From 116c684a9e8b2133c957af12037f9816a64298b3 Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Thu, 16 Jul 2026 16:05:59 +0200
Subject: [PATCH] Fix GSSAPI indicators check ignoring subsequent deny rules if
 allow rule matched first

Resolves: RHEL-182151

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
 ...-authentication-indicators-in-GSSAPI.patch | 23 +++++++++++++------
 openssh.spec                                  |  7 +++++-
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch b/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
index 2a74740..ef70379 100644
--- a/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
+++ b/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
@@ -170,7 +170,7 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
  
  #include "ssh-gss.h"
  
-@@ -87,6 +88,33 @@ ssh_gssapi_krb5_init(void)
+@@ -87,6 +88,42 @@ ssh_gssapi_krb5_init(void)
  	return 1;
  }
  
@@ -178,6 +178,10 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
 + * one of indicators in the list of allowed/denied rules.
 + * In case of the match, apply the decision from the rule.
 + * In case of no indicator from the ticket matching the rule, deny
++ *
++ * Returns -1 on any negative match
++ * Returns 1 on positive match and no negative matches
++ * Returns 0 when no matches occurred
 + */
 +
 +static int
@@ -187,18 +191,23 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
 +	u_int i;
 +	*matched = -1;
 +
-+	/* Check indicators */
 +	for (i = 0; client->indicators[i] != NULL; i++) {
 +		ret = match_pattern_list(client->indicators[i],
 +					 options.gss_indicators, 1);
-+		/* negative or positive match */
-+		if (ret != 0) {
++
++		/* record first positive match */
++		if (ret == 1 && *matched == -1)
 +			*matched = i;
-+			return ret;
++
++		/* deny rule matched, return negative */
++		if (ret == -1) {
++			*matched = i;
++			return -1;
 +		}
 +	}
-+	/* No rule matched */
-+	return 0;
++	/* if there was a match, it was positive,
++	 * otherwise no match */
++	return *matched != -1;
 +}
 +
  /* Check if this user is OK to login. This only works with krb5 - other
diff --git a/openssh.spec b/openssh.spec
index c082bda..e2c0998 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 27%{?dist}
+Release: 28%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -746,6 +746,11 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
+- Fix GSSAPI indicators check ignoring subsequent deny rules if
+  allow rule matched first
+  Resolves: RHEL-182151
+
 * Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-27
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
   FIPS known-group validation that leads to client-side denial of service