rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

import CS openssh-9.9p1-11.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-24 09:29:09 -04:00
parent 22cebc4f1e
commit 1c4d703c00
16 changed files with 1459 additions and 300 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

165
SOURCES/openssh-6.7p1-coverity.patch
View File

@ -159,7 +159,47 @@ diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openb
diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
--- openssh-8.5p1/readconf.c.coverity 2021-03-24 12:03:33.778968131 +0100
+++ openssh-8.5p1/readconf.c 2021-03-24 12:03:33.785968180 +0100
@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
@@ -749,12 +749,12 @@ match_cfg_line(Options *options, const c
debug2("checking match for '%s' host %s originally %s",
full_line, host, original_host);
while ((attrib = argv_next(acp, avp)) != NULL) {
- attrib = oattrib = xstrdup(attrib);
/* Terminate on comment */
if (*attrib == '#') {
argv_consume(acp);
break;
}
+ attrib = oattrib = xstrdup(attrib);
arg = criteria = NULL;
this_result = 1;
if ((negate = (attrib[0] == '!')))
@@ -793,7 +793,7 @@ match_cfg_line(Options *options, const c
debug3("%.200s line %d: %smatched '%s'",
filename, linenum,
this_result ? "" : "not ", oattrib);
- continue;
+ goto next;
}
/* Keep this list in sync with below */
@@ -863,7 +863,7 @@ match_cfg_line(Options *options, const c
debug3("%.200s line %d: skipped exec "
"\"%.100s\"", filename, linenum, cmd);
free(cmd);
- continue;
+ goto next;
}
r = execute_in_shell(cmd);
if (r == -1) {
@@ -887,6 +887,7 @@ match_cfg_line(Options *options, const c
criteria == NULL ? "" : " \"",
criteria == NULL ? "" : criteria,
criteria == NULL ? "" : "\"");
+next:
free(criteria);
free(oattrib);
oattrib = attrib = NULL;
@@ -1847,6 +1848,7 @@ parse_pubkey_algos:
} else if (r != 0) {
error("%.200s line %d: glob failed for %s.",
filename, linenum, arg2);
@ -170,7 +210,109 @@ diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
--- openssh-7.4p1/servconf.c.coverity 2016-12-23 16:40:26.896788690 +0100
+++ openssh-7.4p1/servconf.c 2016-12-23 16:40:26.901788691 +0100
@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
@@ -1104,12 +1104,12 @@ match_cfg_line(const char *full_line, in
}
while ((oattrib = argv_next(acp, avp)) != NULL) {
- attrib = xstrdup(oattrib);
/* Terminate on comment */
- if (*attrib == '#') {
+ if (*oattrib == '#') {
argv_consume(acp); /* mark all arguments consumed */
break;
}
+ attrib = xstrdup(oattrib);
arg = NULL;
attributes++;
/* Criterion "all" has no argument and must appear alone */
@@ -1131,13 +1131,13 @@ match_cfg_line(const char *full_line, in
if (strcasecmp(attrib, "invalid-user") == 0) {
if (ci == NULL) {
result = 0;
- continue;
+ goto next;
}
if (ci->user_invalid == 0)
result = 0;
else
debug("matched invalid-user at line %d", line);
- continue;
+ goto next;
}
/* Keep this list in sync with below */
@@ -1163,7 +1163,7 @@ match_cfg_line(const char *full_line, in
if (strcasecmp(attrib, "user") == 0) {
if (ci == NULL || (ci->test && ci->user == NULL)) {
result = 0;
- continue;
+ goto next;
}
if (ci->user == NULL)
match_test_missing_fatal("User", "user");
@@ -1175,7 +1175,7 @@ match_cfg_line(const char *full_line, in
} else if (strcasecmp(attrib, "group") == 0) {
if (ci == NULL || (ci->test && ci->user == NULL)) {
result = 0;
- continue;
+ goto next;
}
if (ci->user == NULL)
match_test_missing_fatal("Group", "user");
@@ -1189,7 +1189,7 @@ match_cfg_line(const char *full_line, in
} else if (strcasecmp(attrib, "host") == 0) {
if (ci == NULL || (ci->test && ci->host == NULL)) {
result = 0;
- continue;
+ goto next;
}
if (ci->host == NULL)
match_test_missing_fatal("Host", "host");
@@ -1204,7 +1204,7 @@ match_cfg_line(const char *full_line, in
fatal("Invalid Match address argument "
"'%s' at line %d", arg, line);
result = 0;
- continue;
+ goto next;
}
if (ci->address == NULL)
match_test_missing_fatal("Address", "addr");
@@ -1228,7 +1228,7 @@ match_cfg_line(const char *full_line, in
"argument '%s' at line %d", arg,
line);
result = 0;
- continue;
+ goto next;
}
if (ci->laddress == NULL)
match_test_missing_fatal("LocalAddress",
@@ -1256,7 +1256,7 @@ match_cfg_line(const char *full_line, in
}
if (ci == NULL || (ci->test && ci->lport == -1)) {
result = 0;
- continue;
+ goto next;
}
if (ci->lport == 0)
match_test_missing_fatal("LocalPort", "lport");
@@ -1270,7 +1270,7 @@ match_cfg_line(const char *full_line, in
} else if (strcasecmp(attrib, "rdomain") == 0) {
if (ci == NULL || (ci->test && ci->rdomain == NULL)) {
result = 0;
- continue;
+ goto next;
}
if (ci->rdomain == NULL)
match_test_missing_fatal("RDomain", "rdomain");
@@ -1284,6 +1284,7 @@ match_cfg_line(const char *full_line, in
result = -1;
goto out;
}
+next:
free(attrib);
attrib = NULL;
}
@@ -1638,8 +1639,9 @@ process_server_config_line(ServerOptions
if (*activep && *charptr == NULL) {
*charptr = tilde_expand_filename(arg, getuid());
/* increase optional counter */
@ -246,3 +388,22 @@ diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
} else {
if (strncasecmp(cp, "key:", 4) == 0) {
cp += 4;
diff -up openssh-9.9p1/sshd.c.coverity openssh-9.9p1/sshd.c
--- openssh-9.9p1/sshd.c.coverity 2026-04-08 15:19:20.480015568 +0200
+++ openssh-9.9p1/sshd.c 2026-04-08 15:22:10.938328556 +0200
@@ -1069,6 +1069,7 @@ server_accept_loop(int *sock_in, int *so
send_rexec_state(config_s[0], cfg);
close(config_s[0]);
free(pfd);
+ free(startup_pollfd);
return;
}
@@ -1101,6 +1102,7 @@ server_accept_loop(int *sock_in, int *so
log_stderr);
close(config_s[0]);
free(pfd);
+ free(startup_pollfd);
return;
}

11
SOURCES/openssh-7.2p2-x11.patch
View File

@ -32,7 +32,7 @@ diff --git a/channels.c b/channels.c
return -1;
}
@@ -5099,8 +5102,18 @@
@@ -5099,8 +5102,19 @@
connect_local_xsocket(u_int dnr)
{
char buf[1024];
@ -41,10 +41,11 @@ diff --git a/channels.c b/channels.c
+ int len, ret;
+ len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
+#ifdef linux
+ /* try abstract socket first */
+ buf[0] = '\0';
+ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
+ return ret;
+ if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
+ buf[0] = '\0';
+ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
+ return ret;
+ }
+#endif
+ if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
+ return ret;

11
SOURCES/openssh-7.7p1-fips.patch
View File

@ -106,17 +106,18 @@ diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c
#include <sys/types.h>
#include <openssl/dh.h>
@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32
r = SSH_ERR_ALLOC_FAIL;
goto out;
@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
}
p = g = NULL; /* belong to kex->dh now */
+ if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
+ r = SSH_ERR_INVALID_ARGUMENT;
+ goto out;
+ }
p = g = NULL; /* belong to kex->dh now */
+
/* generate and send 'e', client DH public key */
if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
goto out;
diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h
--- openssh-8.6p1/myproposal.h.fips 2021-04-16 05:55:25.000000000 +0200
+++ openssh-8.6p1/myproposal.h 2021-05-06 12:08:36.498926877 +0200

40
SOURCES/openssh-9.6p1-gssapi-keyex.patch
View File

@ -1240,7 +1240,7 @@ diff --color -ruNp a/kexgen.c b/kexgen.c
const struct sshbuf *client_version,
diff --color -ruNp a/kexgssc.c b/kexgssc.c
--- a/kexgssc.c 1970-01-01 01:00:00.000000000 +0100
+++ b/kexgssc.c 2024-10-14 15:18:02.491798105 +0200
+++ b/kexgssc.c 2026-03-13 12:25:23.115812190 +0100
@@ -0,0 +1,706 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -1369,7 +1369,7 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
+
+ /* Verify that the hash matches the MIC we just got. */
+ if (GSS_ERROR(ssh_gssapi_checkmic(gss, &gss->buf, &gss->msg_tok)))
+ sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
+ ssh_packet_disconnect(ssh, "Hash's MIC didn't verify");
+
+ gss_release_buffer(&gss->minor, &gss->msg_tok);
+
@ -1592,10 +1592,10 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
+ fatal("Failed to read token: %s", ssh_err(r));
+ /* If we're already complete - protocol error */
+ if (gss->major == GSS_S_COMPLETE)
+ sshpkt_disconnect(ssh, "Protocol error: received token when complete");
+ ssh_packet_disconnect(ssh, "Protocol error: received token when complete");
+ } else {
+ if (gss->major != GSS_S_COMPLETE)
+ sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
+ ssh_packet_disconnect(ssh, "Protocol error: did not receive final token");
+ }
+ if ((r = sshpkt_get_end(ssh)) != 0)
+ fatal("Expecting end of packet.");
@ -1731,7 +1731,7 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
+
+ /* Verify that the hash matches the MIC we just got. */
+ if (GSS_ERROR(ssh_gssapi_checkmic(gss, &gss->buf, &gss->msg_tok)))
+ sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
+ ssh_packet_disconnect(ssh, "Hash's MIC didn't verify");
+
+ gss_release_buffer(&gss->minor, &gss->msg_tok);
+
@ -1932,10 +1932,10 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
+ fatal("Failed to read token: %s", ssh_err(r));
+ /* If we're already complete - protocol error */
+ if (gss->major == GSS_S_COMPLETE)
+ sshpkt_disconnect(ssh, "Protocol error: received token when complete");
+ ssh_packet_disconnect(ssh, "Protocol error: received token when complete");
+ } else {
+ if (gss->major != GSS_S_COMPLETE)
+ sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
+ ssh_packet_disconnect(ssh, "Protocol error: did not receive final token");
+ }
+ if ((r = sshpkt_get_end(ssh)) != 0)
+ fatal("Expecting end of packet.");
@ -1950,8 +1950,8 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
+#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
diff --color -ruNp a/kexgsss.c b/kexgsss.c
--- a/kexgsss.c 1970-01-01 01:00:00.000000000 +0100
+++ b/kexgsss.c 2024-10-14 15:18:02.491798105 +0200
@@ -0,0 +1,601 @@
+++ b/kexgsss.c 2026-03-13 12:32:17.556172591 +0100
@@ -0,0 +1,603 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
+ *
@ -2083,7 +2083,7 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+{
+ struct kex *kex = ssh->kex;
+ Gssctxt *gss = kex->gss;
+ gss_buffer_desc msg_tok;
+ gss_buffer_desc msg_tok = GSS_C_EMPTY_BUFFER;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t hashlen;
+ struct sshbuf *shared_secret = NULL;
@ -2167,7 +2167,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+ Gssctxt *gss = kex->gss;
+ struct sshbuf *empty;
+ struct sshbuf *client_pubkey = NULL;
+ gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+ OM_uint32 ret_flags = 0;
+ int r;
+
@ -2243,7 +2244,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+ struct ssh *ssh)
+{
+ Gssctxt *gss = ssh->kex->gss;
+ gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+ OM_uint32 ret_flags = 0;
+ int r;
+
@ -2334,7 +2336,7 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+{
+ struct kex *kex = ssh->kex;
+ Gssctxt *gss = kex->gss;
+ gss_buffer_desc msg_tok;
+ gss_buffer_desc msg_tok = GSS_C_EMPTY_BUFFER;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t hashlen;
+ const BIGNUM *pub_key, *dh_p, *dh_g;
@ -2475,10 +2477,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+ fatal("GSS_GEX, bad parameters: %d !< %d !< %d", min, nbits, max);
+
+ kex->dh = mm_choose_dh(min, nbits, max);
+ if (kex->dh == NULL) {
+ sshpkt_disconnect(ssh, "Protocol error: no matching group found");
+ fatal("Protocol error: no matching group found");
+ }
+ if (kex->dh == NULL)
+ ssh_packet_disconnect(ssh, "Protocol error: no matching group found");
+
+ DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 ||
@ -2510,7 +2510,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+ struct ssh *ssh)
+{
+ Gssctxt *gss = ssh->kex->gss;
+ gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+ OM_uint32 ret_flags = 0;
+ int r;
+
@ -2537,7 +2538,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
+ struct ssh *ssh)
+{
+ Gssctxt *gss = ssh->kex->gss;
+ gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+ OM_uint32 ret_flags = 0;
+ int r;
+

45
SOURCES/openssh-9.9p1-authorized-keys-principles-option.patch Normal file
View File

@ -0,0 +1,45 @@
diff --color -ruNp a/auth2-pubkeyfile.c b/auth2-pubkeyfile.c
--- a/auth2-pubkeyfile.c 2024-09-20 00:20:48.000000000 +0200
+++ b/auth2-pubkeyfile.c 2026-04-09 14:38:41.697178612 +0200
@@ -50,6 +50,7 @@
#include "authfile.h"
#include "match.h"
#include "ssherr.h"
+#include "xmalloc.h"
int
auth_authorise_keyopts(struct passwd *pw, struct sshauthopt *opts,
@@ -146,20 +147,23 @@ auth_authorise_keyopts(struct passwd *pw
static int
match_principals_option(const char *principal_list, struct sshkey_cert *cert)
{
- char *result;
+ char *list, *olist, *entry;
u_int i;
- /* XXX percent_expand() sequences for authorized_principals? */
-
- for (i = 0; i < cert->nprincipals; i++) {
- if ((result = match_list(cert->principals[i],
- principal_list, NULL)) != NULL) {
- debug3("matched principal from key options \"%.100s\"",
- result);
- free(result);
- return 1;
+ olist = list = xstrdup(principal_list);
+ for (;;) {
+ if ((entry = strsep(&list, ",")) == NULL || *entry == '\0')
+ break;
+ for (i = 0; i < cert->nprincipals; i++) {
+ if (strcmp(entry, cert->principals[i]) == 0) {
+ debug3("matched principal from key i"
+ "options \"%.100s\"", entry);
+ free(olist);
+ return 1;
+ }
}
}
+ free(olist);
return 0;
}

191
SOURCES/openssh-9.9p1-cve-2026-60002.patch Normal file
View File

@ -0,0 +1,191 @@
diff --color -ruNp a/ssh.c b/ssh.c
--- a/ssh.c 2026-07-14 11:58:09.036496915 +0200
+++ b/ssh.c 2026-07-14 12:00:55.044542741 +0200
@@ -619,26 +619,6 @@ set_addrinfo_port(struct addrinfo *addrs
}
}
-static void
-ssh_conn_info_free(struct ssh_conn_info *cinfo)
-{
- if (cinfo == NULL)
- return;
- free(cinfo->conn_hash_hex);
- free(cinfo->shorthost);
- free(cinfo->uidstr);
- free(cinfo->keyalias);
- free(cinfo->thishost);
- free(cinfo->host_arg);
- free(cinfo->portstr);
- free(cinfo->remhost);
- free(cinfo->remuser);
- free(cinfo->homedir);
- free(cinfo->locuser);
- free(cinfo->jmphost);
- free(cinfo);
-}
-
/*
* Main program for the ssh client.
*/
@@ -1765,8 +1745,8 @@ main(int ac, char **av)
ssh_signal(SIGCHLD, main_sigchld_handler);
/* Log into the remote system. Never returns if the login fails. */
- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
- options.port, pw, timeout_ms, cinfo);
+ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
+ pw, timeout_ms, cinfo);
/* We no longer need the private host keys. Clear them now. */
if (sensitive_data.nkeys != 0) {
diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
--- a/sshconnect2.c 2026-07-14 11:58:09.031477028 +0200
+++ b/sshconnect2.c 2026-07-14 12:01:56.374803123 +0200
@@ -89,7 +89,7 @@ extern Options options;
*/
static char *xxx_host;
-static struct sockaddr *xxx_hostaddr;
+static struct sockaddr_storage xxx_hostaddr;
static const struct ssh_conn_info *xxx_conn_info;
static int key_type_allowed(struct sshkey *, const char *);
@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *
fatal("Server host key %s not in HostKeyAlgorithms",
sshkey_ssh_name(hostkey));
}
- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
xxx_conn_info) != 0)
fatal("Host key verification failed.");
return 0;
@@ -222,8 +222,8 @@ order_hostkeyalgs(char *host, struct soc
}
void
-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
- const struct ssh_conn_info *cinfo)
+ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
+ u_short port, const struct ssh_conn_info *cinfo)
{
char *myproposal[PROPOSAL_MAX];
char *all_key, *hkalgs = NULL, *filtered_algs = NULL;
@@ -234,9 +234,9 @@ ssh_kex2(struct ssh *ssh, char *host, st
char *gss_host = NULL;
#endif
- xxx_host = host;
- xxx_hostaddr = hostaddr;
- xxx_conn_info = cinfo;
+ xxx_host = xstrdup(host);
+ xxx_hostaddr = *hostaddr;
+ xxx_conn_info = ssh_conn_info_dup(cinfo);
if (options.rekey_limit || options.rekey_interval)
ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
@@ -259,8 +259,10 @@ ssh_kex2(struct ssh *ssh, char *host, st
fatal_fr(r, "kex_assemble_namelist");
free(all_key);
- if (use_known_hosts_order)
- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
+ if (use_known_hosts_order) {
+ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
+ port, cinfo);
+ }
filtered_algs = hkalgs ? match_filter_allowlist(hkalgs, options.pubkey_accepted_algos)
: match_filter_allowlist(options.hostkeyalgorithms,
diff --color -ruNp a/sshconnect.c b/sshconnect.c
--- a/sshconnect.c 2026-07-14 11:58:08.892659011 +0200
+++ b/sshconnect.c 2026-07-14 12:00:55.045767462 +0200
@@ -84,6 +84,49 @@ extern char *__progname;
static int show_other_keys(struct hostkeys *, struct sshkey *);
static void warn_changed_key(struct sshkey *);
+void
+ssh_conn_info_free(struct ssh_conn_info *cinfo)
+{
+ if (cinfo == NULL)
+ return;
+ free(cinfo->conn_hash_hex);
+ free(cinfo->shorthost);
+ free(cinfo->uidstr);
+ free(cinfo->keyalias);
+ free(cinfo->thishost);
+ free(cinfo->host_arg);
+ free(cinfo->portstr);
+ free(cinfo->remhost);
+ free(cinfo->remuser);
+ free(cinfo->homedir);
+ free(cinfo->locuser);
+ free(cinfo->jmphost);
+ freezero(cinfo, sizeof(*cinfo));
+}
+
+struct ssh_conn_info *
+ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
+{
+ struct ssh_conn_info *ret;
+
+ if (cinfo == NULL)
+ return NULL;
+ ret = xcalloc(1, sizeof(*ret));
+ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
+ ret->shorthost = xstrdup(cinfo->shorthost);
+ ret->uidstr = xstrdup(cinfo->uidstr);
+ ret->keyalias = xstrdup(cinfo->keyalias);
+ ret->thishost = xstrdup(cinfo->thishost);
+ ret->host_arg = xstrdup(cinfo->host_arg);
+ ret->portstr = xstrdup(cinfo->portstr);
+ ret->remhost = xstrdup(cinfo->remhost);
+ ret->remuser = xstrdup(cinfo->remuser);
+ ret->homedir = xstrdup(cinfo->homedir);
+ ret->locuser = xstrdup(cinfo->locuser);
+ ret->jmphost = xstrdup(cinfo->jmphost);
+ return ret;
+}
+
/* Expand a proxy command */
static char *
expand_proxy_command(const char *proxy_command, const char *user,
@@ -1589,8 +1632,8 @@ out:
*/
void
ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
- const struct ssh_conn_info *cinfo)
+ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
+ int timeout_ms, const struct ssh_conn_info *cinfo)
{
char *host;
char *server_user, *local_user;
diff --color -ruNp a/sshconnect.h b/sshconnect.h
--- a/sshconnect.h 2024-09-20 00:20:48.000000000 +0200
+++ b/sshconnect.h 2026-07-14 12:00:55.045948953 +0200
@@ -73,7 +73,7 @@ int ssh_connect(struct ssh *, const cha
void ssh_kill_proxy_command(void);
void ssh_login(struct ssh *, Sensitive *, const char *,
- struct sockaddr *, u_short, struct passwd *, int,
+ struct sockaddr_storage *, u_short, struct passwd *, int,
const struct ssh_conn_info *);
int verify_host_key(char *, struct sockaddr *, struct sshkey *,
@@ -82,7 +82,7 @@ int verify_host_key(char *, struct sock
void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
char **, char **);
-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
+void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
const struct ssh_conn_info *);
void ssh_userauth2(struct ssh *ssh, const char *, const char *,
@@ -98,3 +98,6 @@ void load_hostkeys_command(struct hostk
const struct sshkey *, const char *);
int hostkey_accepted_by_hostkeyalgs(const struct sshkey *);
+
+void ssh_conn_info_free(struct ssh_conn_info *);
+struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);

103
SOURCES/openssh-9.9p1-ecdsa-incomplete-application.patch Normal file
View File

@ -0,0 +1,103 @@
diff --color -ruNp a/auth2-hostbased.c b/auth2-hostbased.c
--- a/auth2-hostbased.c 2026-04-09 13:22:28.114045749 +0200
+++ b/auth2-hostbased.c 2026-04-09 14:34:44.876393822 +0200
@@ -96,9 +96,10 @@ userauth_hostbased(struct ssh *ssh, cons
error_f("cannot decode key: %s", pkalg);
goto done;
}
- if (key->type != pktype) {
- error_f("type mismatch for decoded key "
- "(received %d, expected %d)", key->type, pktype);
+ if (key->type != pktype || (sshkey_type_plain(pktype) == KEY_ECDSA &&
+ sshkey_ecdsa_nid_from_name(pkalg) != key->ecdsa_nid)) {
+ error_f("key type mismatch for decoded key "
+ "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
goto done;
}
if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
diff --color -ruNp a/auth2-pubkey.c b/auth2-pubkey.c
--- a/auth2-pubkey.c 2026-04-09 13:22:28.157194118 +0200
+++ b/auth2-pubkey.c 2026-04-09 14:35:48.997689347 +0200
@@ -152,9 +152,10 @@ userauth_pubkey(struct ssh *ssh, const c
error_f("cannot decode key: %s", pkalg);
goto done;
}
- if (key->type != pktype) {
- error_f("type mismatch for decoded key "
- "(received %d, expected %d)", key->type, pktype);
+ if (key->type != pktype || (sshkey_type_plain(pktype) == KEY_ECDSA &&
+ sshkey_ecdsa_nid_from_name(pkalg) != key->ecdsa_nid)) {
+ error_f("key type mismatch for decoded key "
+ "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
goto done;
}
if (auth2_key_already_used(authctxt, key)) {
diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
--- a/sshconnect2.c 2026-04-09 13:22:28.193412553 +0200
+++ b/sshconnect2.c 2026-04-09 14:42:37.644945762 +0200
@@ -91,6 +91,7 @@ extern Options options;
static char *xxx_host;
static struct sockaddr *xxx_hostaddr;
static const struct ssh_conn_info *xxx_conn_info;
+static int key_type_allowed(struct sshkey *, const char *);
static int
verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
@@ -100,6 +101,10 @@ verify_host_key_callback(struct sshkey *
if ((r = sshkey_check_rsa_length(hostkey,
options.required_rsa_size)) != 0)
fatal_r(r, "Bad server host key");
+ if (!key_type_allowed(hostkey, options.hostkeyalgorithms)) {
+ fatal("Server host key %s not in HostKeyAlgorithms",
+ sshkey_ssh_name(hostkey));
+ }
if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
xxx_conn_info) != 0)
fatal("Host key verification failed.");
@@ -1776,34 +1781,37 @@ load_identity_file(Identity *id)
}
static int
-key_type_allowed_by_config(struct sshkey *key)
+key_type_allowed(struct sshkey *key, const char *allowlist)
{
- if (match_pattern_list(sshkey_ssh_name(key),
- options.pubkey_accepted_algos, 0) == 1)
+ if (match_pattern_list(sshkey_ssh_name(key), allowlist, 0) == 1)
return 1;
/* RSA keys/certs might be allowed by alternate signature types */
switch (key->type) {
case KEY_RSA:
- if (match_pattern_list("rsa-sha2-512",
- options.pubkey_accepted_algos, 0) == 1)
+ if (match_pattern_list("rsa-sha2-512", allowlist, 0) == 1)
return 1;
- if (match_pattern_list("rsa-sha2-256",
- options.pubkey_accepted_algos, 0) == 1)
+ if (match_pattern_list("rsa-sha2-256", allowlist, 0) == 1)
return 1;
break;
case KEY_RSA_CERT:
if (match_pattern_list("rsa-sha2-512-cert-v01@openssh.com",
- options.pubkey_accepted_algos, 0) == 1)
+ allowlist, 0) == 1)
return 1;
if (match_pattern_list("rsa-sha2-256-cert-v01@openssh.com",
- options.pubkey_accepted_algos, 0) == 1)
+ allowlist, 0) == 1)
return 1;
break;
}
return 0;
}
+static int
+key_type_allowed_by_config(struct sshkey *key)
+{
+ return key_type_allowed(key, options.pubkey_accepted_algos);
+}
+
/* obtain a list of keys from the agent */
static int
get_agent_identities(struct ssh *ssh, int *agent_fdp,

24
SOURCES/openssh-9.9p1-fill-default-options-error.patch Normal file
View File

@ -0,0 +1,24 @@
diff --color -ruNp a/readconf.c b/readconf.c
--- a/readconf.c 2026-04-02 15:36:49.624394836 +0200
+++ b/readconf.c 2026-04-02 15:43:15.115047190 +0200
@@ -2779,7 +2779,7 @@ fill_default_options(Options * options)
{
char *all_cipher, *all_mac, *all_kex, *all_key, *all_sig;
char *def_cipher, *def_mac, *def_kex, *def_key, *def_sig;
- int ret = 0, r;
+ int ret = 0;
if (options->forward_agent == -1)
options->forward_agent = 0;
@@ -2989,9 +2989,9 @@ fill_default_options(Options * options)
KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
#define ASSEMBLE(what, defaults, all) \
do { \
- if ((r = kex_assemble_names(&options->what, \
+ if ((ret = kex_assemble_names(&options->what, \
defaults, all)) != 0) { \
- error_fr(r, "%s", #what); \
+ error_fr(ret, "%s", #what); \
goto fail; \
} \
} while (0)

73
SOURCES/openssh-9.9p1-maxstartups-mistracking.patch Normal file
View File

@ -0,0 +1,73 @@
diff --color -ruNp a/srclimit.c b/srclimit.c
--- a/srclimit.c 2024-09-20 00:20:48.000000000 +0200
+++ b/srclimit.c 2026-03-06 13:30:48.408309619 +0100
@@ -427,7 +427,9 @@ srclimit_penalise(struct xaddr *addr, in
penalty->active = 1;
if (RB_INSERT(penalties_by_expiry, by_expiry, penalty) != NULL)
fatal_f("internal error: %s penalty tables corrupt", t);
- verbose_f("%s: new %s %s penalty of %d seconds for %s", t,
+ do_log2_f(penalty->active ?
+ SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE,
+ "%s: new %s %s penalty of %d seconds for %s", t,
addrnetmask, penalty->active ? "active" : "deferred",
penalty_secs, reason);
if (++(*npenaltiesp) > (size_t)max_sources)
@@ -446,7 +448,7 @@ srclimit_penalise(struct xaddr *addr, in
existing->expiry = now + penalty_cfg.penalty_max;
if (existing->expiry - now > penalty_cfg.penalty_min &&
!existing->active) {
- verbose_f("%s: activating %s penalty of %lld seconds for %s",
+ logit_f("%s: activating %s penalty of %lld seconds for %s",
addrnetmask, t, (long long)(existing->expiry - now),
reason);
existing->active = 1;
diff --color -ruNp a/sshd.c b/sshd.c
--- a/sshd.c 2026-03-06 13:10:52.653617548 +0100
+++ b/sshd.c 2026-03-06 13:24:50.865079998 +0100
@@ -291,8 +291,10 @@ child_finish(struct early_child *child)
{
if (children_active == 0)
fatal_f("internal error: children_active underflow");
- if (child->pipefd != -1)
+ if (child->pipefd != -1) {
+ srclimit_done(child->pipefd);
close(child->pipefd);
+ }
free(child->id);
memset(child, '\0', sizeof(*child));
child->pipefd = -1;
@@ -311,6 +313,7 @@ child_close(struct early_child *child, i
if (!quiet)
debug_f("enter%s", force_final ? " (forcing)" : "");
if (child->pipefd != -1) {
+ srclimit_done(child->pipefd);
close(child->pipefd);
child->pipefd = -1;
}
@@ -978,10 +981,11 @@ server_accept_loop(int *sock_in, int *so
}
/* FALLTHROUGH */
case 0:
- /* child exited preauth */
+ /* child closed pipe */
if (children[i].early)
listening--;
- srclimit_done(children[i].pipefd);
+ debug3_f("child %lu for %s closed pipe",
+ (long)children[i].pid, children[i].id);
child_close(&(children[i]), 0, 0);
break;
case 1:
@@ -1003,6 +1007,12 @@ server_accept_loop(int *sock_in, int *so
"child %ld for %s in state %d",
(int)c, (long)children[i].pid,
children[i].id, children[i].early);
+
+ if (children[i].early)
+ listening--;
+ if (children[i].pid > 0)
+ kill(children[i].pid, SIGTERM);
+ child_close(&(children[i]), 0, 0);
}
break;
}

20
SOURCES/openssh-9.9p1-mux-askpass-check.patch Normal file
View File

@ -0,0 +1,20 @@
diff --color -ruNp a/mux.c b/mux.c
--- a/mux.c 2024-09-20 00:20:48.000000000 +0200
+++ b/mux.c 2026-04-09 15:02:36.016198814 +0200
@@ -1137,6 +1137,16 @@ mux_master_process_proxy(struct ssh *ssh
debug_f("channel %d: proxy request", c->self);
+ if (options.control_master == SSHCTL_MASTER_ASK ||
+ options.control_master == SSHCTL_MASTER_AUTO_ASK) {
+ if (!ask_permission("Allow multiplex proxy connection?")) {
+ debug2_f("proxy refused by user");
+ reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
+ "Permission denied");
+ return 0;
+ }
+ }
+
c->mux_rcb = channel_proxy_downstream;
if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
(r = sshbuf_put_u32(reply, rid)) != 0)

402
SOURCES/openssh-9.9p1-proxyjump-username-validity-checks.patch Normal file
View File

@ -0,0 +1,402 @@
diff --color -ruNp a/readconf.c b/readconf.c
--- a/readconf.c 2026-04-10 15:42:50.693725820 +0200
+++ b/readconf.c 2026-04-10 15:49:57.441110287 +0200
@@ -1533,9 +1533,6 @@ parse_char_array:
case oProxyCommand:
charptr = &options->proxy_command;
- /* Ignore ProxyCommand if ProxyJump already specified */
- if (options->jump_host != NULL)
- charptr = &options->jump_host; /* Skip below */
parse_command:
if (str == NULL) {
error("%.200s line %d: Missing argument.",
@@ -1556,7 +1553,7 @@ parse_command:
}
len = strspn(str, WHITESPACE "=");
/* XXX use argv? */
- if (parse_jump(str + len, options, *activep) == -1) {
+ if (parse_jump(str + len, options, cmdline, *activep) == -1) {
error("%.200s line %d: Invalid ProxyJump \"%s\"",
filename, linenum, str + len);
goto out;
@@ -3370,65 +3367,116 @@ parse_forward(struct Forward *fwd, const
}
int
-parse_jump(const char *s, Options *o, int active)
+ssh_valid_hostname(const char *s)
{
- char *orig, *sdup, *cp;
- char *host = NULL, *user = NULL;
- int r, ret = -1, port = -1, first;
+ size_t i;
- active &= o->proxy_command == NULL && o->jump_host == NULL;
+ if (*s == '-')
+ return 0;
+ for (i = 0; s[i] != 0; i++) {
+ if (strchr("'`\"$\\;&<>|(){},", s[i]) != NULL ||
+ isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
+ return 0;
+ }
+ return 1;
+}
- orig = sdup = xstrdup(s);
+int
+ssh_valid_ruser(const char *s)
+{
+ size_t i;
+
+ if (*s == '-')
+ return 0;
+ for (i = 0; s[i] != 0; i++) {
+ if (iscntrl((u_char)s[i]))
+ return 0;
+ if (strchr("'`\";&<>|(){}", s[i]) != NULL)
+ return 0;
+ /* Disallow '-' after whitespace */
+ if (isspace((u_char)s[i]) && s[i + 1] == '-')
+ return 0;
+ /* Disallow \ in last position */
+ if (s[i] == '\\' && s[i + 1] == '\0')
+ return 0;
+ }
+ return 1;
+}
+
+int
+parse_jump(const char *s, Options *o, int strict, int active)
+{
+ char *orig = NULL, *sdup = NULL, *cp;
+ char *tmp_user = NULL, *tmp_host = NULL, *host = NULL, *user = NULL;
+ int r, ret = -1, tmp_port = -1, port = -1, first = 1;
+
+ if (strcasecmp(s, "none") == 0) {
+ if (active && o->jump_host == NULL) {
+ o->jump_host = xstrdup("none");
+ o->jump_port = 0;
+ }
+ return 0;
+ }
- /* Remove comment and trailing whitespace */
+ orig = xstrdup(s);
if ((cp = strchr(orig, '#')) != NULL)
*cp = '\0';
rtrim(orig);
- first = active;
+ active &= o->proxy_command == NULL && o->jump_host == NULL;
+ sdup = xstrdup(orig);
do {
- if (strcasecmp(s, "none") == 0)
- break;
+ /* Work backwards through string */
if ((cp = strrchr(sdup, ',')) == NULL)
cp = sdup; /* last */
else
*cp++ = '\0';
- if (first) {
- /* First argument and configuration is active */
- r = parse_ssh_uri(cp, &user, &host, &port);
- if (r == -1 || (r == 1 &&
- parse_user_host_port(cp, &user, &host, &port) != 0))
+ r = parse_ssh_uri(cp, &tmp_user, &tmp_host, &tmp_port);
+ if (r == -1 || (r == 1 && parse_user_host_port(cp,
+ &tmp_user, &tmp_host, &tmp_port) != 0))
+ goto out; /* error already logged */
+ if (strict) {
+ if (!ssh_valid_hostname(tmp_host)) {
+ error_f("invalid hostname \"%s\"", tmp_host);
goto out;
- } else {
- /* Subsequent argument or inactive configuration */
- r = parse_ssh_uri(cp, NULL, NULL, NULL);
- if (r == -1 || (r == 1 &&
- parse_user_host_port(cp, NULL, NULL, NULL) != 0))
+ }
+ if (tmp_user != NULL && !ssh_valid_ruser(tmp_user)) {
+ error_f("invalid username \"%s\"", tmp_user);
goto out;
+ }
+ }
+ if (first) {
+ user = tmp_user;
+ host = tmp_host;
+ port = tmp_port;
+ tmp_user = tmp_host = NULL; /* transferred */
}
first = 0; /* only check syntax for subsequent hosts */
+ free(tmp_user);
+ free(tmp_host);
+ tmp_user = tmp_host = NULL;
+ tmp_port = -1;
} while (cp != sdup);
+
/* success */
if (active) {
- if (strcasecmp(s, "none") == 0) {
- o->jump_host = xstrdup("none");
- o->jump_port = 0;
- } else {
- o->jump_user = user;
- o->jump_host = host;
- o->jump_port = port;
- o->proxy_command = xstrdup("none");
- user = host = NULL;
- if ((cp = strrchr(s, ',')) != NULL && cp != s) {
- o->jump_extra = xstrdup(s);
- o->jump_extra[cp - s] = '\0';
- }
+ o->jump_user = user;
+ o->jump_host = host;
+ o->jump_port = port;
+ o->proxy_command = xstrdup("none");
+ user = host = NULL; /* transferred */
+ if (orig != NULL && (cp = strrchr(orig, ',')) != NULL) {
+ o->jump_extra = xstrdup(orig);
+ o->jump_extra[cp - orig] = '\0';
}
}
ret = 0;
out:
free(orig);
+ free(sdup);
+ free(tmp_user);
+ free(tmp_host);
free(user);
free(host);
return ret;
diff --color -ruNp a/readconf.h b/readconf.h
--- a/readconf.h 2026-04-10 15:42:50.470697714 +0200
+++ b/readconf.h 2026-04-10 15:49:57.442110306 +0200
@@ -249,7 +249,9 @@ int process_config_line(Options *, stru
int read_config_file(const char *, struct passwd *, const char *,
const char *, Options *, int, int *);
int parse_forward(struct Forward *, const char *, int, int);
-int parse_jump(const char *, Options *, int);
+int ssh_valid_hostname(const char *);
+int ssh_valid_ruser(const char *);
+int parse_jump(const char *, Options *, int, int);
int parse_ssh_uri(const char *, char **, char **, int *);
int default_ssh_port(void);
int option_clear_or_none(const char *);
diff --color -ruNp a/regress/Makefile b/regress/Makefile
--- a/regress/Makefile 2026-04-10 15:42:50.533815702 +0200
+++ b/regress/Makefile 2026-04-10 16:07:30.566094450 +0200
@@ -111,7 +111,8 @@ LTESTS= connect \
agent-pkcs11-restrict \
agent-pkcs11-cert \
penalty \
- penalty-expire
+ penalty-expire \
+ proxyjump
INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers
INTEROP_TESTS+= dropbear-ciphers dropbear-kex
diff --color -ruNp a/regress/proxyjump.sh b/regress/proxyjump.sh
--- a/regress/proxyjump.sh 1970-01-01 01:00:00.000000000 +0100
+++ b/regress/proxyjump.sh 2026-04-10 16:07:55.225958206 +0200
@@ -0,0 +1,102 @@
+# $OpenBSD: proxyjump.sh,v 1.1 2026/03/30 07:19:02 djm Exp $
+# Placed in the Public Domain.
+
+tid="proxyjump"
+
+# Parsing tests
+verbose "basic parsing"
+for jspec in \
+ "jump1" \
+ "user@jump1" \
+ "jump1:2222" \
+ "user@jump1:2222" \
+ "jump1,jump2" \
+ "user1@jump1:2221,user2@jump2:2222" \
+ "ssh://user@host:2223" \
+ ; do
+ case "$jspec" in
+ "jump1") expected="jump1" ;;
+ "user@jump1") expected="user@jump1" ;;
+ "jump1:2222") expected="jump1:2222" ;;
+ "user@jump1:2222") expected="user@jump1:2222" ;;
+ "jump1,jump2") expected="jump1,jump2" ;;
+ "user1@jump1:2221,user2@jump2:2222")
+ expected="user1@jump1:2221,user2@jump2:2222" ;;
+ "ssh://user@host:2223") expected="user@host:2223" ;;
+ esac
+ f=`${SSH} -GF /dev/null -oProxyJump="$jspec" somehost | \
+ awk '/^proxyjump /{print $2}'`
+ if [ "$f" != "$expected" ]; then
+ fail "ProxyJump $jspec: expected $expected, got $f"
+ fi
+ f=`${SSH} -GF /dev/null -J "$jspec" somehost | \
+ awk '/^proxyjump /{print $2}'`
+ if [ "$f" != "$expected" ]; then
+ fail "ssh -J $jspec: expected $expected, got $f"
+ fi
+done
+
+verbose "precedence"
+f=`${SSH} -GF /dev/null -oProxyJump=none -oProxyJump=jump1 somehost | \
+ grep "^proxyjump "`
+if [ -n "$f" ]; then
+ fail "ProxyJump=none first did not win"
+fi
+f=`${SSH} -GF /dev/null -oProxyJump=jump -oProxyCommand=foo somehost | \
+ grep "^proxyjump "`
+if [ "$f" != "proxyjump jump" ]; then
+ fail "ProxyJump first did not win over ProxyCommand"
+fi
+f=`${SSH} -GF /dev/null -oProxyCommand=foo -oProxyJump=jump somehost | \
+ grep "^proxycommand "`
+if [ "$f" != "proxycommand foo" ]; then
+ fail "ProxyCommand first did not win over ProxyJump"
+fi
+
+verbose "command-line -J invalid characters"
+cp $OBJ/ssh_config $OBJ/ssh_config.orig
+for jspec in \
+ "host;with;semicolon" \
+ "host'with'quote" \
+ "host\`with\`backtick" \
+ "host\$with\$dollar" \
+ "host(with)brace" \
+ "user;with;semicolon@host" \
+ "user'with'quote@host" \
+ "user\`with\`backtick@host" \
+ "user(with)brace@host" ; do
+ ${SSH} -GF /dev/null -J "$jspec" somehost >/dev/null 2>&1
+ if [ $? -ne 255 ]; then
+ fail "ssh -J \"$jspec\" was not rejected"
+ fi
+ ${SSH} -GF /dev/null -oProxyJump="$jspec" somehost >/dev/null 2>&1
+ if [ $? -ne 255 ]; then
+ fail "ssh -oProxyJump=\"$jspec\" was not rejected"
+ fi
+done
+# Special characters should be accepted in the config though.
+echo "ProxyJump user;with;semicolon@host;with;semicolon" >> $OBJ/ssh_config
+f=`${SSH} -GF $OBJ/ssh_config somehost | grep "^proxyjump "`
+if [ "$f" != "proxyjump user;with;semicolon@host;with;semicolon" ]; then
+ fail "ProxyJump did not allow special characters in config: $f"
+fi
+
+verbose "functional test"
+# Use different names to avoid the loop detection in ssh.c
+grep -iv HostKeyAlias $OBJ/ssh_config.orig > $OBJ/ssh_config
+cat << _EOF >> $OBJ/ssh_config
+Host jump-host
+ HostkeyAlias jump-host
+Host target-host
+ HostkeyAlias target-host
+_EOF
+cp $OBJ/known_hosts $OBJ/known_hosts.orig
+sed 's/^[^ ]* /jump-host /' < $OBJ/known_hosts.orig > $OBJ/known_hosts
+sed 's/^[^ ]* /target-host /' < $OBJ/known_hosts.orig >> $OBJ/known_hosts
+start_sshd
+
+verbose "functional ProxyJump"
+res=`${REAL_SSH} -F $OBJ/ssh_config -J jump-host target-host echo "SUCCESS" 2>/dev/null`
+if [ "$res" != "SUCCESS" ]; then
+ fail "functional test failed: expected SUCCESS, got $res"
+fi
diff --color -ruNp a/ssh.c b/ssh.c
--- a/ssh.c 2026-04-10 15:42:50.657913189 +0200
+++ b/ssh.c 2026-04-10 16:04:07.489047966 +0200
@@ -639,43 +639,6 @@ ssh_conn_info_free(struct ssh_conn_info
free(cinfo);
}
-static int
-valid_hostname(const char *s)
-{
- size_t i;
-
- if (*s == '-')
- return 0;
- for (i = 0; s[i] != 0; i++) {
- if (strchr("'`\"$\\;&<>|(){}", s[i]) != NULL ||
- isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
- return 0;
- }
- return 1;
-}
-
-static int
-valid_ruser(const char *s)
-{
- size_t i;
-
- if (*s == '-')
- return 0;
- for (i = 0; s[i] != 0; i++) {
- if (iscntrl((u_char)s[i]))
- return 0;
- if (strchr("'`\";&<>|(){}", s[i]) != NULL)
- return 0;
- /* Disallow '-' after whitespace */
- if (isspace((u_char)s[i]) && s[i + 1] == '-')
- return 0;
- /* Disallow \ in last position */
- if (s[i] == '\\' && s[i + 1] == '\0')
- return 0;
- }
- return 1;
-}
-
/*
* Main program for the ssh client.
*/
@@ -931,9 +894,9 @@ main(int ac, char **av)
}
if (options.proxy_command != NULL)
fatal("Cannot specify -J with ProxyCommand");
- if (parse_jump(optarg, &options, 1) == -1)
+ if (parse_jump(optarg, &options, 1, 1) == -1)
+
fatal("Invalid -J argument");
- options.proxy_command = xstrdup("none");
break;
case 't':
if (options.request_tty == REQUEST_TTY_YES)
@@ -1183,10 +1146,15 @@ main(int ac, char **av)
if (!host)
usage();
- if (!valid_hostname(host))
- fatal("hostname contains invalid characters");
- if (options.user != NULL && !valid_ruser(options.user))
+ /*
+ * Validate commandline-specified values that end up in %tokens
+ * before they are used in config parsing.
+ */
+ if (options.user != NULL && !ssh_valid_ruser(options.user))
fatal("remote username contains invalid characters");
+ if (!ssh_valid_hostname(host))
+ fatal("hostname contains invalid characters");
+
options.host_arg = xstrdup(host);
/* Initialize the command to execute on remote host. */
@@ -1347,7 +1315,8 @@ main(int ac, char **av)
sshbin = "ssh";
/* Consistency check */
- if (options.proxy_command != NULL)
+ if (options.proxy_command != NULL &&
+ strcasecmp(options.proxy_command, "none") != 0)
fatal("inconsistent options: ProxyCommand+ProxyJump");
/* Never use FD passing for ProxyJump */
options.proxy_use_fdpass = 0;
@@ -1467,7 +1436,7 @@ main(int ac, char **av)
cinfo->jmphost = xstrdup(options.jump_host == NULL ?
"" : options.jump_host);
- if (user_on_commandline && !valid_ruser(options.user))
+ if (user_on_commandline && !ssh_valid_ruser(options.user))
fatal("remote username contains invalid characters");
cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost,

15
SOURCES/openssh-9.9p1-scp-clear-setuid.patch Normal file
View File

@ -0,0 +1,15 @@
diff --color -ruNp a/scp.c b/scp.c
--- a/scp.c 2026-04-07 15:54:11.193730842 +0200
+++ b/scp.c 2026-04-07 15:55:52.529425481 +0200
@@ -1705,8 +1705,10 @@ sink(int argc, char **argv, const char *
setimes = targisdir = 0;
mask = umask(0);
- if (!pflag)
+ if (!pflag) {
+ mask |= 07000;
(void) umask(mask);
+ }
if (argc != 1) {
run_err("ambiguous target");
exit(1);

14
SOURCES/openssh-9.9p1-scp-remote-glob.patch Normal file
View File

@ -0,0 +1,14 @@
diff --color -ruNp a/scp.c b/scp.c
--- a/scp.c 2026-07-14 11:40:47.754600847 +0200
+++ b/scp.c 2026-07-14 11:43:04.077524517 +0200
@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
goto out;
}
+ /* Special handling for source of '..' */
+ if (strcmp(filename, "..") == 0)
+ filename = "."; /* Download to dest, not dest/.. */
+
if (targetisdir)
abs_dst = sftp_path_append(target, filename);
else

537
SOURCES/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
View File

@ -1,38 +1,7 @@
From 5d5a66e96ad03132f65371070f4fa475f10207d9 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Mon, 10 Jun 2024 23:00:03 +0300
Subject: [PATCH] support authentication indicators in GSSAPI
RFC 6680 defines a set of GSSAPI extensions to handle attributes
associated with the GSSAPI names. MIT Kerberos and FreeIPA use
name attributes to add information about pre-authentication methods used
to acquire the initial Kerberos ticket. The attribute 'auth-indicators'
may contain list of strings that KDC has associated with the ticket
issuance process.
Use authentication indicators to authorise or deny access to SSH server.
GSSAPIIndicators setting allows to specify a list of possible indicators
that a Kerberos ticket presented must or must not contain. More details
on the syntax are provided in sshd_config(5) man page.
Fixes: https://bugzilla.mindrot.org/show_bug.cgi?id=2696
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
configure.ac | 1 +
gss-serv-krb5.c | 64 +++++++++++++++++++++++++++---
gss-serv.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++-
servconf.c | 15 ++++++-
servconf.h | 2 +
ssh-gss.h | 7 ++++
sshd_config.5 | 44 +++++++++++++++++++++
7 files changed, 228 insertions(+), 8 deletions(-)
diff --git a/configure.ac b/configure.ac
index d92a85809..2cbe20bf3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5004,6 +5004,7 @@ AC_ARG_WITH([kerberos5],
diff --color -ruNp a/configure.ac b/configure.ac
--- a/configure.ac 2026-03-10 12:43:36.860784813 +0100
+++ b/configure.ac 2026-03-10 12:46:27.022297835 +0100
@@ -4932,6 +4932,7 @@ AC_ARG_WITH([kerberos5],
AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
@ -40,10 +9,159 @@ index d92a85809..2cbe20bf3 100644
AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
[Define this if you want to use libkafs' AFS support])])
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 03188d9b3..2c786ef14 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
diff --color -ruNp a/gss-serv.c b/gss-serv.c
--- a/gss-serv.c 2026-06-16 15:38:26.590728235 +0200
+++ b/gss-serv.c 2026-06-16 15:41:13.717696103 +0200
@@ -53,7 +53,7 @@ extern ServerOptions options;
static ssh_gssapi_client gssapi_client =
{ GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
- GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
+ GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0, NULL};
ssh_gssapi_mech gssapi_null_mech =
{ NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
return GSS_S_COMPLETE;
}
+
+/* Extract authentication indicators from the Kerberos ticket. Authentication
+ * indicators are GSSAPI name attributes for the name "auth-indicators".
+ * Multiple indicators might be present in the ticket.
+ * Each indicator is an utf8 string. */
+
+#define AUTH_INDICATORS_TAG "auth-indicators"
+#define SSH_GSSAPI_MAX_INDICATORS 64
+
+/* Privileged (called from accept_secure_ctx) */
+static OM_uint32
+ssh_gssapi_getindicators(Gssctxt *ctx, gss_name_t gss_name, ssh_gssapi_client *client)
+{
+ gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET;
+ gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
+ int is_mechname, authenticated, complete, more;
+ size_t count, i;
+
+ /* always initialize client->indicators */
+ client->indicators = NULL;
+
+ ctx->major = gss_inquire_name(&ctx->minor, gss_name,
+ &is_mechname, NULL, &attrs);
+ if (ctx->major != GSS_S_COMPLETE)
+ return ctx->major;
+
+ if (attrs == GSS_C_NO_BUFFER_SET) {
+ /* no indicators in the ticket */
+ return GSS_S_COMPLETE;
+ }
+
+ /* client->indicators is NULL terminated */
+ count = 0;
+ client->indicators = xcalloc(count + 1, sizeof(char *));
+
+ for (i = 0; i < attrs->count; i++) {
+ authenticated = 0;
+ complete = 0;
+ more = -1;
+
+ /* skip anything but auth-indicators */
+ if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
+ memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value,
+ sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
+ continue;
+
+ /* retrieve all indicators */
+ while (more != 0) {
+ value.value = NULL;
+ display_value.value = NULL;
+
+ ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
+ &attrs->elements[i],
+ &authenticated, &complete,
+ &value, &display_value, &more);
+ if (ctx->major != GSS_S_COMPLETE)
+ goto out;
+
+ if (value.value == NULL || !authenticated)
+ continue;
+
+ if (count >= SSH_GSSAPI_MAX_INDICATORS) {
+ logit("ssh_gssapi_getindicators:"
+ " too many indicators, truncating at %d",
+ SSH_GSSAPI_MAX_INDICATORS);
+ goto out;
+ }
+
+ client->indicators[count] = xmalloc(value.length + 1);
+ memcpy(client->indicators[count], value.value, value.length);
+ client->indicators[count][value.length] = '\0';
+ count++;
+
+ /* add NULL terminator */
+ client->indicators = xrecallocarray(client->indicators, count,
+ count + 1, sizeof(char *));
+ }
+ }
+
+out:
+ if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) {
+ for (i = 0; i < count; i++)
+ free(client->indicators[i]);
+ free(client->indicators);
+ client->indicators = NULL;
+ }
+ gss_release_buffer(&ctx->minor, &value);
+ gss_release_buffer(&ctx->minor, &display_value);
+ gss_release_buffer_set(&ctx->minor, &attrs);
+ return ctx->major;
+}
+
/* Extract the client details from a given context. This can only reliably
* be called once for a context */
@@ -384,6 +477,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
}
gss_release_buffer(&ctx->minor, &ename);
+ /* Retrieve authentication indicators, if they exist */
+ if ((ctx->major = ssh_gssapi_getindicators(ctx,
+ ctx->client, client))) {
+ ssh_gssapi_error(ctx);
+ return (ctx->major);
+ }
/* We can't copy this structure, so we just move the pointer to it */
client->creds = ctx->client_creds;
@@ -446,6 +545,7 @@ int
ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
{
OM_uint32 lmin;
+ size_t i;
(void) kex; /* used in privilege separation */
@@ -464,8 +564,14 @@ ssh_gssapi_userok(char *user, struct pas
gss_release_buffer(&lmin, &gssapi_client.displayname);
gss_release_buffer(&lmin, &gssapi_client.exportedname);
gss_release_cred(&lmin, &gssapi_client.creds);
- explicit_bzero(&gssapi_client,
- sizeof(ssh_gssapi_client));
+
+ if (gssapi_client.indicators != NULL) {
+ for (i = 0; gssapi_client.indicators[i] != NULL; i++)
+ free(gssapi_client.indicators[i]);
+ free(gssapi_client.indicators);
+ }
+
+ explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client));
return 0;
}
else
diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
--- a/gss-serv-krb5.c 2026-03-10 12:43:36.823015336 +0100
+++ b/gss-serv-krb5.c 2026-03-11 12:58:56.024455238 +0100
@@ -43,6 +43,7 @@
#include "log.h"
#include "misc.h"
@ -52,7 +170,7 @@ index 03188d9b3..2c786ef14 100644
#include "ssh-gss.h"
@@ -87,6 +88,32 @@ ssh_gssapi_krb5_init(void)
@@ -87,6 +88,33 @@ ssh_gssapi_krb5_init(void)
return 1;
}
@ -67,6 +185,7 @@ index 03188d9b3..2c786ef14 100644
+{
+ int ret;
+ u_int i;
+ *matched = -1;
+
+ /* Check indicators */
+ for (i = 0; client->indicators[i] != NULL; i++) {
@ -85,218 +204,112 @@ index 03188d9b3..2c786ef14 100644
/* Check if this user is OK to login. This only works with krb5 - other
* GSSAPI mechanisms will need their own.
* Returns true if the user is OK to log in, otherwise returns 0
@@ -193,7 +220,7 @@ static int
@@ -193,15 +221,15 @@ static int
ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
{
krb5_principal princ;
- int retval;
+ int retval, matched;
+ int retval, matched, success;
const char *errmsg;
int k5login_exists;
@@ -216,17 +243,42 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
if (ssh_gssapi_krb5_init() == 0)
return 0;
- if ((retval = krb5_parse_name(krb_context, client->exportedname.value,
- &princ))) {
+ retval = krb5_parse_name(krb_context, client->exportedname.value, &princ);
+ if (retval) {
errmsg = krb5_get_error_message(krb_context, retval);
logit("krb5_parse_name(): %.100s", errmsg);
krb5_free_error_message(krb_context, errmsg);
@@ -216,17 +244,60 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
if (k5login_exists &&
ssh_krb5_kuserok(krb_context, princ, name, k5login_exists)) {
retval = 1;
- logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
- name, (char *)client->displayname.value);
+ errmsg = "krb5_kuserok";
+ errmsg = "krb5_kuserok";
} else if (ssh_gssapi_krb5_cmdok(princ, client->exportedname.value,
name, k5login_exists)) {
retval = 1;
- logit("Authorized to %s, krb5 principal %s "
- "(ssh_gssapi_krb5_cmdok)",
- name, (char *)client->displayname.value);
- } else
+ errmsg = "ssh_gssapi_krb5_cmdok";
} else
retval = 0;
+ if ((retval == 1) && (options.gss_indicators != NULL)) {
+ /* At this point the configuration enforces presence of indicators
+ * so we drop the authorization result again */
+ } else {
+ retval = 0;
+ if (client->indicators) {
+ matched = -1;
+ retval = ssh_gssapi_check_indicators(client, &matched);
+ if (retval != 0) {
+ retval = (retval == 1);
+ logit("Ticket contains indicator %s, "
+ "krb5 principal %s is %s",
+ client->indicators[matched],
+ (char *)client->displayname.value,
+ retval ? "allowed" : "denied");
+ goto cont;
+ }
+ }
+ if (retval == 0) {
+ logit("GSSAPI authentication indicators enforced "
+ "but not matched. krb5 principal %s denied",
+ (char *)client->displayname.value);
+ }
+ goto out;
+ }
+cont:
+
+ /* At this point we are good if no indicators were defined */
+ if (options.gss_indicators == NULL) {
+ retval = 1;
+ goto out;
+ }
+
+ /* At this point we have indicators defined in the configuration,
+ * if clientt did not provide any indicators, we reject */
+ if (!client->indicators) {
+ retval = 0;
+ logit("GSSAPI authentication indicators enforced "
+ "but indicators not provided by the client. "
+ "krb5 principal %s denied",
+ (char *)client->displayname.value);
+ goto out;
+ }
+
+ /* At this point the configuration enforces presence of indicators
+ * check the match */
+ matched = -1;
+ success = ssh_gssapi_check_indicators(client, &matched);
+
+ switch (success) {
+ case 1:
+ logit("Provided indicator %s allowed by the configuration",
+ client->indicators[matched]);
+ retval = 1;
+ break;
+ case -1:
+ logit("Provided indicator %s rejected by the configuration",
+ client->indicators[matched]);
+ retval = 0;
+ break;
+ default:
+ logit("Provided indicators do not match the configuration");
retval = 0;
+ break;
+ }
+out:
+ if (retval == 1) {
+ logit("Authorized to %s, krb5 principal %s (%s)",
+ name, (char *)client->displayname.value, errmsg);
+ name, (char *)client->displayname.value, errmsg);
+ }
krb5_free_principal(krb_context, princ);
return retval;
}
diff --git a/gss-serv.c b/gss-serv.c
index 9d5435eda..5c0491cf1 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -54,7 +54,7 @@ extern ServerOptions options;
static ssh_gssapi_client gssapi_client =
{ GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
- GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
+ GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0, NULL};
ssh_gssapi_mech gssapi_null_mech =
{ NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
@@ -296,6 +296,92 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
return GSS_S_COMPLETE;
}
+
+/* Extract authentication indicators from the Kerberos ticket. Authentication
+ * indicators are GSSAPI name attributes for the name "auth-indicators".
+ * Multiple indicators might be present in the ticket.
+ * Each indicator is a utf8 string. */
+
+#define AUTH_INDICATORS_TAG "auth-indicators"
+
+/* Privileged (called from accept_secure_ctx) */
+static OM_uint32
+ssh_gssapi_getindicators(Gssctxt *ctx, gss_name_t gss_name, ssh_gssapi_client *client)
+{
+ gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET;
+ gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
+ int is_mechname, authenticated, complete, more;
+ size_t count, i;
+
+ ctx->major = gss_inquire_name(&ctx->minor, gss_name,
+ &is_mechname, NULL, &attrs);
+ if (ctx->major != GSS_S_COMPLETE) {
+ return (ctx->major);
+ }
+
+ if (attrs == GSS_C_NO_BUFFER_SET) {
+ /* No indicators in the ticket */
+ return (0);
+ }
+
+ count = 0;
+ for (i = 0; i < attrs->count; i++) {
+ /* skip anything but auth-indicators */
+ if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
+ strncmp(AUTH_INDICATORS_TAG,
+ attrs->elements[i].value,
+ sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
+ continue;
+ count++;
+ }
+
+ if (count == 0) {
+ /* No auth-indicators in the ticket */
+ (void) gss_release_buffer_set(&ctx->minor, &attrs);
+ return (0);
+ }
+
+ client->indicators = recallocarray(NULL, 0, count + 1, sizeof(char*));
+ count = 0;
+ for (i = 0; i < attrs->count; i++) {
+ authenticated = 0;
+ complete = 0;
+ more = -1;
+ /* skip anything but auth-indicators */
+ if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
+ strncmp(AUTH_INDICATORS_TAG,
+ attrs->elements[i].value,
+ sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
+ continue;
+ /* retrieve all indicators */
+ while (more != 0) {
+ value.value = NULL;
+ display_value.value = NULL;
+ ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
+ &attrs->elements[i], &authenticated,
+ &complete, &value, &display_value, &more);
+ if (ctx->major != GSS_S_COMPLETE) {
+ goto out;
+ }
+
+ if ((value.value != NULL) && authenticated) {
+ client->indicators[count] = xmalloc(value.length + 1);
+ memcpy(client->indicators[count], value.value, value.length);
+ client->indicators[count][value.length] = '\0';
+ count++;
+ }
+ }
+ }
+
+out:
+ (void) gss_release_buffer(&ctx->minor, &value);
+ (void) gss_release_buffer(&ctx->minor, &display_value);
+ (void) gss_release_buffer_set(&ctx->minor, &attrs);
+ return (ctx->major);
+}
+
+
/* Extract the client details from a given context. This can only reliably
* be called once for a context */
@@ -385,6 +471,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
}
gss_release_buffer(&ctx->minor, &ename);
+ /* Retrieve authentication indicators, if they exist */
+ if ((ctx->major = ssh_gssapi_getindicators(ctx,
+ ctx->client, client))) {
+ ssh_gssapi_error(ctx);
+ return (ctx->major);
+ }
/* We can't copy this structure, so we just move the pointer to it */
client->creds = ctx->client_creds;
@@ -447,6 +539,7 @@ int
ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
{
OM_uint32 lmin;
+ size_t i;
(void) kex; /* used in privilege separation */
@@ -465,6 +558,14 @@ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
gss_release_buffer(&lmin, &gssapi_client.displayname);
gss_release_buffer(&lmin, &gssapi_client.exportedname);
gss_release_cred(&lmin, &gssapi_client.creds);
+
+ if (gssapi_client.indicators != NULL) {
+ for(i = 0; gssapi_client.indicators[i] != NULL; i++) {
+ free(gssapi_client.indicators[i]);
+ }
+ free(gssapi_client.indicators);
+ }
+
explicit_bzero(&gssapi_client,
sizeof(ssh_gssapi_client));
return 0;
diff --git a/servconf.c b/servconf.c
index e7e4ad046..aab653244 100644
--- a/servconf.c
+++ b/servconf.c
@@ -147,6 +147,7 @@ initialize_server_options(ServerOptions *options)
diff --color -ruNp a/servconf.c b/servconf.c
--- a/servconf.c 2026-03-10 12:43:36.928060353 +0100
+++ b/servconf.c 2026-03-11 13:20:09.725354925 +0100
@@ -144,6 +144,7 @@ initialize_server_options(ServerOptions
options->gss_keyex = -1;
options->gss_cleanup_creds = -1;
options->gss_strict_acceptor = -1;
+ options->gss_indicators = NULL;
options->gss_store_rekey = -1;
options->gss_kex_algorithms = NULL;
+ options->gss_indicators = NULL;
options->use_kuserok = -1;
options->enable_k5users = -1;
options->password_authentication = -1;
@@ -598,7 +599,7 @@ typedef enum {
@@ -557,6 +558,7 @@ fill_default_server_options(ServerOption
CLEAR_ON_NONE(options->routing_domain);
CLEAR_ON_NONE(options->host_key_agent);
CLEAR_ON_NONE(options->per_source_penalty_exempt);
+ CLEAR_ON_NONE(options->gss_indicators);
for (i = 0; i < options->num_host_key_files; i++)
CLEAR_ON_NONE(options->host_key_files[i]);
@@ -594,7 +596,7 @@ typedef enum {
sPerSourcePenalties, sPerSourcePenaltyExemptList,
sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
@ -305,7 +318,7 @@ index e7e4ad046..aab653244 100644
sAcceptEnv, sSetEnv, sPermitTunnel,
sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
sUsePrivilegeSeparation, sAllowAgentForwarding,
@@ -694,6 +695,7 @@ static struct {
@@ -690,6 +692,7 @@ static struct {
{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
@ -313,7 +326,7 @@ index e7e4ad046..aab653244 100644
#else
{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
@@ -703,6 +705,7 @@ static struct {
@@ -699,6 +702,7 @@ static struct {
{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
@ -321,7 +334,7 @@ index e7e4ad046..aab653244 100644
#endif
{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
@@ -1730,6 +1733,15 @@ process_server_config_line_depth(ServerOptions *options, char *line,
@@ -1715,6 +1719,15 @@ process_server_config_line_depth(ServerO
options->gss_kex_algorithms = xstrdup(arg);
break;
@ -337,7 +350,7 @@ index e7e4ad046..aab653244 100644
case sPasswordAuthentication:
intptr = &options->password_authentication;
goto parse_flag;
@@ -3351,6 +3363,7 @@ dump_config(ServerOptions *o)
@@ -3329,6 +3342,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
@ -345,10 +358,9 @@ index e7e4ad046..aab653244 100644
#endif
dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
dump_cfg_fmtint(sKbdInteractiveAuthentication,
diff --git a/servconf.h b/servconf.h
index 7c7e5d434..7c41df417 100644
--- a/servconf.h
+++ b/servconf.h
diff --color -ruNp a/servconf.h b/servconf.h
--- a/servconf.h 2026-03-10 12:43:36.833119920 +0100
+++ b/servconf.h 2026-03-11 13:21:36.742117033 +0100
@@ -181,6 +181,7 @@ typedef struct {
char **allow_groups;
u_int num_deny_groups;
@ -357,7 +369,7 @@ index 7c7e5d434..7c41df417 100644
u_int num_subsystems;
char **subsystem_name;
@@ -310,6 +311,7 @@ TAILQ_HEAD(include_list, include_item);
@@ -309,6 +310,7 @@ TAILQ_HEAD(include_list, include_item);
M_CP_STROPT(routing_domain); \
M_CP_STROPT(permit_user_env_allowlist); \
M_CP_STROPT(pam_service_name); \
@ -365,36 +377,10 @@ index 7c7e5d434..7c41df417 100644
M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
M_CP_STRARRAYOPT(allow_users, num_allow_users); \
M_CP_STRARRAYOPT(deny_users, num_deny_users); \
diff --git a/ssh-gss.h b/ssh-gss.h
index a894e23c9..59cf46d47 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -34,6 +34,12 @@
#include <gssapi/gssapi.h>
#endif
+#ifdef HAVE_GSSAPI_EXT_H
+#include <gssapi_ext.h>
+#elif defined(HAVE_GSSAPI_GSSAPI_EXT_H)
+#include <gssapi/gssapi_ext.h>
+#endif
+
#ifdef KRB5
# ifndef HEIMDAL
# ifdef HAVE_GSSAPI_GENERIC_H
@@ -107,6 +113,7 @@ typedef struct {
ssh_gssapi_ccache store;
int used;
int updated;
+ char **indicators; /* auth indicators */
} ssh_gssapi_client;
typedef struct ssh_gssapi_mech_struct {
diff --git a/sshd_config.5 b/sshd_config.5
index 583a01cdb..90ab87edd 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -785,6 +785,50 @@ gss-nistp256-sha256-
diff --color -ruNp a/sshd_config.5 b/sshd_config.5
--- a/sshd_config.5 2026-03-10 12:43:36.859313302 +0100
+++ b/sshd_config.5 2026-03-11 13:28:04.541970063 +0100
@@ -785,6 +785,52 @@ gss-nistp256-sha256-
gss-curve25519-sha256-
.Ed
This option only applies to connections using GSSAPI.
@ -441,10 +427,33 @@ index 583a01cdb..90ab87edd 100644
+FIDO2-based pre-authentication in FreeIPA, using FIDO2 USB and NFC tokens
+.El
+.Pp
+The default is to not use GSSAPI authentication indicators for access decisions.
+The default
+.Dq none
+is to not use GSSAPI authentication indicators for access decisions.
.It Cm HostbasedAcceptedAlgorithms
The default is handled system-wide by
.Xr crypto-policies 7 .
--
2.49.0
diff --color -ruNp a/ssh-gss.h b/ssh-gss.h
--- a/ssh-gss.h 2026-03-10 12:43:36.898148309 +0100
+++ b/ssh-gss.h 2026-03-11 13:23:07.601956965 +0100
@@ -34,6 +34,12 @@
#include <gssapi/gssapi.h>
#endif
+#ifdef HAVE_GSSAPI_EXT_H
+#include <gssapi_ext.h>
+#elif defined(HAVE_GSSAPI_GSSAPI_EXT_H)
+#include <gssapi/gssapi_ext.h>
+#endif
+
#ifdef KRB5
# ifndef HEIMDAL
# ifdef HAVE_GSSAPI_GENERIC_H
@@ -112,6 +118,7 @@ typedef struct {
ssh_gssapi_ccache store;
int used;
int updated;
+ char **indicators; /* auth indicators */
} ssh_gssapi_client;
typedef struct ssh_gssapi_mech_struct {

11
SOURCES/pam_ssh_agent_auth-0.10.4-doc.patch Normal file
View File

@ -0,0 +1,11 @@
diff --color -ruNp a/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod b/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod
--- a/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod 2019-07-08 18:36:13.000000000 +0200
+++ b/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod 2026-03-17 12:24:44.462364449 +0100
@@ -18,7 +18,6 @@ This module provides authentication via
=item /etc/sudoers:
-In older versions of sudo (< 1.8.5) it was necessary to set:
Defaults env_keep += "SSH_AUTH_SOCK"
=back

97
SPECS/openssh.spec
View File

@ -47,9 +47,9 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 9.9p1
%global openssh_rel 4
%global openssh_rel 11
%global pam_ssh_agent_ver 0.10.4
%global pam_ssh_agent_rel 7
%global pam_ssh_agent_rel 9
Summary: An open source implementation of SSH protocol version 2
Name: openssh
@ -104,6 +104,8 @@ Patch306: pam_ssh_agent_auth-0.10.2-compat.patch
Patch307: pam_ssh_agent_auth-0.10.2-dereference.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2070113
Patch308: pam_ssh_agent_auth-0.10.4-rsasha2.patch
# fix manual page claiming SSH_AUTH_SOCK not being required by newer sudo
Patch309: pam_ssh_agent_auth-0.10.4-doc.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
Patch400: openssh-7.8p1-role-mls.patch
@ -245,6 +247,29 @@ Patch1037: openssh-9.9p1-reject-cntrl-chars-in-username.patch
# upstream 43b3bff47bb029f2299bacb6a36057981b39fdb0
Patch1038: openssh-9.9p1-reject-null-char-in-url-string.patch
Patch1039: openssh-9.9p1-compat-mlkem.patch
# https://github.com/openssh/openssh-portable/pull/649
Patch1040: openssh-9.9p1-fill-default-options-error.patch
# upstream 487e8ac146f7d6616f65c125d5edb210519b833a
Patch1041: openssh-9.9p1-scp-clear-setuid.patch
# upstream c805b97b67c774e0bf922ffb29dfbcda9d7b5add
Patch1042: openssh-9.9p1-mux-askpass-check.patch
# upstream fd1c7e131f331942d20f42f31e79912d570081fa
Patch1043: openssh-9.9p1-ecdsa-incomplete-application.patch
# upstream fd1c7e131f331942d20f42f31e79912d570081fa
Patch1044: openssh-9.9p1-authorized-keys-principles-option.patch
# upstream 76685c9b09a66435cd2ad8373246adf1c53976d3
# upstream 0a0ef4515361143cad21afa072319823854c1cf6
# upstream 607bd871ec029e9aa22e632a22547250f3cae223
# upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
Patch1045: openssh-9.9p1-proxyjump-username-validity-checks.patch
# upstream 36480181fa22f98e180b4f9e10203480c0346c78
Patch1046: openssh-9.9p1-scp-remote-glob.patch
# upstream e8bdfb151a356d0171fea4194dd205fbb252be23
Patch1047: openssh-9.9p1-cve-2026-60002.patch
# upstream eddd1d2daa64a6ab1a915ca88436fa41aede44d4
# upstream bc328144f149af07139a0f2c1329018cd85b86b7
Patch1048: openssh-9.9p1-maxstartups-mistracking.patch
License: BSD
Requires: /sbin/nologin
@ -380,6 +405,7 @@ pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
%patch305 -p2 -b .psaa-agent
%patch307 -p2 -b .psaa-deref
%patch308 -p2 -b .rsasha2
%patch309 -p2 -b .psaa-doc
# Remove duplicate headers and library files
rm -f $(cat %{SOURCE5})
popd
@ -437,9 +463,6 @@ popd
%patch1002 -p1 -b .ssh-manpage
%patch1006 -p1 -b .negotiate-supported-algs
%patch100 -p1 -b .coverity
%patch1007 -p1 -b .sshrsacheck
%patch1012 -p1 -b .evp-fips-kex
%patch1015 -p1 -b .pam-rhost
@ -460,6 +483,17 @@ popd
%patch1037 -p1 -b .reject-cntrl-chars-in-username
%patch1038 -p1 -b .reject-null-char-in-url-string
%patch1039 -p1 -b .skip-mlkem-when-na
%patch1040 -p1 -b .fill-default-options-error
%patch1041 -p1 -b .scp-clear-setuid
%patch1042 -p1 -b .mux-askpass-check
%patch1043 -p1 -b .ecdsa-incomplete-application
%patch1044 -p1 -b .authorized-keys-principles-option
%patch1045 -p1 -b .proxyjump-username-validity-checks
%patch1046 -p1 -b .scp-remote-glob
%patch1047 -p1 -b .cve-2026-60002
%patch1048 -p1 -b .maxstartups-mistracking
%patch100 -p1 -b .coverity
autoreconf
pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@ -748,6 +782,59 @@ test -f %{sysconfig_anaconda} && \
%endif
%changelog
* Thu Jul 30 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-11
- Fix mistracking of MaxStartups process exits in some situations
Resolves: RHEL-216650
* Tue Jul 14 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-10
- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs remote-to-remote copy
via the local host
Resolves: RHEL-193176
- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
Resolves: RHEL-193023
* Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
FIPS known-group validation that leads to client-side denial of service
Resolves: RHEL-186440
- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
cleanup due to missing NULL terminator
Resolves: RHEL-185835
- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
pre-binding
Resolves: RHEL-185850
* Wed Apr 01 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-8
- Fix static analysis issues
Resolves: RHEL-163366
- Ssh should refuse connection when mlkem kex is specified in FIPS
Resolves: RHEL-155161
- CVE-2026-35385: Fix privilege escalation via scp legacy protocol
when not in preserving file mode
Resolves: RHEL-164754
- CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
multiplexing sessions
Resolves: RHEL-166251
- CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
and HostbasedAcceptedAlgorithms with regard to ECDSA keys
Resolves: RHEL-166235
- CVE-2026-35414: Fix mishandling of authorized_keys principals option
Resolves: RHEL-166203
- CVE-2026-35386: Add validation rules to usernames and hostnames
set for ProxyJump/-J on the commandline
Resolves: RHEL-166219
* Thu Mar 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7 + 0.10.4-9
- Version bump
* Mon Mar 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5 + 0.10.4-8
- CVE-2026-3497: Fix information disclosure or denial of service due
to uninitialized variables in gssapi-keyex
Resolves: RHEL-155825
- Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page
Resolves: RHEL-122302
* Wed Feb 25 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-4
- Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode
Resolves: RHEL-151580