Merge branch 'upstream-8.3' into for-8.3/import_openssh-9.9p1-27.el10.alma.1.src.rpm

XCP-ng does not have the systemd-rpm-macros package, in order
to compensate for this lack, certain macros have been adapted.
XCP-ng does not need gtk3 because we disable gnome-askpass.
Due to the fact that our gcc is old, our compiler refuses the
parameters of a patch, patch 2000 was therefore added to ensure
that it works on our platform.

Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech>

Author: Lucas RAVAGNIER

SOURCES/gpgkey-736060BA.gpg

@@ -38,5 +38,5 @@ diff -up openssh/sshd.c.ip-opts openssh/sshd.c
 +			}
 +		} while (i < option_size);
  	}
- 	return;
  #endif /* IP_OPTIONS */
+ }

SOURCES/openssh-10.0-mlkem-nist-fips.patch

@@ -73,22 +73,6 @@ diff -up openssh-8.5p1/loginrec.c.coverity openssh-8.5p1/loginrec.c
  	strncpy(ut->ut_host, li->hostname,
  	    MIN_SIZEOF(ut->ut_host, li->hostname));
  # endif
-@@ -1690,6 +1692,7 @@ record_failed_login(struct ssh *ssh, con
- 
- 	memset(&ut, 0, sizeof(ut));
- 	/* strncpy because we don't necessarily want nul termination */
-+	/* coverity[buffer_size_warning : FALSE] */
- 	strncpy(ut.ut_user, username, sizeof(ut.ut_user));
- 	strlcpy(ut.ut_line, "ssh:notty", sizeof(ut.ut_line));
- 
-@@ -1699,6 +1702,7 @@ record_failed_login(struct ssh *ssh, con
- 	ut.ut_pid = getpid();
- 
- 	/* strncpy because we don't necessarily want nul termination */
-+	/* coverity[buffer_size_warning : FALSE] */
- 	strncpy(ut.ut_host, hostname, sizeof(ut.ut_host));
- 
- 	if (ssh_packet_connection_is_on_socket(ssh) &&
 diff -up openssh-8.5p1/misc.c.coverity openssh-8.5p1/misc.c
 --- openssh-8.5p1/misc.c.coverity	2021-03-24 12:03:33.745967902 +0100
 +++ openssh-8.5p1/misc.c	2021-03-24 13:31:47.037079617 +0100
@@ -175,6 +159,46 @@ diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openb
 diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
 --- openssh-8.5p1/readconf.c.coverity	2021-03-24 12:03:33.778968131 +0100
 +++ openssh-8.5p1/readconf.c	2021-03-24 12:03:33.785968180 +0100
+@@ -749,12 +749,12 @@ match_cfg_line(Options *options, const c
+ 	debug2("checking match for '%s' host %s originally %s",
+ 	    full_line, host, original_host);
+ 	while ((attrib = argv_next(acp, avp)) != NULL) {
+-		attrib = oattrib = xstrdup(attrib);
+ 		/* Terminate on comment */
+ 		if (*attrib == '#') {
+ 			argv_consume(acp);
+ 			break;
+ 		}
++		attrib = oattrib = xstrdup(attrib);
+ 		arg = criteria = NULL;
+ 		this_result = 1;
+ 		if ((negate = (attrib[0] == '!')))
+@@ -793,7 +793,7 @@ match_cfg_line(Options *options, const c
+ 			debug3("%.200s line %d: %smatched '%s'",
+ 			    filename, linenum,
+ 			    this_result ? "" : "not ", oattrib);
+-			continue;
++			goto next;
+ 		}
+ 
+ 		/* Keep this list in sync with below */
+@@ -863,7 +863,7 @@ match_cfg_line(Options *options, const c
+ 				debug3("%.200s line %d: skipped exec "
+ 				    "\"%.100s\"", filename, linenum, cmd);
+ 				free(cmd);
+-				continue;
++				goto next;
+ 			}
+ 			r = execute_in_shell(cmd);
+ 			if (r == -1) {
+@@ -887,6 +887,7 @@ match_cfg_line(Options *options, const c
+ 		    criteria == NULL ? "" : " \"",
+ 		    criteria == NULL ? "" : criteria,
+ 		    criteria == NULL ? "" : "\"");
++next:
+ 		free(criteria);
+ 		free(oattrib);
+ 		oattrib = attrib = NULL;
 @@ -1847,6 +1847,7 @@ parse_pubkey_algos:
  			} else if (r != 0) {
  				error("%.200s line %d: glob failed for %s.",
@@ -186,6 +210,108 @@ diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
 diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
 --- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
 +++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
+@@ -1120,12 +1120,12 @@ match_cfg_line(const char *full_line, in
+ 	}
+ 
+ 	while ((oattrib = argv_next(acp, avp)) != NULL) {
+-		attrib = xstrdup(oattrib);
+ 		/* Terminate on comment */
+-		if (*attrib == '#') {
++		if (*oattrib == '#') {
+ 			argv_consume(acp); /* mark all arguments consumed */
+ 			break;
+ 		}
++		attrib = xstrdup(oattrib);
+ 		arg = NULL;
+ 		attributes++;
+ 		/* Criterion "all" has no argument and must appear alone */
+@@ -1147,13 +1147,13 @@ match_cfg_line(const char *full_line, in
+ 		if (strcasecmp(attrib, "invalid-user") == 0) {
+ 			if (ci == NULL) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->user_invalid == 0)
+ 				result = 0;
+ 			else
+ 				debug("matched invalid-user at line %d", line);
+-			continue;
++			goto next;
+ 		}
+ 
+ 		/* Keep this list in sync with below */
+@@ -1179,7 +1179,7 @@ match_cfg_line(const char *full_line, in
+ 		if (strcasecmp(attrib, "user") == 0) {
+ 			if (ci == NULL || (ci->test && ci->user == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->user == NULL)
+ 				match_test_missing_fatal("User", "user");
+@@ -1191,7 +1191,7 @@ match_cfg_line(const char *full_line, in
+ 		} else if (strcasecmp(attrib, "group") == 0) {
+ 			if (ci == NULL || (ci->test && ci->user == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->user == NULL)
+ 				match_test_missing_fatal("Group", "user");
+@@ -1205,7 +1205,7 @@ match_cfg_line(const char *full_line, in
+ 		} else if (strcasecmp(attrib, "host") == 0) {
+ 			if (ci == NULL || (ci->test && ci->host == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->host == NULL)
+ 				match_test_missing_fatal("Host", "host");
+@@ -1220,7 +1220,7 @@ match_cfg_line(const char *full_line, in
+ 					fatal("Invalid Match address argument "
+ 					    "'%s' at line %d", arg, line);
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->address == NULL)
+ 				match_test_missing_fatal("Address", "addr");
+@@ -1244,7 +1244,7 @@ match_cfg_line(const char *full_line, in
+ 					    "argument '%s' at line %d", arg,
+ 					    line);
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->laddress == NULL)
+ 				match_test_missing_fatal("LocalAddress",
+@@ -1272,7 +1272,7 @@ match_cfg_line(const char *full_line, in
+ 			}
+ 			if (ci == NULL || (ci->test && ci->lport == -1)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->lport == 0)
+ 				match_test_missing_fatal("LocalPort", "lport");
+@@ -1286,7 +1286,7 @@ match_cfg_line(const char *full_line, in
+ 		} else if (strcasecmp(attrib, "rdomain") == 0) {
+ 			if (ci == NULL || (ci->test && ci->rdomain == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->rdomain == NULL)
+ 				match_test_missing_fatal("RDomain", "rdomain");
+@@ -1300,6 +1300,7 @@ match_cfg_line(const char *full_line, in
+ 			result = -1;
+ 			goto out;
+ 		}
++next:
+ 		free(attrib);
+ 		attrib = NULL;
+ 	}
 @@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
  		if (*activep && *charptr == NULL) {
  			*charptr = tilde_expand_filename(arg, getuid());
@@ -262,3 +388,22 @@ diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
  		} else {
  			if (strncasecmp(cp, "key:", 4) == 0) {
  				cp += 4;
+diff --color -ruNp a/sshd.c b/sshd.c
+--- a/sshd.c	2026-04-01 14:29:14.186736233 +0200
++++ b/sshd.c	2026-04-01 14:36:59.136881819 +0200
+@@ -1079,6 +1079,7 @@ server_accept_loop(int *sock_in, int *so
+ 				send_rexec_state(config_s[0], cfg);
+ 				close(config_s[0]);
+ 				free(pfd);
++				free(startup_pollfd);
+ 				return;
+ 			}
+ 
+@@ -1111,6 +1112,7 @@ server_accept_loop(int *sock_in, int *so
+ 				    log_stderr);
+ 				close(config_s[0]);
+ 				free(pfd);
++				free(startup_pollfd);
+ 				return;
+ 			}
+ 

SOURCES/openssh-10.0-mlkem-nist.patch

@@ -32,7 +32,7 @@ diff --git a/channels.c b/channels.c
  	return -1;
  }
 
-@@ -5099,8 +5102,18 @@
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -41,10 +41,11 @@ diff --git a/channels.c b/channels.c
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;

SOURCES/openssh-6.6p1-allow-ip-opts.patch

@@ -1086,7 +1086,7 @@ diff -up openssh-8.6p1/Makefile.in.audit openssh-8.6p1/Makefile.in
 --- openssh-8.6p1/Makefile.in.audit	2021-04-19 16:47:35.731061937 +0200
 +++ openssh-8.6p1/Makefile.in	2021-04-19 16:47:35.756062129 +0200
 @@ -112,7 +112,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	kexsntrup761x25519.o sntrup761.o kexgen.o \
+ 	kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \
  	kexgssc.o \
  	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
 -	sshbuf-io.o
@@ -2056,14 +2056,50 @@ diff -up openssh-8.6p1/sshd-session.c.audit openssh-8.6p1/sshd-session.c
  #include "ssh-sandbox.h"
  #include "auth-options.h"
  #include "version.h"
-@@ -260,8 +261,8 @@ struct sshbuf *loginmsg;
+@@ -260,8 +261,44 @@ struct sshbuf *loginmsg;
  struct sshbuf *loginmsg;
 
  /* Prototypes for various functions defined later in this file. */
 -void destroy_sensitive_data(void);
 -void demote_sensitive_data(void);
 +void destroy_sensitive_data(struct ssh *);
 +void demote_sensitive_data(struct ssh *);
++
++static int
++sshkey_is_private(const struct sshkey *k)
++{
++      switch (k->type) {
++#ifdef WITH_OPENSSL
++      case KEY_RSA_CERT:
++      case KEY_RSA: {
++              const BIGNUM *d;
++              const RSA *rsa = EVP_PKEY_get0_RSA(k->pkey);
++              RSA_get0_key(rsa, NULL, NULL, &d);
++              return d != NULL;
++          }
++      case KEY_DSA_CERT:
++      case KEY_DSA: {
++              const BIGNUM *priv_key;
++              DSA_get0_key(k->dsa, NULL, &priv_key);
++              return priv_key != NULL;
++          }
++#ifdef OPENSSL_HAS_ECC
++      case KEY_ECDSA_CERT:
++      case KEY_ECDSA: {
++              const EC_KEY * ecdsa = EVP_PKEY_get0_EC_KEY(k->pkey);
++              return EC_KEY_get0_private_key(ecdsa) != NULL;
++              }
++#endif /* OPENSSL_HAS_ECC */
++#endif /* WITH_OPENSSL */
++      case KEY_ED25519_CERT:
++      case KEY_ED25519:
++              return (k->ed25519_sk != NULL);
++      default:
++              /* fatal("key_is_private: bad key type %d", k->type); */
++              return 0;
++      }
++}
++
  static void do_ssh2_kex(struct ssh *);
 
  /*
@@ -2222,7 +2258,7 @@ diff -up openssh-8.6p1/sshd-session.c.audit openssh-8.6p1/sshd-session.c
 
  	if (the_active_state != NULL && the_authctxt != NULL) {
 @@ -2525,7 +2593,9 @@ cleanup_exit(int i)
-		_exit(EXIT_AUTH_ATTEMPTED);
+ 	}
  #ifdef SSH_AUDIT_EVENTS
  	/* done after do_cleanup so it can cancel the PAM auth 'thread' */
 -	if (the_active_state != NULL && mm_is_monitor())
@@ -2231,57 +2267,4 @@ diff -up openssh-8.6p1/sshd-session.c.audit openssh-8.6p1/sshd-session.c
 +	    mm_is_monitor())
  		audit_event(the_active_state, SSH_CONNECTION_ABANDON);
  #endif
- 	_exit(i);
-diff -up openssh-8.6p1/sshkey.c.audit openssh-8.6p1/sshkey.c
---- openssh-8.6p1/sshkey.c.audit	2021-04-19 16:47:35.741062014 +0200
-+++ openssh-8.6p1/sshkey.c	2021-04-19 16:47:35.759062152 +0200
-@@ -371,6 +371,38 @@ sshkey_type_is_valid_ca(int type)
- }
- 
- int
-+sshkey_is_private(const struct sshkey *k)
-+{
-+      switch (k->type) {
-+#ifdef WITH_OPENSSL
-+      case KEY_RSA_CERT:
-+      case KEY_RSA: {
-+              const BIGNUM *d;
-+              RSA_get0_key(k->rsa, NULL, NULL, &d);
-+              return d != NULL;
-+          }
-+      case KEY_DSA_CERT:
-+      case KEY_DSA: {
-+              const BIGNUM *priv_key;
-+              DSA_get0_key(k->dsa, NULL, &priv_key);
-+              return priv_key != NULL;
-+          }
-+#ifdef OPENSSL_HAS_ECC
-+      case KEY_ECDSA_CERT:
-+      case KEY_ECDSA:
-+              return EC_KEY_get0_private_key(k->ecdsa) != NULL;
-+#endif /* OPENSSL_HAS_ECC */
-+#endif /* WITH_OPENSSL */
-+      case KEY_ED25519_CERT:
-+      case KEY_ED25519:
-+              return (k->ed25519_pk != NULL);
-+      default:
-+              /* fatal("key_is_private: bad key type %d", k->type); */
-+              return 0;
-+      }
-+}
-+
-+int
- sshkey_is_cert(const struct sshkey *k)
- {
- 	if (k == NULL)
-diff -up openssh-8.6p1/sshkey.h.audit openssh-8.6p1/sshkey.h
---- openssh-8.6p1/sshkey.h.audit	2021-04-19 16:47:35.741062014 +0200
-+++ openssh-8.6p1/sshkey.h	2021-04-19 16:47:35.759062152 +0200
-@@ -189,6 +189,7 @@ int		 sshkey_shield_private(struct sshke
- int		 sshkey_unshield_private(struct sshkey *);
- 
- int	 sshkey_type_from_name(const char *);
-+int	 sshkey_is_private(const struct sshkey *);
- int	 sshkey_is_cert(const struct sshkey *);
- int	 sshkey_is_sk(const struct sshkey *);
- int	 sshkey_type_is_cert(int);
+ 	/* Override default fatal exit value when auth was attempted */