Merge ~sergiodj/ubuntu/+source/openssh:lp1966591-ssh-keygen-permission-bionic into ubuntu/+source/openssh:ubuntu/devel

[Sergio Durigan Junior]

This MP fixes bug #1966591 on Bionic.

From the SRU template:

When using "ssh-keygen -R" to remove a host from "known_hosts" the command changes permissions on the file. This can cause problems particularly when used on the global "known_hosts" file (/etc/ssh/ssh_known_hosts), because then only root can read it. Programs running non-interactively as non-root users suddenly fail to SSH and it's not immediately obvious why.

This bug has been fixed upstream (https://github.com/openssh/openssh-portable/commit/f2d84f1b3fa68d77c99238d4c645d0266fae2a74) and only impacts openssh on Bionic and Focal. The patch is simple and well contained.

The idea is to do a single SRU upload with this MP plus Athos' changes to fix bug #1903516.

There is a PPA with the proposed change here:

https://launchpad.net/~sergiodj/+archive/ubuntu/openssh-bugfix/+packages

autopkgtest is still running, but I don't expect any problems. I'll post the results when they're done.

Unmerged commits

80f1bdb... by Sergio Durigan Junior on 2022-03-30

changelog for 1:7.6p1-4ubuntu0.7

828e903... by Sergio Durigan Junior on 2022-03-30

  * d/p/0001-upstream-preserve-group-world-read-permission-on-kno.patch:
    Preserve group/world read permissions on known_hosts. (LP: #1966591)

5488a2a... by Christian Ehrhardt  on 2020-03-03

1:7.6p1-4ubuntu0.6 (patches unapplied)

Imported using git-ubuntu import.

f271687... by Marc Deslauriers on 2021-08-11

1:7.6p1-4ubuntu0.5 (patches unapplied)

Imported using git-ubuntu import.

18afe7e... by Dimitri John Ledkov on 2020-01-10

1:7.6p1-4ubuntu0.4 (patches unapplied)

Imported using git-ubuntu import.

4ac6e76... by Marc Deslauriers on 2019-03-04

1:7.6p1-4ubuntu0.3 (patches unapplied)

Imported using git-ubuntu import.

844c653... by Marc Deslauriers on 2019-01-31

1:7.6p1-4ubuntu0.2 (patches unapplied)

Imported using git-ubuntu import.

95749f1... by Leonidas S. Barbosa on 2018-11-05

1:7.6p1-4ubuntu0.1 (patches unapplied)

Imported using git-ubuntu import.

diff --git a/debian/changelog b/debian/changelog
index 9d6fadc..22a71c9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,4 @@
+<<<<<<< debian/changelog
 openssh (1:8.9p1-3) unstable; urgency=medium
 
   * Allow ppoll_time64 in seccomp filter (closes: #1006445).
@@ -1532,6 +1533,80 @@ openssh (1:7.6p1-5) unstable; urgency=medium
     #894558).
 
  -- Colin Watson <[e-mail]>  Sun, 01 Apr 2018 21:37:19 +0100
+=======
+openssh (1:7.6p1-4ubuntu0.7) bionic; urgency=medium
+
+  * d/p/0001-upstream-preserve-group-world-read-permission-on-kno.patch:
+    Preserve group/world read permissions on known_hosts. (LP: #1966591)
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 30 Mar 2022 19:04:23 -0400
+
+openssh (1:7.6p1-4ubuntu0.6) bionic; urgency=medium
+
+  * fix clients advertising version 1.99 (LP: #1863930)
+    - d/p/lp-1863930-Fix-logic-bug-in-sshd_exchange_identification.patch
+    - d/p/lp-1863930-unbreak-clients-that-advertise-protocol.patch
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 03 Mar 2020 07:47:02 +0100
+
+openssh (1:7.6p1-4ubuntu0.5) bionic-security; urgency=medium
+
+  * SECURITY REGRESSION: User enumeration issue (LP: #1934501)
+    - debian/patches/CVE-2018-15473.patch: updated to fix bad patch
+      backport.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 11 Aug 2021 14:02:09 -0400
+
+openssh (1:7.6p1-4ubuntu0.4) bionic; urgency=medium
+
+  * Apply upstream patch to stop using 2020 as a future date in regress
+    tests. LP: #1859013
+
+ -- Dimitri John Ledkov <[e-mail]>  Fri, 10 Jan 2020 00:00:50 +0000
+
+openssh (1:7.6p1-4ubuntu0.3) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: Incomplete fix for CVE-2019-6111
+    - debian/patches/CVE-2019-6111-2.patch: add another fix to the filename
+      check in scp.c.
+    - CVE-2019-6111
+  * Fixed inverted CVE numbers in patch filenames and in previous
+    changelog.
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 04 Mar 2019 07:17:51 -0500
+
+openssh (1:7.6p1-4ubuntu0.2) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: access restrictions bypass in scp
+    - debian/patches/CVE-2018-20685.patch: disallow empty filenames
+      or ones that refer to the current directory in scp.c.
+    - CVE-2018-20685
+  * SECURITY UPDATE: scp client spoofing via object name
+    - debian/patches/CVE-2019-6111.patch: make sure the filenames match
+      the wildcard specified by the user, and add new flag to relax the new
+      restrictions in scp.c, scp.1.
+    - CVE-2019-6111
+  * SECURITY UPDATE: scp client missing received object name validation
+    - debian/patches/CVE-2019-6109-1.patch: sanitize scp filenames via
+      snmprintf in atomicio.c, progressmeter.c, progressmeter.h,
+      scp.c, sftp-client.c.
+    - debian/patches/CVE-2019-6109-2.patch: force progressmeter updates in
+      progressmeter.c, progressmeter.h, scp.c, sftp-client.c.
+    - CVE-2019-6109
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 31 Jan 2019 08:58:34 -0500
+
+openssh (1:7.6p1-4ubuntu0.1) bionic-security; urgency=medium
+
+  [ Ryan Finnie ]
+  * SECURITY UPDATE: OpenSSH User Enumeration Vulnerability (LP: #1794629)
+    - debian/patches/CVE-2018-15473.patch: delay bailout for invalid
+      authenticating user until after the packet containing the request
+      has been fully parsed.
+    - CVE-2018-15473
+
+ -- Leonidas S. Barbosa <[e-mail]>  Mon, 05 Nov 2018 08:51:29 -0300
+>>>>>>> debian/changelog
 
 openssh (1:7.6p1-4) unstable; urgency=medium
 
diff --git a/debian/control b/debian/control
index f9dc5f7..98035fb 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,17 @@
 Source: openssh
 Section: net
 Priority: standard
+<<<<<<< debian/control
 Maintainer: Debian OpenSSH Maintainers <[e-mail]>
 Build-Depends: debhelper (>= 13.1~),
                debhelper-compat (= 13),
+=======
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian OpenSSH Maintainers <[e-mail]>
+Build-Depends: autotools-dev,
+               debhelper (>= 9.20160709~),
+               dh-autoreconf,
+>>>>>>> debian/control
                dh-exec,
                dh-runit (>= 2.8.8),
                dpkg-dev (>= 1.16.1~),
diff --git a/debian/patches/0001-upstream-preserve-group-world-read-permission-on-kno.patch b/debian/patches/0001-upstream-preserve-group-world-read-permission-on-kno.patch
 new file mode 100644
index 0000000..433ebfb
--- /dev/null
+++ b/debian/patches/0001-upstream-preserve-group-world-read-permission-on-kno.patch
@@ -0,0 +1,46 @@
+From: "[e-mail]" <[e-mail]>
+Date: Wed, 13 May 2020 09:55:57 +0000
+Subject: upstream: preserve group/world read permission on known_hosts
+
+file across runs of "ssh-keygen -Rf /path". The old behaviour was to remove
+all rights for group/other. bz#3146 ok dtucker@
+
+OpenBSD-Commit-ID: dc369d0e0b5dd826430c63fd5f4b269953448a8a
+
+Origin: backport, https://github.com/openssh/openssh-portable/commit/f2d84f1b3fa68d77c99238d4c645d0266fae2a74
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3146
+Bug-Ubuntu: https://bugs.launchpad.net/openssh/+bug/1966591
+Applied-Upstream: 8.4
+---
+ ssh-keygen.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/ssh-keygen.c b/ssh-keygen.c
+index 835f7d0..bfc5233 100644
+--- a/ssh-keygen.c
++++ b/ssh-keygen.c
+@@ -1235,6 +1235,7 @@ do_known_hosts(struct passwd *pw, const char *name)
+ 	int r, fd, oerrno, inplace = 0;
+ 	struct known_hosts_ctx ctx;
+ 	u_int foreach_options;
++	struct stat sb;
+ 
+ 	if (!have_identity) {
+ 		cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
+@@ -1244,6 +1245,8 @@ do_known_hosts(struct passwd *pw, const char *name)
+ 		free(cp);
+ 		have_identity = 1;
+ 	}
++	if (stat(identity_file, &sb) != 0)
++		fatal("Cannot stat %s: %s", identity_file, strerror(errno));
+ 
+ 	memset(&ctx, 0, sizeof(ctx));
+ 	ctx.out = stdout;
+@@ -1267,6 +1270,7 @@ do_known_hosts(struct passwd *pw, const char *name)
+ 			unlink(tmp);
+ 			fatal("fdopen: %s", strerror(oerrno));
+ 		}
++		fchmod(fd, sb.st_mode & 0644);
+ 		inplace = 1;
+ 	}
+ 
diff --git a/debian/patches/CVE-2018-15473.patch b/debian/patches/CVE-2018-15473.patch
 new file mode 100644
index 0000000..f439e37
--- /dev/null
+++ b/debian/patches/CVE-2018-15473.patch
@@ -0,0 +1,138 @@
+Updated: 2021-08-11
+Backport of:
+
+From 779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 Mon Sep 17 00:00:00 2001
+From: djm <[e-mail]>
+Date: Tue, 31 Jul 2018 03:10:27 +0000
+Subject: [PATCH] =?UTF-8?q?delay=20bailout=20for=20invalid=20authenticatin?=
+ =?UTF-8?q?g=20user=20until=20after=20the=20packet=20containing=20the=20re?=
+ =?UTF-8?q?quest=20has=20been=20fully=20parsed.=20Reported=20by=20Dariusz?=
+ =?UTF-8?q?=20Tytko=20and=20Micha=C5=82=20Sajdak;=20ok=20deraadt?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+delay bailout for invalid authenticating user until after the packet
+containing the request has been fully parsed.
+
+---
+ auth2-gss.c       |    9 ++++++---
+ auth2-hostbased.c |    9 +++++----
+ auth2-pubkey.c    |   21 ++++++++++++++-------
+ 3 files changed, 25 insertions(+), 14 deletions(-)
+
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -104,9 +104,6 @@ userauth_gssapi(struct ssh *ssh)
+ 	u_int len;
+ 	u_char *doid = NULL;
+ 
+-	if (!authctxt->valid || authctxt->user == NULL)
+-		return (0);
+-
+ 	mechs = packet_get_int();
+ 	if (mechs == 0) {
+ 		debug("Mechanism negotiation is not supported");
+@@ -137,6 +134,12 @@ userauth_gssapi(struct ssh *ssh)
+ 		return (0);
+ 	}
+ 
++	if (!authctxt->valid || authctxt->user == NULL) {
++		debug2("%s: disabled because of invalid user", __func__);
++		free(doid);
++		return (0);
++	}
++
+ 	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
+ 		if (ctxt != NULL)
+ 			ssh_gssapi_delete_ctx(&ctxt);
+--- a/auth2-hostbased.c
++++ b/auth2-hostbased.c
+@@ -67,10 +67,6 @@ userauth_hostbased(struct ssh *ssh)
+ 	size_t alen, blen, slen;
+ 	int r, pktype, authenticated = 0;
+ 
+-	if (!authctxt->valid) {
+-		debug2("%s: disabled because of invalid user", __func__);
+-		return 0;
+-	}
+ 	/* XXX use sshkey_froms() */
+ 	if ((r = sshpkt_get_cstring(ssh, &pkalg, &alen)) != 0 ||
+ 	    (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0 ||
+@@ -118,6 +114,11 @@ userauth_hostbased(struct ssh *ssh)
+ 		goto done;
+ 	}
+ 
++       if (!authctxt->valid || authctxt->user == NULL) {
++               debug2("%s: disabled because of invalid user", __func__);
++               goto done;
++       }
++
+ 	service = ssh->compat & SSH_BUG_HBSERVICE ? "ssh-userauth" :
+ 	    authctxt->service;
+ 	if ((b = sshbuf_new()) == NULL)
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -77,18 +77,14 @@ static int
+ userauth_pubkey(struct ssh *ssh)
+ {
+ 	Authctxt *authctxt = ssh->authctxt;
+-	struct sshbuf *b;
++	struct sshbuf *b = NULL;
+ 	struct sshkey *key = NULL;
+-	char *pkalg, *userstyle = NULL, *fp = NULL;
+-	u_char *pkblob, *sig, have_sig;
++	char *pkalg = NULL, *userstyle = NULL, *fp = NULL;
++	u_char *pkblob = NULL, *sig = NULL, have_sig;
+ 	size_t blen, slen;
+ 	int r, pktype;
+ 	int authenticated = 0;
+ 
+-	if (!authctxt->valid) {
+-		debug2("%s: disabled because of invalid user", __func__);
+-		return 0;
+-	}
+ 	if ((r = sshpkt_get_u8(ssh, &have_sig)) != 0)
+ 		fatal("%s: sshpkt_get_u8 failed: %s", __func__, ssh_err(r));
+ 	if (ssh->compat & SSH_BUG_PKAUTH) {
+@@ -166,6 +162,12 @@ userauth_pubkey(struct ssh *ssh)
+ 				fatal("%s: sshbuf_put_string session id: %s",
+ 				    __func__, ssh_err(r));
+ 		}
++		if (!authctxt->valid || authctxt->user == NULL) {
++			debug2("%s: disabled because of invalid user",
++			    __func__);
++			sshbuf_free(b);
++			goto done;
++		}
+ 		/* reconstruct packet */
+ 		xasprintf(&userstyle, "%s%s%s", authctxt->user,
+ 		    authctxt->style ? ":" : "",
+@@ -202,7 +204,6 @@ userauth_pubkey(struct ssh *ssh)
+ 			authenticated = 1;
+ 		}
+ 		sshbuf_free(b);
+-		free(sig);
+ 		auth2_record_key(authctxt, authenticated, key);
+ 	} else {
+ 		debug("%s: test whether pkalg/pkblob are acceptable for %s %s",
+@@ -210,6 +211,11 @@ userauth_pubkey(struct ssh *ssh)
+ 		if ((r = sshpkt_get_end(ssh)) != 0)
+ 			fatal("%s: %s", __func__, ssh_err(r));
+ 
++               if (!authctxt->valid || authctxt->user == NULL) {
++                       debug2("%s: disabled because of invalid user",
++                           __func__);
++                       goto done;
++               }
+ 		/* XXX fake reply and always send PK_OK ? */
+ 		/*
+ 		 * XXX this allows testing whether a user is allowed
+@@ -238,6 +244,7 @@ done:
+ 	free(pkalg);
+ 	free(pkblob);
+ 	free(fp);
++	free(sig);
+ 	return authenticated;
+ }
+ 
diff --git a/debian/patches/CVE-2018-20685.patch b/debian/patches/CVE-2018-20685.patch
 new file mode 100644
index 0000000..0c2b94a
--- /dev/null
+++ b/debian/patches/CVE-2018-20685.patch
@@ -0,0 +1,29 @@
+Backport of:
+
+From 6010c0303a422a9c5fa8860c061bf7105eb7f8b2 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Fri, 16 Nov 2018 03:03:10 +0000
+Subject: [PATCH] upstream: disallow empty incoming filename or ones that refer
+ to the
+
+current directory; based on report/patch from Harry Sintonen
+
+OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9
+---
+ scp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+Index: openssh-7.6p1/scp.c
+===================================================================
+--- openssh-7.6p1.orig/scp.c	2019-01-31 08:56:55.553635620 -0500
++++ openssh-7.6p1/scp.c	2019-01-31 08:56:55.553635620 -0500
+@@ -1073,7 +1073,8 @@ sink(int argc, char **argv)
+ 			SCREWUP("size out of range");
+ 		size = (off_t)ull;
+ 
+-		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
++		if (*cp == '\0' || strchr(cp, '/') != NULL ||
++		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
+ 			run_err("error: unexpected filename: %s", cp);
+ 			exit(1);
+ 		}
diff --git a/debian/patches/CVE-2019-6109-1.patch b/debian/patches/CVE-2019-6109-1.patch
 new file mode 100644
index 0000000..7da9698
--- /dev/null
+++ b/debian/patches/CVE-2019-6109-1.patch
@@ -0,0 +1,253 @@
+Backport of:
+
+From 8976f1c4b2721c26e878151f52bdf346dfe2d54c Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Wed, 23 Jan 2019 08:01:46 +0000
+Subject: [PATCH] upstream: Sanitize scp filenames via snmprintf. To do this we
+ move
+
+the progressmeter formatting outside of signal handler context and have the
+atomicio callback called for EINTR too.  bz#2434 with contributions from djm
+and jjelen at redhat.com, ok djm@
+
+OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8
+---
+ atomicio.c      | 20 ++++++++++++++-----
+ progressmeter.c | 53 ++++++++++++++++++++++---------------------------
+ progressmeter.h |  3 ++-
+ scp.c           |  3 ++-
+ sftp-client.c   | 18 +++++++++--------
+ 5 files changed, 53 insertions(+), 44 deletions(-)
+
+Index: openssh-7.6p1/atomicio.c
+===================================================================
+--- openssh-7.6p1.orig/atomicio.c	2019-01-31 08:58:23.885841566 -0500
++++ openssh-7.6p1/atomicio.c	2019-01-31 08:58:23.881841557 -0500
+@@ -65,9 +65,14 @@ atomicio6(ssize_t (*f) (int, void *, siz
+ 		res = (f) (fd, s + pos, n - pos);
+ 		switch (res) {
+ 		case -1:
+-			if (errno == EINTR)
++			if (errno == EINTR) {
++				/* possible SIGALARM, update callback */
++				if (cb != NULL && cb(cb_arg, 0) == -1) {
++					errno = EINTR;
++					return pos;
++				}
+ 				continue;
+-			if (errno == EAGAIN || errno == EWOULDBLOCK) {
++			} else if (errno == EAGAIN || errno == EWOULDBLOCK) {
+ #ifndef BROKEN_READ_COMPARISON
+ 				(void)poll(&pfd, 1, -1);
+ #endif
+@@ -122,9 +127,14 @@ atomiciov6(ssize_t (*f) (int, const stru
+ 		res = (f) (fd, iov, iovcnt);
+ 		switch (res) {
+ 		case -1:
+-			if (errno == EINTR)
++			if (errno == EINTR) {
++				/* possible SIGALARM, update callback */
++				if (cb != NULL && cb(cb_arg, 0) == -1) {
++					errno = EINTR;
++					return pos;
++				}
+ 				continue;
+-			if (errno == EAGAIN || errno == EWOULDBLOCK) {
++			} else if (errno == EAGAIN || errno == EWOULDBLOCK) {
+ #ifndef BROKEN_READV_COMPARISON
+ 				(void)poll(&pfd, 1, -1);
+ #endif
+Index: openssh-7.6p1/progressmeter.c
+===================================================================
+--- openssh-7.6p1.orig/progressmeter.c	2019-01-31 08:58:23.885841566 -0500
++++ openssh-7.6p1/progressmeter.c	2019-01-31 08:58:23.881841557 -0500
+@@ -31,6 +31,7 @@
+ 
+ #include <errno.h>
+ #include <signal.h>
++#include <stdarg.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <time.h>
+@@ -39,6 +40,7 @@
+ #include "progressmeter.h"
+ #include "atomicio.h"
+ #include "misc.h"
++#include "utf8.h"
+ 
+ #define DEFAULT_WINSIZE 80
+ #define MAX_WINSIZE 512
+@@ -61,7 +63,7 @@ static void setscreensize(void);
+ void refresh_progress_meter(void);
+ 
+ /* signal handler for updating the progress meter */
+-static void update_progress_meter(int);
++static void sig_alarm(int);
+ 
+ static double start;		/* start progress */
+ static double last_update;	/* last progress update */
+@@ -74,6 +76,7 @@ static long stalled;		/* how long we hav
+ static int bytes_per_second;	/* current speed in bytes per second */
+ static int win_size;		/* terminal window size */
+ static volatile sig_atomic_t win_resized; /* for window resizing */
++static volatile sig_atomic_t alarm_fired;
+ 
+ /* units for format_size */
+ static const char unit[] = " KMGT";
+@@ -126,9 +129,17 @@ refresh_progress_meter(void)
+ 	off_t bytes_left;
+ 	int cur_speed;
+ 	int hours, minutes, seconds;
+-	int i, len;
+ 	int file_len;
+ 
++	if ((!alarm_fired && !win_resized) || !can_output())
++		return;
++	alarm_fired = 0;
++
++	if (win_resized) {
++		setscreensize();
++		win_resized = 0;
++	}
++
+ 	transferred = *counter - (cur_pos ? cur_pos : start_pos);
+ 	cur_pos = *counter;
+ 	now = monotime_double();
+@@ -158,16 +169,11 @@ refresh_progress_meter(void)
+ 
+ 	/* filename */
+ 	buf[0] = '\0';
+-	file_len = win_size - 35;
++	file_len = win_size - 36;
+ 	if (file_len > 0) {
+-		len = snprintf(buf, file_len + 1, "\r%s", file);
+-		if (len < 0)
+-			len = 0;
+-		if (len >= file_len + 1)
+-			len = file_len;
+-		for (i = len; i < file_len; i++)
+-			buf[i] = ' ';
+-		buf[file_len] = '\0';
++		buf[0] = '\r';
++		snmprintf(buf+1, sizeof(buf)-1 , &file_len, "%*s",
++		    file_len * -1, file);
+ 	}
+ 
+ 	/* percent of transfer done */
+@@ -228,22 +234,11 @@ refresh_progress_meter(void)
+ 
+ /*ARGSUSED*/
+ static void
+-update_progress_meter(int ignore)
++sig_alarm(int ignore)
+ {
+-	int save_errno;
+-
+-	save_errno = errno;
+-
+-	if (win_resized) {
+-		setscreensize();
+-		win_resized = 0;
+-	}
+-	if (can_output())
+-		refresh_progress_meter();
+-
+-	signal(SIGALRM, update_progress_meter);
++	signal(SIGALRM, sig_alarm);
++	alarm_fired = 1;
+ 	alarm(UPDATE_INTERVAL);
+-	errno = save_errno;
+ }
+ 
+ void
+@@ -259,10 +254,9 @@ start_progress_meter(const char *f, off_
+ 	bytes_per_second = 0;
+ 
+ 	setscreensize();
+-	if (can_output())
+-		refresh_progress_meter();
++	refresh_progress_meter();
+ 
+-	signal(SIGALRM, update_progress_meter);
++	signal(SIGALRM, sig_alarm);
+ 	signal(SIGWINCH, sig_winch);
+ 	alarm(UPDATE_INTERVAL);
+ }
+@@ -286,6 +280,7 @@ stop_progress_meter(void)
+ static void
+ sig_winch(int sig)
+ {
++	signal(SIGWINCH, sig_winch);
+ 	win_resized = 1;
+ }
+ 
+Index: openssh-7.6p1/progressmeter.h
+===================================================================
+--- openssh-7.6p1.orig/progressmeter.h	2019-01-31 08:58:23.885841566 -0500
++++ openssh-7.6p1/progressmeter.h	2019-01-31 08:58:23.881841557 -0500
+@@ -24,4 +24,5 @@
+  */
+ 
+ void	start_progress_meter(const char *, off_t, off_t *);
++void	refresh_progress_meter(void);
+ void	stop_progress_meter(void);
+Index: openssh-7.6p1/scp.c
+===================================================================
+--- openssh-7.6p1.orig/scp.c	2019-01-31 08:58:23.885841566 -0500
++++ openssh-7.6p1/scp.c	2019-01-31 08:58:23.881841557 -0500
+@@ -580,6 +580,7 @@ scpio(void *_cnt, size_t s)
+ 	off_t *cnt = (off_t *)_cnt;
+ 
+ 	*cnt += s;
++	refresh_progress_meter();
+ 	if (limit_kbps > 0)
+ 		bandwidth_limit(&bwlimit, s);
+ 	return 0;
+Index: openssh-7.6p1/sftp-client.c
+===================================================================
+--- openssh-7.6p1.orig/sftp-client.c	2019-01-31 08:58:23.885841566 -0500
++++ openssh-7.6p1/sftp-client.c	2019-01-31 08:58:23.881841557 -0500
+@@ -101,7 +101,9 @@ sftpio(void *_bwlimit, size_t amount)
+ {
+ 	struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
+ 
+-	bandwidth_limit(bwlimit, amount);
++	refresh_progress_meter();
++	if (bwlimit != NULL)
++		bandwidth_limit(bwlimit, amount);
+ 	return 0;
+ }
+ 
+@@ -121,8 +123,8 @@ send_msg(struct sftp_conn *conn, struct
+ 	iov[1].iov_base = (u_char *)sshbuf_ptr(m);
+ 	iov[1].iov_len = sshbuf_len(m);
+ 
+-	if (atomiciov6(writev, conn->fd_out, iov, 2,
+-	    conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) !=
++	if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio,
++	    conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) !=
+ 	    sshbuf_len(m) + sizeof(mlen))
+ 		fatal("Couldn't send packet: %s", strerror(errno));
+ 
+@@ -138,8 +140,8 @@ get_msg(struct sftp_conn *conn, struct s
+ 
+ 	if ((r = sshbuf_reserve(m, 4, &p)) != 0)
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
+-	if (atomicio6(read, conn->fd_in, p, 4,
+-	    conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) {
++	if (atomicio6(read, conn->fd_in, p, 4, sftpio,
++	    conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) {
+ 		if (errno == EPIPE || errno == ECONNRESET)
+ 			fatal("Connection closed");
+ 		else
+@@ -153,8 +155,8 @@ get_msg(struct sftp_conn *conn, struct s
+ 
+ 	if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
+-	if (atomicio6(read, conn->fd_in, p, msg_len,
+-	    conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in)
++	if (atomicio6(read, conn->fd_in, p, msg_len, sftpio,
++	    conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL)
+ 	    != msg_len) {
+ 		if (errno == EPIPE)
+ 			fatal("Connection closed");
diff --git a/debian/patches/CVE-2019-6109-2.patch b/debian/patches/CVE-2019-6109-2.patch
 new file mode 100644
index 0000000..0cdc6d3
--- /dev/null
+++ b/debian/patches/CVE-2019-6109-2.patch
@@ -0,0 +1,106 @@
+Backport of:
+
+From bdc6c63c80b55bcbaa66b5fde31c1cb1d09a41eb Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Thu, 24 Jan 2019 16:52:17 +0000
+Subject: [PATCH] upstream: Have progressmeter force an update at the beginning
+ and
+
+end of each transfer.  Fixes the problem recently introduces where very quick
+transfers do not display the progressmeter at all.  Spotted by naddy@
+
+OpenBSD-Commit-ID: 68dc46c259e8fdd4f5db3ec2a130f8e4590a7a9a
+---
+ progressmeter.c | 13 +++++--------
+ progressmeter.h |  4 ++--
+ scp.c           |  4 ++--
+ sftp-client.c   |  4 ++--
+ 4 files changed, 11 insertions(+), 14 deletions(-)
+
+Index: openssh-7.6p1/progressmeter.c
+===================================================================
+--- openssh-7.6p1.orig/progressmeter.c	2019-01-31 08:58:29.833855684 -0500
++++ openssh-7.6p1/progressmeter.c	2019-01-31 08:58:29.833855684 -0500
+@@ -59,9 +59,6 @@ static void format_rate(char *, int, off
+ static void sig_winch(int);
+ static void setscreensize(void);
+ 
+-/* updates the progressmeter to reflect the current state of the transfer */
+-void refresh_progress_meter(void);
+-
+ /* signal handler for updating the progress meter */
+ static void sig_alarm(int);
+ 
+@@ -120,7 +117,7 @@ format_size(char *buf, int size, off_t b
+ }
+ 
+ void
+-refresh_progress_meter(void)
++refresh_progress_meter(int force_update)
+ {
+ 	char buf[MAX_WINSIZE + 1];
+ 	off_t transferred;
+@@ -131,7 +128,7 @@ refresh_progress_meter(void)
+ 	int hours, minutes, seconds;
+ 	int file_len;
+ 
+-	if ((!alarm_fired && !win_resized) || !can_output())
++	if ((!force_update && !alarm_fired && !win_resized) || !can_output())
+ 		return;
+ 	alarm_fired = 0;
+ 
+@@ -254,7 +251,7 @@ start_progress_meter(const char *f, off_
+ 	bytes_per_second = 0;
+ 
+ 	setscreensize();
+-	refresh_progress_meter();
++	refresh_progress_meter(1);
+ 
+ 	signal(SIGALRM, sig_alarm);
+ 	signal(SIGWINCH, sig_winch);
+@@ -271,7 +268,7 @@ stop_progress_meter(void)
+ 
+ 	/* Ensure we complete the progress */
+ 	if (cur_pos != end_pos)
+-		refresh_progress_meter();
++		refresh_progress_meter(1);
+ 
+ 	atomicio(vwrite, STDOUT_FILENO, "\n", 1);
+ }
+Index: openssh-7.6p1/progressmeter.h
+===================================================================
+--- openssh-7.6p1.orig/progressmeter.h	2019-01-31 08:58:29.833855684 -0500
++++ openssh-7.6p1/progressmeter.h	2019-01-31 08:58:29.833855684 -0500
+@@ -24,5 +24,5 @@
+  */
+ 
+ void	start_progress_meter(const char *, off_t, off_t *);
+-void	refresh_progress_meter(void);
++void	refresh_progress_meter(int);
+ void	stop_progress_meter(void);
+Index: openssh-7.6p1/scp.c
+===================================================================
+--- openssh-7.6p1.orig/scp.c	2019-01-31 08:58:29.833855684 -0500
++++ openssh-7.6p1/scp.c	2019-01-31 08:58:29.833855684 -0500
+@@ -580,7 +580,7 @@ scpio(void *_cnt, size_t s)
+ 	off_t *cnt = (off_t *)_cnt;
+ 
+ 	*cnt += s;
+-	refresh_progress_meter();
++	refresh_progress_meter(0);
+ 	if (limit_kbps > 0)
+ 		bandwidth_limit(&bwlimit, s);
+ 	return 0;
+Index: openssh-7.6p1/sftp-client.c
+===================================================================
+--- openssh-7.6p1.orig/sftp-client.c	2019-01-31 08:58:29.833855684 -0500
++++ openssh-7.6p1/sftp-client.c	2019-01-31 08:58:29.833855684 -0500
+@@ -101,7 +101,7 @@ sftpio(void *_bwlimit, size_t amount)
+ {
+ 	struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
+ 
+-	refresh_progress_meter();
++	refresh_progress_meter(0);
+ 	if (bwlimit != NULL)
+ 		bandwidth_limit(bwlimit, amount);
+ 	return 0;
diff --git a/debian/patches/CVE-2019-6111-2.patch b/debian/patches/CVE-2019-6111-2.patch
 new file mode 100644
index 0000000..21aa8fc
--- /dev/null
+++ b/debian/patches/CVE-2019-6111-2.patch
@@ -0,0 +1,348 @@
+From 3d896c157c722bc47adca51a58dca859225b5874 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Sun, 10 Feb 2019 11:15:52 +0000
+Subject: [PATCH] upstream: when checking that filenames sent by the server
+ side
+
+match what the client requested, be prepared to handle shell-style brace
+alternations, e.g. "{foo,bar}".
+
+"looks good to me" millert@ + in snaps for the last week courtesy
+deraadt@
+
+OpenBSD-Commit-ID: 3b1ce7639b0b25b2248e3a30f561a548f6815f3e
+---
+ scp.c | 282 +++++++++++++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 270 insertions(+), 12 deletions(-)
+
+Index: openssh-7.6p1/scp.c
+===================================================================
+--- openssh-7.6p1.orig/scp.c	2019-03-04 07:17:32.294099797 -0500
++++ openssh-7.6p1/scp.c	2019-03-04 07:17:32.294099797 -0500
+@@ -604,6 +604,253 @@ do_times(int fd, int verb, const struct
+ 	return (response());
+ }
+ 
++/* Appends a string to an array; returns 0 on success, -1 on alloc failure */
++static int
++append(char *cp, char ***ap, size_t *np)
++{
++	char **tmp;
++
++	if ((tmp = reallocarray(*ap, *np + 1, sizeof(*tmp))) == NULL)
++		return -1;
++	tmp[(*np)] = cp;
++	(*np)++;
++	*ap = tmp;
++	return 0;
++}
++
++/*
++ * Finds the start and end of the first brace pair in the pattern.
++ * returns 0 on success or -1 for invalid patterns.
++ */
++static int
++find_brace(const char *pattern, int *startp, int *endp)
++{
++	int i;
++	int in_bracket, brace_level;
++
++	*startp = *endp = -1;
++	in_bracket = brace_level = 0;
++	for (i = 0; i < INT_MAX && *endp < 0 && pattern[i] != '\0'; i++) {
++		switch (pattern[i]) {
++		case '\\':
++			/* skip next character */
++			if (pattern[i + 1] != '\0')
++				i++;
++			break;
++		case '[':
++			in_bracket = 1;
++			break;
++		case ']':
++			in_bracket = 0;
++			break;
++		case '{':
++			if (in_bracket)
++				break;
++			if (pattern[i + 1] == '}') {
++				/* Protect a single {}, for find(1), like csh */
++				i++; /* skip */
++				break;
++			}
++			if (*startp == -1)
++				*startp = i;
++			brace_level++;
++			break;
++		case '}':
++			if (in_bracket)
++				break;
++			if (*startp < 0) {
++				/* Unbalanced brace */
++				return -1;
++			}
++			if (--brace_level <= 0)
++				*endp = i;
++			break;
++		}
++	}
++	/* unbalanced brackets/braces */
++	if (*endp < 0 && (*startp >= 0 || in_bracket))
++		return -1;
++	return 0;
++}
++
++/*
++ * Assembles and records a successfully-expanded pattern, returns -1 on
++ * alloc failure.
++ */
++static int
++emit_expansion(const char *pattern, int brace_start, int brace_end,
++    int sel_start, int sel_end, char ***patternsp, size_t *npatternsp)
++{
++	char *cp;
++	int o = 0, tail_len = strlen(pattern + brace_end + 1);
++
++	if ((cp = malloc(brace_start + (sel_end - sel_start) +
++	    tail_len + 1)) == NULL)
++		return -1;
++
++	/* Pattern before initial brace */
++	if (brace_start > 0) {
++		memcpy(cp, pattern, brace_start);
++		o = brace_start;
++	}
++	/* Current braced selection */
++	if (sel_end - sel_start > 0) {
++		memcpy(cp + o, pattern + sel_start,
++		    sel_end - sel_start);
++		o += sel_end - sel_start;
++	}
++	/* Remainder of pattern after closing brace */
++	if (tail_len > 0) {
++		memcpy(cp + o, pattern + brace_end + 1, tail_len);
++		o += tail_len;
++	}
++	cp[o] = '\0';
++	if (append(cp, patternsp, npatternsp) != 0) {
++		free(cp);
++		return -1;
++	}
++	return 0;
++}
++
++/*
++ * Expand the first encountered brace in pattern, appending the expanded
++ * patterns it yielded to the *patternsp array.
++ *
++ * Returns 0 on success or -1 on allocation failure.
++ *
++ * Signals whether expansion was performed via *expanded and whether
++ * pattern was invalid via *invalid.
++ */
++static int
++brace_expand_one(const char *pattern, char ***patternsp, size_t *npatternsp,
++    int *expanded, int *invalid)
++{
++	int i;
++	int in_bracket, brace_start, brace_end, brace_level;
++	int sel_start, sel_end;
++
++	*invalid = *expanded = 0;
++
++	if (find_brace(pattern, &brace_start, &brace_end) != 0) {
++		*invalid = 1;
++		return 0;
++	} else if (brace_start == -1)
++		return 0;
++
++	in_bracket = brace_level = 0;
++	for (i = sel_start = brace_start + 1; i < brace_end; i++) {
++		switch (pattern[i]) {
++		case '{':
++			if (in_bracket)
++				break;
++			brace_level++;
++			break;
++		case '}':
++			if (in_bracket)
++				break;
++			brace_level--;
++			break;
++		case '[':
++			in_bracket = 1;
++			break;
++		case ']':
++			in_bracket = 0;
++			break;
++		case '\\':
++			if (i < brace_end - 1)
++				i++; /* skip */
++			break;
++		}
++		if (pattern[i] == ',' || i == brace_end - 1) {
++			if (in_bracket || brace_level > 0)
++				continue;
++			/* End of a selection, emit an expanded pattern */
++
++			/* Adjust end index for last selection */
++			sel_end = (i == brace_end - 1) ? brace_end : i;
++			if (emit_expansion(pattern, brace_start, brace_end,
++			    sel_start, sel_end, patternsp, npatternsp) != 0)
++				return -1;
++			/* move on to the next selection */
++			sel_start = i + 1;
++			continue;
++		}
++	}
++	if (in_bracket || brace_level > 0) {
++		*invalid = 1;
++		return 0;
++	}
++	/* success */
++	*expanded = 1;
++	return 0;
++}
++
++/* Expand braces from pattern. Returns 0 on success, -1 on failure */
++static int
++brace_expand(const char *pattern, char ***patternsp, size_t *npatternsp)
++{
++	char *cp, *cp2, **active = NULL, **done = NULL;
++	size_t i, nactive = 0, ndone = 0;
++	int ret = -1, invalid = 0, expanded = 0;
++
++	*patternsp = NULL;
++	*npatternsp = 0;
++
++	/* Start the worklist with the original pattern */
++	if ((cp = strdup(pattern)) == NULL)
++		return -1;
++	if (append(cp, &active, &nactive) != 0) {
++		free(cp);
++		return -1;
++	}
++	while (nactive > 0) {
++		cp = active[nactive - 1];
++		nactive--;
++		if (brace_expand_one(cp, &active, &nactive,
++		    &expanded, &invalid) == -1) {
++			free(cp);
++			goto fail;
++		}
++		if (invalid)
++			fatal("%s: invalid brace pattern \"%s\"", __func__, cp);
++		if (expanded) {
++			/*
++			 * Current entry expanded to new entries on the
++			 * active list; discard the progenitor pattern.
++			 */
++			free(cp);
++			continue;
++		}
++		/*
++		 * Pattern did not expand; append the finename component to
++		 * the completed list
++		 */
++		if ((cp2 = strrchr(cp, '/')) != NULL)
++			*cp2++ = '\0';
++		else
++			cp2 = cp;
++		if (append(xstrdup(cp2), &done, &ndone) != 0) {
++			free(cp);
++			goto fail;
++		}
++		free(cp);
++	}
++	/* success */
++	*patternsp = done;
++	*npatternsp = ndone;
++	done = NULL;
++	ndone = 0;
++	ret = 0;
++ fail:
++	for (i = 0; i < nactive; i++)
++		free(active[i]);
++	free(active);
++	for (i = 0; i < ndone; i++)
++		free(done[i]);
++	free(done);
++	return ret;
++}
++
+ void
+ toremote(char *targ, int argc, char **argv)
+ {
+@@ -959,7 +1206,8 @@ sink(int argc, char **argv, const char *
+ 	unsigned long long ull;
+ 	int setimes, targisdir, wrerrno = 0;
+ 	char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048];
+-	char *src_copy = NULL, *restrict_pattern = NULL;
++	char **patterns = NULL;
++	size_t n, npatterns = 0;
+ 	struct timeval tv[2];
+ 
+ #define	atime	tv[0]
+@@ -989,16 +1237,13 @@ sink(int argc, char **argv, const char *
+ 		 * Prepare to try to restrict incoming filenames to match
+ 		 * the requested destination file glob.
+ 		 */
+-		if ((src_copy = strdup(src)) == NULL)
+-			fatal("strdup failed");
+-		if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) {
+-			*restrict_pattern++ = '\0';
+-		}
++		if (brace_expand(src, &patterns, &npatterns) != 0)
++			fatal("%s: could not expand pattern", __func__);
+ 	}
+ 	for (first = 1;; first = 0) {
+ 		cp = buf;
+ 		if (atomicio(read, remin, cp, 1) != 1)
+-			return;
++			goto done;
+ 		if (*cp++ == '\n')
+ 			SCREWUP("unexpected <newline>");
+ 		do {
+@@ -1024,7 +1269,7 @@ sink(int argc, char **argv, const char *
+ 		}
+ 		if (buf[0] == 'E') {
+ 			(void) atomicio(vwrite, remout, "", 1);
+-			return;
++			goto done;
+ 		}
+ 		if (ch == '\n')
+ 			*--cp = 0;
+@@ -1097,9 +1342,14 @@ sink(int argc, char **argv, const char *
+ 			run_err("error: unexpected filename: %s", cp);
+ 			exit(1);
+ 		}
+-		if (restrict_pattern != NULL &&
+-		    fnmatch(restrict_pattern, cp, 0) != 0)
+-			SCREWUP("filename does not match request");
++		if (npatterns > 0) {
++			for (n = 0; n < npatterns; n++) {
++				if (fnmatch(patterns[n], cp, 0) == 0)
++					break;
++			}
++			if (n >= npatterns)
++				SCREWUP("filename does not match request");
++		}
+ 		if (targisdir) {
+ 			static char *namebuf;
+ 			static size_t cursize;
+@@ -1258,7 +1508,15 @@ bad:			run_err("%s: %s", np, strerror(er
+ 			break;
+ 		}
+ 	}
++done:
++	for (n = 0; n < npatterns; n++)
++		free(patterns[n]);
++	free(patterns);
++	return;
+ screwup:
++	for (n = 0; n < npatterns; n++)
++		free(patterns[n]);
++	free(patterns);
+ 	run_err("protocol error: %s", why);
+ 	exit(1);
+ }
diff --git a/debian/patches/CVE-2019-6111.patch b/debian/patches/CVE-2019-6111.patch
 new file mode 100644
index 0000000..72b8bde
--- /dev/null
+++ b/debian/patches/CVE-2019-6111.patch
@@ -0,0 +1,182 @@
+Backport of:
+
+From 391ffc4b9d31fa1f4ad566499fef9176ff8a07dc Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Sat, 26 Jan 2019 22:41:28 +0000
+Subject: [PATCH] upstream: check in scp client that filenames sent during
+
+remote->local directory copies satisfy the wildcard specified by the user.
+
+This checking provides some protection against a malicious server
+sending unexpected filenames, but it comes at a risk of rejecting wanted
+files due to differences between client and server wildcard expansion rules.
+
+For this reason, this also adds a new -T flag to disable the check.
+
+reported by Harry Sintonen
+fix approach suggested by markus@;
+has been in snaps for ~1wk courtesy deraadt@
+
+OpenBSD-Commit-ID: 00f44b50d2be8e321973f3c6d014260f8f7a8eda
+---
+ scp.1 | 16 +++++++++++++---
+ scp.c | 39 ++++++++++++++++++++++++++++++---------
+ 2 files changed, 43 insertions(+), 12 deletions(-)
+
+Index: openssh-7.6p1/scp.1
+===================================================================
+--- openssh-7.6p1.orig/scp.1	2019-01-31 08:57:08.113664456 -0500
++++ openssh-7.6p1/scp.1	2019-01-31 08:57:44.625749147 -0500
+@@ -19,7 +19,7 @@
+ .Sh SYNOPSIS
+ .Nm scp
+ .Bk -words
+-.Op Fl 346BCpqrv
++.Op Fl 346BCpqrTv
+ .Op Fl c Ar cipher
+ .Op Fl F Ar ssh_config
+ .Op Fl i Ar identity_file
+@@ -202,6 +202,16 @@ to use for the encrypted connection.
+ The program must understand
+ .Xr ssh 1
+ options.
++.It Fl T
++Disable strict filename checking.
++By default when copying files from a remote host to a local directory
++.Nm
++checks that the received filenames match those requested on the command-line
++to prevent the remote end from sending unexpected or unwanted files.
++Because of differences in how various operating systems and shells interpret
++filename wildcards, these checks may cause wanted files to be rejected.
++This option disables these checks at the expense of fully trusting that
++the server will not send unexpected filenames.
+ .It Fl v
+ Verbose mode.
+ Causes
+Index: openssh-7.6p1/scp.c
+===================================================================
+--- openssh-7.6p1.orig/scp.c	2019-01-31 08:57:08.113664456 -0500
++++ openssh-7.6p1/scp.c	2019-01-31 08:57:08.109664446 -0500
+@@ -94,6 +94,7 @@
+ #include <dirent.h>
+ #include <errno.h>
+ #include <fcntl.h>
++#include <fnmatch.h>
+ #include <limits.h>
+ #include <locale.h>
+ #include <pwd.h>
+@@ -365,14 +366,14 @@ void verifydir(char *);
+ struct passwd *pwd;
+ uid_t userid;
+ int errs, remin, remout;
+-int pflag, iamremote, iamrecursive, targetshouldbedirectory;
++int Tflag, pflag, iamremote, iamrecursive, targetshouldbedirectory;
+ 
+ #define	CMDNEEDS	64
+ char cmd[CMDNEEDS];		/* must hold "rcp -r -p -d\0" */
+ 
+ int response(void);
+ void rsource(char *, struct stat *);
+-void sink(int, char *[]);
++void sink(int, char *[], const char *);
+ void source(int, char *[]);
+ void tolocal(int, char *[]);
+ void toremote(char *, int, char *[]);
+@@ -409,8 +410,9 @@ main(int argc, char **argv)
+ 	addargs(&args, "-oPermitLocalCommand=no");
+ 	addargs(&args, "-oClearAllForwardings=yes");
+ 
+-	fflag = tflag = 0;
+-	while ((ch = getopt(argc, argv, "dfl:prtvBCc:i:P:q12346S:o:F:")) != -1)
++	fflag = Tflag = tflag = 0;
++	while ((ch = getopt(argc, argv,
++	    "dfl:prtTvBCc:i:P:q12346S:o:F:")) != -1) {
+ 		switch (ch) {
+ 		/* User-visible flags. */
+ 		case '1':
+@@ -490,9 +492,13 @@ main(int argc, char **argv)
+ 			setmode(0, O_BINARY);
+ #endif
+ 			break;
++		case 'T':
++			Tflag = 1;
++			break;
+ 		default:
+ 			usage();
+ 		}
++	}
+ 	argc -= optind;
+ 	argv += optind;
+ 
+@@ -523,7 +529,7 @@ main(int argc, char **argv)
+ 	}
+ 	if (tflag) {
+ 		/* Receive data. */
+-		sink(argc, argv);
++		sink(argc, argv, NULL);
+ 		exit(errs != 0);
+ 	}
+ 	if (argc < 2)
+@@ -763,7 +769,7 @@ tolocal(int argc, char **argv)
+ 			continue;
+ 		}
+ 		free(bp);
+-		sink(1, argv + argc - 1);
++		sink(1, argv + argc - 1, src);
+ 		(void) close(remin);
+ 		remin = remout = -1;
+ 	}
+@@ -936,7 +942,7 @@ rsource(char *name, struct stat *statp)
+ 	 (sizeof(type) != 4 && sizeof(type) != 8))
+ 
+ void
+-sink(int argc, char **argv)
++sink(int argc, char **argv, const char *src)
+ {
+ 	static BUF buffer;
+ 	struct stat stb;
+@@ -952,6 +958,7 @@ sink(int argc, char **argv)
+ 	unsigned long long ull;
+ 	int setimes, targisdir, wrerrno = 0;
+ 	char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048];
++	char *src_copy = NULL, *restrict_pattern = NULL;
+ 	struct timeval tv[2];
+ 
+ #define	atime	tv[0]
+@@ -976,6 +983,17 @@ sink(int argc, char **argv)
+ 	(void) atomicio(vwrite, remout, "", 1);
+ 	if (stat(targ, &stb) == 0 && S_ISDIR(stb.st_mode))
+ 		targisdir = 1;
++	if (src != NULL && !iamrecursive && !Tflag) {
++		/*
++		 * Prepare to try to restrict incoming filenames to match
++		 * the requested destination file glob.
++		 */
++		if ((src_copy = strdup(src)) == NULL)
++			fatal("strdup failed");
++		if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) {
++			*restrict_pattern++ = '\0';
++		}
++	}
+ 	for (first = 1;; first = 0) {
+ 		cp = buf;
+ 		if (atomicio(read, remin, cp, 1) != 1)
+@@ -1078,6 +1096,9 @@ sink(int argc, char **argv)
+ 			run_err("error: unexpected filename: %s", cp);
+ 			exit(1);
+ 		}
++		if (restrict_pattern != NULL &&
++		    fnmatch(restrict_pattern, cp, 0) != 0)
++			SCREWUP("filename does not match request");
+ 		if (targisdir) {
+ 			static char *namebuf;
+ 			static size_t cursize;
+@@ -1115,7 +1136,7 @@ sink(int argc, char **argv)
+ 					goto bad;
+ 			}
+ 			vect[0] = xstrdup(np);
+-			sink(1, vect);
++			sink(1, vect, src);
+ 			if (setimes) {
+ 				setimes = 0;
+ 				if (utimes(vect[0], tv) < 0)
diff --git a/debian/patches/lp-1863930-Fix-logic-bug-in-sshd_exchange_identification.patch b/debian/patches/lp-1863930-Fix-logic-bug-in-sshd_exchange_identification.patch
 new file mode 100644
index 0000000..5f9fc47
--- /dev/null
+++ b/debian/patches/lp-1863930-Fix-logic-bug-in-sshd_exchange_identification.patch
@@ -0,0 +1,31 @@
+From c9c1bba06ad1c7cad8548549a68c071bd807af60 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Tue, 23 Jan 2018 20:00:58 +0000
+Subject: [PATCH] upstream commit
+
+Fix a logic bug in sshd_exchange_identification which
+prevented clients using major protocol version 2 from connecting to the
+server. ok millert@
+
+OpenBSD-Commit-ID: 8668dec04586e27f1c0eb039ef1feb93d80a5ee9
+
+Backport-Note: dropped the no-op file header change
+Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=c9c1bba06
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1863930
+Last-Update: 2020-03-03
+
+---
+ sshd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sshd.c
++++ b/sshd.c
+@@ -465,7 +465,7 @@ sshd_exchange_identification(struct ssh
+ 	chop(server_version_string);
+ 	debug("Local version string %.200s", server_version_string);
+
+-	if (remote_major != 2 ||
++	if (remote_major != 2 &&
+ 	    !(remote_major == 1 && remote_minor == 99)) {
+ 		s = "Protocol major versions differ.\n";
+ 		(void) atomicio(vwrite, sock_out, s, strlen(s));
diff --git a/debian/patches/lp-1863930-unbreak-clients-that-advertise-protocol.patch b/debian/patches/lp-1863930-unbreak-clients-that-advertise-protocol.patch
 new file mode 100644
index 0000000..dbb035d
--- /dev/null
+++ b/debian/patches/lp-1863930-unbreak-clients-that-advertise-protocol.patch
@@ -0,0 +1,31 @@
+From 9e9c4a7e57b96ab29fe6d7545ed09d2e5bddbdec Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Tue, 23 Jan 2018 05:12:12 +0000
+Subject: [PATCH] upstream commit
+
+unbreak support for clients that advertise a protocol
+version of "1.99" (indicating both v2 and v1 support). Busted by me during
+SSHv1 purge in r1.358; bz2810, ok dtucker
+
+OpenBSD-Commit-ID: e8f9c2bee11afc16c872bb79d6abe9c555bd0e4b
+
+Backport-Note: dropped the no-op file header change
+Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=9e9c4a7e5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1863930
+Last-Update: 2020-03-03
+
+---
+ sshd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sshd.c
++++ b/sshd.c
+@@ -466,7 +466,7 @@ sshd_exchange_identification(struct ssh
+ 	debug("Local version string %.200s", server_version_string);
+
+ 	if (remote_major != 2 ||
+-	    (remote_major == 1 && remote_minor != 99)) {
++	    !(remote_major == 1 && remote_minor == 99)) {
+ 		s = "Protocol major versions differ.\n";
+ 		(void) atomicio(vwrite, sock_out, s, strlen(s));
+ 		close(sock_in);
diff --git a/debian/patches/regress-2020.patch b/debian/patches/regress-2020.patch
 new file mode 100644
index 0000000..b46e0df
--- /dev/null
+++ b/debian/patches/regress-2020.patch
@@ -0,0 +1,44 @@
+From df3ad29af495185aa9b051028ae94b965a4b1659 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Fri, 3 Jan 2020 03:02:26 +0000
+Subject: upstream: what bozo decided to use 2020 as a future date in a regress
+
+test?
+
+OpenBSD-Regress-ID: 3b953df5a7e14081ff6cf495d4e8d40e153cbc3a
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=ff31f15773ee173502eec4d7861ec56f26bba381
+Last-Update: 2020-01-09
+
+Patch-Name: regress-2020.patch
+---
+ regress/cert-hostkey.sh | 2 +-
+ regress/cert-userkey.sh | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
+index 86ea62504..844adabcc 100644
+--- a/regress/cert-hostkey.sh
++++ b/regress/cert-hostkey.sh
+@@ -252,7 +252,7 @@ test_one() {
+ test_one "user-certificate"	failure "-n $HOSTS"
+ test_one "empty principals"	success "-h"
+ test_one "wrong principals"	failure "-h -n foo"
+-test_one "cert not yet valid"	failure "-h -V20200101:20300101"
++test_one "cert not yet valid"	failure "-h -V20300101:20320101"
+ test_one "cert expired"		failure "-h -V19800101:19900101"
+ test_one "cert valid interval"	success "-h -V-1w:+2w"
+ test_one "cert has constraints"	failure "-h -Oforce-command=false"
+diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
+index 38c14a698..5cd02fc3f 100644
+--- a/regress/cert-userkey.sh
++++ b/regress/cert-userkey.sh
+@@ -338,7 +338,7 @@ test_one() {
+ test_one "correct principal"	success "-n ${USER}"
+ test_one "host-certificate"	failure "-n ${USER} -h"
+ test_one "wrong principals"	failure "-n foo"
+-test_one "cert not yet valid"	failure "-n ${USER} -V20200101:20300101"
++test_one "cert not yet valid"	failure "-n ${USER} -V20300101:20320101"
+ test_one "cert expired"		failure "-n ${USER} -V19800101:19900101"
+ test_one "cert valid interval"	success "-n ${USER} -V-1w:+2w"
+ test_one "wrong source-address"	failure "-n ${USER} -Osource-address=10.0.0.0/8"
diff --git a/debian/patches/series b/debian/patches/series
index 580b919..d8dd5ae 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -21,8 +21,26 @@ gnome-ssh-askpass2-icon.patch
 systemd-readiness.patch
 debian-config.patch
 restore-authorized_keys2.patch
+<<<<<<< debian/patches/series
 revert-ipqos-defaults.patch
 maxhostnamelen.patch
 conch-ssh-rsa.patch
 improve-zero-call-used-regs-detection.patch
 sandbox-ppoll_time64.patch
+=======
+seccomp-s390-flock-ipc.patch
+seccomp-getuid-geteuid.patch
+seccomp-s390-ioctl-ep11-crypto.patch
+permitopen-argument-handling.patch
+fix-regress-putty-transfer.patch
+CVE-2018-15473.patch
+CVE-2018-20685.patch
+CVE-2019-6111.patch
+CVE-2019-6109-1.patch
+CVE-2019-6109-2.patch
+CVE-2019-6111-2.patch
+regress-2020.patch
+lp-1863930-unbreak-clients-that-advertise-protocol.patch
+lp-1863930-Fix-logic-bug-in-sshd_exchange_identification.patch
+0001-upstream-preserve-group-world-read-permission-on-kno.patch
+>>>>>>> debian/patches/series