Add openssh 10.2p1 patch

[julek-wolfssl]

No description provided.

[Copilot]

Pull request overview

Adds a vendor patch for integrating wolfSSL support into OpenSSH 10.2p1.

Changes:

• Introduces openssh-10.2p1.patch implementing wolfSSL build/configure integration and compatibility shims.
• Updates OpenSSH build system logic (autoconf/Makefile) to optionally build against wolfSSL and adjust test environment.
• Adds wolfSSL initialization, logging, and RNG seeding integration points in OpenSSH sources (via patch).

Comments suppressed due to low confidence (9)

openssh-patches/openssh-10.2p1.patch:1

• test ... == ... is not POSIX-sh and can break on some /bin/sh implementations used by configure. Use = instead of == in all test expressions here (and below), and consider restructuring the FIPS >= 5.2 probe so that “compile success => yes” (instead of relying on an intentional compile failure) to avoid fragile logic.

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• With wolfSSL enabled, WITH_OPENSSL is also defined in the patch, which will pull in <openssl/opensslv.h>. That header typically won’t exist in a wolfSSL-only environment (wolfSSL’s compat header is usually <wolfssl/openssl/opensslv.h>), so this is likely to break compilation. Recommendation: guard the OpenSSL header include with !defined(USING_WOLFSSL) or include the wolfSSL compat equivalent when USING_WOLFSSL is set.

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• Including <openssl/ssl.h> under WITH_OPENSSL will likely fail for wolfSSL builds (which generally provide <wolfssl/openssl/ssl.h> instead). Since the patch defines WITH_OPENSSL even when using wolfSSL, this include path should be switched to the wolfSSL compat header when USING_WOLFSSL is defined, or otherwise adjusted to match the include strategy used in includes.h.

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• wolfSSL_SetLoggingCb() can cause wolfSSL to emit log messages during/after initialization; routing all of them unconditionally through debug() can create very noisy logs and potential sensitive-information exposure depending on wolfSSL log content. Consider enabling the callback only when OpenSSH debug logging is explicitly enabled (or mapping wolfSSL log levels to OpenSSH LogLevel and filtering accordingly).

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• wolfSSL_Debugging_ON() is enabled unconditionally for all OpenSSH programs in log_init(), which can significantly increase log volume and overhead in production (and may leak details). Recommendation: do not force-enable wolfSSL debugging in core initialization; instead gate it behind an OpenSSH debug flag/config or compile-time option.

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• If getrandom() returns 0, this loop becomes infinite because sz is never reduced. Also, getrandom takes a size_t and returns ssize_t; casting to int can truncate/overflow for larger reads. Fix by using ssize_t len, handling len == 0 as an error/termination case, and passing a bounded size_t chunk size (some platforms cap getrandom per call).

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• AC_TRY_LINK_FUNC is obsolete and commonly triggers warnings with newer autoconf; using AC_CHECK_FUNC/AC_LINK_IFELSE (or AC_SEARCH_LIBS for wolfSSL_Init) is the recommended/maintained approach. Updating this check will improve long-term portability of the configure logic.

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• The warning text mentions “renderer processes”, which appears unrelated to OpenSSH and is confusing in OpenSSH’s configure output. Recommend adjusting the message to refer specifically to OpenSSH/sshd sandboxing (and keep terminology consistent with the rest of the project).

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

openssh-patches/openssh-10.2p1.patch:1

• The new return block uses spaces for indentation and no braces, which is inconsistent with the surrounding OpenSSH style (tabs + aligned indentation). Consider formatting this to match the local convention to keep diffs minimal and readability consistent.

From 362721ed1982880420aa5d5905249ef55641c3e4 Mon Sep 17 00:00:00 2001

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.