Fix header name and move return outside of ifdef.

Fixes from Mike Frysinger via Github PR#597.
Use calloc for sshkeys if mmap is not supported.
2025-10-08 11:32:32 +11:00 · 2025-10-07 21:11:30 +11:00 · 2025-10-07 20:26:55 +11:00 · 2025-10-07 20:16:15 +11:00 · 2025-10-07 20:12:32 +11:00 · 2025-10-07 20:08:02 +11:00
23 changed files with 96 additions and 259 deletions
@@ -140,7 +140,7 @@ ssh-keyscan.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-c
 ssh-keysign.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h sshkey.h ssh.h ssh2.h misc.h sshbuf.h authfile.h msg.h canohost.h pathnames.h readconf.h uidswap.h
 ssh-pkcs11-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h pathnames.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h atomicio.h ssh-pkcs11.h
 ssh-pkcs11-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h ssh-pkcs11.h
-ssh-pkcs11.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshkey.h ssh-pkcs11.h
+ssh-pkcs11.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshkey.h
 ssh-rsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 ssh-sk-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshbuf.h sshkey.h msg.h digest.h pathnames.h ssh-sk.h misc.h
 ssh-sk-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h sshkey.h authfd.h misc.h sshbuf.h msg.h uidswap.h ssh-sk.h ssh-pkcs11.h
@@ -8,11 +8,6 @@ master :
 [![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
 <br>

-10.1 :
-[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_1)
-[![VM CI](../../../actions/workflows/vm.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/vm.yml?query=branch:V_10_1)
-[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_1)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_1)
-
 10.0 :
 [![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_0)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_0)
 [![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_0)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_0)
@@ -29,9 +29,9 @@ jobs:
          - ubuntu-latest
          - ubuntu-22.04-arm
          - ubuntu-24.04-arm
+          - macos-13
          - macos-14
          - macos-15
-          - macos-15-intel
          - windows-2022
          - windows-2025
        config: [default]
@@ -79,9 +79,8 @@ jobs:
          - { target: ubuntu-latest, config: libressl-3.7.3 }
          - { target: ubuntu-latest, config: libressl-3.8.4 }
          - { target: ubuntu-latest, config: libressl-3.9.2 }
-          - { target: ubuntu-latest, config: libressl-4.0.1 }
-          - { target: ubuntu-latest, config: libressl-4.1.1 }
-          - { target: ubuntu-latest, config: libressl-4.2.0 }
+          - { target: ubuntu-latest, config: libressl-4.0.0 }
+          - { target: ubuntu-latest, config: libressl-4.1.0 }
          - { target: ubuntu-latest, config: openssl-master }
          - { target: ubuntu-latest, config: openssl-noec }
          - { target: ubuntu-latest, config: openssl-1.1.1 }
@@ -112,6 +111,7 @@ jobs:
          - { target: ubuntu-latest, config: musl }
          - { target: ubuntu-22.04-arm, config: kitchensink }
          - { target: ubuntu-24.04-arm, config: kitchensink }
+          - { target: macos-13, config: pam }
          - { target: macos-14, config: pam }
          - { target: macos-15, config: pam }
    runs-on: ${{ matrix.target }}
@@ -51,7 +51,6 @@ jobs:
          - obsd74
          - obsd76
          - obsd77
-          - obsd78
          - obsdsnap
          - obsdsnap-i386
          - omnios
@@ -42,7 +42,7 @@ jobs:
      run: sshfs_mount
      working-directory: ${{ runner.temp }}
    - name: update source
-      run: vmrun "cd /usr/src && if [ -d .git ]; then git pull && git log -n1; else cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc; fi"
+      run: vmrun "cd /usr/src && cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc"
    - name: update netcat
      run: vmrun "cd /usr/src/usr.bin/nc && make clean all && sudo make install"
    - name: make clean
@@ -282,12 +282,9 @@ jobs:
        release: ${{ matrix.target }}
        usesh: true
        prepare: |
+          env PKG_PATH=https://ftp.openbsd.org/pub/OpenBSD/${{matrix.target}}/packages/amd64 pkg_add sudo--
          useradd -m builder
-          echo "permit nopass keepenv root" >/etc/doas.conf
-          echo "permit nopass keepenv builder" >>/etc/doas.conf
-          ls -l /etc/doas.conf
-          chown root:wheel /etc/doas.conf
-          chmod 644 /etc/doas.conf
+          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers
          mkdir -p /var/empty /usr/local/etc
          cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli

@@ -296,18 +293,18 @@ jobs:
      run: cd $GITHUB_WORKSPACE && chown -R builder .
    - name: configure
      shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
+      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
    - name: make clean
      shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && doas -u builder make clean
+      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
    - name: make
      shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
+      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
    - name: make tests
      shell: openbsd {0}
      run: |
        cd $GITHUB_WORKSPACE
-        doas -u builder env SUDO=doas make tests
+        sudo -u builder env SUDO=sudo make tests


  solaris:
@@ -1,149 +1,3 @@
-commit 2d8a388de215d9959d72bb11f03e07a6eb2e4614
-Author: Damien Miller <[email protected]>
-Date:   Fri Oct 10 13:37:07 2025 +1100
-
-    depend
-
-commit 1d2676f4ffae35e2db37a35c385efaf2932cd639
-Author: Damien Miller <[email protected]>
-Date:   Thu Oct 9 14:53:04 2025 +1100
-
-    update versions
-
-commit ecd65a492bd0ed3a44a1c07428107b2e148bfee4
-Author: [email protected] <[email protected]>
-Date:   Wed Oct 8 00:32:52 2025 +0000
-
-    upstream: openssh-10.2
-    
-    The only change since 10.1 is the channels.c fix
-    
-    OpenBSD-Commit-ID: 5eebeb0db14c694efd4ee96b5f16112e3e5d5ba9
-
-commit ea9af2921cb6af8e65341531db3a7351917f0a92
-Author: [email protected] <[email protected]>
-Date:   Wed Oct 8 21:02:16 2025 +0000
-
-    upstream: fix crash at exit (visible via ssh-keygen -D) when
-    
-    multiple keys loaded. ok markus deraadt dtucker
-    
-    OpenBSD-Commit-ID: baa9763ec69d162108dafd962792ec5610ff45c9
-
-commit e49013576074ccd2d7ae75fb824170c739ce97a1
-Author: Damien Miller <[email protected]>
-Date:   Thu Oct 9 10:07:40 2025 +1100
-
-    link ssh-keygen directly against ssh-pkcs11.c
-    
-    Matches what OpenBSD does and fixes ssh-keygen regression in
-    certifying keys using a CA key hosted via ssh-agent (bz3877)
-
-commit 684f2ceff8c0eeb775e8653cf32609f8fbfe07b1
-Author: Damien Miller <[email protected]>
-Date:   Thu Oct 9 13:10:27 2025 +1100
-
-    some fixes to p11_setup
-    
-    1. Use the ssh-keygen under test and not the one in $PATH
-    2. Include a test PKCS#11 operation to ensure that the P11 stack is
-       working correctly.
-    
-    Previously, it was possible for p11_setup to return success on
-    configurations with PKCS#11 support disabled.
-
-commit af17ae64a5cfee42334883d2802f40f779131740
-Author: Damien Miller <[email protected]>
-Date:   Thu Oct 9 13:12:15 2025 +1100
-
-    complete PKCS#11 stubs and move to ssh-pkcs11.c
-    
-    Should unbreak --disable-pkcs11 builds
-
-commit bcf7c05a473f92a35f4f3b561fd7a1e339e0a30f
-Author: Darren Tucker <[email protected]>
-Date:   Wed Oct 8 11:26:52 2025 +1100
-
-    Fix header name and move return outside of ifdef.
-    
-    Fixes from Mike Frysinger via Github PR#597.
-
-commit b937061fe4922caced7b91442b3233c0bd763492
-Author: Darren Tucker <[email protected]>
-Date:   Tue Oct 7 21:10:33 2025 +1100
-
-    Check HAVE_MMAP too now that configure sets it.
-
-commit 8d57083c062f03098c9f767ec8d6278dc549a2f6
-Author: Darren Tucker <[email protected]>
-Date:   Tue Oct 7 21:07:05 2025 +1100
-
-    Use calloc for sshkeys if mmap is not supported.
-    
-    Based on Github PR#597 from Mike Frysinger, any bugs added by me.
-
-commit c97b931bffa481c72ff4bfddd9d59a2110899289
-Author: Darren Tucker <[email protected]>
-Date:   Tue Oct 7 20:25:07 2025 +1100
-
-    Add fcntl.h to includes.
-    
-    From FreeBSD via bz#3874: "This was previously included due to nested
-    includes in Heimdal's headers.  Without this, the build fails with an
-    error due to redefining AT_FDCWD."
-
-commit 8aa13832315e52c4404c993a59c6139b44ac6114
-Author: Daan De Meyer <[email protected]>
-Date:   Mon Mar 20 20:22:14 2023 +0100
-
-    Only set PAM_RHOST if the remote host is not "UNKNOWN"
-    
-    When using sshd's -i option with stdio that is not a AF_INET/AF_INET6
-    socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then
-    set as the value of PAM_RHOST, causing pam to try to do a reverse DNS
-    query of "UNKNOWN", which times out multiple times, causing a
-    substantial slowdown when logging in.
-    
-    To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".
-
-commit 0bd6649ea80ead0cd6404dbc25b64937421b556e
-Author: Darren Tucker <[email protected]>
-Date:   Tue Oct 7 20:10:56 2025 +1100
-
-    Don't copy native host keys for hostbased test.
-    
-    Some github runners (notably macos-14) seem to have host keys where
-    public and private do not match, so generate our own keys for testing
-    purposes.
-
-commit 33b63718d40ccc555b8c7a24331a3790b2efc6c5
-Author: Darren Tucker <[email protected]>
-Date:   Tue Oct 7 20:10:07 2025 +1100
-
-    Add 10.1 branch to ci-status page.
-
-commit 52411f15353257e9ec883fc044b7a56b6fca242d
-Author: Darren Tucker <[email protected]>
-Date:   Tue Oct 7 20:04:40 2025 +1100
-
-    Add clock_gettime compat shim.
-    
-    This fixes the build on macOS prior to 10.12 Sierra, since it does not
-    have it.  Found and tested by Sevan Janiyan.
-
-commit beae06f56e0d0a66ca535896149d5fb0b2e8a1b4
-Author: [email protected] <[email protected]>
-Date:   Tue Oct 7 08:02:32 2025 +0000
-
-    upstream: don't reuse c->isatty for signalling that the remote channel
-    
-    has a tty attached as this causes side effects, e.g. in channel_handle_rfd().
-    bz3872
-    
-    ok markus@
-    
-    OpenBSD-Commit-ID: 4cd8a9f641498ca6089442e59bad0fd3dcbe85f8
-
 commit 476bab6259d5a6ea0402ec79bc47ed61e2c15e86
 Author: Damien Miller <[email protected]>
 Date:   Mon Oct 6 12:52:25 2025 +1100
@@ -9438,3 +9292,40 @@ Date:   Tue Oct 10 03:57:45 2023 +0000
    OpenSSH promises not to use (comment change only)
    
    OpenBSD-Commit-ID: e61795b453d4892d2c99ce1039112c4a00250e03
+
+commit 90b0d73d63a706e85f6431f05a62d2ce1b476472
+Author: [email protected] <[email protected]>
+Date:   Fri Oct 6 03:32:15 2023 +0000
+
+    upstream: typo in error message
+    
+    OpenBSD-Regress-ID: 6a8edf0dc39941298e3780b147b10c0a600b4fee
+
+commit e84517f51532ec913d8fb01a8aab7307134774bb
+Author: [email protected] <[email protected]>
+Date:   Fri Oct 6 03:25:14 2023 +0000
+
+    upstream: Perform the softhsm2 setup as discrete steps rather than
+    
+    as a long shell pipeline. Makes it easier to figure out what has happened
+    when it breaks.
+    
+    OpenBSD-Regress-ID: b3f1292115fed65765d0a95414df16e27772d81c
+
+commit cb54becff4d776238e0e9072943ba0872260535d
+Author: [email protected] <[email protected]>
+Date:   Sun Sep 24 08:14:13 2023 +0000
+
+    upstream: REGRESS_FAIL_EARLY defaults to yes now. So no need to
+    
+    overload the value here anymore. OK tb@ bluhm@
+    
+    OpenBSD-Regress-ID: f063330f1bebbcd373100afccebc91a965b14496
+
+commit f01f5137ceba65baf34ceac5a298c12ac01b1fef
+Author: [email protected] <[email protected]>
+Date:   Wed Oct 4 05:42:10 2023 +0000
+
+    upstream: spelling fix;
+    
+    OpenBSD-Commit-ID: 493f95121567e5ab0d9dd1150f873b5535ca0195
@@ -114,7 +114,7 @@ P11OBJS= ssh-pkcs11-client.o
 SKOBJS=	ssh-sk-client.o

 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-	sshconnect.o sshconnect2.o mux.o ssh-pkcs11.o $(SKOBJS)
+	sshconnect.o sshconnect2.o mux.o $(P11OBJS) $(SKOBJS)

 SSHDOBJS=sshd.o \
 	platform-listen.o \
@@ -158,7 +158,7 @@ SSHADD_OBJS=	ssh-add.o $(P11OBJS) $(SKOBJS)

 SSHAGENT_OBJS=	ssh-agent.o $(P11OBJS) $(SKOBJS)

-SSHKEYGEN_OBJS=	ssh-keygen.o sshsig.o ssh-pkcs11.o $(SKOBJS)
+SSHKEYGEN_OBJS=	ssh-keygen.o sshsig.o $(P11OBJS) $(SKOBJS)

 SSHKEYSIGN_OBJS=ssh-keysign.o readconf.o uidswap.o $(P11OBJS) $(SKOBJS)

@@ -1,4 +1,4 @@
-See https://www.openssh.com/releasenotes.html#10.2p1 for the release
+See https://www.openssh.com/releasenotes.html#10.1p1 for the release
 notes.

 Please read https://www.openssh.com/report.html for bug reporting
@@ -237,7 +237,6 @@ pthread_join(sp_pthread_t thread, void **value)


 static pam_handle_t *sshpam_handle = NULL;
-static char *sshpam_initial_user;
 static int sshpam_err = 0;
 static int sshpam_authenticated = 0;
 static int sshpam_session_open = 0;
@@ -486,11 +485,10 @@ check_pam_user(Authctxt *authctxt)
 		return PAM_USER_UNKNOWN;
 	}

-	if (sshpam_initial_user == NULL)
-		fatal_f("internal error: sshpam_initial_user NULL");
-	if (strcmp(sshpam_initial_user, pam_user) != 0) {
-		error_f("PAM user \"%s\" does not match previous \"%s\"",
-		      pam_user, sshpam_initial_user);
+	if (strcmp(authctxt->pw->pw_name, pam_user) != 0) {
+		debug("PAM user \"%s\" does not match expected \"%s\"",
+		      pam_user, authctxt->pw->pw_name);
+		return PAM_USER_UNKNOWN;
 	}
 	return PAM_SUCCESS;
 }
@@ -711,8 +709,6 @@ sshpam_cleanup(void)
 	sshpam_authenticated = 0;
 	pam_end(sshpam_handle, sshpam_err);
 	sshpam_handle = NULL;
-	free(sshpam_initial_user);
-	sshpam_initial_user = NULL;
 }

 static int
@@ -729,8 +725,12 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
 		fatal("Username too long from %s port %d",
 		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
 #endif
-	if (sshpam_handle == NULL && ssh == NULL)
-		fatal("%s: called initially with no packet context", __func__);
+	if (sshpam_handle == NULL) {
+		if (ssh == NULL) {
+			fatal("%s: called initially with no "
+			    "packet context", __func__);
+		}
+	}
 	if (sshpam_handle != NULL) {
 		/* We already have a PAM context; check if the user matches */
 		if ((sshpam_err = check_pam_user(authctxt)) != PAM_SUCCESS)
@@ -740,7 +740,6 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
 	    options.pam_service_name);
 	sshpam_err = pam_start(options.pam_service_name, user,
 	    &store_conv, &sshpam_handle);
-	sshpam_initial_user = xstrdup(user);
 	sshpam_authctxt = authctxt;

 	if (sshpam_err != PAM_SUCCESS) {
@@ -994,9 +994,6 @@
 /* Define to 1 if you have the `mkdtemp' function. */
 #undef HAVE_MKDTEMP

-/* Define to 1 if you have the `mmap' function. */
-#undef HAVE_MMAP
-
 /* define if you have mode_t data type */
 #undef HAVE_MODE_T

@@ -11442,7 +11442,7 @@ fi
 # the equivalent file.  This avoids having to wrap those includes in
 # '#ifdef HAVE_FOO_H'.  If we create any such headers, add the path to includes.
 COMPATINCLUDES=""
-       for ac_header in endian.h ifaddrs.h libgen.h paths.h netgroup.h nlist.h poll.h stdint.h sys/mman.h sys/stat.h sys/time.h sys/un.h time.h util.h
+       for ac_header in endian.h ifaddrs.h libgen.h paths.h netgroup.h nlist.h poll.h stdint.h sys/stat.h sys/time.h sys/un.h time.h util.h
 do :
  as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
 ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
@@ -16792,12 +16792,6 @@ if test "x$ac_cv_func_mkdtemp" = xyes
 then :
  printf "%s\n" "#define HAVE_MKDTEMP 1" >>confdefs.h

-fi
-ac_fn_c_check_func "$LINENO" "mmap" "ac_cv_func_mmap"
-if test "x$ac_cv_func_mmap" = xyes
-then :
-  printf "%s\n" "#define HAVE_MMAP 1" >>confdefs.h
-
 fi
 ac_fn_c_check_func "$LINENO" "ngetaddrinfo" "ac_cv_func_ngetaddrinfo"
 if test "x$ac_cv_func_ngetaddrinfo" = xyes
@@ -3773,24 +3773,6 @@ AC_CHECK_TYPES([nfds_t], , , [
 #endif
 ])

-if test "x$ac_cv_type_nfds_t" != "xyes"; then
-	AC_MSG_CHECKING([if poll nfds_t is unsigned long])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
-#include <sys/types.h>
-#ifdef HAVE_POLL_H
-#include <poll.h>
-#endif
-#ifdef HAVE_SYS_POLL_H
-#include <sys/poll.h>
-#endif
-	    int poll(struct pollfd *, unsigned long, int timeout);
-	    ]], [[return poll(0, 0, 0);]])],
-	    [AC_MSG_RESULT([yes])
-	     AC_DEFINE(POLL_NFDS_T_ULONG, 1, [Define if poll 2nd arg is ulong])],
-	    [AC_MSG_RESULT([no])]
-	)
-fi
-
 # Decide which sandbox style to use
 sandbox_arg=""
 AC_ARG_WITH([sandbox],
@@ -1,4 +1,4 @@
-%global ver 10.2p1
+%global ver 10.1p1
 %global rel 1%{?dist}

 # OpenSSH privilege separation requires a user & group ID
@@ -13,7 +13,7 @@

 Summary:	OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:		openssh
-Version:	10.2p1
+Version:	10.1p1
 URL:		https://www.openssh.com/
 Release:	1
 Source0:	openssh-%{version}.tar.gz
@@ -1129,7 +1129,6 @@ mm_answer_pam_account(struct ssh *ssh, int sock, struct sshbuf *m)
 	if ((r = sshbuf_put_u32(m, ret)) != 0 ||
 	    (r = sshbuf_put_stringb(m, loginmsg)) != 0)
 		fatal_fr(r, "buffer error");
-	sshbuf_reset(loginmsg);

 	mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);

@@ -65,7 +65,7 @@ _rs_forkdetect(void)
 static inline int
 _rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
 {
-#if defined(HAVE_MMAP) && defined(MAP_ANON) && defined(MAP_PRIVATE)
+#if defined(MAP_ANON) && defined(MAP_PRIVATE)
 	if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
 	    MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
 		return (-1);
@@ -84,7 +84,7 @@ _rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
 		*rsp = NULL;
 		return (-1);
 	}
-#endif /* HAVE_MMAP et al */
+#endif

 	_ARC4_ATFORK(_rs_forkhandler);
 	return (0);
@@ -72,11 +72,7 @@ typedef struct pollfd {
 #endif /* !HAVE_STRUCT_POLLFD_FD */

 #ifndef HAVE_NFDS_T
-# ifdef POLL_NFDS_T_ULONG
-typedef unsigned long	nfds_t;
-# else
 typedef unsigned int	nfds_t;
-# endif
 #endif

 #ifndef HAVE_POLL
@@ -964,7 +964,7 @@ EOF
 	softhsm2-util --slot "$slot" --label 01 --id 01 --pin "$TEST_SSH_PIN" \
 	    --import $RSAP8 >/dev/null || fatal "softhsm import RSA fail"
 	chmod 600 $RSA
-	${SSHKEYGEN} -y -f $RSA > ${RSA}.pub
+	ssh-keygen -y -f $RSA > ${RSA}.pub
 	# ECDSA key
 	ECPARAM=${SSH_SOFTHSM_DIR}/ECPARAM
 	EC=${SSH_SOFTHSM_DIR}/EC
@@ -978,7 +978,7 @@ EOF
 	softhsm2-util --slot "$slot" --label 02 --id 02 --pin "$TEST_SSH_PIN" \
 	    --import $ECP8 >/dev/null || fatal "softhsm import EC fail"
 	chmod 600 $EC
-	${SSHKEYGEN} -y -f $EC > ${EC}.pub
+	ssh-keygen -y -f $EC > ${EC}.pub
 	# Ed25519 key
 	ED25519=${SSH_SOFTHSM_DIR}/ED25519
 	ED25519P8=${SSH_SOFTHSM_DIR}/ED25519P8
@@ -990,7 +990,7 @@ EOF
 	    --import $ED25519P8 >/dev/null || \
 		fatal "softhsm import ed25519 fail"
 	chmod 600 $ED25519
-	${SSHKEYGEN} -y -f $ED25519 > ${ED25519}.pub
+	ssh-keygen -y -f $ED25519 > ${ED25519}.pub
 	# Prepare askpass script to load PIN.
 	PIN_SH=$SSH_SOFTHSM_DIR/pin.sh
 	cat > $PIN_SH << EOF
@@ -999,11 +999,7 @@ echo "${TEST_SSH_PIN}"
 EOF
 	chmod 0700 "$PIN_SH"
 	PKCS11_OK=yes
-	if env SSH_ASKPASS="$PIN_SH" SSH_ASKPASS_REQUIRE=force \
-	    ${SSHKEYGEN} -D ${TEST_SSH_PKCS11} >/dev/null 2>&1 ; then
-		return 0
-	fi
-	return 1
+	return 0
 }

 # Peforms ssh-add with the right token PIN.
@@ -435,9 +435,6 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_getpeername
 	SC_ALLOW(__NR_getpeername),
 #endif
-#ifdef __NR_uname
-	SC_ALLOW(__NR_uname),
-#endif
 #ifdef __NR_setsockopt
 	SC_ALLOW_SETSOCKOPT(IPPROTO_IPV6, IPV6_TCLASS),
 	SC_ALLOW_SETSOCKOPT(IPPROTO_IP, IP_TOS),
@@ -310,6 +310,22 @@ main(int argc, char **argv)
 	}
 }
 #else /* ENABLE_PKCS11 */
+/* stubs */
+int
+pkcs11_sign(struct sshkey *key,
+    u_char **sigp, size_t *lenp,
+    const u_char *data, size_t datalen,
+    const char *alg, const char *sk_provider,
+    const char *sk_pin, u_int compat)
+{
+	return SSH_ERR_INTERNAL_ERROR;
+}
+
+void
+pkcs11_key_free(struct sshkey *key)
+{
+}
+
 int
 main(int argc, char **argv)
 {
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.74 2025/10/09 23:25:23 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.72 2025/10/03 00:08:02 djm Exp $ */
 /*
 * Copyright (c) 2010 Markus Friedl.  All rights reserved.
 * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -1486,7 +1486,7 @@ pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
 		case CKC_X_509:
 			if (pkcs11_fetch_x509_pubkey(p, slotidx, &obj,
 			    &key, &label) != 0) {
-				debug_f("failed to fetch key");
+				error("failed to fetch key");
 				continue;
 			}
 			break;
@@ -1613,7 +1613,7 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
 		}

 		if (key == NULL) {
-			debug_f("failed to fetch key");
+			error("failed to fetch key");
 			continue;
 		}
 		note_key(p, slotidx, __func__, key);
@@ -2029,10 +2029,8 @@ pkcs11_terminate(void)

 	debug3_f("called");

-	while ((k11 = TAILQ_FIRST(&pkcs11_keys)) != NULL) {
-		TAILQ_REMOVE(&pkcs11_keys, k11, next);
+	while ((k11 = TAILQ_FIRST(&pkcs11_keys)) != NULL)
 		pkcs11_k11_free(k11);
-	}
 	while ((p = TAILQ_FIRST(&pkcs11_providers)) != NULL) {
 		TAILQ_REMOVE(&pkcs11_providers, p, next);
 		pkcs11_provider_finalize(p);
@@ -2289,13 +2287,11 @@ out:

 #include "log.h"
 #include "sshkey.h"
-#include "ssherr.h"
-#include "ssh-pkcs11.h"

 int
 pkcs11_init(int interactive)
 {
-	error_f("PKCS#11 not supported");
+	error_f("dlopen() not supported");
 	return (-1);
 }

@@ -2303,30 +2299,13 @@ int
 pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp,
    char ***labelsp)
 {
-	error_f("PKCS#11 not supported");
+	error_f("dlopen() not supported");
 	return (-1);
 }

-void
-pkcs11_key_free(struct sshkey *key)
-{
-	error_f("PKCS#11 not supported");
-}
-
-int
-pkcs11_sign(struct sshkey *key,
-    u_char **sigp, size_t *lenp,
-    const u_char *data, size_t datalen,
-    const char *alg, const char *sk_provider,
-    const char *sk_pin, u_int compat)
-{
-	error_f("PKCS#11 not supported");
-	return SSH_ERR_FEATURE_UNSUPPORTED;
-}
-
 void
 pkcs11_terminate(void)
 {
-	error_f("PKCS#11 not supported");
+	error_f("dlopen() not supported");
 }
 #endif /* ENABLE_PKCS11 */
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.107 2025/10/08 00:32:52 djm Exp $ */
+/* $OpenBSD: version.h,v 1.106 2025/10/06 01:45:22 djm Exp $ */

-#define SSH_VERSION	"OpenSSH_10.2"
+#define SSH_VERSION	"OpenSSH_10.1"

 #define SSH_PORTABLE	"p1"
 #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
Author	SHA1	Message	Date
Darren Tucker	a18cd34e9b	Fix header name and move return outside of ifdef. Fixes from Mike Frysinger via Github PR#597.	2025-10-08 11:32:32 +11:00
Darren Tucker	fabf4cd141	Use calloc for sshkeys if mmap is not supported. Based on Github PR#597 from Mike Frysinger, any bugs added by me.	2025-10-07 21:11:30 +11:00
Darren Tucker	9f0dd9505d	Add fcntl.h to includes. From FreeBSD via bz#3874: "This was previously included due to nested includes in Heimdal's headers. Without this, the build fails with an error due to redefining AT_FDCWD."	2025-10-07 20:26:55 +11:00
Daan De Meyer	acb690b499	Only set PAM_RHOST if the remote host is not "UNKNOWN" When using sshd's -i option with stdio that is not a AF_INET/AF_INET6 socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then set as the value of PAM_RHOST, causing pam to try to do a reverse DNS query of "UNKNOWN", which times out multiple times, causing a substantial slowdown when logging in. To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".	2025-10-07 20:16:15 +11:00
Darren Tucker	aefeee5bed	Don't copy native host keys for hostbased test. Some github runners (notably macos-14) seem to have host keys where public and private do not match, so generate our own keys for testing purposes.	2025-10-07 20:12:32 +11:00
Darren Tucker	28a2788d60	Add clock_gettime compat shim. This fixes the build on macOS prior to 10.12 Sierra, since it does not have it. Found and tested by Sevan Janiyan.	2025-10-07 20:08:02 +11:00
[email protected]	979cbc2c1e	upstream: don't reuse c->isatty for signalling that the remote channel has a tty attached as this causes side effects, e.g. in channel_handle_rfd(). bz3872 ok markus@ OpenBSD-Commit-ID: 4cd8a9f641498ca6089442e59bad0fd3dcbe85f8	2025-10-07 19:20:37 +11:00
Damien Miller	1dfb2c1db0	autogenerated files for release	2025-10-06 13:25:16 +11:00