fix duplicate PAM msgs, missing loginmsg reset

without this change in mm_answer_pam_account all messages added in
auth-pam.c sshpam_query(...) case PAM_SUCCESS end up sent here, then are
still sitting in the loginmsg buffer and printed a second time in
session.c do_login(...)

.github/workflows/c-cpp.yml

@@ -29,9 +29,9 @@ jobs:
           - ubuntu-latest
           - ubuntu-22.04-arm
           - ubuntu-24.04-arm
-          - macos-13
           - macos-14
           - macos-15
+          - macos-15-intel
           - windows-2022
           - windows-2025
         config: [default]
@@ -79,8 +79,9 @@ jobs:
           - { target: ubuntu-latest, config: libressl-3.7.3 }
           - { target: ubuntu-latest, config: libressl-3.8.4 }
           - { target: ubuntu-latest, config: libressl-3.9.2 }
-          - { target: ubuntu-latest, config: libressl-4.0.0 }
-          - { target: ubuntu-latest, config: libressl-4.1.0 }
+          - { target: ubuntu-latest, config: libressl-4.0.1 }
+          - { target: ubuntu-latest, config: libressl-4.1.1 }
+          - { target: ubuntu-latest, config: libressl-4.2.0 }
           - { target: ubuntu-latest, config: openssl-master }
           - { target: ubuntu-latest, config: openssl-noec }
           - { target: ubuntu-latest, config: openssl-1.1.1 }
@@ -111,7 +112,6 @@ jobs:
           - { target: ubuntu-latest, config: musl }
           - { target: ubuntu-22.04-arm, config: kitchensink }
           - { target: ubuntu-24.04-arm, config: kitchensink }
-          - { target: macos-13, config: pam }
           - { target: macos-14, config: pam }
           - { target: macos-15, config: pam }
     runs-on: ${{ matrix.target }}

.github/workflows/selfhosted.yml

@@ -51,6 +51,7 @@ jobs:
           - obsd74
           - obsd76
           - obsd77
+          - obsd78
           - obsdsnap
           - obsdsnap-i386
           - omnios

.github/workflows/upstream.yml

@@ -42,7 +42,7 @@ jobs:
       run: sshfs_mount
       working-directory: ${{ runner.temp }}
     - name: update source
-      run: vmrun "cd /usr/src && cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc"
+      run: vmrun "cd /usr/src && if [ -d .git ]; then git pull && git log -n1; else cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc; fi"
     - name: update netcat
       run: vmrun "cd /usr/src/usr.bin/nc && make clean all && sudo make install"
     - name: make clean

.github/workflows/vm.yml

@@ -282,9 +282,12 @@ jobs:
         release: ${{ matrix.target }}
         usesh: true
         prepare: |
-          env PKG_PATH=https://ftp.openbsd.org/pub/OpenBSD/${{matrix.target}}/packages/amd64 pkg_add sudo--
           useradd -m builder
-          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers
+          echo "permit nopass keepenv root" >/etc/doas.conf
+          echo "permit nopass keepenv builder" >>/etc/doas.conf
+          ls -l /etc/doas.conf
+          chown root:wheel /etc/doas.conf
+          chmod 644 /etc/doas.conf
           mkdir -p /var/empty /usr/local/etc
           cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
 
@@ -293,18 +296,18 @@ jobs:
       run: cd $GITHUB_WORKSPACE && chown -R builder .
     - name: configure
       shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
+      run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
     - name: make clean
       shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
+      run: cd $GITHUB_WORKSPACE && doas -u builder make clean
     - name: make
       shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
+      run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
     - name: make tests
       shell: openbsd {0}
       run: |
         cd $GITHUB_WORKSPACE
-        sudo -u builder env SUDO=sudo make tests
+        doas -u builder env SUDO=doas make tests
 
 
   solaris:

Makefile.in

@@ -114,7 +114,7 @@ P11OBJS= ssh-pkcs11-client.o
 SKOBJS=	ssh-sk-client.o
 
 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-	sshconnect.o sshconnect2.o mux.o $(P11OBJS) $(SKOBJS)
+	sshconnect.o sshconnect2.o mux.o ssh-pkcs11.o $(SKOBJS)
 
 SSHDOBJS=sshd.o \
 	platform-listen.o \

auth-pam.c

@@ -237,6 +237,7 @@ pthread_join(sp_pthread_t thread, void **value)
 
 
 static pam_handle_t *sshpam_handle = NULL;
+static char *sshpam_initial_user;
 static int sshpam_err = 0;
 static int sshpam_authenticated = 0;
 static int sshpam_session_open = 0;
@@ -485,10 +486,11 @@ check_pam_user(Authctxt *authctxt)
 		return PAM_USER_UNKNOWN;
 	}
 
-	if (strcmp(authctxt->pw->pw_name, pam_user) != 0) {
-		debug("PAM user \"%s\" does not match expected \"%s\"",
-		      pam_user, authctxt->pw->pw_name);
-		return PAM_USER_UNKNOWN;
+	if (sshpam_initial_user == NULL)
+		fatal_f("internal error: sshpam_initial_user NULL");
+	if (strcmp(sshpam_initial_user, pam_user) != 0) {
+		error_f("PAM user \"%s\" does not match previous \"%s\"",
+		      pam_user, sshpam_initial_user);
 	}
 	return PAM_SUCCESS;
 }
@@ -709,6 +711,8 @@ sshpam_cleanup(void)
 	sshpam_authenticated = 0;
 	pam_end(sshpam_handle, sshpam_err);
 	sshpam_handle = NULL;
+	free(sshpam_initial_user);
+	sshpam_initial_user = NULL;
 }
 
 static int
@@ -725,12 +729,8 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
 		fatal("Username too long from %s port %d",
 		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
 #endif
-	if (sshpam_handle == NULL) {
-		if (ssh == NULL) {
-			fatal("%s: called initially with no "
-			    "packet context", __func__);
-		}
-	}
+	if (sshpam_handle == NULL && ssh == NULL)
+		fatal("%s: called initially with no packet context", __func__);
 	if (sshpam_handle != NULL) {
 		/* We already have a PAM context; check if the user matches */
 		if ((sshpam_err = check_pam_user(authctxt)) != PAM_SUCCESS)
@@ -740,6 +740,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
 	    options.pam_service_name);
 	sshpam_err = pam_start(options.pam_service_name, user,
 	    &store_conv, &sshpam_handle);
+	sshpam_initial_user = xstrdup(user);
 	sshpam_authctxt = authctxt;
 
 	if (sshpam_err != PAM_SUCCESS) {

configure.ac

@@ -3773,6 +3773,24 @@ AC_CHECK_TYPES([nfds_t], , , [
 #endif
 ])
 
+if test "x$ac_cv_type_nfds_t" != "xyes"; then
+	AC_MSG_CHECKING([if poll nfds_t is unsigned long])
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <sys/types.h>
+#ifdef HAVE_POLL_H
+#include <poll.h>
+#endif
+#ifdef HAVE_SYS_POLL_H
+#include <sys/poll.h>
+#endif
+	    int poll(struct pollfd *, unsigned long, int timeout);
+	    ]], [[return poll(0, 0, 0);]])],
+	    [AC_MSG_RESULT([yes])
+	     AC_DEFINE(POLL_NFDS_T_ULONG, 1, [Define if poll 2nd arg is ulong])],
+	    [AC_MSG_RESULT([no])]
+	)
+fi
+
 # Decide which sandbox style to use
 sandbox_arg=""
 AC_ARG_WITH([sandbox],

monitor.c

@@ -1129,6 +1129,7 @@ mm_answer_pam_account(struct ssh *ssh, int sock, struct sshbuf *m)
 	if ((r = sshbuf_put_u32(m, ret)) != 0 ||
 	    (r = sshbuf_put_stringb(m, loginmsg)) != 0)
 		fatal_fr(r, "buffer error");
+	sshbuf_reset(loginmsg);
 
 	mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);
 

openbsd-compat/bsd-poll.h

@@ -72,7 +72,11 @@ typedef struct pollfd {
 #endif /* !HAVE_STRUCT_POLLFD_FD */
 
 #ifndef HAVE_NFDS_T
+# ifdef POLL_NFDS_T_ULONG
+typedef unsigned long	nfds_t;
+# else
 typedef unsigned int	nfds_t;
+# endif
 #endif
 
 #ifndef HAVE_POLL

sandbox-seccomp-filter.c

@@ -435,6 +435,9 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_getpeername
 	SC_ALLOW(__NR_getpeername),
 #endif
+#ifdef __NR_uname
+	SC_ALLOW(__NR_uname),
+#endif
 #ifdef __NR_setsockopt
 	SC_ALLOW_SETSOCKOPT(IPPROTO_IPV6, IPV6_TCLASS),
 	SC_ALLOW_SETSOCKOPT(IPPROTO_IP, IP_TOS),

ssh-pkcs11.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.73 2025/10/08 21:02:16 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.74 2025/10/09 23:25:23 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -1486,7 +1486,7 @@ pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
 		case CKC_X_509:
 			if (pkcs11_fetch_x509_pubkey(p, slotidx, &obj,
 			    &key, &label) != 0) {
-				error("failed to fetch key");
+				debug_f("failed to fetch key");
 				continue;
 			}
 			break;
@@ -1613,7 +1613,7 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
 		}
 
 		if (key == NULL) {
-			error("failed to fetch key");
+			debug_f("failed to fetch key");
 			continue;
 		}
 		note_key(p, slotidx, __func__, key);