Accepting request 922068 from home:hpjansson:branches:network

- Version upgrade to 8.8p1
  * No changes for askpass, see main package changelog for
    details

- Version update to 8.8p1:
  = Security
  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
    supplemental groups when executing an AuthorizedKeysCommand or
    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
    AuthorizedPrincipalsCommandUser directive has been set to run the
    command as a different user. Instead these commands would inherit
    the groups that sshd(8) was started with.
    Depending on system configuration, inherited groups may allow
    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
    gain unintended privilege.
    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
    enabled by default in sshd_config(5).
  = Potentially-incompatible changes
  * This release disables RSA signatures using the SHA-1 hash algorithm
    by default. This change has been made as the SHA-1 hash algorithm is
    cryptographically broken, and it is possible to create chosen-prefix
    hash collisions for <USD$50K.
    For most users, this change should be invisible and there is
    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
    will automatically use the stronger algorithm where possible.
    Incompatibility is more likely when connecting to older SSH
    implementations that have not been upgraded or have not closely tracked
    improvements in the SSH protocol. For these cases, it may be necessary
    to selectively re-enable RSA/SHA1 to allow connection and/or user
    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
    options.
  = New features
  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
    directive to accept a "none" argument to specify the default
    behaviour.
  = Bugfixes
  * scp(1): when using the SFTP protocol, continue transferring files
    after a transfer error occurs, better matching original scp/rcp
    behaviour.
  * ssh(1): fixed a number of memory leaks in multiplexing,
  * ssh-keygen(1): avoid crash when using the -Y find-principals
    command.
  * A number of documentation and manual improvements, including
    bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
  = Potentially-incompatible changes
  * scp(1): this release changes the behaviour of remote to remote
    copies (e.g. "scp host-a:/path host-b:") to transfer through the
    local host by default. This was previously available via the -3
    flag. This mode avoids the need to expose credentials on the
    origin hop, avoids triplicate interpretation of filenames by the
    shell (by the local system, the copy origin and the destination)
    and, in conjunction with the SFTP support for scp(1) mentioned
    below, allows use of all authentication methods to the remote
    hosts (previously, only non-interactive methods could be used).
    A -R flag has been added to select the old behaviour.
  * ssh(1)/sshd(8): both the client and server are now using a
    stricter configuration file parser. The new parser uses more
    shell-like rules for quotes, space and escape characters. It is
    also more strict in rejecting configurations that include options
    lacking arguments. Previously some options (e.g. DenyUsers) could
    appear on a line with no subsequent arguments. This release will
    reject such configurations. The new parser will also reject
    configurations with unterminated quotes and multiple '='
    characters after the option name.
  * ssh(1): when using SSHFP DNS records for host key verification,
    ssh(1) will verify all matching records instead of just those
    with the specific signature type requested. This may cause host
    key verification problems if stale SSHFP records of a different
    or legacy signature type exist alongside other records for a
    particular host. bz#3322
  * ssh-keygen(1): when generating a FIDO key and specifying an
    explicit attestation challenge (using -Ochallenge), the challenge
    will now be hashed by the builtin security key middleware. This
    removes the (undocumented) requirement that challenges be exactly
    32 bytes in length and matches the expectations of libfido2.
  * sshd(8): environment="..." directives in authorized_keys files are
    now first-match-wins and limited to 1024 discrete environment
    variable names.
  = New features
  * scp(1): experimental support for transfers using the SFTP protocol
    as a replacement for the venerable SCP/RCP protocol that it has
    traditionally used. SFTP offers more predictable filename handling
    and does not require expansion of glob(3) patterns via the shell
    on the remote side.
  * sftp-server(8): add a protocol extension to support expansion of
    ~/ and ~user/ prefixed paths. This was added to support these
    paths when used by scp(1) while in SFTP mode.
  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
    the ssh(1) -f flag. GHPR231
  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
    config file to do the same thing as -n does on the ssh(1) command-
    line. GHPR231
  * ssh(1): add a SessionType directive to ssh_config, allowing the
    configuration file to offer equivalent control to the -N (no
    session) and -s (subsystem) command-line flags. GHPR231
  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
    signatures now support listing key validity intervals alongside
    they key, and ssh-keygen(1) can optionally check during signature
    verification whether a specified time falls inside this interval.
    This feature is intended for use by git to support signing and
    verifying objects using ssh keys.
  * ssh-keygen(8): support printing of the full public key in a sshsig
    signature via a -Oprint-pubkey flag.
  = Bugfixes
  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
    the client and server mainloops. Previously the re-key timeout
    could expire but re-keying would not start until a packet was sent
    or received, causing a spin in select() if the connection was
    quiescent.
  * ssh-keygen(1): avoid Y2038 problem in printing certificate
    validity lifetimes. Dates past 2^31-1 seconds since epoch were
    displayed incorrectly on some platforms. bz#3329
  * scp(1): allow spaces to appear in usernames for local to remote
    and scp -3 remote to remote copies. bz#1164
  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
    in favour of KbdInteractiveAuthentication. The former is what was in
    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
    treated as somewhat but not entirely equivalent. We retain the old
    name as a deprecated alias so configuration files continue to work
    as well as a reference in the man page for people looking for it.
    bz#3303
  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
    when extracting a key from a PKCS#11 certificate. bz#3327
  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
    needs file descriptors in non-blocking mode to operate but it was
    not restoring the original state on exit. This could cause
    problems with fds shared with other programs via the shell,
    bz#3280 and GHPR246
  * ssh(1)/sshd(8): switch both client and server mainloops from
    select(3) to pselect(3). Avoids race conditions where a signal
    may arrive immediately before select(3) and not be processed until
    an event fires. bz#2158
  * ssh(1): sessions started with ControlPersist were incorrectly
    executing a shell when the -N (no shell) option was specified.
    bz#3290
  * ssh(1): check if IPQoS or TunnelDevice are already set before
    overriding. Prevents values in config files from overriding values
    supplied on the command line. bz#3319
  * ssh(1): fix debug message when finding a private key to match a
    certificate being attempted for user authentication. Previously it
    would print the certificate's path, whereas it was supposed to be
    showing the private key's path. GHPR247
  * sshd(8): match host certificates against host public keys, not
    private keys. Allows use of certificates with private keys held in
    a ssh-agent.  bz#3524
  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
    allows RSA/SHA2 signatures for public key authentication but fails
    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
    clients of these server to incorrectly match
    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
    keys. bz#3213
  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
    limits@openssh.com extension but fails when the client tries to
    invoke it. bz#3318
  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
    otherwise handled specially by the protocol. Useful in ~/.ssh/config
    to set TERM to something generic (e.g. "xterm" instead of
    "xterm-256color") for destinations that lack terminfo entries.
  * sftp-server(8): the limits@openssh.com extension was incorrectly
    marked as an operation that writes to the filesystem, which made it
    unavailable in sftp-server read-only mode. bz#3318
  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
    the update removed more host keys than remain present.
  * Many manual page fixes.
- Additional changes from 8.6p1 release:
  = Security
  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
    option was enabled with a set of patterns that activated logging
    in code that runs in the low-privilege sandboxed sshd process, the
    log messages were constructed in such a way that printf(3) format
    strings could effectively be specified the low-privilege code.
  = New features
  * sftp-server(8): add a new limits@openssh.com protocol extension
    that allows a client to discover various server limits, including
    maximum packet size and maximum read/write length.
  * sftp(1): use the new limits@openssh.com extension (when available)
    to select better transfer lengths in the client.
  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
    location of the "moduli" file containing the groups for DH-GEX.
  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
    enable printing of the elapsed time in seconds of each test.
  = Bugfixes
  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
    manual pages with the current default. GHPR174
  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
    GHPR234
  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
    backslashes were not being dequoted correctly and quoted space in
    the middle of a string was being incorrectly split. GHPR223
  * ssh(1): return non-zero exit status when killed by signal; bz#3281
  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
    packet size. Also handle zero-length reads that are not explicitly
    banned by the spec.
- Additional changes from 8.5p1 release:
  = Security
  * ssh-agent(1): fixed a double-free memory corruption that was
    introduced in OpenSSH 8.2 . We treat all such memory faults as
    potentially exploitable. This bug could be reached by an attacker
    with access to the agent socket.
  = Potentially-incompatible changes
  * ssh(1), sshd(8): this release changes the first-preference signature
    algorithm from ECDSA to ED25519.
  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
    for interactive use prior to TCP connect. The connection phase of
    the SSH session is time-sensitive and often explicitly interactive.
    The ultimate interactive/bulk TOS/DSCP will be set after
    authentication completes.
  * ssh(1), sshd(8): remove the pre-standardization cipher
    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
    it was standardized in RFC4253 (2006), has been deprecated and
    disabled by default since OpenSSH 7.2 (2016) and was only briefly
    documented in ssh.1 in 2001.
  * ssh(1), sshd(8): update/replace the experimental post-quantum
    hybrid key exchange method based on Streamlined NTRU Prime coupled
    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
    method is replaced with sntrup761x25519-sha512@openssh.com.
  * ssh(1): disable CheckHostIP by default. It provides insignificant
    benefits while making key rotation significantly more difficult,
    especially for hosts behind IP-based load-balancers.
  = New features
  * ssh(1): this release enables UpdateHostkeys by default subject to
    some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.
  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
    that allows forcing maximum debug logging by file/function/line
    pattern-lists.
  * ssh(1): when prompting the user to accept a new hostkey, display
    any other host names/addresses already associated with the key.
  * ssh(1): allow UserKnownHostsFile=none to indicate that no
    known_hosts file should be used to identify host keys.
  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
    client to obtain known_hosts data from a command in addition to
    the usual files.
  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
    client to restrict the destination when RemoteForward is used
    with SOCKS.
  * ssh(1): for FIDO keys, if a signature operation fails with a
    "incorrect PIN" reason and no PIN was initially requested from the
    user, then request a PIN and retry the operation. This supports
    some biometric devices that fall back to requiring PIN when reading
    of the biometric failed, and devices that require PINs for all
    hosted credentials.
  * sshd(8): implement client address-based rate-limiting via new
    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
    directives that provide more fine-grained control on a per-origin
    address basis than the global MaxStartups limit.
  = Bugfixes
   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224
  * sshd(8): fix sshd_config SetEnv directives located inside Match
    blocks. GHPR201
  * ssh(1): when requesting a FIDO token touch on stderr, inform the
    user once the touch has been recorded.
  * ssh(1): prevent integer overflow when ridiculously large
    ConnectTimeout values are specified, capping the effective value
    (for most platforms) at 24 days. bz#3229
  * ssh(1): consider the ECDSA key subtype when ordering host key
    algorithms in the client.
  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
    that it control allowed key algorithms, when this option actually
    specifies the signature algorithms that are accepted. The previous
    name remains available as an alias. bz#3253
  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
  * sftp-server(8): add missing lsetstat@openssh.com documentation
    and advertisement in the server's SSH2_FXP_VERSION hello packet.
  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
    banning packet types once they are received. Fixes memleak caused
    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
    platforms instead of being limited by LONG_MAX. bz#3206
  * Minor man page fixes (capitalization, commas, etc.) bz#3223
  * sftp(1): when doing an sftp recursive upload or download of a
    read-only directory, ensure that the directory is created with
    write and execute permissions in the interim so that the transfer
    can actually complete, then set the directory permission as the
    final step. bz#3222
  * ssh-keygen(1): document the -Z, check the validity of its argument
    earlier and provide a better error message if it's not correct.
    bz#2879
  * ssh(1): ignore comments at the end of config lines in ssh_config,
    similar to what we already do for sshd_config. bz#2320
  * sshd_config(5): mention that DisableForwarding is valid in a
    sshd_config Match block. bz3239
  * sftp(1): fix incorrect sorting of "ls -ltr" under some
    circumstances. bz3248.
  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
    timeout values. bz#3250
  * ssh(1): make hostbased authentication send the signature algorithm
    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
    This make HostbasedAcceptedAlgorithms do what it is supposed to -
    filter on signature algorithm and not key type.
- Rebased patches:
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
  * openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-disable_openssl_abi_check.patch
  * openssh-7.7p1-eal3.patch
  * openssh-7.7p1-enable_PAM_by_default.patch
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-host_ident.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-no_fork-no_pid_file.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-pts_names_formatting.patch
  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
  * openssh-7.7p1-seccomp_ipc_flock.patch
  * openssh-7.7p1-seccomp_stat.patch
  * openssh-7.7p1-send_locale.patch
  * openssh-7.7p1-sftp_force_permissions.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.9p1-keygen-preserve-perms.patch
  * openssh-7.9p1-revert-new-qos-defaults.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch
  * openssh-8.1p1-seccomp-clock_nanosleep.patch
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-use-openssl-kdf.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-fips-ensure-approved-moduli.patch
  * openssh-link-with-sk.patch
  * openssh-reenable-dh-group14-sha1-default.patch
  * openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).

OBS-URL: https://build.opensuse.org/request/show/922068
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235

openssh-7.7p1-IPv6_X_forwarding.patch

@@ -5,15 +5,11 @@ Correctly parse DISPLAY variable for cases where it contains an IPv6 address
 
 bnc#847710 - https://bugzilla.novell.com/show_bug.cgi?id=847710
 
-diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
+Index: openssh-8.8p1/channels.c
---- openssh-7.7p1/channels.c
+===================================================================
-+++ openssh-7.7p1/channels.c
+--- openssh-8.8p1.orig/channels.c
-@@ -4590,33 +4590,42 @@ x11_connect_display(struct ssh *ssh)
++++ openssh-8.8p1/channels.c
- 			return -1;
+@@ -4776,9 +4776,10 @@ x11_connect_display(struct ssh *ssh)
- 
- 		/* OK, we now have a connection to the display. */
- 		return sock;
- 	}
  	/*
  	 * Connect to an inet socket.  The DISPLAY value is supposedly
  	 * hostname:d[.s], where hostname may also be numeric IP address.
@@ -25,14 +21,7 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
  	if (!cp) {
  		error("Could not find ':' in DISPLAY: %.100s", display);
  		return -1;
- 	}
+@@ -4793,6 +4794,14 @@ x11_connect_display(struct ssh *ssh)
- 	*cp = 0;
- 	/*
- 	 * buf now contains the host name.  But first we parse the
- 	 * display number.
- 	 */
- 	if (sscanf(cp + 1, "%u", &display_number) != 1) {
- 		error("Could not parse display number from DISPLAY: %.100s",
  		    display);
  		return -1;
  	}
@@ -47,8 +36,3 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
  
  	/* Look up the host address */
  	memset(&hints, 0, sizeof(hints));
- 	hints.ai_family = ssh->chanctxt->IPv4or6;
- 	hints.ai_socktype = SOCK_STREAM;
- 	snprintf(strport, sizeof strport, "%u", 6000 + display_number);
- 	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
- 		error("%.100s: unknown host. (%s)", buf,

openssh-7.7p1-X11_trusted_forwarding.patch

@@ -6,10 +6,10 @@
 Enable Trusted X11 forwarding by default, since the security benefits of
 having it disabled are negligible these days with XI2 being widely used.
 
-Index: openssh-7.8p1/ssh_config
+Index: openssh-8.8p1/ssh_config
 ===================================================================
---- openssh-7.8p1.orig/ssh_config
+--- openssh-8.8p1.orig/ssh_config
-+++ openssh-7.8p1/ssh_config
++++ openssh-8.8p1/ssh_config
 @@ -17,9 +17,20 @@
  # list of available options, their meanings and defaults, please see the
  # ssh_config(5) man page.
@@ -32,10 +32,10 @@ Index: openssh-7.8p1/ssh_config
  #   PasswordAuthentication yes
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
-Index: openssh-7.8p1/sshd_config
+Index: openssh-8.8p1/sshd_config
 ===================================================================
---- openssh-7.8p1.orig/sshd_config
+--- openssh-8.8p1.orig/sshd_config
-+++ openssh-7.8p1/sshd_config
++++ openssh-8.8p1/sshd_config
 @@ -84,7 +84,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
  #AllowAgentForwarding yes
  #AllowTcpForwarding yes

openssh-7.7p1-X_forward_with_disabled_ipv6.patch

@@ -3,13 +3,13 @@
 Do not throw away already open sockets for X11 forwarding if another socket
 family is not available for bind()
 
-diff --git a/channels.c b/channels.c
+Index: openssh-8.8p1/channels.c
-index f51b7e3..95af47e 100644
+===================================================================
---- a/channels.c
+--- openssh-8.8p1.orig/channels.c
-+++ b/channels.c
++++ openssh-8.8p1/channels.c
-@@ -4637,6 +4637,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+@@ -4607,6 +4607,13 @@ x11_create_display_inet(struct ssh *ssh,
- 				debug2("%s: bind port %d: %.100s", __func__,
+ 				debug2_f("bind port %d: %.100s", port,
- 				    port, strerror(errno));
+ 				    strerror(errno));
  				close(sock);
 +				/* do not remove successfully opened sockets if
 +				 * the request failed because the protocol

openssh-7.7p1-cavstest-ctr.patch

@@ -2,11 +2,11 @@
 # Parent  cc1022edba2c5eeb0facba08468f65afc2466b63
 CAVS test for OpenSSH's own CTR encryption mode implementation
 
-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
---- openssh-8.4p1.orig/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
++++ openssh-8.8p1/Makefile.in
-@@ -25,6 +25,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
+@@ -26,6 +26,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
  SSH_KEYSIGN=$(libexecdir)/ssh-keysign
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
  PRIVSEP_PATH=@PRIVSEP_PATH@
  SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
  STRIP_OPT=@STRIP_OPT@
-@@ -68,6 +69,8 @@ MKDIR_P=@MKDIR_P@
+@@ -69,6 +70,8 @@ MKDIR_P=@MKDIR_P@
  
  TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
  
@@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
  XMSS_OBJS=\
  	ssh-xmss.o \
  	sshkey-xmss.o \
-@@ -242,6 +245,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
+@@ -245,6 +248,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
  sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
  	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
  
@@ -34,7 +34,7 @@ Index: openssh-8.4p1/Makefile.in
  # test driver for the loginrec code - not built by default
  logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
  	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -400,6 +407,7 @@ install-files:
+@@ -407,6 +414,7 @@ install-files:
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -42,10 +42,10 @@ Index: openssh-8.4p1/Makefile.in
  	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
  	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
  	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-Index: openssh-8.4p1/cavstest-ctr.c
+Index: openssh-8.8p1/cavstest-ctr.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/cavstest-ctr.c
++++ openssh-8.8p1/cavstest-ctr.c
 @@ -0,0 +1,214 @@
 +/*
 + *
@@ -261,10 +261,10 @@ Index: openssh-8.4p1/cavstest-ctr.c
 +	printf("\n");
 +	return 0;
 +}
-Index: openssh-8.4p1/cipher.c
+Index: openssh-8.8p1/cipher.c
 ===================================================================
---- openssh-8.4p1.orig/cipher.c
+--- openssh-8.8p1.orig/cipher.c
-+++ openssh-8.4p1/cipher.c
++++ openssh-8.8p1/cipher.c
 @@ -58,15 +58,6 @@
  #define EVP_CIPHER_CTX void
  #endif
@@ -281,10 +281,10 @@ Index: openssh-8.4p1/cipher.c
  struct sshcipher {
  	char	*name;
  	u_int	block_size;
-Index: openssh-8.4p1/cipher.h
+Index: openssh-8.8p1/cipher.h
 ===================================================================
---- openssh-8.4p1.orig/cipher.h
+--- openssh-8.8p1.orig/cipher.h
-+++ openssh-8.4p1/cipher.h
++++ openssh-8.8p1/cipher.h
 @@ -48,7 +48,15 @@
  #define CIPHER_DECRYPT		0
  

openssh-7.7p1-cavstest-kdf.patch

@@ -2,11 +2,11 @@
 # Parent  1e1d5a2ab8bddfc800f570755f9ea1addcc878c1
 CAVS test for KDF implementation in OpenSSH
 
-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
---- openssh-8.4p1.orig/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
++++ openssh-8.8p1/Makefile.in
-@@ -26,6 +26,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
+@@ -27,6 +27,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
  CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
@@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
  PRIVSEP_PATH=@PRIVSEP_PATH@
  SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
  STRIP_OPT=@STRIP_OPT@
-@@ -69,7 +70,7 @@ MKDIR_P=@MKDIR_P@
+@@ -70,7 +71,7 @@ MKDIR_P=@MKDIR_P@
  
  TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
  
@@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
  
  XMSS_OBJS=\
  	ssh-xmss.o \
-@@ -249,6 +250,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
+@@ -252,6 +253,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
  cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o
  	$(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
  
@@ -33,7 +33,7 @@ Index: openssh-8.4p1/Makefile.in
  # test driver for the loginrec code - not built by default
  logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
  	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -408,6 +412,7 @@ install-files:
+@@ -415,6 +419,7 @@ install-files:
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
@@ -41,10 +41,10 @@ Index: openssh-8.4p1/Makefile.in
  	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
  	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
  	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-Index: openssh-8.4p1/cavstest-kdf.c
+Index: openssh-8.8p1/cavstest-kdf.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/cavstest-kdf.c
++++ openssh-8.8p1/cavstest-kdf.c
 @@ -0,0 +1,402 @@
 +/*
 + * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
@@ -249,8 +249,8 @@ Index: openssh-8.4p1/cavstest-kdf.c
 +		goto out;
 +	}
 +
-+	kex.session_id = test->session_id;
++	kex.session_id = sshbuf_new();
-+	kex.session_id_len = test->session_id_len;
++	sshbuf_put(kex.session_id, test->session_id, test->session_id_len);
 +
 +	/* setup kex */
 +

openssh-7.7p1-disable_openssl_abi_check.patch

@@ -4,11 +4,11 @@ disable run-time check for OpenSSL ABI by version number as that is not a
 reliable indicator of ABI changes and doesn't make much sense in a
 distribution package
 
-diff --git a/configure.ac b/configure.ac
+Index: openssh-8.8p1/configure.ac
-index 42ffd95..20a1884 100644
+===================================================================
---- a/configure.ac
+--- openssh-8.8p1.orig/configure.ac
-+++ b/configure.ac
++++ openssh-8.8p1/configure.ac
-@@ -4878,6 +4878,19 @@ AC_ARG_WITH([bsd-auth],
+@@ -5236,6 +5236,19 @@ AC_ARG_WITH([bsd-auth],
  	]
  )
  
@@ -28,11 +28,11 @@ index 42ffd95..20a1884 100644
  # Where to place sshd.pid
  piddir=/var/run
  # make sure the directory exists
-diff --git a/entropy.c b/entropy.c
+Index: openssh-8.8p1/entropy.c
-index f8b9f42..4957b23 100644
+===================================================================
---- a/entropy.c
+--- openssh-8.8p1.orig/entropy.c
-+++ b/entropy.c
++++ openssh-8.8p1/entropy.c
-@@ -223,11 +223,13 @@ seed_rng(void)
+@@ -100,11 +100,13 @@ seed_rng(void)
  	/* Initialise libcrypto */
  	ssh_libcrypto_init();
  

openssh-7.7p1-eal3.patch

@@ -2,15 +2,11 @@
 # Parent  8fd4e445c3a5c823568661a4f71b064cbcb217a9
 fix paths and references in sshd man pages
 
-diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
---- openssh-7.7p1/Makefile.in
+===================================================================
-+++ openssh-7.7p1/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-@@ -127,17 +127,18 @@ MANTYPE		= @MANTYPE@
++++ openssh-8.8p1/Makefile.in
- CONFIGFILES=sshd_config.out ssh_config.out moduli.out
+@@ -165,7 +165,8 @@ PATHSUBS	= \
- CONFIGFILES_IN=sshd_config ssh_config moduli
- 
- PATHSUBS	= \
- 	-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
  	-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
  	-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
  	-e 's|/usr/libexec|$(libexecdir)|g' \
@@ -20,8 +16,3 @@ diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
  	-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
  	-e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \
  	-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
- 	-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
- 	-e 's|/etc/ssh/ssh_host_ed25519_key|$(sysconfdir)/ssh_host_ed25519_key|g' \
- 	-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
- 	-e 's|/etc/moduli|$(sysconfdir)/moduli|g' \
- 	-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \

openssh-7.7p1-enable_PAM_by_default.patch

@@ -4,25 +4,16 @@
 # bnc#46749
 # --used to be called '-pam-fix2'
 
-diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
+Index: openssh-8.8p1/sshd_config
---- openssh-7.7p1/sshd_config
+===================================================================
-+++ openssh-7.7p1/sshd_config
+--- openssh-8.8p1.orig/sshd_config
-@@ -74,17 +74,17 @@ AuthorizedKeysFile	.ssh/authorized_keys
++++ openssh-8.8p1/sshd_config
- # and session processing. If this is enabled, PAM authentication will
+@@ -79,7 +79,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
- # be allowed through the ChallengeResponseAuthentication and
- # PasswordAuthentication.  Depending on your PAM configuration,
- # PAM authentication via ChallengeResponseAuthentication may bypass
- # the setting of "PermitRootLogin without-password".
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
- # and ChallengeResponseAuthentication to 'no'.
+ # and KbdInteractiveAuthentication to 'no'.
 -#UsePAM no
 +UsePAM yes
  
  #AllowAgentForwarding yes
  #AllowTcpForwarding yes
- #GatewayPorts no
- X11Forwarding yes
- #X11DisplayOffset 10
- #X11UseLocalhost yes
- #PermitTTY yes

openssh-7.7p1-fips.patch

@@ -3,11 +3,11 @@
 FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved
 algorithms.
 
-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
---- openssh-8.4p1.orig/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
++++ openssh-8.8p1/Makefile.in
-@@ -112,6 +112,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -113,6 +113,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
  
  SKOBJS=	ssh-sk-client.o
  
@@ -16,10 +16,10 @@ Index: openssh-8.4p1/Makefile.in
  SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
  	sshconnect.o sshconnect2.o mux.o $(SKOBJS)
  
-Index: openssh-8.4p1/cipher-ctr.c
+Index: openssh-8.8p1/cipher-ctr.c
 ===================================================================
---- openssh-8.4p1.orig/cipher-ctr.c
+--- openssh-8.8p1.orig/cipher-ctr.c
-+++ openssh-8.4p1/cipher-ctr.c
++++ openssh-8.8p1/cipher-ctr.c
 @@ -27,6 +27,8 @@
  #include "xmalloc.h"
  #include "log.h"
@@ -38,10 +38,10 @@ Index: openssh-8.4p1/cipher-ctr.c
  #endif
  	return (&aes_ctr);
  }
-Index: openssh-8.4p1/cipher.c
+Index: openssh-8.8p1/cipher.c
 ===================================================================
---- openssh-8.4p1.orig/cipher.c
+--- openssh-8.8p1.orig/cipher.c
-+++ openssh-8.4p1/cipher.c
++++ openssh-8.8p1/cipher.c
 @@ -51,6 +51,9 @@
  
  #include "openbsd-compat/openssl-compat.h"
@@ -61,7 +61,7 @@ Index: openssh-8.4p1/cipher.c
  #ifdef WITH_OPENSSL
  #ifndef OPENSSL_NO_DES
  	{ "3des-cbc",		8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
-@@ -114,8 +117,52 @@ static const struct sshcipher ciphers[]
+@@ -112,8 +115,52 @@ static const struct sshcipher ciphers[]
  	{ NULL,			0, 0, 0, 0, 0, NULL }
  };
  
@@ -114,7 +114,7 @@ Index: openssh-8.4p1/cipher.c
  /* Returns a comma-separated list of supported ciphers. */
  char *
  cipher_alg_list(char sep, int auth_only)
-@@ -124,7 +171,7 @@ cipher_alg_list(char sep, int auth_only)
+@@ -122,7 +169,7 @@ cipher_alg_list(char sep, int auth_only)
  	size_t nlen, rlen = 0;
  	const struct sshcipher *c;
  
@@ -123,7 +123,7 @@ Index: openssh-8.4p1/cipher.c
  		if ((c->flags & CFLAG_INTERNAL) != 0)
  			continue;
  		if (auth_only && c->auth_len == 0)
-@@ -207,7 +254,7 @@ const struct sshcipher *
+@@ -205,7 +252,7 @@ const struct sshcipher *
  cipher_by_name(const char *name)
  {
  	const struct sshcipher *c;
@@ -132,10 +132,10 @@ Index: openssh-8.4p1/cipher.c
  		if (strcmp(c->name, name) == 0)
  			return c;
  	return NULL;
-Index: openssh-8.4p1/fips.c
+Index: openssh-8.8p1/fips.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/fips.c
++++ openssh-8.8p1/fips.c
 @@ -0,0 +1,212 @@
 +/*
 + * Copyright (c) 2012 Petr Cerny.  All rights reserved.
@@ -349,10 +349,10 @@ Index: openssh-8.4p1/fips.c
 +	return dgst;
 +}
 +
-Index: openssh-8.4p1/fips.h
+Index: openssh-8.8p1/fips.h
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/fips.h
++++ openssh-8.8p1/fips.h
 @@ -0,0 +1,44 @@
 +/*
 + * Copyright (c) 2012 Petr Cerny.  All rights reserved.
@@ -398,10 +398,10 @@ Index: openssh-8.4p1/fips.h
 +
 +#endif
 +
-Index: openssh-8.4p1/hmac.c
+Index: openssh-8.8p1/hmac.c
 ===================================================================
---- openssh-8.4p1.orig/hmac.c
+--- openssh-8.8p1.orig/hmac.c
-+++ openssh-8.4p1/hmac.c
++++ openssh-8.8p1/hmac.c
 @@ -145,7 +145,7 @@ hmac_test(void *key, size_t klen, void *
  	size_t			 i;
  	u_char			 digest[16];
@@ -411,10 +411,10 @@ Index: openssh-8.4p1/hmac.c
  		printf("ssh_hmac_start failed");
  	if (ssh_hmac_init(ctx, key, klen) < 0 ||
  	    ssh_hmac_update(ctx, m, mlen) < 0 ||
-Index: openssh-8.4p1/kex.c
+Index: openssh-8.8p1/kex.c
 ===================================================================
---- openssh-8.4p1.orig/kex.c
+--- openssh-8.8p1.orig/kex.c
-+++ openssh-8.4p1/kex.c
++++ openssh-8.8p1/kex.c
 @@ -62,6 +62,8 @@
  #include "sshbuf.h"
  #include "digest.h"
@@ -433,7 +433,7 @@ Index: openssh-8.4p1/kex.c
  #ifdef WITH_OPENSSL
  	{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
  	{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
-@@ -116,6 +118,47 @@ static const struct kexalg kexalgs[] = {
+@@ -118,6 +120,47 @@ static const struct kexalg kexalgs[] = {
  	{ NULL, 0, -1, -1},
  };
  
@@ -481,7 +481,7 @@ Index: openssh-8.4p1/kex.c
  char *
  kex_alg_list(char sep)
  {
-@@ -123,7 +166,7 @@ kex_alg_list(char sep)
+@@ -125,7 +168,7 @@ kex_alg_list(char sep)
  	size_t nlen, rlen = 0;
  	const struct kexalg *k;
  
@@ -490,7 +490,7 @@ Index: openssh-8.4p1/kex.c
  		if (ret != NULL)
  			ret[rlen++] = sep;
  		nlen = strlen(k->name);
-@@ -143,7 +186,7 @@ kex_alg_by_name(const char *name)
+@@ -145,7 +188,7 @@ kex_alg_by_name(const char *name)
  {
  	const struct kexalg *k;
  
@@ -499,7 +499,7 @@ Index: openssh-8.4p1/kex.c
  		if (strcmp(k->name, name) == 0)
  			return k;
  	}
-@@ -163,7 +206,10 @@ kex_names_valid(const char *names)
+@@ -165,7 +208,10 @@ kex_names_valid(const char *names)
  	for ((p = strsep(&cp, ",")); p && *p != '\0';
  	    (p = strsep(&cp, ","))) {
  		if (kex_alg_by_name(p) == NULL) {
@@ -510,10 +510,10 @@ Index: openssh-8.4p1/kex.c
  			free(s);
  			return 0;
  		}
-Index: openssh-8.4p1/mac.c
+Index: openssh-8.8p1/mac.c
 ===================================================================
---- openssh-8.4p1.orig/mac.c
+--- openssh-8.8p1.orig/mac.c
-+++ openssh-8.4p1/mac.c
++++ openssh-8.8p1/mac.c
 @@ -41,6 +41,9 @@
  
  #include "openbsd-compat/openssl-compat.h"
@@ -593,10 +593,10 @@ Index: openssh-8.4p1/mac.c
  		if (strcmp(name, m->name) != 0)
  			continue;
  		if (mac != NULL)
-Index: openssh-8.4p1/readconf.c
+Index: openssh-8.8p1/readconf.c
 ===================================================================
---- openssh-8.4p1.orig/readconf.c
+--- openssh-8.8p1.orig/readconf.c
-+++ openssh-8.4p1/readconf.c
++++ openssh-8.8p1/readconf.c
 @@ -68,6 +68,8 @@
  #include "myproposal.h"
  #include "digest.h"
@@ -606,8 +606,8 @@ Index: openssh-8.4p1/readconf.c
  /* Format of the configuration file:
  
     # Configuration data is parsed as follows:
-@@ -1949,6 +1951,23 @@ option_clear_or_none(const char *o)
+@@ -2307,6 +2309,23 @@ config_has_permitted_cnames(Options *opt
- 	return o == NULL || strcasecmp(o, "none") == 0;
+ 	return options->num_permitted_cnames > 0;
  }
  
 +/* remove algorithms not approved for use in FIPS mode, when running in FIPS
@@ -630,7 +630,7 @@ Index: openssh-8.4p1/readconf.c
  /*
   * Initializes options to special values that indicate that they have not yet
   * been set.  Read_config_file will only set options with this value. Options
-@@ -2240,6 +2259,9 @@ fill_default_options(Options * options)
+@@ -2618,6 +2637,9 @@ fill_default_options(Options * options)
  		options->canonicalize_hostname = SSH_CANONICALISE_NO;
  	if (options->fingerprint_hash == -1)
  		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@@ -640,28 +640,20 @@ Index: openssh-8.4p1/readconf.c
  #ifdef ENABLE_SK_INTERNAL
  	if (options->sk_provider == NULL)
  		options->sk_provider = xstrdup("internal");
-@@ -2273,6 +2295,7 @@ fill_default_options(Options * options)
+@@ -2654,6 +2676,8 @@ fill_default_options(Options * options)
- 	ASSEMBLE(pubkey_key_types, def_key, all_key);
  	ASSEMBLE(ca_sign_algorithms, def_sig, all_sig);
  #undef ASSEMBLE
-+
- 	free(all_cipher);
- 	free(all_mac);
- 	free(all_kex);
-@@ -2284,6 +2307,8 @@ fill_default_options(Options * options)
- 	kex_default_pk_alg_filtered = def_key; /* save for later use */
- 	free(def_sig);
  
 +	filter_fips_algorithms(options);
 +
  #define CLEAR_ON_NONE(v) \
  	do { \
  		if (option_clear_or_none(v)) { \
-Index: openssh-8.4p1/readconf.h
+Index: openssh-8.8p1/readconf.h
 ===================================================================
---- openssh-8.4p1.orig/readconf.h
+--- openssh-8.8p1.orig/readconf.h
-+++ openssh-8.4p1/readconf.h
++++ openssh-8.8p1/readconf.h
-@@ -200,6 +200,7 @@ typedef struct {
+@@ -212,6 +212,7 @@ typedef struct {
  #define SSH_STRICT_HOSTKEY_YES	2
  #define SSH_STRICT_HOSTKEY_ASK	3
  
@@ -669,10 +661,10 @@ Index: openssh-8.4p1/readconf.h
  const char *kex_default_pk_alg(void);
  char	*ssh_connection_hash(const char *thishost, const char *host,
      const char *portstr, const char *user);
-Index: openssh-8.4p1/servconf.c
+Index: openssh-8.8p1/servconf.c
 ===================================================================
---- openssh-8.4p1.orig/servconf.c
+--- openssh-8.8p1.orig/servconf.c
-+++ openssh-8.4p1/servconf.c
++++ openssh-8.8p1/servconf.c
 @@ -70,6 +70,7 @@
  #include "auth.h"
  #include "myproposal.h"
@@ -681,7 +673,7 @@ Index: openssh-8.4p1/servconf.c
  
  static void add_listen_addr(ServerOptions *, const char *,
      const char *, int);
-@@ -201,6 +202,23 @@ option_clear_or_none(const char *o)
+@@ -205,6 +206,23 @@ option_clear_or_none(const char *o)
  	return o == NULL || strcasecmp(o, "none") == 0;
  }
  
@@ -705,7 +697,7 @@ Index: openssh-8.4p1/servconf.c
  static void
  assemble_algorithms(ServerOptions *o)
  {
-@@ -242,6 +260,8 @@ assemble_algorithms(ServerOptions *o)
+@@ -246,6 +264,8 @@ assemble_algorithms(ServerOptions *o)
  	free(def_kex);
  	free(def_key);
  	free(def_sig);
@@ -713,8 +705,8 @@ Index: openssh-8.4p1/servconf.c
 +	filter_fips_algorithms_s(o);
  }
  
- static void
+ void
-@@ -454,6 +474,8 @@ fill_default_server_options(ServerOption
+@@ -438,6 +458,8 @@ fill_default_server_options(ServerOption
  		options->fwd_opts.streamlocal_bind_unlink = 0;
  	if (options->fingerprint_hash == -1)
  		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@@ -723,20 +715,20 @@ Index: openssh-8.4p1/servconf.c
  	if (options->disable_forwarding == -1)
  		options->disable_forwarding = 0;
  	if (options->expose_userauth_info == -1)
-Index: openssh-8.4p1/ssh-keygen.c
+Index: openssh-8.8p1/ssh-keygen.c
 ===================================================================
---- openssh-8.4p1.orig/ssh-keygen.c
+--- openssh-8.8p1.orig/ssh-keygen.c
-+++ openssh-8.4p1/ssh-keygen.c
++++ openssh-8.8p1/ssh-keygen.c
-@@ -66,6 +66,8 @@
+@@ -67,6 +67,8 @@
- #include "ssh-sk.h"
  #include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */
+ #include "cipher.h"
  
 +#include "fips.h"
 +
  #ifdef WITH_OPENSSL
  # define DEFAULT_KEY_TYPE_NAME "rsa"
  #else
-@@ -1036,11 +1038,13 @@ do_fingerprint(struct passwd *pw)
+@@ -1037,11 +1039,13 @@ do_fingerprint(struct passwd *pw)
  static void
  do_gen_all_hostkeys(struct passwd *pw)
  {
@@ -752,7 +744,7 @@ Index: openssh-8.4p1/ssh-keygen.c
  #ifdef WITH_OPENSSL
  		{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
  		{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
-@@ -1055,6 +1059,17 @@ do_gen_all_hostkeys(struct passwd *pw)
+@@ -1056,6 +1060,17 @@ do_gen_all_hostkeys(struct passwd *pw)
  		{ NULL, NULL, NULL }
  	};
  
@@ -770,7 +762,7 @@ Index: openssh-8.4p1/ssh-keygen.c
  	u_int32_t bits = 0;
  	int first = 0;
  	struct stat st;
-@@ -1062,6 +1077,12 @@ do_gen_all_hostkeys(struct passwd *pw)
+@@ -1063,6 +1078,12 @@ do_gen_all_hostkeys(struct passwd *pw)
  	char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file;
  	int i, type, fd, r;
  
@@ -783,7 +775,7 @@ Index: openssh-8.4p1/ssh-keygen.c
  	for (i = 0; key_types[i].key_type; i++) {
  		public = private = NULL;
  		prv_tmp = pub_tmp = prv_file = pub_file = NULL;
-@@ -3586,6 +3607,15 @@ main(int argc, char **argv)
+@@ -3620,6 +3641,15 @@ main(int argc, char **argv)
  		key_type_name = DEFAULT_KEY_TYPE_NAME;
  
  	type = sshkey_type_from_name(key_type_name);
@@ -799,37 +791,37 @@ Index: openssh-8.4p1/ssh-keygen.c
  	type_bits_valid(type, key_type_name, &bits);
  
  	if (!quiet)
-Index: openssh-8.4p1/ssh_config.5
+Index: openssh-8.8p1/ssh_config.5
 ===================================================================
---- openssh-8.4p1.orig/ssh_config.5
+--- openssh-8.8p1.orig/ssh_config.5
-+++ openssh-8.4p1/ssh_config.5
++++ openssh-8.8p1/ssh_config.5
-@@ -682,6 +682,8 @@ Valid options are:
+@@ -736,6 +736,8 @@ The argument to this keyword must be
- and
+ option) or
- .Cm sha256
+ .Cm no
  (the default).
 +.Pp
 +In the FIPS mode the minimum of SHA-1 is enforced (which means sha256).
  .It Cm ForwardAgent
  Specifies whether the connection to the authentication agent (if any)
  will be forwarded to the remote machine.
-Index: openssh-8.4p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
---- openssh-8.4p1.orig/sshd.c
+--- openssh-8.8p1.orig/sshd.c
-+++ openssh-8.4p1/sshd.c
++++ openssh-8.8p1/sshd.c
-@@ -124,6 +124,8 @@
+@@ -126,6 +126,8 @@
- #include "ssherr.h"
+ #include "srclimit.h"
- #include "sk-api.h"
+ #include "dh.h"
  
 +#include "fips.h"
 +
  /* Re-exec fds */
  #define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1)
  #define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2)
-Index: openssh-8.4p1/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
 ===================================================================
---- openssh-8.4p1.orig/sshd_config.5
+--- openssh-8.8p1.orig/sshd_config.5
-+++ openssh-8.4p1/sshd_config.5
++++ openssh-8.8p1/sshd_config.5
-@@ -594,6 +594,8 @@ and
+@@ -600,6 +600,8 @@ and
  .Cm sha256 .
  The default is
  .Cm sha256 .

openssh-7.7p1-fips_checks.patch

@@ -14,10 +14,10 @@
 # file is not found (or the hash matches), proceed in non-FIPS mode and abort
 # otherwise.
 
-Index: openssh-8.4p1/fips-check.c
+Index: openssh-8.8p1/fips-check.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/fips-check.c
++++ openssh-8.8p1/fips-check.c
 @@ -0,0 +1,34 @@
 +#include "includes.h"
 +#include <fcntl.h>
@@ -53,10 +53,10 @@ Index: openssh-8.4p1/fips-check.c
 +    fips_ssh_init();
 +	return 0;
 +}
-Index: openssh-8.4p1/fips.c
+Index: openssh-8.8p1/fips.c
 ===================================================================
---- openssh-8.4p1.orig/fips.c
+--- openssh-8.8p1.orig/fips.c
-+++ openssh-8.4p1/fips.c
++++ openssh-8.8p1/fips.c
 @@ -35,30 +35,293 @@
  #include "log.h"
  #include "xmalloc.h"
@@ -362,10 +362,10 @@ Index: openssh-8.4p1/fips.c
  int
  fips_mode(void)
  {
-Index: openssh-8.4p1/fips.h
+Index: openssh-8.8p1/fips.h
 ===================================================================
---- openssh-8.4p1.orig/fips.h
+--- openssh-8.8p1.orig/fips.h
-+++ openssh-8.4p1/fips.h
++++ openssh-8.8p1/fips.h
 @@ -1,5 +1,5 @@
  /*
 - * Copyright (c) 2012 Petr Cerny.  All rights reserved.
@@ -407,20 +407,20 @@ Index: openssh-8.4p1/fips.h
  
  #endif
 -
-Index: openssh-8.4p1/sftp-server.c
+Index: openssh-8.8p1/sftp-server.c
 ===================================================================
---- openssh-8.4p1.orig/sftp-server.c
+--- openssh-8.8p1.orig/sftp-server.c
-+++ openssh-8.4p1/sftp-server.c
++++ openssh-8.8p1/sftp-server.c
-@@ -53,6 +53,8 @@
+@@ -57,6 +57,8 @@ char *sftp_realpath(const char *, char *
- 
+ /* Maximum data read that we are willing to accept */
- char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
+ #define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024)
  
 +#include "fips.h"
 +
  /* Our verbosity */
  static LogLevel log_level = SYSLOG_LEVEL_ERROR;
  
-@@ -1577,6 +1579,9 @@ sftp_server_main(int argc, char **argv,
+@@ -1717,6 +1719,9 @@ sftp_server_main(int argc, char **argv,
  	extern char *optarg;
  	extern char *__progname;
  
@@ -430,10 +430,10 @@ Index: openssh-8.4p1/sftp-server.c
  	__progname = ssh_get_progname(argv[0]);
  	log_init(__progname, log_level, log_facility, log_stderr);
  
-Index: openssh-8.4p1/ssh.c
+Index: openssh-8.8p1/ssh.c
 ===================================================================
---- openssh-8.4p1.orig/ssh.c
+--- openssh-8.8p1.orig/ssh.c
-+++ openssh-8.4p1/ssh.c
++++ openssh-8.8p1/ssh.c
 @@ -113,6 +113,8 @@
  #include "ssh-pkcs11.h"
  #endif
@@ -443,9 +443,9 @@ Index: openssh-8.4p1/ssh.c
  extern char *__progname;
  
  /* Saves a copy of argv for setproctitle emulation */
-@@ -658,6 +660,10 @@ main(int ac, char **av)
+@@ -632,6 +634,10 @@ main(int ac, char **av)
- 	size_t n, len;
  	u_int j;
+ 	struct ssh_conn_info *cinfo = NULL;
  
 +	/* initialize fips - can go before ssh_malloc_init(), since that is a
 +	 * OpenBSD-only thing (as of OpenSSH 7.6p1) */
@@ -454,11 +454,11 @@ Index: openssh-8.4p1/ssh.c
  	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
  	sanitise_stdfd();
  
-Index: openssh-8.4p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
---- openssh-8.4p1.orig/sshd.c
+--- openssh-8.8p1.orig/sshd.c
-+++ openssh-8.4p1/sshd.c
++++ openssh-8.8p1/sshd.c
-@@ -1545,6 +1545,10 @@ main(int ac, char **av)
+@@ -1547,6 +1547,10 @@ main(int ac, char **av)
  	Authctxt *authctxt;
  	struct connection_info *connection_info = NULL;
  

openssh-7.7p1-host_ident.patch

@@ -2,15 +2,11 @@
 # Parent  0f731d0b541b8a919d24ac91098f560a49712822
 Suggest command line for removal of offending keys from known_hosts file
 
-diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
+Index: openssh-8.8p1/sshconnect.c
---- openssh-7.7p1/sshconnect.c
+===================================================================
-+++ openssh-7.7p1/sshconnect.c
+--- openssh-8.8p1.orig/sshconnect.c
-@@ -1147,16 +1147,21 @@ check_host_key(char *hostname, struct so
++++ openssh-8.8p1/sshconnect.c
- 		}
+@@ -1270,6 +1270,11 @@ check_host_key(char *hostname, const str
- 		/* The host key has changed. */
- 		warn_changed_key(host_key);
- 		error("Add correct host key in %.100s to get rid of this message.",
- 		    user_hostfiles[0]);
  		error("Offending %s key in %s:%lu",
  		    sshkey_type(host_found->key),
  		    host_found->file, host_found->line);
@@ -22,8 +18,3 @@ diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
  
  		/*
  		 * If strict host key checking is in use, the user will have
- 		 * to edit the key manually and we can only abort.
- 		 */
- 		if (options.strict_host_key_checking !=
- 		    SSH_STRICT_HOSTKEY_OFF) {
- 			error("%s host key for %.200s has changed and you have "

openssh-7.7p1-hostname_changes_when_forwarding_X.patch

@@ -3,11 +3,11 @@
 # -- uset do be called '-xauthlocalhostname'
 handle hostname changes when forwarding X
 
-Index: openssh-8.4p1/session.c
+Index: openssh-8.8p1/session.c
 ===================================================================
---- openssh-8.4p1.orig/session.c
+--- openssh-8.8p1.orig/session.c
-+++ openssh-8.4p1/session.c
++++ openssh-8.8p1/session.c
-@@ -985,7 +985,7 @@ copy_environment(char **source, char ***
+@@ -981,7 +981,7 @@ copy_environment(char **source, char ***
  #endif
  
  static char **
@@ -16,7 +16,7 @@ Index: openssh-8.4p1/session.c
  {
  	char buf[256];
  	size_t n;
-@@ -1195,6 +1195,8 @@ do_setup_env(struct ssh *ssh, Session *s
+@@ -1191,6 +1191,8 @@ do_setup_env(struct ssh *ssh, Session *s
  		for (i = 0; env[i]; i++)
  			fprintf(stderr, "  %.200s\n", env[i]);
  	}
@@ -25,7 +25,7 @@ Index: openssh-8.4p1/session.c
  	return env;
  }
  
-@@ -1203,7 +1205,7 @@ do_setup_env(struct ssh *ssh, Session *s
+@@ -1199,7 +1201,7 @@ do_setup_env(struct ssh *ssh, Session *s
   * first in this order).
   */
  static void
@@ -34,8 +34,8 @@ Index: openssh-8.4p1/session.c
  {
  	FILE *f = NULL;
  	char *cmd = NULL, *user_rc = NULL;
-@@ -1260,12 +1262,20 @@ do_rc_files(struct ssh *ssh, Session *s,
+@@ -1256,12 +1258,20 @@ do_rc_files(struct ssh *ssh, Session *s,
- 			fatal("%s: xasprintf: %s", __func__, strerror(errno));
+ 			fatal_f("xasprintf: %s", strerror(errno));
  		f = popen(cmd, "w");
  		if (f) {
 +			char hostname[MAXHOSTNAMELEN];
@@ -55,7 +55,7 @@ Index: openssh-8.4p1/session.c
  		} else {
  			fprintf(stderr, "Could not run %s\n",
  			    cmd);
-@@ -1526,6 +1536,7 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1518,6 +1528,7 @@ do_child(struct ssh *ssh, Session *s, co
  	char **env, *argv[ARGV_MAX], remote_id[512];
  	const char *shell, *shell0;
  	struct passwd *pw = s->pw;
@@ -63,7 +63,7 @@ Index: openssh-8.4p1/session.c
  	int r = 0;
  
  	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
-@@ -1582,7 +1593,7 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1574,7 +1585,7 @@ do_child(struct ssh *ssh, Session *s, co
  	 * Make sure $SHELL points to the shell from the password file,
  	 * even if shell is overridden from login.conf
  	 */
@@ -72,7 +72,7 @@ Index: openssh-8.4p1/session.c
  
  #ifdef HAVE_LOGIN_CAP
  	shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
-@@ -1646,7 +1657,7 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1638,7 +1649,7 @@ do_child(struct ssh *ssh, Session *s, co
  
  	closefrom(STDERR_FILENO + 1);
  

openssh-7.7p1-ldap.patch

@@ -10,11 +10,10 @@
 # internal versions. ssh-keyconverter consequently fails to link as it lacks
 # the proper flags, and libopenbsd-compat doesn't contain the b64_* functions)
 
-diff --git a/HOWTO.ldap-keys b/HOWTO.ldap-keys
+Index: openssh-8.8p1/HOWTO.ldap-keys
-new file mode 100644
+===================================================================
-index 0000000..831d399
 --- /dev/null
-+++ b/HOWTO.ldap-keys
++++ openssh-8.8p1/HOWTO.ldap-keys
 @@ -0,0 +1,108 @@
 +
 +HOW TO START
@@ -124,11 +123,11 @@ index 0000000..831d399
 +  - frederic peters.
 +  - Finlay dobbie.
 +  - Stefan Fisher.
-diff --git a/Makefile.in b/Makefile.in
+Index: openssh-8.8p1/Makefile.in
-index 6010d1c..f54348b 100644
+===================================================================
---- a/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-+++ b/Makefile.in
++++ openssh-8.8p1/Makefile.in
-@@ -25,6 +25,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
+@@ -26,6 +26,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
  SSH_KEYSIGN=$(libexecdir)/ssh-keysign
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@@ -137,7 +136,7 @@ index 6010d1c..f54348b 100644
  CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
  CAVSTEST_KDF=$(libexecdir)/cavstest-kdf
  PRIVSEP_PATH=@PRIVSEP_PATH@
-@@ -74,6 +76,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keys
+@@ -73,6 +75,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-a
  
  TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT)
  
@@ -147,9 +146,9 @@ index 6010d1c..f54348b 100644
  XMSS_OBJS=\
  	ssh-xmss.o \
  	sshkey-xmss.o \
-@@ -158,8 +163,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-server.o sftp-server-main.o
+@@ -160,8 +165,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-serve
  
- SFTP_OBJS=	sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
+ SFTP_OBJS=	sftp.o progressmeter.o $(SFTP_CLIENT_OBJS)
  
 -MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
 -MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
@@ -158,7 +157,7 @@ index 6010d1c..f54348b 100644
  MANTYPE		= @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -242,6 +247,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
+@@ -244,6 +249,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
  	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
@@ -166,9 +165,9 @@ index 6010d1c..f54348b 100644
 +	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
 +
  sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
- 	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
-@@ -406,6 +414,10 @@ install-files:
+@@ -416,6 +424,10 @@ install-files:
  	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
  	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@@ -179,7 +178,7 @@ index 6010d1c..f54348b 100644
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-@@ -425,6 +437,10 @@ install-files:
+@@ -435,6 +447,10 @@ install-files:
  	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
  	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
  	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -190,7 +189,7 @@ index 6010d1c..f54348b 100644
  	$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
  
  install-sysconf:
-@@ -449,6 +465,13 @@ install-sysconf:
+@@ -459,6 +475,13 @@ install-sysconf:
  	else \
  		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
  	fi
@@ -204,7 +203,7 @@ index 6010d1c..f54348b 100644
  
  host-key: ssh-keygen$(EXEEXT)
  	@if [ -z "$(DESTDIR)" ] ; then \
-@@ -487,6 +510,8 @@ uninstall:
+@@ -497,6 +520,8 @@ uninstall:
  	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
  	-rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
@@ -213,7 +212,7 @@ index 6010d1c..f54348b 100644
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -499,6 +524,7 @@ uninstall:
+@@ -509,6 +534,7 @@ uninstall:
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
@@ -221,11 +220,11 @@ index 6010d1c..f54348b 100644
  
  regress-prep:
  	$(MKDIR_P) `pwd`/regress/unittests/test_helper
-diff --git a/configure.ac b/configure.ac
+Index: openssh-8.8p1/configure.ac
-index 4ddf539..1fd0b17 100644
+===================================================================
---- a/configure.ac
+--- openssh-8.8p1.orig/configure.ac
-+++ b/configure.ac
++++ openssh-8.8p1/configure.ac
-@@ -1688,6 +1688,106 @@ AC_ARG_WITH([audit],
+@@ -1758,6 +1758,106 @@ AC_ARG_WITH([audit],
  	esac ]
  )
  
@@ -332,11 +331,10 @@ index 4ddf539..1fd0b17 100644
  AC_ARG_WITH([pie],
      [  --with-pie              Build Position Independent Executables if possible], [
  	if test "x$withval" = "xno"; then
-diff --git a/ldap-helper.c b/ldap-helper.c
+Index: openssh-8.8p1/ldap-helper.c
-new file mode 100644
+===================================================================
-index 0000000..0efff1f
 --- /dev/null
-+++ b/ldap-helper.c
++++ openssh-8.8p1/ldap-helper.c
 @@ -0,0 +1,155 @@
 +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -493,11 +491,10 @@ index 0000000..0efff1f
 +void   *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
 +void    buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
 +
-diff --git a/ldap-helper.h b/ldap-helper.h
+Index: openssh-8.8p1/ldap-helper.h
-new file mode 100644
+===================================================================
-index 0000000..14cb29a
 --- /dev/null
-+++ b/ldap-helper.h
++++ openssh-8.8p1/ldap-helper.h
 @@ -0,0 +1,32 @@
 +/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -531,11 +528,10 @@ index 0000000..14cb29a
 +extern int config_warning_config_file;
 +
 +#endif /* LDAP_HELPER_H */
-diff --git a/ldap.conf b/ldap.conf
+Index: openssh-8.8p1/ldap.conf
-new file mode 100644
+===================================================================
-index 0000000..42e38d3
 --- /dev/null
-+++ b/ldap.conf
++++ openssh-8.8p1/ldap.conf
 @@ -0,0 +1,88 @@
 +# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
 +#
@@ -625,12 +621,11 @@ index 0000000..42e38d3
 +#tls_cert
 +#tls_key
 +
-diff --git a/ldapbody.c b/ldapbody.c
+Index: openssh-8.8p1/ldapbody.c
-new file mode 100644
+===================================================================
-index 0000000..032cc89
 --- /dev/null
-+++ b/ldapbody.c
++++ openssh-8.8p1/ldapbody.c
-@@ -0,0 +1,494 @@
+@@ -0,0 +1,503 @@
 +/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
 + * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
@@ -663,8 +658,17 @@ index 0000000..032cc89
 +#include "ldapmisc.h"
 +#include "ldapbody.h"
 +#include <stdio.h>
++#include <stdlib.h>
 +#include <unistd.h>
 +
++#ifndef FALSE
++# define FALSE 0
++#endif
++
++#ifndef TRUE
++# define TRUE 1
++#endif
++
 +#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"
 +#define PUBKEYATTR "sshPublicKey"
 +#define LDAP_LOGFILE	"%s/ldap.%d"
@@ -1125,11 +1129,10 @@ index 0000000..032cc89
 +	return;
 +}
 +
-diff --git a/ldapbody.h b/ldapbody.h
+Index: openssh-8.8p1/ldapbody.h
-new file mode 100644
+===================================================================
-index 0000000..665dca2
 --- /dev/null
-+++ b/ldapbody.h
++++ openssh-8.8p1/ldapbody.h
 @@ -0,0 +1,37 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1168,11 +1171,10 @@ index 0000000..665dca2
 +
 +#endif /* LDAPBODY_H */
 +
-diff --git a/ldapconf.c b/ldapconf.c
+Index: openssh-8.8p1/ldapconf.c
-new file mode 100644
+===================================================================
-index 0000000..2e22438
 --- /dev/null
-+++ b/ldapconf.c
++++ openssh-8.8p1/ldapconf.c
 @@ -0,0 +1,711 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1885,11 +1887,10 @@ index 0000000..2e22438
 +	dump_cfg_string(lSSH_Filter, options.ssh_filter);
 +}
 +
-diff --git a/ldapconf.h b/ldapconf.h
+Index: openssh-8.8p1/ldapconf.h
-new file mode 100644
+===================================================================
-index 0000000..c2aa704
 --- /dev/null
-+++ b/ldapconf.h
++++ openssh-8.8p1/ldapconf.h
 @@ -0,0 +1,71 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1962,11 +1963,10 @@ index 0000000..c2aa704
 +void dump_config(void);
 +
 +#endif /* LDAPCONF_H */
-diff --git a/ldapincludes.h b/ldapincludes.h
+Index: openssh-8.8p1/ldapincludes.h
-new file mode 100644
+===================================================================
-index 0000000..8539bdc
 --- /dev/null
-+++ b/ldapincludes.h
++++ openssh-8.8p1/ldapincludes.h
 @@ -0,0 +1,41 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -2009,11 +2009,10 @@ index 0000000..8539bdc
 +#endif
 +
 +#endif /* LDAPINCLUDES_H */
-diff --git a/ldapmisc.c b/ldapmisc.c
+Index: openssh-8.8p1/ldapmisc.c
-new file mode 100644
+===================================================================
-index 0000000..de23c0c
 --- /dev/null
-+++ b/ldapmisc.c
++++ openssh-8.8p1/ldapmisc.c
 @@ -0,0 +1,79 @@
 +
 +#include "ldapincludes.h"
@@ -2094,11 +2093,10 @@ index 0000000..de23c0c
 +}
 +#endif
 +
-diff --git a/ldapmisc.h b/ldapmisc.h
+Index: openssh-8.8p1/ldapmisc.h
-new file mode 100644
+===================================================================
-index 0000000..4c271df
 --- /dev/null
-+++ b/ldapmisc.h
++++ openssh-8.8p1/ldapmisc.h
 @@ -0,0 +1,35 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -2135,10 +2133,10 @@ index 0000000..4c271df
 +
 +#endif /* LDAPMISC_H */
 +
-diff --git a/openbsd-compat/base64.c b/openbsd-compat/base64.c
+Index: openssh-8.8p1/openbsd-compat/base64.c
-index 9e74667..14824be 100644
+===================================================================
---- a/openbsd-compat/base64.c
+--- openssh-8.8p1.orig/openbsd-compat/base64.c
-+++ b/openbsd-compat/base64.c
++++ openssh-8.8p1/openbsd-compat/base64.c
 @@ -46,7 +46,7 @@
  
  #include "includes.h"
@@ -2157,7 +2155,7 @@ index 9e74667..14824be 100644
  int
  b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
  {
-@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
+@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srcle
  }
  #endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
  
@@ -2166,10 +2164,10 @@ index 9e74667..14824be 100644
  
  /* skips all whitespace anywhere.
     converts characters, four at a time, starting at (or after)
-diff --git a/openbsd-compat/base64.h b/openbsd-compat/base64.h
+Index: openssh-8.8p1/openbsd-compat/base64.h
-index bd77293..e27df9a 100644
+===================================================================
---- a/openbsd-compat/base64.h
+--- openssh-8.8p1.orig/openbsd-compat/base64.h
-+++ b/openbsd-compat/base64.h
++++ openssh-8.8p1/openbsd-compat/base64.h
 @@ -45,16 +45,16 @@
  
  #include "includes.h"
@@ -2191,11 +2189,10 @@ index bd77293..e27df9a 100644
  int b64_pton(char const *src, u_char *target, size_t targsize);
  # endif /* !HAVE_B64_PTON */
  # define __b64_pton(a,b,c) b64_pton(a,b,c)
-diff --git a/openssh-lpk-openldap.schema b/openssh-lpk-openldap.schema
+Index: openssh-8.8p1/openssh-lpk-openldap.schema
-new file mode 100644
+===================================================================
-index 0000000..c84f90f
 --- /dev/null
-+++ b/openssh-lpk-openldap.schema
++++ openssh-8.8p1/openssh-lpk-openldap.schema
 @@ -0,0 +1,21 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -2218,11 +2215,10 @@ index 0000000..c84f90f
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff --git a/openssh-lpk-sun.schema b/openssh-lpk-sun.schema
+Index: openssh-8.8p1/openssh-lpk-sun.schema
-new file mode 100644
+===================================================================
-index 0000000..3136673
 --- /dev/null
-+++ b/openssh-lpk-sun.schema
++++ openssh-8.8p1/openssh-lpk-sun.schema
 @@ -0,0 +1,23 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -2247,11 +2243,10 @@ index 0000000..3136673
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff --git a/ssh-ldap-helper.8 b/ssh-ldap-helper.8
+Index: openssh-8.8p1/ssh-ldap-helper.8
-new file mode 100644
+===================================================================
-index 0000000..f8440e4
 --- /dev/null
-+++ b/ssh-ldap-helper.8
++++ openssh-8.8p1/ssh-ldap-helper.8
 @@ -0,0 +1,79 @@
 +.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
@@ -2332,21 +2327,19 @@ index 0000000..f8440e4
 +OpenSSH 5.5 + PKA-LDAP .
 +.Sh AUTHORS
 +.An Jan F. Chadima Aq jchadima@redhat.com
-diff --git a/ssh-ldap-wrapper b/ssh-ldap-wrapper
+Index: openssh-8.8p1/ssh-ldap-wrapper
-new file mode 100644
+===================================================================
-index 0000000..9fdfc37
 --- /dev/null
-+++ b/ssh-ldap-wrapper
++++ openssh-8.8p1/ssh-ldap-wrapper
 @@ -0,0 +1,4 @@
 +#!/bin/sh
 +
 +exec @LIBEXECDIR@/ssh-ldap-helper -s "$1"
 +
-diff --git a/ssh-ldap.conf.5 b/ssh-ldap.conf.5
+Index: openssh-8.8p1/ssh-ldap.conf.5
-new file mode 100644
+===================================================================
-index 0000000..15eb03d
 --- /dev/null
-+++ b/ssh-ldap.conf.5
++++ openssh-8.8p1/ssh-ldap.conf.5
 @@ -0,0 +1,376 @@
 +.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"

openssh-7.7p1-no_fork-no_pid_file.patch

@@ -2,11 +2,11 @@
 # Parent  bad0c8b3b8d72abb6960ed85b57ee42352371738
 Do not write a PID file when not daemonizing (e.g. when running from systemd)
 
-diff --git a/sshd.c b/sshd.c
+Index: openssh-8.8p1/sshd.c
-index f3ccc3a..eadc1b3 100644
+===================================================================
---- a/sshd.c
+--- openssh-8.8p1.orig/sshd.c
-+++ b/sshd.c
++++ openssh-8.8p1/sshd.c
-@@ -2076,7 +2076,7 @@ main(int ac, char **av)
+@@ -2129,7 +2129,7 @@ main(int ac, char **av)
  		 * Write out the pid file after the sigterm handler
  		 * is setup and the listen sockets are bound
  		 */

openssh-7.7p1-pam_check_locks.patch

@@ -5,10 +5,10 @@ UsePAM is used
 
 bnc#708678, FATE#312033
 
-Index: openssh-8.4p1/auth.c
+Index: openssh-8.8p1/auth.c
 ===================================================================
---- openssh-8.4p1.orig/auth.c
+--- openssh-8.8p1.orig/auth.c
-+++ openssh-8.4p1/auth.c
++++ openssh-8.8p1/auth.c
 @@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas
  		return 0;
  
@@ -27,10 +27,10 @@ Index: openssh-8.4p1/auth.c
  		int locked = 0;
  
  #ifdef LOCKED_PASSWD_STRING
-Index: openssh-8.4p1/servconf.c
+Index: openssh-8.8p1/servconf.c
 ===================================================================
---- openssh-8.4p1.orig/servconf.c
+--- openssh-8.8p1.orig/servconf.c
-+++ openssh-8.4p1/servconf.c
++++ openssh-8.8p1/servconf.c
 @@ -92,6 +92,7 @@ initialize_server_options(ServerOptions
  
  	/* Portable-specific options */
@@ -39,7 +39,7 @@ Index: openssh-8.4p1/servconf.c
  
  	/* Standard Options */
  	options->num_ports = 0;
-@@ -300,6 +301,8 @@ fill_default_server_options(ServerOption
+@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
  	/* Portable-specific options */
  	if (options->use_pam == -1)
  		options->use_pam = 0;
@@ -48,7 +48,7 @@ Index: openssh-8.4p1/servconf.c
  
  	/* Standard Options */
  	if (options->num_host_key_files == 0) {
-@@ -501,7 +504,7 @@ fill_default_server_options(ServerOption
+@@ -485,7 +488,7 @@ fill_default_server_options(ServerOption
  typedef enum {
  	sBadOption,		/* == unknown option */
  	/* Portable-specific options */
@@ -56,8 +56,8 @@ Index: openssh-8.4p1/servconf.c
 +	sUsePAM, sUsePAMChecklocks,
  	/* Standard Options */
  	sPort, sHostKeyFile, sLoginGraceTime,
- 	sPermitRootLogin, sLogFacility, sLogLevel,
+ 	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
-@@ -553,8 +556,10 @@ static struct {
+@@ -535,8 +538,10 @@ static struct {
  	/* Portable-specific options */
  #ifdef USE_PAM
  	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
@@ -68,7 +68,7 @@ Index: openssh-8.4p1/servconf.c
  #endif
  	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
  	/* Standard Options */
-@@ -1318,6 +1323,9 @@ process_server_config_line_depth(ServerO
+@@ -1331,6 +1336,9 @@ process_server_config_line_depth(ServerO
  	case sUsePAM:
  		intptr = &options->use_pam;
  		goto parse_flag;
@@ -78,11 +78,11 @@ Index: openssh-8.4p1/servconf.c
  
  	/* Standard Options */
  	case sBadOption:
-Index: openssh-8.4p1/servconf.h
+Index: openssh-8.8p1/servconf.h
 ===================================================================
---- openssh-8.4p1.orig/servconf.h
+--- openssh-8.8p1.orig/servconf.h
-+++ openssh-8.4p1/servconf.h
++++ openssh-8.8p1/servconf.h
-@@ -195,6 +195,7 @@ typedef struct {
+@@ -200,6 +200,7 @@ typedef struct {
  	char   *adm_forced_command;
  
  	int	use_pam;		/* Enable auth via PAM */
@@ -90,11 +90,11 @@ Index: openssh-8.4p1/servconf.h
  
  	int	permit_tun;
  
-Index: openssh-8.4p1/sshd_config.0
+Index: openssh-8.8p1/sshd_config.0
 ===================================================================
---- openssh-8.4p1.orig/sshd_config.0
+--- openssh-8.8p1.orig/sshd_config.0
-+++ openssh-8.4p1/sshd_config.0
++++ openssh-8.8p1/sshd_config.0
-@@ -1032,6 +1032,14 @@ DESCRIPTION
+@@ -1074,6 +1074,14 @@ DESCRIPTION
               If UsePAM is enabled, you will not be able to run sshd(8) as a
               non-root user.  The default is no.
  
@@ -109,11 +109,11 @@ Index: openssh-8.4p1/sshd_config.0
       VersionAddendum
               Optionally specifies additional text to append to the SSH
               protocol banner sent by the server upon connection.  The default
-Index: openssh-8.4p1/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
 ===================================================================
---- openssh-8.4p1.orig/sshd_config.5
+--- openssh-8.8p1.orig/sshd_config.5
-+++ openssh-8.4p1/sshd_config.5
++++ openssh-8.8p1/sshd_config.5
-@@ -1718,6 +1718,18 @@ is enabled, you will not be able to run
+@@ -1775,6 +1775,18 @@ is enabled, you will not be able to run
  as a non-root user.
  The default is
  .Cm no .

openssh-7.7p1-pts_names_formatting.patch

@@ -4,15 +4,11 @@
 # formats in ?tmp? files)
 # --used to be called '-pts'
 
-diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
+Index: openssh-8.8p1/loginrec.c
---- openssh-7.7p1/loginrec.c
+===================================================================
-+++ openssh-7.7p1/loginrec.c
+--- openssh-8.8p1.orig/loginrec.c
-@@ -541,17 +541,17 @@ getlast_entry(struct logininfo *li)
++++ openssh-8.8p1/loginrec.c
- /*
+@@ -549,7 +549,7 @@ getlast_entry(struct logininfo *li)
-  * 'line' string utility functions
-  *
-  * These functions process the 'line' string into one of three forms:
-  *
   * 1. The full filename (including '/dev')
   * 2. The stripped name (excluding '/dev')
   * 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00
@@ -21,17 +17,7 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
   *
   * Form 3 is used on some systems to identify a .tmp.? entry when
   * attempting to remove it. Typically both addition and removal is
-  * performed by one application - say, sshd - so as long as the choice
+@@ -610,6 +610,10 @@ line_abbrevname(char *dst, const char *s
-  * uniquely identifies a terminal it's ok.
-  */
- 
- 
-@@ -602,16 +602,20 @@ line_abbrevname(char *dst, const char *s
- 	/* Always skip prefix if present */
- 	if (strncmp(src, "/dev/", 5) == 0)
- 		src += 5;
- 
- #ifdef WITH_ABBREV_NO_TTY
  	if (strncmp(src, "tty", 3) == 0)
  		src += 3;
  #endif
@@ -42,8 +28,3 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
  
  	len = strlen(src);
  
- 	if (len > 0) {
- 		if (((int)len - dstsize) > 0)
- 			src +=  ((int)len - dstsize);
- 
- 		/* note: _don't_ change this to strlcpy */

openssh-7.7p1-remove_xauth_cookies_on_exit.patch

@@ -5,15 +5,11 @@ try to remove xauth cookies on logout
 
 bnc#98815
 
-diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
+Index: openssh-8.8p1/session.c
---- openssh-7.7p1/session.c
+===================================================================
-+++ openssh-7.7p1/session.c
+--- openssh-8.8p1.orig/session.c
-@@ -2302,16 +2302,44 @@ session_close(struct ssh *ssh, Session *
++++ openssh-8.8p1/session.c
- 	u_int i;
+@@ -2441,6 +2441,34 @@ session_close(struct ssh *ssh, Session *
- 
- 	verbose("Close session: user %s from %.200s port %d id %d",
- 	    s->pw->pw_name,
- 	    ssh_remote_ipaddr(ssh),
  	    ssh_remote_port(ssh),
  	    s->self);
  
@@ -48,8 +44,3 @@ diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
  	if (s->ttyfd != -1)
  		session_pty_cleanup(s);
  	free(s->term);
- 	free(s->display);
- 	free(s->x11_chanids);
- 	free(s->auth_display);
- 	free(s->auth_data);
- 	free(s->auth_proto);

openssh-7.7p1-seccomp_ipc_flock.patch

@@ -15,11 +15,11 @@ this is only need on s390 architecture.
 
 Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
 
-Index: openssh-7.9p1/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
 ===================================================================
---- openssh-7.9p1.orig/sandbox-seccomp-filter.c
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
-+++ openssh-7.9p1/sandbox-seccomp-filter.c
++++ openssh-8.8p1/sandbox-seccomp-filter.c
-@@ -175,6 +175,9 @@ static const struct sock_filter preauth_
+@@ -219,6 +219,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_geteuid32
  	SC_ALLOW(__NR_geteuid32),
  #endif
@@ -29,7 +29,7 @@ Index: openssh-7.9p1/sandbox-seccomp-filter.c
  #ifdef __NR_getpgid
  	SC_ALLOW(__NR_getpgid),
  #endif
-@@ -193,6 +196,9 @@ static const struct sock_filter preauth_
+@@ -237,6 +240,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_getuid32
  	SC_ALLOW(__NR_getuid32),
  #endif

openssh-7.7p1-seccomp_stat.patch

@@ -5,15 +5,11 @@ Allow the stat() syscall for OpenSSL re-seed patch
 
 bnc#912436
 
-diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
---- openssh-7.7p1/sandbox-seccomp-filter.c
+===================================================================
-+++ openssh-7.7p1/sandbox-seccomp-filter.c
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
-@@ -224,16 +224,19 @@ static const struct sock_filter preauth_
++++ openssh-8.8p1/sandbox-seccomp-filter.c
- 	SC_ALLOW(__NR_select),
+@@ -294,6 +294,9 @@ static const struct sock_filter preauth_
- #endif
- #ifdef __NR_shutdown
- 	SC_ALLOW(__NR_shutdown),
- #endif
  #ifdef __NR_sigprocmask
  	SC_ALLOW(__NR_sigprocmask),
  #endif
@@ -23,8 +19,3 @@ diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-secc
  #ifdef __NR_time
  	SC_ALLOW(__NR_time),
  #endif
- #ifdef __NR_write
- 	SC_ALLOW(__NR_write),
- #endif
- #ifdef __NR_socketcall
- 	SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),

openssh-7.7p1-send_locale.patch

@@ -3,15 +3,11 @@
 send locales in default configuration
 bnc#65747
 
-diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
+Index: openssh-8.8p1/ssh_config
---- openssh-7.7p1/ssh_config
+===================================================================
-+++ openssh-7.7p1/ssh_config
+--- openssh-8.8p1.orig/ssh_config
-@@ -26,16 +26,21 @@ Host *
++++ openssh-8.8p1/ssh_config
- # security reasons: Someone stealing the authentification data on the
+@@ -31,6 +31,11 @@ Host *
- # remote side (the "spoofed" X-server by the remote sshd) can read your
- # keystrokes as you type, just like any other X11 client could do.
- # Set this to "no" here for global effect or in your own ~/.ssh/config
- # file if you want to have the remote X11 authentification data to 
  # expire after twenty minutes after remote login.
      ForwardX11Trusted yes
  
@@ -23,20 +19,11 @@ diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
  #   PasswordAuthentication yes
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
- #   GSSAPIDelegateCredentials no
+Index: openssh-8.8p1/sshd_config
- #   BatchMode no
+===================================================================
- #   CheckHostIP yes
+--- openssh-8.8p1.orig/sshd_config
- #   AddressFamily any
++++ openssh-8.8p1/sshd_config
- #   ConnectTimeout 0
+@@ -108,6 +108,11 @@ X11Forwarding yes
-diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
---- openssh-7.7p1/sshd_config
-+++ openssh-7.7p1/sshd_config
-@@ -104,14 +104,19 @@ X11Forwarding yes
- #VersionAddendum none
- 
- # no default banner path
- #Banner none
- 
  # override default of no subsystems
  Subsystem	sftp	/usr/libexec/sftp-server
  
@@ -48,6 +35,3 @@ diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
  #	X11Forwarding no
- #	AllowTcpForwarding no
- #	PermitTTY no
- #	ForceCommand cvs server

openssh-7.7p1-sftp_force_permissions.patch

@@ -1,7 +1,7 @@
-Index: openssh-8.4p1/sftp-server.8
+Index: openssh-8.8p1/sftp-server.8
 ===================================================================
---- openssh-8.4p1.orig/sftp-server.8
+--- openssh-8.8p1.orig/sftp-server.8
-+++ openssh-8.4p1/sftp-server.8
++++ openssh-8.8p1/sftp-server.8
 @@ -38,6 +38,7 @@
  .Op Fl P Ar denied_requests
  .Op Fl p Ar allowed_requests
@@ -21,11 +21,11 @@ Index: openssh-8.4p1/sftp-server.8
  .El
  .Pp
  On some systems,
-Index: openssh-8.4p1/sftp-server.c
+Index: openssh-8.8p1/sftp-server.c
 ===================================================================
---- openssh-8.4p1.orig/sftp-server.c
+--- openssh-8.8p1.orig/sftp-server.c
-+++ openssh-8.4p1/sftp-server.c
++++ openssh-8.8p1/sftp-server.c
-@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
+@@ -73,6 +73,10 @@ struct sshbuf *oqueue;
  /* Version of client */
  static u_int version;
  
@@ -36,7 +36,7 @@ Index: openssh-8.4p1/sftp-server.c
  /* SSH2_FXP_INIT received */
  static int init_done;
  
-@@ -687,6 +691,7 @@ process_open(u_int32_t id)
+@@ -724,6 +728,7 @@ process_open(u_int32_t id)
  	Attrib a;
  	char *name;
  	int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
@@ -44,7 +44,7 @@ Index: openssh-8.4p1/sftp-server.c
  
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
  	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
-@@ -696,6 +701,10 @@ process_open(u_int32_t id)
+@@ -733,6 +738,10 @@ process_open(u_int32_t id)
  	debug3("request %u: open flags %d", id, pflags);
  	flags = flags_from_portable(pflags);
  	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
@@ -55,7 +55,7 @@ Index: openssh-8.4p1/sftp-server.c
  	logit("open \"%s\" flags %s mode 0%o",
  	    name, string_from_portable(pflags), mode);
  	if (readonly &&
-@@ -717,6 +726,8 @@ process_open(u_int32_t id)
+@@ -754,6 +763,8 @@ process_open(u_int32_t id)
  			}
  		}
  	}
@@ -64,7 +64,7 @@ Index: openssh-8.4p1/sftp-server.c
  	if (status != SSH2_FX_OK)
  		send_status(id, status);
  	free(name);
-@@ -1131,6 +1142,7 @@ process_mkdir(u_int32_t id)
+@@ -1183,6 +1194,7 @@ process_mkdir(u_int32_t id)
  	Attrib a;
  	char *name;
  	int r, mode, status = SSH2_FX_FAILURE;
@@ -72,7 +72,7 @@ Index: openssh-8.4p1/sftp-server.c
  
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
  	    (r = decode_attrib(iqueue, &a)) != 0)
-@@ -1138,9 +1150,16 @@ process_mkdir(u_int32_t id)
+@@ -1190,9 +1202,16 @@ process_mkdir(u_int32_t id)
  
  	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
  	    a.perm & 07777 : 0777;
@@ -89,7 +89,7 @@ Index: openssh-8.4p1/sftp-server.c
  	status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
  	send_status(id, status);
  	free(name);
-@@ -1560,7 +1579,7 @@ sftp_server_usage(void)
+@@ -1700,7 +1719,7 @@ sftp_server_usage(void)
  	fprintf(stderr,
  	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
  	    "[-l log_level]\n\t[-P denied_requests] "
@@ -98,7 +98,7 @@ Index: openssh-8.4p1/sftp-server.c
  	    "       %s -Q protocol_feature\n",
  	    __progname, __progname);
  	exit(1);
-@@ -1588,7 +1607,7 @@ sftp_server_main(int argc, char **argv,
+@@ -1728,7 +1747,7 @@ sftp_server_main(int argc, char **argv,
  	pw = pwcopy(user_pw);
  
  	while (!skipargs && (ch = getopt(argc, argv,
@@ -107,7 +107,7 @@ Index: openssh-8.4p1/sftp-server.c
  		switch (ch) {
  		case 'Q':
  			if (strcasecmp(optarg, "requests") != 0) {
-@@ -1650,6 +1669,15 @@ sftp_server_main(int argc, char **argv,
+@@ -1790,6 +1809,15 @@ sftp_server_main(int argc, char **argv,
  				fatal("Invalid umask \"%s\"", optarg);
  			(void)umask((mode_t)mask);
  			break;

openssh-7.7p1-sftp_print_diagnostic_messages.patch

@@ -2,10 +2,10 @@
 # Parent  60bdbe6dd8d6bc011883472363d56e1d97f68835
 Put back sftp client diagnostic messages in batch mode
 
-Index: openssh-8.4p1/sftp.1
+Index: openssh-8.8p1/sftp.1
 ===================================================================
---- openssh-8.4p1.orig/sftp.1
+--- openssh-8.8p1.orig/sftp.1
-+++ openssh-8.4p1/sftp.1
++++ openssh-8.8p1/sftp.1
 @@ -287,6 +287,9 @@ Specifies the port to connect to on the
  .It Fl p
  Preserves modification times, access times, and modes from the
@@ -16,12 +16,12 @@ Index: openssh-8.4p1/sftp.1
  .It Fl q
  Quiet mode: disables the progress meter as well as warning and
  diagnostic messages from
-Index: openssh-8.4p1/sftp.c
+Index: openssh-8.8p1/sftp.c
 ===================================================================
---- openssh-8.4p1.orig/sftp.c
+--- openssh-8.8p1.orig/sftp.c
-+++ openssh-8.4p1/sftp.c
++++ openssh-8.8p1/sftp.c
-@@ -85,6 +85,9 @@ static volatile pid_t sshpid = -1;
+@@ -82,6 +82,9 @@ static volatile pid_t sshpid = -1;
- /* Suppress diagnositic messages */
+ /* Suppress diagnostic messages */
  int quiet = 0;
  
 +/* Force diagnositic messages in batch mode */
@@ -30,7 +30,7 @@ Index: openssh-8.4p1/sftp.c
  /* This is set to 0 if the progressmeter is not desired. */
  int showprogress = 1;
  
-@@ -2408,7 +2411,7 @@ main(int argc, char **argv)
+@@ -2381,7 +2384,7 @@ main(int argc, char **argv)
  	infile = stdin;
  
  	while ((ch = getopt(argc, argv,
@@ -39,7 +39,7 @@ Index: openssh-8.4p1/sftp.c
  		switch (ch) {
  		/* Passed through to ssh(1) */
  		case 'A':
-@@ -2426,6 +2429,9 @@ main(int argc, char **argv)
+@@ -2399,6 +2402,9 @@ main(int argc, char **argv)
  			addargs(&args, "-%c", ch);
  			addargs(&args, "%s", optarg);
  			break;
@@ -49,7 +49,7 @@ Index: openssh-8.4p1/sftp.c
  		case 'q':
  			ll = SYSLOG_LEVEL_ERROR;
  			quiet = 1;
-@@ -2510,6 +2516,8 @@ main(int argc, char **argv)
+@@ -2483,6 +2489,8 @@ main(int argc, char **argv)
  			usage();
  		}
  	}

openssh-7.7p1-systemd-notify.patch

@@ -3,11 +3,11 @@
 Send signals to systemd to prevent various race conditions
 bsc#1048367
 
-Index: openssh-7.8p1/configure.ac
+Index: openssh-8.8p1/configure.ac
 ===================================================================
---- openssh-7.8p1.orig/configure.ac
+--- openssh-8.8p1.orig/configure.ac
-+++ openssh-7.8p1/configure.ac
++++ openssh-8.8p1/configure.ac
-@@ -4378,6 +4378,30 @@ AC_ARG_WITH([kerberos5],
+@@ -4751,6 +4751,30 @@ AC_ARG_WITH([kerberos5],
  AC_SUBST([GSSLIBS])
  AC_SUBST([K5LIBS])
  
@@ -38,7 +38,7 @@ Index: openssh-7.8p1/configure.ac
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -5183,6 +5207,7 @@ echo "                   libldns support
+@@ -5564,6 +5588,7 @@ echo "                   libldns support
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
  echo "         Solaris privilege support: $SPP_MSG"
@@ -46,11 +46,11 @@ Index: openssh-7.8p1/configure.ac
  echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
  echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
  echo "                  BSD Auth support: $BSD_AUTH_MSG"
-Index: openssh-7.8p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
---- openssh-7.8p1.orig/sshd.c
+--- openssh-8.8p1.orig/sshd.c
-+++ openssh-7.8p1/sshd.c
++++ openssh-8.8p1/sshd.c
-@@ -87,6 +87,10 @@
+@@ -85,6 +85,10 @@
  #include <prot.h>
  #endif
  
@@ -72,7 +72,7 @@ Index: openssh-7.8p1/sshd.c
  	logit("Received SIGHUP; restarting.");
  	if (options.pid_file != NULL)
  		unlink(options.pid_file);
-@@ -1995,6 +2003,11 @@ main(int ac, char **av)
+@@ -2076,6 +2084,11 @@ main(int ac, char **av)
  			}
  		}
  

openssh-7.9p1-keygen-preserve-perms.patch

@@ -8,11 +8,11 @@ Date:   Fri Sep 27 01:57:16 2019 +0200
     just going with what mkstemp() gives us. This is useful in corner
     cases where known_hosts is shared between users.
 
-diff --git a/ssh-keygen.c b/ssh-keygen.c
+Index: openssh-8.8p1/ssh-keygen.c
-index 03a7fe5..ca8a309 100644
+===================================================================
---- a/ssh-keygen.c
+--- openssh-8.8p1.orig/ssh-keygen.c
-+++ b/ssh-keygen.c
++++ openssh-8.8p1/ssh-keygen.c
-@@ -1338,6 +1338,11 @@ do_known_hosts(struct passwd *pw, const char *name)
+@@ -1384,6 +1384,11 @@ do_known_hosts(struct passwd *pw, const
  		if (inplace)
  			unlink(tmp);
  	} else if (inplace) {
@@ -24,7 +24,7 @@ index 03a7fe5..ca8a309 100644
  		/* Backup existing file */
  		if (unlink(old) == -1 && errno != ENOENT)
  			fatal("unlink %.100s: %s", old, strerror(errno));
-@@ -1352,6 +1357,12 @@ do_known_hosts(struct passwd *pw, const char *name)
+@@ -1398,6 +1403,12 @@ do_known_hosts(struct passwd *pw, const
  			unlink(old);
  			exit(1);
  		}

openssh-7.9p1-revert-new-qos-defaults.patch

@@ -6,11 +6,11 @@ Date:   Thu Jun 20 23:54:11 2019 +0200
     
     Reverts OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181
 
-diff --git a/readconf.c b/readconf.c
+Index: openssh-8.8p1/readconf.c
-index 24f2cb1..bbdea0d 100644
+===================================================================
---- a/readconf.c
+--- openssh-8.8p1.orig/readconf.c
-+++ b/readconf.c
++++ openssh-8.8p1/readconf.c
-@@ -2183,9 +2183,9 @@ fill_default_options(Options * options)
+@@ -2679,9 +2679,9 @@ fill_default_options(Options * options)
  	if (options->visual_host_key == -1)
  		options->visual_host_key = 0;
  	if (options->ip_qos_interactive == -1)
@@ -21,12 +21,12 @@ index 24f2cb1..bbdea0d 100644
 +		options->ip_qos_bulk = IPTOS_THROUGHPUT;
  	if (options->request_tty == -1)
  		options->request_tty = REQUEST_TTY_AUTO;
- 	if (options->proxy_use_fdpass == -1)
+ 	if (options->session_type == -1)
-diff --git a/servconf.c b/servconf.c
+Index: openssh-8.8p1/servconf.c
-index 13cf154..766ac6b 100644
+===================================================================
---- a/servconf.c
+--- openssh-8.8p1.orig/servconf.c
-+++ b/servconf.c
++++ openssh-8.8p1/servconf.c
-@@ -445,9 +445,9 @@ fill_default_server_options(ServerOptions *options)
+@@ -459,9 +459,9 @@ fill_default_server_options(ServerOption
  	if (options->permit_tun == -1)
  		options->permit_tun = SSH_TUNMODE_NO;
  	if (options->ip_qos_interactive == -1)
@@ -38,11 +38,11 @@ index 13cf154..766ac6b 100644
  	if (options->version_addendum == NULL)
  		options->version_addendum = xstrdup("");
  	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
-diff --git a/ssh_config.5 b/ssh_config.5
+Index: openssh-8.8p1/ssh_config.5
-index 3bf0502..10246f8 100644
+===================================================================
---- a/ssh_config.5
+--- openssh-8.8p1.orig/ssh_config.5
-+++ b/ssh_config.5
++++ openssh-8.8p1/ssh_config.5
-@@ -1088,11 +1088,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+@@ -1182,11 +1182,9 @@ If one argument is specified, it is used
  If two values are specified, the first is automatically selected for
  interactive sessions and the second for non-interactive sessions.
  The default is
@@ -56,11 +56,11 @@ index 3bf0502..10246f8 100644
  for non-interactive sessions.
  .It Cm KbdInteractiveAuthentication
  Specifies whether to use keyboard-interactive authentication.
-diff --git a/sshd_config.5 b/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
-index 50a4917..a276fcb 100644
+===================================================================
---- a/sshd_config.5
+--- openssh-8.8p1.orig/sshd_config.5
-+++ b/sshd_config.5
++++ openssh-8.8p1/sshd_config.5
-@@ -868,11 +868,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+@@ -903,11 +903,9 @@ If one argument is specified, it is used
  If two values are specified, the first is automatically selected for
  interactive sessions and the second for non-interactive sessions.
  The default is

openssh-8.1p1-audit.patch

@@ -1,9 +1,9 @@
-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
---- openssh-8.4p1.orig/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
++++ openssh-8.8p1/Makefile.in
-@@ -113,7 +113,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -114,7 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
+ 	kexsntrup761x25519.o sntrup761.o kexgen.o \
  	kexgssc.o \
  	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
 -	sshbuf-io.o
@@ -11,11 +11,11 @@ Index: openssh-8.4p1/Makefile.in
  
  SKOBJS=	ssh-sk-client.o
  
-Index: openssh-8.4p1/audit-bsm.c
+Index: openssh-8.8p1/audit-bsm.c
 ===================================================================
---- openssh-8.4p1.orig/audit-bsm.c
+--- openssh-8.8p1.orig/audit-bsm.c
-+++ openssh-8.4p1/audit-bsm.c
++++ openssh-8.8p1/audit-bsm.c
-@@ -372,13 +372,26 @@ audit_connection_from(const char *host,
+@@ -373,13 +373,26 @@ audit_connection_from(const char *host,
  #endif
  }
  
@@ -43,7 +43,7 @@ Index: openssh-8.4p1/audit-bsm.c
  audit_session_open(struct logininfo *li)
  {
  	/* not implemented */
-@@ -390,6 +403,12 @@ audit_session_close(struct logininfo *li
+@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li
  	/* not implemented */
  }
  
@@ -56,7 +56,7 @@ Index: openssh-8.4p1/audit-bsm.c
  void
  audit_event(struct ssh *ssh, ssh_audit_event_t event)
  {
-@@ -451,4 +470,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
+@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
  		debug("%s: unhandled event %d", __func__, event);
  	}
  }
@@ -85,10 +85,10 @@ Index: openssh-8.4p1/audit-bsm.c
 +	/* not implemented */
 +}
  #endif /* BSM */
-Index: openssh-8.4p1/audit-linux.c
+Index: openssh-8.8p1/audit-linux.c
 ===================================================================
---- openssh-8.4p1.orig/audit-linux.c
+--- openssh-8.8p1.orig/audit-linux.c
-+++ openssh-8.4p1/audit-linux.c
++++ openssh-8.8p1/audit-linux.c
 @@ -33,27 +33,40 @@
  
  #include "log.h"
@@ -459,10 +459,10 @@ Index: openssh-8.4p1/audit-linux.c
 +		error("cannot write into audit");
 +}
  #endif /* USE_LINUX_AUDIT */
-Index: openssh-8.4p1/audit.c
+Index: openssh-8.8p1/audit.c
 ===================================================================
---- openssh-8.4p1.orig/audit.c
+--- openssh-8.8p1.orig/audit.c
-+++ openssh-8.4p1/audit.c
++++ openssh-8.8p1/audit.c
 @@ -34,6 +34,12 @@
  #include "log.h"
  #include "hostfile.h"
@@ -640,10 +640,10 @@ Index: openssh-8.4p1/audit.c
  }
  # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
  #endif /* SSH_AUDIT_EVENTS */
-Index: openssh-8.4p1/audit.h
+Index: openssh-8.8p1/audit.h
 ===================================================================
---- openssh-8.4p1.orig/audit.h
+--- openssh-8.8p1.orig/audit.h
-+++ openssh-8.4p1/audit.h
++++ openssh-8.8p1/audit.h
 @@ -26,6 +26,7 @@
  # define _SSH_AUDIT_H
  
@@ -686,10 +686,10 @@ Index: openssh-8.4p1/audit.h
 +void	audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
  
  #endif /* _SSH_AUDIT_H */
-Index: openssh-8.4p1/auditstub.c
+Index: openssh-8.8p1/auditstub.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/auditstub.c
++++ openssh-8.8p1/auditstub.c
 @@ -0,0 +1,52 @@
 +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
 +
@@ -743,20 +743,11 @@ Index: openssh-8.4p1/auditstub.c
 +audit_session_key_free_body(struct ssh *ssh, int ctos, pid_t pid, uid_t uid)
 +{
 +}
-Index: openssh-8.4p1/auth.c
+Index: openssh-8.8p1/auth.c
 ===================================================================
---- openssh-8.4p1.orig/auth.c
+--- openssh-8.8p1.orig/auth.c
-+++ openssh-8.4p1/auth.c
++++ openssh-8.8p1/auth.c
-@@ -367,7 +367,7 @@ auth_log(struct ssh *ssh, int authentica
+@@ -599,9 +599,6 @@ getpwnamallow(struct ssh *ssh, const cha
- # endif
- #endif
- #ifdef SSH_AUDIT_EVENTS
--	if (authenticated == 0 && !authctxt->postponed)
-+	if (authenticated == 0 && !authctxt->postponed && !partial)
- 		audit_event(ssh, audit_classify_auth(method));
- #endif
- }
-@@ -593,9 +593,6 @@ getpwnamallow(struct ssh *ssh, const cha
  		record_failed_login(ssh, user,
  		    auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
  #endif
@@ -766,10 +757,10 @@ Index: openssh-8.4p1/auth.c
  		return (NULL);
  	}
  	if (!allowed_user(ssh, pw))
-Index: openssh-8.4p1/auth.h
+Index: openssh-8.8p1/auth.h
 ===================================================================
---- openssh-8.4p1.orig/auth.h
+--- openssh-8.8p1.orig/auth.h
-+++ openssh-8.4p1/auth.h
++++ openssh-8.8p1/auth.h
 @@ -189,6 +189,8 @@ struct passwd * getpwnamallow(struct ssh
  
  char	*expand_authorized_keys(const char *, struct passwd *pw);
@@ -788,11 +779,11 @@ Index: openssh-8.4p1/auth.h
  
  /* Key / cert options linkage to auth layer */
  const struct sshauthopt *auth_options(struct ssh *);
-Index: openssh-8.4p1/auth2-hostbased.c
+Index: openssh-8.8p1/auth2-hostbased.c
 ===================================================================
---- openssh-8.4p1.orig/auth2-hostbased.c
+--- openssh-8.8p1.orig/auth2-hostbased.c
-+++ openssh-8.4p1/auth2-hostbased.c
++++ openssh-8.8p1/auth2-hostbased.c
-@@ -150,7 +150,7 @@ userauth_hostbased(struct ssh *ssh)
+@@ -149,7 +149,7 @@ userauth_hostbased(struct ssh *ssh)
  	authenticated = 0;
  	if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser,
  	    chost, key)) &&
@@ -801,7 +792,7 @@ Index: openssh-8.4p1/auth2-hostbased.c
  	    sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0)
  		authenticated = 1;
  
-@@ -167,6 +167,19 @@ done:
+@@ -166,6 +166,19 @@ done:
  	return authenticated;
  }
  
@@ -821,11 +812,11 @@ Index: openssh-8.4p1/auth2-hostbased.c
  /* return 1 if given hostkey is allowed */
  int
  hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
-Index: openssh-8.4p1/auth2-pubkey.c
+Index: openssh-8.8p1/auth2-pubkey.c
 ===================================================================
---- openssh-8.4p1.orig/auth2-pubkey.c
+--- openssh-8.8p1.orig/auth2-pubkey.c
-+++ openssh-8.4p1/auth2-pubkey.c
++++ openssh-8.8p1/auth2-pubkey.c
-@@ -212,7 +212,7 @@ userauth_pubkey(struct ssh *ssh)
+@@ -203,7 +203,7 @@ userauth_pubkey(struct ssh *ssh)
  		/* test for correct signature */
  		authenticated = 0;
  		if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
@@ -834,7 +825,7 @@ Index: openssh-8.4p1/auth2-pubkey.c
  		    sshbuf_ptr(b), sshbuf_len(b),
  		    (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
  		    ssh->compat, &sig_details)) == 0) {
-@@ -308,6 +308,19 @@ done:
+@@ -295,6 +295,19 @@ done:
  	return authenticated;
  }
  
@@ -854,11 +845,11 @@ Index: openssh-8.4p1/auth2-pubkey.c
  static int
  match_principals_option(const char *principal_list, struct sshkey_cert *cert)
  {
-Index: openssh-8.4p1/auth2.c
+Index: openssh-8.8p1/auth2.c
 ===================================================================
---- openssh-8.4p1.orig/auth2.c
+--- openssh-8.8p1.orig/auth2.c
-+++ openssh-8.4p1/auth2.c
++++ openssh-8.8p1/auth2.c
-@@ -293,9 +293,6 @@ input_userauth_request(int type, u_int32
+@@ -290,9 +290,6 @@ input_userauth_request(int type, u_int32
  		} else {
  			/* Invalid user, fake password information */
  			authctxt->pw = fakepw();
@@ -868,10 +859,10 @@ Index: openssh-8.4p1/auth2.c
  		}
  #ifdef USE_PAM
  		if (options.use_pam)
-Index: openssh-8.4p1/cipher.c
+Index: openssh-8.8p1/cipher.c
 ===================================================================
---- openssh-8.4p1.orig/cipher.c
+--- openssh-8.8p1.orig/cipher.c
-+++ openssh-8.4p1/cipher.c
++++ openssh-8.8p1/cipher.c
 @@ -58,25 +58,6 @@
  #define EVP_CIPHER_CTX void
  #endif
@@ -898,7 +889,7 @@ Index: openssh-8.4p1/cipher.c
  static const struct sshcipher ciphers_all[] = {
  #ifdef WITH_OPENSSL
  #ifndef OPENSSL_NO_DES
-@@ -462,7 +443,7 @@ cipher_get_length(struct sshcipher_ctx *
+@@ -460,7 +441,7 @@ cipher_get_length(struct sshcipher_ctx *
  void
  cipher_free(struct sshcipher_ctx *cc)
  {
@@ -907,10 +898,10 @@ Index: openssh-8.4p1/cipher.c
  		return;
  	if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
  		chachapoly_free(cc->cp_ctx);
-Index: openssh-8.4p1/cipher.h
+Index: openssh-8.8p1/cipher.h
 ===================================================================
---- openssh-8.4p1.orig/cipher.h
+--- openssh-8.8p1.orig/cipher.h
-+++ openssh-8.4p1/cipher.h
++++ openssh-8.8p1/cipher.h
 @@ -47,7 +47,25 @@
  #define CIPHER_ENCRYPT		1
  #define CIPHER_DECRYPT		0
@@ -938,10 +929,10 @@ Index: openssh-8.4p1/cipher.h
  struct sshcipher_ctx {
  	int	plaintext;
  	int	encrypt;
-Index: openssh-8.4p1/kex.c
+Index: openssh-8.8p1/kex.c
 ===================================================================
---- openssh-8.4p1.orig/kex.c
+--- openssh-8.8p1.orig/kex.c
-+++ openssh-8.4p1/kex.c
++++ openssh-8.8p1/kex.c
 @@ -62,6 +62,7 @@
  #include "ssherr.h"
  #include "sshbuf.h"
@@ -950,7 +941,7 @@ Index: openssh-8.4p1/kex.c
  
  #ifdef GSSAPI
  #include "ssh-gss.h"
-@@ -857,12 +858,16 @@ kex_start_rekex(struct ssh *ssh)
+@@ -859,12 +860,16 @@ kex_start_rekex(struct ssh *ssh)
  }
  
  static int
@@ -967,9 +958,9 @@ Index: openssh-8.4p1/kex.c
  		return SSH_ERR_NO_CIPHER_ALG_MATCH;
 +	}
  	if ((enc->cipher = cipher_by_name(name)) == NULL) {
- 		error("%s: unsupported cipher %s", __func__, name);
+ 		error_f("unsupported cipher %s", name);
  		free(name);
-@@ -883,8 +888,12 @@ choose_mac(struct ssh *ssh, struct sshma
+@@ -885,8 +890,12 @@ choose_mac(struct ssh *ssh, struct sshma
  {
  	char *name = match_list(client, server, NULL);
  
@@ -981,9 +972,9 @@ Index: openssh-8.4p1/kex.c
  		return SSH_ERR_NO_MAC_ALG_MATCH;
 +	}
  	if (mac_setup(mac, name) < 0) {
- 		error("%s: unsupported MAC %s", __func__, name);
+ 		error_f("unsupported MAC %s", name);
  		free(name);
-@@ -897,12 +906,16 @@ choose_mac(struct ssh *ssh, struct sshma
+@@ -899,12 +908,16 @@ choose_mac(struct ssh *ssh, struct sshma
  }
  
  static int
@@ -1002,7 +993,7 @@ Index: openssh-8.4p1/kex.c
  #ifdef WITH_ZLIB
  	if (strcmp(name, "zlib@openssh.com") == 0) {
  		comp->type = COMP_DELAYED;
-@@ -1043,7 +1056,7 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1045,7 +1058,7 @@ kex_choose_conf(struct ssh *ssh)
  		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
  		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
  		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
@@ -1011,7 +1002,7 @@ Index: openssh-8.4p1/kex.c
  		    sprop[nenc])) != 0) {
  			kex->failed_choice = peer[nenc];
  			peer[nenc] = NULL;
-@@ -1058,7 +1071,7 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1060,7 +1073,7 @@ kex_choose_conf(struct ssh *ssh)
  			peer[nmac] = NULL;
  			goto out;
  		}
@@ -1020,7 +1011,7 @@ Index: openssh-8.4p1/kex.c
  		    sprop[ncomp])) != 0) {
  			kex->failed_choice = peer[ncomp];
  			peer[ncomp] = NULL;
-@@ -1081,6 +1094,10 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1083,6 +1096,10 @@ kex_choose_conf(struct ssh *ssh)
  		dh_need = MAXIMUM(dh_need, newkeys->enc.block_size);
  		dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len);
  		dh_need = MAXIMUM(dh_need, newkeys->mac.key_len);
@@ -1031,7 +1022,7 @@ Index: openssh-8.4p1/kex.c
  	}
  	/* XXX need runden? */
  	kex->we_need = need;
-@@ -1245,6 +1262,36 @@ dump_digest(const char *msg, const u_cha
+@@ -1250,6 +1267,36 @@ dump_digest(const char *msg, const u_cha
  }
  #endif
  
@@ -1068,10 +1059,10 @@ Index: openssh-8.4p1/kex.c
  /*
   * Send a plaintext error message to the peer, suffixed by \r\n.
   * Only used during banner exchange, and there only for the server.
-Index: openssh-8.4p1/kex.h
+Index: openssh-8.8p1/kex.h
 ===================================================================
---- openssh-8.4p1.orig/kex.h
+--- openssh-8.8p1.orig/kex.h
-+++ openssh-8.4p1/kex.h
++++ openssh-8.8p1/kex.h
 @@ -226,6 +226,8 @@ int	 kexgss_client(struct ssh *);
  int	 kexgss_server(struct ssh *);
  #endif
@@ -1081,10 +1072,10 @@ Index: openssh-8.4p1/kex.h
  int	 kex_dh_keypair(struct kex *);
  int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
      struct sshbuf **);
-Index: openssh-8.4p1/mac.c
+Index: openssh-8.8p1/mac.c
 ===================================================================
---- openssh-8.4p1.orig/mac.c
+--- openssh-8.8p1.orig/mac.c
-+++ openssh-8.4p1/mac.c
++++ openssh-8.8p1/mac.c
 @@ -277,6 +277,20 @@ mac_clear(struct sshmac *mac)
  	mac->umac_ctx = NULL;
  }
@@ -1106,10 +1097,10 @@ Index: openssh-8.4p1/mac.c
  /* XXX copied from ciphers_valid */
  #define	MAC_SEP	","
  int
-Index: openssh-8.4p1/mac.h
+Index: openssh-8.8p1/mac.h
 ===================================================================
---- openssh-8.4p1.orig/mac.h
+--- openssh-8.8p1.orig/mac.h
-+++ openssh-8.4p1/mac.h
++++ openssh-8.8p1/mac.h
 @@ -49,5 +49,6 @@ int	 mac_compute(struct sshmac *, u_int3
  int	 mac_check(struct sshmac *, u_int32_t, const u_char *, size_t,
      const u_char *, size_t);
@@ -1117,10 +1108,10 @@ Index: openssh-8.4p1/mac.h
 +void	 mac_destroy(struct sshmac *);
  
  #endif /* SSHMAC_H */
-Index: openssh-8.4p1/monitor.c
+Index: openssh-8.8p1/monitor.c
 ===================================================================
---- openssh-8.4p1.orig/monitor.c
+--- openssh-8.8p1.orig/monitor.c
-+++ openssh-8.4p1/monitor.c
++++ openssh-8.8p1/monitor.c
 @@ -93,6 +93,7 @@
  #include "compat.h"
  #include "ssh2.h"
@@ -1129,7 +1120,7 @@ Index: openssh-8.4p1/monitor.c
  #include "match.h"
  #include "ssherr.h"
  #include "sk-api.h"
-@@ -108,6 +109,8 @@ extern u_char session_id[];
+@@ -107,6 +108,8 @@ extern u_int utmp_len;
  extern struct sshbuf *loginmsg;
  extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */
  
@@ -1138,7 +1129,7 @@ Index: openssh-8.4p1/monitor.c
  /* State exported from the child */
  static struct sshbuf *child_state;
  
-@@ -155,6 +158,11 @@ int mm_answer_gss_updatecreds(struct ssh
+@@ -152,6 +155,11 @@ int mm_answer_gss_updatecreds(struct ssh
  #ifdef SSH_AUDIT_EVENTS
  int mm_answer_audit_event(struct ssh *, int, struct sshbuf *);
  int mm_answer_audit_command(struct ssh *, int, struct sshbuf *);
@@ -1150,7 +1141,7 @@ Index: openssh-8.4p1/monitor.c
  #endif
  
  static Authctxt *authctxt;
-@@ -210,6 +218,10 @@ struct mon_table mon_dispatch_proto20[]
+@@ -207,6 +215,10 @@ struct mon_table mon_dispatch_proto20[]
  #endif
  #ifdef SSH_AUDIT_EVENTS
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@@ -1161,7 +1152,7 @@ Index: openssh-8.4p1/monitor.c
  #endif
  #ifdef BSD_AUTH
      {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -244,6 +256,11 @@ struct mon_table mon_dispatch_postauth20
+@@ -241,6 +253,11 @@ struct mon_table mon_dispatch_postauth20
  #ifdef SSH_AUDIT_EVENTS
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
@@ -1173,7 +1164,7 @@ Index: openssh-8.4p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -1407,8 +1424,10 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1403,8 +1420,10 @@ mm_answer_keyverify(struct ssh *ssh, int
  	int r, ret, req_presence = 0, req_verify = 0, valid_data = 0;
  	int encoded_ret;
  	struct sshkey_sig_details *sig_details = NULL;
@@ -1185,18 +1176,18 @@ Index: openssh-8.4p1/monitor.c
  	    (r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||
  	    (r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||
  	    (r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
-@@ -1417,6 +1436,8 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1413,6 +1432,8 @@ mm_answer_keyverify(struct ssh *ssh, int
  	if (hostbased_cuser == NULL || hostbased_chost == NULL ||
  	  !monitor_allowed_key(blob, bloblen))
- 		fatal("%s: bad key, not previously allowed", __func__);
+ 		fatal_f("bad key, not previously allowed");
 +	if (type != key_blobtype)
-+		fatal("%s: bad key type", __func__);
++		fatal_f("bad key type");
  
  	/* Empty signature algorithm means NULL. */
  	if (*sigalg == '\0') {
-@@ -1432,14 +1453,19 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1428,14 +1449,19 @@ mm_answer_keyverify(struct ssh *ssh, int
  	case MM_USERKEY:
- 		valid_data = monitor_valid_userblob(data, datalen);
+ 		valid_data = monitor_valid_userblob(ssh, data, datalen);
  		auth_method = "publickey";
 +		ret = user_key_verify(ssh, key, signature, signaturelen, data,
 +		    datalen, sigalg, ssh->compat, &sig_details);
@@ -1214,55 +1205,55 @@ Index: openssh-8.4p1/monitor.c
  		break;
  	}
  	if (!valid_data)
-@@ -1449,8 +1475,6 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1447,8 +1473,6 @@ mm_answer_keyverify(struct ssh *ssh, int
  	    SSH_FP_DEFAULT)) == NULL)
- 		fatal("%s: sshkey_fingerprint failed", __func__);
+ 		fatal_f("sshkey_fingerprint failed");
  
 -	ret = sshkey_verify(key, signature, signaturelen, data, datalen,
 -	    sigalg, ssh->compat, &sig_details);
- 	debug3("%s: %s %p signature %s%s%s", __func__, auth_method, key,
+ 	debug3_f("%s %s signature %s%s%s", auth_method, sshkey_type(key),
  	    (ret == 0) ? "verified" : "unverified",
  	    (ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");
-@@ -1537,13 +1561,19 @@ mm_record_login(struct ssh *ssh, Session
+@@ -1535,13 +1559,19 @@ mm_record_login(struct ssh *ssh, Session
  }
  
  static void
 -mm_session_close(Session *s)
 +mm_session_close(struct ssh *ssh, Session *s)
  {
- 	debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid);
+ 	debug3_f("session %d pid %ld", s->self, (long)s->pid);
  	if (s->ttyfd != -1) {
- 		debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
+ 		debug3_f("tty %s ptyfd %d", s->tty, s->ptyfd);
  		session_pty_cleanup2(s);
  	}
 +#ifdef SSH_AUDIT_EVENTS
 +	if (s->command != NULL) {
-+		debug3("%s: command %d", __func__, s->command_handle);
++		debug3_f("command %d", s->command_handle);
 +		session_end_command2(ssh, s);
 +	}
 +#endif
  	session_unused(s->self);
  }
  
-@@ -1610,7 +1640,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
+@@ -1608,7 +1638,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
  
   error:
  	if (s != NULL)
 -		mm_session_close(s);
 +		mm_session_close(ssh, s);
  	if ((r = sshbuf_put_u32(m, 0)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 		fatal_fr(r, "assemble 0");
  	mm_request_send(sock, MONITOR_ANS_PTY, m);
-@@ -1629,7 +1659,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
+@@ -1627,7 +1657,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
  	if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 		fatal_fr(r, "parse tty");
  	if ((s = session_by_tty(tty)) != NULL)
 -		mm_session_close(s);
 +		mm_session_close(ssh, s);
  	sshbuf_reset(m);
  	free(tty);
  	return (0);
-@@ -1651,6 +1681,8 @@ mm_answer_term(struct ssh *ssh, int sock
+@@ -1649,6 +1679,8 @@ mm_answer_term(struct ssh *ssh, int sock
  		sshpam_cleanup();
  #endif
  
@@ -1271,7 +1262,7 @@ Index: openssh-8.4p1/monitor.c
  	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
  		if (errno != EINTR)
  			exit(1);
-@@ -1697,12 +1729,47 @@ mm_answer_audit_command(struct ssh *ssh,
+@@ -1695,12 +1727,47 @@ mm_answer_audit_command(struct ssh *ssh,
  {
  	char *cmd;
  	int r;
@@ -1320,18 +1311,18 @@ Index: openssh-8.4p1/monitor.c
  	free(cmd);
  	return (0);
  }
-@@ -1768,6 +1835,7 @@ monitor_apply_keystate(struct ssh *ssh,
+@@ -1772,6 +1839,7 @@ monitor_apply_keystate(struct ssh *ssh,
  void
  mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
  {
 +	struct sshbuf *m;
- 	debug3("%s: Waiting for new keys", __func__);
+ 	debug3_f("Waiting for new keys");
  
  	if ((child_state = sshbuf_new()) == NULL)
-@@ -1775,6 +1843,19 @@ mm_get_keystate(struct ssh *ssh, struct
+@@ -1779,6 +1847,18 @@ mm_get_keystate(struct ssh *ssh, struct
  	mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,
  	    child_state);
- 	debug3("%s: GOT new keys", __func__);
+ 	debug3_f("GOT new keys");
 +
 +#ifdef SSH_AUDIT_EVENTS
 +	m = sshbuf_new();
@@ -1344,11 +1335,10 @@ Index: openssh-8.4p1/monitor.c
 +	/* Drain any buffered messages from the child */
 +	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
 +		;
-+
  }
  
  
-@@ -2052,3 +2133,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
+@@ -2056,3 +2136,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
  
  #endif /* GSSAPI */
  
@@ -1451,10 +1441,10 @@ Index: openssh-8.4p1/monitor.c
 +	return 0;
 +}
 +#endif /* SSH_AUDIT_EVENTS */
-Index: openssh-8.4p1/monitor.h
+Index: openssh-8.8p1/monitor.h
 ===================================================================
---- openssh-8.4p1.orig/monitor.h
+--- openssh-8.8p1.orig/monitor.h
-+++ openssh-8.4p1/monitor.h
++++ openssh-8.8p1/monitor.h
 @@ -61,7 +61,13 @@ enum monitor_reqtype {
  	MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
  	MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
@@ -1470,11 +1460,11 @@ Index: openssh-8.4p1/monitor.h
  
  	MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
  	MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
-Index: openssh-8.4p1/monitor_wrap.c
+Index: openssh-8.8p1/monitor_wrap.c
 ===================================================================
---- openssh-8.4p1.orig/monitor_wrap.c
+--- openssh-8.8p1.orig/monitor_wrap.c
-+++ openssh-8.4p1/monitor_wrap.c
++++ openssh-8.8p1/monitor_wrap.c
-@@ -492,7 +492,7 @@ mm_key_allowed(enum mm_keytype type, con
+@@ -499,7 +499,7 @@ mm_key_allowed(enum mm_keytype type, con
   */
  
  int
@@ -1483,17 +1473,17 @@ Index: openssh-8.4p1/monitor_wrap.c
      const u_char *data, size_t datalen, const char *sigalg, u_int compat,
      struct sshkey_sig_details **sig_detailsp)
  {
-@@ -508,7 +508,8 @@ mm_sshkey_verify(const struct sshkey *ke
+@@ -515,7 +515,8 @@ mm_sshkey_verify(const struct sshkey *ke
  		*sig_detailsp = NULL;
  	if ((m = sshbuf_new()) == NULL)
- 		fatal("%s: sshbuf_new failed", __func__);
+ 		fatal_f("sshbuf_new failed");
 -	if ((r = sshkey_puts(key, m)) != 0 ||
 +	if ((r = sshbuf_put_u32(m, type)) != 0 ||
 +	    (r = sshkey_puts(key, m)) != 0 ||
  	    (r = sshbuf_put_string(m, sig, siglen)) != 0 ||
  	    (r = sshbuf_put_string(m, data, datalen)) != 0 ||
  	    (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
-@@ -541,6 +542,20 @@ mm_sshkey_verify(const struct sshkey *ke
+@@ -548,6 +549,20 @@ mm_sshkey_verify(const struct sshkey *ke
  	return 0;
  }
  
@@ -1514,7 +1504,7 @@ Index: openssh-8.4p1/monitor_wrap.c
  void
  mm_send_keystate(struct ssh *ssh, struct monitor *monitor)
  {
-@@ -894,11 +909,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
+@@ -900,11 +915,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
  	sshbuf_free(m);
  }
  
@@ -1529,7 +1519,7 @@ Index: openssh-8.4p1/monitor_wrap.c
  
  	debug3("%s entering command %s", __func__, command);
  
-@@ -908,6 +924,30 @@ mm_audit_run_command(const char *command
+@@ -914,6 +930,30 @@ mm_audit_run_command(const char *command
  		fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
  	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);
@@ -1560,7 +1550,7 @@ Index: openssh-8.4p1/monitor_wrap.c
  	sshbuf_free(m);
  }
  #endif /* SSH_AUDIT_EVENTS */
-@@ -1068,3 +1108,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
+@@ -1074,3 +1114,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
  }
  
  #endif /* GSSAPI */
@@ -1644,10 +1634,10 @@ Index: openssh-8.4p1/monitor_wrap.c
 +	sshbuf_free(m);
 +}
 +#endif /* SSH_AUDIT_EVENTS */
-Index: openssh-8.4p1/monitor_wrap.h
+Index: openssh-8.8p1/monitor_wrap.h
 ===================================================================
---- openssh-8.4p1.orig/monitor_wrap.h
+--- openssh-8.8p1.orig/monitor_wrap.h
-+++ openssh-8.4p1/monitor_wrap.h
++++ openssh-8.8p1/monitor_wrap.h
 @@ -58,7 +58,9 @@ int mm_user_key_allowed(struct ssh *, st
      struct sshauthopt **);
  int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *,
@@ -1673,10 +1663,10 @@ Index: openssh-8.4p1/monitor_wrap.h
  #endif
  
  struct Session;
-Index: openssh-8.4p1/packet.c
+Index: openssh-8.8p1/packet.c
 ===================================================================
---- openssh-8.4p1.orig/packet.c
+--- openssh-8.8p1.orig/packet.c
-+++ openssh-8.4p1/packet.c
++++ openssh-8.8p1/packet.c
 @@ -81,6 +81,7 @@
  #endif
  
@@ -1685,7 +1675,7 @@ Index: openssh-8.4p1/packet.c
  #include "compat.h"
  #include "ssh2.h"
  #include "cipher.h"
-@@ -518,6 +519,13 @@ ssh_packet_get_connection_out(struct ssh
+@@ -506,6 +507,13 @@ ssh_packet_get_connection_out(struct ssh
  	return ssh->state->connection_out;
  }
  
@@ -1699,7 +1689,7 @@ Index: openssh-8.4p1/packet.c
  /*
   * Returns the IP-address of the remote host as a string.  The returned
   * string must not be freed.
-@@ -595,22 +603,19 @@ ssh_packet_close_internal(struct ssh *ss
+@@ -583,22 +591,19 @@ ssh_packet_close_internal(struct ssh *ss
  {
  	struct session_state *state = ssh->state;
  	u_int mode;
@@ -1727,7 +1717,7 @@ Index: openssh-8.4p1/packet.c
  	for (mode = 0; mode < MODE_MAX; mode++) {
  		kex_free_newkeys(state->newkeys[mode]);	/* current keys */
  		state->newkeys[mode] = NULL;
-@@ -646,8 +651,18 @@ ssh_packet_close_internal(struct ssh *ss
+@@ -634,8 +639,18 @@ ssh_packet_close_internal(struct ssh *ss
  #endif	/* WITH_ZLIB */
  	cipher_free(state->send_context);
  	cipher_free(state->receive_context);
@@ -1746,15 +1736,15 @@ Index: openssh-8.4p1/packet.c
  		free(ssh->local_ipaddr);
  		ssh->local_ipaddr = NULL;
  		free(ssh->remote_ipaddr);
-@@ -904,6 +919,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
+@@ -892,6 +907,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
- 		   (unsigned long long)state->p_send.bytes,
+ 		    (unsigned long long)state->p_send.bytes,
- 		   (unsigned long long)state->p_send.blocks);
+ 		    (unsigned long long)state->p_send.blocks);
  		kex_free_newkeys(state->newkeys[mode]);
 +		audit_session_key_free(ssh, mode);
  		state->newkeys[mode] = NULL;
  	}
  	/* note that both bytes and the seqnr are not reset */
-@@ -2210,6 +2226,73 @@ ssh_packet_get_output(struct ssh *ssh)
+@@ -2178,6 +2194,73 @@ ssh_packet_get_output(struct ssh *ssh)
  	return (void *)ssh->state->output;
  }
  
@@ -1828,20 +1818,20 @@ Index: openssh-8.4p1/packet.c
  /* Reset after_authentication and reset compression in post-auth privsep */
  static int
  ssh_packet_set_postauth(struct ssh *ssh)
-Index: openssh-8.4p1/packet.h
+Index: openssh-8.8p1/packet.h
 ===================================================================
---- openssh-8.4p1.orig/packet.h
+--- openssh-8.8p1.orig/packet.h
-+++ openssh-8.4p1/packet.h
++++ openssh-8.8p1/packet.h
-@@ -218,4 +218,5 @@ const u_char	*sshpkt_ptr(struct ssh *, s
+@@ -219,4 +219,5 @@ const u_char	*sshpkt_ptr(struct ssh *, s
  # undef EC_POINT
  #endif
  
 +void	 packet_destroy_all(struct ssh *, int, int);
  #endif				/* PACKET_H */
-Index: openssh-8.4p1/session.c
+Index: openssh-8.8p1/session.c
 ===================================================================
---- openssh-8.4p1.orig/session.c
+--- openssh-8.8p1.orig/session.c
-+++ openssh-8.4p1/session.c
++++ openssh-8.8p1/session.c
 @@ -136,7 +136,7 @@ extern char *__progname;
  extern int debug_flag;
  extern u_int utmp_len;
@@ -1851,7 +1841,7 @@ Index: openssh-8.4p1/session.c
  extern struct sshbuf *loginmsg;
  extern struct sshauthopt *auth_opts;
  extern char *tun_fwd_ifnames; /* serverloop.c */
-@@ -647,6 +647,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
+@@ -643,6 +643,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
  	/* Parent.  Close the slave side of the pseudo tty. */
  	close(ttyfd);
  
@@ -1866,7 +1856,7 @@ Index: openssh-8.4p1/session.c
  	/* Enter interactive session. */
  	s->ptymaster = ptymaster;
  	ssh_packet_set_interactive(ssh, 1,
-@@ -711,15 +719,19 @@ do_exec(struct ssh *ssh, Session *s, con
+@@ -707,15 +715,19 @@ do_exec(struct ssh *ssh, Session *s, con
  	    s->self);
  
  #ifdef SSH_AUDIT_EVENTS
@@ -1888,7 +1878,7 @@ Index: openssh-8.4p1/session.c
  #endif
  	if (s->ttyfd != -1)
  		ret = do_exec_pty(ssh, s, command);
-@@ -1542,8 +1554,11 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1534,8 +1546,11 @@ do_child(struct ssh *ssh, Session *s, co
  	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
  
  	/* remove hostkey from the child's memory */
@@ -1901,7 +1891,7 @@ Index: openssh-8.4p1/session.c
  
  	/* Force a password change */
  	if (s->authctxt->force_pwchange) {
-@@ -1752,6 +1767,9 @@ session_unused(int id)
+@@ -1744,6 +1759,9 @@ session_unused(int id)
  	sessions[id].ttyfd = -1;
  	sessions[id].ptymaster = -1;
  	sessions[id].x11_chanids = NULL;
@@ -1911,7 +1901,7 @@ Index: openssh-8.4p1/session.c
  	sessions[id].next_unused = sessions_first_unused;
  	sessions_first_unused = id;
  }
-@@ -1834,6 +1852,19 @@ session_open(Authctxt *authctxt, int cha
+@@ -1823,6 +1841,19 @@ session_open(Authctxt *authctxt, int cha
  }
  
  Session *
@@ -1931,7 +1921,7 @@ Index: openssh-8.4p1/session.c
  session_by_tty(char *tty)
  {
  	int i;
-@@ -2444,6 +2475,32 @@ session_exit_message(struct ssh *ssh, Se
+@@ -2430,6 +2461,32 @@ session_exit_message(struct ssh *ssh, Se
  		chan_write_failed(ssh, c);
  }
  
@@ -1964,7 +1954,7 @@ Index: openssh-8.4p1/session.c
  void
  session_close(struct ssh *ssh, Session *s)
  {
-@@ -2485,6 +2542,10 @@ session_close(struct ssh *ssh, Session *
+@@ -2471,6 +2528,10 @@ session_close(struct ssh *ssh, Session *
  
  	if (s->ttyfd != -1)
  		session_pty_cleanup(s);
@@ -1975,7 +1965,7 @@ Index: openssh-8.4p1/session.c
  	free(s->term);
  	free(s->display);
  	free(s->x11_chanids);
-@@ -2560,14 +2621,14 @@ session_close_by_channel(struct ssh *ssh
+@@ -2545,14 +2606,14 @@ session_close_by_channel(struct ssh *ssh
  }
  
  void
@@ -1992,7 +1982,7 @@ Index: openssh-8.4p1/session.c
  			else
  				session_close(ssh, s);
  		}
-@@ -2693,6 +2754,15 @@ do_authenticated2(struct ssh *ssh, Authc
+@@ -2678,6 +2739,15 @@ do_authenticated2(struct ssh *ssh, Authc
  	server_loop2(ssh, authctxt);
  }
  
@@ -2008,7 +1998,7 @@ Index: openssh-8.4p1/session.c
  void
  do_cleanup(struct ssh *ssh, Authctxt *authctxt)
  {
-@@ -2756,7 +2826,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
+@@ -2741,7 +2811,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
  	 * or if running in monitor.
  	 */
  	if (!use_privsep || mm_is_monitor())
@@ -2017,10 +2007,10 @@ Index: openssh-8.4p1/session.c
  }
  
  /* Return a name for the remote host that fits inside utmp_size */
-Index: openssh-8.4p1/session.h
+Index: openssh-8.8p1/session.h
 ===================================================================
---- openssh-8.4p1.orig/session.h
+--- openssh-8.8p1.orig/session.h
-+++ openssh-8.4p1/session.h
++++ openssh-8.8p1/session.h
 @@ -61,6 +61,12 @@ struct Session {
  		char	*name;
  		char	*val;
@@ -2048,10 +2038,10 @@ Index: openssh-8.4p1/session.h
  Session	*session_by_tty(char *);
  void	 session_close(struct ssh *, Session *);
  void	 do_setusercontext(struct passwd *);
-Index: openssh-8.4p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
---- openssh-8.4p1.orig/sshd.c
+--- openssh-8.8p1.orig/sshd.c
-+++ openssh-8.4p1/sshd.c
++++ openssh-8.8p1/sshd.c
 @@ -122,6 +122,7 @@
  #include "ssh-gss.h"
  #endif
@@ -2060,7 +2050,7 @@ Index: openssh-8.4p1/sshd.c
  #include "ssh-sandbox.h"
  #include "auth-options.h"
  #include "version.h"
-@@ -267,8 +268,8 @@ struct sshbuf *loginmsg;
+@@ -262,8 +263,8 @@ struct sshbuf *loginmsg;
  struct passwd *privsep_pw = NULL;
  
  /* Prototypes for various functions defined later in this file. */
@@ -2071,7 +2061,7 @@ Index: openssh-8.4p1/sshd.c
  static void do_ssh2_kex(struct ssh *);
  
  static char *listener_proctitle;
-@@ -286,6 +287,15 @@ close_listen_socks(void)
+@@ -281,6 +282,15 @@ close_listen_socks(void)
  	num_listen_socks = -1;
  }
  
@@ -2087,8 +2077,8 @@ Index: openssh-8.4p1/sshd.c
  static void
  close_startup_pipes(void)
  {
-@@ -390,18 +400,45 @@ grace_alarm_handler(int sig)
+@@ -386,18 +396,45 @@ grace_alarm_handler(int sig)
- 	    ssh_remote_port(the_active_state));
+ 	}
  }
  
 -/* Destroy the host and server keys.  They will no longer be needed. */
@@ -2136,7 +2126,7 @@ Index: openssh-8.4p1/sshd.c
  			sshkey_free(sensitive_data.host_certificates[i]);
  			sensitive_data.host_certificates[i] = NULL;
  		}
-@@ -410,14 +447,26 @@ destroy_sensitive_data(void)
+@@ -406,20 +443,38 @@ destroy_sensitive_data(void)
  
  /* Demote private to public keys for network child */
  void
@@ -2163,9 +2153,8 @@ Index: openssh-8.4p1/sshd.c
 +				fp = NULL;
  			if ((r = sshkey_from_private(
  			    sensitive_data.host_keys[i], &tmp)) != 0)
- 				fatal("could not demote host %s key: %s",
+ 				fatal_r(r, "could not demote host %s key",
-@@ -425,6 +474,12 @@ demote_sensitive_data(void)
+ 				    sshkey_type(sensitive_data.host_keys[i]));
- 				    ssh_err(r));
  			sshkey_free(sensitive_data.host_keys[i]);
  			sensitive_data.host_keys[i] = tmp;
 +			if (fp != NULL) {
@@ -2177,7 +2166,7 @@ Index: openssh-8.4p1/sshd.c
  		}
  		/* Certs do not need demotion */
  	}
-@@ -452,7 +507,7 @@ reseed_prngs(void)
+@@ -447,7 +502,7 @@ reseed_prngs(void)
  }
  
  static void
@@ -2186,7 +2175,7 @@ Index: openssh-8.4p1/sshd.c
  {
  	gid_t gidset[1];
  
-@@ -467,7 +522,7 @@ privsep_preauth_child(void)
+@@ -462,7 +517,7 @@ privsep_preauth_child(void)
  	reseed_prngs();
  
  	/* Demote the private keys to public keys. */
@@ -2195,7 +2184,7 @@ Index: openssh-8.4p1/sshd.c
  
  	/* Demote the child */
  	if (privsep_chroot) {
-@@ -502,7 +557,7 @@ privsep_preauth(struct ssh *ssh)
+@@ -497,7 +552,7 @@ privsep_preauth(struct ssh *ssh)
  
  	if (use_privsep == PRIVSEP_ON)
  		box = ssh_sandbox_init(pmonitor);
@@ -2204,7 +2193,7 @@ Index: openssh-8.4p1/sshd.c
  	if (pid == -1) {
  		fatal("fork of unprivileged child failed");
  	} else if (pid != 0) {
-@@ -548,7 +603,7 @@ privsep_preauth(struct ssh *ssh)
+@@ -542,7 +597,7 @@ privsep_preauth(struct ssh *ssh)
  		/* Arrange for logging to be sent to the monitor */
  		set_log_handler(mm_log_handler, pmonitor);
  
@@ -2213,7 +2202,7 @@ Index: openssh-8.4p1/sshd.c
  		setproctitle("%s", "[net]");
  		if (box != NULL)
  			ssh_sandbox_child(box);
-@@ -592,7 +647,7 @@ privsep_postauth(struct ssh *ssh, Authct
+@@ -586,7 +641,7 @@ privsep_postauth(struct ssh *ssh, Authct
  	pmonitor->m_sendfd = -1;
  
  	/* Demote the private keys to public keys. */
@@ -2222,7 +2211,7 @@ Index: openssh-8.4p1/sshd.c
  
  	reseed_prngs();
  
-@@ -1159,7 +1214,7 @@ server_listen(void)
+@@ -1140,7 +1195,7 @@ server_listen(void)
   * from this function are in a forked subprocess.
   */
  static void
@@ -2231,7 +2220,7 @@ Index: openssh-8.4p1/sshd.c
  {
  	fd_set *fdset;
  	int i, j, ret, maxfd;
-@@ -1220,6 +1275,7 @@ server_accept_loop(int *sock_in, int *so
+@@ -1186,6 +1241,7 @@ server_accept_loop(int *sock_in, int *so
  		if (received_sigterm) {
  			logit("Received signal %d; terminating.",
  			    (int) received_sigterm);
@@ -2239,7 +2228,7 @@ Index: openssh-8.4p1/sshd.c
  			close_listen_socks();
  			if (options.pid_file != NULL)
  				unlink(options.pid_file);
-@@ -2089,7 +2145,7 @@ main(int ac, char **av)
+@@ -2091,7 +2147,7 @@ main(int ac, char **av)
  #endif
  
  		/* Accept a connection and return in a forked child */
@@ -2248,7 +2237,7 @@ Index: openssh-8.4p1/sshd.c
  		    &newsock, config_s);
  	}
  
-@@ -2325,6 +2381,9 @@ main(int ac, char **av)
+@@ -2321,6 +2377,9 @@ main(int ac, char **av)
  	do_authenticated(ssh, authctxt);
  
  	/* The connection has been terminated. */
@@ -2258,7 +2247,7 @@ Index: openssh-8.4p1/sshd.c
  	ssh_packet_get_bytes(ssh, &ibytes, &obytes);
  	verbose("Transferred: sent %llu, received %llu bytes",
  	    (unsigned long long)obytes, (unsigned long long)ibytes);
-@@ -2509,6 +2568,15 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -2501,6 +2560,15 @@ do_ssh2_kex(struct ssh *ssh)
  void
  cleanup_exit(int i)
  {
@@ -2274,8 +2263,8 @@ Index: openssh-8.4p1/sshd.c
  	if (the_active_state != NULL && the_authctxt != NULL) {
  		do_cleanup(the_active_state, the_authctxt);
  		if (use_privsep && privsep_is_preauth &&
-@@ -2520,9 +2588,16 @@ cleanup_exit(int i)
+@@ -2513,9 +2581,16 @@ cleanup_exit(int i)
- 				    pmonitor->m_pid, strerror(errno));
+ 			}
  		}
  	}
 +	is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0;
@@ -2292,10 +2281,10 @@ Index: openssh-8.4p1/sshd.c
  		audit_event(the_active_state, SSH_CONNECTION_ABANDON);
  #endif
  	_exit(i);
-Index: openssh-8.4p1/sshkey.c
+Index: openssh-8.8p1/sshkey.c
 ===================================================================
---- openssh-8.4p1.orig/sshkey.c
+--- openssh-8.8p1.orig/sshkey.c
-+++ openssh-8.4p1/sshkey.c
++++ openssh-8.8p1/sshkey.c
 @@ -371,6 +371,38 @@ sshkey_type_is_valid_ca(int type)
  }
  
@@ -2335,11 +2324,11 @@ Index: openssh-8.4p1/sshkey.c
  sshkey_is_cert(const struct sshkey *k)
  {
  	if (k == NULL)
-Index: openssh-8.4p1/sshkey.h
+Index: openssh-8.8p1/sshkey.h
 ===================================================================
---- openssh-8.4p1.orig/sshkey.h
+--- openssh-8.8p1.orig/sshkey.h
-+++ openssh-8.4p1/sshkey.h
++++ openssh-8.8p1/sshkey.h
-@@ -187,6 +187,7 @@ int		 sshkey_shield_private(struct sshke
+@@ -189,6 +189,7 @@ int		 sshkey_shield_private(struct sshke
  int		 sshkey_unshield_private(struct sshkey *);
  
  int	 sshkey_type_from_name(const char *);

openssh-8.1p1-seccomp-clock_gettime64.patch

@@ -9,11 +9,11 @@ upcoming glibc ( 2.31 )
  sandbox-seccomp-filter.c | 3 +++
  1 file changed, 3 insertions(+)
 
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
-index 3ef30c9d5..999c46c9f 100644
+===================================================================
---- a/sandbox-seccomp-filter.c
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
++++ openssh-8.8p1/sandbox-seccomp-filter.c
-@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = {
+@@ -279,6 +279,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_clock_nanosleep_time64
  	SC_ALLOW(__NR_clock_nanosleep_time64),
  #endif

openssh-8.1p1-seccomp-clock_nanosleep.patch

@@ -1,8 +1,8 @@
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
-index c1e689e..74f69bc 100644
+===================================================================
---- a/sandbox-seccomp-filter.c
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
++++ openssh-8.8p1/sandbox-seccomp-filter.c
-@@ -264,6 +264,9 @@ static const struct sock_filter preauth_insns[] = {
+@@ -273,6 +273,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_clock_gettime64
  	SC_ALLOW(__NR_clock_gettime64),
  #endif

openssh-8.1p1-seccomp-clock_nanosleep_time64.patch

@@ -8,11 +8,11 @@ Needed on Linux ARM.  bz#3100, patch from jjelen@redhat.com.
  sandbox-seccomp-filter.c | 3 +++
  1 file changed, 3 insertions(+)
 
-Index: openssh-8.1p1/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
 ===================================================================
---- openssh-8.1p1.orig/sandbox-seccomp-filter.c
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
-+++ openssh-8.1p1/sandbox-seccomp-filter.c
++++ openssh-8.8p1/sandbox-seccomp-filter.c
-@@ -251,6 +251,9 @@ static const struct sock_filter preauth_
+@@ -276,6 +276,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_clock_nanosleep
      SC_ALLOW(__NR_clock_nanosleep),
  #endif

openssh-8.1p1-use-openssl-kdf.patch

@@ -1,8 +1,8 @@
-diff --git a/kex.c b/kex.c
+Index: openssh-8.8p1/kex.c
-index 96e44a5..7cd37d6 100644
+===================================================================
---- a/kex.c
+--- openssh-8.8p1.orig/kex.c
-+++ b/kex.c
++++ openssh-8.8p1/kex.c
-@@ -38,6 +38,7 @@
+@@ -40,6 +40,7 @@
  #ifdef WITH_OPENSSL
  #include <openssl/crypto.h>
  #include <openssl/dh.h>
@@ -10,7 +10,7 @@ index 96e44a5..7cd37d6 100644
  #endif
  
  #include "ssh.h"
-@@ -1109,8 +1110,92 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1115,8 +1116,93 @@ kex_choose_conf(struct ssh *ssh)
  	return r;
  }
  
@@ -69,7 +69,8 @@ index 96e44a5..7cd37d6 100644
 +	    || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
 +			     hash, (size_t) hashlen) != 1
 +	    || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
-+			     kex->session_id, (size_t) kex->session_id_len) != 1)
++			     sshbuf_ptr(kex->session_id),
++			     (size_t) sshbuf_len(kex->session_id)) != 1)
 +	    goto out;
 +
 +	digest = calloc (1, need);
@@ -104,7 +105,7 @@ index 96e44a5..7cd37d6 100644
      const struct sshbuf *shared_secret, u_char **keyp)
  {
  	struct kex *kex = ssh->kex;
-@@ -1174,6 +1259,50 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
+@@ -1179,6 +1265,50 @@ derive_key(struct ssh *ssh, int id, u_in
  	return r;
  }
  

openssh-8.4p1-vendordir.patch

@@ -1,52 +1,31 @@
 Gemeinsame Unterverzeichnisse: openssh-8.4p1/contrib und openssh-8.4p1-vendor/contrib.
-diff -u openssh-8.4p1/dh.c openssh-8.4p1-vendor/dh.c
+Index: openssh-8.8p1/dh.c
---- openssh-8.4p1/dh.c	2020-09-27 09:25:01.000000000 +0200
+===================================================================
-+++ openssh-8.4p1-vendor/dh.c	2021-01-29 11:49:40.968418136 +0100
+--- openssh-8.8p1.orig/dh.c
-@@ -151,10 +151,18 @@
++++ openssh-8.8p1/dh.c
- 	size_t linesize = 0;
+@@ -54,7 +54,17 @@ void dh_set_moduli_file(const char *file
- 	int best, bestcount, which, linenum;
- 	struct dhgroup dhg;
-+	char *dh_moduli_path;
-+	struct stat st;
  
--	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL) {
+ static const char * get_moduli_filename(void)
+ {
+-	return moduli_filename ? moduli_filename : _PATH_DH_MODULI;
++	struct stat st;
++
++	if (moduli_filename)
++		return moduli_filename;
++
 +	if (stat(_PATH_VENDOR_DH_MODULI, &st) == 0 &&
 +	    stat(_PATH_DH_MODULI, &st) == -1) {
-+	        dh_moduli_path = _PATH_VENDOR_DH_MODULI;
++	        return _PATH_VENDOR_DH_MODULI;
-+	} else {
-+	        dh_moduli_path = _PATH_DH_MODULI;
 +	}
-+	if ((f = fopen(dh_moduli_path, "r")) == NULL) {
++
- 		logit("WARNING: could not open %s (%s), using fixed modulus",
++	return _PATH_DH_MODULI;
--		    _PATH_DH_MODULI, strerror(errno));
+ }
-+		      dh_moduli_path, strerror(errno));
- 		return (dh_new_group_fallback(max));
- 	}
  
-@@ -185,7 +193,7 @@
+ static int
- 
+Index: openssh-8.8p1/pathnames.h
- 	if (bestcount == 0) {
+===================================================================
- 		fclose(f);
+--- openssh-8.8p1.orig/pathnames.h
--		logit("WARNING: no suitable primes in %s", _PATH_DH_MODULI);
++++ openssh-8.8p1/pathnames.h
-+		logit("WARNING: no suitable primes in %s", dh_moduli_path);
- 		return (dh_new_group_fallback(max));
- 	}
- 	which = arc4random_uniform(bestcount);
-@@ -210,7 +218,7 @@
- 	fclose(f);
- 	if (bestcount != which + 1) {
- 		logit("WARNING: selected prime disappeared in %s, giving up",
--		    _PATH_DH_MODULI);
-+		      dh_moduli_path);
- 		return (dh_new_group_fallback(max));
- 	}
- 
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/.github und openssh-8.4p1-vendor/.github.
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/m4 und openssh-8.4p1-vendor/m4.
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/openbsd-compat und openssh-8.4p1-vendor/openbsd-compat.
-diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
---- openssh-8.4p1/pathnames.h	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/pathnames.h	2021-01-29 11:35:41.655599046 +0100
 @@ -18,6 +18,8 @@
  #define SSHDIR				ETCDIR "/ssh"
  #endif
@@ -74,11 +53,11 @@ diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
  
  #ifndef _PATH_SSH_PROGRAM
  #define _PATH_SSH_PROGRAM		"/usr/bin/ssh"
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/regress und openssh-8.4p1-vendor/regress.
+Index: openssh-8.8p1/ssh.c
-diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
+===================================================================
---- openssh-8.4p1/ssh.c	2020-09-27 09:25:01.000000000 +0200
+--- openssh-8.8p1.orig/ssh.c
-+++ openssh-8.4p1-vendor/ssh.c	2021-01-27 18:22:52.322271681 +0100
++++ openssh-8.8p1/ssh.c
-@@ -593,6 +593,7 @@
+@@ -549,6 +549,7 @@ static void
  process_config_files(const char *host_name, struct passwd *pw, int final_pass,
      int *want_final_pass)
  {
@@ -86,7 +65,7 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
  	char buf[PATH_MAX];
  	int r;
  
-@@ -611,10 +612,23 @@
+@@ -567,10 +568,23 @@ process_config_files(const char *host_na
  			    &options, SSHCONF_CHECKPERM | SSHCONF_USERCONF |
  			    (final_pass ? SSHCONF_FINAL : 0), want_final_pass);
  
@@ -114,11 +93,11 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
  	}
  }
  
-Nur in openssh-8.4p1-vendor: #ssh_config.5#.
+Index: openssh-8.8p1/ssh_config.5
-diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
+===================================================================
---- openssh-8.4p1/ssh_config.5	2020-09-27 09:25:01.000000000 +0200
+--- openssh-8.8p1.orig/ssh_config.5
-+++ openssh-8.4p1-vendor/ssh_config.5	2021-02-24 12:02:53.935729753 +0100
++++ openssh-8.8p1/ssh_config.5
-@@ -54,6 +54,9 @@
+@@ -54,6 +54,9 @@ user's configuration file
  .It
  system-wide configuration file
  .Pq Pa /etc/ssh/ssh_config
@@ -128,7 +107,7 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
  .El
  .Pp
  For each parameter, the first obtained value
-@@ -1942,6 +1945,11 @@
+@@ -2212,6 +2215,11 @@ This file provides defaults for those
  values that are not specified in the user's configuration file, and
  for those users who do not have a configuration file.
  This file must be world-readable.
@@ -140,11 +119,11 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
  .El
  .Sh SEE ALSO
  .Xr ssh 1
-Nur in openssh-8.4p1-vendor: ssh_config.5~.
+Index: openssh-8.8p1/sshd.c
-diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
+===================================================================
---- openssh-8.4p1/sshd.c	2020-09-27 09:25:01.000000000 +0200
+--- openssh-8.8p1.orig/sshd.c
-+++ openssh-8.4p1-vendor/sshd.c	2021-01-27 18:25:38.370273280 +0100
++++ openssh-8.8p1/sshd.c
-@@ -136,7 +136,7 @@
+@@ -145,7 +145,7 @@ extern char *__progname;
  ServerOptions options;
  
  /* Name of the server configuration file. */
@@ -153,7 +132,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
  
  /*
   * Debug mode flag.  This can be set on the command line.  If debug
-@@ -1526,6 +1526,7 @@
+@@ -1594,6 +1594,7 @@ prepare_proctitle(int ac, char **av)
  int
  main(int ac, char **av)
  {
@@ -161,7 +140,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
  	struct ssh *ssh = NULL;
  	extern char *optarg;
  	extern int optind;
-@@ -1737,7 +1738,21 @@
+@@ -1809,7 +1810,21 @@ main(int ac, char **av)
  			 */
  			(void)atomicio(vwrite, startup_pipe, "\0", 1);
  		}
@@ -183,9 +162,10 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
  		load_server_config(config_file_name, cfg);
  
  	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
-diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
---- openssh-8.4p1/sshd_config.5	2020-09-27 09:25:01.000000000 +0200
+===================================================================
-+++ openssh-8.4p1-vendor/sshd_config.5	2021-02-24 14:14:27.912038335 +0100
+--- openssh-8.8p1.orig/sshd_config.5
++++ openssh-8.8p1/sshd_config.5
 @@ -44,7 +44,9 @@
  .Xr sshd 8
  reads configuration data from
@@ -197,11 +177,11 @@ diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
  .Fl f
  on the command line).
  The file contains keyword-argument pairs, one per line.
-Nur in openssh-8.4p1-vendor: sshd_config.5~.
+Index: openssh-8.8p1/ssh-keysign.c
-diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
+===================================================================
---- openssh-8.4p1/ssh-keysign.c	2020-09-27 09:25:01.000000000 +0200
+--- openssh-8.8p1.orig/ssh-keysign.c
-+++ openssh-8.4p1-vendor/ssh-keysign.c	2021-02-24 11:34:17.684570215 +0100
++++ openssh-8.8p1/ssh-keysign.c
-@@ -172,6 +172,7 @@
+@@ -172,6 +172,7 @@ main(int argc, char **argv)
  	u_char *signature, *data, rver;
  	char *host, *fp;
  	size_t slen, dlen;
@@ -209,19 +189,20 @@ diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
  
  	if (pledge("stdio rpath getpw dns id", NULL) != 0)
  		fatal("%s: pledge: %s", __progname, strerror(errno));
-@@ -205,8 +206,12 @@
+@@ -205,8 +206,14 @@ main(int argc, char **argv)
  
  	/* verify that ssh-keysign is enabled by the admin */
  	initialize_options(&options);
 -	(void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
 -	    &options, 0, NULL);
++
 +	if (stat(_PATH_HOST_CONFIG_FILE, &st) == 0)
 +	        (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
 +		    &options, 0, NULL);
 +	else
-+	        (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw,
++	        (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw, "", "",
-+		    "", "", &options, 0, NULL);
++		    &options, 0, NULL);
- 	fill_default_options(&options);
++
+ 	(void)fill_default_options(&options);
  	if (options.enable_ssh_keysign != 1)
  		fatal("ssh-keysign not enabled in %s",
-Nur in openssh-8.4p1-vendor: ssh-keysign.c~.

openssh-8.4p1.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24
-size 1742201

openssh-8.4p1.tar.gz.asc

@@ -1,14 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQHDBAABCgAdFiEEWcIRjtIG2SfmZ+vj0+X1a22SDTAFAl9wQnwACgkQ0+X1a22S
-DTAR6wyAjRcvW7Jg9v73AR7TUO4WAD085sYi4ZLsECMZqhVZUBVv0Ofmcz2ISg3I
-NU1nr9Kiqf1/i05OUIR64kJEd4wTSwv+4HhyP5MPJqyCkKcFJ9TyRy6pASZtyH6D
-hKezJ79iGUg1U46bI6yyxchcAKrz0if97fKd0/1h5yE7T5lcbo+zQPsAg9dDXHBJ
-nL5mpBQXU3xbU8bC+E+vZ7VAyxEm6kzuY7MRW2wOhpPQ5DJgEjAUjtvzvd9SJhKl
-u/hgKXqIJBQB1pHlAFI1knfTrGUGrzob8QphukrvmbMJC3dO/o3Dplvx6lZkes0c
-6hP66rhTRp5Tmw9ae3iUmoDf6SyStlo/4QomCuw0NxHrSOng16VjCR+NRWHvZbXC
-JckIqparyOJ2jtHz0+e52sRZCZKauFBDMZboNj7f+htwQRUFOVfeSecpJiYut4bM
-YALdayOQwL96J6aMdoMKfMGZUevCPN6OM96E6cMC1fmanBenZQ/vatmskIvvvO/P
-rwECYTpGVRezhAvXMEy9x+EVdV6ctA==
-=PW3D
------END PGP SIGNATURE-----

openssh-8.8p1.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
+size 1815060

openssh-8.8p1.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmFQfp8ACgkQKj9BTnNg
+YLq2SQ/8C3iOHTkyqX82FYt0SKkybebe9b2iBPr91HQOUmx+U3I+vgrSWArXabWJ
+uSu0b685RQKlcr7UjEtPk6g0cm45NoJFjju9ljvnOFfZw73V3a5qX15Lx4xRnkRx
+v1LJn6Yh12PKLWL4/A1qPQnfAObVwq/BF0BR01FfXLAOt5+lFwYvg79HpE+69b0r
+KtcIEpsyTEn2lSKSWD7q4lpe6Z/iR+XzBKfnB6JJXhKyHiDV63hlAJk9Pt3mIvS6
+tnE9/7GDawvi+Tsl018kw3wsf6aHVSQ+O+vzcDgfy0vDJVGjD6Ec9it9FvikXJh6
+3pSTBYuUJdt+CAQYvmEui73v4nrkfouHXsxqgzEDZaTwIZC4wPrvNYxUaIyirWlc
+l4/YSnxSxSiYbvPa5eYRBvXvoWbnQXjPOkuhjETxz/KTcHirQpWE9eldi0jHcKUa
+FVu9YqMPAjIUd1Jj4vC5bgH7v5cLeEMm/AetMvKsJs+rhY9NZaKpiqOqU2m6Geb+
+sQSXHNTeA8uOlrHim4SmYHtmfglVbH5lIroiUqtRzjbOhMhqUb+yN9+aAxe0bwmN
+VcFMSThlbmYokb9bkQryY2I/FfXb997vxgF6v15Z8d9e8HH2zc2Irj1HYXG4Bf3o
+WCiSvd8+Tr/FxS2Gn8qj/vgSPWXT0d0Hy4zHW9JeT/jn3RtIYhU=
+=EnoG
+-----END PGP SIGNATURE-----

openssh-askpass-gnome.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Tue Sep 28 19:05:15 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
+
+- Version upgrade to 8.8p1
+  * No changes for askpass, see main package changelog for
+    details
+
 -------------------------------------------------------------------
 Thu Sep 17 20:41:39 UTC 2020 - Jan Engelhardt <jengelh@inai.de>
 

openssh-askpass-gnome.spec

@@ -18,7 +18,7 @@
 
 %define _name openssh
 Name:           openssh-askpass-gnome
-Version:        8.4p1
+Version:        8.8p1
 Release:        0
 Summary:        A GNOME-Based Passphrase Dialog for OpenSSH
 License:        BSD-2-Clause

openssh-fips-ensure-approved-moduli.patch

@@ -4,11 +4,11 @@ Date:   Mon Oct 26 22:26:46 2020 +0100
 
     Ensure DHGs are approved in FIPS mode using OpenSSL's DH_check_params()
 
-diff --git a/dh.c b/dh.c
+Index: openssh-8.8p1/dh.c
-index 7cb135d..3fe7f75 100644
+===================================================================
---- a/dh.c
+--- openssh-8.8p1.orig/dh.c
-+++ b/dh.c
++++ openssh-8.8p1/dh.c
-@@ -143,6 +143,28 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
+@@ -155,6 +155,28 @@ parse_prime(int linenum, char *line, str
  	return 0;
  }
  
@@ -37,7 +37,7 @@ index 7cb135d..3fe7f75 100644
  DH *
  choose_dh(int min, int wantbits, int max)
  {
-@@ -161,12 +183,20 @@ choose_dh(int min, int wantbits, int max)
+@@ -173,12 +195,20 @@ choose_dh(int min, int wantbits, int max
  	linenum = 0;
  	best = bestcount = 0;
  	while (getline(&line, &linesize, f) != -1) {
@@ -58,7 +58,7 @@ index 7cb135d..3fe7f75 100644
  		if (dhg.size > max || dhg.size < min)
  			continue;
  
-@@ -193,10 +223,16 @@ choose_dh(int min, int wantbits, int max)
+@@ -206,10 +236,16 @@ choose_dh(int min, int wantbits, int max
  	linenum = 0;
  	bestcount = 0;
  	while (getline(&line, &linesize, f) != -1) {

openssh-fix-ssh-copy-id.patch

@@ -1,30 +0,0 @@
-From 66f16e5425eb881570e82bfef7baeac2e7accc0a Mon Sep 17 00:00:00 2001
-From: Oleg <Fallmay@users.noreply.github.com>
-Date: Thu, 1 Oct 2020 12:09:08 +0300
-Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
-
----
- contrib/ssh-copy-id | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
-index 392f64f94..a76907717 100644
---- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -247,7 +247,7 @@ installkeys_sh() {
-   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
-   #    the cat adds the keys we're getting via STDIN
-   #    and if available restorecon is used to restore the SELinux context
--  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
-+  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
- 	cd;
- 	umask 077;
- 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
-@@ -258,6 +258,7 @@ installkeys_sh() {
- 	  restorecon -F .ssh ${AUTH_KEY_FILE};
- 	fi
- EOF
-+  )
- 
-   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
-   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"

openssh-link-with-sk.patch

@@ -1,15 +1,15 @@
-diff --git a/Makefile.in b/Makefile.in
+Index: openssh-8.8p1/Makefile.in
-index 6dec09c..25e74ac 100644
+===================================================================
---- a/Makefile.in
+--- openssh-8.8p1.orig/Makefile.in
-+++ b/Makefile.in
++++ openssh-8.8p1/Makefile.in
-@@ -251,8 +251,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+@@ -252,8 +252,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libss
  ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
  	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
  
 -sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
--	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+-	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 +sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o $(SFTPSERVER_OBJS)
-+	$(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
++	$(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
  
  sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
  	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)

openssh-reenable-dh-group14-sha1-default.patch

@@ -1,7 +1,7 @@
-diff --git a/myproposal.h b/myproposal.h
+Index: openssh-8.8p1/myproposal.h
-index 5312e60..83fd62d 100644
+===================================================================
---- a/myproposal.h
+--- openssh-8.8p1.orig/myproposal.h
-+++ b/myproposal.h
++++ openssh-8.8p1/myproposal.h
 @@ -33,7 +33,8 @@
  	"diffie-hellman-group-exchange-sha256," \
  	"diffie-hellman-group16-sha512," \
@@ -12,11 +12,11 @@ index 5312e60..83fd62d 100644
  
  #define KEX_CLIENT_KEX KEX_SERVER_KEX
  
-diff --git a/ssh_config.5 b/ssh_config.5
+Index: openssh-8.8p1/ssh_config.5
-index d5888f2..100563e 100644
+===================================================================
---- a/ssh_config.5
+--- openssh-8.8p1.orig/ssh_config.5
-+++ b/ssh_config.5
++++ openssh-8.8p1/ssh_config.5
-@@ -1170,7 +1170,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
+@@ -1227,7 +1227,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
  diffie-hellman-group-exchange-sha256,
  diffie-hellman-group16-sha512,
  diffie-hellman-group18-sha512,
@@ -26,11 +26,11 @@ index d5888f2..100563e 100644
  .Ed
  .Pp
  The list of available key exchange algorithms may also be obtained using
-diff --git a/sshd_config.5 b/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
-index 0f5fe53..97364f5 100644
+===================================================================
---- a/sshd_config.5
+--- openssh-8.8p1.orig/sshd_config.5
-+++ b/sshd_config.5
++++ openssh-8.8p1/sshd_config.5
-@@ -986,7 +986,7 @@ curve25519-sha256,curve25519-sha256@libssh.org,
+@@ -997,7 +997,7 @@ curve25519-sha256,curve25519-sha256@libs
  ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
  diffie-hellman-group-exchange-sha256,
  diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,

openssh-whitelist-syscalls.patch

@@ -1,6 +1,8 @@
---- a/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
+===================================================================
-@@ -195,6 +195,9 @@
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
++++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -201,6 +201,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_close
  	SC_ALLOW(__NR_close),
  #endif
@@ -10,9 +12,9 @@
  #ifdef __NR_exit
  	SC_ALLOW(__NR_exit),
  #endif
-@@ -204,6 +207,9 @@
+@@ -213,6 +216,9 @@ static const struct sock_filter preauth_
- #ifdef __NR_futex
+ #ifdef __NR_futex_time64
- 	SC_ALLOW(__NR_futex),
+ 	SC_ALLOW(__NR_futex_time64),
  #endif
 +#ifdef __NR_futex_time64
 +	SC_ALLOW(__NR_futex_time64),
@@ -20,13 +22,13 @@
  #ifdef __NR_geteuid
  	SC_ALLOW(__NR_geteuid),
  #endif
-@@ -282,6 +288,9 @@
+@@ -293,6 +299,9 @@ static const struct sock_filter preauth_
- #ifdef __NR_pselect6
- 	SC_ALLOW(__NR_pselect6),
  #endif
+ #ifdef __NR_pselect6_time64
+ 	SC_ALLOW(__NR_pselect6_time64),
++#endif
 +#ifdef __NR_pselect6_time64
 +	SC_ALLOW(__NR_pselect6_time64),
-+#endif
+ #endif
  #ifdef __NR_read
  	SC_ALLOW(__NR_read),
- #endif

openssh.changes

@@ -1,3 +1,362 @@
+-------------------------------------------------------------------
+Tue Sep 28 17:50:57 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
+
+- Version update to 8.8p1:
+  = Security
+  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
+    supplemental groups when executing an AuthorizedKeysCommand or
+    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
+    AuthorizedPrincipalsCommandUser directive has been set to run the
+    command as a different user. Instead these commands would inherit
+    the groups that sshd(8) was started with.
+
+    Depending on system configuration, inherited groups may allow
+    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
+    gain unintended privilege.
+
+    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
+    enabled by default in sshd_config(5).
+
+  = Potentially-incompatible changes
+  * This release disables RSA signatures using the SHA-1 hash algorithm
+    by default. This change has been made as the SHA-1 hash algorithm is
+    cryptographically broken, and it is possible to create chosen-prefix
+    hash collisions for <USD$50K.
+
+    For most users, this change should be invisible and there is
+    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
+    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
+    will automatically use the stronger algorithm where possible.
+
+    Incompatibility is more likely when connecting to older SSH
+    implementations that have not been upgraded or have not closely tracked
+    improvements in the SSH protocol. For these cases, it may be necessary
+    to selectively re-enable RSA/SHA1 to allow connection and/or user
+    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
+    options.
+
+  = New features
+  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
+    directive to accept a "none" argument to specify the default
+    behaviour.
+
+  = Bugfixes
+  * scp(1): when using the SFTP protocol, continue transferring files
+    after a transfer error occurs, better matching original scp/rcp
+    behaviour.
+  * ssh(1): fixed a number of memory leaks in multiplexing,
+  * ssh-keygen(1): avoid crash when using the -Y find-principals
+    command.
+  * A number of documentation and manual improvements, including
+    bz#3340, PR139, PR215, PR241, PR257
+
+- Additional changes from 8.7p1 release:
+  = Potentially-incompatible changes
+  * scp(1): this release changes the behaviour of remote to remote
+    copies (e.g. "scp host-a:/path host-b:") to transfer through the
+    local host by default. This was previously available via the -3
+    flag. This mode avoids the need to expose credentials on the
+    origin hop, avoids triplicate interpretation of filenames by the
+    shell (by the local system, the copy origin and the destination)
+    and, in conjunction with the SFTP support for scp(1) mentioned
+    below, allows use of all authentication methods to the remote
+    hosts (previously, only non-interactive methods could be used).
+    A -R flag has been added to select the old behaviour.
+  * ssh(1)/sshd(8): both the client and server are now using a
+    stricter configuration file parser. The new parser uses more
+    shell-like rules for quotes, space and escape characters. It is
+    also more strict in rejecting configurations that include options
+    lacking arguments. Previously some options (e.g. DenyUsers) could
+    appear on a line with no subsequent arguments. This release will
+    reject such configurations. The new parser will also reject
+    configurations with unterminated quotes and multiple '='
+    characters after the option name.
+  * ssh(1): when using SSHFP DNS records for host key verification,
+    ssh(1) will verify all matching records instead of just those
+    with the specific signature type requested. This may cause host
+    key verification problems if stale SSHFP records of a different
+    or legacy signature type exist alongside other records for a
+    particular host. bz#3322
+  * ssh-keygen(1): when generating a FIDO key and specifying an
+    explicit attestation challenge (using -Ochallenge), the challenge
+    will now be hashed by the builtin security key middleware. This
+    removes the (undocumented) requirement that challenges be exactly
+    32 bytes in length and matches the expectations of libfido2.
+  * sshd(8): environment="..." directives in authorized_keys files are
+    now first-match-wins and limited to 1024 discrete environment
+    variable names.
+
+  = New features
+  * scp(1): experimental support for transfers using the SFTP protocol
+    as a replacement for the venerable SCP/RCP protocol that it has
+    traditionally used. SFTP offers more predictable filename handling
+    and does not require expansion of glob(3) patterns via the shell
+    on the remote side.
+  * sftp-server(8): add a protocol extension to support expansion of
+    ~/ and ~user/ prefixed paths. This was added to support these
+    paths when used by scp(1) while in SFTP mode.
+  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
+    the ssh(1) -f flag. GHPR231
+  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
+    config file to do the same thing as -n does on the ssh(1) command-
+    line. GHPR231
+  * ssh(1): add a SessionType directive to ssh_config, allowing the
+    configuration file to offer equivalent control to the -N (no
+    session) and -s (subsystem) command-line flags. GHPR231
+  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
+    signatures now support listing key validity intervals alongside
+    they key, and ssh-keygen(1) can optionally check during signature
+    verification whether a specified time falls inside this interval.
+    This feature is intended for use by git to support signing and
+    verifying objects using ssh keys.
+  * ssh-keygen(8): support printing of the full public key in a sshsig
+    signature via a -Oprint-pubkey flag.
+
+  = Bugfixes
+  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
+    the client and server mainloops. Previously the re-key timeout
+    could expire but re-keying would not start until a packet was sent
+    or received, causing a spin in select() if the connection was
+    quiescent.
+  * ssh-keygen(1): avoid Y2038 problem in printing certificate
+    validity lifetimes. Dates past 2^31-1 seconds since epoch were
+    displayed incorrectly on some platforms. bz#3329
+  * scp(1): allow spaces to appear in usernames for local to remote
+    and scp -3 remote to remote copies. bz#1164
+  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
+    in favour of KbdInteractiveAuthentication. The former is what was in
+    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
+    treated as somewhat but not entirely equivalent. We retain the old
+    name as a deprecated alias so configuration files continue to work
+    as well as a reference in the man page for people looking for it.
+    bz#3303
+  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
+    when extracting a key from a PKCS#11 certificate. bz#3327
+  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
+    needs file descriptors in non-blocking mode to operate but it was
+    not restoring the original state on exit. This could cause
+    problems with fds shared with other programs via the shell,
+    bz#3280 and GHPR246
+  * ssh(1)/sshd(8): switch both client and server mainloops from
+    select(3) to pselect(3). Avoids race conditions where a signal
+    may arrive immediately before select(3) and not be processed until
+    an event fires. bz#2158
+  * ssh(1): sessions started with ControlPersist were incorrectly
+    executing a shell when the -N (no shell) option was specified.
+    bz#3290
+  * ssh(1): check if IPQoS or TunnelDevice are already set before
+    overriding. Prevents values in config files from overriding values
+    supplied on the command line. bz#3319
+  * ssh(1): fix debug message when finding a private key to match a
+    certificate being attempted for user authentication. Previously it
+    would print the certificate's path, whereas it was supposed to be
+    showing the private key's path. GHPR247
+  * sshd(8): match host certificates against host public keys, not
+    private keys. Allows use of certificates with private keys held in
+    a ssh-agent.  bz#3524
+  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
+    allows RSA/SHA2 signatures for public key authentication but fails
+    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
+    clients of these server to incorrectly match
+    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
+    keys. bz#3213
+  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
+    limits@openssh.com extension but fails when the client tries to
+    invoke it. bz#3318
+  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
+    otherwise handled specially by the protocol. Useful in ~/.ssh/config
+    to set TERM to something generic (e.g. "xterm" instead of
+    "xterm-256color") for destinations that lack terminfo entries.
+  * sftp-server(8): the limits@openssh.com extension was incorrectly
+    marked as an operation that writes to the filesystem, which made it
+    unavailable in sftp-server read-only mode. bz#3318
+  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
+    the update removed more host keys than remain present.
+  * Many manual page fixes.
+
+- Additional changes from 8.6p1 release:
+  = Security
+  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
+    option was enabled with a set of patterns that activated logging
+    in code that runs in the low-privilege sandboxed sshd process, the
+    log messages were constructed in such a way that printf(3) format
+    strings could effectively be specified the low-privilege code.
+
+  = New features
+  * sftp-server(8): add a new limits@openssh.com protocol extension
+    that allows a client to discover various server limits, including
+    maximum packet size and maximum read/write length.
+  * sftp(1): use the new limits@openssh.com extension (when available)
+    to select better transfer lengths in the client.
+  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
+    location of the "moduli" file containing the groups for DH-GEX.
+  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
+    enable printing of the elapsed time in seconds of each test.
+
+  = Bugfixes
+  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
+    manual pages with the current default. GHPR174
+  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
+    GHPR234
+  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
+    backslashes were not being dequoted correctly and quoted space in
+    the middle of a string was being incorrectly split. GHPR223
+  * ssh(1): return non-zero exit status when killed by signal; bz#3281
+  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
+    packet size. Also handle zero-length reads that are not explicitly
+    banned by the spec.
+
+- Additional changes from 8.5p1 release:
+  = Security
+  * ssh-agent(1): fixed a double-free memory corruption that was
+    introduced in OpenSSH 8.2 . We treat all such memory faults as
+    potentially exploitable. This bug could be reached by an attacker
+    with access to the agent socket.
+
+  = Potentially-incompatible changes
+  * ssh(1), sshd(8): this release changes the first-preference signature
+    algorithm from ECDSA to ED25519.
+  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
+    for interactive use prior to TCP connect. The connection phase of
+    the SSH session is time-sensitive and often explicitly interactive.
+    The ultimate interactive/bulk TOS/DSCP will be set after
+    authentication completes.
+  * ssh(1), sshd(8): remove the pre-standardization cipher
+    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
+    it was standardized in RFC4253 (2006), has been deprecated and
+    disabled by default since OpenSSH 7.2 (2016) and was only briefly
+    documented in ssh.1 in 2001.
+  * ssh(1), sshd(8): update/replace the experimental post-quantum
+    hybrid key exchange method based on Streamlined NTRU Prime coupled
+    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
+    method is replaced with sntrup761x25519-sha512@openssh.com.
+  * ssh(1): disable CheckHostIP by default. It provides insignificant
+    benefits while making key rotation significantly more difficult,
+    especially for hosts behind IP-based load-balancers.
+
+  = New features
+  * ssh(1): this release enables UpdateHostkeys by default subject to
+    some conservative preconditions:
+    - The key was matched in the UserKnownHostsFile (and not in the
+      GlobalKnownHostsFile).
+    - The same key does not exist under another name.
+    - A certificate host key is not in use.
+    - known_hosts contains no matching wildcard hostname pattern.
+    - VerifyHostKeyDNS is not enabled.
+    - The default UserKnownHostsFile is in use.
+  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
+    that allows forcing maximum debug logging by file/function/line
+    pattern-lists.
+  * ssh(1): when prompting the user to accept a new hostkey, display
+    any other host names/addresses already associated with the key.
+  * ssh(1): allow UserKnownHostsFile=none to indicate that no
+    known_hosts file should be used to identify host keys.
+  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
+    client to obtain known_hosts data from a command in addition to
+    the usual files.
+  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
+    client to restrict the destination when RemoteForward is used
+    with SOCKS.
+  * ssh(1): for FIDO keys, if a signature operation fails with a
+    "incorrect PIN" reason and no PIN was initially requested from the
+    user, then request a PIN and retry the operation. This supports
+    some biometric devices that fall back to requiring PIN when reading
+    of the biometric failed, and devices that require PINs for all
+    hosted credentials.
+  * sshd(8): implement client address-based rate-limiting via new
+    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
+    directives that provide more fine-grained control on a per-origin
+    address basis than the global MaxStartups limit.
+
+  = Bugfixes
+   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
+   make it easier to determine which connection they are associated
+   with in cases like scp -3, ProxyJump, etc. bz#3224
+  * sshd(8): fix sshd_config SetEnv directives located inside Match
+    blocks. GHPR201
+  * ssh(1): when requesting a FIDO token touch on stderr, inform the
+    user once the touch has been recorded.
+  * ssh(1): prevent integer overflow when ridiculously large
+    ConnectTimeout values are specified, capping the effective value
+    (for most platforms) at 24 days. bz#3229
+  * ssh(1): consider the ECDSA key subtype when ordering host key
+    algorithms in the client.
+  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
+    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
+    that it control allowed key algorithms, when this option actually
+    specifies the signature algorithms that are accepted. The previous
+    name remains available as an alias. bz#3253
+  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
+    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
+  * sftp-server(8): add missing lsetstat@openssh.com documentation
+    and advertisement in the server's SSH2_FXP_VERSION hello packet.
+  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
+    banning packet types once they are received. Fixes memleak caused
+    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
+  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
+    platforms instead of being limited by LONG_MAX. bz#3206
+  * Minor man page fixes (capitalization, commas, etc.) bz#3223
+  * sftp(1): when doing an sftp recursive upload or download of a
+    read-only directory, ensure that the directory is created with
+    write and execute permissions in the interim so that the transfer
+    can actually complete, then set the directory permission as the
+    final step. bz#3222
+  * ssh-keygen(1): document the -Z, check the validity of its argument
+    earlier and provide a better error message if it's not correct.
+    bz#2879
+  * ssh(1): ignore comments at the end of config lines in ssh_config,
+    similar to what we already do for sshd_config. bz#2320
+  * sshd_config(5): mention that DisableForwarding is valid in a
+    sshd_config Match block. bz3239
+  * sftp(1): fix incorrect sorting of "ls -ltr" under some
+    circumstances. bz3248.
+  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
+    timeout values. bz#3250
+  * ssh(1): make hostbased authentication send the signature algorithm
+    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
+    This make HostbasedAcceptedAlgorithms do what it is supposed to -
+    filter on signature algorithm and not key type.
+
+- Rebased patches:
+  * openssh-7.7p1-IPv6_X_forwarding.patch
+  * openssh-7.7p1-X11_trusted_forwarding.patch
+  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
+  * openssh-7.7p1-cavstest-ctr.patch
+  * openssh-7.7p1-cavstest-kdf.patch
+  * openssh-7.7p1-disable_openssl_abi_check.patch
+  * openssh-7.7p1-eal3.patch
+  * openssh-7.7p1-enable_PAM_by_default.patch
+  * openssh-7.7p1-fips.patch
+  * openssh-7.7p1-fips_checks.patch
+  * openssh-7.7p1-host_ident.patch
+  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
+  * openssh-7.7p1-ldap.patch
+  * openssh-7.7p1-no_fork-no_pid_file.patch
+  * openssh-7.7p1-pam_check_locks.patch
+  * openssh-7.7p1-pts_names_formatting.patch
+  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
+  * openssh-7.7p1-seccomp_ipc_flock.patch
+  * openssh-7.7p1-seccomp_stat.patch
+  * openssh-7.7p1-send_locale.patch
+  * openssh-7.7p1-sftp_force_permissions.patch
+  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
+  * openssh-7.7p1-systemd-notify.patch
+  * openssh-7.9p1-keygen-preserve-perms.patch
+  * openssh-7.9p1-revert-new-qos-defaults.patch
+  * openssh-8.0p1-gssapi-keyex.patch
+  * openssh-8.1p1-audit.patch
+  * openssh-8.1p1-seccomp-clock_gettime64.patch
+  * openssh-8.1p1-seccomp-clock_nanosleep.patch
+  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
+  * openssh-8.1p1-use-openssl-kdf.patch
+  * openssh-8.4p1-vendordir.patch
+  * openssh-fips-ensure-approved-moduli.patch
+  * openssh-link-with-sk.patch
+  * openssh-reenable-dh-group14-sha1-default.patch
+  * openssh-whitelist-syscalls.patch
+
+- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).
+
 -------------------------------------------------------------------
 Thu Aug 19 10:07:10 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>
 

openssh.spec

@@ -35,7 +35,7 @@
   %define _fillupdir %{_localstatedir}/adm/fillup-templates
 %endif
 Name:           openssh
-Version:        8.4p1
+Version:        8.8p1
 Release:        0
 Summary:        Secure Shell Client and Server (Remote Login Program)
 License:        BSD-2-Clause AND MIT
@@ -105,7 +105,6 @@ Patch40:        openssh-8.1p1-ed25519-use-openssl-rng.patch
 Patch41:        openssh-fips-ensure-approved-moduli.patch
 Patch42:        openssh-link-with-sk.patch
 Patch43:        openssh-reenable-dh-group14-sha1-default.patch
-Patch44:        openssh-fix-ssh-copy-id.patch
 Patch45:        openssh-8.4p1-ssh_config_d.patch
 Patch46:        openssh-whitelist-syscalls.patch
 Patch47:        openssh-8.4p1-vendordir.patch