git: 516c0db3f73b - main - security/openssh-portable: Update to 10.4p1
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 24 Jul 2026 20:41:52 UTC
The branch main has been updated by bdrewery:
URL: https://cgit.FreeBSD.org/ports/commit/?id=516c0db3f73bb14676fe982815f99f5992ba5310
commit 516c0db3f73bb14676fe982815f99f5992ba5310
Author: Bryan Drewery <bdrewery@FreeBSD.org>
AuthorDate: 2026-07-06 19:43:03 +0000
Commit: Bryan Drewery <bdrewery@FreeBSD.org>
CommitDate: 2026-07-24 20:41:38 +0000
security/openssh-portable: Update to 10.4p1
Deprecate the HPN patch. It was removed in base in 2016. It has not
matched the upstream patch in many years, which has been renamed
to "hpn-ssh". Bringing it back as a separate port could make sense
but won't be done in this port.
Release notes: https://www.openssh.org/txt/release-10.4
---
UPDATING | 26 +++++
security/openssh-portable/Makefile | 18 ++-
security/openssh-portable/distinfo | 12 +-
.../openssh-portable/files/extra-patch-blacklistd | 91 +++++----------
security/openssh-portable/files/extra-patch-hpn | 125 +++++++++------------
.../openssh-portable/files/extra-patch-hpn-compat | 24 ++--
security/openssh-portable/files/patch-servconf.c | 44 --------
security/openssh-portable/files/patch-servconf.h | 44 ++++++++
security/openssh-portable/files/patch-ssh-agent.c | 28 ++---
security/openssh-portable/pkg-message.hpn | 48 ++++++++
10 files changed, 243 insertions(+), 217 deletions(-)
diff --git a/UPDATING b/UPDATING
index b336593c9e71..2bd60bfdf8f7 100644
--- a/UPDATING
+++ b/UPDATING
@@ -5,6 +5,32 @@ they are unavoidable.
You should get into the habit of checking this file for changes each time
you update your ports collection, before attempting any port upgrades.
+20260721:
+ AFFECTS: users of security/openssh-portable
+ AUTHOR: bdrewery@FreeBSD.org
+
+ The OpenSSH HPN option and flavor are deprecated and will be removed.
+ Base removed the patch in 2016, and the patch has not matched upstream
+ in many years. The new upstream is named "hpn-ssh". It may be revived
+ as a separate package/port in the future.
+
+ To switch the package:
+ # pkg set -n openssh-portable-hpn:openssh-portable
+
+ Remove these options:
+ sshd_config:
+ - NoneEnabled
+ - HPNDisabled
+ - HPNBufferSize
+ - TcpRcvBufPoll
+ ssh_config:
+ - NoneEnabled
+ - NoneSwitch
+ - TcpRcvBufPoll
+ - TcpRcvBuf
+ - HPNDisabled
+ - HPNBufferSize
+
20260708:
AFFECTS: users of net/croc
AUTHOR: olgeni@FreeBSD.org
diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index abbc35b5a7ca..edda2734cef1 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,5 +1,5 @@
PORTNAME= openssh
-DISTVERSION= 10.3p1
+DISTVERSION= 10.4p1
PORTREVISION= 0
PORTEPOCH= 1
CATEGORIES= security
@@ -96,7 +96,17 @@ ETCDIR?= ${PREFIX}/etc/ssh
.include <bsd.port.pre.mk>
-PATCH_SITES+= http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,hpn,gsskex
+PATCH_SITES+= http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,hpn,gsskex,github_openssh
+
+# This needs to be applied first, before the gsskex patch at least.
+PATCH_SITES+= https://github.com/openssh/openssh-portable/commit/:github_openssh
+PATCHFILES+= c147093565634eae9f91e4df99e04a6b3513f9c6.patch:-p1:github_openssh
+
+.if ${FLAVOR:U} == hpn || ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER}
+DEPRECATED= HPN patch is deprecated. Removed in base in 2016, and does not match official HPN-SSH implementation
+EXPIRATION_DATE=2026-10-01
+PKGMESSAGE= ${PKGDIR}/pkg-message.hpn
+.endif
# Must add this patch before HPN due to conflicts
.if !${PORT_OPTIONS:MBLACKLISTD}
@@ -115,13 +125,13 @@ EXTRA_PATCHES+= ${FILESDIR}/extra-patch-hpn-gss-glue
. endif
# - See https://sources.debian.org/data/main/o/openssh/ for which subdir to
# pull from.
-GSSAPI_DEBIAN_VERSION= 10.3p1
+# GSSAPI_DEBIAN_VERSION= 10.4p1
GSSAPI_DEBIAN_SUBDIR= ${GSSAPI_DEBIAN_VERSION:U${DISTVERSION}}-1
# - Debian does not use a versioned filename so we trick fetch to make one for
# us with the ?<anything>=/ trick.
PATCH_SITES+= https://sources.debian.org/data/main/o/openssh/1:${GSSAPI_DEBIAN_SUBDIR}/debian/patches/gssapi.patch?dummy=/:gsskex
# Bump this when updating the patch location
-GSSAPI_DISTVERSION= 10.3p1
+GSSAPI_DISTVERSION= 10.4p1
PATCHFILES+= openssh-${GSSAPI_DISTVERSION:U${DISTVERSION}}-gsskex-all-debian-rh-${GSSAPI_DISTVERSION}.patch:-p1:gsskex
EXTRA_PATCHES+= ${FILESDIR}/extra-patch-gssapi-kexgssc.c
EXTRA_PATCHES+= ${FILESDIR}/extra-patch-gssapi-kexgsss.c
diff --git a/security/openssh-portable/distinfo b/security/openssh-portable/distinfo
index 14b3b9a55b8d..b40e02584996 100644
--- a/security/openssh-portable/distinfo
+++ b/security/openssh-portable/distinfo
@@ -1,5 +1,7 @@
-TIMESTAMP = 1777161775
-SHA256 (openssh-10.3p1.tar.gz) = 56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4
-SIZE (openssh-10.3p1.tar.gz) = 2007369
-SHA256 (openssh-10.3p1-gsskex-all-debian-rh-10.3p1.patch) = 58f2d59009442572107f6e02c43145676d4ee6461907f719820c77b07adb6612
-SIZE (openssh-10.3p1-gsskex-all-debian-rh-10.3p1.patch) = 126667
+TIMESTAMP = 1784648115
+SHA256 (openssh-10.4p1.tar.gz) = ef6026dd2aea8d56059638d5d3262902c892ceba9f88395835e0d06d3fb63238
+SIZE (openssh-10.4p1.tar.gz) = 2321796
+SHA256 (c147093565634eae9f91e4df99e04a6b3513f9c6.patch) = 862c37dd85fe286e8ea6394c0c8111d54688bb81617bbe3928a1138651687ebe
+SIZE (c147093565634eae9f91e4df99e04a6b3513f9c6.patch) = 4206
+SHA256 (openssh-10.4p1-gsskex-all-debian-rh-10.4p1.patch) = dc88ff53591dcafcb6ac148d451eb1b9adc9d2c047e68509354ea4f07dc56f41
+SIZE (openssh-10.4p1-gsskex-all-debian-rh-10.4p1.patch) = 124953
diff --git a/security/openssh-portable/files/extra-patch-blacklistd b/security/openssh-portable/files/extra-patch-blacklistd
index 70c6efd8c6ab..85ce165d6f6d 100644
--- a/security/openssh-portable/files/extra-patch-blacklistd
+++ b/security/openssh-portable/files/extra-patch-blacklistd
@@ -157,7 +157,7 @@
+blacklist_init(void)
+{
+
-+ if (options.use_blacklist)
++ if (options.use_blocklist)
+ blstate = bl_create(false, NULL, im_log);
+}
+
@@ -272,71 +272,34 @@
debug_f("user %s authenticated by privileged process", authctxt->user);
auth_attempted = 0;
---- servconf.c.orig 2025-10-02 12:00:00.000000000
-+++ servconf.c 2025-10-02 12:00:00.000000000
-@@ -184,6 +184,7 @@
- options->max_sessions = -1;
- options->banner = NULL;
- options->use_dns = -1;
-+ options->use_blacklist = -1;
- options->client_alive_interval = -1;
- options->client_alive_count_max = -1;
- options->num_authkeys_files = 0;
-@@ -449,6 +458,8 @@
- options->max_sessions = DEFAULT_SESSIONS_MAX;
- if (options->use_dns == -1)
- options->use_dns = 0;
-+ if (options->use_blacklist == -1)
-+ options->use_blacklist = 0;
- if (options->client_alive_interval == -1)
- options->client_alive_interval = 0;
- if (options->client_alive_count_max == -1)
-@@ -567,6 +568,7 @@
- sGatewayPorts, sPubkeyAuthentication, sPubkeyAcceptedAlgorithms,
- sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions,
- sBanner, sUseDNS, sHostbasedAuthentication,
-+ sUseBlacklist,
- sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedAlgorithms,
- sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
- sPerSourcePenalties, sPerSourcePenaltyExemptList,
-@@ -700,6 +712,8 @@
- { "maxsessions", sMaxSessions, SSHCFG_ALL },
- { "banner", sBanner, SSHCFG_ALL },
- { "usedns", sUseDNS, SSHCFG_GLOBAL },
-+ { "useblacklist", sUseBlacklist, SSHCFG_GLOBAL },
-+ { "useblocklist", sUseBlacklist, SSHCFG_GLOBAL } /* alias */,
- { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
- { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
- { "clientaliveinterval", sClientAliveInterval, SSHCFG_ALL },
-@@ -1782,6 +1796,10 @@
- intptr = &options->use_dns;
- goto parse_flag;
-
-+ case sUseBlacklist:
-+ intptr = &options->use_blacklist;
-+ goto parse_flag;
-+
- case sLogFacility:
- log_facility_ptr = &options->log_facility;
- arg = argv_next(&ac, &av);
-@@ -3279,6 +3297,7 @@
+--- servconf.c.orig 2026-07-06 00:57:12.000000000 -0700
++++ servconf.c 2026-07-06 12:44:00.554064000 -0700
+@@ -4237,6 +4237,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sCompression, o->compression);
dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
dump_cfg_fmtint(sUseDNS, o->use_dns);
-+ dump_cfg_fmtint(sUseBlacklist, o->use_blacklist);
++ dump_cfg_fmtint(sUseBlocklist, o->use_blocklist);
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding);
dump_cfg_fmtint(sDisableForwarding, o->disable_forwarding);
---- servconf.h.orig 2025-10-02 12:00:00.000000000
-+++ servconf.h 2025-10-02 12:00:00.000000000
-@@ -195,6 +195,7 @@
- int max_sessions;
- char *banner; /* SSH-2 banner message */
- int use_dns;
-+ int use_blacklist;
- int client_alive_interval; /*
- * poke the client this often to
- * see if it's still there
+--- servconf.h.orig 2026-07-06 00:57:12.000000000 -0700
++++ servconf.h 2026-07-06 13:28:33.943319000 -0700
+@@ -210,6 +210,7 @@ SSHCONF_INTFLAG(use_dns, UseDNS, SSHCFG_GLOBAL, 0, SSH
+ SSHCONF_INT(max_sessions, MaxSessions, SSHCFG_ALL, NULL, DEFAULT_SESSIONS_MAX, SSHCFG_COPY_MATCH) \
+ SSHCONF_STRING(banner, Banner, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
+ SSHCONF_INTFLAG(use_dns, UseDNS, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \
++SSHCONF_INTFLAG(use_blocklist, UseBlocklist, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \
+ SSHCONF_INT(client_alive_interval, ClientAliveInterval, SSHCFG_ALL, NULL, 0, SSHCFG_COPY_MATCH) \
+ SSHCONF_INT(client_alive_count_max, ClientAliveCountMax, SSHCFG_ALL, NULL, 3, SSHCFG_COPY_MATCH) \
+ SSHCONF_STRARRAY(authorized_keys_files, num_authkeys_files, AuthorizedKeysFile, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
+@@ -260,6 +261,7 @@ SSHCONF_ALIAS(SKeyAuthentication, KbdInteractiveAuthen
+ SSHCONF_ALIAS(DSAAuthentication, PubkeyAuthentication, SSHCFG_GLOBAL) \
+ SSHCONF_ALIAS(ChallengeResponseAuthentication, KbdInteractiveAuthentication, SSHCFG_ALL) \
+ SSHCONF_ALIAS(SKeyAuthentication, KbdInteractiveAuthentication, SSHCFG_ALL) \
++SSHCONF_ALIAS(UseBlacklist, UseBlocklist, SSHCFG_GLOBAL) \
+ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL)
+
+ #define SSHD_CONFIG_ENTRIES_BASE \
--- sshd-session.c.orig 2026-04-02 01:09:03.000000000 -0700
+++ sshd-session.c 2026-04-25 16:49:54.889134000 -0700
@@ -95,6 +95,7 @@
@@ -375,17 +338,17 @@
is to never expire connections for having no open channels.
This option may be useful in conjunction with
.Cm ChannelTimeout .
-+.It Cm UseBlacklist
++.It Cm UseBlocklist
+Specifies whether
+.Xr sshd 8
+attempts to send authentication success and failure messages
+to the
-+.Xr blacklistd 8
++.Xr blocklistd 8
+daemon.
+The default is
+.Cm no .
+For forward compatibility with an upcoming
-+.Xr blacklistd
++.Xr blocklistd
+rename, the
+.Cm UseBlocklist
+alias can be used instead.
@@ -398,7 +361,7 @@
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
-+#UseBlacklist no
++#UseBlocklist no
#VersionAddendum none
# no default banner path
diff --git a/security/openssh-portable/files/extra-patch-hpn b/security/openssh-portable/files/extra-patch-hpn
index 6601e745cdf9..cf4295ff121d 100644
--- a/security/openssh-portable/files/extra-patch-hpn
+++ b/security/openssh-portable/files/extra-patch-hpn
@@ -693,9 +693,9 @@ diff -urN -x configure -x config.guess -x config.h.in -x config.sub work.clean/o
char **patterns = NULL;
size_t n, npatterns = 0;
struct timeval tv[2];
---- work/openssh/servconf.c.orig 2025-04-09 00:02:43.000000000 -0700
-+++ work/openssh/servconf.c 2025-04-10 22:30:44.919047000 -0700
-@@ -69,6 +69,9 @@
+--- work/openssh/servconf.c.orig 2026-07-21 08:56:02.560966000 -0700
++++ work/openssh/servconf.c 2026-07-21 09:12:31.696064000 -0700
+@@ -62,6 +62,9 @@
#include "myproposal.h"
#include "digest.h"
#include "version.h"
@@ -703,27 +703,13 @@ diff -urN -x configure -x config.guess -x config.h.in -x config.sub work.clean/o
+#include "sshbuf.h"
+#endif
- #if !defined(SSHD_PAM_SERVICE)
- # define SSHD_PAM_SERVICE "sshd"
-@@ -204,6 +207,14 @@ initialize_server_options(ServerOptions *options)
- options->authorized_principals_file = NULL;
- options->authorized_principals_command = NULL;
- options->authorized_principals_command_user = NULL;
-+#ifdef NONE_CIPHER_ENABLED
-+ options->none_enabled = -1;
-+#endif
-+#ifdef HPN_ENABLED
-+ options->tcp_rcv_buf_poll = -1;
-+ options->hpn_disabled = -1;
-+ options->hpn_buffer_size = -1;
-+#endif
- options->ip_qos_interactive = -1;
- options->ip_qos_bulk = -1;
- options->version_addendum = NULL;
-@@ -471,6 +482,57 @@ fill_default_server_options(ServerOptions *options)
- }
- if (options->permit_tun == -1)
- options->permit_tun = SSH_TUNMODE_NO;
+ #define SSHD_CONFIG_BLOB_VERSION 1
+
+@@ -303,7 +306,58 @@ fill_default_server_options(ServerOptions *options)
+ #undef SSHCONF_UNSUPPORTED_INT
+ #undef SSHCONF_UNSUPPORTED_STRING
+ #undef SSHCONF_ALIAS
++
+#ifdef NONE_CIPHER_ENABLED
+ if (options->none_enabled == -1)
+ options->none_enabled = 0;
@@ -742,7 +728,7 @@ diff -urN -x configure -x config.guess -x config.h.in -x config.sub work.clean/o
+ } else {
+ int sock, socksize;
+ socklen_t socksizelen = sizeof(socksize);
-+
+
+ /*
+ * get the current RCV size and set it to that
+ * create a socket but don't connect it
@@ -775,51 +761,25 @@ diff -urN -x configure -x config.guess -x config.h.in -x config.sub work.clean/o
+ }
+#endif
+
- if (options->ip_qos_interactive == -1)
- options->ip_qos_interactive = IPTOS_DSCP_AF21;
- if (options->ip_qos_bulk == -1)
-@@ -573,6 +635,12 @@ typedef enum {
- sUsePrivilegeSeparation, sAllowAgentForwarding,
- sHostCertificate, sInclude,
- sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
-+#ifdef NONE_CIPHER_ENABLED
-+ sNoneEnabled,
-+#endif
-+#ifdef HPN_ENABLED
-+ sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
-+#endif
- sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
- sKexAlgorithms, sCASignatureAlgorithms, sIPQoS, sVersionAddendum,
- sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
-@@ -727,6 +795,14 @@ static struct {
- { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
- { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
- { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
-+#ifdef NONE_CIPHER_ENABLED
-+ { "noneenabled", sNoneEnabled, SSHCFG_ALL },
-+#endif
-+#ifdef HPN_ENABLED
-+ { "hpndisabled", sHPNDisabled, SSHCFG_ALL },
-+ { "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
-+ { "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
-+#endif
- { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
- { "include", sInclude, SSHCFG_ALL },
- { "ipqos", sIPQoS, SSHCFG_ALL },
-@@ -1568,6 +1644,25 @@ process_server_config_line_depth(ServerOptions *option
- intptr = &options->hostbased_authentication;
- goto parse_flag;
+ #ifdef USE_PAM
+ if (options->pam_service_name == NULL)
+ options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
+@@ -1350,8 +1404,27 @@ process_server_config_line_depth(ServerOptions *option
+ case sHostbasedAuthentication:
+ intptr = &options->hostbased_authentication;
++ goto parse_flag;
++
+#ifdef NONE_CIPHER_ENABLED
+ case sNoneEnabled:
+ intptr = &options->none_enabled;
-+ goto parse_flag;
+ goto parse_flag;
+#endif
+#ifdef HPN_ENABLED
+ case sTcpRcvBufPoll:
+ intptr = &options->tcp_rcv_buf_poll;
+ goto parse_flag;
-+
+
+ case sHPNDisabled:
+ intptr = &options->hpn_disabled;
+ goto parse_flag;
@@ -832,24 +792,41 @@ diff -urN -x configure -x config.guess -x config.h.in -x config.sub work.clean/o
case sHostbasedUsesNameFromPacketOnly:
intptr = &options->hostbased_uses_name_from_packet_only;
goto parse_flag;
---- work.clean/openssh-6.8p1/servconf.h 2015-03-17 00:49:20.000000000 -0500
-+++ work/openssh-6.8p1/servconf.h 2015-04-03 13:48:37.316827000 -0500
-@@ -169,6 +169,15 @@
-
- int use_pam; /* Enable auth via PAM */
+--- work/openssh/servconf.h.orig 2026-07-21 08:56:02.562664000 -0700
++++ work/openssh/servconf.h 2026-07-21 09:05:57.527148000 -0700
+@@ -264,13 +264,31 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL)
+ SSHCONF_ALIAS(UseBlacklist, UseBlocklist, SSHCFG_GLOBAL) \
+ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL)
+#ifdef NONE_CIPHER_ENABLED
-+ int none_enabled; /* enable NONE cipher switch */
++#define SSHD_CONFIG_HPN_NONE_ENABLED \
++ SSHCONF_INTFLAG(none_enabled, NoneEnabled, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH)
++#else
++#define SSHD_CONFIG_HPN_NONE_ENABLED
+#endif
+#ifdef HPN_ENABLED
-+ int tcp_rcv_buf_poll; /* poll tcp rcv window in autotuning kernels*/
-+ int hpn_disabled; /* disable hpn functionality. false by default */
-+ int hpn_buffer_size; /* set the hpn buffer size - default 3MB */
-+#endif
-+
- int permit_tun;
++#define SSHD_CONFIG_ENTRIES_HPN \
++SSHCONF_INTFLAG(hpn_buffer_size, HPNBufferSize, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) \
++SSHCONF_INTFLAG(tcp_rcv_buf_poll, TcpRcvBufPoll, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) \
++SSHCONF_INTFLAG(hpn_disabled, HPNDisabled, SSHCFG_ALL, -1, SSHCFG_COPY_MATCH) \
++SSHD_CONFIG_HPN_NONE_ENABLED
++#else
++#define SSHD_CONFIG_ENTRIES_HPN \
++SSHD_CONFIG_HPN_NONE_ENABLED
++#endif
++
+ #define SSHD_CONFIG_ENTRIES_BASE \
+ SSHD_CONFIG_ENTRIES_CUSTOM \
+ SSHD_CONFIG_ENTRIES_MAIN \
+ SSHD_CONFIG_ENTRIES_LEGACY \
+ SSHD_CONFIG_ENTRIES_ALIASES \
+ SSHD_CONFIG_ENTRIES_PAM \
+- SSHD_CONFIG_ENTRIES_LASTLOG
++ SSHD_CONFIG_ENTRIES_LASTLOG \
++ SSHD_CONFIG_ENTRIES_HPN
- int num_permitted_opens;
+ #ifdef USE_PAM
+ #define SSHD_CONFIG_ENTRIES_PAM \
--- work/openssh-7.7p1/serverloop.c.orig 2018-04-01 22:38:28.000000000 -0700
+++ work/openssh-7.7p1/serverloop.c 2018-06-27 16:53:02.246871000 -0700
@@ -550,6 +550,12 @@ server_request_tun(struct ssh *ssh)
diff --git a/security/openssh-portable/files/extra-patch-hpn-compat b/security/openssh-portable/files/extra-patch-hpn-compat
index 58c2d7a0e0e7..0316bb4dbfe3 100644
--- a/security/openssh-portable/files/extra-patch-hpn-compat
+++ b/security/openssh-portable/files/extra-patch-hpn-compat
@@ -31,16 +31,16 @@ r294563 was incomplete; re-add the client-side options as well.
{ NULL, oBadOption }
};
---- servconf.c.orig 2024-09-19 15:20:48.000000000 -0700
-+++ servconf.c 2024-10-07 20:18:18.259726000 -0700
-@@ -746,6 +746,10 @@ static struct {
- { "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL },
- { "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL },
- { "refuseconnection", sRefuseConnection, SSHCFG_ALL },
-+ { "noneenabled", sUnsupported, SSHCFG_ALL },
-+ { "hpndisabled", sDeprecated, SSHCFG_ALL },
-+ { "hpnbuffersize", sDeprecated, SSHCFG_ALL },
-+ { "tcprcvbufpoll", sDeprecated, SSHCFG_ALL },
- { NULL, sBadOption, 0 }
- };
+--- servconf.h.orig 2026-07-06 00:57:12.000000000 -0700
++++ servconf.h 2026-07-06 13:38:43.139752000 -0700
+@@ -251,6 +251,10 @@ SSHCONF_DEPRECATE(AFSTokenPassing, SSHCFG_GLOBAL, SSHC
+ SSHCONF_DEPRECATE(UsePrivilegeSeparation, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \
+ SSHCONF_DEPRECATE(KerberosTgtPassing, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \
+ SSHCONF_DEPRECATE(AFSTokenPassing, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \
++SSHCONF_DEPRECATE(NoneEnabled, SSHCFG_ALL, SSHCONF_DEPRECATED) \
++SSHCONF_DEPRECATE(HPNDisabled, SSHCFG_ALL, SSHCONF_DEPRECATED) \
++SSHCONF_DEPRECATE(HPNBufferSize, SSHCFG_ALL, SSHCONF_DEPRECATED) \
++SSHCONF_DEPRECATE(TCPRcvBufPoll, SSHCFG_ALL, SSHCONF_DEPRECATED) \
+ SSHCONF_DEPRECATE(Protocol, SSHCFG_GLOBAL, SSHCONF_IGNORE)
+ #define SSHD_CONFIG_ENTRIES_ALIASES \
diff --git a/security/openssh-portable/files/patch-servconf.c b/security/openssh-portable/files/patch-servconf.c
deleted file mode 100644
index cba3768c1507..000000000000
--- a/security/openssh-portable/files/patch-servconf.c
+++ /dev/null
@@ -1,44 +0,0 @@
-r99048 | des | 2002-06-29 05:51:56 -0500 (Sat, 29 Jun 2002) | 4 lines
-Changed paths:
- M /head/crypto/openssh/myproposal.h
- M /head/crypto/openssh/readconf.c
- M /head/crypto/openssh/servconf.c
-
-Apply FreeBSD's configuration defaults.
-
---- servconf.c.orig 2026-04-25 16:05:26.936844000 -0700
-+++ servconf.c 2026-04-25 16:18:06.486288000 -0700
-@@ -298,7 +299,11 @@ fill_default_server_options(ServerOptions *options)
-
- /* Portable-specific options */
- if (options->use_pam == -1)
-- options->use_pam = 0;
-+#ifdef USE_PAM
-+ options->use_pam = 1;
-+#else
-+ options->use_pam = 0;
-+#endif
- if (options->pam_service_name == NULL)
- options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
-
-@@ -328,7 +333,7 @@ fill_default_server_options(ServerOptions *options)
- if (options->login_grace_time == -1)
- options->login_grace_time = 120;
- if (options->permit_root_login == PERMIT_NOT_SET)
-- options->permit_root_login = PERMIT_NO_PASSWD;
-+ options->permit_root_login = PERMIT_NO;
- if (options->ignore_rhosts == -1)
- options->ignore_rhosts = 1;
- if (options->ignore_user_known_hosts == -1)
-@@ -380,7 +385,11 @@ fill_default_server_options(ServerOptions *options)
- if (options->gss_strict_acceptor == -1)
- options->gss_strict_acceptor = 1;
- if (options->password_authentication == -1)
-+#ifdef USE_PAM
-+ options->password_authentication = 0;
-+#else
- options->password_authentication = 1;
-+#endif
- if (options->kbd_interactive_authentication == -1)
- options->kbd_interactive_authentication = 1;
- if (options->permit_empty_passwd == -1)
diff --git a/security/openssh-portable/files/patch-servconf.h b/security/openssh-portable/files/patch-servconf.h
new file mode 100644
index 000000000000..88f415253423
--- /dev/null
+++ b/security/openssh-portable/files/patch-servconf.h
@@ -0,0 +1,44 @@
+Match FreeBSD base defaults.
+
+--- servconf.h.orig 2026-07-06 13:41:09.300286000 -0700
++++ servconf.h 2026-07-06 13:43:13.161664000 -0700
+@@ -157,6 +157,12 @@ SSHCONF_NONCONF(timingsecret)
+ SSHCONF_CUSTOM(PerSourcePenalties, persourcepenalties, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \
+ SSHCONF_CUSTOM(RekeyLimit, rekeylimit, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
+ SSHCONF_NONCONF(timingsecret)
++
++#ifdef USE_PAM
++#define SSHCONF_PASSWD_AUTH_DEFAULT 0
++#else
++#define SSHCONF_PASSWD_AUTH_DEFAULT 1
++#endif
+
+ #define SSHD_CONFIG_ENTRIES_MAIN \
+ SSHCONF_INT(address_family, AddressFamily, SSHCFG_GLOBAL, multistate_addressfamily, AF_UNSPEC, SSHCFG_COPY_NONE) \
+@@ -166,7 +172,7 @@ SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_G
+ SSHCONF_STRING(pid_file, PidFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \
+ SSHCONF_STRING(moduli_file, ModuliFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \
+ SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_GLOBAL, NULL, SSHD_DEFAULT_LOGIN_GRACE_TIME, SSHCFG_COPY_NONE) \
+-SSHCONF_INT(permit_root_login, PermitRootLogin, SSHCFG_ALL, multistate_permitrootlogin, PERMIT_NO_PASSWD, SSHCFG_COPY_MATCH) \
++SSHCONF_INT(permit_root_login, PermitRootLogin, SSHCFG_ALL, multistate_permitrootlogin, PERMIT_NO, SSHCFG_COPY_MATCH) \
+ SSHCONF_INT(ignore_rhosts, IgnoreRhosts, SSHCFG_ALL, multistate_ignore_rhosts, 1, SSHCFG_COPY_MATCH) \
+ SSHCONF_INTFLAG(ignore_user_known_hosts, IgnoreUserKnownHosts, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \
+ SSHCONF_INTFLAG(print_motd, PrintMotd, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+@@ -190,7 +196,7 @@ SSHCONF_STRING(pubkey_accepted_algos, PubkeyAcceptedAl
+ SSHCONF_INT(pubkey_auth_options, PubkeyAuthOptions, SSHCFG_ALL, NULL, 0, SSHCFG_COPY_MATCH) \
+ SSHCONF_INTFLAG(pubkey_authentication, PubkeyAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \
+ SSHCONF_STRING(pubkey_accepted_algos, PubkeyAcceptedAlgorithms, SSHCFG_ALL, SSHCFG_COPY_MATCH) \
+-SSHCONF_INTFLAG(password_authentication, PasswordAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \
++SSHCONF_INTFLAG(password_authentication, PasswordAuthentication, SSHCFG_ALL, SSHCONF_PASSWD_AUTH_DEFAULT, SSHCFG_COPY_MATCH) \
+ SSHCONF_INTFLAG(kbd_interactive_authentication, KbdInteractiveAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \
+ SSHCONF_INTFLAG(permit_empty_passwd, PermitEmptyPasswords, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+ SSHCONF_INT(compression, Compression, SSHCFG_GLOBAL, multistate_compression, SSHD_DEFAULT_COMPRESSION, SSHCFG_COPY_NONE) \
+@@ -278,7 +284,7 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL)
+
+ #ifdef USE_PAM
+ #define SSHD_CONFIG_ENTRIES_PAM \
+-SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \
++SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+ SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL, SSHCFG_COPY_NONE)
+ #else
+ #define SSHD_CONFIG_ENTRIES_PAM \
diff --git a/security/openssh-portable/files/patch-ssh-agent.c b/security/openssh-portable/files/patch-ssh-agent.c
index 6f049a8847e5..9b04f1a9d5c4 100644
--- a/security/openssh-portable/files/patch-ssh-agent.c
+++ b/security/openssh-portable/files/patch-ssh-agent.c
@@ -8,9 +8,9 @@ r226103 | des | 2011-10-07 08:10:16 -0500 (Fri, 07 Oct 2011) | 5 lines
Add a -x option that causes ssh-agent(1) to exit when all clients have
disconnected.
---- ssh-agent.c.orig 2025-10-05 19:25:16.000000000 -0700
-+++ ssh-agent.c 2025-10-06 08:33:47.247562000 -0700
-@@ -193,11 +193,28 @@ static char *websafe_allowlist;
+--- ssh-agent.c.orig 2026-07-06 00:57:12.000000000 -0700
++++ ssh-agent.c 2026-07-06 13:49:39.833660000 -0700
+@@ -196,11 +196,28 @@ static char *websafe_allowlist;
static int restrict_websafe = 1;
static char *websafe_allowlist;
@@ -39,7 +39,7 @@ disconnected.
close(e->fd);
sshbuf_free(e->input);
sshbuf_free(e->output);
-@@ -210,6 +227,8 @@ close_socket(SocketEntry *e)
+@@ -213,6 +230,8 @@ close_socket(SocketEntry *e)
memset(e, '\0', sizeof(*e));
e->fd = -1;
e->type = AUTH_UNUSED;
@@ -48,7 +48,7 @@ disconnected.
}
static void
-@@ -1887,6 +1906,10 @@ new_socket(sock_type type, int fd)
+@@ -1932,6 +1951,10 @@ new_socket(sock_type type, int fd)
debug_f("type = %s", type == AUTH_CONNECTION ? "CONNECTION" :
(type == AUTH_SOCKET ? "SOCKET" : "UNKNOWN"));
@@ -59,7 +59,7 @@ disconnected.
set_nonblock(fd);
if (fd > max_fd)
-@@ -2177,7 +2200,7 @@ usage(void)
+@@ -2225,7 +2248,7 @@ usage(void)
usage(void)
{
fprintf(stderr,
@@ -68,7 +68,7 @@ disconnected.
" [-O option] [-P allowed_providers] [-t life]\n"
" ssh-agent [-TU] [-a bind_address] [-E fingerprint_hash] [-O option]\n"
" [-P allowed_providers] [-t life] command [arg ...]\n"
-@@ -2218,6 +2241,7 @@ main(int ac, char **av)
+@@ -2267,6 +2290,7 @@ main(int ac, char **av)
/* drop */
(void)setegid(getgid());
(void)setgid(getgid());
@@ -76,22 +76,22 @@ disconnected.
platform_disable_tracing(0); /* strict=no */
-@@ -2229,7 +2253,7 @@ main(int ac, char **av)
+@@ -2278,7 +2302,7 @@ main(int ac, char **av)
__progname = ssh_get_progname(av[0]);
seed_rng();
-- while ((ch = getopt(ac, av, "cDdksTuUE:a:O:P:t:")) != -1) {
-+ while ((ch = getopt(ac, av, "cDdksTuUE:a:O:P:t:x")) != -1) {
+- while ((ch = getopt(ac, av, "cDdksTuUVE:a:O:P:t:")) != -1) {
++ while ((ch = getopt(ac, av, "cDdksTuUVE:a:O:P:t:x")) != -1) {
switch (ch) {
case 'E':
fingerprint_hash = ssh_digest_alg_by_name(optarg);
-@@ -2285,6 +2309,9 @@ main(int ac, char **av)
- fprintf(stderr, "Invalid lifetime\n");
+@@ -2335,6 +2359,9 @@ main(int ac, char **av)
usage();
}
-+ break;
+ break;
+ case 'x':
+ xcount = 0;
- break;
++ break;
case 'T':
T_flag++;
+ break;
diff --git a/security/openssh-portable/pkg-message.hpn b/security/openssh-portable/pkg-message.hpn
new file mode 100644
index 000000000000..79700272aa2e
--- /dev/null
+++ b/security/openssh-portable/pkg-message.hpn
@@ -0,0 +1,48 @@
+[
+{ type: install
+ message: <<EOM
+To enable this port, add openssh_enable="YES" in your rc.conf. To
+prevent conflict with openssh in the base system add sshd_enable="NO"
+in your rc.conf. Also you can configure openssh at another TCP port (via
+sshd_config 'Port' and 'Listen' options or via 'openssh_flags'
+variable in rc.conf) and run it in same time with base sshd.
+
+'PermitRootLogin no' is the default for the OpenSSH port.
+This now matches the PermitRootLogin configuration of OpenSSH in
+the base system. Please be aware of this when upgrading your
+OpenSSH port, and if truly necessary, re-enable remote root login
+by readjusting this option in your sshd_config.
+
+Users are encouraged to create single-purpose users with ssh keys, disable
+Password authentication by setting 'PasswordAuthentication no' and
+'ChallengeResponseAuthentication no', and to define very narrow sudo
+privileges instead of using root for automated tasks.
+
+!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+This HPN package is deprecated. You should migrate to the openssh-portable
+package and remove these options from your configs.
+The patch was removed in base in 2016, and has not matched the new
+upstream "hpn-ssh" in many years.
+
+To switch the package:
+# pkg set -n openssh-portable-hpn:openssh-portable
+
+Remove these options:
+ sshd_config:
+ - NoneEnabled
+ - HPNDisabled
+ - HPNBufferSize
+ - TcpRcvBufPoll
+ ssh_config:
+ - NoneEnabled
+ - NoneSwitch
+ - TcpRcvBufPoll
+ - TcpRcvBuf
+ - HPNDisabled
+ - HPNBufferSize
+
+!!!!!!!!!!!!!!!!!!!!!!!!!!!
+EOM
+}
+]