fix duplicate PAM msgs, missing loginmsg reset

without this change in mm_answer_pam_account all messages added in auth-pam.c sshpam_query(...) case PAM_SUCCESS end up sent here, then are still sitting in the loginmsg buffer and printed a second time in session.c do_login(...)
Pull fixed yaml from master.
2026-02-15 20:21:57 -05:00 · 2025-11-14 19:20:32 +11:00 · 2025-11-13 22:18:47 +11:00 · 2025-11-01 08:39:00 +11:00 · 2025-11-01 08:38:50 +11:00 · 2025-11-01 08:37:57 +11:00
23 changed files with 259 additions and 96 deletions
@@ -140,7 +140,7 @@ ssh-keyscan.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-c
 ssh-keysign.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h sshkey.h ssh.h ssh2.h misc.h sshbuf.h authfile.h msg.h canohost.h pathnames.h readconf.h uidswap.h
 ssh-pkcs11-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h pathnames.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h atomicio.h ssh-pkcs11.h
 ssh-pkcs11-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h ssh-pkcs11.h
-ssh-pkcs11.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshkey.h
+ssh-pkcs11.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshkey.h ssh-pkcs11.h
 ssh-rsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 ssh-sk-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshbuf.h sshkey.h msg.h digest.h pathnames.h ssh-sk.h misc.h
 ssh-sk-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h sshkey.h authfd.h misc.h sshbuf.h msg.h uidswap.h ssh-sk.h ssh-pkcs11.h
@@ -8,6 +8,11 @@ master :
 [![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
 <br>

+10.1 :
+[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_1)
+[![VM CI](../../../actions/workflows/vm.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/vm.yml?query=branch:V_10_1)
+[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_1)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_1)
+
 10.0 :
 [![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_0)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_0)
 [![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_0)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_0)
@@ -29,9 +29,9 @@ jobs:
          - ubuntu-latest
          - ubuntu-22.04-arm
          - ubuntu-24.04-arm
-          - macos-13
          - macos-14
          - macos-15
+          - macos-15-intel
          - windows-2022
          - windows-2025
        config: [default]
@@ -79,8 +79,9 @@ jobs:
          - { target: ubuntu-latest, config: libressl-3.7.3 }
          - { target: ubuntu-latest, config: libressl-3.8.4 }
          - { target: ubuntu-latest, config: libressl-3.9.2 }
-          - { target: ubuntu-latest, config: libressl-4.0.0 }
-          - { target: ubuntu-latest, config: libressl-4.1.0 }
+          - { target: ubuntu-latest, config: libressl-4.0.1 }
+          - { target: ubuntu-latest, config: libressl-4.1.1 }
+          - { target: ubuntu-latest, config: libressl-4.2.0 }
          - { target: ubuntu-latest, config: openssl-master }
          - { target: ubuntu-latest, config: openssl-noec }
          - { target: ubuntu-latest, config: openssl-1.1.1 }
@@ -111,7 +112,6 @@ jobs:
          - { target: ubuntu-latest, config: musl }
          - { target: ubuntu-22.04-arm, config: kitchensink }
          - { target: ubuntu-24.04-arm, config: kitchensink }
-          - { target: macos-13, config: pam }
          - { target: macos-14, config: pam }
          - { target: macos-15, config: pam }
    runs-on: ${{ matrix.target }}
@@ -51,6 +51,7 @@ jobs:
          - obsd74
          - obsd76
          - obsd77
+          - obsd78
          - obsdsnap
          - obsdsnap-i386
          - omnios
@@ -42,7 +42,7 @@ jobs:
      run: sshfs_mount
      working-directory: ${{ runner.temp }}
    - name: update source
-      run: vmrun "cd /usr/src && cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc"
+      run: vmrun "cd /usr/src && if [ -d .git ]; then git pull && git log -n1; else cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc; fi"
    - name: update netcat
      run: vmrun "cd /usr/src/usr.bin/nc && make clean all && sudo make install"
    - name: make clean
@@ -282,9 +282,12 @@ jobs:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
-          env PKG_PATH=https://ftp.openbsd.org/pub/OpenBSD/${{matrix.target}}/packages/amd64 pkg_add sudo--
          useradd -m builder
-          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers
+          echo "permit nopass keepenv root" >/etc/doas.conf
+          echo "permit nopass keepenv builder" >>/etc/doas.conf
+          ls -l /etc/doas.conf
+          chown root:wheel /etc/doas.conf
+          chmod 644 /etc/doas.conf
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

@@ -293,18 +296,18 @@ jobs:
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
+      run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
    - name: make clean
      shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
+      run: cd $GITHUB_WORKSPACE && doas -u builder make clean
    - name: make
      shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
+      run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
    - name: make tests
      shell: openbsd {0}
      run: |
        cd $GITHUB_WORKSPACE
-        sudo -u builder env SUDO=sudo make tests
+        doas -u builder env SUDO=doas make tests


  solaris:
@@ -1,3 +1,149 @@
+commit 2d8a388de215d9959d72bb11f03e07a6eb2e4614
+Author: Damien Miller <[email protected]>
+Date:   Fri Oct 10 13:37:07 2025 +1100
+
+    depend
+
+commit 1d2676f4ffae35e2db37a35c385efaf2932cd639
+Author: Damien Miller <[email protected]>
+Date:   Thu Oct 9 14:53:04 2025 +1100
+
+    update versions
+
+commit ecd65a492bd0ed3a44a1c07428107b2e148bfee4
+Author: [email protected] <[email protected]>
+Date:   Wed Oct 8 00:32:52 2025 +0000
+
+    upstream: openssh-10.2
+    
+    The only change since 10.1 is the channels.c fix
+    
+    OpenBSD-Commit-ID: 5eebeb0db14c694efd4ee96b5f16112e3e5d5ba9
+
+commit ea9af2921cb6af8e65341531db3a7351917f0a92
+Author: [email protected] <[email protected]>
+Date:   Wed Oct 8 21:02:16 2025 +0000
+
+    upstream: fix crash at exit (visible via ssh-keygen -D) when
+    
+    multiple keys loaded. ok markus deraadt dtucker
+    
+    OpenBSD-Commit-ID: baa9763ec69d162108dafd962792ec5610ff45c9
+
+commit e49013576074ccd2d7ae75fb824170c739ce97a1
+Author: Damien Miller <[email protected]>
+Date:   Thu Oct 9 10:07:40 2025 +1100
+
+    link ssh-keygen directly against ssh-pkcs11.c
+    
+    Matches what OpenBSD does and fixes ssh-keygen regression in
+    certifying keys using a CA key hosted via ssh-agent (bz3877)
+
+commit 684f2ceff8c0eeb775e8653cf32609f8fbfe07b1
+Author: Damien Miller <[email protected]>
+Date:   Thu Oct 9 13:10:27 2025 +1100
+
+    some fixes to p11_setup
+    
+    1. Use the ssh-keygen under test and not the one in $PATH
+    2. Include a test PKCS#11 operation to ensure that the P11 stack is
+       working correctly.
+    
+    Previously, it was possible for p11_setup to return success on
+    configurations with PKCS#11 support disabled.
+
+commit af17ae64a5cfee42334883d2802f40f779131740
+Author: Damien Miller <[email protected]>
+Date:   Thu Oct 9 13:12:15 2025 +1100
+
+    complete PKCS#11 stubs and move to ssh-pkcs11.c
+    
+    Should unbreak --disable-pkcs11 builds
+
+commit bcf7c05a473f92a35f4f3b561fd7a1e339e0a30f
+Author: Darren Tucker <[email protected]>
+Date:   Wed Oct 8 11:26:52 2025 +1100
+
+    Fix header name and move return outside of ifdef.
+    
+    Fixes from Mike Frysinger via Github PR#597.
+
+commit b937061fe4922caced7b91442b3233c0bd763492
+Author: Darren Tucker <[email protected]>
+Date:   Tue Oct 7 21:10:33 2025 +1100
+
+    Check HAVE_MMAP too now that configure sets it.
+
+commit 8d57083c062f03098c9f767ec8d6278dc549a2f6
+Author: Darren Tucker <[email protected]>
+Date:   Tue Oct 7 21:07:05 2025 +1100
+
+    Use calloc for sshkeys if mmap is not supported.
+    
+    Based on Github PR#597 from Mike Frysinger, any bugs added by me.
+
+commit c97b931bffa481c72ff4bfddd9d59a2110899289
+Author: Darren Tucker <[email protected]>
+Date:   Tue Oct 7 20:25:07 2025 +1100
+
+    Add fcntl.h to includes.
+    
+    From FreeBSD via bz#3874: "This was previously included due to nested
+    includes in Heimdal's headers.  Without this, the build fails with an
+    error due to redefining AT_FDCWD."
+
+commit 8aa13832315e52c4404c993a59c6139b44ac6114
+Author: Daan De Meyer <[email protected]>
+Date:   Mon Mar 20 20:22:14 2023 +0100
+
+    Only set PAM_RHOST if the remote host is not "UNKNOWN"
+    
+    When using sshd's -i option with stdio that is not a AF_INET/AF_INET6
+    socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then
+    set as the value of PAM_RHOST, causing pam to try to do a reverse DNS
+    query of "UNKNOWN", which times out multiple times, causing a
+    substantial slowdown when logging in.
+    
+    To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".
+
+commit 0bd6649ea80ead0cd6404dbc25b64937421b556e
+Author: Darren Tucker <[email protected]>
+Date:   Tue Oct 7 20:10:56 2025 +1100
+
+    Don't copy native host keys for hostbased test.
+    
+    Some github runners (notably macos-14) seem to have host keys where
+    public and private do not match, so generate our own keys for testing
+    purposes.
+
+commit 33b63718d40ccc555b8c7a24331a3790b2efc6c5
+Author: Darren Tucker <[email protected]>
+Date:   Tue Oct 7 20:10:07 2025 +1100
+
+    Add 10.1 branch to ci-status page.
+
+commit 52411f15353257e9ec883fc044b7a56b6fca242d
+Author: Darren Tucker <[email protected]>
+Date:   Tue Oct 7 20:04:40 2025 +1100
+
+    Add clock_gettime compat shim.
+    
+    This fixes the build on macOS prior to 10.12 Sierra, since it does not
+    have it.  Found and tested by Sevan Janiyan.
+
+commit beae06f56e0d0a66ca535896149d5fb0b2e8a1b4
+Author: [email protected] <[email protected]>
+Date:   Tue Oct 7 08:02:32 2025 +0000
+
+    upstream: don't reuse c->isatty for signalling that the remote channel
+    
+    has a tty attached as this causes side effects, e.g. in channel_handle_rfd().
+    bz3872
+    
+    ok markus@
+    
+    OpenBSD-Commit-ID: 4cd8a9f641498ca6089442e59bad0fd3dcbe85f8
+
 commit 476bab6259d5a6ea0402ec79bc47ed61e2c15e86
 Author: Damien Miller <[email protected]>
 Date:   Mon Oct 6 12:52:25 2025 +1100
@@ -9292,40 +9438,3 @@ Date:   Tue Oct 10 03:57:45 2023 +0000
    OpenSSH promises not to use (comment change only)
    
    OpenBSD-Commit-ID: e61795b453d4892d2c99ce1039112c4a00250e03
-
-commit 90b0d73d63a706e85f6431f05a62d2ce1b476472
-Author: [email protected] <[email protected]>
-Date:   Fri Oct 6 03:32:15 2023 +0000
-
-    upstream: typo in error message
-    
-    OpenBSD-Regress-ID: 6a8edf0dc39941298e3780b147b10c0a600b4fee
-
-commit e84517f51532ec913d8fb01a8aab7307134774bb
-Author: [email protected] <[email protected]>
-Date:   Fri Oct 6 03:25:14 2023 +0000
-
-    upstream: Perform the softhsm2 setup as discrete steps rather than
-    
-    as a long shell pipeline. Makes it easier to figure out what has happened
-    when it breaks.
-    
-    OpenBSD-Regress-ID: b3f1292115fed65765d0a95414df16e27772d81c
-
-commit cb54becff4d776238e0e9072943ba0872260535d
-Author: [email protected] <[email protected]>
-Date:   Sun Sep 24 08:14:13 2023 +0000
-
-    upstream: REGRESS_FAIL_EARLY defaults to yes now. So no need to
-    
-    overload the value here anymore. OK tb@ bluhm@
-    
-    OpenBSD-Regress-ID: f063330f1bebbcd373100afccebc91a965b14496
-
-commit f01f5137ceba65baf34ceac5a298c12ac01b1fef
-Author: [email protected] <[email protected]>
-Date:   Wed Oct 4 05:42:10 2023 +0000
-
-    upstream: spelling fix;
-    
-    OpenBSD-Commit-ID: 493f95121567e5ab0d9dd1150f873b5535ca0195
@@ -114,7 +114,7 @@ P11OBJS= ssh-pkcs11-client.o
 SKOBJS=	ssh-sk-client.o

 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-	sshconnect.o sshconnect2.o mux.o $(P11OBJS) $(SKOBJS)
+	sshconnect.o sshconnect2.o mux.o ssh-pkcs11.o $(SKOBJS)

 SSHDOBJS=sshd.o \
 	platform-listen.o \
@@ -158,7 +158,7 @@ SSHADD_OBJS=	ssh-add.o $(P11OBJS) $(SKOBJS)

 SSHAGENT_OBJS=	ssh-agent.o $(P11OBJS) $(SKOBJS)

-SSHKEYGEN_OBJS=	ssh-keygen.o sshsig.o $(P11OBJS) $(SKOBJS)
+SSHKEYGEN_OBJS=	ssh-keygen.o sshsig.o ssh-pkcs11.o $(SKOBJS)

 SSHKEYSIGN_OBJS=ssh-keysign.o readconf.o uidswap.o $(P11OBJS) $(SKOBJS)

@@ -1,4 +1,4 @@
-See https://www.openssh.com/releasenotes.html#10.1p1 for the release
+See https://www.openssh.com/releasenotes.html#10.2p1 for the release
 notes.

 Please read https://www.openssh.com/report.html for bug reporting
@@ -237,6 +237,7 @@ pthread_join(sp_pthread_t thread, void **value)


 static pam_handle_t *sshpam_handle = NULL;
+static char *sshpam_initial_user;
 static int sshpam_err = 0;
 static int sshpam_authenticated = 0;
 static int sshpam_session_open = 0;
@@ -485,10 +486,11 @@ check_pam_user(Authctxt *authctxt)
 		return PAM_USER_UNKNOWN;
 	}

-	if (strcmp(authctxt->pw->pw_name, pam_user) != 0) {
-		debug("PAM user \"%s\" does not match expected \"%s\"",
-		      pam_user, authctxt->pw->pw_name);
-		return PAM_USER_UNKNOWN;
+	if (sshpam_initial_user == NULL)
+		fatal_f("internal error: sshpam_initial_user NULL");
+	if (strcmp(sshpam_initial_user, pam_user) != 0) {
+		error_f("PAM user \"%s\" does not match previous \"%s\"",
+		      pam_user, sshpam_initial_user);
 	}
 	return PAM_SUCCESS;
 }
@@ -709,6 +711,8 @@ sshpam_cleanup(void)
 	sshpam_authenticated = 0;
 	pam_end(sshpam_handle, sshpam_err);
 	sshpam_handle = NULL;
+	free(sshpam_initial_user);
+	sshpam_initial_user = NULL;
 }

 static int
@@ -725,12 +729,8 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
 		fatal("Username too long from %s port %d",
 		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
 #endif
-	if (sshpam_handle == NULL) {
-		if (ssh == NULL) {
-			fatal("%s: called initially with no "
-			    "packet context", __func__);
-		}
-	}
+	if (sshpam_handle == NULL && ssh == NULL)
+		fatal("%s: called initially with no packet context", __func__);
 	if (sshpam_handle != NULL) {
 		/* We already have a PAM context; check if the user matches */
 		if ((sshpam_err = check_pam_user(authctxt)) != PAM_SUCCESS)
@@ -740,6 +740,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
 	    options.pam_service_name);
 	sshpam_err = pam_start(options.pam_service_name, user,
 	    &store_conv, &sshpam_handle);
+	sshpam_initial_user = xstrdup(user);
 	sshpam_authctxt = authctxt;

 	if (sshpam_err != PAM_SUCCESS) {
@@ -994,6 +994,9 @@
 /* Define to 1 if you have the `mkdtemp' function. */
 #undef HAVE_MKDTEMP

+/* Define to 1 if you have the `mmap' function. */
+#undef HAVE_MMAP
+
 /* define if you have mode_t data type */
 #undef HAVE_MODE_T

@@ -11442,7 +11442,7 @@ fi
 # the equivalent file.  This avoids having to wrap those includes in
 # '#ifdef HAVE_FOO_H'.  If we create any such headers, add the path to includes.
 COMPATINCLUDES=""
-       for ac_header in endian.h ifaddrs.h libgen.h paths.h netgroup.h nlist.h poll.h stdint.h sys/stat.h sys/time.h sys/un.h time.h util.h
+       for ac_header in endian.h ifaddrs.h libgen.h paths.h netgroup.h nlist.h poll.h stdint.h sys/mman.h sys/stat.h sys/time.h sys/un.h time.h util.h
 do :
  as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@@ -16792,6 +16792,12 @@ if test "x$ac_cv_func_mkdtemp" = xyes
 then :
  printf "%s\n" "#define HAVE_MKDTEMP 1" >>confdefs.h

+fi
+ac_fn_c_check_func "$LINENO" "mmap" "ac_cv_func_mmap"
+if test "x$ac_cv_func_mmap" = xyes
+then :
+  printf "%s\n" "#define HAVE_MMAP 1" >>confdefs.h
+
 fi
 ac_fn_c_check_func "$LINENO" "ngetaddrinfo" "ac_cv_func_ngetaddrinfo"
 if test "x$ac_cv_func_ngetaddrinfo" = xyes
@@ -3773,6 +3773,24 @@ AC_CHECK_TYPES([nfds_t], , , [
 #endif
 ])

+if test "x$ac_cv_type_nfds_t" != "xyes"; then
+	AC_MSG_CHECKING([if poll nfds_t is unsigned long])
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <sys/types.h>
+#ifdef HAVE_POLL_H
+#include <poll.h>
+#endif
+#ifdef HAVE_SYS_POLL_H
+#include <sys/poll.h>
+#endif
+	    int poll(struct pollfd *, unsigned long, int timeout);
+	    ]], [[return poll(0, 0, 0);]])],
+	    [AC_MSG_RESULT([yes])
+	     AC_DEFINE(POLL_NFDS_T_ULONG, 1, [Define if poll 2nd arg is ulong])],
+	    [AC_MSG_RESULT([no])]
+	)
+fi
+
 # Decide which sandbox style to use
 sandbox_arg=""
 AC_ARG_WITH([sandbox],
@@ -1,4 +1,4 @@
-%global ver 10.1p1
+%global ver 10.2p1
 %global rel 1%{?dist}

 # OpenSSH privilege separation requires a user & group ID
@@ -13,7 +13,7 @@

 Summary:	OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:		openssh
-Version:	10.1p1
+Version:	10.2p1
 URL:		https://www.openssh.com/
 Release:	1
 Source0:	openssh-%{version}.tar.gz
@@ -1129,6 +1129,7 @@ mm_answer_pam_account(struct ssh *ssh, int sock, struct sshbuf *m)
 	if ((r = sshbuf_put_u32(m, ret)) != 0 ||
 	    (r = sshbuf_put_stringb(m, loginmsg)) != 0)
 		fatal_fr(r, "buffer error");
+	sshbuf_reset(loginmsg);

 	mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);

@@ -65,7 +65,7 @@ _rs_forkdetect(void)
 static inline int
 _rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
 {
-#if defined(MAP_ANON) && defined(MAP_PRIVATE)
+#if defined(HAVE_MMAP) && defined(MAP_ANON) && defined(MAP_PRIVATE)
 	if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
 	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
 		return (-1);
@@ -84,7 +84,7 @@ _rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
 		*rsp = NULL;
 		return (-1);
 	}
-#endif
+#endif /* HAVE_MMAP et al */

 	_ARC4_ATFORK(_rs_forkhandler);
 	return (0);
@@ -72,7 +72,11 @@ typedef struct pollfd {
 #endif /* !HAVE_STRUCT_POLLFD_FD */

 #ifndef HAVE_NFDS_T
+# ifdef POLL_NFDS_T_ULONG
+typedef unsigned long	nfds_t;
+# else
 typedef unsigned int	nfds_t;
+# endif
 #endif

 #ifndef HAVE_POLL
@@ -964,7 +964,7 @@ EOF
 	softhsm2-util --slot "$slot" --label 01 --id 01 --pin "$TEST_SSH_PIN" \
 	    --import $RSAP8 >/dev/null || fatal "softhsm import RSA fail"
 	chmod 600 $RSA
-	ssh-keygen -y -f $RSA > ${RSA}.pub
+	${SSHKEYGEN} -y -f $RSA > ${RSA}.pub
 	# ECDSA key
 	ECPARAM=${SSH_SOFTHSM_DIR}/ECPARAM
 	EC=${SSH_SOFTHSM_DIR}/EC
@@ -978,7 +978,7 @@ EOF
 	softhsm2-util --slot "$slot" --label 02 --id 02 --pin "$TEST_SSH_PIN" \
 	    --import $ECP8 >/dev/null || fatal "softhsm import EC fail"
 	chmod 600 $EC
-	ssh-keygen -y -f $EC > ${EC}.pub
+	${SSHKEYGEN} -y -f $EC > ${EC}.pub
 	# Ed25519 key
 	ED25519=${SSH_SOFTHSM_DIR}/ED25519
 	ED25519P8=${SSH_SOFTHSM_DIR}/ED25519P8
@@ -990,7 +990,7 @@ EOF
 	    --import $ED25519P8 >/dev/null || \
 		fatal "softhsm import ed25519 fail"
 	chmod 600 $ED25519
-	ssh-keygen -y -f $ED25519 > ${ED25519}.pub
+	${SSHKEYGEN} -y -f $ED25519 > ${ED25519}.pub
 	# Prepare askpass script to load PIN.
 	PIN_SH=$SSH_SOFTHSM_DIR/pin.sh
 	cat > $PIN_SH << EOF
@@ -999,7 +999,11 @@ echo "${TEST_SSH_PIN}"
 EOF
 	chmod 0700 "$PIN_SH"
 	PKCS11_OK=yes
-	return 0
+	if env SSH_ASKPASS="$PIN_SH" SSH_ASKPASS_REQUIRE=force \
+	    ${SSHKEYGEN} -D ${TEST_SSH_PKCS11} >/dev/null 2>&1 ; then
+		return 0
+	fi
+	return 1
 }

 # Peforms ssh-add with the right token PIN.
@@ -435,6 +435,9 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_getpeername
 	SC_ALLOW(__NR_getpeername),
 #endif
+#ifdef __NR_uname
+	SC_ALLOW(__NR_uname),
+#endif
 #ifdef __NR_setsockopt
 	SC_ALLOW_SETSOCKOPT(IPPROTO_IPV6, IPV6_TCLASS),
 	SC_ALLOW_SETSOCKOPT(IPPROTO_IP, IP_TOS),
@@ -310,22 +310,6 @@ main(int argc, char **argv)
 	}
 }
 #else /* ENABLE_PKCS11 */
-/* stubs */
-int
-pkcs11_sign(struct sshkey *key,
-    u_char **sigp, size_t *lenp,
-    const u_char *data, size_t datalen,
-    const char *alg, const char *sk_provider,
-    const char *sk_pin, u_int compat)
-{
-	return SSH_ERR_INTERNAL_ERROR;
-}
-
-void
-pkcs11_key_free(struct sshkey *key)
-{
-}
-
 int
 main(int argc, char **argv)
 {
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.72 2025/10/03 00:08:02 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.74 2025/10/09 23:25:23 djm Exp $ */
 /*
 * Copyright (c) 2010 Markus Friedl.  All rights reserved.
 * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -1486,7 +1486,7 @@ pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
 		case CKC_X_509:
 			if (pkcs11_fetch_x509_pubkey(p, slotidx, &obj,
 			    &key, &label) != 0) {
-				error("failed to fetch key");
+				debug_f("failed to fetch key");
 				continue;
 			}
 			break;
@@ -1613,7 +1613,7 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
 		}

 		if (key == NULL) {
-			error("failed to fetch key");
+			debug_f("failed to fetch key");
 			continue;
 		}
 		note_key(p, slotidx, __func__, key);
@@ -2029,8 +2029,10 @@ pkcs11_terminate(void)

 	debug3_f("called");

-	while ((k11 = TAILQ_FIRST(&pkcs11_keys)) != NULL)
+	while ((k11 = TAILQ_FIRST(&pkcs11_keys)) != NULL) {
+		TAILQ_REMOVE(&pkcs11_keys, k11, next);
 		pkcs11_k11_free(k11);
+	}
 	while ((p = TAILQ_FIRST(&pkcs11_providers)) != NULL) {
 		TAILQ_REMOVE(&pkcs11_providers, p, next);
 		pkcs11_provider_finalize(p);
@@ -2287,11 +2289,13 @@ out:

 #include "log.h"
 #include "sshkey.h"
+#include "ssherr.h"
+#include "ssh-pkcs11.h"

 int
 pkcs11_init(int interactive)
 {
-	error_f("dlopen() not supported");
+	error_f("PKCS#11 not supported");
 	return (-1);
 }

@@ -2299,13 +2303,30 @@ int
 pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp,
    char ***labelsp)
 {
-	error_f("dlopen() not supported");
+	error_f("PKCS#11 not supported");
 	return (-1);
 }

+void
+pkcs11_key_free(struct sshkey *key)
+{
+	error_f("PKCS#11 not supported");
+}
+
+int
+pkcs11_sign(struct sshkey *key,
+    u_char **sigp, size_t *lenp,
+    const u_char *data, size_t datalen,
+    const char *alg, const char *sk_provider,
+    const char *sk_pin, u_int compat)
+{
+	error_f("PKCS#11 not supported");
+	return SSH_ERR_FEATURE_UNSUPPORTED;
+}
+
 void
 pkcs11_terminate(void)
 {
-	error_f("dlopen() not supported");
+	error_f("PKCS#11 not supported");
 }
 #endif /* ENABLE_PKCS11 */
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.106 2025/10/06 01:45:22 djm Exp $ */
+/* $OpenBSD: version.h,v 1.107 2025/10/08 00:32:52 djm Exp $ */

-#define SSH_VERSION	"OpenSSH_10.1"
+#define SSH_VERSION	"OpenSSH_10.2"

 #define SSH_PORTABLE	"p1"
 #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
Author	SHA1	Message	Date
Matthew Heller	3d3ee425b6	fix duplicate PAM msgs, missing loginmsg reset without this change in mm_answer_pam_account all messages added in auth-pam.c sshpam_query(...) case PAM_SUCCESS end up sent here, then are still sitting in the loginmsg buffer and printed a second time in session.c do_login(...)	2026-02-15 20:21:57 -05:00
Damien Miller	c8f6f3808a	Pull fixed yaml from master.	2025-11-14 19:20:32 +11:00
Icenowy Zheng	cb41e63c65	seccomp sandbox: allow uname(3) The uname(3) syscall is utilized by zlib-ng on RISC-V to decide whether the kernel handles VILL bit of V extension properly (by checking the kernel version against 6.5). Allow it in the seccomp sandbox. Signed-off-by: Icenowy Zheng <[email protected]>	2025-11-13 22:18:47 +11:00
Darren Tucker	01a5bfdd41	Support using git for OpenBSD src tree tests.	2025-11-01 08:39:00 +11:00
Darren Tucker	6ea3242de3	Add OpenBSD 7.8 test target.	2025-11-01 08:38:50 +11:00
Darren Tucker	af56d5cf96	Update LibreSSL versions and add 4.2.0.	2025-11-01 08:37:57 +11:00
Damien Miller	876a7d2a12	check PAM user against previous user, not pw_name Avoids early fatal() if the user doesn't exist. Reported by Viswesh Narayanan; ok dtucker@	2025-10-31 13:49:31 +11:00
Darren Tucker	f02b666a17	Retire macos-13 runners, add Intel-specific ones.	2025-10-17 16:38:58 +11:00
Darren Tucker	f4c6cb9433	If we have nfds_t, check if it's int or long. Should fix build on very old Mac OS X, eg 10.3. Spotted and patch tested by Sevan Janiyan.	2025-10-17 16:38:56 +11:00
Damien Miller	434ba76840	link ssh against ssh-pkcs11.o Should fix PIN entry for direct use of PKCS11Provider in ssh(1) bz3879	2025-10-17 09:14:40 +11:00
Darren Tucker	ecc795c135	Switch OpenBSD VMs to use doas instead of sudo. OpenBSD 7.3 packages have been removed from the mirrors so we can't install sudo for it any more, so switch to the native doas utility.	2025-10-13 21:01:19 +11:00
[email protected]	607f337637	upstream: downgrade a useless error() -> debug() OpenBSD-Commit-ID: 5b0c9bcddb324f8bed2c8e8ffe9c92d263adc2d9	2025-10-13 13:31:42 +11:00
Damien Miller	d01efaa1c9	autogenerated files for release	2025-10-10 13:38:31 +11:00
Damien Miller	2d8a388de2	depend	2025-10-10 13:37:07 +11:00
Damien Miller	1d2676f4ff	update versions	2025-10-09 14:53:04 +11:00
[email protected]	ecd65a492b	upstream: openssh-10.2 The only change since 10.1 is the channels.c fix OpenBSD-Commit-ID: 5eebeb0db14c694efd4ee96b5f16112e3e5d5ba9	2025-10-09 14:52:31 +11:00
[email protected]	ea9af2921c	upstream: fix crash at exit (visible via ssh-keygen -D) when multiple keys loaded. ok markus deraadt dtucker OpenBSD-Commit-ID: baa9763ec69d162108dafd962792ec5610ff45c9	2025-10-09 14:52:27 +11:00
Damien Miller	e490135760	link ssh-keygen directly against ssh-pkcs11.c Matches what OpenBSD does and fixes ssh-keygen regression in certifying keys using a CA key hosted via ssh-agent (bz3877)	2025-10-09 14:52:24 +11:00
Damien Miller	684f2ceff8	some fixes to p11_setup 1. Use the ssh-keygen under test and not the one in $PATH 2. Include a test PKCS#11 operation to ensure that the P11 stack is working correctly. Previously, it was possible for p11_setup to return success on configurations with PKCS#11 support disabled.	2025-10-09 14:52:20 +11:00
Damien Miller	af17ae64a5	complete PKCS#11 stubs and move to ssh-pkcs11.c Should unbreak --disable-pkcs11 builds	2025-10-09 14:52:16 +11:00
Darren Tucker	bcf7c05a47	Fix header name and move return outside of ifdef. Fixes from Mike Frysinger via Github PR#597.	2025-10-08 11:26:52 +11:00
Darren Tucker	b937061fe4	Check HAVE_MMAP too now that configure sets it.	2025-10-07 21:10:33 +11:00
Darren Tucker	8d57083c06	Use calloc for sshkeys if mmap is not supported. Based on Github PR#597 from Mike Frysinger, any bugs added by me.	2025-10-07 21:07:05 +11:00
Darren Tucker	c97b931bff	Add fcntl.h to includes. From FreeBSD via bz#3874: "This was previously included due to nested includes in Heimdal's headers. Without this, the build fails with an error due to redefining AT_FDCWD."	2025-10-07 20:25:07 +11:00
Daan De Meyer	8aa1383231	Only set PAM_RHOST if the remote host is not "UNKNOWN" When using sshd's -i option with stdio that is not a AF_INET/AF_INET6 socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then set as the value of PAM_RHOST, causing pam to try to do a reverse DNS query of "UNKNOWN", which times out multiple times, causing a substantial slowdown when logging in. To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".	2025-10-07 20:15:42 +11:00
Darren Tucker	0bd6649ea8	Don't copy native host keys for hostbased test. Some github runners (notably macos-14) seem to have host keys where public and private do not match, so generate our own keys for testing purposes.	2025-10-07 20:10:56 +11:00
Darren Tucker	33b63718d4	Add 10.1 branch to ci-status page.	2025-10-07 20:10:07 +11:00
Darren Tucker	52411f1535	Add clock_gettime compat shim. This fixes the build on macOS prior to 10.12 Sierra, since it does not have it. Found and tested by Sevan Janiyan.	2025-10-07 20:04:40 +11:00
[email protected]	beae06f56e	upstream: don't reuse c->isatty for signalling that the remote channel has a tty attached as this causes side effects, e.g. in channel_handle_rfd(). bz3872 ok markus@ OpenBSD-Commit-ID: 4cd8a9f641498ca6089442e59bad0fd3dcbe85f8	2025-10-07 19:20:20 +11:00