[packages/openssh-legacy] Up to 10.5p1; DSA restored via openssh-dsa.patch
arekm
arekm at pld-linux.org
Thu Sep 3 22:48:45 CEST 2026
commit 225db8a1721e3ba259f3f76b9ab288a2009b077a
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Sep 3 22:45:56 2026 +0200
Up to 10.5p1; DSA restored via openssh-dsa.patch
(that way gets us few CVE fixes)
ldap-helper-sigpipe.patch | 102 --
ldap.conf.patch | 56 -
openssh-chroot.patch | 162 ---
openssh-dsa.patch | 1153 ++++++++++++++++++++
openssh-ldap-fixes.patch | 24 -
openssh-ldap.patch | 2614 ---------------------------------------------
openssh-legacy.spec | 34 +-
openssh-sigpipe.patch | 99 --
8 files changed, 1165 insertions(+), 3079 deletions(-)
---
diff --git a/openssh-legacy.spec b/openssh-legacy.spec
index 09ebb32..2ee82bf 100644
--- a/openssh-legacy.spec
+++ b/openssh-legacy.spec
@@ -20,37 +20,30 @@ Summary(pt_BR.UTF-8): Implementação livre do SSH
Summary(ru.UTF-8): OpenSSH - свободная реализация протокола Secure Shell (SSH)
Summary(uk.UTF-8): OpenSSH - вільна реалізація протоколу Secure Shell (SSH)
Name: openssh-legacy
-# Upgrade only to versions that support DSA keys
-Version: 9.8p1
-Release: 13
+Version: 10.5p1
+Release: 1
License: BSD
Group: Applications/Networking
Source0: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
-# Source0-md5: bc04ff77796758c0b37bd0bc9314cd3f
+# Source0-md5: a95119f402dfa0166c9dd1237239085c
Patch0: openssh-no-pty-tests.patch
Patch1: openssh-tests-reuseport.patch
Patch2: openssh-pam_misc.patch
-Patch3: openssh-sigpipe.patch
-# http://pkgs.fedoraproject.org/gitweb/?p=openssh.git;a=tree
-Patch4: openssh-ldap.patch
-Patch5: openssh-ldap-fixes.patch
-Patch6: ldap.conf.patch
Patch7: openssh-config.patch
-Patch8: ldap-helper-sigpipe.patch
-
-Patch11: openssh-chroot.patch
Patch13: openssh-skip-interop-tests.patch
Patch14: openssh-bind.patch
+# the whole point of this package: upstream dropped DSA in 10.0
+Patch100: openssh-dsa.patch
URL: http://www.openssh.com/portable.html
BuildRequires: %{__perl}
BuildRequires: autoconf >= 2.50
BuildRequires: automake
+%{?with_kerberos5:BuildRequires: heimdal-devel >= 0.7}
%{?with_libedit:BuildRequires: libedit-devel}
BuildRequires: libfido2-devel >= 1.5.0
%{?with_libseccomp:BuildRequires: libseccomp-devel}
%{?with_selinux:BuildRequires: libselinux-devel}
-%{?with_ldap:BuildRequires: openldap-devel}
BuildRequires: openssl-devel >= 1.1.1
BuildRequires: pam-devel
%if %{with tests} && %{with tests_conch}
@@ -254,18 +247,12 @@ Ssh (Secure Shell) - це програма для "заходу" (login) до в
%patch -P0 -p1
%patch -P1 -p1
%patch -P2 -p1
-%patch -P3 -p1
-%patch -P4 -p1
-%patch -P5 -p1
-%patch -P6 -p1
%patch -P7 -p1
-%patch -P8 -p1
-
-%patch -P11 -p1
%patch -P13 -p1
%patch -P14 -p1
+%patch -P100 -p1
# hack since arc4random from openbsd-compat needs symbols from libssh and vice versa
sed -i -e 's#-lssh -lopenbsd-compat#-lssh -lopenbsd-compat -lssh -lopenbsd-compat#g' Makefile*
@@ -277,7 +264,7 @@ sed -i -e 's#-lssh -lopenbsd-compat#-lssh -lopenbsd-compat -lssh -lopenbsd-compa
%{__aclocal}
%{__autoconf}
%{__autoheader}
-CPPFLAGS="%{rpmcppflags} -DCHROOT -std=gnu99"
+CPPFLAGS="%{rpmcppflags} -std=gnu99"
%configure \
PERL=%{__perl} \
--disable-strip \
@@ -305,7 +292,10 @@ CPPFLAGS="%{rpmcppflags} -DCHROOT -std=gnu99"
%endif
--with-xauth=%{_bindir}/xauth
-%{__make} ssh scp sftp ssh-keygen ssh-keyscan ssh-keysign
+# scp/sftp exec ssh as their transport; the system one has no DSA,
+# which is the only reason this package exists
+%{__make} ssh scp sftp ssh-keygen ssh-keyscan ssh-keysign \
+ SSH_PROGRAM=%{_bindir}/ssh-legacy
%if %{with tests}
%{__make} -j1 tests \
diff --git a/ldap-helper-sigpipe.patch b/ldap-helper-sigpipe.patch
deleted file mode 100644
index 7808407..0000000
--- a/ldap-helper-sigpipe.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-ignore SIGPIPE from ldap-helper. ssh server does not read whole input if matching key is found
-
-with latest ldap patch from fedora openssh package repo
-(84822b5decc2ddd8415a3167b9ff9f0a368929a3), i encountered bug that if there are
-lots of keys for user and matching key is found near the beginning, the
-ssh-ldap-helper gets sigpipe because apparently sshd server does not read out
-whole output. and that killed by signal is propagated so that whole key auth
-fails.
-
-i'm not sure in which side the fixing should be made, should ldap-helper ignore
-SIGPIPE? should ssh authorizedkeyscommand always read up whole input?
-
-in my case user had only 51 keys outputing ~35k of text:
-# /usr/lib/openssh/ssh-ldap-helper -s git | wc
- 51 251 35685
-
-i think it's quite easy to reproduce:
-- print out matchin key early
-- produce more lines of output
-
-so, here's strace of ssh-ldap-helper being called from ssh-ldap-wrapper:
-
-execve("/usr/lib/openssh/ssh-ldap-helper", ["/usr/lib/openssh/ssh-ldap-helper", "-s", "git"], [/* 13 vars */]) = 0
-access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
-open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
-open("/usr/lib/libldap-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3
-open("/usr/lib/liblber-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
-open("/usr/lib/libsasl2.so.3", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libssl.so.1.0.0", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libcrypto.so.1.0.0", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libpam.so.0", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
-open("/lib/libfreebl3.so", O_RDONLY|O_CLOEXEC) = 3
-open("/dev/null", O_RDWR|O_LARGEFILE) = 4
-open("/etc/ldap.conf", O_RDONLY|O_LARGEFILE) = 4
-open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
-open("/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/host.conf", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/openldap/ldap.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
-open("/tmp/ldaprc", O_RDONLY) = -1 ENOENT (No such file or directory)
-open("/tmp/.ldaprc", O_RDONLY) = -1 ENOENT (No such file or directory)
-stat64("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=247, ...}) = 0
-open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 4
-open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
-open("/lib/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 4
---- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=615, si_uid=99} ---
-+++ killed by SIGPIPE +++
-
-at the same time in the log:
-
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: matching key found: file /usr/lib/openssh/ssh-ldap-wrapper, line 1 DSA 96:a8:6c:5b:42:ad:b4:f3:01:fc:19:38:da:63:0b:37
-Nov 2 18:20:44 gitolite3 sshd[605]: error: AuthorizedKeysCommand /usr/lib/openssh/ssh-ldap-wrapper returned status 141
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: restore_uid: 0/0
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: temporarily_use_uid: 264/264 (e=0/0)
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: trying public key file /home/services/git/.ssh/authorized_keys
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: fd 8 clearing O_NONBLOCK
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: restore_uid: 0/0
-Nov 2 18:20:44 gitolite3 sshd[605]: Failed publickey for git from 127.0.0.1 port 34574 ssh2: DSA 96:a8:6c:5b:42:ad:b4:f3:01:fc:19:38:da:63:0b:37
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: userauth-request for user git service ssh-connection method keyboard-interactive [preauth]
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: attempt 2 failures 1 [preauth]
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: keyboard-interactive devs [preauth]
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: auth2_challenge: user=git devs= [preauth]
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: kbdint_alloc: devices 'pam' [preauth]
-Nov 2 18:20:44 gitolite3 sshd[605]: debug1: auth2_challenge_start: trying authentication method 'pam' [preauth]
-
-there's quick workaround too (without patching),
-instead of "exec ssh-ldap-helper", run it, and "exit 0" from the wrapper
-script. i don't like this solution, but it makes the problem go away:
-
-# cat /usr/lib/openssh/ssh-ldap-wrapper
-#!/bin/sh
-/usr/lib/openssh/ssh-ldap-helper -s "$1"
-exit 0
-
---- openssh-6.6p1/ldap-helper.c~ 2014-05-13 17:04:22.258162978 +0300
-+++ openssh-6.6p1/ldap-helper.c 2014-05-13 17:14:08.398824417 +0300
-@@ -31,6 +31,7 @@
- #include <stdlib.h>
- #include <string.h>
- #include <unistd.h>
-+#include <signal.h>
-
- static int config_debug = 0;
- int config_exclusive_config_file = 0;
-@@ -137,6 +137,8 @@
- ldap_checkconfig();
- ldap_do_connect();
-
-+ signal(SIGPIPE, SIG_IGN);
-+
- if (config_single_user) {
- process_user (config_single_user, outfile);
- } else {
diff --git a/ldap.conf.patch b/ldap.conf.patch
deleted file mode 100644
index 6584785..0000000
--- a/ldap.conf.patch
+++ /dev/null
@@ -1,56 +0,0 @@
---- openssh-5.9p1/./ldap-helper.c~ 2011-09-29 00:38:28.000000000 +0300
-+++ openssh-5.9p1/./ldap-helper.c 2011-09-29 00:54:04.004223268 +0300
-@@ -34,7 +34,7 @@
-
- static int config_debug = 0;
- int config_exclusive_config_file = 0;
--static char *config_file_name = "/etc/ssh/ldap.conf";
-+static char *config_file_name = "/etc/ldap.conf";
- static char *config_single_user = NULL;
- static int config_verbose = SYSLOG_LEVEL_VERBOSE;
- int config_warning_config_file = 0;
-@@ -48,7 +48,7 @@
- fprintf(stderr, "Options:\n");
- fprintf(stderr, " -d Output the log messages to stderr.\n");
- fprintf(stderr, " -e Check the config file for unknown commands.\n");
-- fprintf(stderr, " -f file Use alternate config file (default is /etc/ssh/ldap.conf).\n");
-+ fprintf(stderr, " -f file Use alternate config file (default is /etc/ldap.conf).\n");
- fprintf(stderr, " -s user Do not demonize, send the user's key to stdout.\n");
- fprintf(stderr, " -v Increase verbosity of the debug output (implies -d).\n");
- fprintf(stderr, " -w Warn on unknown commands in the config file.\n");
---- openssh-5.9p1/./ssh-ldap-helper.8~ 2011-09-29 00:38:28.000000000 +0300
-+++ openssh-5.9p1/./ssh-ldap-helper.8 2011-09-29 00:54:14.308032118 +0300
-@@ -56,7 +56,7 @@
- halts if it encounters an unknown item in the ldap.conf file.
- .It Fl f
- .Nm
--uses this file as the ldap configuration file instead of /etc/ssh/ldap.conf (default).
-+uses this file as the ldap configuration file instead of /etc/ldap.conf (default).
- .It Fl s
- .Nm
- prints out the user's keys to stdout and exits.
---- openssh-5.9p1/./ssh-ldap.conf.5~ 2011-09-29 00:38:28.000000000 +0300
-+++ openssh-5.9p1/./ssh-ldap.conf.5 2011-09-29 00:54:40.285897653 +0300
-@@ -21,11 +21,11 @@
- .Nm ssh-ldap.conf
- .Nd configuration file for ssh-ldap-helper
- .Sh SYNOPSIS
--.Nm /etc/ssh/ldap.conf
-+.Nm /etc/ldap.conf
- .Sh DESCRIPTION
- .Xr ssh-ldap-helper 8
- reads configuration data from
--.Pa /etc/ssh/ldap.conf
-+.Pa /etc/ldap.conf
- (or the file specified with
- .Fl f
- on the command line).
-@@ -361,7 +361,7 @@
- .El
- .Sh FILES
- .Bl -tag -width Ds
--.It Pa /etc/ssh/ldap.conf
-+.It Pa /etc/ldap.conf
- Ldap configuration file for
- .Xr ssh-ldap-helper 8 .
- .El
diff --git a/openssh-chroot.patch b/openssh-chroot.patch
deleted file mode 100644
index e2c01a0..0000000
--- a/openssh-chroot.patch
+++ /dev/null
@@ -1,162 +0,0 @@
-diff -ruNp openssh-9.8p1.orig/servconf.c openssh-9.8p1/servconf.c
---- openssh-9.8p1.orig/servconf.c 2024-07-01 06:36:28.000000000 +0200
-+++ openssh-9.8p1/servconf.c 2024-07-01 11:17:17.929993456 +0200
-@@ -94,6 +94,8 @@ initialize_server_options(ServerOptions
- options->use_pam = -1;
- options->pam_service_name = NULL;
-
-+ options->use_chroot = -1;
-+
- /* Standard Options */
- options->num_ports = 0;
- options->ports_from_cmdline = 0;
-@@ -299,6 +301,9 @@ fill_default_server_options(ServerOption
- if (options->pam_service_name == NULL)
- options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
-
-+ if (options->use_chroot == -1)
-+ options->use_chroot = 0;
-+
- /* Standard Options */
- if (options->num_host_key_files == 0) {
- /* fill default hostkeys for protocols */
-@@ -538,6 +543,7 @@ typedef enum {
- sBadOption, /* == unknown option */
- /* Portable-specific options */
- sUsePAM, sPAMServiceName,
-+ sUseChroot,
- /* Standard Options */
- sPort, sHostKeyFile, sLoginGraceTime,
- sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
-@@ -595,6 +601,11 @@ static struct {
- { "usepam", sUnsupported, SSHCFG_GLOBAL },
- { "pamservicename", sUnsupported, SSHCFG_ALL },
- #endif
-+#ifdef CHROOT
-+ { "usechroot", sUseChroot, SSHCFG_GLOBAL },
-+#else
-+ { "usechroot", sUnsupported, SSHCFG_GLOBAL },
-+#endif /* CHROOT */
- { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
- /* Standard Options */
- { "port", sPort, SSHCFG_GLOBAL },
-@@ -1338,6 +1349,10 @@ process_server_config_line_depth(ServerO
- *charptr = xstrdup(arg);
- break;
-
-+ case sUseChroot:
-+ intptr = &options->use_chroot;
-+ goto parse_flag;
-+
- /* Standard Options */
- case sBadOption:
- goto out;
-diff -urNp -x '*.orig' openssh-8.8p1.org/servconf.h openssh-8.8p1/servconf.h
---- openssh-8.8p1.org/servconf.h 2021-09-26 16:03:19.000000000 +0200
-+++ openssh-8.8p1/servconf.h 2021-12-09 20:13:16.486586503 +0100
-@@ -183,6 +183,7 @@ typedef struct {
- int max_authtries;
- int max_sessions;
- char *banner; /* SSH-2 banner message */
-+ int use_chroot; /* Enable chrooted enviroment support */
- int use_dns;
- int client_alive_interval; /*
- * poke the client this often to
-diff -urNp -x '*.orig' openssh-8.8p1.org/session.c openssh-8.8p1/session.c
---- openssh-8.8p1.org/session.c 2021-09-26 16:03:19.000000000 +0200
-+++ openssh-8.8p1/session.c 2021-12-09 20:13:16.489919836 +0100
-@@ -1359,6 +1359,10 @@ void
- do_setusercontext(struct passwd *pw)
- {
- char uidstr[32], *chroot_path, *tmp;
-+#ifdef CHROOT
-+ char *user_dir;
-+ char *new_root;
-+#endif /* CHROOT */
-
- platform_setusercontext(pw);
-
-@@ -1401,6 +1405,29 @@ do_setusercontext(struct passwd *pw)
- free(options.chroot_directory);
- options.chroot_directory = NULL;
- in_chroot = 1;
-+#ifdef CHROOT
-+ } else if (!in_chroot && options.use_chroot) {
-+ user_dir = xstrdup(pw->pw_dir);
-+ new_root = user_dir + 1;
-+
-+ while ((new_root = strchr(new_root, '.')) != NULL) {
-+ new_root--;
-+ if (strncmp(new_root, "/./", 3) == 0) {
-+ *new_root = '\0';
-+ new_root += 2;
-+
-+ if (chroot(user_dir) != 0)
-+ fatal("Couldn't chroot to user directory %s", user_dir);
-+ /* NOTE: session->pw comes from pwcopy(), so replace pw_dir this way (incompatible with plain getpwnam() or getpwnam_r()) */
-+ free(pw->pw_dir);
-+ pw->pw_dir = xstrdup(new_root);
-+ in_chroot = 1;
-+ break;
-+ }
-+ new_root += 2;
-+ }
-+ free(user_dir);
-+#endif /* CHROOT */
- }
-
- #ifdef HAVE_LOGIN_CAP
-diff -urNp -x '*.orig' openssh-8.8p1.org/sshd_config openssh-8.8p1/sshd_config
---- openssh-8.8p1.org/sshd_config 2021-12-09 20:13:16.326586503 +0100
-+++ openssh-8.8p1/sshd_config 2021-12-09 20:13:16.489919836 +0100
-@@ -85,6 +85,10 @@ GSSAPIAuthentication yes
- # and KbdInteractiveAuthentication to 'no'.
- #UsePAM no
-
-+# Set this to 'yes' to enable support for chrooted user environment.
-+# You must create such environment before you can use this feature.
-+#UseChroot yes
-+
- #AllowAgentForwarding yes
- #AllowTcpForwarding yes
- #GatewayPorts no
-diff -urNp -x '*.orig' openssh-8.8p1.org/sshd_config.0 openssh-8.8p1/sshd_config.0
---- openssh-8.8p1.org/sshd_config.0 2021-09-26 16:06:42.000000000 +0200
-+++ openssh-8.8p1/sshd_config.0 2021-12-09 20:13:16.489919836 +0100
-@@ -1053,6 +1053,16 @@ DESCRIPTION
- open channels. This option may be useful in conjunction with
- ChannelTimeout.
-
-+ UseChroot
-+ Specifies whether to use chroot-jail environment with ssh/sftp,
-+ i.e. restrict users to a particular area in the filesystem. This
-+ is done by setting user home directory to, for example,
-+ /path/to/chroot/./home/username. sshd looks for a '.' in the
-+ users home directory, then calls chroot(2) to whatever directory
-+ was before the . and continues with the normal ssh functionality.
-+ For this to work properly you have to create special chroot-jail
-+ environment in a /path/to/chroot directory.
-+
- UseDNS Specifies whether sshd(8) should look up the remote host name,
- and to check that the resolved host name for the remote IP
- address maps back to the very same IP address.
-diff -urNp -x '*.orig' openssh-8.8p1.org/sshd_config.5 openssh-8.8p1/sshd_config.5
---- openssh-8.8p1.org/sshd_config.5 2021-09-26 16:03:19.000000000 +0200
-+++ openssh-8.8p1/sshd_config.5 2021-12-09 20:13:16.489919836 +0100
-@@ -1697,6 +1697,16 @@ Gives the facility code that is used whe
- The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
- LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
- The default is AUTH.
-+.It Cm UseChroot
-+Specifies whether to use chroot-jail environment with ssh/sftp, i.e. restrict
-+users to a particular area in the filesystem. This is done by setting user
-+home directory to, for example, /path/to/chroot/./home/username.
-+.Nm sshd
-+looks for a '.' in the users home directory, then calls
-+.Xr chroot 2
-+to whatever directory was before the . and continues with the normal ssh
-+functionality. For this to work properly you have to create special chroot-jail
-+environment in a /path/to/chroot directory.
- .It Cm TCPKeepAlive
- Specifies whether the system should send TCP keepalive messages to the
- other side.
diff --git a/openssh-dsa.patch b/openssh-dsa.patch
new file mode 100644
index 0000000..2c38732
--- /dev/null
+++ b/openssh-dsa.patch
@@ -0,0 +1,1153 @@
+Restore DSA (ssh-dss) support, removed upstream in 10.0.
+
+Reverse of upstream a32d28d79256 plus the --enable-dsa-keys configure knob,
+which upstream dropped in a separate commit. Everything stays behind
+WITH_DSA, so a build without --enable-dsa-keys is unaffected.
+
+Rebasing this against a new release: reverse-apply
+https://github.com/openssh/openssh-portable/commit/a32d28d79256.patch and
+re-add the configure.ac hunks below; the rest is context drift.
+
+--- openssh-10.5p1.orig/ssh-dss.c 2026-09-03 17:59:28.199664554 +0200
++++ openssh-10.5p1/ssh-dss.c 2026-09-03 17:25:34.368593374 +0200
+@@ -0,0 +1,457 @@
++/* $OpenBSD: ssh-dss.c,v 1.50 2024/01/11 01:45:36 djm Exp $ */
++/*
++ * Copyright (c) 2000 Markus Friedl. All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ * notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ * notice, this list of conditions and the following disclaimer in the
++ * documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++#include "includes.h"
++
++#if defined(WITH_OPENSSL) && defined(WITH_DSA)
++
++#include <sys/types.h>
++
++#include <openssl/bn.h>
++#include <openssl/dsa.h>
++#include <openssl/evp.h>
++
++#include <stdarg.h>
++#include <string.h>
++
++#include "sshbuf.h"
++#include "ssherr.h"
++#include "digest.h"
++#define SSHKEY_INTERNAL
++#include "sshkey.h"
++
++#include "openbsd-compat/openssl-compat.h"
++
++#define INTBLOB_LEN 20
++#define SIGBLOB_LEN (2*INTBLOB_LEN)
++
++static u_int
++ssh_dss_size(const struct sshkey *key)
++{
++ const BIGNUM *dsa_p;
++
++ if (key->dsa == NULL)
++ return 0;
++ DSA_get0_pqg(key->dsa, &dsa_p, NULL, NULL);
++ return BN_num_bits(dsa_p);
++}
++
++static int
++ssh_dss_alloc(struct sshkey *k)
++{
++ if ((k->dsa = DSA_new()) == NULL)
++ return SSH_ERR_ALLOC_FAIL;
++ return 0;
++}
++
++static void
++ssh_dss_cleanup(struct sshkey *k)
++{
++ DSA_free(k->dsa);
++ k->dsa = NULL;
++}
++
++static int
++ssh_dss_equal(const struct sshkey *a, const struct sshkey *b)
++{
++ const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a;
++ const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b;
++
++ if (a->dsa == NULL || b->dsa == NULL)
++ return 0;
++ DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a);
++ DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b);
++ DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL);
++ DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL);
++ if (dsa_p_a == NULL || dsa_p_b == NULL ||
++ dsa_q_a == NULL || dsa_q_b == NULL ||
++ dsa_g_a == NULL || dsa_g_b == NULL ||
++ dsa_pub_key_a == NULL || dsa_pub_key_b == NULL)
++ return 0;
++ if (BN_cmp(dsa_p_a, dsa_p_b) != 0)
++ return 0;
++ if (BN_cmp(dsa_q_a, dsa_q_b) != 0)
++ return 0;
++ if (BN_cmp(dsa_g_a, dsa_g_b) != 0)
++ return 0;
++ if (BN_cmp(dsa_pub_key_a, dsa_pub_key_b) != 0)
++ return 0;
++ return 1;
++}
++
++static int
++ssh_dss_serialize_public(const struct sshkey *key, struct sshbuf *b,
++ enum sshkey_serialize_rep opts)
++{
++ int r;
++ const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
++
++ if (key->dsa == NULL)
++ return SSH_ERR_INVALID_ARGUMENT;
++ DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g);
++ DSA_get0_key(key->dsa, &dsa_pub_key, NULL);
++ if (dsa_p == NULL || dsa_q == NULL ||
++ dsa_g == NULL || dsa_pub_key == NULL)
++ return SSH_ERR_INTERNAL_ERROR;
++ if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 ||
++ (r = sshbuf_put_bignum2(b, dsa_q)) != 0 ||
++ (r = sshbuf_put_bignum2(b, dsa_g)) != 0 ||
++ (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0)
++ return r;
++
++ return 0;
++}
++
++static int
++ssh_dss_serialize_private(const struct sshkey *key, struct sshbuf *b,
++ enum sshkey_serialize_rep opts)
++{
++ int r;
++ const BIGNUM *dsa_priv_key;
++
++ DSA_get0_key(key->dsa, NULL, &dsa_priv_key);
++ if (!sshkey_is_cert(key)) {
++ if ((r = ssh_dss_serialize_public(key, b, opts)) != 0)
++ return r;
++ }
++ if ((r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0)
++ return r;
++
++ return 0;
++}
++
++static int
++ssh_dss_generate(struct sshkey *k, int bits)
++{
++ DSA *private;
++
++ if (bits != 1024)
++ return SSH_ERR_KEY_LENGTH;
++ if ((private = DSA_new()) == NULL)
++ return SSH_ERR_ALLOC_FAIL;
++ if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
++ NULL, NULL) || !DSA_generate_key(private)) {
++ DSA_free(private);
++ return SSH_ERR_LIBCRYPTO_ERROR;
++ }
++ k->dsa = private;
++ return 0;
++}
++
++static int
++ssh_dss_copy_public(const struct sshkey *from, struct sshkey *to)
++{
++ const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
++ BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL;
++ BIGNUM *dsa_pub_key_dup = NULL;
++ int r = SSH_ERR_INTERNAL_ERROR;
++
++ DSA_get0_pqg(from->dsa, &dsa_p, &dsa_q, &dsa_g);
++ DSA_get0_key(from->dsa, &dsa_pub_key, NULL);
++ if ((dsa_p_dup = BN_dup(dsa_p)) == NULL ||
++ (dsa_q_dup = BN_dup(dsa_q)) == NULL ||
++ (dsa_g_dup = BN_dup(dsa_g)) == NULL ||
++ (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) {
++ r = SSH_ERR_ALLOC_FAIL;
++ goto out;
++ }
++ if (!DSA_set0_pqg(to->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) {
++ r = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++ dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */
++ if (!DSA_set0_key(to->dsa, dsa_pub_key_dup, NULL)) {
++ r = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++ dsa_pub_key_dup = NULL; /* transferred */
++ /* success */
++ r = 0;
++ out:
++ BN_clear_free(dsa_p_dup);
++ BN_clear_free(dsa_q_dup);
++ BN_clear_free(dsa_g_dup);
++ BN_clear_free(dsa_pub_key_dup);
++ return r;
++}
++
++static int
++ssh_dss_deserialize_public(const char *ktype, struct sshbuf *b,
++ struct sshkey *key)
++{
++ int ret = SSH_ERR_INTERNAL_ERROR;
++ BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL;
++
++ if (sshbuf_get_bignum2(b, &dsa_p) != 0 ||
++ sshbuf_get_bignum2(b, &dsa_q) != 0 ||
++ sshbuf_get_bignum2(b, &dsa_g) != 0 ||
++ sshbuf_get_bignum2(b, &dsa_pub_key) != 0) {
++ ret = SSH_ERR_INVALID_FORMAT;
++ goto out;
++ }
++ if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) {
++ ret = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++ dsa_p = dsa_q = dsa_g = NULL; /* transferred */
++ if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) {
++ ret = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++ dsa_pub_key = NULL; /* transferred */
++#ifdef DEBUG_PK
++ DSA_print_fp(stderr, key->dsa, 8);
++#endif
++ /* success */
++ ret = 0;
++ out:
++ BN_clear_free(dsa_p);
++ BN_clear_free(dsa_q);
++ BN_clear_free(dsa_g);
++ BN_clear_free(dsa_pub_key);
++ return ret;
++}
++
++static int
++ssh_dss_deserialize_private(const char *ktype, struct sshbuf *b,
++ struct sshkey *key)
++{
++ int r;
++ BIGNUM *dsa_priv_key = NULL;
++
++ if (!sshkey_is_cert(key)) {
++ if ((r = ssh_dss_deserialize_public(ktype, b, key)) != 0)
++ return r;
++ }
++
++ if ((r = sshbuf_get_bignum2(b, &dsa_priv_key)) != 0)
++ return r;
++ if (!DSA_set0_key(key->dsa, NULL, dsa_priv_key)) {
++ BN_clear_free(dsa_priv_key);
++ return SSH_ERR_LIBCRYPTO_ERROR;
++ }
++ return 0;
++}
++
++static int
++ssh_dss_sign(struct sshkey *key,
++ u_char **sigp, size_t *lenp,
++ const u_char *data, size_t datalen,
++ const char *alg, const char *sk_provider, const char *sk_pin, u_int compat)
++{
++ DSA_SIG *sig = NULL;
++ const BIGNUM *sig_r, *sig_s;
++ u_char digest[SSH_DIGEST_MAX_LENGTH], sigblob[SIGBLOB_LEN];
++ size_t rlen, slen, len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
++ struct sshbuf *b = NULL;
++ int ret = SSH_ERR_INVALID_ARGUMENT;
++
++ if (lenp != NULL)
++ *lenp = 0;
++ if (sigp != NULL)
++ *sigp = NULL;
++
++ if (key == NULL || key->dsa == NULL ||
++ sshkey_type_plain(key->type) != KEY_DSA)
++ return SSH_ERR_INVALID_ARGUMENT;
++ if (dlen == 0)
++ return SSH_ERR_INTERNAL_ERROR;
++
++ if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
++ digest, sizeof(digest))) != 0)
++ goto out;
++
++ if ((sig = DSA_do_sign(digest, dlen, key->dsa)) == NULL) {
++ ret = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++
++ DSA_SIG_get0(sig, &sig_r, &sig_s);
++ rlen = BN_num_bytes(sig_r);
++ slen = BN_num_bytes(sig_s);
++ if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
++ ret = SSH_ERR_INTERNAL_ERROR;
++ goto out;
++ }
++ explicit_bzero(sigblob, SIGBLOB_LEN);
++ BN_bn2bin(sig_r, sigblob + SIGBLOB_LEN - INTBLOB_LEN - rlen);
++ BN_bn2bin(sig_s, sigblob + SIGBLOB_LEN - slen);
++
++ if ((b = sshbuf_new()) == NULL) {
++ ret = SSH_ERR_ALLOC_FAIL;
++ goto out;
++ }
++ if ((ret = sshbuf_put_cstring(b, "ssh-dss")) != 0 ||
++ (ret = sshbuf_put_string(b, sigblob, SIGBLOB_LEN)) != 0)
++ goto out;
++
++ len = sshbuf_len(b);
++ if (sigp != NULL) {
++ if ((*sigp = malloc(len)) == NULL) {
++ ret = SSH_ERR_ALLOC_FAIL;
++ goto out;
++ }
++ memcpy(*sigp, sshbuf_ptr(b), len);
++ }
++ if (lenp != NULL)
++ *lenp = len;
++ ret = 0;
++ out:
++ explicit_bzero(digest, sizeof(digest));
++ DSA_SIG_free(sig);
++ sshbuf_free(b);
++ return ret;
++}
++
++static int
++ssh_dss_verify(const struct sshkey *key,
++ const u_char *sig, size_t siglen,
++ const u_char *data, size_t dlen, const char *alg, u_int compat,
++ struct sshkey_sig_details **detailsp)
++{
++ DSA_SIG *dsig = NULL;
++ BIGNUM *sig_r = NULL, *sig_s = NULL;
++ u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob = NULL;
++ size_t len, hlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
++ int ret = SSH_ERR_INTERNAL_ERROR;
++ struct sshbuf *b = NULL;
++ char *ktype = NULL;
++
++ if (key == NULL || key->dsa == NULL ||
++ sshkey_type_plain(key->type) != KEY_DSA ||
++ sig == NULL || siglen == 0)
++ return SSH_ERR_INVALID_ARGUMENT;
++ if (hlen == 0)
++ return SSH_ERR_INTERNAL_ERROR;
++
++ /* fetch signature */
++ if ((b = sshbuf_from(sig, siglen)) == NULL)
++ return SSH_ERR_ALLOC_FAIL;
++ if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
++ sshbuf_get_string(b, &sigblob, &len) != 0) {
++ ret = SSH_ERR_INVALID_FORMAT;
++ goto out;
++ }
++ if (strcmp("ssh-dss", ktype) != 0) {
++ ret = SSH_ERR_KEY_TYPE_MISMATCH;
++ goto out;
++ }
++ if (sshbuf_len(b) != 0) {
++ ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
++ goto out;
++ }
++
++ if (len != SIGBLOB_LEN) {
++ ret = SSH_ERR_INVALID_FORMAT;
++ goto out;
++ }
++
++ /* parse signature */
++ if ((dsig = DSA_SIG_new()) == NULL ||
++ (sig_r = BN_new()) == NULL ||
++ (sig_s = BN_new()) == NULL) {
++ ret = SSH_ERR_ALLOC_FAIL;
++ goto out;
++ }
++ if ((BN_bin2bn(sigblob, INTBLOB_LEN, sig_r) == NULL) ||
++ (BN_bin2bn(sigblob + INTBLOB_LEN, INTBLOB_LEN, sig_s) == NULL)) {
++ ret = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++ if (!DSA_SIG_set0(dsig, sig_r, sig_s)) {
++ ret = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++ sig_r = sig_s = NULL; /* transferred */
++
++ /* sha1 the data */
++ if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, dlen,
++ digest, sizeof(digest))) != 0)
++ goto out;
++
++ switch (DSA_do_verify(digest, hlen, dsig, key->dsa)) {
++ case 1:
++ ret = 0;
++ break;
++ case 0:
++ ret = SSH_ERR_SIGNATURE_INVALID;
++ goto out;
++ default:
++ ret = SSH_ERR_LIBCRYPTO_ERROR;
++ goto out;
++ }
++
++ out:
++ explicit_bzero(digest, sizeof(digest));
++ DSA_SIG_free(dsig);
++ BN_clear_free(sig_r);
++ BN_clear_free(sig_s);
++ sshbuf_free(b);
++ free(ktype);
++ if (sigblob != NULL)
++ freezero(sigblob, len);
++ return ret;
++}
++
++static const struct sshkey_impl_funcs sshkey_dss_funcs = {
++ /* .size = */ ssh_dss_size,
++ /* .alloc = */ ssh_dss_alloc,
++ /* .cleanup = */ ssh_dss_cleanup,
++ /* .equal = */ ssh_dss_equal,
++ /* .ssh_serialize_public = */ ssh_dss_serialize_public,
++ /* .ssh_deserialize_public = */ ssh_dss_deserialize_public,
++ /* .ssh_serialize_private = */ ssh_dss_serialize_private,
++ /* .ssh_deserialize_private = */ ssh_dss_deserialize_private,
++ /* .generate = */ ssh_dss_generate,
++ /* .copy_public = */ ssh_dss_copy_public,
++ /* .sign = */ ssh_dss_sign,
++ /* .verify = */ ssh_dss_verify,
++};
++
++const struct sshkey_impl sshkey_dss_impl = {
++ /* .name = */ "ssh-dss",
++ /* .shortname = */ "DSA",
++ /* .sigalg = */ NULL,
++ /* .type = */ KEY_DSA,
++ /* .nid = */ 0,
++ /* .cert = */ 0,
++ /* .sigonly = */ 0,
++ /* .keybits = */ 0,
++ /* .funcs = */ &sshkey_dss_funcs,
++};
++
++const struct sshkey_impl sshkey_dsa_cert_impl = {
++ /* .name = */ "ssh-dss-cert-v01 at openssh.com",
++ /* .shortname = */ "DSA-CERT",
++ /* .sigalg = */ NULL,
++ /* .type = */ KEY_DSA_CERT,
++ /* .nid = */ 0,
++ /* .cert = */ 1,
++ /* .sigonly = */ 0,
++ /* .keybits = */ 0,
++ /* .funcs = */ &sshkey_dss_funcs,
++};
++
++#endif /* WITH_OPENSSL && WITH_DSA */
+--- openssh-10.5p1.orig/Makefile.in 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/Makefile.in 2026-09-03 17:52:29.113757934 +0200
+@@ -96,7 +96,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ log.o match.o moduli.o nchan.o packet.o \
+ readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \
+ atomicio.o dispatch.o mac.o misc.o utf8.o \
+- monitor_fdpass.o rijndael.o ssh-ecdsa.o ssh-ecdsa-sk.o \
++ monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
+ ssh-ed25519-sk.o ssh-rsa.o dh.o \
+ msg.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+ smult_curve25519_ref.o \
+--- openssh-10.5p1.orig/PROTOCOL 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/PROTOCOL 2026-09-03 17:25:34.366074290 +0200
+@@ -691,15 +691,15 @@ authorized_keys files, are formatted as
+ of the public key algorithm name followed by a base64-encoded key blob.
+ The public key blob (before base64 encoding) is the same format used for
+ the encoding of public keys sent on the wire: as described in RFC4253
+-section 6.6 for RSA keys, RFC5656 section 3.1 for ECDSA keys and
+-https://datatracker.ietf.org/doc/draft-miller-ssh-cert/
+-for the OpenSSH certificate formats.
++section 6.6 for RSA and DSA keys, RFC5656 section 3.1 for ECDSA keys
++and the "New public key formats" section of PROTOCOL.certkeys for the
++OpenSSH certificate formats.
+
+ 5.2 Private key format
+
+ OpenSSH private keys, as generated by ssh-keygen(1) use the format
+ described in PROTOCOL.key by default. As a legacy option, PEM format
+-(RFC7468) private keys are also supported for RSA and ECDSA keys
++(RFC7468) private keys are also supported for RSA, DSA and ECDSA keys
+ and were the default format before OpenSSH 7.8.
+
+ 5.3 KRL format
+--- openssh-10.5p1.orig/TODO 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/TODO 2026-09-03 17:25:34.366210251 +0200
+@@ -7,7 +7,7 @@ Documentation:
+
+ - Install FAQ?
+
+-- General FAQ on S/Key, TIS, RSA, RSA2, etc and suggestions on when it
++- General FAQ on S/Key, TIS, RSA, RSA2, DSA, etc and suggestions on when it
+ would be best to use them.
+
+ - Create a Documentation/ directory?
+--- openssh-10.5p1.orig/authfd.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/authfd.c 2026-09-03 17:25:34.366316955 +0200
+@@ -601,6 +601,8 @@ ssh_add_identity_constrained(int sock, s
+ #ifdef WITH_OPENSSL
+ case KEY_RSA:
+ case KEY_RSA_CERT:
++ case KEY_DSA:
++ case KEY_DSA_CERT:
+ case KEY_ECDSA:
+ case KEY_ECDSA_CERT:
+ case KEY_ECDSA_SK:
+--- openssh-10.5p1.orig/authfile.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/authfile.c 2026-09-03 17:25:34.366462630 +0200
+@@ -324,6 +324,7 @@ sshkey_load_private_cert(int type, const
+ switch (type) {
+ #ifdef WITH_OPENSSL
+ case KEY_RSA:
++ case KEY_DSA:
+ case KEY_ECDSA:
+ #endif /* WITH_OPENSSL */
+ case KEY_ED25519:
+--- openssh-10.5p1.orig/configure.ac 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/configure.ac 2026-09-03 17:54:21.967977235 +0200
+@@ -2306,6 +2306,16 @@ AC_ARG_WITH([security-key-builtin],
+ [ enable_sk_internal=$withval ]
+ )
+
++enable_dsa=
++AC_ARG_ENABLE([dsa-keys],
++ [ --enable-dsa-keys enable DSA key support [no]],
++ [
++ if test "x$enableval" != "xno" ; then
++ enable_dsa=1
++ fi
++ ]
++)
++
+ enable_sk_standalone=
+ AC_ARG_WITH([security-key-standalone],
+ [ --with-security-key-standalone build standalone sk-libfido2 SecurityKeyProvider],
+@@ -3227,6 +3237,7 @@ if test "x$openssl" = "xyes" ; then
+ AC_CHECK_FUNCS([ \
+ BN_is_prime_ex \
+ DES_crypt \
++ DSA_generate_parameters_ex \
+ EVP_DigestSign \
+ EVP_DigestVerify \
+ EVP_DigestFinal_ex \
+@@ -3365,6 +3376,26 @@ if test "x$openssl" = "xyes" ; then
+ ;;
+ esac
+
++
++ openssl_dsa=no
++ if test ! -z "$enable_dsa" ; then
++ AC_CHECK_DECLS([OPENSSL_NO_DSA], [], [
++ AC_CHECK_DECLS([OPENSSL_IS_BORINGSSL], [],
++ [ openssl_dsa=yes ],
++ [ #include <openssl/opensslconf.h> ]
++ )
++ ],
++ [ #include <openssl/opensslconf.h> ]
++ )
++ AC_MSG_CHECKING([whether to enable DSA key support])
++ if test "x$openssl_dsa" = "xno"; then
++ AC_MSG_ERROR([DSA requested but not supported by OpenSSL])
++ else
++ AC_MSG_RESULT([yes])
++ AC_DEFINE([WITH_DSA], [1],
++ [DSA keys explicitly enabled])
++ fi
++ fi
+ fi
+
+ # PKCS11/U2F depend on OpenSSL and dlopen().
+--- openssh-10.5p1.orig/contrib/cygwin/ssh-user-config 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/contrib/cygwin/ssh-user-config 2026-09-03 17:25:34.367207621 +0200
+@@ -246,8 +246,9 @@ done
+ check_user_homedir
+ check_user_dot_ssh_dir
+ create_identity id_rsa rsa "SSH2 RSA"
+-create_identity id_ed25519 ed25519 "SSH2 Ed25519"
++create_identity id_dsa dsa "SSH2 DSA"
+ create_identity id_ecdsa ecdsa "SSH2 ECDSA"
++create_identity identity rsa1 "(deprecated) SSH1 RSA"
+ fix_authorized_keys_perms
+
+ echo
+--- openssh-10.5p1.orig/dns.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/dns.c 2026-09-03 17:25:34.367307221 +0200
+@@ -87,6 +87,9 @@ dns_read_key(uint8_t *algorithm, uint8_t
+ case KEY_RSA:
+ *algorithm = SSHFP_KEY_RSA;
+ break;
++ case KEY_DSA:
++ *algorithm = SSHFP_KEY_DSA;
++ break;
+ case KEY_ECDSA:
+ *algorithm = SSHFP_KEY_ECDSA;
+ break;
+--- openssh-10.5p1.orig/hostfile.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/hostfile.c 2026-09-03 17:25:34.367461153 +0200
+@@ -150,8 +150,8 @@ host_hash(const char *host, const char *
+ }
+
+ /*
+- * Parses an RSA key from a string. Moves the pointer over the key.
+- * Skips any whitespace at the beginning and at end.
++ * Parses an RSA (number of bits, e, n) or DSA key from a string. Moves the
++ * pointer over the key. Skips any whitespace at the beginning and at end.
+ */
+
+ int
+--- openssh-10.5p1.orig/openbsd-compat/openssl-compat.h 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/openbsd-compat/openssl-compat.h 2026-09-03 17:25:34.367591063 +0200
+@@ -43,6 +43,9 @@ int ssh_libcrypto_init(void);
+ #ifndef OPENSSL_RSA_MAX_MODULUS_BITS
+ # define OPENSSL_RSA_MAX_MODULUS_BITS 16384
+ #endif
++#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
++# define OPENSSL_DSA_MAX_MODULUS_BITS 10000
++#endif
+
+ #ifdef LIBRESSL_VERSION_NUMBER
+ # if LIBRESSL_VERSION_NUMBER < 0x3010000fL
+--- openssh-10.5p1.orig/pathnames.h 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/pathnames.h 2026-09-03 17:52:29.113572140 +0200
+@@ -36,6 +36,7 @@
+ */
+ #define _PATH_SERVER_CONFIG_FILE SSHDIR "/sshd_config"
+ #define _PATH_HOST_CONFIG_FILE SSHDIR "/ssh_config"
++#define _PATH_HOST_DSA_KEY_FILE SSHDIR "/ssh_host_dsa_key"
+ #define _PATH_HOST_ECDSA_KEY_FILE SSHDIR "/ssh_host_ecdsa_key"
+ #define _PATH_HOST_RSA_KEY_FILE SSHDIR "/ssh_host_rsa_key"
+ #define _PATH_HOST_ED25519_KEY_FILE SSHDIR "/ssh_host_ed25519_key"
+@@ -86,6 +87,7 @@
+ * Name of the default file containing client-side authentication key. This
+ * file should only be readable by the user him/herself.
+ */
++#define _PATH_SSH_CLIENT_ID_DSA _PATH_SSH_USER_DIR "/id_dsa"
+ #define _PATH_SSH_CLIENT_ID_ECDSA _PATH_SSH_USER_DIR "/id_ecdsa"
+ #define _PATH_SSH_CLIENT_ID_RSA _PATH_SSH_USER_DIR "/id_rsa"
+ #define _PATH_SSH_CLIENT_ID_ED25519 _PATH_SSH_USER_DIR "/id_ed25519"
+--- openssh-10.5p1.orig/readconf.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/readconf.c 2026-09-03 17:53:47.033890585 +0200
+@@ -2917,6 +2917,9 @@ fill_default_options(Options * options)
+ }
+ if (options->num_identity_files == 0) {
+ add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_RSA, 0);
++#ifdef WITH_DSA
++ add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_DSA, 0);
++#endif
+ add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_ECDSA, 0);
+ add_identity_file(options, "~/",
+ _PATH_SSH_CLIENT_ID_ECDSA_SK, 0);
+--- openssh-10.5p1.orig/ssh-add.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/ssh-add.c 2026-09-03 17:53:47.034747034 +0200
+@@ -80,6 +80,9 @@ extern char *__progname;
+ static char *default_files[] = {
+ #ifdef WITH_OPENSSL
+ _PATH_SSH_CLIENT_ID_RSA,
++#ifdef WITH_DSA
++ _PATH_SSH_CLIENT_ID_DSA,
++#endif
+ _PATH_SSH_CLIENT_ID_ECDSA,
+ _PATH_SSH_CLIENT_ID_ECDSA_SK,
+ #endif /* WITH_OPENSSL */
+--- openssh-10.5p1.orig/ssh-keygen.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/ssh-keygen.c 2026-09-03 17:54:21.863142098 +0200
+@@ -70,14 +70,18 @@
+ #define DEFAULT_KEY_TYPE_NAME "ed25519"
+
+ /*
+- * Default number of bits in the RSA and ECDSA keys. These value can be
++ * Default number of bits in the RSA, DSA and ECDSA keys. These value can be
+ * overridden on the command line.
+ *
+- * These values provide security equivalent to at least 128 bits of security
+- * according to NIST Special Publication 800-57: Recommendation for Key
+- * Management Part 1 rev 4 section 5.6.1.
++ * These values, with the exception of DSA, provide security equivalent to at
++ * least 128 bits of security according to NIST Special Publication 800-57:
++ * Recommendation for Key Management Part 1 rev 4 section 5.6.1.
++ * For DSA it (and FIPS-186-4 section 4.2) specifies that the only size for
++ * which a 160bit hash is acceptable is 1kbit, and since ssh-dss specifies only
++ * SHA1 we limit the DSA key size 1k bits.
+ */
+ #define DEFAULT_BITS 3072
++#define DEFAULT_BITS_DSA 1024
+ #define DEFAULT_BITS_ECDSA 256
+
+ static int quiet = 0;
+@@ -181,6 +185,9 @@ type_bits_valid(int type, const char *na
+ int nid;
+
+ switch(type) {
++ case KEY_DSA:
++ *bitsp = DEFAULT_BITS_DSA;
++ break;
+ case KEY_ECDSA:
+ if (name != NULL &&
+ (nid = sshkey_ecdsa_nid_from_name(name)) > 0)
+@@ -196,6 +203,10 @@ type_bits_valid(int type, const char *na
+ }
+ #ifdef WITH_OPENSSL
+ switch (type) {
++ case KEY_DSA:
++ if (*bitsp != 1024)
++ fatal("Invalid DSA key length: must be 1024 bits");
++ break;
+ case KEY_RSA:
+ if (*bitsp < SSH_RSA_MINIMUM_MODULUS_SIZE)
+ fatal("Invalid RSA key length: minimum is %d bits",
+@@ -246,6 +257,12 @@ ask_filename(struct passwd *pw, const ch
+ name = _PATH_SSH_CLIENT_ID_ED25519;
+ else {
+ switch (sshkey_type_from_shortname(key_type_name)) {
++#ifdef WITH_DSA
++ case KEY_DSA_CERT:
++ case KEY_DSA:
++ name = _PATH_SSH_CLIENT_ID_DSA;
++ break;
++#endif
+ case KEY_ECDSA_CERT:
+ case KEY_ECDSA:
+ name = _PATH_SSH_CLIENT_ID_ECDSA;
+@@ -357,6 +374,12 @@ do_convert_to_pkcs8(struct sshkey *k)
+ EVP_PKEY_get0_RSA(k->pkey)))
+ fatal("PEM_write_RSA_PUBKEY failed");
+ break;
++#ifdef WITH_DSA
++ case KEY_DSA:
++ if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
++ fatal("PEM_write_DSA_PUBKEY failed");
++ break;
++#endif
+ case KEY_ECDSA:
+ if (!PEM_write_EC_PUBKEY(stdout,
+ EVP_PKEY_get0_EC_KEY(k->pkey)))
+@@ -376,6 +399,12 @@ do_convert_to_pem(struct sshkey *k)
+ EVP_PKEY_get0_RSA(k->pkey)))
+ fatal("PEM_write_RSAPublicKey failed");
+ break;
++#ifdef WITH_DSA
++ case KEY_DSA:
++ if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
++ fatal("PEM_write_DSA_PUBKEY failed");
++ break;
++#endif
+ case KEY_ECDSA:
+ if (!PEM_write_EC_PUBKEY(stdout,
+ EVP_PKEY_get0_EC_KEY(k->pkey)))
+@@ -447,6 +476,10 @@ do_convert_private_ssh2(struct sshbuf *b
+ u_int magic, i1, i2, i3, i4;
+ size_t slen;
+ u_long e;
++#ifdef WITH_DSA
++ BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL;
++ BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL;
++#endif
+ BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;
+ BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL;
+ BIGNUM *rsa_dmp1 = NULL, *rsa_dmq1 = NULL;
+@@ -478,6 +511,10 @@ do_convert_private_ssh2(struct sshbuf *b
+
+ if (strstr(type, "rsa")) {
+ ktype = KEY_RSA;
++#ifdef WITH_DSA
++ } else if (strstr(type, "dsa")) {
++ ktype = KEY_DSA;
++#endif
+ } else {
+ free(type);
+ return NULL;
+@@ -487,6 +524,27 @@ do_convert_private_ssh2(struct sshbuf *b
+ free(type);
+
+ switch (key->type) {
++#ifdef WITH_DSA
++ case KEY_DSA:
++ if ((dsa_p = BN_new()) == NULL ||
++ (dsa_q = BN_new()) == NULL ||
++ (dsa_g = BN_new()) == NULL ||
++ (dsa_pub_key = BN_new()) == NULL ||
++ (dsa_priv_key = BN_new()) == NULL)
++ fatal_f("BN_new");
++ buffer_get_bignum_bits(b, dsa_p);
++ buffer_get_bignum_bits(b, dsa_g);
++ buffer_get_bignum_bits(b, dsa_q);
++ buffer_get_bignum_bits(b, dsa_pub_key);
++ buffer_get_bignum_bits(b, dsa_priv_key);
++ if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g))
++ fatal_f("DSA_set0_pqg failed");
++ dsa_p = dsa_q = dsa_g = NULL; /* transferred */
++ if (!DSA_set0_key(key->dsa, dsa_pub_key, dsa_priv_key))
++ fatal_f("DSA_set0_key failed");
++ dsa_pub_key = dsa_priv_key = NULL; /* transferred */
++ break;
++#endif
+ case KEY_RSA:
+ if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
+ (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
+@@ -662,6 +720,14 @@ do_convert_from_pkcs8(struct sshkey **k,
+ (*k)->pkey = pubkey;
+ pubkey = NULL;
+ break;
++#ifdef WITH_DSA
++ case EVP_PKEY_DSA:
++ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
++ fatal("sshkey_new failed");
++ (*k)->type = KEY_DSA;
++ (*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
++ break;
++#endif
+ case EVP_PKEY_EC:
+ if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
+ fatal("sshkey_new failed");
+@@ -734,6 +800,12 @@ do_convert_from(struct passwd *pw)
+ fprintf(stdout, "\n");
+ } else {
+ switch (k->type) {
++#ifdef WITH_DSA
++ case KEY_DSA:
++ ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
++ NULL, 0, NULL, NULL);
++ break;
++#endif
+ case KEY_ECDSA:
+ ok = PEM_write_ECPrivateKey(stdout,
+ EVP_PKEY_get0_EC_KEY(k->pkey), NULL, NULL, 0,
+@@ -3263,7 +3335,7 @@ usage(void)
+ fprintf(stderr,
+ "usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n"
+ " [-m format] [-N new_passphrase] [-O option]\n"
+- " [-t ecdsa|ecdsa-sk|ed25519|ed25519-sk|mldsa44-ed25519|rsa]\n"
++ " [-t dsa|ecdsa|ecdsa-sk|ed25519|ed25519-sk|mldsa44-ed25519|rsa]\n"
+ " [-w provider] [-Z cipher]\n"
+ " ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n"
+ " [-P old_passphrase] [-Z cipher]\n"
+@@ -3759,6 +3831,11 @@ main(int argc, char **argv)
+ n += do_print_resource_record(pw,
+ _PATH_HOST_RSA_KEY_FILE, rr_hostname,
+ print_generic, opts, nopts);
++#ifdef WITH_DSA
++ n += do_print_resource_record(pw,
++ _PATH_HOST_DSA_KEY_FILE, rr_hostname,
++ print_generic, opts, nopts);
++#endif
+ n += do_print_resource_record(pw,
+ _PATH_HOST_ECDSA_KEY_FILE, rr_hostname,
+ print_generic, opts, nopts);
+--- openssh-10.5p1.orig/ssh-keyscan.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/ssh-keyscan.c 2026-09-03 17:53:47.035533145 +0200
+@@ -62,6 +62,7 @@ int ssh_port = SSH_DEFAULT_PORT;
+ #define KT_RSA (1)
+ #define KT_ECDSA (1<<1)
+ #define KT_ED25519 (1<<2)
++#define KT_DSA (1<<3)
+ #define KT_ECDSA_SK (1<<4)
+ #define KT_ED25519_SK (1<<5)
+ #define KT_MLDSA44_ED25519 (1<<6)
+@@ -239,6 +240,10 @@ keygrab_ssh2(con *c)
+ int r;
+
+ switch (c->c_keytype) {
++ case KT_DSA:
++ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
++ "ssh-dss-cert-v01 at openssh.com" : "ssh-dss";
++ break;
+ case KT_RSA:
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
+ "rsa-sha2-512-cert-v01 at openssh.com,"
+@@ -747,6 +752,11 @@ main(int argc, char **argv)
+ int type = sshkey_type_from_shortname(tname);
+
+ switch (type) {
++#ifdef WITH_DSA
++ case KEY_DSA:
++ get_keytypes |= KT_DSA;
++ break;
++#endif
+ case KEY_ECDSA:
+ get_keytypes |= KT_ECDSA;
+ break;
+--- openssh-10.5p1.orig/ssh-keysign.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/ssh-keysign.c 2026-09-03 17:53:47.034832022 +0200
+@@ -200,6 +200,9 @@ main(int argc, char **argv)
+
+ i = 0;
+ /* XXX This really needs to read sshd_config for the paths */
++#ifdef WITH_DSA
++ key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
++#endif
+ key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
+ key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY);
+ key_fd[i++] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY);
+--- openssh-10.5p1.orig/ssh.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/ssh.c 2026-09-03 17:53:47.034561240 +0200
+@@ -1758,10 +1758,16 @@ main(int ac, char **av)
+ L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1);
+ L_CERT(_PATH_HOST_RSA_KEY_FILE, 2);
+ L_CERT(_PATH_HOST_MLDSA44_ED25519_KEY_FILE, 3);
++#ifdef WITH_DSA
++ L_CERT(_PATH_HOST_DSA_KEY_FILE, 8);
++#endif
+ L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4);
+ L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5);
+ L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6);
+ L_PUBKEY(_PATH_HOST_MLDSA44_ED25519_KEY_FILE, 7);
++#ifdef WITH_DSA
++ L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 9);
++#endif
+ if (loaded == 0)
+ debug("HostbasedAuthentication enabled but no "
+ "local public host keys could be loaded.");
+--- openssh-10.5p1.orig/ssh_config 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/ssh_config 2026-09-03 17:25:34.370082823 +0200
+@@ -1,4 +1,4 @@
+-# $OpenBSD: ssh_config,v 1.37 2025/05/06 05:40:56 djm Exp $
++# $OpenBSD: ssh_config,v 1.36 2023/08/02 23:04:38 djm Exp $
+
+ # This is the ssh client system-wide configuration file. See
+ # ssh_config(5) for more information. This file provides defaults for
+@@ -30,6 +30,7 @@
+ # ConnectTimeout 0
+ # StrictHostKeyChecking ask
+ # IdentityFile ~/.ssh/id_rsa
++# IdentityFile ~/.ssh/id_dsa
+ # IdentityFile ~/.ssh/id_ecdsa
+ # IdentityFile ~/.ssh/id_ed25519
+ # Port 22
+--- openssh-10.5p1.orig/sshconnect.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/sshconnect.c 2026-09-03 17:53:47.034994959 +0200
+@@ -1674,6 +1674,9 @@ show_other_keys(struct hostkeys *hostkey
+ {
+ int type[] = {
+ KEY_RSA,
++#ifdef WITH_DSA
++ KEY_DSA,
++#endif
+ KEY_ECDSA,
+ KEY_ED25519,
+ KEY_MLDSA44_ED25519,
+--- openssh-10.5p1.orig/sshd-auth.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/sshd-auth.c 2026-09-03 17:53:47.035448431 +0200
+@@ -247,6 +247,9 @@ list_hostkey_types(void)
+ append_hostkey_type(b, "rsa-sha2-512");
+ append_hostkey_type(b, "rsa-sha2-256");
+ /* FALLTHROUGH */
++#ifdef WITH_DSA
++ case KEY_DSA:
++#endif
+ case KEY_ECDSA:
+ case KEY_ED25519:
+ case KEY_MLDSA44_ED25519:
+@@ -267,6 +270,9 @@ list_hostkey_types(void)
+ append_hostkey_type(b,
+ "rsa-sha2-256-cert-v01 at openssh.com");
+ /* FALLTHROUGH */
++#ifdef WITH_DSA
++ case KEY_DSA_CERT:
++#endif
+ case KEY_ECDSA_CERT:
+ case KEY_ED25519_CERT:
+ case KEY_MLDSA44_ED25519_CERT:
+@@ -292,6 +298,9 @@ get_hostkey_public_by_type(int type, int
+ for (i = 0; i < options.num_host_key_files; i++) {
+ switch (type) {
+ case KEY_RSA_CERT:
++#ifdef WITH_DSA
++ case KEY_DSA_CERT:
++#endif
+ case KEY_ECDSA_CERT:
+ case KEY_ED25519_CERT:
+ case KEY_MLDSA44_ED25519_CERT:
+--- openssh-10.5p1.orig/sshd-session.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/sshd-session.c 2026-09-03 17:25:34.370701274 +0200
+@@ -435,6 +435,7 @@ get_hostkey_by_type(int type, int nid, i
+ for (i = 0; i < options.num_host_key_files; i++) {
+ switch (type) {
+ case KEY_RSA_CERT:
++ case KEY_DSA_CERT:
+ case KEY_ECDSA_CERT:
+ case KEY_ED25519_CERT:
+ case KEY_ECDSA_SK_CERT:
+--- openssh-10.5p1.orig/sshd.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/sshd.c 2026-09-03 17:53:47.035137474 +0200
+@@ -1652,6 +1652,9 @@ main(int ac, char **av)
+
+ switch (keytype) {
+ case KEY_RSA:
++#ifdef WITH_DSA
++ case KEY_DSA:
++#endif
+ case KEY_ECDSA:
+ case KEY_ED25519:
+ case KEY_MLDSA44_ED25519:
+--- openssh-10.5p1.orig/sshkey.c 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/sshkey.c 2026-09-03 17:52:58.999985011 +0200
+@@ -113,6 +113,10 @@ extern const struct sshkey_impl sshkey_r
+ extern const struct sshkey_impl sshkey_rsa_sha256_cert_impl;
+ extern const struct sshkey_impl sshkey_rsa_sha512_impl;
+ extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl;
++# ifdef WITH_DSA
++extern const struct sshkey_impl sshkey_dss_impl;
++extern const struct sshkey_impl sshkey_dsa_cert_impl;
++# endif
+ #endif /* WITH_OPENSSL */
+
+ const struct sshkey_impl * const keyimpls[] = {
+@@ -139,6 +143,10 @@ const struct sshkey_impl * const keyimpl
+ &sshkey_ecdsa_sk_webauthn_impl,
+ &sshkey_ecdsa_sk_webauthn_cert_impl,
+ # endif /* ENABLE_SK */
++# ifdef WITH_DSA
++ &sshkey_dss_impl,
++ &sshkey_dsa_cert_impl,
++# endif
+ &sshkey_rsa_impl,
+ &sshkey_rsa_cert_impl,
+ &sshkey_rsa_sha256_impl,
+@@ -433,6 +441,8 @@ sshkey_type_plain(int type)
+ switch (type) {
+ case KEY_RSA_CERT:
+ return KEY_RSA;
++ case KEY_DSA_CERT:
++ return KEY_DSA;
+ case KEY_ECDSA_CERT:
+ return KEY_ECDSA;
+ case KEY_ECDSA_SK_CERT:
+@@ -455,6 +465,8 @@ sshkey_type_certified(int type)
+ switch (type) {
+ case KEY_RSA:
+ return KEY_RSA_CERT;
++ case KEY_DSA:
++ return KEY_DSA_CERT;
+ case KEY_ECDSA:
+ return KEY_ECDSA_CERT;
+ case KEY_ECDSA_SK:
+@@ -3297,6 +3309,20 @@ sshkey_private_to_blob_pem_pkcs8(struct
+ goto out;
+
+ switch (key->type) {
++#ifdef WITH_DSA
++ case KEY_DSA:
++ if (format == SSHKEY_PRIVATE_PEM) {
++ success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
++ cipher, passphrase, len, NULL, NULL);
++ } else {
++ if ((pkey = EVP_PKEY_new()) == NULL) {
++ r = SSH_ERR_ALLOC_FAIL;
++ goto out;
++ }
++ success = EVP_PKEY_set1_DSA(pkey, key->dsa);
++ }
++ break;
++#endif
+ case KEY_ECDSA:
+ if (format == SSHKEY_PRIVATE_PEM) {
+ success = PEM_write_bio_ECPrivateKey(bio,
+@@ -3375,6 +3401,9 @@ sshkey_private_to_fileblob(struct sshkey
+ {
+ switch (key->type) {
+ #ifdef WITH_OPENSSL
++#ifdef WITH_DSA
++ case KEY_DSA:
++#endif
+ case KEY_ECDSA:
+ case KEY_RSA:
+ case KEY_ED25519:
+@@ -3552,6 +3581,19 @@ sshkey_parse_private_pem_fileblob(struct
+ prv->pkey = pk;
+ if ((r = sshkey_check_rsa_length(prv, 0)) != 0)
+ goto out;
++#ifdef WITH_DSA
++ } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA &&
++ (type == KEY_UNSPEC || type == KEY_DSA)) {
++ if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
++ r = SSH_ERR_ALLOC_FAIL;
++ goto out;
++ }
++ prv->dsa = EVP_PKEY_get1_DSA(pk);
++ prv->type = KEY_DSA;
++#ifdef DEBUG_PK
++ DSA_print_fp(stderr, prv->dsa, 8);
++#endif
++#endif
+ } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC &&
+ (type == KEY_UNSPEC || type == KEY_ECDSA)) {
+ if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
+--- openssh-10.5p1.orig/sshkey.h 2026-08-11 04:22:17.000000000 +0200
++++ openssh-10.5p1/sshkey.h 2026-09-03 17:52:29.113495487 +0200
+@@ -30,6 +30,9 @@
+
+ #ifdef WITH_OPENSSL
+ #include <openssl/rsa.h>
++#ifdef WITH_DSA
++#include <openssl/dsa.h>
++#endif
+ #include <openssl/ec.h>
+ #include <openssl/ecdsa.h>
+ #include <openssl/evp.h>
+@@ -37,6 +40,7 @@
+ #else /* OPENSSL */
+ #define BIGNUM void
+ #define RSA void
++#define DSA void
+ #define EC_KEY void
+ #define EC_GROUP void
+ #define EC_POINT void
+@@ -52,9 +56,11 @@ struct sshbuf;
+ /* Key types */
+ enum sshkey_types {
+ KEY_RSA,
++ KEY_DSA,
+ KEY_ECDSA,
+ KEY_ED25519,
+ KEY_RSA_CERT,
++ KEY_DSA_CERT,
+ KEY_ECDSA_CERT,
+ KEY_ED25519_CERT,
+ KEY_ECDSA_SK,
+@@ -113,6 +119,8 @@ struct sshkey_cert {
+ struct sshkey {
+ int type;
+ int flags;
++ /* KEY_DSA */
++ DSA *dsa;
+ /* KEY_ECDSA and KEY_ECDSA_SK */
+ int ecdsa_nid; /* NID of curve */
+ /* libcrypto-backed keys */
+@@ -330,6 +338,7 @@ int check_rsa_length(const RSA *rsa); /*
+
+ #ifndef WITH_OPENSSL
+ #undef RSA
++#undef DSA
+ #undef EC_KEY
+ #undef EC_GROUP
+ #undef EC_POINT
diff --git a/openssh-ldap-fixes.patch b/openssh-ldap-fixes.patch
deleted file mode 100644
index cca4e92..0000000
--- a/openssh-ldap-fixes.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff -urNp -x '*.orig' openssh-8.4p1.org/Makefile.in openssh-8.4p1/Makefile.in
---- openssh-8.4p1.org/Makefile.in 2021-03-01 11:29:52.615391132 +0100
-+++ openssh-8.4p1/Makefile.in 2021-03-01 11:29:52.908739606 +0100
-@@ -234,7 +234,7 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
- $(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
-
- ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
-- $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
-+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- $(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldap-helper.c openssh-8.4p1/ldap-helper.c
---- openssh-8.4p1.org/ldap-helper.c 2021-03-01 11:29:52.615391132 +0100
-+++ openssh-8.4p1/ldap-helper.c 2021-03-01 11:29:52.908739606 +0100
-@@ -62,6 +62,8 @@ usage(void)
- int
- main(int ac, char **av)
- {
-+ extern char *optarg;
-+ extern int optind;
- int opt;
- FILE *outfile = NULL;
-
diff --git a/openssh-ldap.patch b/openssh-ldap.patch
deleted file mode 100644
index a689d38..0000000
--- a/openssh-ldap.patch
+++ /dev/null
@@ -1,2614 +0,0 @@
-diff -urNp -x '*.orig' openssh-8.4p1.org/HOWTO.ldap-keys openssh-8.4p1/HOWTO.ldap-keys
---- openssh-8.4p1.org/HOWTO.ldap-keys 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/HOWTO.ldap-keys 2021-03-01 11:29:31.277623165 +0100
-@@ -0,0 +1,108 @@
-+
-+HOW TO START
-+
-+1) configure LDAP server
-+ * Use LDAP server documentation
-+2) add appropriate LDAP schema
-+ * For OpenLDAP or SunONE Use attached schema, otherwise you have to create it.
-+ * LDAP user entry
-+ User entry:
-+ - attached to the 'ldapPublicKey' objectclass
-+ - attached to the 'posixAccount' objectclass
-+ - with a filled 'sshPublicKey' attribute
-+3) insert users into LDAP
-+ * Use LDAP Tree management tool as useful
-+ * Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema and the additionnal lpk.schema.
-+ * Example:
-+ dn: uid=captain,ou=commanders,dc=enterprise,dc=universe
-+ objectclass: top
-+ objectclass: person
-+ objectclass: organizationalPerson
-+ objectclass: posixAccount
-+ objectclass: ldapPublicKey
-+ description: Jonathan Archer
-+ userPassword: Porthos
-+ cn: onathan Archer
-+ sn: onathan Archer
-+ uid: captain
-+ uidNumber: 1001
-+ gidNumber: 1001
-+ homeDirectory: /home/captain
-+ sshPublicKey: ssh-rss AAAAB3.... =captain at universe
-+ sshPublicKey: command="kill -9 1" ssh-rss AAAAM5...
-+4) on the ssh side set in sshd_config
-+ * Set up the backend
-+ AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper
-+ AuthorizedKeysCommandUser <appropriate user to run LDAP>
-+ * Do not forget to set
-+ PubkeyAuthentication yes
-+ * Swith off unnecessary auth methods
-+5) confugure ldap.conf
-+ * Default ldap.conf is placed in /etc/ssh
-+ * The configuration style is the same as other ldap based aplications
-+6) if necessary edit ssh-ldap-wrapper
-+ * There is a possibility to change ldap.conf location
-+ * There are some debug options
-+ * Example
-+ /usr/libexec/openssh -s -f /etc/ldap.conf -w -d >> /tmp/ldapdebuglog.txt
-+
-+HOW TO MIGRATE FROM LPK
-+
-+1) goto HOW TO START 4) .... the ldap schema is the same
-+
-+2) convert the group requests to the appropriate LDAP requests
-+
-+HOW TO SOLVE PROBLEMS
-+
-+1) use debug in sshd
-+ * /usr/sbin/sshd -d -d -d -d
-+2) use debug in ssh-ldap-helper
-+ * ssh-ldap-helper -d -d -d -d -s <username>
-+3) use tcpdump ... other ldap client etc.
-+
-+ADVANTAGES
-+
-+1) Blocking an user account can be done directly from LDAP (if sshd is using PubkeyAuthentication + AuthorizedKeysCommand with ldap only).
-+
-+DISADVANTAGES
-+
-+1) LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP
-+ allows write to users dn, somebody could replace some user's public key by his own and impersonate some
-+ of your users in all your server farm -- be VERY CAREFUL.
-+2) With incomplete PKI the MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login
-+ as the impersonated user.
-+3) If LDAP server is down there may be no fallback on passwd auth.
-+
-+MISC.
-+
-+1) todo
-+ * Possibility to reuse the ssh-ldap-helper.
-+ * Tune the LDAP part to accept all possible LDAP configurations.
-+
-+2) differences from original lpk
-+ * No LDAP code in sshd.
-+ * Support for various LDAP platforms and configurations.
-+ * LDAP is configured in separate ldap.conf file.
-+
-+3) docs/link
-+ * http://pacsec.jp/core05/psj05-barisani-en.pdf
-+ * http://fritz.potsdam.edu/projects/openssh-lpk/
-+ * http://fritz.potsdam.edu/projects/sshgate/
-+ * http://dev.inversepath.com/trac/openssh-lpk
-+ * http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
-+
-+4) contributors/ideas/greets
-+ - Eric AUGE <eau at phear.org>
-+ - Andrea Barisani <andrea at inversepath.com>
-+ - Falk Siemonsmeier.
-+ - Jacob Rief.
-+ - Michael Durchgraf.
-+ - frederic peters.
-+ - Finlay dobbie.
-+ - Stefan Fisher.
-+ - Robin H. Johnson.
-+ - Adrian Bridgett.
-+
-+5) Author
-+ Jan F. Chadima <jchadima at redhat.com>
-+
-diff -ruN openssh-9.8p1.orig/Makefile.in openssh-9.8p1/Makefile.in
---- openssh-9.8p1.orig/Makefile.in 2024-07-01 06:36:28.000000000 +0200
-+++ openssh-9.8p1/Makefile.in 2024-07-01 11:10:26.787664770 +0200
-@@ -24,6 +24,8 @@
- ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
- SFTP_SERVER=$(libexecdir)/sftp-server
- SSH_KEYSIGN=$(libexecdir)/ssh-keysign
-+SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
-+SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
- SSHD_SESSION=$(libexecdir)/sshd-session
- SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
-@@ -68,10 +70,11 @@
- EXEEXT=@EXEEXT@
- MANFMT=@MANFMT@
- MKDIR_P=@MKDIR_P@
-+INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
-
- .SUFFIXES: .lo
-
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-ldap-helper$(EXEEXT)
-
- XMSS_OBJS=\
- ssh-xmss.o \
-@@ -163,8 +166,8 @@
-
- SFTP_OBJS= sftp.o sftp-usergroup.o progressmeter.o $(SFTP_CLIENT_OBJS)
-
--MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
--MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
-+MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
-+MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
- MANTYPE = @MANTYPE@
-
- CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -241,6 +244,9 @@
- ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
- $(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS)
-
-+ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
-+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
-+
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- $(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS)
-
-@@ -414,6 +420,10 @@
- $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
- $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- $(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
-+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
-+ $(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
-+ $(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
-+ fi
- $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
- $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
- $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-@@ -431,6 +441,10 @@
- $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
- $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
- $(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
-+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
-+ $(INSTALL) -m 644 ssh-ldap-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8 ; \
-+ $(INSTALL) -m 644 ssh-ldap.conf.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh-ldap.conf.5 ; \
-+ fi
-
- install-sysconf:
- $(MKDIR_P) $(DESTDIR)$(sysconfdir)
-@@ -454,6 +468,13 @@
- else \
- echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
- fi
-+ if test ! -z "$(INSTALL_SSH_LDAP_HELPER)" ; then \
-+ if [ ! -f $(DESTDIR)$(sysconfdir)/ldap.conf ]; then \
-+ $(INSTALL) -m 644 ldap.conf $(DESTDIR)$(sysconfdir)/ldap.conf; \
-+ else \
-+ echo "$(DESTDIR)$(sysconfdir)/ldap.conf already exists, install will not overwrite"; \
-+ fi ; \
-+ fi
-
- host-key: ssh-keygen$(EXEEXT)
- @if [ -z "$(DESTDIR)" ] ; then \
-@@ -492,6 +513,8 @@
- -rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
- -rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- -rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
-+ -rm -f $(DESTDIR)$(SSH_LDAP_HELPER)$(EXEEXT)
-+ -rm -f $(DESTDIR)$(SSH_LDAP_WRAPPER)$(EXEEXT)
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -504,6 +527,7 @@
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
- -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
-+ -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
-
- regress-prep:
- $(MKDIR_P) `pwd`/regress/unittests/test_helper
-diff -urNp -x '*.orig' openssh-8.4p1.org/configure.ac openssh-8.4p1/configure.ac
---- openssh-8.4p1.org/configure.ac 2021-03-01 11:29:31.004275724 +0100
-+++ openssh-8.4p1/configure.ac 2021-03-01 11:29:31.277623165 +0100
-@@ -1763,6 +1763,106 @@ AC_COMPILE_IFELSE(
- CFLAGS="$SAVED_CFLAGS"
- AC_SUBST([PICFLAG])
-
-+# Check whether user wants LDAP support
-+LDAP_MSG="no"
-+INSTALL_SSH_LDAP_HELPER=""
-+AC_ARG_WITH(ldap,
-+ [ --with-ldap[[=PATH]] Enable LDAP pubkey support (optionally in PATH)],
-+ [
-+ if test "x$withval" != "xno" ; then
-+
-+ INSTALL_SSH_LDAP_HELPER="yes"
-+ CPPFLAGS="$CPPFLAGS -DLDAP_DEPRECATED"
-+
-+ if test "x$withval" != "xyes" ; then
-+ CPPFLAGS="$CPPFLAGS -I${withval}/include"
-+ LDFLAGS="$LDFLAGS -L${withval}/lib"
-+ fi
-+
-+ AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
-+ LDAP_MSG="yes"
-+
-+ AC_CHECK_HEADERS(lber.h)
-+ AC_CHECK_HEADERS(ldap.h, , AC_MSG_ERROR(could not locate <ldap.h>))
-+ AC_CHECK_HEADERS(ldap_ssl.h)
-+
-+ AC_ARG_WITH(ldap-lib,
-+ [ --with-ldap-lib=type select ldap library [auto|netscape5|netscape4|netscape3|umich|openldap]])
-+
-+ if test -z "$with_ldap_lib"; then
-+ with_ldap_lib=auto
-+ fi
-+
-+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then
-+ AC_CHECK_LIB(lber, main, LIBS="-llber $LIBS" found_ldap_lib=yes)
-+ AC_CHECK_LIB(ldap, main, LIBS="-lldap $LIBS" found_ldap_lib=yes)
-+ fi
-+
-+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape5 \); then
-+ AC_CHECK_LIB(ldap50, main, LIBS="-lldap50 -lssldap50 -lssl3 -lnss3 -lnspr4 -lprldap50 -lplc4 -lplds4 $LIBS" found_ldap_lib=yes)
-+ fi
-+
-+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape4 \); then
-+ AC_CHECK_LIB(ldapssl41, main, LIBS="-lldapssl41 -lplc3 -lplds3 -lnspr3 $LIBS" found_ldap_lib=yes)
-+ if test -z "$found_ldap_lib"; then
-+ AC_CHECK_LIB(ldapssl40, main, LIBS="-lldapssl40 $LIBS" found_ldap_lib=yes)
-+ fi
-+ if test -z "$found_ldap_lib"; then
-+ AC_CHECK_LIB(ldap41, main, LIBS="-lldap41 $LIBS" found_ldap_lib=yes)
-+ fi
-+ if test -z "$found_ldap_lib"; then
-+ AC_CHECK_LIB(ldap40, main, LIBS="-lldap40 $LIBS" found_ldap_lib=yes)
-+ fi
-+ fi
-+
-+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = netscape3 \); then
-+ AC_CHECK_LIB(ldapssl30, main, LIBS="-lldapssl30 $LIBS" found_ldap_lib=yes)
-+ fi
-+
-+ if test -z "$found_ldap_lib"; then
-+ AC_MSG_ERROR(could not locate a valid LDAP library)
-+ fi
-+
-+ AC_MSG_CHECKING([for working LDAP support])
-+ AC_TRY_COMPILE(
-+ [#include <sys/types.h>
-+ #include <ldap.h>],
-+ [(void)ldap_init(0, 0);],
-+ [AC_MSG_RESULT(yes)],
-+ [
-+ AC_MSG_RESULT(no)
-+ AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
-+ ])
-+ AC_CHECK_FUNCS( \
-+ ldap_init \
-+ ldap_get_lderrno \
-+ ldap_set_lderrno \
-+ ldap_parse_result \
-+ ldap_memfree \
-+ ldap_controls_free \
-+ ldap_set_option \
-+ ldap_get_option \
-+ ldapssl_init \
-+ ldap_start_tls_s \
-+ ldap_pvt_tls_set_option \
-+ ldap_initialize \
-+ )
-+ AC_CHECK_FUNCS(ldap_set_rebind_proc,
-+ AC_MSG_CHECKING([number arguments of ldap_set_rebind_proc])
-+ AC_TRY_COMPILE(
-+ [#include <lber.h>
-+ #include <ldap.h>],
-+ [ldap_set_rebind_proc(0, 0, 0);],
-+ [ac_cv_ldap_set_rebind_proc=3],
-+ [ac_cv_ldap_set_rebind_proc=2])
-+ AC_MSG_RESULT($ac_cv_ldap_set_rebind_proc)
-+ AC_DEFINE(LDAP_SET_REBIND_PROC_ARGS, $ac_cv_ldap_set_rebind_proc, [number arguments of ldap_set_rebind_proc])
-+ )
-+ fi
-+ ]
-+)
-+AC_SUBST(INSTALL_SSH_LDAP_HELPER)
-+
- dnl Checks for library functions. Please keep in alphabetical order
- AC_CHECK_FUNCS([ \
- Blowfish_initstate \
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldap-helper.c openssh-8.4p1/ldap-helper.c
---- openssh-8.4p1.org/ldap-helper.c 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldap-helper.c 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,156 @@
-+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "ldapincludes.h"
-+#include "log.h"
-+#include "misc.h"
-+#include "xmalloc.h"
-+#include "ldapconf.h"
-+#include "ldapbody.h"
-+#include <stdlib.h>
-+#include <string.h>
-+#include <unistd.h>
-+
-+static int config_debug = 0;
-+int config_exclusive_config_file = 0;
-+static char *config_file_name = "/etc/ssh/ldap.conf";
-+static char *config_single_user = NULL;
-+static int config_verbose = SYSLOG_LEVEL_VERBOSE;
-+int config_warning_config_file = 0;
-+extern char *__progname;
-+
-+static void
-+usage(void)
-+{
-+ fprintf(stderr, "usage: %s [options]\n",
-+ __progname);
-+ fprintf(stderr, "Options:\n");
-+ fprintf(stderr, " -d Output the log messages to stderr.\n");
-+ fprintf(stderr, " -e Check the config file for unknown commands.\n");
-+ fprintf(stderr, " -f file Use alternate config file (default is /etc/ssh/ldap.conf).\n");
-+ fprintf(stderr, " -s user Do not demonize, send the user's key to stdout.\n");
-+ fprintf(stderr, " -v Increase verbosity of the debug output (implies -d).\n");
-+ fprintf(stderr, " -w Warn on unknown commands in the config file.\n");
-+ exit(1);
-+}
-+
-+/*
-+ * Main program for the ssh pka ldap agent.
-+ */
-+
-+int
-+main(int ac, char **av)
-+{
-+ int opt;
-+ FILE *outfile = NULL;
-+
-+ __progname = ssh_get_progname(av[0]);
-+
-+ log_init(__progname, SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
-+
-+ /*
-+ * Initialize option structure to indicate that no values have been
-+ * set.
-+ */
-+ initialize_options();
-+
-+ /* Parse command-line arguments. */
-+ while ((opt = getopt(ac, av, "def:s:vw")) != -1) {
-+ switch (opt) {
-+ case 'd':
-+ config_debug = 1;
-+ break;
-+
-+ case 'e':
-+ config_exclusive_config_file = 1;
-+ config_warning_config_file = 1;
-+ break;
-+
-+ case 'f':
-+ config_file_name = optarg;
-+ break;
-+
-+ case 's':
-+ config_single_user = optarg;
-+ outfile = fdopen (dup (fileno (stdout)), "w");
-+ break;
-+
-+ case 'v':
-+ config_debug = 1;
-+ if (config_verbose < SYSLOG_LEVEL_DEBUG3)
-+ config_verbose++;
-+ break;
-+
-+ case 'w':
-+ config_warning_config_file = 1;
-+ break;
-+
-+ case '?':
-+ default:
-+ usage();
-+ break;
-+ }
-+ }
-+
-+ /* Initialize loging */
-+ log_init(__progname, config_verbose, SYSLOG_FACILITY_AUTH, config_debug);
-+
-+ if (ac != optind)
-+ fatal ("illegal extra parameter %s", av[1]);
-+
-+ /* Ensure that fds 0 and 2 are open or directed to /dev/null */
-+ if (config_debug == 0)
-+ sanitise_stdfd();
-+
-+ /* Read config file */
-+ read_config_file(config_file_name);
-+ fill_default_options();
-+ if (config_verbose == SYSLOG_LEVEL_DEBUG3) {
-+ debug3 ("=== Configuration ===");
-+ dump_config();
-+ debug3 ("=== *** ===");
-+ }
-+
-+ ldap_checkconfig();
-+ ldap_do_connect();
-+
-+ if (config_single_user) {
-+ process_user (config_single_user, outfile);
-+ } else {
-+ usage();
-+ fatal ("Not yet implemented");
-+/* TODO
-+ * open unix socket a run the loop on it
-+ */
-+ }
-+
-+ ldap_do_close();
-+ return 0;
-+}
-+
-+/* Ugly hack */
-+void *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
-+void buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldap-helper.h openssh-8.4p1/ldap-helper.h
---- openssh-8.4p1.org/ldap-helper.h 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldap-helper.h 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,32 @@
-+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#ifndef LDAP_HELPER_H
-+#define LDAP_HELPER_H
-+
-+extern int config_exclusive_config_file;
-+extern int config_warning_config_file;
-+
-+#endif /* LDAP_HELPER_H */
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldap.conf openssh-8.4p1/ldap.conf
---- openssh-8.4p1.org/ldap.conf 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldap.conf 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,88 @@
-+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
-+#
-+# This is the example configuration file for the OpenSSH
-+# LDAP backend
-+#
-+# see ssh-ldap.conf(5)
-+#
-+
-+# URI with your LDAP server name. This allows to use
-+# Unix Domain Sockets to connect to a local LDAP Server.
-+#uri ldap://127.0.0.1/
-+#uri ldaps://127.0.0.1/
-+#uri ldapi://%2fvar%2frun%2fldapi_sock/
-+# Note: %2f encodes the '/' used as directory separator
-+
-+# Another way to specify your LDAP server is to provide an
-+# host name and the port of our LDAP server. Host name
-+# must be resolvable without using LDAP.
-+# Multiple hosts may be specified, each separated by a
-+# space. How long nss_ldap takes to failover depends on
-+# whether your LDAP client library supports configurable
-+# network or connect timeouts (see bind_timelimit).
-+#host 127.0.0.1
-+
-+# The port.
-+# Optional: default is 389.
-+#port 389
-+
-+# The distinguished name to bind to the server with.
-+# Optional: default is to bind anonymously.
-+#binddn cn=openssh_keys,dc=example,dc=org
-+
-+# The credentials to bind with.
-+# Optional: default is no credential.
-+#bindpw TopSecret
-+
-+# The distinguished name of the search base.
-+#base dc=example,dc=org
-+
-+# The LDAP version to use (defaults to 3
-+# if supported by client library)
-+#ldap_version 3
-+
-+# The search scope.
-+#scope sub
-+#scope one
-+#scope base
-+
-+# Search timelimit
-+#timelimit 30
-+
-+# Bind/connect timelimit
-+#bind_timelimit 30
-+
-+# Reconnect policy: hard (default) will retry connecting to
-+# the software with exponential backoff, soft will fail
-+# immediately.
-+#bind_policy hard
-+
-+# SSL setup, may be implied by URI also.
-+#ssl no
-+#ssl on
-+#ssl start_tls
-+
-+# OpenLDAP SSL options
-+# Require and verify server certificate (yes/no)
-+# Default is to use libldap's default behavior, which can be configured in
-+# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
-+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
-+#tls_checkpeer hard
-+
-+# CA certificates for server certificate verification
-+# At least one of these are required if tls_checkpeer is "yes"
-+#tls_cacertfile /etc/ssl/ca.cert
-+#tls_cacertdir /etc/pki/tls/certs
-+
-+# Seed the PRNG if /dev/urandom is not provided
-+#tls_randfile /var/run/egd-pool
-+
-+# SSL cipher suite
-+# See man ciphers for syntax
-+#tls_ciphers TLSv1
-+
-+# Client certificate and key
-+# Use these, if your server requires client authentication.
-+#tls_cert
-+#tls_key
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapbody.c openssh-8.4p1/ldapbody.c
---- openssh-8.4p1.org/ldapbody.c 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapbody.c 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,495 @@
-+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "ldapincludes.h"
-+#include "log.h"
-+#include "xmalloc.h"
-+#include "ldapconf.h"
-+#include "ldapmisc.h"
-+#include "ldapbody.h"
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <unistd.h>
-+
-+#define LDAPSEARCH_FORMAT "(&(objectclass=%s)(objectclass=ldapPublicKey)(uid=%s)%s)"
-+#define PUBKEYATTR "sshPublicKey"
-+#define LDAP_LOGFILE "%s/ldap.%d"
-+
-+static FILE *logfile = NULL;
-+static LDAP *ld;
-+
-+static char *attrs[] = {
-+ PUBKEYATTR,
-+ NULL
-+};
-+
-+void
-+ldap_checkconfig (void)
-+{
-+#ifdef HAVE_LDAP_INITIALIZE
-+ if (options.host == NULL && options.uri == NULL)
-+#else
-+ if (options.host == NULL)
-+#endif
-+ fatal ("missing \"host\" in config file");
-+}
-+
-+#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
-+static int
-+_rebind_proc (LDAP * ld, LDAP_CONST char *url, int request, ber_int_t msgid)
-+{
-+ struct timeval timeout;
-+ int rc;
-+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
-+ LDAPMessage *result;
-+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
-+
-+ debug2 ("Doing LDAP rebind to %s", options.binddn);
-+ if (options.ssl == SSL_START_TLS) {
-+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS) {
-+ error ("ldap_starttls_s: %s", ldap_err2string (rc));
-+ return LDAP_OPERATIONS_ERROR;
-+ }
-+ }
-+
-+#if !defined(HAVE_LDAP_PARSE_RESULT) || !defined(HAVE_LDAP_CONTROLS_FREE)
-+ return ldap_simple_bind_s (ld, options.binddn, options.bindpw);
-+#else
-+ if (ldap_simple_bind(ld, options.binddn, options.bindpw) < 0)
-+ fatal ("ldap_simple_bind %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
-+
-+ timeout.tv_sec = options.bind_timelimit;
-+ timeout.tv_usec = 0;
-+ result = NULL;
-+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
-+ error ("ldap_result %s", ldap_err2string (ldap_get_lderrno (ld, 0, 0)));
-+ ldap_msgfree (result);
-+ return LDAP_OPERATIONS_ERROR;
-+ }
-+ debug3 ("LDAP rebind to %s succesfull", options.binddn);
-+ return rc;
-+#endif
-+}
-+#else
-+
-+static int
-+_rebind_proc (LDAP * ld, char **whop, char **credp, int *methodp, int freeit)
-+{
-+ if (freeit)
-+ return LDAP_SUCCESS;
-+
-+ *whop = strdup (options.binddn);
-+ *credp = strdup (options.bindpw);
-+ *methodp = LDAP_AUTH_SIMPLE;
-+ debug2 ("Doing LDAP rebind for %s", *whop);
-+ return LDAP_SUCCESS;
-+}
-+#endif
-+
-+void
-+ldap_do_connect(void)
-+{
-+ int rc, msgid, ld_errno = 0;
-+ struct timeval timeout;
-+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
-+ int parserc;
-+ LDAPMessage *result;
-+ LDAPControl **controls;
-+ int reconnect = 0;
-+#endif /* HAVE_LDAP_PARSE_RESULT && HAVE_LDAP_CONTROLS_FREE */
-+
-+ debug ("LDAP do connect");
-+
-+retry:
-+ if (reconnect) {
-+ debug3 ("Reconnecting with ld_errno %d", ld_errno);
-+ if (options.bind_policy == 0 ||
-+ (ld_errno != LDAP_SERVER_DOWN && ld_errno != LDAP_TIMEOUT) ||
-+ reconnect > 5)
-+ fatal ("Cannot connect to LDAP server");
-+
-+ if (reconnect > 1)
-+ sleep (reconnect - 1);
-+
-+ if (ld != NULL) {
-+ ldap_unbind (ld);
-+ ld = NULL;
-+ }
-+ logit("reconnecting to LDAP server...");
-+ }
-+
-+ if (ld == NULL) {
-+ int rc;
-+ struct timeval tv;
-+
-+#ifdef HAVE_LDAP_SET_OPTION
-+ if (options.debug > 0) {
-+#ifdef LBER_OPT_LOG_PRINT_FILE
-+ if (options.logdir) {
-+ char *logfilename;
-+ int logfilenamelen;
-+
-+ logfilenamelen = strlen (LDAP_LOGFILE) + strlen ("000000") + strlen (options.logdir);
-+ logfilename = xmalloc (logfilenamelen);
-+ snprintf (logfilename, logfilenamelen, LDAP_LOGFILE, options.logdir, (int) getpid ());
-+ logfilename[logfilenamelen - 1] = 0;
-+ if ((logfile = fopen (logfilename, "a")) == NULL)
-+ fatal ("cannot append to %s: %s", logfilename, strerror (errno));
-+ debug3 ("LDAP debug into %s", logfilename);
-+ free (logfilename);
-+ ber_set_option (NULL, LBER_OPT_LOG_PRINT_FILE, logfile);
-+ }
-+#endif
-+ if (options.debug) {
-+#ifdef LBER_OPT_DEBUG_LEVEL
-+ ber_set_option (NULL, LBER_OPT_DEBUG_LEVEL, &options.debug);
-+#endif /* LBER_OPT_DEBUG_LEVEL */
-+#ifdef LDAP_OPT_DEBUG_LEVEL
-+ (void) ldap_set_option (NULL, LDAP_OPT_DEBUG_LEVEL, &options.debug);
-+#endif /* LDAP_OPT_DEBUG_LEVEL */
-+ debug3 ("Set LDAP debug to %d", options.debug);
-+ }
-+ }
-+#endif /* HAVE_LDAP_SET_OPTION */
-+
-+ ld = NULL;
-+#ifdef HAVE_LDAPSSL_INIT
-+ if (options.host != NULL) {
-+ if (options.ssl_on == SSL_LDAPS) {
-+ if ((rc = ldapssl_client_init (options.sslpath, NULL)) != LDAP_SUCCESS)
-+ fatal ("ldapssl_client_init %s", ldap_err2string (rc));
-+ debug3 ("LDAPssl client init");
-+ }
-+
-+ if (options.ssl_on != SSL_OFF) {
-+ if ((ld = ldapssl_init (options.host, options.port, TRUE)) == NULL)
-+ fatal ("ldapssl_init failed");
-+ debug3 ("LDAPssl init");
-+ }
-+ }
-+#endif /* HAVE_LDAPSSL_INIT */
-+
-+ /* continue with opening */
-+ if (ld == NULL) {
-+#if defined (HAVE_LDAP_START_TLS_S) || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
-+ /* Some global TLS-specific options need to be set before we create our
-+ * session context, so we set them here. */
-+
-+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE
-+ /* rand file */
-+ if (options.tls_randfile != NULL) {
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
-+ options.tls_randfile)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_RANDOM_FILE): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS random file %s", options.tls_randfile);
-+ }
-+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */
-+
-+ /* ca cert file */
-+ if (options.tls_cacertfile != NULL) {
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
-+ options.tls_cacertfile)) != LDAP_SUCCESS)
-+ error ("ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS CA cert file %s ", options.tls_cacertfile);
-+ }
-+
-+ /* ca cert directory */
-+ if (options.tls_cacertdir != NULL) {
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
-+ options.tls_cacertdir)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS CA cert dir %s ", options.tls_cacertdir);
-+ }
-+
-+ /* require cert? */
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
-+ &options.tls_checkpeer)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS check peer to %d ", options.tls_checkpeer);
-+
-+ /* set cipher suite, certificate and private key: */
-+ if (options.tls_ciphers != NULL) {
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
-+ options.tls_ciphers)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CIPHER_SUITE): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS ciphers to %s ", options.tls_ciphers);
-+ }
-+
-+ /* cert file */
-+ if (options.tls_cert != NULL) {
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE,
-+ options.tls_cert)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_CERTFILE): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS cert file %s ", options.tls_cert);
-+ }
-+
-+ /* key file */
-+ if (options.tls_key != NULL) {
-+ if ((rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE,
-+ options.tls_key)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS_KEYFILE): %s",
-+ ldap_err2string (rc));
-+ debug3 ("Set TLS key file %s ", options.tls_key);
-+ }
-+#endif
-+#ifdef HAVE_LDAP_INITIALIZE
-+ if (options.uri != NULL) {
-+ if ((rc = ldap_initialize (&ld, options.uri)) != LDAP_SUCCESS)
-+ fatal ("ldap_initialize %s", ldap_err2string (rc));
-+ debug3 ("LDAP initialize %s", options.uri);
-+ }
-+ }
-+#endif /* HAVE_LDAP_INTITIALIZE */
-+
-+ /* continue with opening */
-+ if ((ld == NULL) && (options.host != NULL)) {
-+#ifdef HAVE_LDAP_INIT
-+ if ((ld = ldap_init (options.host, options.port)) == NULL)
-+ fatal ("ldap_init failed");
-+ debug3 ("LDAP init %s:%d", options.host, options.port);
-+#else
-+ if ((ld = ldap_open (options.host, options.port)) == NULL)
-+ fatal ("ldap_open failed");
-+ debug3 ("LDAP open %s:%d", options.host, options.port);
-+#endif /* HAVE_LDAP_INIT */
-+ }
-+
-+ if (ld == NULL)
-+ fatal ("no way to open ldap");
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
-+ if (options.ssl == SSL_LDAPS) {
-+ if ((rc = ldap_set_option (ld, LDAP_OPT_X_TLS, &options.tls_checkpeer)) != LDAP_SUCCESS)
-+ fatal ("ldap_set_option(LDAP_OPT_X_TLS) %s", ldap_err2string (rc));
-+ debug3 ("LDAP set LDAP_OPT_X_TLS_%d", options.tls_checkpeer);
-+ }
-+#endif /* LDAP_OPT_X_TLS */
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)
-+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
-+ &options.ldap_version);
-+#else
-+ ld->ld_version = options.ldap_version;
-+#endif
-+ debug3 ("LDAP set version to %d", options.ldap_version);
-+
-+#if LDAP_SET_REBIND_PROC_ARGS == 3
-+ ldap_set_rebind_proc (ld, _rebind_proc, NULL);
-+#elif LDAP_SET_REBIND_PROC_ARGS == 2
-+ ldap_set_rebind_proc (ld, _rebind_proc);
-+#else
-+#warning unknown LDAP_SET_REBIND_PROC_ARGS
-+#endif
-+ debug3 ("LDAP set rebind proc");
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_DEREF)
-+ (void) ldap_set_option (ld, LDAP_OPT_DEREF, &options.deref);
-+#else
-+ ld->ld_deref = options.deref;
-+#endif
-+ debug3 ("LDAP set deref to %d", options.deref);
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_TIMELIMIT)
-+ (void) ldap_set_option (ld, LDAP_OPT_TIMELIMIT,
-+ &options.timelimit);
-+#else
-+ ld->ld_timelimit = options.timelimit;
-+#endif
-+ debug3 ("LDAP set timelimit to %d", options.timelimit);
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_X_OPT_CONNECT_TIMEOUT)
-+ /*
-+ * This is a new option in the Netscape SDK which sets
-+ * the TCP connect timeout. For want of a better value,
-+ * we use the bind_timelimit to control this.
-+ */
-+ timeout = options.bind_timelimit * 1000;
-+ (void) ldap_set_option (ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeout);
-+ debug3 ("LDAP set opt connect timeout to %d", timeout);
-+#endif
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
-+ tv.tv_sec = options.bind_timelimit;
-+ tv.tv_usec = 0;
-+ (void) ldap_set_option (ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
-+ debug3 ("LDAP set opt network timeout to %ld.0", tv.tv_sec);
-+#endif
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_REFERRALS)
-+ (void) ldap_set_option (ld, LDAP_OPT_REFERRALS,
-+ options.referrals ? LDAP_OPT_ON : LDAP_OPT_OFF);
-+ debug3 ("LDAP set referrals to %d", options.referrals);
-+#endif
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_RESTART)
-+ (void) ldap_set_option (ld, LDAP_OPT_RESTART,
-+ options.restart ? LDAP_OPT_ON : LDAP_OPT_OFF);
-+ debug3 ("LDAP set restart to %d", options.restart);
-+#endif
-+
-+#ifdef HAVE_LDAP_START_TLS_S
-+ if (options.ssl == SSL_START_TLS) {
-+ int version;
-+
-+ if (ldap_get_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version)
-+ == LDAP_SUCCESS) {
-+ if (version < LDAP_VERSION3) {
-+ version = LDAP_VERSION3;
-+ (void) ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION,
-+ &version);
-+ debug3 ("LDAP set version to %d", version);
-+ }
-+ }
-+
-+ if ((rc = ldap_start_tls_s (ld, NULL, NULL)) != LDAP_SUCCESS)
-+ fatal ("ldap_starttls_s: %s", ldap_err2string (rc));
-+ debug3 ("LDAP start TLS");
-+ }
-+#endif /* HAVE_LDAP_START_TLS_S */
-+ }
-+
-+ if ((msgid = ldap_simple_bind (ld, options.binddn,
-+ options.bindpw)) == -1) {
-+ ld_errno = ldap_get_lderrno (ld, 0, 0);
-+
-+ error ("ldap_simple_bind %s", ldap_err2string (ld_errno));
-+ reconnect++;
-+ goto retry;
-+ }
-+ debug3 ("LDAP simple bind (%s)", options.binddn);
-+
-+ timeout.tv_sec = options.bind_timelimit;
-+ timeout.tv_usec = 0;
-+ if ((rc = ldap_result (ld, msgid, FALSE, &timeout, &result)) < 1) {
-+ ld_errno = ldap_get_lderrno (ld, 0, 0);
-+
-+ error ("ldap_result %s", ldap_err2string (ld_errno));
-+ reconnect++;
-+ goto retry;
-+ }
-+ debug3 ("LDAP result in time");
-+
-+#if defined(HAVE_LDAP_PARSE_RESULT) && defined(HAVE_LDAP_CONTROLS_FREE)
-+ controls = NULL;
-+ if ((parserc = ldap_parse_result (ld, result, &rc, 0, 0, 0, &controls, TRUE)) != LDAP_SUCCESS)
-+ fatal ("ldap_parse_result %s", ldap_err2string (parserc));
-+ debug3 ("LDAP parse result OK");
-+
-+ if (controls != NULL) {
-+ ldap_controls_free (controls);
-+ }
-+#else
-+ rc = ldap_result2error (session->ld, result, TRUE);
-+#endif
-+ if (rc != LDAP_SUCCESS)
-+ fatal ("error trying to bind as user \"%s\" (%s)",
-+ options.binddn, ldap_err2string (rc));
-+
-+ debug2 ("LDAP do connect OK");
-+}
-+
-+void
-+process_user (const char *user, FILE *output)
-+{
-+ LDAPMessage *res, *e;
-+ char *buffer;
-+ int bufflen, rc, i;
-+ struct timeval timeout;
-+
-+ debug ("LDAP process user");
-+
-+ /* quick check for attempts to be evil */
-+ if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
-+ (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL)) {
-+ logit ("illegal user name %s not processed", user);
-+ return;
-+ }
-+
-+ /* build filter for LDAP request */
-+ bufflen = strlen (LDAPSEARCH_FORMAT) + strlen(options.account_class) + strlen (user);
-+ if (options.ssh_filter != NULL)
-+ bufflen += strlen (options.ssh_filter);
-+ buffer = xmalloc (bufflen);
-+ snprintf(buffer, bufflen, LDAPSEARCH_FORMAT, options.account_class, user, (options.ssh_filter != NULL) ? options.ssh_filter : NULL);
-+ buffer[bufflen - 1] = 0;
-+
-+ debug3 ("LDAP search scope = %d %s", options.scope, buffer);
-+
-+ timeout.tv_sec = options.timelimit;
-+ timeout.tv_usec = 0;
-+ if ((rc = ldap_search_st(ld, options.base, options.scope, buffer, attrs, 0, &timeout, &res)) != LDAP_SUCCESS) {
-+ error ("ldap_search_st(): %s", ldap_err2string (rc));
-+ free (buffer);
-+ return;
-+ }
-+
-+ /* free */
-+ free (buffer);
-+
-+ for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {
-+ int num;
-+ struct berval **keys;
-+
-+ keys = ldap_get_values_len(ld, e, PUBKEYATTR);
-+ num = ldap_count_values_len(keys);
-+ for (i = 0 ; i < num ; i++) {
-+ char *cp; //, *options = NULL;
-+
-+ for (cp = keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++);
-+ if (!*cp || *cp == '\n' || *cp == '#')
-+ continue;
-+
-+ /* We have found the desired key. */
-+ fprintf (output, "%s\n", keys[i]->bv_val);
-+ }
-+
-+ ldap_value_free_len(keys);
-+ }
-+
-+ ldap_msgfree(res);
-+ debug2 ("LDAP process user finished");
-+}
-+
-+void
-+ldap_do_close(void)
-+{
-+ int rc;
-+
-+ debug ("LDAP do close");
-+ if ((rc = ldap_unbind_ext(ld, NULL, NULL)) != LDAP_SUCCESS)
-+ fatal ("ldap_unbind_ext: %s",
-+ ldap_err2string (rc));
-+
-+ ld = NULL;
-+ debug2 ("LDAP do close OK");
-+ return;
-+}
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapbody.h openssh-8.4p1/ldapbody.h
---- openssh-8.4p1.org/ldapbody.h 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapbody.h 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,37 @@
-+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#ifndef LDAPBODY_H
-+#define LDAPBODY_H
-+
-+#include <stdio.h>
-+
-+void ldap_checkconfig(void);
-+void ldap_do_connect(void);
-+void process_user(const char *, FILE *);
-+void ldap_do_close(void);
-+
-+#endif /* LDAPBODY_H */
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapconf.c openssh-8.4p1/ldapconf.c
---- openssh-8.4p1.org/ldapconf.c 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapconf.c 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,692 @@
-+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "ldapincludes.h"
-+#include "ldap-helper.h"
-+#include "log.h"
-+#include "misc.h"
-+#include "xmalloc.h"
-+#include "ldapconf.h"
-+#include <unistd.h>
-+#include <stdlib.h>
-+#include <string.h>
-+
-+/* Keyword tokens. */
-+
-+typedef enum {
-+ lBadOption,
-+ lHost, lURI, lBase, lBindDN, lBindPW, lRootBindDN,
-+ lScope, lDeref, lPort, lTimeLimit, lBind_TimeLimit,
-+ lLdap_Version, lBind_Policy, lSSLPath, lSSL, lReferrals,
-+ lRestart, lTLS_CheckPeer, lTLS_CaCertFile,
-+ lTLS_CaCertDir, lTLS_Ciphers, lTLS_Cert, lTLS_Key,
-+ lTLS_RandFile, lLogDir, lDebug, lSSH_Filter,
-+ lAccountClass, lDeprecated, lUnsupported
-+} OpCodes;
-+
-+/* Textual representations of the tokens. */
-+
-+static struct {
-+ const char *name;
-+ OpCodes opcode;
-+} keywords[] = {
-+ { "URI", lURI },
-+ { "Base", lBase },
-+ { "BindDN", lBindDN },
-+ { "BindPW", lBindPW },
-+ { "RootBindDN", lRootBindDN },
-+ { "Host", lHost },
-+ { "Port", lPort },
-+ { "Scope", lScope },
-+ { "Deref", lDeref },
-+ { "TimeLimit", lTimeLimit },
-+ { "TimeOut", lTimeLimit },
-+ { "Bind_Timelimit", lBind_TimeLimit },
-+ { "Network_TimeOut", lBind_TimeLimit },
-+/*
-+ * Todo
-+ * SIZELIMIT
-+ */
-+ { "Ldap_Version", lLdap_Version },
-+ { "Version", lLdap_Version },
-+ { "Bind_Policy", lBind_Policy },
-+ { "SSLPath", lSSLPath },
-+ { "SSL", lSSL },
-+ { "Referrals", lReferrals },
-+ { "Restart", lRestart },
-+ { "TLS_CheckPeer", lTLS_CheckPeer },
-+ { "TLS_ReqCert", lTLS_CheckPeer },
-+ { "TLS_CaCertFile", lTLS_CaCertFile },
-+ { "TLS_CaCert", lTLS_CaCertFile },
-+ { "TLS_CaCertDir", lTLS_CaCertDir },
-+ { "TLS_Ciphers", lTLS_Ciphers },
-+ { "TLS_Cipher_Suite", lTLS_Ciphers },
-+ { "TLS_Cert", lTLS_Cert },
-+ { "TLS_Certificate", lTLS_Cert },
-+ { "TLS_Key", lTLS_Key },
-+ { "TLS_RandFile", lTLS_RandFile },
-+/*
-+ * Todo
-+ * TLS_CRLCHECK
-+ * TLS_CRLFILE
-+ */
-+ { "LogDir", lLogDir },
-+ { "Debug", lDebug },
-+ { "SSH_Filter", lSSH_Filter },
-+ { "AccountClass", lAccountClass },
-+ { NULL, lBadOption }
-+};
-+
-+/* Configuration ptions. */
-+
-+Options options;
-+
-+/*
-+ * Returns the number of the token pointed to by cp or oBadOption.
-+ */
-+
-+static OpCodes
-+parse_token(const char *cp, const char *filename, int linenum)
-+{
-+ u_int i;
-+
-+ for (i = 0; keywords[i].name; i++)
-+ if (strcasecmp(cp, keywords[i].name) == 0)
-+ return keywords[i].opcode;
-+
-+ if (config_warning_config_file)
-+ logit("%s: line %d: Bad configuration option: %s",
-+ filename, linenum, cp);
-+ return lBadOption;
-+}
-+
-+/*
-+ * Processes a single option line as used in the configuration files. This
-+ * only sets those values that have not already been set.
-+ */
-+#define WHITESPACE " \t\r\n"
-+
-+static int
-+process_config_line(char *line, const char *filename, int linenum)
-+{
-+ char *s, **charptr, **xstringptr, *endofnumber, *keyword, *arg;
-+ char *rootbinddn = NULL;
-+ int opcode, *intptr, value;
-+ size_t len;
-+
-+ /* Strip trailing whitespace */
-+ for (len = strlen(line) - 1; len > 0; len--) {
-+ if (strchr(WHITESPACE, line[len]) == NULL)
-+ break;
-+ line[len] = '\0';
-+ }
-+
-+ s = line;
-+ /* Get the keyword. (Each line is supposed to begin with a keyword). */
-+ if ((keyword = strdelim(&s)) == NULL)
-+ return 0;
-+ /* Ignore leading whitespace. */
-+ if (*keyword == '\0')
-+ keyword = strdelim(&s);
-+ if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
-+ return 0;
-+
-+ opcode = parse_token(keyword, filename, linenum);
-+
-+ switch (opcode) {
-+ case lBadOption:
-+ /* don't panic, but count bad options */
-+ return -1;
-+ /* NOTREACHED */
-+
-+ case lHost:
-+ xstringptr = &options.host;
-+parse_xstring:
-+ if (!s || *s == '\0')
-+ fatal("%s line %d: missing dn",filename,linenum);
-+ if (*xstringptr == NULL)
-+ *xstringptr = xstrdup(s);
-+ return 0;
-+
-+ case lURI:
-+ xstringptr = &options.uri;
-+ goto parse_xstring;
-+
-+ case lBase:
-+ xstringptr = &options.base;
-+ goto parse_xstring;
-+
-+ case lBindDN:
-+ xstringptr = &options.binddn;
-+ goto parse_xstring;
-+
-+ case lBindPW:
-+ charptr = &options.bindpw;
-+parse_string:
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing argument.", filename, linenum);
-+ if (*charptr == NULL)
-+ *charptr = xstrdup(arg);
-+ break;
-+
-+ case lRootBindDN:
-+ xstringptr = &rootbinddn;
-+ goto parse_xstring;
-+
-+ case lScope:
-+ intptr = &options.scope;
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing sub/one/base argument.", filename, linenum);
-+ value = 0; /* To avoid compiler warning... */
-+ if (strcasecmp (arg, "sub") == 0 || strcasecmp (arg, "subtree") == 0)
-+ value = LDAP_SCOPE_SUBTREE;
-+ else if (strcasecmp (arg, "one") == 0)
-+ value = LDAP_SCOPE_ONELEVEL;
-+ else if (strcasecmp (arg, "base") == 0)
-+ value = LDAP_SCOPE_BASE;
-+ else
-+ fatal("%.200s line %d: Bad sub/one/base argument.", filename, linenum);
-+ if (*intptr == -1)
-+ *intptr = value;
-+ break;
-+
-+ case lDeref:
-+ intptr = &options.scope;
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing never/searching/finding/always argument.", filename, linenum);
-+ value = 0; /* To avoid compiler warning... */
-+ if (!strcasecmp (arg, "never"))
-+ value = LDAP_DEREF_NEVER;
-+ else if (!strcasecmp (arg, "searching"))
-+ value = LDAP_DEREF_SEARCHING;
-+ else if (!strcasecmp (arg, "finding"))
-+ value = LDAP_DEREF_FINDING;
-+ else if (!strcasecmp (arg, "always"))
-+ value = LDAP_DEREF_ALWAYS;
-+ else
-+ fatal("%.200s line %d: Bad never/searching/finding/always argument.", filename, linenum);
-+ if (*intptr == -1)
-+ *intptr = value;
-+ break;
-+
-+ case lPort:
-+ intptr = &options.port;
-+parse_int:
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing argument.", filename, linenum);
-+ if (arg[0] < '0' || arg[0] > '9')
-+ fatal("%.200s line %d: Bad number.", filename, linenum);
-+
-+ /* Octal, decimal, or hex format? */
-+ value = strtol(arg, &endofnumber, 0);
-+ if (arg == endofnumber)
-+ fatal("%.200s line %d: Bad number.", filename, linenum);
-+ if (*intptr == -1)
-+ *intptr = value;
-+ break;
-+
-+ case lTimeLimit:
-+ intptr = &options.timelimit;
-+parse_time:
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%s line %d: missing time value.",
-+ filename, linenum);
-+ if ((value = convtime(arg)) == -1)
-+ fatal("%s line %d: invalid time value.",
-+ filename, linenum);
-+ if (*intptr == -1)
-+ *intptr = value;
-+ break;
-+
-+ case lBind_TimeLimit:
-+ intptr = &options.bind_timelimit;
-+ goto parse_time;
-+
-+ case lLdap_Version:
-+ intptr = &options.ldap_version;
-+ goto parse_int;
-+
-+ case lBind_Policy:
-+ intptr = &options.bind_policy;
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing soft/hard argument.", filename, linenum);
-+ value = 0; /* To avoid compiler warning... */
-+ if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "hard_open") == 0 || strcasecmp(arg, "hard_init") == 0)
-+ value = 1;
-+ else if (strcasecmp(arg, "soft") == 0)
-+ value = 0;
-+ else
-+ fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
-+ if (*intptr == -1)
-+ break;
-+
-+ case lSSLPath:
-+ charptr = &options.sslpath;
-+ goto parse_string;
-+
-+ case lSSL:
-+ intptr = &options.ssl;
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing yes/no/start_tls argument.", filename, linenum);
-+ value = 0; /* To avoid compiler warning... */
-+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
-+ value = SSL_LDAPS;
-+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
-+ value = SSL_OFF;
-+ else if (!strcasecmp (arg, "start_tls"))
-+ value = SSL_START_TLS;
-+ else
-+ fatal("%.200s line %d: Bad yes/no/start_tls argument.", filename, linenum);
-+ if (*intptr == -1)
-+ *intptr = value;
-+ break;
-+
-+ case lReferrals:
-+ intptr = &options.referrals;
-+parse_flag:
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
-+ value = 0; /* To avoid compiler warning... */
-+ if (strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
-+ value = 1;
-+ else if (strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
-+ value = 0;
-+ else
-+ fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
-+ if (*intptr == -1)
-+ *intptr = value;
-+ break;
-+
-+ case lRestart:
-+ intptr = &options.restart;
-+ goto parse_flag;
-+
-+ case lTLS_CheckPeer:
-+ intptr = &options.tls_checkpeer;
-+ arg = strdelim(&s);
-+ if (!arg || *arg == '\0')
-+ fatal("%.200s line %d: Missing never/hard/demand/alow/try argument.", filename, linenum);
-+ value = 0; /* To avoid compiler warning... */
-+ if (strcasecmp(arg, "never") == 0 || strcasecmp(arg, "no") == 0 || strcasecmp(arg, "false") == 0 || strcasecmp(arg, "off") == 0)
-+ value = LDAP_OPT_X_TLS_NEVER;
-+ else if (strcasecmp(arg, "hard") == 0 || strcasecmp(arg, "yes") == 0 || strcasecmp(arg, "true") == 0 || strcasecmp(arg, "on") == 0)
-+ value = LDAP_OPT_X_TLS_HARD;
-+ else if (strcasecmp(arg, "demand") == 0)
-+ value = LDAP_OPT_X_TLS_DEMAND;
-+ else if (strcasecmp(arg, "allow") == 0)
-+ value = LDAP_OPT_X_TLS_ALLOW;
-+ else if (strcasecmp(arg, "try") == 0)
-+ value = LDAP_OPT_X_TLS_TRY;
-+ else
-+ fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
-+ if (*intptr == -1)
-+ break;
-+
-+ case lTLS_CaCertFile:
-+ charptr = &options.tls_cacertfile;
-+ goto parse_string;
-+
-+ case lTLS_CaCertDir:
-+ charptr = &options.tls_cacertdir;
-+ goto parse_string;
-+
-+ case lTLS_Ciphers:
-+ xstringptr = &options.tls_ciphers;
-+ goto parse_xstring;
-+
-+ case lTLS_Cert:
-+ charptr = &options.tls_cert;
-+ goto parse_string;
-+
-+ case lTLS_Key:
-+ charptr = &options.tls_key;
-+ goto parse_string;
-+
-+ case lTLS_RandFile:
-+ charptr = &options.tls_randfile;
-+ goto parse_string;
-+
-+ case lLogDir:
-+ charptr = &options.logdir;
-+ goto parse_string;
-+
-+ case lDebug:
-+ intptr = &options.debug;
-+ goto parse_int;
-+
-+ case lSSH_Filter:
-+ xstringptr = &options.ssh_filter;
-+ goto parse_xstring;
-+
-+ case lAccountClass:
-+ charptr = &options.account_class;
-+ goto parse_string;
-+
-+ case lDeprecated:
-+ debug("%s line %d: Deprecated option \"%s\"",
-+ filename, linenum, keyword);
-+ return 0;
-+
-+ case lUnsupported:
-+ error("%s line %d: Unsupported option \"%s\"",
-+ filename, linenum, keyword);
-+ return 0;
-+
-+ default:
-+ fatal("process_config_line: Unimplemented opcode %d", opcode);
-+ }
-+
-+ /* Check that there is no garbage at end of line. */
-+ if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
-+ fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
-+ filename, linenum, arg);
-+ }
-+ return 0;
-+}
-+
-+/*
-+ * Reads the config file and modifies the options accordingly. Options
-+ * should already be initialized before this call. This never returns if
-+ * there is an error. If the file does not exist, this returns 0.
-+ */
-+
-+void
-+read_config_file(const char *filename)
-+{
-+ FILE *f;
-+ char line[1024];
-+ int active, linenum;
-+ int bad_options = 0;
-+ struct stat sb;
-+
-+ if ((f = fopen(filename, "r")) == NULL)
-+ fatal("fopen %s: %s", filename, strerror(errno));
-+
-+ if (fstat(fileno(f), &sb) == -1)
-+ fatal("fstat %s: %s", filename, strerror(errno));
-+ if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
-+ (sb.st_mode & 022) != 0))
-+ fatal("Bad owner or permissions on %s", filename);
-+
-+ debug("Reading configuration data %.200s", filename);
-+
-+ /*
-+ * Mark that we are now processing the options. This flag is turned
-+ * on/off by Host specifications.
-+ */
-+ active = 1;
-+ linenum = 0;
-+ while (fgets(line, sizeof(line), f)) {
-+ /* Update line number counter. */
-+ linenum++;
-+ if (process_config_line(line, filename, linenum) != 0)
-+ bad_options++;
-+ }
-+ fclose(f);
-+ if ((bad_options > 0) && config_exclusive_config_file)
-+ fatal("%s: terminating, %d bad configuration options",
-+ filename, bad_options);
-+}
-+
-+/*
-+ * Initializes options to special values that indicate that they have not yet
-+ * been set. Read_config_file will only set options with this value. Options
-+ * are processed in the following order: command line, user config file,
-+ * system config file. Last, fill_default_options is called.
-+ */
-+
-+void
-+initialize_options(void)
-+{
-+ memset(&options, 'X', sizeof(options));
-+ options.host = NULL;
-+ options.uri = NULL;
-+ options.base = NULL;
-+ options.binddn = NULL;
-+ options.bindpw = NULL;
-+ options.scope = -1;
-+ options.deref = -1;
-+ options.port = -1;
-+ options.timelimit = -1;
-+ options.bind_timelimit = -1;
-+ options.ldap_version = -1;
-+ options.bind_policy = -1;
-+ options.sslpath = NULL;
-+ options.ssl = -1;
-+ options.referrals = -1;
-+ options.restart = -1;
-+ options.tls_checkpeer = -1;
-+ options.tls_cacertfile = NULL;
-+ options.tls_cacertdir = NULL;
-+ options.tls_ciphers = NULL;
-+ options.tls_cert = NULL;
-+ options.tls_key = NULL;
-+ options.tls_randfile = NULL;
-+ options.logdir = NULL;
-+ options.debug = -1;
-+ options.ssh_filter = NULL;
-+ options.account_class = NULL;
-+}
-+
-+/*
-+ * Called after processing other sources of option data, this fills those
-+ * options for which no value has been specified with their default values.
-+ */
-+
-+void
-+fill_default_options(void)
-+{
-+ if (options.uri != NULL) {
-+ LDAPURLDesc *ludp;
-+
-+ if (ldap_url_parse(options.uri, &ludp) == LDAP_SUCCESS) {
-+ if (options.ssl == -1) {
-+ if (strcmp (ludp->lud_scheme, "ldap") == 0)
-+ options.ssl = 2;
-+ if (strcmp (ludp->lud_scheme, "ldapi") == 0)
-+ options.ssl = 0;
-+ else if (strcmp (ludp->lud_scheme, "ldaps") == 0)
-+ options.ssl = 1;
-+ }
-+ if (options.host == NULL)
-+ options.host = xstrdup (ludp->lud_host);
-+ if (options.port == -1)
-+ options.port = ludp->lud_port;
-+
-+ ldap_free_urldesc (ludp);
-+ }
-+ }
-+ if (options.ssl == -1)
-+ options.ssl = SSL_START_TLS;
-+ if (options.port == -1)
-+ options.port = (options.ssl == 0) ? 389 : 636;
-+ if (options.uri == NULL) {
-+ int len;
-+#define MAXURILEN 4096
-+
-+ options.uri = xmalloc (MAXURILEN);
-+ len = snprintf (options.uri, MAXURILEN, "ldap%s://%s:%d",
-+ (options.ssl == 0) ? "" : "s", options.host, options.port);
-+ options.uri[MAXURILEN - 1] = 0;
-+ options.uri = xreallocarray (options.uri, len + 1, 1);
-+ }
-+ if (options.binddn == NULL)
-+ options.binddn = "";
-+ if (options.bindpw == NULL)
-+ options.bindpw = "";
-+ if (options.scope == -1)
-+ options.scope = LDAP_SCOPE_SUBTREE;
-+ if (options.deref == -1)
-+ options.deref = LDAP_DEREF_NEVER;
-+ if (options.timelimit == -1)
-+ options.timelimit = 10;
-+ if (options.bind_timelimit == -1)
-+ options.bind_timelimit = 10;
-+ if (options.ldap_version == -1)
-+ options.ldap_version = 3;
-+ if (options.bind_policy == -1)
-+ options.bind_policy = 1;
-+ if (options.referrals == -1)
-+ options.referrals = 1;
-+ if (options.restart == -1)
-+ options.restart = 1;
-+ if (options.tls_checkpeer == -1)
-+ options.tls_checkpeer = LDAP_OPT_X_TLS_HARD;
-+ if (options.debug == -1)
-+ options.debug = 0;
-+ if (options.ssh_filter == NULL)
-+ options.ssh_filter = "";
-+ if (options.account_class == NULL)
-+ options.account_class = "posixAccount";
-+}
-+
-+static const char *
-+lookup_opcode_name(OpCodes code)
-+{
-+ u_int i;
-+
-+ for (i = 0; keywords[i].name != NULL; i++)
-+ if (keywords[i].opcode == code)
-+ return(keywords[i].name);
-+ return "UNKNOWN";
-+}
-+
-+static void
-+dump_cfg_string(OpCodes code, const char *val)
-+{
-+ if (val == NULL)
-+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
-+ else
-+ debug3("%s %s", lookup_opcode_name(code), val);
-+}
-+
-+static void
-+dump_cfg_int(OpCodes code, int val)
-+{
-+ if (val == -1)
-+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
-+ else
-+ debug3("%s %d", lookup_opcode_name(code), val);
-+}
-+
-+struct names {
-+ int value;
-+ char *name;
-+};
-+
-+static void
-+dump_cfg_namedint(OpCodes code, int val, struct names *names)
-+{
-+ u_int i;
-+
-+ if (val == -1)
-+ debug3("%s <UNDEFINED>", lookup_opcode_name(code));
-+ else {
-+ for (i = 0; names[i].value != -1; i++)
-+ if (names[i].value == val) {
-+ debug3("%s %s", lookup_opcode_name(code), names[i].name);
-+ return;
-+ }
-+ debug3("%s unknown: %d", lookup_opcode_name(code), val);
-+ }
-+}
-+
-+static struct names _yesnotls[] = {
-+ { 0, "No" },
-+ { 1, "Yes" },
-+ { 2, "Start_TLS" },
-+ { -1, NULL }};
-+
-+static struct names _scope[] = {
-+ { LDAP_SCOPE_BASE, "Base" },
-+ { LDAP_SCOPE_ONELEVEL, "One" },
-+ { LDAP_SCOPE_SUBTREE, "Sub"},
-+ { -1, NULL }};
-+
-+static struct names _deref[] = {
-+ { LDAP_DEREF_NEVER, "Never" },
-+ { LDAP_DEREF_SEARCHING, "Searching" },
-+ { LDAP_DEREF_FINDING, "Finding" },
-+ { LDAP_DEREF_ALWAYS, "Always" },
-+ { -1, NULL }};
-+
-+static struct names _yesno[] = {
-+ { 0, "No" },
-+ { 1, "Yes" },
-+ { -1, NULL }};
-+
-+static struct names _bindpolicy[] = {
-+ { 0, "Soft" },
-+ { 1, "Hard" },
-+ { -1, NULL }};
-+
-+static struct names _checkpeer[] = {
-+ { LDAP_OPT_X_TLS_NEVER, "Never" },
-+ { LDAP_OPT_X_TLS_HARD, "Hard" },
-+ { LDAP_OPT_X_TLS_DEMAND, "Demand" },
-+ { LDAP_OPT_X_TLS_ALLOW, "Allow" },
-+ { LDAP_OPT_X_TLS_TRY, "TRY" },
-+ { -1, NULL }};
-+
-+void
-+dump_config(void)
-+{
-+ dump_cfg_string(lURI, options.uri);
-+ dump_cfg_string(lHost, options.host);
-+ dump_cfg_int(lPort, options.port);
-+ dump_cfg_namedint(lSSL, options.ssl, _yesnotls);
-+ dump_cfg_int(lLdap_Version, options.ldap_version);
-+ dump_cfg_int(lTimeLimit, options.timelimit);
-+ dump_cfg_int(lBind_TimeLimit, options.bind_timelimit);
-+ dump_cfg_string(lBase, options.base);
-+ dump_cfg_string(lBindDN, options.binddn);
-+ dump_cfg_string(lBindPW, options.bindpw);
-+ dump_cfg_namedint(lScope, options.scope, _scope);
-+ dump_cfg_namedint(lDeref, options.deref, _deref);
-+ dump_cfg_namedint(lReferrals, options.referrals, _yesno);
-+ dump_cfg_namedint(lRestart, options.restart, _yesno);
-+ dump_cfg_namedint(lBind_Policy, options.bind_policy, _bindpolicy);
-+ dump_cfg_string(lSSLPath, options.sslpath);
-+ dump_cfg_namedint(lTLS_CheckPeer, options.tls_checkpeer, _checkpeer);
-+ dump_cfg_string(lTLS_CaCertFile, options.tls_cacertfile);
-+ dump_cfg_string(lTLS_CaCertDir, options.tls_cacertdir);
-+ dump_cfg_string(lTLS_Ciphers, options.tls_ciphers);
-+ dump_cfg_string(lTLS_Cert, options.tls_cert);
-+ dump_cfg_string(lTLS_Key, options.tls_key);
-+ dump_cfg_string(lTLS_RandFile, options.tls_randfile);
-+ dump_cfg_string(lLogDir, options.logdir);
-+ dump_cfg_int(lDebug, options.debug);
-+ dump_cfg_string(lSSH_Filter, options.ssh_filter);
-+ dump_cfg_string(lAccountClass, options.logdir);
-+}
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapconf.h openssh-8.4p1/ldapconf.h
---- openssh-8.4p1.org/ldapconf.h 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapconf.h 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,72 @@
-+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#ifndef LDAPCONF_H
-+#define LDAPCONF_H
-+
-+#define SSL_OFF 0
-+#define SSL_LDAPS 1
-+#define SSL_START_TLS 2
-+
-+/* Data structure for representing option data. */
-+
-+typedef struct {
-+ char *host;
-+ char *uri;
-+ char *base;
-+ char *binddn;
-+ char *bindpw;
-+ int scope;
-+ int deref;
-+ int port;
-+ int timelimit;
-+ int bind_timelimit;
-+ int ldap_version;
-+ int bind_policy;
-+ char *sslpath;
-+ int ssl;
-+ int referrals;
-+ int restart;
-+ int tls_checkpeer;
-+ char *tls_cacertfile;
-+ char *tls_cacertdir;
-+ char *tls_ciphers;
-+ char *tls_cert;
-+ char *tls_key;
-+ char *tls_randfile;
-+ char *logdir;
-+ int debug;
-+ char *ssh_filter;
-+ char *account_class;
-+} Options;
-+
-+extern Options options;
-+
-+void read_config_file(const char *);
-+void initialize_options(void);
-+void fill_default_options(void);
-+void dump_config(void);
-+
-+#endif /* LDAPCONF_H */
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapincludes.h openssh-8.4p1/ldapincludes.h
---- openssh-8.4p1.org/ldapincludes.h 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapincludes.h 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,41 @@
-+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#ifndef LDAPINCLUDES_H
-+#define LDAPINCLUDES_H
-+
-+#include "includes.h"
-+
-+#ifdef HAVE_LBER_H
-+#include <lber.h>
-+#endif
-+#ifdef HAVE_LDAP_H
-+#include <ldap.h>
-+#endif
-+#ifdef HAVE_LDAP_SSL_H
-+#include <ldap_ssl.h>
-+#endif
-+
-+#endif /* LDAPINCLUDES_H */
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapmisc.c openssh-8.4p1/ldapmisc.c
---- openssh-8.4p1.org/ldapmisc.c 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapmisc.c 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,79 @@
-+
-+#include "ldapincludes.h"
-+#include "ldapmisc.h"
-+
-+#ifndef HAVE_LDAP_GET_LDERRNO
-+int
-+ldap_get_lderrno (LDAP * ld, char **m, char **s)
-+{
-+#ifdef HAVE_LDAP_GET_OPTION
-+ int rc;
-+#endif
-+ int lderrno;
-+
-+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
-+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
-+ return rc;
-+#else
-+ lderrno = ld->ld_errno;
-+#endif
-+
-+ if (s != NULL) {
-+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
-+ if ((rc = ldap_get_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
-+ return rc;
-+#else
-+ *s = ld->ld_error;
-+#endif
-+ }
-+
-+ if (m != NULL) {
-+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
-+ if ((rc = ldap_get_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
-+ return rc;
-+#else
-+ *m = ld->ld_matched;
-+#endif
-+ }
-+
-+ return lderrno;
-+}
-+#endif
-+
-+#ifndef HAVE_LDAP_SET_LDERRNO
-+int
-+ldap_set_lderrno (LDAP * ld, int lderrno, const char *m, const char *s)
-+{
-+#ifdef HAVE_LDAP_SET_OPTION
-+ int rc;
-+#endif
-+
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
-+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_NUMBER, &lderrno)) != LDAP_SUCCESS)
-+ return rc;
-+#else
-+ ld->ld_errno = lderrno;
-+#endif
-+
-+ if (s != NULL) {
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_ERROR_STRING)
-+ if ((rc = ldap_set_option (ld, LDAP_OPT_ERROR_STRING, s)) != LDAP_SUCCESS)
-+ return rc;
-+#else
-+ ld->ld_error = s;
-+#endif
-+ }
-+
-+ if (m != NULL) {
-+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_MATCHED_DN)
-+ if ((rc = ldap_set_option (ld, LDAP_OPT_MATCHED_DN, m)) != LDAP_SUCCESS)
-+ return rc;
-+#else
-+ ld->ld_matched = m;
-+#endif
-+ }
-+
-+ return LDAP_SUCCESS;
-+}
-+#endif
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ldapmisc.h openssh-8.4p1/ldapmisc.h
---- openssh-8.4p1.org/ldapmisc.h 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ldapmisc.h 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,35 @@
-+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
-+/*
-+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#ifndef LDAPMISC_H
-+#define LDAPMISC_H
-+
-+#include "ldapincludes.h"
-+
-+int ldap_get_lderrno (LDAP *, char **, char **);
-+int ldap_set_lderrno (LDAP *, int, const char *, const char *);
-+
-+#endif /* LDAPMISC_H */
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/openssh-lpk-openldap.schema openssh-8.4p1/openssh-lpk-openldap.schema
---- openssh-8.4p1.org/openssh-lpk-openldap.schema 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/openssh-lpk-openldap.schema 2021-03-01 11:29:31.280956671 +0100
-@@ -0,0 +1,21 @@
-+#
-+# LDAP Public Key Patch schema for use with openssh-ldappubkey
-+# useful with PKA-LDAP also
-+#
-+# Author: Eric AUGE <eau at phear.org>
-+#
-+# Based on the proposal of : Mark Ruijter
-+#
-+
-+
-+# octetString SYNTAX
-+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
-+ DESC 'MANDATORY: OpenSSH Public key'
-+ EQUALITY octetStringMatch
-+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
-+
-+# printableString SYNTAX yes|no
-+objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
-+ DESC 'MANDATORY: OpenSSH LPK objectclass'
-+ MUST ( sshPublicKey $ uid )
-+ )
-diff -urNp -x '*.orig' openssh-8.4p1.org/openssh-lpk-sun.schema openssh-8.4p1/openssh-lpk-sun.schema
---- openssh-8.4p1.org/openssh-lpk-sun.schema 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/openssh-lpk-sun.schema 2021-03-01 11:29:31.284290176 +0100
-@@ -0,0 +1,23 @@
-+#
-+# LDAP Public Key Patch schema for use with openssh-ldappubkey
-+# useful with PKA-LDAP also
-+#
-+# Author: Eric AUGE <eau at phear.org>
-+#
-+# Schema for Sun Directory Server.
-+# Based on the original schema, modified by Stefan Fischer.
-+#
-+
-+dn: cn=schema
-+
-+# octetString SYNTAX
-+attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
-+ DESC 'MANDATORY: OpenSSH Public key'
-+ EQUALITY octetStringMatch
-+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
-+
-+# printableString SYNTAX yes|no
-+objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
-+ DESC 'MANDATORY: OpenSSH LPK objectclass'
-+ MUST ( sshPublicKey $ uid )
-+ )
-diff -urNp -x '*.orig' openssh-8.4p1.org/ssh-ldap-helper.8 openssh-8.4p1/ssh-ldap-helper.8
---- openssh-8.4p1.org/ssh-ldap-helper.8 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ssh-ldap-helper.8 2021-03-01 11:29:31.284290176 +0100
-@@ -0,0 +1,79 @@
-+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
-+.\"
-+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
-+.\"
-+.\" Permission to use, copy, modify, and distribute this software for any
-+.\" purpose with or without fee is hereby granted, provided that the above
-+.\" copyright notice and this permission notice appear in all copies.
-+.\"
-+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+.\"
-+.Dd $Mdocdate: April 29 2010 $
-+.Dt SSH-LDAP-HELPER 8
-+.Os
-+.Sh NAME
-+.Nm ssh-ldap-helper
-+.Nd sshd helper program for ldap support
-+.Sh SYNOPSIS
-+.Nm ssh-ldap-helper
-+.Op Fl devw
-+.Op Fl f Ar file
-+.Op Fl s Ar user
-+.Sh DESCRIPTION
-+.Nm
-+is used by
-+.Xr sshd 1
-+to access keys provided by an LDAP.
-+.Nm
-+is disabled by default and can only be enabled in the
-+sshd configuration file
-+.Pa /etc/ssh/sshd_config
-+by setting
-+.Cm AuthorizedKeysCommand
-+to
-+.Dq /usr/libexec/ssh-ldap-wrapper .
-+.Pp
-+.Nm
-+is not intended to be invoked by the user, but from
-+.Xr sshd 8 via
-+.Xr ssh-ldap-wrapper .
-+.Pp
-+The options are as follows:
-+.Bl -tag -width Ds
-+.It Fl d
-+Set the debug mode;
-+.Nm
-+prints all logs to stderr instead of syslog.
-+.It Fl e
-+Implies \-w;
-+.Nm
-+halts if it encounters an unknown item in the ldap.conf file.
-+.It Fl f
-+.Nm
-+uses this file as the ldap configuration file instead of /etc/ssh/ldap.conf (default).
-+.It Fl s
-+.Nm
-+prints out the user's keys to stdout and exits.
-+.It Fl v
-+Implies \-d;
-+increases verbosity.
-+.It Fl w
-+.Nm
-+writes warnings about unknown items in the ldap.conf configuration file.
-+.El
-+.Sh SEE ALSO
-+.Xr sshd 8 ,
-+.Xr sshd_config 5 ,
-+.Xr ssh-ldap.conf 5 ,
-+.Sh HISTORY
-+.Nm
-+first appeared in
-+OpenSSH 5.5 + PKA-LDAP .
-+.Sh AUTHORS
-+.An Jan F. Chadima Aq jchadima at redhat.com
-diff -urNp -x '*.orig' openssh-8.4p1.org/ssh-ldap-wrapper openssh-8.4p1/ssh-ldap-wrapper
---- openssh-8.4p1.org/ssh-ldap-wrapper 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ssh-ldap-wrapper 2021-03-01 11:29:31.284290176 +0100
-@@ -0,0 +1,4 @@
-+#!/bin/sh
-+
-+exec /usr/libexec/openssh/ssh-ldap-helper -s "$1"
-+
-diff -urNp -x '*.orig' openssh-8.4p1.org/ssh-ldap.conf.5 openssh-8.4p1/ssh-ldap.conf.5
---- openssh-8.4p1.org/ssh-ldap.conf.5 1970-01-01 01:00:00.000000000 +0100
-+++ openssh-8.4p1/ssh-ldap.conf.5 2021-03-01 11:29:31.284290176 +0100
-@@ -0,0 +1,379 @@
-+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
-+.\"
-+.\" Copyright (c) 2010 Jan F. Chadima. All rights reserved.
-+.\"
-+.\" Permission to use, copy, modify, and distribute this software for any
-+.\" purpose with or without fee is hereby granted, provided that the above
-+.\" copyright notice and this permission notice appear in all copies.
-+.\"
-+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+.\"
-+.Dd $Mdocdate: may 12 2010 $
-+.Dt SSH-LDAP.CONF 5
-+.Os
-+.Sh NAME
-+.Nm ssh-ldap.conf
-+.Nd configuration file for ssh-ldap-helper
-+.Sh SYNOPSIS
-+.Nm /etc/ssh/ldap.conf
-+.Sh DESCRIPTION
-+.Xr ssh-ldap-helper 8
-+reads configuration data from
-+.Pa /etc/ssh/ldap.conf
-+(or the file specified with
-+.Fl f
-+on the command line).
-+The file contains keyword-argument pairs, one per line.
-+Lines starting with
-+.Ql #
-+and empty lines are interpreted as comments.
-+.Pp
-+The value starts with the first non-blank character after
-+the keyword's name, and terminates at the end of the line,
-+or at the last sequence of blanks before the end of the line.
-+Quoting values that contain blanks
-+may be incorrect, as the quotes would become part of the value.
-+The possible keywords and their meanings are as follows (note that
-+keywords are case-insensitive, and arguments, on a case by case basis, may be case-sensitive).
-+.Bl -tag -width Ds
-+.It Cm URI
-+The argument(s) are in the form
-+.Pa ldap[si]://[name[:port]]
-+and specify the URI(s) of an LDAP server(s) to which the
-+.Xr ssh-ldap-helper 8
-+should connect. The URI scheme may be any of
-+.Dq ldap ,
-+.Dq ldaps
-+or
-+.Dq ldapi ,
-+which refer to LDAP over TCP, LDAP over SSL (TLS) and LDAP
-+over IPC (UNIX domain sockets), respectively.
-+Each server's name can be specified as a
-+domain-style name or an IP address literal. Optionally, the
-+server's name can followed by a ':' and the port number the LDAP
-+server is listening on. If no port number is provided, the default
-+port for the scheme is used (389 for ldap://, 636 for ldaps://).
-+For LDAP over IPC, name is the name of the socket, and no port
-+is required, nor allowed; note that directory separators must be
-+URL-encoded, like any other characters that are special to URLs;
-+A space separated list of URIs may be provided.
-+There is no default.
-+.It Cm Base
-+Specifies the default base Distinguished Name (DN) to use when performing ldap operations.
-+The base must be specified as a DN in LDAP format.
-+There is no default.
-+.It Cm BindDN
-+Specifies the default BIND DN to use when connecting to the ldap server.
-+The bind DN must be specified as a Distinguished Name in LDAP format.
-+There is no default.
-+.It Cm BindPW
-+Specifies the default password to use when connecting to the ldap server via
-+.Cm BindDN .
-+There is no default.
-+.It Cm RootBindDN
-+Intentionaly does nothing. Recognized for compatibility reasons.
-+.It Cm Host
-+The argument(s) specifies the name(s) of an LDAP server(s) to which the
-+.Xr ssh-ldap-helper 8
-+should connect. Each server's name can be specified as a
-+domain-style name or an IP address and optionally followed by a ':' and
-+the port number the ldap server is listening on. A space-separated
-+list of hosts may be provided.
-+There is no default.
-+.Cm Host
-+is deprecated in favor of
-+.Cm URI .
-+.It Cm Port
-+Specifies the default port used when connecting to LDAP servers(s).
-+The port may be specified as a number.
-+The default port is 389 for ldap:// or 636 for ldaps:// respectively.
-+.Cm Port
-+is deprecated in favor of
-+.Cm URI .
-+.It Cm Scope
-+Specifies the starting point of an LDAP search and the depth from the base DN to which the search should descend.
-+There are three options (values) that can be assigned to the
-+.Cm Scope parameter:
-+.Dq base ,
-+.Dq one
-+and
-+.Dq subtree .
-+Alias for the subtree is
-+.Dq sub .
-+The value
<Skipped 374 lines>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/openssh-legacy.git/commitdiff/225db8a1721e3ba259f3f76b9ab288a2009b077a
More information about the pld-cvs-commit
mailing list