New upstream release (8.0p1)

1 files changed, 1637 insertions, 902 deletions

diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index f62bf6672..45d131d27 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -1,4 +1,4 @@
-From 72b1d308e6400194ef6e4e7dd45bfa48fa39b5e6 Mon Sep 17 00:00:00 2001
+From 7ce79be85036c4b36937f1b1ba85f6094068412c Mon Sep 17 00:00:00 2001
 From: Simon Wilkinson <simon@sxw.org.uk>
 Date: Sun, 9 Feb 2014 16:09:48 +0000
 Subject: GSSAPI key exchange support
@@ -16,185 +16,69 @@ have it merged into the main openssh package rather than having separate
 -krb5 packages (as we used to have).  It seems to have a generally good
 security history.
 
+Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2018-10-20
+Last-Updated: 2019-06-05
 
 Patch-Name: gssapi.patch
 ---
- ChangeLog.gssapi | 113 ++++++++++++++++
- Makefile.in      |   3 +-
- auth-krb5.c      |  17 ++-
- auth.c           |  96 +------------
- auth2-gss.c      |  54 +++++++-
- auth2.c          |   2 +
- canohost.c       |  93 +++++++++++++
- canohost.h       |   3 +
- clientloop.c     |  15 ++-
- config.h.in      |   6 +
- configure.ac     |  24 ++++
- gss-genr.c       | 280 +++++++++++++++++++++++++++++++++++++-
- gss-serv-krb5.c  |  85 +++++++++++-
- gss-serv.c       | 184 +++++++++++++++++++++++--
- kex.c            |  19 +++
- kex.h            |  14 ++
- kexgssc.c        | 341 +++++++++++++++++++++++++++++++++++++++++++++++
- kexgsss.c        | 300 +++++++++++++++++++++++++++++++++++++++++
- monitor.c        | 122 +++++++++++++++--
- monitor.h        |   3 +
- monitor_wrap.c   |  53 +++++++-
- monitor_wrap.h   |   4 +-
- opacket.c        |   2 +-
- opacket.h        |   2 +-
- readconf.c       |  43 ++++++
- readconf.h       |   5 +
- servconf.c       |  26 ++++
- servconf.h       |   2 +
- ssh-gss.h        |  41 +++++-
- ssh_config       |   2 +
- ssh_config.5     |  32 +++++
- sshconnect2.c    | 133 +++++++++++++++++-
- sshd.c           | 110 +++++++++++++++
- sshd_config      |   2 +
- sshd_config.5    |  10 ++
- sshkey.c         |   3 +-
- sshkey.h         |   1 +
- 37 files changed, 2099 insertions(+), 146 deletions(-)
- create mode 100644 ChangeLog.gssapi
+ Makefile.in     |   3 +-
+ auth-krb5.c     |  17 +-
+ auth.c          |  96 +-------
+ auth2-gss.c     |  56 ++++-
+ auth2.c         |   2 +
+ canohost.c      |  93 ++++++++
+ canohost.h      |   3 +
+ clientloop.c    |  15 +-
+ configure.ac    |  24 ++
+ gss-genr.c      | 300 +++++++++++++++++++++++-
+ gss-serv-krb5.c |  85 ++++++-
+ gss-serv.c      | 186 +++++++++++++--
+ hmac.c          |   1 +
+ kex.c           |  66 +++++-
+ kex.h           |  29 +++
+ kexdh.c         |  10 +
+ kexgen.c        |   2 +-
+ kexgssc.c       | 606 ++++++++++++++++++++++++++++++++++++++++++++++++
+ kexgsss.c       | 474 +++++++++++++++++++++++++++++++++++++
+ mac.c           |   1 +
+ monitor.c       | 139 ++++++++++-
+ monitor.h       |   2 +
+ monitor_wrap.c  |  57 ++++-
+ monitor_wrap.h  |   4 +-
+ readconf.c      |  70 ++++++
+ readconf.h      |   6 +
+ servconf.c      |  47 ++++
+ servconf.h      |   3 +
+ session.c       |  10 +-
+ ssh-gss.h       |  50 +++-
+ ssh.1           |   8 +
+ ssh.c           |   4 +-
+ ssh_config      |   2 +
+ ssh_config.5    |  57 +++++
+ sshconnect2.c   | 140 ++++++++++-
+ sshd.c          | 120 +++++++++-
+ sshd_config     |   2 +
+ sshd_config.5   |  30 +++
+ sshkey.c        |   3 +-
+ sshkey.h        |   1 +
+ 40 files changed, 2664 insertions(+), 160 deletions(-)
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
 
-diff --git a/ChangeLog.gssapi b/ChangeLog.gssapi
-new file mode 100644
-index 000000000..f117a336a
---- /dev/null
-+++ b/ChangeLog.gssapi
-@@ -0,0 +1,113 @@
-+20110101
-+  - Finally update for OpenSSH 5.6p1
-+  - Add GSSAPIServerIdentity option from Jim Basney
-+ 
-+20100308
-+  - [ Makefile.in, key.c, key.h ]
-+    Updates for OpenSSH 5.4p1
-+  - [ servconf.c ]
-+    Include GSSAPI options in the sshd -T configuration dump, and flag
-+    some older configuration options as being unsupported. Thanks to Colin 
-+    Watson.
-+  -
-+
-+20100124
-+  - [ sshconnect2.c ]
-+    Adapt to deal with additional element in Authmethod structure. Thanks to
-+    Colin Watson
-+
-+20090615
-+  - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c
-+      sshd.c ]
-+    Fix issues identified by Greg Hudson following a code review
-+       Check return value of gss_indicate_mechs
-+       Protect GSSAPI calls in monitor, so they can only be used if enabled
-+       Check return values of bignum functions in key exchange
-+       Use BN_clear_free to clear other side's DH value
-+       Make ssh_gssapi_id_kex more robust
-+       Only configure kex table pointers if GSSAPI is enabled
-+       Don't leak mechanism list, or gss mechanism list
-+       Cast data.length before printing
-+       If serverkey isn't provided, use an empty string, rather than NULL
-+
-+20090201
-+  - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h
-+      ssh_config.5 sshconnet2.c ]
-+    Add support for the GSSAPIClientIdentity option, which allows the user
-+    to specify which GSSAPI identity to use to contact a given server
-+
-+20080404
-+  - [ gss-serv.c ]
-+    Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow
-+    been omitted from a previous version of this patch. Reported by Borislav
-+    Stoichkov
-+
-+20070317
-+  - [ gss-serv-krb5.c ]
-+    Remove C99ism, where new_ccname was being declared in the middle of a 
-+    function
-+
-+20061220
-+  - [ servconf.c ]
-+    Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and 
-+    documented, behaviour. Reported by Dan Watson.
-+
-+20060910
-+  - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c
-+      ssh-gss.h ]
-+    add support for gss-group14-sha1 key exchange mechanisms
-+  - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ]
-+    Add GSSAPIStrictAcceptorCheck option to allow the disabling of
-+    acceptor principal checking on multi-homed machines.
-+    <Bugzilla #928>
-+  - [ sshd_config ssh_config ]
-+    Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample
-+    configuration files
-+  - [ kexgss.c kegsss.c sshconnect2.c sshd.c ]
-+    Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf()
-+    Limit length of error messages displayed by client
-+
-+20060909
-+  - [ gss-genr.c gss-serv.c ]
-+    move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server
-+    only, where they belong 
-+    <Bugzilla #1225>
-+
-+20060829
-+  - [ gss-serv-krb5.c ]
-+    Fix CCAPI credentials cache name when creating KRB5CCNAME environment 
-+    variable
-+
-+20060828
-+  - [ gss-genr.c ]
-+    Avoid Heimdal context freeing problem
-+    <Fixed upstream 20060829>
-+
-+20060818
-+  - [ gss-genr.c ssh-gss.h sshconnect2.c ]
-+    Make sure that SPENGO is disabled 
-+    <Bugzilla #1218 - Fixed upstream 20060818>
-+
-+20060421
-+  - [ gssgenr.c, sshconnect2.c ]
-+    a few type changes (signed versus unsigned, int versus size_t) to
-+    fix compiler errors/warnings 
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ kexgssc.c, sshconnect2.c ]
-+    fix uninitialized variable warnings
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ gssgenr.c ]
-+    pass oid to gss_display_status (helpful when using GSSAPI mechglue)
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <Bugzilla #1220 >
-+  - [ gss-serv-krb5.c ]
-+    #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <Fixed upstream 20060304>
-+  - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c 
-+    add client-side GssapiKeyExchange option
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ sshconnect2.c ]
-+    add support for GssapiTrustDns option for gssapi-with-mic
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <gssapi-with-mic support is Bugzilla #1008>
 diff --git a/Makefile.in b/Makefile.in
-index 126b2c742..70050ffb6 100644
+index 6f001bb36..c31821acc 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -100,6 +100,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
         kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
-        kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \
-        kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \
+        kexgexc.o kexgexs.o \
+        sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
 +       kexgssc.o \
         platform-pledge.o platform-tracing.o platform-misc.o
  
- SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-@@ -113,7 +114,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
+ 
+@@ -114,7 +115,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
         auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
         auth2-none.o auth2-passwd.o auth2-pubkey.o \
         monitor.o monitor_wrap.o auth-krb5.o \
@@ -255,7 +139,7 @@ index 3096f1c8e..204752e1b 100644
         return (krb5_cc_resolve(ctx, ccname, ccache));
  }
 diff --git a/auth.c b/auth.c
-index 3ca3762cc..d8e6b4a3d 100644
+index 8696f258e..f7a23afba 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -399,7 +399,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
@@ -268,7 +152,7 @@ index 3ca3762cc..d8e6b4a3d 100644
                         return 1;
                 break;
         case PERMIT_FORCED_ONLY:
-@@ -737,99 +738,6 @@ fakepw(void)
+@@ -723,99 +724,6 @@ fakepw(void)
         return (&fake);
  }
  
@@ -369,7 +253,7 @@ index 3ca3762cc..d8e6b4a3d 100644
   * Return the canonical name of the host in the other side of the current
   * connection.  The host name is cached, so it is efficient to call this
 diff --git a/auth2-gss.c b/auth2-gss.c
-index 9351e0428..1f12bb113 100644
+index 9351e0428..d6446c0cf 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
@@ -381,11 +265,11 @@ index 9351e0428..1f12bb113 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -54,6 +54,46 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
+@@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
  
-+/* 
++/*
 + * The 'gssapi_keyex' userauth mechanism.
 + */
 +static int
@@ -393,7 +277,7 @@ index 9351e0428..1f12bb113 100644
 +{
 +       Authctxt *authctxt = ssh->authctxt;
 +       int r, authenticated = 0;
-+       struct sshbuf *b;
++       struct sshbuf *b = NULL;
 +       gss_buffer_desc mic, gssbuf;
 +       u_char *p;
 +       size_t len;
@@ -401,8 +285,10 @@ index 9351e0428..1f12bb113 100644
 +       if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
 +           (r = sshpkt_get_end(ssh)) != 0)
 +               fatal("%s: %s", __func__, ssh_err(r));
++
 +       if ((b = sshbuf_new()) == NULL)
 +               fatal("%s: sshbuf_new failed", __func__);
++
 +       mic.value = p;
 +       mic.length = len;
 +
@@ -414,11 +300,11 @@ index 9351e0428..1f12bb113 100644
 +       gssbuf.length = sshbuf_len(b);
 +
 +       /* gss_kex_context is NULL with privsep, so we can't check it here */
-+       if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 
++       if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context,
 +           &gssbuf, &mic))))
 +               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+                   authctxt->pw));
-+       
++                   authctxt->pw, 1));
++
 +       sshbuf_free(b);
 +       free(mic.value);
 +
@@ -428,27 +314,27 @@ index 9351e0428..1f12bb113 100644
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -260,7 +300,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+@@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
         if ((r = sshpkt_get_end(ssh)) != 0)
                 fatal("%s: %s", __func__, ssh_err(r));
  
 -       authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
 +       authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+           authctxt->pw));
++           authctxt->pw, 1));
  
         if ((!use_privsep || mm_is_monitor()) &&
             (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -306,7 +347,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
         gssbuf.length = sshbuf_len(b);
  
         if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
 -               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+               authenticated = 
-+                   PRIVSEP(ssh_gssapi_userok(authctxt->user, authctxt->pw));
++               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
++                   authctxt->pw, 0));
         else
                 logit("GSSAPI MIC check failed");
  
-@@ -326,6 +368,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -326,6 +370,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
         return 0;
  }
  
@@ -462,10 +348,10 @@ index 9351e0428..1f12bb113 100644
         "gssapi-with-mic",
         userauth_gssapi,
 diff --git a/auth2.c b/auth2.c
-index 4d19957a6..a77742819 100644
+index 16ae1a363..7417eafa4 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -74,6 +74,7 @@ extern Authmethod method_passwd;
+@@ -75,6 +75,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -473,7 +359,7 @@ index 4d19957a6..a77742819 100644
  extern Authmethod method_gssapi;
  #endif
  
-@@ -81,6 +82,7 @@ Authmethod *authmethods[] = {
+@@ -82,6 +83,7 @@ Authmethod *authmethods[] = {
         &method_none,
         &method_pubkey,
  #ifdef GSSAPI
@@ -600,7 +486,7 @@ index 26d62855a..0cadc9f18 100644
  int             get_peer_port(int);
  char           *get_local_ipaddr(int);
 diff --git a/clientloop.c b/clientloop.c
-index 8d312cdaa..1464634b0 100644
+index 086c0dfe8..9b90c64f3 100644
 --- a/clientloop.c
 +++ b/clientloop.c
 @@ -112,6 +112,10 @@
@@ -614,7 +500,7 @@ index 8d312cdaa..1464634b0 100644
  /* import options */
  extern Options options;
  
-@@ -1370,9 +1374,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
+@@ -1374,9 +1378,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
                         break;
  
                 /* Do channel operations unless rekeying in progress. */
@@ -632,37 +518,13 @@ index 8d312cdaa..1464634b0 100644
 +               }
 +
                 /* Buffer input from the connection.  */
-                client_process_net_input(readset);
- 
-diff --git a/config.h.in b/config.h.in
-index 91b65db8f..209760c7c 100644
---- a/config.h.in
-+++ b/config.h.in
-@@ -1845,6 +1845,9 @@
- /* Use btmp to log bad logins */
- #undef USE_BTMP
- 
-+/* platform uses an in-memory credentials cache */
-+#undef USE_CCAPI
-+
- /* Use libedit for sftp */
- #undef USE_LIBEDIT
- 
-@@ -1860,6 +1863,9 @@
- /* Use PIPES instead of a socketpair() */
- #undef USE_PIPES
- 
-+/* platform has the Security Authorization Session API */
-+#undef USE_SECURITY_SESSION_API
-+
- /* Define if you have Solaris privileges */
- #undef USE_SOLARIS_PRIVS
+                client_process_net_input(ssh, readset);
  
 diff --git a/configure.ac b/configure.ac
-index 7379ab358..023e7cc55 100644
+index 30be6c182..2869f7042 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -664,6 +664,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+@@ -665,6 +665,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
             [Use tunnel device compatibility to OpenBSD])
         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
             [Prepend the address family to IP tunnel traffic])
@@ -670,7 +532,7 @@ index 7379ab358..023e7cc55 100644
 +       AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 +               [SessionCreate(0, 0);],
 +               [ac_cv_use_security_session_api="yes"
-+                AC_DEFINE([USE_SECURITY_SESSION_API], [1], 
++                AC_DEFINE([USE_SECURITY_SESSION_API], [1],
 +                       [platform has the Security Authorization Session API])
 +                LIBS="$LIBS -framework Security"
 +                AC_MSG_RESULT([yes])],
@@ -681,7 +543,7 @@ index 7379ab358..023e7cc55 100644
 +               [#include <Kerberos/Kerberos.h>],
 +               [cc_context_t c;
 +                (void) cc_initialize (&c, 0, NULL, NULL);],
-+               [AC_DEFINE([USE_CCAPI], [1], 
++               [AC_DEFINE([USE_CCAPI], [1],
 +                       [platform uses an in-memory credentials cache])
 +                LIBS="$LIBS -framework Security"
 +                AC_MSG_RESULT([yes])
@@ -694,7 +556,7 @@ index 7379ab358..023e7cc55 100644
         AC_CHECK_DECL([AU_IPv4], [],
             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 diff --git a/gss-genr.c b/gss-genr.c
-index d56257b4a..491e62cee 100644
+index d56257b4a..763a63ffa 100644
 --- a/gss-genr.c
 +++ b/gss-genr.c
 @@ -1,7 +1,7 @@
@@ -706,16 +568,15 @@ index d56257b4a..491e62cee 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -39,14 +39,37 @@
- #include "xmalloc.h"
- #include "ssherr.h"
+@@ -41,12 +41,36 @@
  #include "sshbuf.h"
-+#include "sshkey.h"
  #include "log.h"
  #include "ssh2.h"
 +#include "cipher.h"
++#include "sshkey.h"
 +#include "kex.h"
 +#include "digest.h"
++#include "packet.h"
  
  #include "ssh-gss.h"
  
@@ -736,7 +597,7 @@ index d56257b4a..491e62cee 100644
 +
 +static ssh_gss_kex_mapping *gss_enc2oid = NULL;
 +
-+int 
++int
 +ssh_gssapi_oid_table_ok(void) {
 +       return (gss_enc2oid != NULL);
 +}
@@ -744,10 +605,25 @@ index d56257b4a..491e62cee 100644
  /* sshbuf_get for gss_buffer_desc */
  int
  ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
-@@ -62,6 +85,143 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
+@@ -62,6 +86,162 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
         return 0;
  }
  
++/* sshpkt_get of gss_buffer_desc */
++int
++ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *ssh, gss_buffer_desc *g)
++{
++       int r;
++       u_char *p;
++       size_t len;
++
++       if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)
++               return r;
++       g->value = p;
++       g->length = len;
++       return 0;
++}
++
 +/*
 + * Return a list of the gss-group1-sha1 mechanisms supported by this program
 + *
@@ -756,27 +632,30 @@ index d56257b4a..491e62cee 100644
 + */
 +
 +char *
-+ssh_gssapi_client_mechanisms(const char *host, const char *client) {
-+       gss_OID_set gss_supported;
++ssh_gssapi_client_mechanisms(const char *host, const char *client,
++    const char *kex) {
++       gss_OID_set gss_supported = NULL;
 +       OM_uint32 min_status;
 +
 +       if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))
 +               return NULL;
 +
-+       return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
-+           host, client));
++       return ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
++           host, client, kex);
 +}
 +
 +char *
 +ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
-+    const char *host, const char *client) {
-+       struct sshbuf *buf;
++    const char *host, const char *client, const char *kex) {
++       struct sshbuf *buf = NULL;
 +       size_t i;
-+       int r, oidpos, enclen;
++       int r = SSH_ERR_ALLOC_FAIL;
++       int oidpos, enclen;
 +       char *mechs, *encoded;
 +       u_char digest[SSH_DIGEST_MAX_LENGTH];
 +       char deroid[2];
-+       struct ssh_digest_ctx *md;
++       struct ssh_digest_ctx *md = NULL;
++       char *s, *cp, *p;
 +
 +       if (gss_enc2oid != NULL) {
 +               for (i = 0; gss_enc2oid[i].encoded != NULL; i++)
@@ -791,6 +670,7 @@ index d56257b4a..491e62cee 100644
 +               fatal("%s: sshbuf_new failed", __func__);
 +
 +       oidpos = 0;
++       s = cp = xstrdup(kex);
 +       for (i = 0; i < gss_supported->count; i++) {
 +               if (gss_supported->elements[i].length < 128 &&
 +                   (*check)(NULL, &(gss_supported->elements[i]), host, client)) {
@@ -799,12 +679,15 @@ index d56257b4a..491e62cee 100644
 +                       deroid[1] = gss_supported->elements[i].length;
 +
 +                       if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
-+                           ssh_digest_update(md, deroid, 2) != 0 ||
-+                           ssh_digest_update(md,
-+                           gss_supported->elements[i].elements,
-+                           gss_supported->elements[i].length) != 0 ||
-+                           ssh_digest_final(md, digest, sizeof(digest)) != 0)
-+                               fatal("%s: digest failed", __func__);
++                           (r = ssh_digest_update(md, deroid, 2)) != 0 ||
++                           (r = ssh_digest_update(md,
++                               gss_supported->elements[i].elements,
++                               gss_supported->elements[i].length)) != 0 ||
++                           (r = ssh_digest_final(md, digest, sizeof(digest))) != 0)
++                               fatal("%s: digest failed: %s", __func__,
++                                   ssh_err(r));
++                       ssh_digest_free(md);
++                       md = NULL;
 +
 +                       encoded = xmalloc(ssh_digest_bytes(SSH_DIGEST_MD5)
 +                           * 2);
@@ -812,69 +695,66 @@ index d56257b4a..491e62cee 100644
 +                           ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
 +                           ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
 +
-+                       if (oidpos != 0) {
-+                               if ((r = sshbuf_put_u8(buf, ',')) != 0)
-+                                       fatal("%s: buffer error: %s",
++                       cp = strncpy(s, kex, strlen(kex));
++                       for ((p = strsep(&cp, ",")); p && *p != '\0';
++                               (p = strsep(&cp, ","))) {
++                               if (sshbuf_len(buf) != 0 &&
++                                   (r = sshbuf_put_u8(buf, ',')) != 0)
++                                       fatal("%s: sshbuf_put_u8 error: %s",
++                                           __func__, ssh_err(r));
++                               if ((r = sshbuf_put(buf, p, strlen(p))) != 0 ||
++                                   (r = sshbuf_put(buf, encoded, enclen)) != 0)
++                                       fatal("%s: sshbuf_put error: %s",
 +                                           __func__, ssh_err(r));
 +                       }
 +
-+                       if ((r = sshbuf_put(buf, KEX_GSS_GEX_SHA1_ID,
-+                           sizeof(KEX_GSS_GEX_SHA1_ID) - 1)) != 0 ||
-+                           (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
-+                           (r = sshbuf_put_u8(buf, ',')) != 0 ||
-+                           (r = sshbuf_put(buf, KEX_GSS_GRP1_SHA1_ID,
-+                           sizeof(KEX_GSS_GRP1_SHA1_ID) - 1)) != 0 ||
-+                           (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
-+                           (r = sshbuf_put_u8(buf, ',')) != 0 ||
-+                           (r = sshbuf_put(buf, KEX_GSS_GRP14_SHA1_ID,
-+                           sizeof(KEX_GSS_GRP14_SHA1_ID) - 1)) != 0 ||
-+                           (r = sshbuf_put(buf, encoded, enclen)) != 0)
-+                               fatal("%s: buffer error: %s",
-+                                   __func__, ssh_err(r));
-+
 +                       gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
 +                       gss_enc2oid[oidpos].encoded = encoded;
 +                       oidpos++;
 +               }
 +       }
++       free(s);
 +       gss_enc2oid[oidpos].oid = NULL;
 +       gss_enc2oid[oidpos].encoded = NULL;
 +
 +       if ((mechs = sshbuf_dup_string(buf)) == NULL)
 +               fatal("%s: sshbuf_dup_string failed", __func__);
 +
++       sshbuf_free(buf);
++
 +       if (strlen(mechs) == 0) {
 +               free(mechs);
 +               mechs = NULL;
 +       }
-+       
++
 +       return (mechs);
 +}
 +
 +gss_OID
 +ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
 +       int i = 0;
-+       
-+       switch (kex_type) {
-+       case KEX_GSS_GRP1_SHA1:
-+               if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))
-+                       return GSS_C_NO_OID;
-+               name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;
-+               break;
-+       case KEX_GSS_GRP14_SHA1:
-+               if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))
-+                       return GSS_C_NO_OID;
-+               name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;
-+               break;
-+       case KEX_GSS_GEX_SHA1:
-+               if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))
-+                       return GSS_C_NO_OID;
-+               name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;
++
++#define SKIP_KEX_NAME(type) \
++       case type: \
++               if (strlen(name) < sizeof(type##_ID)) \
++                       return GSS_C_NO_OID; \
++               name += sizeof(type##_ID) - 1; \
 +               break;
++
++       switch (kex_type) {
++       SKIP_KEX_NAME(KEX_GSS_GRP1_SHA1)
++       SKIP_KEX_NAME(KEX_GSS_GRP14_SHA1)
++       SKIP_KEX_NAME(KEX_GSS_GRP14_SHA256)
++       SKIP_KEX_NAME(KEX_GSS_GRP16_SHA512)
++       SKIP_KEX_NAME(KEX_GSS_GEX_SHA1)
++       SKIP_KEX_NAME(KEX_GSS_NISTP256_SHA256)
++       SKIP_KEX_NAME(KEX_GSS_C25519_SHA256)
 +       default:
 +               return GSS_C_NO_OID;
 +       }
 +
++#undef SKIP_KEX_NAME
++
 +       while (gss_enc2oid[i].encoded != NULL &&
 +           strcmp(name, gss_enc2oid[i].encoded) != 0)
 +               i++;
@@ -888,7 +768,7 @@ index d56257b4a..491e62cee 100644
  /* Check that the OID in a data stream matches that in the context */
  int
  ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -218,7 +378,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
+@@ -218,7 +398,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
         }
  
         ctx->major = gss_init_sec_context(&ctx->minor,
@@ -897,7 +777,7 @@ index d56257b4a..491e62cee 100644
             GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
             0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -247,9 +407,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
+@@ -247,9 +427,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
         return (ctx->major);
  }
  
@@ -919,8 +799,8 @@ index d56257b4a..491e62cee 100644
 +           GSS_C_NT_USER_NAME, &gssname);
 +
 +       if (!ctx->major)
-+               ctx->major = gss_acquire_cred(&ctx->minor, 
-+                   gssname, 0, oidset, GSS_C_INITIATE, 
++               ctx->major = gss_acquire_cred(&ctx->minor,
++                   gssname, 0, oidset, GSS_C_INITIATE,
 +                   &ctx->client_creds, NULL, NULL);
 +
 +       gss_release_name(&status, &gssname);
@@ -935,13 +815,13 @@ index d56257b4a..491e62cee 100644
  OM_uint32
  ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
  {
-+       if (ctx == NULL) 
++       if (ctx == NULL)
 +               return -1;
 +
         if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
             GSS_C_QOP_DEFAULT, buffer, hash)))
                 ssh_gssapi_error(ctx);
-@@ -257,6 +451,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
+@@ -257,6 +471,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
         return (ctx->major);
  }
  
@@ -961,12 +841,12 @@ index d56257b4a..491e62cee 100644
  void
  ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
      const char *context)
-@@ -273,11 +480,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
+@@ -273,11 +500,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
  }
  
  int
 -ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
-+ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, 
++ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host,
 +    const char *client)
  {
         gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
@@ -979,7 +859,7 @@ index d56257b4a..491e62cee 100644
  
         /* RFC 4462 says we MUST NOT do SPNEGO */
         if (oid->length == spnego_oid.length && 
-@@ -287,6 +499,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -287,6 +519,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
         ssh_gssapi_build_ctx(ctx);
         ssh_gssapi_set_oid(*ctx, oid);
         major = ssh_gssapi_import_name(*ctx, host);
@@ -990,12 +870,12 @@ index d56257b4a..491e62cee 100644
         if (!GSS_ERROR(major)) {
                 major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
                     NULL);
-@@ -296,10 +512,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -296,10 +532,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
                             GSS_C_NO_BUFFER);
         }
  
 -       if (GSS_ERROR(major)) 
-+       if (GSS_ERROR(major) || intctx != NULL) 
++       if (GSS_ERROR(major) || intctx != NULL)
                 ssh_gssapi_delete_ctx(ctx);
  
         return (!GSS_ERROR(major));
@@ -1010,7 +890,7 @@ index d56257b4a..491e62cee 100644
 +       static OM_uint32 last_call = 0;
 +       OM_uint32 lifetime, now, major, minor;
 +       int equal;
-+       
++
 +       now = time(NULL);
 +
 +       if (ctxt) {
@@ -1038,8 +918,8 @@ index d56257b4a..491e62cee 100644
 +
 +       if (saved_mech == GSS_C_NO_OID)
 +               return 0;
-+       
-+       major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, 
++
++       major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,
 +           &name, &lifetime, NULL, NULL);
 +       if (major == GSS_S_CREDENTIALS_EXPIRED)
 +               return 0;
@@ -1059,7 +939,7 @@ index d56257b4a..491e62cee 100644
 +
  #endif /* GSSAPI */
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index a151bc1e4..90f8692f5 100644
+index a151bc1e4..ef9beb67c 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
 @@ -1,7 +1,7 @@
@@ -1107,7 +987,7 @@ index a151bc1e4..90f8692f5 100644
  }
  
 +int
-+ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, 
++ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store,
 +    ssh_gssapi_client *client)
 +{
 +       krb5_ccache ccache = NULL;
@@ -1116,14 +996,14 @@ index a151bc1e4..90f8692f5 100644
 +       krb5_error_code problem;
 +       OM_uint32 maj_status, min_status;
 +
-+       if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
++       if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
 +                logit("krb5_cc_resolve(): %.100s",
 +                    krb5_get_err_text(krb_context, problem));
 +                return 0;
-+               }
-+       
++       }
++
 +       /* Find out who the principal in this cache is */
-+       if ((problem = krb5_cc_get_principal(krb_context, ccache, 
++       if ((problem = krb5_cc_get_principal(krb_context, ccache,
 +           &principal))) {
 +               logit("krb5_cc_get_principal(): %.100s",
 +                   krb5_get_err_text(krb_context, problem));
@@ -1185,7 +1065,7 @@ index a151bc1e4..90f8692f5 100644
  
  #endif /* KRB5 */
 diff --git a/gss-serv.c b/gss-serv.c
-index ab3a15f0f..6c087a1b1 100644
+index ab3a15f0f..1d47870e7 100644
 --- a/gss-serv.c
 +++ b/gss-serv.c
 @@ -1,7 +1,7 @@
@@ -1197,7 +1077,7 @@ index ab3a15f0f..6c087a1b1 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -44,17 +44,22 @@
+@@ -44,17 +44,19 @@
  #include "session.h"
  #include "misc.h"
  #include "servconf.h"
@@ -1205,16 +1085,14 @@ index ab3a15f0f..6c087a1b1 100644
  
  #include "ssh-gss.h"
 +#include "monitor_wrap.h"
-+
-+extern ServerOptions options;
  
  extern ServerOptions options;
  
  static ssh_gssapi_client gssapi_client =
-     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
+-    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
 -    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
-+    GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,  NULL,
-+    {NULL, NULL, NULL, NULL, NULL}, 0, 0};
++    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
++    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
  
  ssh_gssapi_mech gssapi_null_mech =
 -    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
@@ -1222,7 +1100,7 @@ index ab3a15f0f..6c087a1b1 100644
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -140,6 +145,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+@@ -140,6 +142,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
         return (ssh_gssapi_acquire_cred(*ctx));
  }
  
@@ -1232,7 +1110,8 @@ index ab3a15f0f..6c087a1b1 100644
 +       if (supported_oids == NULL)
 +               ssh_gssapi_prepare_supported_oids();
 +       return (ssh_gssapi_kex_mechs(supported_oids,
-+           &ssh_gssapi_server_check_mech, NULL, NULL));
++           &ssh_gssapi_server_check_mech, NULL, NULL,
++           options.gss_kex_algorithms));
 +}
 +
 +/* Unprivileged */
@@ -1241,7 +1120,7 @@ index ab3a15f0f..6c087a1b1 100644
 +    const char *dummy) {
 +       Gssctxt *ctx = NULL;
 +       int res;
-+ 
++
 +       res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));
 +       ssh_gssapi_delete_ctx(&ctx);
 +
@@ -1251,7 +1130,7 @@ index ab3a15f0f..6c087a1b1 100644
  /* Unprivileged */
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
-@@ -150,7 +177,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
+@@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
         gss_OID_set supported;
  
         gss_create_empty_oid_set(&min_status, oidset);
@@ -1262,7 +1141,7 @@ index ab3a15f0f..6c087a1b1 100644
  
         while (supported_mechs[i]->name != NULL) {
                 if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -276,8 +305,48 @@ OM_uint32
+@@ -276,8 +303,48 @@ OM_uint32
  ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  {
         int i = 0;
@@ -1278,21 +1157,21 @@ index ab3a15f0f..6c087a1b1 100644
 +                       return GSS_S_COMPLETE;
 +               }
 +
-+               if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, 
-+                   ctx->client_creds, ctx->oid, &new_name, 
++               if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
++                   ctx->client_creds, ctx->oid, &new_name,
 +                   NULL, NULL, NULL))) {
 +                       ssh_gssapi_error(ctx);
 +                       return (ctx->major);
 +               }
 +
-+               ctx->major = gss_compare_name(&ctx->minor, client->name, 
++               ctx->major = gss_compare_name(&ctx->minor, client->name,
 +                   new_name, &equal);
 +
 +               if (GSS_ERROR(ctx->major)) {
 +                       ssh_gssapi_error(ctx);
 +                       return (ctx->major);
 +               }
-+ 
++
 +               if (!equal) {
 +                       debug("Rekeyed credentials have different name");
 +                       return GSS_S_COMPLETE;
@@ -1305,14 +1184,14 @@ index ab3a15f0f..6c087a1b1 100644
 +               gss_release_cred(&ctx->minor, &client->creds);
 +               client->name = new_name;
 +               client->creds = ctx->client_creds;
-+               ctx->client_creds = GSS_C_NO_CREDENTIAL;
++               ctx->client_creds = GSS_C_NO_CREDENTIAL;
 +               client->updated = 1;
 +               return GSS_S_COMPLETE;
 +       }
  
         client->mech = NULL;
  
-@@ -292,6 +361,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
         if (client->mech == NULL)
                 return GSS_S_FAILURE;
  
@@ -1326,7 +1205,7 @@ index ab3a15f0f..6c087a1b1 100644
         if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
             &client->displayname, NULL))) {
                 ssh_gssapi_error(ctx);
-@@ -309,6 +385,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
                 return (ctx->major);
         }
  
@@ -1335,16 +1214,20 @@ index ab3a15f0f..6c087a1b1 100644
         /* We can't copy this structure, so we just move the pointer to it */
         client->creds = ctx->client_creds;
         ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -356,7 +434,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+@@ -356,19 +432,23 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
  
  /* Privileged */
  int
 -ssh_gssapi_userok(char *user)
-+ssh_gssapi_userok(char *user, struct passwd *pw)
++ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  {
         OM_uint32 lmin;
  
-@@ -366,9 +444,11 @@ ssh_gssapi_userok(char *user)
++       (void) kex; /* used in privilege separation */
++
+        if (gssapi_client.exportedname.length == 0 ||
+            gssapi_client.exportedname.value == NULL) {
+                debug("No suitable client data");
                 return 0;
         }
         if (gssapi_client.mech && gssapi_client.mech->userok)
@@ -1365,7 +1248,7 @@ index ab3a15f0f..6c087a1b1 100644
 -/* Privileged */
 -OM_uint32
 -ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
-+/* These bits are only used for rekeying. The unpriviledged child is running 
++/* These bits are only used for rekeying. The unpriviledged child is running
 + * as the user, the monitor is root.
 + *
 + * In the child, we want to :
@@ -1376,7 +1259,7 @@ index ab3a15f0f..6c087a1b1 100644
 +/* Stuff for PAM */
 +
 +#ifdef USE_PAM
-+static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, 
++static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg,
 +    struct pam_response **resp, void *data)
  {
 -       ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
@@ -1389,18 +1272,18 @@ index ab3a15f0f..6c087a1b1 100644
 +void
 +ssh_gssapi_rekey_creds(void) {
 +       int ok;
-+       int ret;
 +#ifdef USE_PAM
++       int ret;
 +       pam_handle_t *pamh = NULL;
 +       struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
 +       char *envstr;
 +#endif
 +
-+       if (gssapi_client.store.filename == NULL && 
++       if (gssapi_client.store.filename == NULL &&
 +           gssapi_client.store.envval == NULL &&
 +           gssapi_client.store.envvar == NULL)
 +               return;
-+ 
++
 +       ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store));
 +
 +       if (!ok)
@@ -1423,7 +1306,7 @@ index ab3a15f0f..6c087a1b1 100644
 +       if (ret)
 +               return;
 +
-+       xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, 
++       xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar,
 +           gssapi_client.store.envval);
 +
 +       ret = pam_putenv(pamh, envstr);
@@ -1433,7 +1316,7 @@ index ab3a15f0f..6c087a1b1 100644
 +#endif
 +}
 +
-+int 
++int
 +ssh_gssapi_update_creds(ssh_gssapi_ccache *store) {
 +       int ok = 0;
 +
@@ -1455,11 +1338,29 @@ index ab3a15f0f..6c087a1b1 100644
  }
  
  /* Privileged */
+diff --git a/hmac.c b/hmac.c
+index 1c879640c..a29f32c5c 100644
+--- a/hmac.c
++++ b/hmac.c
+@@ -19,6 +19,7 @@
+ 
+ #include <sys/types.h>
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #include "sshbuf.h"
+ #include "digest.h"
 diff --git a/kex.c b/kex.c
-index 25f9f66f6..fb5bfaea5 100644
+index 34808b5c3..a2a4794e8 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -54,6 +54,10 @@
+@@ -55,11 +55,16 @@
+ #include "misc.h"
+ #include "dispatch.h"
+ #include "monitor.h"
++#include "xmalloc.h"
+ 
+ #include "ssherr.h"
  #include "sshbuf.h"
  #include "digest.h"
  
@@ -1470,57 +1371,129 @@ index 25f9f66f6..fb5bfaea5 100644
  /* prototype */
  static int kex_choose_conf(struct ssh *);
  static int kex_input_newkeys(int, u_int32_t, struct ssh *);
-@@ -105,6 +109,14 @@ static const struct kexalg kexalgs[] = {
+@@ -113,15 +118,28 @@ static const struct kexalg kexalgs[] = {
  #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
         { NULL, -1, -1, -1},
  };
-+static const struct kexalg kexalg_prefixes[] = {
++static const struct kexalg gss_kexalgs[] = {
 +#ifdef GSSAPI
 +       { KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
 +       { KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
 +       { KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
++       { KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
++       { KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
++       { KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256,
++           NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
++       { KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
 +#endif
 +       { NULL, -1, -1, -1 },
 +};
  
- char *
- kex_alg_list(char sep)
-@@ -137,6 +149,10 @@ kex_alg_by_name(const char *name)
+-char *
+-kex_alg_list(char sep)
++static char *
++kex_alg_list_internal(char sep, const struct kexalg *algs)
+ {
+        char *ret = NULL, *tmp;
+        size_t nlen, rlen = 0;
+        const struct kexalg *k;
+ 
+-       for (k = kexalgs; k->name != NULL; k++) {
++       for (k = algs; k->name != NULL; k++) {
+                if (ret != NULL)
+                        ret[rlen++] = sep;
+                nlen = strlen(k->name);
+@@ -136,6 +154,18 @@ kex_alg_list(char sep)
+        return ret;
+ }
+ 
++char *
++kex_alg_list(char sep)
++{
++       return kex_alg_list_internal(sep, kexalgs);
++}
++
++char *
++kex_gss_alg_list(char sep)
++{
++       return kex_alg_list_internal(sep, gss_kexalgs);
++}
++
+ static const struct kexalg *
+ kex_alg_by_name(const char *name)
+ {
+@@ -145,6 +175,10 @@ kex_alg_by_name(const char *name)
                 if (strcmp(k->name, name) == 0)
                         return k;
         }
-+       for (k = kexalg_prefixes; k->name != NULL; k++) {
++       for (k = gss_kexalgs; k->name != NULL; k++) {
 +               if (strncmp(k->name, name, strlen(k->name)) == 0)
 +                       return k;
 +       }
         return NULL;
  }
  
-@@ -653,6 +669,9 @@ kex_free(struct kex *kex)
-        sshbuf_free(kex->peer);
-        sshbuf_free(kex->my);
+@@ -301,6 +335,29 @@ kex_assemble_names(char **listp, const char *def, const char *all)
+        return r;
+ }
+ 
++/* Validate GSS KEX method name list */
++int
++kex_gss_names_valid(const char *names)
++{
++       char *s, *cp, *p;
++
++       if (names == NULL || *names == '\0')
++               return 0;
++       s = cp = xstrdup(names);
++       for ((p = strsep(&cp, ",")); p && *p != '\0';
++           (p = strsep(&cp, ","))) {
++               if (strncmp(p, "gss-", 4) != 0
++                 || kex_alg_by_name(p) == NULL) {
++                       error("Unsupported KEX algorithm \"%.100s\"", p);
++                       free(s);
++                       return 0;
++               }
++       }
++       debug3("gss kex names ok: [%s]", names);
++       free(s);
++       return 1;
++}
++
+ /* put algorithm proposal into buffer */
+ int
+ kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX])
+@@ -657,6 +714,9 @@ kex_free(struct kex *kex)
+        sshbuf_free(kex->server_version);
+        sshbuf_free(kex->client_pub);
         free(kex->session_id);
 +#ifdef GSSAPI
 +       free(kex->gss_host);
 +#endif /* GSSAPI */
-        free(kex->client_version_string);
-        free(kex->server_version_string);
         free(kex->failed_choice);
+        free(kex->hostkey_alg);
+        free(kex->name);
 diff --git a/kex.h b/kex.h
-index 593de1208..4e5ead839 100644
+index 6d446d1cc..2d5f1d4ed 100644
 --- a/kex.h
 +++ b/kex.h
-@@ -100,6 +100,9 @@ enum kex_exchange {
-        KEX_DH_GEX_SHA256,
+@@ -103,6 +103,15 @@ enum kex_exchange {
         KEX_ECDH_SHA2,
         KEX_C25519_SHA256,
+        KEX_KEM_SNTRUP4591761X25519_SHA512,
++#ifdef GSSAPI
 +       KEX_GSS_GRP1_SHA1,
 +       KEX_GSS_GRP14_SHA1,
++       KEX_GSS_GRP14_SHA256,
++       KEX_GSS_GRP16_SHA512,
 +       KEX_GSS_GEX_SHA1,
++       KEX_GSS_NISTP256_SHA256,
++       KEX_GSS_C25519_SHA256,
++#endif
         KEX_MAX
  };
  
-@@ -148,6 +151,12 @@ struct kex {
+@@ -154,6 +163,12 @@ struct kex {
         u_int   flags;
         int     hash_alg;
         int     ec_nid;
@@ -1530,27 +1503,93 @@ index 593de1208..4e5ead839 100644
 +       char    *gss_host;
 +       char    *gss_client;
 +#endif
-        char    *client_version_string;
-        char    *server_version_string;
         char    *failed_choice;
-@@ -198,6 +207,11 @@ int         kexecdh_server(struct ssh *);
- int     kexc25519_client(struct ssh *);
- int     kexc25519_server(struct ssh *);
- 
-+#ifdef GSSAPI
+        int     (*verify_host_key)(struct sshkey *, struct ssh *);
+        struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
+@@ -175,8 +190,10 @@ struct kex {
+ 
+ int     kex_names_valid(const char *);
+ char   *kex_alg_list(char);
++char   *kex_gss_alg_list(char);
+ char   *kex_names_cat(const char *, const char *);
+ int     kex_assemble_names(char **, const char *, const char *);
++int     kex_gss_names_valid(const char *);
+ 
+ int     kex_exchange_identification(struct ssh *, int, const char *);
+ 
+@@ -203,6 +220,12 @@ int         kexgex_client(struct ssh *);
+ int     kexgex_server(struct ssh *);
+ int     kex_gen_client(struct ssh *);
+ int     kex_gen_server(struct ssh *);
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
++int     kexgssgex_client(struct ssh *);
++int     kexgssgex_server(struct ssh *);
 +int     kexgss_client(struct ssh *);
 +int     kexgss_server(struct ssh *);
 +#endif
-+
- int     kex_dh_hash(int, const char *, const char *,
-     const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
-     const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
+ 
+ int     kex_dh_keypair(struct kex *);
+ int     kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
+@@ -235,6 +258,12 @@ int         kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
+     const BIGNUM *, const u_char *, size_t,
+     u_char *, size_t *);
+ 
++int     kex_gen_hash(int hash_alg, const struct sshbuf *client_version,
++    const struct sshbuf *server_version, const struct sshbuf *client_kexinit,
++    const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob,
++    const struct sshbuf *client_pub, const struct sshbuf *server_pub,
++    const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen);
++
+ void   kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
+        __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+        __attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+diff --git a/kexdh.c b/kexdh.c
+index 67133e339..edaa46762 100644
+--- a/kexdh.c
++++ b/kexdh.c
+@@ -48,13 +48,23 @@ kex_dh_keygen(struct kex *kex)
+ {
+        switch (kex->kex_type) {
+        case KEX_DH_GRP1_SHA1:
++#ifdef GSSAPI
++       case KEX_GSS_GRP1_SHA1:
++#endif
+                kex->dh = dh_new_group1();
+                break;
+        case KEX_DH_GRP14_SHA1:
+        case KEX_DH_GRP14_SHA256:
++#ifdef GSSAPI
++       case KEX_GSS_GRP14_SHA1:
++       case KEX_GSS_GRP14_SHA256:
++#endif
+                kex->dh = dh_new_group14();
+                break;
+        case KEX_DH_GRP16_SHA512:
++#ifdef GSSAPI
++       case KEX_GSS_GRP16_SHA512:
++#endif
+                kex->dh = dh_new_group16();
+                break;
+        case KEX_DH_GRP18_SHA512:
+diff --git a/kexgen.c b/kexgen.c
+index 2abbb9ef6..569dc83f3 100644
+--- a/kexgen.c
++++ b/kexgen.c
+@@ -43,7 +43,7 @@
+ static int input_kex_gen_init(int, u_int32_t, struct ssh *);
+ static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
+ 
+-static int
++int
+ kex_gen_hash(
+     int hash_alg,
+     const struct sshbuf *client_version,
 diff --git a/kexgssc.c b/kexgssc.c
 new file mode 100644
-index 000000000..3c8ae08dd
+index 000000000..f6e1405eb
 --- /dev/null
 +++ b/kexgssc.c
-@@ -0,0 +1,341 @@
+@@ -0,0 +1,606 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1577,7 +1616,7 @@ index 000000000..3c8ae08dd
 +
 +#include "includes.h"
 +
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +
 +#include "includes.h"
 +
@@ -1596,113 +1635,88 @@ index 000000000..3c8ae08dd
 +#include "packet.h"
 +#include "dh.h"
 +#include "digest.h"
++#include "ssherr.h"
 +
 +#include "ssh-gss.h"
 +
 +int
-+kexgss_client(struct ssh *ssh) {
-+       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-+       gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
++kexgss_client(struct ssh *ssh)
++{
++       struct kex *kex = ssh->kex;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
++           recv_tok = GSS_C_EMPTY_BUFFER,
++           gssbuf, msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
 +       Gssctxt *ctxt;
 +       OM_uint32 maj_status, min_status, ret_flags;
-+       u_int klen, kout, slen = 0, strlen;
-+       DH *dh; 
-+       BIGNUM *dh_server_pub = NULL;
-+       BIGNUM *shared_secret = NULL;
-+       const BIGNUM *pub_key, *dh_p, *dh_g;
-+       BIGNUM *p = NULL;
-+       BIGNUM *g = NULL;       
-+       u_char *kbuf;
-+       u_char *serverhostkey = NULL;
-+       u_char *empty = "";
-+       char *msg;
++       struct sshbuf *server_blob = NULL;
++       struct sshbuf *shared_secret = NULL;
++       struct sshbuf *server_host_key_blob = NULL;
++       struct sshbuf *empty = NULL;
++       u_char *msg;
 +       int type = 0;
 +       int first = 1;
-+       int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
 +       u_char hash[SSH_DIGEST_MAX_LENGTH];
 +       size_t hashlen;
++       u_char c;
++       int r;
 +
-+       /* Initialise our GSSAPI world */       
++       /* Initialise our GSSAPI world */
 +       ssh_gssapi_build_ctx(&ctxt);
-+       if (ssh_gssapi_id_kex(ctxt, ssh->kex->name, ssh->kex->kex_type) 
++       if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
 +           == GSS_C_NO_OID)
 +               fatal("Couldn't identify host exchange");
 +
-+       if (ssh_gssapi_import_name(ctxt, ssh->kex->gss_host))
++       if (ssh_gssapi_import_name(ctxt, kex->gss_host))
 +               fatal("Couldn't import hostname");
 +
-+       if (ssh->kex->gss_client && 
-+           ssh_gssapi_client_identity(ctxt, ssh->kex->gss_client))
++       if (kex->gss_client &&
++           ssh_gssapi_client_identity(ctxt, kex->gss_client))
 +               fatal("Couldn't acquire client credentials");
 +
-+       switch (ssh->kex->kex_type) {
++       /* Step 1 */
++       switch (kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
-+               dh = dh_new_group1();
-+               break;
 +       case KEX_GSS_GRP14_SHA1:
-+               dh = dh_new_group14();
++       case KEX_GSS_GRP14_SHA256:
++       case KEX_GSS_GRP16_SHA512:
++               r = kex_dh_keypair(kex);
++               break;
++       case KEX_GSS_NISTP256_SHA256:
++               r = kex_ecdh_keypair(kex);
 +               break;
-+       case KEX_GSS_GEX_SHA1:
-+               debug("Doing group exchange\n");
-+               nbits = dh_estimate(ssh->kex->we_need * 8);
-+               packet_start(SSH2_MSG_KEXGSS_GROUPREQ);
-+               packet_put_int(min);
-+               packet_put_int(nbits);
-+               packet_put_int(max);
-+
-+               packet_send();
-+
-+               packet_read_expect(SSH2_MSG_KEXGSS_GROUP);
-+
-+               if ((p = BN_new()) == NULL)
-+                       fatal("BN_new() failed");
-+               packet_get_bignum2(p);
-+               if ((g = BN_new()) == NULL)
-+                       fatal("BN_new() failed");
-+               packet_get_bignum2(g);
-+               packet_check_eom();
-+
-+               if (BN_num_bits(p) < min || BN_num_bits(p) > max)
-+                       fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
-+                           min, BN_num_bits(p), max);
-+
-+               dh = dh_new_group(g, p);
++       case KEX_GSS_C25519_SHA256:
++               r = kex_c25519_keypair(kex);
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
 +       }
-+       
-+       /* Step 1 - e is dh->pub_key */
-+       dh_gen_key(dh, ssh->kex->we_need * 8);
-+       DH_get0_key(dh, &pub_key, NULL);
-+       DH_get0_pqg(dh, &dh_p, NULL, &dh_g);
-+
-+       /* This is f, we initialise it now to make life easier */
-+       dh_server_pub = BN_new();
-+       if (dh_server_pub == NULL)
-+               fatal("dh_server_pub == NULL");
++       if (r != 0)
++               return r;
 +
 +       token_ptr = GSS_C_NO_BUFFER;
-+                        
++
 +       do {
 +               debug("Calling gss_init_sec_context");
-+               
++
 +               maj_status = ssh_gssapi_init_ctx(ctxt,
-+                   ssh->kex->gss_deleg_creds, token_ptr, &send_tok,
++                   kex->gss_deleg_creds, token_ptr, &send_tok,
 +                   &ret_flags);
 +
 +               if (GSS_ERROR(maj_status)) {
++                       /* XXX Useles code: Missing send? */
 +                       if (send_tok.length != 0) {
-+                               packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                               packet_put_string(send_tok.value,
-+                                   send_tok.length);
++                               if ((r = sshpkt_start(ssh,
++                                       SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
 +                       }
 +                       fatal("gss_init_context failed");
 +               }
 +
 +               /* If we've got an old receive buffer get rid of it */
 +               if (token_ptr != GSS_C_NO_BUFFER)
-+                       free(recv_tok.value);
++                       gss_release_buffer(&min_status, &recv_tok);
 +
 +               if (maj_status == GSS_S_COMPLETE) {
 +                       /* If mutual state flag is not true, kex fails */
@@ -1714,75 +1728,90 @@ index 000000000..3c8ae08dd
 +                               fatal("Integrity check failed");
 +               }
 +
-+               /* 
++               /*
 +                * If we have data to send, then the last message that we
-+                * received cannot have been a 'complete'. 
++                * received cannot have been a 'complete'.
 +                */
 +               if (send_tok.length != 0) {
 +                       if (first) {
-+                               packet_start(SSH2_MSG_KEXGSS_INIT);
-+                               packet_put_string(send_tok.value,
-+                                   send_tok.length);
-+                               packet_put_bignum2(pub_key);
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0 ||
++                                   (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0)
++                                       fatal("failed to construct packet: %s", ssh_err(r));
 +                               first = 0;
 +                       } else {
-+                               packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                               packet_put_string(send_tok.value,
-+                                   send_tok.length);
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("failed to construct packet: %s", ssh_err(r));
 +                       }
-+                       packet_send();
++                       if ((r = sshpkt_send(ssh)) != 0)
++                               fatal("failed to send packet: %s", ssh_err(r));
 +                       gss_release_buffer(&min_status, &send_tok);
 +
 +                       /* If we've sent them data, they should reply */
-+                       do {    
-+                               type = packet_read();
++                       do {
++                               type = ssh_packet_read(ssh);
 +                               if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
 +                                       debug("Received KEXGSS_HOSTKEY");
-+                                       if (serverhostkey)
++                                       if (server_host_key_blob)
 +                                               fatal("Server host key received more than once");
-+                                       serverhostkey = 
-+                                           packet_get_string(&slen);
++                                       if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
++                                               fatal("Failed to read server host key: %s", ssh_err(r));
 +                               }
 +                       } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
 +
 +                       switch (type) {
 +                       case SSH2_MSG_KEXGSS_CONTINUE:
 +                               debug("Received GSSAPI_CONTINUE");
-+                               if (maj_status == GSS_S_COMPLETE) 
++                               if (maj_status == GSS_S_COMPLETE)
 +                                       fatal("GSSAPI Continue received from server when complete");
-+                               recv_tok.value = packet_get_string(&strlen);
-+                               recv_tok.length = strlen; 
++                               if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &recv_tok)) != 0 ||
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("Failed to read token: %s", ssh_err(r));
 +                               break;
 +                       case SSH2_MSG_KEXGSS_COMPLETE:
 +                               debug("Received GSSAPI_COMPLETE");
-+                               packet_get_bignum2(dh_server_pub);
-+                               msg_tok.value =  packet_get_string(&strlen);
-+                               msg_tok.length = strlen; 
++                               if (msg_tok.value != NULL)
++                                       fatal("Received GSSAPI_COMPLETE twice?");
++                               if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
++                                   (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &msg_tok)) != 0)
++                                       fatal("Failed to read message: %s", ssh_err(r));
 +
 +                               /* Is there a token included? */
-+                               if (packet_get_char()) {
-+                                       recv_tok.value=
-+                                           packet_get_string(&strlen);
-+                                       recv_tok.length = strlen;
++                               if ((r = sshpkt_get_u8(ssh, &c)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               if (c) {
++                                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(
++                                           ssh, &recv_tok)) != 0)
++                                               fatal("Failed to read token: %s", ssh_err(r));
 +                                       /* If we're already complete - protocol error */
 +                                       if (maj_status == GSS_S_COMPLETE)
-+                                               packet_disconnect("Protocol error: received token when complete");
-+                                       } else {
-+                                               /* No token included */
-+                                               if (maj_status != GSS_S_COMPLETE)
-+                                                       packet_disconnect("Protocol error: did not receive final token");
++                                               sshpkt_disconnect(ssh, "Protocol error: received token when complete");
++                               } else {
++                                       /* No token included */
++                                       if (maj_status != GSS_S_COMPLETE)
++                                               sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
++                               }
++                               if ((r = sshpkt_get_end(ssh)) != 0) {
++                                       fatal("Expecting end of packet.");
 +                               }
 +                               break;
 +                       case SSH2_MSG_KEXGSS_ERROR:
 +                               debug("Received Error");
-+                               maj_status = packet_get_int();
-+                               min_status = packet_get_int();
-+                               msg = packet_get_string(NULL);
-+                               (void) packet_get_string_ptr(NULL);
-+                               fatal("GSSAPI Error: \n%.400s",msg);
++                               if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 ||
++                                   (r = sshpkt_get_u32(ssh, &min_status)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("sshpkt_get failed: %s", ssh_err(r));
++                               fatal("GSSAPI Error: \n%.400s", msg);
 +                       default:
-+                               packet_disconnect("Protocol error: didn't expect packet type %d",
-+                               type);
++                               sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
++                                   type);
 +                       }
 +                       token_ptr = &recv_tok;
 +               } else {
@@ -1792,93 +1821,358 @@ index 000000000..3c8ae08dd
 +               }
 +       } while (maj_status & GSS_S_CONTINUE_NEEDED);
 +
-+       /* 
-+        * We _must_ have received a COMPLETE message in reply from the 
-+        * server, which will have set dh_server_pub and msg_tok 
++       /*
++        * We _must_ have received a COMPLETE message in reply from the
++        * server, which will have set server_blob and msg_tok
 +        */
 +
 +       if (type != SSH2_MSG_KEXGSS_COMPLETE)
 +               fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
 +
-+       /* Check f in range [1, p-1] */
-+       if (!dh_pub_is_valid(dh, dh_server_pub))
-+               packet_disconnect("bad server public DH value");
-+
-+       /* compute K=f^x mod p */
-+       klen = DH_size(dh);
-+       kbuf = xmalloc(klen);
-+       kout = DH_compute_key(kbuf, dh_server_pub, dh);
-+       if (kout < 0)
-+               fatal("DH_compute_key: failed");
-+
-+       shared_secret = BN_new();
-+       if (shared_secret == NULL)
-+               fatal("kexgss_client: BN_new failed");
-+
-+       if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
-+               fatal("kexdh_client: BN_bin2bn failed");
-+
-+       memset(kbuf, 0, klen);
-+       free(kbuf);
-+
-+       hashlen = sizeof(hash);
-+       switch (ssh->kex->kex_type) {
++       /* compute shared secret */
++       switch (kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
 +       case KEX_GSS_GRP14_SHA1:
-+               kex_dh_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string,
-+                   ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   (serverhostkey ? serverhostkey : empty), slen,
-+                   pub_key,            /* e */
-+                   dh_server_pub,      /* f */
-+                   shared_secret,      /* K */
-+                   hash, &hashlen
-+               );
++       case KEX_GSS_GRP14_SHA256:
++       case KEX_GSS_GRP16_SHA512:
++               r = kex_dh_dec(kex, server_blob, &shared_secret);
++               break;
++       case KEX_GSS_C25519_SHA256:
++               if (sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] & 0x80)
++                       fatal("The received key has MSB of last octet set!");
++               r = kex_c25519_dec(kex, server_blob, &shared_secret);
 +               break;
-+       case KEX_GSS_GEX_SHA1:
-+               kexgex_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string,
-+                   ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   (serverhostkey ? serverhostkey : empty), slen,
-+                   min, nbits, max,
-+                   dh_p, dh_g,
-+                   pub_key,
-+                   dh_server_pub,
-+                   shared_secret,
-+                   hash, &hashlen
-+               );
++       case KEX_GSS_NISTP256_SHA256:
++               if (sshbuf_len(server_blob) != 65)
++                       fatal("The received NIST-P256 key did not match"
++                           "expected length (expected 65, got %zu)", sshbuf_len(server_blob));
++
++               if (sshbuf_ptr(server_blob)[0] != POINT_CONVERSION_UNCOMPRESSED)
++                       fatal("The received NIST-P256 key does not have first octet 0x04");
++
++               r = kex_ecdh_dec(kex, server_blob, &shared_secret);
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
++               r = SSH_ERR_INVALID_ARGUMENT;
++               break;
++       }
++       if (r != 0)
++               goto out;
++
++       if ((empty = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
 +       }
 +
++       hashlen = sizeof(hash);
++       if ((r = kex_gen_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->my,
++           kex->peer,
++           (server_host_key_blob ? server_host_key_blob : empty),
++           kex->client_pub,
++           server_blob,
++           shared_secret,
++           hash, &hashlen)) != 0)
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++
 +       gssbuf.value = hash;
 +       gssbuf.length = hashlen;
 +
 +       /* Verify that the hash matches the MIC we just got. */
 +       if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
-+               packet_disconnect("Hash's MIC didn't verify");
++               sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
 +
-+       free(msg_tok.value);
++       gss_release_buffer(&min_status, &msg_tok);
 +
-+       DH_free(dh);
-+       free(serverhostkey);
-+       BN_clear_free(dh_server_pub);
++       if (kex->gss_deleg_creds)
++               ssh_gssapi_credentials_updated(ctxt);
++
++       if (gss_kex_context == NULL)
++               gss_kex_context = ctxt;
++       else
++               ssh_gssapi_delete_ctx(&ctxt);
++
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
++
++out:
++       explicit_bzero(hash, sizeof(hash));
++       explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
++       sshbuf_free(empty);
++       sshbuf_free(server_host_key_blob);
++       sshbuf_free(server_blob);
++       sshbuf_free(shared_secret);
++       sshbuf_free(kex->client_pub);
++       kex->client_pub = NULL;
++       return r;
++}
++
++int
++kexgssgex_client(struct ssh *ssh)
++{
++       struct kex *kex = ssh->kex;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
++           recv_tok = GSS_C_EMPTY_BUFFER, gssbuf,
++            msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
++       Gssctxt *ctxt;
++       OM_uint32 maj_status, min_status, ret_flags;
++       struct sshbuf *shared_secret = NULL;
++       BIGNUM *p = NULL;
++       BIGNUM *g = NULL;
++       struct sshbuf *buf = NULL;
++       struct sshbuf *server_host_key_blob = NULL;
++       struct sshbuf *server_blob = NULL;
++       BIGNUM *dh_server_pub = NULL;
++       u_char *msg;
++       int type = 0;
++       int first = 1;
++       u_char hash[SSH_DIGEST_MAX_LENGTH];
++       size_t hashlen;
++       const BIGNUM *pub_key, *dh_p, *dh_g;
++       int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
++       struct sshbuf *empty = NULL;
++       u_char c;
++       int r;
++
++       /* Initialise our GSSAPI world */
++       ssh_gssapi_build_ctx(&ctxt);
++       if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
++           == GSS_C_NO_OID)
++               fatal("Couldn't identify host exchange");
++
++       if (ssh_gssapi_import_name(ctxt, kex->gss_host))
++               fatal("Couldn't import hostname");
++
++       if (kex->gss_client &&
++           ssh_gssapi_client_identity(ctxt, kex->gss_client))
++               fatal("Couldn't acquire client credentials");
++
++       debug("Doing group exchange");
++       nbits = dh_estimate(kex->dh_need * 8);
++
++       kex->min = DH_GRP_MIN;
++       kex->max = DH_GRP_MAX;
++       kex->nbits = nbits;
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUPREQ)) != 0 ||
++           (r = sshpkt_put_u32(ssh, min)) != 0 ||
++           (r = sshpkt_put_u32(ssh, nbits)) != 0 ||
++           (r = sshpkt_put_u32(ssh, max)) != 0 ||
++           (r = sshpkt_send(ssh)) != 0)
++               fatal("Failed to construct a packet: %s", ssh_err(r));
++
++       if ((r = ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0)
++               fatal("Error: %s", ssh_err(r));
++
++       if ((r = sshpkt_get_bignum2(ssh, &p)) != 0 ||
++           (r = sshpkt_get_bignum2(ssh, &g)) != 0 ||
++           (r = sshpkt_get_end(ssh)) != 0)
++               fatal("shpkt_get_bignum2 failed: %s", ssh_err(r));
++
++       if (BN_num_bits(p) < min || BN_num_bits(p) > max)
++               fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
++                   min, BN_num_bits(p), max);
++
++       if ((kex->dh = dh_new_group(g, p)) == NULL)
++               fatal("dn_new_group() failed");
++       p = g = NULL; /* belong to kex->dh now */
++
++       if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
++               goto out;
++       DH_get0_key(kex->dh, &pub_key, NULL);
++
++       token_ptr = GSS_C_NO_BUFFER;
++
++       do {
++               /* Step 2 - call GSS_Init_sec_context() */
++               debug("Calling gss_init_sec_context");
++
++               maj_status = ssh_gssapi_init_ctx(ctxt,
++                   kex->gss_deleg_creds, token_ptr, &send_tok,
++                   &ret_flags);
++
++               if (GSS_ERROR(maj_status)) {
++                       /* XXX Useles code: Missing send? */
++                       if (send_tok.length != 0) {
++                               if ((r = sshpkt_start(ssh,
++                                       SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                       }
++                       fatal("gss_init_context failed");
++               }
++
++               /* If we've got an old receive buffer get rid of it */
++               if (token_ptr != GSS_C_NO_BUFFER)
++                       gss_release_buffer(&min_status, &recv_tok);
++
++               if (maj_status == GSS_S_COMPLETE) {
++                       /* If mutual state flag is not true, kex fails */
++                       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
++                               fatal("Mutual authentication failed");
++
++                       /* If integ avail flag is not true kex fails */
++                       if (!(ret_flags & GSS_C_INTEG_FLAG))
++                               fatal("Integrity check failed");
++               }
++
++               /*
++                * If we have data to send, then the last message that we
++                * received cannot have been a 'complete'.
++                */
++               if (send_tok.length != 0) {
++                       if (first) {
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0 ||
++                                   (r = sshpkt_put_bignum2(ssh, pub_key)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               first = 0;
++                       } else {
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh,send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                       }
++                       if ((r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt_send failed: %s", ssh_err(r));
++                       gss_release_buffer(&min_status, &send_tok);
++
++                       /* If we've sent them data, they should reply */
++                       do {
++                               type = ssh_packet_read(ssh);
++                               if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
++                                       debug("Received KEXGSS_HOSTKEY");
++                                       if (server_host_key_blob)
++                                               fatal("Server host key received more than once");
++                                       if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
++                                               fatal("sshpkt failed: %s", ssh_err(r));
++                               }
++                       } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
++
++                       switch (type) {
++                       case SSH2_MSG_KEXGSS_CONTINUE:
++                               debug("Received GSSAPI_CONTINUE");
++                               if (maj_status == GSS_S_COMPLETE)
++                                       fatal("GSSAPI Continue received from server when complete");
++                               if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &recv_tok)) != 0 ||
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               break;
++                       case SSH2_MSG_KEXGSS_COMPLETE:
++                               debug("Received GSSAPI_COMPLETE");
++                               if (msg_tok.value != NULL)
++                                       fatal("Received GSSAPI_COMPLETE twice?");
++                               if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
++                                   (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &msg_tok)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++
++                               /* Is there a token included? */
++                               if ((r = sshpkt_get_u8(ssh, &c)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               if (c) {
++                                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(
++                                               ssh, &recv_tok)) != 0 ||
++                                           (r = sshpkt_get_end(ssh)) != 0)
++                                               fatal("sshpkt failed: %s", ssh_err(r));
++                                       /* If we're already complete - protocol error */
++                                       if (maj_status == GSS_S_COMPLETE)
++                                               sshpkt_disconnect(ssh, "Protocol error: received token when complete");
++                               } else {
++                                       /* No token included */
++                                       if (maj_status != GSS_S_COMPLETE)
++                                               sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
++                               }
++                               break;
++                       case SSH2_MSG_KEXGSS_ERROR:
++                               debug("Received Error");
++                               if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 ||
++                                   (r = sshpkt_get_u32(ssh, &min_status)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               fatal("GSSAPI Error: \n%.400s", msg);
++                       default:
++                               sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
++                                   type);
++                       }
++                       token_ptr = &recv_tok;
++               } else {
++                       /* No data, and not complete */
++                       if (maj_status != GSS_S_COMPLETE)
++                               fatal("Not complete, and no token output");
++               }
++       } while (maj_status & GSS_S_CONTINUE_NEEDED);
++
++       /*
++        * We _must_ have received a COMPLETE message in reply from the
++        * server, which will have set dh_server_pub and msg_tok
++        */
++
++       if (type != SSH2_MSG_KEXGSS_COMPLETE)
++               fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
++
++       /* 7. C verifies that the key Q_S is valid */
++       /* 8. C computes shared secret */
++       if ((buf = sshbuf_new()) == NULL ||
++           (r = sshbuf_put_stringb(buf, server_blob)) != 0 ||
++           (r = sshbuf_get_bignum2(buf, &dh_server_pub)) != 0)
++               goto out;
++       sshbuf_free(buf);
++       buf = NULL;
++
++       if ((shared_secret = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
++       }
++
++       if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0)
++               goto out;
++       if ((empty = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
++       }
++
++       DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
++       hashlen = sizeof(hash);
++       if ((r = kexgex_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->my,
++           kex->peer,
++           (server_host_key_blob ? server_host_key_blob : empty),
++           kex->min, kex->nbits, kex->max,
++           dh_p, dh_g,
++           pub_key,
++           dh_server_pub,
++           sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
++           hash, &hashlen)) != 0)
++               fatal("Failed to calculate hash: %s", ssh_err(r));
++
++       gssbuf.value = hash;
++       gssbuf.length = hashlen;
++
++       /* Verify that the hash matches the MIC we just got. */
++       if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
++               sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
++
++       gss_release_buffer(&min_status, &msg_tok);
 +
 +       /* save session id */
-+       if (ssh->kex->session_id == NULL) {
-+               ssh->kex->session_id_len = hashlen;
-+               ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);
-+               memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);
++       if (kex->session_id == NULL) {
++               kex->session_id_len = hashlen;
++               kex->session_id = xmalloc(kex->session_id_len);
++               memcpy(kex->session_id, hash, kex->session_id_len);
 +       }
 +
-+       if (ssh->kex->gss_deleg_creds)
++       if (kex->gss_deleg_creds)
 +               ssh_gssapi_credentials_updated(ctxt);
 +
 +       if (gss_kex_context == NULL)
@@ -1886,18 +2180,28 @@ index 000000000..3c8ae08dd
 +       else
 +               ssh_gssapi_delete_ctx(&ctxt);
 +
-+       kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);
-+       BN_clear_free(shared_secret);
-+       return kex_send_newkeys(ssh);
++       /* Finally derive the keys and send them */
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
++out:
++       sshbuf_free(buf);
++       sshbuf_free(server_blob);
++       sshbuf_free(empty);
++       explicit_bzero(hash, sizeof(hash));
++       DH_free(kex->dh);
++       kex->dh = NULL;
++       BN_clear_free(dh_server_pub);
++       sshbuf_free(shared_secret);
++       sshbuf_free(server_host_key_blob);
++       return r;
 +}
-+
-+#endif /* GSSAPI */
++#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
 diff --git a/kexgsss.c b/kexgsss.c
 new file mode 100644
-index 000000000..18070f1d7
+index 000000000..60bc02deb
 --- /dev/null
 +++ b/kexgsss.c
-@@ -0,0 +1,300 @@
+@@ -0,0 +1,474 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1924,7 +2228,7 @@ index 000000000..18070f1d7
 +
 +#include "includes.h"
 +
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +
 +#include <string.h>
 +
@@ -1942,40 +2246,41 @@ index 000000000..18070f1d7
 +#include "dh.h"
 +#include "ssh-gss.h"
 +#include "monitor_wrap.h"
-+#include "misc.h"
++#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
 +#include "servconf.h"
++#include "ssh-gss.h"
 +#include "digest.h"
++#include "ssherr.h"
 +
 +extern ServerOptions options;
 +
 +int
 +kexgss_server(struct ssh *ssh)
 +{
++       struct kex *kex = ssh->kex;
 +       OM_uint32 maj_status, min_status;
-+       
-+       /* 
++
++       /*
 +        * Some GSSAPI implementations use the input value of ret_flags (an
-+        * output variable) as a means of triggering mechanism specific 
-+        * features. Initializing it to zero avoids inadvertently 
-+        * activating this non-standard behaviour.
++        * output variable) as a means of triggering mechanism specific
++        * features. Initializing it to zero avoids inadvertently
++        * activating this non-standard behaviour.
 +        */
 +
 +       OM_uint32 ret_flags = 0;
 +       gss_buffer_desc gssbuf, recv_tok, msg_tok;
 +       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +       Gssctxt *ctxt = NULL;
-+       u_int slen, klen, kout;
-+       u_char *kbuf;
-+       DH *dh;
-+       int min = -1, max = -1, nbits = -1;
-+       const BIGNUM *pub_key, *dh_p, *dh_g;
-+       BIGNUM *shared_secret = NULL;
-+       BIGNUM *dh_client_pub = NULL;
++       struct sshbuf *shared_secret = NULL;
++       struct sshbuf *client_pubkey = NULL;
++       struct sshbuf *server_pubkey = NULL;
++       struct sshbuf *empty = sshbuf_new();
 +       int type = 0;
 +       gss_OID oid;
 +       char *mechs;
 +       u_char hash[SSH_DIGEST_MAX_LENGTH];
 +       size_t hashlen;
++       int r;
 +
 +       /* Initialise GSSAPI */
 +
@@ -1988,8 +2293,8 @@ index 000000000..18070f1d7
 +               free(mechs);
 +       }
 +
-+       debug2("%s: Identifying %s", __func__, ssh->kex->name);
-+       oid = ssh_gssapi_id_kex(NULL, ssh->kex->name, ssh->kex->kex_type);
++       debug2("%s: Identifying %s", __func__, kex->name);
++       oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
 +       if (oid == GSS_C_NO_OID)
 +          fatal("Unknown gssapi mechanism");
 +
@@ -1998,94 +2303,82 @@ index 000000000..18070f1d7
 +       if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
 +               fatal("Unable to acquire credentials for the server");
 +
-+       switch (ssh->kex->kex_type) {
-+       case KEX_GSS_GRP1_SHA1:
-+               dh = dh_new_group1();
-+               break;
-+       case KEX_GSS_GRP14_SHA1:
-+               dh = dh_new_group14();
-+               break;
-+       case KEX_GSS_GEX_SHA1:
-+               debug("Doing group exchange");
-+               packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);
-+               min = packet_get_int();
-+               nbits = packet_get_int();
-+               max = packet_get_int();
-+               packet_check_eom();
-+               if (max < min || nbits < min || max < nbits)
-+                       fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
-+                           min, nbits, max);
-+               dh = PRIVSEP(choose_dh(MAX(DH_GRP_MIN, min),
-+                   nbits, MIN(DH_GRP_MAX, max)));
-+               if (dh == NULL)
-+                       packet_disconnect("Protocol error: no matching group found");
-+               DH_get0_pqg(dh, &dh_p, NULL, &dh_g);
-+
-+               packet_start(SSH2_MSG_KEXGSS_GROUP);
-+               packet_put_bignum2(dh_p);
-+               packet_put_bignum2(dh_g);
-+               packet_send();
-+
-+               packet_write_wait();
-+               break;
-+       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
-+       }
-+
-+       dh_gen_key(dh, ssh->kex->we_need * 8);
-+
 +       do {
-+               debug("Wait SSH2_MSG_GSSAPI_INIT");
-+               type = packet_read();
++               debug("Wait SSH2_MSG_KEXGSS_INIT");
++               type = ssh_packet_read(ssh);
 +               switch(type) {
 +               case SSH2_MSG_KEXGSS_INIT:
-+                       if (dh_client_pub != NULL) 
++                       if (client_pubkey != NULL)
 +                               fatal("Received KEXGSS_INIT after initialising");
-+                       recv_tok.value = packet_get_string(&slen);
-+                       recv_tok.length = slen; 
-+
-+                       if ((dh_client_pub = BN_new()) == NULL)
-+                               fatal("dh_client_pub == NULL");
-+
-+                       packet_get_bignum2(dh_client_pub);
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++
++                       switch (kex->kex_type) {
++                       case KEX_GSS_GRP1_SHA1:
++                       case KEX_GSS_GRP14_SHA1:
++                       case KEX_GSS_GRP14_SHA256:
++                       case KEX_GSS_GRP16_SHA512:
++                               r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
++                                   &shared_secret);
++                               break;
++                       case KEX_GSS_NISTP256_SHA256:
++                               r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
++                                   &shared_secret);
++                               break;
++                       case KEX_GSS_C25519_SHA256:
++                               r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
++                                   &shared_secret);
++                               break;
++                       default:
++                               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++                       }
++                       if (r != 0)
++                               goto out;
 +
 +                       /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
 +                       break;
 +               case SSH2_MSG_KEXGSS_CONTINUE:
-+                       recv_tok.value = packet_get_string(&slen);
-+                       recv_tok.length = slen; 
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
 +                       break;
 +               default:
-+                       packet_disconnect(
++                       sshpkt_disconnect(ssh,
 +                           "Protocol error: didn't expect packet type %d",
 +                           type);
 +               }
 +
-+               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, 
++               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
 +                   &send_tok, &ret_flags));
 +
-+               free(recv_tok.value);
++               gss_release_buffer(&min_status, &recv_tok);
 +
 +               if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
 +                       fatal("Zero length token output when incomplete");
 +
-+               if (dh_client_pub == NULL)
++               if (client_pubkey == NULL)
 +                       fatal("No client public key");
-+               
++
 +               if (maj_status & GSS_S_CONTINUE_NEEDED) {
 +                       debug("Sending GSSAPI_CONTINUE");
-+                       packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                       packet_put_string(send_tok.value, send_tok.length);
-+                       packet_send();
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
 +                       gss_release_buffer(&min_status, &send_tok);
 +               }
 +       } while (maj_status & GSS_S_CONTINUE_NEEDED);
 +
 +       if (GSS_ERROR(maj_status)) {
 +               if (send_tok.length > 0) {
-+                       packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                       packet_put_string(send_tok.value, send_tok.length);
-+                       packet_send();
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
 +               }
 +               fatal("accept_ctx died");
 +       }
@@ -2095,123 +2388,320 @@ index 000000000..18070f1d7
 +
 +       if (!(ret_flags & GSS_C_INTEG_FLAG))
 +               fatal("Integrity flag wasn't set");
-+       
-+       if (!dh_pub_is_valid(dh, dh_client_pub))
-+               packet_disconnect("bad client public DH value");
 +
-+       klen = DH_size(dh);
-+       kbuf = xmalloc(klen); 
-+       kout = DH_compute_key(kbuf, dh_client_pub, dh);
-+       if (kout < 0)
-+               fatal("DH_compute_key: failed");
++       hashlen = sizeof(hash);
++       if ((r = kex_gen_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->peer,
++           kex->my,
++           empty,
++           client_pubkey,
++           server_pubkey,
++           shared_secret,
++           hash, &hashlen)) != 0)
++               goto out;
 +
-+       shared_secret = BN_new();
-+       if (shared_secret == NULL)
-+               fatal("kexgss_server: BN_new failed");
++       gssbuf.value = hash;
++       gssbuf.length = hashlen;
 +
-+       if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
-+               fatal("kexgss_server: BN_bin2bn failed");
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))))
++               fatal("Couldn't get MIC");
 +
-+       memset(kbuf, 0, klen);
-+       free(kbuf);
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 ||
++           (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
++           (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
 +
-+       DH_get0_key(dh, &pub_key, NULL);
-+       DH_get0_pqg(dh, &dh_p, NULL, &dh_g);
++       if (send_tok.length != 0) {
++               if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */
++                   (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0)
++                       fatal("sshpkt failed: %s", ssh_err(r));
++       } else {
++               if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */
++                       fatal("sshpkt failed: %s", ssh_err(r));
++       }
++       if ((r = sshpkt_send(ssh)) != 0)
++               fatal("sshpkt_send failed: %s", ssh_err(r));
 +
-+       hashlen = sizeof(hash);
-+       switch (ssh->kex->kex_type) {
-+       case KEX_GSS_GRP1_SHA1:
-+       case KEX_GSS_GRP14_SHA1:
-+               kex_dh_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string, ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   NULL, 0, /* Change this if we start sending host keys */
-+                   dh_client_pub, pub_key, shared_secret,
-+                   hash, &hashlen
-+               );
-+               break;
-+       case KEX_GSS_GEX_SHA1:
-+               kexgex_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string, ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   NULL, 0,
-+                   min, nbits, max,
-+                   dh_p, dh_g,
-+                   dh_client_pub,
-+                   pub_key,
-+                   shared_secret,
-+                   hash, &hashlen
-+               );
-+               break;
-+       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
++       gss_release_buffer(&min_status, &send_tok);
++       gss_release_buffer(&min_status, &msg_tok);
++
++       if (gss_kex_context == NULL)
++               gss_kex_context = ctxt;
++       else
++               ssh_gssapi_delete_ctx(&ctxt);
++
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
++
++       /* If this was a rekey, then save out any delegated credentials we
++        * just exchanged.  */
++       if (options.gss_store_rekey)
++               ssh_gssapi_rekey_creds();
++out:
++       sshbuf_free(empty);
++       explicit_bzero(hash, sizeof(hash));
++       sshbuf_free(shared_secret);
++       sshbuf_free(client_pubkey);
++       sshbuf_free(server_pubkey);
++       return r;
++}
++
++int
++kexgssgex_server(struct ssh *ssh)
++{
++       struct kex *kex = ssh->kex;
++       OM_uint32 maj_status, min_status;
++
++       /*
++        * Some GSSAPI implementations use the input value of ret_flags (an
++        * output variable) as a means of triggering mechanism specific
++        * features. Initializing it to zero avoids inadvertently
++        * activating this non-standard behaviour.
++        */
++
++       OM_uint32 ret_flags = 0;
++       gss_buffer_desc gssbuf, recv_tok, msg_tok;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
++       Gssctxt *ctxt = NULL;
++       struct sshbuf *shared_secret = NULL;
++       int type = 0;
++       gss_OID oid;
++       char *mechs;
++       u_char hash[SSH_DIGEST_MAX_LENGTH];
++       size_t hashlen;
++       BIGNUM *dh_client_pub = NULL;
++       const BIGNUM *pub_key, *dh_p, *dh_g;
++       int min = -1, max = -1, nbits = -1;
++       int cmin = -1, cmax = -1; /* client proposal */
++       struct sshbuf *empty = sshbuf_new();
++       int r;
++
++       /* Initialise GSSAPI */
++
++       /* If we're rekeying, privsep means that some of the private structures
++        * in the GSSAPI code are no longer available. This kludges them back
++        * into life
++        */
++       if (!ssh_gssapi_oid_table_ok())
++               if ((mechs = ssh_gssapi_server_mechanisms()))
++                       free(mechs);
++
++       debug2("%s: Identifying %s", __func__, kex->name);
++       oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
++       if (oid == GSS_C_NO_OID)
++          fatal("Unknown gssapi mechanism");
++
++       debug2("%s: Acquiring credentials", __func__);
++
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
++               fatal("Unable to acquire credentials for the server");
++
++       /* 5. S generates an ephemeral key pair (do the allocations early) */
++       debug("Doing group exchange");
++       ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUPREQ);
++       /* store client proposal to provide valid signature */
++       if ((r = sshpkt_get_u32(ssh, &cmin)) != 0 ||
++           (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
++           (r = sshpkt_get_u32(ssh, &cmax)) != 0 ||
++           (r = sshpkt_get_end(ssh)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
++       kex->nbits = nbits;
++       kex->min = cmin;
++       kex->max = cmax;
++       min = MAX(DH_GRP_MIN, cmin);
++       max = MIN(DH_GRP_MAX, cmax);
++       nbits = MAXIMUM(DH_GRP_MIN, nbits);
++       nbits = MINIMUM(DH_GRP_MAX, nbits);
++       if (max < min || nbits < min || max < nbits)
++               fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
++                   min, nbits, max);
++       kex->dh = PRIVSEP(choose_dh(min, nbits, max));
++       if (kex->dh == NULL) {
++               sshpkt_disconnect(ssh, "Protocol error: no matching group found");
++               fatal("Protocol error: no matching group found");
 +       }
 +
-+       BN_clear_free(dh_client_pub);
++       DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 ||
++           (r = sshpkt_put_bignum2(ssh, dh_p)) != 0 ||
++           (r = sshpkt_put_bignum2(ssh, dh_g)) != 0 ||
++           (r = sshpkt_send(ssh)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
++
++       if ((r = ssh_packet_write_wait(ssh)) != 0)
++               fatal("ssh_packet_write_wait: %s", ssh_err(r));
++
++       /* Compute our exchange value in parallel with the client */
++       if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
++               goto out;
++
++       do {
++               debug("Wait SSH2_MSG_GSSAPI_INIT");
++               type = ssh_packet_read(ssh);
++               switch(type) {
++               case SSH2_MSG_KEXGSS_INIT:
++                       if (dh_client_pub != NULL)
++                               fatal("Received KEXGSS_INIT after initialising");
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++
++                       /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
++                       break;
++               case SSH2_MSG_KEXGSS_CONTINUE:
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++                       break;
++               default:
++                       sshpkt_disconnect(ssh,
++                           "Protocol error: didn't expect packet type %d",
++                           type);
++               }
++
++               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
++                   &send_tok, &ret_flags));
++
++               gss_release_buffer(&min_status, &recv_tok);
++
++               if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
++                       fatal("Zero length token output when incomplete");
++
++               if (dh_client_pub == NULL)
++                       fatal("No client public key");
++
++               if (maj_status & GSS_S_CONTINUE_NEEDED) {
++                       debug("Sending GSSAPI_CONTINUE");
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++                       gss_release_buffer(&min_status, &send_tok);
++               }
++       } while (maj_status & GSS_S_CONTINUE_NEEDED);
++
++       if (GSS_ERROR(maj_status)) {
++               if (send_tok.length > 0) {
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++               }
++               fatal("accept_ctx died");
++       }
 +
-+       if (ssh->kex->session_id == NULL) {
-+               ssh->kex->session_id_len = hashlen;
-+               ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);
-+               memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);
++       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
++               fatal("Mutual Authentication flag wasn't set");
++
++       if (!(ret_flags & GSS_C_INTEG_FLAG))
++               fatal("Integrity flag wasn't set");
++
++       /* calculate shared secret */
++       if ((shared_secret = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
 +       }
++       if ((r = kex_dh_compute_key(kex, dh_client_pub, shared_secret)) != 0)
++               goto out;
++
++       DH_get0_key(kex->dh, &pub_key, NULL);
++       DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
++       hashlen = sizeof(hash);
++       if ((r = kexgex_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->peer,
++           kex->my,
++           empty,
++           cmin, nbits, cmax,
++           dh_p, dh_g,
++           dh_client_pub,
++           pub_key,
++           sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
++           hash, &hashlen)) != 0)
++               fatal("kexgex_hash failed: %s", ssh_err(r));
 +
 +       gssbuf.value = hash;
 +       gssbuf.length = hashlen;
 +
-+       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok))))
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))))
 +               fatal("Couldn't get MIC");
 +
-+       packet_start(SSH2_MSG_KEXGSS_COMPLETE);
-+       packet_put_bignum2(pub_key);
-+       packet_put_string(msg_tok.value,msg_tok.length);
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 ||
++           (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||
++           (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
 +
 +       if (send_tok.length != 0) {
-+               packet_put_char(1); /* true */
-+               packet_put_string(send_tok.value, send_tok.length);
++               if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */
++                   (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0)
++                       fatal("sshpkt failed: %s", ssh_err(r));
 +       } else {
-+               packet_put_char(0); /* false */
++               if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */
++                       fatal("sshpkt failed: %s", ssh_err(r));
 +       }
-+       packet_send();
++       if ((r = sshpkt_send(ssh)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
 +
 +       gss_release_buffer(&min_status, &send_tok);
 +       gss_release_buffer(&min_status, &msg_tok);
 +
 +       if (gss_kex_context == NULL)
 +               gss_kex_context = ctxt;
-+       else 
++       else
 +               ssh_gssapi_delete_ctx(&ctxt);
 +
-+       DH_free(dh);
-+
-+       kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);
-+       BN_clear_free(shared_secret);
-+       kex_send_newkeys(ssh);
++       /* Finally derive the keys and send them */
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
 +
 +       /* If this was a rekey, then save out any delegated credentials we
 +        * just exchanged.  */
 +       if (options.gss_store_rekey)
 +               ssh_gssapi_rekey_creds();
-+       return 0;
++out:
++       sshbuf_free(empty);
++       explicit_bzero(hash, sizeof(hash));
++       DH_free(kex->dh);
++       kex->dh = NULL;
++       BN_clear_free(dh_client_pub);
++       sshbuf_free(shared_secret);
++       return r;
 +}
-+#endif /* GSSAPI */
++#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
+diff --git a/mac.c b/mac.c
+index 51dc11d76..3d11eba62 100644
+--- a/mac.c
++++ b/mac.c
+@@ -29,6 +29,7 @@
+ 
+ #include <string.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ 
+ #include "digest.h"
+ #include "hmac.h"
 diff --git a/monitor.c b/monitor.c
-index 531b2993a..eabc1e89b 100644
+index 60e529444..0766d6ef5 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -145,6 +145,8 @@ int mm_answer_gss_setup_ctx(int, struct sshbuf *);
- int mm_answer_gss_accept_ctx(int, struct sshbuf *);
- int mm_answer_gss_userok(int, struct sshbuf *);
- int mm_answer_gss_checkmic(int, struct sshbuf *);
-+int mm_answer_gss_sign(int, struct sshbuf *);
-+int mm_answer_gss_updatecreds(int, struct sshbuf *);
+@@ -147,6 +147,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
++int mm_answer_gss_sign(struct ssh *, int, struct sshbuf *);
++int mm_answer_gss_updatecreds(struct ssh *, int, struct sshbuf *);
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -215,11 +217,18 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -219,11 +221,18 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
@@ -2230,7 +2720,7 @@ index 531b2993a..eabc1e89b 100644
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -289,6 +298,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
+@@ -292,6 +301,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
         /* Permit requests for moduli and signatures */
         monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
         monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2241,32 +2731,36 @@ index 531b2993a..eabc1e89b 100644
  
         /* The first few requests do not require asynchronous access */
         while (!authenticated) {
-@@ -401,6 +414,10 @@ monitor_child_postauth(struct monitor *pmonitor)
+@@ -405,6 +418,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
         monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
         monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
         monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
 +#ifdef GSSAPI
 +       /* and for the GSSAPI key exchange */
 +       monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
-+#endif         
++#endif
  
         if (auth_opts->permit_pty_flag) {
                 monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1666,6 +1683,13 @@ monitor_apply_keystate(struct monitor *pmonitor)
+@@ -1687,6 +1704,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+ # ifdef OPENSSL_HAS_ECC
+                kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
- #endif /* WITH_OPENSSL */
-                kex->kex[KEX_C25519_SHA256] = kexc25519_server;
-+#ifdef GSSAPI
++# ifdef GSSAPI
 +               if (options.gss_keyex) {
 +                       kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
 +                       kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+                       kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++                       kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
++                       kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
++                       kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server;
++                       kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server;
++                       kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
 +               }
-+#endif
-                kex->load_host_public_key=&get_hostkey_public_by_type;
-                kex->load_host_private_key=&get_hostkey_private_by_type;
-                kex->host_key_index=&get_hostkey_index;
-@@ -1756,8 +1780,8 @@ mm_answer_gss_setup_ctx(int sock, struct sshbuf *m)
++# endif
+ #endif /* WITH_OPENSSL */
+                kex->kex[KEX_C25519_SHA256] = kex_gen_server;
+                kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
+@@ -1780,8 +1808,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
         u_char *p;
         int r;
  
@@ -2277,7 +2771,7 @@ index 531b2993a..eabc1e89b 100644
  
         if ((r = sshbuf_get_string(m, &p, &len)) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1789,8 +1813,8 @@ mm_answer_gss_accept_ctx(int sock, struct sshbuf *m)
+@@ -1813,8 +1841,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
         OM_uint32 flags = 0; /* GSI needs this */
         int r;
  
@@ -2288,7 +2782,7 @@ index 531b2993a..eabc1e89b 100644
  
         if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1810,6 +1834,7 @@ mm_answer_gss_accept_ctx(int sock, struct sshbuf *m)
+@@ -1834,6 +1862,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2296,7 +2790,7 @@ index 531b2993a..eabc1e89b 100644
         }
         return (0);
  }
-@@ -1821,8 +1846,8 @@ mm_answer_gss_checkmic(int sock, struct sshbuf *m)
+@@ -1845,8 +1874,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
         OM_uint32 ret;
         int r;
  
@@ -2307,8 +2801,12 @@ index 531b2993a..eabc1e89b 100644
  
         if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
             (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -1851,10 +1876,11 @@ mm_answer_gss_userok(int sock, struct sshbuf *m)
-        int r, authenticated;
+@@ -1872,13 +1901,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+ int
+ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+ {
+-       int r, authenticated;
++       int r, authenticated, kex;
         const char *displayname;
  
 -       if (!options.gss_authentication)
@@ -2317,24 +2815,40 @@ index 531b2993a..eabc1e89b 100644
 +               fatal("%s: GSSAPI not enabled", __func__);
  
 -       authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user);
-+       authenticated = authctxt->valid && 
-+           ssh_gssapi_userok(authctxt->user, authctxt->pw);
++       if ((r = sshbuf_get_u32(m, &kex)) != 0)
++               fatal("%s: buffer error: %s", __func__, ssh_err(r));
++
++       authenticated = authctxt->valid &&
++           ssh_gssapi_userok(authctxt->user, authctxt->pw, kex);
  
         sshbuf_reset(m);
         if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -1871,5 +1897,83 @@ mm_answer_gss_userok(int sock, struct sshbuf *m)
+@@ -1887,7 +1920,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+        debug3("%s: sending result %d", __func__, authenticated);
+        mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
+ 
+-       auth_method = "gssapi-with-mic";
++       if (kex) {
++               auth_method = "gssapi-keyex";
++       } else {
++               auth_method = "gssapi-with-mic";
++       }
+ 
+        if ((displayname = ssh_gssapi_displayname()) != NULL)
+                auth2_record_info(authctxt, "%s", displayname);
+@@ -1895,5 +1932,85 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
         /* Monitor loop will terminate if authenticated */
         return (authenticated);
  }
 +
-+int 
-+mm_answer_gss_sign(int socket, struct sshbuf *m)
++int
++mm_answer_gss_sign(struct ssh *ssh, int socket, struct sshbuf *m)
 +{
 +       gss_buffer_desc data;
 +       gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
 +       OM_uint32 major, minor;
 +       size_t len;
-+       u_char *p;
++       u_char *p = NULL;
 +       int r;
 +
 +       if (!options.gss_authentication && !options.gss_keyex)
@@ -2344,8 +2858,9 @@ index 531b2993a..eabc1e89b 100644
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +       data.value = p;
 +       data.length = len;
-+       if (data.length != 20) 
-+               fatal("%s: data length incorrect: %d", __func__, 
++       /* Lengths of SHA-1, SHA-256 and SHA-512 hashes that are used */
++       if (data.length != 20 && data.length != 32 && data.length != 64)
++               fatal("%s: data length incorrect: %d", __func__,
 +                   (int) data.length);
 +
 +       /* Save the session ID on the first time around */
@@ -2359,6 +2874,7 @@ index 531b2993a..eabc1e89b 100644
 +       free(data.value);
 +
 +       sshbuf_reset(m);
++
 +       if ((r = sshbuf_put_u32(m, major)) != 0 ||
 +           (r = sshbuf_put_string(m, hash.value, hash.length)) != 0)
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
@@ -2369,7 +2885,7 @@ index 531b2993a..eabc1e89b 100644
 +
 +       /* Turn on getpwnam permissions */
 +       monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
-+       
++
 +       /* And credential updating, for when rekeying */
 +       monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1);
 +
@@ -2377,16 +2893,16 @@ index 531b2993a..eabc1e89b 100644
 +}
 +
 +int
-+mm_answer_gss_updatecreds(int socket, struct sshbuf *m) {
++mm_answer_gss_updatecreds(struct ssh *ssh, int socket, struct sshbuf *m) {
 +       ssh_gssapi_ccache store;
 +       int r, ok;
 +
 +       if (!options.gss_authentication && !options.gss_keyex)
 +               fatal("%s: GSSAPI not enabled", __func__);
 +
-+       if ((r = sshbuf_get_cstring(m, &store.filename, NULL)) != 0 ||
-+           (r = sshbuf_get_cstring(m, &store.envvar, NULL)) != 0 ||
-+           (r = sshbuf_get_cstring(m, &store.envval, NULL)) != 0)
++       if ((r = sshbuf_get_string(m, (u_char **)&store.filename, NULL)) != 0 ||
++           (r = sshbuf_get_string(m, (u_char **)&store.envvar, NULL)) != 0 ||
++           (r = sshbuf_get_string(m, (u_char **)&store.envval, NULL)) != 0)
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +       ok = ssh_gssapi_update_creds(&store);
@@ -2407,33 +2923,40 @@ index 531b2993a..eabc1e89b 100644
  #endif /* GSSAPI */
  
 diff --git a/monitor.h b/monitor.h
-index 16047299f..44fbed589 100644
+index 683e5e071..2b1a2d590 100644
 --- a/monitor.h
 +++ b/monitor.h
-@@ -63,6 +63,9 @@ enum monitor_reqtype {
+@@ -63,6 +63,8 @@ enum monitor_reqtype {
         MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
         MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
  
 +       MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
 +       MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
-+
  };
  
- struct monitor {
+ struct ssh;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 732fb3476..1865a122a 100644
+index 186e8f022..8e4c1c1f8 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -984,7 +984,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+@@ -978,13 +978,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
  }
  
  int
 -mm_ssh_gssapi_userok(char *user)
-+mm_ssh_gssapi_userok(char *user, struct passwd *pw)
++mm_ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  {
         struct sshbuf *m;
         int r, authenticated = 0;
-@@ -1003,4 +1003,55 @@ mm_ssh_gssapi_userok(char *user)
+ 
+        if ((m = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
++       if ((r = sshbuf_put_u32(m, kex)) != 0)
++               fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 
+        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
+        mm_request_receive_expect(pmonitor->m_recvfd,
+@@ -997,4 +999,57 @@ mm_ssh_gssapi_userok(char *user)
         debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
         return (authenticated);
  }
@@ -2459,7 +2982,7 @@ index 732fb3476..1865a122a 100644
 +
 +       sshbuf_free(m);
 +
-+       return(major);
++       return (major);
 +}
 +
 +int
@@ -2470,6 +2993,7 @@ index 732fb3476..1865a122a 100644
 +
 +       if ((m = sshbuf_new()) == NULL)
 +               fatal("%s: sshbuf_new failed", __func__);
++
 +       if ((r = sshbuf_put_cstring(m,
 +           store->filename ? store->filename : "")) != 0 ||
 +           (r = sshbuf_put_cstring(m,
@@ -2483,6 +3007,7 @@ index 732fb3476..1865a122a 100644
 +
 +       if ((r = sshbuf_get_u32(m, &ok)) != 0)
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
++
 +       sshbuf_free(m);
 +
 +       return (ok);
@@ -2490,61 +3015,43 @@ index 732fb3476..1865a122a 100644
 +
  #endif /* GSSAPI */
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 644da081d..7f93144ff 100644
+index fdebb3aa4..69164a8c0 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
-@@ -60,8 +60,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
+@@ -61,8 +61,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
     gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
 -int mm_ssh_gssapi_userok(char *user);
-+int mm_ssh_gssapi_userok(char *user, struct passwd *);
++int mm_ssh_gssapi_userok(char *user, struct passwd *, int kex);
  OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
 +OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
 +int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *);
  #endif
  
  #ifdef USE_PAM
-diff --git a/opacket.c b/opacket.c
-index e637d7a71..7672c0b59 100644
---- a/opacket.c
-+++ b/opacket.c
-@@ -80,7 +80,7 @@ ssh_packet_put_raw(struct ssh *ssh, const void *buf, u_int len)
- 
- #ifdef WITH_OPENSSL
- void
--ssh_packet_put_bignum2(struct ssh *ssh, BIGNUM * value)
-+ssh_packet_put_bignum2(struct ssh *ssh, const BIGNUM * value)
- {
-        int r;
- 
-diff --git a/opacket.h b/opacket.h
-index f92fe586e..1cf66a2d3 100644
---- a/opacket.h
-+++ b/opacket.h
-@@ -7,7 +7,7 @@ void     ssh_packet_start(struct ssh *, u_char);
- void     ssh_packet_put_char(struct ssh *, int ch);
- void     ssh_packet_put_int(struct ssh *, u_int value);
- void     ssh_packet_put_int64(struct ssh *, u_int64_t value);
--void     ssh_packet_put_bignum2(struct ssh *, BIGNUM * value);
-+void     ssh_packet_put_bignum2(struct ssh *, const BIGNUM * value);
- void     ssh_packet_put_ecpoint(struct ssh *, const EC_GROUP *, const EC_POINT *);
- void     ssh_packet_put_string(struct ssh *, const void *buf, u_int len);
- void     ssh_packet_put_cstring(struct ssh *, const char *str);
 diff --git a/readconf.c b/readconf.c
-index 433811521..36bc5e59a 100644
+index ec497e79f..4d699e5f1 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -161,6 +161,8 @@ typedef enum {
+@@ -67,6 +67,7 @@
+ #include "uidswap.h"
+ #include "myproposal.h"
+ #include "digest.h"
++#include "ssh-gss.h"
+ 
+ /* Format of the configuration file:
+ 
+@@ -162,6 +163,8 @@ typedef enum {
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 +       oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
-+       oGssServerIdentity, 
++       oGssServerIdentity, oGssKexAlgorithms,
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
         oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
         oHashKnownHosts,
-@@ -201,10 +203,20 @@ static struct {
+@@ -202,10 +205,22 @@ static struct {
         /* Sometimes-unsupported options */
  #if defined(GSSAPI)
         { "gssapiauthentication", oGssAuthentication },
@@ -2554,6 +3061,7 @@ index 433811521..36bc5e59a 100644
 +       { "gssapiclientidentity", oGssClientIdentity },
 +       { "gssapiserveridentity", oGssServerIdentity },
 +       { "gssapirenewalforcesrekey", oGssRenewalRekey },
++       { "gssapikexalgorithms", oGssKexAlgorithms },
  # else
         { "gssapiauthentication", oUnsupported },
 +       { "gssapikeyexchange", oUnsupported },
@@ -2562,10 +3070,11 @@ index 433811521..36bc5e59a 100644
 +       { "gssapiclientidentity", oUnsupported },
 +       { "gssapiserveridentity", oUnsupported },
 +       { "gssapirenewalforcesrekey", oUnsupported },
++       { "gssapikexalgorithms", oUnsupported },
  #endif
  #ifdef ENABLE_PKCS11
-        { "smartcarddevice", oPKCS11Provider },
-@@ -974,10 +986,30 @@ parse_time:
+        { "pkcs11provider", oPKCS11Provider },
+@@ -983,10 +998,42 @@ parse_time:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2593,10 +3102,22 @@ index 433811521..36bc5e59a 100644
 +               intptr = &options->gss_renewal_rekey;
 +               goto parse_flag;
 +
++       case oGssKexAlgorithms:
++               arg = strdelim(&s);
++               if (!arg || *arg == '\0')
++                       fatal("%.200s line %d: Missing argument.",
++                           filename, linenum);
++               if (!kex_gss_names_valid(arg))
++                       fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.",
++                           filename, linenum, arg ? arg : "<NONE>");
++               if (*activep && options->gss_kex_algorithms == NULL)
++                       options->gss_kex_algorithms = xstrdup(arg);
++               break;
++
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
-@@ -1842,7 +1874,12 @@ initialize_options(Options * options)
+@@ -1854,7 +1901,13 @@ initialize_options(Options * options)
         options->pubkey_authentication = -1;
         options->challenge_response_authentication = -1;
         options->gss_authentication = -1;
@@ -2606,10 +3127,11 @@ index 433811521..36bc5e59a 100644
 +       options->gss_renewal_rekey = -1;
 +       options->gss_client_identity = NULL;
 +       options->gss_server_identity = NULL;
++       options->gss_kex_algorithms = NULL;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
-@@ -1988,8 +2025,14 @@ fill_default_options(Options * options)
+@@ -2000,8 +2053,18 @@ fill_default_options(Options * options)
                 options->challenge_response_authentication = 1;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2621,14 +3143,33 @@ index 433811521..36bc5e59a 100644
 +               options->gss_trust_dns = 0;
 +       if (options->gss_renewal_rekey == -1)
 +               options->gss_renewal_rekey = 0;
++#ifdef GSSAPI
++       if (options->gss_kex_algorithms == NULL)
++               options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
++#endif
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
+@@ -2616,7 +2679,14 @@ dump_client_config(Options *o, const char *host)
+        dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
+ #ifdef GSSAPI
+        dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
++       dump_cfg_fmtint(oGssKeyEx, o->gss_keyex);
+        dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
++       dump_cfg_fmtint(oGssTrustDns, o->gss_trust_dns);
++       dump_cfg_fmtint(oGssRenewalRekey, o->gss_renewal_rekey);
++       dump_cfg_string(oGssClientIdentity, o->gss_client_identity);
++       dump_cfg_string(oGssServerIdentity, o->gss_server_identity);
++       dump_cfg_string(oGssKexAlgorithms, o->gss_kex_algorithms ?
++           o->gss_kex_algorithms : GSS_KEX_DEFAULT_KEX);
+ #endif /* GSSAPI */
+        dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
+        dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
 diff --git a/readconf.h b/readconf.h
-index fc7e38251..8e4900d01 100644
+index 8e36bf32a..0bff6d80a 100644
 --- a/readconf.h
 +++ b/readconf.h
-@@ -40,7 +40,12 @@ typedef struct {
+@@ -40,7 +40,13 @@ typedef struct {
         int     challenge_response_authentication;
                                         /* Try S/Key or TIS, authentication. */
         int     gss_authentication;     /* Try GSS authentication */
@@ -2638,14 +3179,23 @@ index fc7e38251..8e4900d01 100644
 +       int     gss_renewal_rekey;      /* Credential renewal forces rekey */
 +       char    *gss_client_identity;   /* Principal to initiate GSSAPI with */
 +       char    *gss_server_identity;   /* GSSAPI target principal */
++       char    *gss_kex_algorithms;    /* GSSAPI kex methods to be offered by client. */
         int     password_authentication;        /* Try password
                                                  * authentication. */
         int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff --git a/servconf.c b/servconf.c
-index 932d363bb..4668b8a45 100644
+index ffac5d2c7..ffdad31e7 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -124,8 +124,10 @@ initialize_server_options(ServerOptions *options)
+@@ -64,6 +64,7 @@
+ #include "auth.h"
+ #include "myproposal.h"
+ #include "digest.h"
++#include "ssh-gss.h"
+ 
+ static void add_listen_addr(ServerOptions *, const char *,
+     const char *, int);
+@@ -124,8 +125,11 @@ initialize_server_options(ServerOptions *options)
         options->kerberos_ticket_cleanup = -1;
         options->kerberos_get_afs_token = -1;
         options->gss_authentication=-1;
@@ -2653,10 +3203,11 @@ index 932d363bb..4668b8a45 100644
         options->gss_cleanup_creds = -1;
         options->gss_strict_acceptor = -1;
 +       options->gss_store_rekey = -1;
++       options->gss_kex_algorithms = NULL;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
-@@ -337,10 +339,14 @@ fill_default_server_options(ServerOptions *options)
+@@ -351,10 +355,18 @@ fill_default_server_options(ServerOptions *options)
                 options->kerberos_get_afs_token = 0;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2668,18 +3219,22 @@ index 932d363bb..4668b8a45 100644
                 options->gss_strict_acceptor = 1;
 +       if (options->gss_store_rekey == -1)
 +               options->gss_store_rekey = 0;
++#ifdef GSSAPI
++       if (options->gss_kex_algorithms == NULL)
++               options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
++#endif
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
-@@ -485,6 +491,7 @@ typedef enum {
+@@ -498,6 +510,7 @@ typedef enum {
         sHostKeyAlgorithms,
         sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
         sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
-+       sGssKeyEx, sGssStoreRekey,
++       sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
         sAcceptEnv, sSetEnv, sPermitTunnel,
         sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
         sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -559,12 +566,20 @@ static struct {
+@@ -572,12 +585,22 @@ static struct {
  #ifdef GSSAPI
         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -2687,6 +3242,7 @@ index 932d363bb..4668b8a45 100644
         { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 +       { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
 +       { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
++       { "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
  #else
         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
         { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
@@ -2694,13 +3250,14 @@ index 932d363bb..4668b8a45 100644
         { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 +       { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
 +       { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
  #endif
 +       { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
 +       { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1468,6 +1483,10 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -1485,6 +1508,10 @@ process_server_config_line(ServerOptions *options, char *line,
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2711,7 +3268,7 @@ index 932d363bb..4668b8a45 100644
         case sGssCleanupCreds:
                 intptr = &options->gss_cleanup_creds;
                 goto parse_flag;
-@@ -1476,6 +1495,10 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -1493,6 +1520,22 @@ process_server_config_line(ServerOptions *options, char *line,
                 intptr = &options->gss_strict_acceptor;
                 goto parse_flag;
  
@@ -2719,25 +3276,37 @@ index 932d363bb..4668b8a45 100644
 +               intptr = &options->gss_store_rekey;
 +               goto parse_flag;
 +
++       case sGssKexAlgorithms:
++               arg = strdelim(&cp);
++               if (!arg || *arg == '\0')
++                       fatal("%.200s line %d: Missing argument.",
++                           filename, linenum);
++               if (!kex_gss_names_valid(arg))
++                       fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.",
++                           filename, linenum, arg ? arg : "<NONE>");
++               if (*activep && options->gss_kex_algorithms == NULL)
++                       options->gss_kex_algorithms = xstrdup(arg);
++               break;
++
         case sPasswordAuthentication:
                 intptr = &options->password_authentication;
                 goto parse_flag;
-@@ -2560,7 +2583,10 @@ dump_config(ServerOptions *o)
- #endif
+@@ -2579,6 +2622,10 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-+       dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
         dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
++       dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
 +       dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
 +       dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
++       dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
  #endif
         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
         dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff --git a/servconf.h b/servconf.h
-index 0175e00e8..3b76da816 100644
+index 54e0a8d8d..a476d5220 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -125,8 +125,10 @@ typedef struct {
+@@ -126,8 +126,11 @@ typedef struct {
         int     kerberos_get_afs_token;         /* If true, try to get AFS token if
                                                  * authenticated with Kerberos. */
         int     gss_authentication;     /* If true, permit GSSAPI authentication */
@@ -2745,11 +3314,38 @@ index 0175e00e8..3b76da816 100644
         int     gss_cleanup_creds;      /* If true, destroy cred cache on logout */
         int     gss_strict_acceptor;    /* If true, restrict the GSSAPI acceptor name */
 +       int     gss_store_rekey;
++       char   *gss_kex_algorithms;     /* GSSAPI kex methods to be offered by client. */
         int     password_authentication;        /* If true, permit password
                                                  * authentication. */
         int     kbd_interactive_authentication; /* If true, permit */
+diff --git a/session.c b/session.c
+index ac06b08e9..ac3d9d19d 100644
+--- a/session.c
++++ b/session.c
+@@ -2674,13 +2674,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
+ 
+ #ifdef KRB5
+        if (options.kerberos_ticket_cleanup &&
+-           authctxt->krb5_ctx)
++           authctxt->krb5_ctx) {
++               temporarily_use_uid(authctxt->pw);
+                krb5_cleanup_proc(authctxt);
++               restore_uid();
++       }
+ #endif
+ 
+ #ifdef GSSAPI
+-       if (options.gss_cleanup_creds)
++       if (options.gss_cleanup_creds) {
++               temporarily_use_uid(authctxt->pw);
+                ssh_gssapi_cleanup_creds();
++               restore_uid();
++       }
+ #endif
+ 
+        /* remove agent socket */
 diff --git a/ssh-gss.h b/ssh-gss.h
-index 36180d07a..350ce7882 100644
+index 36180d07a..70dd36658 100644
 --- a/ssh-gss.h
 +++ b/ssh-gss.h
 @@ -1,6 +1,6 @@
@@ -2760,7 +3356,7 @@ index 36180d07a..350ce7882 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -61,10 +61,22 @@
+@@ -61,10 +61,30 @@
  
  #define SSH_GSS_OIDTYPE 0x06
  
@@ -2773,7 +3369,15 @@ index 36180d07a..350ce7882 100644
 +#define SSH2_MSG_KEXGSS_GROUP                          41
 +#define KEX_GSS_GRP1_SHA1_ID                           "gss-group1-sha1-"
 +#define KEX_GSS_GRP14_SHA1_ID                          "gss-group14-sha1-"
++#define KEX_GSS_GRP14_SHA256_ID                        "gss-group14-sha256-"
++#define KEX_GSS_GRP16_SHA512_ID                        "gss-group16-sha512-"
 +#define KEX_GSS_GEX_SHA1_ID                            "gss-gex-sha1-"
++#define KEX_GSS_NISTP256_SHA256_ID                     "gss-nistp256-sha256-"
++#define KEX_GSS_C25519_SHA256_ID                       "gss-curve25519-sha256-"
++
++#define        GSS_KEX_DEFAULT_KEX \
++       KEX_GSS_GEX_SHA1_ID "," \
++       KEX_GSS_GRP14_SHA1_ID
 +
  typedef struct {
         char *filename;
@@ -2783,7 +3387,7 @@ index 36180d07a..350ce7882 100644
         void *data;
  } ssh_gssapi_ccache;
  
-@@ -72,8 +84,11 @@ typedef struct {
+@@ -72,8 +92,11 @@ typedef struct {
         gss_buffer_desc displayname;
         gss_buffer_desc exportedname;
         gss_cred_id_t creds;
@@ -2795,7 +3399,7 @@ index 36180d07a..350ce7882 100644
  } ssh_gssapi_client;
  
  typedef struct ssh_gssapi_mech_struct {
-@@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct {
+@@ -84,6 +107,7 @@ typedef struct ssh_gssapi_mech_struct {
         int (*userok) (ssh_gssapi_client *, char *);
         int (*localname) (ssh_gssapi_client *, char **);
         void (*storecreds) (ssh_gssapi_client *);
@@ -2803,7 +3407,7 @@ index 36180d07a..350ce7882 100644
  } ssh_gssapi_mech;
  
  typedef struct {
-@@ -94,10 +110,11 @@ typedef struct {
+@@ -94,10 +118,11 @@ typedef struct {
         gss_OID         oid; /* client */
         gss_cred_id_t   creds; /* server */
         gss_name_t      client; /* server */
@@ -2816,7 +3420,15 @@ index 36180d07a..350ce7882 100644
  
  int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
  void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -123,17 +140,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
+@@ -109,6 +134,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
+ 
+ struct sshbuf;
+ int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
++int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *);
+ 
+ OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
+ OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
+@@ -123,17 +149,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
  OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_buildmic(struct sshbuf *, const char *,
      const char *, const char *);
@@ -2826,17 +3438,17 @@ index 36180d07a..350ce7882 100644
 +int ssh_gssapi_credentials_updated(Gssctxt *);
  
  /* In the server */
-+typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, 
++typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *,
 +    const char *);
-+char *ssh_gssapi_client_mechanisms(const char *, const char *);
++char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *);
 +char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
-+    const char *);
++    const char *, const char *);
 +gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
-+int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, 
++int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *,
 +    const char *);
  OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
 -int ssh_gssapi_userok(char *name);
-+int ssh_gssapi_userok(char *name, struct passwd *);
++int ssh_gssapi_userok(char *name, struct passwd *, int kex);
  OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_do_child(char ***, u_int *);
  void ssh_gssapi_cleanup_creds(void);
@@ -2852,8 +3464,57 @@ index 36180d07a..350ce7882 100644
  #endif /* GSSAPI */
  
  #endif /* _SSH_GSS_H */
+diff --git a/ssh.1 b/ssh.1
+index 9480eba8d..a1c7d2305 100644
+--- a/ssh.1
++++ b/ssh.1
+@@ -497,7 +497,13 @@ For full details of the options listed below, and their possible values, see
+ .It GatewayPorts
+ .It GlobalKnownHostsFile
+ .It GSSAPIAuthentication
++.It GSSAPIKeyExchange
++.It GSSAPIClientIdentity
+ .It GSSAPIDelegateCredentials
++.It GSSAPIKexAlgorithms
++.It GSSAPIRenewalForcesRekey
++.It GSSAPIServerIdentity
++.It GSSAPITrustDns
+ .It HashKnownHosts
+ .It Host
+ .It HostbasedAuthentication
+@@ -573,6 +579,8 @@ flag),
+ (supported message integrity codes),
+ .Ar kex
+ (key exchange algorithms),
++.Ar kex-gss
++(GSSAPI key exchange algorithms),
+ .Ar key
+ (key types),
+ .Ar key-cert
+diff --git a/ssh.c b/ssh.c
+index 91e7c3511..42be7d88f 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -736,6 +736,8 @@ main(int ac, char **av)
+                                cp = mac_alg_list('\n');
+                        else if (strcmp(optarg, "kex") == 0)
+                                cp = kex_alg_list('\n');
++                       else if (strcmp(optarg, "kex-gss") == 0)
++                               cp = kex_gss_alg_list('\n');
+                        else if (strcmp(optarg, "key") == 0)
+                                cp = sshkey_alg_list(0, 0, 0, '\n');
+                        else if (strcmp(optarg, "key-cert") == 0)
+@@ -748,7 +750,7 @@ main(int ac, char **av)
+                                cp = xstrdup("2");
+                        else if (strcmp(optarg, "help") == 0) {
+                                cp = xstrdup(
+-                                   "cipher\ncipher-auth\nkex\nkey\n"
++                                   "cipher\ncipher-auth\nkex\nkex-gss\nkey\n"
+                                    "key-cert\nkey-plain\nmac\n"
+                                    "protocol-version\nsig");
+                        }
 diff --git a/ssh_config b/ssh_config
-index c12f5ef52..bcb9f153d 100644
+index 5e8ef548b..1ff999b68 100644
 --- a/ssh_config
 +++ b/ssh_config
 @@ -24,6 +24,8 @@
@@ -2866,61 +3527,95 @@ index c12f5ef52..bcb9f153d 100644
  #   CheckHostIP yes
  #   AddressFamily any
 diff --git a/ssh_config.5 b/ssh_config.5
-index 4d5b01d3e..16c79368a 100644
+index 412629637..c3c8b274a 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -736,10 +736,42 @@ The default is
+@@ -754,10 +754,67 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
-+.It Cm GSSAPIKeyExchange
-+Specifies whether key exchange based on GSSAPI may be used. When using
-+GSSAPI key exchange the server need not have a host key.
-+The default is
-+.Cm no .
 +.It Cm GSSAPIClientIdentity
-+If set, specifies the GSSAPI client identity that ssh should use when 
-+connecting to the server. The default is unset, which means that the default 
++If set, specifies the GSSAPI client identity that ssh should use when
++connecting to the server. The default is unset, which means that the default
 +identity will be used.
-+.It Cm GSSAPIServerIdentity
-+If set, specifies the GSSAPI server identity that ssh should expect when 
-+connecting to the server. The default is unset, which means that the
-+expected GSSAPI server identity will be determined from the target
-+hostname.
  .It Cm GSSAPIDelegateCredentials
  Forward (delegate) credentials to the server.
  The default is
  .Cm no .
++.It Cm GSSAPIKeyExchange
++Specifies whether key exchange based on GSSAPI may be used. When using
++GSSAPI key exchange the server need not have a host key.
++The default is
++.Dq no .
 +.It Cm GSSAPIRenewalForcesRekey
-+If set to 
-+.Cm yes
++If set to
++.Dq yes
 +then renewal of the client's GSSAPI credentials will force the rekeying of the
-+ssh connection. With a compatible server, this can delegate the renewed 
++ssh connection. With a compatible server, this will delegate the renewed
 +credentials to a session on the server.
++.Pp
++Checks are made to ensure that credentials are only propagated when the new
++credentials match the old ones on the originating client and where the
++receiving server still has the old set in its cache.
++.Pp
 +The default is
-+.Cm no .
++.Dq no .
++.Pp
++For this to work
++.Cm GSSAPIKeyExchange
++needs to be enabled in the server and also used by the client.
++.It Cm GSSAPIServerIdentity
++If set, specifies the GSSAPI server identity that ssh should expect when
++connecting to the server. The default is unset, which means that the
++expected GSSAPI server identity will be determined from the target
++hostname.
 +.It Cm GSSAPITrustDns
-+Set to 
-+.Cm yes
++Set to
++.Dq yes
 +to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If 
-+.Cm no ,
++the name of the host being connected to. If
++.Dq no ,
 +the hostname entered on the
 +command line will be passed untouched to the GSSAPI library.
 +The default is
-+.Cm no .
++.Dq no .
++.It Cm GSSAPIKexAlgorithms
++The list of key exchange algorithms that are offered for GSSAPI
++key exchange. Possible values are
++.Bd -literal -offset 3n
++gss-gex-sha1-,
++gss-group1-sha1-,
++gss-group14-sha1-,
++gss-group14-sha256-,
++gss-group16-sha512-,
++gss-nistp256-sha256-,
++gss-curve25519-sha256-
++.Ed
++.Pp
++The default is
++.Dq gss-gex-sha1-,gss-group14-sha1- .
++This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index 1675f3935..8c872a4fb 100644
+index dffee90b1..4020371ae 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -162,6 +162,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
-        struct kex *kex;
+@@ -78,8 +78,6 @@
+ #endif
+ 
+ /* import */
+-extern char *client_version_string;
+-extern char *server_version_string;
+ extern Options options;
+ 
+ /*
+@@ -161,6 +159,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+        char *s, *all_key;
         int r;
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       char *orig = NULL, *gss = NULL;
 +       char *gss_host = NULL;
 +#endif
@@ -2928,11 +3623,11 @@ index 1675f3935..8c872a4fb 100644
         xxx_host = host;
         xxx_hostaddr = hostaddr;
  
-@@ -194,6 +199,35 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -193,6 +196,35 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
                     order_hostkeyalgs(host, hostaddr, port));
         }
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       if (options.gss_keyex) {
 +               /* Add the GSSAPI mechanisms currently supported on this
 +                * client to the key exchange algorithm proposal */
@@ -2941,19 +3636,19 @@ index 1675f3935..8c872a4fb 100644
 +               if (options.gss_server_identity)
 +                       gss_host = xstrdup(options.gss_server_identity);
 +               else if (options.gss_trust_dns)
-+                       gss_host = remote_hostname(active_state);
++                       gss_host = remote_hostname(ssh);
 +               else
 +                       gss_host = xstrdup(host);
 +
 +               gss = ssh_gssapi_client_mechanisms(gss_host,
-+                   options.gss_client_identity);
++                   options.gss_client_identity, options.gss_kex_algorithms);
 +               if (gss) {
 +                       debug("Offering GSSAPI proposal: %s", gss);
 +                       xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
 +                           "%s,%s", gss, orig);
 +
-+                       /* If we've got GSSAPI algorithms, then we also
-+                        * support the 'null' hostkey, as a last resort */
++                       /* If we've got GSSAPI algorithms, then we also support the
++                        * 'null' hostkey, as a last resort */
 +                       orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
 +                       xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
 +                           "%s,null", orig);
@@ -2962,38 +3657,43 @@ index 1675f3935..8c872a4fb 100644
 +#endif
 +
         if (options.rekey_limit || options.rekey_interval)
-                packet_set_rekey_limits(options.rekey_limit,
+                ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
                     options.rekey_interval);
-@@ -215,15 +249,41 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -211,16 +243,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+ # ifdef OPENSSL_HAS_ECC
+        ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
  # endif
- #endif
-        kex->kex[KEX_C25519_SHA256] = kexc25519_client;
-+#ifdef GSSAPI
++# ifdef GSSAPI
 +       if (options.gss_keyex) {
-+               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
-+               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
-+               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_client;
++               ssh->kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_C25519_SHA256] = kexgss_client;
 +       }
-+#endif
-        kex->client_version_string=client_version_string;
-        kex->server_version_string=server_version_string;
-        kex->verify_host_key=&verify_host_key_callback;
++# endif
+ #endif
+        ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
+        ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_client;
+        ssh->kex->verify_host_key=&verify_host_key_callback;
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       if (options.gss_keyex) {
-+               kex->gss_deleg_creds = options.gss_deleg_creds;
-+               kex->gss_trust_dns = options.gss_trust_dns;
-+               kex->gss_client = options.gss_client_identity;
-+               kex->gss_host = gss_host;
++               ssh->kex->gss_deleg_creds = options.gss_deleg_creds;
++               ssh->kex->gss_trust_dns = options.gss_trust_dns;
++               ssh->kex->gss_client = options.gss_client_identity;
++               ssh->kex->gss_host = gss_host;
 +       }
 +#endif
 +
-        ssh_dispatch_run_fatal(active_state, DISPATCH_BLOCK, &kex->done);
+        ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done);
  
         /* remove ext-info from the KEX proposals for rekeying */
         myproposal[PROPOSAL_KEX_ALGS] =
             compat_kex_proposal(options.kex_algorithms);
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       /* repair myproposal after it was crumpled by the */
 +       /* ext-info removal above */
 +       if (gss) {
@@ -3003,82 +3703,83 @@ index 1675f3935..8c872a4fb 100644
 +               free(gss);
 +       }
 +#endif
-        if ((r = kex_prop2buf(kex->my, myproposal)) != 0)
+        if ((r = kex_prop2buf(ssh->kex->my, myproposal)) != 0)
                 fatal("kex_prop2buf: %s", ssh_err(r));
  
-@@ -314,6 +374,7 @@ int input_gssapi_token(int type, u_int32_t, struct ssh *);
- int    input_gssapi_hash(int type, u_int32_t, struct ssh *);
- int    input_gssapi_error(int, u_int32_t, struct ssh *);
- int    input_gssapi_errtok(int, u_int32_t, struct ssh *);
-+int    userauth_gsskeyex(Authctxt *authctxt);
+@@ -317,6 +379,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
+ static int input_gssapi_token(int type, u_int32_t, struct ssh *);
+ static int input_gssapi_error(int, u_int32_t, struct ssh *);
+ static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
++static int userauth_gsskeyex(struct ssh *);
  #endif
  
- void   userauth(Authctxt *, char *);
-@@ -330,6 +391,11 @@ static char *authmethods_get(void);
+ void   userauth(struct ssh *, char *);
+@@ -333,6 +396,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
 +       {"gssapi-keyex",
 +               userauth_gsskeyex,
 +               NULL,
-+               &options.gss_authentication,
++               &options.gss_keyex,
 +               NULL},
         {"gssapi-with-mic",
                 userauth_gssapi,
-                NULL,
-@@ -686,25 +752,40 @@ userauth_gssapi(Authctxt *authctxt)
-        static u_int mech = 0;
+                userauth_gssapi_cleanup,
+@@ -698,12 +766,25 @@ userauth_gssapi(struct ssh *ssh)
         OM_uint32 min;
         int r, ok = 0;
+        gss_OID mech = NULL;
 +       char *gss_host;
 +
 +       if (options.gss_server_identity)
 +               gss_host = xstrdup(options.gss_server_identity);
 +       else if (options.gss_trust_dns)
-+               gss_host = remote_hostname(active_state);
++               gss_host = remote_hostname(ssh);
 +       else
 +               gss_host = xstrdup(authctxt->host);
  
         /* Try one GSSAPI method at a time, rather than sending them all at
          * once. */
  
-        if (gss_supported == NULL)
--               gss_indicate_mechs(&min, &gss_supported);
-+               if (GSS_ERROR(gss_indicate_mechs(&min, &gss_supported))) {
-+                       gss_supported = NULL;
+        if (authctxt->gss_supported_mechs == NULL)
+-               gss_indicate_mechs(&min, &authctxt->gss_supported_mechs);
++               if (GSS_ERROR(gss_indicate_mechs(&min,
++                   &authctxt->gss_supported_mechs))) {
++                       authctxt->gss_supported_mechs = NULL;
 +                       free(gss_host);
 +                       return 0;
 +               }
  
-        /* Check to see if the mechanism is usable before we offer it */
-        while (mech < gss_supported->count && !ok) {
+        /* Check to see whether the mechanism is usable before we offer it */
+        while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
+@@ -712,13 +793,15 @@ userauth_gssapi(struct ssh *ssh)
+                    elements[authctxt->mech_tried];
                 /* My DER encoding requires length<128 */
-                if (gss_supported->elements[mech].length < 128 &&
-                    ssh_gssapi_check_mechanism(&gssctxt,
--                   &gss_supported->elements[mech], authctxt->host)) {
-+                   &gss_supported->elements[mech], gss_host,
-+                    options.gss_client_identity)) {
+                if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
+-                   mech, authctxt->host)) {
++                   mech, gss_host, options.gss_client_identity)) {
                         ok = 1; /* Mechanism works */
                 } else {
-                        mech++;
+                        authctxt->mech_tried++;
                 }
         }
  
 +       free(gss_host);
 +
-        if (!ok)
+        if (!ok || mech == NULL)
                 return 0;
  
-@@ -935,6 +1016,54 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
+@@ -958,6 +1041,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
         free(lang);
         return r;
  }
 +
 +int
-+userauth_gsskeyex(Authctxt *authctxt)
++userauth_gsskeyex(struct ssh *ssh)
 +{
-+       struct ssh *ssh = active_state; /* XXX */
-+       struct sshbuf *b;
++       struct sshbuf *b = NULL;
++       Authctxt *authctxt = ssh->authctxt;
 +       gss_buffer_desc gssbuf;
 +       gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
 +       OM_uint32 ms;
@@ -3089,12 +3790,13 @@ index 1675f3935..8c872a4fb 100644
 +               return (0);
 +
 +       if (gss_kex_context == NULL) {
-+               debug("No valid Key exchange context"); 
++               debug("No valid Key exchange context");
 +               return (0);
 +       }
 +
 +       if ((b = sshbuf_new()) == NULL)
 +               fatal("%s: sshbuf_new failed", __func__);
++
 +       ssh_gssapi_buildmic(b, authctxt->server_user, authctxt->service,
 +           "gssapi-keyex");
 +
@@ -3123,9 +3825,9 @@ index 1675f3935..8c872a4fb 100644
 +
  #endif /* GSSAPI */
  
- int
+ static int
 diff --git a/sshd.c b/sshd.c
-index ba26287ba..539a000fd 100644
+index cbd3bce91..98680721b 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -123,6 +123,10 @@
@@ -3139,21 +3841,28 @@ index ba26287ba..539a000fd 100644
  /* Re-exec fds */
  #define REEXEC_DEVCRYPTO_RESERVED_FD   (STDERR_FILENO + 1)
  #define REEXEC_STARTUP_PIPE_FD         (STDERR_FILENO + 2)
-@@ -1810,10 +1814,13 @@ main(int ac, char **av)
+@@ -796,8 +800,8 @@ notify_hostkeys(struct ssh *ssh)
+        }
+        debug3("%s: sent %u hostkeys", __func__, nkeys);
+        if (nkeys == 0)
+-               fatal("%s: no hostkeys", __func__);
+-       if ((r = sshpkt_send(ssh)) != 0)
++               debug3("%s: no hostkeys", __func__);
++       else if ((r = sshpkt_send(ssh)) != 0)
+                sshpkt_fatal(ssh, r, "%s: send", __func__);
+        sshbuf_free(buf);
+ }
+@@ -1769,7 +1773,8 @@ main(int ac, char **av)
                 free(fp);
         }
         accumulate_host_timing_secret(cfg, NULL);
-+#ifndef GSSAPI
+-       if (!sensitive_data.have_ssh2_key) {
 +       /* The GSSAPI key exchange can run without a host key */
-        if (!sensitive_data.have_ssh2_key) {
++       if (!sensitive_data.have_ssh2_key && !options.gss_keyex) {
                 logit("sshd: no hostkeys available -- exiting.");
                 exit(1);
         }
-+#endif
- 
-        /*
-         * Load certificates. They are stored in an array at identical
-@@ -2104,6 +2111,60 @@ main(int ac, char **av)
+@@ -2064,6 +2069,60 @@ main(int ac, char **av)
             rdomain == NULL ? "" : "\"");
         free(laddr);
  
@@ -3214,18 +3923,18 @@ index ba26287ba..539a000fd 100644
         /*
          * We don't want to listen forever unless the other side
          * successfully authenticates itself.  So we set up an alarm which is
-@@ -2287,6 +2348,48 @@ do_ssh2_kex(void)
+@@ -2260,6 +2319,48 @@ do_ssh2_kex(struct ssh *ssh)
         myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
             list_hostkey_types());
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       {
 +       char *orig;
 +       char *gss = NULL;
 +       char *newstr = NULL;
 +       orig = myproposal[PROPOSAL_KEX_ALGS];
 +
-+       /* 
++       /*
 +        * If we don't have a host key, then there's no point advertising
 +        * the other key exchange algorithms
 +        */
@@ -3245,10 +3954,10 @@ index ba26287ba..539a000fd 100644
 +       else if (orig)
 +               newstr = orig;
 +
-+       /* 
++       /*
 +        * If we've got GSSAPI mechanisms, then we've got the 'null' host
 +        * key alg, but we can't tell people about it unless its the only
-+        * host key algorithm we support
++        * host key algorithm we support
 +        */
 +       if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0)
 +               myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null";
@@ -3261,22 +3970,28 @@ index ba26287ba..539a000fd 100644
 +#endif
 +
         /* start key exchange */
-        if ((r = kex_setup(active_state, myproposal)) != 0)
+        if ((r = kex_setup(ssh, myproposal)) != 0)
                 fatal("kex_setup: %s", ssh_err(r));
-@@ -2304,6 +2407,13 @@ do_ssh2_kex(void)
+@@ -2275,7 +2376,18 @@ do_ssh2_kex(struct ssh *ssh)
+ # ifdef OPENSSL_HAS_ECC
+        kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
- #endif
-        kex->kex[KEX_C25519_SHA256] = kexc25519_server;
-+#ifdef GSSAPI
+-#endif
++# ifdef GSSAPI
 +       if (options.gss_keyex) {
 +               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
 +               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++               kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
++               kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
++               kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server;
++               kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server;
++               kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
 +       }
-+#endif
-        kex->server = 1;
-        kex->client_version_string=client_version_string;
-        kex->server_version_string=server_version_string;
++# endif
++#endif /* WITH_OPENSSL */
+        kex->kex[KEX_C25519_SHA256] = kex_gen_server;
+        kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
+        kex->load_host_public_key=&get_hostkey_public_by_type;
 diff --git a/sshd_config b/sshd_config
 index 19b7c91a1..2c48105f8 100644
 --- a/sshd_config
@@ -3291,35 +4006,55 @@ index 19b7c91a1..2c48105f8 100644
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff --git a/sshd_config.5 b/sshd_config.5
-index c6484370b..985eef5a2 100644
+index b224f2929..2baa6622b 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -648,6 +648,11 @@ The default is
- Specifies whether user authentication based on GSSAPI is allowed.
+@@ -653,6 +653,11 @@ Specifies whether to automatically destroy the user's credentials cache
+ on logout.
  The default is
- .Cm no .
+ .Cm yes .
 +.It Cm GSSAPIKeyExchange
 +Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
 +doesn't rely on ssh keys to verify host identity.
 +The default is
 +.Cm no .
- .It Cm GSSAPICleanupCredentials
- Specifies whether to automatically destroy the user's credentials cache
- on logout.
-@@ -667,6 +672,11 @@ machine's default store.
+ .It Cm GSSAPIStrictAcceptorCheck
+ Determines whether to be strict about the identity of the GSSAPI acceptor
+ a client authenticates against.
+@@ -667,6 +672,31 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
 +.It Cm GSSAPIStoreCredentialsOnRekey
-+Controls whether the user's GSSAPI credentials should be updated following a 
-+successful connection rekeying. This option can be used to accepted renewed 
++Controls whether the user's GSSAPI credentials should be updated following a
++successful connection rekeying. This option can be used to accepted renewed
 +or updated credentials from a compatible client. The default is
-+.Cm no .
++.Dq no .
++.Pp
++For this to work
++.Cm GSSAPIKeyExchange
++needs to be enabled in the server and also used by the client.
++.It Cm GSSAPIKexAlgorithms
++The list of key exchange algorithms that are accepted by GSSAPI
++key exchange. Possible values are
++.Bd -literal -offset 3n
++gss-gex-sha1-,
++gss-group1-sha1-,
++gss-group14-sha1-,
++gss-group14-sha256-,
++gss-group16-sha512-,
++gss-nistp256-sha256-,
++gss-curve25519-sha256-
++.Ed
++.Pp
++The default is
++.Dq gss-gex-sha1-,gss-group14-sha1- .
++This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HostbasedAcceptedKeyTypes
  Specifies the key types that will be accepted for hostbased authentication
  as a list of comma-separated patterns.
 diff --git a/sshkey.c b/sshkey.c
-index 6555c5ef8..a85c185fc 100644
+index ad1957762..789cd61ef 100644
 --- a/sshkey.c
 +++ b/sshkey.c
 @@ -135,6 +135,7 @@ static const struct keytype keytypes[] = {
@@ -3340,10 +4075,10 @@ index 6555c5ef8..a85c185fc 100644
                 if (!include_sigonly && kt->sigonly)
                         continue;
 diff --git a/sshkey.h b/sshkey.h
-index f6a007fdf..f54deb0c0 100644
+index a91e60436..c11106c93 100644
 --- a/sshkey.h
 +++ b/sshkey.h
-@@ -64,6 +64,7 @@ enum sshkey_types {
+@@ -65,6 +65,7 @@ enum sshkey_types {
         KEY_ED25519_CERT,
         KEY_XMSS,
         KEY_XMSS_CERT,