auth2-methods.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h misc.h servconf.h openbsd-compat/sys-queue.h xmalloc.h hostfile.h auth.h auth-pam.h audit.h loginrec.h

auth2-none.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h atomicio.h xmalloc.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h packet.h openbsd-compat/sys-queue.h dispatch.h log.h ssherr.h misc.h servconf.h ssh2.h monitor_wrap.h

auth2-passwd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h openbsd-compat/sys-queue.h dispatch.h ssherr.h log.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h monitor_wrap.h misc.h servconf.h

auth2-pubkeyfile.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh.h log.h ssherr.h misc.h sshkey.h digest.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-options.h authfile.h match.h

auth2.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h atomicio.h xmalloc.h ssh2.h packet.h openbsd-compat/sys-queue.h dispatch.h log.h ssherr.h sshbuf.h misc.h servconf.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h pathnames.h monitor_wrap.h digest.h kex.h

auth2.o: mac.h crypto_api.h

poly1305.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h poly1305.h

progressmeter.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h progressmeter.h atomicio.h misc.h utf8.h

readconf.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/glob.h xmalloc.h ssh.h ssherr.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h pathnames.h log.h sshkey.h misc.h readconf.h match.h kex.h mac.h crypto_api.h uidswap.h

readpass.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h misc.h pathnames.h log.h ssherr.h ssh.h uidswap.h

rijndael.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h rijndael.h

sandbox-capsicum.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

sandbox-darwin.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

sandbox-null.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

sandbox-rlimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

sandbox-seccomp-filter.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

sandbox-solaris.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

scp.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/glob.h xmalloc.h ssh.h atomicio.h pathnames.h log.h ssherr.h misc.h progressmeter.h utf8.h sftp.h sftp-common.h sftp-client.h

servconf.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/glob.h openbsd-compat/sys-queue.h xmalloc.h ssh.h log.h ssherr.h sshbuf.h misc.h servconf.h pathnames.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey.h kex.h

serverloop.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h packet.h dispatch.h sshbuf.h log.h ssherr.h misc.h servconf.h canohost.h sshpty.h channels.h ssh2.h sshkey.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h

serverloop.o: rijndael.h kex.h mac.h crypto_api.h hostfile.h auth.h auth-pam.h audit.h loginrec.h session.h auth-options.h serverloop.h

session.o: hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-options.h authfd.h pathnames.h log.h misc.h servconf.h sshlogin.h serverloop.h canohost.h session.h kex.h mac.h crypto_api.h monitor_wrap.h sftp.h atomicio.h

sshconnect.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h hostfile.h ssh.h sshbuf.h packet.h openbsd-compat/sys-queue.h dispatch.h sshkey.h sshconnect.h log.h ssherr.h match.h misc.h readconf.h atomicio.h dns.h monitor_fdpass.h ssh2.h version.h authfile.h

sshconnect2.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h packet.h dispatch.h compat.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey.h kex.h mac.h crypto_api.h

sshconnect2.o: sshconnect.h authfile.h dh.h authfd.h log.h ssherr.h misc.h readconf.h match.h canohost.h msg.h pathnames.h uidswap.h hostfile.h utf8.h ssh-sk.h sk-api.h

sshd-session.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshpty.h packet.h dispatch.h log.h ssherr.h sshbuf.h misc.h match.h servconf.h uidswap.h compat.h cipher.h cipher-chachapoly.h

sshd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h xmalloc.h ssh.h sshpty.h log.h ssherr.h sshbuf.h misc.h servconf.h compat.h digest.h sshkey.h authfile.h pathnames.h canohost.h hostfile.h auth.h auth-pam.h

ssherr.o: ssherr.h

sshkey-xmss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h

dtucker@dtucker.net sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBDV81zWQ1+XVfWH5z4L4klDQ/z/6l2GLphfSTX/Rmq6kL5H8mkfzUlryxLlkN8cD9srtVJBAmwJWfJBNsCo958YAAAAEc3NoOg==

djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBLnJo3ZVDENYZGXm5uO9lU7b0iDFq5gHpTu1MaHPWTEfPdvw+AjFQQ/q5YizuMJkXGsMdYmblJEJZYHpm9IS7ZkAAAAEc3NoOg==

djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBJoAXBTQalfg+kC5wy1vE7HkIHtVnmV6AUuuIo9KQ1P+70juHwvsFKpsGaqQbrHJkTVgYDGVP02XHj8+Fb18yBIAAAAEc3NoOg==

djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBH+z1I48s6ydOhP5SJmI02zVCLf0K15B+UMHgoTIKVfUIv5oDoVX7e9f+7QiRmTeEOdZfQydiaVqsfi7qPSve+0AAAAEc3NoOg==

djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBPM4BmUg/fMnsl42JwktTekk/mB8Be3M+yK2ayg6lqYsqEri8yhRx84gey51OHKVk1TwlGbJjcMHI4URreDBEMQAAAAEc3NoOg==

9.9 :

[](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_9)

[](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_9)

kitchensink)

CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam"

CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux"

CFLAGS="-DSK_DEBUG -DSANDBOX_SECCOMP_FILTER_DEBUG"

;;

hardenedmalloc)

;;

tcmalloc)

CONFIGFLAGS="--with-ldflags=-ltcmalloc"

;;

krb5|heimdal)

CONFIGFLAGS="--with-kerberos5"

CONFIGFLAGS="--disable-pkcs11"

LIBCRYPTOFLAGS="--with-ssl-dir=/opt/boringssl --with-rpath=-Wl,-rpath,"

;;

libressl-*)

LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath,"

;;

CONFIGFLAGS="--with-selinux"

;;

sk)

;;

without-openssl)

LIBCRYPTOFLAGS="--without-openssl"

# Native linker is not great with PIC so OpenSSL is built w/out.

CONFIGFLAGS="${CONFIGFLAGS} --disable-security-key"

;;

hurd)

SKIP_LTESTS="forwarding multiplex proxy-connect hostkey-agent agent-ptrace"

;;

# SHA256 functions in sha2.h conflict with OpenSSL's breaking sk-dummy

CONFIGFLAGS="${CONFIGFLAGS} --without-hardening --disable-security-key"

;;

openwrt-*)

LIBCRYPTOFLAGS="--without-openssl"

TEST_TARGET="t-exec"

;;

}

trap output_failed_logs 0

if [ -z "${LTESTS}" ]; then

else

fi

if [ ! -z "${SSHD_CONFOPTS}" ]; then

echo "rerunning t-exec with TEST_SSH_SSHD_CONFOPTS='${SSHD_CONFOPTS}'"

if [ -z "${LTESTS}" ]; then

else

fi

fi

INSTALL_BORINGSSL=1

PACKAGES="${PACKAGES} cmake ninja-build"

;;

putty-*)

INSTALL_PUTTY=$(echo "${TARGET}" | cut -f2 -d-)

PACKAGES="${PACKAGES} cmake"

cp -r ${HOME}/boringssl/include /opt/boringssl)

fi

if [ ! -z "${INSTALL_ZLIB}" ]; then

(cd ${HOME} && git clone https://github.com/madler/zlib.git &&

cd ${HOME}/zlib && ./configure && make &&

on:

push:

pull_request:

jobs:

ci:

matrix:

# First we test all OSes in the default configuration.

target:

- ubuntu-22.04

- macos-13

- macos-14

- windows-2019

- windows-2022

config: [default]

include:

- { target: windows-2019, config: cygwin-release }

- { target: windows-2022, config: cygwin-release }

- { target: ubuntu-22.04, config: gcc-11-Werror }

- { target: ubuntu-22.04, config: gcc-12-Werror }

- { target: ubuntu-22.04, config: hardenedmalloc }

- { target: ubuntu-latest, config: boringssl }

- { target: ubuntu-latest, config: libressl-master }

- { target: ubuntu-latest, config: libressl-3.2.6 }

- { target: ubuntu-latest, config: libressl-3.3.6 }

- { target: ubuntu-latest, config: libressl-3.6.1 }

- { target: ubuntu-latest, config: libressl-3.7.2 }

- { target: ubuntu-latest, config: libressl-3.8.4 }

- { target: ubuntu-latest, config: openssl-master }

- { target: ubuntu-latest, config: openssl-noec }

- { target: ubuntu-latest, config: openssl-1.1.1 }

- { target: ubuntu-latest, config: openssl-1.1.1t }

- { target: ubuntu-latest, config: openssl-1.1.1w }

- { target: ubuntu-latest, config: openssl-3.0.0 }

- { target: ubuntu-latest, config: openssl-3.1.0 }

- { target: ubuntu-latest, config: openssl-1.1.1_stable }

- { target: ubuntu-latest, config: openssl-3.0 } # stable branch

- { target: ubuntu-latest, config: openssl-3.1 } # stable branch

- { target: ubuntu-latest, config: putty-0.78 }

- { target: ubuntu-latest, config: putty-0.79 }

- { target: ubuntu-latest, config: putty-0.80 }

- { target: ubuntu-latest, config: putty-snapshot }

- { target: ubuntu-latest, config: zlib-develop }

- { target: macos-13, config: pam }

- { target: macos-14, config: pam }

runs-on: ${{ matrix.target }}

steps:

- name: set cygwin git params

REMOTE: ${{ startsWith(matrix.host, 'remote') }}

VM: ${{ startsWith(matrix.host, 'libvirt') || startsWith(matrix.host, 'persist') }}

SSHFS: ${{ startsWith(matrix.host, 'libvirt') || startsWith(matrix.host, 'persist') || startsWith(matrix.host, 'remote') }}

strategy:

fail-fast: false

# We use a matrix in two parts: firstly all of the VMs are tested with the

- fbsd12

- fbsd13

- fbsd14

- nbsd3

- nbsd4

- nbsd8

- nbsd9

- obsd51

- obsd67

- obsd72

include:

# Long-running/slow tests have access to high priority runners.

- { target: aix51, config: default, host: libvirt-hipri }

- { target: openindiana, config: pam, host: libvirt-hipri }

- { target: sol10, config: default, host: libvirt-hipri }

- { target: sol10, config: pam, host: libvirt-hipri }

- { target: ARM64, config: pam, host: ARM64 }

# Physical hosts with remote runners.

- { target: debian-riscv64, config: default, host: remote-debian-riscv64 }

- { target: openwrt-mips, config: default, host: remote-openwrt-mips }

- { target: openwrt-mipsel, config: default, host: remote-openwrt-mipsel }

steps:

- name: shutdown VM if running

if: env.VM == 'true'

run: vmshutdown

if: always() && env.SSHFS == 'true'

run: fusermount -u ${GITHUB_WORKSPACE} || true

working-directory: ${{ runner.temp }}

- name: shutdown VM

if: always() && env.VM == 'true'

run: vmshutdown

selfhosted:

name: "upstream ${{ matrix.target }} ${{ matrix.config }}"

if: github.repository == 'openssh/openssh-portable-selfhosted'

env:

DEBUG_ACTIONS: true

EPHEMERAL: true

TARGET_HOST: ${{ matrix.target }}

TARGET_CONFIG: ${{ matrix.config }}

TARGET_DOMAIN: ${{ format('{0}-{1}-{2}', matrix.target, matrix.config, github.run_id) || matrix.target }}

strategy:

fail-fast: false

matrix:

target: [ obsdsnap, obsdsnap-i386 ]

config: [ default, without-openssl, ubsan ]

steps:

- name: unmount stale workspace

run: fusermount -u ${GITHUB_WORKSPACE} || true

env:

SUDO: sudo

timeout-minutes: 300

- name: save logs

if: failure()

uses: actions/upload-artifact@main

with:

name: ${{ matrix.target }}-${{ matrix.config }}-logs

path: |

- name: unmount workspace

if: always()

working-directory: ${{ runner.temp }}

- name: shutdown VM

if: always()

**/*.o

**/*.lo

**/*.so

**/*.out

**/*.a

**/*.un~

ssh-pkcs11-helper

ssh-sk-helper

sshd

tags

fb39324748824cb0387e9d67c41d1bef945c54ea Makefile change

5f378c38ad8976d507786dc4db9283a879ec8cd0 Makefile change

112aacedd3b61cc5c34b1fa6d9fb759214179172 Makefile change

Old upstream tree:

Author: Damien Miller <djm@mindrot.org>

Date: Tue Feb 18 19:03:42 2025 +1100

openssh-9.9p2

Author: djm@openbsd.org <djm@openbsd.org>

Date: Tue Feb 18 08:02:48 2025 +0000

OpenBSD-Commit-ID: 7bcd4ffe0fa1e27ff98d451fb9c22f5fae6e610d

Author: djm@openbsd.org <djm@openbsd.org>

Date: Tue Feb 18 08:02:12 2025 +0000

OpenBSD-Commit-ID: c656ac4abd1504389d1733d85152044b15830217

Author: djm@openbsd.org <djm@openbsd.org>

Date: Mon Feb 10 23:00:29 2025 +0000

OpenBSD-Commit-ID: 02703b4bd207fafd03788bc4e7774bf80be6c9a8

Author: Damien Miller <djm@mindrot.org>

Date: Wed Oct 30 14:25:14 2024 +1100

fix uint64_t types; reported by Tom G. Christensen

Author: Damien Miller <djm@mindrot.org>

Date: Sun Oct 27 13:28:11 2024 +1100

htole64() etc for systems without endian.h

Author: djm@openbsd.org <djm@openbsd.org>

Date: Sun Oct 27 02:06:59 2024 +0000

OpenBSD-Commit-ID: 13511fdef7535bdbc35b644c90090013da43a318

Author: djm@openbsd.org <djm@openbsd.org>

Date: Sun Oct 27 02:06:01 2024 +0000

OpenBSD-Commit-ID: 26d81a430811672bc762687166986cad40d28cc0

Author: djm@openbsd.org <djm@openbsd.org>

Date: Thu Sep 26 23:55:08 2024 +0000

OpenBSD-Commit-ID: b1c6acec66cd5bd1252feff1d02ad7129ced37c7

Author: djm@openbsd.org <djm@openbsd.org>

Date: Wed Sep 25 01:24:04 2024 +0000

OpenBSD-Commit-ID: d1eebedb8c902002b75b75debfe1eeea1801f58a

Author: Damien Miller <djm@mindrot.org>

Date: Wed Sep 25 11:15:45 2024 +1000

From Void Linux

Author: Damien Miller <djm@mindrot.org>

Date: Wed Sep 25 11:13:05 2024 +1000

Fixes compile error on Void Linux/Musl

Author: Christoph Ostarek <christoph@zededa.com>

Date: Wed Jul 3 12:46:59 2024 +0200

02e16ad95fb1f56ab004b01a10aab89f7103c55d did a copy-paste for

utmpx, but forgot to change the ifdef appropriately

Author: Darren Tucker <dtucker@dtucker.net>

Date: Mon Sep 23 20:52:31 2024 +1000

Add 9.9 branch to CI status console.

commit 46d1fb16b20e971b9ac15e86a3d3e350b49c9ad6

Author: Damien Miller <djm@mindrot.org>

Date: Fri Sep 20 08:20:13 2024 +1000

Date: Tue Apr 11 16:49:19 2023 +1000

Test against LibreSSL 3.7.2.

PRNGD:

If your system lacks kernel-based random collection, the use of Lutz

http://prngd.sourceforge.net/

EGD:

The Entropy Gathering Daemon (EGD) supports the same interface as prngd.

http://egd.sourceforge.net/

Autoconf:

If you modify configure.ac or configure doesn't exist (eg if you checked

"autoreconf". Earlier versions may also work but this is not guaranteed.

http://www.gnu.org/software/autoconf/

abs_top_srcdir=@abs_top_srcdir@

abs_top_builddir=@abs_top_builddir@

VPATH=@srcdir@

SSH_PROGRAM=@bindir@/ssh

ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass

SFTP_SERVER=$(libexecdir)/sftp-server

SSH_KEYSIGN=$(libexecdir)/ssh-keysign

SSHD_SESSION=$(libexecdir)/sshd-session

SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper

SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper

PRIVSEP_PATH=@PRIVSEP_PATH@

STRIP_OPT=@STRIP_OPT@

TEST_SHELL=@TEST_SHELL@

BUILDDIR=@abs_top_builddir@

PATHS= -DSSHDIR=\"$(sysconfdir)\" \

-D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \

-D_PATH_SFTP_SERVER=\"$(SFTP_SERVER)\" \

-D_PATH_SSH_KEY_SIGN=\"$(SSH_KEYSIGN)\" \

-D_PATH_SSHD_SESSION=\"$(SSHD_SESSION)\" \

-D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \

-D_PATH_SSH_SK_HELPER=\"$(SSH_SK_HELPER)\" \

-D_PATH_SSH_PIDDIR=\"$(piddir)\" \

SSHDLIBS=@SSHDLIBS@

LIBEDIT=@LIBEDIT@

LIBFIDO2=@LIBFIDO2@

AR=@AR@

AWK=@AWK@

RANLIB=@RANLIB@

.SUFFIXES: .lo

XMSS_OBJS=\

ssh-xmss.o \

auth2-gss.o gss-serv.o gss-serv-krb5.o \

loginrec.o auth-pam.o auth-shadow.o auth-sia.o \

sftp-server.o sftp-common.o \

SFTP_CLIENT_OBJS=sftp-common.o sftp-client.o sftp-glob.o

$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(CHANNELLIBS)

sshd-session$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHD_SESSION_OBJS)

scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS)

$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)

logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o

$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)

$(MANPAGES): $(MANPAGES_IN)

if test "$(MANTYPE)" = "cat"; then \

manpage=$(srcdir)/`echo $@ | sed 's/\.[1-9]\.out$$/\.0/'`; \

$(FIXPATHSCMD) $${manpage} | $(FIXALGORITHMSCMD) > $@; \

fi

conffile=`echo $@ | sed 's/.out$$//'`; \

$(FIXPATHSCMD) $(srcdir)/$${conffile} > $@

rm -f regress/unittests/utf8/test_utf8$(EXEEXT)

rm -f regress/misc/sk-dummy/*.o

rm -f regress/misc/sk-dummy/*.lo

(cd openbsd-compat && $(MAKE) clean)

distclean: regressclean

rm -f regress/misc/sk-dummy/*.o

rm -f regress/misc/sk-dummy/*.lo

rm -f regress/misc/sk-dummy/sk-dummy.so

(cd openbsd-compat && $(MAKE) distclean)

if test -d pkg ; then \

rm -fr pkg ; \

$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)

$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)

$(INSTALL) -m 0755 $(STRIP_OPT) sshd-session$(EXEEXT) $(DESTDIR)$(SSHD_SESSION)$(EXEEXT)

$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)

$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)

$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)

$(MKDIR_P) `pwd`/regress/unittests/sshsig

$(MKDIR_P) `pwd`/regress/unittests/utf8

$(MKDIR_P) `pwd`/regress/misc/sk-dummy

[ -f `pwd`/regress/Makefile ] || \

ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile

$(CC) $(CFLAGS) $(CPPFLAGS) $(PICFLAG) -shared -o $@ $(SK_DUMMY_OBJS) \

-L. -Lopenbsd-compat -lopenbsd-compat $(LDFLAGS_NOPIE) $(TESTLIBS)

regress-binaries: regress-prep $(LIBCOMPAT) \

regress/modpipe$(EXEEXT) \

regress/timestamp$(EXEEXT) \

OBJ="$(BUILDDIR)/regress" \

$@ && echo $@ tests passed

interop-tests t-exec file-tests extra-tests: regress-prep regress-binaries $(TARGETS)

cd $(srcdir)/regress || exit $$?; \

EGREP='@EGREP@' \

TEST_MALLOC_OPTIONS="@TEST_MALLOC_OPTIONS@" \

TEST_SSH_SCP="$(BUILDDIR)/scp" \

TEST_SSH_SSH="$(BUILDDIR)/ssh" \

TEST_SSH_SSHD_SESSION="$(BUILDDIR)/sshd-session" \

TEST_SSH_SSHAGENT="$(BUILDDIR)/ssh-agent" \

TEST_SSH_SSHADD="$(BUILDDIR)/ssh-add" \

TEST_SSH_SSHKEYGEN="$(BUILDDIR)/ssh-keygen" \

The SSH agent protocol is described in

This file documents OpenSSH's extensions to the agent protocol.

if any key (plain private or certificate) was successfully loaded, or

SSH_AGENT_FAILURE if no key was loaded.

Options must be lexically ordered by "name" if they appear in the

sequence. Each named option may only appear once in a certificate.

Custom options should append the originating author or organisation's

domain name to the option name, e.g. "my-option@example.com".

of this script will not be permitted if

this option is not present.

notes.

Please read https://www.openssh.com/report.html for bug reporting

This is the port of OpenBSD's excellent OpenSSH[0] to Linux and other

Unices.

OpenSSH is based on the last free version of Tatu Ylonen's sample

This port consists of the re-introduction of autoconf support, PAM

support, EGD/PRNGD support and replacements for OpenBSD library

This version actively tracks changes in the OpenBSD CVS repository.

There is now several mailing lists for this port of OpenSSH. Please

refer to https://www.openssh.com/list.html for details on how to join.

### Building a release

```

tar zxvf openssh-X.YpZ.tar.gz

### Building from git

```

git clone https://github.com/openssh/openssh-portable # or https://anongit.mindrot.org/openssh.git

/*

* Copyright (c) 2004-2008 Damien Miller <djm@mindrot.org>

#define _SA(x) ((struct sockaddr *)(x))

addr_unicast_masklen(int af)

{

switch (af) {

}

}

addr_xaddr_to_sa(const struct xaddr *xa, struct sockaddr *sa, socklen_t *len,

u_int16_t port)

{

return 0;

}

addr_invert(struct xaddr *n)

{

int i;

}

}

addr_hostmask(int af, u_int l, struct xaddr *n)

{

if (addr_netmask(af, l, n) == -1 || addr_invert(n) == -1)

}

}

addr_or(struct xaddr *dst, const struct xaddr *a, const struct xaddr *b)

{

int i;

}

}

addr_is_all0s(const struct xaddr *a)

{

int i;

* Returns 0 if host portion of address is all-zeros,

* -1 if not all zeros or on failure.

*/

addr_host_is_all0s(const struct xaddr *a, u_int masklen)

{

struct xaddr tmp_addr, tmp_mask, tmp_result;

}

#if 0

addr_host_to_all0s(struct xaddr *a, u_int masklen)

{

struct xaddr tmp_mask;

return 0;

}

addr_sa_pton(const char *h, const char *s, struct sockaddr *sa, socklen_t slen)

{

struct addrinfo hints, *ai;

freeaddrinfo(ai);

return 0;

}

int

addr_ntop(const struct xaddr *n, char *p, size_t len)

#define addr32 xa.addr32

};

int addr_sa_to_xaddr(struct sockaddr *sa, socklen_t slen, struct xaddr *xa);

int addr_netmask(int af, u_int l, struct xaddr *n);

int addr_pton(const char *p, struct xaddr *n);

int addr_pton_cidr(const char *p, struct xaddr *n, u_int *l);

int addr_ntop(const struct xaddr *n, char *p, size_t len);

int addr_and(struct xaddr *dst, const struct xaddr *a, const struct xaddr *b);

int addr_cmp(const struct xaddr *a, const struct xaddr *b);

int addr_host_to_all1s(struct xaddr *a, u_int masklen);

int addr_netmatch(const struct xaddr *host, const struct xaddr *net,

u_int masklen);

/*

* Copyright (c) 2000 Markus Friedl. All rights reserved.

* Copyright (c) 2010 Damien Miller. All rights reserved.

#include <time.h>

#include <unistd.h>

#include <limits.h>

#include "xmalloc.h"

#include "ssh.h"

struct sshkey_cert *cert, struct sshauthopt **authoptsp)

{

FILE *f;

if (authoptsp != NULL)

*authoptsp = NULL;

temporarily_use_uid(pw);

return 0;

}

return success;

}

user_key_allowed(struct ssh *ssh, struct passwd *pw, struct sshkey *key,

int auth_attempt, struct sshauthopt **authoptsp)

{

struct sshauthopt *opts = NULL;

const char *rdomain, *remote_ip, *remote_host;

remote_ip, ssh_remote_port(ssh));

for (i = 0; !success && i < options.num_authkeys_files; i++) {

if (strcasecmp(options.authorized_keys_files[i], "none") == 0)

continue;

file = expand_authorized_keys(

options.authorized_keys_files[i], pw);

}

}

if (success)

goto out;

/*

* Copyright (c) 2000 Markus Friedl. All rights reserved.

*

/* 0-4.2 ms of delay */

delay = (double)PEEK_U32(hash) / 1000 / 1000 / 1000 / 1000;

freezero(hash, len);

return MIN_FAIL_DELAY_SECONDS + delay;

}

/*

* Copyright (c) 2000, 2013 Markus Friedl. All rights reserved.

*

#include "ssherr.h"

#include "krl.h"

/* Save a key blob to a file */

static int

sshkey_save_private_blob(struct sshbuf *keybuf, const char *filename)

#USR_LOCAL_IS_SYMLINK=yes

# System V init run levels

SYSVINITSTART=S98

# We will source these if they exist

POST_MAKE_INSTALL_FIXES=./pkg-post-make-install-fixes.sh

POST_PROTOTYPE_EDITS=./pkg-post-prototype-edit.sh

cat > space << _EOF

# extra space required by start/stop links added by installf

# in postinstall

$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME} 0 1

_EOF

[ "$RC1_D" = no ] || \

[ "$RCS_D" = yes ] && \

fi

## Build preinstall file

if [ "\${USE_SYM_LINKS}" = yes ]

then

[ "$RCS_D" = yes ] && \\

[ "$RC1_D" = no ] || \\

installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s

else

[ "$RCS_D" = yes ] && \\

[ "$RC1_D" = no ] || \\

installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l

fi

fi

/*

* Author: Tatu Ylonen <ylo@cs.hut.fi>

* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

#define NUM_SOCKS 10

/* -- X11 forwarding */

/* Maximum number of fake X11 displays to try. */

#define MAX_DISPLAYS 1000

u_int *display_numberp, int **chanids)

{

Channel *nc = NULL;

struct addrinfo hints, *ai, *aitop;

char strport[NI_MAXSERV];

int gaierr, n, num_socks = 0, socks[NUM_SOCKS];

return -1;

for (display_number = x11_display_offset;

display_number < MAX_DISPLAYS;

display_number++) {

memset(&hints, 0, sizeof(hints));

hints.ai_family = ssh->chanctxt->IPv4or6;

hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;

* buf now contains the host name. But first we parse the

* display number.

*/

error("Could not parse display number from DISPLAY: %.100s",

display);

return -1;

memset(&hints, 0, sizeof(hints));

hints.ai_family = ssh->chanctxt->IPv4or6;

hints.ai_socktype = SOCK_STREAM;

if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {

error("%.100s: unknown host. (%s)", buf,

ssh_gai_strerror(gaierr));

/* Connect it to the display. */

if (connect(sock, ai->ai_addr, ai->ai_addrlen) == -1) {

debug2("connect %.100s port %u: %.100s", buf,

close(sock);

continue;

}

freeaddrinfo(aitop);

if (!ai) {

error("connect %.100s port %u: %.100s", buf,

return -1;

}

set_nodelay(sock);

fatal_fr(r, "send x11-req");

free(new_data);

}

/*

* Author: Tatu Ylonen <ylo@cs.hut.fi>

int x11_create_display_inet(struct ssh *, int, int, int, u_int *, int **);

void x11_request_forwarding_with_spoofing(struct ssh *, int,

const char *, const char *, const char *, int);

/* channel close */

/*

* Author: Tatu Ylonen <ylo@cs.hut.fi>

* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

goto out;

}

if (cipher_authlen(cipher) &&

ret = SSH_ERR_LIBCRYPTO_ERROR;

goto out;

}

if (authlen != cipher_authlen(cc->cipher))

return SSH_ERR_INVALID_ARGUMENT;

/* increment IV */

return SSH_ERR_LIBCRYPTO_ERROR;

/* set tag on decryption */

if (!cc->encrypt &&

return SSH_ERR_LIBCRYPTO_ERROR;

}

if (aadlen) {

return cc->encrypt ?

SSH_ERR_LIBCRYPTO_ERROR : SSH_ERR_MAC_INVALID;

if (cc->encrypt &&

return SSH_ERR_LIBCRYPTO_ERROR;

}

return 0;

if ((size_t)evplen != len)

return SSH_ERR_INVALID_ARGUMENT;

if (cipher_authlen(c)) {

return SSH_ERR_LIBCRYPTO_ERROR;

return SSH_ERR_LIBCRYPTO_ERROR;

#endif

return 0;

return SSH_ERR_INVALID_ARGUMENT;

if (cipher_authlen(c)) {

/* XXX iv arg is const, but EVP_CIPHER_CTX_ctrl isn't */

return SSH_ERR_LIBCRYPTO_ERROR;

} else if (!EVP_CIPHER_CTX_set_iv(cc->evp, iv, evplen))

return SSH_ERR_LIBCRYPTO_ERROR;

/*

* Author: Tatu Ylonen <ylo@cs.hut.fi>

* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

if (just_started)

return 1;

if (timespeccmp(&now, &next_interval, <))

/* Calculate number of intervals missed since the last check */

n = (now.tv_sec - next_interval.tv_sec) * 1000LL * 1000 * 1000;

don't. */

#undef HAVE_DECL_HOWMANY

/* Define to 1 if you have the declaration of `h_errno', and to 0 if you

don't. */

#undef HAVE_DECL_H_ERRNO

/* Define to 1 if you have the declaration of `loginfailed', and to 0 if you

don't. */

#undef HAVE_DECL_LOGINFAILED

don't. */

#undef HAVE_DECL_OFFSETOF

/* Define to 1 if you have the declaration of `O_NONBLOCK', and to 0 if you

don't. */

#undef HAVE_DECL_O_NONBLOCK

EOPNOTSUPP. */

#undef LINK_OPNOTSUPP_ERRNO

/* Adjust Linux out-of-memory killer */

#undef LINUX_OOM_ADJUST

/* Set this to your mail directory if you do not have _PATH_MAILDIR */

#undef MAIL_DIRECTORY

/* Need setpgrp to for controlling tty */

#undef NEED_SETPGRP

/* no privsep sandboxing */

#undef SANDBOX_NULL

/* Sandbox using setrlimit(2) */

#undef SANDBOX_RLIMIT

/* Sandbox using Solaris/Illumos privileges */

#undef SANDBOX_SOLARIS

/* Specify the system call convention in use */

#undef SECCOMP_AUDIT_ARCH

/* Define if you have Solaris projects */

#undef USE_SOLARIS_PROJECTS

/* compiler variable declarations after code */

#undef VARIABLE_DECLARATION_AFTER_CODE

/* Define if you want to enable AIX4's authenticate function */

#undef WITH_AIXAUTHENTICATE

/* Define if you have/want arrays (cluster-wide session management, not C

arrays) */

#undef WITH_IRIX_ARRAY

KRB5CONF

SSHDLIBS

SSH_PRIVSEP_USER

LIBFIDO2

SK_DUMMY_LIBRARY

OPENSSL_BIN

openssl_bin

PICFLAG

LIBEDIT

LDNSCONFIG

LIBOBJS

with_ldflags_after

with_libs

with_Werror

with_solaris_contracts

with_solaris_projects

with_solaris_privs

with_zlib_version_check

with_ldns

with_libedit

with_audit

with_pie

enable_pkcs11

enable_security_key

with_security_key_builtin

with_ssl_dir

with_openssl_header_check

with_ssl_engine

--disable-largefile omit support for large files

--disable-pkcs11 disable PKCS#11 support code [no]

--disable-security-key disable U2F/FIDO support code no

--disable-strip Disable calling strip(1) on install

--disable-etc-default-login Disable using PATH from /etc/default/login no

--disable-fd-passing disable file descriptor passsing no

--with-ldflags-after Specify additional flags to pass to linker after configure

--with-libs Specify additional libraries to link with

--with-Werror Build main code with -Werror

--with-solaris-contracts Enable Solaris process contracts (experimental)

--with-solaris-projects Enable Solaris projects (experimental)

--with-solaris-privs Enable Solaris/Illumos privileges (experimental)

--without-zlib-version-check Disable zlib version check

--with-ldns[=PATH] Use ldns for DNSSEC support (optionally in PATH)

--with-libedit[=PATH] Enable libedit support for sftp

--with-audit=module Enable audit support (modules=debug,bsm,linux)

--with-pie Build Position Independent Executables if possible

--with-security-key-builtin include builtin U2F/FIDO support

--with-ssl-dir=PATH Specify path to OpenSSL installation

--without-openssl-header-check Disable OpenSSL version consistency check

--with-ssl-engine Enable OpenSSL (hardware) ENGINE support

--with-pam Enable PAM support

--with-pam-service=name Specify PAM service name

--with-privsep-user=user Specify non-privileged user for privilege separation

--with-selinux Enable SELinux support

--with-kerberos5=PATH Enable Kerberos 5 support

--with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)

then :

have_long_long_max=1

fi

ac_fn_check_decl "$LINENO" "RLIMIT_NPROC" "ac_cv_have_decl_RLIMIT_NPROC" "

#include <sys/types.h>

#include <sys/resource.h>

fi

# On some platforms (eg SunOS4) sys/audit.h requires sys/[time|types|label.h]

# to be included first.

ac_fn_c_check_header_compile "$LINENO" "sys/audit.h" "ac_cv_header_sys_audit_h" "

# the --with-solaris-privs option and --with-sandbox=solaris).

SOLARIS_PRIVS="no"

# Check for some target-specific stuff

case "$host" in

*-*-aix*)

cat confdefs.h - <<_ACEOF >conftest.$ac_ext

/* end confdefs.h. */

#define testmacro foo

#define testmacro bar

int

fi

rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext

}

;;

*-*-dgux*)

printf "%s\n" "#define BROKEN_POLL 1" >>confdefs.h

;;

*-*-dragonfly*)

SSHDLIBS="$SSHDLIBS"

printf "%s\n" "#define LINUX_OOM_ADJUST 1" >>confdefs.h

printf "%s\n" "#define SYSTEMD_NOTIFY 1" >>confdefs.h

inet6_default_4in6=yes

fi

AUDIT_MODULE=none

# Check whether --with-audit was given.

fi

ac_fn_check_decl "$LINENO" "bzero" "ac_cv_have_decl_bzero" "$ac_includes_default" "$ac_c_undeclared_builtin_options" "CFLAGS"

if test "x$ac_cv_have_decl_bzero" = xyes

then :

fi

fi

fi

rm -f core conftest.err conftest.$ac_objext conftest.beam \

conftest$ac_exeext conftest.$ac_ext

fi

" "$ac_c_undeclared_builtin_options" "CFLAGS"

then :

fi

if test "x$openssl" != "xyes" ; then

enable_pkcs11="disabled; missing libcrypto"

fi

fi

fi

ac_fn_c_check_func "$LINENO" "arc4random" "ac_cv_func_arc4random"

if test "x$ac_cv_func_arc4random" = xyes

then :

fi

( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \

test "x$ac_cv_header_sandbox_h" = "xyes") ; then

test "x$ac_cv_func_sandbox_init" != "xyes" -o \

long long num = 0x7fffffffffffffffll;

#endif

strcpy(expected_out, "9223372036854775807");

snprintf(buf, mazsize, "%lld", num);

if(strcmp(buf, expected_out) != 0)

exit(1);

exit(0);

LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"

# Make a copy of CFLAGS/LDFLAGS without PIE options.

AC_CHECK_DECL([LLONG_MAX], [have_llong_max=1], , [#include <limits.h>])

AC_CHECK_DECL([LONG_LONG_MAX], [have_long_long_max=1], , [#include <limits.h>])

AC_CHECK_DECL([RLIMIT_NPROC],

[AC_DEFINE([HAVE_RLIMIT_NPROC], [], [sys/resource.h has RLIMIT_NPROC])], , [

#include <sys/types.h>

wchar.h \

])

# On some platforms (eg SunOS4) sys/audit.h requires sys/[time|types|label.h]

# to be included first.

AC_CHECK_HEADERS([sys/audit.h], [], [], [

# the --with-solaris-privs option and --with-sandbox=solaris).

SOLARIS_PRIVS="no"

# Check for some target-specific stuff

case "$host" in

*-*-aix*)

AC_MSG_CHECKING([if compiler allows macro redefinitions])

AC_COMPILE_IFELSE(

[AC_LANG_PROGRAM([[

#define testmacro foo

#define testmacro bar]],

[[ exit(0); ]])],

# Cygwin defines optargs, optargs as declspec(dllimport) for historical

# reasons which cause compile warnings, so we disable those warnings.

OSSH_CHECK_CFLAG_COMPILE([-Wno-attributes])

;;

*-*-dgux*)

AC_DEFINE([IP_TOS_IS_BROKEN], [1],

# cf. Apple bug 3710161 (not public, but searchable)

AC_DEFINE([BROKEN_POLL], [1],

[System poll(2) implementation is broken])

;;

*-*-dragonfly*)

SSHDLIBS="$SSHDLIBS"

AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])

AC_DEFINE([USE_BTMP])

AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])

AC_DEFINE([SYSTEMD_NOTIFY], [1], [Have sshd notify systemd on start/reload])

inet6_default_4in6=yes

case `uname -r` in

fi ]

)

AUDIT_MODULE=none

AC_ARG_WITH([audit],

[ --with-audit=module Enable audit support (modules=debug,bsm,linux)],

warn \

])

AC_CHECK_DECLS([bzero, memmem])

dnl Wide character support.

[ enable_sk_internal=$withval ]

)

)

AC_SEARCH_LIBS([dlopen], [dl])

AC_MSG_RESULT([no])

]

)

fi

# PKCS11/U2F depend on OpenSSL and dlopen().

enable_pkcs11=yes

enable_sk=yes

if test "x$openssl" != "xyes" ; then

enable_pkcs11="disabled; missing libcrypto"

fi

fi

fi

AC_CHECK_FUNCS([ \

arc4random \

arc4random_buf \

# Decide which sandbox style to use

sandbox_arg=""

AC_ARG_WITH([sandbox],

[

if test "x$withval" = "xyes" ; then

sandbox_arg=""

)

fi

( test -z "$sandbox_arg" && test "x$ac_cv_func_sandbox_init" = "xyes" && \

test "x$ac_cv_header_sandbox_h" = "xyes") ; then

test "x$ac_cv_func_sandbox_init" != "xyes" -o \

long long num = 0x7fffffffffffffffll;

#endif

strcpy(expected_out, "9223372036854775807");

snprintf(buf, mazsize, "%lld", num);

if(strcmp(buf, expected_out) != 0)

exit(1);

exit(0);

LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"

# Make a copy of CFLAGS/LDFLAGS without PIE options.

AC_SUBST([LDFLAGS_NOPIE])

AC_SUBST([CFLAGS_NOPIE])

else

ssh-keygen -t "${type}" -f "${pwdhome}/.ssh/${file}" > /dev/null

fi

then

csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys"

cat "${pwdhome}/.ssh/${file}.pub" >> "${pwdhome}/.ssh/authorized_keys"

%global rel 1%{?dist}

# OpenSSH privilege separation requires a user & group ID

# Use GTK2 instead of GNOME in gnome-ssh-askpass

%global gtk2 1

%global without_openssl 0

# build without openssl where 1.1.1 is not available

%if %{defined fedora} && 0%{?fedora} <= 28

# rpm -ba|--rebuild --define 'no_gtk2 1'

%{?no_gtk2:%global gtk2 0}

# Options for static OpenSSL link:

# rpm -ba|--rebuild --define "static_openssl 1"

%{?static_openssl:%global static_libcrypto 1}

Group: Applications/Internet

BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot

Obsoletes: ssh

Requires: initscripts >= 5.20

BuildRequires: perl

%if ! %{without_openssl}

BuildRequires: openssl-devel >= 1.1.1

%endif

BuildRequires: /bin/login

BuildRequires: glibc-devel, pam

%if ! %{no_x11_askpass}

BuildRequires: /usr/include/X11/Xlib.h

# Xt development tools

Group: System Environment/Daemons

Obsoletes: ssh-server

Requires: openssh = %{version}-%{release}, chkconfig >= 0.9

Requires: /etc/pam.d/system-auth

%package askpass

Summary: A passphrase dialog for OpenSSH and X.

- Remove reference of dropped sshd.pam.old file

- Update openssl-devel dependency to require >= 1.1.1

- Build with --without-openssl elsewhere

* Thu Oct 28 2021 Damien Miller <djm@mindrot.org>

- Remove remaining traces of --with-md5-passwords

Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation

Name: openssh

URL: https://www.openssh.com/

Release: 1

Source0: openssh-%{version}.tar.gz

/* (or die trying) */

#ifndef HAVE_U_INT

typedef unsigned int u_int;

#endif

#ifndef HAVE_INTXX_T

# endif /* WORDS_BIGENDIAN */

#endif /* BYTE_ORDER */

# define openssh_swap32(v) \

(uint32_t)(((uint32_t)(v) & 0xff) << 24 | \

((uint32_t)(v) & 0xff00) << 8 | \

((uint64_t)(v) & 0xff000000000000ULL) >> 40 | \

((uint64_t)(v) & 0xff00000000000000ULL) >> 56)

# ifdef WORDS_BIGENDIAN

# else

# endif

#endif

/*

* Copyright (c) 2000 Niels Provos. All rights reserved.

*

if (bestcount == 0) {

fclose(f);

}

which = arc4random_uniform(bestcount);

/*

* Copyright (c) 2001 Kevin Steves. All rights reserved.

*

#ifdef HAVE_PATHS_H

# include <paths.h>

#endif

/*

*-*-nto-qnx needs these headers for strcasecmp and LASTLOG_FILE respectively

}

static inline uint32_t core_num__u8_6__count_ones(uint8_t x0) {

return __popcnt(x0);

return __builtin_popcount(x0);

#endif

}

/*

* Author: Tatu Ylonen <ylo@cs.hut.fi>

* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

#include <sys/types.h>