git: 7a946c37c5c1 - main - security/openssh-portable: Use blocklist
Bryan Drewery <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <[email protected]> |
The branch main has been updated by bdrewery: URL: https://cgit.FreeBSD.org/ports/commit/?id=7a946c37c5c1bc81516a207509eee0f03574a823 commit 7a946c37c5c1bc81516a207509eee0f03574a823 Author: Jose Luis Duran <[email protected]> AuthorDate: 2026-07-27 16:48:44 +0000 Commit: Bryan Drewery <[email protected]> CommitDate: 2026-08-13 15:58:56 +0000 security/openssh-portable: Use blocklist Starting from FreeBSD version 1500000, prefer the new blocklist nomenclature. Once older versions are no longer supported, we should use blocklist exclusively. This also fixes a regression with UseBlacklist not being properly read from the config in commit 516c0db3f73b for the 10.4 update. PR: 294082 --- UPDATING | 10 + security/openssh-portable/Makefile | 36 +- .../files/extra-patch-blacklist-hpn | 1277 ++++++++++++++++++++ .../openssh-portable/files/extra-patch-blacklistd | 27 +- .../openssh-portable/files/extra-patch-blocklistd | 400 ++++++ security/openssh-portable/files/extra-patch-hpn | 2 +- .../files/extra-patch-no-blacklistd-hpn-glue | 27 + .../files/extra-patch-no-blocklistd-hpn-glue | 4 +- 8 files changed, 1764 insertions(+), 19 deletions(-) diff --git a/UPDATING b/UPDATING index 8e23b6eaf1ba..bdcb3ab1b7dd 100644 --- a/UPDATING +++ b/UPDATING @@ -5,6 +5,16 @@ they are unavoidable. You should get into the habit of checking this file for changes each time you update your ports collection, before attempting any port upgrades. +20260813: + AFFECTS: users of security/openssh-portable + AUTHOR: [email protected] + + For FreeBSD 15+, the option BLACKLISTD has been renamed to BLOCKLISTD. + The option is enabled by default. If you had this option disabled you + will need to disable the new spelling as well. + + The ssh config file supports both UseBlacklist and UseBlocklist. + 20260724: AFFECTS: users of news/inn, news/inn-current AUTHOR: [email protected] diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile index e3357b650f9b..1a41dae0af39 100644 --- a/security/openssh-portable/Makefile +++ b/security/openssh-portable/Makefile @@ -1,6 +1,6 @@ PORTNAME= openssh DISTVERSION= 10.5p1 -PORTREVISION= 0 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES= security MASTER_SITES= OPENBSD/OpenSSH/portable @@ -42,8 +42,8 @@ gssapi_PKGNAMESUFFIX= -portable-gssapi OPTIONS_DEFINE= DOCS PAM TCP_WRAPPERS LIBEDIT BSM \ HPN KERB_GSSAPI \ - LDNS NONECIPHER FIDO_U2F BLACKLISTD -OPTIONS_DEFAULT= BLACKLISTD LIBEDIT PAM TCP_WRAPPERS LDNS FIDO_U2F + LDNS NONECIPHER FIDO_U2F BLOCKLISTD +OPTIONS_DEFAULT= BLOCKLISTD LIBEDIT PAM TCP_WRAPPERS LDNS FIDO_U2F .if ${FLAVOR:U} == hpn OPTIONS_DEFAULT+= HPN NONECIPHER .endif @@ -62,7 +62,7 @@ HEIMDAL_BASE_DESC= Heimdal Kerberos (base) MIT_DESC= MIT Kerberos (security/krb5) NONECIPHER_DESC= NONE Cipher support FIDO_U2F_DESC= FIDO/U2F support (security/libfido2) -BLACKLISTD_DESC= FreeBSD blacklistd(8) support +BLOCKLISTD_DESC= FreeBSD blocklistd(8) support OPTIONS_SUB= yes @@ -90,7 +90,7 @@ FIDO_U2F_LIB_DEPENDS= libfido2.so:security/libfido2 FIDO_U2F_CONFIGURE_ON= --with-security-key-builtin FIDO_U2F_CONFIGURE_OFF= --disable-security-key -BLACKLISTD_EXTRA_PATCHES= ${FILESDIR}/extra-patch-blacklistd +BLOCKLISTD_EXTRA_PATCHES= ${FILESDIR}/extra-patch-blocklistd ETCDIR?= ${PREFIX}/etc/ssh @@ -98,6 +98,10 @@ ETCDIR?= ${PREFIX}/etc/ssh PATCH_SITES+= http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,hpn,gsskex +.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000 +BLOCKLISTD_EXTRA_PATCHES= ${FILESDIR}/extra-patch-blacklistd +.endif + .if ${FLAVOR:U} == hpn || ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER} DEPRECATED= HPN patch is deprecated. Removed in base in 2016, and does not match official HPN-SSH implementation EXPIRATION_DATE=2026-10-01 @@ -105,10 +109,14 @@ PKGMESSAGE= ${PKGDIR}/pkg-message.hpn .endif # Must add this patch before HPN due to conflicts -.if !${PORT_OPTIONS:MBLACKLISTD} +.if !${PORT_OPTIONS:MBLOCKLISTD} . if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER} # Needed glue for applying HPN patch without conflict +. if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000 +EXTRA_PATCHES+= ${FILESDIR}/extra-patch-no-blacklistd-hpn-glue +. else EXTRA_PATCHES+= ${FILESDIR}/extra-patch-no-blocklistd-hpn-glue +. endif . endif .endif @@ -133,8 +141,12 @@ EXTRA_PATCHES+= ${FILESDIR}/extra-patch-gssapi-kexgssc.c EXTRA_PATCHES+= ${FILESDIR}/extra-patch-gssapi-kexgsss.c .endif -.if ${PORT_OPTIONS:MBLACKLISTD} +.if ${PORT_OPTIONS:MBLOCKLISTD} +. if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000 CONFIGURE_LIBS+= -lblacklist +. else +CONFIGURE_LIBS+= -lblocklist +. endif .endif # https://www.psc.edu/hpn-ssh https://github.com/rapier1/openssh-portable/tree/hpn-openssl1.1-7_7_P1 @@ -145,7 +157,11 @@ HPN_VERSION= 14v15 HPN_DISTVERSION= 7.7p1 #PATCH_SITES+= SOURCEFORGE/hpnssh/HPN-SSH%20${HPN_VERSION}%20${HPN_DISTVERSION}/:hpn #PATCHFILES+= ${PORTNAME}-${HPN_DISTVERSION}-hpnssh${HPN_VERSION}.diff.gz:-p1:hpn +. if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000 +EXTRA_PATCHES+= ${FILESDIR}/extra-patch-blacklist-hpn:-p2 +. else EXTRA_PATCHES+= ${FILESDIR}/extra-patch-hpn:-p2 +. endif .elif !${PORT_OPTIONS:MHPN} && !${PORT_OPTIONS:MNONECIPHER} # Apply compatibility patch EXTRA_PATCHES+= ${FILESDIR}/extra-patch-hpn-compat @@ -222,8 +238,12 @@ post-patch: @${ECHO_CMD} '#define SSH_VERSION_FREEBSD_PORT "${VERSION_ADDENDUM_DEFAULT}"' >> \ ${WRKSRC}/version.h -post-configure-BLACKLISTD-on: +post-configure-BLOCKLISTD-on: +.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000 @${ECHO_CMD} "#define USE_BLACKLIST 1" >> ${WRKSRC}/config.h +.else + @${ECHO_CMD} "#define USE_BLOCKLIST 1" >> ${WRKSRC}/config.h +.endif post-install: ${MV} ${STAGEDIR}${ETCDIR}/moduli \ diff --git a/security/openssh-portable/files/extra-patch-blacklist-hpn b/security/openssh-portable/files/extra-patch-blacklist-hpn new file mode 100644 index 000000000000..1831ae22f7c3 --- /dev/null +++ b/security/openssh-portable/files/extra-patch-blacklist-hpn @@ -0,0 +1,1277 @@ +diff -urN -x configure -x config.guess -x config.h.in -x config.sub work.clean/openssh-6.8p1/HPN-README work/openssh-6.8p1/HPN-README +--- work.clean/openssh-6.8p1/HPN-README 1969-12-31 18:00:00.000000000 -0600 ++++ work/openssh-6.8p1/HPN-README 2015-04-01 22:16:49.869215000 -0500 +@@ -0,0 +1,129 @@ ++Notes: ++ ++MULTI-THREADED CIPHER: ++The AES cipher in CTR mode has been multithreaded (MTR-AES-CTR). This will allow ssh installations ++on hosts with multiple cores to use more than one processing core during encryption. ++Tests have show significant throughput performance increases when using MTR-AES-CTR up ++to and including a full gigabit per second on quad core systems. It should be possible to ++achieve full line rate on dual core systems but OS and data management overhead makes this ++more difficult to achieve. The cipher stream from MTR-AES-CTR is entirely compatible with single ++thread AES-CTR (ST-AES-CTR) implementations and should be 100% backward compatible. Optimal ++performance requires the MTR-AES-CTR mode be enabled on both ends of the connection. ++The MTR-AES-CTR replaces ST-AES-CTR and is used in exactly the same way with the same ++nomenclature. ++Use examples: ssh -caes128-ctr [email protected] ++ scp -oCipher=aes256-ctr file [email protected]:~/file ++ ++NONE CIPHER: ++To use the NONE option you must have the NoneEnabled switch set on the server and ++you *must* have *both* NoneEnabled and NoneSwitch set to yes on the client. The NONE ++feature works with ALL ssh subsystems (as far as we can tell) *AS LONG AS* a tty is not ++spawned. If a user uses the -T switch to prevent a tty being created the NONE cipher will ++be disabled. ++ ++The performance increase will only be as good as the network and TCP stack tuning ++on the reciever side of the connection allows. As a rule of thumb a user will need ++at least 10Mb/s connection with a 100ms RTT to see a doubling of performance. The ++HPN-SSH home page describes this in greater detail. ++ ++http://www.psc.edu/networking/projects/hpn-ssh ++ ++BUFFER SIZES: ++ ++If HPN is disabled the receive buffer size will be set to the ++OpenSSH default of 64K. ++ ++If an HPN system connects to a nonHPN system the receive buffer will ++be set to the HPNBufferSize value. The default is 2MB but user adjustable. ++ ++If an HPN to HPN connection is established a number of different things might ++happen based on the user options and conditions. ++ ++Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll enabled, TCPRcvBuf NOT Set ++HPN Buffer Size = up to 64MB ++This is the default state. The HPN buffer size will grow to a maximum of 64MB ++as the TCP receive buffer grows. The maximum HPN Buffer size of 64MB is ++geared towards 10GigE transcontinental connections. ++ ++Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll disabled, TCPRcvBuf NOT Set ++HPN Buffer Size = TCP receive buffer value. ++Users on non-autotuning systesm should disable TCPRcvBufPoll in the ++ssh_cofig and sshd_config ++ ++Conditions: HPNBufferSize SET, TCPRcvBufPoll disabled, TCPRcvBuf NOT Set ++HPN Buffer Size = minmum of TCP receive buffer and HPNBufferSize. ++This would be the system defined TCP receive buffer (RWIN). ++ ++Conditions: HPNBufferSize SET, TCPRcvBufPoll disabled, TCPRcvBuf SET ++HPN Buffer Size = minmum of TCPRcvBuf and HPNBufferSize. ++Generally there is no need to set both. ++ ++Conditions: HPNBufferSize SET, TCPRcvBufPoll enabled, TCPRcvBuf NOT Set ++HPN Buffer Size = grows to HPNBufferSize ++The buffer will grow up to the maximum size specified here. ++ ++Conditions: HPNBufferSize SET, TCPRcvBufPoll enabled, TCPRcvBuf SET ++HPN Buffer Size = minmum of TCPRcvBuf and HPNBufferSize. ++Generally there is no need to set both of these, especially on autotuning ++systems. However, if the users wishes to override the autotuning this would be ++one way to do it. ++ ++Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll enabled, TCPRcvBuf SET ++HPN Buffer Size = TCPRcvBuf. ++This will override autotuning and set the TCP recieve buffer to the user defined ++value. ++ ++ ++HPN Specific Configuration options ++ ++TcpRcvBuf=[int]KB client ++ set the TCP socket receive buffer to n Kilobytes. It can be set up to the ++maximum socket size allowed by the system. This is useful in situations where ++the tcp receive window is set low but the maximum buffer size is set ++higher (as is typical). This works on a per TCP connection basis. You can also ++use this to artifically limit the transfer rate of the connection. In these ++cases the throughput will be no more than n/RTT. The minimum buffer size is 1KB. ++Default is the current system wide tcp receive buffer size. ++ ++TcpRcvBufPoll=[yes/no] client/server ++ enable of disable the polling of the tcp receive buffer through the life ++of the connection. You would want to make sure that this option is enabled ++for systems making use of autotuning kernels (linux 2.4.24+, 2.6, MS Vista) ++default is yes. ++ ++NoneEnabled=[yes/no] client/server ++ enable or disable the use of the None cipher. Care must always be used ++when enabling this as it will allow users to send data in the clear. However, ++it is important to note that authentication information remains encrypted ++even if this option is enabled. Set to no by default. ++ ++NoneSwitch=[yes/no] client ++ Switch the encryption cipher being used to the None cipher after ++authentication takes place. NoneEnabled must be enabled on both the client ++and server side of the connection. When the connection switches to the NONE ++cipher a warning is sent to STDERR. The connection attempt will fail with an ++error if a client requests a NoneSwitch from the server that does not explicitly ++have NoneEnabled set to yes. Note: The NONE cipher cannot be used in ++interactive (shell) sessions and it will fail silently. Set to no by default. ++ ++HPNDisabled=[yes/no] client/server ++ In some situations, such as transfers on a local area network, the impact ++of the HPN code produces a net decrease in performance. In these cases it is ++helpful to disable the HPN functionality. By default HPNDisabled is set to no. ++ ++HPNBufferSize=[int]KB client/server ++ This is the default buffer size the HPN functionality uses when interacting ++with nonHPN SSH installations. Conceptually this is similar to the TcpRcvBuf ++option as applied to the internal SSH flow control. This value can range from ++1KB to 64MB (1-65536). Use of oversized or undersized buffers can cause performance ++problems depending on the length of the network path. The default size of this buffer ++is 2MB. ++ ++ ++Credits: This patch was conceived, designed, and led by Chris Rapier ([email protected]) ++ The majority of the actual coding for versions up to HPN12v1 was performed ++ by Michael Stevens ([email protected]). The MT-AES-CTR cipher was ++ implemented by Ben Bennet ([email protected]) and improved by Mike Tasota ++ ([email protected]) an NSF REU grant recipient for 2013. ++ This work was financed, in part, by Cisco System, Inc., the National ++ Library of Medicine, and the National Science Foundation. +--- channels.c.orig 2023-02-02 04:21:54.000000000 -0800 ++++ channels.c 2023-02-03 10:45:34.136793000 -0800 +@@ -229,6 +229,12 @@ static void channel_handler_init(struct ssh_channels * + /* Setup helper */ + static void channel_handler_init(struct ssh_channels *sc); + ++ ++#ifdef HPN_ENABLED ++static int hpn_disabled = 0; ++static int hpn_buffer_size = 2 * 1024 * 1024; ++#endif ++ + /* -- channel core */ + + void +@@ -495,6 +501,9 @@ channel_new(struct ssh *ssh, char *ctype, int type, in + c->local_window = window; + c->local_window_max = window; + c->local_maxpacket = maxpack; ++#ifdef HPN_ENABLED ++ c->dynamic_window = 0; ++#endif + c->remote_name = xstrdup(remote_name); + c->ctl_chan = -1; + c->delayed = 1; /* prevent call to channel_post handler */ +@@ -1190,6 +1199,30 @@ channel_set_fds(struct ssh *ssh, int id, int rfd, int + fatal_fr(r, "channel %i", c->self); + } + ++#ifdef HPN_ENABLED ++static int ++channel_tcpwinsz(struct ssh *ssh) ++{ ++ u_int32_t tcpwinsz = 0; ++ socklen_t optsz = sizeof(tcpwinsz); ++ int ret = -1; ++ ++ /* if we aren't on a socket return 128KB */ ++ if (!ssh_packet_connection_is_on_socket(ssh)) ++ return 128 * 1024; ++ ++ ret = getsockopt(ssh_packet_get_connection_in(ssh), ++ SOL_SOCKET, SO_RCVBUF, &tcpwinsz, &optsz); ++ /* return no more than SSHBUF_SIZE_MAX (currently 256MB) */ ++ if ((ret == 0) && tcpwinsz > SSHBUF_SIZE_MAX) ++ tcpwinsz = SSHBUF_SIZE_MAX; ++ ++ debug2("tcpwinsz: tcp connection %d, Receive window: %d", ++ ssh_packet_get_connection_in(ssh), tcpwinsz); ++ return tcpwinsz; ++} ++#endif ++ + static void + channel_pre_listener(struct ssh *ssh, Channel *c) + { +@@ -2301,18 +2334,29 @@ channel_check_window(struct ssh *ssh, Channel *c) + c->local_maxpacket*3) || + c->local_window < c->local_window_max/2) && + c->local_consumed > 0) { ++ u_int addition = 0; ++#ifdef HPN_ENABLED ++ u_int32_t tcpwinsz = channel_tcpwinsz(ssh); ++ /* adjust max window size if we are in a dynamic environment */ ++ if (c->dynamic_window && (tcpwinsz > c->local_window_max)) { ++ /* grow the window somewhat aggressively to maintain pressure */ ++ addition = 1.5 * (tcpwinsz - c->local_window_max); ++ c->local_window_max += addition; ++ debug("Channel: Window growth to %d by %d bytes", c->local_window_max, addition); ++ } ++#endif + if (!c->have_remote_id) + fatal_f("channel %d: no remote id", c->self); + if ((r = sshpkt_start(ssh, + SSH2_MSG_CHANNEL_WINDOW_ADJUST)) != 0 || + (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || +- (r = sshpkt_put_u32(ssh, c->local_consumed)) != 0 || ++ (r = sshpkt_put_u32(ssh, c->local_consumed + addition)) != 0 || + (r = sshpkt_send(ssh)) != 0) { + fatal_fr(r, "channel %i", c->self); + } + debug2("channel %d: window %d sent adjust %d", c->self, +- c->local_window, c->local_consumed); +- c->local_window += c->local_consumed; ++ c->local_window, c->local_consumed + addition); ++ c->local_window += c->local_consumed + addition; + c->local_consumed = 0; + } + return 1; +@@ -3709,6 +3753,17 @@ channel_fwd_bind_addr(struct ssh *ssh, const char *lis + return addr; + } + ++#ifdef HPN_ENABLED ++void ++channel_set_hpn(int external_hpn_disabled, int external_hpn_buffer_size) ++{ ++ hpn_disabled = external_hpn_disabled; ++ hpn_buffer_size = external_hpn_buffer_size; ++ debug("HPN Disabled: %d, HPN Buffer Size: %d", hpn_disabled, ++ hpn_buffer_size); ++} ++#endif ++ + static int + channel_setup_fwd_listener_tcpip(struct ssh *ssh, int type, + struct Forward *fwd, int *allocated_listen_port, +@@ -3848,6 +3903,17 @@ channel_setup_fwd_listener_tcpip(struct ssh *ssh, int + } + + /* Allocate a channel number for the socket. */ ++#ifdef HPN_ENABLED ++ /* ++ * explicitly test for hpn disabled option. if true use smaller ++ * window size. ++ */ ++ if (!hpn_disabled) ++ c = channel_new(ssh, "port listener", type, sock, sock, ++ -1, hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT, ++ 0, "port listener", 1); ++ else ++#endif + c = channel_new(ssh, "port-listener", type, sock, sock, -1, + CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, + 0, "port listener", 1); +@@ -5016,6 +5082,14 @@ x11_create_display_inet(struct ssh *ssh, int x11_displ + *chanids = xcalloc(num_socks + 1, sizeof(**chanids)); + for (n = 0; n < num_socks; n++) { + sock = socks[n]; ++#ifdef HPN_ENABLED ++ if (!hpn_disabled) ++ nc = channel_new(ssh, "x11 listener", ++ SSH_CHANNEL_X11_LISTENER, sock, sock, -1, ++ hpn_buffer_size, CHAN_X11_PACKET_DEFAULT, ++ 0, "X11 inet listener", 1); ++ else ++#endif + nc = channel_new(ssh, "x11-listener", + SSH_CHANNEL_X11_LISTENER, sock, sock, -1, + CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, +--- work/openssh-7.7p1/channels.h.orig 2018-04-01 22:38:28.000000000 -0700 ++++ work/openssh-7.7p1/channels.h 2018-06-27 16:38:40.766588000 -0700 +@@ -143,6 +143,9 @@ struct Channel { + u_int local_maxpacket; + int extended_usage; + int single_connection; ++#ifdef HPN_ENABLED ++ int dynamic_window; ++#endif + + char *ctype; /* type */ + +@@ -335,5 +338,10 @@ void chan_ibuf_empty(struct ssh *, Channel *); + void chan_rcvd_ieof(struct ssh *, Channel *); + void chan_write_failed(struct ssh *, Channel *); + void chan_obuf_empty(struct ssh *, Channel *); ++ ++#ifdef HPN_ENABLED ++/* hpn handler */ ++void channel_set_hpn(int, int); ++#endif + + #endif +--- work/openssh-7.7p1/cipher.c.orig 2018-04-01 22:38:28.000000000 -0700 ++++ work/openssh-7.7p1/cipher.c 2018-06-27 16:55:43.165788000 -0700 +@@ -212,7 +212,12 @@ ciphers_valid(const char *names) + for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; + (p = strsep(&cp, CIPHER_SEP))) { + c = cipher_by_name(p); ++#ifdef NONE_CIPHER_ENABLED ++ if (c == NULL || ((c->flags & CFLAG_INTERNAL) != 0 && ++ (c->flags & CFLAG_NONE) != 0)) { ++#else + if (c == NULL || (c->flags & CFLAG_INTERNAL) != 0) { ++#endif + free(cipher_list); + return 0; + } +--- work/openssh/clientloop.c.orig 2023-12-18 06:59:50.000000000 -0800 ++++ work/openssh/clientloop.c 2024-01-08 16:27:47.806586000 -0800 +@@ -1813,6 +1813,15 @@ client_request_x11(struct ssh *ssh, const char *reques + sock = x11_connect_display(ssh); + if (sock < 0) + return NULL; ++#ifdef HPN_ENABLED ++ /* again is this really necessary for X11? */ ++ if (!options.hpn_disabled) ++ c = channel_new(ssh, "x11-connection", ++ SSH_CHANNEL_X11_OPEN, sock, sock, -1, ++ options.hpn_buffer_size, ++ CHAN_X11_PACKET_DEFAULT, 0, "x11", 1); ++ else ++#endif + c = channel_new(ssh, "x11-connection", + SSH_CHANNEL_X11_OPEN, sock, sock, -1, + CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1); +@@ -1848,6 +1857,14 @@ client_request_agent(struct ssh *ssh, const char *requ + else + debug2_fr(r, "ssh_agent_bind_hostkey"); + ++#ifdef HPN_ENABLED ++ if (!options.hpn_disabled) ++ c = channel_new(ssh, "agent-connection", ++ SSH_CHANNEL_OPEN, sock, sock, -1, ++ options.hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT, 0, ++ "authentication agent connection", 1); ++ else ++#endif + c = channel_new(ssh, "agent-connection", + SSH_CHANNEL_OPEN, sock, sock, -1, + CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, +@@ -1876,6 +1893,12 @@ client_request_tun_fwd(struct ssh *ssh, int tun_mode, + } + debug("Tunnel forwarding using interface %s", ifname); + ++#ifdef HPN_ENABLED ++ if (!options.hpn_disabled) ++ c = channel_new(ssh, "tun-connection", SSH_CHANNEL_OPENING, fd, fd, -1, ++ options.hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1); ++ else ++#endif + c = channel_new(ssh, "tun-connection", SSH_CHANNEL_OPENING, fd, fd, -1, + CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1); + c->datagram = 1; +--- work/openssh/compat.c.orig 2021-04-15 20:55:25.000000000 -0700 ++++ work/openssh/compat.c 2021-04-28 14:37:33.129317000 -0700 +@@ -149,6 +149,14 @@ compat_banner(struct ssh *ssh, const char *version) + debug_f("match: %s pat %s compat 0x%08x", + version, check[i].pat, check[i].bugs); + ssh->compat = check[i].bugs; ++#ifdef HPN_ENABLED ++ /* Check to see if the remote side is OpenSSH and not HPN */ ++ if (strstr(version,"OpenSSH") != NULL && ++ strstr(version,"hpn") == NULL) { ++ ssh->compat |= SSH_BUG_LARGEWINDOW; ++ debug("Remote is NON-HPN aware"); ++ } ++#endif + return; + } + } +--- work/openssh/compat.h.orig 2015-05-29 03:27:21.000000000 -0500 ++++ work/openssh/compat.h 2015-06-02 09:55:04.208681000 -0500 +@@ -62,6 +62,9 @@ + #define SSH_BUG_CURVE25519PAD 0x10000000 + #define SSH_BUG_HOSTKEYS 0x20000000 + #define SSH_BUG_DHGEX_LARGE 0x40000000 ++#ifdef HPN_ENABLED ++#define SSH_BUG_LARGEWINDOW 0x80000000 ++#endif + + void enable_compat13(void); + void enable_compat20(void); +--- work/openssh/configure.ac.orig 2020-03-22 11:06:53.034550000 -0700 ++++ work/openssh/configure.ac 2020-03-22 11:07:10.017487000 -0700 +@@ -4778,6 +4778,25 @@ AC_ARG_WITH([maildir], + ] + ) # maildir + ++#check whether user wants HPN support ++HPN_MSG="no" ++AC_ARG_WITH(hpn, ++ [ --with-hpn Enable HPN support], ++ [ if test "x$withval" != "xno" ; then ++ AC_DEFINE(HPN_ENABLED,1,[Define if you want HPN support.]) ++ HPN_MSG="yes" ++ fi ] ++) ++#check whether user wants NONECIPHER support ++NONECIPHER_MSG="no" ++AC_ARG_WITH(nonecipher, ++ [ --with-nonecipher Enable NONECIPHER support], ++ [ if test "x$withval" != "xno" ; then ++ AC_DEFINE(NONE_CIPHER_ENABLED,1,[Define if you want NONECIPHER support.]) ++ NONECIPHER_MSG="yes" ++ fi ] ++) ++ + if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then + AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test]) + disable_ptmx_check=yes +@@ -5459,6 +5478,8 @@ echo " Random number source: $RAND_MSG" + echo " Privsep sandbox style: $SANDBOX_STYLE" + echo " PKCS#11 support: $enable_pkcs11" + echo " U2F/FIDO support: $enable_sk" ++echo " HPN support: $HPN_MSG" ++echo " NONECIPHER support: $NONECIPHER_MSG" + + echo "" + +--- work/openssh/kex.c.orig 2023-12-18 06:59:50.000000000 -0800 ++++ work/openssh/kex.c 2024-01-08 16:24:07.547292000 -0800 +@@ -1252,6 +1252,20 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq) + peer[ncomp] = NULL; + goto out; + } ++#ifdef NONE_CIPHER_ENABLED ++ debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name); ++ if (strcmp(newkeys->enc.name, "none") == 0) { ++ int auth_flag; ++ ++ auth_flag = ssh_packet_authentication_state(ssh); ++ debug("Requesting NONE. Authflag is %d", auth_flag); ++ if (auth_flag == 1) { ++ debug("None requested post authentication."); ++ } else { ++ fatal("Pre-authentication none cipher requests are not allowed."); ++ } ++ } ++#endif + debug("kex: %s cipher: %s MAC: %s compression: %s", + ctos ? "client->server" : "server->client", + newkeys->enc.name, +@@ -1462,7 +1476,7 @@ kex_exchange_identification(struct ssh *ssh, int timeo + */ + int + kex_exchange_identification(struct ssh *ssh, int timeout_ms, +- const char *version_addendum) ++ const char *version_addendum, int hpn_disabled) + { + int remote_major, remote_minor, mismatch, oerrno = 0; + size_t len, n; +@@ -1479,8 +1493,13 @@ kex_exchange_identification(struct ssh *ssh, int timeo + sshbuf_reset(our_version); + if (version_addendum != NULL && *version_addendum == '\0') + version_addendum = NULL; +- if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%s%s%s\r\n", ++ if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%s%s%s%s\r\n", + PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, ++#ifdef HPN_ENABLED ++ hpn_disabled ? "" : SSH_HPN, ++#else ++ "", ++#endif + version_addendum == NULL ? "" : " ", + version_addendum == NULL ? "" : version_addendum)) != 0) { + oerrno = errno; +--- work/openssh-7.7p1/packet.c.orig 2018-04-01 22:38:28.000000000 -0700 ++++ work/openssh-7.7p1/packet.c 2018-06-27 16:42:42.739507000 -0700 +@@ -926,6 +926,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode) + return 0; + } + ++#ifdef NONE_CIPHER_ENABLED ++/* this supports the forced rekeying required for the NONE cipher */ ++int rekey_requested = 0; ++void ++packet_request_rekeying(void) ++{ ++ rekey_requested = 1; ++} ++ ++int ++ssh_packet_authentication_state(struct ssh *ssh) ++{ ++ struct session_state *state = ssh->state; ++ ++ return(state->after_authentication); ++} ++#endif ++ + #define MAX_PACKETS (1U<<31) + static int + ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) +@@ -944,6 +962,14 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbou + /* Peer can't rekey */ + if (ssh->compat & SSH_BUG_NOREKEY) + return 0; ++#ifdef NONE_CIPHER_ENABLED ++ /* used to force rekeying when called for by the none ++ * cipher switch methods -cjr */ ++ if (rekey_requested == 1) { ++ rekey_requested = 0; ++ return 1; ++ } ++#endif + + /* + * Permit one packet in or out per rekey - this allows us to +--- work.orig/openssh/packet.h.orig 2026-08-10 19:22:17.000000000 -0700 ++++ work/openssh/packet.h 2026-08-11 15:53:39.430108000 -0700 +@@ -207,4 +207,9 @@ char *connection_info_message(struct ssh *ssh); + const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); + char *connection_info_message(struct ssh *ssh); + ++#ifdef NONE_CIPHER_ENABLED ++void packet_request_rekeying(void); ++int ssh_packet_authentication_state(struct ssh *ssh); ++#endif ++ + #endif /* PACKET_H */ +--- work/openssh/readconf.c.orig 2025-04-09 00:02:43.000000000 -0700 ++++ work/openssh/readconf.c 2025-04-10 22:29:45.138038000 -0700 +@@ -71,6 +71,9 @@ + #include "myproposal.h" + #include "digest.h" + #include "version.h" ++#ifdef HPN_ENABLED ++#include "sshbuf.h" ++#endif + + /* Format of the configuration file: + +@@ -172,6 +175,12 @@ typedef enum { + oLocalCommand, oPermitLocalCommand, oRemoteCommand, + oVisualHostKey, + oKexAlgorithms, oIPQoS, oRequestTTY, oSessionType, oStdinNull, ++#ifdef HPN_ENABLED ++ oHPNDisabled, oHPNBufferSize, oTcpRcvBufPoll, oTcpRcvBuf, ++#endif ++#ifdef NONE_CIPHER_ENABLED ++ oNoneSwitch, oNoneEnabled, ++#endif + oForkAfterAuthentication, oIgnoreUnknown, oProxyUseFdpass, + oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots, + oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs, +@@ -323,6 +332,16 @@ static struct { + { "hostbasedkeytypes", oHostbasedAcceptedAlgorithms }, /* obsolete */ + { "pubkeyacceptedalgorithms", oPubkeyAcceptedAlgorithms }, + { "pubkeyacceptedkeytypes", oPubkeyAcceptedAlgorithms }, /* obsolete */ ++#ifdef NONE_CIPHER_ENABLED ++ { "noneenabled", oNoneEnabled }, ++ { "noneswitch", oNoneSwitch }, ++#endif ++#ifdef HPN_ENABLED ++ { "tcprcvbufpoll", oTcpRcvBufPoll }, ++ { "tcprcvbuf", oTcpRcvBuf }, ++ { "hpndisabled", oHPNDisabled }, ++ { "hpnbuffersize", oHPNBufferSize }, ++#endif + { "ignoreunknown", oIgnoreUnknown }, + { "proxyjump", oProxyJump }, + { "securitykeyprovider", oSecurityKeyProvider }, +@@ -1332,6 +1351,44 @@ parse_time: + intptr = &options->check_host_ip; + goto parse_flag; + ++#ifdef HPN_ENABLED ++ case oHPNDisabled: ++ intptr = &options->hpn_disabled; ++ goto parse_flag; ++ ++ case oHPNBufferSize: ++ intptr = &options->hpn_buffer_size; ++ goto parse_int; ++ ++ case oTcpRcvBufPoll: ++ intptr = &options->tcp_rcv_buf_poll; ++ goto parse_flag; ++ ++ case oTcpRcvBuf: ++ intptr = &options->tcp_rcv_buf; ++ goto parse_int; ++#endif ++ ++#ifdef NONE_CIPHER_ENABLED ++ case oNoneEnabled: ++ intptr = &options->none_enabled; ++ goto parse_flag; ++ ++ /* we check to see if the command comes from the */ ++ /* command line or not. If it does then enable it */ ++ /* otherwise fail. NONE should never be a default configuration */ ++ case oNoneSwitch: ++ if(strcmp(filename,"command-line") == 0) { ++ intptr = &options->none_switch; ++ goto parse_flag; ++ } else { ++ error("NoneSwitch is found in %.200s.\nYou may only use this configuration option from the command line", filename); ++ error("Continuing..."); ++ debug("NoneSwitch directive found in %.200s.", filename); ++ return 0; ++ } ++#endif ++ + case oVerifyHostKeyDNS: + intptr = &options->verify_host_key_dns; + multistate_ptr = multistate_yesnoask; +@@ -2742,6 +2799,16 @@ initialize_options(Options * options) + options->ip_qos_interactive = -1; + options->ip_qos_bulk = -1; + options->request_tty = -1; ++#ifdef NONE_CIPHER_ENABLED ++ options->none_switch = -1; ++ options->none_enabled = -1; ++#endif ++#ifdef HPN_ENABLED ++ options->hpn_disabled = -1; ++ options->hpn_buffer_size = -1; ++ options->tcp_rcv_buf_poll = -1; ++ options->tcp_rcv_buf = -1; ++#endif + options->session_type = -1; + options->stdin_null = -1; + options->fork_after_authentication = -1; +@@ -2916,6 +2983,34 @@ fill_default_options(Options * options) + options->server_alive_interval = 0; + if (options->server_alive_count_max == -1) + options->server_alive_count_max = 3; ++#ifdef NONE_CIPHER_ENABLED ++ if (options->none_switch == -1) ++ options->none_switch = 0; ++ if (options->none_enabled == -1) ++ options->none_enabled = 0; ++#endif ++#ifdef HPN_ENABLED ++ if (options->hpn_disabled == -1) ++ options->hpn_disabled = 0; ++ if (options->hpn_buffer_size > -1) { ++ /* if a user tries to set the size to 0 set it to 1KB */ ++ if (options->hpn_buffer_size == 0) ++ options->hpn_buffer_size = 1; ++ /* limit the buffer to SSHBUF_SIZE_MAX (currently 256MB) */ ++ if (options->hpn_buffer_size > (SSHBUF_SIZE_MAX / 1024)) { ++ options->hpn_buffer_size = SSHBUF_SIZE_MAX; ++ debug("User requested buffer larger than 256MB. Request reverted to 256MB"); ++ } else ++ options->hpn_buffer_size *= 1024; ++ debug("hpn_buffer_size set to %d", options->hpn_buffer_size); ++ } ++ if (options->tcp_rcv_buf == 0) ++ options->tcp_rcv_buf = 1; ++ if (options->tcp_rcv_buf > -1) ++ options->tcp_rcv_buf *=1024; ++ if (options->tcp_rcv_buf_poll == -1) ++ options->tcp_rcv_buf_poll = 1; ++#endif + if (options->control_master == -1) + options->control_master = 0; + if (options->control_persist == -1) { +--- work.clean/openssh-6.8p1/readconf.h 2015-03-17 00:49:20.000000000 -0500 ++++ work/openssh-6.8p1/readconf.h 2015-04-03 13:47:45.670125000 -0500 +@@ -105,6 +105,16 @@ + int clear_forwardings; + + int enable_ssh_keysign; ++#ifdef NONE_CIPHER_ENABLED ++ int none_switch; /* Use none cipher */ ++ int none_enabled; /* Allow none to be used */ ++#endif ++#ifdef HPN_ENABLED ++ int tcp_rcv_buf; /* user switch to set tcp recv buffer */ ++ int tcp_rcv_buf_poll; /* Option to poll recv buf every window transfer */ ++ int hpn_disabled; /* Switch to disable HPN buffer management */ ++ int hpn_buffer_size; /* User definable size for HPN buffer window */ ++#endif + int64_t rekey_limit; + int rekey_interval; + int no_host_authentication_for_localhost; +--- work/openssh/scp.c.orig 2020-09-27 00:25:01.000000000 -0700 ++++ work/openssh/scp.c 2020-11-10 10:31:03.060729000 -0800 +@@ -1246,7 +1246,7 @@ sink(int argc, char **argv, const char *src) + off_t size, statbytes; + unsigned long long ull; + int setimes, targisdir, wrerr; +- char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048]; ++ char ch, *cp, *np, *targ, *why, *vect[1], buf[COPY_BUFLEN], visbuf[COPY_BUFLEN]; + char **patterns = NULL; + size_t n, npatterns = 0; + struct timeval tv[2]; +--- work/openssh/servconf.c.orig 2026-07-21 08:56:02.560966000 -0700 ++++ work/openssh/servconf.c 2026-07-21 09:12:31.696064000 -0700 +@@ -62,6 +62,9 @@ + #include "myproposal.h" + #include "digest.h" + #include "version.h" ++#ifdef HPN_ENABLED ++#include "sshbuf.h" ++#endif + + #define SSHD_CONFIG_BLOB_VERSION 1 + +@@ -303,7 +306,58 @@ fill_default_server_options(ServerOptions *options) + #undef SSHCONF_UNSUPPORTED_INT + #undef SSHCONF_UNSUPPORTED_STRING + #undef SSHCONF_ALIAS ++ ++#ifdef NONE_CIPHER_ENABLED ++ if (options->none_enabled == -1) ++ options->none_enabled = 0; ++#endif ++#ifdef HPN_ENABLED ++ if (options->hpn_disabled == -1) ++ options->hpn_disabled = 0; ++ ++ if (options->hpn_buffer_size == -1) { ++ /* ++ * option not explicitly set. Now we have to figure out ++ * what value to use. ++ */ ++ if (options->hpn_disabled == 1) { ++ options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT; ++ } else { ++ int sock, socksize; ++ socklen_t socksizelen = sizeof(socksize); + ++ /* ++ * get the current RCV size and set it to that ++ * create a socket but don't connect it ++ * we use that the get the rcv socket size ++ */ ++ sock = socket(AF_INET, SOCK_STREAM, 0); ++ getsockopt(sock, SOL_SOCKET, SO_RCVBUF, ++ &socksize, &socksizelen); ++ close(sock); ++ options->hpn_buffer_size = socksize; ++ debug ("HPN Buffer Size: %d", options->hpn_buffer_size); ++ } ++ } else { ++ /* ++ * we have to do this incase the user sets both values in a ++ * contradictory manner. hpn_disabled overrrides ++ * hpn_buffer_size ++ */ ++ if (options->hpn_disabled <= 0) { ++ if (options->hpn_buffer_size == 0) ++ options->hpn_buffer_size = 1; ++ /* limit the maximum buffer to SSHBUF_SIZE_MAX (currently 256MB) */ ++ if (options->hpn_buffer_size > (SSHBUF_SIZE_MAX / 1024)) { ++ options->hpn_buffer_size = SSHBUF_SIZE_MAX; ++ } else { ++ options->hpn_buffer_size *= 1024; ++ } ++ } else ++ options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT; ++ } ++#endif ++ + #ifdef USE_PAM + if (options->pam_service_name == NULL) + options->pam_service_name = xstrdup(SSHD_PAM_SERVICE); +@@ -1350,8 +1404,27 @@ process_server_config_line_depth(ServerOptions *option + + case sHostbasedAuthentication: + intptr = &options->hostbased_authentication; ++ goto parse_flag; ++ ++#ifdef NONE_CIPHER_ENABLED ++ case sNoneEnabled: ++ intptr = &options->none_enabled; + goto parse_flag; ++#endif ++#ifdef HPN_ENABLED ++ case sTcpRcvBufPoll: ++ intptr = &options->tcp_rcv_buf_poll; ++ goto parse_flag; + ++ case sHPNDisabled: ++ intptr = &options->hpn_disabled; ++ goto parse_flag; ++ ++ case sHPNBufferSize: ++ intptr = &options->hpn_buffer_size; ++ goto parse_int; ++#endif ++ + case sHostbasedUsesNameFromPacketOnly: + intptr = &options->hostbased_uses_name_from_packet_only; + goto parse_flag; +--- work/openssh/servconf.h.orig 2026-07-21 08:56:02.562664000 -0700 ++++ work/openssh/servconf.h 2026-07-21 09:05:57.527148000 -0700 +@@ -264,13 +264,31 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL) + SSHCONF_ALIAS(UseBlacklist, UseBlocklist, SSHCFG_GLOBAL) \ + SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL) + ++#ifdef NONE_CIPHER_ENABLED ++#define SSHD_CONFIG_HPN_NONE_ENABLED \ ++ SSHCONF_INTFLAG(none_enabled, NoneEnabled, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) ++#else ++#define SSHD_CONFIG_HPN_NONE_ENABLED ++#endif ++#ifdef HPN_ENABLED ++#define SSHD_CONFIG_ENTRIES_HPN \ ++SSHCONF_INTFLAG(hpn_buffer_size, HPNBufferSize, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) \ ++SSHCONF_INTFLAG(tcp_rcv_buf_poll, TcpRcvBufPoll, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) \ ++SSHCONF_INTFLAG(hpn_disabled, HPNDisabled, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) \ ++SSHD_CONFIG_HPN_NONE_ENABLED ++#else ++#define SSHD_CONFIG_ENTRIES_HPN \ ++SSHD_CONFIG_HPN_NONE_ENABLED ++#endif ++ + #define SSHD_CONFIG_ENTRIES_BASE \ + SSHD_CONFIG_ENTRIES_CUSTOM \ + SSHD_CONFIG_ENTRIES_MAIN \ *** 1017 LINES SKIPPED ***