Adding debian version 1:9.9p1-1.debian/1%9.9p1-1debian

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

29 files changed, 240 insertions, 225 deletions

diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index e014ae5..15229e0 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From fa2050cccface30a90effecf902ac69779e684a5 Mon Sep 17 00:00:00 2001
+From ec27bea14d45b10b31cc0cc8b8808977678890ad Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
@@ -13,10 +13,10 @@ Patch-Name: authorized-keys-man-symlink.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/Makefile.in b/Makefile.in
-index 6635b5518..f08dd03d9 100644
+index e92bf3e31..eeea95410 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -427,6 +427,7 @@ install-files:
+@@ -426,6 +426,7 @@ install-files:
  	$(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
  	$(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
  	$(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/configure-cache-vars.patch b/debian/patches/configure-cache-vars.patch
index 86481d7..cf7c732 100644
--- a/debian/patches/configure-cache-vars.patch
+++ b/debian/patches/configure-cache-vars.patch
@@ -1,4 +1,4 @@
-From 322f3ff14422182dff32e0dc51c1d0b23b8cba0e Mon Sep 17 00:00:00 2001
+From 36643abfa8abe5cb3f8c52cecadb1e6675d1fe23 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Wed, 3 Apr 2024 11:52:04 +0100
 Subject: Add Autoconf cache variables for OSSH_CHECK_*FLAG_*
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index fd0443b..9bbcf9d 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From 6bed4d1be79474891ebaa62259919f14acf28273 Mon Sep 17 00:00:00 2001
+From b054afdc85f743749259187c2cd8e396d76f442b Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
@@ -8,7 +8,7 @@ initial protocol handshake, for those scared by package-versioning.patch.
 
 Bug-Debian: http://bugs.debian.org/562048
 Forwarded: not-needed
-Last-Update: 2024-07-03
+Last-Update: 2024-09-22
 
 Patch-Name: debian-banner.patch
 ---
@@ -22,10 +22,10 @@ Patch-Name: debian-banner.patch
  7 files changed, 23 insertions(+), 5 deletions(-)
 
 diff --git a/kex.c b/kex.c
-index 744fb27fb..e872ab02e 100644
+index 19b1fcaa8..ca6d5b53d 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -1239,7 +1239,7 @@ send_error(struct ssh *ssh, char *msg)
+@@ -1237,7 +1237,7 @@ send_error(struct ssh *ssh, char *msg)
   */
  int
  kex_exchange_identification(struct ssh *ssh, int timeout_ms,
@@ -34,7 +34,7 @@ index 744fb27fb..e872ab02e 100644
  {
  	int remote_major, remote_minor, mismatch, oerrno = 0;
  	size_t len, n;
-@@ -1257,7 +1257,8 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+@@ -1255,7 +1255,8 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
  	if (version_addendum != NULL && *version_addendum == '\0')
  		version_addendum = NULL;
  	if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%s%s%s\r\n",
@@ -45,10 +45,10 @@ index 744fb27fb..e872ab02e 100644
  	    version_addendum == NULL ? "" : version_addendum)) != 0) {
  		oerrno = errno;
 diff --git a/kex.h b/kex.h
-index d3c57a329..5ca4f9a5e 100644
+index cd6a40333..6a08023d0 100644
 --- a/kex.h
 +++ b/kex.h
-@@ -213,7 +213,7 @@ void	 kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX],
+@@ -215,7 +215,7 @@ void	 kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX],
      const char *, const char *, const char *, const char *, const char *);
  void	 kex_proposal_free_entries(char *prop[PROPOSAL_MAX]);
  
@@ -58,45 +58,45 @@ index d3c57a329..5ca4f9a5e 100644
  struct kex *kex_new(void);
  int	 kex_ready(struct ssh *, char *[PROPOSAL_MAX]);
 diff --git a/servconf.c b/servconf.c
-index 169b9ff07..81511bc86 100644
+index 1d5c143ba..49a066df8 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -217,6 +217,7 @@ initialize_server_options(ServerOptions *options)
- 	options->num_channel_timeouts = 0;
+@@ -219,6 +219,7 @@ initialize_server_options(ServerOptions *options)
  	options->unused_connection_timeout = -1;
  	options->sshd_session_path = NULL;
+ 	options->refuse_connection = -1;
 +	options->debian_banner = -1;
  }
  
  /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
-@@ -501,6 +502,8 @@ fill_default_server_options(ServerOptions *options)
- 		options->unused_connection_timeout = 0;
- 	if (options->sshd_session_path == NULL)
+@@ -507,6 +508,8 @@ fill_default_server_options(ServerOptions *options)
  		options->sshd_session_path = xstrdup(_PATH_SSHD_SESSION);
+ 	if (options->refuse_connection == -1)
+ 		options->refuse_connection = 0;
 +	if (options->debian_banner == -1)
 +		options->debian_banner = 1;
  
  	assemble_algorithms(options);
  
-@@ -585,6 +588,7 @@ typedef enum {
+@@ -591,6 +594,7 @@ typedef enum {
  	sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider,
  	sRequiredRSASize, sChannelTimeout, sUnusedConnectionTimeout,
- 	sSshdSessionPath,
+ 	sSshdSessionPath, sRefuseConnection,
 +	sDebianBanner,
  	sDeprecated, sIgnore, sUnsupported
  } ServerOpCodes;
  
-@@ -763,6 +767,7 @@ static struct {
- 	{ "channeltimeout", sChannelTimeout, SSHCFG_ALL },
+@@ -770,6 +774,7 @@ static struct {
  	{ "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL },
  	{ "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL },
+ 	{ "refuseconnection", sRefuseConnection, SSHCFG_ALL },
 +	{ "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
  	{ NULL, sBadOption, 0 }
  };
  
-@@ -2702,6 +2707,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- 		charptr = &options->sshd_session_path;
- 		goto parse_filename;
+@@ -2725,6 +2730,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 		multistate_ptr = multistate_flag;
+ 		goto parse_multistate;
  
 +	case sDebianBanner:
 +		intptr = &options->debian_banner;
@@ -105,22 +105,22 @@ index 169b9ff07..81511bc86 100644
  	case sDeprecated:
  	case sIgnore:
  	case sUnsupported:
-@@ -3251,6 +3260,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
+@@ -3278,6 +3287,7 @@ dump_config(ServerOptions *o)
  	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
  	dump_cfg_fmtint(sExposeAuthInfo, o->expose_userauth_info);
+ 	dump_cfg_fmtint(sRefuseConnection, o->refuse_connection);
 +	dump_cfg_fmtint(sDebianBanner, o->debian_banner);
  
  	/* string arguments */
  	dump_cfg_string(sPidFile, o->pid_file);
 diff --git a/servconf.h b/servconf.h
-index c1e2751ee..1532e5420 100644
+index 26819aa92..00c834403 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -251,6 +251,8 @@ typedef struct {
- 	int	unused_connection_timeout;
- 
+@@ -254,6 +254,8 @@ typedef struct {
  	char   *sshd_session_path;
+ 
+ 	int	refuse_connection;
 +
 +	int	debian_banner;
  }       ServerOptions;
@@ -140,12 +140,12 @@ index cbfc20735..f9d3a1ff2 100644
  
  	/* Put the connection into non-blocking mode. */
 diff --git a/sshd-session.c b/sshd-session.c
-index b6e544108..2a512dd74 100644
+index 1d7cdd00a..a9e1cf4f6 100644
 --- a/sshd-session.c
 +++ b/sshd-session.c
-@@ -1303,7 +1303,7 @@ main(int ac, char **av)
- 	if (!debug_flag)
- 		alarm(options.login_grace_time);
+@@ -1314,7 +1314,7 @@ main(int ac, char **av)
+ 			fatal("login grace time setitimer failed");
+ 	}
  
 -	if ((r = kex_exchange_identification(ssh, -1,
 +	if ((r = kex_exchange_identification(ssh, -1, options.debian_banner,
@@ -153,7 +153,7 @@ index b6e544108..2a512dd74 100644
  		sshpkt_fatal(ssh, r, "banner exchange");
  
 diff --git a/sshd_config.5 b/sshd_config.5
-index 5dd656869..81671fb99 100644
+index 11a8e922f..ed2f74060 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -629,6 +629,11 @@ or
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index ee3b297..f3840d9 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 8b067a754bdeac8fcdab1fbb2010651cf07b1b61 Mon Sep 17 00:00:00 2001
+From f0e3f2f89d93cc90cd2e03acb5294fba07058b27 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -48,10 +48,10 @@ Patch-Name: debian-config.patch
  7 files changed, 100 insertions(+), 10 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index eaca29ace..1b64b7af5 100644
+index d3c3056ef..90bf74f32 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -2739,7 +2739,7 @@ fill_default_options(Options * options)
+@@ -2773,7 +2773,7 @@ fill_default_options(Options * options)
  	if (options->forward_x11 == -1)
  		options->forward_x11 = 0;
  	if (options->forward_x11_trusted == -1)
@@ -73,10 +73,10 @@ index 7afc28072..02b122a85 100644
  
  # This may be necessary if /usr/src and/or /usr/obj are group-writable,
 diff --git a/ssh.1 b/ssh.1
-index c8c5558e5..0697ec77d 100644
+index 3ad246c27..9ca6e18e2 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -861,6 +861,16 @@ directive in
+@@ -863,6 +863,16 @@ directive in
  .Xr ssh_config 5
  for more information.
  .Pp
@@ -93,7 +93,7 @@ index c8c5558e5..0697ec77d 100644
  .It Fl x
  Disables X11 forwarding.
  .Pp
-@@ -869,6 +879,20 @@ Enables trusted X11 forwarding.
+@@ -871,6 +881,20 @@ Enables trusted X11 forwarding.
  Trusted X11 forwardings are not subjected to the X11 SECURITY extension
  controls.
  .Pp
@@ -140,7 +140,7 @@ index 16197d15d..92d06ef38 100644
 +    HashKnownHosts yes
 +    GSSAPIAuthentication yes
 diff --git a/ssh_config.5 b/ssh_config.5
-index cb1bba1a7..091b933b4 100644
+index 86258eb4f..9adc0fdb7 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -71,6 +71,29 @@ Since the first obtained value for each parameter is used, more
@@ -173,7 +173,7 @@ index cb1bba1a7..091b933b4 100644
  The file contains keyword-argument pairs, one per line.
  Lines starting with
  .Ql #
-@@ -901,11 +924,12 @@ elapsed.
+@@ -903,11 +926,12 @@ elapsed.
  .It Cm ForwardX11Trusted
  If this option is set to
  .Cm yes ,
@@ -246,7 +246,7 @@ index ecfe8d026..677f97d5d 100644
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
 diff --git a/sshd_config.5 b/sshd_config.5
-index 9d33cb472..1f6c42523 100644
+index e177e4af8..2887ed531 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -56,6 +56,35 @@ Arguments may optionally be enclosed in double quotes
@@ -285,7 +285,7 @@ index 9d33cb472..1f6c42523 100644
  The possible
  keywords and their meanings are as follows (note that
  keywords are case-insensitive and arguments are case-sensitive):
-@@ -1840,7 +1869,7 @@ Overrides the default path to the
+@@ -1865,7 +1894,7 @@ Overrides the default path to the
  .Cm sshd-session
  binary that is invoked to handle each connection.
  The default is
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index 6e78215..fd60549 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From 0d8aedb659c1c3892a9ba071ea003530ea8ca1b3 Mon Sep 17 00:00:00 2001
+From 2b058d79e79790dd2991ccd74463e7f28703dd05 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 3c2b05b..c4d24be 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From cceb89a954534c1bed67d20613fe8aa82bec37e4 Mon Sep 17 00:00:00 2001
+From ae3314e7c7ba0ad3dfcb49e2dc2913b442a5f33c Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
@@ -13,10 +13,10 @@ Patch-Name: doc-hash-tab-completion.patch
  1 file changed, 3 insertions(+)
 
 diff --git a/ssh_config.5 b/ssh_config.5
-index d1b1da95a..cb1bba1a7 100644
+index 073ef69e2..86258eb4f 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1020,6 +1020,9 @@ Note that existing names and addresses in known hosts files
+@@ -1022,6 +1022,9 @@ Note that existing names and addresses in known hosts files
  will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index b10014b..cfbb175 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From fac5d188210df34ace8c8f1f6f47c2a72e01c535 Mon Sep 17 00:00:00 2001
+From 9f8d5d786d80ef632c1531eb11ff83cc97b1d19c Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index 5f5f9ce..4950a16 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -1,4 +1,4 @@
-From 19f6afb4e07135a843c2f5caaa663a1d3f3db6f1 Mon Sep 17 00:00:00 2001
+From 25a0d098399b79a2ee544f17947829c01f13932c Mon Sep 17 00:00:00 2001
 From: Simon Wilkinson <simon@sxw.org.uk>
 Date: Sun, 9 Feb 2014 16:09:48 +0000
 Subject: GSSAPI key exchange support
@@ -21,11 +21,11 @@ Author: Colin Watson <cjwatson@debian.org>
 Author: Jakub Jelen <jjelen@redhat.com>
 Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/pull/23
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2024-07-31
+Last-Updated: 2024-09-22
 
 Patch-Name: gssapi.patch
 ---
- Makefile.in     |   5 +-
+ Makefile.in     |   6 +-
  README.md       |  36 +++
  auth.c          |   3 +-
  auth2-gss.c     |  54 ++++-
@@ -65,16 +65,16 @@ Patch-Name: gssapi.patch
  sshd_config.5   |  30 +++
  sshkey.c        |   8 +-
  sshkey.h        |   1 +
- 40 files changed, 2667 insertions(+), 71 deletions(-)
+ 40 files changed, 2667 insertions(+), 72 deletions(-)
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
  create mode 100644 ssh-null.c
 
 diff --git a/Makefile.in b/Makefile.in
-index e1b77ebc6..6635b5518 100644
+index 4243006b0..e92bf3e31 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+@@ -103,14 +103,14 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
  	readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \
  	atomicio.o dispatch.o mac.o misc.o utf8.o \
  	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
@@ -83,15 +83,15 @@ index e1b77ebc6..6635b5518 100644
  	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
  	ssh-pkcs11.o smult_curve25519_ref.o \
  	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \
-@@ -112,6 +112,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	ssh-ed25519.o digest-openssl.o digest-libc.o \
+ 	hmac.o ed25519.o hash.o \
  	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
- 	kexgexc.o kexgexs.o \
- 	kexsntrup761x25519.o sntrup761.o kexgen.o \
-+	kexgssc.o \
+-	kexgexc.o kexgexs.o \
++	kexgexc.o kexgexs.o kexgssc.o \
+ 	kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \
  	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
  	sshbuf-io.o
- 
-@@ -134,7 +135,7 @@ SSHD_SESSION_OBJS=sshd-session.o auth-rhosts.o auth-passwd.o \
+@@ -134,7 +134,7 @@ SSHD_SESSION_OBJS=sshd-session.o auth-rhosts.o auth-passwd.o \
  	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
  	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
  	monitor.o monitor_wrap.o auth-krb5.o \
@@ -145,7 +145,7 @@ index 9431b0ffd..e5051828c 100644
  
  [![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml)
 diff --git a/auth.c b/auth.c
-index 2e4cbef07..407b32e78 100644
+index 9a6e5a319..e4578169b 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -356,7 +356,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
@@ -334,7 +334,7 @@ index 8ed8b1c34..6d57339a1 100644
  		if (conn_in_ready)
  			client_process_net_input(ssh);
 diff --git a/configure.ac b/configure.ac
-index 5a865f8e1..dc274329f 100644
+index 591d5a388..6a0140a9d 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -774,6 +774,30 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@@ -1171,7 +1171,7 @@ index 00e3d118b..b761d12aa 100644
  
  /* Privileged */
 diff --git a/kex-names.c b/kex-names.c
-index 339eb1c23..f077520bb 100644
+index ec840c1f9..081f78c94 100644
 --- a/kex-names.c
 +++ b/kex-names.c
 @@ -45,6 +45,10 @@
@@ -1185,7 +1185,7 @@ index 339eb1c23..f077520bb 100644
  struct kexalg {
  	char *name;
  	u_int type;
-@@ -83,15 +87,28 @@ static const struct kexalg kexalgs[] = {
+@@ -89,15 +93,28 @@ static const struct kexalg kexalgs[] = {
  #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
  	{ NULL, 0, -1, -1},
  };
@@ -1217,7 +1217,7 @@ index 339eb1c23..f077520bb 100644
  		if (ret != NULL)
  			ret[rlen++] = sep;
  		nlen = strlen(k->name);
-@@ -106,6 +123,18 @@ kex_alg_list(char sep)
+@@ -112,6 +129,18 @@ kex_alg_list(char sep)
  	return ret;
  }
  
@@ -1236,7 +1236,7 @@ index 339eb1c23..f077520bb 100644
  static const struct kexalg *
  kex_alg_by_name(const char *name)
  {
-@@ -115,6 +144,10 @@ kex_alg_by_name(const char *name)
+@@ -121,6 +150,10 @@ kex_alg_by_name(const char *name)
  		if (strcmp(k->name, name) == 0)
  			return k;
  	}
@@ -1247,7 +1247,7 @@ index 339eb1c23..f077520bb 100644
  	return NULL;
  }
  
-@@ -177,6 +210,29 @@ kex_names_valid(const char *names)
+@@ -183,6 +216,29 @@ kex_names_valid(const char *names)
  	return 1;
  }
  
@@ -1278,7 +1278,7 @@ index 339eb1c23..f077520bb 100644
  int
  kex_has_any_alg(const char *proposal, const char *algs)
 diff --git a/kex.c b/kex.c
-index 63aae5d71..fd018021e 100644
+index 6b957e5e1..f09e79e6b 100644
 --- a/kex.c
 +++ b/kex.c
 @@ -58,6 +58,7 @@
@@ -1300,13 +1300,13 @@ index 63aae5d71..fd018021e 100644
  	free(kex->hostkey_alg);
  	free(kex->name);
 diff --git a/kex.h b/kex.h
-index 34665eb20..d3c57a329 100644
+index d08988b3e..cd6a40333 100644
 --- a/kex.h
 +++ b/kex.h
-@@ -102,6 +102,15 @@ enum kex_exchange {
- 	KEX_ECDH_SHA2,
+@@ -103,6 +103,15 @@ enum kex_exchange {
  	KEX_C25519_SHA256,
  	KEX_KEM_SNTRUP761X25519_SHA512,
+ 	KEX_KEM_MLKEM768X25519_SHA256,
 +#ifdef GSSAPI
 +	KEX_GSS_GRP1_SHA1,
 +	KEX_GSS_GRP14_SHA1,
@@ -1319,7 +1319,7 @@ index 34665eb20..d3c57a329 100644
  	KEX_MAX
  };
  
-@@ -164,6 +173,12 @@ struct kex {
+@@ -165,6 +174,12 @@ struct kex {
  	u_int	flags;
  	int	hash_alg;
  	int	ec_nid;
@@ -1332,7 +1332,7 @@ index 34665eb20..d3c57a329 100644
  	char	*failed_choice;
  	int	(*verify_host_key)(struct sshkey *, struct ssh *);
  	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
-@@ -188,7 +203,9 @@ u_int	 kex_type_from_name(const char *);
+@@ -190,7 +205,9 @@ u_int	 kex_type_from_name(const char *);
  int	 kex_hash_from_name(const char *);
  int	 kex_nid_from_name(const char *);
  int	 kex_names_valid(const char *);
@@ -1342,7 +1342,7 @@ index 34665eb20..d3c57a329 100644
  char	*kex_names_cat(const char *, const char *);
  int	 kex_has_any_alg(const char *, const char *);
  int	 kex_assemble_names(char **, const char *, const char *);
-@@ -224,6 +241,12 @@ int	 kexgex_client(struct ssh *);
+@@ -226,6 +243,12 @@ int	 kexgex_client(struct ssh *);
  int	 kexgex_server(struct ssh *);
  int	 kex_gen_client(struct ssh *);
  int	 kex_gen_server(struct ssh *);
@@ -1355,7 +1355,7 @@ index 34665eb20..d3c57a329 100644
  
  int	 kex_dh_keypair(struct kex *);
  int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
-@@ -256,6 +279,12 @@ int	 kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
+@@ -264,6 +287,12 @@ int	 kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
      const BIGNUM *, const u_char *, size_t,
      u_char *, size_t *);
  
@@ -1397,7 +1397,7 @@ index c1084f214..0faab21b0 100644
  		break;
  	case KEX_DH_GRP18_SHA512:
 diff --git a/kexgen.c b/kexgen.c
-index 20f3c5711..ca704844e 100644
+index 40d688d62..15df591ca 100644
 --- a/kexgen.c
 +++ b/kexgen.c
 @@ -44,7 +44,7 @@
@@ -2502,10 +2502,10 @@ index 000000000..1fd1d1e48
 +}
 +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
 diff --git a/monitor.c b/monitor.c
-index 9e0e03ea2..92e2ca107 100644
+index 5966b4f96..ad7fef5a9 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -140,6 +140,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
+@@ -141,6 +141,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
  int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
  int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
  int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
@@ -2514,7 +2514,7 @@ index 9e0e03ea2..92e2ca107 100644
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -213,11 +215,18 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -214,11 +216,18 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
@@ -2533,7 +2533,7 @@ index 9e0e03ea2..92e2ca107 100644
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -286,6 +295,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
+@@ -287,6 +296,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
  	/* Permit requests for moduli and signatures */
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2544,7 +2544,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	/* The first few requests do not require asynchronous access */
  	while (!authenticated) {
-@@ -407,6 +420,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
+@@ -408,6 +421,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2555,7 +2555,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	if (auth_opts->permit_pty_flag) {
  		monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1760,6 +1777,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+@@ -1770,6 +1787,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
  # ifdef OPENSSL_HAS_ECC
  	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
@@ -2573,7 +2573,7 @@ index 9e0e03ea2..92e2ca107 100644
  #endif /* WITH_OPENSSL */
  	kex->kex[KEX_C25519_SHA256] = kex_gen_server;
  	kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
-@@ -1852,8 +1880,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1863,8 +1891,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
  	u_char *p;
  	int r;
  
@@ -2584,7 +2584,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
  		fatal_fr(r, "parse");
-@@ -1885,8 +1913,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1896,8 +1924,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
  	OM_uint32 flags = 0; /* GSI needs this */
  	int r;
  
@@ -2595,7 +2595,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
  		fatal_fr(r, "ssh_gssapi_get_buffer_desc");
-@@ -1906,6 +1934,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1917,6 +1945,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2603,7 +2603,7 @@ index 9e0e03ea2..92e2ca107 100644
  	}
  	return (0);
  }
-@@ -1917,8 +1946,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1928,8 +1957,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
  	OM_uint32 ret;
  	int r;
  
@@ -2614,7 +2614,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
  	    (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -1944,13 +1973,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1955,13 +1984,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
  int
  mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  {
@@ -2636,7 +2636,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	sshbuf_reset(m);
  	if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -1959,7 +1992,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1970,7 +2003,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  	debug3_f("sending result %d", authenticated);
  	mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
  
@@ -2649,7 +2649,7 @@ index 9e0e03ea2..92e2ca107 100644
  
  	if ((displayname = ssh_gssapi_displayname()) != NULL)
  		auth2_record_info(authctxt, "%s", displayname);
-@@ -1967,5 +2004,83 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1978,5 +2015,83 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  	/* Monitor loop will terminate if authenticated */
  	return (authenticated);
  }
@@ -2845,7 +2845,7 @@ index e768036ed..09b0ccaaa 100644
  
  #ifdef USE_PAM
 diff --git a/readconf.c b/readconf.c
-index 4e3791cb7..8bdeb9d08 100644
+index 3d9cc6dbb..0ce392538 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -70,6 +70,7 @@
@@ -2888,7 +2888,7 @@ index 4e3791cb7..8bdeb9d08 100644
  #endif
  #ifdef ENABLE_PKCS11
  	{ "pkcs11provider", oPKCS11Provider },
-@@ -1227,10 +1242,46 @@ parse_time:
+@@ -1256,10 +1271,46 @@ parse_time:
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2935,7 +2935,7 @@ index 4e3791cb7..8bdeb9d08 100644
  	case oBatchMode:
  		intptr = &options->batch_mode;
  		goto parse_flag;
-@@ -2542,7 +2593,13 @@ initialize_options(Options * options)
+@@ -2576,7 +2627,13 @@ initialize_options(Options * options)
  	options->fwd_opts.streamlocal_bind_unlink = -1;
  	options->pubkey_authentication = -1;
  	options->gss_authentication = -1;
@@ -2949,7 +2949,7 @@ index 4e3791cb7..8bdeb9d08 100644
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
-@@ -2705,8 +2762,18 @@ fill_default_options(Options * options)
+@@ -2739,8 +2796,18 @@ fill_default_options(Options * options)
  		options->pubkey_authentication = SSH_PUBKEY_AUTH_ALL;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -2968,7 +2968,7 @@ index 4e3791cb7..8bdeb9d08 100644
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -3533,7 +3600,14 @@ dump_client_config(Options *o, const char *host)
+@@ -3567,7 +3634,14 @@ dump_client_config(Options *o, const char *host)
  	dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
  #ifdef GSSAPI
  	dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
@@ -3002,7 +3002,7 @@ index 9447d5d6e..f039c11bd 100644
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff --git a/servconf.c b/servconf.c
-index 5b32f0bfc..c1bfca258 100644
+index 89b8413e8..731f208be 100644
 --- a/servconf.c
 +++ b/servconf.c
 @@ -68,6 +68,7 @@
@@ -3025,7 +3025,7 @@ index 5b32f0bfc..c1bfca258 100644
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->permit_empty_passwd = -1;
-@@ -376,10 +380,18 @@ fill_default_server_options(ServerOptions *options)
+@@ -378,10 +382,18 @@ fill_default_server_options(ServerOptions *options)
  		options->kerberos_get_afs_token = 0;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -3044,7 +3044,7 @@ index 5b32f0bfc..c1bfca258 100644
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -558,6 +570,7 @@ typedef enum {
+@@ -564,6 +576,7 @@ typedef enum {
  	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
@@ -3052,7 +3052,7 @@ index 5b32f0bfc..c1bfca258 100644
  	sAcceptEnv, sSetEnv, sPermitTunnel,
  	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -643,12 +656,22 @@ static struct {
+@@ -649,12 +662,22 @@ static struct {
  #ifdef GSSAPI
  	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -3075,7 +3075,7 @@ index 5b32f0bfc..c1bfca258 100644
  	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
  	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
  	{ "challengeresponseauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, /* alias */
-@@ -1585,6 +1608,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1605,6 +1628,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -3086,7 +3086,7 @@ index 5b32f0bfc..c1bfca258 100644
  	case sGssCleanupCreds:
  		intptr = &options->gss_cleanup_creds;
  		goto parse_flag;
-@@ -1593,6 +1620,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1613,6 +1640,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
  		intptr = &options->gss_strict_acceptor;
  		goto parse_flag;
  
@@ -3109,7 +3109,7 @@ index 5b32f0bfc..c1bfca258 100644
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -3178,6 +3221,10 @@ dump_config(ServerOptions *o)
+@@ -3204,6 +3247,10 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
  	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@@ -3121,10 +3121,10 @@ index 5b32f0bfc..c1bfca258 100644
  	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
  	dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff --git a/servconf.h b/servconf.h
-index 22b158d10..c1e2751ee 100644
+index 5089bc9ea..26819aa92 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -149,8 +149,11 @@ typedef struct {
+@@ -150,8 +150,11 @@ typedef struct {
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@@ -3401,10 +3401,10 @@ index 000000000..a934bda77
 +
 +#endif /* GSSAPI */
 diff --git a/ssh.1 b/ssh.1
-index f871ff4e4..dc382cd49 100644
+index 710d3d4e6..8f78b3a1e 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -536,7 +536,13 @@ For full details of the options listed below, and their possible values, see
+@@ -538,7 +538,13 @@ For full details of the options listed below, and their possible values, see
  .It GatewayPorts
  .It GlobalKnownHostsFile
  .It GSSAPIAuthentication
@@ -3418,7 +3418,7 @@ index f871ff4e4..dc382cd49 100644
  .It HashKnownHosts
  .It Host
  .It HostbasedAcceptedAlgorithms
-@@ -624,6 +630,8 @@ flag),
+@@ -626,6 +632,8 @@ flag),
  (supported message integrity codes),
  .Ar kex
  (key exchange algorithms),
@@ -3465,7 +3465,7 @@ index cc5663562..16197d15d 100644
  #   CheckHostIP no
  #   AddressFamily any
 diff --git a/ssh_config.5 b/ssh_config.5
-index 2e1902283..255577462 100644
+index 7c7c5c50d..4a48c5775 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -938,10 +938,67 @@ The default is
@@ -3537,7 +3537,7 @@ index 2e1902283..255577462 100644
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index e63bb5ec6..e27139adf 100644
+index 11fcdea8a..d809a6507 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
 @@ -222,6 +222,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
@@ -3595,7 +3595,7 @@ index e63bb5ec6..e27139adf 100644
  	/* start key exchange */
  	if ((r = kex_setup(ssh, myproposal)) != 0)
  		fatal_r(r, "kex_setup");
-@@ -271,11 +312,31 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+@@ -271,12 +312,32 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
  # ifdef OPENSSL_HAS_ECC
  	ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
  # endif
@@ -3614,6 +3614,7 @@ index e63bb5ec6..e27139adf 100644
 +#endif /* WITH_OPENSSL */
  	ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
  	ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client;
+ 	ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client;
  	ssh->kex->verify_host_key=&verify_host_key_callback;
  
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
@@ -3628,7 +3629,7 @@ index e63bb5ec6..e27139adf 100644
  	ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done);
  	kex_proposal_free_entries(myproposal);
  
-@@ -368,6 +429,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
+@@ -369,6 +430,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
  static int input_gssapi_token(int type, u_int32_t, struct ssh *);
  static int input_gssapi_error(int, u_int32_t, struct ssh *);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
@@ -3636,7 +3637,7 @@ index e63bb5ec6..e27139adf 100644
  #endif
  
  void	userauth(struct ssh *, char *);
-@@ -384,6 +446,11 @@ static char *authmethods_get(void);
+@@ -385,6 +447,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -3648,7 +3649,7 @@ index e63bb5ec6..e27139adf 100644
  	{"gssapi-with-mic",
  		userauth_gssapi,
  		userauth_gssapi_cleanup,
-@@ -755,12 +822,32 @@ userauth_gssapi(struct ssh *ssh)
+@@ -756,12 +823,32 @@ userauth_gssapi(struct ssh *ssh)
  	OM_uint32 min;
  	int r, ok = 0;
  	gss_OID mech = NULL;
@@ -3682,7 +3683,7 @@ index e63bb5ec6..e27139adf 100644
  
  	/* Check to see whether the mechanism is usable before we offer it */
  	while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
-@@ -769,13 +856,15 @@ userauth_gssapi(struct ssh *ssh)
+@@ -770,13 +857,15 @@ userauth_gssapi(struct ssh *ssh)
  		    elements[authctxt->mech_tried];
  		/* My DER encoding requires length<128 */
  		if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
@@ -3699,7 +3700,7 @@ index e63bb5ec6..e27139adf 100644
  	if (!ok || mech == NULL)
  		return 0;
  
-@@ -1009,6 +1098,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
+@@ -1010,6 +1099,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
  	free(lang);
  	return r;
  }
@@ -3756,10 +3757,10 @@ index e63bb5ec6..e27139adf 100644
  
  static int
 diff --git a/sshd-session.c b/sshd-session.c
-index fe6ae7f32..ab88db7c5 100644
+index 4b79b9ba6..03a028c82 100644
 --- a/sshd-session.c
 +++ b/sshd-session.c
-@@ -656,8 +656,8 @@ notify_hostkeys(struct ssh *ssh)
+@@ -658,8 +658,8 @@ notify_hostkeys(struct ssh *ssh)
  	}
  	debug3_f("sent %u hostkeys", nkeys);
  	if (nkeys == 0)
@@ -3770,7 +3771,7 @@ index fe6ae7f32..ab88db7c5 100644
  		sshpkt_fatal(ssh, r, "%s: send", __func__);
  	sshbuf_free(buf);
  }
-@@ -1431,6 +1431,48 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -1445,6 +1445,48 @@ do_ssh2_kex(struct ssh *ssh)
  
  	free(hkalgs);
  
@@ -3819,7 +3820,7 @@ index fe6ae7f32..ab88db7c5 100644
  	/* start key exchange */
  	if ((r = kex_setup(ssh, myproposal)) != 0)
  		fatal_r(r, "kex_setup");
-@@ -1448,7 +1490,18 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -1462,7 +1504,18 @@ do_ssh2_kex(struct ssh *ssh)
   #ifdef OPENSSL_HAS_ECC
  	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
   #endif
@@ -3838,12 +3839,12 @@ index fe6ae7f32..ab88db7c5 100644
 +#endif /* WITH_OPENSSL */
  	kex->kex[KEX_C25519_SHA256] = kex_gen_server;
  	kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
- 	kex->load_host_public_key=&get_hostkey_public_by_type;
+  	kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server;
 diff --git a/sshd.c b/sshd.c
-index ed54fc6d6..54c65dfe6 100644
+index df76dc78c..48b334c68 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -1551,7 +1551,8 @@ main(int ac, char **av)
+@@ -1558,7 +1558,8 @@ main(int ac, char **av)
  		free(fp);
  	}
  	accumulate_host_timing_secret(cfg, NULL);
@@ -3867,7 +3868,7 @@ index 36894ace5..ecfe8d026 100644
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff --git a/sshd_config.5 b/sshd_config.5
-index 1ab0f41d9..5e41f0478 100644
+index dbed44f2a..6959d5f6c 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -739,6 +739,11 @@ Specifies whether to automatically destroy the user's credentials cache
@@ -3915,10 +3916,10 @@ index 1ab0f41d9..5e41f0478 100644
  Specifies the signature algorithms that will be accepted for hostbased
  authentication as a list of comma-separated patterns.
 diff --git a/sshkey.c b/sshkey.c
-index d4356e72c..c7abbe298 100644
+index 1db83788d..c3acd4e09 100644
 --- a/sshkey.c
 +++ b/sshkey.c
-@@ -130,6 +130,9 @@ extern const struct sshkey_impl sshkey_dsa_cert_impl;
+@@ -131,6 +131,9 @@ extern const struct sshkey_impl sshkey_dsa_cert_impl;
  extern const struct sshkey_impl sshkey_xmss_impl;
  extern const struct sshkey_impl sshkey_xmss_cert_impl;
  #endif
@@ -3928,7 +3929,7 @@ index d4356e72c..c7abbe298 100644
  
  const struct sshkey_impl * const keyimpls[] = {
  	&sshkey_ed25519_impl,
-@@ -169,6 +172,9 @@ const struct sshkey_impl * const keyimpls[] = {
+@@ -170,6 +173,9 @@ const struct sshkey_impl * const keyimpls[] = {
  	&sshkey_xmss_impl,
  	&sshkey_xmss_cert_impl,
  #endif
@@ -3938,7 +3939,7 @@ index d4356e72c..c7abbe298 100644
  	NULL
  };
  
-@@ -324,7 +330,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
+@@ -339,7 +345,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
  
  	for (i = 0; keyimpls[i] != NULL; i++) {
  		impl = keyimpls[i];
@@ -3948,10 +3949,10 @@ index d4356e72c..c7abbe298 100644
  		if (!include_sigonly && impl->sigonly)
  			continue;
 diff --git a/sshkey.h b/sshkey.h
-index 32933bbbd..dc5d3051b 100644
+index d0cdea0ce..cce4b93c0 100644
 --- a/sshkey.h
 +++ b/sshkey.h
-@@ -71,6 +71,7 @@ enum sshkey_types {
+@@ -73,6 +73,7 @@ enum sshkey_types {
  	KEY_ECDSA_SK_CERT,
  	KEY_ED25519_SK,
  	KEY_ED25519_SK_CERT,
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index a5f8c57..c38b7d7 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -1,4 +1,4 @@
-From 92c7e83658c40484aa7a0fa977a45de38461beef Mon Sep 17 00:00:00 2001
+From 1f9b181b1f2af9c29468f7a3ab2f51fb354e51ec Mon Sep 17 00:00:00 2001
 From: Richard Kettlewell <rjk@greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:52 +0000
 Subject: Various keepalive extensions
@@ -16,7 +16,7 @@ keepalives.
 Author: Ian Jackson <ian@chiark.greenend.org.uk>
 Author: Matthew Vernon <matthew@debian.org>
 Author: Colin Watson <cjwatson@debian.org>
-Last-Update: 2023-12-18
+Last-Update: 2024-09-13
 
 Patch-Name: keepalive-extensions.patch
 ---
@@ -26,7 +26,7 @@ Patch-Name: keepalive-extensions.patch
  3 files changed, 34 insertions(+), 4 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index cd1ebc85d..7d7296960 100644
+index 08342f2a2..f78786964 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -182,6 +182,7 @@ typedef enum {
@@ -46,16 +46,23 @@ index cd1ebc85d..7d7296960 100644
  
  	{ NULL, oBadOption }
  };
-@@ -1886,6 +1889,8 @@ parse_pubkey_algos:
+@@ -1166,6 +1169,7 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host,
+ 		argv_consume(&ac);
+ 		break;
+ 	case oConnectTimeout:
++	case oSetupTimeOut:	  /* Debian-specific compatibility alias */
+ 		intptr = &options->connection_timeout;
+ parse_time:
+ 		arg = argv_next(&ac, &av);
+@@ -1908,6 +1912,7 @@ parse_pubkey_algos:
  		goto parse_flag;
  
  	case oServerAliveInterval:
 +	case oProtocolKeepAlives: /* Debian-specific compatibility alias */
-+	case oSetupTimeOut:	  /* Debian-specific compatibility alias */
  		intptr = &options->server_alive_interval;
  		goto parse_time;
  
-@@ -2859,8 +2864,13 @@ fill_default_options(Options * options)
+@@ -2893,8 +2898,13 @@ fill_default_options(Options * options)
  		options->rekey_interval = 0;
  	if (options->verify_host_key_dns == -1)
  		options->verify_host_key_dns = 0;
@@ -72,7 +79,7 @@ index cd1ebc85d..7d7296960 100644
  		options->server_alive_count_max = 3;
  	if (options->control_master == -1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index 255577462..c6041339b 100644
+index 4a48c5775..31142f8c5 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -297,9 +297,13 @@ If set to
@@ -90,7 +97,16 @@ index 255577462..c6041339b 100644
  The argument must be
  .Cm yes
  or
-@@ -1927,7 +1931,14 @@ from the server,
+@@ -620,6 +624,8 @@ Specifies the timeout (in seconds) used when connecting to the
+ SSH server, instead of using the default system TCP timeout.
+ This timeout is applied both to establishing the connection and to performing
+ the initial SSH protocol handshake and key exchange.
++.Cm SetupTimeOut
++is a Debian-specific compatibility alias for this option.
+ .It Cm ControlMaster
+ Enables the sharing of multiple sessions over a single network connection.
+ When set to
+@@ -1933,7 +1939,12 @@ from the server,
  will send a message through the encrypted
  channel to request a response from the server.
  The default
@@ -100,13 +116,11 @@ index 255577462..c6041339b 100644
 +.Cm BatchMode
 +option is set (Debian-specific).
 +.Cm ProtocolKeepAlives
-+and
-+.Cm SetupTimeOut
-+are Debian-specific compatibility aliases for this option.
++is a Debian-specific compatibility alias for this option.
  .It Cm SessionType
  May be used to either request invocation of a subsystem on the remote system,
  or to prevent the execution of a remote command at all.
-@@ -2041,6 +2052,12 @@ Specifies whether the system should send TCP keepalive messages to the
+@@ -2047,6 +2058,12 @@ Specifies whether the system should send TCP keepalive messages to the
  other side.
  If they are sent, death of the connection or crash of one
  of the machines will be properly noticed.
@@ -120,10 +134,10 @@ index 255577462..c6041339b 100644
  connections will die if the route is down temporarily, and some people
  find it annoying.
 diff --git a/sshd_config.5 b/sshd_config.5
-index 5e41f0478..5dd656869 100644
+index 6959d5f6c..11a8e922f 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -1959,6 +1959,9 @@ This avoids infinitely hanging sessions.
+@@ -1984,6 +1984,9 @@ This avoids infinitely hanging sessions.
  .Pp
  To disable TCP keepalive messages, the value should be set to
  .Cm no .
diff --git a/debian/patches/maxhostnamelen.patch b/debian/patches/maxhostnamelen.patch
index af2bf16..b34d772 100644
--- a/debian/patches/maxhostnamelen.patch
+++ b/debian/patches/maxhostnamelen.patch
@@ -1,4 +1,4 @@
-From 5ffb02dd0478b1ceb24dd356d0ccad7cb7ec728b Mon Sep 17 00:00:00 2001
+From d4e17cdc03d060ca67e4f6628c90cc40c2eaa022 Mon Sep 17 00:00:00 2001
 From: Svante Signell <svante.signell@gmail.com>
 Date: Fri, 5 Nov 2021 23:22:53 +0000
 Subject: Define MAXHOSTNAMELEN on GNU/Hurd
@@ -12,7 +12,7 @@ Patch-Name: maxhostnamelen.patch
  1 file changed, 6 insertions(+)
 
 diff --git a/defines.h b/defines.h
-index 279e509aa..7225cbfab 100644
+index ed860e78b..aa3518732 100644
 --- a/defines.h
 +++ b/defines.h
 @@ -136,6 +136,12 @@ enum
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 393de6f..6df2e8f 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From 1c3c2c02b1d68675b121d87d1ffee84113659c93 Mon Sep 17 00:00:00 2001
+From 7001f10dfce73dfee2a9d56c63eca74bebdbebb1 Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index 3f2ca27..86550be 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From d03bde90030a339d7e4e39273cb3eadadfb99320 Mon Sep 17 00:00:00 2001
+From f1374ee189355c4ff510c5b817ecccb5306a1410 Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
@@ -23,7 +23,7 @@ Patch-Name: no-openssl-version-status.patch
  2 files changed, 6 insertions(+), 4 deletions(-)
 
 diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
-index 6c65003f2..30e97c464 100644
+index 14865077e..0cea08c03 100644
 --- a/openbsd-compat/openssl-compat.c
 +++ b/openbsd-compat/openssl-compat.c
 @@ -49,18 +49,18 @@ ssh_compatible_openssl(long headerver, long libver)
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index 8774599..f1fa958 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From 169d164b95c9f068cbf5fc9860029690f9bf19d3 Mon Sep 17 00:00:00 2001
+From 672018a74977e165fc82c47d64b8cbd420b95fb8 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
@@ -42,7 +42,7 @@ index 5086a6d42..6dffdc7e6 100644
  .Sh SEE ALSO
  .Xr ssh-keygen 1 ,
 diff --git a/ssh-keygen.1 b/ssh-keygen.1
-index df6803fd9..0617d0dc2 100644
+index 06f0555a4..76239bcdf 100644
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
 @@ -211,9 +211,7 @@ key in
@@ -86,7 +86,7 @@ index df6803fd9..0617d0dc2 100644
  The file format is described in
  .Xr moduli 5 .
 diff --git a/sshd.8 b/sshd.8
-index e2a621950..2469bfff8 100644
+index 464d402f6..bd1117bfe 100644
 --- a/sshd.8
 +++ b/sshd.8
 @@ -64,7 +64,7 @@ over an insecure network.
@@ -98,7 +98,7 @@ index e2a621950..2469bfff8 100644
  It forks a new
  daemon for each incoming connection.
  The forked daemons handle
-@@ -932,7 +932,7 @@ This file is for host-based authentication (see
+@@ -936,7 +936,7 @@ This file is for host-based authentication (see
  .Xr ssh 1 ) .
  It should only be writable by root.
  .Pp
@@ -107,7 +107,7 @@ index e2a621950..2469bfff8 100644
  Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange"
  key exchange method.
  The file format is described in
-@@ -1030,7 +1030,6 @@ The content of this file is not sensitive; it can be world-readable.
+@@ -1034,7 +1034,6 @@ The content of this file is not sensitive; it can be world-readable.
  .Xr ssh-keyscan 1 ,
  .Xr chroot 2 ,
  .Xr hosts_access 5 ,
@@ -116,7 +116,7 @@ index e2a621950..2469bfff8 100644
  .Xr sshd_config 5 ,
  .Xr inetd 8 ,
 diff --git a/sshd_config.5 b/sshd_config.5
-index 81671fb99..9d33cb472 100644
+index ed2f74060..e177e4af8 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -1001,9 +1001,6 @@ for interactive sessions and
@@ -129,7 +129,7 @@ index 81671fb99..9d33cb472 100644
  The default is
  .Cm yes .
  The argument to this keyword must be
-@@ -1112,45 +1109,33 @@ The following forms may be used:
+@@ -1117,45 +1114,33 @@ The following forms may be used:
  .Sm off
  .Ar hostname | address
  .Sm on
@@ -176,7 +176,7 @@ index 81671fb99..9d33cb472 100644
  .It Cm LoginGraceTime
  The server disconnects after this time if the user has not
  successfully logged in.
-@@ -1276,14 +1261,8 @@ The available criteria are
+@@ -1283,14 +1268,8 @@ The available criteria are
  .Cm Host ,
  .Cm LocalAddress ,
  .Cm LocalPort ,
@@ -192,15 +192,15 @@ index 81671fb99..9d33cb472 100644
  .Pp
  The match patterns may consist of single entries or comma-separated
  lists and may use the wildcard and negation operators described in the
-@@ -1356,7 +1335,6 @@ Available keywords are
- .Cm PubkeyAuthOptions ,
+@@ -1364,7 +1343,6 @@ Available keywords are
+ .Cm RefuseConnection ,
  .Cm RekeyLimit ,
  .Cm RevokedKeys ,
 -.Cm RDomain ,
  .Cm SetEnv ,
  .Cm StreamLocalBindMask ,
  .Cm StreamLocalBindUnlink ,
-@@ -1838,15 +1816,6 @@ an OpenSSH Key Revocation List (KRL) as generated by
+@@ -1863,15 +1841,6 @@ an OpenSSH Key Revocation List (KRL) as generated by
  .Xr ssh-keygen 1 .
  For more information on KRLs, see the KEY REVOCATION LISTS section in
  .Xr ssh-keygen 1 .
@@ -216,7 +216,7 @@ index 81671fb99..9d33cb472 100644
  .It Cm SecurityKeyProvider
  Specifies a path to a library that will be used when loading
  FIDO authenticator-hosted keys, overriding the default of using
-@@ -2180,8 +2149,6 @@ A literal
+@@ -2205,8 +2174,6 @@ A literal
  Identifies the connection endpoints, containing
  four space-separated values: client address, client port number,
  server address, and server port number.
@@ -225,7 +225,7 @@ index 81671fb99..9d33cb472 100644
  .It %F
  The fingerprint of the CA key.
  .It %f
-@@ -2220,9 +2187,6 @@ accepts the tokens %%, %h, %U, and %u.
+@@ -2245,9 +2212,6 @@ accepts the tokens %%, %h, %U, and %u.
  .Pp
  .Cm ChrootDirectory
  accepts the tokens %%, %h, %U, and %u.
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 0caca0d..d3d4810 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From 184037a22103428f83d1e8d14c09631aef14dc2f Mon Sep 17 00:00:00 2001
+From 756ba4bb63a1d4a7547ae0a2ba1fdc135b8c829f Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
@@ -18,10 +18,10 @@ Patch-Name: package-versioning.patch
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/kex.c b/kex.c
-index fd018021e..744fb27fb 100644
+index f09e79e6b..19b1fcaa8 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -1257,7 +1257,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+@@ -1255,7 +1255,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
  	if (version_addendum != NULL && *version_addendum == '\0')
  		version_addendum = NULL;
  	if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%s%s%s\r\n",
@@ -31,11 +31,11 @@ index fd018021e..744fb27fb 100644
  	    version_addendum == NULL ? "" : version_addendum)) != 0) {
  		oerrno = errno;
 diff --git a/version.h b/version.h
-index 81b7645a7..3b43b47e5 100644
+index 8c7e37e7d..7e0cac99f 100644
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION	"OpenSSH_9.8"
+ #define SSH_VERSION	"OpenSSH_9.9"
  
  #define SSH_PORTABLE	"p1"
 -#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
diff --git a/debian/patches/pam-avoid-unknown-host.patch b/debian/patches/pam-avoid-unknown-host.patch
index 8c8d78a..234cb1d 100644
--- a/debian/patches/pam-avoid-unknown-host.patch
+++ b/debian/patches/pam-avoid-unknown-host.patch
@@ -1,4 +1,4 @@
-From 97c671bccd4f923e2bb814516ad7bf1d9261709c Mon Sep 17 00:00:00 2001
+From 2d1ea9f5f1100fa7c7e648ea976ceda005d5966c Mon Sep 17 00:00:00 2001
 From: Daan De Meyer <daan.j.demeyer@gmail.com>
 Date: Mon, 20 Mar 2023 20:22:14 +0100
 Subject: Only set PAM_RHOST if the remote host is not "UNKNOWN"
diff --git a/debian/patches/regress-conch-dev-zero.patch b/debian/patches/regress-conch-dev-zero.patch
index 95f7aab..51f4557 100644
--- a/debian/patches/regress-conch-dev-zero.patch
+++ b/debian/patches/regress-conch-dev-zero.patch
@@ -1,4 +1,4 @@
-From e3d47eadb58dda63a125eecaa722ce7891c75356 Mon Sep 17 00:00:00 2001
+From e307b199fed9b07cfaf92ab3d653fab49108c0e0 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 31 Mar 2024 00:24:11 +0000
 Subject: regress: Redirect conch stdin from /dev/zero
diff --git a/debian/patches/restore-authorized_keys2.patch b/debian/patches/restore-authorized_keys2.patch
index b061307..b68b44b 100644
--- a/debian/patches/restore-authorized_keys2.patch
+++ b/debian/patches/restore-authorized_keys2.patch
@@ -1,4 +1,4 @@
-From 69f63b1e4919e4a51cb199fa81fa318bc517bbd2 Mon Sep 17 00:00:00 2001
+From 5bba205e4762e28f6b127f64fd30870aedae3fd1 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 5 Mar 2017 02:02:11 +0000
 Subject: Restore reading authorized_keys2 by default
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch
index fdd3c61..b4a8543 100644
--- a/debian/patches/restore-tcp-wrappers.patch
+++ b/debian/patches/restore-tcp-wrappers.patch
@@ -1,4 +1,4 @@
-From 0ff8d4f5356adbdebdbdbf951713d22b1e8e264e Mon Sep 17 00:00:00 2001
+From 20df52e18eb28e8e50e475d85bb652e8fdc5f588 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 7 Oct 2014 13:22:41 +0100
 Subject: Restore TCP wrappers support
@@ -28,10 +28,10 @@ Patch-Name: restore-tcp-wrappers.patch
  3 files changed, 89 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index dc274329f..f6bca2631 100644
+index 6a0140a9d..90548dcfc 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1686,6 +1686,62 @@ else
+@@ -1693,6 +1693,62 @@ else
  	AC_MSG_RESULT([no])
  fi
  
@@ -94,7 +94,7 @@ index dc274329f..f6bca2631 100644
  # Check whether user wants to use ldns
  LDNS_MSG="no"
  AC_ARG_WITH(ldns,
-@@ -5723,6 +5779,7 @@ echo "                       PAM support: $PAM_MSG"
+@@ -5734,6 +5790,7 @@ echo "                       PAM support: $PAM_MSG"
  echo "                   OSF SIA support: $SIA_MSG"
  echo "                 KerberosV support: $KRB5_MSG"
  echo "                   SELinux support: $SELINUX_MSG"
@@ -103,7 +103,7 @@ index dc274329f..f6bca2631 100644
  echo "                   libldns support: $LDNS_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
 diff --git a/sshd-session.c b/sshd-session.c
-index ab88db7c5..dff1fefbe 100644
+index 03a028c82..f36d58b1b 100644
 --- a/sshd-session.c
 +++ b/sshd-session.c
 @@ -110,6 +110,13 @@
@@ -120,7 +120,7 @@ index ab88db7c5..dff1fefbe 100644
  /* Re-exec fds */
  #define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1)
  #define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2)
-@@ -1254,6 +1261,24 @@ main(int ac, char **av)
+@@ -1256,6 +1263,24 @@ main(int ac, char **av)
  #ifdef SSH_AUDIT_EVENTS
  	audit_connection_from(remote_ip, remote_port);
  #endif
@@ -146,10 +146,10 @@ index ab88db7c5..dff1fefbe 100644
  	rdomain = ssh_packet_rdomain_in(ssh);
  
 diff --git a/sshd.8 b/sshd.8
-index c0f095ca4..e2a621950 100644
+index 08ebf53a1..464d402f6 100644
 --- a/sshd.8
 +++ b/sshd.8
-@@ -921,6 +921,12 @@ the user's home directory becomes accessible.
+@@ -925,6 +925,12 @@ the user's home directory becomes accessible.
  This file should be writable only by the user, and need not be
  readable by anyone else.
  .Pp
@@ -162,7 +162,7 @@ index c0f095ca4..e2a621950 100644
  .It Pa /etc/hosts.equiv
  This file is for host-based authentication (see
  .Xr ssh 1 ) .
-@@ -1023,6 +1029,7 @@ The content of this file is not sensitive; it can be world-readable.
+@@ -1027,6 +1033,7 @@ The content of this file is not sensitive; it can be world-readable.
  .Xr ssh-keygen 1 ,
  .Xr ssh-keyscan 1 ,
  .Xr chroot 2 ,
diff --git a/debian/patches/revert-ipqos-defaults.patch b/debian/patches/revert-ipqos-defaults.patch
index 2758571..0ad35c6 100644
--- a/debian/patches/revert-ipqos-defaults.patch
+++ b/debian/patches/revert-ipqos-defaults.patch
@@ -1,4 +1,4 @@
-From 91663a43be78a3b33c0cc055033d648269a4f98c Mon Sep 17 00:00:00 2001
+From 5fefa8a7853e96cb7a143432690212f4d1fbfc1a Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Mon, 8 Apr 2019 10:46:29 +0100
 Subject: Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP
@@ -24,10 +24,10 @@ Patch-Name: revert-ipqos-defaults.patch
  4 files changed, 8 insertions(+), 12 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 1b64b7af5..a60aed047 100644
+index 90bf74f32..a321e6d8f 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -2891,9 +2891,9 @@ fill_default_options(Options * options)
+@@ -2925,9 +2925,9 @@ fill_default_options(Options * options)
  	if (options->visual_host_key == -1)
  		options->visual_host_key = 0;
  	if (options->ip_qos_interactive == -1)
@@ -40,10 +40,10 @@ index 1b64b7af5..a60aed047 100644
  		options->request_tty = REQUEST_TTY_AUTO;
  	if (options->session_type == -1)
 diff --git a/servconf.c b/servconf.c
-index 81511bc86..86c798b34 100644
+index 49a066df8..3c7ca3287 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -479,9 +479,9 @@ fill_default_server_options(ServerOptions *options)
+@@ -483,9 +483,9 @@ fill_default_server_options(ServerOptions *options)
  	if (options->permit_tun == -1)
  		options->permit_tun = SSH_TUNMODE_NO;
  	if (options->ip_qos_interactive == -1)
@@ -56,10 +56,10 @@ index 81511bc86..86c798b34 100644
  		options->version_addendum = xstrdup("");
  	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index 091b933b4..98a2ef60b 100644
+index 9adc0fdb7..14042dce5 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1322,11 +1322,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+@@ -1329,11 +1329,9 @@ If one argument is specified, it is used as the packet class unconditionally.
  If two values are specified, the first is automatically selected for
  interactive sessions and the second for non-interactive sessions.
  The default is
@@ -74,7 +74,7 @@ index 091b933b4..98a2ef60b 100644
  .It Cm KbdInteractiveAuthentication
  Specifies whether to use keyboard-interactive authentication.
 diff --git a/sshd_config.5 b/sshd_config.5
-index 1f6c42523..1edd6c812 100644
+index 2887ed531..70d57bfdb 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -1022,11 +1022,9 @@ If one argument is specified, it is used as the packet class unconditionally.
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index 2c64f53..ce8ce8d 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From 75bbbbd155147a06ebf5bcc1b2ae9bf08c127cf0 Mon Sep 17 00:00:00 2001
+From 9435f6fe82fc57fac0e6efb9c76923eeee80fe22 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index c481c3b..c28562a 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -1,4 +1,4 @@
-From 1003c8e9926862f7f01fad4a9004766aa47948d1 Mon Sep 17 00:00:00 2001
+From 7b503b507e60ba714732f10ea46a00fd0896baa9 Mon Sep 17 00:00:00 2001
 From: Manoj Srivastava <srivasta@debian.org>
 Date: Sun, 9 Feb 2014 16:09:49 +0000
 Subject: Handle SELinux authorisation roles
@@ -80,10 +80,10 @@ index f75f1d20d..44558851e 100644
  		if ((r = kex_server_update_ext_info(ssh)) != 0)
  			fatal_fr(r, "kex_server_update_ext_info failed");
 diff --git a/monitor.c b/monitor.c
-index 92e2ca107..62cc2da6b 100644
+index ad7fef5a9..05d63a8ee 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -117,6 +117,7 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *);
+@@ -118,6 +118,7 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *);
  int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *);
  int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *);
  int mm_answer_authserv(struct ssh *, int, struct sshbuf *);
@@ -91,7 +91,7 @@ index 92e2ca107..62cc2da6b 100644
  int mm_answer_authpassword(struct ssh *, int, struct sshbuf *);
  int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *);
  int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *);
-@@ -191,6 +192,7 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -192,6 +193,7 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -99,7 +99,7 @@ index 92e2ca107..62cc2da6b 100644
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -832,6 +834,7 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -842,6 +844,7 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
  
  	/* Allow service/style information on the auth context */
  	monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -107,7 +107,7 @@ index 92e2ca107..62cc2da6b 100644
  	monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
  
  #ifdef USE_PAM
-@@ -865,15 +868,42 @@ mm_answer_authserv(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -875,15 +878,42 @@ mm_answer_authserv(struct ssh *ssh, int sock, struct sshbuf *m)
  	monitor_permit_authentications(1);
  
  	if ((r = sshbuf_get_cstring(m, &authctxt->service, NULL)) != 0 ||
@@ -152,7 +152,7 @@ index 92e2ca107..62cc2da6b 100644
  	return (0);
  }
  
-@@ -1594,7 +1624,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1604,7 +1634,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
  	res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
  	if (res == 0)
  		goto error;
@@ -243,7 +243,7 @@ index 09b0ccaaa..2493da591 100644
  char *mm_auth2_read_banner(void);
  int mm_auth_password(struct ssh *, char *);
 diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index 4c024c6d2..4fe61f020 100644
+index 8adfec5a7..61e239561 100644
 --- a/openbsd-compat/port-linux.c
 +++ b/openbsd-compat/port-linux.c
 @@ -65,7 +65,7 @@ ssh_selinux_enabled(void)
@@ -414,10 +414,10 @@ index 344a1ddf9..20ea822a7 100644
  const char	*session_get_remote_name_or_ip(struct ssh *, u_int, int);
  
 diff --git a/sshd-session.c b/sshd-session.c
-index dff1fefbe..b6e544108 100644
+index f36d58b1b..1d7cdd00a 100644
 --- a/sshd-session.c
 +++ b/sshd-session.c
-@@ -438,7 +438,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
+@@ -440,7 +440,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
  
  	/* Drop privileges */
  	if (!skip_privdrop)
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 0fb8602..9819925 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From 693e1ad72a8bc084f804451beaad6f941921b435 Mon Sep 17 00:00:00 2001
+From 4d7555c76af470ce9c85600497629e3ffe8c6448 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
diff --git a/debian/patches/skip-utimensat-test-on-zfs.patch b/debian/patches/skip-utimensat-test-on-zfs.patch
index 5a9a489..055b12b 100644
--- a/debian/patches/skip-utimensat-test-on-zfs.patch
+++ b/debian/patches/skip-utimensat-test-on-zfs.patch
@@ -1,4 +1,4 @@
-From 1cf8791cab882050d43f539da1464eb308eca92e Mon Sep 17 00:00:00 2001
+From dadf16cb45c44f62f1c6c66bc537f6bda066292c Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Mon, 11 Mar 2024 16:24:49 +0000
 Subject: Skip utimensat test on ZFS
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index 4c5641e..da82776 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 2e73396b1e30fed205ad9daf4575f26e24b6cf63 Mon Sep 17 00:00:00 2001
+From 0c398b704de5f588e6c41cf21d2d1f2cbfda5f11 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 7b45493..a108a70 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From b53a7a6dc0eb0375ef367780fd66c86e182bc67c Mon Sep 17 00:00:00 2001
+From aba90adf0199191cca06cea519233ef9cf67df75 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
@@ -18,10 +18,10 @@ Patch-Name: ssh-argv0.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/ssh.1 b/ssh.1
-index 55bc1faef..c8c5558e5 100644
+index d80ce6bfc..3ad246c27 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1666,6 +1666,7 @@ if an error occurred.
+@@ -1668,6 +1668,7 @@ if an error occurred.
  .Xr sftp 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index b63fe3c..329841e 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -1,4 +1,4 @@
-From 127ffecd39fa5f1b61506e6060c4a4cdec64f019 Mon Sep 17 00:00:00 2001
+From 439f5f7701cfc92af75c471df81e269dce8ab321 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:50 +0000
 Subject: Accept obsolete ssh-vulnkey configuration options
@@ -17,7 +17,7 @@ Patch-Name: ssh-vulnkey-compat.patch
  2 files changed, 2 insertions(+)
 
 diff --git a/readconf.c b/readconf.c
-index 8bdeb9d08..cd1ebc85d 100644
+index 0ce392538..08342f2a2 100644
 --- a/readconf.c
 +++ b/readconf.c
 @@ -197,6 +197,7 @@ static struct {
@@ -29,10 +29,10 @@ index 8bdeb9d08..cd1ebc85d 100644
  	{ "useroaming", oDeprecated },
  	{ "usersh", oDeprecated },
 diff --git a/servconf.c b/servconf.c
-index c1bfca258..169b9ff07 100644
+index 731f208be..1d5c143ba 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -692,6 +692,7 @@ static struct {
+@@ -698,6 +698,7 @@ static struct {
  	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
  	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
  	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index e32e7fd..bd386c5 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -1,4 +1,4 @@
-From 297eb3e9ae97bdd2e944efd9fdbdcf7f78514b79 Mon Sep 17 00:00:00 2001
+From 55ee34a4dce90532d19dddc56cb77d11703f0288 Mon Sep 17 00:00:00 2001
 From: Natalie Amery <nmamery@chiark.greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:54 +0000
 Subject: "LogLevel SILENT" compatibility
diff --git a/debian/patches/systemd-socket-activation.patch b/debian/patches/systemd-socket-activation.patch
index 7a9c0ca..9a8fd42 100644
--- a/debian/patches/systemd-socket-activation.patch
+++ b/debian/patches/systemd-socket-activation.patch
@@ -1,4 +1,4 @@
-From 05c8e02a8f6df17722a95fc11cf315865f90e024 Mon Sep 17 00:00:00 2001
+From 8616cd415d778b058f6c27064e52364e90fc6418 Mon Sep 17 00:00:00 2001
 From: Steve Langasek <steve.langasek@ubuntu.com>
 Date: Thu, 1 Sep 2022 16:03:37 +0100
 Subject: Support systemd socket activation
@@ -19,7 +19,7 @@ Patch-Name: systemd-socket-activation.patch
  2 files changed, 119 insertions(+), 15 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index f6bca2631..ee6aca972 100644
+index 90548dcfc..8b3a9776b 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -940,6 +940,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@@ -31,7 +31,7 @@ index f6bca2631..ee6aca972 100644
  	case `uname -r` in
  	1.*|2.0.*)
 diff --git a/sshd.c b/sshd.c
-index 54c65dfe6..51d5357b9 100644
+index 48b334c68..142310c07 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -93,10 +93,18 @@
@@ -57,7 +57,7 @@ index 54c65dfe6..51d5357b9 100644
  
  extern char *__progname;
  
-@@ -733,6 +741,88 @@ send_rexec_state(int fd, struct sshbuf *conf)
+@@ -740,6 +748,88 @@ send_rexec_state(int fd, struct sshbuf *conf)
  	debug3_f("done");
  }
  
@@ -146,7 +146,7 @@ index 54c65dfe6..51d5357b9 100644
  /*
   * Listen for TCP connections
   */
-@@ -812,6 +902,9 @@ static void
+@@ -819,6 +909,9 @@ static void
  server_listen(void)
  {
  	u_int i;
@@ -156,7 +156,7 @@ index 54c65dfe6..51d5357b9 100644
  
  	/* Initialise per-source limit tracking. */
  	srclimit_init(options.max_startups,
-@@ -821,17 +914,27 @@ server_listen(void)
+@@ -828,17 +921,27 @@ server_listen(void)
  	    &options.per_source_penalty,
  	    options.per_source_penalty_exempt);
  
@@ -194,8 +194,8 @@ index 54c65dfe6..51d5357b9 100644
  	if (!num_listen_socks)
  		fatal("Cannot bind any address.");
  }
-@@ -1344,7 +1447,7 @@ main(int ac, char **av)
- 	if (!test_flag && !do_dump_cfg && !path_absolute(av[0]))
+@@ -1351,7 +1454,7 @@ main(int ac, char **av)
+ 	if (!test_flag && !inetd_flag && !do_dump_cfg && !path_absolute(av[0]))
  		fatal("sshd requires execution with an absolute path");
  
 -	closefrom(STDERR_FILENO + 1);
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index b649927..8b53864 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From c02212390140a127d47873d8d27081466bd5daeb Mon Sep 17 00:00:00 2001
+From 2bf33ed3e0d641de721a055f7ea6af01be212cff Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability
@@ -51,7 +51,7 @@ index d5d2c7a12..13c3c201b 100644
  			    "bad modes for %.200s", pw->pw_name, path);
  			auth_debug_add("Bad file modes for %.200s", path);
 diff --git a/auth.c b/auth.c
-index 407b32e78..ec692715e 100644
+index e4578169b..4b878865f 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -430,8 +430,7 @@ check_key_in_hostfiles(struct passwd *pw, struct sshkey *key, const char *host,
@@ -169,10 +169,10 @@ index 113403896..4681f79f7 100644
  #define MAXIMUM(a, b)	(((a) > (b)) ? (a) : (b))
  #define ROUNDUP(x, y)   ((((x)+((y)-1))/(y))*(y))
 diff --git a/readconf.c b/readconf.c
-index 7d7296960..eaca29ace 100644
+index f78786964..d3c3056ef 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -2518,8 +2518,7 @@ read_config_file_depth(const char *filename, struct passwd *pw,
+@@ -2552,8 +2552,7 @@ read_config_file_depth(const char *filename, struct passwd *pw,
  
  		if (fstat(fileno(f), &sb) == -1)
  			fatal("fstat %s: %s", filename, strerror(errno));
@@ -183,10 +183,10 @@ index 7d7296960..eaca29ace 100644
  	}
  
 diff --git a/ssh.1 b/ssh.1
-index dc382cd49..55bc1faef 100644
+index 8f78b3a1e..d80ce6bfc 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1570,6 +1570,8 @@ The file format and configuration options are described in
+@@ -1572,6 +1572,8 @@ The file format and configuration options are described in
  .Xr ssh_config 5 .
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not writable by others.
@@ -196,10 +196,10 @@ index dc382cd49..55bc1faef 100644
  .It Pa ~/.ssh/environment
  Contains additional definitions for environment variables; see
 diff --git a/ssh_config.5 b/ssh_config.5
-index c6041339b..d1b1da95a 100644
+index 31142f8c5..073ef69e2 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -2409,6 +2409,8 @@ The format of this file is described above.
+@@ -2417,6 +2417,8 @@ The format of this file is described above.
  This file is used by the SSH client.
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not writable by others.