Avoid calling into Kerberos libraries from ssh_gssapi_server_mechanisms in the privsep monitor.

30 files changed, 68 insertions, 59 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 7a3e2e900..252076632 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-41265d4fa6f5946719155a08a19717a4ca229454
-41265d4fa6f5946719155a08a19717a4ca229454
+624433c4fff092e3aaaff6aa8954eb93e0387c44
+624433c4fff092e3aaaff6aa8954eb93e0387c44
 971a7653746a6972b907dfe0ce139c06e4a6f482
 971a7653746a6972b907dfe0ce139c06e4a6f482
 openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 3e93967b2..1752adb3d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,8 @@ openssh (1:7.4p1-2) UNRELEASED; urgency=medium
 
   * Attempt to hack around regress/forwarding.sh test failure in some
     environments.
+  * Avoid calling into Kerberos libraries from ssh_gssapi_server_mechanisms
+    in the privsep monitor.
 
  -- Colin Watson <cjwatson@debian.org>  Wed, 28 Dec 2016 19:46:57 +0000
 
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index d025cf7eb..0f46b253b 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -1,4 +1,4 @@
-From f7088f0a3d04473cfdcf11fe6b084b81beb7041c Mon Sep 17 00:00:00 2001
+From 46602f789c947e6af524d0b4c9774faf3dd073d0 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:02 +0000
 Subject: Quieten logs when multiple from= restrictions are used
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index dcfd8b403..2bee50ff1 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From 0290fd6980eaefa222cc39b6a4871be0a8c72a7d Mon Sep 17 00:00:00 2001
+From 300ba52e4888c6ee488eb8d4cd8fcb9936c420be Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 20ceefe9c..afca1f120 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From 541f4f5664934bccc96a9b7a2a7e957ce2cff6af Mon Sep 17 00:00:00 2001
+From c32eb5bc49794211d9c093694b960480d0f9c6cf Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
@@ -80,7 +80,7 @@ index 90dfa4c2..913a21b3 100644
  
  /* Information about the incoming connection as used by Match */
 diff --git a/sshd.c b/sshd.c
-index 39e4699c..747beec8 100644
+index 49f3a2e5..eebf1984 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -378,7 +378,8 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 9b46e1392..e1555494a 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 41265d4fa6f5946719155a08a19717a4ca229454 Mon Sep 17 00:00:00 2001
+From 624433c4fff092e3aaaff6aa8954eb93e0387c44 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index 18a16fb6d..9bf19dcf8 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From de4a8d3eaf773015b6d725c9c682430325a14b0e Mon Sep 17 00:00:00 2001
+From 6ba1a4137b4cf1418e2b756f1abae3cc549961ea Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 76f9ae4f9..2ab099d96 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From 934c9a5c1689c7ce4b78dee3f65c30f53e41ec81 Mon Sep 17 00:00:00 2001
+From b812c38deda716bc94de2aaa99d6e61a2719c822 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch
index 54f99e662..7d053e8ef 100644
--- a/debian/patches/doc-upstart.patch
+++ b/debian/patches/doc-upstart.patch
@@ -1,4 +1,4 @@
-From c8d763aeef5f450e55172ff2374e0b9abb3f08a9 Mon Sep 17 00:00:00 2001
+From 1bf9a6bfb80250544b8ff1d50c94a4c851d9fb2e Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:12 +0000
 Subject: Refer to ssh's Upstart job as well as its init script
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index ec7647c6d..f36a851a0 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From 7e6bb45ce4ead0e3256d1741e0020bc5d4e6a09b Mon Sep 17 00:00:00 2001
+From c5aacd35abd57633871aa81af2e089deb5f72aab Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index ea56167d7..57def8057 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -1,4 +1,4 @@
-From 9f717de15a8e113f7c6a3db52d75ce0172885f95 Mon Sep 17 00:00:00 2001
+From 40ab38b3f501f3e21662f0294eef06789605c5f8 Mon Sep 17 00:00:00 2001
 From: Simon Wilkinson <simon@sxw.org.uk>
 Date: Sun, 9 Feb 2014 16:09:48 +0000
 Subject: GSSAPI key exchange support
@@ -17,7 +17,7 @@ have it merged into the main openssh package rather than having separate
 security history.
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2016-08-07
+Last-Updated: 2016-12-28
 
 Patch-Name: gssapi.patch
 ---
@@ -34,7 +34,7 @@ Patch-Name: gssapi.patch
  configure.ac     |  24 ++++
  gss-genr.c       | 275 +++++++++++++++++++++++++++++++++++++++++++-
  gss-serv-krb5.c  |  85 ++++++++++++--
- gss-serv.c       | 185 +++++++++++++++++++++++++++---
+ gss-serv.c       | 184 +++++++++++++++++++++++++++---
  kex.c            |  19 ++++
  kex.h            |  14 +++
  kexgssc.c        | 338 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
@@ -51,12 +51,12 @@ Patch-Name: gssapi.patch
  ssh_config       |   2 +
  ssh_config.5     |  32 ++++++
  sshconnect2.c    | 122 +++++++++++++++++++-
- sshd.c           | 110 ++++++++++++++++++
+ sshd.c           | 112 +++++++++++++++++-
  sshd_config      |   2 +
  sshd_config.5    |  10 ++
  sshkey.c         |   3 +-
  sshkey.h         |   1 +
- 35 files changed, 2053 insertions(+), 147 deletions(-)
+ 35 files changed, 2053 insertions(+), 148 deletions(-)
  create mode 100644 ChangeLog.gssapi
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
@@ -1162,7 +1162,7 @@ index 795992d9..fd8b3718 100644
  
  #endif /* KRB5 */
 diff --git a/gss-serv.c b/gss-serv.c
-index 53993d67..2f6baf70 100644
+index 53993d67..2e27cbf9 100644
 --- a/gss-serv.c
 +++ b/gss-serv.c
 @@ -1,7 +1,7 @@
@@ -1199,17 +1199,16 @@ index 53993d67..2f6baf70 100644
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -142,6 +147,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+@@ -142,6 +147,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
  }
  
  /* Unprivileged */
 +char *
 +ssh_gssapi_server_mechanisms(void) {
-+       gss_OID_set     supported;
-+
-+       ssh_gssapi_supported_oids(&supported);
-+       return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,
-+           NULL, NULL));
++       if (supported_oids == NULL)
++               ssh_gssapi_prepare_supported_oids();
++       return (ssh_gssapi_kex_mechs(supported_oids,
++           &ssh_gssapi_server_check_mech, NULL, NULL));
 +}
 +
 +/* Unprivileged */
@@ -1229,7 +1228,7 @@ index 53993d67..2f6baf70 100644
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
  {
-@@ -151,7 +179,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
+@@ -151,7 +178,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
         gss_OID_set supported;
  
         gss_create_empty_oid_set(&min_status, oidset);
@@ -1240,7 +1239,7 @@ index 53993d67..2f6baf70 100644
  
         while (supported_mechs[i]->name != NULL) {
                 if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -277,8 +307,48 @@ OM_uint32
+@@ -277,8 +306,48 @@ OM_uint32
  ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  {
         int i = 0;
@@ -1290,7 +1289,7 @@ index 53993d67..2f6baf70 100644
  
         client->mech = NULL;
  
-@@ -293,6 +363,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -293,6 +362,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
         if (client->mech == NULL)
                 return GSS_S_FAILURE;
  
@@ -1304,7 +1303,7 @@ index 53993d67..2f6baf70 100644
         if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
             &client->displayname, NULL))) {
                 ssh_gssapi_error(ctx);
-@@ -310,6 +387,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -310,6 +386,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
                 return (ctx->major);
         }
  
@@ -1313,7 +1312,7 @@ index 53993d67..2f6baf70 100644
         /* We can't copy this structure, so we just move the pointer to it */
         client->creds = ctx->client_creds;
         ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -357,7 +436,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+@@ -357,7 +435,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
  
  /* Privileged */
  int
@@ -1322,7 +1321,7 @@ index 53993d67..2f6baf70 100644
  {
         OM_uint32 lmin;
  
-@@ -367,9 +446,11 @@ ssh_gssapi_userok(char *user)
+@@ -367,9 +445,11 @@ ssh_gssapi_userok(char *user)
                 return 0;
         }
         if (gssapi_client.mech && gssapi_client.mech->userok)
@@ -1336,7 +1335,7 @@ index 53993d67..2f6baf70 100644
                         /* Destroy delegated credentials if userok fails */
                         gss_release_buffer(&lmin, &gssapi_client.displayname);
                         gss_release_buffer(&lmin, &gssapi_client.exportedname);
-@@ -383,14 +464,90 @@ ssh_gssapi_userok(char *user)
+@@ -383,14 +463,90 @@ ssh_gssapi_userok(char *user)
         return (0);
  }
  
@@ -3047,7 +3046,7 @@ index 103a2b36..d534e619 100644
  
  int
 diff --git a/sshd.c b/sshd.c
-index 1dc4d182..ec2cf976 100644
+index 1dc4d182..0970f297 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -123,6 +123,10 @@
@@ -3061,6 +3060,15 @@ index 1dc4d182..ec2cf976 100644
  /* Re-exec fds */
  #define REEXEC_DEVCRYPTO_RESERVED_FD   (STDERR_FILENO + 1)
  #define REEXEC_STARTUP_PIPE_FD         (STDERR_FILENO + 2)
+@@ -531,7 +535,7 @@ privsep_preauth_child(void)
+ 
+ #ifdef GSSAPI
+        /* Cache supported mechanism OIDs for later use */
+-       if (options.gss_authentication)
++       if (options.gss_authentication || options.gss_keyex)
+                ssh_gssapi_prepare_supported_oids();
+ #endif
+ 
 @@ -1705,10 +1709,13 @@ main(int ac, char **av)
                     key ? "private" : "agent", i, sshkey_ssh_name(pubkey), fp);
                 free(fp);
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 4db3caa5a..36497da1d 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -1,4 +1,4 @@
-From 0bdc6351d8a32c33e65542617c71da8ddcdeb331 Mon Sep 17 00:00:00 2001
+From 2336e779d7f90c0574ae8632584d3f9c3e06c4b1 Mon Sep 17 00:00:00 2001
 From: Richard Kettlewell <rjk@greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:52 +0000
 Subject: Various keepalive extensions
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 0cfee84e5..b097627b8 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From 04923a79cca487e1295685638a6113dbe5ec54bd Mon Sep 17 00:00:00 2001
+From 432a9b5cd1f63c4c1dc678cc0916819bc57280bc Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index af5caaa99..495da970f 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From 85a592345eb1c86e918f08643b8b48aee69aec63 Mon Sep 17 00:00:00 2001
+From 3dc476595ed1850596f833153fde8ce166ff13f8 Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index 50f5db1ae..f4cef1af6 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From f16966d39a328b5f6461343d088f863c8cf2a2d4 Mon Sep 17 00:00:00 2001
+From 807a8417d6f3c3203024ed8c026a1f79ace12ecb Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 0b46869c9..678fb551d 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From bfc81c7380b71bd5c0e841e8bd16bfc726a43603 Mon Sep 17 00:00:00 2001
+From 9d2f9a1fb49b3d3c73a654e1b4aae6e26ad23075 Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
@@ -36,7 +36,7 @@ index 1cc556e8..c64c51bb 100644
         if (atomicio(vwrite, connection_out, client_version_string,
             strlen(client_version_string)) != strlen(client_version_string))
 diff --git a/sshd.c b/sshd.c
-index 5a3f796d..39e4699c 100644
+index 9aab36c3..49f3a2e5 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -378,7 +378,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index ab94faecc..89c47e308 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -1,4 +1,4 @@
-From 68d399525871ecd1a2837f04045581a2774ba4bb Mon Sep 17 00:00:00 2001
+From 466cba7557bc735e09e9b362582ebbc7785cbcd0 Mon Sep 17 00:00:00 2001
 From: Peter Samuelson <peter@p12n.org>
 Date: Sun, 9 Feb 2014 16:09:55 +0000
 Subject: Reduce severity of "Killed by signal %d"
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch
index e41b99d6e..dc9fec5fd 100644
--- a/debian/patches/restore-tcp-wrappers.patch
+++ b/debian/patches/restore-tcp-wrappers.patch
@@ -1,4 +1,4 @@
-From 6a15c9b672c5833f21ed7e0cea3a25dd8de966c4 Mon Sep 17 00:00:00 2001
+From 10d7583287f2d589da0786819e62a0be5ec9847f Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 7 Oct 2014 13:22:41 +0100
 Subject: Restore TCP wrappers support
@@ -128,7 +128,7 @@ index 41fc5051..c6784602 100644
  .Xr moduli 5 ,
  .Xr sshd_config 5 ,
 diff --git a/sshd.c b/sshd.c
-index ec2cf976..4f791b92 100644
+index 0970f297..72d85de1 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -127,6 +127,13 @@
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index aad0e6b50..7aa44ac8f 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From 630c67159398218379b51112ce708fc4f208f903 Mon Sep 17 00:00:00 2001
+From 5362ffb871dbb4ca9f19f25756eee0a88cd177e8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 9ab9394b3..a09f8c82d 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -1,4 +1,4 @@
-From 5e4ebd6472d995738a2c67d618c4bd1ee2c00968 Mon Sep 17 00:00:00 2001
+From ef3ee35a1061c563f2c32ab13f77324b6372e8be Mon Sep 17 00:00:00 2001
 From: Manoj Srivastava <srivasta@debian.org>
 Date: Sun, 9 Feb 2014 16:09:49 +0000
 Subject: Handle SELinux authorisation roles
@@ -426,7 +426,7 @@ index 98e1dafe..0a31dce4 100644
                        const char *value);
  
 diff --git a/sshd.c b/sshd.c
-index 4f791b92..5a3f796d 100644
+index 72d85de1..9aab36c3 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -678,7 +678,7 @@ privsep_postauth(Authctxt *authctxt)
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 5c609f373..7e522ff17 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From 62a564b1f2f9cb086a3618c6df4113a4d9dbe273 Mon Sep 17 00:00:00 2001
+From fa35a4226bf7f9e4c3fa6b6be06d1a38a58bd162 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
index b82b21afe..7a62bce5e 100644
--- a/debian/patches/sigstop.patch
+++ b/debian/patches/sigstop.patch
@@ -1,4 +1,4 @@
-From e6e10c563bbe69426d5074b0b97e2a9b0b4b3b49 Mon Sep 17 00:00:00 2001
+From 78a2f42f1ae8a81e2a229405273b2c1369667b5c Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:17 +0000
 Subject: Support synchronisation with service supervisor using SIGSTOP
@@ -13,7 +13,7 @@ Patch-Name: sigstop.patch
  1 file changed, 10 insertions(+)
 
 diff --git a/sshd.c b/sshd.c
-index 747beec8..414e19ee 100644
+index eebf1984..b6826c84 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -1878,6 +1878,16 @@ main(int ac, char **av)
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index 73d48641f..f61725049 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 135f35985c55d9734dcd61cf159d3e7916b95b60 Mon Sep 17 00:00:00 2001
+From 76b2e45116ded18137a30406cf5f22b11b9feeab Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 983a4fc67..5ea2fb243 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From 4476fe4e30c33c250ddd6bd01e644979f10acd25 Mon Sep 17 00:00:00 2001
+From e11b941efd85f5b55c055eb11511c7bbb6464b5f Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index 29a876cd8..2398598f5 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -1,4 +1,4 @@
-From 01e8999cc86a0b2ffed5f98abed624b0e7c2707f Mon Sep 17 00:00:00 2001
+From 8bdb2e6f613ad62c3aa781ba6cb7088ee16a6dfd Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:50 +0000
 Subject: Accept obsolete ssh-vulnkey configuration options
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index d6a5707d4..a8eeb7ebc 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -1,4 +1,4 @@
-From bdc8262449eefe39f2dc4ddcbb44b84ddade4cd3 Mon Sep 17 00:00:00 2001
+From ed3f2695800c03da18c36191aefd27d554bf052e Mon Sep 17 00:00:00 2001
 From: Jonathan David Amery <jdamery@ysolde.ucam.org>
 Date: Sun, 9 Feb 2014 16:09:54 +0000
 Subject: "LogLevel SILENT" compatibility
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
index 0a8ff5d9c..a5a543596 100644
--- a/debian/patches/systemd-readiness.patch
+++ b/debian/patches/systemd-readiness.patch
@@ -1,4 +1,4 @@
-From c95bb2c6a018688e44481bf1d199607db567fd9e Mon Sep 17 00:00:00 2001
+From a7e11f49e8d6dfe6b44b24960af5e112cd953ae7 Mon Sep 17 00:00:00 2001
 From: Michael Biebl <biebl@debian.org>
 Date: Mon, 21 Dec 2015 16:08:47 +0000
 Subject: Add systemd readiness notification support
@@ -56,7 +56,7 @@ index 4747ce4a..9f59794b 100644
  echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
  echo "                  BSD Auth support: $BSD_AUTH_MSG"
 diff --git a/sshd.c b/sshd.c
-index 414e19ee..8b793480 100644
+index b6826c84..027daa9d 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -85,6 +85,10 @@
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index 1a6194544..ee5c38c23 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From 47c946434c6e99ff9da531cfcafb051e38e79ff8 Mon Sep 17 00:00:00 2001
+From 5ba9e0eff0a725c4d616f296c6449fe3dbe0bdcf Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability
diff --git a/gss-serv.c b/gss-serv.c
index 2f6baf70d..2e27cbf9c 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -149,11 +149,10 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
 /* Unprivileged */
 char *
 ssh_gssapi_server_mechanisms(void) {
-        gss_OID_set     supported;
-
-        ssh_gssapi_supported_oids(&supported);
-        return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,
-            NULL, NULL));
+        if (supported_oids == NULL)
+                ssh_gssapi_prepare_supported_oids();
+        return (ssh_gssapi_kex_mechs(supported_oids,
+            &ssh_gssapi_server_check_mech, NULL, NULL));
 }
 
 /* Unprivileged */
diff --git a/sshd.c b/sshd.c
index 8b793480e..027daa9d8 100644
--- a/sshd.c
+++ b/sshd.c
@@ -547,7 +547,7 @@ privsep_preauth_child(void)
 
 #ifdef GSSAPI
         /* Cache supported mechanism OIDs for later use */
-        if (options.gss_authentication)
+        if (options.gss_authentication || options.gss_keyex)
                 ssh_gssapi_prepare_supported_oids();
 #endif