File openssh-cve-2025-32728.patch of Package openssh.38179

From fc86875e6acb36401dfc1dfb6b628a9d1460f367 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Wed, 9 Apr 2025 07:00:03 +0000
Subject: [PATCH] upstream: Fix logic error in DisableForwarding option. This
 option

was documented as disabling X11 and agent forwarding but it failed to do so.
Spotted by Tim Rice.

OpenBSD-Commit-ID: fffc89195968f7eedd2fc57f0b1f1ef3193f5ed1
---
 session.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Index: openssh-8.4p1/session.c
===================================================================
--- openssh-8.4p1.orig/session.c
+++ openssh-8.4p1/session.c
@@ -2289,7 +2289,8 @@ session_auth_agent_req(struct ssh *ssh,
 	if ((r = sshpkt_get_end(ssh)) != 0)
 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
 	if (!auth_opts->permit_agent_forwarding_flag ||
-	    !options.allow_agent_forwarding) {
+	    !options.allow_agent_forwarding ||
+	    options.disable_forwarding) {
 		debug("%s: agent forwarding disabled", __func__);
 		return 0;
 	}
@@ -2735,7 +2736,7 @@ session_setup_x11fwd(struct ssh *ssh, Se
 		ssh_packet_send_debug(ssh, "X11 forwarding disabled by key options.");
 		return 0;
 	}
-	if (!options.x11_forwarding) {
+	if (!options.x11_forwarding || options.disable_forwarding) {
 		debug("X11 forwarding disabled in server configuration file.");
 		return 0;
 	}