diff -ur '--exclude=.*.un~' '--exclude=*.rej' '--exclude=*.orig' a/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff b/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff
--- a/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff	2024-02-06 14:35:08.616169052 -0800
+++ b/openssh-8_5_P1-hpn-DynWinNoneSwitch-15.2.diff	2024-02-06 14:43:41.333312099 -0800
@@ -269,7 +269,7 @@
  
  		/* Allocate a channel number for the socket. */
 +		/* explicitly test for hpn disabled option. if true use smaller window size */
- 		c = channel_new(ssh, "port listener", type, sock, sock, -1,
+ 		c = channel_new(ssh, "port-listener", type, sock, sock, -1,
 -		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
 -		    0, "port listener", 1);
 +				hpn_disabled ? CHAN_TCP_WINDOW_DEFAULT : hpn_buffer_size,
@@ -341,10 +341,10 @@
  	sock = x11_connect_display(ssh);
  	if (sock < 0)
  		return NULL;
--	c = channel_new(ssh, "x11",
+-	c = channel_new(ssh, "x11-connection",
 -	    SSH_CHANNEL_X11_OPEN, sock, sock, -1,
 -	    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
-+        c = channel_new(ssh, "x11",
++        c = channel_new(ssh, "x11-connection",
 +			SSH_CHANNEL_X11_OPEN, sock, sock, -1,
 +			/* again is this really necessary for X11? */
 +			options.hpn_disabled ? CHAN_TCP_WINDOW_DEFAULT : options.hpn_buffer_size,
@@ -353,9 +353,9 @@
  	return c;
  }
 @@ -1608,9 +1610,10 @@ client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
- 		return NULL;
- 	}
- 	c = channel_new(ssh, "authentication agent connection",
+ 		debug2_fr(r, "ssh_agent_bind_hostkey");
+ 
+ 	c = channel_new(ssh, "agent-connection",
 -	    SSH_CHANNEL_OPEN, sock, sock, -1,
 -	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
 -	    "authentication agent connection", 1);
@@ -370,9 +370,9 @@
  	}
  	debug("Tunnel forwarding using interface %s", ifname);
  
--	c = channel_new(ssh, "tun", SSH_CHANNEL_OPENING, fd, fd, -1,
+-	c = channel_new(ssh, "tun-connection", SSH_CHANNEL_OPENING, fd, fd, -1,
 -	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
-+        c = channel_new(ssh, "tun", SSH_CHANNEL_OPENING, fd, fd, -1,
++        c = channel_new(ssh, "tun-connection", SSH_CHANNEL_OPENING, fd, fd, -1,
 +	    options.hpn_disabled ? CHAN_TCP_WINDOW_DEFAULT : options.hpn_buffer_size,
 +	    CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
  	c->datagram = 1;
@@ -536,18 +536,10 @@
  	if (state->rekey_limit)
  		*max_blocks = MINIMUM(*max_blocks,
  		    state->rekey_limit / enc->block_size);
-@@ -954,6 +963,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+@@ -954,6 +963,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
  	return 0;
  }
  
-+/* this supports the forced rekeying required for the NONE cipher */
-+int rekey_requested = 0;
-+void
-+packet_request_rekeying(void)
-+{
-+	rekey_requested = 1;
-+}
-+
 +/* used to determine if pre or post auth when rekeying for aes-ctr
 + * and none cipher switch */
 +int
@@ -561,27 +553,14 @@
  #define MAX_PACKETS	(1U<<31)
  static int
  ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
-@@ -980,6 +1007,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
- 	if (state->p_send.packets == 0 && state->p_read.packets == 0)
- 		return 0;
- 
-+	/* used to force rekeying when called for by the none
-+         * cipher switch methods -cjr */
-+        if (rekey_requested == 1) {
-+                rekey_requested = 0;
-+                return 1;
-+        }
-+
- 	/* Time-based rekeying */
- 	if (state->rekey_interval != 0 &&
- 	    (int64_t)state->rekey_time + state->rekey_interval <= monotime())
-@@ -1317,7 +1351,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+@@ -1317,8 +1336,8 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
  	struct session_state *state = ssh->state;
- 	int len, r, ms_remain;
- 	fd_set *setp;
+ 	int len, r, ms_remain = 0;
+ 	struct pollfd pfd;
 -	char buf[8192];
 +	char buf[SSH_IOBUFSZ];
- 	struct timeval timeout, start, *timeoutp = NULL;
+ 	struct timeval start;
+ 	struct timespec timespec, *timespecp = NULL;
  
  	DBG(debug("packet_read()"));
 diff --git a/packet.h b/packet.h
@@ -598,12 +577,11 @@
  };
  
  typedef int (ssh_packet_hook_fn)(struct ssh *, struct sshbuf *,
-@@ -155,6 +158,10 @@ int	 ssh_packet_inc_alive_timeouts(struct ssh *);
+@@ -155,6 +158,9 @@ int	 ssh_packet_inc_alive_timeouts(struct ssh *);
  int	 ssh_packet_set_maxsize(struct ssh *, u_int);
  u_int	 ssh_packet_get_maxsize(struct ssh *);
  
 +/* for forced packet rekeying post auth */
-+void	 packet_request_rekeying(void);
 +int	 packet_authentication_state(const struct ssh *);
 +
  int	 ssh_packet_get_state(struct ssh *, struct sshbuf *);
@@ -621,7 +599,7 @@
  
  /* Format of the configuration file:
  
-@@ -166,6 +167,8 @@ typedef enum {
+@@ -166,5 +167,7 @@ typedef enum {
  	oHashKnownHosts,
  	oTunnel, oTunnelDevice,
  	oLocalCommand, oPermitLocalCommand, oRemoteCommand,
@@ -629,7 +607,6 @@
 +	oNoneEnabled, oNoneMacEnabled, oNoneSwitch,
  	oVisualHostKey,
  	oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
- 	oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
 @@ -297,6 +300,9 @@ static struct {
  	{ "kexalgorithms", oKexAlgorithms },
  	{ "ipqos", oIPQoS },
@@ -637,9 +614,9 @@
 +	{ "noneenabled", oNoneEnabled },
 +	{ "nonemacenabled", oNoneMacEnabled },
 +	{ "noneswitch", oNoneSwitch },
- 	{ "proxyusefdpass", oProxyUseFdpass },
- 	{ "canonicaldomains", oCanonicalDomains },
- 	{ "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
+ 	{ "sessiontype", oSessionType },
+ 	{ "stdinnull", oStdinNull },
+ 	{ "forkafterauthentication", oForkAfterAuthentication },
 @@ -317,6 +323,11 @@ static struct {
  	{ "securitykeyprovider", oSecurityKeyProvider },
  	{ "knownhostscommand", oKnownHostsCommand },
@@ -717,9 +694,9 @@
 +	options->hpn_buffer_size = -1;
 +	options->tcp_rcv_buf_poll = -1;
 +	options->tcp_rcv_buf = -1;
- 	options->proxy_use_fdpass = -1;
- 	options->ignored_unknown = NULL;
- 	options->num_canonical_domains = 0;
+ 	options->session_type = -1;
+ 	options->stdin_null = -1;
+ 	options->fork_after_authentication = -1;
 @@ -2426,6 +2484,41 @@ fill_default_options(Options * options)
  		options->server_alive_interval = 0;
  	if (options->server_alive_count_max == -1)
@@ -975,15 +952,6 @@
 index 306658cb..d4309903 100644
 --- a/serverloop.c
 +++ b/serverloop.c
-@@ -322,7 +322,7 @@ static int
- process_input(struct ssh *ssh, fd_set *readset, int connection_in)
- {
- 	int r, len;
--	char buf[16384];
-+	char buf[SSH_IOBUFSZ];
- 
- 	/* Read and buffer any input data from the client. */
- 	if (FD_ISSET(connection_in, readset)) {
 @@ -608,7 +608,8 @@ server_request_tun(struct ssh *ssh)
  	debug("Tunnel forwarding using interface %s", ifname);
  
@@ -1012,7 +980,7 @@
  
  	/* Allocate a channel for the authentication agent socket. */
 +	/* this shouldn't matter if its hpn or not - cjr */
- 	nc = channel_new(ssh, "auth socket",
+ 	nc = channel_new(ssh, "auth-listener",
  	    SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
  	    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
 @@ -2250,10 +2251,11 @@ session_set_fds(struct ssh *ssh, Session *s,
@@ -1047,30 +1015,17 @@
  Note that
 diff --git a/sftp.c b/sftp.c
 index fb3c08d1..89bebbb2 100644
---- a/sftp.c
-+++ b/sftp.c
-@@ -71,7 +71,7 @@ typedef void EditLine;
- #include "sftp-client.h"
- 
- #define DEFAULT_COPY_BUFLEN	32768	/* Size of buffer for up/download */
--#define DEFAULT_NUM_REQUESTS	64	/* # concurrent outstanding requests */
-+#define DEFAULT_NUM_REQUESTS	256	/* # concurrent outstanding requests */
- 
- /* File to read commands from */
- FILE* infile;
-diff --git a/ssh-keygen.c b/ssh-keygen.c
-index cfb5f115..36a6e519 100644
---- a/ssh-keygen.c
-+++ b/ssh-keygen.c
-@@ -2971,7 +2971,7 @@ do_download_sk(const char *skprovider, const char *device)
- 			freezero(pin, strlen(pin));
- 		error_r(r, "Unable to load resident keys");
- 		return -1;
--	}
-+ 	}
- 	if (nkeys == 0)
- 		logit("No keys to download");
- 	if (pin != NULL)
+--- a/sftp-client.c
++++ b/sftp-client.c
+@@ -65,7 +65,7 @@ typedef void EditLine;
+ #define DEFAULT_COPY_BUFLEN	32768
+ 
+ /* Default number of concurrent xfer requests (fix sftp.1 scp.1 if changed) */
+-#define DEFAULT_NUM_REQUESTS	64
++#define DEFAULT_NUM_REQUESTS	256
+ 
+ /* Minimum amount of data to read at a time */
+ #define MIN_READ_SIZE	512
 diff --git a/ssh.c b/ssh.c
 index 53330da5..27b9770e 100644
 --- a/ssh.c
@@ -1266,7 +1221,19 @@
 index 059c9480..2a18d8e1 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -85,6 +85,13 @@ extern char *client_version_string;
+diff --git a/sshconnect2.c b/sshconnect2.c
+index bc05f0214..c460648b8 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -74,6 +74,7 @@
+ #include "utf8.h"
+ #include "ssh-sk.h"
+ #include "sk-api.h"
++#include "myproposal.h"
+
+ #ifdef GSSAPI
+ #include "ssh-gss.h"
+@@ -85,6 +86,13 @@ extern char *client_version_string;
  extern char *server_version_string;
  extern Options options;
  
@@ -1298,7 +1265,7 @@
  	xxx_host = host;
  	xxx_hostaddr = hostaddr;
  	xxx_conn_info = cinfo;
-@@ -489,6 +500,34 @@ ssh_userauth2(struct ssh *ssh, const char *local_user,
+@@ -489,6 +500,33 @@ ssh_userauth2(struct ssh *ssh, const char *local_user,
  
  	if (!authctxt.success)
  		fatal("Authentication failed.");
@@ -1322,7 +1289,6 @@
 +				fprintf(stderr, "WARNING: ENABLED NONE MAC\n");
 +			}
 +			kex_prop2buf(ssh->kex->my, myproposal);
-+			packet_request_rekeying();
 +		} else {
 +			/* requested NONE cipher when in a tty */
 +			debug("Cannot switch to NONE cipher with tty allocated");
@@ -1330,9 +1296,9 @@
 +		}
 +	}
 +
- 	debug("Authentication succeeded (%s).", authctxt.method->name);
- }
- 
+ 	if (ssh_packet_connection_is_on_socket(ssh)) {
+ 		verbose("Authenticated to %s ([%s]:%d) using \"%s\".", host,
+ 		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
 diff --git a/sshd.c b/sshd.c
 index 6277e6d6..d66fa41a 100644
 --- a/sshd.c
@@ -1359,8 +1325,8 @@
  		if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) == -1) {
  			error("Bind to port %s on %s failed: %.200s.",
 @@ -1727,6 +1734,19 @@ main(int ac, char **av)
- 	/* Fill in default values for those options not explicitly set. */
- 	fill_default_server_options(&options);
+ 		fatal("AuthorizedPrincipalsCommand set without "
+ 		    "AuthorizedPrincipalsCommandUser");
  
 +	if (options.none_enabled == 1) {
 +		char *old_ciphers = options.ciphers;
@@ -1375,9 +1341,9 @@
 +		}
 +	}
 +
- 	/* challenge-response is implemented via keyboard interactive */
- 	if (options.challenge_response_authentication)
- 		options.kbd_interactive_authentication = 1;
+ 	/*
+ 	 * Check whether there is any path through configured auth methods.
+ 	 * Unfortunately it is not possible to verify this generally before
 @@ -2166,6 +2186,9 @@ main(int ac, char **av)
  	    rdomain == NULL ? "" : "\"");
  	free(laddr);
@@ -1398,9 +1364,9 @@
 +	if (options.nonemac_enabled == 1)
 +		debug("WARNING: None MAC enabled");
 +	
- 	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(ssh,
- 	    options.kex_algorithms);
- 	myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal(ssh,
+ 	if (options.rekey_limit || options.rekey_interval)
+ 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+ 		    options.rekey_interval);
 diff --git a/sshd_config b/sshd_config
 index 19b7c91a..cdd889b2 100644
 --- a/sshd_config
@@ -1428,14 +1394,3 @@
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
  #	X11Forwarding no
-diff --git a/version.h b/version.h
-index 6b4fa372..332fb486 100644
---- a/version.h
-+++ b/version.h
-@@ -3,4 +3,5 @@
- #define SSH_VERSION	"OpenSSH_8.5"
- 
- #define SSH_PORTABLE	"p1"
--#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
-+#define SSH_HPN         "-hpn15v2"
-+#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
diff -ur '--exclude=.*.un~' '--exclude=*.rej' '--exclude=*.orig' a/openssh-8_5_P1-hpn-PeakTput-15.2.diff b/openssh-8_5_P1-hpn-PeakTput-15.2.diff
--- a/openssh-8_5_P1-hpn-PeakTput-15.2.diff	2024-02-06 14:35:08.616169052 -0800
+++ b/openssh-8_5_P1-hpn-PeakTput-15.2.diff	2024-02-06 14:35:41.225360690 -0800
@@ -14,7 +14,7 @@
 @@ -127,6 +129,7 @@ refresh_progress_meter(int force_update)
  	int cur_speed;
  	int hours, minutes, seconds;
- 	int file_len;
+ 	int file_len, cols;
 +	off_t delta_pos;
  
  	if ((!force_update && !alarm_fired && !win_resized) || !can_output())
@@ -30,39 +30,36 @@
  	if (bytes_left > 0)
  		elapsed = now - last_update;
  	else {
-@@ -166,7 +173,7 @@ refresh_progress_meter(int force_update)
+@@ -171,13 +178,14 @@ refresh_progress_meter(int force_update)
+ 		bytes_per_second = cur_speed;
+ 
+ 	last_update = now;
++	last_pos = cur_pos;
+ 
+ 	/* Don't bother if we can't even display the completion percentage */
+ 	if (win_size < 4)
+ 		return;
  
  	/* filename */
- 	buf[0] = '\0';
--	file_len = win_size - 36;
-+	file_len = win_size - 45;
+-	file_len = cols = win_size - 36;
++	file_len = cols = win_size - 45;
  	if (file_len > 0) {
- 		buf[0] = '\r';
- 		snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s",
-@@ -191,6 +198,15 @@ refresh_progress_meter(int force_update)
+ 		asmprintf(&buf, INT_MAX, &cols, "%-*s", file_len, file);
+ 		/* If we used fewer columns than expected then pad */
+@@ -191,6 +198,13 @@ refresh_progress_meter(int force_update)
  	    (off_t)bytes_per_second);
  	strlcat(buf, "/s ", win_size);
  
 +	/* instantaneous rate */
 +	if (bytes_left > 0)
-+		format_rate(buf + strlen(buf), win_size - strlen(buf),
-+			    delta_pos);
++		format_rate((off_t)delta_pos);
 +	else
-+		format_rate(buf + strlen(buf), win_size - strlen(buf),
-+			    max_delta_pos);
++		format_rate((off_t)max_delta_pos);
 +	strlcat(buf, "/s ", win_size);
 +
  	/* ETA */
  	if (!transferred)
  		stalled += elapsed;
-@@ -227,6 +243,7 @@ refresh_progress_meter(int force_update)
- 
- 	atomicio(vwrite, STDOUT_FILENO, buf, win_size - 1);
- 	last_update = now;
-+	last_pos = cur_pos;
- }
- 
- /*ARGSUSED*/
 diff --git a/ssh-keygen.c b/ssh-keygen.c
 index cfb5f115..986ff59b 100644
 --- a/ssh-keygen.c
