CVS commit: pkgsrc/security/openssh

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Wed Oct  7 15:22:05 UTC 2026

Modified Files:
        pkgsrc/security/openssh: Makefile distinfo options.mk
        pkgsrc/security/openssh/patches: patch-atomicio.c patch-configure.ac

Log Message:
security/openssh: update to version 10.6p1.

Pkgsrc changes:
 * Adapt patches to what's changed upstream.
 * Version & checksum changes.

Upstream changes:

Changes since OpenSSH 10.5
==========================

This release contains a number of security fixes, several new
features and some small bugfixes.

Security
========

 * sftp(1): more strictly validate paths returned from the server to
   avoid some cases where a server could return paths that could
   manipulate a recursive copy operation into writing outside its
   target directory. Report and patch from Junghoon Cho.

 * sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI
   credentials when authentication has succeeded. Avoids a situation
   where credentials from a failed GSSAPIAuthentication attempt may
   persist and be made inappropriately available if another
   authentication subsequently succeeds. Issue report and patch from
   Moritz Theile.

 * sshd(8): reset GSSAPIAuthentication before authentication, avoiding
   state from one authentication attempt being confused with that of
   a later attempt. Report and feedback from Moritz Theile.

 * sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate the
   side-channel leaks described in "Crossing the Streams: SSH
   Plaintext Recovery via a Common Compression Context in
   Multiplexed Channels" by Fabian B�umer and Marcus Brinkmann,
   preprint https://arxiv.org/abs/2609.07709 (2026)

   A chosen-plaintext attack method exists which makes use of
   dictionary-based compression to recover secrets from one channel
   by interacting with the SSH session's shared compression
   dictionary through another channel.

   Attacker-controlled input can recognizably reflect into the
   total length of transmitted ciphertexts by virtue of LZ77
   replacing repeated strings with back-references into the SSH
   session's encoder search buffer, which is shared across all
   channels. For this reason, the documentation already recommended
   against enabling compression for connections that share trusted
   and untrusted traffic.

   This change will reduce the effectiveness of the Compression
   option. Users are encouraged to use application-level compression
   over the SSH protocol where possible, as this will typically be
   more effective and will be completely immune to this type of
   attack.

 * ssh(1): disallow '$' and '\' characters in usernames entered on
   the command-line to avoid usernames from untrusted sources
   yielding injection in shell context via ProxyCommand, Match exec,
   etc. Usernames specified via the configuration files are not
   subject this this control. Reported by SecBuddyF KeenLab Tencent
   (CodeBuddy Security)

   We continue to recommend against directly exposing ssh(1) and
   other tools' command-lines to untrusted input. Mitigations such
   as this can not be absolute given the variety of shells and user
   configurations in use.

 * ssh-keygen(1): correct handling of Daylight Saving Time when
   converting dates. Previous handling could cause errors of
   up to +/- 1 hour (unless you are in the Antarctica/Troll
   timezone, where the error could be +/- 2 hours). These errors
   could result in creation of certificates with incorrect expiry
   times. bz4004; from Khush Patel

 * sshd(8), ssh(1): ensure that compressed payloads don't inflate
   past the maximum supported packet length. Reported by Oleh Konko.

 * sshd(8): fully honor the authorized_keys "restrict" keyword,
   which was not being properly applied to tunnel forwarding
   (PermitTunnel, disabled by default). This is a separate problem
   to the one fixed in openssh-10.5.

 * sshd(8): correctly handle some options that accept "none". Some
   options, including AuthorizedPrincipalsFile, were documented as
   accepting "none" as a way to disable them; however, when
   overridden by an sshd_config(5) Match keyword, this argument was
   being incorrectly interpreted as a literal file.
   With Chris Rohlf in collaboration with Claude and Anthropic Research

 * sshd(8): On OS X SDK >= 27, sandboxing is no longer supported
   as the API we depended upon has been removed and no obvious
   alternative provided.

 * sshd(8): on platforms that do not support file descriptor passing
   and that require root for PTY allocation, the post-authentication
   sshd-session process retains root privilege, whereas on other
   platforms this process runs with the privilege of the logged-in
   user. When sshd-session was run with elevated privilege, it could
   perform certain actions as root and circumvent controls that
   would normally have applied to the user, such as making unix
   domain socket connections or binding (via -R forwarding) to low-
   numbered TCP ports.

   For this reason, this release disables the GatewayPorts and
   StreamLocalForwarding options and support for these (few)
   platforms will be removed in future if no alternatives to
   requiring privilege in the post-authentication process are found.
   Affected platforms include QNX 6, SCO OpenServer 5 and builds
   that were made with the --disable-fd-passing configure option.

   This problem was reported separately by sn0x-sharma and by Dark
   River.

New features
------------

 * All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature
   algorithm. Note that this no longer uses the "@openssh.com"
   vendor extension suffix that the previous experimental
   implementation used. Keys generated with the previous experimental
   support must be regenerated and/or removed.

 * sshd(8): Add the WarnWeakCrypto option to sshd_config(5). This
   option was previously available for the client only. This option
   is enabled by default and will log when the client uses a key
   agreement scheme that is not post-quantum safe.

 * ssh-keygen(1), ssh-add(1): preserve user-verification (PIN or
   biometric) requirement for resident keys loaded from a FIDO
   token, by checking the credential's credProtect policy.
   GHPR701 from Savely Krasovsky

 * ssh(1): include local and remote version strings in the ~I
   connection information display.

 * ssh-add(1): add a -P flag to skip PIN entry for FIDO and PKCS#11
   tokens that do not require it.

 * sftp(1): add '-p' flag for mkdir/lmkdir to create directories as
   required. This flag has similar ergonomics to mkdir(1), and
   previously-existing directories do not cause an error.

 * ssh-keygen(1): add a "hexdump" key export mode that dumps the SSH
   wire-formatted key blob in hex format. Useful when writing
   documentation, tests, etc. E.g. `ssh-keygen -em hexdump -f /key`

 * ssh(1), sshd(8): ChannelTimeout now accepts timeouts with
   fractional seconds.

 * sshd(8): allow specification of the location of $SSH_AUTH_SOCK
   used for agent forwarding using a new AgentSocketPath option.
   This supports both using a user-specific path, such as the
   default of a subdirectory of $HOME ("user:.ssh/agent"), and
   the previous approach of allowing agent forwarding sockets to be
   located in a shared directory (e.g. "shared:/tmp"). Sockets
   created in shared directories will be created inside a
   subdirectory with a randomised name. bz3860

 * ssh-agent(1): allow specification of agent socket directories
   using a -A flag. It accepts "user:" and "shared:" directory
   styles similar to the sshd AgentSocketPath option.

 * sshd(8): account for public key authentication "key ok" tests
   separately to auth attempts. Add a `PubkeyOptions max-pk-ok:nnnn`
   option to allow a number of PK_OK tests (asking whether the
   server might accept a given public key) that do not count against
   MaxAuthTries, defaulting to 6 attempts. After these attempts are
   exhausted, further attempts count as failed authentications
   against MaxAuthTries. Practically, this allows more keys on disk
   or held in ssh-agent to be checked for use before the server
   disconnects.

 * ssh(1), sshd(8): extend the existing TCPKeepAlive option to also
   support setting keepalives on sockets created for forwarding
   connections. Previously this option controlled keepalives on the
   connection socket only. TCPKeepAlive "yes" or "transport" enables
   keepalives on the connection socket. "TCPKeepAlive all" additionally
   enables them for forwarding sockets. bz3921

Bugfixes
--------

 * sshd(8), ssh(1): fix configuration matching on more Turkic
   languages which have disjoint dotted and dotless i/I characters,
   specifically Azerbaijani and Crimean Tatar. bz3991

 * ssh(1), sshd(8): don't attempt to set TCP_NODELAY on non-IP/IPv6
   sockets. Eliminates some noise in debug logs.

 * ssh(1): fix case for ssh -G option output; bz4005

 * ssh(1), sshd(8): Fix ChannelTimeout specificity; previously a
   more specific channel type (e.g. "session:shell") could clobber
   a user-specified ChannelTimeout if it was less specific (e.g.
   "session").  Also, in some cases, the debug messages were
   printing 0 instead of the effective timeout. bz3994

 * sftp(1): avoid NULL dereference crash in some circumstances when
   a server fails a stat/lstat operation. GHPR707

 * sshd(8): close a race condition where a SIGTERM/SIGQUIT would be
   ignored if it was received by the server while it was processing a
   SIGHUP restart request. bz3981

 * sshd(8), ssh(1): check key and CA signature types during key
   parsing against allowlists (PubkeyAcceptedAlgorithms, etc) as
   early as possible. This reduces the attack surface presented by
   disabled algorithms. Suggested by and with extensive feedback
   from Chris Rohlf in collaboration with Claude and Anthropic
   Research.

 * All: switch the fallback implementation of the ed25519 signature
   algorithm used when libcrypto is disabled from SUPERCOP ed25519
   to libsodium. The libsodium implementation includes a number of
   strictness checks over the original reference implementation we
   have used to this point and a more ergonomic API.

 * ssh-add(1), ssh(1), ssh-keygen(1): fix spin on password entry when
   the program attempting to read a password was started in a
   background process group, with no TTY and with certain signals
   ignored. bz3995

 * scp(1): disallow nul byte in received scp -O filename. This was
   not reachable in normal operation. Reported by Chua Wei Xun.

 * ssh-keygen(1), ssh(1), sshd(8): implement a maximum number of KDF
   rounds that will be accepted when writing an OpenSSH-format
   private key or when loading one. This limit is set quite high
   (1M), but ensures that a service that is passed a bad key with a
   ridiculously high number of rounds will eventually complete
   parsing it.

 * ssh-keygen(1): bump the default number of KDF rounds from 24 to
   32 (this is a linear increase, not like bcrypt(3) which is
   exponential).

 * ssh(1): make StreamLocalBindMask properly respect Host/Match
   blocks and make it first-match-wins as documented. bz4013

 * sshd(8): make StreamLocalBindMask properly first-match-wins.

Portability
-----------

 * All: remove the NetBSD BROKEN_READ_COMPARISON workaround. This
   appears to be no longer required and caused pre-auth CPU spinning.

 * sshd(8): don't link sshd against libselinux when SELinux support
   is enabled (note: this library is still linked for the sshd-auth
   and sshd-session helper binaries).

 * sshd(8): allow madvise(..., MADV_DONTNEED_LOCKED) in the seccomp
   sandbox; needed by GrapheneOS' hardened allocator. bz4001

 * sshd(8): restrict mremap(2) flags accepted by the seccomp
   sandbox. Only MREMAP_MAYMOVE is now accepted as other flags may
   have some utility in attack chains. Reported by: Mohammad Hossein
   Abedini.

 * sshd(8): allow PAMServiceName in Match (regressed in 10.4).
   During the refactor of server option parsing, the ability to set
   PAMServiceName in Match blocks was accidentally disabled.

 * sshd(8): the --disable-fd-passing configure option has been
   removed.


To generate a diff of this commit:
cvs rdiff -u -r1.298 -r1.299 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.134 -r1.135 pkgsrc/security/openssh/distinfo
cvs rdiff -u -r1.51 -r1.52 pkgsrc/security/openssh/options.mk
cvs rdiff -u -r1.5 -r1.6 pkgsrc/security/openssh/patches/patch-atomicio.c
cvs rdiff -u -r1.12 -r1.13 pkgsrc/security/openssh/patches/patch-configure.ac

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssh/Makefile
diff -u pkgsrc/security/openssh/Makefile:1.298 pkgsrc/security/openssh/Makefile:1.299
--- pkgsrc/security/openssh/Makefile:1.298      Mon Oct  5 18:48:24 2026
+++ pkgsrc/security/openssh/Makefile    Wed Oct  7 15:22:05 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.298 2026/10/05 18:48:24 he Exp $
+# $NetBSD: Makefile,v 1.299 2026/10/07 15:22:05 he Exp $
 
-DISTNAME=              openssh-10.5p1
-PKGREVISION=           2
+DISTNAME=              openssh-10.6p1
 CATEGORIES=            security
 MASTER_SITES=          ${MASTER_SITE_OPENBSD:=OpenSSH/portable/}
 

Index: pkgsrc/security/openssh/distinfo
diff -u pkgsrc/security/openssh/distinfo:1.134 pkgsrc/security/openssh/distinfo:1.135
--- pkgsrc/security/openssh/distinfo:1.134      Mon Oct  5 18:08:15 2026
+++ pkgsrc/security/openssh/distinfo    Wed Oct  7 15:22:05 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.134 2026/10/05 18:08:15 he Exp $
+$NetBSD: distinfo,v 1.135 2026/10/07 15:22:05 he Exp $
 
-BLAKE2s (openssh-10.5p1.tar.gz) = 0a7483f05aa98e39cd4c7c8f2c259a3f5dd96d784e8934f6a7e94d6bf0a47c83
-SHA512 (openssh-10.5p1.tar.gz) = 5336c1945527b29ed59cc500fa8bfbd918f5ba97e85512daad9ab7241418929bf7152d300e5f3c5f9a8c8d699dfde5a64c5faa4fc33b2758ab52dd04040d6284
-Size (openssh-10.5p1.tar.gz) = 2333659 bytes
+BLAKE2s (openssh-10.6p1.tar.gz) = f2ac2881839430ca50df9c8fe56ac786d01c62c231fd9c5a7f321e01f34dfeec
+SHA512 (openssh-10.6p1.tar.gz) = 243e07c8c68c649552ee019e6aac4393634de6e403cb793b3cd756d5c46e84cc8b2b560e6c0b36e8fb48979b109f888317411a9d640583109117ea621f27700a
+Size (openssh-10.6p1.tar.gz) = 2355244 bytes
 SHA1 (patch-Makefile.in) = d58adac52e169f25f0b0c3a321f154b44b0475e6
-SHA1 (patch-atomicio.c) = 43b9f79b7f426605fc638216e9ee299ebdfa58d0
-SHA1 (patch-configure.ac) = ea50059cf979d5c00f8beae027e0419fbd68cdb2
+SHA1 (patch-atomicio.c) = c4ec07e00b29fe902c38b202e6572a290a8b84f9
+SHA1 (patch-configure.ac) = 680d8fdfb7b63c7bf25b8340c7f68defb71703a0
 SHA1 (patch-defines.h) = c1dbb18076b4fa399b0f791bb543ef1e5cb0408e
 SHA1 (patch-sshkey.h) = aaaf622f377e455c49683fcc2ca42576ccd097bb

Index: pkgsrc/security/openssh/options.mk
diff -u pkgsrc/security/openssh/options.mk:1.51 pkgsrc/security/openssh/options.mk:1.52
--- pkgsrc/security/openssh/options.mk:1.51     Mon Aug  3 13:12:31 2026
+++ pkgsrc/security/openssh/options.mk  Wed Oct  7 15:22:05 2026
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.51 2026/08/03 13:12:31 wiz Exp $
+# $NetBSD: options.mk,v 1.52 2026/10/07 15:22:05 he Exp $
 
 PKG_OPTIONS_VAR=       PKG_OPTIONS.openssh
 PKG_SUPPORTED_OPTIONS= editline fido kerberos openssl pam openssh-legacymodsz
@@ -22,7 +22,10 @@ PKG_SUGGESTED_OPTIONS+=      pam
 .include "../../mk/bsd.options.mk"
 
 .if !empty(PKG_OPTIONS:Mopenssl)
-.include "../../security/openssl/buildlink3.mk"
+# Want/need newish OpenSSL:
+BUILDLINK_API_DEPENDS.openssl+= openssl>=3
+# but it may come from the in-tree version:
+.include "../../security/openssl/builtin.mk"
 CONFIGURE_ARGS+=       --with-ssl-dir=${SSLBASE:Q}
 .else
 CONFIGURE_ARGS+=       --without-openssl

Index: pkgsrc/security/openssh/patches/patch-atomicio.c
diff -u pkgsrc/security/openssh/patches/patch-atomicio.c:1.5 pkgsrc/security/openssh/patches/patch-atomicio.c:1.6
--- pkgsrc/security/openssh/patches/patch-atomicio.c:1.5        Mon Oct  5 18:08:15 2026
+++ pkgsrc/security/openssh/patches/patch-atomicio.c    Wed Oct  7 15:22:05 2026
@@ -1,25 +1,15 @@
-$NetBSD: patch-atomicio.c,v 1.5 2026/10/05 18:08:15 he Exp $
+$NetBSD: patch-atomicio.c,v 1.6 2026/10/07 15:22:05 he Exp $
 
-Remove no-longer-needed BROKEN_READ_COMPARISON code, to mirror
-
-  https://github.com/openssh/openssh-portable/commit/a765b86d
-
-ref. mailing list thread at
-
-  https://lists.mindrot.org/pipermail/openssh-unix-dev/2026-September/042758.html
+Fix for PR#60563.
 
 --- atomicio.c.orig    2026-09-22 07:42:45.683284535 +0000
 +++ atomicio.c
-@@ -51,11 +51,7 @@ atomicio6(ssize_t (*f) (int, void *, siz
+@@ -51,7 +51,7 @@ atomicio6(ssize_t (*f) (int, void *, siz
        struct pollfd pfd;
  
        pfd.fd = fd;
--#ifndef BROKEN_READ_COMPARISON
 -      pfd.events = f == read ? POLLIN : POLLOUT;
--#else
--      pfd.events = POLLIN|POLLOUT;
--#endif
-+      pfd.events = f != vwrite ? POLLIN : POLLOUT;
++      pfd.events = f == vwrite ? POLLOUT : POLLIN;
        while (n > pos) {
                res = (f) (fd, s + pos, n - pos);
                switch (res) {

Index: pkgsrc/security/openssh/patches/patch-configure.ac
diff -u pkgsrc/security/openssh/patches/patch-configure.ac:1.12 pkgsrc/security/openssh/patches/patch-configure.ac:1.13
--- pkgsrc/security/openssh/patches/patch-configure.ac:1.12     Tue Sep 22 08:03:59 2026
+++ pkgsrc/security/openssh/patches/patch-configure.ac  Wed Oct  7 15:22:05 2026
@@ -1,4 +1,4 @@
-$NetBSD: patch-configure.ac,v 1.12 2026/09/22 08:03:59 he Exp $
+$NetBSD: patch-configure.ac,v 1.13 2026/10/07 15:22:05 he Exp $
 
 Remove no-longer-needed BROKEN_READ_COMPARISON, ref.
    https://github.com/openssh/openssh-portable/commit/a765b86d
@@ -17,16 +17,7 @@ Tweak for wtmpx location probing.
  # Allow user to specify flags
  AC_ARG_WITH([cflags],
        [  --with-cflags           Specify additional flags to pass to compiler],
-@@ -1144,8 +1147,6 @@ mips-sony-bsd|mips-sony-newsos4)
-       AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
-           [Prepend the address family to IP tunnel traffic])
-       TEST_MALLOC_OPTIONS="AJRX"
--      AC_DEFINE([BROKEN_READ_COMPARISON], [1],
--          [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
-       ;;
- *-*-freebsd*)
-       AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
-@@ -5742,9 +5743,17 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+@@ -5741,9 +5744,17 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
  ])
  if test -z "$conf_wtmpx_location"; then
        if test x"$system_wtmpx_path" = x"no" ; then
@@ -46,7 +37,7 @@ Tweak for wtmpx location probing.
        AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"],
                [Define if you want to specify the path to your wtmpx file])
  fi
-@@ -5853,7 +5862,7 @@ echo "OpenSSH has been configured with t
+@@ -5852,7 +5863,7 @@ echo "OpenSSH has been configured with t
  echo "                     User binaries: $B"
  echo "                   System binaries: $C"
  echo "               Configuration files: $D"