+ {
+ 	struct sshbuf *buf = NULL;
+ 	BIGNUM *shared_secret = NULL;
+@@ -176,11 +176,20 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob,
+ 		r = SSH_ERR_ALLOC_FAIL;
+ 		goto out;
+ 	}
+-	if (ECDH_compute_key(kbuf, klen, dh_pub, key, NULL) != (int)klen ||
++	if (kex->ec_nid == NID_sm2) {
++		if (SM2KAP_compute_key(kbuf, klen, dh_pub, key, server) != (int)klen ||
+ 	    BN_bin2bn(kbuf, klen, shared_secret) == NULL) {

_service:tar_scm:feature-openssh-7.4-hima-sftpserver-oom-and-fix.patch Changed

@@ -1,19 +1,20 @@
 From 6d98c61e18fe65a52e21df9cece74675f9c18125 Mon Sep 17 00:00:00 2001
-From: s00467541 <shenyining@huawei.com>
+From: shenyining <shenyining@huawei.com>
 Date: Thu, 16 Apr 2020 17:13:24 +0800
 Subject: PATCH sync patch, add new judgement and
  delete default sftp-put-check.cfg
 
-Signed-off-by: s00467541 <shenyining@huawei.com>
+Signed-off-by: shenyining <shenyining@huawei.com>
+
 ---
- sftp-server.c | 703 +++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 691 insertions(+), 12 deletions(-)
+ sftp-server.c | 702 +++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 690 insertions(+), 12 deletions(-)
 
 diff --git a/sftp-server.c b/sftp-server.c
-index 01d6f8f..682c19a 100644
+index 5677aa3..4eb06d1 100644
 --- a/sftp-server.c
 +++ b/sftp-server.c
-@@ -29,6 +29,12 @@
+@@ -30,6 +30,12 @@
  #include <sys/statvfs.h>
  #endif
  
@@ -26,7 +27,7 @@
  #include <dirent.h>
  #include <errno.h>
  #include <fcntl.h>
-@@ -51,6 +57,17 @@
+@@ -57,6 +63,17 @@
  #include "sftp.h"
  #include "sftp-common.h"
  
@@ -44,7 +45,7 @@
  char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
  
  /* Maximum data read that we are willing to accept */
-@@ -89,6 +106,452 @@ struct Stat {
+@@ -98,6 +115,452 @@ struct Stat {
  	Attrib attrib;
  };
  
@@ -497,7 +498,7 @@
  /* Packet handlers */
  static void process_open(u_int32_t id);
  static void process_close(u_int32_t id);
-@@ -695,6 +1158,15 @@ process_open(u_int32_t id)
+@@ -755,6 +1218,15 @@ process_open(u_int32_t id)
  	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
  	    (r = decode_attrib(iqueue, &a)) != 0)
  		fatal_fr(r, "parse");
@@ -513,7 +514,7 @@
  
  	debug3("request %u: open flags %d", id, pflags);
  	flags = flags_from_portable(pflags);
-@@ -728,6 +1200,8 @@ process_open(u_int32_t id)
+@@ -788,6 +1260,8 @@ process_open(u_int32_t id)
  		(void) umask(old_umask); /* restore umask to something sane */
  	if (status != SSH2_FX_OK)
  		send_status(id, status);
@@ -522,7 +523,7 @@
  	free(name);
  }
  
-@@ -759,6 +1233,17 @@ process_read(u_int32_t id)
+@@ -820,6 +1294,17 @@ process_read(u_int32_t id)
  	    (r = sshbuf_get_u32(iqueue, &len)) != 0)
  		fatal_fr(r, "parse");
  
@@ -540,7 +541,7 @@
  	debug("request %u: read \"%s\" (handle %d) off %llu len %u",
  	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
  	if ((fd = handle_to_fd(handle)) == -1)
-@@ -800,6 +1285,18 @@ process_write(u_int32_t id)
+@@ -874,6 +1359,18 @@ process_write(u_int32_t id)
  	    (r = sshbuf_get_string(iqueue, &data, &len)) != 0)
  		fatal_fr(r, "parse");
  
@@ -559,7 +560,7 @@
  	debug("request %u: write \"%s\" (handle %d) off %llu len %zu",
  	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
  	fd = handle_to_fd(handle);
-@@ -813,17 +1310,30 @@ process_write(u_int32_t id)
+@@ -888,17 +1385,30 @@ process_write(u_int32_t id)
  			    strerror(errno));
  		} else {
  /* XXX ATOMICIO ? */
@@ -600,7 +601,7 @@
  			}
  		}
  	}
-@@ -841,6 +1352,16 @@ process_do_stat(u_int32_t id, int do_lstat)
+@@ -917,6 +1427,16 @@ process_do_stat(u_int32_t id, int do_lstat)
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -617,7 +618,7 @@
  	debug3("request %u: %sstat", id, do_lstat ? "l" : "");
  	verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name);
  	r = do_lstat ? lstat(name, &st) : stat(name, &st);
-@@ -877,6 +1398,16 @@ process_fstat(u_int32_t id)
+@@ -953,6 +1473,16 @@ process_fstat(u_int32_t id)
  
  	if ((r = get_handle(iqueue, &handle)) != 0)
  		fatal_fr(r, "parse");
@@ -634,7 +635,7 @@
  	debug("request %u: fstat \"%s\" (handle %u)",
  	    id, handle_to_name(handle), handle);
  	fd = handle_to_fd(handle);
-@@ -929,6 +1460,14 @@ process_setstat(u_int32_t id)
+@@ -1005,6 +1535,14 @@ process_setstat(u_int32_t id)
  	    (r = decode_attrib(iqueue, &a)) != 0)
  		fatal_fr(r, "parse");
  
@@ -649,7 +650,7 @@
  	debug("request %u: setstat name \"%s\"", id, name);
  	if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
  		logit("set \"%s\" size %llu",
-@@ -983,6 +1522,13 @@ process_fsetstat(u_int32_t id)
+@@ -1059,6 +1597,13 @@ process_fsetstat(u_int32_t id)
  	else {
  		char *name = handle_to_name(handle);
  
@@ -663,7 +664,7 @@
  		if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
  			logit("set \"%s\" size %llu",
  			    name, (unsigned long long)a.size);
-@@ -1040,6 +1586,14 @@ process_opendir(u_int32_t id)
+@@ -1116,6 +1661,14 @@ process_opendir(u_int32_t id)
  	if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -678,18 +679,17 @@
  	debug3("request %u: opendir", id);
  	logit("opendir \"%s\"", path);
  	dirp = opendir(path);
-@@ -1094,6 +1648,10 @@ process_readdir(u_int32_t id)
+@@ -1170,6 +1723,9 @@ process_readdir(u_int32_t id)
  			    strcmp(path, "/") ? "/" : "", dp->d_name);
  			if (lstat(pathname, &st) == -1)
  				continue;
-+			if (RETURN_OK != path_permition_check(pathname,FLAG_PERMITOP))
-+                        {
-+                                continue;
-+                        }
++			if (RETURN_OK != path_permition_check(pathname,FLAG_PERMITOP)) {
++				continue;
++			}
  			stat_to_attrib(&st, &(statscount.attrib));
  			statscount.name = xstrdup(dp->d_name);
- 			statscount.long_name = ls_file(dp->d_name, &st, 0, 0);
-@@ -1125,6 +1683,14 @@ process_remove(u_int32_t id)
+ 			statscount.long_name = ls_file(dp->d_name, &st,
+@@ -1202,6 +1758,14 @@ process_remove(u_int32_t id)
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -704,7 +704,7 @@
  	debug3("request %u: remove", id);
  	logit("remove name \"%s\"", name);
  	r = unlink(name);
-@@ -1144,6 +1710,14 @@ process_mkdir(u_int32_t id)
+@@ -1221,6 +1785,14 @@ process_mkdir(u_int32_t id)
  	    (r = decode_attrib(iqueue, &a)) != 0)
  		fatal_fr(r, "parse");
  
@@ -719,7 +719,7 @@
  	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
  	    a.perm & 07777 : 0777;
  	debug3("request %u: mkdir", id);
-@@ -1163,6 +1737,14 @@ process_rmdir(u_int32_t id)
+@@ -1240,6 +1812,14 @@ process_rmdir(u_int32_t id)
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -734,7 +734,7 @@
  	debug3("request %u: rmdir", id);
  	logit("rmdir name \"%s\"", name);
  	r = rmdir(name);
-@@ -1187,8 +1769,12 @@ process_realpath(u_int32_t id)
+@@ -1264,8 +1844,12 @@ process_realpath(u_int32_t id)
  	}
  	debug3("request %u: realpath", id);
  	verbose("realpath \"%s\"", path);
@@ -749,7 +749,7 @@
  	} else {
  		Stat s;
  		attrib_clear(&s.attrib);
-@@ -1209,6 +1795,16 @@ process_rename(u_int32_t id)
+@@ -1286,6 +1870,16 @@ process_rename(u_int32_t id)
  	    (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
  		fatal_fr(r, "parse");
  
@@ -766,7 +766,7 @@
  	debug3("request %u: rename", id);
  	logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
  	status = SSH2_FX_FAILURE;

_service:tar_scm:openssh-5.8p2-sigpipe.patch Changed

_service:tar_scm:openssh-6.3p1-ctr-evp-fast.patch Deleted

@@ -1,101 +0,0 @@
-diff -up openssh-5.9p1/cipher-ctr.c.ctr-evp openssh-5.9p1/cipher-ctr.c
---- openssh-5.9p1/cipher-ctr.c.ctr-evp	2012-01-11 09:24:06.000000000 +0100
-+++ openssh-5.9p1/cipher-ctr.c	2012-01-11 15:54:04.675956600 +0100
-@@ -38,7 +38,7 @@ void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, in
- 
- struct ssh_aes_ctr_ctx
- {
--	AES_KEY		aes_ctx;
-+	EVP_CIPHER_CTX	ecbctx;
- 	u_char		aes_counterAES_BLOCK_SIZE;
- };
- 
-@@ -63,21 +63,42 @@ ssh_aes_ctr(EVP_CIPHER_CTX *ctx, u_char
- {
- 	struct ssh_aes_ctr_ctx *c;
- 	size_t n = 0;
--	u_char bufAES_BLOCK_SIZE;
-+	u_char ctrbufAES_BLOCK_SIZE*256;
-+	u_char bufAES_BLOCK_SIZE*256;
- 
- 	if (len == 0)
- 		return (1);
- 	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL)
- 		return (0);
- 
--	while ((len--) > 0) {
-+	for (; len > 0; len -= sizeof(u_int)) {
-+		u_int r,a,b;
-+
- 		if (n == 0) {
--			AES_encrypt(c->aes_counter, buf, &c->aes_ctx);
--			ssh_ctr_inc(c->aes_counter, AES_BLOCK_SIZE);
-+			int outl, i, buflen;
-+
-+			buflen = MIN(len, sizeof(ctrbuf));
-+
-+			for(i = 0; i < buflen; i += AES_BLOCK_SIZE) {
-+				memcpy(&ctrbufi, c->aes_counter, AES_BLOCK_SIZE);
-+				ssh_ctr_inc(c->aes_counter, AES_BLOCK_SIZE);
-+			}
-+
-+			EVP_EncryptUpdate(&c->ecbctx, buf, &outl,
-+				ctrbuf, buflen);
- 		}
--		*(dest++) = *(src++) ^ bufn;
--		n = (n + 1) % AES_BLOCK_SIZE;
-+
-+		memcpy(&a, src, sizeof(a));
-+		memcpy(&b, &bufn, sizeof(b));
-+		r = a ^ b;
-+		memcpy(dest, &r, sizeof(r));
-+		src += sizeof(a);
-+		dest += sizeof(r);
-+
-+		n = (n + sizeof(b)) % sizeof(buf);
- 	}
-+	memset(ctrbuf, '\0', sizeof(ctrbuf));
-+	memset(buf, '\0', sizeof(buf));
- 	return (1);
- }
- 
-@@ -91,9 +112,28 @@ ssh_aes_ctr_init(EVP_CIPHER_CTX *ctx, co
- 		c = xmalloc(sizeof(*c));
- 		EVP_CIPHER_CTX_set_app_data(ctx, c);
- 	}
--	if (key != NULL)
--		AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
--		    &c->aes_ctx);
-+
-+	EVP_CIPHER_CTX_init(&c->ecbctx);
-+
-+	if (key != NULL) {
-+		const EVP_CIPHER *cipher;
-+		switch(EVP_CIPHER_CTX_key_length(ctx)*8) {
-+			case 128:
-+				cipher = EVP_aes_128_ecb();
-+				break;
-+			case 192:
-+				cipher = EVP_aes_192_ecb();
-+				break;
-+			case 256:
-+				cipher = EVP_aes_256_ecb();
-+				break;
-+			default:
-+				fatal("ssh_aes_ctr_init: wrong aes key length");
-+		}
-+		if(!EVP_EncryptInit_ex(&c->ecbctx, cipher, NULL, key, NULL))
-+			fatal("ssh_aes_ctr_init: cannot initialize aes encryption");
-+		EVP_CIPHER_CTX_set_padding(&c->ecbctx, 0);
-+	}
- 	if (iv != NULL)
- 		memcpy(c->aes_counter, iv, AES_BLOCK_SIZE);
- 	return (1);
-@@ -105,6 +145,7 @@ ssh_aes_ctr_cleanup(EVP_CIPHER_CTX *ctx)
- 	struct ssh_aes_ctr_ctx *c;
- 
- 	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
-+		EVP_CIPHER_CTX_cleanup(&c->ecbctx);
- 		memset(c, 0, sizeof(*c));
- 		free(c);
- 		EVP_CIPHER_CTX_set_app_data(ctx, NULL);

_service:tar_scm:openssh-6.6.1p1-log-in-chroot.patch Changed

_service:tar_scm:openssh-6.6p1-keycat.patch Changed

@@ -1,3 +1,4 @@
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-6.6p1-keycat.patch
 diff -up openssh/misc.c.keycat openssh/misc.c
 --- openssh/misc.c.keycat	2015-06-24 10:57:50.158849606 +0200
 +++ openssh/misc.c	2015-06-24 11:04:23.989868638 +0200
@@ -61,13 +62,13 @@
  	ssh-xmss.o \
 @@ -190,6 +191,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
  ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
- 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
+ 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
  
 +ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
-+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
++	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS) $(CHANNELLIBS)
 +
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
  
 @@ -321,6 +325,7 @@ install-files:
  	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)

_service:tar_scm:openssh-6.6p1-keyperm.patch Deleted

@@ -1,31 +0,0 @@
-diff -up openssh-8.2p1/authfile.c.keyperm openssh-8.2p1/authfile.c
---- openssh-8.2p1/authfile.c.keyperm	2020-02-14 01:40:54.000000000 +0100
-+++ openssh-8.2p1/authfile.c	2020-02-17 11:55:12.841729758 +0100
-@@ -31,6 +31,7 @@
- 
- #include <errno.h>
- #include <fcntl.h>
-+#include <grp.h>
- #include <stdio.h>
- #include <stdarg.h>
- #include <stdlib.h>
-@@ -101,7 +102,19 @@ sshkey_perm_ok(int fd, const char *filen
- #ifdef HAVE_CYGWIN
- 	if (check_ntsec(filename))
- #endif
-+
- 	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
-+		if (st.st_mode & 040) {
-+			struct group *gr;
-+
-+			if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid)) {
-+				/* The only additional bit is read
-+				 * for ssh_keys group, which is fine */
-+				if ((st.st_mode & 077) == 040 ) {
-+					return 0;
-+				}
-+			}
-+		}
- 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
- 		error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");
- 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");

_service:tar_scm:openssh-6.7p1-coverity.patch Changed

@@ -1,41 +1,38 @@
-diff -up openssh-8.5p1/addr.c.coverity openssh-8.5p1/addr.c
---- openssh-8.5p1/addr.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/addr.c	2021-03-24 12:03:33.782968159 +0100
-@@ -312,8 +312,10 @@ addr_pton(const char *p, struct xaddr *n
- 	if (p == NULL || getaddrinfo(p, NULL, &hints, &ai) != 0)
- 		return -1;
- 
--	if (ai == NULL || ai->ai_addr == NULL)
-+	if (ai == NULL || ai->ai_addr == NULL) {
-+		freeaddrinfo(ai);
- 		return -1;
-+	}
- 
- 	if (n != NULL && addr_sa_to_xaddr(ai->ai_addr, ai->ai_addrlen,
- 	    n) == -1) {
-@@ -336,12 +338,16 @@ addr_sa_pton(const char *h, const char *
- 	if (h == NULL || getaddrinfo(h, s, &hints, &ai) != 0)
- 		return -1;
- 
--	if (ai == NULL || ai->ai_addr == NULL)
-+	if (ai == NULL || ai->ai_addr == NULL) {
-+		freeaddrinfo(ai);
- 		return -1;
-+	}
- 
- 	if (sa != NULL) {
--		if (slen < ai->ai_addrlen)
-+		if (slen < ai->ai_addrlen) {
-+			freeaddrinfo(ai);
- 			return -1;
-+		}
- 		memcpy(sa, &ai->ai_addr, ai->ai_addrlen);
- 	}
- 
-diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
---- openssh-8.5p1/auth-krb5.c.coverity	2021-03-24 12:03:33.724967756 +0100
-+++ openssh-8.5p1/auth-krb5.c	2021-03-24 12:03:33.782968159 +0100
-@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-6.7p1-coverity.patch
+
+---
+ auth-krb5.c                   | 2 ++
+ auth-options.c                | 1 +
+ channels.c                    | 6 ++++--
+ dns.c                         | 1 +
+ gss-genr.c                    | 3 ++-
+ kexgssc.c                     | 4 +++-
+ krl.c                         | 4 ++++
+ loginrec.c                    | 4 ++++
+ misc.c                        | 3 +++
+ moduli.c                      | 1 +
+ monitor.c                     | 4 ++--
+ monitor_wrap.c                | 6 +++---
+ openbsd-compat/bindresvport.c | 2 +-
+ openbsd-compat/bsd-pselect.c  | 8 ++++----
+ readconf.c                    | 1 +
+ scp.c                         | 4 ++--
+ servconf.c                    | 5 +++--
+ serverloop.c                  | 2 +-
+ session.c                     | 2 ++
+ sftp.c                        | 3 ++-
+ ssh-agent.c                   | 5 +++--
+ ssh-keygen.c                  | 7 +++++++
+ ssh.c                         | 1 +
+ sshd.c                        | 9 +++++++--
+ sshsig.c                      | 1 +
+ 25 files changed, 65 insertions(+), 24 deletions(-)
+
+diff --git a/auth-krb5.c b/auth-krb5.c
+index d80c3ab..71ea1e3 100644
+--- a/auth-krb5.c
++++ b/auth-krb5.c
+@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
  		umask(old_umask);
  		if (tmpfd == -1) {
  			logit("mkstemp(): %.100s", strerror(oerrno));
@@ -43,7 +40,7 @@
  			return oerrno;
  		}
  
-@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
+@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm
  			oerrno = errno;
  			logit("fchmod(): %.100s", strerror(oerrno));
  			close(tmpfd);
@@ -51,10 +48,11 @@
  			return oerrno;
  		}
  		/* make sure the KRB5CCNAME is set for non-standard location */
-diff -up openssh-8.5p1/auth-options.c.coverity openssh-8.5p1/auth-options.c
---- openssh-8.5p1/auth-options.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/auth-options.c	2021-03-24 12:03:33.782968159 +0100
-@@ -706,6 +708,7 @@ serialise_array(struct sshbuf *m, char *
+diff --git a/auth-options.c b/auth-options.c
+index 7cb2a64..a4b1db4 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -723,6 +723,7 @@ serialise_array(struct sshbuf *m, char **a, size_t n)
  		return r;
  	}
  	/* success */
@@ -62,19 +60,11 @@
  	return 0;
  }
  
-diff -up openssh-7.4p1/channels.c.coverity openssh-7.4p1/channels.c
---- openssh-7.4p1/channels.c.coverity	2016-12-23 16:40:26.881788686 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 16:42:36.244818763 +0100
-@@ -1875,7 +1875,7 @@ channel_post_connecting(struct ssh *ssh,
- 		debug("channel %d: connection failed: %s",
- 		    c->self, strerror(err));
- 		/* Try next address, if any */
--		if ((sock = connect_next(&c->connect_ctx)) > 0) {
-+		if ((sock = connect_next(&c->connect_ctx)) >= 0) {
- 			close(c->sock);
- 			c->sock = c->rfd = c->wfd = sock;
- 			channel_find_maxfd(ssh->chanctxt);
-@@ -3804,7 +3804,7 @@ int
+diff --git a/channels.c b/channels.c
+index 300c753..ea4d8da 100644
+--- a/channels.c
++++ b/channels.c
+@@ -4081,7 +4081,7 @@ int
  channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  {
  	int r, success = 0, idx = -1;
@@ -83,7 +73,7 @@
  	int port_to_connect, listen_port;
  
  	/* Send the forward request to the remote side. */
-@@ -3832,7 +3832,6 @@ channel_request_remote_forwarding(struct
+@@ -4109,7 +4109,6 @@ channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  	success = 1;
  	if (success) {
  		/* Record that connection to this host/port is permitted. */
@@ -91,7 +81,7 @@
  		port_to_connect = listen_port = 0;
  		if (fwd->connect_path != NULL) {
  			host_to_connect = xstrdup(fwd->connect_path);
-@@ -3853,6 +3852,9 @@ channel_request_remote_forwarding(struct
+@@ -4130,6 +4129,9 @@ channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  		    host_to_connect, port_to_connect,
  		    listen_host, listen_path, listen_port, NULL);
  	}
@@ -101,37 +91,23 @@
  	return idx;
  }
  
-diff -up openssh-8.5p1/compat.c.coverity openssh-8.5p1/compat.c
---- openssh-8.5p1/compat.c.coverity	2021-03-24 12:03:33.768968062 +0100
-+++ openssh-8.5p1/compat.c	2021-03-24 12:03:33.783968166 +0100
-@@ -191,10 +191,12 @@ compat_kex_proposal(struct ssh *ssh, cha
- 		return p;
- 	debug2_f("original KEX proposal: %s", p);
- 	if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
-+		/* coverityoverwrite_var : FALSE */
- 		if ((p = match_filter_denylist(p,
- 		    "curve25519-sha256@libssh.org")) == NULL)
- 			fatal("match_filter_denylist failed");
- 	if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
-+		/* coverityoverwrite_var : FALSE */
- 		if ((p = match_filter_denylist(p,
- 		    "diffie-hellman-group-exchange-sha256,"
- 		    "diffie-hellman-group-exchange-sha1")) == NULL)
-diff -up openssh-8.5p1/dns.c.coverity openssh-8.5p1/dns.c
---- openssh-8.5p1/dns.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/dns.c	2021-03-24 12:03:33.783968166 +0100
-@@ -282,6 +282,7 @@ verify_host_key_dns(const char *hostname
-		    &hostkey_digest, &hostkey_digest_len, hostkey)) {
-			error("Error calculating key fingerprint.");
-			freerrset(fingerprints);
+diff --git a/dns.c b/dns.c
+index f2310be..15218f1 100644
+--- a/dns.c
++++ b/dns.c
+@@ -259,6 +259,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
+ 		    &hostkey_digest, &hostkey_digest_len, hostkey)) {
+ 			error("Error calculating key fingerprint.");
+ 			freerrset(fingerprints);
 +				free(dnskey_digest);
-			return -1;
-		}
-
-diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
---- openssh-8.5p1/gss-genr.c.coverity	2021-03-26 11:52:46.613942552 +0100
-+++ openssh-8.5p1/gss-genr.c	2021-03-26 11:54:37.881726318 +0100
-@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
+ 			return -1;
+ 		}
+ 
+diff --git a/gss-genr.c b/gss-genr.c
+index 9f9745b..810b382 100644
+--- a/gss-genr.c
++++ b/gss-genr.c
+@@ -168,8 +168,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
  			enclen = __b64_ntop(digest,
  			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
  			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
@@ -142,9 +118,10 @@

_service:tar_scm:openssh-7.3p1-x11-max-displays.patch Changed

@@ -1,7 +1,19 @@
-diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
---- openssh-7.4p1/channels.c.x11max	2016-12-23 15:46:32.071506625 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 15:46:32.139506636 +0100
-@@ -152,8 +152,8 @@ static int all_opens_permitted = 0;
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.3p1-x11-max-displays.patch
+
+---
+ channels.c    | 23 ++++++++++++++---------
+ channels.h    |  2 +-
+ servconf.c    | 12 +++++++++++-
+ servconf.h    |  2 ++
+ session.c     |  5 +++--
+ sshd_config.5 |  7 +++++++
+ 6 files changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/channels.c b/channels.c
+index 7230540..040a4c6 100644
+--- a/channels.c
++++ b/channels.c
+@@ -101,8 +101,8 @@
  #define FWD_PERMIT_ANY_HOST	"*"
  
  /* -- X11 forwarding */
@@ -10,9 +22,9 @@
 +/* Minimum port number for X11 forwarding */
 +#define X11_PORT_MIN 6000
  
- /* Per-channel callback for pre/post select() actions */
- typedef void chan_fn(struct ssh *, Channel *c,
-@@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
+ /* Per-channel callback for pre/post IO actions */
+ typedef void chan_fn(struct ssh *, Channel *c);
+@@ -4801,7 +4801,7 @@ rdynamic_connect_finish(struct ssh *ssh, Channel *c)
   */
  int
  x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
@@ -21,7 +33,7 @@
      u_int *display_numberp, int **chanids)
  {
  	Channel *nc = NULL;
-@@ -4240,10 +4241,15 @@ x11_create_display_inet(int x11_display_
+@@ -4814,10 +4814,15 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  	if (chanids == NULL)
  		return -1;
  
@@ -39,7 +51,7 @@
  		memset(&hints, 0, sizeof(hints));
  		hints.ai_family = ssh->chanctxt->IPv4or6;
  		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
-@@ -4295,7 +4301,7 @@ x11_create_display_inet(int x11_display_
+@@ -4870,7 +4875,7 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  		if (num_socks > 0)
  			break;
  	}
@@ -48,7 +60,7 @@
  		error("Failed to allocate internet-domain X11 display socket.");
  		return -1;
  	}
-@@ -4441,7 +4447,7 @@ x11_connect_display(void)
+@@ -5054,7 +5059,7 @@ x11_connect_display(struct ssh *ssh)
  	memset(&hints, 0, sizeof(hints));
  	hints.ai_family = ssh->chanctxt->IPv4or6;
  	hints.ai_socktype = SOCK_STREAM;
@@ -57,7 +69,7 @@
  	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
  		error("%.100s: unknown host. (%s)", buf,
  		ssh_gai_strerror(gaierr));
-@@ -4457,7 +4463,7 @@ x11_connect_display(void)
+@@ -5070,7 +5075,7 @@ x11_connect_display(struct ssh *ssh)
  		/* Connect it to the display. */
  		if (connect(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
  			debug2("connect %.100s port %u: %.100s", buf,
@@ -66,21 +78,20 @@
  			close(sock);
  			continue;
  		}
-@@ -4466,8 +4472,8 @@ x11_connect_display(void)
- 	}
+@@ -5080,7 +5085,7 @@ x11_connect_display(struct ssh *ssh)
  	freeaddrinfo(aitop);
  	if (!ai) {
--		error("connect %.100s port %u: %.100s", buf,
+ 		error("connect %.100s port %u: %.100s", buf,
 -		    6000 + display_number, strerror(errno));
-+		error("connect %.100s port %u: %.100s", buf,
 +		    X11_PORT_MIN + display_number, strerror(errno));
  		return -1;
  	}
  	set_nodelay(sock);
-diff -up openssh-7.4p1/channels.h.x11max openssh-7.4p1/channels.h
---- openssh-7.4p1/channels.h.x11max	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/channels.h	2016-12-23 15:46:32.139506636 +0100
-@@ -293,7 +293,7 @@ int	 permitopen_port(const char *);
+diff --git a/channels.h b/channels.h
+index 828c1b6..7d8a83e 100644
+--- a/channels.h
++++ b/channels.h
+@@ -361,7 +361,7 @@ int	 permitopen_port(const char *);
  
  void	 channel_set_x11_refuse_time(struct ssh *, u_int);
  int	 x11_connect_display(struct ssh *);
@@ -89,10 +100,11 @@
  void	 x11_request_forwarding_with_spoofing(struct ssh *, int,
  	    const char *, const char *, const char *, int);
  
-diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
---- openssh-7.4p1/servconf.c.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:47:27.320519121 +0100
-@@ -95,6 +95,7 @@ initialize_server_options(ServerOptions
+diff --git a/servconf.c b/servconf.c
+index 13c4a08..fdba127 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -115,6 +115,7 @@ initialize_server_options(ServerOptions *options)
  	options->print_lastlog = -1;
  	options->x11_forwarding = -1;
  	options->x11_display_offset = -1;
@@ -100,7 +112,7 @@
  	options->x11_use_localhost = -1;
  	options->permit_tty = -1;
  	options->permit_user_rc = -1;
-@@ -243,6 +244,8 @@ fill_default_server_options(ServerOption
+@@ -330,6 +331,8 @@ fill_default_server_options(ServerOptions *options)
  		options->x11_forwarding = 0;
  	if (options->x11_display_offset == -1)
  		options->x11_display_offset = 10;
@@ -109,7 +121,7 @@
  	if (options->x11_use_localhost == -1)
  		options->x11_use_localhost = 1;
  	if (options->xauth_location == NULL)
-@@ -419,7 +422,7 @@ typedef enum {
+@@ -518,7 +521,7 @@ typedef enum {
  	sPasswordAuthentication,
  	sKbdInteractiveAuthentication, sListenAddress, sAddressFamily,
  	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
@@ -118,7 +130,7 @@
  	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
  	sPermitUserEnvironment, sAllowTcpForwarding, sCompression,
  	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
-@@ -540,6 +543,7 @@ static struct {
+@@ -652,6 +655,7 @@ static struct {
  	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
  	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
  	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
@@ -126,7 +138,7 @@
  	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
  	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
  	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
-@@ -1316,6 +1320,10 @@ process_server_config_line(ServerOptions
+@@ -1680,6 +1684,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  			*intptr = value;
  		break;
  
@@ -137,7 +149,7 @@
  	case sX11UseLocalhost:
  		intptr = &options->x11_use_localhost;
  		goto parse_flag;
-@@ -2063,6 +2071,7 @@ copy_set_server_options(ServerOptions *d
+@@ -2678,6 +2686,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
  	M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
  	M_CP_INTOPT(x11_display_offset);
  	M_CP_INTOPT(x11_forwarding);
@@ -145,7 +157,7 @@
  	M_CP_INTOPT(x11_use_localhost);
  	M_CP_INTOPT(permit_tty);
  	M_CP_INTOPT(permit_user_rc);
-@@ -2315,6 +2324,7 @@ dump_config(ServerOptions *o)
+@@ -2953,6 +2962,7 @@ dump_config(ServerOptions *o)
  #endif
  	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
  	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
@@ -153,10 +165,11 @@
  	dump_cfg_int(sMaxAuthTries, o->max_authtries);
  	dump_cfg_int(sMaxSessions, o->max_sessions);
  	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
-diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
---- openssh-7.4p1/servconf.h.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 15:46:32.140506636 +0100
-@@ -55,6 +55,7 @@
+diff --git a/servconf.h b/servconf.h
+index 37d3a6f..77fd779 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -45,6 +45,7 @@
  
  #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
  #define DEFAULT_SESSIONS_MAX	10	/* Default for MaxSessions */
@@ -164,7 +177,7 @@
  
  /* Magic name for internal sftp-server */
  #define INTERNAL_SFTP_NAME	"internal-sftp"
-@@ -85,6 +86,7 @@ typedef struct {
+@@ -105,6 +106,7 @@ typedef struct {
  	int     x11_forwarding;	/* If true, permit inet (spoofing) X11 fwd. */
  	int     x11_display_offset;	/* What DISPLAY number to start
  					 * searching at */
@@ -172,13 +185,14 @@
  	int     x11_use_localhost;	/* If true, use localhost for fake X11 server. */
  	char   *xauth_location;	/* Location of xauth program */

_service:tar_scm:openssh-7.4p1-systemd.patch Changed

@@ -1,16 +1,19 @@
-commit 0e22b79bfde45a7cf7a2e51a68ec11c4285f3b31
-Author: Jakub Jelen <jjelen@redhat.com>
-Date:   Mon Nov 21 15:04:06 2016 +0100
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.4p1-systemd.patch
 
-    systemd stuff
+---
+ configure.ac         | 24 ++++++++++++++++++++++++
+ contrib/sshd.service | 16 ++++++++++++++++
+ sshd.c               |  9 +++++++++
+ 3 files changed, 49 insertions(+)
+ create mode 100644 contrib/sshd.service
 
 diff --git a/configure.ac b/configure.ac
-index 2ffc369..162ce92 100644
+index bbe133e..6f7dc48 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4265,6 +4265,30 @@ AC_ARG_WITH(kerberos5,
- AC_SUBST(GSSLIBS)
+@@ -4822,6 +4822,29 @@ AC_SUBST(GSSLIBS)
  AC_SUBST(K5LIBS)
+ AC_SUBST(CHANNELLIBS)
  
 +# Check whether user wants systemd support
 +SYSTEMD_MSG="no"
@@ -35,11 +38,10 @@
 +	fi 
 +)
 +
-+
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -5097,6 +5121,7 @@ echo "                   libedit support: $LIBEDIT_MSG"
+@@ -5621,6 +5644,7 @@ echo "                   libldns support: $LDNS_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
  echo "         Solaris privilege support: $SPP_MSG"
@@ -70,10 +72,10 @@
 +WantedBy=multi-user.target
 +
 diff --git a/sshd.c b/sshd.c
-index 816611c..b8b9d13 100644
+index 0d4cfef..2a9b96d 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -85,6 +85,10 @@
+@@ -88,6 +88,10 @@
  #include <prot.h>
  #endif
  
@@ -84,7 +86,7 @@
  #include "xmalloc.h"
  #include "ssh.h"
  #include "ssh2.h"
-@@ -1888,6 +1892,11 @@ main(int ac, char **av)
+@@ -2121,6 +2125,11 @@ main(int ac, char **av)
  			}
  		}
  
@@ -96,3 +98,6 @@
  		/* Accept a connection and return in a forked child */
  		server_accept_loop(&sock_in, &sock_out,
  		    &newsock, config_s);
+-- 
+2.27.0
+

_service:tar_scm:openssh-7.6p1-audit.patch Changed

@@ -1,7 +1,55 @@
-diff -up openssh-8.6p1/audit-bsm.c.audit openssh-8.6p1/audit-bsm.c
---- openssh-8.6p1/audit-bsm.c.audit	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/audit-bsm.c	2021-04-19 16:47:35.753062106 +0200
-@@ -373,13 +373,26 @@ audit_connection_from(const char *host,
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.6p1-audit.patch
+
+---
+ Makefile.in       |   2 +-
+ audit-bsm.c       |  45 ++++++-
+ audit-linux.c     | 301 +++++++++++++++++++++++++++++++++++++++++++---
+ audit.c           | 129 ++++++++++++++++++--
+ audit.h           |  22 +++-
+ auditstub.c       |  52 ++++++++
+ auth.c            |   3 -
+ auth.h            |   5 +
+ auth2-hostbased.c |  16 ++-
+ auth2-pubkey.c    |  16 ++-
+ auth2.c           |   3 -
+ cipher.c          |  21 +---
+ cipher.h          |  20 ++-
+ kex.c             |  61 ++++++++--
+ kex.h             |   2 +
+ mac.c             |  14 +++
+ mac.h             |   1 +
+ monitor.c         | 194 ++++++++++++++++++++++++++++--
+ monitor.h         |   8 +-
+ monitor_wrap.c    | 130 +++++++++++++++++++-
+ monitor_wrap.h    |  11 +-
+ packet.c          |  98 +++++++++++++--
+ packet.h          |   1 +
+ session.c         |  84 +++++++++++--
+ session.h         |  10 +-
+ sshd.c            | 103 +++++++++++++---
+ sshkey.c          |  32 +++++
+ sshkey.h          |   1 +
+ 28 files changed, 1274 insertions(+), 111 deletions(-)
+ create mode 100644 auditstub.c
+
+diff --git a/Makefile.in b/Makefile.in
+index 45f7a93..9b4c06b 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -114,7 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	kexsntrup761x25519.o sntrup761.o kexgen.o \
+ 	kexgssc.o \
+ 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
+-	sshbuf-io.o
++	sshbuf-io.o auditstub.o
+ 
+ SKOBJS=	ssh-sk-client.o
+ 
+diff --git a/audit-bsm.c b/audit-bsm.c
+index ccfcf6f..a49abb9 100644
+--- a/audit-bsm.c
++++ b/audit-bsm.c
+@@ -373,12 +373,25 @@ audit_connection_from(const char *host, int port)
  #endif
  }
  
@@ -19,17 +67,16 @@
  	/* not implemented */
  }
  
- void
++void
 +audit_count_session_open(void)
 +{
 +	/* not necessary */
 +}
 +
-+void
+ void
  audit_session_open(struct logininfo *li)
  {
- 	/* not implemented */
-@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li
+@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li)
  	/* not implemented */
  }
  
@@ -42,7 +89,7 @@
  void
  audit_event(struct ssh *ssh, ssh_audit_event_t event)
  {
-@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
+@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_event_t event)
  		debug("%s: unhandled event %d", __func__, event);
  	}
  }
@@ -71,234 +118,10 @@
 +	/* not implemented */
 +}
  #endif /* BSM */
-diff -up openssh-8.6p1/audit.c.audit openssh-8.6p1/audit.c
---- openssh-8.6p1/audit.c.audit	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/audit.c	2021-04-19 16:47:35.753062106 +0200
-@@ -34,6 +34,12 @@
- #include "log.h"
- #include "hostfile.h"
- #include "auth.h"
-+#include "ssh-gss.h"
-+#include "monitor_wrap.h"
-+#include "xmalloc.h"
-+#include "misc.h"
-+#include "servconf.h"
-+#include "ssherr.h"
- 
- /*
-  * Care must be taken when using this since it WILL NOT be initialized when
-@@ -41,6 +47,7 @@
-  * audit_event(CONNECTION_ABANDON) is called.  Test for NULL before using.
-  */
- extern Authctxt *the_authctxt;
-+extern ServerOptions options;
- 
- /* Maybe add the audit class to struct Authmethod? */
- ssh_audit_event_t
-@@ -69,13 +76,10 @@ audit_classify_auth(const char *method)
- const char *
- audit_username(void)
- {
--	static const char unknownuser = "(unknown user)";
--	static const char invaliduser = "(invalid user)";
-+	static const char unknownuser = "(unknown)";
- 
--	if (the_authctxt == NULL || the_authctxt->user == NULL)
-+	if (the_authctxt == NULL || the_authctxt->user == NULL || !the_authctxt->valid)
- 		return (unknownuser);
--	if (!the_authctxt->valid)
--		return (invaliduser);
- 	return (the_authctxt->user);
- }
- 
-@@ -109,6 +113,35 @@ audit_event_lookup(ssh_audit_event_t ev)
- 	return(event_lookupi.name);
- }
- 
-+void
-+audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
-+{
-+	char *fp;
-+
-+	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
-+	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
-+		*rv = -SSH_ERR_INTERNAL_ERROR;
-+	free(fp);
-+}
-+
-+void
-+audit_unsupported(struct ssh *ssh, int what)
-+{
-+	PRIVSEP(audit_unsupported_body(ssh, what));
-+}
-+
-+void
-+audit_kex(struct ssh *ssh, int ctos, char *enc, char *mac, char *comp, char *pfs)
-+{
-+	PRIVSEP(audit_kex_body(ssh, ctos, enc, mac, comp, pfs, getpid(), getuid()));
-+}
-+
-+void
-+audit_session_key_free(struct ssh *ssh, int ctos)
-+{
-+	PRIVSEP(audit_session_key_free_body(ssh, ctos, getpid(), getuid()));
-+}
-+
- # ifndef CUSTOM_SSH_AUDIT_EVENTS
- /*
-  * Null implementations of audit functions.
-@@ -138,6 +171,17 @@ audit_event(struct ssh *ssh, ssh_audit_e
- }
- 
- /*
-+ * Called when a child process has called, or will soon call,
-+ * audit_session_open.
-+ */
-+void
-+audit_count_session_open(void)
-+{
-+	debug("audit count session open euid %d user %s", geteuid(),
-+	      audit_username());
-+}
-+
-+/*
-  * Called when a user session is started.  Argument is the tty allocated to
-  * the session, or NULL if no tty was allocated.
-  *
-@@ -172,13 +216,82 @@ audit_session_close(struct logininfo *li
- /*
-  * This will be called when a user runs a non-interactive command.  Note that
-  * it may be called multiple times for a single connection since SSH2 allows
-- * multiple sessions within a single connection.
-+ * multiple sessions within a single connection.  Returns a "handle" for
-+ * audit_end_command.
-  */
--void
--audit_run_command(const char *command)
-+int
-+audit_run_command(struct ssh *ssh, const char *command)

_service:tar_scm:openssh-7.7p1-fips.patch Deleted

@@ -1,452 +0,0 @@
-diff -up openssh-8.6p1/cipher-ctr.c.fips openssh-8.6p1/cipher-ctr.c
---- openssh-8.6p1/cipher-ctr.c.fips	2021-04-19 16:53:02.994577324 +0200
-+++ openssh-8.6p1/cipher-ctr.c	2021-04-19 16:53:03.064577862 +0200
-@@ -179,7 +179,8 @@ evp_aes_128_ctr(void)
- 	aes_ctr.do_cipher = ssh_aes_ctr;
- #ifndef SSH_OLD_EVP
- 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
--	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
-+	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV |
-+	    EVP_CIPH_FLAG_FIPS;
- #endif
- 	return (&aes_ctr);
- }
-diff -up openssh-8.6p1/dh.c.fips openssh-8.6p1/dh.c
---- openssh-8.6p1/dh.c.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/dh.c	2021-04-19 16:58:47.750263410 +0200
-@@ -164,6 +164,12 @@ choose_dh(int min, int wantbits, int max
- 	int best, bestcount, which, linenum;
- 	struct dhgroup dhg;
- 
-+	if (FIPS_mode()) {
-+		logit("Using arbitrary primes is not allowed in FIPS mode."
-+		    " Falling back to known groups.");
-+		return (dh_new_group_fallback(max));
-+	}
-+
- 	if ((f = fopen(get_moduli_filename(), "r")) == NULL) {
- 		logit("WARNING: could not open %s (%s), using fixed modulus",
- 		    get_moduli_filename(), strerror(errno));
-@@ -502,4 +508,38 @@ dh_estimate(int bits)
- 	return 8192;
- }
- 
-+/*
-+ * Compares the received DH parameters with known-good groups,
-+ * which might be either from group14, group16 or group18.
-+ */
-+int
-+dh_is_known_group(const DH *dh)
-+{
-+	const BIGNUM *p, *g;
-+	const BIGNUM *known_p, *known_g;
-+	DH *known = NULL;
-+	int bits = 0, rv = 0;
-+
-+	DH_get0_pqg(dh, &p, NULL, &g);
-+	bits = BN_num_bits(p);
-+
-+	if (bits <= 3072) {
-+		known = dh_new_group14();
-+	} else if (bits <= 6144) {
-+		known = dh_new_group16();
-+	} else {
-+		known = dh_new_group18();
-+	}
-+
-+	DH_get0_pqg(known, &known_p, NULL, &known_g);
-+
-+	if (BN_cmp(g, known_g) == 0 &&
-+	    BN_cmp(p, known_p) == 0) {
-+		rv = 1;
-+	}
-+
-+	DH_free(known);
-+	return rv;
-+}
-+
- #endif /* WITH_OPENSSL */
-diff -up openssh-8.6p1/dh.h.fips openssh-8.6p1/dh.h
---- openssh-8.6p1/dh.h.fips	2021-04-19 16:53:03.064577862 +0200
-+++ openssh-8.6p1/dh.h	2021-04-19 16:59:31.951616078 +0200
-@@ -45,6 +45,7 @@ DH	*dh_new_group_fallback(int);
- 
- int	 dh_gen_key(DH *, int);
- int	 dh_pub_is_valid(const DH *, const BIGNUM *);
-+int	 dh_is_known_group(const DH *);
- 
- u_int	 dh_estimate(int);
- void	 dh_set_moduli_file(const char *);
-diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c
---- openssh-8.6p1/kex.c.fips	2021-04-19 16:53:03.058577815 +0200
-+++ openssh-8.6p1/kex.c	2021-04-19 16:53:03.065577869 +0200
-@@ -203,7 +203,10 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
- 		if (kex_alg_by_name(p) == NULL) {
--			error("Unsupported KEX algorithm \"%.100s\"", p);
-+			if (FIPS_mode())
-+				error("\"%.100s\" is not allowed in FIPS mode", p);
-+			else
-+				error("Unsupported KEX algorithm \"%.100s\"", p);
- 			free(s);
- 			return 0;
- 		}
-diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c
---- openssh-8.6p1/kexgexc.c.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/kexgexc.c	2021-04-19 16:53:03.065577869 +0200
-@@ -28,6 +28,7 @@
- 
- #ifdef WITH_OPENSSL
- 
-+#include <openssl/crypto.h>
- #include <sys/types.h>
- 
- #include <openssl/dh.h>
-@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
- 	}
-+	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
-+		r = SSH_ERR_INVALID_ARGUMENT;
-+		goto out;
-+	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
- 	/* generate and send 'e', client DH public key */
-diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h
---- openssh-8.6p1/myproposal.h.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/myproposal.h	2021-04-19 16:53:03.065577869 +0200
-@@ -57,6 +57,18 @@
- 	"rsa-sha2-512," \
- 	"rsa-sha2-256"
- 
-+#define	KEX_FIPS_PK_ALG	\
-+	"ecdsa-sha2-nistp256-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp384-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp521-cert-v01@openssh.com," \
-+	"rsa-sha2-512-cert-v01@openssh.com," \
-+	"rsa-sha2-256-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp256," \
-+	"ecdsa-sha2-nistp384," \
-+	"ecdsa-sha2-nistp521," \
-+	"rsa-sha2-512," \
-+	"rsa-sha2-256," \
-+
- #define	KEX_SERVER_ENCRYPT \
- 	"chacha20-poly1305@openssh.com," \
- 	"aes128-ctr,aes192-ctr,aes256-ctr," \
-@@ -78,6 +92,27 @@
- 
- #define KEX_CLIENT_MAC KEX_SERVER_MAC
- 
-+#define	KEX_FIPS_ENCRYPT \
-+	"aes128-ctr,aes192-ctr,aes256-ctr," \
-+	"aes128-cbc,3des-cbc," \
-+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se," \
-+	"aes128-gcm@openssh.com,aes256-gcm@openssh.com"
-+#define KEX_DEFAULT_KEX_FIPS		\
-+	"ecdh-sha2-nistp256," \
-+	"ecdh-sha2-nistp384," \
-+	"ecdh-sha2-nistp521," \
-+	"diffie-hellman-group-exchange-sha256," \
-+	"diffie-hellman-group16-sha512," \
-+	"diffie-hellman-group18-sha512," \
-+	"diffie-hellman-group14-sha256"
-+#define KEX_FIPS_MAC \
-+	"hmac-sha1," \
-+	"hmac-sha2-256," \
-+	"hmac-sha2-512," \
-+	"hmac-sha1-etm@openssh.com," \
-+	"hmac-sha2-256-etm@openssh.com," \
-+	"hmac-sha2-512-etm@openssh.com"
-+
- /* Not a KEX value, but here so all the algorithm defaults are together */
- #define	SSH_ALLOWED_CA_SIGALGS	\
- 	"ssh-ed25519," \
-diff -up openssh-8.6p1/readconf.c.fips openssh-8.6p1/readconf.c
---- openssh-8.6p1/readconf.c.fips	2021-04-19 16:53:02.999577362 +0200
-+++ openssh-8.6p1/readconf.c	2021-04-19 16:53:03.065577869 +0200
-@@ -2538,11 +2538,16 @@ fill_default_options(Options * options)
- 	all_key = sshkey_alg_list(0, 0, 1, ',');
- 	all_sig = sshkey_alg_list(0, 1, 1, ',');
- 	/* remove unsupported algos from default lists */
--	def_cipher = match_filter_allowlist(KEX_CLIENT_ENCRYPT, all_cipher);
--	def_mac = match_filter_allowlist(KEX_CLIENT_MAC, all_mac);
--	def_kex = match_filter_allowlist(KEX_CLIENT_KEX, all_kex);
--	def_key = match_filter_allowlist(KEX_DEFAULT_PK_ALG, all_key);
--	def_sig = match_filter_allowlist(SSH_ALLOWED_CA_SIGALGS, all_sig);
-+	def_cipher = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_ENCRYPT : KEX_CLIENT_ENCRYPT), all_cipher);
-+	def_mac = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_MAC : KEX_CLIENT_MAC), all_mac);
-+	def_kex = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_DEFAULT_KEX_FIPS : KEX_CLIENT_KEX), all_kex);
-+	def_key = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG), all_key);
-+	def_sig = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
- #define ASSEMBLE(what, defaults, all) \
- 	do { \
- 		if ((r = kex_assemble_names(&options->what, \
-diff -up openssh-8.6p1/sandbox-seccomp-filter.c.fips openssh-8.6p1/sandbox-seccomp-filter.c
---- openssh-8.6p1/sandbox-seccomp-filter.c.fips	2021-04-19 16:53:03.034577631 +0200
-+++ openssh-8.6p1/sandbox-seccomp-filter.c	2021-04-19 16:53:03.065577869 +0200
-@@ -160,6 +160,9 @@ static const struct sock_filter preauth_
- #ifdef __NR_open
- 	SC_DENY(__NR_open, EACCES),
- #endif
-+#ifdef __NR_socket

_service:tar_scm:openssh-7.8p1-UsePAM-warning.patch Changed

@@ -1,13 +1,14 @@
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.8p1-UsePAM-warning.patch
 diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
 --- openssh-8.6p1/sshd.c.log-usepam-no	2021-04-19 14:00:45.099735129 +0200
 +++ openssh-8.6p1/sshd.c	2021-04-19 14:03:21.140920974 +0200
 @@ -1749,6 +1749,10 @@ main(int ac, char **av)
  	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL);
+ 	    cfg, &includes, NULL, rexeced_flag);
  
-+	/* 'UsePAM no' is not supported in Fedora */
++	/* 'UsePAM no' is not supported in openEuler */
 +	if (! options.use_pam)
-+		logit("WARNING: 'UsePAM no' is not supported in Fedora and may cause several problems.");
++		logit("WARNING: 'UsePAM no' is not supported in openEuler and may cause several problems.");
 +
  #ifdef WITH_OPENSSL
  	if (options.moduli_file != NULL)
@@ -19,7 +20,7 @@
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and KbdInteractiveAuthentication to 'no'.
-+# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
++# WARNING: 'UsePAM no' is not supported in openEuler and may cause several
 +# problems.
  #UsePAM no

_service:tar_scm:openssh-7.8p1-role-mls.patch Changed

_service:tar_scm:openssh-8.0p1-crypto-policies.patch Changed

@@ -1,13 +1,14 @@
-diff -up openssh-8.7p1/ssh_config.5.crypto-policies openssh-8.7p1/ssh_config.5
---- openssh-8.7p1/ssh_config.5.crypto-policies	2021-08-30 13:29:00.174292872 +0200
-+++ openssh-8.7p1/ssh_config.5	2021-08-30 13:31:32.009548808 +0200
-@@ -373,17 +373,13 @@ or
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-8.0p1-crypto-policies.patch
+diff --color -ru a/ssh_config.5 b/ssh_config.5
+--- a/ssh_config.5	2022-07-12 15:05:22.550013071 +0200
++++ b/ssh_config.5	2022-07-12 15:17:20.016704545 +0200
+@@ -373,17 +373,13 @@
  causes no CNAMEs to be considered for canonicalization.
  This is the default behaviour.
  .It Cm CASignatureAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies which algorithms are allowed for signing of certificates
@@ -24,13 +25,13 @@
  If the specified list begins with a
  .Sq +
  character, then the specified algorithms will be appended to the default set
-@@ -445,20 +441,25 @@ If the option is set to
+@@ -445,20 +441,25 @@
  (the default),
  the check will not be executed.
  .It Cm Ciphers
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the ciphers allowed and their order of preference.
@@ -54,7 +55,7 @@
  .Pp
  The supported ciphers are:
  .Bd -literal -offset indent
-@@ -474,13 +475,6 @@ aes256-gcm@openssh.com
+@@ -474,13 +475,6 @@
  chacha20-poly1305@openssh.com
  .Ed
  .Pp
@@ -68,19 +69,19 @@
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClearAllForwardings
-@@ -874,6 +868,11 @@ command line will be passed untouched to
+@@ -874,6 +868,11 @@
  The default is
  .Dq no .
  .It Cm GSSAPIKexAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  The list of key exchange algorithms that are offered for GSSAPI
  key exchange. Possible values are
  .Bd -literal -offset 3n
-@@ -886,10 +885,8 @@ gss-nistp256-sha256-,
+@@ -886,10 +885,8 @@
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -92,13 +93,58 @@
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-@@ -1219,29 +1216,25 @@ it may be zero or more of:
+@@ -913,36 +910,25 @@
+ but may be manually hashed using
+ .Xr ssh-keygen 1 .
+ .It Cm HostbasedAcceptedAlgorithms
++The default is handled system-wide by
++.Xr crypto-policies 7 .
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
++.Xr update-crypto-policies 8 .
++.Pp
+ Specifies the signature algorithms that will be used for hostbased
+ authentication as a comma-separated list of patterns.
+ Alternately if the specified list begins with a
+ .Sq +
+ character, then the specified signature algorithms will be appended
+-to the default set instead of replacing them.
++to the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq -
+ character, then the specified signature algorithms (including wildcards)
+-will be removed from the default set instead of replacing them.
++will be removed from the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq ^
+ character, then the specified signature algorithms will be placed
+-at the head of the default set.
+-The default for this option is:
+-.Bd -literal -offset 3n
+-ssh-ed25519-cert-v01@openssh.com,
+-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-ecdsa-sha2-nistp384-cert-v01@openssh.com,
+-ecdsa-sha2-nistp521-cert-v01@openssh.com,
+-sk-ssh-ed25519-cert-v01@openssh.com,
+-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,
+-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-ed25519,
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-sk-ssh-ed25519@openssh.com,
+-sk-ecdsa-sha2-nistp256@openssh.com,
+-rsa-sha2-512,rsa-sha2-256
+-.Ed
++at the head of the built-in openssh default set.
+ .Pp
+ The
+ .Fl Q
+@@ -1219,30 +1216,25 @@
  and
  .Cm pam .
  .It Cm KexAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the available KEX (Key Exchange) algorithms.
@@ -107,7 +153,7 @@
  .Sq +
 -character, then the specified algorithms will be appended to the default set
 -instead of replacing them.
-+character, then the specified algorithms will be appended to the built-in
++character, then the specified methods will be appended to the built-in
 +openssh default set instead of replacing them.
  If the specified list begins with a
  .Sq -
@@ -120,6 +166,7 @@
 -default set.
 -The default is:
 -.Bd -literal -offset indent
+-sntrup761x25519-sha512@openssh.com,
 -curve25519-sha256,curve25519-sha256@libssh.org,
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
@@ -131,13 +178,13 @@
  .Pp
  The list of available key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
-@@ -1351,37 +1344,33 @@ function, and all code in the
+@@ -1351,37 +1344,33 @@
  file.
  This option is intended for debugging and no overrides are enabled by default.
  .It Cm MACs
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the MAC (message authentication code) algorithms
@@ -178,13 +225,13 @@
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
  .It Cm NoHostAuthenticationForLocalhost
-@@ -1553,36 +1542,25 @@ instead of continuing to execute and pas
+@@ -1553,36 +1542,25 @@
  The default is
  .Cm no .
  .It Cm PubkeyAcceptedAlgorithms
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
  Specifies the signature algorithms that will be used for public key
@@ -224,16 +271,27 @@
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
-diff -up openssh-8.7p1/sshd_config.5.crypto-policies openssh-8.7p1/sshd_config.5
---- openssh-8.7p1/sshd_config.5.crypto-policies	2021-08-30 13:29:00.157292731 +0200
-+++ openssh-8.7p1/sshd_config.5	2021-08-30 13:32:16.263918533 +0200
-@@ -373,17 +373,13 @@ If the argument is
+@@ -2237,7 +2207,9 @@ for those users who do not have a config
+ This file must be world-readable.
+ .El
+ .Sh SEE ALSO
+-.Xr ssh 1
++.Xr ssh 1 ,
++.Xr crypto-policies 7 ,
++.Xr update-crypto-policies 8
+ .Sh AUTHORS
+ .An -nosplit
+ OpenSSH is a derivative of the original and free
+diff --color -ru a/sshd_config.5 b/sshd_config.5
+--- a/sshd_config.5	2022-07-12 15:05:22.535012771 +0200
++++ b/sshd_config.5	2022-07-12 15:15:33.394809258 +0200

_service:tar_scm:openssh-8.0p1-gssapi-keyex.patch Changed

@@ -1,8 +1,52 @@
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-8.0p1-gssapi-keyex.patch
+
+---
+ Makefile.in     |   3 +-
+ auth.c          |  94 +-------
+ auth2-gss.c     |  56 ++++-
+ auth2.c         |   2 +
+ canohost.c      |  93 ++++++++
+ canohost.h      |   3 +
+ clientloop.c    |  11 +
+ configure.ac    |  24 ++
+ gss-genr.c      | 297 +++++++++++++++++++++++-
+ gss-serv-krb5.c |  97 +++++++-
+ gss-serv.c      | 205 +++++++++++++++--
+ kex.c           |  66 +++++-
+ kex.h           |  29 +++
+ kexdh.c         |  10 +
+ kexgen.c        |   2 +-
+ kexgssc.c       | 599 ++++++++++++++++++++++++++++++++++++++++++++++++
+ kexgsss.c       | 474 ++++++++++++++++++++++++++++++++++++++
+ monitor.c       | 138 ++++++++++-
+ monitor.h       |   2 +
+ monitor_wrap.c  |  57 ++++-
+ monitor_wrap.h  |   4 +-
+ readconf.c      |  70 ++++++
+ readconf.h      |   6 +
+ servconf.c      |  47 ++++
+ servconf.h      |   3 +
+ session.c       |  10 +-
+ ssh-gss.h       |  54 ++++-
+ ssh.1           |   8 +
+ ssh.c           |   6 +-
+ ssh_config      |   2 +
+ ssh_config.5    |  58 +++++
+ sshconnect2.c   | 156 ++++++++++++-
+ sshd.c          |  62 ++++-
+ sshd_config     |   2 +
+ sshd_config.5   |  31 +++
+ sshkey.c        |   3 +-
+ sshkey.h        |   1 +
+ 37 files changed, 2623 insertions(+), 162 deletions(-)
+ create mode 100644 kexgssc.c
+ create mode 100644 kexgsss.c
+
 diff --git a/Makefile.in b/Makefile.in
-index e7549470..b68c1710 100644
+index f4c7540..8229885 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -112,6 +112,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
  	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
  	kexgexc.o kexgexs.o \
  	kexsntrup761x25519.o sntrup761.o kexgen.o \
@@ -10,19 +54,20 @@
  	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
  	sshbuf-io.o
  
-@@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
+@@ -128,7 +129,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
  	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
- 	auth2-none.o auth2-passwd.o auth2-pubkey.o \
+ 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
  	monitor.o monitor_wrap.o auth-krb5.o \
 -	auth2-gss.o gss-serv.o gss-serv-krb5.o \
 +	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
+ 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
  	srclimit.o sftp-server.o sftp-common.o \
  	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
-diff -up a/auth.c.gsskex b/auth.c
---- a/auth.c.gsskex	2021-08-20 06:03:49.000000000 +0200
-+++ b/auth.c	2021-08-27 12:41:51.262788953 +0200
-@@ -402,7 +402,8 @@ auth_root_allowed(struct ssh *ssh, const
+diff --git a/auth.c b/auth.c
+index 13e8d79..a449f27 100644
+--- a/auth.c
++++ b/auth.c
+@@ -358,7 +358,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
  	case PERMIT_NO_PASSWD:
  		if (strcmp(method, "publickey") == 0 ||
  		    strcmp(method, "hostbased") == 0 ||
@@ -32,10 +77,11 @@
  			return 1;
  		break;
  	case PERMIT_FORCED_ONLY:
-@@ -730,97 +731,6 @@ fakepw(void)
+@@ -639,97 +640,6 @@ fakepw(void)
+ 	return (&fake);
  }
  
- /*
+-/*
 - * Returns the remote DNS hostname as a string. The returned string must not
 - * be freed. NB. this will usually trigger a DNS query the first time it is
 - * called.
@@ -126,16 +172,15 @@
 -	return xstrdup(name);
 -}
 -
--/*
+ /*
   * Return the canonical name of the host in the other side of the current
   * connection.  The host name is cached, so it is efficient to call this
-  * several times.
 diff --git a/auth2-gss.c b/auth2-gss.c
-index 9351e042..d6446c0c 100644
+index d9b192c..cd6487c 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.32 2021/01/27 10:15:08 djm Exp $ */
+ /* $OpenBSD: auth2-gss.c,v 1.33 2021/12/19 22:12:07 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -143,7 +188,7 @@
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
+@@ -55,6 +55,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
  
@@ -192,7 +237,7 @@
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+@@ -261,7 +303,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
  	if ((r = sshpkt_get_end(ssh)) != 0)
  		fatal_fr(r, "parse packet");
  
@@ -202,7 +247,7 @@
  
  	if ((!use_privsep || mm_is_monitor()) &&
  	    (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -314,7 +357,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  	gssbuf.length = sshbuf_len(b);
  
  	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
@@ -212,7 +257,7 @@
  	else
  		logit("GSSAPI MIC check failed");
  
-@@ -326,6 +370,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -336,6 +380,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  	return 0;
  }
  
@@ -224,12 +269,12 @@
 +
  Authmethod method_gssapi = {
  	"gssapi-with-mic",
- 	userauth_gssapi,
+ 	NULL,
 diff --git a/auth2.c b/auth2.c
-index 0e776224..1c217268 100644
+index 15ae306..7510c25 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -73,6 +73,7 @@ extern Authmethod method_passwd;
+@@ -71,6 +71,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -237,7 +282,7 @@
  extern Authmethod method_gssapi;
  #endif
  
-@@ -80,6 +81,7 @@ Authmethod *authmethods = {
+@@ -78,6 +79,7 @@ Authmethod *authmethods = {
  	&method_none,
  	&method_pubkey,
  #ifdef GSSAPI
@@ -246,7 +291,7 @@
  #endif
  	&method_passwd,
 diff --git a/canohost.c b/canohost.c
-index abea9c6e..8e81b519 100644
+index a810da0..fe337d7 100644
 --- a/canohost.c
 +++ b/canohost.c
 @@ -35,6 +35,99 @@
@@ -350,7 +395,7 @@
  ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
  {
 diff --git a/canohost.h b/canohost.h
-index 26d62855..0cadc9f1 100644
+index 26d6285..0cadc9f 100644
 --- a/canohost.h
 +++ b/canohost.h
 @@ -15,6 +15,9 @@
@@ -364,10 +409,10 @@
  int		 get_peer_port(int);
  char		*get_local_ipaddr(int);
 diff --git a/clientloop.c b/clientloop.c

_service:tar_scm:openssh-8.0p1-pkcs11-uri.patch Changed

@@ -1,7 +1,98 @@
-diff -up openssh-8.7p1/configure.ac.pkcs11-uri openssh-8.7p1/configure.ac
---- openssh-8.7p1/configure.ac.pkcs11-uri	2021-08-30 13:07:43.646699953 +0200
-+++ openssh-8.7p1/configure.ac	2021-08-30 13:07:43.662700088 +0200
-@@ -1985,12 +1985,14 @@ AC_LINK_IFELSE(
+Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-8.0p1-pkcs11-uri.patch
+
+---
+ Makefile.in                      |  20 +-
+ configure.ac                     |  37 ++
+ regress/agent-pkcs11.sh          |   2 +-
+ regress/pkcs11.sh                | 349 +++++++++++++++
+ regress/unittests/pkcs11/tests.c | 337 +++++++++++++++
+ ssh-add.c                        |  44 +-
+ ssh-agent.c                      | 101 ++++-
+ ssh-keygen.c                     |   7 +-
+ ssh-pkcs11-client.c              |   3 +
+ ssh-pkcs11-uri.c                 | 419 ++++++++++++++++++
+ ssh-pkcs11-uri.h                 |  42 ++
+ ssh-pkcs11.c                     | 715 +++++++++++++++++++++++--------
+ ssh-pkcs11.h                     |   4 +
+ ssh.c                            | 104 +++--
+ ssh_config.5                     |  15 +
+ 15 files changed, 1961 insertions(+), 238 deletions(-)
+ create mode 100644 regress/pkcs11.sh
+ create mode 100644 regress/unittests/pkcs11/tests.c
+ create mode 100644 ssh-pkcs11-uri.c
+ create mode 100644 ssh-pkcs11-uri.h
+
+diff --git a/Makefile.in b/Makefile.in
+index 8229885..45f7a93 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -105,7 +105,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
+ 	ssh-ed25519-sk.o ssh-rsa.o dh.o \
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+-	ssh-pkcs11.o smult_curve25519_ref.o \
++	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
+ 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
+ 	ssh-ed25519.o digest-openssl.o digest-libc.o \
+ 	hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
+@@ -299,6 +299,8 @@ clean:	regressclean
+ 	rm -f regress/unittests/sshsig/test_sshsig$(EXEEXT)
+ 	rm -f regress/unittests/utf8/*.o
+ 	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)
++	rm -f regress/unittests/pkcs11/*.o
++	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)
+ 	rm -f regress/misc/sk-dummy/*.o
+ 	rm -f regress/misc/sk-dummy/*.lo
+ 	rm -f regress/misc/sk-dummy/sk-dummy.so
+@@ -336,6 +338,8 @@ distclean:	regressclean
+ 	rm -f regress/unittests/sshsig/test_sshsig
+ 	rm -f regress/unittests/utf8/*.o
+ 	rm -f regress/unittests/utf8/test_utf8
++	rm -f regress/unittests/pkcs11/*.o
++	rm -f regress/unittests/pkcs11/test_pkcs11
+ 	rm -f regress/misc/sk-dummy/*.o
+ 	rm -f regress/misc/sk-dummy/*.lo
+ 	rm -f regress/misc/sk-dummy/sk-dummy.so
+@@ -513,6 +517,7 @@ regress-prep:
+ 	$(MKDIR_P) `pwd`/regress/unittests/sshkey
+ 	$(MKDIR_P) `pwd`/regress/unittests/sshsig
+ 	$(MKDIR_P) `pwd`/regress/unittests/utf8
++	$(MKDIR_P) `pwd`/regress/unittests/pkcs11
+ 	$(MKDIR_P) `pwd`/regress/misc/sk-dummy
+ 	 -f `pwd`/regress/Makefile  || \
+ 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
+@@ -679,6 +684,16 @@ regress/unittests/utf8/test_utf8$(EXEEXT): \
+ 	    regress/unittests/test_helper/libtest_helper.a \
+ 	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
+ 
++UNITTESTS_TEST_PKCS11_OBJS=\
++	regress/unittests/pkcs11/tests.o
++
++regress/unittests/pkcs11/test_pkcs11$(EXEEXT): \
++    ${UNITTESTS_TEST_PKCS11_OBJS} \
++    regress/unittests/test_helper/libtest_helper.a libssh.a
++	$(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_PKCS11_OBJS) \
++	    regress/unittests/test_helper/libtest_helper.a \
++	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
++
+ # These all need to be compiled -fPIC, so they are treated differently.
+ SK_DUMMY_OBJS=\
+ 	regress/misc/sk-dummy/sk-dummy.lo \
+@@ -713,7 +728,8 @@ regress-unit-binaries: regress-prep $(REGRESSLIBS) \
+ 	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
+ 	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
+ 	regress/unittests/sshsig/test_sshsig$(EXEEXT) \
+-	regress/unittests/utf8/test_utf8$(EXEEXT)
++	regress/unittests/utf8/test_utf8$(EXEEXT) \
++	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
+ 
+ tests:	file-tests t-exec interop-tests unit
+ 	echo all tests passed
+diff --git a/configure.ac b/configure.ac
+index 6f7dc48..b57d0a5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2035,12 +2035,14 @@ AC_LINK_IFELSE(
  	AC_DEFINE(HAVE_ISBLANK, 1, Define if you have isblank(3C).)
  )
  
@@ -16,7 +107,7 @@
  		fi
  	
  )
-@@ -2019,6 +2021,40 @@ AC_SEARCH_LIBS(dlopen, dl)
+@@ -2064,6 +2066,40 @@ AC_SEARCH_LIBS(dlopen, dl)
  AC_CHECK_FUNCS(dlopen)
  AC_CHECK_DECL(RTLD_NOW, , , #include <dlfcn.h>)
  
@@ -57,7 +148,7 @@
  # IRIX has a const char return value for gai_strerror()
  AC_CHECK_FUNCS(gai_strerror, 
  	AC_DEFINE(HAVE_GAI_STRERROR)
-@@ -5624,6 +5660,7 @@ echo "                  BSD Auth support
+@@ -5651,6 +5687,7 @@ echo "                  BSD Auth support: $BSD_AUTH_MSG"
  echo "              Random number source: $RAND_MSG"
  echo "             Privsep sandbox style: $SANDBOX_STYLE"
  echo "                   PKCS#11 support: $enable_pkcs11"
@@ -65,74 +156,10 @@
  echo "                  U2F/FIDO support: $enable_sk"
  
  echo ""
-diff -up openssh-8.7p1/Makefile.in.pkcs11-uri openssh-8.7p1/Makefile.in
---- openssh-8.7p1/Makefile.in.pkcs11-uri	2021-08-30 13:07:43.571699324 +0200
-+++ openssh-8.7p1/Makefile.in	2021-08-30 13:07:43.663700096 +0200
-@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
- 	ssh-ed25519-sk.o ssh-rsa.o dh.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
--	ssh-pkcs11.o smult_curve25519_ref.o \
-+	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
- 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
- 	ssh-ed25519.o digest-openssl.o digest-libc.o \
- 	hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
-@@ -302,6 +302,8 @@ clean:	regressclean
- 	rm -f regress/unittests/sshsig/test_sshsig$(EXEEXT)
- 	rm -f regress/unittests/utf8/*.o
- 	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)
-+	rm -f regress/unittests/pkcs11/*.o
-+	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)
- 	rm -f regress/misc/sk-dummy/*.o
- 	rm -f regress/misc/sk-dummy/*.lo
- 	rm -f regress/misc/sk-dummy/sk-dummy.so
-@@ -339,6 +341,8 @@ distclean:	regressclean
- 	rm -f regress/unittests/sshsig/test_sshsig
- 	rm -f regress/unittests/utf8/*.o
- 	rm -f regress/unittests/utf8/test_utf8
-+	rm -f regress/unittests/pkcs11/*.o
-+	rm -f regress/unittests/pkcs11/test_pkcs11
- 	(cd openbsd-compat && $(MAKE) distclean)
- 	if test -d pkg ; then \
- 		rm -fr pkg ; \
-@@ -513,6 +517,7 @@ regress-prep:
- 	$(MKDIR_P) `pwd`/regress/unittests/sshkey
- 	$(MKDIR_P) `pwd`/regress/unittests/sshsig
- 	$(MKDIR_P) `pwd`/regress/unittests/utf8
-+	$(MKDIR_P) `pwd`/regress/unittests/pkcs11
- 	$(MKDIR_P) `pwd`/regress/misc/sk-dummy
- 	 -f `pwd`/regress/Makefile  || \
- 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
-@@ -677,6 +682,16 @@ regress/unittests/utf8/test_utf8$(EXEEXT
- 	    regress/unittests/test_helper/libtest_helper.a \
- 	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
- 
-+UNITTESTS_TEST_PKCS11_OBJS=\
-+	regress/unittests/pkcs11/tests.o
-+
-+regress/unittests/pkcs11/test_pkcs11$(EXEEXT): \
-+    ${UNITTESTS_TEST_PKCS11_OBJS} \
-+    regress/unittests/test_helper/libtest_helper.a libssh.a
-+	$(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_PKCS11_OBJS) \
-+	    regress/unittests/test_helper/libtest_helper.a \
-+	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-+
- # These all need to be compiled -fPIC, so they are treated differently.
- SK_DUMMY_OBJS=\
- 	regress/misc/sk-dummy/sk-dummy.lo \
-@@ -711,7 +726,8 @@ regress-unit-binaries: regress-prep $(RE
- 	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
- 	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
- 	regress/unittests/sshsig/test_sshsig$(EXEEXT) \
--	regress/unittests/utf8/test_utf8$(EXEEXT)
-+	regress/unittests/utf8/test_utf8$(EXEEXT) \
-+	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
- 
- tests:	file-tests t-exec interop-tests unit
- 	echo all tests passed
-diff -up openssh-8.7p1/regress/agent-pkcs11.sh.pkcs11-uri openssh-8.7p1/regress/agent-pkcs11.sh
---- openssh-8.7p1/regress/agent-pkcs11.sh.pkcs11-uri	2021-08-20 06:03:49.000000000 +0200
-+++ openssh-8.7p1/regress/agent-pkcs11.sh	2021-08-30 13:07:43.663700096 +0200
+diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh
+index 268a70d..72efa3b 100644
+--- a/regress/agent-pkcs11.sh
++++ b/regress/agent-pkcs11.sh
 @@ -113,7 +113,7 @@ else
  	done

_service:tar_scm:openssh-Add-sw64-architecture.patch Added

_service:tar_scm:set-ssh-config.patch Added

_service:tar_scm:set-sshd-config.patch Changed

_service:tar_scm:skip-scp-test-if-there-is-no-scp-on-remote-path-as-s.patch Added

@@ -0,0 +1,38 @@
+From e32af8efd8d36f8349761615b73cb3174e52134a Mon Sep 17 00:00:00 2001
+From: chengyechun <chengyechun1@huawei.com>
+Date: Thu, 5 Jan 2023 22:45:10 +0800
+Subject: PATCH skip scp test if there is no scp on remote path as scp3.sh
+ did
+
+---
+ regress/multiplex.sh | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/regress/multiplex.sh b/regress/multiplex.sh
+index 4744fa3..8ab0f59 100644
+--- a/regress/multiplex.sh
++++ b/regress/multiplex.sh
+@@ -67,11 +67,15 @@ echo "get ${DATA} ${COPY}" | \
+ test -f ${COPY}			|| fail "sftp: failed copy ${DATA}" 
+ cmp ${DATA} ${COPY}		|| fail "sftp: corrupted copy of ${DATA}"
+ 
+-rm -f ${COPY}
+-trace "scp transfer over multiplexed connection and check result"
+-${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >>$TEST_REGRESS_LOGFILE 2>&1
+-test -f ${COPY}			|| fail "scp: failed copy ${DATA}" 
+-cmp ${DATA} ${COPY}		|| fail "scp: corrupted copy of ${DATA}"
++$SSH -F $OBJ/ssh_proxy somehost \
++    'IFS=":"; for i in $PATH;do  -x "$i/scp"  && exit 0; done; exit 1'
++if  $? -eq 0 ; then
++	rm -f ${COPY}
++	trace "scp transfer over multiplexed connection and check result"
++	${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >>$TEST_REGRESS_LOGFILE 2>&1
++	test -f ${COPY}			|| fail "scp: failed copy ${DATA}" 
++	cmp ${DATA} ${COPY}		|| fail "scp: corrupted copy of ${DATA}"
++fi
+ 
+ rm -f ${COPY}
+ verbose "test $tid: forward"
+-- 
+2.23.0
+

_service Changed

_service:tar_scm:openssh-8.8p1.tar.gz.asc Deleted

_service:tar_scm:openssh-8.8p1.tar.gz -> _service:tar_scm:openssh-9.1p1.tar.gz Changed

_service:tar_scm:openssh-9.1p1.tar.gz.asc Added

_service:tar_scm:ssh-keygen-bash-completion.sh Added

@@ -0,0 +1,63 @@
+# ssh-keygen(1) completion                                 -*- shell-script -*-
+
+_ssh_keygen()
+{
+    local cur prev words cword
+    _init_completion -n = || return
+
+    case $prev in
+        -*abCIJjMNnrPSVWz)
+            return
+            ;;
+        -*E)
+            COMPREPLY=( $(compgen -W 'md5 sha256' -- "$cur") )
+            return
+            ;;
+        -*FR)
+            # TODO: trim this down to actual entries in known hosts files
+            _known_hosts_real -- "$cur"
+            return
+            ;;
+        -*D)
+            _filedir so
+            return
+            ;;
+        -*fGKsT)
+            _filedir
+            return
+            ;;
+        -*m)
+            COMPREPLY=( $(compgen -W 'PEM PKCS8 RFC4716' -- "$cur") )
+            return
+            ;;
+        -*O)
+            if  $cur != *=* ; then
+                COMPREPLY=( $(compgen -W 'clear force-command=
+                    no-agent-forwarding no-port-forwarding no-pty no-user-rc
+                    no-x11-forwarding permit-agent-forwarding
+                    permit-port-forwarding permit-pty permit-user-rc
+                    permit-x11-forwarding source-address=' -- "$cur") )
+                 $COMPREPLY == *=  && compopt -o nospace
+            fi
+            return
+            ;;
+        -*t)
+            local protocols=$(_xfunc ssh _ssh_query "$1" protocol-version)
+            local types='dsa ecdsa ed25519 rsa sm2'
+            if  $protocols == *1* ; then
+                types+=' rsa1'
+            fi
+            COMPREPLY=( $(compgen -W "$types" -- "$cur") )
+            return
+            ;;
+    esac
+
+    if  $cur == -* ; then
+        local opts=$(_parse_usage "$1" "-?")
+         -z "$opts"  && opts=$(_parse_help "$1" "-?")  # OpenSSH < 7
+        COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+    fi
+} &&
+complete -F _ssh_keygen ssh-keygen
+
+# ex: filetype=sh