.gitignore

@@ -38,5 +38,3 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
 /openssh-8.0p1.tar.gz.asc
 /openssh-8.1p1.tar.gz
 /openssh-8.1p1.tar.gz.asc
-/openssh-8.2p1.tar.gz
-/openssh-8.2p1.tar.gz.asc

openssh-5.1p1-askpass-progress.patch

@@ -9,7 +9,7 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
  #include <gtk/gtk.h>
  #include <gdk/gdkx.h>
  
-@@ -81,14 +82,25 @@ ok_dialog(GtkWidget *entry, gpointer dia
+@@ -81,13 +82,24 @@ ok_dialog(GtkWidget *entry, gpointer dia
  	gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK);
  }
  
@@ -25,21 +25,20 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
 +}
 +
  static int
- passphrase_dialog(char *message, int prompt_type)
+ passphrase_dialog(char *message)
  {
  	const char *failed;
  	char *passphrase, *local;
  	int result, grab_tries, grab_server, grab_pointer;
- 	int buttons, default_response;
 -	GtkWidget *parent_window, *dialog, *entry;
 +	GtkWidget *parent_window, *dialog, *entry, *progress, *hbox;
  	GdkGrabStatus status;
  
  	grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL);
-@@ -104,16 +116,37 @@ passphrase_dialog(char *message)
+@@ -104,14 +116,32 @@ passphrase_dialog(char *message)
- 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
+ 					"%s",
+ 					message);
  
- 	if (prompt_type == PROMPT_ENTRY) {
 +	hbox = gtk_hbox_new(FALSE, 0);
 +	gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), hbox, FALSE,
 +	    FALSE, 0);
@@ -47,18 +46,15 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
 +
  	entry = gtk_entry_new();
  	gtk_box_pack_start(
--		    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
+-	    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))), entry,
--		    entry, FALSE, FALSE, 0);
+-	    FALSE, FALSE, 0);
 +	    GTK_BOX(hbox), entry,
 +	    TRUE, FALSE, 0);
 +	gtk_entry_set_width_chars(GTK_ENTRY(entry), 2);
  	gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
  	gtk_widget_grab_focus(entry);
  	gtk_widget_show(entry);
- 		/* Make <enter> close dialog */
+ 
- 		g_signal_connect(G_OBJECT(entry), "activate",
- 				 G_CALLBACK(ok_dialog), dialog);
-+
 +	hbox = gtk_hbox_new(FALSE, 0);
 +	gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), hbox, FALSE,
 +	    FALSE, 8);
@@ -70,9 +66,16 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
 +	gtk_box_pack_start(GTK_BOX(hbox), progress, TRUE,
 +	    TRUE, 5);
 +	gtk_widget_show(progress);
++
+ 	gtk_window_set_title(GTK_WINDOW(dialog), "OpenSSH");
+ 	gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER);
+ 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
+@@ -120,6 +150,8 @@ passphrase_dialog(char *message)
+ 	gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK);
+ 	g_signal_connect(G_OBJECT(entry), "activate",
+ 			 G_CALLBACK(ok_dialog), dialog);
 +	g_signal_connect(G_OBJECT(entry), "changed",
 +			 G_CALLBACK(move_progress), progress);
-+
- 	}
  
- 	/* Grab focus */
+ 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
+ 

openssh-6.6.1p1-log-in-chroot.patch

@@ -56,8 +56,8 @@ diff -up openssh-7.4p1/monitor.c.log-in-chroot openssh-7.4p1/monitor.c
 +	pmonitor->m_state = "postauth";
 +
  	monitor_set_child_handler(pmonitor->m_pid);
- 	ssh_signal(SIGHUP, &monitor_child_handler);
+ 	signal(SIGHUP, &monitor_child_handler);
- 	ssh_signal(SIGTERM, &monitor_child_handler);
+ 	signal(SIGTERM, &monitor_child_handler);
 @@ -472,7 +476,7 @@ monitor_read_log(struct monitor *pmonito
  	if (log_level_name(level) == NULL)
  		fatal("%s: invalid log level %u (corrupted message?)",

openssh-6.6p1-GSSAPIEnablek5users.patch

@@ -122,7 +122,7 @@ diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
 --- openssh-7.4p1/sshd_config.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
 +++ openssh-7.4p1/sshd_config	2016-12-23 15:18:40.631216103 +0100
 @@ -80,6 +80,7 @@ GSSAPIAuthentication yes
- #GSSAPICleanupCredentials yes
+ GSSAPICleanupCredentials no
  #GSSAPIStrictAcceptorCheck yes
  #GSSAPIKeyExchange no
 +#GSSAPIEnablek5users no

openssh-6.6p1-ctr-cavstest.patch

@@ -7,14 +7,14 @@ diff -up openssh-6.8p1/Makefile.in.ctr-cavs openssh-6.8p1/Makefile.in
  SSH_KEYCAT=$(libexecdir)/ssh-keycat
 +CTR_CAVSTEST=$(libexecdir)/ctr-cavstest
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
 @@ -66,7 +67,7 @@ EXEEXT=@EXEEXT@
+ MKDIR_P=@MKDIR_P@
+ INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
  
- .SUFFIXES: .lo
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
- 
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
  
  XMSS_OBJS=\
  	ssh-xmss.o \
@@ -25,8 +25,8 @@ diff -up openssh-6.8p1/Makefile.in.ctr-cavs openssh-6.8p1/Makefile.in
 +ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
 +	$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
 +
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
 @@ -326,6 +330,7 @@ install-files:
  		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \

openssh-6.6p1-keycat.patch

@@ -41,22 +41,22 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
  SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
 +SSH_KEYCAT=$(libexecdir)/ssh-keycat
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
 @@ -52,6 +52,7 @@ K5LIBS=@K5LIBS@
  GSSLIBS=@GSSLIBS@
  SSHLIBS=@SSHLIBS@
  SSHDLIBS=@SSHDLIBS@
 +KEYCATLIBS=@KEYCATLIBS@
  LIBEDIT=@LIBEDIT@
- LIBFIDO2=@LIBFIDO2@
  AR=@AR@
+ AWK=@AWK@
 @@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
+ MKDIR_P=@MKDIR_P@
+ INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
  
- .SUFFIXES: .lo
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
- 
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
  
  XMSS_OBJS=\
  	ssh-xmss.o \
@@ -67,8 +67,8 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
 +ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
 +	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(KEYCATLIBS) $(LIBS)
 +
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
 @@ -321,6 +325,7 @@ install-files:
  		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \

openssh-6.6p1-keyperm.patch

@@ -1,7 +1,8 @@
-diff -up openssh-8.2p1/authfile.c.keyperm openssh-8.2p1/authfile.c
+diff --git a/authfile.c b/authfile.c
---- openssh-8.2p1/authfile.c.keyperm	2020-02-14 01:40:54.000000000 +0100
+index e93d867..4fc5b3d 100644
-+++ openssh-8.2p1/authfile.c	2020-02-17 11:55:12.841729758 +0100
+--- a/authfile.c
-@@ -31,6 +31,7 @@
++++ b/authfile.c
+@@ -32,6 +32,7 @@
  
  #include <errno.h>
  #include <fcntl.h>
@@ -9,23 +10,17 @@ diff -up openssh-8.2p1/authfile.c.keyperm openssh-8.2p1/authfile.c
  #include <stdio.h>
  #include <stdarg.h>
  #include <stdlib.h>
-@@ -101,7 +102,19 @@ sshkey_perm_ok(int fd, const char *filen
+@@ -207,6 +208,13 @@ sshkey_perm_ok(int fd, const char *filename)
  #ifdef HAVE_CYGWIN
  	if (check_ntsec(filename))
  #endif
-+
- 	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
 +	if (st.st_mode & 040) {
 +		struct group *gr;
 +
-+			if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid)) {
++		if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid))
-+				/* The only additional bit is read
++			st.st_mode &= ~040;
-+				 * for ssh_keys group, which is fine */
-+				if ((st.st_mode & 077) == 040 ) {
-+					return 0;
-+				}
-+			}
 +	}
++
+ 	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
  		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
  		error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");
- 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");

openssh-6.6p1-kuserok.patch

@@ -217,7 +217,7 @@ diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
  	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
  	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 @@ -1644,6 +1649,10 @@ process_server_config_line(ServerOptions
- 		*activep = (inc_flags & SSHCFG_NEVERMATCH) ? 0 : value;
+ 		*activep = value;
  		break;
  
 +	case sKerberosUseKuserok:
@@ -286,4 +286,4 @@ diff -up openssh-7.4p1/sshd_config.kuserok openssh-7.4p1/sshd_config
 +#KerberosUseKuserok yes
  
  # GSSAPI options
- #GSSAPIAuthentication no
+ GSSAPIAuthentication yes

openssh-6.7p1-coverity.patch

@@ -136,11 +136,11 @@ diff -up openssh-7.4p1/sftp.c.coverity openssh-7.4p1/sftp.c
 --- openssh-7.4p1/sftp.c.coverity	2016-12-19 05:59:41.000000000 +0100
 +++ openssh-7.4p1/sftp.c	2016-12-23 16:40:26.903788691 +0100
 @@ -224,7 +224,7 @@ killchild(int signo)
- 	pid = sshpid;
+ {
- 	if (pid > 1) {
+ 	if (sshpid > 1) {
- 		kill(pid, SIGTERM);
+ 		kill(sshpid, SIGTERM);
--		waitpid(pid, NULL, 0);
+-		waitpid(sshpid, NULL, 0);
-+		(void) waitpid(pid, NULL, 0);
++		(void) waitpid(sshpid, NULL, 0);
  	}
  
  	_exit(1);

openssh-6.7p1-kdf-cavs.patch

@@ -7,14 +7,14 @@ diff -up openssh-6.8p1/Makefile.in.kdf-cavs openssh-6.8p1/Makefile.in
  CTR_CAVSTEST=$(libexecdir)/ctr-cavstest
 +SSH_CAVS=$(libexecdir)/ssh-cavs
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
 @@ -67,7 +68,7 @@ EXEEXT=@EXEEXT@
+ MKDIR_P=@MKDIR_P@
+ INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
  
- .SUFFIXES: .lo
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
- 
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT) ssh-cavs$(EXEEXT)
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT) ssh-cavs$(EXEEXT)
  
  XMSS_OBJS=\
  	ssh-xmss.o \
@@ -22,11 +22,11 @@ diff -up openssh-6.8p1/Makefile.in.kdf-cavs openssh-6.8p1/Makefile.in
  ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
  	$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
  
-+ssh-cavs$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-cavs.o $(SKOBJS)
++ssh-cavs$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-cavs.o
-+	$(LD) -o $@ ssh-cavs.o $(SKOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
++	$(LD) -o $@ ssh-cavs.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 +
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
 @@ -331,6 +335,8 @@ install-files:
  	fi

openssh-6.7p1-ldap.patch

@@ -134,54 +134,52 @@ diff -up openssh-6.8p1/Makefile.in.ldap openssh-6.8p1/Makefile.in
 +SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
 +SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
 @@ -50,6 +50,7 @@
+ CFLAGS=@CFLAGS@
  CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
- PICFLAG=@PICFLAG@
  LIBS=@LIBS@
 +LDAPLIBS=@LDAPLIBS@
  K5LIBS=@K5LIBS@
  GSSLIBS=@GSSLIBS@
  SSHLIBS=@SSHLIBS@
-@@ -61,10 +63,11 @@ XAUTH_PATH=@XAUTH_PATH@
+@@ -61,8 +63,9 @@ XAUTH_PATH=@XAUTH_PATH@
  EXEEXT=@EXEEXT@
  MANFMT=@MANFMT@
  MKDIR_P=@MKDIR_P@
 +INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
  
- .SUFFIXES: .lo
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
- 
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT)
  
  XMSS_OBJS=\
  	ssh-xmss.o \
 @@ -112,8 +115,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+ 	sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
+ 	sandbox-solaris.o uidswap.o
  
- SFTP_OBJS=	sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
+-MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
- 
+-MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
--MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
++MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap-helper.8.out ssh-ldap.conf.5.out
--MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
++MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 ssh-ldap-helper.8 ssh-ldap.conf.5
-+MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap-helper.8.out ssh-ldap.conf.5.out
-+MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5 ssh-ldap-helper.8 ssh-ldap.conf.5
  MANTYPE		= @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
 @@ -184,6 +187,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
- ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
+ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
- 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
+ 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
  
 +ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
 +	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lfipscheck $(LIBS) $(LDAPLIBS)
 +
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
 @@ -311,6 +317,10 @@ install-files:
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
  	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
 +	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
 +		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
 +		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
@@ -190,9 +188,9 @@ diff -up openssh-6.8p1/Makefile.in.ldap openssh-6.8p1/Makefile.in
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 @@ -327,6 +337,10 @@ install-files:
+ 	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
  	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
  	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
- 	$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
 +	if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
 +		$(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \
 +		$(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \
@@ -215,18 +213,18 @@ diff -up openssh-6.8p1/Makefile.in.ldap openssh-6.8p1/Makefile.in
  host-key: ssh-keygen$(EXEEXT)
  	@if [ -z "$(DESTDIR)" ] ; then \
 @@ -419,6 +440,8 @@ uninstall:
+ 	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- 	-rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
 +	-rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)
 +	-rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
 @@ -430,6 +453,7 @@ uninstall:
+ 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
- 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
 +	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
  
  regress-prep:
@@ -235,8 +233,8 @@ diff -up openssh-6.8p1/configure.ac.ldap openssh-6.8p1/configure.ac
 --- openssh-6.8p1/configure.ac.ldap	2015-03-17 06:49:20.000000000 +0100
 +++ openssh-6.8p1/configure.ac	2015-03-18 11:11:29.030801464 +0100
 @@ -1605,6 +1605,110 @@ if test "x$use_pie" != "xno"; then
- CFLAGS="$SAVED_CFLAGS"
+ 	fi
- AC_SUBST([PICFLAG])
+ fi
  
 +# Check whether user wants LDAP support
 +LDAP_MSG="no"

openssh-6.8p1-sshdT-output.patch

@@ -3,8 +3,8 @@ diff -up openssh/servconf.c.sshdt openssh/servconf.c
 +++ openssh/servconf.c	2015-06-24 11:44:39.734745802 +0200
 @@ -2317,7 +2317,7 @@ dump_config(ServerOptions *o)
  	dump_cfg_string(sXAuthLocation, o->xauth_location);
- 	dump_cfg_string(sCiphers, o->ciphers);
+ 	dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT);
- 	dump_cfg_string(sMacs, o->macs);
+ 	dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC);
 -	dump_cfg_string(sBanner, o->banner);
 +	dump_cfg_string(sBanner, o->banner != NULL ? o->banner : "none");
  	dump_cfg_string(sForceCommand, o->adm_forced_command);

openssh-7.6p1-audit.patch

@@ -747,21 +747,20 @@ diff -up openssh/auth2-hostbased.c.audit openssh/auth2-hostbased.c
  	    chost, key)) &&
 -	    PRIVSEP(sshkey_verify(key, sig, slen,
 +	    PRIVSEP(hostbased_key_verify(ssh, key, sig, slen,
- 	    sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0)
+ 	    sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat)) == 0)
  		authenticated = 1;
  
-@@ -175,6 +175,20 @@ done:
+@@ -175,6 +175,19 @@ done:
  	return authenticated;
  }
  
 +int
 +hostbased_key_verify(struct ssh *ssh, const struct sshkey *key, const u_char *sig,
-+    size_t slen, const u_char *data, size_t datalen, const char *pkalg, u_int compat,
++    size_t slen, const u_char *data, size_t datalen, const char *pkalg, u_int compat)
-+    struct sshkey_sig_details **detailsp)
 +{
 +	int rv;
 +
-+	rv = sshkey_verify(key, sig, slen, data, datalen, pkalg, compat, detailsp);
++	rv = sshkey_verify(key, sig, slen, data, datalen, pkalg, compat);
 +#ifdef SSH_AUDIT_EVENTS
 +	audit_key(ssh, 0, &rv, key);
 +#endif
@@ -782,19 +781,18 @@ diff -up openssh/auth2-pubkey.c.audit openssh/auth2-pubkey.c
 +		    PRIVSEP(user_key_verify(ssh, key, sig, slen,
  		    sshbuf_ptr(b), sshbuf_len(b),
  		    (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
- 		    ssh->compat, &sig_details)) == 0) {
+ 		    ssh->compat)) == 0) {
-@@ -278,6 +278,20 @@ done:
+@@ -278,6 +278,19 @@ done:
  	return authenticated;
  }
  
 +int
 +user_key_verify(struct ssh *ssh, const struct sshkey *key, const u_char *sig,
-+    size_t slen, const u_char *data, size_t datalen, const char *pkalg, u_int compat,
++    size_t slen, const u_char *data, size_t datalen, const char *pkalg, u_int compat)
-+    struct sshkey_sig_details **detailsp)
 +{
 +	int rv;
 +
-+	rv = sshkey_verify(key, sig, slen, data, datalen, pkalg, compat, detailsp);
++	rv = sshkey_verify(key, sig, slen, data, datalen, pkalg, compat);
 +#ifdef SSH_AUDIT_EVENTS
 +	audit_key(ssh, 1, &rv, key);
 +#endif
@@ -834,7 +832,7 @@ diff -up openssh/auth.h.audit openssh/auth.h
  char	*expand_authorized_keys(const char *, struct passwd *pw);
  char	*authorized_principals_file(struct passwd *);
 +int	 user_key_verify(struct ssh *, const struct sshkey *, const u_char *, size_t,
-+    const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **);
++    const u_char *, size_t, const char *, u_int);
  
  FILE	*auth_openkeyfile(const char *, struct passwd *, int);
  FILE	*auth_openprincipals(const char *, struct passwd *, int);
@@ -843,7 +841,7 @@ diff -up openssh/auth.h.audit openssh/auth.h
  int	 sshd_hostkey_sign(struct ssh *, struct sshkey *, struct sshkey *,
      u_char **, size_t *, const u_char *, size_t, const char *);
 +int	 hostbased_key_verify(struct ssh *, const struct sshkey *, const u_char *, size_t,
-+    const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **);
++    const u_char *, size_t, const char *, u_int);
  
  /* Key / cert options linkage to auth layer */
  const struct sshauthopt *auth_options(struct ssh *);
@@ -975,9 +973,9 @@ diff -up openssh/kex.c.audit openssh/kex.c
 +#endif
  		return SSH_ERR_NO_COMPRESS_ALG_MATCH;
 +	}
- #ifdef WITH_ZLIB
  	if (strcmp(name, "zlib@openssh.com") == 0) {
  		comp->type = COMP_DELAYED;
+ 	} else if (strcmp(name, "zlib") == 0) {
 @@ -933,7 +946,7 @@ kex_choose_conf(struct ssh *ssh)
  		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
  		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
@@ -1093,15 +1091,16 @@ diff -up openssh/mac.h.audit openssh/mac.h
 diff -up openssh/Makefile.in.audit openssh/Makefile.in
 --- openssh/Makefile.in.audit	2019-04-03 17:02:20.705885965 +0200
 +++ openssh/Makefile.in	2019-04-03 17:02:20.715886060 +0200
-@@ -109,7 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -109,7 +109,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	kexgexc.o kexgexs.o \
  	sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
  	kexgssc.o \
-	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
+-	platform-pledge.o platform-tracing.o platform-misc.o
--	sshbuf-io.o
++	platform-pledge.o platform-tracing.o platform-misc.o \
-+	sshbuf-io.o auditstub.o
++	auditstub.o
  
- SKOBJS=	ssh-sk-client.o
  
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
 diff -up openssh/monitor.c.audit openssh/monitor.c
 --- openssh/monitor.c.audit	2019-04-03 17:02:20.674885671 +0200
 +++ openssh/monitor.c	2019-04-03 17:03:17.201421405 +0200
@@ -1112,7 +1111,7 @@ diff -up openssh/monitor.c.audit openssh/monitor.c
 +#include "audit.h"
  #include "match.h"
  #include "ssherr.h"
- #include "sk-api.h"
+ 
 @@ -107,6 +108,8 @@ extern u_char session_id[];
  extern struct sshbuf *loginmsg;
  extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */
@@ -1158,16 +1157,16 @@ diff -up openssh/monitor.c.audit openssh/monitor.c
      {0, 0, NULL}
  };
 @@ -1445,8 +1462,10 @@ mm_answer_keyverify(struct ssh *ssh, int
+ 	char *sigalg;
  	size_t signaturelen, datalen, bloblen;
- 	int r, ret, req_presence = 0, valid_data = 0, encoded_ret;
+ 	int r, ret, valid_data = 0, encoded_ret;
- 	struct sshkey_sig_details *sig_details = NULL;
 +	int type = 0;
  
--	if ((r = sshbuf_get_string_direct(m, &blob, &bloblen)) != 0 ||
+-	if ((r = sshbuf_get_string(m, &blob, &bloblen)) != 0 ||
 +	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
-+	    (r = sshbuf_get_string_direct(m, &blob, &bloblen)) != 0 ||
++	    (r = sshbuf_get_string(m, &blob, &bloblen)) != 0 ||
- 	    (r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||
+ 	    (r = sshbuf_get_string(m, &signature, &signaturelen)) != 0 ||
- 	    (r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||
+ 	    (r = sshbuf_get_string(m, &data, &datalen)) != 0 ||
  	    (r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
 @@ -1455,6 +1474,8 @@ mm_answer_keyverify(struct ssh *ssh, int
  	if (hostbased_cuser == NULL || hostbased_chost == NULL ||
@@ -1178,19 +1177,19 @@ diff -up openssh/monitor.c.audit openssh/monitor.c
  
  	/* Empty signature algorithm means NULL. */
  	if (*sigalg == '\0') {
-@@ -1470,25 +1491,28 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1470,21 +1491,24 @@ mm_answer_keyverify(struct ssh *ssh, int
  	case MM_USERKEY:
  		valid_data = monitor_valid_userblob(data, datalen);
  		auth_method = "publickey";
 +		ret = user_key_verify(ssh, key, signature, signaturelen, data,
-+		    datalen, sigalg, ssh->compat, &sig_details);
++		    datalen, sigalg, ssh->compat);
  		break;
  	case MM_HOSTKEY:
  		valid_data = monitor_valid_hostbasedblob(data, datalen,
  		    hostbased_cuser, hostbased_chost);
- 		auth_method = "hostbased";
 +		ret = hostbased_key_verify(ssh, key, signature, signaturelen, data,
-+		    datalen, sigalg, ssh->compat, &sig_details);
++		    datalen, sigalg, ssh->compat);
+ 		auth_method = "hostbased";
  		break;
  	default:
  		valid_data = 0;
@@ -1200,15 +1199,11 @@ diff -up openssh/monitor.c.audit openssh/monitor.c
  	if (!valid_data)
  		fatal("%s: bad signature data blob", __func__);
  
- 	if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
- 	    SSH_FP_DEFAULT)) == NULL)
- 		fatal("%s: sshkey_fingerprint failed", __func__);
- 
 -	ret = sshkey_verify(key, signature, signaturelen, data, datalen,
--	    sigalg, ssh->compat, &sig_details);
+-	    sigalg, ssh->compat);
- 	debug3("%s: %s %p signature %s%s%s", __func__, auth_method, key,
+ 	debug3("%s: %s %p signature %s", __func__, auth_method, key,
- 	    (ret == 0) ? "verified" : "unverified",
+ 	    (ret == 0) ? "verified" : "unverified");
- 	    (ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");
+ 	auth2_record_key(authctxt, ret == 0, key);
 @@ -1536,13 +1560,19 @@ mm_record_login(struct ssh *ssh, Session
  }
  
@@ -1464,11 +1459,11 @@ diff -up openssh/monitor_wrap.c.audit openssh/monitor_wrap.c
  int
 -mm_sshkey_verify(const struct sshkey *key, const u_char *sig, size_t siglen,
 +mm_sshkey_verify(enum mm_keytype type, const struct sshkey *key, const u_char *sig, size_t siglen,
-     const u_char *data, size_t datalen, const char *sigalg, u_int compat,
+     const u_char *data, size_t datalen, const char *sigalg, u_int compat)
-     struct sshkey_sig_details **sig_detailsp)
  {
+ 	struct sshbuf *m;
 @@ -525,7 +525,8 @@ mm_sshkey_verify(const struct sshkey *ke
- 		*sig_detailsp = NULL;
+ 
  	if ((m = sshbuf_new()) == NULL)
  		fatal("%s: sshbuf_new failed", __func__);
 -	if ((r = sshkey_puts(key, m)) != 0 ||
@@ -1477,24 +1472,22 @@ diff -up openssh/monitor_wrap.c.audit openssh/monitor_wrap.c
  	    (r = sshbuf_put_string(m, sig, siglen)) != 0 ||
  	    (r = sshbuf_put_string(m, data, datalen)) != 0 ||
  	    (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
-@@ -547,6 +548,22 @@ mm_sshkey_verify(const struct sshkey *ke
+@@ -547,6 +548,20 @@ mm_sshkey_verify(const struct sshkey *ke
  	return 0;
  }
  
 +int
 +mm_hostbased_key_verify(struct ssh *ssh, const struct sshkey *key, const u_char *sig, size_t siglen,
-+    const u_char *data, size_t datalen, const char *pkalg, u_int compat,
++    const u_char *data, size_t datalen, const char *pkalg, u_int compat)
-+    struct sshkey_sig_details **detailsp)
 +{
-+	return mm_sshkey_verify(MM_HOSTKEY, key, sig, siglen, data, datalen, pkalg, compat, detailsp);
++	return mm_sshkey_verify(MM_HOSTKEY, key, sig, siglen, data, datalen, pkalg, compat);
 +}
 +
 +int
 +mm_user_key_verify(struct ssh *ssh, const struct sshkey *key, const u_char *sig, size_t siglen,
-+    const u_char *data, size_t datalen, const char *pkalg, u_int compat,
++    const u_char *data, size_t datalen, const char *pkalg, u_int compat)
-+    struct sshkey_sig_details **detailsp)
 +{
-+	return mm_sshkey_verify(MM_USERKEY, key, sig, siglen, data, datalen, pkalg, compat, detailsp);
++	return mm_sshkey_verify(MM_USERKEY, key, sig, siglen, data, datalen, pkalg, compat);
 +}
 +
  void
@@ -1639,9 +1632,9 @@ diff -up openssh/monitor_wrap.h.audit openssh/monitor_wrap.h
      const char *, struct sshkey *);
 -int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
 +int mm_hostbased_key_verify(struct ssh *, const struct sshkey *, const u_char *, size_t,
-+    const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **);
++    const u_char *, size_t, const char *, u_int);
 +int mm_user_key_verify(struct ssh*, const struct sshkey *, const u_char *, size_t,
-     const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **);
+     const u_char *, size_t, const char *, u_int);
  
  #ifdef GSSAPI
 @@ -82,7 +84,12 @@ void mm_sshpam_free_ctx(void *);
@@ -1662,7 +1655,7 @@ diff -up openssh/packet.c.audit openssh/packet.c
 --- openssh/packet.c.audit	2019-03-27 23:26:14.000000000 +0100
 +++ openssh/packet.c	2019-04-03 17:02:20.716886069 +0200
 @@ -77,6 +77,7 @@
- #endif
+ #include <zlib.h>
  
  #include "xmalloc.h"
 +#include "audit.h"
@@ -1712,7 +1705,7 @@ diff -up openssh/packet.c.audit openssh/packet.c
  		kex_free_newkeys(state->newkeys[mode]);	/* current keys */
  		state->newkeys[mode] = NULL;
 @@ -636,8 +641,18 @@ ssh_packet_close_internal(struct ssh *ss
- #endif	/* WITH_ZLIB */
+ 	}
  	cipher_free(state->send_context);
  	cipher_free(state->receive_context);
 +	if (had_keys && state->server_side) {
@@ -2048,7 +2041,7 @@ diff -up openssh/sshd.c.audit openssh/sshd.c
 +void demote_sensitive_data(struct ssh *);
  static void do_ssh2_kex(struct ssh *);
  
- static char *listener_proctitle;
+ /*
 @@ -278,6 +279,15 @@ close_listen_socks(void)
  	num_listen_socks = -1;
  }
@@ -2321,5 +2314,5 @@ diff -up openssh/sshkey.h.audit openssh/sshkey.h
  int	 sshkey_type_from_name(const char *);
 +int	 sshkey_is_private(const struct sshkey *);
  int	 sshkey_is_cert(const struct sshkey *);
- int	 sshkey_is_sk(const struct sshkey *);
  int	 sshkey_type_is_cert(int);
+ int	 sshkey_type_plain(int);

openssh-7.7p1-fips.patch

@@ -11,6 +11,19 @@ diff -up openssh-8.0p1/cipher-ctr.c.fips openssh-8.0p1/cipher-ctr.c
  #endif
  	return (&aes_ctr);
  }
+diff -up openssh-8.0p1/clientloop.c.fips openssh-8.0p1/clientloop.c
+--- openssh-8.0p1/clientloop.c.fips	2019-07-23 14:55:45.331525692 +0200
++++ openssh-8.0p1/clientloop.c	2019-07-23 14:55:45.401526401 +0200
+@@ -2049,7 +2049,8 @@ key_accepted_by_hostkeyalgs(const struct
+ {
+ 	const char *ktype = sshkey_ssh_name(key);
+ 	const char *hostkeyalgs = options.hostkeyalgorithms != NULL ?
+-	    options.hostkeyalgorithms : KEX_DEFAULT_PK_ALG;
++	    options.hostkeyalgorithms : (FIPS_mode() ?
++	    KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG);
+ 
+ 	if (key == NULL || key->type == KEY_UNSPEC)
+ 		return 0;
 diff -up openssh-8.0p1/dh.c.fips openssh-8.0p1/dh.c
 --- openssh-8.0p1/dh.c.fips	2019-04-18 00:52:57.000000000 +0200
 +++ openssh-8.0p1/dh.c	2019-07-23 14:55:45.401526401 +0200
@@ -128,76 +141,69 @@ diff -up openssh-8.0p1/Makefile.in.fips openssh-8.0p1/Makefile.in
 -	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
 +	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
  
- scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS)
+ scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
- 	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
  
- ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHADD_OBJS)
+ ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
--	$(LD) -o $@ $(SSHADD_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+-	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+	$(LD) -o $@ $(SSHADD_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
++	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
- ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHAGENT_OBJS)
+ ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-agent.o ssh-pkcs11-client.o
--	$(LD) -o $@ $(SSHAGENT_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+-	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+	$(LD) -o $@ $(SSHAGENT_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
++	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
- ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYGEN_OBJS)
+ ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o sshsig.o
--	$(LD) -o $@ $(SSHKEYGEN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+-	$(LD) -o $@ ssh-keygen.o sshsig.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+	$(LD) -o $@ $(SSHKEYGEN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
++	$(LD) -o $@ ssh-keygen.o sshsig.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
- ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSIGN_OBJS)
+ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o readconf.o uidswap.o compat.o
--	$(LD) -o $@ $(SSHKEYSIGN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+-	$(LD) -o $@ ssh-keysign.o readconf.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+	$(LD) -o $@ $(SSHKEYSIGN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
++	$(LD) -o $@ ssh-keysign.o readconf.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
- ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(P11HELPER_OBJS)
+ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
- 	$(LD) -o $@ $(P11HELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
 @@ -216,7 +216,7 @@ ssh-cavs$(EXEEXT): $(LIBCOMPAT) libssh.a
- 	$(LD) -o $@ ssh-cavs.o $(SKOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ ssh-cavs.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
  
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
--	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+-	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
-+	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
++	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
  
- sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
+ sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-realpath.o sftp-server-main.o
- 	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ sftp-server.o sftp-common.o sftp-realpath.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 diff -up openssh-8.0p1/myproposal.h.fips openssh-8.0p1/myproposal.h
 --- openssh-8.0p1/myproposal.h.fips	2019-04-18 00:52:57.000000000 +0200
 +++ openssh-8.0p1/myproposal.h	2019-07-23 14:55:45.402526411 +0200
-@@ -111,6 +111,20 @@
+@@ -111,6 +111,16 @@
  	"rsa-sha2-256," \
  	"ssh-rsa"
  
 +#define	KEX_FIPS_PK_ALG	\
-+	"ecdsa-sha2-nistp256-cert-v01@openssh.com," \
++	HOSTKEY_ECDSA_CERT_METHODS \
-+	"ecdsa-sha2-nistp384-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp521-cert-v01@openssh.com," \
 +	"rsa-sha2-512-cert-v01@openssh.com," \
 +	"rsa-sha2-256-cert-v01@openssh.com," \
 +	"ssh-rsa-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp256," \
++	HOSTKEY_ECDSA_METHODS \
-+	"ecdsa-sha2-nistp384," \
-+	"ecdsa-sha2-nistp521," \
 +	"rsa-sha2-512," \
 +	"rsa-sha2-256," \
 +	"ssh-rsa"
 +
+ /* the actual algorithms */
+ 
  #define KEX_SERVER_ENCRYPT \
- 	"chacha20-poly1305@openssh.com," \
+@@ -134,6 +142,38 @@
- 	"aes128-ctr,aes192-ctr,aes256-ctr," \
-@@ -134,6 +142,27 @@
  
  #define KEX_CLIENT_MAC KEX_SERVER_MAC
  
 +#define	KEX_FIPS_ENCRYPT \
 +	"aes128-ctr,aes192-ctr,aes256-ctr," \
 +	"aes128-cbc,3des-cbc," \
-+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se," \
++	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se" \
-+	"aes128-gcm@openssh.com,aes256-gcm@openssh.com"
++	AESGCM_CIPHER_MODES
++#ifdef HAVE_EVP_SHA256
 +# define KEX_DEFAULT_KEX_FIPS		\
-+	"ecdh-sha2-nistp256," \
++	KEX_ECDH_METHODS \
-+	"ecdh-sha2-nistp384," \
++	KEX_SHA2_METHODS \
-+	"ecdh-sha2-nistp521," \
-+	"diffie-hellman-group-exchange-sha256," \
-+	"diffie-hellman-group16-sha512," \
-+	"diffie-hellman-group18-sha512," \
 +	"diffie-hellman-group14-sha256"
 +# define KEX_FIPS_MAC \
 +	"hmac-sha1," \
@@ -206,35 +212,55 @@ diff -up openssh-8.0p1/myproposal.h.fips openssh-8.0p1/myproposal.h
 +	"hmac-sha1-etm@openssh.com," \
 +	"hmac-sha2-256-etm@openssh.com," \
 +	"hmac-sha2-512-etm@openssh.com"
++#else
++# ifdef OPENSSL_HAS_NISTP521
++#  define KEX_DEFAULT_KEX_FIPS		\
++	"ecdh-sha2-nistp256," \
++	"ecdh-sha2-nistp384," \
++	"ecdh-sha2-nistp521"
++# else
++#  define KEX_DEFAULT_KEX_FIPS		\
++	"ecdh-sha2-nistp256," \
++	"ecdh-sha2-nistp384"
++# endif
++#define        KEX_FIPS_MAC \
++       "hmac-sha1"
++#endif
 +
  /* Not a KEX value, but here so all the algorithm defaults are together */
  #define	SSH_ALLOWED_CA_SIGALGS	\
- 	"ecdsa-sha2-nistp256," \
+ 	HOSTKEY_ECDSA_METHODS \
 diff -up openssh-8.0p1/readconf.c.fips openssh-8.0p1/readconf.c
 --- openssh-8.0p1/readconf.c.fips	2019-07-23 14:55:45.334525723 +0200
 +++ openssh-8.0p1/readconf.c	2019-07-23 14:55:45.402526411 +0200
-@@ -2179,11 +2179,16 @@ fill_default_options(Options * options)
+@@ -2179,18 +2179,19 @@ fill_default_options(Options * options)
+ 	all_kex = kex_alg_list(',');
  	all_key = sshkey_alg_list(0, 0, 1, ',');
  	all_sig = sshkey_alg_list(0, 1, 1, ',');
- 	/* remove unsupported algos from default lists */
+-#define ASSEMBLE(what, defaults, all) \
--	def_cipher = match_filter_whitelist(KEX_CLIENT_ENCRYPT, all_cipher);
++#define ASSEMBLE(what, defaults, fips_defaults, all) \
--	def_mac = match_filter_whitelist(KEX_CLIENT_MAC, all_mac);
--	def_kex = match_filter_whitelist(KEX_CLIENT_KEX, all_kex);
--	def_key = match_filter_whitelist(KEX_DEFAULT_PK_ALG, all_key);
--	def_sig = match_filter_whitelist(SSH_ALLOWED_CA_SIGALGS, all_sig);
-+	def_cipher = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_ENCRYPT : KEX_CLIENT_ENCRYPT), all_cipher);
-+	def_mac = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_MAC : KEX_CLIENT_MAC), all_mac);
-+	def_kex = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_DEFAULT_KEX_FIPS : KEX_CLIENT_KEX), all_kex);
-+	def_key = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG), all_key);
-+	def_sig = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
- #define ASSEMBLE(what, defaults, all) \
  	do { \
  		if ((r = kex_assemble_names(&options->what, \
+-		    defaults, all)) != 0) \
++		    (FIPS_mode() ? fips_defaults : defaults), \
++		    all)) != 0) \
+ 			fatal("%s: %s: %s", __func__, #what, ssh_err(r)); \
+ 	} while (0)
+-	ASSEMBLE(ciphers, KEX_CLIENT_ENCRYPT, all_cipher);
+-	ASSEMBLE(macs, KEX_CLIENT_MAC, all_mac);
+-	ASSEMBLE(kex_algorithms, KEX_CLIENT_KEX, all_kex);
+-	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(ca_sign_algorithms, SSH_ALLOWED_CA_SIGALGS, all_sig);
++	ASSEMBLE(ciphers, KEX_CLIENT_ENCRYPT, KEX_FIPS_ENCRYPT, all_cipher);
++	ASSEMBLE(macs, KEX_CLIENT_MAC, KEX_FIPS_MAC, all_mac);
++	ASSEMBLE(kex_algorithms, KEX_CLIENT_KEX, KEX_DEFAULT_KEX_FIPS, all_kex);
++	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(ca_sign_algorithms, SSH_ALLOWED_CA_SIGALGS, KEX_FIPS_PK_ALG, all_sig);
+ #undef ASSEMBLE
+ 	free(all_cipher);
+ 	free(all_mac);
 diff -up openssh-8.0p1/sandbox-seccomp-filter.c.fips openssh-8.0p1/sandbox-seccomp-filter.c
 --- openssh-8.0p1/sandbox-seccomp-filter.c.fips	2019-07-23 14:55:45.373526117 +0200
 +++ openssh-8.0p1/sandbox-seccomp-filter.c	2019-07-23 14:55:45.402526411 +0200
@@ -251,28 +277,35 @@ diff -up openssh-8.0p1/sandbox-seccomp-filter.c.fips openssh-8.0p1/sandbox-secco
 diff -up openssh-8.0p1/servconf.c.fips openssh-8.0p1/servconf.c
 --- openssh-8.0p1/servconf.c.fips	2019-07-23 14:55:45.361525996 +0200
 +++ openssh-8.0p1/servconf.c	2019-07-23 14:55:45.403526421 +0200
-@@ -208,11 +208,16 @@ assemble_algorithms(ServerOptions *o)
+@@ -208,18 +208,19 @@ assemble_algorithms(ServerOptions *o)
+ 	all_kex = kex_alg_list(',');
  	all_key = sshkey_alg_list(0, 0, 1, ',');
  	all_sig = sshkey_alg_list(0, 1, 1, ',');
- 	/* remove unsupported algos from default lists */
+-#define ASSEMBLE(what, defaults, all) \
--	def_cipher = match_filter_whitelist(KEX_SERVER_ENCRYPT, all_cipher);
++#define ASSEMBLE(what, defaults, fips_defaults, all) \
--	def_mac = match_filter_whitelist(KEX_SERVER_MAC, all_mac);
--	def_kex = match_filter_whitelist(KEX_SERVER_KEX, all_kex);
--	def_key = match_filter_whitelist(KEX_DEFAULT_PK_ALG, all_key);
--	def_sig = match_filter_whitelist(SSH_ALLOWED_CA_SIGALGS, all_sig);
-+	def_cipher = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_ENCRYPT : KEX_SERVER_ENCRYPT), all_cipher);
-+	def_mac = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_MAC : KEX_SERVER_MAC), all_mac);
-+	def_kex = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_DEFAULT_KEX_FIPS : KEX_SERVER_KEX), all_kex);
-+	def_key = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG), all_key);
-+	def_sig = match_filter_whitelist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
- #define ASSEMBLE(what, defaults, all) \
  	do { \
- 		if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
+-		if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
++		if ((r = kex_assemble_names(&o->what, (FIPS_mode() \
++		    ? fips_defaults : defaults), all)) != 0) \
+ 			fatal("%s: %s: %s", __func__, #what, ssh_err(r)); \
+ 	} while (0)
+-	ASSEMBLE(ciphers, KEX_SERVER_ENCRYPT, all_cipher);
+-	ASSEMBLE(macs, KEX_SERVER_MAC, all_mac);
+-	ASSEMBLE(kex_algorithms, KEX_SERVER_KEX, all_kex);
+-	ASSEMBLE(hostkeyalgorithms, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(ca_sign_algorithms, SSH_ALLOWED_CA_SIGALGS, all_sig);
++	ASSEMBLE(ciphers, KEX_SERVER_ENCRYPT, KEX_FIPS_ENCRYPT, all_cipher);
++	ASSEMBLE(macs, KEX_SERVER_MAC, KEX_FIPS_MAC, all_mac);
++	ASSEMBLE(kex_algorithms, KEX_SERVER_KEX, KEX_DEFAULT_KEX_FIPS, all_kex);
++	ASSEMBLE(hostkeyalgorithms, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(ca_sign_algorithms, SSH_ALLOWED_CA_SIGALGS, KEX_FIPS_PK_ALG, all_sig);
+ #undef ASSEMBLE
+ 	free(all_cipher);
+ 	free(all_mac);
 diff -up openssh-8.0p1/ssh.c.fips openssh-8.0p1/ssh.c
 --- openssh-8.0p1/ssh.c.fips	2019-07-23 14:55:45.378526168 +0200
 +++ openssh-8.0p1/ssh.c	2019-07-23 14:55:45.403526421 +0200
@@ -307,7 +340,7 @@ diff -up openssh-8.0p1/ssh.c.fips openssh-8.0p1/ssh.c
  	seed_rng();
  
 +	if (FIPS_mode()) {
-+		debug("FIPS mode initialized");
++		logit("FIPS mode initialized");
 +	}
 +
  	/*
@@ -325,6 +358,35 @@ diff -up openssh-8.0p1/sshconnect2.c.fips openssh-8.0p1/sshconnect2.c
  #include "openbsd-compat/sys-queue.h"
  
  #include "xmalloc.h"
+@@ -115,7 +117,8 @@ order_hostkeyalgs(char *host, struct soc
+ 	for (i = 0; i < options.num_system_hostfiles; i++)
+ 		load_hostkeys(hostkeys, hostname, options.system_hostfiles[i]);
+ 
+-	oavail = avail = xstrdup(KEX_DEFAULT_PK_ALG);
++	oavail = avail = xstrdup((FIPS_mode()
++	    ? KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG));
+ 	maxlen = strlen(avail) + 1;
+ 	first = xmalloc(maxlen);
+ 	last = xmalloc(maxlen);
+@@ -182,14 +185,16 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ 	if (options.hostkeyalgorithms != NULL) {
+ 		all_key = sshkey_alg_list(0, 0, 1, ',');
+ 		if (kex_assemble_names(&options.hostkeyalgorithms,
+-		    KEX_DEFAULT_PK_ALG, all_key) != 0)
++		    (FIPS_mode() ? KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG),
++		    all_key) != 0)
+ 			fatal("%s: kex_assemble_namelist", __func__);
+ 		free(all_key);
+ 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
+ 		    compat_pkalg_proposal(options.hostkeyalgorithms);
+ 	} else {
+ 		/* Enforce default */
+-		options.hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG);
++		options.hostkeyalgorithms = xstrdup((FIPS_mode()
++		    ? KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG));
+ 		/* Prefer algorithms that we already have keys for */
+ 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
+ 		    compat_pkalg_proposal(
 @@ -198,29 +203,34 @@ ssh_kex2(struct ssh *ssh, char *host, st
  
  #if defined(GSSAPI) && defined(WITH_OPENSSL)
@@ -427,7 +489,7 @@ diff -up openssh-8.0p1/sshd.c.fips openssh-8.0p1/sshd.c
  	log_init(__progname, options.log_level, options.log_facility, log_stderr);
  
 +	if (FIPS_mode()) {
-+		debug("FIPS mode initialized");
++		logit("FIPS mode initialized");
 +	}
 +
  	/* Chdir to the root directory so that the current disk can be
@@ -468,9 +530,9 @@ diff -up openssh-8.0p1/sshkey.c.fips openssh-8.0p1/sshkey.c
  #include "sshkey.h"
  #include "match.h"
 +#include "log.h"
- #include "ssh-sk.h"
  
  #ifdef WITH_XMSS
+ #include "sshkey-xmss.h"
 @@ -1591,6 +1593,8 @@ rsa_generate_private_key(u_int bits, RSA
  	}
  	if (!BN_set_word(f4, RSA_F4) ||

openssh-7.7p1-redhat.patch

@@ -1,7 +1,7 @@
-diff -up openssh/ssh_config.redhat openssh/ssh_config
+diff -up openssh-7.7p1/ssh_config.redhat openssh-7.7p1/ssh_config
---- openssh/ssh_config.redhat	2020-02-11 23:28:35.000000000 +0100
+--- openssh-7.7p1/ssh_config.redhat	2018-04-02 07:38:28.000000000 +0200
-+++ openssh/ssh_config	2020-02-13 18:13:39.180641839 +0100
++++ openssh-7.7p1/ssh_config	2018-07-03 10:44:06.522245125 +0200
-@@ -43,3 +43,7 @@
+@@ -44,3 +44,7 @@
  #   VisualHostKey no
  #   ProxyCommand ssh -q -W %h:%p gateway.example.com
  #   RekeyLimit 1G 1h
@@ -9,9 +9,9 @@ diff -up openssh/ssh_config.redhat openssh/ssh_config
 +# To modify the system-wide ssh configuration, create a  *.conf  file under
 +#  /etc/ssh/ssh_config.d/  which will be automatically included below
 +Include /etc/ssh/ssh_config.d/*.conf
-diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
+diff -up openssh-7.7p1/ssh_config_redhat.redhat openssh-7.7p1/ssh_config_redhat
---- openssh/ssh_config_redhat.redhat	2020-02-13 18:13:39.180641839 +0100
+--- openssh-7.7p1/ssh_config_redhat.redhat	2018-07-03 10:44:06.522245125 +0200
-+++ openssh/ssh_config_redhat	2020-02-13 18:13:39.180641839 +0100
++++ openssh-7.7p1/ssh_config_redhat	2018-07-03 10:44:06.522245125 +0200
 @@ -0,0 +1,21 @@
 +# The options here are in the "Match final block" to be applied as the last
 +# options and could be potentially overwritten by the user configuration
@@ -34,10 +34,11 @@ diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
 +
 +# Uncomment this if you want to use .local domain
 +# Host *.local
-diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
++#   CheckHostIP no
---- openssh/sshd_config.0.redhat	2020-02-12 14:30:04.000000000 +0100
+diff -up openssh-7.7p1/sshd_config.0.redhat openssh-7.7p1/sshd_config.0
-+++ openssh/sshd_config.0	2020-02-13 18:13:39.181641855 +0100
+--- openssh-7.7p1/sshd_config.0.redhat	2018-04-02 07:39:27.000000000 +0200
-@@ -970,9 +970,9 @@ DESCRIPTION
++++ openssh-7.7p1/sshd_config.0	2018-07-03 10:44:06.523245133 +0200
+@@ -872,9 +872,9 @@ DESCRIPTION
  
       SyslogFacility
               Gives the facility code that is used when logging messages from
@@ -50,10 +51,10 @@ diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
  
       TCPKeepAlive
               Specifies whether the system should send TCP keepalive messages
-diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
+diff -up openssh-7.7p1/sshd_config.5.redhat openssh-7.7p1/sshd_config.5
---- openssh/sshd_config.5.redhat	2020-02-11 23:28:35.000000000 +0100
+--- openssh-7.7p1/sshd_config.5.redhat	2018-04-02 07:38:28.000000000 +0200
-+++ openssh/sshd_config.5	2020-02-13 18:13:39.181641855 +0100
++++ openssh-7.7p1/sshd_config.5	2018-07-03 10:44:06.523245133 +0200
-@@ -1614,7 +1614,7 @@ By default no subsystems are defined.
+@@ -1461,7 +1461,7 @@ By default no subsystems are defined.
  .It Cm SyslogFacility
  Gives the facility code that is used when logging messages from
  .Xr sshd 8 .
@@ -62,10 +63,10 @@ diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
  LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
  The default is AUTH.
  .It Cm TCPKeepAlive
-diff -up openssh/sshd_config.redhat openssh/sshd_config
+diff -up openssh-7.7p1/sshd_config.redhat openssh-7.7p1/sshd_config
---- openssh/sshd_config.redhat	2020-02-11 23:28:35.000000000 +0100
+--- openssh-7.7p1/sshd_config.redhat	2018-04-02 07:38:28.000000000 +0200
-+++ openssh/sshd_config	2020-02-13 18:20:16.349913681 +0100
++++ openssh-7.7p1/sshd_config	2018-07-03 10:45:16.950782466 +0200
-@@ -10,6 +10,10 @@
+@@ -10,20 +10,34 @@
  # possible, but leave them commented.  Uncommented options override the
  # default value.
  
@@ -76,18 +77,18 @@ diff -up openssh/sshd_config.redhat openssh/sshd_config
  #Port 22
  #AddressFamily any
  #ListenAddress 0.0.0.0
-@@ -114,3 +118,7 @@ Subsystem	sftp	/usr/libexec/sftp-server
+ #ListenAddress ::
- #	AllowTcpForwarding no
+ 
- #	PermitTTY no
+-#HostKey /etc/ssh/ssh_host_rsa_key
- #	ForceCommand cvs server
+-#HostKey /etc/ssh/ssh_host_ecdsa_key
-+
+-#HostKey /etc/ssh/ssh_host_ed25519_key
-+# To modify the system-wide ssh configuration, create a  *.conf  file under
++HostKey /etc/ssh/ssh_host_rsa_key
-+#  /etc/ssh/sshd_config.d/  which will be automatically included below
++HostKey /etc/ssh/ssh_host_ecdsa_key
-+Include /etc/ssh/sshd_config.d/*.conf
++HostKey /etc/ssh/ssh_host_ed25519_key
-diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
+ 
---- openssh/sshd_config_redhat.redhat	2020-02-13 18:14:02.268006439 +0100
+ # Ciphers and keying
-+++ openssh/sshd_config_redhat	2020-02-13 18:19:20.765035947 +0100
+ #RekeyLimit default none
-@@ -0,0 +1,31 @@
+ 
 +# System-wide Crypto policy:
 +# This system is following system-wide crypto policy. The changes to
 +# Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any
@@ -97,25 +98,69 @@ diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
 +# variable in  /etc/sysconfig/sshd  to overwrite the policy.
 +# For more information, see manual page for update-crypto-policies(8).
 +
+ # Logging
+ #SyslogFacility AUTH
 +SyslogFacility AUTHPRIV
-+
+ #LogLevel INFO
+ 
+ # Authentication:
+@@ -56,9 +70,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ # To disable tunneled clear text passwords, change to no here!
+ #PasswordAuthentication yes
+ #PermitEmptyPasswords no
 +PasswordAuthentication yes
+ 
+ # Change to no to disable s/key passwords
+ #ChallengeResponseAuthentication yes
 +ChallengeResponseAuthentication no
-+
+ 
+ # Kerberos options
+ #KerberosAuthentication no
+@@ -67,8 +83,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ #KerberosGetAFSToken no
+ 
+ # GSSAPI options
+-#GSSAPIAuthentication no
+-#GSSAPICleanupCredentials yes
 +GSSAPIAuthentication yes
 +GSSAPICleanupCredentials no
-+
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing,
+ # and session processing. If this is enabled, PAM authentication will
+@@ -79,16 +95,20 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ # If you just want the PAM account and session checks to run without
+ # PAM authentication, then enable this but set PasswordAuthentication
+ # and ChallengeResponseAuthentication to 'no'.
+-#UsePAM no
 +UsePAM yes
-+
+ 
+ #AllowAgentForwarding yes
+ #AllowTcpForwarding yes
+ #GatewayPorts no
+-#X11Forwarding no
 +X11Forwarding yes
+ #X11DisplayOffset 10
+ #X11UseLocalhost yes
+ #PermitTTY yes
+-#PrintMotd yes
 +
 +# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
 +# as it is more configurable and versatile than the built-in version.
 +PrintMotd no
 +
+ #PrintLastLog yes
+ #TCPKeepAlive yes
+ #PermitUserEnvironment no
+@@ -106,6 +126,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ # no default banner path
+ #Banner none
+ 
 +# Accept locale-related environment variables
 +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
 +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
 +AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
 +AcceptEnv XMODIFIERS
 +
+ # override default of no subsystems
+ Subsystem	sftp	/usr/libexec/sftp-server
+ 

openssh-7.8p1-UsePAM-warning.patch

@@ -3,7 +3,7 @@ diff --git a/sshd.c b/sshd.c
 +++ b/sshd.c
 @@ -1701,6 +1701,10 @@ main(int ac, char **av)
  	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL);
+ 	    cfg, NULL);
  
 +	/* 'UsePAM no' is not supported in Fedora */
 +	if (! options.use_pam)
@@ -21,6 +21,6 @@ diff --git a/sshd_config b/sshd_config
  # and ChallengeResponseAuthentication to 'no'.
 +# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
 +# problems.
- #UsePAM no
+ UsePAM yes
  
  #AllowAgentForwarding yes

openssh-7.8p1-role-mls.patch

@@ -339,7 +339,7 @@ diff -up openssh/monitor_wrap.h.role-mls openssh/monitor_wrap.h
 +++ openssh/monitor_wrap.h	2018-08-22 11:22:10.439929513 +0200
 @@ -44,6 +44,9 @@ DH *mm_choose_dh(int, int, int);
  int mm_sshkey_sign(struct ssh *, struct sshkey *, u_char **, size_t *,
-     const u_char *, size_t, const char *, const char *, u_int compat);
+     const u_char *, size_t, const char *, u_int compat);
  void mm_inform_authserv(char *, char *);
 +#ifdef WITH_SELINUX
 +void mm_inform_authrole(char *);
@@ -359,7 +359,7 @@ diff -up openssh/openbsd-compat/Makefile.in.role-mls openssh/openbsd-compat/Make
 +	port-linux-sshd.o
  
  .c.o:
- 	$(CC) $(CFLAGS_NOPIE) $(PICFLAG) $(CPPFLAGS) -c $<
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
 diff -up openssh/openbsd-compat/port-linux.c.role-mls openssh/openbsd-compat/port-linux.c
 --- openssh/openbsd-compat/port-linux.c.role-mls	2018-08-20 07:57:29.000000000 +0200
 +++ openssh/openbsd-compat/port-linux.c	2018-08-22 11:14:56.819430949 +0200

openssh-8.0p1-crypto-policies.patch

@@ -1,29 +1,7 @@
-diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
+diff -up openssh-8.0p1/ssh_config.5.crypto-policies openssh-8.0p1/ssh_config.5
---- openssh/ssh_config.5.crypto-policies	2020-02-07 15:05:55.665451715 +0100
+--- openssh-8.0p1/ssh_config.5.crypto-policies	2019-05-13 14:04:01.999099570 +0200
-+++ openssh/ssh_config.5	2020-02-07 15:07:11.632641922 +0100
++++ openssh-8.0p1/ssh_config.5	2019-05-13 14:12:36.343923071 +0200
-@@ -361,15 +361,15 @@ domains.
+@@ -445,12 +445,10 @@ aes256-gcm@openssh.com
- .It Cm CASignatureAlgorithms
- Specifies which algorithms are allowed for signing of certificates
- by certificate authorities (CAs).
--The default is:
--.Bd -literal -offset indent
--ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
--ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
--.Ed
--.Pp
- .Xr ssh 1
- will not accept host certificates signed using algorithms other than those
- specified.
-+.Pp
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- .It Cm CertificateFile
- Specifies a file from which the user's certificate is read.
- A corresponding private key must be provided separately in order
-@@ -453,12 +453,10 @@ aes256-gcm@openssh.com
  chacha20-poly1305@openssh.com
  .Ed
  .Pp
@@ -40,7 +18,7 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
  .Pp
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
-@@ -824,8 +822,10 @@ gss-nistp256-sha256-,
+@@ -812,8 +810,10 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -53,7 +31,7 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
  This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HashKnownHosts
  Indicates that
-@@ -1162,15 +1162,10 @@ If the specified list begins with a
+@@ -1123,16 +1123,10 @@ If the specified value begins with a
  .Sq ^
  character, then the specified methods will be placed at the head of the
  default set.
@@ -64,7 +42,8 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
 -diffie-hellman-group-exchange-sha256,
 -diffie-hellman-group16-sha512,
 -diffie-hellman-group18-sha512,
--diffie-hellman-group14-sha256
+-diffie-hellman-group14-sha256,
+-diffie-hellman-group14-sha1
 -.Ed
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
@@ -73,7 +52,7 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
  .Pp
  The list of available key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
-@@ -1252,14 +1247,10 @@ The algorithms that contain
+@@ -1210,14 +1204,10 @@ The algorithms that contain
  calculate the MAC after encryption (encrypt-then-mac).
  These are considered safer and their use recommended.
  .Pp
@@ -92,7 +71,7 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
  .Pp
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
-@@ -1407,22 +1398,10 @@ If the specified list begins with a
+@@ -1361,17 +1351,10 @@ If the specified value begins with a
  .Sq ^
  character, then the specified key types will be placed at the head of the
  default set.
@@ -101,16 +80,11 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
 -ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -ecdsa-sha2-nistp384-cert-v01@openssh.com,
 -ecdsa-sha2-nistp521-cert-v01@openssh.com,
--sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -ssh-ed25519-cert-v01@openssh.com,
--sk-ssh-ed25519-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
--rsa-sha2-512-cert-v01@openssh.com,
--rsa-sha2-256-cert-v01@openssh.com,
 -ssh-rsa-cert-v01@openssh.com,
 -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
--sk-ecdsa-sha2-nistp256@openssh.com,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
--ssh-ed25519,sk-ssh-ed25519@openssh.com,
--rsa-sha2-512,rsa-sha2-256,ssh-rsa
 -.Ed
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
@@ -118,32 +92,11 @@ diff -up openssh/ssh_config.5.crypto-policies openssh/ssh_config.5
 +.Xr update-crypto-policies 8 .
  .Pp
  The list of available key types may also be obtained using
- .Qq ssh -Q PubkeyAcceptedKeyTypes .
+ .Qq ssh -Q key .
-diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
+diff -up openssh-8.0p1/sshd_config.5.crypto-policies openssh-8.0p1/sshd_config.5
---- openssh/sshd_config.5.crypto-policies	2020-02-07 15:05:55.639451308 +0100
+--- openssh-8.0p1/sshd_config.5.crypto-policies	2019-05-13 14:12:41.226968863 +0200
-+++ openssh/sshd_config.5	2020-02-07 15:05:55.672451825 +0100
++++ openssh-8.0p1/sshd_config.5	2019-05-13 14:15:14.581406997 +0200
-@@ -377,14 +377,14 @@ By default, no banner is displayed.
+@@ -490,12 +490,10 @@ aes256-gcm@openssh.com
- .It Cm CASignatureAlgorithms
- Specifies which algorithms are allowed for signing of certificates
- by certificate authorities (CAs).
--The default is:
--.Bd -literal -offset indent
--ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
--ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
--.Ed
--.Pp
- Certificates signed using other algorithms will not be accepted for
- public key or host-based authentication.
-+.Pp
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- .It Cm ChallengeResponseAuthentication
- Specifies whether challenge-response authentication is allowed (e.g. via
- PAM or through authentication styles supported in
-@@ -486,12 +486,10 @@ aes256-gcm@openssh.com
  chacha20-poly1305@openssh.com
  .El
  .Pp
@@ -160,7 +113,7 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
  .Pp
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
-@@ -693,8 +691,10 @@ gss-nistp256-sha256-,
+@@ -700,8 +698,10 @@ gss-nistp256-sha256-,
  gss-curve25519-sha256-
  .Ed
  .Pp
@@ -173,7 +126,7 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
  This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HostbasedAcceptedKeyTypes
  Specifies the key types that will be accepted for hostbased authentication
-@@ -794,22 +794,10 @@ environment variable.
+@@ -792,17 +792,10 @@ environment variable.
  .It Cm HostKeyAlgorithms
  Specifies the host key algorithms
  that the server offers.
@@ -182,16 +135,11 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
 -ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -ecdsa-sha2-nistp384-cert-v01@openssh.com,
 -ecdsa-sha2-nistp521-cert-v01@openssh.com,
--sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -ssh-ed25519-cert-v01@openssh.com,
--sk-ssh-ed25519-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
--rsa-sha2-512-cert-v01@openssh.com,
--rsa-sha2-256-cert-v01@openssh.com,
 -ssh-rsa-cert-v01@openssh.com,
 -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
--sk-ecdsa-sha2-nistp256@openssh.com,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
--ssh-ed25519,sk-ssh-ed25519@openssh.com,
--rsa-sha2-512,rsa-sha2-256,ssh-rsa
 -.Ed
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
@@ -199,9 +147,9 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
 +.Xr update-crypto-policies 8 .
  .Pp
  The list of available key types may also be obtained using
- .Qq ssh -Q HostKeyAlgorithms .
+ .Qq ssh -Q key .
-@@ -987,14 +975,10 @@ ecdh-sha2-nistp521
+@@ -960,14 +953,10 @@ ecdh-sha2-nistp384
- sntrup4591761x25519-sha512@tinyssh.org
+ ecdh-sha2-nistp521
  .El
  .Pp
 -The default is:
@@ -210,7 +158,7 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
 -diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
--diffie-hellman-group14-sha256
+-diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
 -.Ed
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
@@ -218,8 +166,8 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
 +.Xr update-crypto-policies 8 .
  .Pp
  The list of available key exchange algorithms may also be obtained using
- .Qq ssh -Q KexAlgorithms .
+ .Qq ssh -Q kex .
-@@ -1121,14 +1105,10 @@ umac-64-etm@openssh.com
+@@ -1090,14 +1079,10 @@ umac-64-etm@openssh.com
  umac-128-etm@openssh.com
  .El
  .Pp
@@ -238,7 +186,7 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
  .Pp
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
-@@ -1492,22 +1472,10 @@ If the specified list begins with a
+@@ -1455,17 +1440,10 @@ If the specified value begins with a
  .Sq ^
  character, then the specified key types will be placed at the head of the
  default set.
@@ -247,16 +195,11 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
 -ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -ecdsa-sha2-nistp384-cert-v01@openssh.com,
 -ecdsa-sha2-nistp521-cert-v01@openssh.com,
--sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -ssh-ed25519-cert-v01@openssh.com,
--sk-ssh-ed25519-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
--rsa-sha2-512-cert-v01@openssh.com,
--rsa-sha2-256-cert-v01@openssh.com,
 -ssh-rsa-cert-v01@openssh.com,
 -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
--sk-ecdsa-sha2-nistp256@openssh.com,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
--ssh-ed25519,sk-ssh-ed25519@openssh.com,
--rsa-sha2-512,rsa-sha2-256,ssh-rsa
 -.Ed
 +The default is handled system-wide by
 +.Xr crypto-policies 7 .
@@ -264,4 +207,4 @@ diff -up openssh/sshd_config.5.crypto-policies openssh/sshd_config.5
 +.Xr update-crypto-policies 8 .
  .Pp
  The list of available key types may also be obtained using
- .Qq ssh -Q PubkeyAcceptedKeyTypes .
+ .Qq ssh -Q key .

openssh-8.0p1-gssapi-keyex.patch

@@ -1,29 +1,29 @@
 diff --git a/Makefile.in b/Makefile.in
-index e7549470..b68c1710 100644
+index 6f001bb3..c31821ac 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -100,6 +100,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
  	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
  	kexgexc.o kexgexs.o \
  	sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
 +	kexgssc.o \
- 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
+ 	platform-pledge.o platform-tracing.o platform-misc.o
- 	sshbuf-io.o
  
-@@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
+ 
+@@ -114,7 +115,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
  	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
  	auth2-none.o auth2-passwd.o auth2-pubkey.o \
  	monitor.o monitor_wrap.o auth-krb5.o \
 -	auth2-gss.o gss-serv.o gss-serv-krb5.o \
 +	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
  	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
- 	sftp-server.o sftp-common.o \
+ 	sftp-server.o sftp-common.o sftp-realpath.o \
  	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
 diff --git a/auth.c b/auth.c
-index 086b8ebb..687c57b4 100644
+index 332b6220..7664aaac 100644
 --- a/auth.c
 +++ b/auth.c
-@@ -400,7 +400,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
+@@ -399,7 +399,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
  	case PERMIT_NO_PASSWD:
  		if (strcmp(method, "publickey") == 0 ||
  		    strcmp(method, "hostbased") == 0 ||
@@ -33,7 +33,7 @@ index 086b8ebb..687c57b4 100644
  			return 1;
  		break;
  	case PERMIT_FORCED_ONLY:
-@@ -724,99 +725,6 @@ fakepw(void)
+@@ -723,99 +724,6 @@ fakepw(void)
  	return (&fake);
  }
  
@@ -62,7 +62,7 @@ index 086b8ebb..687c57b4 100644
 -	if (getpeername(ssh_packet_get_connection_in(ssh),
 -	    (struct sockaddr *)&from, &fromlen) == -1) {
 -		debug("getpeername failed: %.100s", strerror(errno));
--		return xstrdup(ntop);
+-		return strdup(ntop);
 -	}
 -
 -	ipv64_normalise_mapped(&from, &fromlen);
@@ -74,7 +74,7 @@ index 086b8ebb..687c57b4 100644
 -	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
 -	    NULL, 0, NI_NAMEREQD) != 0) {
 -		/* Host name not found.  Use ip address. */
--		return xstrdup(ntop);
+-		return strdup(ntop);
 -	}
 -
 -	/*
@@ -89,7 +89,7 @@ index 086b8ebb..687c57b4 100644
 -		logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
 -		    name, ntop);
 -		freeaddrinfo(ai);
--		return xstrdup(ntop);
+-		return strdup(ntop);
 -	}
 -
 -	/* Names are stored in lowercase. */
@@ -110,7 +110,7 @@ index 086b8ebb..687c57b4 100644
 -	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
 -		logit("reverse mapping checking getaddrinfo for %.700s "
 -		    "[%s] failed.", name, ntop);
--		return xstrdup(ntop);
+-		return strdup(ntop);
 -	}
 -	/* Look for the address from the list of addresses. */
 -	for (ai = aitop; ai; ai = ai->ai_next) {
@@ -125,9 +125,9 @@ index 086b8ebb..687c57b4 100644
 -		/* Address not found for the host name. */
 -		logit("Address %.100s maps to %.600s, but this does not "
 -		    "map back to the address.", ntop, name);
--		return xstrdup(ntop);
+-		return strdup(ntop);
 -	}
--	return xstrdup(name);
+-	return strdup(name);
 -}
 -
  /*
@@ -229,10 +229,10 @@ index 9351e042..d6446c0c 100644
  	"gssapi-with-mic",
  	userauth_gssapi,
 diff --git a/auth2.c b/auth2.c
-index 0e776224..1c217268 100644
+index 16ae1a36..7417eafa 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -73,6 +73,7 @@ extern Authmethod method_passwd;
+@@ -75,6 +75,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -240,7 +240,7 @@ index 0e776224..1c217268 100644
  extern Authmethod method_gssapi;
  #endif
  
-@@ -80,6 +81,7 @@ Authmethod *authmethods[] = {
+@@ -82,6 +83,7 @@ Authmethod *authmethods[] = {
  	&method_none,
  	&method_pubkey,
  #ifdef GSSAPI
@@ -249,7 +249,7 @@ index 0e776224..1c217268 100644
  #endif
  	&method_passwd,
 diff --git a/canohost.c b/canohost.c
-index abea9c6e..8e81b519 100644
+index f71a0856..404731d2 100644
 --- a/canohost.c
 +++ b/canohost.c
 @@ -35,6 +35,99 @@
@@ -281,7 +281,7 @@ index abea9c6e..8e81b519 100644
 +	if (getpeername(ssh_packet_get_connection_in(ssh),
 +	    (struct sockaddr *)&from, &fromlen) == -1) {
 +		debug("getpeername failed: %.100s", strerror(errno));
-+		return xstrdup(ntop);
++		return strdup(ntop);
 +	}
 +
 +	ipv64_normalise_mapped(&from, &fromlen);
@@ -293,7 +293,7 @@ index abea9c6e..8e81b519 100644
 +	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
 +	    NULL, 0, NI_NAMEREQD) != 0) {
 +		/* Host name not found.  Use ip address. */
-+		return xstrdup(ntop);
++		return strdup(ntop);
 +	}
 +
 +	/*
@@ -308,7 +308,7 @@ index abea9c6e..8e81b519 100644
 +		logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
 +		    name, ntop);
 +		freeaddrinfo(ai);
-+		return xstrdup(ntop);
++		return strdup(ntop);
 +	}
 +
 +	/* Names are stored in lowercase. */
@@ -329,7 +329,7 @@ index abea9c6e..8e81b519 100644
 +	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
 +		logit("reverse mapping checking getaddrinfo for %.700s "
 +		    "[%s] failed.", name, ntop);
-+		return xstrdup(ntop);
++		return strdup(ntop);
 +	}
 +	/* Look for the address from the list of addresses. */
 +	for (ai = aitop; ai; ai = ai->ai_next) {
@@ -344,9 +344,9 @@ index abea9c6e..8e81b519 100644
 +		/* Address not found for the host name. */
 +		logit("Address %.100s maps to %.600s, but this does not "
 +		    "map back to the address.", ntop, name);
-+		return xstrdup(ntop);
++		return strdup(ntop);
 +	}
-+	return xstrdup(name);
++	return strdup(name);
 +}
 +
  void
@@ -367,7 +367,7 @@ index 26d62855..0cadc9f1 100644
  int		 get_peer_port(int);
  char		*get_local_ipaddr(int);
 diff --git a/clientloop.c b/clientloop.c
-index ebd0dbca..1bdac6a4 100644
+index 521467bd..a0578e9d 100644
 --- a/clientloop.c
 +++ b/clientloop.c
 @@ -112,6 +112,10 @@
@@ -381,7 +381,7 @@ index ebd0dbca..1bdac6a4 100644
  /* import options */
  extern Options options;
  
-@@ -1379,9 +1383,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
+@@ -1374,9 +1378,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
  			break;
  
  		/* Do channel operations unless rekeying in progress. */
@@ -402,10 +402,10 @@ index ebd0dbca..1bdac6a4 100644
  		client_process_net_input(ssh, readset);
  
 diff --git a/configure.ac b/configure.ac
-index b689db4b..efafb6bd 100644
+index 30be6c18..2869f704 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -674,6 +674,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+@@ -665,6 +665,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
  	    [Use tunnel device compatibility to OpenBSD])
  	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
  	    [Prepend the address family to IP tunnel traffic])
@@ -437,7 +437,7 @@ index b689db4b..efafb6bd 100644
  	AC_CHECK_DECL([AU_IPv4], [],
  	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 diff --git a/gss-genr.c b/gss-genr.c
-index d56257b4..763a63ff 100644
+index d56257b4..3eaa5fa5 100644
 --- a/gss-genr.c
 +++ b/gss-genr.c
 @@ -1,7 +1,7 @@
@@ -486,7 +486,7 @@ index d56257b4..763a63ff 100644
  /* sshbuf_get for gss_buffer_desc */
  int
  ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
-@@ -62,6 +86,162 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
+@@ -62,6 +86,161 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
  	return 0;
  }
  
@@ -530,8 +530,7 @@ index d56257b4..763a63ff 100644
 +    const char *host, const char *client, const char *kex) {
 +	struct sshbuf *buf = NULL;
 +	size_t i;
-+	int r = SSH_ERR_ALLOC_FAIL;
++	int r, oidpos, enclen;
-+	int oidpos, enclen;
 +	char *mechs, *encoded;
 +	u_char digest[SSH_DIGEST_MAX_LENGTH];
 +	char deroid[2];
@@ -649,7 +648,7 @@ index d56257b4..763a63ff 100644
  /* Check that the OID in a data stream matches that in the context */
  int
  ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -218,7 +398,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
+@@ -218,7 +397,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
  	}
  
  	ctx->major = gss_init_sec_context(&ctx->minor,
@@ -658,7 +657,7 @@ index d56257b4..763a63ff 100644
  	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
  	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -247,9 +427,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
+@@ -247,9 +426,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
  	return (ctx->major);
  }
  
@@ -702,7 +701,7 @@ index d56257b4..763a63ff 100644
  	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
  	    GSS_C_QOP_DEFAULT, buffer, hash)))
  		ssh_gssapi_error(ctx);
-@@ -257,6 +471,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
+@@ -257,6 +470,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
  	return (ctx->major);
  }
  
@@ -722,7 +721,7 @@ index d56257b4..763a63ff 100644
  void
  ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
      const char *context)
-@@ -273,11 +500,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
+@@ -273,11 +499,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
  }
  
  int
@@ -740,7 +739,7 @@ index d56257b4..763a63ff 100644
  
  	/* RFC 4462 says we MUST NOT do SPNEGO */
  	if (oid->length == spnego_oid.length && 
-@@ -287,6 +519,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -287,6 +518,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
  	ssh_gssapi_build_ctx(ctx);
  	ssh_gssapi_set_oid(*ctx, oid);
  	major = ssh_gssapi_import_name(*ctx, host);
@@ -751,7 +750,7 @@ index d56257b4..763a63ff 100644
  	if (!GSS_ERROR(major)) {
  		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
  		    NULL);
-@@ -296,10 +532,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -296,10 +531,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
  			    GSS_C_NO_BUFFER);
  	}
  
@@ -1260,10 +1259,10 @@ index ab3a15f0..6ce56e92 100644
  
  /* Privileged */
 diff --git a/kex.c b/kex.c
-index ce85f043..574c7609 100644
+index 34808b5c..a2a4794e 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -57,11 +57,16 @@
+@@ -55,11 +55,16 @@
  #include "misc.h"
  #include "dispatch.h"
  #include "monitor.h"
@@ -1280,7 +1279,7 @@ index ce85f043..574c7609 100644
  /* prototype */
  static int kex_choose_conf(struct ssh *);
  static int kex_input_newkeys(int, u_int32_t, struct ssh *);
-@@ -115,15 +120,28 @@ static const struct kexalg kexalgs[] = {
+@@ -113,15 +118,28 @@ static const struct kexalg kexalgs[] = {
  #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
  	{ NULL, 0, -1, -1},
  };
@@ -1312,7 +1311,7 @@ index ce85f043..574c7609 100644
  		if (ret != NULL)
  			ret[rlen++] = sep;
  		nlen = strlen(k->name);
-@@ -138,6 +156,18 @@ kex_alg_list(char sep)
+@@ -136,6 +154,18 @@ kex_alg_list(char sep)
  	return ret;
  }
  
@@ -1331,7 +1330,7 @@ index ce85f043..574c7609 100644
  static const struct kexalg *
  kex_alg_by_name(const char *name)
  {
-@@ -147,6 +177,10 @@ kex_alg_by_name(const char *name)
+@@ -145,6 +175,10 @@ kex_alg_by_name(const char *name)
  		if (strcmp(k->name, name) == 0)
  			return k;
  	}
@@ -1342,7 +1341,7 @@ index ce85f043..574c7609 100644
  	return NULL;
  }
  
-@@ -315,6 +349,29 @@ kex_assemble_names(char **listp, const char *def, const char *all)
+@@ -301,6 +335,29 @@ kex_assemble_names(char **listp, const char *def, const char *all)
  	return r;
  }
  
@@ -1372,7 +1371,7 @@ index ce85f043..574c7609 100644
  /* put algorithm proposal into buffer */
  int
  kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX])
-@@ -698,6 +755,9 @@ kex_free(struct kex *kex)
+@@ -657,6 +714,9 @@ kex_free(struct kex *kex)
  	sshbuf_free(kex->server_version);
  	sshbuf_free(kex->client_pub);
  	free(kex->session_id);
@@ -1383,10 +1382,10 @@ index ce85f043..574c7609 100644
  	free(kex->hostkey_alg);
  	free(kex->name);
 diff --git a/kex.h b/kex.h
-index a5ae6ac0..fe714141 100644
+index 6d446d1c..f95dc02c 100644
 --- a/kex.h
 +++ b/kex.h
-@@ -102,6 +102,15 @@ enum kex_exchange {
+@@ -103,6 +103,15 @@ enum kex_exchange {
  	KEX_ECDH_SHA2,
  	KEX_C25519_SHA256,
  	KEX_KEM_SNTRUP4591761X25519_SHA512,
@@ -1402,7 +1401,7 @@ index a5ae6ac0..fe714141 100644
  	KEX_MAX
  };
  
-@@ -153,6 +162,12 @@ struct kex {
+@@ -154,6 +163,12 @@ struct kex {
  	u_int	flags;
  	int	hash_alg;
  	int	ec_nid;
@@ -1415,7 +1414,7 @@ index a5ae6ac0..fe714141 100644
  	char	*failed_choice;
  	int	(*verify_host_key)(struct sshkey *, struct ssh *);
  	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
-@@ -174,8 +189,10 @@ struct kex {
+@@ -175,8 +190,10 @@ struct kex {
  
  int	 kex_names_valid(const char *);
  char	*kex_alg_list(char);
@@ -1426,11 +1425,11 @@ index a5ae6ac0..fe714141 100644
  
  int	 kex_exchange_identification(struct ssh *, int, const char *);
  
-@@ -202,6 +219,12 @@ int	 kexgex_client(struct ssh *);
+@@ -203,6 +220,12 @@ int	 kexgex_client(struct ssh *);
  int	 kexgex_server(struct ssh *);
  int	 kex_gen_client(struct ssh *);
  int	 kex_gen_server(struct ssh *);
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
++#ifdef GSSAPI
 +int	 kexgssgex_client(struct ssh *);
 +int	 kexgssgex_server(struct ssh *);
 +int	 kexgss_client(struct ssh *);
@@ -1439,7 +1438,7 @@ index a5ae6ac0..fe714141 100644
  
  int	 kex_dh_keypair(struct kex *);
  int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
-@@ -234,6 +257,12 @@ int	 kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
+@@ -235,6 +258,12 @@ int	 kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
      const BIGNUM *, const u_char *, size_t,
      u_char *, size_t *);
  
@@ -1481,10 +1480,10 @@ index 67133e33..edaa4676 100644
  		break;
  	case KEX_DH_GRP18_SHA512:
 diff --git a/kexgen.c b/kexgen.c
-index 69348b96..c0e8c2f4 100644
+index 2abbb9ef..569dc83f 100644
 --- a/kexgen.c
 +++ b/kexgen.c
-@@ -44,7 +44,7 @@
+@@ -43,7 +43,7 @@
  static int input_kex_gen_init(int, u_int32_t, struct ssh *);
  static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
  
@@ -1495,10 +1494,10 @@ index 69348b96..c0e8c2f4 100644
      const struct sshbuf *client_version,
 diff --git a/kexgssc.c b/kexgssc.c
 new file mode 100644
-index 00000000..f6e1405e
+index 00000000..0b2f6a56
 --- /dev/null
 +++ b/kexgssc.c
-@@ -0,0 +1,606 @@
+@@ -0,0 +1,595 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1560,7 +1559,7 @@ index 00000000..f6e1405e
 +	struct sshbuf *server_blob = NULL;
 +	struct sshbuf *shared_secret = NULL;
 +	struct sshbuf *server_host_key_blob = NULL;
-+	struct sshbuf *empty = NULL;
++	struct sshbuf *empty = sshbuf_new();
 +	u_char *msg;
 +	int type = 0;
 +	int first = 1;
@@ -1768,11 +1767,6 @@ index 00000000..f6e1405e
 +	if (r != 0)
 +		goto out;
 +
-+	if ((empty = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+
 +	hashlen = sizeof(hash);
 +	if ((r = kex_gen_hash(
 +	    kex->hash_alg,
@@ -1842,7 +1836,7 @@ index 00000000..f6e1405e
 +	size_t hashlen;
 +	const BIGNUM *pub_key, *dh_p, *dh_g;
 +	int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
-+	struct sshbuf *empty = NULL;
++	struct sshbuf *empty = sshbuf_new();
 +	u_char c;
 +	int r;
 +
@@ -2034,7 +2028,6 @@ index 00000000..f6e1405e
 +	    (r = sshbuf_get_bignum2(buf, &dh_server_pub)) != 0)
 +		goto out;
 +	sshbuf_free(buf);
-+	buf = NULL;
 +
 +	if ((shared_secret = sshbuf_new()) == NULL) {
 +		r = SSH_ERR_ALLOC_FAIL;
@@ -2043,10 +2036,6 @@ index 00000000..f6e1405e
 +
 +	if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0)
 +		goto out;
-+	if ((empty = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
 +
 +	DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
 +	hashlen = sizeof(hash);
@@ -2093,7 +2082,6 @@ index 00000000..f6e1405e
 +	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
 +		r = kex_send_newkeys(ssh);
 +out:
-+	sshbuf_free(buf);
 +	sshbuf_free(server_blob);
 +	sshbuf_free(empty);
 +	explicit_bzero(hash, sizeof(hash));
@@ -2586,10 +2574,10 @@ index 00000000..60bc02de
 +}
 +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
 diff --git a/monitor.c b/monitor.c
-index 2ce89fe9..ebf76c7f 100644
+index 60e52944..669cdb4a 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -148,6 +148,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
+@@ -147,6 +147,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
  int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
  int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
  int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
@@ -2598,7 +2586,7 @@ index 2ce89fe9..ebf76c7f 100644
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -220,11 +222,18 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -219,11 +221,18 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
@@ -2617,7 +2605,7 @@ index 2ce89fe9..ebf76c7f 100644
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -293,6 +302,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
+@@ -292,6 +301,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
  	/* Permit requests for moduli and signatures */
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2628,7 +2616,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	/* The first few requests do not require asynchronous access */
  	while (!authenticated) {
-@@ -406,6 +419,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
+@@ -405,6 +418,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2639,7 +2627,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if (auth_opts->permit_pty_flag) {
  		monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1713,6 +1730,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+@@ -1687,6 +1704,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
  # ifdef OPENSSL_HAS_ECC
  		kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
@@ -2657,7 +2645,7 @@ index 2ce89fe9..ebf76c7f 100644
  #endif /* WITH_OPENSSL */
  		kex->kex[KEX_C25519_SHA256] = kex_gen_server;
  		kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
-@@ -1806,8 +1834,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1780,8 +1808,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
  	u_char *p;
  	int r;
  
@@ -2668,7 +2656,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
  		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1839,8 +1867,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1813,8 +1841,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
  	OM_uint32 flags = 0; /* GSI needs this */
  	int r;
  
@@ -2679,7 +2667,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
  		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1860,6 +1888,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1834,6 +1862,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2687,7 +2675,7 @@ index 2ce89fe9..ebf76c7f 100644
  	}
  	return (0);
  }
-@@ -1871,8 +1900,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1845,8 +1874,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
  	OM_uint32 ret;
  	int r;
  
@@ -2698,7 +2686,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
  	    (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -1898,13 +1927,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1872,13 +1901,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
  int
  mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  {
@@ -2720,7 +2708,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	sshbuf_reset(m);
  	if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -1913,7 +1946,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1887,7 +1920,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  	debug3("%s: sending result %d", __func__, authenticated);
  	mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
  
@@ -2733,7 +2721,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((displayname = ssh_gssapi_displayname()) != NULL)
  		auth2_record_info(authctxt, "%s", displayname);
-@@ -1921,5 +1958,85 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1895,5 +1932,85 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  	/* Monitor loop will terminate if authenticated */
  	return (authenticated);
  }
@@ -2833,10 +2821,10 @@ index 683e5e07..2b1a2d59 100644
  
  struct ssh;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 001a8fa1..6edb509a 100644
+index 186e8f02..8e4c1c1f 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -993,13 +993,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+@@ -978,13 +978,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
  }
  
  int
@@ -2853,7 +2841,7 @@ index 001a8fa1..6edb509a 100644
  
  	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
  	mm_request_receive_expect(pmonitor->m_recvfd,
-@@ -1012,4 +1014,57 @@ mm_ssh_gssapi_userok(char *user)
+@@ -997,4 +999,57 @@ mm_ssh_gssapi_userok(char *user)
  	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
  	return (authenticated);
  }
@@ -2912,10 +2900,10 @@ index 001a8fa1..6edb509a 100644
 +
  #endif /* GSSAPI */
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 23ab096a..485590c1 100644
+index fdebb3aa..69164a8c 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
-@@ -64,8 +64,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
+@@ -61,8 +61,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
     gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
@@ -2928,7 +2916,7 @@ index 23ab096a..485590c1 100644
  
  #ifdef USE_PAM
 diff --git a/readconf.c b/readconf.c
-index f3cac6b3..da8022dd 100644
+index ec497e79..4d699e5f 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -67,6 +67,7 @@
@@ -2939,7 +2927,7 @@ index f3cac6b3..da8022dd 100644
  
  /* Format of the configuration file:
  
-@@ -160,6 +161,8 @@ typedef enum {
+@@ -162,6 +163,8 @@ typedef enum {
  	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
  	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
  	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
@@ -2948,7 +2936,7 @@ index f3cac6b3..da8022dd 100644
  	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
  	oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
  	oHashKnownHosts,
-@@ -204,10 +207,22 @@ static struct {
+@@ -202,10 +205,22 @@ static struct {
  	/* Sometimes-unsupported options */
  #if defined(GSSAPI)
  	{ "gssapiauthentication", oGssAuthentication },
@@ -2971,7 +2959,7 @@ index f3cac6b3..da8022dd 100644
  #endif
  #ifdef ENABLE_PKCS11
  	{ "pkcs11provider", oPKCS11Provider },
-@@ -1029,10 +1044,42 @@ parse_time:
+@@ -983,10 +998,42 @@ parse_time:
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -3014,7 +3002,7 @@ index f3cac6b3..da8022dd 100644
  	case oBatchMode:
  		intptr = &options->batch_mode;
  		goto parse_flag;
-@@ -1911,7 +1958,13 @@ initialize_options(Options * options)
+@@ -1854,7 +1901,13 @@ initialize_options(Options * options)
  	options->pubkey_authentication = -1;
  	options->challenge_response_authentication = -1;
  	options->gss_authentication = -1;
@@ -3028,7 +3016,7 @@ index f3cac6b3..da8022dd 100644
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
-@@ -2059,8 +2112,18 @@ fill_default_options(Options * options)
+@@ -2000,8 +2053,18 @@ fill_default_options(Options * options)
  		options->challenge_response_authentication = 1;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -3047,7 +3035,7 @@ index f3cac6b3..da8022dd 100644
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -2702,7 +2765,14 @@ dump_client_config(Options *o, const char *host)
+@@ -2616,7 +2679,14 @@ dump_client_config(Options *o, const char *host)
  	dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
  #ifdef GSSAPI
  	dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
@@ -3063,10 +3051,10 @@ index f3cac6b3..da8022dd 100644
  	dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
  	dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
 diff --git a/readconf.h b/readconf.h
-index feedb3d2..a8a8870d 100644
+index 8e36bf32..0bff6d80 100644
 --- a/readconf.h
 +++ b/readconf.h
-@@ -41,7 +41,13 @@ typedef struct {
+@@ -40,7 +40,13 @@ typedef struct {
  	int     challenge_response_authentication;
  					/* Try S/Key or TIS, authentication. */
  	int     gss_authentication;	/* Try GSS authentication */
@@ -3081,10 +3069,10 @@ index feedb3d2..a8a8870d 100644
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff --git a/servconf.c b/servconf.c
-index 70f5f73f..191575a1 100644
+index ffac5d2c..ffdad31e 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -69,6 +69,7 @@
+@@ -64,6 +64,7 @@
  #include "auth.h"
  #include "myproposal.h"
  #include "digest.h"
@@ -3092,7 +3080,7 @@ index 70f5f73f..191575a1 100644
  
  static void add_listen_addr(ServerOptions *, const char *,
      const char *, int);
-@@ -133,8 +134,11 @@ initialize_server_options(ServerOptions *options)
+@@ -124,8 +125,11 @@ initialize_server_options(ServerOptions *options)
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
  	options->gss_authentication=-1;
@@ -3104,7 +3092,7 @@ index 70f5f73f..191575a1 100644
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->challenge_response_authentication = -1;
-@@ -375,10 +379,18 @@ fill_default_server_options(ServerOptions *options)
+@@ -351,10 +355,18 @@ fill_default_server_options(ServerOptions *options)
  		options->kerberos_get_afs_token = 0;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -3123,7 +3111,7 @@ index 70f5f73f..191575a1 100644
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -531,6 +543,7 @@ typedef enum {
+@@ -498,6 +510,7 @@ typedef enum {
  	sHostKeyAlgorithms,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
@@ -3131,7 +3119,7 @@ index 70f5f73f..191575a1 100644
  	sAcceptEnv, sSetEnv, sPermitTunnel,
  	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -607,12 +620,22 @@ static struct {
+@@ -572,12 +585,22 @@ static struct {
  #ifdef GSSAPI
  	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -3154,7 +3142,7 @@ index 70f5f73f..191575a1 100644
  	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
  	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
  	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1548,6 +1571,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1485,6 +1508,10 @@ process_server_config_line(ServerOptions *options, char *line,
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -3165,7 +3153,7 @@ index 70f5f73f..191575a1 100644
  	case sGssCleanupCreds:
  		intptr = &options->gss_cleanup_creds;
  		goto parse_flag;
-@@ -1556,6 +1583,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1493,6 +1520,22 @@ process_server_config_line(ServerOptions *options, char *line,
  		intptr = &options->gss_strict_acceptor;
  		goto parse_flag;
  
@@ -3188,7 +3176,7 @@ index 70f5f73f..191575a1 100644
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -2777,6 +2820,10 @@ dump_config(ServerOptions *o)
+@@ -2579,6 +2622,10 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
  	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@@ -3200,10 +3188,10 @@ index 70f5f73f..191575a1 100644
  	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
  	dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff --git a/servconf.h b/servconf.h
-index 4202a2d0..3f47ea25 100644
+index 54e0a8d8..a476d522 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -132,8 +132,11 @@ typedef struct {
+@@ -126,8 +126,11 @@ typedef struct {
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@@ -3216,10 +3204,10 @@ index 4202a2d0..3f47ea25 100644
  						 * authentication. */
  	int     kbd_interactive_authentication;	/* If true, permit */
 diff --git a/session.c b/session.c
-index 8c0e54f7..06a33442 100644
+index 48cfaafb..78cc8358 100644
 --- a/session.c
 +++ b/session.c
-@@ -2678,13 +2678,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
+@@ -2674,13 +2674,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
  
  #ifdef KRB5
  	if (options.kerberos_ticket_cleanup &&
@@ -3362,10 +3350,10 @@ index 36180d07..70dd3665 100644
  
  #endif /* _SSH_GSS_H */
 diff --git a/ssh.1 b/ssh.1
-index 60de6087..db5c65bc 100644
+index 9480eba8..a1c7d230 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -503,7 +503,13 @@ For full details of the options listed below, and their possible values, see
+@@ -497,7 +497,13 @@ For full details of the options listed below, and their possible values, see
  .It GatewayPorts
  .It GlobalKnownHostsFile
  .It GSSAPIAuthentication
@@ -3379,7 +3367,7 @@ index 60de6087..db5c65bc 100644
  .It HashKnownHosts
  .It Host
  .It HostbasedAuthentication
-@@ -579,6 +585,8 @@ flag),
+@@ -573,6 +579,8 @@ flag),
  (supported message integrity codes),
  .Ar kex
  (key exchange algorithms),
@@ -3389,29 +3377,27 @@ index 60de6087..db5c65bc 100644
  (key types),
  .Ar key-cert
 diff --git a/ssh.c b/ssh.c
-index 15aee569..110cf9c1 100644
+index 91e7c351..42be7d88 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -747,6 +747,8 @@ main(int ac, char **av)
+@@ -736,6 +736,8 @@ main(int ac, char **av)
- 			else if (strcmp(optarg, "kex") == 0 ||
+ 				cp = mac_alg_list('\n');
- 			    strcasecmp(optarg, "KexAlgorithms") == 0)
+ 			else if (strcmp(optarg, "kex") == 0)
  				cp = kex_alg_list('\n');
 +			else if (strcmp(optarg, "kex-gss") == 0)
 +				cp = kex_gss_alg_list('\n');
  			else if (strcmp(optarg, "key") == 0)
  				cp = sshkey_alg_list(0, 0, 0, '\n');
  			else if (strcmp(optarg, "key-cert") == 0)
-@@ -772,8 +774,8 @@ main(int ac, char **av)
+@@ -748,7 +750,7 @@ main(int ac, char **av)
- 			} else if (strcmp(optarg, "help") == 0) {
+ 				cp = xstrdup("2");
+ 			else if (strcmp(optarg, "help") == 0) {
  				cp = xstrdup(
- 				    "cipher\ncipher-auth\ncompression\nkex\n"
+-				    "cipher\ncipher-auth\nkex\nkey\n"
--				    "key\nkey-cert\nkey-plain\nkey-sig\nmac\n"
++				    "cipher\ncipher-auth\nkex\nkex-gss\nkey\n"
--				    "protocol-version\nsig");
+ 				    "key-cert\nkey-plain\nmac\n"
-+				    "kex-gss\nkey\nkey-cert\nkey-plain\n"
+ 				    "protocol-version\nsig");
-+				    "key-sig\nmac\nprotocol-version\nsig");
  			}
- 			if (cp == NULL)
- 				fatal("Unsupported query \"%s\"", optarg);
 diff --git a/ssh_config b/ssh_config
 index 5e8ef548..1ff999b6 100644
 --- a/ssh_config
@@ -3426,10 +3412,10 @@ index 5e8ef548..1ff999b6 100644
  #   CheckHostIP yes
  #   AddressFamily any
 diff --git a/ssh_config.5 b/ssh_config.5
-index 06a32d31..3f490697 100644
+index 41262963..c3c8b274 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -766,10 +766,67 @@ The default is
+@@ -754,10 +754,67 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -3498,10 +3484,10 @@ index 06a32d31..3f490697 100644
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index af00fb30..03bc87eb 100644
+index dffee90b..0d0a6cb8 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -80,8 +80,6 @@
+@@ -78,8 +78,6 @@
  #endif
  
  /* import */
@@ -3510,9 +3496,9 @@ index af00fb30..03bc87eb 100644
  extern Options options;
  
  /*
-@@ -163,6 +161,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+@@ -161,6 +159,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
  	char *s, *all_key;
- 	int r, use_known_hosts_order = 0;
+ 	int r;
  
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +	char *orig = NULL, *gss = NULL;
@@ -3522,8 +3508,8 @@ index af00fb30..03bc87eb 100644
  	xxx_host = host;
  	xxx_hostaddr = hostaddr;
  
-@@ -206,6 +209,35 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+@@ -193,6 +196,35 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- 		    compat_pkalg_proposal(options.hostkeyalgorithms);
+ 		    order_hostkeyalgs(host, hostaddr, port));
  	}
  
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
@@ -3558,7 +3544,7 @@ index af00fb30..03bc87eb 100644
  	if (options.rekey_limit || options.rekey_interval)
  		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
  		    options.rekey_interval);
-@@ -224,16 +256,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+@@ -211,16 +243,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
  # ifdef OPENSSL_HAS_ECC
  	ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
  # endif
@@ -3606,7 +3592,7 @@ index af00fb30..03bc87eb 100644
  	if ((r = kex_prop2buf(ssh->kex->my, myproposal)) != 0)
  		fatal("kex_prop2buf: %s", ssh_err(r));
  
-@@ -330,6 +392,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
+@@ -317,6 +379,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
  static int input_gssapi_token(int type, u_int32_t, struct ssh *);
  static int input_gssapi_error(int, u_int32_t, struct ssh *);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
@@ -3614,7 +3600,7 @@ index af00fb30..03bc87eb 100644
  #endif
  
  void	userauth(struct ssh *, char *);
-@@ -346,6 +409,11 @@ static char *authmethods_get(void);
+@@ -333,6 +396,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -3626,7 +3612,7 @@ index af00fb30..03bc87eb 100644
  	{"gssapi-with-mic",
  		userauth_gssapi,
  		userauth_gssapi_cleanup,
-@@ -716,12 +784,25 @@ userauth_gssapi(struct ssh *ssh)
+@@ -698,12 +766,23 @@ userauth_gssapi(struct ssh *ssh)
  	OM_uint32 min;
  	int r, ok = 0;
  	gss_OID mech = NULL;
@@ -3644,16 +3630,14 @@ index af00fb30..03bc87eb 100644
  
  	if (authctxt->gss_supported_mechs == NULL)
 -		gss_indicate_mechs(&min, &authctxt->gss_supported_mechs);
-+		if (GSS_ERROR(gss_indicate_mechs(&min,
++		if (GSS_ERROR(gss_indicate_mechs(&min, &authctxt->gss_supported_mechs))) {
-+		    &authctxt->gss_supported_mechs))) {
-+			authctxt->gss_supported_mechs = NULL;
 +			free(gss_host);
 +			return 0;
 +		}
  
  	/* Check to see whether the mechanism is usable before we offer it */
  	while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
-@@ -730,13 +811,15 @@ userauth_gssapi(struct ssh *ssh)
+@@ -712,13 +791,15 @@ userauth_gssapi(struct ssh *ssh)
  		    elements[authctxt->mech_tried];
  		/* My DER encoding requires length<128 */
  		if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
@@ -3670,7 +3654,7 @@ index af00fb30..03bc87eb 100644
  	if (!ok || mech == NULL)
  		return 0;
  
-@@ -976,6 +1059,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
+@@ -958,6 +1039,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
  	free(lang);
  	return r;
  }
@@ -3727,10 +3711,10 @@ index af00fb30..03bc87eb 100644
  
  static int
 diff --git a/sshd.c b/sshd.c
-index 60b2aaf7..d92f03aa 100644
+index cbd3bce9..8c223f6a 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -817,8 +817,8 @@ notify_hostkeys(struct ssh *ssh)
+@@ -796,8 +796,8 @@ notify_hostkeys(struct ssh *ssh)
  	}
  	debug3("%s: sent %u hostkeys", __func__, nkeys);
  	if (nkeys == 0)
@@ -3741,7 +3725,7 @@ index 60b2aaf7..d92f03aa 100644
  		sshpkt_fatal(ssh, r, "%s: send", __func__);
  	sshbuf_free(buf);
  }
-@@ -1852,7 +1852,8 @@ main(int ac, char **av)
+@@ -1769,7 +1769,8 @@ main(int ac, char **av)
  		free(fp);
  	}
  	accumulate_host_timing_secret(cfg, NULL);
@@ -3751,7 +3735,7 @@ index 60b2aaf7..d92f03aa 100644
  		logit("sshd: no hostkeys available -- exiting.");
  		exit(1);
  	}
-@@ -2347,6 +2348,48 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -2260,6 +2261,48 @@ do_ssh2_kex(struct ssh *ssh)
  	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
  	    list_hostkey_types());
  
@@ -3800,7 +3784,7 @@ index 60b2aaf7..d92f03aa 100644
  	/* start key exchange */
  	if ((r = kex_setup(ssh, myproposal)) != 0)
  		fatal("kex_setup: %s", ssh_err(r));
-@@ -2362,7 +2405,18 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -2275,7 +2318,18 @@ do_ssh2_kex(struct ssh *ssh)
  # ifdef OPENSSL_HAS_ECC
  	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
@@ -3826,18 +3810,18 @@ index 19b7c91a..2c48105f 100644
 +++ b/sshd_config
 @@ -69,6 +69,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
  # GSSAPI options
- #GSSAPIAuthentication no
+ GSSAPIAuthentication yes
- #GSSAPICleanupCredentials yes
+ GSSAPICleanupCredentials no
 +#GSSAPIStrictAcceptorCheck yes
 +#GSSAPIKeyExchange no
  
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff --git a/sshd_config.5 b/sshd_config.5
-index 70ccea44..f6b41a2f 100644
+index b224f292..2baa6622 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -646,6 +646,11 @@ Specifies whether to automatically destroy the user's credentials cache
+@@ -653,6 +653,11 @@ Specifies whether to automatically destroy the user's credentials cache
  on logout.
  The default is
  .Cm yes .
@@ -3849,7 +3833,7 @@ index 70ccea44..f6b41a2f 100644
  .It Cm GSSAPIStrictAcceptorCheck
  Determines whether to be strict about the identity of the GSSAPI acceptor
  a client authenticates against.
-@@ -660,6 +665,31 @@ machine's default store.
+@@ -667,6 +672,31 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
@@ -3882,18 +3866,18 @@ index 70ccea44..f6b41a2f 100644
  Specifies the key types that will be accepted for hostbased authentication
  as a list of comma-separated patterns.
 diff --git a/sshkey.c b/sshkey.c
-index 57995ee6..fd5b7724 100644
+index ad195776..789cd61e 100644
 --- a/sshkey.c
 +++ b/sshkey.c
-@@ -154,6 +154,7 @@ static const struct keytype keytypes[] = {
+@@ -135,6 +135,7 @@ static const struct keytype keytypes[] = {
- 	    KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 },
+ #  endif /* OPENSSL_HAS_NISTP521 */
  # endif /* OPENSSL_HAS_ECC */
  #endif /* WITH_OPENSSL */
 +	{ "null", "null", NULL, KEY_NULL, 0, 0, 0 },
  	{ NULL, NULL, NULL, -1, -1, 0, 0 }
  };
  
-@@ -255,7 +256,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
+@@ -223,7 +224,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
  	const struct keytype *kt;
  
  	for (kt = keytypes; kt->type != -1; kt++) {
@@ -3903,13 +3887,13 @@ index 57995ee6..fd5b7724 100644
  		if (!include_sigonly && kt->sigonly)
  			continue;
 diff --git a/sshkey.h b/sshkey.h
-index 71a3fddc..37a43a67 100644
+index a91e6043..c11106c9 100644
 --- a/sshkey.h
 +++ b/sshkey.h
-@@ -69,6 +69,7 @@ enum sshkey_types {
+@@ -65,6 +65,7 @@ enum sshkey_types {
- 	KEY_ECDSA_SK_CERT,
+ 	KEY_ED25519_CERT,
- 	KEY_ED25519_SK,
+ 	KEY_XMSS,
- 	KEY_ED25519_SK_CERT,
+ 	KEY_XMSS_CERT,
 +	KEY_NULL,
  	KEY_UNSPEC
  };

openssh-8.1p1-seccomp-nanosleep.patch

@@ -0,0 +1,21 @@
+commit 7e929163ed40f9ce90060a3ca6df558c3d901379
+Author: Jakub Jelen <jjelen@redhat.com>
+Date:   Wed Nov 13 12:57:05 2019 +0100
+
+    seccomp: Allow clock_nanosleep() to make OpenSSH working with latest glibc
+
+diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+index b5cda70b..be239767 100644
+--- a/sandbox-seccomp-filter.c
++++ b/sandbox-seccomp-filter.c
+@@ -242,6 +242,9 @@ static const struct sock_filter preauth_insns[] = {
+ #ifdef __NR_nanosleep
+ 	SC_ALLOW(__NR_nanosleep),
+ #endif
++#ifdef __NR_clock_nanosleep
++	SC_ALLOW(__NR_clock_nanosleep),
++#endif
+ #ifdef __NR__newselect
+ 	SC_ALLOW(__NR__newselect),
+ #endif
+

openssh-8.2p1-visibility.patch

@@ -1,40 +0,0 @@
-diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c
-index dca158de..afdcb1d2 100644
---- a/regress/misc/sk-dummy/sk-dummy.c
-+++ b/regress/misc/sk-dummy/sk-dummy.c
-@@ -71,7 +71,7 @@ skdebug(const char *func, const char *fmt, ...)
- #endif
- }
- 
--uint32_t
-+uint32_t __attribute__((visibility("default")))
- sk_api_version(void)
- {
- 	return SSH_SK_VERSION_MAJOR;
-@@ -220,7 +220,7 @@ check_options(struct sk_option **options)
- 	return 0;
- }
- 
--int
-+int __attribute__((visibility("default")))
- sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
-     const char *application, uint8_t flags, const char *pin,
-     struct sk_option **options, struct sk_enroll_response **enroll_response)
-@@ -467,7 +467,7 @@ sig_ed25519(const uint8_t *message, size_t message_len,
- 	return ret;
- }
- 
--int
-+int __attribute__((visibility("default")))
- sk_sign(uint32_t alg, const uint8_t *message, size_t message_len,
-     const char *application, const uint8_t *key_handle, size_t key_handle_len,
-     uint8_t flags, const char *pin, struct sk_option **options,
-@@ -518,7 +518,7 @@ sk_sign(uint32_t alg, const uint8_t *message, size_t message_len,
- 	return ret;
- }
- 
--int
-+int __attribute__((visibility("default")))
- sk_load_resident_keys(const char *pin, struct sk_option **options,
-     struct sk_resident_key ***rks, size_t *nrks)
- {

openssh.spec

@@ -65,10 +65,10 @@
 %endif
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%global openssh_ver 8.2p1
+%global openssh_ver 8.1p1
 %global openssh_rel 2
 %global pam_ssh_agent_ver 0.10.3
-%global pam_ssh_agent_rel 9
+%global pam_ssh_agent_rel 8
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
@@ -196,8 +196,7 @@ Patch949: openssh-7.6p1-cleanup-selinux.patch
 # Sandbox adjustments for s390 and audit
 Patch950: openssh-7.5p1-sandbox.patch
 # PKCS#11 URIs (upstream #2817, 2nd iteration)
-# https://github.com/Jakuje/openssh-portable/commits/jjelen-pkcs11
+# git diff upstream/master > ~/devel/fedora/openssh/openssh-8.0p1-pkcs11-uri.patch
-# git show > ~/devel/fedora/openssh/openssh-8.0p1-pkcs11-uri.patch
 Patch951: openssh-8.0p1-pkcs11-uri.patch
 # Unbreak scp between two IPv6 hosts (#1620333)
 Patch953: openssh-7.8p1-scp-ipv6.patch
@@ -211,8 +210,8 @@ Patch962: openssh-8.0p1-crypto-policies.patch
 Patch963: openssh-8.0p1-openssl-evp.patch
 # Use OpenSSL KDF (#1631761)
 Patch964: openssh-8.0p1-openssl-kdf.patch
-# sk-dummy.so built with -fvisibility=hidden does not work
+# Unbreak seccomp filter with latest glibc (#1771946)
-Patch965: openssh-8.2p1-visibility.patch
+Patch965: openssh-8.1p1-seccomp-nanosleep.patch
 
 License: BSD
 Requires: /sbin/nologin
@@ -239,7 +238,6 @@ BuildRequires: perl-podlators
 BuildRequires: systemd-devel
 BuildRequires: gcc
 BuildRequires: p11-kit-devel
-BuildRequires: libfido2-devel
 Recommends: p11-kit
 
 %if %{kerberos5}
@@ -297,7 +295,7 @@ Requires: openssh = %{version}-%{release}
 %package -n pam_ssh_agent_auth
 Summary: PAM module for authentication with ssh-agent
 Version: %{pam_ssh_agent_ver}
-Release: %{pam_ssh_agent_rel}.%{openssh_rel}.0.riscv64%{?dist}%{?rescue_rel}
+Release: %{pam_ssh_agent_rel}.%{openssh_rel}.0.riscv64%{?dist}%{?rescue_rel}.1
 License: BSD
 
 %description
@@ -414,7 +412,7 @@ popd
 %patch962 -p1 -b .crypto-policies
 %patch963 -p1 -b .openssl-evp
 %patch964 -p1 -b .openssl-kdf
-%patch965 -p1 -b .visibility
+%patch965 -p1 -b .seccomp-nanosleep
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-race
@@ -429,7 +427,7 @@ popd
 
 %build
 # the -fvisibility=hidden is needed for clean build of the pam_ssh_agent_auth
-# it is needed for lib(open)ssh build too since it is linked to the pam module too
+# and it makes the ssh build more clean and even optimized better
 CFLAGS="$RPM_OPT_FLAGS -fvisibility=hidden"; export CFLAGS
 %if %{rescue}
 CFLAGS="$CFLAGS -Os"
@@ -478,7 +476,6 @@ fi
 	--without-hardening `# The hardening flags are configured by system` \
 	--with-systemd \
 	--with-default-pkcs11-provider=yes \
-	--with-security-key-builtin=yes \
 %if %{ldap}
 	--with-ldap \
 %endif
@@ -563,7 +560,6 @@ make tests
 rm -rf $RPM_BUILD_ROOT
 mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
 mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config.d
-mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config.d
 mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
 mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
 make install DESTDIR=$RPM_BUILD_ROOT
@@ -577,7 +573,6 @@ install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
 install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
 install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
 install -m644 ssh_config_redhat $RPM_BUILD_ROOT/etc/ssh/ssh_config.d/05-redhat.conf
-install -m644 sshd_config_redhat $RPM_BUILD_ROOT/etc/ssh/sshd_config.d/05-redhat.conf
 install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
 install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
 install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
@@ -659,14 +654,12 @@ getent passwd sshd >/dev/null || \
 %attr(0755,root,root) %{_bindir}/sftp
 %attr(0755,root,root) %{_bindir}/ssh-copy-id
 %attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper
-%attr(0755,root,root) %{_libexecdir}/openssh/ssh-sk-helper
 %attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*
 %attr(0644,root,root) %{_mandir}/man1/ssh-add.1*
 %attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*
 %attr(0644,root,root) %{_mandir}/man1/sftp.1*
 %attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
-%attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
 %endif
 
 %if ! %{rescue}
@@ -681,8 +674,6 @@ getent passwd sshd >/dev/null || \
 %attr(0644,root,root) %{_mandir}/man8/sshd.8*
 %attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
-%dir %attr(0700,root,root) %{_sysconfdir}/ssh/sshd_config.d/
-%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/05-redhat.conf
 %attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
 %attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
 %attr(0644,root,root) %{_unitdir}/sshd.service
@@ -728,28 +719,9 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
-* Thu Mar 26 2020 David Abdurachmanov <david.abdurachmanov@sifive.com> - 8.2p1-2 + 0.10.3-9.0.riscv64
+* Fri Nov 15 2019 David Abdurachmanov <david.abdurachmanov@sifive.com> - 8.1p1-2 + 0.10.3-8.0.riscv64.1
 - Add support for RISC-V (riscv64)
 
-* Thu Feb 20 2020 Jakub Jelen <jjelen@redhat.com> - 8.2p1-2 + 0.10.3-9
-- Build against libfido2 to unbreak internal u2f support
-
-* Mon Feb 17 2020 Jakub Jelen <jjelen@redhat.com> - 8.2p1-1 + 0.10.3-9
-- New upstrem reelase (#1803290)
-- New /etc/ssh/sshd_config.d drop in directory
-- Support for U2F security keys
-- Correctly report invalid key permissions (#1801459)
-- Do not write bogus information on stderr in FIPS mode (#1778224)
-
-* Mon Feb 03 2020 Jakub Jelen <jjelen@redhat.com> - 8.1p1-4 + 0.10.3-8
-- Unbreak seccomp filter on ARM (#1796267)
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 8.1p1-3.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Wed Nov 27 2019 Jakub Jelen <jjelen@redhat.com> - 8.1p1-3 + 0.10.3-8
-- Unbreak seccomp filter also on ARM (#1777054)
-
 * Thu Nov 14 2019 Jakub Jelen <jjelen@redhat.com> - 8.1p1-2 + 0.10.3-8
 - Unbreak seccomp filter with latest glibc (#1771946)
 

pam_ssh_agent_auth-0.10.2-compat.patch

@@ -1,6 +1,6 @@
 diff -up openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c
 --- openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c	2020-02-07 10:43:05.011757956 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c	2018-08-24 10:22:56.281930322 +0200
 @@ -27,6 +27,7 @@
   * or implied, of Jamie Beverly.
   */
@@ -34,7 +34,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat openss
  
 diff -up openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/identity.h
 --- openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/identity.h	2020-02-07 10:43:05.011757956 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/identity.h	2018-08-24 10:18:05.009393312 +0200
 @@ -30,8 +30,8 @@
  #include "openbsd-compat/sys-queue.h"
  #include "xmalloc.h"
@@ -56,8 +56,8 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-compat openssh/pam_ss
      int tried;
      int isprivate;      /* key points to the private key */
 diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
---- openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat	2020-02-07 10:43:05.009757925 +0100
+--- openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat	2018-08-24 10:18:05.007393297 +0200
-+++ openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2018-08-24 10:18:32.937612513 +0200
 @@ -36,8 +36,8 @@
  #include "openbsd-compat/sys-queue.h"
  #include "xmalloc.h"
@@ -119,7 +119,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
                                  const char * ruser, const char * servicename)
  {
      u_char *cookie = NULL;
-@@ -114,22 +120,23 @@ pamsshagentauth_session_id2_gen(Buffer *
+@@ -114,22 +116,23 @@ pamsshagentauth_session_id2_gen(Buffer *
      char ** reported_argv = NULL;
      size_t count = 0;
      char * action_logbuf = NULL;
@@ -147,7 +147,13 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
          }
          cookie[i] = (u_char) rnd;
          rnd >>= 8;
-@@ -144,7 +151,8 @@ pamsshagentauth_session_id2_gen(Buffer *
+@@ -139,12 +141,13 @@ pamsshagentauth_session_id2_gen(Buffer *
+     if (count > 0) { 
+         free_logbuf = 1;
+         action_logbuf = log_action(reported_argv, count);
+-        agent_action(&action_agentbuf, reported_argv, count);
++        agent_action(&action_agentbuf, reported_argv, count);
+         pamsshagentauth_free_command_line(reported_argv, count);
      }
      else {
          action_logbuf = "unknown on this platform";
@@ -157,7 +163,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
      }
      
      /*
-@@ -161,35 +169,39 @@ pamsshagentauth_session_id2_gen(Buffer *
+@@ -161,35 +163,39 @@ pamsshagentauth_session_id2_gen(Buffer *
      retc = getcwd(pwd, sizeof(pwd) - 1);
      time(&ts);
  
@@ -201,14 +207,6 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
 -        pamsshagentauth_buffer_free(&action_agentbuf);
 +        free(action_logbuf);
 +        sshbuf_free(action_agentbuf);
-+    }
-+    /* debug3("hostname: %s", hostname); */
-+    if (reti >= 0) {
-+        if ((r = sshbuf_put_cstring(*session_id2, hostname)) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+    } else {
-+        if ((r = sshbuf_put_cstring(*session_id2, "")) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
      }
 -    /* pamsshagentauth_debug3("hostname: %s", hostname); */
 -    if(reti >= 0)
@@ -217,13 +215,21 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
 -        pamsshagentauth_buffer_put_cstring(session_id2, "");
 -    /* pamsshagentauth_debug3("ts: %ld", ts); */
 -    pamsshagentauth_buffer_put_int64(session_id2, (uint64_t) ts);
++    /* debug3("hostname: %s", hostname); */
++    if (reti >= 0) {
++        if ((r = sshbuf_put_cstring(*session_id2, hostname)) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    } else {
++        if ((r = sshbuf_put_cstring(*session_id2, "")) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    }
 +    /* debug3("ts: %ld", ts); */
 +    if ((r = sshbuf_put_u64(*session_id2, (uint64_t) ts)) != 0)
 +        fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
      free(cookie);
      return;
-@@ -278,7 +290,8 @@ ssh_get_authentication_connection_for_ui
+@@ -278,7 +280,8 @@ ssh_get_authentication_connection_for_ui
  
  	auth = xmalloc(sizeof(*auth));
  	auth->fd = sock;
@@ -233,7 +239,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
  	auth->howmany = 0;
  
  	return auth;
-@@ -287,9 +300,9 @@ ssh_get_authentication_connection_for_ui
+@@ -287,43 +289,42 @@ ssh_get_authentication_connection_for_ui
  int
  pamsshagentauth_find_authorized_keys(const char * user, const char * ruser, const char * servicename)
  {
@@ -245,8 +251,11 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
      AuthenticationConnection *ac;
      char *comment;
      uint8_t retval = 0;
-@@ -299,31 +312,30 @@ pamsshagentauth_find_authorized_keys(con
+     uid_t uid = getpwnam(ruser)->pw_uid;
-     pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
+ 
+     OpenSSL_add_all_digests();
+-    pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
++    pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
  
      if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
 -        pamsshagentauth_verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
@@ -286,8 +295,8 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat
      return retval;
  }
 diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c
---- openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat	2020-02-07 10:43:05.010757940 +0100
+--- openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat	2018-08-24 10:18:05.008393305 +0200
-+++ openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c	2018-08-24 10:18:05.009393312 +0200
 @@ -104,7 +104,7 @@ pam_sm_authenticate(pam_handle_t * pamh,
   * a patch 8-)
   */
@@ -377,7 +386,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat open
  cleanexit:
 diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c
 --- openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c	2018-08-24 10:18:05.009393312 +0200
 @@ -66,8 +66,8 @@
  #include "xmalloc.h"
  #include "match.h"
@@ -444,7 +453,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compa
          pamsshagentauth_user_key_allowed2(getpwuid(authorized_keys_file_allowed_owner_uid),
 diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h
 --- openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h	2018-08-24 10:18:05.010393320 +0200
 @@ -32,7 +32,7 @@
  #define _PAM_USER_KEY_ALLOWED_H
  
@@ -456,7 +465,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h.psaa-compa
  #endif
 diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c
 --- openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c	2018-08-24 10:18:05.010393320 +0200
 @@ -45,44 +45,46 @@
  #include "xmalloc.h"
  #include "ssh.h"
@@ -733,7 +742,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat o
  }
 diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h
 --- openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h	2018-08-24 10:18:05.010393320 +0200
 @@ -32,7 +32,7 @@
  #define _PAM_USER_KEY_ALLOWED_H
  
@@ -746,7 +755,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h.psaa-compat o
  #endif
 diff -up openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c
 --- openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c	2020-02-07 10:43:05.012757972 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c	2018-08-24 10:18:05.010393320 +0200
 @@ -53,8 +53,8 @@
  #include "xmalloc.h"
  #include "match.h"
@@ -790,7 +799,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat openssh
  		}
 diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
 --- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2020-02-07 10:43:23.520048960 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2018-08-24 10:22:13.202657025 +0200
 @@ -37,10 +37,11 @@
  #include "xmalloc.h"
  #include "ssh.h"
@@ -805,7 +814,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat
  #include "pathnames.h"
  #include "misc.h"
  #include "secure_filename.h"
-@@ -48,54 +49,59 @@
+@@ -48,54 +48,59 @@
  #include "identity.h"
  #include "pam_user_authorized_keys.h"
  
@@ -824,8 +833,8 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat
      char           *pkalg = NULL;
      u_char         *pkblob = NULL, *sig = NULL;
 -    u_int           blen = 0, slen = 0;
--    int             authenticated = 0;
 +    size_t          blen = 0, slen = 0;
+-    int             authenticated = 0;
 +    int             r, authenticated = 0;
  
 -    pkalg = (char *) key_ssh_name(id->key);
@@ -870,7 +879,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat
  
      /* test for correct signature */
 -    if(pamsshagentauth_key_verify(id->key, sig, slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) == 1)
-+    if (sshkey_verify(id->key, sig, slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0, NULL) == 0)
++    if (sshkey_verify(id->key, sig, slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0) == 0)
          authenticated = 1;
  
    user_auth_clean_exit:
@@ -889,7 +898,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat
  }
 diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h
 --- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h	2020-02-07 10:43:05.013757988 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h	2018-08-24 10:18:05.010393320 +0200
 @@ -31,7 +31,7 @@
  #ifndef _USERAUTH_PUBKEY_FROM_ID_H
  #define _USERAUTH_PUBKEY_FROM_ID_H
@@ -902,7 +911,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h.psaa-compat
  #endif
 diff -up openssh/pam_ssh_agent_auth-0.10.3/uuencode.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/uuencode.c
 --- openssh/pam_ssh_agent_auth-0.10.3/uuencode.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/uuencode.c	2020-02-07 10:43:05.013757988 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/uuencode.c	2018-08-24 10:18:05.010393320 +0200
 @@ -56,7 +56,7 @@ pamsshagentauth_uudecode(const char *src
  	/* and remove trailing whitespace because __b64_pton needs this */
  	*p = '\0';

pam_ssh_agent_auth-0.9.3-build.patch

@@ -159,17 +159,15 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in.psaa-build openssh-
  LIBS=@LIBS@
  AR=@AR@
  AWK=@AWK@
-@@ -61,8 +61,8 @@ INSTALL=@INSTALL@
+@@ -61,7 +61,7 @@ INSTALL=@INSTALL@
  PERL=@PERL@
  SED=@SED@
  ENT=@ENT@
 -LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
--LDFLAGS_SHARED = @LDFLAGS_SHARED@
 +LDFLAGS=-L.. -L../openbsd-compat/ @LDFLAGS@
-+LDFLAGS_SHARED =-Wl,-z,defs @LDFLAGS_SHARED@
+ LDFLAGS_SHARED = @LDFLAGS_SHARED@
  EXEEXT=@EXEEXT@
  
- INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
 @@ -74,7 +74,7 @@ SSHOBJS=xmalloc.o atomicio.o authfd.o bu
  
  ED25519OBJS=ed25519-donna/ed25519.o
@@ -191,8 +189,8 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in.psaa-build openssh-
  
 -pam_ssh_agent_auth.so: $(LIBCOMPAT) $(SSHOBJS) $(ED25519OBJS) $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o
 -	$(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(ED25519OBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat pam_ssh_agent_auth.o $(LIBS) -lpam
-+pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o ../uidswap.o ../ssh-sk-client.o
++pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o ../uidswap.o
-+	$(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) ../ssh-sk-client.o $(LDFLAGS) -lssh -lopenbsd-compat pam_ssh_agent_auth.o ../uidswap.o $(LIBS) -lpam
++	$(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat pam_ssh_agent_auth.o ../uidswap.o $(LIBS) -lpam
  
  $(MANPAGES): $(MANPAGES_IN)
  	pod2man --section=8 --release=v0.10.3 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8

sources

@@ -1,4 +1,4 @@
-SHA512 (openssh-8.2p1.tar.gz) = c4db64e52a3a4c410de9de49f9cb104dd493b10250af3599b92457dd986277b3fd99a6f51cec94892fd1be5bd0369c5757262ea7805f0de464b245c3d34c120a
+SHA512 (openssh-8.1p1.tar.gz) = b987ea4ffd4ab0c94110723860273b06ed8ffb4d21cbd99ca144a4722dc55f4bf86f6253d500386b6bee7af50f066e2aa2dd095d50746509a10e11221d39d925
-SHA512 (openssh-8.2p1.tar.gz.asc) = e6d091289d62d3a01d5978e3c26f72d8ea6979c345fbebc215515185ea567c959f5b17e32052d752829ab4c6bc537fd977f7aa02cf0a23280da63fd9d880f303
+SHA512 (openssh-8.1p1.tar.gz.asc) = f36458ef8822376a5b305cfbc971f5d2db8bf2f48fea9a957e02ef2fc27a48bacb59495587fee81fa2d89bca6250a8fb407e1f5a7dae7ceb361ab332c0771344
 SHA512 (DJM-GPG-KEY.gpg) = db1191ed9b6495999e05eed2ef863fb5179bdb63e94850f192dad68eed8579836f88fbcfffd9f28524fe1457aff8cd248ee3e0afc112c8f609b99a34b80ecc0d
 SHA512 (pam_ssh_agent_auth-0.10.3.tar.bz2) = d75062c4e46b0b011f46aed9704a99049995fea8b5115ff7ee26dad7e93cbcf54a8af7efc6b521109d77dc03c6f5284574d2e1b84c6829cec25610f24fb4bd66