openssh: upgrade to 9.7p1

openssh/openssh-6.6.1p1-selinux-contexts.patch

@@ -93,19 +93,17 @@ index 8f32464..18a2ca4 100644
  #endif
  
 diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index 22ea8ef..1fc963d 100644
+--- a/openbsd-compat/port-linux.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
---- a/openbsd-compat/port-linux.c
++++ b/openbsd-compat/port-linux.c	(date 1703108053912)
-+++ b/openbsd-compat/port-linux.c
+@@ -207,7 +207,7 @@
-@@ -179,7 +179,7 @@ ssh_selinux_change_context(const char *newname)
+ 	xasprintf(&newctx, "%.*s%s%s", (int)(cx - oldctx + 1), oldctx,
- 	strlcpy(newctx + len, newname, newlen - len);
+ 	    newname, cx2 == NULL ? "" : cx2);
- 	if ((cx = index(cx + 1, ':')))
+
- 		strlcat(newctx, cx, newlen);
+-	debug3_f("setting context from '%s' to '%s'", oldctx, newctx);
--	debug3("%s: setting context from '%s' to '%s'", __func__,
++	debug_f("setting context from '%s' to '%s'", oldctx, newctx);
-+	debug_f("setting context from '%s' to '%s'",
- 	    oldctx, newctx);
  	if (setcon(newctx) < 0)
- 		do_log2(log_level, "%s: setcon %s from %s failed with %s",
+ 		do_log2_f(log_level, "setcon %s from %s failed with %s",
-		    __func__, newctx, oldctx, strerror(errno));
+ 		    newctx, oldctx, strerror(errno));
 diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
 index cb51f99..8b7cda2 100644
 --- a/openbsd-compat/port-linux.h

openssh/openssh-6.7p1-coverity.patch

@@ -17,17 +17,6 @@ diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
  			return oerrno;
  		}
  		/* make sure the KRB5CCNAME is set for non-standard location */
-diff -up openssh-8.5p1/auth-options.c.coverity openssh-8.5p1/auth-options.c
---- openssh-8.5p1/auth-options.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/auth-options.c	2021-03-24 12:03:33.782968159 +0100
-@@ -706,6 +708,7 @@ serialise_array(struct sshbuf *m, char *
- 		return r;
- 	}
- 	/* success */
-+	sshbuf_free(b);
- 	return 0;
- }
- 
 diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
 --- openssh-8.5p1/gss-genr.c.coverity	2021-03-26 11:52:46.613942552 +0100
 +++ openssh-8.5p1/gss-genr.c	2021-03-26 11:54:37.881726318 +0100
@@ -42,32 +31,9 @@ diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
  			for ((p = strsep(&cp, ",")); p && *p != '\0';
  				(p = strsep(&cp, ","))) {
  				if (sshbuf_len(buf) != 0 &&
-diff -up openssh-8.5p1/kexgssc.c.coverity openssh-8.5p1/kexgssc.c
---- openssh-8.5p1/kexgssc.c.coverity	2021-03-24 12:03:33.711967665 +0100
-+++ openssh-8.5p1/kexgssc.c	2021-03-24 12:03:33.783968166 +0100
-@@ -98,8 +98,10 @@ kexgss_client(struct ssh *ssh)
- 	default:
- 		fatal_f("Unexpected KEX type %d", kex->kex_type);
- 	}
--	if (r != 0)
-+	if (r != 0) {
-+		ssh_gssapi_delete_ctx(&ctxt);
- 		return r;
-+	}
- 
- 	token_ptr = GSS_C_NO_BUFFER;
- 
 diff -up openssh-8.5p1/krl.c.coverity openssh-8.5p1/krl.c
 --- openssh-8.5p1/krl.c.coverity	2021-03-02 11:31:47.000000000 +0100
 +++ openssh-8.5p1/krl.c	2021-03-24 12:03:33.783968166 +0100
-@@ -1209,6 +1209,7 @@ ssh_krl_from_blob(struct sshbuf *buf, st
- 	sshkey_free(key);
- 	sshbuf_free(copy);
- 	sshbuf_free(sect);
-+	/* coverity[leaked_storage : FALSE] */
- 	return r;
- }
- 
 @@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, cons
  		return r;
  	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
@@ -164,23 +130,6 @@ diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
  	return (0);
  
   error:
-diff -up openssh-7.4p1/monitor_wrap.c.coverity openssh-7.4p1/monitor_wrap.c
---- openssh-7.4p1/monitor_wrap.c.coverity	2016-12-23 16:40:26.892788689 +0100
-+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:40:26.900788691 +0100
-@@ -525,10 +525,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
- 	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
- 	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
- 		error_f("cannot allocate fds for pty");
--		if (tmp1 > 0)
-+		if (tmp1 >= 0)
- 			close(tmp1);
--		if (tmp2 > 0)
--			close(tmp2);
-+		/*DEAD CODE if (tmp2 >= 0)
-+			close(tmp2);*/
- 		return 0;
- 	}
- 	close(tmp1);
 diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
 --- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity	2016-12-19 05:59:41.000000000 +0100
 +++ openssh-7.4p1/openbsd-compat/bindresvport.c	2016-12-23 16:40:26.901788691 +0100
@@ -234,23 +183,6 @@ diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
  				goto out;
  			}
  			free(arg2);
-diff -up openssh-8.7p1/scp.c.coverity openssh-8.7p1/scp.c
---- openssh-8.7p1/scp.c.coverity	2021-08-30 16:23:35.389741329 +0200
-+++ openssh-8.7p1/scp.c	2021-08-30 16:27:04.854555296 +0200
-@@ -186,11 +186,11 @@ killchild(int signo)
- {
- 	if (do_cmd_pid > 1) {
- 		kill(do_cmd_pid, signo ? signo : SIGTERM);
--		waitpid(do_cmd_pid, NULL, 0);
-+		(void) waitpid(do_cmd_pid, NULL, 0);
- 	}
- 	if (do_cmd_pid2 > 1) {
- 		kill(do_cmd_pid2, signo ? signo : SIGTERM);
--		waitpid(do_cmd_pid2, NULL, 0);
-+		(void) waitpid(do_cmd_pid2, NULL, 0);
- 	}
- 
- 	if (signo)
 diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
 --- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
 +++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
@@ -278,18 +210,6 @@ diff -up openssh-8.7p1/serverloop.c.coverity openssh-8.7p1/serverloop.c
  		if (tun != SSH_TUNID_ANY &&
  		    auth_opts->force_tun_device != (int)tun)
  			goto done;
-diff -up openssh-7.4p1/sftp.c.coverity openssh-7.4p1/sftp.c
---- openssh-7.4p1/sftp.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/sftp.c	2016-12-23 16:40:26.903788691 +0100
-@@ -224,7 +224,7 @@ killchild(int signo)
- 	pid = sshpid;
- 	if (pid > 1) {
- 		kill(pid, SIGTERM);
--		waitpid(pid, NULL, 0);
-+		(void) waitpid(pid, NULL, 0);
- 	}
- 
- 	_exit(1);
 diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
 --- openssh-7.4p1/ssh-agent.c.coverity	2016-12-19 05:59:41.000000000 +0100
 +++ openssh-7.4p1/ssh-agent.c	2016-12-23 16:40:26.903788691 +0100
@@ -301,28 +221,6 @@ diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
  			return NULL;
  		}
  		/* validate also provider from URI */
-@@ -1220,8 +1220,8 @@ main(int ac, char **av)
- 	sanitise_stdfd();
- 
- 	/* drop */
--	setegid(getgid());
--	setgid(getgid());
-+	(void) setegid(getgid());
-+	(void) setgid(getgid());
- 
- 	platform_disable_tracing(0);	/* strict=no */
- 
-diff -up openssh-8.5p1/ssh.c.coverity openssh-8.5p1/ssh.c
---- openssh-8.5p1/ssh.c.coverity	2021-03-24 12:03:33.779968138 +0100
-+++ openssh-8.5p1/ssh.c	2021-03-24 12:03:33.786968187 +0100
-@@ -1746,6 +1746,7 @@ control_persist_detach(void)
- 		close(muxserver_sock);
- 		muxserver_sock = -1;
- 		options.control_master = SSHCTL_MASTER_NO;
-+		/* coverity[leaked_handle: FALSE]*/
- 		muxclient(options.control_path);
- 		/* muxclient() doesn't return on success. */
- 		fatal("Failed to connect to new control master");
 diff -up openssh-7.4p1/sshd.c.coverity openssh-7.4p1/sshd.c
 --- openssh-7.4p1/sshd.c.coverity	2016-12-23 16:40:26.897788690 +0100
 +++ openssh-7.4p1/sshd.c	2016-12-23 16:40:26.904788692 +0100

openssh/openssh-7.2p2-x11.patch

@@ -1,7 +1,7 @@
-diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
+diff --git a/channels.c b/channels.c
---- openssh-7.2p2/channels.c.x11	2016-03-09 19:04:48.000000000 +0100
+--- a/channels.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-7.2p2/channels.c	2016-06-03 10:42:04.775164520 +0200
++++ b/channels.c	(date 1703026069921)
-@@ -3990,21 +3990,24 @@ x11_create_display_inet(int x11_display_
+@@ -5075,11 +5075,13 @@
  }
 
  static int
@@ -14,8 +14,10 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
 +    if (len <= 0)
 +        return -1;
  	sock = socket(AF_UNIX, SOCK_STREAM, 0);
- 	if (sock == -1)
+ 	if (sock == -1) {
  		error("socket: %.100s", strerror(errno));
+@@ -5087,11 +5089,12 @@
+ 	}
  	memset(&addr, 0, sizeof(addr));
  	addr.sun_family = AF_UNIX;
 -	strlcpy(addr.sun_path, pathname, sizeof addr.sun_path);
@@ -30,7 +32,7 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
  	return -1;
  }
 
-@@ -4012,8 +4015,18 @@ static int
+@@ -5099,8 +5102,18 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];

openssh/openssh-7.8p1-role-mls.patch

@@ -23,7 +23,7 @@ diff -up openssh/auth2.c.role-mls openssh/auth2.c
  	if ((style = strchr(user, ':')) != NULL)
  		*style++ = 0;
  
-@@ -296,8 +304,15 @@ input_userauth_request(int type, u_int32
+@@ -314,8 +314,15 @@ input_userauth_request(int type, u_int32
  		    use_privsep ? " [net]" : "");
  		authctxt->service = xstrdup(service);
  		authctxt->style = style ? xstrdup(style) : NULL;
@@ -38,8 +38,8 @@ diff -up openssh/auth2.c.role-mls openssh/auth2.c
 +#endif
 +        }
  		userauth_banner(ssh);
- 		if (auth2_setup_methods_lists(authctxt) != 0)
+ 		if ((r = kex_server_update_ext_info(ssh)) != 0)
- 			ssh_packet_disconnect(ssh,
+ 			fatal_fr(r, "kex_server_update_ext_info failed");
 diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
 --- openssh/auth2-gss.c.role-mls	2018-08-20 07:57:29.000000000 +0200
 +++ openssh/auth2-gss.c	2018-08-22 11:15:42.459799171 +0200

openssh/openssh-8.7p1-minrsabits.patch

@@ -1,20 +1,18 @@
 diff --git a/readconf.c b/readconf.c
-index 7f26c680..42be690b 100644
+--- a/readconf.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
---- a/readconf.c
++++ b/readconf.c	(date 1703169891147)
-+++ b/readconf.c
+@@ -326,6 +326,7 @@
-@@ -320,6 +320,7 @@ static struct {
  	{ "securitykeyprovider", oSecurityKeyProvider },
  	{ "knownhostscommand", oKnownHostsCommand },
  	{ "requiredrsasize", oRequiredRSASize },
 +	{ "rsaminsize", oRequiredRSASize }, /* alias */
  	{ "enableescapecommandline", oEnableEscapeCommandline },
- 
+ 	{ "obscurekeystroketiming", oObscureKeystrokeTiming },
- 	{ NULL, oBadOption }
+ 	{ "channeltimeout", oChannelTimeout },
 diff --git a/servconf.c b/servconf.c
-index 29df0463..423772b1 100644
+--- a/servconf.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
---- a/servconf.c
++++ b/servconf.c	(date 1703169891148)
-+++ b/servconf.c
+@@ -691,6 +691,7 @@
-@@ -676,6 +680,7 @@ static struct {
  	{ "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
  	{ "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
  	{ "requiredrsasize", sRequiredRSASize, SSHCFG_ALL },

openssh/openssh-8.7p1-recursive-scp.patch

@@ -1,28 +1,28 @@
-diff -up openssh-8.7p1/scp.c.scp-sftpdirs openssh-8.7p1/scp.c
+diff --git a/scp.c b/scp.c
---- openssh-8.7p1/scp.c.scp-sftpdirs	2022-02-07 12:31:07.407740407 +0100
+--- a/scp.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-8.7p1/scp.c	2022-02-07 12:31:07.409740424 +0100
++++ b/scp.c	(date 1703111453316)
-@@ -1324,7 +1324,7 @@ source_sftp(int argc, char *src, char *t
+@@ -1372,7 +1372,7 @@
 
  	if (src_is_dir && iamrecursive) {
- 		if (upload_dir(conn, src, abs_dst, pflag,
+ 		if (sftp_upload_dir(conn, src, abs_dst, pflag,
 -		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1) != 0) {
 +		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1, 1) != 0) {
  			error("failed to upload directory %s to %s", src, targ);
  			errs = 1;
  		}
-diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
+diff --git a/sftp-client.c b/sftp-client.c
---- openssh-8.7p1/sftp-client.c.scp-sftpdirs	2021-08-20 06:03:49.000000000 +0200
+--- a/sftp-client.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-8.7p1/sftp-client.c	2022-02-07 12:47:59.117516131 +0100
++++ b/sftp-client.c	(date 1703169614263)
-@@ -971,7 +971,7 @@ do_fsetstat(struct sftp_conn *conn, cons
+@@ -1003,7 +1003,7 @@
 
  /* Implements both the realpath and expand-path operations */
  static char *
--do_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
+-sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
-+do_realpath_expand(struct sftp_conn *conn, const char *path, int expand, int create_dir)
++sftp_realpath_expand(struct sftp_conn *conn, const char *path, int expand, int create_dir)
  {
  	struct sshbuf *msg;
  	u_int expected_id, count, id;
-@@ -1033,11 +1033,43 @@ do_realpath_expand(struct sftp_conn *con
+@@ -1049,11 +1049,43 @@
  		if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
  		    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
  			fatal_fr(r, "parse status");
@@ -33,7 +33,7 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
 -		return NULL;
 +		if ((status == SSH2_FX_NO_SUCH_FILE) && create_dir)  {
 +			memset(&a, '\0', sizeof(a));
-+			if ((r = do_mkdir(conn, path, &a, 0)) != 0) {
++			if ((r = sftp_mkdir(conn, path, &a, 0)) != 0) {
 +				sshbuf_free(msg);
 +				return NULL;
 +			}
@@ -71,42 +71,42 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
  	} else if (type != SSH2_FXP_NAME)
  		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
  		    SSH2_FXP_NAME, type);
-@@ -1039,9 +1067,9 @@ do_realpath_expand(struct sftp_conn *con
+@@ -1078,9 +1110,9 @@
  }
 
  char *
--do_realpath(struct sftp_conn *conn, const char *path)
+-sftp_realpath(struct sftp_conn *conn, const char *path)
-+do_realpath(struct sftp_conn *conn, const char *path, int create_dir)
++sftp_realpath(struct sftp_conn *conn, const char *path, int create_dir)
  {
--	return do_realpath_expand(conn, path, 0);
+-	return sftp_realpath_expand(conn, path, 0);
-+	return do_realpath_expand(conn, path, 0, create_dir);
++	return sftp_realpath_expand(conn, path, 0, create_dir);
  }
 
  int
-@@ -1055,9 +1083,9 @@ do_expand_path(struct sftp_conn *conn, c
+@@ -1094,9 +1126,9 @@
  {
- 	if (!can_expand_path(conn)) {
+ 	if (!sftp_can_expand_path(conn)) {
  		debug3_f("no server support, fallback to realpath");
--		return do_realpath_expand(conn, path, 0);
+-		return sftp_realpath_expand(conn, path, 0);
-+		return do_realpath_expand(conn, path, 0, 0);
++		return sftp_realpath_expand(conn, path, 0, 0);
  	}
--	return do_realpath_expand(conn, path, 1);
+-	return sftp_realpath_expand(conn, path, 1);
-+	return do_realpath_expand(conn, path, 1, 0);
++	return sftp_realpath_expand(conn, path, 1, 0);
  }
 
  int
-@@ -1807,7 +1835,7 @@ download_dir(struct sftp_conn *conn, con
+@@ -2016,7 +2048,7 @@
  	char *src_canon;
  	int ret;
 
--	if ((src_canon = do_realpath(conn, src)) == NULL) {
+-	if ((src_canon = sftp_realpath(conn, src)) == NULL) {
-+	if ((src_canon = do_realpath(conn, src, 0)) == NULL) {
++	if ((src_canon = sftp_realpath(conn, src, 0)) == NULL) {
  		error("download \"%s\": path canonicalization failed", src);
  		return -1;
  	}
-@@ -2115,12 +2143,12 @@ upload_dir_internal(struct sftp_conn *co
+@@ -2365,12 +2397,12 @@
  int
- upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
+ sftp_upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
      int preserve_flag, int print_flag, int resume, int fsync_flag,
 -    int follow_link_flag, int inplace_flag)
 +    int follow_link_flag, int inplace_flag, int create_dir)
@@ -114,68 +114,69 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
  	char *dst_canon;
  	int ret;
 
--	if ((dst_canon = do_realpath(conn, dst)) == NULL) {
+-	if ((dst_canon = sftp_realpath(conn, dst)) == NULL) {
-+	if ((dst_canon = do_realpath(conn, dst, create_dir)) == NULL) {
++	if ((dst_canon = sftp_realpath(conn, dst, create_dir)) == NULL) {
  		error("upload \"%s\": path canonicalization failed", dst);
  		return -1;
  	}
-@@ -2557,7 +2585,7 @@ crossload_dir(struct sftp_conn *from, st
+@@ -2825,7 +2857,7 @@
  	char *from_path_canon;
  	int ret;
 
--	if ((from_path_canon = do_realpath(from, from_path)) == NULL) {
+-	if ((from_path_canon = sftp_realpath(from, from_path)) == NULL) {
-+	if ((from_path_canon = do_realpath(from, from_path, 0)) == NULL) {
++	if ((from_path_canon = sftp_realpath(from, from_path, 0)) == NULL) {
  		error("crossload \"%s\": path canonicalization failed",
  		    from_path);
  		return -1;
-diff -up openssh-8.7p1/sftp-client.h.scp-sftpdirs openssh-8.7p1/sftp-client.h
+diff --git a/sftp-client.h b/sftp-client.h
---- openssh-8.7p1/sftp-client.h.scp-sftpdirs	2021-08-20 06:03:49.000000000 +0200
+--- a/sftp-client.h	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-8.7p1/sftp-client.h	2022-02-07 12:31:07.410740433 +0100
++++ b/sftp-client.h	(date 1703111691284)
-@@ -111,7 +111,7 @@ int do_fsetstat(struct sftp_conn *, cons
+@@ -111,7 +111,7 @@
- int do_lsetstat(struct sftp_conn *conn, const char *path, Attrib *a);
+ int sftp_lsetstat(struct sftp_conn *conn, const char *path, Attrib *a);
 
  /* Canonicalise 'path' - caller must free result */
--char *do_realpath(struct sftp_conn *, const char *);
+-char *sftp_realpath(struct sftp_conn *, const char *);
-+char *do_realpath(struct sftp_conn *, const char *, int);
++char *sftp_realpath(struct sftp_conn *, const char *, int);
 
  /* Canonicalisation with tilde expansion (requires server extension) */
- char *do_expand_path(struct sftp_conn *, const char *);
+ char *sftp_expand_path(struct sftp_conn *, const char *);
-@@ -159,7 +159,7 @@ int do_upload(struct sftp_conn *, const
+@@ -163,7 +163,7 @@
   * times if 'pflag' is set
   */
- int upload_dir(struct sftp_conn *, const char *, const char *,
+ int sftp_upload_dir(struct sftp_conn *, const char *, const char *,
 -    int, int, int, int, int, int);
 +    int, int, int, int, int, int, int);
 
  /*
   * Download a 'from_path' from the 'from' connection and upload it to
-diff -up openssh-8.7p1/sftp.c.scp-sftpdirs openssh-8.7p1/sftp.c
+
---- openssh-8.7p1/sftp.c.scp-sftpdirs	2021-08-20 06:03:49.000000000 +0200
+diff --git a/sftp.c b/sftp.c
-+++ openssh-8.7p1/sftp.c	2022-02-07 12:31:07.411740442 +0100
+--- a/sftp.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-@@ -760,7 +760,7 @@ process_put(struct sftp_conn *conn, cons
++++ b/sftp.c	(date 1703168795365)
- 		if (globpath_is_dir(g.gl_pathv[i]) && (rflag || global_rflag)) {
+@@ -807,7 +807,7 @@
- 			if (upload_dir(conn, g.gl_pathv[i], abs_dst,
+ 		    (rflag || global_rflag)) {
+ 			if (sftp_upload_dir(conn, g.gl_pathv[i], abs_dst,
  			    pflag || global_pflag, 1, resume,
 -			    fflag || global_fflag, 0, 0) == -1)
 +			    fflag || global_fflag, 0, 0, 0) == -1)
  				err = -1;
  		} else {
- 			if (do_upload(conn, g.gl_pathv[i], abs_dst,
+ 			if (sftp_upload(conn, g.gl_pathv[i], abs_dst,
-@@ -1577,7 +1577,7 @@ parse_dispatch_command(struct sftp_conn
+@@ -1642,7 +1642,7 @@
  		if (path1 == NULL || *path1 == '\0')
  			path1 = xstrdup(startdir);
- 		path1 = make_absolute(path1, *pwd);
+ 		path1 = sftp_make_absolute(path1, *pwd);
--		if ((tmp = do_realpath(conn, path1)) == NULL) {
+-		if ((tmp = sftp_realpath(conn, path1)) == NULL) {
-+		if ((tmp = do_realpath(conn, path1, 0)) == NULL) {
++		if ((tmp = sftp_realpath(conn, path1, 0)) == NULL) {
  			err = 1;
  			break;
  		}
-@@ -2160,7 +2160,7 @@ interactive_loop(struct sftp_conn *conn,
+@@ -2247,7 +2247,7 @@
  	}
  #endif /* USE_LIBEDIT */
 
--	remote_path = do_realpath(conn, ".");
+-	if ((remote_path = sftp_realpath(conn, ".")) == NULL)
-+	remote_path = do_realpath(conn, ".", 0);
++	if ((remote_path = sftp_realpath(conn, ".", 0)) == NULL)
- 	if (remote_path == NULL)
  		fatal("Need cwd");
  	startdir = xstrdup(remote_path);
+

openssh/openssh-9.3p1-merged-openssl-evp.patch

@@ -659,9 +659,9 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  # ifdef OPENSSL_HAS_ECC
  #  include <openssl/ec.h>
  #  include <openssl/ecdsa.h>
-@@ -268,6 +271,10 @@
+@@ -266,6 +266,10 @@
  const char	*sshkey_ssh_name_plain(const struct sshkey *);
- int		 sshkey_names_valid2(const char *, int);
+ int		 sshkey_names_valid2(const char *, int, int);
  char		*sshkey_alg_list(int, int, int, char);
 +int		 sshkey_calculate_signature(EVP_PKEY*, int, u_char **,
 +    int *, const u_char *, size_t);
@@ -695,10 +695,10 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  #if !defined(WITH_OPENSSL)
  # undef RSA
  # undef DSA
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh-pkcs11.c openssh-9.3p1-patched/ssh-pkcs11.c
+diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
---- openssh-9.3p1/ssh-pkcs11.c	2023-06-06 15:53:36.592443989 +0200
+--- a/ssh-pkcs11.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-9.3p1-patched/ssh-pkcs11.c	2023-06-06 15:52:25.626551768 +0200
++++ b/ssh-pkcs11.c	(date 1703110934679)
-@@ -777,8 +777,24 @@
+@@ -620,8 +620,24 @@
 
  	return (0);
  }
@@ -722,14 +722,14 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 +
  /* remove trailing spaces. Note, that this does NOT guarantee the buffer
   * will be null terminated if there are no trailing spaces! */
- static void
+ static char *
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh-pkcs11-client.c openssh-9.3p1-patched/ssh-pkcs11-client.c
+diff --git a/ssh-pkcs11-client.c b/ssh-pkcs11-client.c
---- openssh-9.3p1/ssh-pkcs11-client.c	2023-06-06 15:53:36.591443976 +0200
+--- a/ssh-pkcs11-client.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-9.3p1-patched/ssh-pkcs11-client.c	2023-06-06 15:52:25.626551768 +0200
++++ b/ssh-pkcs11-client.c	(date 1703110830967)
-@@ -225,8 +225,36 @@
+@@ -402,8 +402,36 @@
- static RSA_METHOD	*helper_rsa;
+ 	if (helper->nrsa == 0 && helper->nec == 0)
- #if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW)
+ 		helper_terminate(helper);
- static EC_KEY_METHOD	*helper_ecdsa;
+ }
 +
 +int
 +is_ecdsa_pkcs11(EC_KEY *ecdsa)
@@ -744,7 +744,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 +		return 1;
 +	return 0;
 +}
- #endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */
+ #endif /* defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) */
 
 +int
 +is_rsa_pkcs11(RSA *rsa)
@@ -762,14 +762,15 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 +
  /* redirect private key crypto operations to the ssh-pkcs11-helper */
  static void
- wrap_key(struct sshkey *k)
+ wrap_key(struct helper *helper, struct sshkey *k)
-diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh-pkcs11.h openssh-9.3p1-patched/ssh-pkcs11.h
+diff --git a/ssh-pkcs11.h b/ssh-pkcs11.h
---- openssh-9.3p1/ssh-pkcs11.h	2023-06-06 15:53:36.592443989 +0200
+--- a/ssh-pkcs11.h	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ openssh-9.3p1-patched/ssh-pkcs11.h	2023-06-06 15:52:25.626551768 +0200
++++ b/ssh-pkcs11.h	(date 1703111023334)
-@@ -39,6 +39,11 @@
+@@ -38,6 +38,12 @@
- 	    u_int32_t *);
+ /* Only available in ssh-pkcs11-client.c so far */
- #endif
+ int pkcs11_make_cert(const struct sshkey *,
- 
+     const struct sshkey *, struct sshkey **);
++
 +#ifdef HAVE_EC_KEY_METHOD_NEW
 +int is_ecdsa_pkcs11(EC_KEY *ecdsa);
 +#endif

openssh/openssh-9.3p1-openssl-compat.patch

@@ -1,40 +0,0 @@
---- openssh-9.3p1/openbsd-compat/openssl-compat.c	2023-03-15 22:28:19.000000000 +0100
-+++ /home/dbelyavs/work/upstream/openssh-portable/openbsd-compat/openssl-compat.c	2023-05-25 14:19:42.870841944 +0200
-@@ -33,10 +33,10 @@
- 
- /*
-  * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
-- * We match major, minor, fix and status (not patch) for <1.0.0.
-- * After that, we acceptable compatible fix versions (so we
-- * allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
-- * within a patch series.
-+ * Versions >=3 require only major versions to match.
-+ * For versions <3, we accept compatible fix versions (so we allow 1.0.1
-+ * to work with 1.0.0). Going backwards is only allowed within a patch series.
-+ * See https://www.openssl.org/policies/releasestrat.html
-  */
- 
- int
-@@ -48,15 +48,17 @@
- 	if (headerver == libver)
- 		return 1;
- 
--	/* for versions < 1.0.0, major,minor,fix,status must match */
--	if (headerver < 0x1000000f) {
--		mask = 0xfffff00fL; /* major,minor,fix,status */
-+	/*
-+	 * For versions >= 3.0, only the major and status must match.
-+	 */
-+	if (headerver >= 0x3000000f) {
-+		mask = 0xf000000fL; /* major,status */
- 		return (headerver & mask) == (libver & mask);
- 	}
- 
- 	/*
--	 * For versions >= 1.0.0, major,minor,status must match and library
--	 * fix version must be equal to or newer than the header.
-+	 * For versions >= 1.0.0, but <3, major,minor,status must match and
-+	 * library fix version must be equal to or newer than the header.
- 	 */
- 	mask = 0xfff0000fL; /* major,minor,status */
- 	hfix = (headerver & 0x000ff000) >> 12;

openssh/openssh-9.7p1-negotiate-supported-algs.patch

@@ -0,0 +1,118 @@
+diff -up openssh-9.3p1/regress/hostkey-agent.sh.xxx openssh-9.3p1/regress/hostkey-agent.sh
+--- openssh-9.3p1/regress/hostkey-agent.sh.xxx	2023-05-29 18:15:56.311236887 +0200
++++ openssh-9.3p1/regress/hostkey-agent.sh	2023-05-29 18:16:07.598503551 +0200
+@@ -17,8 +17,21 @@ trace "make CA key"
+ 
+ ${SSHKEYGEN} -qt ed25519 -f $OBJ/agent-ca -N '' || fatal "ssh-keygen CA"
+ 
++PUBKEY_ACCEPTED_ALGOS=`$SSH -G "example.com" | \
++    grep -i "PubkeyAcceptedAlgorithms" | cut -d ' ' -f2- | tr "," "|"`
++SSH_ACCEPTED_KEYTYPES=`echo "$SSH_KEYTYPES" | egrep "$PUBKEY_ACCEPTED_ALGOS"`
++echo $PUBKEY_ACCEPTED_ALGOS | grep "rsa"
++r=$?
++if [ $r == 0 ]; then
++echo $SSH_ACCEPTED_KEYTYPES | grep "rsa"
++r=$?
++if [ $r -ne 0 ]; then
++SSH_ACCEPTED_KEYTYPES="$SSH_ACCEPTED_KEYTYPES ssh-rsa"
++fi
++fi
++
+ trace "load hostkeys"
+-for k in $SSH_KEYTYPES ; do
++for k in $SSH_ACCEPTED_KEYTYPES ; do
+ 	${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
+ 	${SSHKEYGEN} -s $OBJ/agent-ca -qh -n localhost-with-alias \
+ 		-I localhost-with-alias $OBJ/agent-key.$k.pub || \
+@@ -32,12 +48,16 @@ rm $OBJ/agent-ca # Don't need CA private
+ 
+ unset SSH_AUTH_SOCK
+ 
+-for k in $SSH_KEYTYPES ; do
++for k in $SSH_ACCEPTED_KEYTYPES ; do
+ 	verbose "key type $k"
++	hka=$k
++	if [ $k = "ssh-rsa" ]; then
++	   hka="rsa-sha2-512"
++	fi
+ 	cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+-	echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy
++	echo "HostKeyAlgorithms $hka" >> $OBJ/sshd_proxy
+ 	echo "Hostkey $OBJ/agent-key.${k}" >> $OBJ/sshd_proxy
+-	opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
++	opts="-oHostKeyAlgorithms=$hka -F $OBJ/ssh_proxy"
+ 	( printf 'localhost-with-alias,127.0.0.1,::1 ' ;
+ 	  cat $OBJ/agent-key.$k.pub) > $OBJ/known_hosts
+ 	SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
+@@ -50,15 +70,16 @@ for k in $SSH_KEYTYPES ; do
+ done
+ 
+ SSH_CERTTYPES=`ssh -Q key-sig | grep 'cert-v01@openssh.com'`
++SSH_ACCEPTED_CERTTYPES=`echo "$SSH_CERTTYPES" | egrep "$PUBKEY_ACCEPTED_ALGOS"`
+ 
+ # Prepare sshd_proxy for certificates.
+ cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+ HOSTKEYALGS=""
+-for k in $SSH_CERTTYPES ; do
++for k in $SSH_ACCEPTED_CERTTYPES ; do
+ 	test -z "$HOSTKEYALGS" || HOSTKEYALGS="${HOSTKEYALGS},"
+ 	HOSTKEYALGS="${HOSTKEYALGS}${k}"
+ done
+-for k in $SSH_KEYTYPES ; do
++for k in $SSH_ACCEPTED_KEYTYPES ; do
+ 	echo "Hostkey $OBJ/agent-key.${k}.pub" >> $OBJ/sshd_proxy
+ 	echo "HostCertificate $OBJ/agent-key.${k}-cert.pub" >> $OBJ/sshd_proxy
+ 	test -f $OBJ/agent-key.${k}.pub || fatal "no $k key"
+@@ -70,7 +93,7 @@ echo "HostKeyAlgorithms $HOSTKEYALGS" >>
+ ( printf '@cert-authority localhost-with-alias ' ;
+   cat $OBJ/agent-ca.pub) > $OBJ/known_hosts
+ 
+-for k in $SSH_CERTTYPES ; do
++for k in $SSH_ACCEPTED_CERTTYPES ; do
+ 	verbose "cert type $k"
+ 	opts="-oHostKeyAlgorithms=$k -F $OBJ/ssh_proxy"
+ 	SSH_CONNECTION=`${SSH} $opts host 'echo $SSH_CONNECTION'`
+diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
+--- openssh-9.3p1/sshconnect2.c.xxx	2023-04-26 17:37:35.100827792 +0200
++++ openssh-9.3p1/sshconnect2.c	2023-04-26 17:50:31.860748877 +0200
+@@ -221,7 +221,7 @@
+     const struct ssh_conn_info *cinfo)
+ {
+ 	char *myproposal[PROPOSAL_MAX];
+-	char *all_key, *hkalgs = NULL;
++	char *s, *all_key, *hkalgs = NULL, *filtered_algs = NULL;
+ 	int r, use_known_hosts_order = 0;
+ 
+ #if defined(GSSAPI) && defined(WITH_OPENSSL)
+@@ -257,10 +257,22 @@
+ 	if (use_known_hosts_order)
+ 		hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
+ 
++	filtered_algs = hkalgs ? match_filter_allowlist(hkalgs, options.pubkey_accepted_algos)
++		               : match_filter_allowlist(options.hostkeyalgorithms,
++				 options.pubkey_accepted_algos);
++	if (filtered_algs == NULL) {
++		if (hkalgs)
++			fatal_f("No match between algorithms for %s (host %s) and pubkey accepted algorithms %s",
++			       hkalgs, host, options.pubkey_accepted_algos);
++		else
++			fatal_f("No match between host key algorithms %s and pubkey accepted algorithms %s",
++			        options.hostkeyalgorithms, options.pubkey_accepted_algos);
++	}
++
+ 	kex_proposal_populate_entries(ssh, myproposal,
+ 	    options.kex_algorithms, options.ciphers, options.macs,
+ 	    compression_alg_list(options.compression),
+-	    hkalgs ? hkalgs : options.hostkeyalgorithms);
++	    filtered_algs);
+ 
+ #if defined(GSSAPI) && defined(WITH_OPENSSL)
+ 	if (options.gss_keyex) {
+@@ -304,6 +316,7 @@
+ #endif
+ 
+ 	free(hkalgs);
++	free(filtered_algs);
+ 
+ 	/* start key exchange */
+ 	if ((r = kex_setup(ssh, myproposal)) != 0)

openssh/openssh-9.7p1-nohostsha1proof.patch

@@ -1,6 +1,6 @@
-diff -up openssh-8.7p1/compat.c.sshrsacheck openssh-8.7p1/compat.c
+diff -up openssh-9.7p1/compat.c.sshrsacheck openssh-9.7p1/compat.c
---- openssh-8.7p1/compat.c.sshrsacheck	2023-01-12 13:29:06.338710923 +0100
+--- openssh-9.7p1/compat.c.sshrsacheck	2023-01-12 13:29:06.338710923 +0100
-+++ openssh-8.7p1/compat.c	2023-01-12 13:29:06.357711165 +0100
++++ openssh-9.7p1/compat.c	2023-01-12 13:29:06.357711165 +0100
 @@ -43,6 +43,7 @@ void
  compat_banner(struct ssh *ssh, const char *version)
  {
@@ -31,9 +31,9 @@ diff -up openssh-8.7p1/compat.c.sshrsacheck openssh-8.7p1/compat.c
  }
  
  /* Always returns pointer to allocated memory, caller must free. */
-diff -up openssh-8.7p1/compat.h.sshrsacheck openssh-8.7p1/compat.h
+diff -up openssh-9.7p1/compat.h.sshrsacheck openssh-9.7p1/compat.h
---- openssh-8.7p1/compat.h.sshrsacheck	2021-08-20 06:03:49.000000000 +0200
+--- openssh-9.7p1/compat.h.sshrsacheck	2021-08-20 06:03:49.000000000 +0200
-+++ openssh-8.7p1/compat.h	2023-01-12 13:29:06.358711178 +0100
++++ openssh-9.7p1/compat.h	2023-01-12 13:29:06.358711178 +0100
 @@ -30,7 +30,7 @@
  #define SSH_BUG_UTF8TTYMODE	0x00000001
  #define SSH_BUG_SIGTYPE		0x00000002
@@ -43,9 +43,9 @@ diff -up openssh-8.7p1/compat.h.sshrsacheck openssh-8.7p1/compat.h
  #define SSH_OLD_SESSIONID	0x00000010
  /* #define unused		0x00000020 */
  #define SSH_BUG_DEBUG		0x00000040
-diff -up openssh-8.7p1/monitor.c.sshrsacheck openssh-8.7p1/monitor.c
+diff -up openssh-9.7p1/monitor.c.sshrsacheck openssh-9.7p1/monitor.c
---- openssh-8.7p1/monitor.c.sshrsacheck	2023-01-20 13:07:54.279676981 +0100
+--- openssh-9.7p1/monitor.c.sshrsacheck	2023-01-20 13:07:54.279676981 +0100
-+++ openssh-8.7p1/monitor.c	2023-01-20 15:01:07.007821379 +0100
++++ openssh-9.7p1/monitor.c	2023-01-20 15:01:07.007821379 +0100
 @@ -660,11 +660,12 @@ mm_answer_sign(struct ssh *ssh, int sock
  	struct sshkey *key;
  	struct sshbuf *sigbuf = NULL;
@@ -94,9 +94,9 @@ diff -up openssh-8.7p1/monitor.c.sshrsacheck openssh-8.7p1/monitor.c
  	    is_proof ? "hostkey proof" : "KEX", siglen);
  
  	sshbuf_reset(m);
-diff -up openssh-8.7p1/regress/cert-userkey.sh.sshrsacheck openssh-8.7p1/regress/cert-userkey.sh
+diff -up openssh-9.7p1/regress/cert-userkey.sh.sshrsacheck openssh-9.7p1/regress/cert-userkey.sh
---- openssh-8.7p1/regress/cert-userkey.sh.sshrsacheck	2023-01-25 14:26:52.885963113 +0100
+--- openssh-9.7p1/regress/cert-userkey.sh.sshrsacheck	2023-01-25 14:26:52.885963113 +0100
-+++ openssh-8.7p1/regress/cert-userkey.sh	2023-01-25 14:27:25.757219800 +0100
++++ openssh-9.7p1/regress/cert-userkey.sh	2023-01-25 14:27:25.757219800 +0100
 @@ -7,7 +7,8 @@ rm -f $OBJ/authorized_keys_$USER $OBJ/us
  cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
  cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
@@ -107,9 +107,9 @@ diff -up openssh-8.7p1/regress/cert-userkey.sh.sshrsacheck openssh-8.7p1/regress
  EXTRA_TYPES=""
  rsa=""
  
-diff -up openssh-8.7p1/regress/Makefile.sshrsacheck openssh-8.7p1/regress/Makefile
+diff -up openssh-9.7p1/regress/Makefile.sshrsacheck openssh-9.7p1/regress/Makefile
---- openssh-8.7p1/regress/Makefile.sshrsacheck	2023-01-20 13:07:54.169676051 +0100
+--- openssh-9.7p1/regress/Makefile.sshrsacheck	2023-01-20 13:07:54.169676051 +0100
-+++ openssh-8.7p1/regress/Makefile	2023-01-20 13:07:54.290677074 +0100
++++ openssh-9.7p1/regress/Makefile	2023-01-20 13:07:54.290677074 +0100
 @@ -2,7 +2,8 @@
  
  tests:		prep file-tests t-exec unit
@@ -120,9 +120,9 @@ diff -up openssh-8.7p1/regress/Makefile.sshrsacheck openssh-8.7p1/regress/Makefi
  
  # File based tests
  file-tests: $(REGRESS_TARGETS)
-diff -up openssh-8.7p1/regress/test-exec.sh.sshrsacheck openssh-8.7p1/regress/test-exec.sh
+diff -up openssh-9.7p1/regress/test-exec.sh.sshrsacheck openssh-9.7p1/regress/test-exec.sh
---- openssh-8.7p1/regress/test-exec.sh.sshrsacheck	2023-01-25 14:24:54.778040819 +0100
+--- openssh-9.7p1/regress/test-exec.sh.sshrsacheck	2023-01-25 14:24:54.778040819 +0100
-+++ openssh-8.7p1/regress/test-exec.sh	2023-01-25 14:26:39.500858590 +0100
++++ openssh-9.7p1/regress/test-exec.sh	2023-01-25 14:26:39.500858590 +0100
 @@ -581,8 +581,9 @@ maybe_filter_sk() {
  	fi
  }
@@ -135,10 +135,10 @@ diff -up openssh-8.7p1/regress/test-exec.sh.sshrsacheck openssh-8.7p1/regress/te
  
  for t in ${SSH_KEYTYPES}; do
  	# generate user key
-diff -up openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-8.7p1/regress/unittests/kex/test_kex.c
+diff -up openssh-9.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-9.7p1/regress/unittests/kex/test_kex.c
---- openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck	2023-01-26 13:34:52.645743677 +0100
+--- openssh-9.7p1/regress/unittests/kex/test_kex.c.nosha1hostproof	2024-03-11 11:20:49.000000000 +0600
-+++ openssh-8.7p1/regress/unittests/kex/test_kex.c	2023-01-26 13:36:56.220745823 +0100
++++ openssh-9.7p1/regress/unittests/kex/test_kex.c	2024-03-21 21:26:44.502547206 +0600
-@@ -97,7 +97,8 @@ do_kex_with_key(char *kex, int keytype,
+@@ -96,7 +96,8 @@
  	memcpy(kex_params.proposal, myproposal, sizeof(myproposal));
  	if (kex != NULL)
  		kex_params.proposal[PROPOSAL_KEX_ALGS] = kex;
@@ -148,18 +148,19 @@ diff -up openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-8.7p
  	ASSERT_PTR_NE(keyname, NULL);
  	kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname;
  	ASSERT_INT_EQ(ssh_init(&client, 0, &kex_params), 0);
-@@ -180,7 +181,7 @@ do_kex(char *kex)
+@@ -180,7 +181,7 @@
- {
  #ifdef WITH_OPENSSL
  	do_kex_with_key(kex, KEY_RSA, 2048);
+ #ifdef WITH_DSA
 -	do_kex_with_key(kex, KEY_DSA, 1024);
 +	/* do_kex_with_key(kex, KEY_DSA, 1024); */
+ #endif
  #ifdef OPENSSL_HAS_ECC
  	do_kex_with_key(kex, KEY_ECDSA, 256);
- #endif /* OPENSSL_HAS_ECC */
+
-diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_file.c
+diff -up openssh-9.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-9.7p1/regress/unittests/sshkey/test_file.c
---- openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck	2023-01-26 12:04:55.946343408 +0100
+--- openssh-9.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck	2023-01-26 12:04:55.946343408 +0100
-+++ openssh-8.7p1/regress/unittests/sshkey/test_file.c	2023-01-26 12:06:35.235164432 +0100
++++ openssh-9.7p1/regress/unittests/sshkey/test_file.c	2023-01-26 12:06:35.235164432 +0100
 @@ -110,6 +110,7 @@ sshkey_file_tests(void)
  	sshkey_free(k2);
  	TEST_DONE();
@@ -177,10 +178,10 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-
  
  	TEST_START("load RSA cert with SHA512 signature");
  	ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1_sha512"), &k2), 0);
-diff -up openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c
+diff -up openssh-9.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-9.7p1/regress/unittests/sshkey/test_fuzz.c
---- openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck	2023-01-26 12:10:37.533168013 +0100
+--- openssh-9.7p1/regress/unittests/sshkey/test_fuzz.c.nosha1hostproof	2024-03-11 11:20:49.000000000 +0600
-+++ openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c	2023-01-26 12:15:35.637631860 +0100
++++ openssh-9.7p1/regress/unittests/sshkey/test_fuzz.c	2024-03-21 21:28:07.606026626 +0600
-@@ -333,13 +333,14 @@ sshkey_fuzz_tests(void)
+@@ -338,13 +338,14 @@
  	TEST_DONE();
  
  #ifdef WITH_OPENSSL
@@ -196,25 +197,25 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-
  
  	TEST_START("fuzz RSA SHA256 sig");
  	buf = load_file("rsa_1");
-@@ -357,6 +358,7 @@ sshkey_fuzz_tests(void)
+@@ -362,6 +363,7 @@
  	sshkey_free(k1);
  	TEST_DONE();
  
 +/* Skip this test, SHA1 signatures are not supported
+ #ifdef WITH_DSA
  	TEST_START("fuzz DSA sig");
  	buf = load_file("dsa_1");
- 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
+@@ -371,6 +373,7 @@
-@@ -364,6 +366,7 @@ sshkey_fuzz_tests(void)
- 	sig_fuzz(k1, NULL);
  	sshkey_free(k1);
  	TEST_DONE();
+ #endif
 +*/
  
  #ifdef OPENSSL_HAS_ECC
  	TEST_START("fuzz ECDSA sig");
-diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c
+diff -up openssh-9.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openssh-9.7p1/regress/unittests/sshkey/test_sshkey.c
---- openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck	2023-01-26 11:02:52.339413463 +0100
+--- openssh-9.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck	2023-01-26 11:02:52.339413463 +0100
-+++ openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c	2023-01-26 11:58:42.324253896 +0100
++++ openssh-9.7p1/regress/unittests/sshkey/test_sshkey.c	2023-01-26 11:58:42.324253896 +0100
 @@ -60,6 +60,9 @@ build_cert(struct sshbuf *b, struct sshk
  	u_char *sigblob;
  	size_t siglen;
@@ -277,24 +278,26 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openss
  	ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
  	    SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
  	ASSERT_PTR_EQ(k4, NULL);
-diff -up openssh-8.7p1/regress/unittests/sshsig/tests.c.sshrsacheck openssh-8.7p1/regress/unittests/sshsig/tests.c
+diff -up openssh-9.7p1/regress/unittests/sshsig/tests.c.sshrsacheck openssh-9.7p1/regress/unittests/sshsig/tests.c
---- openssh-8.7p1/regress/unittests/sshsig/tests.c.sshrsacheck	2023-01-26 12:19:23.659513651 +0100
+--- openssh-9.7p1/regress/unittests/sshsig/tests.c.nosha1hostproof	2024-03-11 11:20:49.000000000 +0600
-+++ openssh-8.7p1/regress/unittests/sshsig/tests.c	2023-01-26 12:20:28.021044803 +0100
++++ openssh-9.7p1/regress/unittests/sshsig/tests.c	2024-03-21 21:29:14.951604758 +0600
-@@ -102,9 +102,11 @@ tests(void)
+@@ -103,11 +103,13 @@
  	check_sig("rsa.pub", "rsa.sig", msg, namespace);
  	TEST_DONE();
  
 +/* Skip this test, SHA1 signatures are not supported
+ #ifdef WITH_DSA
  	TEST_START("check DSA signature");
  	check_sig("dsa.pub", "dsa.sig", msg, namespace);
  	TEST_DONE();
+ #endif
 +*/
  
  #ifdef OPENSSL_HAS_ECC
  	TEST_START("check ECDSA signature");
-diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
+diff -up openssh-9.7p1/serverloop.c.sshrsacheck openssh-9.7p1/serverloop.c
---- openssh-8.7p1/serverloop.c.sshrsacheck	2023-01-12 14:57:08.118400073 +0100
+--- openssh-9.7p1/serverloop.c.sshrsacheck	2023-01-12 14:57:08.118400073 +0100
-+++ openssh-8.7p1/serverloop.c	2023-01-12 14:59:17.330470518 +0100
++++ openssh-9.7p1/serverloop.c	2023-01-12 14:59:17.330470518 +0100
 @@ -80,6 +80,7 @@
  #include "auth-options.h"
  #include "serverloop.h"
@@ -314,9 +317,9 @@ diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
  		debug3_f("sign %s key (index %d) using sigalg %s",
  		    sshkey_type(key), ndx, sigalg == NULL ? "default" : sigalg);
  		if ((r = sshbuf_put_cstring(sigbuf,
-diff -up openssh-8.7p1/sshconnect2.c.sshrsacheck openssh-8.7p1/sshconnect2.c
+diff -up openssh-9.7p1/sshconnect2.c.sshrsacheck openssh-9.7p1/sshconnect2.c
---- openssh-8.7p1/sshconnect2.c.sshrsacheck	2023-01-25 15:33:29.140353651 +0100
+--- openssh-9.7p1/sshconnect2.c.sshrsacheck	2023-01-25 15:33:29.140353651 +0100
-+++ openssh-8.7p1/sshconnect2.c	2023-01-25 15:59:34.225364883 +0100
++++ openssh-9.7p1/sshconnect2.c	2023-01-25 15:59:34.225364883 +0100
 @@ -1461,6 +1464,14 @@ identity_sign(struct identity *id, u_cha
  			retried = 1;
  			goto retry_pin;
@@ -332,9 +335,9 @@ diff -up openssh-8.7p1/sshconnect2.c.sshrsacheck openssh-8.7p1/sshconnect2.c
  		goto out;
  	}
  
-diff -up openssh-8.7p1/sshd.c.sshrsacheck openssh-8.7p1/sshd.c
+diff -up openssh-9.7p1/sshd.c.sshrsacheck openssh-9.7p1/sshd.c
---- openssh-8.7p1/sshd.c.sshrsacheck	2023-01-12 13:29:06.355711140 +0100
+--- openssh-9.7p1/sshd.c.sshrsacheck	2023-01-12 13:29:06.355711140 +0100
-+++ openssh-8.7p1/sshd.c	2023-01-12 13:29:06.358711178 +0100
++++ openssh-9.7p1/sshd.c	2023-01-12 13:29:06.358711178 +0100
 @@ -1640,6 +1651,7 @@ main(int ac, char **av)
  	Authctxt *authctxt;
  	struct connection_info *connection_info = NULL;
@@ -387,9 +390,9 @@ diff -up openssh-8.7p1/sshd.c.sshrsacheck openssh-8.7p1/sshd.c
  	/* Prepare the channels layer */
  	channel_init_channels(ssh);
  	channel_set_af(ssh, options.address_family);
-diff -up openssh-8.7p1/ssh-rsa.c.sshrsacheck openssh-8.7p1/ssh-rsa.c
+diff -up openssh-9.7p1/ssh-rsa.c.sshrsacheck openssh-9.7p1/ssh-rsa.c
---- openssh-8.7p1/ssh-rsa.c.sshrsacheck	2023-01-20 13:07:54.180676144 +0100
+--- openssh-9.7p1/ssh-rsa.c.sshrsacheck	2023-01-20 13:07:54.180676144 +0100
-+++ openssh-8.7p1/ssh-rsa.c	2023-01-20 13:07:54.290677074 +0100
++++ openssh-9.7p1/ssh-rsa.c	2023-01-20 13:07:54.290677074 +0100
 @@ -254,7 +254,8 @@ ssh_rsa_verify(const struct sshkey *key,
  			ret = SSH_ERR_INVALID_ARGUMENT;
  			goto out;

openssh/openssh.spec

@@ -1,4 +1,8 @@
 # Do we want SELinux & Audit
+%if 0%{?rhel} < 7
+%global noselinux 1
+%endif
+
 %if 0%{?!noselinux:1}
 %global WITH_SELINUX 1
 %else
@@ -32,6 +36,12 @@
 %global pam_ssh_agent 0
 %endif
 
+%if 0%{?fedora} || 0%{?rhel} >= 8
+%global _emptydir %{_datadir}/empty.sshd
+%else
+%global _emptydir %{_localstatedir}/empty/sshd
+%endif
+
 # Reserve options to override askpass settings with:
 # rpm -ba|--rebuild --define 'skip_xxx 1'
 %{?skip_gnome_askpass:%global no_gnome_askpass 1}
@@ -46,10 +56,10 @@
 %{?static_openssl:%global static_libcrypto 1}
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%global openssh_ver 9.3p2
+%global openssh_ver 9.7p1
 %global openssh_rel 1
 %global pam_ssh_agent_ver 0.10.4
-%global pam_ssh_agent_rel 11
+%global pam_ssh_agent_rel 13
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
@@ -59,7 +69,15 @@ URL: http://www.openssh.com/portable.html
 #URL1: https://github.com/jbeverly/pam_ssh_agent_auth/
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
+%if 0%{?rhel} >= 8
 Source2: sshd.pam
+%else
+%if 0%{?rhel} == 7
+Source2: sshd.pam.el7
+%else
+Source2: sshd.pam.el6
+%endif
+%endif
 Source3: gpgkey-736060BA.gpg
 Source4: https://github.com/jbeverly/pam_ssh_agent_auth/archive/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.gz
 Source5: pam_ssh_agent-rmheaders
@@ -80,6 +98,7 @@ Source21: ssh-host-keys-migration.service
 Source22: openssh.pam
 Source23: openssh.ssh_config
 Source24: openssh.sshd_config
+Source25: sshd.init
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch100: openssh-6.7p1-coverity.patch
@@ -145,7 +164,7 @@ Patch711: openssh-7.8p1-UsePAM-warning.patch
 # Reenable MONITOR_REQ_GSSCHECKMIC after gssapi-with-mic failures
 # upstream MR:
 # https://github.com/openssh-gsskex/openssh-gsskex/pull/21
-Patch800: openssh-9.3p1-gssapi-keyex.patch
+Patch800: openssh-9.7p1-gssapi-keyex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
 Patch801: openssh-6.6p1-force_krb.patch
 # add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
@@ -185,7 +204,7 @@ Patch950: openssh-7.5p1-sandbox.patch
 # PKCS#11 URIs (upstream #2817, 2nd iteration)
 # https://github.com/Jakuje/openssh-portable/commits/jjelen-pkcs11
 # git show > ~/devel/fedora/openssh/openssh-8.0p1-pkcs11-uri.patch
-Patch951: openssh-9.3p2-pkcs11-uri.patch
+Patch951: openssh-9.7p1-pkcs11-uri.patch
 # Unbreak scp between two IPv6 hosts (#1620333)
 Patch953: openssh-7.8p1-scp-ipv6.patch
 # Mention crypto-policies in manual pages (#1668325)
@@ -227,14 +246,11 @@ Patch1002: openssh-8.7p1-ssh-manpage.patch
 # Don't propose disallowed algorithms during hostkey negotiation
 # upstream MR:
 # https://github.com/openssh/openssh-portable/pull/323
-Patch1006: openssh-8.7p1-negotiate-supported-algs.patch
+Patch1006: openssh-9.7p1-negotiate-supported-algs.patch
 
 Patch1012: openssh-9.0p1-evp-fips-dh.patch
 Patch1013: openssh-9.0p1-evp-fips-ecdh.patch
-Patch1014: openssh-8.7p1-nohostsha1proof.patch
+Patch1014: openssh-9.7p1-nohostsha1proof.patch
-
-# upstream b7afd8a4ecaca8afd3179b55e9db79c0ff210237
-Patch1016: openssh-9.3p1-openssl-compat.patch
 
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
@@ -253,10 +269,22 @@ BuildRequires: audit-libs-devel >= 2.0.5
 BuildRequires: util-linux, groff
 BuildRequires: pam-devel
 BuildRequires: openssl3-devel >= 0.9.8j
+%if 0%{?fedora} || 0%{?rhel} >= 7
 BuildRequires: perl-podlators
 BuildRequires: systemd-devel
 BuildRequires: systemd-rpm-macros
-BuildRequires: gcc make
+%else
+BuildRequires: perl
+%endif
+%if 0%{?fedora} || 0%{?rhel} != 7
+BuildRequires: gcc
+%else
+BuildRequires: devtoolset-12-gcc devtoolset-12-build
+%if 0%{?rhel} < 7
+BuildRequires: autoconf2.69 automake1.16 m4
+%endif
+%endif
+BuildRequires: make
 BuildRequires: p11-kit-devel
 BuildRequires: libfido2-devel
 Requires: p11-kit
@@ -272,10 +300,11 @@ BuildRequires: libedit-devel ncurses-devel
 %endif
 
 %if %{WITH_SELINUX}
-Requires: libselinux >= 2.3-5
+Requires: libselinux
-BuildRequires: libselinux-devel >= 2.3-5
+BuildRequires: libselinux-devel
 Requires: audit-libs >= 1.0.8
 BuildRequires: audit-libs >= 1.0.8
+BuildRequires: pkgconfig(libseccomp)
 %endif
 
 BuildRequires: xauth
@@ -297,7 +326,11 @@ Requires: pam >= 1.0.1-3
 %if 0%{?rhel} >= 8
 Requires: crypto-policies >= 20220824-1
 %endif
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %{?systemd_requires}
+%else
+Requires(post): chkconfig >= 0.9, /sbin/service
+%endif
 
 %package keycat
 Summary: A mls keycat backend for openssh
@@ -368,84 +401,85 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 
 %if %{pam_ssh_agent}
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
-%patch -P 300 -p2 -b .psaa-build
+%patch300 -p2 -b .psaa-build
-%patch -P 301 -p2 -b .psaa-seteuid
+%patch301 -p2 -b .psaa-seteuid
-%patch -P 302 -p2 -b .psaa-visibility
+%patch302 -p2 -b .psaa-visibility
-%patch -P 306 -p2 -b .psaa-compat
+%patch306 -p2 -b .psaa-compat
-%patch -P 305 -p2 -b .psaa-agent
+%patch305 -p2 -b .psaa-agent
-%patch -P 307 -p2 -b .psaa-deref
+%patch307 -p2 -b .psaa-deref
-%patch -P 308 -p2 -b .rsasha2
+%patch308 -p2 -b .rsasha2
-%patch -P 309 -p1 -b .psaa-configure-c99
+%patch309 -p1 -b .psaa-configure-c99
 # Remove duplicate headers and library files
 rm -f $(cat %{SOURCE5})
 popd
 %endif
 
-%patch -P 400 -p1 -b .role-mls
+%patch400 -p1 -b .role-mls
-%patch -P 404 -p1 -b .privsep-selinux
+%patch404 -p1 -b .privsep-selinux
 
-%patch -P 502 -p1 -b .keycat
+%patch502 -p1 -b .keycat
 
-%patch -P 601 -p1 -b .ip-opts
+%patch601 -p1 -b .ip-opts
-%patch -P 606 -p1 -b .ipv6man
+%patch606 -p1 -b .ipv6man
-%patch -P 607 -p1 -b .sigpipe
+%patch607 -p1 -b .sigpipe
-%patch -P 609 -p1 -b .x11
+%patch609 -p1 -b .x11
-%patch -P 702 -p1 -b .progress
+%patch702 -p1 -b .progress
-%patch -P 703 -p1 -b .grab-info
+%patch703 -p1 -b .grab-info
-%patch -P 707 -p1 -b .redhat
+%patch707 -p1 -b .redhat
-%patch -P 711 -p1 -b .log-usepam-no
+%patch711 -p1 -b .log-usepam-no
 #
-%patch -P 800 -p1 -b .gsskex
+%patch800 -p1 -b .gsskex
-%patch -P 801 -p1 -b .force_krb
+%patch801 -p1 -b .force_krb
-%patch -P 804 -p1 -b .ccache_name
+%patch804 -p1 -b .ccache_name
-%patch -P 805 -p1 -b .k5login
+%patch805 -p1 -b .k5login
 #
-%patch -P 901 -p1 -b .kuserok
+%patch901 -p1 -b .kuserok
-%patch -P 906 -p1 -b .fromto-remote
+%patch906 -p1 -b .fromto-remote
-%patch -P 916 -p1 -b .contexts
+%patch916 -p1 -b .contexts
-%patch -P 918 -p1 -b .log-in-chroot
+%patch918 -p1 -b .log-in-chroot
-%patch -P 919 -p1 -b .scp
+%patch919 -p1 -b .scp
-%patch -P 802 -p1 -b .GSSAPIEnablek5users
+%patch802 -p1 -b .GSSAPIEnablek5users
-%patch -P 922 -p1 -b .sshdt
+%patch922 -p1 -b .sshdt
-%patch -P 926 -p1 -b .sftp-force-mode
+%patch926 -p1 -b .sftp-force-mode
-%patch -P 939 -p1 -b .s390-dev
+%patch939 -p1 -b .s390-dev
-%patch -P 944 -p1 -b .x11max
+%patch944 -p1 -b .x11max
-%patch -P 948 -p1 -b .systemd
+%patch948 -p1 -b .systemd
-%patch -P 949 -p1 -b .refactor
+%patch949 -p1 -b .refactor
-%patch -P 950 -p1 -b .sandbox
+%patch950 -p1 -b .sandbox
-%patch -P 951 -p1 -b .pkcs11-uri
+%patch951 -p1 -b .pkcs11-uri
-%patch -P 953 -p1 -b .scp-ipv6
+%patch953 -p1 -b .scp-ipv6
 %if 0%{?rhel} >= 8
-%patch -P 962 -p1 -b .crypto-policies
+%patch962 -p1 -b .crypto-policies
 %endif
-%patch -P 963 -p1 -b .openssl-evp
+%patch963 -p1 -b .openssl-evp
-%patch -P 964 -p1 -b .openssl-kdf
+%patch964 -p1 -b .openssl-kdf
-%patch -P 965 -p1 -b .visibility
+%patch965 -p1 -b .visibility
-%patch -P 966 -p1 -b .x11-ipv6
+%patch966 -p1 -b .x11-ipv6
-%patch -P 974 -p1 -b .keygen-strip-doseol
+%patch974 -p1 -b .keygen-strip-doseol
-%patch -P 975 -p1 -b .preserve-pam-errors
+%patch975 -p1 -b .preserve-pam-errors
 
-%patch -P 977 -p1 -b .kill-scp
+%patch977 -p1 -b .kill-scp
 
-%patch -P 981 -p1 -b .scp-sftpdirs
+%patch981 -p1 -b .scp-sftpdirs
-%patch -P 982 -p1 -b .minrsabits
+%patch982 -p1 -b .minrsabits
-%patch -P 984 -p1 -b .ibmca
+%patch984 -p1 -b .ibmca
 
-%patch -P 200 -p1 -b .audit
+%patch200 -p1 -b .audit
-%patch -P 201 -p1 -b .audit-race
+%patch201 -p1 -b .audit-race
-%patch -P 202 -p1 -b .audit-log
+%patch202 -p1 -b .audit-log
-%patch -P 700 -p1 -b .fips
+%patch700 -p1 -b .fips
 
-%patch -P 1002 -p1 -b .ssh-manpage
+%patch1002 -p1 -b .ssh-manpage
 
-%patch -P 1006 -p1 -b .negotiate-supported-algs
+%patch1006 -p1 -b .negotiate-supported-algs
 
-%patch -P 1012 -p1 -b .evp-fips-dh
+%patch1012 -p1 -b .evp-fips-dh
-%patch -P 1013 -p1 -b .evp-fips-ecdh
+%patch1013 -p1 -b .evp-fips-ecdh
-%patch -P 1014 -p1 -b .nosha1hostproof
+%patch1014 -p1 -b .nosha1hostproof
-%patch -P 1016 -p1 -b .ossl-version
+
+
+%patch100 -p1 -b .coverity
 
-%patch -P 100 -p1 -b .coverity
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -453,9 +487,14 @@ autoreconf
 popd
 
 %build
+%if 0%{?rhel} == 7
+%enable_devtoolset12
+%endif
+
 %set_build_flags
 # the -fvisibility=hidden is needed for clean build of the pam_ssh_agent_auth
 # it is needed for lib(open)ssh build too since it is linked to the pam module too
+
 CFLAGS="$CFLAGS -I%{_includedir}/openssl3 -fvisibility=hidden"; export CFLAGS
 %if %{pie}
 %ifarch s390 s390x sparc sparcv9 sparc64
@@ -466,6 +505,10 @@ CFLAGS="$CFLAGS -fpic"
 SAVE_LDFLAGS="$LDFLAGS"
 LDFLAGS="$LDFLAGS -pie -z relro -z now"
 
+%if 0%{?rhel} < 7
+LDFLAGS="$LDFLAGS -lrt"
+%endif
+
 export CFLAGS
 export LDFLAGS
 
@@ -490,16 +533,24 @@ fi
 	--sysconfdir=%{_sysconfdir}/ssh \
 	--libexecdir=%{_libexecdir}/openssh \
 	--datadir=%{_datadir}/openssh \
+	--enable-vendor-patchlevel="RHEL10-%{openssh_ver}-%{openssh_rel}" \
+%if 0%{?fedora} || 0%{?rhel} >= 7
 	--with-default-path=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \
 	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
-	--with-privsep-path=%{_datadir}/empty.sshd \
+%else
+	--with-default-path=/usr/local/bin:/bin:/usr/bin \
+	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
+%endif
+	--with-privsep-path=%{_emptydir} \
 	--disable-strip \
 	--without-zlib-version-check \
 	--with-ssl-engine \
 	--with-ipaddr-display \
 	--with-pie=no \
 	--without-hardening `# The hardening flags are configured by system` \
+%if 0%{?fedora} || 0%{?rhel} >= 7
 	--with-systemd \
+%endif
 	--with-default-pkcs11-provider=yes \
 	--with-security-key-builtin=yes \
 	--with-pam \
@@ -550,6 +601,11 @@ popd
 %if %{pam_ssh_agent}
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
 LDFLAGS="$SAVE_LDFLAGS -ldl"
+
+%if 0%{?rhel} < 7
+LDFLAGS="$LDFLAGS -lrt"
+%endif
+
 %configure --with-selinux \
 	--libexecdir=/%{_libdir}/security \
 	--with-mantype=man \
@@ -584,10 +640,12 @@ install -m644 sshd_config_redhat_cp $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_confi
 install -m644 sshd_config_redhat $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config.d/50-redhat.conf
 install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
 %else
-install -m 644 %{SOURCE22} $RPM_BUILD_ROOT/etc/pam.d/sshd
 install -m 644 %{SOURCE23} $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config
 install -m 644 %{SOURCE24} $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config
 %endif
+install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
+install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
+%if 0%{?rhel} >= 7
 install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
 install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
 install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
@@ -598,9 +656,7 @@ install -d -m755 $RPM_BUILD_ROOT/%{_userunitdir}
 install -m644 %{SOURCE16} $RPM_BUILD_ROOT/%{_userunitdir}/ssh-agent.service
 install -m644 %{SOURCE17} $RPM_BUILD_ROOT/%{_userunitdir}/ssh-agent.socket
 install -m744 %{SOURCE13} $RPM_BUILD_ROOT/%{_libexecdir}/openssh/sshd-keygen
-install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
+install -d -m711 ${RPM_BUILD_ROOT}/%{_emptydir}
-install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
-install -d -m711 ${RPM_BUILD_ROOT}/%{_datadir}/empty.sshd
 install -p -D -m 0644 %{SOURCE19} %{buildroot}%{_sysusersdir}/openssh-server.conf
 # Migration service/script for Fedora 38 change to remove group ownership for standard host keys
 # See https://fedoraproject.org/wiki/Changes/SSHKeySignSuidBit
@@ -609,6 +665,10 @@ install -m744 %{SOURCE20} $RPM_BUILD_ROOT/%{_libexecdir}/openssh/ssh-host-keys-m
 install -m644 %{SOURCE21} $RPM_BUILD_ROOT/%{_unitdir}/ssh-host-keys-migration.service
 install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib
 touch $RPM_BUILD_ROOT/%{_localstatedir}/lib/.ssh-host-keys-migration
+%else
+install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
+install -m755 %{SOURCE25} $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd
+%endif
 
 %if ! %{no_gnome_askpass}
 install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
@@ -643,10 +703,16 @@ getent group ssh_keys >/dev/null || groupadd -r ssh_keys || :
 getent group sshd >/dev/null || groupadd -g %{sshd_uid} -r sshd || :
 getent passwd sshd >/dev/null || \
   useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd \
-  -s /sbin/nologin -r -d /usr/share/empty.sshd sshd 2> /dev/null || :
+  -s /sbin/nologin -r -d %{_emptydir} sshd 2> /dev/null || :
 
 %post server
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %systemd_post sshd.service sshd.socket
+%else
+/sbin/chkconfig --add sshd
+%else
+
+%endif
 %if 0%{?fedora} || 0%{?rhel} >= 8
 # Migration scriptlet for Fedora 31 and 32 installations to sshd_config
 # drop-in directory (in F32+).
@@ -662,18 +728,34 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %preun server
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %systemd_preun sshd.service sshd.socket
+%else
+if [ "$1" = 0 ]
+then
+        /sbin/service sshd stop > /dev/null 2>&1 || :
+        /sbin/chkconfig --del sshd
+fi
+%endif
 
 %postun server
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %systemd_postun_with_restart sshd.service
+%else
+/sbin/service sshd condrestart > /dev/null 2>&1 || :
+%endif
 
 %post clients
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %systemd_user_post ssh-agent.service
 %systemd_user_post ssh-agent.socket
+%endif
 
 %preun clients
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %systemd_user_preun ssh-agent.service
 %systemd_user_preun ssh-agent.socket
+%endif
 
 %files
 %doc CREDITS ChangeLog OVERVIEW PROTOCOL* README README.platform README.privsep README.tun README.dns TODO LICENCE
@@ -710,14 +792,15 @@ test -f %{sysconfig_anaconda} && \
 %attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
 %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %attr(0644,root,root) %{_userunitdir}/ssh-agent.service
 %attr(0644,root,root) %{_userunitdir}/ssh-agent.socket
+%endif
 
 %files server
-%dir %attr(0711,root,root) %{_datadir}/empty.sshd
+%dir %attr(0711,root,root) %{_emptydir}
 %attr(0755,root,root) %{_sbindir}/sshd
 %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
-%attr(0755,root,root) %{_libexecdir}/openssh/sshd-keygen
 %attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
 %attr(0644,root,root) %{_mandir}/man5/moduli.5*
 %attr(0644,root,root) %{_mandir}/man8/sshd.8*
@@ -731,6 +814,7 @@ test -f %{sysconfig_anaconda} && \
 %attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
 %attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
 
+%if 0%{?fedora} || 0%{?rhel} >= 7
 %attr(0644,root,root) %{_unitdir}/sshd.service
 %attr(0644,root,root) %{_unitdir}/sshd@.service
 %attr(0644,root,root) %{_unitdir}/sshd.socket
@@ -739,7 +823,11 @@ test -f %{sysconfig_anaconda} && \
 %attr(0644,root,root) %{_sysusersdir}/openssh-server.conf
 %attr(0644,root,root) %{_unitdir}/ssh-host-keys-migration.service
 %attr(0744,root,root) %{_libexecdir}/openssh/ssh-host-keys-migration.sh
+%attr(0755,root,root) %{_libexecdir}/openssh/sshd-keygen
 %ghost %attr(0644,root,root) %{_localstatedir}/lib/.ssh-host-keys-migration
+%else
+%attr(0755,root,root) /etc/rc.d/init.d/sshd
+%endif
 
 %files keycat
 %doc HOWTO.ssh-keycat
@@ -758,12 +846,22 @@ test -f %{sysconfig_anaconda} && \
 
 %if %{pam_ssh_agent}
 %files -n pam_ssh_agent_auth
+%if 0%{?fedora} || 0%{?rhel} >= 8
 %license pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE
+%else
+%doc pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE
+%endif
 %attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so
 %attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*
 %endif
 
 %changelog
+* Wed Feb 28 2024 Raven <raven@sysadmins.ws> - 9.6p2-1
+- New upstream release
+
+* Fri Oct 20 2023 Raven <raven@sysadmins.ws> - 9.3p2-1
+- add pam config ported from proper rhel versions
+
 * Fri Oct 20 2023 Raven <raven@sysadmins.ws> - 9.3p2-1
 - New upstream release
 

openssh/sshd.init

@@ -0,0 +1,236 @@
+#!/bin/bash
+#
+# sshd		Start up the OpenSSH server daemon
+#
+# chkconfig: 2345 55 25
+# description: SSH is a protocol for secure remote shell access. \
+#              This service starts up the OpenSSH server daemon.
+#
+# processname: sshd
+# config: /etc/ssh/ssh_host_key
+# config: /etc/ssh/ssh_host_key.pub
+# config: /etc/ssh/ssh_random_seed
+# config: /etc/ssh/sshd_config
+# pidfile: /var/run/sshd.pid
+
+### BEGIN INIT INFO
+# Provides: sshd
+# Required-Start: $local_fs $network $syslog
+# Required-Stop: $local_fs $syslog
+# Should-Start: $syslog
+# Should-Stop: $network $syslog
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Start up the OpenSSH server daemon
+# Description:       SSH is a protocol for secure remote shell access.
+#		     This service starts up the OpenSSH server daemon.
+### END INIT INFO
+
+# source function library
+. /etc/rc.d/init.d/functions
+
+# pull in sysconfig settings
+[ -f /etc/sysconfig/sshd ] && . /etc/sysconfig/sshd
+
+RETVAL=0
+prog="sshd"
+lockfile=/var/lock/subsys/$prog
+
+# Some functions to make the below more readable
+KEYGEN=/usr/bin/ssh-keygen
+SSHD=/usr/sbin/sshd
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+PID_FILE=/var/run/sshd.pid
+
+runlevel=$(set -- $(runlevel); eval "echo \$$#" )
+
+fips_enabled() {
+	if [ -r /proc/sys/crypto/fips_enabled ]; then
+		cat /proc/sys/crypto/fips_enabled
+	else
+		echo 0
+	fi
+}
+
+do_rsa1_keygen() {
+	if [ ! -s $RSA1_KEY -a `fips_enabled` -eq 0 ]; then
+		echo -n $"Generating SSH1 RSA host key: "
+		rm -f $RSA1_KEY
+		if test ! -f $RSA1_KEY && $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
+			chmod 600 $RSA1_KEY
+			chmod 644 $RSA1_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $RSA1_KEY.pub
+			fi
+			success $"RSA1 key generation"
+			echo
+		else
+			failure $"RSA1 key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+do_rsa_keygen() {
+	if [ ! -s $RSA_KEY ]; then
+		echo -n $"Generating SSH2 RSA host key: "
+		rm -f $RSA_KEY
+		if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
+			chmod 600 $RSA_KEY
+			chmod 644 $RSA_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $RSA_KEY.pub
+			fi
+			success $"RSA key generation"
+			echo
+		else
+			failure $"RSA key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+do_dsa_keygen() {
+	if [ ! -s $DSA_KEY -a `fips_enabled` -eq 0 ]; then
+		echo -n $"Generating SSH2 DSA host key: "
+		rm -f $DSA_KEY
+		if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
+			chmod 600 $DSA_KEY
+			chmod 644 $DSA_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $DSA_KEY.pub
+			fi
+			success $"DSA key generation"
+			echo
+		else
+			failure $"DSA key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+do_restart_sanity_check()
+{
+	$SSHD -t
+	RETVAL=$?
+	if [ $RETVAL -ne  0 ]; then
+		failure $"Configuration file or keys are invalid"
+		echo
+	fi
+}
+
+start()
+{
+	[ -x $SSHD ] || exit 5
+	[ -f /etc/ssh/sshd_config ] || exit 6
+	# Create keys if necessary
+	if [ "x${AUTOCREATE_SERVER_KEYS}" != xNO ]; then
+		do_rsa_keygen
+		if [ "x${AUTOCREATE_SERVER_KEYS}" != xRSAONLY ]; then
+			do_rsa1_keygen
+			do_dsa_keygen
+		fi
+	fi
+
+	echo -n $"Starting $prog: "
+	$SSHD $OPTIONS && success || failure
+	RETVAL=$?
+	[ $RETVAL -eq 0 ] && touch $lockfile
+	echo
+	return $RETVAL
+}
+
+stop()
+{
+	echo -n $"Stopping $prog: "
+	killproc -p $PID_FILE $SSHD
+	RETVAL=$?
+	# if we are in halt or reboot runlevel kill all running sessions
+	# so the TCP connections are closed cleanly
+	if [ "x$runlevel" = x0 -o "x$runlevel" = x6 ] ; then
+	    trap '' TERM
+	    killall $prog 2>/dev/null
+	    trap TERM
+	fi
+	[ $RETVAL -eq 0 ] && rm -f $lockfile
+	echo
+}
+
+reload()
+{
+	echo -n $"Reloading $prog: "
+	killproc -p $PID_FILE $SSHD -HUP
+	RETVAL=$?
+	echo
+}
+
+restart() {
+	stop
+	start
+}
+
+force_reload() {
+	restart
+}
+
+rh_status() {
+	status -p $PID_FILE openssh-daemon
+}
+
+rh_status_q() {
+	rh_status >/dev/null 2>&1
+}
+
+case "$1" in
+	start)
+		rh_status_q && exit 0
+		start
+		;;
+	stop)
+		if ! rh_status_q; then
+			rm -f $lockfile
+			exit 0
+		fi
+		stop
+		;;
+	restart)
+		restart
+		;;
+	reload)
+		rh_status_q || exit 7
+		reload
+		;;
+	force-reload)
+		force_reload
+		;;
+	condrestart|try-restart)
+		rh_status_q || exit 0
+		if [ -f $lockfile ] ; then
+			do_restart_sanity_check
+			if [ $RETVAL -eq 0 ] ; then
+				stop
+				# avoid race
+				sleep 3
+				start
+			else
+				RETVAL=6
+			fi
+		fi
+		;;
+	status)
+		rh_status
+		RETVAL=$?
+		if [ $RETVAL -eq 3 -a -f $lockfile ] ; then
+			RETVAL=2
+		fi
+		;;
+	*)
+		echo $"Usage: $0 {start|stop|restart|reload|force-reload|condrestart|try-restart|status}"
+		RETVAL=2
+esac
+exit $RETVAL

openssh/sshd.pam.el6

@@ -0,0 +1,14 @@
+#%PAM-1.0
+auth	   required	pam_sepermit.so
+auth       include      password-auth
+account    required     pam_nologin.so
+account    include      password-auth
+password   include      password-auth
+# pam_selinux.so close should be the first session rule
+session    required     pam_selinux.so close
+session    required     pam_loginuid.so
+# pam_selinux.so open should only be followed by sessions to be executed in the user context
+session    required     pam_selinux.so open env_params
+session    required     pam_namespace.so
+session    optional     pam_keyinit.so force revoke
+session    include      password-auth