Fix rekeying failure with GSSAPI key exchange (thanks, Harald Barth; closes: #819361).

34 files changed, 71 insertions, 46 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 6f9925b66..a923bac35 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-79d4110c92f82de854b10b2d96df9daaaaeaec3a
-79d4110c92f82de854b10b2d96df9daaaaeaec3a
+3f1016b4535faf6e48aa71e21569aa714a25193f
+3f1016b4535faf6e48aa71e21569aa714a25193f
 971a7653746a6972b907dfe0ce139c06e4a6f482
 971a7653746a6972b907dfe0ce139c06e4a6f482
 openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index a65e90c78..b0e752529 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,6 +6,8 @@ openssh (1:7.4p1-6) UNRELEASED; urgency=medium
   * Document sshd_config changes that may be needed following the removal of
     protocol 1 support from sshd (closes: #851573).
   * Remove ssh_host_dsa_key from HostKey default (closes: #850614).
+  * Fix rekeying failure with GSSAPI key exchange (thanks, Harald Barth;
+    closes: #819361).
 
  -- Colin Watson <cjwatson@debian.org>  Fri, 06 Jan 2017 08:40:14 +0000
 
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index 0f46b253b..cf6febf31 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -1,4 +1,4 @@
-From 46602f789c947e6af524d0b4c9774faf3dd073d0 Mon Sep 17 00:00:00 2001
+From b2b04daa38b264f346acd81e08d224dbf33bac5b Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:02 +0000
 Subject: Quieten logs when multiple from= restrictions are used
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 2bee50ff1..a3306e339 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From 300ba52e4888c6ee488eb8d4cd8fcb9936c420be Mon Sep 17 00:00:00 2001
+From 7ad6dd01af3f4531ccc8e918bc857738e195fd3d Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index afca1f120..874728b02 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From c32eb5bc49794211d9c093694b960480d0f9c6cf Mon Sep 17 00:00:00 2001
+From 2a1aeb898e4214f98acc210c992d33334e6710dd Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index e1555494a..ff3f5f42d 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 624433c4fff092e3aaaff6aa8954eb93e0387c44 Mon Sep 17 00:00:00 2001
+From 2b53482aec037f0747198f19e449f51d921acd30 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index 9bf19dcf8..2e2f9610d 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From 6ba1a4137b4cf1418e2b756f1abae3cc549961ea Mon Sep 17 00:00:00 2001
+From c1248ea6dcbbf5702d65efc1750763f66a97ba19 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 2ab099d96..814d8ad7b 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From b812c38deda716bc94de2aaa99d6e61a2719c822 Mon Sep 17 00:00:00 2001
+From 87e480b4f405f3249d7f8a912849eb6263456353 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch
index 7d053e8ef..14d6ff88d 100644
--- a/debian/patches/doc-upstart.patch
+++ b/debian/patches/doc-upstart.patch
@@ -1,4 +1,4 @@
-From 1bf9a6bfb80250544b8ff1d50c94a4c851d9fb2e Mon Sep 17 00:00:00 2001
+From 7ea8a3c1e0c2ff4998b3fe3caaaba8ff42e513ff Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:12 +0000
 Subject: Refer to ssh's Upstart job as well as its init script
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index f36a851a0..1558dbd8f 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From c5aacd35abd57633871aa81af2e089deb5f72aab Mon Sep 17 00:00:00 2001
+From 0327e9b3a5f6d1e945f1f028e742e14cf5823962 Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index 57def8057..7196d16b6 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -1,4 +1,4 @@
-From 40ab38b3f501f3e21662f0294eef06789605c5f8 Mon Sep 17 00:00:00 2001
+From 48fbb156bdc676fb6ba6817770e4e971fbf85b1f Mon Sep 17 00:00:00 2001
 From: Simon Wilkinson <simon@sxw.org.uk>
 Date: Sun, 9 Feb 2014 16:09:48 +0000
 Subject: GSSAPI key exchange support
@@ -17,7 +17,7 @@ have it merged into the main openssh package rather than having separate
 security history.
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2016-12-28
+Last-Updated: 2017-01-16
 
 Patch-Name: gssapi.patch
 ---
@@ -50,13 +50,13 @@ Patch-Name: gssapi.patch
  ssh-gss.h        |  41 ++++++-
  ssh_config       |   2 +
  ssh_config.5     |  32 ++++++
- sshconnect2.c    | 122 +++++++++++++++++++-
+ sshconnect2.c    | 131 ++++++++++++++++++++-
  sshd.c           | 112 +++++++++++++++++-
  sshd_config      |   2 +
  sshd_config.5    |  10 ++
  sshkey.c         |   3 +-
  sshkey.h         |   1 +
- 35 files changed, 2053 insertions(+), 148 deletions(-)
+ 35 files changed, 2062 insertions(+), 148 deletions(-)
  create mode 100644 ChangeLog.gssapi
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
@@ -2843,7 +2843,7 @@ index 591365f3..a7703fc7 100644
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index 103a2b36..d534e619 100644
+index 103a2b36..c35a0bd5 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
 @@ -162,6 +162,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
@@ -2858,7 +2858,7 @@ index 103a2b36..d534e619 100644
         xxx_host = host;
         xxx_hostaddr = hostaddr;
  
-@@ -192,6 +197,36 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -192,6 +197,35 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
                     order_hostkeyalgs(host, hostaddr, port));
         }
  
@@ -2887,7 +2887,6 @@ index 103a2b36..d534e619 100644
 +                       orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
 +                       xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
 +                           "%s,null", orig);
-+                       free(gss);
 +               }
 +       }
 +#endif
@@ -2895,7 +2894,7 @@ index 103a2b36..d534e619 100644
         if (options.rekey_limit || options.rekey_interval)
                 packet_set_rekey_limits((u_int32_t)options.rekey_limit,
                     (time_t)options.rekey_interval);
-@@ -213,10 +248,26 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -213,15 +247,41 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
  # endif
  #endif
         kex->kex[KEX_C25519_SHA256] = kexc25519_client;
@@ -2922,7 +2921,22 @@ index 103a2b36..d534e619 100644
         dispatch_run(DISPATCH_BLOCK, &kex->done, active_state);
  
         /* remove ext-info from the KEX proposals for rekeying */
-@@ -311,6 +362,7 @@ int input_gssapi_token(int type, u_int32_t, void *);
+        myproposal[PROPOSAL_KEX_ALGS] =
+            compat_kex_proposal(options.kex_algorithms);
++#ifdef GSSAPI
++       /* repair myproposal after it was crumpled by the */
++       /* ext-info removal above */
++       if (gss) {
++               orig = myproposal[PROPOSAL_KEX_ALGS];
++               xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
++                   "%s,%s", gss, orig);
++               free(gss);
++       }
++#endif
+        if ((r = kex_prop2buf(kex->my, myproposal)) != 0)
+                fatal("kex_prop2buf: %s", ssh_err(r));
+ 
+@@ -311,6 +371,7 @@ int input_gssapi_token(int type, u_int32_t, void *);
  int    input_gssapi_hash(int type, u_int32_t, void *);
  int    input_gssapi_error(int, u_int32_t, void *);
  int    input_gssapi_errtok(int, u_int32_t, void *);
@@ -2930,7 +2944,7 @@ index 103a2b36..d534e619 100644
  #endif
  
  void   userauth(Authctxt *, char *);
-@@ -327,6 +379,11 @@ static char *authmethods_get(void);
+@@ -327,6 +388,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -2942,7 +2956,7 @@ index 103a2b36..d534e619 100644
         {"gssapi-with-mic",
                 userauth_gssapi,
                 NULL,
-@@ -652,25 +709,40 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -652,25 +718,40 @@ userauth_gssapi(Authctxt *authctxt)
         static u_int mech = 0;
         OM_uint32 min;
         int ok = 0;
@@ -2985,7 +2999,7 @@ index 103a2b36..d534e619 100644
         if (!ok)
                 return 0;
  
-@@ -761,8 +833,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
+@@ -761,8 +842,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
  {
         Authctxt *authctxt = ctxt;
         Gssctxt *gssctxt;
@@ -2996,7 +3010,7 @@ index 103a2b36..d534e619 100644
  
         if (authctxt == NULL)
                 fatal("input_gssapi_response: no authentication context");
-@@ -875,6 +947,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
+@@ -875,6 +956,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
         free(lang);
         return 0;
  }
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 36497da1d..59b39cd84 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -1,4 +1,4 @@
-From 2336e779d7f90c0574ae8632584d3f9c3e06c4b1 Mon Sep 17 00:00:00 2001
+From 9078d9722d24a42b8f86621d20a6a6b42ba18d37 Mon Sep 17 00:00:00 2001
 From: Richard Kettlewell <rjk@greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:52 +0000
 Subject: Various keepalive extensions
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index b097627b8..4d27c68ab 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From 432a9b5cd1f63c4c1dc678cc0916819bc57280bc Mon Sep 17 00:00:00 2001
+From 360c4ebd14706887879f1c6d542cd092afffb07b Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
diff --git a/debian/patches/no-dsa-host-key-by-default.patch b/debian/patches/no-dsa-host-key-by-default.patch
index cd5bd34a4..bfe6033b1 100644
--- a/debian/patches/no-dsa-host-key-by-default.patch
+++ b/debian/patches/no-dsa-host-key-by-default.patch
@@ -1,4 +1,4 @@
-From 79d4110c92f82de854b10b2d96df9daaaaeaec3a Mon Sep 17 00:00:00 2001
+From 3f1016b4535faf6e48aa71e21569aa714a25193f Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Mon, 16 Jan 2017 13:53:04 +0000
 Subject: Remove ssh_host_dsa_key from HostKey default
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index 495da970f..b1c045643 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From 3dc476595ed1850596f833153fde8ce166ff13f8 Mon Sep 17 00:00:00 2001
+From 48c127fe8f40037d0f33efa8da19cb32514b440e Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index f4cef1af6..9a7edf949 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From 807a8417d6f3c3203024ed8c026a1f79ace12ecb Mon Sep 17 00:00:00 2001
+From 4badfe75ad62ee50394afa9aaac62b3465fd384e Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 678fb551d..fcc231fc9 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From 9d2f9a1fb49b3d3c73a654e1b4aae6e26ad23075 Mon Sep 17 00:00:00 2001
+From c89c88a0bcada4616262e3d7d9b165aca709927b Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index 89c47e308..c19fc46fe 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -1,4 +1,4 @@
-From 466cba7557bc735e09e9b362582ebbc7785cbcd0 Mon Sep 17 00:00:00 2001
+From 71809791262478c78d1db2ca1004604c39db8150 Mon Sep 17 00:00:00 2001
 From: Peter Samuelson <peter@p12n.org>
 Date: Sun, 9 Feb 2014 16:09:55 +0000
 Subject: Reduce severity of "Killed by signal %d"
diff --git a/debian/patches/regress-forwarding-race.patch b/debian/patches/regress-forwarding-race.patch
index 92d13c82c..f1a535fb2 100644
--- a/debian/patches/regress-forwarding-race.patch
+++ b/debian/patches/regress-forwarding-race.patch
@@ -1,4 +1,4 @@
-From d225c4fe44ad94a30a5033e58594f2bebaa674f2 Mon Sep 17 00:00:00 2001
+From 166f04046035ffca27c820649df360eaa5dd1b99 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Mon, 2 Jan 2017 14:55:16 +0000
 Subject: Fix race conditions in forwarding tests
diff --git a/debian/patches/regress-integrity-robust.patch b/debian/patches/regress-integrity-robust.patch
index 92b5ae5fc..651a7a88e 100644
--- a/debian/patches/regress-integrity-robust.patch
+++ b/debian/patches/regress-integrity-robust.patch
@@ -1,4 +1,4 @@
-From ada7edd8b4ec246a0c1c283c5e5956f09d503fbd Mon Sep 17 00:00:00 2001
+From 7ce93c802065cd926e7cbfd10e629f3a2d352301 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 1 Jan 2017 15:21:10 +0000
 Subject: Make integrity tests more robust against timeouts
diff --git a/debian/patches/regress-mktemp.patch b/debian/patches/regress-mktemp.patch
index 2d9b436f5..f5cfde1e8 100644
--- a/debian/patches/regress-mktemp.patch
+++ b/debian/patches/regress-mktemp.patch
@@ -1,4 +1,4 @@
-From cc50ca70e3b438577c33a85147e2a68666deaad9 Mon Sep 17 00:00:00 2001
+From 6ca09916439a58f0789deb79960ee5defc05a946 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 3 Jan 2017 12:09:42 +0000
 Subject: Create mux socket for regress in temp directory
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch
index dc9fec5fd..ec958d3ab 100644
--- a/debian/patches/restore-tcp-wrappers.patch
+++ b/debian/patches/restore-tcp-wrappers.patch
@@ -1,4 +1,4 @@
-From 10d7583287f2d589da0786819e62a0be5ec9847f Mon Sep 17 00:00:00 2001
+From 5488e924267d7a845fb86a0b6b4db1e340799a5a Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 7 Oct 2014 13:22:41 +0100
 Subject: Restore TCP wrappers support
diff --git a/debian/patches/sandbox-x32-workaround.patch b/debian/patches/sandbox-x32-workaround.patch
index 9fabaecfa..340363de9 100644
--- a/debian/patches/sandbox-x32-workaround.patch
+++ b/debian/patches/sandbox-x32-workaround.patch
@@ -1,4 +1,4 @@
-From e346421ca6852fbf9f95cf0e764ecc345e5ce21d Mon Sep 17 00:00:00 2001
+From 8c1a0893f0e55a793071af9734d2fa2eb1f3a2a6 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 3 Jan 2017 14:01:56 +0000
 Subject: Work around clock_gettime kernel bug on Linux x32
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index 7aa44ac8f..f318c49fb 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From 5362ffb871dbb4ca9f19f25756eee0a88cd177e8 Mon Sep 17 00:00:00 2001
+From cfc11fb9604f8049957a409ff0835f642a047496 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index a09f8c82d..98be50fad 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -1,4 +1,4 @@
-From ef3ee35a1061c563f2c32ab13f77324b6372e8be Mon Sep 17 00:00:00 2001
+From a01822fe1c50668ef7918dfd28b1c7e88ff16254 Mon Sep 17 00:00:00 2001
 From: Manoj Srivastava <srivasta@debian.org>
 Date: Sun, 9 Feb 2014 16:09:49 +0000
 Subject: Handle SELinux authorisation roles
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 7e522ff17..c263dd7f1 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From fa35a4226bf7f9e4c3fa6b6be06d1a38a58bd162 Mon Sep 17 00:00:00 2001
+From 5ec0d5f79166a7e2aeab5c7f13d64bb08c4621bd Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
index 7a62bce5e..fa4d0a8cc 100644
--- a/debian/patches/sigstop.patch
+++ b/debian/patches/sigstop.patch
@@ -1,4 +1,4 @@
-From 78a2f42f1ae8a81e2a229405273b2c1369667b5c Mon Sep 17 00:00:00 2001
+From 218ecbc433b69b8584000380626a9d9aa31c095b Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:17 +0000
 Subject: Support synchronisation with service supervisor using SIGSTOP
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index f61725049..b14ec01d4 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 76b2e45116ded18137a30406cf5f22b11b9feeab Mon Sep 17 00:00:00 2001
+From 0ae30d0171b789953318670ac8679127ddfb3cd1 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 5ea2fb243..7fbaa25dd 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From e11b941efd85f5b55c055eb11511c7bbb6464b5f Mon Sep 17 00:00:00 2001
+From e39339d49d1b05e1db45c6420d7e6da29cf483dc Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index 2398598f5..fbe64336b 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -1,4 +1,4 @@
-From 8bdb2e6f613ad62c3aa781ba6cb7088ee16a6dfd Mon Sep 17 00:00:00 2001
+From ffecece153b7caedf997dccf17747633675631fd Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:50 +0000
 Subject: Accept obsolete ssh-vulnkey configuration options
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index a8eeb7ebc..7a4839c03 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -1,4 +1,4 @@
-From ed3f2695800c03da18c36191aefd27d554bf052e Mon Sep 17 00:00:00 2001
+From f4d9efefeae948e1e00212bf9702245c3c51c8c5 Mon Sep 17 00:00:00 2001
 From: Jonathan David Amery <jdamery@ysolde.ucam.org>
 Date: Sun, 9 Feb 2014 16:09:54 +0000
 Subject: "LogLevel SILENT" compatibility
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
index a5a543596..6c8cf9b6d 100644
--- a/debian/patches/systemd-readiness.patch
+++ b/debian/patches/systemd-readiness.patch
@@ -1,4 +1,4 @@
-From a7e11f49e8d6dfe6b44b24960af5e112cd953ae7 Mon Sep 17 00:00:00 2001
+From 0fd4134a3ef467e1e69db5b19b7903cf306ec64b Mon Sep 17 00:00:00 2001
 From: Michael Biebl <biebl@debian.org>
 Date: Mon, 21 Dec 2015 16:08:47 +0000
 Subject: Add systemd readiness notification support
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index ee5c38c23..2e32f9d76 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From 5ba9e0eff0a725c4d616f296c6449fe3dbe0bdcf Mon Sep 17 00:00:00 2001
+From c20ad02ad58a523c6f4974e1ca124e71b7b801b1 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability
diff --git a/sshconnect2.c b/sshconnect2.c
index d534e6190..c35a0bd50 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -222,7 +222,6 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
                         orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
                         xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
                             "%s,null", orig);
-                        free(gss);
                 }
         }
 #endif
@@ -273,6 +272,16 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
         /* remove ext-info from the KEX proposals for rekeying */
         myproposal[PROPOSAL_KEX_ALGS] =
             compat_kex_proposal(options.kex_algorithms);
+#ifdef GSSAPI
+        /* repair myproposal after it was crumpled by the */
+        /* ext-info removal above */
+        if (gss) {
+                orig = myproposal[PROPOSAL_KEX_ALGS];
+                xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
+                    "%s,%s", gss, orig);
+                free(gss);
+        }
+#endif
         if ((r = kex_prop2buf(kex->my, myproposal)) != 0)
                 fatal("kex_prop2buf: %s", ssh_err(r));