New upstream release (8.0p1)

35 files changed, 1891 insertions, 2220 deletions

diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index c895e63db..3e5fac6e1 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From 67a6cbb29f77920718884e783238f4a00fe64001 Mon Sep 17 00:00:00 2001
+From f9a76ef65bfb6c17d613ab3db2bf39db5087adfc Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
@@ -13,10 +13,10 @@ Patch-Name: authorized-keys-man-symlink.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/Makefile.in b/Makefile.in
-index 70050ffb6..ee166114d 100644
+index c31821acc..0960a6a03 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -356,6 +356,7 @@ install-files:
+@@ -357,6 +357,7 @@ install-files:
         $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
         $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
         $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/check-filenames-in-scp-client.patch b/debian/patches/check-filenames-in-scp-client.patch
deleted file mode 100644
index 519358ce6..000000000
--- a/debian/patches/check-filenames-in-scp-client.patch
+++ /dev/null
@@ -1,187 +0,0 @@
-From 125924e47db3713a85a70e0f8d6c23818d2ea054 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Sat, 26 Jan 2019 22:41:28 +0000
-Subject: upstream: check in scp client that filenames sent during
-
-remote->local directory copies satisfy the wildcard specified by the user.
-
-This checking provides some protection against a malicious server
-sending unexpected filenames, but it comes at a risk of rejecting wanted
-files due to differences between client and server wildcard expansion rules.
-
-For this reason, this also adds a new -T flag to disable the check.
-
-reported by Harry Sintonen
-fix approach suggested by markus@;
-has been in snaps for ~1wk courtesy deraadt@
-
-OpenBSD-Commit-ID: 00f44b50d2be8e321973f3c6d014260f8f7a8eda
-
-CVE-2019-6111
-
-Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=391ffc4b9d31fa1f4ad566499fef9176ff8a07dc
-Last-Update: 2019-02-08
-
-Patch-Name: check-filenames-in-scp-client.patch
----
- scp.1 | 12 +++++++++++-
- scp.c | 37 +++++++++++++++++++++++++++++--------
- 2 files changed, 40 insertions(+), 9 deletions(-)
-
-diff --git a/scp.1 b/scp.1
-index 0e5cc1b2d..397e77091 100644
---- a/scp.1
-+++ b/scp.1
-@@ -18,7 +18,7 @@
- .Nd secure copy (remote file copy program)
- .Sh SYNOPSIS
- .Nm scp
--.Op Fl 346BCpqrv
-+.Op Fl 346BCpqrTv
- .Op Fl c Ar cipher
- .Op Fl F Ar ssh_config
- .Op Fl i Ar identity_file
-@@ -208,6 +208,16 @@ to use for the encrypted connection.
- The program must understand
- .Xr ssh 1
- options.
-+.It Fl T
-+Disable strict filename checking.
-+By default when copying files from a remote host to a local directory
-+.Nm
-+checks that the received filenames match those requested on the command-line
-+to prevent the remote end from sending unexpected or unwanted files.
-+Because of differences in how various operating systems and shells interpret
-+filename wildcards, these checks may cause wanted files to be rejected.
-+This option disables these checks at the expense of fully trusting that
-+the server will not send unexpected filenames.
- .It Fl v
- Verbose mode.
- Causes
-diff --git a/scp.c b/scp.c
-index 1971c80cd..035037bcc 100644
---- a/scp.c
-+++ b/scp.c
-@@ -94,6 +94,7 @@
- #include <dirent.h>
- #include <errno.h>
- #include <fcntl.h>
-+#include <fnmatch.h>
- #include <limits.h>
- #include <locale.h>
- #include <pwd.h>
-@@ -383,14 +384,14 @@ void verifydir(char *);
- struct passwd *pwd;
- uid_t userid;
- int errs, remin, remout;
--int pflag, iamremote, iamrecursive, targetshouldbedirectory;
-+int Tflag, pflag, iamremote, iamrecursive, targetshouldbedirectory;
- 
- #define        CMDNEEDS        64
- char cmd[CMDNEEDS];            /* must hold "rcp -r -p -d\0" */
- 
- int response(void);
- void rsource(char *, struct stat *);
--void sink(int, char *[]);
-+void sink(int, char *[], const char *);
- void source(int, char *[]);
- void tolocal(int, char *[]);
- void toremote(int, char *[]);
-@@ -429,8 +430,9 @@ main(int argc, char **argv)
-        addargs(&args, "-oRemoteCommand=none");
-        addargs(&args, "-oRequestTTY=no");
- 
--       fflag = tflag = 0;
--       while ((ch = getopt(argc, argv, "dfl:prtvBCc:i:P:q12346S:o:F:")) != -1)
-+       fflag = Tflag = tflag = 0;
-+       while ((ch = getopt(argc, argv,
-+           "dfl:prtTvBCc:i:P:q12346S:o:F:")) != -1) {
-                switch (ch) {
-                /* User-visible flags. */
-                case '1':
-@@ -509,9 +511,13 @@ main(int argc, char **argv)
-                        setmode(0, O_BINARY);
- #endif
-                        break;
-+               case 'T':
-+                       Tflag = 1;
-+                       break;
-                default:
-                        usage();
-                }
-+       }
-        argc -= optind;
-        argv += optind;
- 
-@@ -542,7 +548,7 @@ main(int argc, char **argv)
-        }
-        if (tflag) {
-                /* Receive data. */
--               sink(argc, argv);
-+               sink(argc, argv, NULL);
-                exit(errs != 0);
-        }
-        if (argc < 2)
-@@ -800,7 +806,7 @@ tolocal(int argc, char **argv)
-                        continue;
-                }
-                free(bp);
--               sink(1, argv + argc - 1);
-+               sink(1, argv + argc - 1, src);
-                (void) close(remin);
-                remin = remout = -1;
-        }
-@@ -976,7 +982,7 @@ rsource(char *name, struct stat *statp)
-         (sizeof(type) != 4 && sizeof(type) != 8))
- 
- void
--sink(int argc, char **argv)
-+sink(int argc, char **argv, const char *src)
- {
-        static BUF buffer;
-        struct stat stb;
-@@ -992,6 +998,7 @@ sink(int argc, char **argv)
-        unsigned long long ull;
-        int setimes, targisdir, wrerrno = 0;
-        char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048];
-+       char *src_copy = NULL, *restrict_pattern = NULL;
-        struct timeval tv[2];
- 
- #define        atime   tv[0]
-@@ -1016,6 +1023,17 @@ sink(int argc, char **argv)
-        (void) atomicio(vwrite, remout, "", 1);
-        if (stat(targ, &stb) == 0 && S_ISDIR(stb.st_mode))
-                targisdir = 1;
-+       if (src != NULL && !iamrecursive && !Tflag) {
-+               /*
-+                * Prepare to try to restrict incoming filenames to match
-+                * the requested destination file glob.
-+                */
-+               if ((src_copy = strdup(src)) == NULL)
-+                       fatal("strdup failed");
-+               if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) {
-+                       *restrict_pattern++ = '\0';
-+               }
-+       }
-        for (first = 1;; first = 0) {
-                cp = buf;
-                if (atomicio(read, remin, cp, 1) != 1)
-@@ -1120,6 +1138,9 @@ sink(int argc, char **argv)
-                        run_err("error: unexpected filename: %s", cp);
-                        exit(1);
-                }
-+               if (restrict_pattern != NULL &&
-+                   fnmatch(restrict_pattern, cp, 0) != 0)
-+                       SCREWUP("filename does not match request");
-                if (targisdir) {
-                        static char *namebuf;
-                        static size_t cursize;
-@@ -1157,7 +1178,7 @@ sink(int argc, char **argv)
-                                        goto bad;
-                        }
-                        vect[0] = xstrdup(np);
--                       sink(1, vect);
-+                       sink(1, vect, src);
-                        if (setimes) {
-                                setimes = 0;
-                                if (utimes(vect[0], tv) < 0)
diff --git a/debian/patches/conch-old-privkey-format.patch b/debian/patches/conch-old-privkey-format.patch
index 90bb3e995..40fe32898 100644
--- a/debian/patches/conch-old-privkey-format.patch
+++ b/debian/patches/conch-old-privkey-format.patch
@@ -1,4 +1,4 @@
-From 1d2a55436d4b556269f42ad5f7e16608b5a8ed74 Mon Sep 17 00:00:00 2001
+From 9c01e0ae9889c05bfe68b2f1f1c5e5019e63ff0b Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Thu, 30 Aug 2018 00:58:56 +0100
 Subject: Work around conch interoperability failure
@@ -18,7 +18,7 @@ Patch-Name: conch-old-privkey-format.patch
  3 files changed, 16 insertions(+), 3 deletions(-)
 
 diff --git a/regress/Makefile b/regress/Makefile
-index 647b4a049..6e462a4f6 100644
+index 925edf71a..6fdfcc8ca 100644
 --- a/regress/Makefile
 +++ b/regress/Makefile
 @@ -110,8 +110,9 @@ CLEANFILES= *.core actual agent-key.* authorized_keys_${USERNAME} \
@@ -47,10 +47,10 @@ index 199d863a0..c7df19fd4 100644
             127.0.0.1 "cat ${DATA}" 2>/dev/null | cat > ${COPY}
         if [ $? -ne 0 ]; then
 diff --git a/regress/test-exec.sh b/regress/test-exec.sh
-index 40d46e3cd..1bbd47f25 100644
+index b8e2009de..08338121b 100644
 --- a/regress/test-exec.sh
 +++ b/regress/test-exec.sh
-@@ -504,6 +504,18 @@ REGRESS_INTEROP_CONCH=no
+@@ -500,6 +500,18 @@ REGRESS_INTEROP_CONCH=no
  if test -x "$CONCH" ; then
         REGRESS_INTEROP_CONCH=yes
  fi
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 7963b03ed..61e58e553 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From a18385c6866da4d69f46b64626ae5d60b4cf4a66 Mon Sep 17 00:00:00 2001
+From 085c44daefaee16df97e1b2a0967b2140cc86de0 Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
@@ -8,21 +8,60 @@ initial protocol handshake, for those scared by package-versioning.patch.
 
 Bug-Debian: http://bugs.debian.org/562048
 Forwarded: not-needed
-Last-Update: 2018-10-19
+Last-Update: 2019-06-05
 
 Patch-Name: debian-banner.patch
 ---
+ kex.c         | 5 +++--
+ kex.h         | 2 +-
  servconf.c    | 9 +++++++++
  servconf.h    | 2 ++
+ sshconnect.c  | 2 +-
  sshd.c        | 3 ++-
  sshd_config.5 | 5 +++++
- 4 files changed, 18 insertions(+), 1 deletion(-)
+ 7 files changed, 23 insertions(+), 5 deletions(-)
 
+diff --git a/kex.c b/kex.c
+index be354206d..bbb7a2340 100644
+--- a/kex.c
++++ b/kex.c
+@@ -1168,7 +1168,7 @@ send_error(struct ssh *ssh, char *msg)
+  */
+ int
+ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+-    const char *version_addendum)
++    int debian_banner, const char *version_addendum)
+ {
+        int remote_major, remote_minor, mismatch;
+        size_t len, i, n;
+@@ -1186,7 +1186,8 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+        if (version_addendum != NULL && *version_addendum == '\0')
+                version_addendum = NULL;
+        if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%.100s%s%s\r\n",
+-          PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
++          PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2,
++           debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
+            version_addendum == NULL ? "" : " ",
+            version_addendum == NULL ? "" : version_addendum)) != 0) {
+                error("%s: sshbuf_putf: %s", __func__, ssh_err(r));
+diff --git a/kex.h b/kex.h
+index 2d5f1d4ed..39f67bbc1 100644
+--- a/kex.h
++++ b/kex.h
+@@ -195,7 +195,7 @@ char        *kex_names_cat(const char *, const char *);
+ int     kex_assemble_names(char **, const char *, const char *);
+ int     kex_gss_names_valid(const char *);
+ 
+-int     kex_exchange_identification(struct ssh *, int, const char *);
++int     kex_exchange_identification(struct ssh *, int, int, const char *);
+ 
+ struct kex *kex_new(void);
+ int     kex_ready(struct ssh *, char *[PROPOSAL_MAX]);
 diff --git a/servconf.c b/servconf.c
-index 6caf1db38..c5dd617ef 100644
+index c01e0690e..8d2bced52 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -182,6 +182,7 @@ initialize_server_options(ServerOptions *options)
+@@ -184,6 +184,7 @@ initialize_server_options(ServerOptions *options)
         options->fingerprint_hash = -1;
         options->disable_forwarding = -1;
         options->expose_userauth_info = -1;
@@ -30,7 +69,7 @@ index 6caf1db38..c5dd617ef 100644
  }
  
  /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
-@@ -417,6 +418,8 @@ fill_default_server_options(ServerOptions *options)
+@@ -437,6 +438,8 @@ fill_default_server_options(ServerOptions *options)
                 options->disable_forwarding = 0;
         if (options->expose_userauth_info == -1)
                 options->expose_userauth_info = 0;
@@ -39,7 +78,7 @@ index 6caf1db38..c5dd617ef 100644
  
         assemble_algorithms(options);
  
-@@ -504,6 +507,7 @@ typedef enum {
+@@ -523,6 +526,7 @@ typedef enum {
         sStreamLocalBindMask, sStreamLocalBindUnlink,
         sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
         sExposeAuthInfo, sRDomain,
@@ -47,7 +86,7 @@ index 6caf1db38..c5dd617ef 100644
         sDeprecated, sIgnore, sUnsupported
  } ServerOpCodes;
  
-@@ -661,6 +665,7 @@ static struct {
+@@ -682,6 +686,7 @@ static struct {
         { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL },
         { "rdomain", sRDomain, SSHCFG_ALL },
         { "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
@@ -55,7 +94,7 @@ index 6caf1db38..c5dd617ef 100644
         { NULL, sBadOption, 0 }
  };
  
-@@ -2173,6 +2178,10 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -2211,6 +2216,10 @@ process_server_config_line(ServerOptions *options, char *line,
                         *charptr = xstrdup(arg);
                 break;
  
@@ -67,10 +106,10 @@ index 6caf1db38..c5dd617ef 100644
         case sIgnore:
         case sUnsupported:
 diff --git a/servconf.h b/servconf.h
-index 3b76da816..4e3c54042 100644
+index a476d5220..986093ffa 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -212,6 +212,8 @@ typedef struct {
+@@ -214,6 +214,8 @@ typedef struct {
         int     fingerprint_hash;
         int     expose_userauth_info;
         u_int64_t timing_secret;
@@ -79,22 +118,35 @@ index 3b76da816..4e3c54042 100644
  }       ServerOptions;
  
  /* Information about the incoming connection as used by Match */
+diff --git a/sshconnect.c b/sshconnect.c
+index 0b6f6af4b..1183ffe0e 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -1287,7 +1287,7 @@ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+        lowercase(host);
+ 
+        /* Exchange protocol version identification strings with the server. */
+-       if (kex_exchange_identification(ssh, timeout_ms, NULL) != 0)
++       if (kex_exchange_identification(ssh, timeout_ms, 1, NULL) != 0)
+                cleanup_exit(255); /* error already logged */
+ 
+        /* Put the connection into non-blocking mode. */
 diff --git a/sshd.c b/sshd.c
-index 9481272fc..d7e77d343 100644
+index e3e96426e..1e7ece588 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -384,7 +384,8 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
-        char remote_version[256];       /* Must be at least as big as buf. */
+@@ -2160,7 +2160,8 @@ main(int ac, char **av)
+        if (!debug_flag)
+                alarm(options.login_grace_time);
  
-        xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
--           PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
-+           PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2,
-+           options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
-            *options.version_addendum == '\0' ? "" : " ",
-            options.version_addendum);
+-       if (kex_exchange_identification(ssh, -1, options.version_addendum) != 0)
++       if (kex_exchange_identification(ssh, -1, options.debian_banner,
++           options.version_addendum) != 0)
+                cleanup_exit(255); /* error already logged */
  
+        ssh_packet_set_nonblocking(ssh);
 diff --git a/sshd_config.5 b/sshd_config.5
-index e7e55dd71..37e6be38f 100644
+index 2ef671d1b..addea54a0 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -543,6 +543,11 @@ or
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 4866d52ad..0d47f6706 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From a433d9baa031d7136a8cf3e3807ebff83a3a8634 Mon Sep 17 00:00:00 2001
+From ebd590550bb09fe129b103994d53143788683d05 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -39,10 +39,10 @@ Patch-Name: debian-config.patch
  6 files changed, 77 insertions(+), 9 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 6b01f20d2..661b8bf40 100644
+index cd60007f8..f35bde6e6 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -2000,7 +2000,7 @@ fill_default_options(Options * options)
+@@ -2028,7 +2028,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
@@ -52,10 +52,10 @@ index 6b01f20d2..661b8bf40 100644
                 options->forward_x11_timeout = 1200;
         /*
 diff --git a/ssh.1 b/ssh.1
-index ad1ed0f86..1bcc8edab 100644
+index 8d2b08a29..4e298cb56 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -782,6 +782,16 @@ directive in
+@@ -795,6 +795,16 @@ directive in
  .Xr ssh_config 5
  for more information.
  .Pp
@@ -72,7 +72,7 @@ index ad1ed0f86..1bcc8edab 100644
  .It Fl x
  Disables X11 forwarding.
  .Pp
-@@ -790,6 +800,17 @@ Enables trusted X11 forwarding.
+@@ -803,6 +813,17 @@ Enables trusted X11 forwarding.
  Trusted X11 forwardings are not subjected to the X11 SECURITY extension
  controls.
  .Pp
@@ -91,7 +91,7 @@ index ad1ed0f86..1bcc8edab 100644
  Send log information using the
  .Xr syslog 3
 diff --git a/ssh_config b/ssh_config
-index bcb9f153d..1b676fb2c 100644
+index 1ff999b68..6dd6ecf87 100644
 --- a/ssh_config
 +++ b/ssh_config
 @@ -17,9 +17,10 @@
@@ -106,7 +106,7 @@ index bcb9f153d..1b676fb2c 100644
  #   PasswordAuthentication yes
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
-@@ -46,3 +47,6 @@
+@@ -45,3 +46,6 @@
  #   VisualHostKey no
  #   ProxyCommand ssh -q -W %h:%p gateway.example.com
  #   RekeyLimit 1G 1h
@@ -114,7 +114,7 @@ index bcb9f153d..1b676fb2c 100644
 +    HashKnownHosts yes
 +    GSSAPIAuthentication yes
 diff --git a/ssh_config.5 b/ssh_config.5
-index a91355726..1a8e24bd1 100644
+index 39535c4f8..a27631ae9 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
 @@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more
@@ -140,7 +140,7 @@ index a91355726..1a8e24bd1 100644
  The file contains keyword-argument pairs, one per line.
  Lines starting with
  .Ql #
-@@ -699,11 +715,12 @@ elapsed.
+@@ -717,11 +733,12 @@ elapsed.
  .It Cm ForwardX11Trusted
  If this option is set to
  .Cm yes ,
@@ -204,7 +204,7 @@ index 2c48105f8..ed8272f6d 100644
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
 diff --git a/sshd_config.5 b/sshd_config.5
-index 23f71fd1d..ba50a30f1 100644
+index f995e4ab0..c0c4ebd66 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -56,6 +56,28 @@ Arguments may optionally be enclosed in double quotes
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index e2acdf1a2..6879e11ba 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From 0ee33d93c5c7a5fbb8b027aa24e7c9668125fda9 Mon Sep 17 00:00:00 2001
+From 13a16baaf467fae5d507cdb17e3bc753639bca4f Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index c6bc43299..60ded7c30 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From 1d0c41a7e0b2426733ddb598248d0488c9c00a8b Mon Sep 17 00:00:00 2001
+From 099b0bdc57b9a21842c457d83ff9488fa814c9c4 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
@@ -13,10 +13,10 @@ Patch-Name: doc-hash-tab-completion.patch
  1 file changed, 3 insertions(+)
 
 diff --git a/ssh_config.5 b/ssh_config.5
-index 7d55fa820..a91355726 100644
+index bd1e9311d..39535c4f8 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -793,6 +793,9 @@ Note that existing names and addresses in known hosts files
+@@ -836,6 +836,9 @@ Note that existing names and addresses in known hosts files
  will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
diff --git a/debian/patches/fix-key-type-check.patch b/debian/patches/fix-key-type-check.patch
deleted file mode 100644
index 846df5768..000000000
--- a/debian/patches/fix-key-type-check.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 5e021158aa22cc64da4fca1618ee0bfd2d031049 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Fri, 16 Nov 2018 02:43:56 +0000
-Subject: upstream: fix bug in HostbasedAcceptedKeyTypes and
-
-PubkeyAcceptedKeyTypes options. If only RSA-SHA2 siganture types were
-specified, then authentication would always fail for RSA keys as the monitor
-checks only the base key (not the signature algorithm) type against
-*AcceptedKeyTypes. bz#2746; reported by Jakub Jelen; ok dtucker
-
-OpenBSD-Commit-ID: 117bc3dc54578dbdb515a1d3732988cb5b00461b
-
-Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=cd9467318b56e6e93ff9575c906ff8350af9b8a2
-Last-Update: 2019-02-28
-
-Patch-Name: fix-key-type-check.patch
----
- monitor.c | 39 ++++++++++++++++++++++++++++++++++-----
- 1 file changed, 34 insertions(+), 5 deletions(-)
-
-diff --git a/monitor.c b/monitor.c
-index 08fddabd7..037d6d333 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: monitor.c,v 1.186 2018/07/20 03:46:34 djm Exp $ */
-+/* $OpenBSD: monitor.c,v 1.188 2018/11/16 02:43:56 djm Exp $ */
- /*
-  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
-  * Copyright 2002 Markus Friedl <markus@openbsd.org>
-@@ -892,6 +892,35 @@ mm_answer_authrole(int sock, struct sshbuf *m)
-        return (0);
- }
- 
-+/*
-+ * Check that the key type appears in the supplied pattern list, ignoring
-+ * mismatches in the signature algorithm. (Signature algorithm checks are
-+ * performed in the unprivileged authentication code).
-+ * Returns 1 on success, 0 otherwise.
-+ */
-+static int
-+key_base_type_match(const char *method, const struct sshkey *key,
-+    const char *list)
-+{
-+       char *s, *l, *ol = xstrdup(list);
-+       int found = 0;
-+
-+       l = ol;
-+       for ((s = strsep(&l, ",")); s && *s != '\0'; (s = strsep(&l, ","))) {
-+               if (sshkey_type_from_name(s) == key->type) {
-+                       found = 1;
-+                       break;
-+               }
-+       }
-+       if (!found) {
-+               error("%s key type %s is not in permitted list %s", method,
-+                   sshkey_ssh_name(key), list);
-+       }
-+
-+       free(ol);
-+       return found;
-+}
-+
- int
- mm_answer_authpassword(int sock, struct sshbuf *m)
- {
-@@ -1197,8 +1226,8 @@ mm_answer_keyallowed(int sock, struct sshbuf *m)
-                                break;
-                        if (auth2_key_already_used(authctxt, key))
-                                break;
--                       if (match_pattern_list(sshkey_ssh_name(key),
--                           options.pubkey_key_types, 0) != 1)
-+                       if (!key_base_type_match(auth_method, key,
-+                           options.pubkey_key_types))
-                                break;
-                        allowed = user_key_allowed(ssh, authctxt->pw, key,
-                            pubkey_auth_attempt, &opts);
-@@ -1209,8 +1238,8 @@ mm_answer_keyallowed(int sock, struct sshbuf *m)
-                                break;
-                        if (auth2_key_already_used(authctxt, key))
-                                break;
--                       if (match_pattern_list(sshkey_ssh_name(key),
--                           options.hostbased_key_types, 0) != 1)
-+                       if (!key_base_type_match(auth_method, key,
-+                           options.hostbased_key_types))
-                                break;
-                        allowed = hostbased_key_allowed(authctxt->pw,
-                            cuser, chost, key);
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index b6d4f1239..35f3327df 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From df56506f727e37c13346259bdcd5975e257a259d Mon Sep 17 00:00:00 2001
+From 601332e5cc1198d6dabddc8168249a81c5dc822a Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index f62bf6672..45d131d27 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -1,4 +1,4 @@
-From 72b1d308e6400194ef6e4e7dd45bfa48fa39b5e6 Mon Sep 17 00:00:00 2001
+From 7ce79be85036c4b36937f1b1ba85f6094068412c Mon Sep 17 00:00:00 2001
 From: Simon Wilkinson <simon@sxw.org.uk>
 Date: Sun, 9 Feb 2014 16:09:48 +0000
 Subject: GSSAPI key exchange support
@@ -16,185 +16,69 @@ have it merged into the main openssh package rather than having separate
 -krb5 packages (as we used to have).  It seems to have a generally good
 security history.
 
+Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/commits/debian/master
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2018-10-20
+Last-Updated: 2019-06-05
 
 Patch-Name: gssapi.patch
 ---
- ChangeLog.gssapi | 113 ++++++++++++++++
- Makefile.in      |   3 +-
- auth-krb5.c      |  17 ++-
- auth.c           |  96 +------------
- auth2-gss.c      |  54 +++++++-
- auth2.c          |   2 +
- canohost.c       |  93 +++++++++++++
- canohost.h       |   3 +
- clientloop.c     |  15 ++-
- config.h.in      |   6 +
- configure.ac     |  24 ++++
- gss-genr.c       | 280 +++++++++++++++++++++++++++++++++++++-
- gss-serv-krb5.c  |  85 +++++++++++-
- gss-serv.c       | 184 +++++++++++++++++++++++--
- kex.c            |  19 +++
- kex.h            |  14 ++
- kexgssc.c        | 341 +++++++++++++++++++++++++++++++++++++++++++++++
- kexgsss.c        | 300 +++++++++++++++++++++++++++++++++++++++++
- monitor.c        | 122 +++++++++++++++--
- monitor.h        |   3 +
- monitor_wrap.c   |  53 +++++++-
- monitor_wrap.h   |   4 +-
- opacket.c        |   2 +-
- opacket.h        |   2 +-
- readconf.c       |  43 ++++++
- readconf.h       |   5 +
- servconf.c       |  26 ++++
- servconf.h       |   2 +
- ssh-gss.h        |  41 +++++-
- ssh_config       |   2 +
- ssh_config.5     |  32 +++++
- sshconnect2.c    | 133 +++++++++++++++++-
- sshd.c           | 110 +++++++++++++++
- sshd_config      |   2 +
- sshd_config.5    |  10 ++
- sshkey.c         |   3 +-
- sshkey.h         |   1 +
- 37 files changed, 2099 insertions(+), 146 deletions(-)
- create mode 100644 ChangeLog.gssapi
+ Makefile.in     |   3 +-
+ auth-krb5.c     |  17 +-
+ auth.c          |  96 +-------
+ auth2-gss.c     |  56 ++++-
+ auth2.c         |   2 +
+ canohost.c      |  93 ++++++++
+ canohost.h      |   3 +
+ clientloop.c    |  15 +-
+ configure.ac    |  24 ++
+ gss-genr.c      | 300 +++++++++++++++++++++++-
+ gss-serv-krb5.c |  85 ++++++-
+ gss-serv.c      | 186 +++++++++++++--
+ hmac.c          |   1 +
+ kex.c           |  66 +++++-
+ kex.h           |  29 +++
+ kexdh.c         |  10 +
+ kexgen.c        |   2 +-
+ kexgssc.c       | 606 ++++++++++++++++++++++++++++++++++++++++++++++++
+ kexgsss.c       | 474 +++++++++++++++++++++++++++++++++++++
+ mac.c           |   1 +
+ monitor.c       | 139 ++++++++++-
+ monitor.h       |   2 +
+ monitor_wrap.c  |  57 ++++-
+ monitor_wrap.h  |   4 +-
+ readconf.c      |  70 ++++++
+ readconf.h      |   6 +
+ servconf.c      |  47 ++++
+ servconf.h      |   3 +
+ session.c       |  10 +-
+ ssh-gss.h       |  50 +++-
+ ssh.1           |   8 +
+ ssh.c           |   4 +-
+ ssh_config      |   2 +
+ ssh_config.5    |  57 +++++
+ sshconnect2.c   | 140 ++++++++++-
+ sshd.c          | 120 +++++++++-
+ sshd_config     |   2 +
+ sshd_config.5   |  30 +++
+ sshkey.c        |   3 +-
+ sshkey.h        |   1 +
+ 40 files changed, 2664 insertions(+), 160 deletions(-)
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
 
-diff --git a/ChangeLog.gssapi b/ChangeLog.gssapi
-new file mode 100644
-index 000000000..f117a336a
---- /dev/null
-+++ b/ChangeLog.gssapi
-@@ -0,0 +1,113 @@
-+20110101
-+  - Finally update for OpenSSH 5.6p1
-+  - Add GSSAPIServerIdentity option from Jim Basney
-+ 
-+20100308
-+  - [ Makefile.in, key.c, key.h ]
-+    Updates for OpenSSH 5.4p1
-+  - [ servconf.c ]
-+    Include GSSAPI options in the sshd -T configuration dump, and flag
-+    some older configuration options as being unsupported. Thanks to Colin 
-+    Watson.
-+  -
-+
-+20100124
-+  - [ sshconnect2.c ]
-+    Adapt to deal with additional element in Authmethod structure. Thanks to
-+    Colin Watson
-+
-+20090615
-+  - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c
-+      sshd.c ]
-+    Fix issues identified by Greg Hudson following a code review
-+       Check return value of gss_indicate_mechs
-+       Protect GSSAPI calls in monitor, so they can only be used if enabled
-+       Check return values of bignum functions in key exchange
-+       Use BN_clear_free to clear other side's DH value
-+       Make ssh_gssapi_id_kex more robust
-+       Only configure kex table pointers if GSSAPI is enabled
-+       Don't leak mechanism list, or gss mechanism list
-+       Cast data.length before printing
-+       If serverkey isn't provided, use an empty string, rather than NULL
-+
-+20090201
-+  - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h
-+      ssh_config.5 sshconnet2.c ]
-+    Add support for the GSSAPIClientIdentity option, which allows the user
-+    to specify which GSSAPI identity to use to contact a given server
-+
-+20080404
-+  - [ gss-serv.c ]
-+    Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow
-+    been omitted from a previous version of this patch. Reported by Borislav
-+    Stoichkov
-+
-+20070317
-+  - [ gss-serv-krb5.c ]
-+    Remove C99ism, where new_ccname was being declared in the middle of a 
-+    function
-+
-+20061220
-+  - [ servconf.c ]
-+    Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and 
-+    documented, behaviour. Reported by Dan Watson.
-+
-+20060910
-+  - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c
-+      ssh-gss.h ]
-+    add support for gss-group14-sha1 key exchange mechanisms
-+  - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ]
-+    Add GSSAPIStrictAcceptorCheck option to allow the disabling of
-+    acceptor principal checking on multi-homed machines.
-+    <Bugzilla #928>
-+  - [ sshd_config ssh_config ]
-+    Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample
-+    configuration files
-+  - [ kexgss.c kegsss.c sshconnect2.c sshd.c ]
-+    Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf()
-+    Limit length of error messages displayed by client
-+
-+20060909
-+  - [ gss-genr.c gss-serv.c ]
-+    move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server
-+    only, where they belong 
-+    <Bugzilla #1225>
-+
-+20060829
-+  - [ gss-serv-krb5.c ]
-+    Fix CCAPI credentials cache name when creating KRB5CCNAME environment 
-+    variable
-+
-+20060828
-+  - [ gss-genr.c ]
-+    Avoid Heimdal context freeing problem
-+    <Fixed upstream 20060829>
-+
-+20060818
-+  - [ gss-genr.c ssh-gss.h sshconnect2.c ]
-+    Make sure that SPENGO is disabled 
-+    <Bugzilla #1218 - Fixed upstream 20060818>
-+
-+20060421
-+  - [ gssgenr.c, sshconnect2.c ]
-+    a few type changes (signed versus unsigned, int versus size_t) to
-+    fix compiler errors/warnings 
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ kexgssc.c, sshconnect2.c ]
-+    fix uninitialized variable warnings
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ gssgenr.c ]
-+    pass oid to gss_display_status (helpful when using GSSAPI mechglue)
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <Bugzilla #1220 >
-+  - [ gss-serv-krb5.c ]
-+    #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <Fixed upstream 20060304>
-+  - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c 
-+    add client-side GssapiKeyExchange option
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ sshconnect2.c ]
-+    add support for GssapiTrustDns option for gssapi-with-mic
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <gssapi-with-mic support is Bugzilla #1008>
 diff --git a/Makefile.in b/Makefile.in
-index 126b2c742..70050ffb6 100644
+index 6f001bb36..c31821acc 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -100,6 +100,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
         kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
-        kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \
-        kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \
+        kexgexc.o kexgexs.o \
+        sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
 +       kexgssc.o \
         platform-pledge.o platform-tracing.o platform-misc.o
  
- SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-@@ -113,7 +114,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
+ 
+@@ -114,7 +115,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
         auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
         auth2-none.o auth2-passwd.o auth2-pubkey.o \
         monitor.o monitor_wrap.o auth-krb5.o \
@@ -255,7 +139,7 @@ index 3096f1c8e..204752e1b 100644
         return (krb5_cc_resolve(ctx, ccname, ccache));
  }
 diff --git a/auth.c b/auth.c
-index 3ca3762cc..d8e6b4a3d 100644
+index 8696f258e..f7a23afba 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -399,7 +399,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
@@ -268,7 +152,7 @@ index 3ca3762cc..d8e6b4a3d 100644
                         return 1;
                 break;
         case PERMIT_FORCED_ONLY:
-@@ -737,99 +738,6 @@ fakepw(void)
+@@ -723,99 +724,6 @@ fakepw(void)
         return (&fake);
  }
  
@@ -369,7 +253,7 @@ index 3ca3762cc..d8e6b4a3d 100644
   * Return the canonical name of the host in the other side of the current
   * connection.  The host name is cached, so it is efficient to call this
 diff --git a/auth2-gss.c b/auth2-gss.c
-index 9351e0428..1f12bb113 100644
+index 9351e0428..d6446c0cf 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
@@ -381,11 +265,11 @@ index 9351e0428..1f12bb113 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -54,6 +54,46 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
+@@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
  
-+/* 
++/*
 + * The 'gssapi_keyex' userauth mechanism.
 + */
 +static int
@@ -393,7 +277,7 @@ index 9351e0428..1f12bb113 100644
 +{
 +       Authctxt *authctxt = ssh->authctxt;
 +       int r, authenticated = 0;
-+       struct sshbuf *b;
++       struct sshbuf *b = NULL;
 +       gss_buffer_desc mic, gssbuf;
 +       u_char *p;
 +       size_t len;
@@ -401,8 +285,10 @@ index 9351e0428..1f12bb113 100644
 +       if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
 +           (r = sshpkt_get_end(ssh)) != 0)
 +               fatal("%s: %s", __func__, ssh_err(r));
++
 +       if ((b = sshbuf_new()) == NULL)
 +               fatal("%s: sshbuf_new failed", __func__);
++
 +       mic.value = p;
 +       mic.length = len;
 +
@@ -414,11 +300,11 @@ index 9351e0428..1f12bb113 100644
 +       gssbuf.length = sshbuf_len(b);
 +
 +       /* gss_kex_context is NULL with privsep, so we can't check it here */
-+       if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 
++       if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context,
 +           &gssbuf, &mic))))
 +               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+                   authctxt->pw));
-+       
++                   authctxt->pw, 1));
++
 +       sshbuf_free(b);
 +       free(mic.value);
 +
@@ -428,27 +314,27 @@ index 9351e0428..1f12bb113 100644
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -260,7 +300,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+@@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
         if ((r = sshpkt_get_end(ssh)) != 0)
                 fatal("%s: %s", __func__, ssh_err(r));
  
 -       authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
 +       authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+           authctxt->pw));
++           authctxt->pw, 1));
  
         if ((!use_privsep || mm_is_monitor()) &&
             (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -306,7 +347,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
         gssbuf.length = sshbuf_len(b);
  
         if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
 -               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+               authenticated = 
-+                   PRIVSEP(ssh_gssapi_userok(authctxt->user, authctxt->pw));
++               authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
++                   authctxt->pw, 0));
         else
                 logit("GSSAPI MIC check failed");
  
-@@ -326,6 +368,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -326,6 +370,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
         return 0;
  }
  
@@ -462,10 +348,10 @@ index 9351e0428..1f12bb113 100644
         "gssapi-with-mic",
         userauth_gssapi,
 diff --git a/auth2.c b/auth2.c
-index 4d19957a6..a77742819 100644
+index 16ae1a363..7417eafa4 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -74,6 +74,7 @@ extern Authmethod method_passwd;
+@@ -75,6 +75,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -473,7 +359,7 @@ index 4d19957a6..a77742819 100644
  extern Authmethod method_gssapi;
  #endif
  
-@@ -81,6 +82,7 @@ Authmethod *authmethods[] = {
+@@ -82,6 +83,7 @@ Authmethod *authmethods[] = {
         &method_none,
         &method_pubkey,
  #ifdef GSSAPI
@@ -600,7 +486,7 @@ index 26d62855a..0cadc9f18 100644
  int             get_peer_port(int);
  char           *get_local_ipaddr(int);
 diff --git a/clientloop.c b/clientloop.c
-index 8d312cdaa..1464634b0 100644
+index 086c0dfe8..9b90c64f3 100644
 --- a/clientloop.c
 +++ b/clientloop.c
 @@ -112,6 +112,10 @@
@@ -614,7 +500,7 @@ index 8d312cdaa..1464634b0 100644
  /* import options */
  extern Options options;
  
-@@ -1370,9 +1374,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
+@@ -1374,9 +1378,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
                         break;
  
                 /* Do channel operations unless rekeying in progress. */
@@ -632,37 +518,13 @@ index 8d312cdaa..1464634b0 100644
 +               }
 +
                 /* Buffer input from the connection.  */
-                client_process_net_input(readset);
- 
-diff --git a/config.h.in b/config.h.in
-index 91b65db8f..209760c7c 100644
---- a/config.h.in
-+++ b/config.h.in
-@@ -1845,6 +1845,9 @@
- /* Use btmp to log bad logins */
- #undef USE_BTMP
- 
-+/* platform uses an in-memory credentials cache */
-+#undef USE_CCAPI
-+
- /* Use libedit for sftp */
- #undef USE_LIBEDIT
- 
-@@ -1860,6 +1863,9 @@
- /* Use PIPES instead of a socketpair() */
- #undef USE_PIPES
- 
-+/* platform has the Security Authorization Session API */
-+#undef USE_SECURITY_SESSION_API
-+
- /* Define if you have Solaris privileges */
- #undef USE_SOLARIS_PRIVS
+                client_process_net_input(ssh, readset);
  
 diff --git a/configure.ac b/configure.ac
-index 7379ab358..023e7cc55 100644
+index 30be6c182..2869f7042 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -664,6 +664,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+@@ -665,6 +665,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
             [Use tunnel device compatibility to OpenBSD])
         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
             [Prepend the address family to IP tunnel traffic])
@@ -670,7 +532,7 @@ index 7379ab358..023e7cc55 100644
 +       AC_TRY_COMPILE([#include <Security/AuthSession.h>],
 +               [SessionCreate(0, 0);],
 +               [ac_cv_use_security_session_api="yes"
-+                AC_DEFINE([USE_SECURITY_SESSION_API], [1], 
++                AC_DEFINE([USE_SECURITY_SESSION_API], [1],
 +                       [platform has the Security Authorization Session API])
 +                LIBS="$LIBS -framework Security"
 +                AC_MSG_RESULT([yes])],
@@ -681,7 +543,7 @@ index 7379ab358..023e7cc55 100644
 +               [#include <Kerberos/Kerberos.h>],
 +               [cc_context_t c;
 +                (void) cc_initialize (&c, 0, NULL, NULL);],
-+               [AC_DEFINE([USE_CCAPI], [1], 
++               [AC_DEFINE([USE_CCAPI], [1],
 +                       [platform uses an in-memory credentials cache])
 +                LIBS="$LIBS -framework Security"
 +                AC_MSG_RESULT([yes])
@@ -694,7 +556,7 @@ index 7379ab358..023e7cc55 100644
         AC_CHECK_DECL([AU_IPv4], [],
             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 diff --git a/gss-genr.c b/gss-genr.c
-index d56257b4a..491e62cee 100644
+index d56257b4a..763a63ffa 100644
 --- a/gss-genr.c
 +++ b/gss-genr.c
 @@ -1,7 +1,7 @@
@@ -706,16 +568,15 @@ index d56257b4a..491e62cee 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -39,14 +39,37 @@
- #include "xmalloc.h"
- #include "ssherr.h"
+@@ -41,12 +41,36 @@
  #include "sshbuf.h"
-+#include "sshkey.h"
  #include "log.h"
  #include "ssh2.h"
 +#include "cipher.h"
++#include "sshkey.h"
 +#include "kex.h"
 +#include "digest.h"
++#include "packet.h"
  
  #include "ssh-gss.h"
  
@@ -736,7 +597,7 @@ index d56257b4a..491e62cee 100644
 +
 +static ssh_gss_kex_mapping *gss_enc2oid = NULL;
 +
-+int 
++int
 +ssh_gssapi_oid_table_ok(void) {
 +       return (gss_enc2oid != NULL);
 +}
@@ -744,10 +605,25 @@ index d56257b4a..491e62cee 100644
  /* sshbuf_get for gss_buffer_desc */
  int
  ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
-@@ -62,6 +85,143 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
+@@ -62,6 +86,162 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
         return 0;
  }
  
++/* sshpkt_get of gss_buffer_desc */
++int
++ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *ssh, gss_buffer_desc *g)
++{
++       int r;
++       u_char *p;
++       size_t len;
++
++       if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)
++               return r;
++       g->value = p;
++       g->length = len;
++       return 0;
++}
++
 +/*
 + * Return a list of the gss-group1-sha1 mechanisms supported by this program
 + *
@@ -756,27 +632,30 @@ index d56257b4a..491e62cee 100644
 + */
 +
 +char *
-+ssh_gssapi_client_mechanisms(const char *host, const char *client) {
-+       gss_OID_set gss_supported;
++ssh_gssapi_client_mechanisms(const char *host, const char *client,
++    const char *kex) {
++       gss_OID_set gss_supported = NULL;
 +       OM_uint32 min_status;
 +
 +       if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))
 +               return NULL;
 +
-+       return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
-+           host, client));
++       return ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
++           host, client, kex);
 +}
 +
 +char *
 +ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
-+    const char *host, const char *client) {
-+       struct sshbuf *buf;
++    const char *host, const char *client, const char *kex) {
++       struct sshbuf *buf = NULL;
 +       size_t i;
-+       int r, oidpos, enclen;
++       int r = SSH_ERR_ALLOC_FAIL;
++       int oidpos, enclen;
 +       char *mechs, *encoded;
 +       u_char digest[SSH_DIGEST_MAX_LENGTH];
 +       char deroid[2];
-+       struct ssh_digest_ctx *md;
++       struct ssh_digest_ctx *md = NULL;
++       char *s, *cp, *p;
 +
 +       if (gss_enc2oid != NULL) {
 +               for (i = 0; gss_enc2oid[i].encoded != NULL; i++)
@@ -791,6 +670,7 @@ index d56257b4a..491e62cee 100644
 +               fatal("%s: sshbuf_new failed", __func__);
 +
 +       oidpos = 0;
++       s = cp = xstrdup(kex);
 +       for (i = 0; i < gss_supported->count; i++) {
 +               if (gss_supported->elements[i].length < 128 &&
 +                   (*check)(NULL, &(gss_supported->elements[i]), host, client)) {
@@ -799,12 +679,15 @@ index d56257b4a..491e62cee 100644
 +                       deroid[1] = gss_supported->elements[i].length;
 +
 +                       if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
-+                           ssh_digest_update(md, deroid, 2) != 0 ||
-+                           ssh_digest_update(md,
-+                           gss_supported->elements[i].elements,
-+                           gss_supported->elements[i].length) != 0 ||
-+                           ssh_digest_final(md, digest, sizeof(digest)) != 0)
-+                               fatal("%s: digest failed", __func__);
++                           (r = ssh_digest_update(md, deroid, 2)) != 0 ||
++                           (r = ssh_digest_update(md,
++                               gss_supported->elements[i].elements,
++                               gss_supported->elements[i].length)) != 0 ||
++                           (r = ssh_digest_final(md, digest, sizeof(digest))) != 0)
++                               fatal("%s: digest failed: %s", __func__,
++                                   ssh_err(r));
++                       ssh_digest_free(md);
++                       md = NULL;
 +
 +                       encoded = xmalloc(ssh_digest_bytes(SSH_DIGEST_MD5)
 +                           * 2);
@@ -812,69 +695,66 @@ index d56257b4a..491e62cee 100644
 +                           ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
 +                           ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
 +
-+                       if (oidpos != 0) {
-+                               if ((r = sshbuf_put_u8(buf, ',')) != 0)
-+                                       fatal("%s: buffer error: %s",
++                       cp = strncpy(s, kex, strlen(kex));
++                       for ((p = strsep(&cp, ",")); p && *p != '\0';
++                               (p = strsep(&cp, ","))) {
++                               if (sshbuf_len(buf) != 0 &&
++                                   (r = sshbuf_put_u8(buf, ',')) != 0)
++                                       fatal("%s: sshbuf_put_u8 error: %s",
++                                           __func__, ssh_err(r));
++                               if ((r = sshbuf_put(buf, p, strlen(p))) != 0 ||
++                                   (r = sshbuf_put(buf, encoded, enclen)) != 0)
++                                       fatal("%s: sshbuf_put error: %s",
 +                                           __func__, ssh_err(r));
 +                       }
 +
-+                       if ((r = sshbuf_put(buf, KEX_GSS_GEX_SHA1_ID,
-+                           sizeof(KEX_GSS_GEX_SHA1_ID) - 1)) != 0 ||
-+                           (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
-+                           (r = sshbuf_put_u8(buf, ',')) != 0 ||
-+                           (r = sshbuf_put(buf, KEX_GSS_GRP1_SHA1_ID,
-+                           sizeof(KEX_GSS_GRP1_SHA1_ID) - 1)) != 0 ||
-+                           (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
-+                           (r = sshbuf_put_u8(buf, ',')) != 0 ||
-+                           (r = sshbuf_put(buf, KEX_GSS_GRP14_SHA1_ID,
-+                           sizeof(KEX_GSS_GRP14_SHA1_ID) - 1)) != 0 ||
-+                           (r = sshbuf_put(buf, encoded, enclen)) != 0)
-+                               fatal("%s: buffer error: %s",
-+                                   __func__, ssh_err(r));
-+
 +                       gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
 +                       gss_enc2oid[oidpos].encoded = encoded;
 +                       oidpos++;
 +               }
 +       }
++       free(s);
 +       gss_enc2oid[oidpos].oid = NULL;
 +       gss_enc2oid[oidpos].encoded = NULL;
 +
 +       if ((mechs = sshbuf_dup_string(buf)) == NULL)
 +               fatal("%s: sshbuf_dup_string failed", __func__);
 +
++       sshbuf_free(buf);
++
 +       if (strlen(mechs) == 0) {
 +               free(mechs);
 +               mechs = NULL;
 +       }
-+       
++
 +       return (mechs);
 +}
 +
 +gss_OID
 +ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
 +       int i = 0;
-+       
-+       switch (kex_type) {
-+       case KEX_GSS_GRP1_SHA1:
-+               if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))
-+                       return GSS_C_NO_OID;
-+               name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;
-+               break;
-+       case KEX_GSS_GRP14_SHA1:
-+               if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))
-+                       return GSS_C_NO_OID;
-+               name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;
-+               break;
-+       case KEX_GSS_GEX_SHA1:
-+               if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))
-+                       return GSS_C_NO_OID;
-+               name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;
++
++#define SKIP_KEX_NAME(type) \
++       case type: \
++               if (strlen(name) < sizeof(type##_ID)) \
++                       return GSS_C_NO_OID; \
++               name += sizeof(type##_ID) - 1; \
 +               break;
++
++       switch (kex_type) {
++       SKIP_KEX_NAME(KEX_GSS_GRP1_SHA1)
++       SKIP_KEX_NAME(KEX_GSS_GRP14_SHA1)
++       SKIP_KEX_NAME(KEX_GSS_GRP14_SHA256)
++       SKIP_KEX_NAME(KEX_GSS_GRP16_SHA512)
++       SKIP_KEX_NAME(KEX_GSS_GEX_SHA1)
++       SKIP_KEX_NAME(KEX_GSS_NISTP256_SHA256)
++       SKIP_KEX_NAME(KEX_GSS_C25519_SHA256)
 +       default:
 +               return GSS_C_NO_OID;
 +       }
 +
++#undef SKIP_KEX_NAME
++
 +       while (gss_enc2oid[i].encoded != NULL &&
 +           strcmp(name, gss_enc2oid[i].encoded) != 0)
 +               i++;
@@ -888,7 +768,7 @@ index d56257b4a..491e62cee 100644
  /* Check that the OID in a data stream matches that in the context */
  int
  ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -218,7 +378,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
+@@ -218,7 +398,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
         }
  
         ctx->major = gss_init_sec_context(&ctx->minor,
@@ -897,7 +777,7 @@ index d56257b4a..491e62cee 100644
             GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
             0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -247,9 +407,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
+@@ -247,9 +427,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
         return (ctx->major);
  }
  
@@ -919,8 +799,8 @@ index d56257b4a..491e62cee 100644
 +           GSS_C_NT_USER_NAME, &gssname);
 +
 +       if (!ctx->major)
-+               ctx->major = gss_acquire_cred(&ctx->minor, 
-+                   gssname, 0, oidset, GSS_C_INITIATE, 
++               ctx->major = gss_acquire_cred(&ctx->minor,
++                   gssname, 0, oidset, GSS_C_INITIATE,
 +                   &ctx->client_creds, NULL, NULL);
 +
 +       gss_release_name(&status, &gssname);
@@ -935,13 +815,13 @@ index d56257b4a..491e62cee 100644
  OM_uint32
  ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
  {
-+       if (ctx == NULL) 
++       if (ctx == NULL)
 +               return -1;
 +
         if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
             GSS_C_QOP_DEFAULT, buffer, hash)))
                 ssh_gssapi_error(ctx);
-@@ -257,6 +451,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
+@@ -257,6 +471,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
         return (ctx->major);
  }
  
@@ -961,12 +841,12 @@ index d56257b4a..491e62cee 100644
  void
  ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
      const char *context)
-@@ -273,11 +480,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
+@@ -273,11 +500,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
  }
  
  int
 -ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
-+ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, 
++ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host,
 +    const char *client)
  {
         gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
@@ -979,7 +859,7 @@ index d56257b4a..491e62cee 100644
  
         /* RFC 4462 says we MUST NOT do SPNEGO */
         if (oid->length == spnego_oid.length && 
-@@ -287,6 +499,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -287,6 +519,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
         ssh_gssapi_build_ctx(ctx);
         ssh_gssapi_set_oid(*ctx, oid);
         major = ssh_gssapi_import_name(*ctx, host);
@@ -990,12 +870,12 @@ index d56257b4a..491e62cee 100644
         if (!GSS_ERROR(major)) {
                 major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
                     NULL);
-@@ -296,10 +512,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -296,10 +532,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
                             GSS_C_NO_BUFFER);
         }
  
 -       if (GSS_ERROR(major)) 
-+       if (GSS_ERROR(major) || intctx != NULL) 
++       if (GSS_ERROR(major) || intctx != NULL)
                 ssh_gssapi_delete_ctx(ctx);
  
         return (!GSS_ERROR(major));
@@ -1010,7 +890,7 @@ index d56257b4a..491e62cee 100644
 +       static OM_uint32 last_call = 0;
 +       OM_uint32 lifetime, now, major, minor;
 +       int equal;
-+       
++
 +       now = time(NULL);
 +
 +       if (ctxt) {
@@ -1038,8 +918,8 @@ index d56257b4a..491e62cee 100644
 +
 +       if (saved_mech == GSS_C_NO_OID)
 +               return 0;
-+       
-+       major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, 
++
++       major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,
 +           &name, &lifetime, NULL, NULL);
 +       if (major == GSS_S_CREDENTIALS_EXPIRED)
 +               return 0;
@@ -1059,7 +939,7 @@ index d56257b4a..491e62cee 100644
 +
  #endif /* GSSAPI */
 diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index a151bc1e4..90f8692f5 100644
+index a151bc1e4..ef9beb67c 100644
 --- a/gss-serv-krb5.c
 +++ b/gss-serv-krb5.c
 @@ -1,7 +1,7 @@
@@ -1107,7 +987,7 @@ index a151bc1e4..90f8692f5 100644
  }
  
 +int
-+ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, 
++ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store,
 +    ssh_gssapi_client *client)
 +{
 +       krb5_ccache ccache = NULL;
@@ -1116,14 +996,14 @@ index a151bc1e4..90f8692f5 100644
 +       krb5_error_code problem;
 +       OM_uint32 maj_status, min_status;
 +
-+       if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
++       if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
 +                logit("krb5_cc_resolve(): %.100s",
 +                    krb5_get_err_text(krb_context, problem));
 +                return 0;
-+               }
-+       
++       }
++
 +       /* Find out who the principal in this cache is */
-+       if ((problem = krb5_cc_get_principal(krb_context, ccache, 
++       if ((problem = krb5_cc_get_principal(krb_context, ccache,
 +           &principal))) {
 +               logit("krb5_cc_get_principal(): %.100s",
 +                   krb5_get_err_text(krb_context, problem));
@@ -1185,7 +1065,7 @@ index a151bc1e4..90f8692f5 100644
  
  #endif /* KRB5 */
 diff --git a/gss-serv.c b/gss-serv.c
-index ab3a15f0f..6c087a1b1 100644
+index ab3a15f0f..1d47870e7 100644
 --- a/gss-serv.c
 +++ b/gss-serv.c
 @@ -1,7 +1,7 @@
@@ -1197,7 +1077,7 @@ index ab3a15f0f..6c087a1b1 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -44,17 +44,22 @@
+@@ -44,17 +44,19 @@
  #include "session.h"
  #include "misc.h"
  #include "servconf.h"
@@ -1205,16 +1085,14 @@ index ab3a15f0f..6c087a1b1 100644
  
  #include "ssh-gss.h"
 +#include "monitor_wrap.h"
-+
-+extern ServerOptions options;
  
  extern ServerOptions options;
  
  static ssh_gssapi_client gssapi_client =
-     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
+-    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
 -    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
-+    GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,  NULL,
-+    {NULL, NULL, NULL, NULL, NULL}, 0, 0};
++    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
++    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
  
  ssh_gssapi_mech gssapi_null_mech =
 -    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
@@ -1222,7 +1100,7 @@ index ab3a15f0f..6c087a1b1 100644
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -140,6 +145,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+@@ -140,6 +142,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
         return (ssh_gssapi_acquire_cred(*ctx));
  }
  
@@ -1232,7 +1110,8 @@ index ab3a15f0f..6c087a1b1 100644
 +       if (supported_oids == NULL)
 +               ssh_gssapi_prepare_supported_oids();
 +       return (ssh_gssapi_kex_mechs(supported_oids,
-+           &ssh_gssapi_server_check_mech, NULL, NULL));
++           &ssh_gssapi_server_check_mech, NULL, NULL,
++           options.gss_kex_algorithms));
 +}
 +
 +/* Unprivileged */
@@ -1241,7 +1120,7 @@ index ab3a15f0f..6c087a1b1 100644
 +    const char *dummy) {
 +       Gssctxt *ctx = NULL;
 +       int res;
-+ 
++
 +       res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));
 +       ssh_gssapi_delete_ctx(&ctx);
 +
@@ -1251,7 +1130,7 @@ index ab3a15f0f..6c087a1b1 100644
  /* Unprivileged */
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
-@@ -150,7 +177,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
+@@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
         gss_OID_set supported;
  
         gss_create_empty_oid_set(&min_status, oidset);
@@ -1262,7 +1141,7 @@ index ab3a15f0f..6c087a1b1 100644
  
         while (supported_mechs[i]->name != NULL) {
                 if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -276,8 +305,48 @@ OM_uint32
+@@ -276,8 +303,48 @@ OM_uint32
  ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  {
         int i = 0;
@@ -1278,21 +1157,21 @@ index ab3a15f0f..6c087a1b1 100644
 +                       return GSS_S_COMPLETE;
 +               }
 +
-+               if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, 
-+                   ctx->client_creds, ctx->oid, &new_name, 
++               if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
++                   ctx->client_creds, ctx->oid, &new_name,
 +                   NULL, NULL, NULL))) {
 +                       ssh_gssapi_error(ctx);
 +                       return (ctx->major);
 +               }
 +
-+               ctx->major = gss_compare_name(&ctx->minor, client->name, 
++               ctx->major = gss_compare_name(&ctx->minor, client->name,
 +                   new_name, &equal);
 +
 +               if (GSS_ERROR(ctx->major)) {
 +                       ssh_gssapi_error(ctx);
 +                       return (ctx->major);
 +               }
-+ 
++
 +               if (!equal) {
 +                       debug("Rekeyed credentials have different name");
 +                       return GSS_S_COMPLETE;
@@ -1305,14 +1184,14 @@ index ab3a15f0f..6c087a1b1 100644
 +               gss_release_cred(&ctx->minor, &client->creds);
 +               client->name = new_name;
 +               client->creds = ctx->client_creds;
-+               ctx->client_creds = GSS_C_NO_CREDENTIAL;
++               ctx->client_creds = GSS_C_NO_CREDENTIAL;
 +               client->updated = 1;
 +               return GSS_S_COMPLETE;
 +       }
  
         client->mech = NULL;
  
-@@ -292,6 +361,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
         if (client->mech == NULL)
                 return GSS_S_FAILURE;
  
@@ -1326,7 +1205,7 @@ index ab3a15f0f..6c087a1b1 100644
         if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
             &client->displayname, NULL))) {
                 ssh_gssapi_error(ctx);
-@@ -309,6 +385,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
                 return (ctx->major);
         }
  
@@ -1335,16 +1214,20 @@ index ab3a15f0f..6c087a1b1 100644
         /* We can't copy this structure, so we just move the pointer to it */
         client->creds = ctx->client_creds;
         ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -356,7 +434,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+@@ -356,19 +432,23 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
  
  /* Privileged */
  int
 -ssh_gssapi_userok(char *user)
-+ssh_gssapi_userok(char *user, struct passwd *pw)
++ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  {
         OM_uint32 lmin;
  
-@@ -366,9 +444,11 @@ ssh_gssapi_userok(char *user)
++       (void) kex; /* used in privilege separation */
++
+        if (gssapi_client.exportedname.length == 0 ||
+            gssapi_client.exportedname.value == NULL) {
+                debug("No suitable client data");
                 return 0;
         }
         if (gssapi_client.mech && gssapi_client.mech->userok)
@@ -1365,7 +1248,7 @@ index ab3a15f0f..6c087a1b1 100644
 -/* Privileged */
 -OM_uint32
 -ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
-+/* These bits are only used for rekeying. The unpriviledged child is running 
++/* These bits are only used for rekeying. The unpriviledged child is running
 + * as the user, the monitor is root.
 + *
 + * In the child, we want to :
@@ -1376,7 +1259,7 @@ index ab3a15f0f..6c087a1b1 100644
 +/* Stuff for PAM */
 +
 +#ifdef USE_PAM
-+static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, 
++static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg,
 +    struct pam_response **resp, void *data)
  {
 -       ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
@@ -1389,18 +1272,18 @@ index ab3a15f0f..6c087a1b1 100644
 +void
 +ssh_gssapi_rekey_creds(void) {
 +       int ok;
-+       int ret;
 +#ifdef USE_PAM
++       int ret;
 +       pam_handle_t *pamh = NULL;
 +       struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
 +       char *envstr;
 +#endif
 +
-+       if (gssapi_client.store.filename == NULL && 
++       if (gssapi_client.store.filename == NULL &&
 +           gssapi_client.store.envval == NULL &&
 +           gssapi_client.store.envvar == NULL)
 +               return;
-+ 
++
 +       ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store));
 +
 +       if (!ok)
@@ -1423,7 +1306,7 @@ index ab3a15f0f..6c087a1b1 100644
 +       if (ret)
 +               return;
 +
-+       xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, 
++       xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar,
 +           gssapi_client.store.envval);
 +
 +       ret = pam_putenv(pamh, envstr);
@@ -1433,7 +1316,7 @@ index ab3a15f0f..6c087a1b1 100644
 +#endif
 +}
 +
-+int 
++int
 +ssh_gssapi_update_creds(ssh_gssapi_ccache *store) {
 +       int ok = 0;
 +
@@ -1455,11 +1338,29 @@ index ab3a15f0f..6c087a1b1 100644
  }
  
  /* Privileged */
+diff --git a/hmac.c b/hmac.c
+index 1c879640c..a29f32c5c 100644
+--- a/hmac.c
++++ b/hmac.c
+@@ -19,6 +19,7 @@
+ 
+ #include <sys/types.h>
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #include "sshbuf.h"
+ #include "digest.h"
 diff --git a/kex.c b/kex.c
-index 25f9f66f6..fb5bfaea5 100644
+index 34808b5c3..a2a4794e8 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -54,6 +54,10 @@
+@@ -55,11 +55,16 @@
+ #include "misc.h"
+ #include "dispatch.h"
+ #include "monitor.h"
++#include "xmalloc.h"
+ 
+ #include "ssherr.h"
  #include "sshbuf.h"
  #include "digest.h"
  
@@ -1470,57 +1371,129 @@ index 25f9f66f6..fb5bfaea5 100644
  /* prototype */
  static int kex_choose_conf(struct ssh *);
  static int kex_input_newkeys(int, u_int32_t, struct ssh *);
-@@ -105,6 +109,14 @@ static const struct kexalg kexalgs[] = {
+@@ -113,15 +118,28 @@ static const struct kexalg kexalgs[] = {
  #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
         { NULL, -1, -1, -1},
  };
-+static const struct kexalg kexalg_prefixes[] = {
++static const struct kexalg gss_kexalgs[] = {
 +#ifdef GSSAPI
 +       { KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
 +       { KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
 +       { KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
++       { KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
++       { KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
++       { KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256,
++           NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
++       { KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
 +#endif
 +       { NULL, -1, -1, -1 },
 +};
  
- char *
- kex_alg_list(char sep)
-@@ -137,6 +149,10 @@ kex_alg_by_name(const char *name)
+-char *
+-kex_alg_list(char sep)
++static char *
++kex_alg_list_internal(char sep, const struct kexalg *algs)
+ {
+        char *ret = NULL, *tmp;
+        size_t nlen, rlen = 0;
+        const struct kexalg *k;
+ 
+-       for (k = kexalgs; k->name != NULL; k++) {
++       for (k = algs; k->name != NULL; k++) {
+                if (ret != NULL)
+                        ret[rlen++] = sep;
+                nlen = strlen(k->name);
+@@ -136,6 +154,18 @@ kex_alg_list(char sep)
+        return ret;
+ }
+ 
++char *
++kex_alg_list(char sep)
++{
++       return kex_alg_list_internal(sep, kexalgs);
++}
++
++char *
++kex_gss_alg_list(char sep)
++{
++       return kex_alg_list_internal(sep, gss_kexalgs);
++}
++
+ static const struct kexalg *
+ kex_alg_by_name(const char *name)
+ {
+@@ -145,6 +175,10 @@ kex_alg_by_name(const char *name)
                 if (strcmp(k->name, name) == 0)
                         return k;
         }
-+       for (k = kexalg_prefixes; k->name != NULL; k++) {
++       for (k = gss_kexalgs; k->name != NULL; k++) {
 +               if (strncmp(k->name, name, strlen(k->name)) == 0)
 +                       return k;
 +       }
         return NULL;
  }
  
-@@ -653,6 +669,9 @@ kex_free(struct kex *kex)
-        sshbuf_free(kex->peer);
-        sshbuf_free(kex->my);
+@@ -301,6 +335,29 @@ kex_assemble_names(char **listp, const char *def, const char *all)
+        return r;
+ }
+ 
++/* Validate GSS KEX method name list */
++int
++kex_gss_names_valid(const char *names)
++{
++       char *s, *cp, *p;
++
++       if (names == NULL || *names == '\0')
++               return 0;
++       s = cp = xstrdup(names);
++       for ((p = strsep(&cp, ",")); p && *p != '\0';
++           (p = strsep(&cp, ","))) {
++               if (strncmp(p, "gss-", 4) != 0
++                 || kex_alg_by_name(p) == NULL) {
++                       error("Unsupported KEX algorithm \"%.100s\"", p);
++                       free(s);
++                       return 0;
++               }
++       }
++       debug3("gss kex names ok: [%s]", names);
++       free(s);
++       return 1;
++}
++
+ /* put algorithm proposal into buffer */
+ int
+ kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX])
+@@ -657,6 +714,9 @@ kex_free(struct kex *kex)
+        sshbuf_free(kex->server_version);
+        sshbuf_free(kex->client_pub);
         free(kex->session_id);
 +#ifdef GSSAPI
 +       free(kex->gss_host);
 +#endif /* GSSAPI */
-        free(kex->client_version_string);
-        free(kex->server_version_string);
         free(kex->failed_choice);
+        free(kex->hostkey_alg);
+        free(kex->name);
 diff --git a/kex.h b/kex.h
-index 593de1208..4e5ead839 100644
+index 6d446d1cc..2d5f1d4ed 100644
 --- a/kex.h
 +++ b/kex.h
-@@ -100,6 +100,9 @@ enum kex_exchange {
-        KEX_DH_GEX_SHA256,
+@@ -103,6 +103,15 @@ enum kex_exchange {
         KEX_ECDH_SHA2,
         KEX_C25519_SHA256,
+        KEX_KEM_SNTRUP4591761X25519_SHA512,
++#ifdef GSSAPI
 +       KEX_GSS_GRP1_SHA1,
 +       KEX_GSS_GRP14_SHA1,
++       KEX_GSS_GRP14_SHA256,
++       KEX_GSS_GRP16_SHA512,
 +       KEX_GSS_GEX_SHA1,
++       KEX_GSS_NISTP256_SHA256,
++       KEX_GSS_C25519_SHA256,
++#endif
         KEX_MAX
  };
  
-@@ -148,6 +151,12 @@ struct kex {
+@@ -154,6 +163,12 @@ struct kex {
         u_int   flags;
         int     hash_alg;
         int     ec_nid;
@@ -1530,27 +1503,93 @@ index 593de1208..4e5ead839 100644
 +       char    *gss_host;
 +       char    *gss_client;
 +#endif
-        char    *client_version_string;
-        char    *server_version_string;
         char    *failed_choice;
-@@ -198,6 +207,11 @@ int         kexecdh_server(struct ssh *);
- int     kexc25519_client(struct ssh *);
- int     kexc25519_server(struct ssh *);
- 
-+#ifdef GSSAPI
+        int     (*verify_host_key)(struct sshkey *, struct ssh *);
+        struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
+@@ -175,8 +190,10 @@ struct kex {
+ 
+ int     kex_names_valid(const char *);
+ char   *kex_alg_list(char);
++char   *kex_gss_alg_list(char);
+ char   *kex_names_cat(const char *, const char *);
+ int     kex_assemble_names(char **, const char *, const char *);
++int     kex_gss_names_valid(const char *);
+ 
+ int     kex_exchange_identification(struct ssh *, int, const char *);
+ 
+@@ -203,6 +220,12 @@ int         kexgex_client(struct ssh *);
+ int     kexgex_server(struct ssh *);
+ int     kex_gen_client(struct ssh *);
+ int     kex_gen_server(struct ssh *);
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
++int     kexgssgex_client(struct ssh *);
++int     kexgssgex_server(struct ssh *);
 +int     kexgss_client(struct ssh *);
 +int     kexgss_server(struct ssh *);
 +#endif
-+
- int     kex_dh_hash(int, const char *, const char *,
-     const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
-     const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
+ 
+ int     kex_dh_keypair(struct kex *);
+ int     kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
+@@ -235,6 +258,12 @@ int         kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
+     const BIGNUM *, const u_char *, size_t,
+     u_char *, size_t *);
+ 
++int     kex_gen_hash(int hash_alg, const struct sshbuf *client_version,
++    const struct sshbuf *server_version, const struct sshbuf *client_kexinit,
++    const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob,
++    const struct sshbuf *client_pub, const struct sshbuf *server_pub,
++    const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen);
++
+ void   kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
+        __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+        __attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+diff --git a/kexdh.c b/kexdh.c
+index 67133e339..edaa46762 100644
+--- a/kexdh.c
++++ b/kexdh.c
+@@ -48,13 +48,23 @@ kex_dh_keygen(struct kex *kex)
+ {
+        switch (kex->kex_type) {
+        case KEX_DH_GRP1_SHA1:
++#ifdef GSSAPI
++       case KEX_GSS_GRP1_SHA1:
++#endif
+                kex->dh = dh_new_group1();
+                break;
+        case KEX_DH_GRP14_SHA1:
+        case KEX_DH_GRP14_SHA256:
++#ifdef GSSAPI
++       case KEX_GSS_GRP14_SHA1:
++       case KEX_GSS_GRP14_SHA256:
++#endif
+                kex->dh = dh_new_group14();
+                break;
+        case KEX_DH_GRP16_SHA512:
++#ifdef GSSAPI
++       case KEX_GSS_GRP16_SHA512:
++#endif
+                kex->dh = dh_new_group16();
+                break;
+        case KEX_DH_GRP18_SHA512:
+diff --git a/kexgen.c b/kexgen.c
+index 2abbb9ef6..569dc83f3 100644
+--- a/kexgen.c
++++ b/kexgen.c
+@@ -43,7 +43,7 @@
+ static int input_kex_gen_init(int, u_int32_t, struct ssh *);
+ static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
+ 
+-static int
++int
+ kex_gen_hash(
+     int hash_alg,
+     const struct sshbuf *client_version,
 diff --git a/kexgssc.c b/kexgssc.c
 new file mode 100644
-index 000000000..3c8ae08dd
+index 000000000..f6e1405eb
 --- /dev/null
 +++ b/kexgssc.c
-@@ -0,0 +1,341 @@
+@@ -0,0 +1,606 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1577,7 +1616,7 @@ index 000000000..3c8ae08dd
 +
 +#include "includes.h"
 +
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +
 +#include "includes.h"
 +
@@ -1596,113 +1635,88 @@ index 000000000..3c8ae08dd
 +#include "packet.h"
 +#include "dh.h"
 +#include "digest.h"
++#include "ssherr.h"
 +
 +#include "ssh-gss.h"
 +
 +int
-+kexgss_client(struct ssh *ssh) {
-+       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-+       gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
++kexgss_client(struct ssh *ssh)
++{
++       struct kex *kex = ssh->kex;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
++           recv_tok = GSS_C_EMPTY_BUFFER,
++           gssbuf, msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
 +       Gssctxt *ctxt;
 +       OM_uint32 maj_status, min_status, ret_flags;
-+       u_int klen, kout, slen = 0, strlen;
-+       DH *dh; 
-+       BIGNUM *dh_server_pub = NULL;
-+       BIGNUM *shared_secret = NULL;
-+       const BIGNUM *pub_key, *dh_p, *dh_g;
-+       BIGNUM *p = NULL;
-+       BIGNUM *g = NULL;       
-+       u_char *kbuf;
-+       u_char *serverhostkey = NULL;
-+       u_char *empty = "";
-+       char *msg;
++       struct sshbuf *server_blob = NULL;
++       struct sshbuf *shared_secret = NULL;
++       struct sshbuf *server_host_key_blob = NULL;
++       struct sshbuf *empty = NULL;
++       u_char *msg;
 +       int type = 0;
 +       int first = 1;
-+       int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
 +       u_char hash[SSH_DIGEST_MAX_LENGTH];
 +       size_t hashlen;
++       u_char c;
++       int r;
 +
-+       /* Initialise our GSSAPI world */       
++       /* Initialise our GSSAPI world */
 +       ssh_gssapi_build_ctx(&ctxt);
-+       if (ssh_gssapi_id_kex(ctxt, ssh->kex->name, ssh->kex->kex_type) 
++       if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
 +           == GSS_C_NO_OID)
 +               fatal("Couldn't identify host exchange");
 +
-+       if (ssh_gssapi_import_name(ctxt, ssh->kex->gss_host))
++       if (ssh_gssapi_import_name(ctxt, kex->gss_host))
 +               fatal("Couldn't import hostname");
 +
-+       if (ssh->kex->gss_client && 
-+           ssh_gssapi_client_identity(ctxt, ssh->kex->gss_client))
++       if (kex->gss_client &&
++           ssh_gssapi_client_identity(ctxt, kex->gss_client))
 +               fatal("Couldn't acquire client credentials");
 +
-+       switch (ssh->kex->kex_type) {
++       /* Step 1 */
++       switch (kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
-+               dh = dh_new_group1();
-+               break;
 +       case KEX_GSS_GRP14_SHA1:
-+               dh = dh_new_group14();
++       case KEX_GSS_GRP14_SHA256:
++       case KEX_GSS_GRP16_SHA512:
++               r = kex_dh_keypair(kex);
++               break;
++       case KEX_GSS_NISTP256_SHA256:
++               r = kex_ecdh_keypair(kex);
 +               break;
-+       case KEX_GSS_GEX_SHA1:
-+               debug("Doing group exchange\n");
-+               nbits = dh_estimate(ssh->kex->we_need * 8);
-+               packet_start(SSH2_MSG_KEXGSS_GROUPREQ);
-+               packet_put_int(min);
-+               packet_put_int(nbits);
-+               packet_put_int(max);
-+
-+               packet_send();
-+
-+               packet_read_expect(SSH2_MSG_KEXGSS_GROUP);
-+
-+               if ((p = BN_new()) == NULL)
-+                       fatal("BN_new() failed");
-+               packet_get_bignum2(p);
-+               if ((g = BN_new()) == NULL)
-+                       fatal("BN_new() failed");
-+               packet_get_bignum2(g);
-+               packet_check_eom();
-+
-+               if (BN_num_bits(p) < min || BN_num_bits(p) > max)
-+                       fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
-+                           min, BN_num_bits(p), max);
-+
-+               dh = dh_new_group(g, p);
++       case KEX_GSS_C25519_SHA256:
++               r = kex_c25519_keypair(kex);
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
 +       }
-+       
-+       /* Step 1 - e is dh->pub_key */
-+       dh_gen_key(dh, ssh->kex->we_need * 8);
-+       DH_get0_key(dh, &pub_key, NULL);
-+       DH_get0_pqg(dh, &dh_p, NULL, &dh_g);
-+
-+       /* This is f, we initialise it now to make life easier */
-+       dh_server_pub = BN_new();
-+       if (dh_server_pub == NULL)
-+               fatal("dh_server_pub == NULL");
++       if (r != 0)
++               return r;
 +
 +       token_ptr = GSS_C_NO_BUFFER;
-+                        
++
 +       do {
 +               debug("Calling gss_init_sec_context");
-+               
++
 +               maj_status = ssh_gssapi_init_ctx(ctxt,
-+                   ssh->kex->gss_deleg_creds, token_ptr, &send_tok,
++                   kex->gss_deleg_creds, token_ptr, &send_tok,
 +                   &ret_flags);
 +
 +               if (GSS_ERROR(maj_status)) {
++                       /* XXX Useles code: Missing send? */
 +                       if (send_tok.length != 0) {
-+                               packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                               packet_put_string(send_tok.value,
-+                                   send_tok.length);
++                               if ((r = sshpkt_start(ssh,
++                                       SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
 +                       }
 +                       fatal("gss_init_context failed");
 +               }
 +
 +               /* If we've got an old receive buffer get rid of it */
 +               if (token_ptr != GSS_C_NO_BUFFER)
-+                       free(recv_tok.value);
++                       gss_release_buffer(&min_status, &recv_tok);
 +
 +               if (maj_status == GSS_S_COMPLETE) {
 +                       /* If mutual state flag is not true, kex fails */
@@ -1714,75 +1728,90 @@ index 000000000..3c8ae08dd
 +                               fatal("Integrity check failed");
 +               }
 +
-+               /* 
++               /*
 +                * If we have data to send, then the last message that we
-+                * received cannot have been a 'complete'. 
++                * received cannot have been a 'complete'.
 +                */
 +               if (send_tok.length != 0) {
 +                       if (first) {
-+                               packet_start(SSH2_MSG_KEXGSS_INIT);
-+                               packet_put_string(send_tok.value,
-+                                   send_tok.length);
-+                               packet_put_bignum2(pub_key);
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0 ||
++                                   (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0)
++                                       fatal("failed to construct packet: %s", ssh_err(r));
 +                               first = 0;
 +                       } else {
-+                               packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                               packet_put_string(send_tok.value,
-+                                   send_tok.length);
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("failed to construct packet: %s", ssh_err(r));
 +                       }
-+                       packet_send();
++                       if ((r = sshpkt_send(ssh)) != 0)
++                               fatal("failed to send packet: %s", ssh_err(r));
 +                       gss_release_buffer(&min_status, &send_tok);
 +
 +                       /* If we've sent them data, they should reply */
-+                       do {    
-+                               type = packet_read();
++                       do {
++                               type = ssh_packet_read(ssh);
 +                               if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
 +                                       debug("Received KEXGSS_HOSTKEY");
-+                                       if (serverhostkey)
++                                       if (server_host_key_blob)
 +                                               fatal("Server host key received more than once");
-+                                       serverhostkey = 
-+                                           packet_get_string(&slen);
++                                       if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
++                                               fatal("Failed to read server host key: %s", ssh_err(r));
 +                               }
 +                       } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
 +
 +                       switch (type) {
 +                       case SSH2_MSG_KEXGSS_CONTINUE:
 +                               debug("Received GSSAPI_CONTINUE");
-+                               if (maj_status == GSS_S_COMPLETE) 
++                               if (maj_status == GSS_S_COMPLETE)
 +                                       fatal("GSSAPI Continue received from server when complete");
-+                               recv_tok.value = packet_get_string(&strlen);
-+                               recv_tok.length = strlen; 
++                               if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &recv_tok)) != 0 ||
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("Failed to read token: %s", ssh_err(r));
 +                               break;
 +                       case SSH2_MSG_KEXGSS_COMPLETE:
 +                               debug("Received GSSAPI_COMPLETE");
-+                               packet_get_bignum2(dh_server_pub);
-+                               msg_tok.value =  packet_get_string(&strlen);
-+                               msg_tok.length = strlen; 
++                               if (msg_tok.value != NULL)
++                                       fatal("Received GSSAPI_COMPLETE twice?");
++                               if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
++                                   (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &msg_tok)) != 0)
++                                       fatal("Failed to read message: %s", ssh_err(r));
 +
 +                               /* Is there a token included? */
-+                               if (packet_get_char()) {
-+                                       recv_tok.value=
-+                                           packet_get_string(&strlen);
-+                                       recv_tok.length = strlen;
++                               if ((r = sshpkt_get_u8(ssh, &c)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               if (c) {
++                                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(
++                                           ssh, &recv_tok)) != 0)
++                                               fatal("Failed to read token: %s", ssh_err(r));
 +                                       /* If we're already complete - protocol error */
 +                                       if (maj_status == GSS_S_COMPLETE)
-+                                               packet_disconnect("Protocol error: received token when complete");
-+                                       } else {
-+                                               /* No token included */
-+                                               if (maj_status != GSS_S_COMPLETE)
-+                                                       packet_disconnect("Protocol error: did not receive final token");
++                                               sshpkt_disconnect(ssh, "Protocol error: received token when complete");
++                               } else {
++                                       /* No token included */
++                                       if (maj_status != GSS_S_COMPLETE)
++                                               sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
++                               }
++                               if ((r = sshpkt_get_end(ssh)) != 0) {
++                                       fatal("Expecting end of packet.");
 +                               }
 +                               break;
 +                       case SSH2_MSG_KEXGSS_ERROR:
 +                               debug("Received Error");
-+                               maj_status = packet_get_int();
-+                               min_status = packet_get_int();
-+                               msg = packet_get_string(NULL);
-+                               (void) packet_get_string_ptr(NULL);
-+                               fatal("GSSAPI Error: \n%.400s",msg);
++                               if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 ||
++                                   (r = sshpkt_get_u32(ssh, &min_status)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("sshpkt_get failed: %s", ssh_err(r));
++                               fatal("GSSAPI Error: \n%.400s", msg);
 +                       default:
-+                               packet_disconnect("Protocol error: didn't expect packet type %d",
-+                               type);
++                               sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
++                                   type);
 +                       }
 +                       token_ptr = &recv_tok;
 +               } else {
@@ -1792,93 +1821,358 @@ index 000000000..3c8ae08dd
 +               }
 +       } while (maj_status & GSS_S_CONTINUE_NEEDED);
 +
-+       /* 
-+        * We _must_ have received a COMPLETE message in reply from the 
-+        * server, which will have set dh_server_pub and msg_tok 
++       /*
++        * We _must_ have received a COMPLETE message in reply from the
++        * server, which will have set server_blob and msg_tok
 +        */
 +
 +       if (type != SSH2_MSG_KEXGSS_COMPLETE)
 +               fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
 +
-+       /* Check f in range [1, p-1] */
-+       if (!dh_pub_is_valid(dh, dh_server_pub))
-+               packet_disconnect("bad server public DH value");
-+
-+       /* compute K=f^x mod p */
-+       klen = DH_size(dh);
-+       kbuf = xmalloc(klen);
-+       kout = DH_compute_key(kbuf, dh_server_pub, dh);
-+       if (kout < 0)
-+               fatal("DH_compute_key: failed");
-+
-+       shared_secret = BN_new();
-+       if (shared_secret == NULL)
-+               fatal("kexgss_client: BN_new failed");
-+
-+       if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
-+               fatal("kexdh_client: BN_bin2bn failed");
-+
-+       memset(kbuf, 0, klen);
-+       free(kbuf);
-+
-+       hashlen = sizeof(hash);
-+       switch (ssh->kex->kex_type) {
++       /* compute shared secret */
++       switch (kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
 +       case KEX_GSS_GRP14_SHA1:
-+               kex_dh_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string,
-+                   ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   (serverhostkey ? serverhostkey : empty), slen,
-+                   pub_key,            /* e */
-+                   dh_server_pub,      /* f */
-+                   shared_secret,      /* K */
-+                   hash, &hashlen
-+               );
++       case KEX_GSS_GRP14_SHA256:
++       case KEX_GSS_GRP16_SHA512:
++               r = kex_dh_dec(kex, server_blob, &shared_secret);
++               break;
++       case KEX_GSS_C25519_SHA256:
++               if (sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] & 0x80)
++                       fatal("The received key has MSB of last octet set!");
++               r = kex_c25519_dec(kex, server_blob, &shared_secret);
 +               break;
-+       case KEX_GSS_GEX_SHA1:
-+               kexgex_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string,
-+                   ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   (serverhostkey ? serverhostkey : empty), slen,
-+                   min, nbits, max,
-+                   dh_p, dh_g,
-+                   pub_key,
-+                   dh_server_pub,
-+                   shared_secret,
-+                   hash, &hashlen
-+               );
++       case KEX_GSS_NISTP256_SHA256:
++               if (sshbuf_len(server_blob) != 65)
++                       fatal("The received NIST-P256 key did not match"
++                           "expected length (expected 65, got %zu)", sshbuf_len(server_blob));
++
++               if (sshbuf_ptr(server_blob)[0] != POINT_CONVERSION_UNCOMPRESSED)
++                       fatal("The received NIST-P256 key does not have first octet 0x04");
++
++               r = kex_ecdh_dec(kex, server_blob, &shared_secret);
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
++               r = SSH_ERR_INVALID_ARGUMENT;
++               break;
++       }
++       if (r != 0)
++               goto out;
++
++       if ((empty = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
 +       }
 +
++       hashlen = sizeof(hash);
++       if ((r = kex_gen_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->my,
++           kex->peer,
++           (server_host_key_blob ? server_host_key_blob : empty),
++           kex->client_pub,
++           server_blob,
++           shared_secret,
++           hash, &hashlen)) != 0)
++               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++
 +       gssbuf.value = hash;
 +       gssbuf.length = hashlen;
 +
 +       /* Verify that the hash matches the MIC we just got. */
 +       if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
-+               packet_disconnect("Hash's MIC didn't verify");
++               sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
 +
-+       free(msg_tok.value);
++       gss_release_buffer(&min_status, &msg_tok);
 +
-+       DH_free(dh);
-+       free(serverhostkey);
-+       BN_clear_free(dh_server_pub);
++       if (kex->gss_deleg_creds)
++               ssh_gssapi_credentials_updated(ctxt);
++
++       if (gss_kex_context == NULL)
++               gss_kex_context = ctxt;
++       else
++               ssh_gssapi_delete_ctx(&ctxt);
++
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
++
++out:
++       explicit_bzero(hash, sizeof(hash));
++       explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
++       sshbuf_free(empty);
++       sshbuf_free(server_host_key_blob);
++       sshbuf_free(server_blob);
++       sshbuf_free(shared_secret);
++       sshbuf_free(kex->client_pub);
++       kex->client_pub = NULL;
++       return r;
++}
++
++int
++kexgssgex_client(struct ssh *ssh)
++{
++       struct kex *kex = ssh->kex;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
++           recv_tok = GSS_C_EMPTY_BUFFER, gssbuf,
++            msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
++       Gssctxt *ctxt;
++       OM_uint32 maj_status, min_status, ret_flags;
++       struct sshbuf *shared_secret = NULL;
++       BIGNUM *p = NULL;
++       BIGNUM *g = NULL;
++       struct sshbuf *buf = NULL;
++       struct sshbuf *server_host_key_blob = NULL;
++       struct sshbuf *server_blob = NULL;
++       BIGNUM *dh_server_pub = NULL;
++       u_char *msg;
++       int type = 0;
++       int first = 1;
++       u_char hash[SSH_DIGEST_MAX_LENGTH];
++       size_t hashlen;
++       const BIGNUM *pub_key, *dh_p, *dh_g;
++       int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
++       struct sshbuf *empty = NULL;
++       u_char c;
++       int r;
++
++       /* Initialise our GSSAPI world */
++       ssh_gssapi_build_ctx(&ctxt);
++       if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
++           == GSS_C_NO_OID)
++               fatal("Couldn't identify host exchange");
++
++       if (ssh_gssapi_import_name(ctxt, kex->gss_host))
++               fatal("Couldn't import hostname");
++
++       if (kex->gss_client &&
++           ssh_gssapi_client_identity(ctxt, kex->gss_client))
++               fatal("Couldn't acquire client credentials");
++
++       debug("Doing group exchange");
++       nbits = dh_estimate(kex->dh_need * 8);
++
++       kex->min = DH_GRP_MIN;
++       kex->max = DH_GRP_MAX;
++       kex->nbits = nbits;
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUPREQ)) != 0 ||
++           (r = sshpkt_put_u32(ssh, min)) != 0 ||
++           (r = sshpkt_put_u32(ssh, nbits)) != 0 ||
++           (r = sshpkt_put_u32(ssh, max)) != 0 ||
++           (r = sshpkt_send(ssh)) != 0)
++               fatal("Failed to construct a packet: %s", ssh_err(r));
++
++       if ((r = ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0)
++               fatal("Error: %s", ssh_err(r));
++
++       if ((r = sshpkt_get_bignum2(ssh, &p)) != 0 ||
++           (r = sshpkt_get_bignum2(ssh, &g)) != 0 ||
++           (r = sshpkt_get_end(ssh)) != 0)
++               fatal("shpkt_get_bignum2 failed: %s", ssh_err(r));
++
++       if (BN_num_bits(p) < min || BN_num_bits(p) > max)
++               fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
++                   min, BN_num_bits(p), max);
++
++       if ((kex->dh = dh_new_group(g, p)) == NULL)
++               fatal("dn_new_group() failed");
++       p = g = NULL; /* belong to kex->dh now */
++
++       if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
++               goto out;
++       DH_get0_key(kex->dh, &pub_key, NULL);
++
++       token_ptr = GSS_C_NO_BUFFER;
++
++       do {
++               /* Step 2 - call GSS_Init_sec_context() */
++               debug("Calling gss_init_sec_context");
++
++               maj_status = ssh_gssapi_init_ctx(ctxt,
++                   kex->gss_deleg_creds, token_ptr, &send_tok,
++                   &ret_flags);
++
++               if (GSS_ERROR(maj_status)) {
++                       /* XXX Useles code: Missing send? */
++                       if (send_tok.length != 0) {
++                               if ((r = sshpkt_start(ssh,
++                                       SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                       }
++                       fatal("gss_init_context failed");
++               }
++
++               /* If we've got an old receive buffer get rid of it */
++               if (token_ptr != GSS_C_NO_BUFFER)
++                       gss_release_buffer(&min_status, &recv_tok);
++
++               if (maj_status == GSS_S_COMPLETE) {
++                       /* If mutual state flag is not true, kex fails */
++                       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
++                               fatal("Mutual authentication failed");
++
++                       /* If integ avail flag is not true kex fails */
++                       if (!(ret_flags & GSS_C_INTEG_FLAG))
++                               fatal("Integrity check failed");
++               }
++
++               /*
++                * If we have data to send, then the last message that we
++                * received cannot have been a 'complete'.
++                */
++               if (send_tok.length != 0) {
++                       if (first) {
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 ||
++                                   (r = sshpkt_put_string(ssh, send_tok.value,
++                                       send_tok.length)) != 0 ||
++                                   (r = sshpkt_put_bignum2(ssh, pub_key)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               first = 0;
++                       } else {
++                               if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                                   (r = sshpkt_put_string(ssh,send_tok.value,
++                                       send_tok.length)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                       }
++                       if ((r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt_send failed: %s", ssh_err(r));
++                       gss_release_buffer(&min_status, &send_tok);
++
++                       /* If we've sent them data, they should reply */
++                       do {
++                               type = ssh_packet_read(ssh);
++                               if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
++                                       debug("Received KEXGSS_HOSTKEY");
++                                       if (server_host_key_blob)
++                                               fatal("Server host key received more than once");
++                                       if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
++                                               fatal("sshpkt failed: %s", ssh_err(r));
++                               }
++                       } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
++
++                       switch (type) {
++                       case SSH2_MSG_KEXGSS_CONTINUE:
++                               debug("Received GSSAPI_CONTINUE");
++                               if (maj_status == GSS_S_COMPLETE)
++                                       fatal("GSSAPI Continue received from server when complete");
++                               if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &recv_tok)) != 0 ||
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               break;
++                       case SSH2_MSG_KEXGSS_COMPLETE:
++                               debug("Received GSSAPI_COMPLETE");
++                               if (msg_tok.value != NULL)
++                                       fatal("Received GSSAPI_COMPLETE twice?");
++                               if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
++                                   (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                                       &msg_tok)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++
++                               /* Is there a token included? */
++                               if ((r = sshpkt_get_u8(ssh, &c)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               if (c) {
++                                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(
++                                               ssh, &recv_tok)) != 0 ||
++                                           (r = sshpkt_get_end(ssh)) != 0)
++                                               fatal("sshpkt failed: %s", ssh_err(r));
++                                       /* If we're already complete - protocol error */
++                                       if (maj_status == GSS_S_COMPLETE)
++                                               sshpkt_disconnect(ssh, "Protocol error: received token when complete");
++                               } else {
++                                       /* No token included */
++                                       if (maj_status != GSS_S_COMPLETE)
++                                               sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
++                               }
++                               break;
++                       case SSH2_MSG_KEXGSS_ERROR:
++                               debug("Received Error");
++                               if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 ||
++                                   (r = sshpkt_get_u32(ssh, &min_status)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
++                                   (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */
++                                   (r = sshpkt_get_end(ssh)) != 0)
++                                       fatal("sshpkt failed: %s", ssh_err(r));
++                               fatal("GSSAPI Error: \n%.400s", msg);
++                       default:
++                               sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
++                                   type);
++                       }
++                       token_ptr = &recv_tok;
++               } else {
++                       /* No data, and not complete */
++                       if (maj_status != GSS_S_COMPLETE)
++                               fatal("Not complete, and no token output");
++               }
++       } while (maj_status & GSS_S_CONTINUE_NEEDED);
++
++       /*
++        * We _must_ have received a COMPLETE message in reply from the
++        * server, which will have set dh_server_pub and msg_tok
++        */
++
++       if (type != SSH2_MSG_KEXGSS_COMPLETE)
++               fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
++
++       /* 7. C verifies that the key Q_S is valid */
++       /* 8. C computes shared secret */
++       if ((buf = sshbuf_new()) == NULL ||
++           (r = sshbuf_put_stringb(buf, server_blob)) != 0 ||
++           (r = sshbuf_get_bignum2(buf, &dh_server_pub)) != 0)
++               goto out;
++       sshbuf_free(buf);
++       buf = NULL;
++
++       if ((shared_secret = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
++       }
++
++       if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0)
++               goto out;
++       if ((empty = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
++       }
++
++       DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
++       hashlen = sizeof(hash);
++       if ((r = kexgex_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->my,
++           kex->peer,
++           (server_host_key_blob ? server_host_key_blob : empty),
++           kex->min, kex->nbits, kex->max,
++           dh_p, dh_g,
++           pub_key,
++           dh_server_pub,
++           sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
++           hash, &hashlen)) != 0)
++               fatal("Failed to calculate hash: %s", ssh_err(r));
++
++       gssbuf.value = hash;
++       gssbuf.length = hashlen;
++
++       /* Verify that the hash matches the MIC we just got. */
++       if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
++               sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
++
++       gss_release_buffer(&min_status, &msg_tok);
 +
 +       /* save session id */
-+       if (ssh->kex->session_id == NULL) {
-+               ssh->kex->session_id_len = hashlen;
-+               ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);
-+               memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);
++       if (kex->session_id == NULL) {
++               kex->session_id_len = hashlen;
++               kex->session_id = xmalloc(kex->session_id_len);
++               memcpy(kex->session_id, hash, kex->session_id_len);
 +       }
 +
-+       if (ssh->kex->gss_deleg_creds)
++       if (kex->gss_deleg_creds)
 +               ssh_gssapi_credentials_updated(ctxt);
 +
 +       if (gss_kex_context == NULL)
@@ -1886,18 +2180,28 @@ index 000000000..3c8ae08dd
 +       else
 +               ssh_gssapi_delete_ctx(&ctxt);
 +
-+       kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);
-+       BN_clear_free(shared_secret);
-+       return kex_send_newkeys(ssh);
++       /* Finally derive the keys and send them */
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
++out:
++       sshbuf_free(buf);
++       sshbuf_free(server_blob);
++       sshbuf_free(empty);
++       explicit_bzero(hash, sizeof(hash));
++       DH_free(kex->dh);
++       kex->dh = NULL;
++       BN_clear_free(dh_server_pub);
++       sshbuf_free(shared_secret);
++       sshbuf_free(server_host_key_blob);
++       return r;
 +}
-+
-+#endif /* GSSAPI */
++#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
 diff --git a/kexgsss.c b/kexgsss.c
 new file mode 100644
-index 000000000..18070f1d7
+index 000000000..60bc02deb
 --- /dev/null
 +++ b/kexgsss.c
-@@ -0,0 +1,300 @@
+@@ -0,0 +1,474 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1924,7 +2228,7 @@ index 000000000..18070f1d7
 +
 +#include "includes.h"
 +
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +
 +#include <string.h>
 +
@@ -1942,40 +2246,41 @@ index 000000000..18070f1d7
 +#include "dh.h"
 +#include "ssh-gss.h"
 +#include "monitor_wrap.h"
-+#include "misc.h"
++#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
 +#include "servconf.h"
++#include "ssh-gss.h"
 +#include "digest.h"
++#include "ssherr.h"
 +
 +extern ServerOptions options;
 +
 +int
 +kexgss_server(struct ssh *ssh)
 +{
++       struct kex *kex = ssh->kex;
 +       OM_uint32 maj_status, min_status;
-+       
-+       /* 
++
++       /*
 +        * Some GSSAPI implementations use the input value of ret_flags (an
-+        * output variable) as a means of triggering mechanism specific 
-+        * features. Initializing it to zero avoids inadvertently 
-+        * activating this non-standard behaviour.
++        * output variable) as a means of triggering mechanism specific
++        * features. Initializing it to zero avoids inadvertently
++        * activating this non-standard behaviour.
 +        */
 +
 +       OM_uint32 ret_flags = 0;
 +       gss_buffer_desc gssbuf, recv_tok, msg_tok;
 +       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +       Gssctxt *ctxt = NULL;
-+       u_int slen, klen, kout;
-+       u_char *kbuf;
-+       DH *dh;
-+       int min = -1, max = -1, nbits = -1;
-+       const BIGNUM *pub_key, *dh_p, *dh_g;
-+       BIGNUM *shared_secret = NULL;
-+       BIGNUM *dh_client_pub = NULL;
++       struct sshbuf *shared_secret = NULL;
++       struct sshbuf *client_pubkey = NULL;
++       struct sshbuf *server_pubkey = NULL;
++       struct sshbuf *empty = sshbuf_new();
 +       int type = 0;
 +       gss_OID oid;
 +       char *mechs;
 +       u_char hash[SSH_DIGEST_MAX_LENGTH];
 +       size_t hashlen;
++       int r;
 +
 +       /* Initialise GSSAPI */
 +
@@ -1988,8 +2293,8 @@ index 000000000..18070f1d7
 +               free(mechs);
 +       }
 +
-+       debug2("%s: Identifying %s", __func__, ssh->kex->name);
-+       oid = ssh_gssapi_id_kex(NULL, ssh->kex->name, ssh->kex->kex_type);
++       debug2("%s: Identifying %s", __func__, kex->name);
++       oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
 +       if (oid == GSS_C_NO_OID)
 +          fatal("Unknown gssapi mechanism");
 +
@@ -1998,94 +2303,82 @@ index 000000000..18070f1d7
 +       if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
 +               fatal("Unable to acquire credentials for the server");
 +
-+       switch (ssh->kex->kex_type) {
-+       case KEX_GSS_GRP1_SHA1:
-+               dh = dh_new_group1();
-+               break;
-+       case KEX_GSS_GRP14_SHA1:
-+               dh = dh_new_group14();
-+               break;
-+       case KEX_GSS_GEX_SHA1:
-+               debug("Doing group exchange");
-+               packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);
-+               min = packet_get_int();
-+               nbits = packet_get_int();
-+               max = packet_get_int();
-+               packet_check_eom();
-+               if (max < min || nbits < min || max < nbits)
-+                       fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
-+                           min, nbits, max);
-+               dh = PRIVSEP(choose_dh(MAX(DH_GRP_MIN, min),
-+                   nbits, MIN(DH_GRP_MAX, max)));
-+               if (dh == NULL)
-+                       packet_disconnect("Protocol error: no matching group found");
-+               DH_get0_pqg(dh, &dh_p, NULL, &dh_g);
-+
-+               packet_start(SSH2_MSG_KEXGSS_GROUP);
-+               packet_put_bignum2(dh_p);
-+               packet_put_bignum2(dh_g);
-+               packet_send();
-+
-+               packet_write_wait();
-+               break;
-+       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
-+       }
-+
-+       dh_gen_key(dh, ssh->kex->we_need * 8);
-+
 +       do {
-+               debug("Wait SSH2_MSG_GSSAPI_INIT");
-+               type = packet_read();
++               debug("Wait SSH2_MSG_KEXGSS_INIT");
++               type = ssh_packet_read(ssh);
 +               switch(type) {
 +               case SSH2_MSG_KEXGSS_INIT:
-+                       if (dh_client_pub != NULL) 
++                       if (client_pubkey != NULL)
 +                               fatal("Received KEXGSS_INIT after initialising");
-+                       recv_tok.value = packet_get_string(&slen);
-+                       recv_tok.length = slen; 
-+
-+                       if ((dh_client_pub = BN_new()) == NULL)
-+                               fatal("dh_client_pub == NULL");
-+
-+                       packet_get_bignum2(dh_client_pub);
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++
++                       switch (kex->kex_type) {
++                       case KEX_GSS_GRP1_SHA1:
++                       case KEX_GSS_GRP14_SHA1:
++                       case KEX_GSS_GRP14_SHA256:
++                       case KEX_GSS_GRP16_SHA512:
++                               r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
++                                   &shared_secret);
++                               break;
++                       case KEX_GSS_NISTP256_SHA256:
++                               r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
++                                   &shared_secret);
++                               break;
++                       case KEX_GSS_C25519_SHA256:
++                               r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
++                                   &shared_secret);
++                               break;
++                       default:
++                               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++                       }
++                       if (r != 0)
++                               goto out;
 +
 +                       /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
 +                       break;
 +               case SSH2_MSG_KEXGSS_CONTINUE:
-+                       recv_tok.value = packet_get_string(&slen);
-+                       recv_tok.length = slen; 
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
 +                       break;
 +               default:
-+                       packet_disconnect(
++                       sshpkt_disconnect(ssh,
 +                           "Protocol error: didn't expect packet type %d",
 +                           type);
 +               }
 +
-+               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, 
++               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
 +                   &send_tok, &ret_flags));
 +
-+               free(recv_tok.value);
++               gss_release_buffer(&min_status, &recv_tok);
 +
 +               if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
 +                       fatal("Zero length token output when incomplete");
 +
-+               if (dh_client_pub == NULL)
++               if (client_pubkey == NULL)
 +                       fatal("No client public key");
-+               
++
 +               if (maj_status & GSS_S_CONTINUE_NEEDED) {
 +                       debug("Sending GSSAPI_CONTINUE");
-+                       packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                       packet_put_string(send_tok.value, send_tok.length);
-+                       packet_send();
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
 +                       gss_release_buffer(&min_status, &send_tok);
 +               }
 +       } while (maj_status & GSS_S_CONTINUE_NEEDED);
 +
 +       if (GSS_ERROR(maj_status)) {
 +               if (send_tok.length > 0) {
-+                       packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+                       packet_put_string(send_tok.value, send_tok.length);
-+                       packet_send();
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
 +               }
 +               fatal("accept_ctx died");
 +       }
@@ -2095,123 +2388,320 @@ index 000000000..18070f1d7
 +
 +       if (!(ret_flags & GSS_C_INTEG_FLAG))
 +               fatal("Integrity flag wasn't set");
-+       
-+       if (!dh_pub_is_valid(dh, dh_client_pub))
-+               packet_disconnect("bad client public DH value");
 +
-+       klen = DH_size(dh);
-+       kbuf = xmalloc(klen); 
-+       kout = DH_compute_key(kbuf, dh_client_pub, dh);
-+       if (kout < 0)
-+               fatal("DH_compute_key: failed");
++       hashlen = sizeof(hash);
++       if ((r = kex_gen_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->peer,
++           kex->my,
++           empty,
++           client_pubkey,
++           server_pubkey,
++           shared_secret,
++           hash, &hashlen)) != 0)
++               goto out;
 +
-+       shared_secret = BN_new();
-+       if (shared_secret == NULL)
-+               fatal("kexgss_server: BN_new failed");
++       gssbuf.value = hash;
++       gssbuf.length = hashlen;
 +
-+       if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
-+               fatal("kexgss_server: BN_bin2bn failed");
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))))
++               fatal("Couldn't get MIC");
 +
-+       memset(kbuf, 0, klen);
-+       free(kbuf);
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 ||
++           (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
++           (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
 +
-+       DH_get0_key(dh, &pub_key, NULL);
-+       DH_get0_pqg(dh, &dh_p, NULL, &dh_g);
++       if (send_tok.length != 0) {
++               if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */
++                   (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0)
++                       fatal("sshpkt failed: %s", ssh_err(r));
++       } else {
++               if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */
++                       fatal("sshpkt failed: %s", ssh_err(r));
++       }
++       if ((r = sshpkt_send(ssh)) != 0)
++               fatal("sshpkt_send failed: %s", ssh_err(r));
 +
-+       hashlen = sizeof(hash);
-+       switch (ssh->kex->kex_type) {
-+       case KEX_GSS_GRP1_SHA1:
-+       case KEX_GSS_GRP14_SHA1:
-+               kex_dh_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string, ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   NULL, 0, /* Change this if we start sending host keys */
-+                   dh_client_pub, pub_key, shared_secret,
-+                   hash, &hashlen
-+               );
-+               break;
-+       case KEX_GSS_GEX_SHA1:
-+               kexgex_hash(
-+                   ssh->kex->hash_alg,
-+                   ssh->kex->client_version_string, ssh->kex->server_version_string,
-+                   sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
-+                   sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
-+                   NULL, 0,
-+                   min, nbits, max,
-+                   dh_p, dh_g,
-+                   dh_client_pub,
-+                   pub_key,
-+                   shared_secret,
-+                   hash, &hashlen
-+               );
-+               break;
-+       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
++       gss_release_buffer(&min_status, &send_tok);
++       gss_release_buffer(&min_status, &msg_tok);
++
++       if (gss_kex_context == NULL)
++               gss_kex_context = ctxt;
++       else
++               ssh_gssapi_delete_ctx(&ctxt);
++
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
++
++       /* If this was a rekey, then save out any delegated credentials we
++        * just exchanged.  */
++       if (options.gss_store_rekey)
++               ssh_gssapi_rekey_creds();
++out:
++       sshbuf_free(empty);
++       explicit_bzero(hash, sizeof(hash));
++       sshbuf_free(shared_secret);
++       sshbuf_free(client_pubkey);
++       sshbuf_free(server_pubkey);
++       return r;
++}
++
++int
++kexgssgex_server(struct ssh *ssh)
++{
++       struct kex *kex = ssh->kex;
++       OM_uint32 maj_status, min_status;
++
++       /*
++        * Some GSSAPI implementations use the input value of ret_flags (an
++        * output variable) as a means of triggering mechanism specific
++        * features. Initializing it to zero avoids inadvertently
++        * activating this non-standard behaviour.
++        */
++
++       OM_uint32 ret_flags = 0;
++       gss_buffer_desc gssbuf, recv_tok, msg_tok;
++       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
++       Gssctxt *ctxt = NULL;
++       struct sshbuf *shared_secret = NULL;
++       int type = 0;
++       gss_OID oid;
++       char *mechs;
++       u_char hash[SSH_DIGEST_MAX_LENGTH];
++       size_t hashlen;
++       BIGNUM *dh_client_pub = NULL;
++       const BIGNUM *pub_key, *dh_p, *dh_g;
++       int min = -1, max = -1, nbits = -1;
++       int cmin = -1, cmax = -1; /* client proposal */
++       struct sshbuf *empty = sshbuf_new();
++       int r;
++
++       /* Initialise GSSAPI */
++
++       /* If we're rekeying, privsep means that some of the private structures
++        * in the GSSAPI code are no longer available. This kludges them back
++        * into life
++        */
++       if (!ssh_gssapi_oid_table_ok())
++               if ((mechs = ssh_gssapi_server_mechanisms()))
++                       free(mechs);
++
++       debug2("%s: Identifying %s", __func__, kex->name);
++       oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
++       if (oid == GSS_C_NO_OID)
++          fatal("Unknown gssapi mechanism");
++
++       debug2("%s: Acquiring credentials", __func__);
++
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
++               fatal("Unable to acquire credentials for the server");
++
++       /* 5. S generates an ephemeral key pair (do the allocations early) */
++       debug("Doing group exchange");
++       ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUPREQ);
++       /* store client proposal to provide valid signature */
++       if ((r = sshpkt_get_u32(ssh, &cmin)) != 0 ||
++           (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
++           (r = sshpkt_get_u32(ssh, &cmax)) != 0 ||
++           (r = sshpkt_get_end(ssh)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
++       kex->nbits = nbits;
++       kex->min = cmin;
++       kex->max = cmax;
++       min = MAX(DH_GRP_MIN, cmin);
++       max = MIN(DH_GRP_MAX, cmax);
++       nbits = MAXIMUM(DH_GRP_MIN, nbits);
++       nbits = MINIMUM(DH_GRP_MAX, nbits);
++       if (max < min || nbits < min || max < nbits)
++               fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
++                   min, nbits, max);
++       kex->dh = PRIVSEP(choose_dh(min, nbits, max));
++       if (kex->dh == NULL) {
++               sshpkt_disconnect(ssh, "Protocol error: no matching group found");
++               fatal("Protocol error: no matching group found");
 +       }
 +
-+       BN_clear_free(dh_client_pub);
++       DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 ||
++           (r = sshpkt_put_bignum2(ssh, dh_p)) != 0 ||
++           (r = sshpkt_put_bignum2(ssh, dh_g)) != 0 ||
++           (r = sshpkt_send(ssh)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
++
++       if ((r = ssh_packet_write_wait(ssh)) != 0)
++               fatal("ssh_packet_write_wait: %s", ssh_err(r));
++
++       /* Compute our exchange value in parallel with the client */
++       if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
++               goto out;
++
++       do {
++               debug("Wait SSH2_MSG_GSSAPI_INIT");
++               type = ssh_packet_read(ssh);
++               switch(type) {
++               case SSH2_MSG_KEXGSS_INIT:
++                       if (dh_client_pub != NULL)
++                               fatal("Received KEXGSS_INIT after initialising");
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++
++                       /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
++                       break;
++               case SSH2_MSG_KEXGSS_CONTINUE:
++                       if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
++                               &recv_tok)) != 0 ||
++                           (r = sshpkt_get_end(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++                       break;
++               default:
++                       sshpkt_disconnect(ssh,
++                           "Protocol error: didn't expect packet type %d",
++                           type);
++               }
++
++               maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
++                   &send_tok, &ret_flags));
++
++               gss_release_buffer(&min_status, &recv_tok);
++
++               if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
++                       fatal("Zero length token output when incomplete");
++
++               if (dh_client_pub == NULL)
++                       fatal("No client public key");
++
++               if (maj_status & GSS_S_CONTINUE_NEEDED) {
++                       debug("Sending GSSAPI_CONTINUE");
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++                       gss_release_buffer(&min_status, &send_tok);
++               }
++       } while (maj_status & GSS_S_CONTINUE_NEEDED);
++
++       if (GSS_ERROR(maj_status)) {
++               if (send_tok.length > 0) {
++                       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
++                           (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
++                           (r = sshpkt_send(ssh)) != 0)
++                               fatal("sshpkt failed: %s", ssh_err(r));
++               }
++               fatal("accept_ctx died");
++       }
 +
-+       if (ssh->kex->session_id == NULL) {
-+               ssh->kex->session_id_len = hashlen;
-+               ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);
-+               memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);
++       if (!(ret_flags & GSS_C_MUTUAL_FLAG))
++               fatal("Mutual Authentication flag wasn't set");
++
++       if (!(ret_flags & GSS_C_INTEG_FLAG))
++               fatal("Integrity flag wasn't set");
++
++       /* calculate shared secret */
++       if ((shared_secret = sshbuf_new()) == NULL) {
++               r = SSH_ERR_ALLOC_FAIL;
++               goto out;
 +       }
++       if ((r = kex_dh_compute_key(kex, dh_client_pub, shared_secret)) != 0)
++               goto out;
++
++       DH_get0_key(kex->dh, &pub_key, NULL);
++       DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
++       hashlen = sizeof(hash);
++       if ((r = kexgex_hash(
++           kex->hash_alg,
++           kex->client_version,
++           kex->server_version,
++           kex->peer,
++           kex->my,
++           empty,
++           cmin, nbits, cmax,
++           dh_p, dh_g,
++           dh_client_pub,
++           pub_key,
++           sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
++           hash, &hashlen)) != 0)
++               fatal("kexgex_hash failed: %s", ssh_err(r));
 +
 +       gssbuf.value = hash;
 +       gssbuf.length = hashlen;
 +
-+       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok))))
++       if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))))
 +               fatal("Couldn't get MIC");
 +
-+       packet_start(SSH2_MSG_KEXGSS_COMPLETE);
-+       packet_put_bignum2(pub_key);
-+       packet_put_string(msg_tok.value,msg_tok.length);
++       if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 ||
++           (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||
++           (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
 +
 +       if (send_tok.length != 0) {
-+               packet_put_char(1); /* true */
-+               packet_put_string(send_tok.value, send_tok.length);
++               if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */
++                   (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0)
++                       fatal("sshpkt failed: %s", ssh_err(r));
 +       } else {
-+               packet_put_char(0); /* false */
++               if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */
++                       fatal("sshpkt failed: %s", ssh_err(r));
 +       }
-+       packet_send();
++       if ((r = sshpkt_send(ssh)) != 0)
++               fatal("sshpkt failed: %s", ssh_err(r));
 +
 +       gss_release_buffer(&min_status, &send_tok);
 +       gss_release_buffer(&min_status, &msg_tok);
 +
 +       if (gss_kex_context == NULL)
 +               gss_kex_context = ctxt;
-+       else 
++       else
 +               ssh_gssapi_delete_ctx(&ctxt);
 +
-+       DH_free(dh);
-+
-+       kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);
-+       BN_clear_free(shared_secret);
-+       kex_send_newkeys(ssh);
++       /* Finally derive the keys and send them */
++       if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
++               r = kex_send_newkeys(ssh);
 +
 +       /* If this was a rekey, then save out any delegated credentials we
 +        * just exchanged.  */
 +       if (options.gss_store_rekey)
 +               ssh_gssapi_rekey_creds();
-+       return 0;
++out:
++       sshbuf_free(empty);
++       explicit_bzero(hash, sizeof(hash));
++       DH_free(kex->dh);
++       kex->dh = NULL;
++       BN_clear_free(dh_client_pub);
++       sshbuf_free(shared_secret);
++       return r;
 +}
-+#endif /* GSSAPI */
++#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
+diff --git a/mac.c b/mac.c
+index 51dc11d76..3d11eba62 100644
+--- a/mac.c
++++ b/mac.c
+@@ -29,6 +29,7 @@
+ 
+ #include <string.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ 
+ #include "digest.h"
+ #include "hmac.h"
 diff --git a/monitor.c b/monitor.c
-index 531b2993a..eabc1e89b 100644
+index 60e529444..0766d6ef5 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -145,6 +145,8 @@ int mm_answer_gss_setup_ctx(int, struct sshbuf *);
- int mm_answer_gss_accept_ctx(int, struct sshbuf *);
- int mm_answer_gss_userok(int, struct sshbuf *);
- int mm_answer_gss_checkmic(int, struct sshbuf *);
-+int mm_answer_gss_sign(int, struct sshbuf *);
-+int mm_answer_gss_updatecreds(int, struct sshbuf *);
+@@ -147,6 +147,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
++int mm_answer_gss_sign(struct ssh *, int, struct sshbuf *);
++int mm_answer_gss_updatecreds(struct ssh *, int, struct sshbuf *);
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -215,11 +217,18 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -219,11 +221,18 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
@@ -2230,7 +2720,7 @@ index 531b2993a..eabc1e89b 100644
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -289,6 +298,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
+@@ -292,6 +301,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
         /* Permit requests for moduli and signatures */
         monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
         monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2241,32 +2731,36 @@ index 531b2993a..eabc1e89b 100644
  
         /* The first few requests do not require asynchronous access */
         while (!authenticated) {
-@@ -401,6 +414,10 @@ monitor_child_postauth(struct monitor *pmonitor)
+@@ -405,6 +418,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
         monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
         monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
         monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
 +#ifdef GSSAPI
 +       /* and for the GSSAPI key exchange */
 +       monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
-+#endif         
++#endif
  
         if (auth_opts->permit_pty_flag) {
                 monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1666,6 +1683,13 @@ monitor_apply_keystate(struct monitor *pmonitor)
+@@ -1687,6 +1704,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+ # ifdef OPENSSL_HAS_ECC
+                kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
- #endif /* WITH_OPENSSL */
-                kex->kex[KEX_C25519_SHA256] = kexc25519_server;
-+#ifdef GSSAPI
++# ifdef GSSAPI
 +               if (options.gss_keyex) {
 +                       kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
 +                       kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+                       kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++                       kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
++                       kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
++                       kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server;
++                       kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server;
++                       kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
 +               }
-+#endif
-                kex->load_host_public_key=&get_hostkey_public_by_type;
-                kex->load_host_private_key=&get_hostkey_private_by_type;
-                kex->host_key_index=&get_hostkey_index;
-@@ -1756,8 +1780,8 @@ mm_answer_gss_setup_ctx(int sock, struct sshbuf *m)
++# endif
+ #endif /* WITH_OPENSSL */
+                kex->kex[KEX_C25519_SHA256] = kex_gen_server;
+                kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
+@@ -1780,8 +1808,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
         u_char *p;
         int r;
  
@@ -2277,7 +2771,7 @@ index 531b2993a..eabc1e89b 100644
  
         if ((r = sshbuf_get_string(m, &p, &len)) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1789,8 +1813,8 @@ mm_answer_gss_accept_ctx(int sock, struct sshbuf *m)
+@@ -1813,8 +1841,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
         OM_uint32 flags = 0; /* GSI needs this */
         int r;
  
@@ -2288,7 +2782,7 @@ index 531b2993a..eabc1e89b 100644
  
         if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1810,6 +1834,7 @@ mm_answer_gss_accept_ctx(int sock, struct sshbuf *m)
+@@ -1834,6 +1862,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2296,7 +2790,7 @@ index 531b2993a..eabc1e89b 100644
         }
         return (0);
  }
-@@ -1821,8 +1846,8 @@ mm_answer_gss_checkmic(int sock, struct sshbuf *m)
+@@ -1845,8 +1874,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
         OM_uint32 ret;
         int r;
  
@@ -2307,8 +2801,12 @@ index 531b2993a..eabc1e89b 100644
  
         if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
             (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -1851,10 +1876,11 @@ mm_answer_gss_userok(int sock, struct sshbuf *m)
-        int r, authenticated;
+@@ -1872,13 +1901,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+ int
+ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+ {
+-       int r, authenticated;
++       int r, authenticated, kex;
         const char *displayname;
  
 -       if (!options.gss_authentication)
@@ -2317,24 +2815,40 @@ index 531b2993a..eabc1e89b 100644
 +               fatal("%s: GSSAPI not enabled", __func__);
  
 -       authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user);
-+       authenticated = authctxt->valid && 
-+           ssh_gssapi_userok(authctxt->user, authctxt->pw);
++       if ((r = sshbuf_get_u32(m, &kex)) != 0)
++               fatal("%s: buffer error: %s", __func__, ssh_err(r));
++
++       authenticated = authctxt->valid &&
++           ssh_gssapi_userok(authctxt->user, authctxt->pw, kex);
  
         sshbuf_reset(m);
         if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -1871,5 +1897,83 @@ mm_answer_gss_userok(int sock, struct sshbuf *m)
+@@ -1887,7 +1920,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+        debug3("%s: sending result %d", __func__, authenticated);
+        mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
+ 
+-       auth_method = "gssapi-with-mic";
++       if (kex) {
++               auth_method = "gssapi-keyex";
++       } else {
++               auth_method = "gssapi-with-mic";
++       }
+ 
+        if ((displayname = ssh_gssapi_displayname()) != NULL)
+                auth2_record_info(authctxt, "%s", displayname);
+@@ -1895,5 +1932,85 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
         /* Monitor loop will terminate if authenticated */
         return (authenticated);
  }
 +
-+int 
-+mm_answer_gss_sign(int socket, struct sshbuf *m)
++int
++mm_answer_gss_sign(struct ssh *ssh, int socket, struct sshbuf *m)
 +{
 +       gss_buffer_desc data;
 +       gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
 +       OM_uint32 major, minor;
 +       size_t len;
-+       u_char *p;
++       u_char *p = NULL;
 +       int r;
 +
 +       if (!options.gss_authentication && !options.gss_keyex)
@@ -2344,8 +2858,9 @@ index 531b2993a..eabc1e89b 100644
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +       data.value = p;
 +       data.length = len;
-+       if (data.length != 20) 
-+               fatal("%s: data length incorrect: %d", __func__, 
++       /* Lengths of SHA-1, SHA-256 and SHA-512 hashes that are used */
++       if (data.length != 20 && data.length != 32 && data.length != 64)
++               fatal("%s: data length incorrect: %d", __func__,
 +                   (int) data.length);
 +
 +       /* Save the session ID on the first time around */
@@ -2359,6 +2874,7 @@ index 531b2993a..eabc1e89b 100644
 +       free(data.value);
 +
 +       sshbuf_reset(m);
++
 +       if ((r = sshbuf_put_u32(m, major)) != 0 ||
 +           (r = sshbuf_put_string(m, hash.value, hash.length)) != 0)
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
@@ -2369,7 +2885,7 @@ index 531b2993a..eabc1e89b 100644
 +
 +       /* Turn on getpwnam permissions */
 +       monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
-+       
++
 +       /* And credential updating, for when rekeying */
 +       monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1);
 +
@@ -2377,16 +2893,16 @@ index 531b2993a..eabc1e89b 100644
 +}
 +
 +int
-+mm_answer_gss_updatecreds(int socket, struct sshbuf *m) {
++mm_answer_gss_updatecreds(struct ssh *ssh, int socket, struct sshbuf *m) {
 +       ssh_gssapi_ccache store;
 +       int r, ok;
 +
 +       if (!options.gss_authentication && !options.gss_keyex)
 +               fatal("%s: GSSAPI not enabled", __func__);
 +
-+       if ((r = sshbuf_get_cstring(m, &store.filename, NULL)) != 0 ||
-+           (r = sshbuf_get_cstring(m, &store.envvar, NULL)) != 0 ||
-+           (r = sshbuf_get_cstring(m, &store.envval, NULL)) != 0)
++       if ((r = sshbuf_get_string(m, (u_char **)&store.filename, NULL)) != 0 ||
++           (r = sshbuf_get_string(m, (u_char **)&store.envvar, NULL)) != 0 ||
++           (r = sshbuf_get_string(m, (u_char **)&store.envval, NULL)) != 0)
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +       ok = ssh_gssapi_update_creds(&store);
@@ -2407,33 +2923,40 @@ index 531b2993a..eabc1e89b 100644
  #endif /* GSSAPI */
  
 diff --git a/monitor.h b/monitor.h
-index 16047299f..44fbed589 100644
+index 683e5e071..2b1a2d590 100644
 --- a/monitor.h
 +++ b/monitor.h
-@@ -63,6 +63,9 @@ enum monitor_reqtype {
+@@ -63,6 +63,8 @@ enum monitor_reqtype {
         MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
         MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
  
 +       MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
 +       MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
-+
  };
  
- struct monitor {
+ struct ssh;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 732fb3476..1865a122a 100644
+index 186e8f022..8e4c1c1f8 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -984,7 +984,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+@@ -978,13 +978,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
  }
  
  int
 -mm_ssh_gssapi_userok(char *user)
-+mm_ssh_gssapi_userok(char *user, struct passwd *pw)
++mm_ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  {
         struct sshbuf *m;
         int r, authenticated = 0;
-@@ -1003,4 +1003,55 @@ mm_ssh_gssapi_userok(char *user)
+ 
+        if ((m = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
++       if ((r = sshbuf_put_u32(m, kex)) != 0)
++               fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 
+        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
+        mm_request_receive_expect(pmonitor->m_recvfd,
+@@ -997,4 +999,57 @@ mm_ssh_gssapi_userok(char *user)
         debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
         return (authenticated);
  }
@@ -2459,7 +2982,7 @@ index 732fb3476..1865a122a 100644
 +
 +       sshbuf_free(m);
 +
-+       return(major);
++       return (major);
 +}
 +
 +int
@@ -2470,6 +2993,7 @@ index 732fb3476..1865a122a 100644
 +
 +       if ((m = sshbuf_new()) == NULL)
 +               fatal("%s: sshbuf_new failed", __func__);
++
 +       if ((r = sshbuf_put_cstring(m,
 +           store->filename ? store->filename : "")) != 0 ||
 +           (r = sshbuf_put_cstring(m,
@@ -2483,6 +3007,7 @@ index 732fb3476..1865a122a 100644
 +
 +       if ((r = sshbuf_get_u32(m, &ok)) != 0)
 +               fatal("%s: buffer error: %s", __func__, ssh_err(r));
++
 +       sshbuf_free(m);
 +
 +       return (ok);
@@ -2490,61 +3015,43 @@ index 732fb3476..1865a122a 100644
 +
  #endif /* GSSAPI */
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 644da081d..7f93144ff 100644
+index fdebb3aa4..69164a8c0 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
-@@ -60,8 +60,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
+@@ -61,8 +61,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
     gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
 -int mm_ssh_gssapi_userok(char *user);
-+int mm_ssh_gssapi_userok(char *user, struct passwd *);
++int mm_ssh_gssapi_userok(char *user, struct passwd *, int kex);
  OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
 +OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
 +int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *);
  #endif
  
  #ifdef USE_PAM
-diff --git a/opacket.c b/opacket.c
-index e637d7a71..7672c0b59 100644
---- a/opacket.c
-+++ b/opacket.c
-@@ -80,7 +80,7 @@ ssh_packet_put_raw(struct ssh *ssh, const void *buf, u_int len)
- 
- #ifdef WITH_OPENSSL
- void
--ssh_packet_put_bignum2(struct ssh *ssh, BIGNUM * value)
-+ssh_packet_put_bignum2(struct ssh *ssh, const BIGNUM * value)
- {
-        int r;
- 
-diff --git a/opacket.h b/opacket.h
-index f92fe586e..1cf66a2d3 100644
---- a/opacket.h
-+++ b/opacket.h
-@@ -7,7 +7,7 @@ void     ssh_packet_start(struct ssh *, u_char);
- void     ssh_packet_put_char(struct ssh *, int ch);
- void     ssh_packet_put_int(struct ssh *, u_int value);
- void     ssh_packet_put_int64(struct ssh *, u_int64_t value);
--void     ssh_packet_put_bignum2(struct ssh *, BIGNUM * value);
-+void     ssh_packet_put_bignum2(struct ssh *, const BIGNUM * value);
- void     ssh_packet_put_ecpoint(struct ssh *, const EC_GROUP *, const EC_POINT *);
- void     ssh_packet_put_string(struct ssh *, const void *buf, u_int len);
- void     ssh_packet_put_cstring(struct ssh *, const char *str);
 diff --git a/readconf.c b/readconf.c
-index 433811521..36bc5e59a 100644
+index ec497e79f..4d699e5f1 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -161,6 +161,8 @@ typedef enum {
+@@ -67,6 +67,7 @@
+ #include "uidswap.h"
+ #include "myproposal.h"
+ #include "digest.h"
++#include "ssh-gss.h"
+ 
+ /* Format of the configuration file:
+ 
+@@ -162,6 +163,8 @@ typedef enum {
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 +       oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
-+       oGssServerIdentity, 
++       oGssServerIdentity, oGssKexAlgorithms,
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
         oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
         oHashKnownHosts,
-@@ -201,10 +203,20 @@ static struct {
+@@ -202,10 +205,22 @@ static struct {
         /* Sometimes-unsupported options */
  #if defined(GSSAPI)
         { "gssapiauthentication", oGssAuthentication },
@@ -2554,6 +3061,7 @@ index 433811521..36bc5e59a 100644
 +       { "gssapiclientidentity", oGssClientIdentity },
 +       { "gssapiserveridentity", oGssServerIdentity },
 +       { "gssapirenewalforcesrekey", oGssRenewalRekey },
++       { "gssapikexalgorithms", oGssKexAlgorithms },
  # else
         { "gssapiauthentication", oUnsupported },
 +       { "gssapikeyexchange", oUnsupported },
@@ -2562,10 +3070,11 @@ index 433811521..36bc5e59a 100644
 +       { "gssapiclientidentity", oUnsupported },
 +       { "gssapiserveridentity", oUnsupported },
 +       { "gssapirenewalforcesrekey", oUnsupported },
++       { "gssapikexalgorithms", oUnsupported },
  #endif
  #ifdef ENABLE_PKCS11
-        { "smartcarddevice", oPKCS11Provider },
-@@ -974,10 +986,30 @@ parse_time:
+        { "pkcs11provider", oPKCS11Provider },
+@@ -983,10 +998,42 @@ parse_time:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2593,10 +3102,22 @@ index 433811521..36bc5e59a 100644
 +               intptr = &options->gss_renewal_rekey;
 +               goto parse_flag;
 +
++       case oGssKexAlgorithms:
++               arg = strdelim(&s);
++               if (!arg || *arg == '\0')
++                       fatal("%.200s line %d: Missing argument.",
++                           filename, linenum);
++               if (!kex_gss_names_valid(arg))
++                       fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.",
++                           filename, linenum, arg ? arg : "<NONE>");
++               if (*activep && options->gss_kex_algorithms == NULL)
++                       options->gss_kex_algorithms = xstrdup(arg);
++               break;
++
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
-@@ -1842,7 +1874,12 @@ initialize_options(Options * options)
+@@ -1854,7 +1901,13 @@ initialize_options(Options * options)
         options->pubkey_authentication = -1;
         options->challenge_response_authentication = -1;
         options->gss_authentication = -1;
@@ -2606,10 +3127,11 @@ index 433811521..36bc5e59a 100644
 +       options->gss_renewal_rekey = -1;
 +       options->gss_client_identity = NULL;
 +       options->gss_server_identity = NULL;
++       options->gss_kex_algorithms = NULL;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
-@@ -1988,8 +2025,14 @@ fill_default_options(Options * options)
+@@ -2000,8 +2053,18 @@ fill_default_options(Options * options)
                 options->challenge_response_authentication = 1;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2621,14 +3143,33 @@ index 433811521..36bc5e59a 100644
 +               options->gss_trust_dns = 0;
 +       if (options->gss_renewal_rekey == -1)
 +               options->gss_renewal_rekey = 0;
++#ifdef GSSAPI
++       if (options->gss_kex_algorithms == NULL)
++               options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
++#endif
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
+@@ -2616,7 +2679,14 @@ dump_client_config(Options *o, const char *host)
+        dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
+ #ifdef GSSAPI
+        dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
++       dump_cfg_fmtint(oGssKeyEx, o->gss_keyex);
+        dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
++       dump_cfg_fmtint(oGssTrustDns, o->gss_trust_dns);
++       dump_cfg_fmtint(oGssRenewalRekey, o->gss_renewal_rekey);
++       dump_cfg_string(oGssClientIdentity, o->gss_client_identity);
++       dump_cfg_string(oGssServerIdentity, o->gss_server_identity);
++       dump_cfg_string(oGssKexAlgorithms, o->gss_kex_algorithms ?
++           o->gss_kex_algorithms : GSS_KEX_DEFAULT_KEX);
+ #endif /* GSSAPI */
+        dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
+        dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
 diff --git a/readconf.h b/readconf.h
-index fc7e38251..8e4900d01 100644
+index 8e36bf32a..0bff6d80a 100644
 --- a/readconf.h
 +++ b/readconf.h
-@@ -40,7 +40,12 @@ typedef struct {
+@@ -40,7 +40,13 @@ typedef struct {
         int     challenge_response_authentication;
                                         /* Try S/Key or TIS, authentication. */
         int     gss_authentication;     /* Try GSS authentication */
@@ -2638,14 +3179,23 @@ index fc7e38251..8e4900d01 100644
 +       int     gss_renewal_rekey;      /* Credential renewal forces rekey */
 +       char    *gss_client_identity;   /* Principal to initiate GSSAPI with */
 +       char    *gss_server_identity;   /* GSSAPI target principal */
++       char    *gss_kex_algorithms;    /* GSSAPI kex methods to be offered by client. */
         int     password_authentication;        /* Try password
                                                  * authentication. */
         int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff --git a/servconf.c b/servconf.c
-index 932d363bb..4668b8a45 100644
+index ffac5d2c7..ffdad31e7 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -124,8 +124,10 @@ initialize_server_options(ServerOptions *options)
+@@ -64,6 +64,7 @@
+ #include "auth.h"
+ #include "myproposal.h"
+ #include "digest.h"
++#include "ssh-gss.h"
+ 
+ static void add_listen_addr(ServerOptions *, const char *,
+     const char *, int);
+@@ -124,8 +125,11 @@ initialize_server_options(ServerOptions *options)
         options->kerberos_ticket_cleanup = -1;
         options->kerberos_get_afs_token = -1;
         options->gss_authentication=-1;
@@ -2653,10 +3203,11 @@ index 932d363bb..4668b8a45 100644
         options->gss_cleanup_creds = -1;
         options->gss_strict_acceptor = -1;
 +       options->gss_store_rekey = -1;
++       options->gss_kex_algorithms = NULL;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
-@@ -337,10 +339,14 @@ fill_default_server_options(ServerOptions *options)
+@@ -351,10 +355,18 @@ fill_default_server_options(ServerOptions *options)
                 options->kerberos_get_afs_token = 0;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2668,18 +3219,22 @@ index 932d363bb..4668b8a45 100644
                 options->gss_strict_acceptor = 1;
 +       if (options->gss_store_rekey == -1)
 +               options->gss_store_rekey = 0;
++#ifdef GSSAPI
++       if (options->gss_kex_algorithms == NULL)
++               options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
++#endif
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
-@@ -485,6 +491,7 @@ typedef enum {
+@@ -498,6 +510,7 @@ typedef enum {
         sHostKeyAlgorithms,
         sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
         sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
-+       sGssKeyEx, sGssStoreRekey,
++       sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
         sAcceptEnv, sSetEnv, sPermitTunnel,
         sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
         sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -559,12 +566,20 @@ static struct {
+@@ -572,12 +585,22 @@ static struct {
  #ifdef GSSAPI
         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -2687,6 +3242,7 @@ index 932d363bb..4668b8a45 100644
         { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 +       { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
 +       { "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
++       { "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
  #else
         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
         { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
@@ -2694,13 +3250,14 @@ index 932d363bb..4668b8a45 100644
         { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 +       { "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
 +       { "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
++       { "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
  #endif
 +       { "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
 +       { "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1468,6 +1483,10 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -1485,6 +1508,10 @@ process_server_config_line(ServerOptions *options, char *line,
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2711,7 +3268,7 @@ index 932d363bb..4668b8a45 100644
         case sGssCleanupCreds:
                 intptr = &options->gss_cleanup_creds;
                 goto parse_flag;
-@@ -1476,6 +1495,10 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -1493,6 +1520,22 @@ process_server_config_line(ServerOptions *options, char *line,
                 intptr = &options->gss_strict_acceptor;
                 goto parse_flag;
  
@@ -2719,25 +3276,37 @@ index 932d363bb..4668b8a45 100644
 +               intptr = &options->gss_store_rekey;
 +               goto parse_flag;
 +
++       case sGssKexAlgorithms:
++               arg = strdelim(&cp);
++               if (!arg || *arg == '\0')
++                       fatal("%.200s line %d: Missing argument.",
++                           filename, linenum);
++               if (!kex_gss_names_valid(arg))
++                       fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.",
++                           filename, linenum, arg ? arg : "<NONE>");
++               if (*activep && options->gss_kex_algorithms == NULL)
++                       options->gss_kex_algorithms = xstrdup(arg);
++               break;
++
         case sPasswordAuthentication:
                 intptr = &options->password_authentication;
                 goto parse_flag;
-@@ -2560,7 +2583,10 @@ dump_config(ServerOptions *o)
- #endif
+@@ -2579,6 +2622,10 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-+       dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
         dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
++       dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
 +       dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
 +       dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
++       dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
  #endif
         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
         dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff --git a/servconf.h b/servconf.h
-index 0175e00e8..3b76da816 100644
+index 54e0a8d8d..a476d5220 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -125,8 +125,10 @@ typedef struct {
+@@ -126,8 +126,11 @@ typedef struct {
         int     kerberos_get_afs_token;         /* If true, try to get AFS token if
                                                  * authenticated with Kerberos. */
         int     gss_authentication;     /* If true, permit GSSAPI authentication */
@@ -2745,11 +3314,38 @@ index 0175e00e8..3b76da816 100644
         int     gss_cleanup_creds;      /* If true, destroy cred cache on logout */
         int     gss_strict_acceptor;    /* If true, restrict the GSSAPI acceptor name */
 +       int     gss_store_rekey;
++       char   *gss_kex_algorithms;     /* GSSAPI kex methods to be offered by client. */
         int     password_authentication;        /* If true, permit password
                                                  * authentication. */
         int     kbd_interactive_authentication; /* If true, permit */
+diff --git a/session.c b/session.c
+index ac06b08e9..ac3d9d19d 100644
+--- a/session.c
++++ b/session.c
+@@ -2674,13 +2674,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
+ 
+ #ifdef KRB5
+        if (options.kerberos_ticket_cleanup &&
+-           authctxt->krb5_ctx)
++           authctxt->krb5_ctx) {
++               temporarily_use_uid(authctxt->pw);
+                krb5_cleanup_proc(authctxt);
++               restore_uid();
++       }
+ #endif
+ 
+ #ifdef GSSAPI
+-       if (options.gss_cleanup_creds)
++       if (options.gss_cleanup_creds) {
++               temporarily_use_uid(authctxt->pw);
+                ssh_gssapi_cleanup_creds();
++               restore_uid();
++       }
+ #endif
+ 
+        /* remove agent socket */
 diff --git a/ssh-gss.h b/ssh-gss.h
-index 36180d07a..350ce7882 100644
+index 36180d07a..70dd36658 100644
 --- a/ssh-gss.h
 +++ b/ssh-gss.h
 @@ -1,6 +1,6 @@
@@ -2760,7 +3356,7 @@ index 36180d07a..350ce7882 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -61,10 +61,22 @@
+@@ -61,10 +61,30 @@
  
  #define SSH_GSS_OIDTYPE 0x06
  
@@ -2773,7 +3369,15 @@ index 36180d07a..350ce7882 100644
 +#define SSH2_MSG_KEXGSS_GROUP                          41
 +#define KEX_GSS_GRP1_SHA1_ID                           "gss-group1-sha1-"
 +#define KEX_GSS_GRP14_SHA1_ID                          "gss-group14-sha1-"
++#define KEX_GSS_GRP14_SHA256_ID                        "gss-group14-sha256-"
++#define KEX_GSS_GRP16_SHA512_ID                        "gss-group16-sha512-"
 +#define KEX_GSS_GEX_SHA1_ID                            "gss-gex-sha1-"
++#define KEX_GSS_NISTP256_SHA256_ID                     "gss-nistp256-sha256-"
++#define KEX_GSS_C25519_SHA256_ID                       "gss-curve25519-sha256-"
++
++#define        GSS_KEX_DEFAULT_KEX \
++       KEX_GSS_GEX_SHA1_ID "," \
++       KEX_GSS_GRP14_SHA1_ID
 +
  typedef struct {
         char *filename;
@@ -2783,7 +3387,7 @@ index 36180d07a..350ce7882 100644
         void *data;
  } ssh_gssapi_ccache;
  
-@@ -72,8 +84,11 @@ typedef struct {
+@@ -72,8 +92,11 @@ typedef struct {
         gss_buffer_desc displayname;
         gss_buffer_desc exportedname;
         gss_cred_id_t creds;
@@ -2795,7 +3399,7 @@ index 36180d07a..350ce7882 100644
  } ssh_gssapi_client;
  
  typedef struct ssh_gssapi_mech_struct {
-@@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct {
+@@ -84,6 +107,7 @@ typedef struct ssh_gssapi_mech_struct {
         int (*userok) (ssh_gssapi_client *, char *);
         int (*localname) (ssh_gssapi_client *, char **);
         void (*storecreds) (ssh_gssapi_client *);
@@ -2803,7 +3407,7 @@ index 36180d07a..350ce7882 100644
  } ssh_gssapi_mech;
  
  typedef struct {
-@@ -94,10 +110,11 @@ typedef struct {
+@@ -94,10 +118,11 @@ typedef struct {
         gss_OID         oid; /* client */
         gss_cred_id_t   creds; /* server */
         gss_name_t      client; /* server */
@@ -2816,7 +3420,15 @@ index 36180d07a..350ce7882 100644
  
  int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
  void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -123,17 +140,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
+@@ -109,6 +134,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
+ 
+ struct sshbuf;
+ int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
++int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *);
+ 
+ OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
+ OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
+@@ -123,17 +149,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
  OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_buildmic(struct sshbuf *, const char *,
      const char *, const char *);
@@ -2826,17 +3438,17 @@ index 36180d07a..350ce7882 100644
 +int ssh_gssapi_credentials_updated(Gssctxt *);
  
  /* In the server */
-+typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, 
++typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *,
 +    const char *);
-+char *ssh_gssapi_client_mechanisms(const char *, const char *);
++char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *);
 +char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
-+    const char *);
++    const char *, const char *);
 +gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
-+int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, 
++int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *,
 +    const char *);
  OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
 -int ssh_gssapi_userok(char *name);
-+int ssh_gssapi_userok(char *name, struct passwd *);
++int ssh_gssapi_userok(char *name, struct passwd *, int kex);
  OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_do_child(char ***, u_int *);
  void ssh_gssapi_cleanup_creds(void);
@@ -2852,8 +3464,57 @@ index 36180d07a..350ce7882 100644
  #endif /* GSSAPI */
  
  #endif /* _SSH_GSS_H */
+diff --git a/ssh.1 b/ssh.1
+index 9480eba8d..a1c7d2305 100644
+--- a/ssh.1
++++ b/ssh.1
+@@ -497,7 +497,13 @@ For full details of the options listed below, and their possible values, see
+ .It GatewayPorts
+ .It GlobalKnownHostsFile
+ .It GSSAPIAuthentication
++.It GSSAPIKeyExchange
++.It GSSAPIClientIdentity
+ .It GSSAPIDelegateCredentials
++.It GSSAPIKexAlgorithms
++.It GSSAPIRenewalForcesRekey
++.It GSSAPIServerIdentity
++.It GSSAPITrustDns
+ .It HashKnownHosts
+ .It Host
+ .It HostbasedAuthentication
+@@ -573,6 +579,8 @@ flag),
+ (supported message integrity codes),
+ .Ar kex
+ (key exchange algorithms),
++.Ar kex-gss
++(GSSAPI key exchange algorithms),
+ .Ar key
+ (key types),
+ .Ar key-cert
+diff --git a/ssh.c b/ssh.c
+index 91e7c3511..42be7d88f 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -736,6 +736,8 @@ main(int ac, char **av)
+                                cp = mac_alg_list('\n');
+                        else if (strcmp(optarg, "kex") == 0)
+                                cp = kex_alg_list('\n');
++                       else if (strcmp(optarg, "kex-gss") == 0)
++                               cp = kex_gss_alg_list('\n');
+                        else if (strcmp(optarg, "key") == 0)
+                                cp = sshkey_alg_list(0, 0, 0, '\n');
+                        else if (strcmp(optarg, "key-cert") == 0)
+@@ -748,7 +750,7 @@ main(int ac, char **av)
+                                cp = xstrdup("2");
+                        else if (strcmp(optarg, "help") == 0) {
+                                cp = xstrdup(
+-                                   "cipher\ncipher-auth\nkex\nkey\n"
++                                   "cipher\ncipher-auth\nkex\nkex-gss\nkey\n"
+                                    "key-cert\nkey-plain\nmac\n"
+                                    "protocol-version\nsig");
+                        }
 diff --git a/ssh_config b/ssh_config
-index c12f5ef52..bcb9f153d 100644
+index 5e8ef548b..1ff999b68 100644
 --- a/ssh_config
 +++ b/ssh_config
 @@ -24,6 +24,8 @@
@@ -2866,61 +3527,95 @@ index c12f5ef52..bcb9f153d 100644
  #   CheckHostIP yes
  #   AddressFamily any
 diff --git a/ssh_config.5 b/ssh_config.5
-index 4d5b01d3e..16c79368a 100644
+index 412629637..c3c8b274a 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -736,10 +736,42 @@ The default is
+@@ -754,10 +754,67 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
-+.It Cm GSSAPIKeyExchange
-+Specifies whether key exchange based on GSSAPI may be used. When using
-+GSSAPI key exchange the server need not have a host key.
-+The default is
-+.Cm no .
 +.It Cm GSSAPIClientIdentity
-+If set, specifies the GSSAPI client identity that ssh should use when 
-+connecting to the server. The default is unset, which means that the default 
++If set, specifies the GSSAPI client identity that ssh should use when
++connecting to the server. The default is unset, which means that the default
 +identity will be used.
-+.It Cm GSSAPIServerIdentity
-+If set, specifies the GSSAPI server identity that ssh should expect when 
-+connecting to the server. The default is unset, which means that the
-+expected GSSAPI server identity will be determined from the target
-+hostname.
  .It Cm GSSAPIDelegateCredentials
  Forward (delegate) credentials to the server.
  The default is
  .Cm no .
++.It Cm GSSAPIKeyExchange
++Specifies whether key exchange based on GSSAPI may be used. When using
++GSSAPI key exchange the server need not have a host key.
++The default is
++.Dq no .
 +.It Cm GSSAPIRenewalForcesRekey
-+If set to 
-+.Cm yes
++If set to
++.Dq yes
 +then renewal of the client's GSSAPI credentials will force the rekeying of the
-+ssh connection. With a compatible server, this can delegate the renewed 
++ssh connection. With a compatible server, this will delegate the renewed
 +credentials to a session on the server.
++.Pp
++Checks are made to ensure that credentials are only propagated when the new
++credentials match the old ones on the originating client and where the
++receiving server still has the old set in its cache.
++.Pp
 +The default is
-+.Cm no .
++.Dq no .
++.Pp
++For this to work
++.Cm GSSAPIKeyExchange
++needs to be enabled in the server and also used by the client.
++.It Cm GSSAPIServerIdentity
++If set, specifies the GSSAPI server identity that ssh should expect when
++connecting to the server. The default is unset, which means that the
++expected GSSAPI server identity will be determined from the target
++hostname.
 +.It Cm GSSAPITrustDns
-+Set to 
-+.Cm yes
++Set to
++.Dq yes
 +to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If 
-+.Cm no ,
++the name of the host being connected to. If
++.Dq no ,
 +the hostname entered on the
 +command line will be passed untouched to the GSSAPI library.
 +The default is
-+.Cm no .
++.Dq no .
++.It Cm GSSAPIKexAlgorithms
++The list of key exchange algorithms that are offered for GSSAPI
++key exchange. Possible values are
++.Bd -literal -offset 3n
++gss-gex-sha1-,
++gss-group1-sha1-,
++gss-group14-sha1-,
++gss-group14-sha256-,
++gss-group16-sha512-,
++gss-nistp256-sha256-,
++gss-curve25519-sha256-
++.Ed
++.Pp
++The default is
++.Dq gss-gex-sha1-,gss-group14-sha1- .
++This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index 1675f3935..8c872a4fb 100644
+index dffee90b1..4020371ae 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -162,6 +162,11 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
-        struct kex *kex;
+@@ -78,8 +78,6 @@
+ #endif
+ 
+ /* import */
+-extern char *client_version_string;
+-extern char *server_version_string;
+ extern Options options;
+ 
+ /*
+@@ -161,6 +159,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+        char *s, *all_key;
         int r;
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       char *orig = NULL, *gss = NULL;
 +       char *gss_host = NULL;
 +#endif
@@ -2928,11 +3623,11 @@ index 1675f3935..8c872a4fb 100644
         xxx_host = host;
         xxx_hostaddr = hostaddr;
  
-@@ -194,6 +199,35 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -193,6 +196,35 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
                     order_hostkeyalgs(host, hostaddr, port));
         }
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       if (options.gss_keyex) {
 +               /* Add the GSSAPI mechanisms currently supported on this
 +                * client to the key exchange algorithm proposal */
@@ -2941,19 +3636,19 @@ index 1675f3935..8c872a4fb 100644
 +               if (options.gss_server_identity)
 +                       gss_host = xstrdup(options.gss_server_identity);
 +               else if (options.gss_trust_dns)
-+                       gss_host = remote_hostname(active_state);
++                       gss_host = remote_hostname(ssh);
 +               else
 +                       gss_host = xstrdup(host);
 +
 +               gss = ssh_gssapi_client_mechanisms(gss_host,
-+                   options.gss_client_identity);
++                   options.gss_client_identity, options.gss_kex_algorithms);
 +               if (gss) {
 +                       debug("Offering GSSAPI proposal: %s", gss);
 +                       xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
 +                           "%s,%s", gss, orig);
 +
-+                       /* If we've got GSSAPI algorithms, then we also
-+                        * support the 'null' hostkey, as a last resort */
++                       /* If we've got GSSAPI algorithms, then we also support the
++                        * 'null' hostkey, as a last resort */
 +                       orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
 +                       xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
 +                           "%s,null", orig);
@@ -2962,38 +3657,43 @@ index 1675f3935..8c872a4fb 100644
 +#endif
 +
         if (options.rekey_limit || options.rekey_interval)
-                packet_set_rekey_limits(options.rekey_limit,
+                ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
                     options.rekey_interval);
-@@ -215,15 +249,41 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -211,16 +243,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+ # ifdef OPENSSL_HAS_ECC
+        ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
  # endif
- #endif
-        kex->kex[KEX_C25519_SHA256] = kexc25519_client;
-+#ifdef GSSAPI
++# ifdef GSSAPI
 +       if (options.gss_keyex) {
-+               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
-+               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
-+               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_client;
++               ssh->kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_client;
++               ssh->kex->kex[KEX_GSS_C25519_SHA256] = kexgss_client;
 +       }
-+#endif
-        kex->client_version_string=client_version_string;
-        kex->server_version_string=server_version_string;
-        kex->verify_host_key=&verify_host_key_callback;
++# endif
+ #endif
+        ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
+        ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_client;
+        ssh->kex->verify_host_key=&verify_host_key_callback;
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       if (options.gss_keyex) {
-+               kex->gss_deleg_creds = options.gss_deleg_creds;
-+               kex->gss_trust_dns = options.gss_trust_dns;
-+               kex->gss_client = options.gss_client_identity;
-+               kex->gss_host = gss_host;
++               ssh->kex->gss_deleg_creds = options.gss_deleg_creds;
++               ssh->kex->gss_trust_dns = options.gss_trust_dns;
++               ssh->kex->gss_client = options.gss_client_identity;
++               ssh->kex->gss_host = gss_host;
 +       }
 +#endif
 +
-        ssh_dispatch_run_fatal(active_state, DISPATCH_BLOCK, &kex->done);
+        ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done);
  
         /* remove ext-info from the KEX proposals for rekeying */
         myproposal[PROPOSAL_KEX_ALGS] =
             compat_kex_proposal(options.kex_algorithms);
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       /* repair myproposal after it was crumpled by the */
 +       /* ext-info removal above */
 +       if (gss) {
@@ -3003,82 +3703,83 @@ index 1675f3935..8c872a4fb 100644
 +               free(gss);
 +       }
 +#endif
-        if ((r = kex_prop2buf(kex->my, myproposal)) != 0)
+        if ((r = kex_prop2buf(ssh->kex->my, myproposal)) != 0)
                 fatal("kex_prop2buf: %s", ssh_err(r));
  
-@@ -314,6 +374,7 @@ int input_gssapi_token(int type, u_int32_t, struct ssh *);
- int    input_gssapi_hash(int type, u_int32_t, struct ssh *);
- int    input_gssapi_error(int, u_int32_t, struct ssh *);
- int    input_gssapi_errtok(int, u_int32_t, struct ssh *);
-+int    userauth_gsskeyex(Authctxt *authctxt);
+@@ -317,6 +379,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
+ static int input_gssapi_token(int type, u_int32_t, struct ssh *);
+ static int input_gssapi_error(int, u_int32_t, struct ssh *);
+ static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
++static int userauth_gsskeyex(struct ssh *);
  #endif
  
- void   userauth(Authctxt *, char *);
-@@ -330,6 +391,11 @@ static char *authmethods_get(void);
+ void   userauth(struct ssh *, char *);
+@@ -333,6 +396,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
 +       {"gssapi-keyex",
 +               userauth_gsskeyex,
 +               NULL,
-+               &options.gss_authentication,
++               &options.gss_keyex,
 +               NULL},
         {"gssapi-with-mic",
                 userauth_gssapi,
-                NULL,
-@@ -686,25 +752,40 @@ userauth_gssapi(Authctxt *authctxt)
-        static u_int mech = 0;
+                userauth_gssapi_cleanup,
+@@ -698,12 +766,25 @@ userauth_gssapi(struct ssh *ssh)
         OM_uint32 min;
         int r, ok = 0;
+        gss_OID mech = NULL;
 +       char *gss_host;
 +
 +       if (options.gss_server_identity)
 +               gss_host = xstrdup(options.gss_server_identity);
 +       else if (options.gss_trust_dns)
-+               gss_host = remote_hostname(active_state);
++               gss_host = remote_hostname(ssh);
 +       else
 +               gss_host = xstrdup(authctxt->host);
  
         /* Try one GSSAPI method at a time, rather than sending them all at
          * once. */
  
-        if (gss_supported == NULL)
--               gss_indicate_mechs(&min, &gss_supported);
-+               if (GSS_ERROR(gss_indicate_mechs(&min, &gss_supported))) {
-+                       gss_supported = NULL;
+        if (authctxt->gss_supported_mechs == NULL)
+-               gss_indicate_mechs(&min, &authctxt->gss_supported_mechs);
++               if (GSS_ERROR(gss_indicate_mechs(&min,
++                   &authctxt->gss_supported_mechs))) {
++                       authctxt->gss_supported_mechs = NULL;
 +                       free(gss_host);
 +                       return 0;
 +               }
  
-        /* Check to see if the mechanism is usable before we offer it */
-        while (mech < gss_supported->count && !ok) {
+        /* Check to see whether the mechanism is usable before we offer it */
+        while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
+@@ -712,13 +793,15 @@ userauth_gssapi(struct ssh *ssh)
+                    elements[authctxt->mech_tried];
                 /* My DER encoding requires length<128 */
-                if (gss_supported->elements[mech].length < 128 &&
-                    ssh_gssapi_check_mechanism(&gssctxt,
--                   &gss_supported->elements[mech], authctxt->host)) {
-+                   &gss_supported->elements[mech], gss_host,
-+                    options.gss_client_identity)) {
+                if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
+-                   mech, authctxt->host)) {
++                   mech, gss_host, options.gss_client_identity)) {
                         ok = 1; /* Mechanism works */
                 } else {
-                        mech++;
+                        authctxt->mech_tried++;
                 }
         }
  
 +       free(gss_host);
 +
-        if (!ok)
+        if (!ok || mech == NULL)
                 return 0;
  
-@@ -935,6 +1016,54 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
+@@ -958,6 +1041,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
         free(lang);
         return r;
  }
 +
 +int
-+userauth_gsskeyex(Authctxt *authctxt)
++userauth_gsskeyex(struct ssh *ssh)
 +{
-+       struct ssh *ssh = active_state; /* XXX */
-+       struct sshbuf *b;
++       struct sshbuf *b = NULL;
++       Authctxt *authctxt = ssh->authctxt;
 +       gss_buffer_desc gssbuf;
 +       gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
 +       OM_uint32 ms;
@@ -3089,12 +3790,13 @@ index 1675f3935..8c872a4fb 100644
 +               return (0);
 +
 +       if (gss_kex_context == NULL) {
-+               debug("No valid Key exchange context"); 
++               debug("No valid Key exchange context");
 +               return (0);
 +       }
 +
 +       if ((b = sshbuf_new()) == NULL)
 +               fatal("%s: sshbuf_new failed", __func__);
++
 +       ssh_gssapi_buildmic(b, authctxt->server_user, authctxt->service,
 +           "gssapi-keyex");
 +
@@ -3123,9 +3825,9 @@ index 1675f3935..8c872a4fb 100644
 +
  #endif /* GSSAPI */
  
- int
+ static int
 diff --git a/sshd.c b/sshd.c
-index ba26287ba..539a000fd 100644
+index cbd3bce91..98680721b 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -123,6 +123,10 @@
@@ -3139,21 +3841,28 @@ index ba26287ba..539a000fd 100644
  /* Re-exec fds */
  #define REEXEC_DEVCRYPTO_RESERVED_FD   (STDERR_FILENO + 1)
  #define REEXEC_STARTUP_PIPE_FD         (STDERR_FILENO + 2)
-@@ -1810,10 +1814,13 @@ main(int ac, char **av)
+@@ -796,8 +800,8 @@ notify_hostkeys(struct ssh *ssh)
+        }
+        debug3("%s: sent %u hostkeys", __func__, nkeys);
+        if (nkeys == 0)
+-               fatal("%s: no hostkeys", __func__);
+-       if ((r = sshpkt_send(ssh)) != 0)
++               debug3("%s: no hostkeys", __func__);
++       else if ((r = sshpkt_send(ssh)) != 0)
+                sshpkt_fatal(ssh, r, "%s: send", __func__);
+        sshbuf_free(buf);
+ }
+@@ -1769,7 +1773,8 @@ main(int ac, char **av)
                 free(fp);
         }
         accumulate_host_timing_secret(cfg, NULL);
-+#ifndef GSSAPI
+-       if (!sensitive_data.have_ssh2_key) {
 +       /* The GSSAPI key exchange can run without a host key */
-        if (!sensitive_data.have_ssh2_key) {
++       if (!sensitive_data.have_ssh2_key && !options.gss_keyex) {
                 logit("sshd: no hostkeys available -- exiting.");
                 exit(1);
         }
-+#endif
- 
-        /*
-         * Load certificates. They are stored in an array at identical
-@@ -2104,6 +2111,60 @@ main(int ac, char **av)
+@@ -2064,6 +2069,60 @@ main(int ac, char **av)
             rdomain == NULL ? "" : "\"");
         free(laddr);
  
@@ -3214,18 +3923,18 @@ index ba26287ba..539a000fd 100644
         /*
          * We don't want to listen forever unless the other side
          * successfully authenticates itself.  So we set up an alarm which is
-@@ -2287,6 +2348,48 @@ do_ssh2_kex(void)
+@@ -2260,6 +2319,48 @@ do_ssh2_kex(struct ssh *ssh)
         myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
             list_hostkey_types());
  
-+#ifdef GSSAPI
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +       {
 +       char *orig;
 +       char *gss = NULL;
 +       char *newstr = NULL;
 +       orig = myproposal[PROPOSAL_KEX_ALGS];
 +
-+       /* 
++       /*
 +        * If we don't have a host key, then there's no point advertising
 +        * the other key exchange algorithms
 +        */
@@ -3245,10 +3954,10 @@ index ba26287ba..539a000fd 100644
 +       else if (orig)
 +               newstr = orig;
 +
-+       /* 
++       /*
 +        * If we've got GSSAPI mechanisms, then we've got the 'null' host
 +        * key alg, but we can't tell people about it unless its the only
-+        * host key algorithm we support
++        * host key algorithm we support
 +        */
 +       if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0)
 +               myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null";
@@ -3261,22 +3970,28 @@ index ba26287ba..539a000fd 100644
 +#endif
 +
         /* start key exchange */
-        if ((r = kex_setup(active_state, myproposal)) != 0)
+        if ((r = kex_setup(ssh, myproposal)) != 0)
                 fatal("kex_setup: %s", ssh_err(r));
-@@ -2304,6 +2407,13 @@ do_ssh2_kex(void)
+@@ -2275,7 +2376,18 @@ do_ssh2_kex(struct ssh *ssh)
+ # ifdef OPENSSL_HAS_ECC
+        kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
- #endif
-        kex->kex[KEX_C25519_SHA256] = kexc25519_server;
-+#ifdef GSSAPI
+-#endif
++# ifdef GSSAPI
 +       if (options.gss_keyex) {
 +               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
 +               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++               kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
++               kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
++               kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server;
++               kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server;
++               kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
 +       }
-+#endif
-        kex->server = 1;
-        kex->client_version_string=client_version_string;
-        kex->server_version_string=server_version_string;
++# endif
++#endif /* WITH_OPENSSL */
+        kex->kex[KEX_C25519_SHA256] = kex_gen_server;
+        kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
+        kex->load_host_public_key=&get_hostkey_public_by_type;
 diff --git a/sshd_config b/sshd_config
 index 19b7c91a1..2c48105f8 100644
 --- a/sshd_config
@@ -3291,35 +4006,55 @@ index 19b7c91a1..2c48105f8 100644
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff --git a/sshd_config.5 b/sshd_config.5
-index c6484370b..985eef5a2 100644
+index b224f2929..2baa6622b 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -648,6 +648,11 @@ The default is
- Specifies whether user authentication based on GSSAPI is allowed.
+@@ -653,6 +653,11 @@ Specifies whether to automatically destroy the user's credentials cache
+ on logout.
  The default is
- .Cm no .
+ .Cm yes .
 +.It Cm GSSAPIKeyExchange
 +Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
 +doesn't rely on ssh keys to verify host identity.
 +The default is
 +.Cm no .
- .It Cm GSSAPICleanupCredentials
- Specifies whether to automatically destroy the user's credentials cache
- on logout.
-@@ -667,6 +672,11 @@ machine's default store.
+ .It Cm GSSAPIStrictAcceptorCheck
+ Determines whether to be strict about the identity of the GSSAPI acceptor
+ a client authenticates against.
+@@ -667,6 +672,31 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
 +.It Cm GSSAPIStoreCredentialsOnRekey
-+Controls whether the user's GSSAPI credentials should be updated following a 
-+successful connection rekeying. This option can be used to accepted renewed 
++Controls whether the user's GSSAPI credentials should be updated following a
++successful connection rekeying. This option can be used to accepted renewed
 +or updated credentials from a compatible client. The default is
-+.Cm no .
++.Dq no .
++.Pp
++For this to work
++.Cm GSSAPIKeyExchange
++needs to be enabled in the server and also used by the client.
++.It Cm GSSAPIKexAlgorithms
++The list of key exchange algorithms that are accepted by GSSAPI
++key exchange. Possible values are
++.Bd -literal -offset 3n
++gss-gex-sha1-,
++gss-group1-sha1-,
++gss-group14-sha1-,
++gss-group14-sha256-,
++gss-group16-sha512-,
++gss-nistp256-sha256-,
++gss-curve25519-sha256-
++.Ed
++.Pp
++The default is
++.Dq gss-gex-sha1-,gss-group14-sha1- .
++This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HostbasedAcceptedKeyTypes
  Specifies the key types that will be accepted for hostbased authentication
  as a list of comma-separated patterns.
 diff --git a/sshkey.c b/sshkey.c
-index 6555c5ef8..a85c185fc 100644
+index ad1957762..789cd61ef 100644
 --- a/sshkey.c
 +++ b/sshkey.c
 @@ -135,6 +135,7 @@ static const struct keytype keytypes[] = {
@@ -3340,10 +4075,10 @@ index 6555c5ef8..a85c185fc 100644
                 if (!include_sigonly && kt->sigonly)
                         continue;
 diff --git a/sshkey.h b/sshkey.h
-index f6a007fdf..f54deb0c0 100644
+index a91e60436..c11106c93 100644
 --- a/sshkey.h
 +++ b/sshkey.h
-@@ -64,6 +64,7 @@ enum sshkey_types {
+@@ -65,6 +65,7 @@ enum sshkey_types {
         KEY_ED25519_CERT,
         KEY_XMSS,
         KEY_XMSS_CERT,
diff --git a/debian/patches/have-progressmeter-force-update-at-beginning-and-end-transfer.patch b/debian/patches/have-progressmeter-force-update-at-beginning-and-end-transfer.patch
deleted file mode 100644
index 767dbf2b5..000000000
--- a/debian/patches/have-progressmeter-force-update-at-beginning-and-end-transfer.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 2a8f710447442e9a03e71c022859112ec2d77d17 Mon Sep 17 00:00:00 2001
-From: "dtucker@openbsd.org" <dtucker@openbsd.org>
-Date: Thu, 24 Jan 2019 16:52:17 +0000
-Subject: upstream: Have progressmeter force an update at the beginning and
-
-end of each transfer.  Fixes the problem recently introduces where very quick
-transfers do not display the progressmeter at all.  Spotted by naddy@
-
-OpenBSD-Commit-ID: 68dc46c259e8fdd4f5db3ec2a130f8e4590a7a9a
-
-Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=bdc6c63c80b55bcbaa66b5fde31c1cb1d09a41eb
-Last-Update: 2019-02-08
-
-Patch-Name: have-progressmeter-force-update-at-beginning-and-end-transfer.patch
----
- progressmeter.c | 13 +++++--------
- progressmeter.h |  4 ++--
- scp.c           |  2 +-
- sftp-client.c   |  2 +-
- 4 files changed, 9 insertions(+), 12 deletions(-)
-
-diff --git a/progressmeter.c b/progressmeter.c
-index add462dde..e385c1254 100644
---- a/progressmeter.c
-+++ b/progressmeter.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: progressmeter.c,v 1.46 2019/01/23 08:01:46 dtucker Exp $ */
-+/* $OpenBSD: progressmeter.c,v 1.47 2019/01/24 16:52:17 dtucker Exp $ */
- /*
-  * Copyright (c) 2003 Nils Nordman.  All rights reserved.
-  *
-@@ -59,9 +59,6 @@ static void format_rate(char *, int, off_t);
- static void sig_winch(int);
- static void setscreensize(void);
- 
--/* updates the progressmeter to reflect the current state of the transfer */
--void refresh_progress_meter(void);
--
- /* signal handler for updating the progress meter */
- static void sig_alarm(int);
- 
-@@ -120,7 +117,7 @@ format_size(char *buf, int size, off_t bytes)
- }
- 
- void
--refresh_progress_meter(void)
-+refresh_progress_meter(int force_update)
- {
-        char buf[MAX_WINSIZE + 1];
-        off_t transferred;
-@@ -131,7 +128,7 @@ refresh_progress_meter(void)
-        int hours, minutes, seconds;
-        int file_len;
- 
--       if ((!alarm_fired && !win_resized) || !can_output())
-+       if ((!force_update && !alarm_fired && !win_resized) || !can_output())
-                return;
-        alarm_fired = 0;
- 
-@@ -254,7 +251,7 @@ start_progress_meter(const char *f, off_t filesize, off_t *ctr)
-        bytes_per_second = 0;
- 
-        setscreensize();
--       refresh_progress_meter();
-+       refresh_progress_meter(1);
- 
-        signal(SIGALRM, sig_alarm);
-        signal(SIGWINCH, sig_winch);
-@@ -271,7 +268,7 @@ stop_progress_meter(void)
- 
-        /* Ensure we complete the progress */
-        if (cur_pos != end_pos)
--               refresh_progress_meter();
-+               refresh_progress_meter(1);
- 
-        atomicio(vwrite, STDOUT_FILENO, "\n", 1);
- }
-diff --git a/progressmeter.h b/progressmeter.h
-index 8f6678060..1703ea75b 100644
---- a/progressmeter.h
-+++ b/progressmeter.h
-@@ -1,4 +1,4 @@
--/* $OpenBSD: progressmeter.h,v 1.4 2019/01/23 08:01:46 dtucker Exp $ */
-+/* $OpenBSD: progressmeter.h,v 1.5 2019/01/24 16:52:17 dtucker Exp $ */
- /*
-  * Copyright (c) 2002 Nils Nordman.  All rights reserved.
-  *
-@@ -24,5 +24,5 @@
-  */
- 
- void   start_progress_meter(const char *, off_t, off_t *);
--void   refresh_progress_meter(void);
-+void   refresh_progress_meter(int);
- void   stop_progress_meter(void);
-diff --git a/scp.c b/scp.c
-index 80308573c..1971c80cd 100644
---- a/scp.c
-+++ b/scp.c
-@@ -593,7 +593,7 @@ scpio(void *_cnt, size_t s)
-        off_t *cnt = (off_t *)_cnt;
- 
-        *cnt += s;
--       refresh_progress_meter();
-+       refresh_progress_meter(0);
-        if (limit_kbps > 0)
-                bandwidth_limit(&bwlimit, s);
-        return 0;
-diff --git a/sftp-client.c b/sftp-client.c
-index 2bc698f86..cf2887a40 100644
---- a/sftp-client.c
-+++ b/sftp-client.c
-@@ -101,7 +101,7 @@ sftpio(void *_bwlimit, size_t amount)
- {
-        struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
- 
--       refresh_progress_meter();
-+       refresh_progress_meter(0);
-        if (bwlimit != NULL)
-                bandwidth_limit(bwlimit, amount);
-        return 0;
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 4207302c3..fbfe6a1fb 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -1,4 +1,4 @@
-From 7ba31c6ff505278fb9f33b695605ca3a093caba2 Mon Sep 17 00:00:00 2001
+From 4d8dd12bab7bbc954815d7953a0c86ce1687bd34 Mon Sep 17 00:00:00 2001
 From: Richard Kettlewell <rjk@greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:52 +0000
 Subject: Various keepalive extensions
@@ -26,10 +26,10 @@ Patch-Name: keepalive-extensions.patch
  3 files changed, 34 insertions(+), 4 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 5e655e924..052d4b1ac 100644
+index 29f3bd98d..3d0b6ff90 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -175,6 +175,7 @@ typedef enum {
+@@ -177,6 +177,7 @@ typedef enum {
         oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
         oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
         oPubkeyAcceptedKeyTypes, oCASignatureAlgorithms, oProxyJump,
@@ -37,7 +37,7 @@ index 5e655e924..052d4b1ac 100644
         oIgnore, oIgnoredUnknownOption, oDeprecated, oUnsupported
  } OpCodes;
  
-@@ -322,6 +323,8 @@ static struct {
+@@ -326,6 +327,8 @@ static struct {
         { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
         { "ignoreunknown", oIgnoreUnknown },
         { "proxyjump", oProxyJump },
@@ -46,7 +46,7 @@ index 5e655e924..052d4b1ac 100644
  
         { NULL, oBadOption }
  };
-@@ -1415,6 +1418,8 @@ parse_keytypes:
+@@ -1440,6 +1443,8 @@ parse_keytypes:
                 goto parse_flag;
  
         case oServerAliveInterval:
@@ -55,7 +55,7 @@ index 5e655e924..052d4b1ac 100644
                 intptr = &options->server_alive_interval;
                 goto parse_time;
  
-@@ -2101,8 +2106,13 @@ fill_default_options(Options * options)
+@@ -2133,8 +2138,13 @@ fill_default_options(Options * options)
                 options->rekey_interval = 0;
         if (options->verify_host_key_dns == -1)
                 options->verify_host_key_dns = 0;
@@ -72,10 +72,10 @@ index 5e655e924..052d4b1ac 100644
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index 16c79368a..54e143c93 100644
+index c3c8b274a..250c92d04 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -247,8 +247,12 @@ Valid arguments are
+@@ -265,8 +265,12 @@ Valid arguments are
  If set to
  .Cm yes ,
  passphrase/password querying will be disabled.
@@ -89,7 +89,7 @@ index 16c79368a..54e143c93 100644
  The argument must be
  .Cm yes
  or
-@@ -1485,7 +1489,14 @@ from the server,
+@@ -1535,7 +1539,14 @@ from the server,
  will send a message through the encrypted
  channel to request a response from the server.
  The default
@@ -105,7 +105,7 @@ index 16c79368a..54e143c93 100644
  .It Cm SetEnv
  Directly specify one or more environment variables and their contents to
  be sent to the server.
-@@ -1565,6 +1576,12 @@ Specifies whether the system should send TCP keepalive messages to the
+@@ -1615,6 +1626,12 @@ Specifies whether the system should send TCP keepalive messages to the
  other side.
  If they are sent, death of the connection or crash of one
  of the machines will be properly noticed.
@@ -119,10 +119,10 @@ index 16c79368a..54e143c93 100644
  connections will die if the route is down temporarily, and some people
  find it annoying.
 diff --git a/sshd_config.5 b/sshd_config.5
-index 985eef5a2..e7e55dd71 100644
+index 2baa6622b..2ef671d1b 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -1577,6 +1577,9 @@ This avoids infinitely hanging sessions.
+@@ -1597,6 +1597,9 @@ This avoids infinitely hanging sessions.
  .Pp
  To disable TCP keepalive messages, the value should be set to
  .Cm no .
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 75ed46db7..21e8d7947 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From bb8bb2621914ad600202e38d5b9b4f4544b191e5 Mon Sep 17 00:00:00 2001
+From 15b7cc25dea4efdef7fdd129d0e3d1a091afd67b Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
@@ -14,10 +14,10 @@ Patch-Name: mention-ssh-keygen-on-keychange.patch
  1 file changed, 8 insertions(+), 1 deletion(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index 700ea6c3c..158e8146f 100644
+index 103d84e38..0b6f6af4b 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -1121,9 +1121,13 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
+@@ -986,9 +986,13 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
                         error("%s. This could either mean that", key_msg);
                         error("DNS SPOOFING is happening or the IP address for the host");
                         error("and its host key have changed at the same time.");
@@ -32,7 +32,7 @@ index 700ea6c3c..158e8146f 100644
                 }
                 /* The host key has changed. */
                 warn_changed_key(host_key);
-@@ -1132,6 +1136,9 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
+@@ -997,6 +1001,9 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
                 error("Offending %s key in %s:%lu",
                     sshkey_type(host_found->key),
                     host_found->file, host_found->line);
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index 3b2e05e58..dcc672726 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From 690051b3aa4ff72af57e4a82d640858357eef820 Mon Sep 17 00:00:00 2001
+From 1f61e987ccec2a2af15044196c1a6730959ead98 Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
@@ -23,7 +23,7 @@ Patch-Name: no-openssl-version-status.patch
  2 files changed, 4 insertions(+), 3 deletions(-)
 
 diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
-index 8b4a36274..ea0b0c9fb 100644
+index a37ca61bf..c1749210d 100644
 --- a/openbsd-compat/openssl-compat.c
 +++ b/openbsd-compat/openssl-compat.c
 @@ -34,7 +34,7 @@
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index cdb905b2e..e46967c72 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From 96c85e746d4f94c7d2748a200e5817ad8a987918 Mon Sep 17 00:00:00 2001
+From 47beec5c944ea9add7d267110fc9dcf15e7b8932 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
@@ -44,10 +44,10 @@ index ef0de0850..149846c8c 100644
  .Sh SEE ALSO
  .Xr ssh-keygen 1 ,
 diff --git a/ssh-keygen.1 b/ssh-keygen.1
-index bfa2eb5f3..da6b5ed76 100644
+index 124456577..9b877b860 100644
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -176,9 +176,7 @@ key in
+@@ -178,9 +178,7 @@ key in
  .Pa ~/.ssh/id_ed25519
  or
  .Pa ~/.ssh/id_rsa .
@@ -58,7 +58,7 @@ index bfa2eb5f3..da6b5ed76 100644
  .Pp
  Normally this program generates the key and asks for a file in which
  to store the private key.
-@@ -229,9 +227,7 @@ If
+@@ -243,9 +241,7 @@ If
  .Fl f
  has also been specified, its argument is used as a prefix to the
  default path for the resulting host key files.
@@ -69,7 +69,7 @@ index bfa2eb5f3..da6b5ed76 100644
  .It Fl a Ar rounds
  When saving a private key this option specifies the number of KDF
  (key derivation function) rounds used.
-@@ -677,7 +673,7 @@ option.
+@@ -703,7 +699,7 @@ option.
  Valid generator values are 2, 3, and 5.
  .Pp
  Screened DH groups may be installed in
@@ -78,7 +78,7 @@ index bfa2eb5f3..da6b5ed76 100644
  It is important that this file contains moduli of a range of bit lengths and
  that both ends of a connection share common moduli.
  .Sh CERTIFICATES
-@@ -877,7 +873,7 @@ on all machines
+@@ -903,7 +899,7 @@ on all machines
  where the user wishes to log in using public key authentication.
  There is no need to keep the contents of this file secret.
  .Pp
@@ -88,10 +88,10 @@ index bfa2eb5f3..da6b5ed76 100644
  The file format is described in
  .Xr moduli 5 .
 diff --git a/ssh.1 b/ssh.1
-index 81f29af43..5dfad6daa 100644
+index 64ead5f57..e4aeae7b4 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -860,6 +860,10 @@ implements public key authentication protocol automatically,
+@@ -873,6 +873,10 @@ implements public key authentication protocol automatically,
  using one of the DSA, ECDSA, Ed25519 or RSA algorithms.
  The HISTORY section of
  .Xr ssl 8
@@ -133,7 +133,7 @@ index 57a7fd66b..4abc01d66 100644
  .Xr sshd_config 5 ,
  .Xr inetd 8 ,
 diff --git a/sshd_config.5 b/sshd_config.5
-index 37e6be38f..23f71fd1d 100644
+index addea54a0..f995e4ab0 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -395,8 +395,7 @@ Certificates signed using other algorithms will not be accepted for
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 809c78846..0d2be82dc 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From b258a00bedcf29200b394c671c6deb1e53157f32 Mon Sep 17 00:00:00 2001
+From 85e700a732e9a308eeee67f5a284e19fd6befbb8 Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
@@ -9,47 +9,33 @@ generally just try attacks rather than bothering to scan for
 vulnerable-looking version strings.  (However, see debian-banner.patch.)
 
 Forwarded: not-needed
-Last-Update: 2017-10-04
+Last-Update: 2019-06-05
 
 Patch-Name: package-versioning.patch
 ---
- sshconnect.c | 2 +-
- sshd.c       | 2 +-
- version.h    | 7 ++++++-
- 3 files changed, 8 insertions(+), 3 deletions(-)
+ kex.c     | 2 +-
+ version.h | 7 ++++++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
 
-diff --git a/sshconnect.c b/sshconnect.c
-index 158e8146f..b9418e277 100644
---- a/sshconnect.c
-+++ b/sshconnect.c
-@@ -609,7 +609,7 @@ send_client_banner(int connection_out, int minor1)
- {
-        /* Send our own protocol version identification. */
-        xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
--           PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION);
-+           PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE);
-        if (atomicio(vwrite, connection_out, client_version_string,
-            strlen(client_version_string)) != strlen(client_version_string))
-                fatal("write: %.100s", strerror(errno));
-diff --git a/sshd.c b/sshd.c
-index 2bc6679e5..9481272fc 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -384,7 +384,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
-        char remote_version[256];       /* Must be at least as big as buf. */
- 
-        xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
--           PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
-+           PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
-            *options.version_addendum == '\0' ? "" : " ",
-            options.version_addendum);
- 
+diff --git a/kex.c b/kex.c
+index a2a4794e8..be354206d 100644
+--- a/kex.c
++++ b/kex.c
+@@ -1186,7 +1186,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
+        if (version_addendum != NULL && *version_addendum == '\0')
+                version_addendum = NULL;
+        if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%.100s%s%s\r\n",
+-          PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
++          PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
+            version_addendum == NULL ? "" : " ",
+            version_addendum == NULL ? "" : version_addendum)) != 0) {
+                error("%s: sshbuf_putf: %s", __func__, ssh_err(r));
 diff --git a/version.h b/version.h
-index 422dfbc3a..5e1ce0426 100644
+index 806ead9a6..599c859e6 100644
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION    "OpenSSH_7.9"
+ #define SSH_VERSION    "OpenSSH_8.0"
  
  #define SSH_PORTABLE   "p1"
 -#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
diff --git a/debian/patches/request-rsa-sha2-cert-signatures.patch b/debian/patches/request-rsa-sha2-cert-signatures.patch
deleted file mode 100644
index 2c876be31..000000000
--- a/debian/patches/request-rsa-sha2-cert-signatures.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From d94226d4fcefbc398c5583e12b5d07ca33884ba4 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Thu, 27 Dec 2018 23:02:11 +0000
-Subject: upstream: Request RSA-SHA2 signatures for
-
-rsa-sha2-{256|512}-cert-v01@openssh.com cert algorithms; ok markus@
-
-OpenBSD-Commit-ID: afc6f7ca216ccd821656d1c911d2a3deed685033
-
-Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=f429c1b2ef631f2855e51a790cf71761d752bbca
-Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2944
-Bug-Debian: https://bugs.debian.org/923419
-Last-Update: 2019-02-28
-
-Patch-Name: request-rsa-sha2-cert-signatures.patch
----
- authfd.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/authfd.c b/authfd.c
-index ecdd869ab..62cbf8c19 100644
---- a/authfd.c
-+++ b/authfd.c
-@@ -327,10 +327,12 @@ ssh_free_identitylist(struct ssh_identitylist *idl)
- static u_int
- agent_encode_alg(const struct sshkey *key, const char *alg)
- {
--       if (alg != NULL && key->type == KEY_RSA) {
--               if (strcmp(alg, "rsa-sha2-256") == 0)
-+       if (alg != NULL && sshkey_type_plain(key->type) == KEY_RSA) {
-+               if (strcmp(alg, "rsa-sha2-256") == 0 ||
-+                   strcmp(alg, "rsa-sha2-256-cert-v01@openssh.com") == 0)
-                        return SSH_AGENT_RSA_SHA2_256;
--               else if (strcmp(alg, "rsa-sha2-512") == 0)
-+               if (strcmp(alg, "rsa-sha2-512") == 0 ||
-+                   strcmp(alg, "rsa-sha2-512-cert-v01@openssh.com") == 0)
-                        return SSH_AGENT_RSA_SHA2_512;
-        }
-        return 0;
diff --git a/debian/patches/restore-authorized_keys2.patch b/debian/patches/restore-authorized_keys2.patch
index fcb1ac7e3..574923e1c 100644
--- a/debian/patches/restore-authorized_keys2.patch
+++ b/debian/patches/restore-authorized_keys2.patch
@@ -1,4 +1,4 @@
-From cebe4b82b280810172877a7f3d489c506c9a0691 Mon Sep 17 00:00:00 2001
+From 1af6147744892b18e2239c085abe87f5408cbaae Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 5 Mar 2017 02:02:11 +0000
 Subject: Restore reading authorized_keys2 by default
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch
index fdc6cf18a..0472ea7d0 100644
--- a/debian/patches/restore-tcp-wrappers.patch
+++ b/debian/patches/restore-tcp-wrappers.patch
@@ -1,4 +1,4 @@
-From 389e16d0109d8c49a761cd7c267438b05c9ab984 Mon Sep 17 00:00:00 2001
+From 0f9f44654708e4fde2f52c52f717d061b5e458fa Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 7 Oct 2014 13:22:41 +0100
 Subject: Restore TCP wrappers support
@@ -18,7 +18,7 @@ but it at least probably doesn't involve dropping this feature shortly
 before a freeze.
 
 Forwarded: not-needed
-Last-Update: 2018-08-24
+Last-Update: 2019-06-05
 
 Patch-Name: restore-tcp-wrappers.patch
 ---
@@ -28,10 +28,10 @@ Patch-Name: restore-tcp-wrappers.patch
  3 files changed, 89 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 023e7cc55..917300b43 100644
+index 2869f7042..ce16e7758 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1517,6 +1517,62 @@ else
+@@ -1518,6 +1518,62 @@ else
         AC_MSG_RESULT([no])
  fi
  
@@ -94,7 +94,7 @@ index 023e7cc55..917300b43 100644
  # Check whether user wants to use ldns
  LDNS_MSG="no"
  AC_ARG_WITH(ldns,
-@@ -5329,6 +5385,7 @@ echo "                       PAM support: $PAM_MSG"
+@@ -5269,6 +5325,7 @@ echo "                       PAM support: $PAM_MSG"
  echo "                   OSF SIA support: $SIA_MSG"
  echo "                 KerberosV support: $KRB5_MSG"
  echo "                   SELinux support: $SELINUX_MSG"
@@ -128,7 +128,7 @@ index fb133c14b..57a7fd66b 100644
  .Xr moduli 5 ,
  .Xr sshd_config 5 ,
 diff --git a/sshd.c b/sshd.c
-index 539a000fd..673db87f6 100644
+index 98680721b..46870d3b5 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -127,6 +127,13 @@
@@ -145,7 +145,7 @@ index 539a000fd..673db87f6 100644
  /* Re-exec fds */
  #define REEXEC_DEVCRYPTO_RESERVED_FD   (STDERR_FILENO + 1)
  #define REEXEC_STARTUP_PIPE_FD         (STDERR_FILENO + 2)
-@@ -2099,6 +2106,24 @@ main(int ac, char **av)
+@@ -2057,6 +2064,24 @@ main(int ac, char **av)
  #ifdef SSH_AUDIT_EVENTS
         audit_connection_from(remote_ip, remote_port);
  #endif
@@ -153,7 +153,7 @@ index 539a000fd..673db87f6 100644
 +       allow_severity = options.log_facility|LOG_INFO;
 +       deny_severity = options.log_facility|LOG_WARNING;
 +       /* Check whether logins are denied from this host. */
-+       if (packet_connection_is_on_socket()) {
++       if (ssh_packet_connection_is_on_socket(ssh)) {
 +               struct request_info req;
 +
 +               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
diff --git a/debian/patches/revert-ipqos-defaults.patch b/debian/patches/revert-ipqos-defaults.patch
index a329b9be1..d0b02d792 100644
--- a/debian/patches/revert-ipqos-defaults.patch
+++ b/debian/patches/revert-ipqos-defaults.patch
@@ -1,4 +1,4 @@
-From 6b56cd57db9061296231f14d537f1ebaf25e8877 Mon Sep 17 00:00:00 2001
+From 7d50f9e5be88179325983a1f58c9d51bb58f025a Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Mon, 8 Apr 2019 10:46:29 +0100
 Subject: Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP
@@ -24,10 +24,10 @@ Patch-Name: revert-ipqos-defaults.patch
  4 files changed, 8 insertions(+), 12 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 661b8bf40..6d046f063 100644
+index f35bde6e6..2ba312441 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -2133,9 +2133,9 @@ fill_default_options(Options * options)
+@@ -2165,9 +2165,9 @@ fill_default_options(Options * options)
         if (options->visual_host_key == -1)
                 options->visual_host_key = 0;
         if (options->ip_qos_interactive == -1)
@@ -40,10 +40,10 @@ index 661b8bf40..6d046f063 100644
                 options->request_tty = REQUEST_TTY_AUTO;
         if (options->proxy_use_fdpass == -1)
 diff --git a/servconf.c b/servconf.c
-index c5dd617ef..bf2669147 100644
+index 8d2bced52..365e6ff1e 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -403,9 +403,9 @@ fill_default_server_options(ServerOptions *options)
+@@ -423,9 +423,9 @@ fill_default_server_options(ServerOptions *options)
         if (options->permit_tun == -1)
                 options->permit_tun = SSH_TUNMODE_NO;
         if (options->ip_qos_interactive == -1)
@@ -56,10 +56,10 @@ index c5dd617ef..bf2669147 100644
                 options->version_addendum = xstrdup("");
         if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index 1a8e24bd1..f6c1b3b33 100644
+index a27631ae9..a9f6d906f 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1055,11 +1055,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+@@ -1098,11 +1098,9 @@ If one argument is specified, it is used as the packet class unconditionally.
  If two values are specified, the first is automatically selected for
  interactive sessions and the second for non-interactive sessions.
  The default is
@@ -74,10 +74,10 @@ index 1a8e24bd1..f6c1b3b33 100644
  .It Cm KbdInteractiveAuthentication
  Specifies whether to use keyboard-interactive authentication.
 diff --git a/sshd_config.5 b/sshd_config.5
-index ba50a30f1..03f813e72 100644
+index c0c4ebd66..e5380f5dc 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -866,11 +866,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+@@ -886,11 +886,9 @@ If one argument is specified, it is used as the packet class unconditionally.
  If two values are specified, the first is automatically selected for
  interactive sessions and the second for non-interactive sessions.
  The default is
diff --git a/debian/patches/sanitize-scp-filenames-via-snmprintf.patch b/debian/patches/sanitize-scp-filenames-via-snmprintf.patch
deleted file mode 100644
index e58b8b1bd..000000000
--- a/debian/patches/sanitize-scp-filenames-via-snmprintf.patch
+++ /dev/null
@@ -1,276 +0,0 @@
-From 11b88754cadcad0ba79b4ffcc127223248dccb54 Mon Sep 17 00:00:00 2001
-From: "dtucker@openbsd.org" <dtucker@openbsd.org>
-Date: Wed, 23 Jan 2019 08:01:46 +0000
-Subject: upstream: Sanitize scp filenames via snmprintf. To do this we move
-
-the progressmeter formatting outside of signal handler context and have the
-atomicio callback called for EINTR too.  bz#2434 with contributions from djm
-and jjelen at redhat.com, ok djm@
-
-OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8
-
-CVE-2019-6109
-
-Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=8976f1c4b2721c26e878151f52bdf346dfe2d54c
-Bug-Debian: https://bugs.debian.org/793412
-Last-Update: 2019-02-08
-
-Patch-Name: sanitize-scp-filenames-via-snmprintf.patch
----
- atomicio.c      | 20 ++++++++++++++-----
- progressmeter.c | 53 ++++++++++++++++++++++---------------------------
- progressmeter.h |  3 ++-
- scp.c           |  1 +
- sftp-client.c   | 16 ++++++++-------
- 5 files changed, 51 insertions(+), 42 deletions(-)
-
-diff --git a/atomicio.c b/atomicio.c
-index f854a06f5..d91bd7621 100644
---- a/atomicio.c
-+++ b/atomicio.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */
-+/* $OpenBSD: atomicio.c,v 1.29 2019/01/23 08:01:46 dtucker Exp $ */
- /*
-  * Copyright (c) 2006 Damien Miller. All rights reserved.
-  * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
-@@ -65,9 +65,14 @@ atomicio6(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n,
-                res = (f) (fd, s + pos, n - pos);
-                switch (res) {
-                case -1:
--                       if (errno == EINTR)
-+                       if (errno == EINTR) {
-+                               /* possible SIGALARM, update callback */
-+                               if (cb != NULL && cb(cb_arg, 0) == -1) {
-+                                       errno = EINTR;
-+                                       return pos;
-+                               }
-                                continue;
--                       if (errno == EAGAIN || errno == EWOULDBLOCK) {
-+                       } else if (errno == EAGAIN || errno == EWOULDBLOCK) {
- #ifndef BROKEN_READ_COMPARISON
-                                (void)poll(&pfd, 1, -1);
- #endif
-@@ -122,9 +127,14 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd,
-                res = (f) (fd, iov, iovcnt);
-                switch (res) {
-                case -1:
--                       if (errno == EINTR)
-+                       if (errno == EINTR) {
-+                               /* possible SIGALARM, update callback */
-+                               if (cb != NULL && cb(cb_arg, 0) == -1) {
-+                                       errno = EINTR;
-+                                       return pos;
-+                               }
-                                continue;
--                       if (errno == EAGAIN || errno == EWOULDBLOCK) {
-+                       } else if (errno == EAGAIN || errno == EWOULDBLOCK) {
- #ifndef BROKEN_READV_COMPARISON
-                                (void)poll(&pfd, 1, -1);
- #endif
-diff --git a/progressmeter.c b/progressmeter.c
-index fe9bf52e4..add462dde 100644
---- a/progressmeter.c
-+++ b/progressmeter.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: progressmeter.c,v 1.45 2016/06/30 05:17:05 dtucker Exp $ */
-+/* $OpenBSD: progressmeter.c,v 1.46 2019/01/23 08:01:46 dtucker Exp $ */
- /*
-  * Copyright (c) 2003 Nils Nordman.  All rights reserved.
-  *
-@@ -31,6 +31,7 @@
- 
- #include <errno.h>
- #include <signal.h>
-+#include <stdarg.h>
- #include <stdio.h>
- #include <string.h>
- #include <time.h>
-@@ -39,6 +40,7 @@
- #include "progressmeter.h"
- #include "atomicio.h"
- #include "misc.h"
-+#include "utf8.h"
- 
- #define DEFAULT_WINSIZE 80
- #define MAX_WINSIZE 512
-@@ -61,7 +63,7 @@ static void setscreensize(void);
- void refresh_progress_meter(void);
- 
- /* signal handler for updating the progress meter */
--static void update_progress_meter(int);
-+static void sig_alarm(int);
- 
- static double start;           /* start progress */
- static double last_update;     /* last progress update */
-@@ -74,6 +76,7 @@ static long stalled;          /* how long we have been stalled */
- static int bytes_per_second;   /* current speed in bytes per second */
- static int win_size;           /* terminal window size */
- static volatile sig_atomic_t win_resized; /* for window resizing */
-+static volatile sig_atomic_t alarm_fired;
- 
- /* units for format_size */
- static const char unit[] = " KMGT";
-@@ -126,9 +129,17 @@ refresh_progress_meter(void)
-        off_t bytes_left;
-        int cur_speed;
-        int hours, minutes, seconds;
--       int i, len;
-        int file_len;
- 
-+       if ((!alarm_fired && !win_resized) || !can_output())
-+               return;
-+       alarm_fired = 0;
-+
-+       if (win_resized) {
-+               setscreensize();
-+               win_resized = 0;
-+       }
-+
-        transferred = *counter - (cur_pos ? cur_pos : start_pos);
-        cur_pos = *counter;
-        now = monotime_double();
-@@ -158,16 +169,11 @@ refresh_progress_meter(void)
- 
-        /* filename */
-        buf[0] = '\0';
--       file_len = win_size - 35;
-+       file_len = win_size - 36;
-        if (file_len > 0) {
--               len = snprintf(buf, file_len + 1, "\r%s", file);
--               if (len < 0)
--                       len = 0;
--               if (len >= file_len + 1)
--                       len = file_len;
--               for (i = len; i < file_len; i++)
--                       buf[i] = ' ';
--               buf[file_len] = '\0';
-+               buf[0] = '\r';
-+               snmprintf(buf+1, sizeof(buf)-1 , &file_len, "%*s",
-+                   file_len * -1, file);
-        }
- 
-        /* percent of transfer done */
-@@ -228,22 +234,11 @@ refresh_progress_meter(void)
- 
- /*ARGSUSED*/
- static void
--update_progress_meter(int ignore)
-+sig_alarm(int ignore)
- {
--       int save_errno;
--
--       save_errno = errno;
--
--       if (win_resized) {
--               setscreensize();
--               win_resized = 0;
--       }
--       if (can_output())
--               refresh_progress_meter();
--
--       signal(SIGALRM, update_progress_meter);
-+       signal(SIGALRM, sig_alarm);
-+       alarm_fired = 1;
-        alarm(UPDATE_INTERVAL);
--       errno = save_errno;
- }
- 
- void
-@@ -259,10 +254,9 @@ start_progress_meter(const char *f, off_t filesize, off_t *ctr)
-        bytes_per_second = 0;
- 
-        setscreensize();
--       if (can_output())
--               refresh_progress_meter();
-+       refresh_progress_meter();
- 
--       signal(SIGALRM, update_progress_meter);
-+       signal(SIGALRM, sig_alarm);
-        signal(SIGWINCH, sig_winch);
-        alarm(UPDATE_INTERVAL);
- }
-@@ -286,6 +280,7 @@ stop_progress_meter(void)
- static void
- sig_winch(int sig)
- {
-+       signal(SIGWINCH, sig_winch);
-        win_resized = 1;
- }
- 
-diff --git a/progressmeter.h b/progressmeter.h
-index bf179dca6..8f6678060 100644
---- a/progressmeter.h
-+++ b/progressmeter.h
-@@ -1,4 +1,4 @@
--/* $OpenBSD: progressmeter.h,v 1.3 2015/01/14 13:54:13 djm Exp $ */
-+/* $OpenBSD: progressmeter.h,v 1.4 2019/01/23 08:01:46 dtucker Exp $ */
- /*
-  * Copyright (c) 2002 Nils Nordman.  All rights reserved.
-  *
-@@ -24,4 +24,5 @@
-  */
- 
- void   start_progress_meter(const char *, off_t, off_t *);
-+void   refresh_progress_meter(void);
- void   stop_progress_meter(void);
-diff --git a/scp.c b/scp.c
-index 7163d33dc..80308573c 100644
---- a/scp.c
-+++ b/scp.c
-@@ -593,6 +593,7 @@ scpio(void *_cnt, size_t s)
-        off_t *cnt = (off_t *)_cnt;
- 
-        *cnt += s;
-+       refresh_progress_meter();
-        if (limit_kbps > 0)
-                bandwidth_limit(&bwlimit, s);
-        return 0;
-diff --git a/sftp-client.c b/sftp-client.c
-index 4986d6d8d..2bc698f86 100644
---- a/sftp-client.c
-+++ b/sftp-client.c
-@@ -101,7 +101,9 @@ sftpio(void *_bwlimit, size_t amount)
- {
-        struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
- 
--       bandwidth_limit(bwlimit, amount);
-+       refresh_progress_meter();
-+       if (bwlimit != NULL)
-+               bandwidth_limit(bwlimit, amount);
-        return 0;
- }
- 
-@@ -121,8 +123,8 @@ send_msg(struct sftp_conn *conn, struct sshbuf *m)
-        iov[1].iov_base = (u_char *)sshbuf_ptr(m);
-        iov[1].iov_len = sshbuf_len(m);
- 
--       if (atomiciov6(writev, conn->fd_out, iov, 2,
--           conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) !=
-+       if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio,
-+           conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) !=
-            sshbuf_len(m) + sizeof(mlen))
-                fatal("Couldn't send packet: %s", strerror(errno));
- 
-@@ -138,8 +140,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial)
- 
-        if ((r = sshbuf_reserve(m, 4, &p)) != 0)
-                fatal("%s: buffer error: %s", __func__, ssh_err(r));
--       if (atomicio6(read, conn->fd_in, p, 4,
--           conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) {
-+       if (atomicio6(read, conn->fd_in, p, 4, sftpio,
-+           conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) {
-                if (errno == EPIPE || errno == ECONNRESET)
-                        fatal("Connection closed");
-                else
-@@ -157,8 +159,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial)
- 
-        if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
-                fatal("%s: buffer error: %s", __func__, ssh_err(r));
--       if (atomicio6(read, conn->fd_in, p, msg_len,
--           conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in)
-+       if (atomicio6(read, conn->fd_in, p, msg_len, sftpio,
-+           conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL)
-            != msg_len) {
-                if (errno == EPIPE)
-                        fatal("Connection closed");
diff --git a/debian/patches/scp-disallow-dot-or-empty-filename.patch b/debian/patches/scp-disallow-dot-or-empty-filename.patch
deleted file mode 100644
index 716f2ffa8..000000000
--- a/debian/patches/scp-disallow-dot-or-empty-filename.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From dee21e97428e69d30e2d15c71f3e7cc08bf8e4f8 Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Fri, 16 Nov 2018 03:03:10 +0000
-Subject: upstream: disallow empty incoming filename or ones that refer to the
-
-current directory; based on report/patch from Harry Sintonen
-
-OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9
-
-Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=6010c0303a422a9c5fa8860c061bf7105eb7f8b2
-Bug-Debian: https://bugs.debian.org/919101
-Last-Update: 2019-01-12
-
-Patch-Name: scp-disallow-dot-or-empty-filename.patch
----
- scp.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scp.c b/scp.c
-index ed2864250..7163d33dc 100644
---- a/scp.c
-+++ b/scp.c
-@@ -1114,7 +1114,8 @@ sink(int argc, char **argv)
-                        SCREWUP("size out of range");
-                size = (off_t)ull;
- 
--               if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
-+               if (*cp == '\0' || strchr(cp, '/') != NULL ||
-+                   strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
-                        run_err("error: unexpected filename: %s", cp);
-                        exit(1);
-                }
diff --git a/debian/patches/scp-handle-braces.patch b/debian/patches/scp-handle-braces.patch
deleted file mode 100644
index 0cbdcfdc0..000000000
--- a/debian/patches/scp-handle-braces.patch
+++ /dev/null
@@ -1,353 +0,0 @@
-From 7a3fa37583d4abf128f7f4c6eb1e7ffc90115eab Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Sun, 10 Feb 2019 11:15:52 +0000
-Subject: upstream: when checking that filenames sent by the server side
-
-match what the client requested, be prepared to handle shell-style brace
-alternations, e.g. "{foo,bar}".
-
-"looks good to me" millert@ + in snaps for the last week courtesy
-deraadt@
-
-OpenBSD-Commit-ID: 3b1ce7639b0b25b2248e3a30f561a548f6815f3e
-
-Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=3d896c157c722bc47adca51a58dca859225b5874
-Bug-Debian: https://bugs.debian.org/923486
-Last-Update: 2019-03-01
-
-Patch-Name: scp-handle-braces.patch
----
- scp.c | 280 +++++++++++++++++++++++++++++++++++++++++++++++++++++++---
- 1 file changed, 269 insertions(+), 11 deletions(-)
-
-diff --git a/scp.c b/scp.c
-index 035037bcc..3888baab0 100644
---- a/scp.c
-+++ b/scp.c
-@@ -635,6 +635,253 @@ parse_scp_uri(const char *uri, char **userp, char **hostp, int *portp,
-        return r;
- }
- 
-+/* Appends a string to an array; returns 0 on success, -1 on alloc failure */
-+static int
-+append(char *cp, char ***ap, size_t *np)
-+{
-+       char **tmp;
-+
-+       if ((tmp = reallocarray(*ap, *np + 1, sizeof(*tmp))) == NULL)
-+               return -1;
-+       tmp[(*np)] = cp;
-+       (*np)++;
-+       *ap = tmp;
-+       return 0;
-+}
-+
-+/*
-+ * Finds the start and end of the first brace pair in the pattern.
-+ * returns 0 on success or -1 for invalid patterns.
-+ */
-+static int
-+find_brace(const char *pattern, int *startp, int *endp)
-+{
-+       int i;
-+       int in_bracket, brace_level;
-+
-+       *startp = *endp = -1;
-+       in_bracket = brace_level = 0;
-+       for (i = 0; i < INT_MAX && *endp < 0 && pattern[i] != '\0'; i++) {
-+               switch (pattern[i]) {
-+               case '\\':
-+                       /* skip next character */
-+                       if (pattern[i + 1] != '\0')
-+                               i++;
-+                       break;
-+               case '[':
-+                       in_bracket = 1;
-+                       break;
-+               case ']':
-+                       in_bracket = 0;
-+                       break;
-+               case '{':
-+                       if (in_bracket)
-+                               break;
-+                       if (pattern[i + 1] == '}') {
-+                               /* Protect a single {}, for find(1), like csh */
-+                               i++; /* skip */
-+                               break;
-+                       }
-+                       if (*startp == -1)
-+                               *startp = i;
-+                       brace_level++;
-+                       break;
-+               case '}':
-+                       if (in_bracket)
-+                               break;
-+                       if (*startp < 0) {
-+                               /* Unbalanced brace */
-+                               return -1;
-+                       }
-+                       if (--brace_level <= 0)
-+                               *endp = i;
-+                       break;
-+               }
-+       }
-+       /* unbalanced brackets/braces */
-+       if (*endp < 0 && (*startp >= 0 || in_bracket))
-+               return -1;
-+       return 0;
-+}
-+
-+/*
-+ * Assembles and records a successfully-expanded pattern, returns -1 on
-+ * alloc failure.
-+ */
-+static int
-+emit_expansion(const char *pattern, int brace_start, int brace_end,
-+    int sel_start, int sel_end, char ***patternsp, size_t *npatternsp)
-+{
-+       char *cp;
-+       int o = 0, tail_len = strlen(pattern + brace_end + 1);
-+
-+       if ((cp = malloc(brace_start + (sel_end - sel_start) +
-+           tail_len + 1)) == NULL)
-+               return -1;
-+
-+       /* Pattern before initial brace */
-+       if (brace_start > 0) {
-+               memcpy(cp, pattern, brace_start);
-+               o = brace_start;
-+       }
-+       /* Current braced selection */
-+       if (sel_end - sel_start > 0) {
-+               memcpy(cp + o, pattern + sel_start,
-+                   sel_end - sel_start);
-+               o += sel_end - sel_start;
-+       }
-+       /* Remainder of pattern after closing brace */
-+       if (tail_len > 0) {
-+               memcpy(cp + o, pattern + brace_end + 1, tail_len);
-+               o += tail_len;
-+       }
-+       cp[o] = '\0';
-+       if (append(cp, patternsp, npatternsp) != 0) {
-+               free(cp);
-+               return -1;
-+       }
-+       return 0;
-+}
-+
-+/*
-+ * Expand the first encountered brace in pattern, appending the expanded
-+ * patterns it yielded to the *patternsp array.
-+ *
-+ * Returns 0 on success or -1 on allocation failure.
-+ *
-+ * Signals whether expansion was performed via *expanded and whether
-+ * pattern was invalid via *invalid.
-+ */
-+static int
-+brace_expand_one(const char *pattern, char ***patternsp, size_t *npatternsp,
-+    int *expanded, int *invalid)
-+{
-+       int i;
-+       int in_bracket, brace_start, brace_end, brace_level;
-+       int sel_start, sel_end;
-+
-+       *invalid = *expanded = 0;
-+
-+       if (find_brace(pattern, &brace_start, &brace_end) != 0) {
-+               *invalid = 1;
-+               return 0;
-+       } else if (brace_start == -1)
-+               return 0;
-+
-+       in_bracket = brace_level = 0;
-+       for (i = sel_start = brace_start + 1; i < brace_end; i++) {
-+               switch (pattern[i]) {
-+               case '{':
-+                       if (in_bracket)
-+                               break;
-+                       brace_level++;
-+                       break;
-+               case '}':
-+                       if (in_bracket)
-+                               break;
-+                       brace_level--;
-+                       break;
-+               case '[':
-+                       in_bracket = 1;
-+                       break;
-+               case ']':
-+                       in_bracket = 0;
-+                       break;
-+               case '\\':
-+                       if (i < brace_end - 1)
-+                               i++; /* skip */
-+                       break;
-+               }
-+               if (pattern[i] == ',' || i == brace_end - 1) {
-+                       if (in_bracket || brace_level > 0)
-+                               continue;
-+                       /* End of a selection, emit an expanded pattern */
-+
-+                       /* Adjust end index for last selection */
-+                       sel_end = (i == brace_end - 1) ? brace_end : i;
-+                       if (emit_expansion(pattern, brace_start, brace_end,
-+                           sel_start, sel_end, patternsp, npatternsp) != 0)
-+                               return -1;
-+                       /* move on to the next selection */
-+                       sel_start = i + 1;
-+                       continue;
-+               }
-+       }
-+       if (in_bracket || brace_level > 0) {
-+               *invalid = 1;
-+               return 0;
-+       }
-+       /* success */
-+       *expanded = 1;
-+       return 0;
-+}
-+
-+/* Expand braces from pattern. Returns 0 on success, -1 on failure */
-+static int
-+brace_expand(const char *pattern, char ***patternsp, size_t *npatternsp)
-+{
-+       char *cp, *cp2, **active = NULL, **done = NULL;
-+       size_t i, nactive = 0, ndone = 0;
-+       int ret = -1, invalid = 0, expanded = 0;
-+
-+       *patternsp = NULL;
-+       *npatternsp = 0;
-+
-+       /* Start the worklist with the original pattern */
-+       if ((cp = strdup(pattern)) == NULL)
-+               return -1;
-+       if (append(cp, &active, &nactive) != 0) {
-+               free(cp);
-+               return -1;
-+       }
-+       while (nactive > 0) {
-+               cp = active[nactive - 1];
-+               nactive--;
-+               if (brace_expand_one(cp, &active, &nactive,
-+                   &expanded, &invalid) == -1) {
-+                       free(cp);
-+                       goto fail;
-+               }
-+               if (invalid)
-+                       fatal("%s: invalid brace pattern \"%s\"", __func__, cp);
-+               if (expanded) {
-+                       /*
-+                        * Current entry expanded to new entries on the
-+                        * active list; discard the progenitor pattern.
-+                        */
-+                       free(cp);
-+                       continue;
-+               }
-+               /*
-+                * Pattern did not expand; append the finename component to
-+                * the completed list
-+                */
-+               if ((cp2 = strrchr(cp, '/')) != NULL)
-+                       *cp2++ = '\0';
-+               else
-+                       cp2 = cp;
-+               if (append(xstrdup(cp2), &done, &ndone) != 0) {
-+                       free(cp);
-+                       goto fail;
-+               }
-+               free(cp);
-+       }
-+       /* success */
-+       *patternsp = done;
-+       *npatternsp = ndone;
-+       done = NULL;
-+       ndone = 0;
-+       ret = 0;
-+ fail:
-+       for (i = 0; i < nactive; i++)
-+               free(active[i]);
-+       free(active);
-+       for (i = 0; i < ndone; i++)
-+               free(done[i]);
-+       free(done);
-+       return ret;
-+}
-+
- void
- toremote(int argc, char **argv)
- {
-@@ -998,7 +1245,8 @@ sink(int argc, char **argv, const char *src)
-        unsigned long long ull;
-        int setimes, targisdir, wrerrno = 0;
-        char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048];
--       char *src_copy = NULL, *restrict_pattern = NULL;
-+       char **patterns = NULL;
-+       size_t n, npatterns = 0;
-        struct timeval tv[2];
- 
- #define        atime   tv[0]
-@@ -1028,16 +1276,13 @@ sink(int argc, char **argv, const char *src)
-                 * Prepare to try to restrict incoming filenames to match
-                 * the requested destination file glob.
-                 */
--               if ((src_copy = strdup(src)) == NULL)
--                       fatal("strdup failed");
--               if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) {
--                       *restrict_pattern++ = '\0';
--               }
-+               if (brace_expand(src, &patterns, &npatterns) != 0)
-+                       fatal("%s: could not expand pattern", __func__);
-        }
-        for (first = 1;; first = 0) {
-                cp = buf;
-                if (atomicio(read, remin, cp, 1) != 1)
--                       return;
-+                       goto done;
-                if (*cp++ == '\n')
-                        SCREWUP("unexpected <newline>");
-                do {
-@@ -1063,7 +1308,7 @@ sink(int argc, char **argv, const char *src)
-                }
-                if (buf[0] == 'E') {
-                        (void) atomicio(vwrite, remout, "", 1);
--                       return;
-+                       goto done;
-                }
-                if (ch == '\n')
-                        *--cp = 0;
-@@ -1138,9 +1383,14 @@ sink(int argc, char **argv, const char *src)
-                        run_err("error: unexpected filename: %s", cp);
-                        exit(1);
-                }
--               if (restrict_pattern != NULL &&
--                   fnmatch(restrict_pattern, cp, 0) != 0)
--                       SCREWUP("filename does not match request");
-+               if (npatterns > 0) {
-+                       for (n = 0; n < npatterns; n++) {
-+                               if (fnmatch(patterns[n], cp, 0) == 0)
-+                                       break;
-+                       }
-+                       if (n >= npatterns)
-+                               SCREWUP("filename does not match request");
-+               }
-                if (targisdir) {
-                        static char *namebuf;
-                        static size_t cursize;
-@@ -1299,7 +1549,15 @@ bad:                     run_err("%s: %s", np, strerror(errno));
-                        break;
-                }
-        }
-+done:
-+       for (n = 0; n < npatterns; n++)
-+               free(patterns[n]);
-+       free(patterns);
-+       return;
- screwup:
-+       for (n = 0; n < npatterns; n++)
-+               free(patterns[n]);
-+       free(patterns);
-        run_err("protocol error: %s", why);
-        exit(1);
- }
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index d054b2a82..29cf5603f 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From eefdc7046766b52e39f1b6eafcde22c1e013ce9f Mon Sep 17 00:00:00 2001
+From 76a51e544a6a6a674ff1dddf4bb6da05d9cce774 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
@@ -17,10 +17,10 @@ Patch-Name: scp-quoting.patch
  1 file changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/scp.c b/scp.c
-index 60682c687..ed2864250 100644
+index 80bc0e8b1..a2dc410bd 100644
 --- a/scp.c
 +++ b/scp.c
-@@ -198,8 +198,16 @@ do_local_cmd(arglist *a)
+@@ -199,8 +199,16 @@ do_local_cmd(arglist *a)
  
         if (verbose_mode) {
                 fprintf(stderr, "Executing:");
diff --git a/debian/patches/seccomp-s390-flock-ipc.patch b/debian/patches/seccomp-s390-flock-ipc.patch
index e864427bd..ad00d1220 100644
--- a/debian/patches/seccomp-s390-flock-ipc.patch
+++ b/debian/patches/seccomp-s390-flock-ipc.patch
@@ -1,4 +1,4 @@
-From 690939ba320d93e6f3ab5266bea94d8fb06c8bae Mon Sep 17 00:00:00 2001
+From 9fa2ceb14b6e7e5e902cff416bc9ad3963be9883 Mon Sep 17 00:00:00 2001
 From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
 Date: Tue, 9 May 2017 10:53:04 -0300
 Subject: Allow flock and ipc syscall for s390 architecture
diff --git a/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch b/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
index ecbe1d142..fcd7285bd 100644
--- a/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
+++ b/debian/patches/seccomp-s390-ioctl-ep11-crypto.patch
@@ -1,4 +1,4 @@
-From 9ce189b9f22890421b7f8d3f49a39186d3ce3e14 Mon Sep 17 00:00:00 2001
+From 9d4508c5c1d6466c662befcb26aff09f41966102 Mon Sep 17 00:00:00 2001
 From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
 Date: Tue, 9 May 2017 13:33:30 -0300
 Subject: Enable specific ioctl call for EP11 crypto card (s390)
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 269a87c76..5ab339ac9 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -1,4 +1,4 @@
-From cf3f6ac19812e4d32874304b3854b055831c2124 Mon Sep 17 00:00:00 2001
+From 21e3ff3ab4791d3c94bd775da66cde29797fcb36 Mon Sep 17 00:00:00 2001
 From: Manoj Srivastava <srivasta@debian.org>
 Date: Sun, 9 Feb 2014 16:09:49 +0000
 Subject: Handle SELinux authorisation roles
@@ -9,7 +9,7 @@ SELinux maintainer, so we'll keep it until we have something better.
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
 Bug-Debian: http://bugs.debian.org/394795
-Last-Update: 2018-08-24
+Last-Update: 2019-06-05
 
 Patch-Name: selinux-role.patch
 ---
@@ -31,7 +31,7 @@ Patch-Name: selinux-role.patch
  15 files changed, 99 insertions(+), 32 deletions(-)
 
 diff --git a/auth.h b/auth.h
-index 977562f0a..90802a5eb 100644
+index bf393e755..8f13bdf48 100644
 --- a/auth.h
 +++ b/auth.h
 @@ -65,6 +65,7 @@ struct Authctxt {
@@ -43,19 +43,19 @@ index 977562f0a..90802a5eb 100644
         /* Method lists for multiple authentication */
         char            **auth_methods; /* modified from server config */
 diff --git a/auth2.c b/auth2.c
-index a77742819..3035926ba 100644
+index 7417eafa4..d60e7f1f2 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -257,7 +257,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+@@ -267,7 +267,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
  {
         Authctxt *authctxt = ssh->authctxt;
         Authmethod *m = NULL;
--       char *user, *service, *method, *style = NULL;
-+       char *user, *service, *method, *style = NULL, *role = NULL;
-        int authenticated = 0;
+-       char *user = NULL, *service = NULL, *method = NULL, *style = NULL;
++       char *user = NULL, *service = NULL, *method = NULL, *style = NULL, *role = NULL;
+        int r, authenticated = 0;
         double tstart = monotime_double();
  
-@@ -270,8 +270,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+@@ -281,8 +281,13 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
         debug("userauth-request for user %s service %s method %s", user, service, method);
         debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -69,7 +69,7 @@ index a77742819..3035926ba 100644
  
         if (authctxt->attempt++ == 0) {
                 /* setup auth context */
-@@ -298,8 +303,9 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+@@ -309,8 +314,9 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
                     use_privsep ? " [net]" : "");
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
@@ -77,22 +77,22 @@ index a77742819..3035926ba 100644
                 if (use_privsep)
 -                       mm_inform_authserv(service, style);
 +                       mm_inform_authserv(service, style, role);
-                userauth_banner();
+                userauth_banner(ssh);
                 if (auth2_setup_methods_lists(authctxt) != 0)
-                        packet_disconnect("no authentication methods enabled");
+                        ssh_packet_disconnect(ssh,
 diff --git a/monitor.c b/monitor.c
-index eabc1e89b..08fddabd7 100644
+index 0766d6ef5..5f84e880d 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -117,6 +117,7 @@ int mm_answer_sign(int, struct sshbuf *);
- int mm_answer_pwnamallow(int, struct sshbuf *);
- int mm_answer_auth2_read_banner(int, struct sshbuf *);
- int mm_answer_authserv(int, struct sshbuf *);
-+int mm_answer_authrole(int, struct sshbuf *);
- int mm_answer_authpassword(int, struct sshbuf *);
- int mm_answer_bsdauthquery(int, struct sshbuf *);
- int mm_answer_bsdauthrespond(int, struct sshbuf *);
-@@ -193,6 +194,7 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -117,6 +117,7 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *);
+ int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *);
+ int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *);
+ int mm_answer_authserv(struct ssh *, int, struct sshbuf *);
++int mm_answer_authrole(struct ssh *, int, struct sshbuf *);
+ int mm_answer_authpassword(struct ssh *, int, struct sshbuf *);
+ int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *);
+ int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *);
+@@ -197,6 +198,7 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -100,7 +100,7 @@ index eabc1e89b..08fddabd7 100644
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -817,6 +819,7 @@ mm_answer_pwnamallow(int sock, struct sshbuf *m)
+@@ -819,6 +821,7 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
  
         /* Allow service/style information on the auth context */
         monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -108,7 +108,7 @@ index eabc1e89b..08fddabd7 100644
         monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
  
  #ifdef USE_PAM
-@@ -850,16 +853,42 @@ mm_answer_authserv(int sock, struct sshbuf *m)
+@@ -852,16 +855,42 @@ mm_answer_authserv(struct ssh *ssh, int sock, struct sshbuf *m)
         monitor_permit_authentications(1);
  
         if ((r = sshbuf_get_cstring(m, &authctxt->service, NULL)) != 0 ||
@@ -135,7 +135,7 @@ index eabc1e89b..08fddabd7 100644
 +}
 +
 +int
-+mm_answer_authrole(int sock, struct sshbuf *m)
++mm_answer_authrole(struct ssh *ssh, int sock, struct sshbuf *m)
 +{
 +       int r;
 +
@@ -154,7 +154,7 @@ index eabc1e89b..08fddabd7 100644
         return (0);
  }
  
-@@ -1501,7 +1530,7 @@ mm_answer_pty(int sock, struct sshbuf *m)
+@@ -1528,7 +1557,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m)
         res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
         if (res == 0)
                 goto error;
@@ -164,23 +164,23 @@ index eabc1e89b..08fddabd7 100644
         if ((r = sshbuf_put_u32(m, 1)) != 0 ||
             (r = sshbuf_put_cstring(m, s->tty)) != 0)
 diff --git a/monitor.h b/monitor.h
-index 44fbed589..8f65e684d 100644
+index 2b1a2d590..4d87284aa 100644
 --- a/monitor.h
 +++ b/monitor.h
-@@ -66,6 +66,8 @@ enum monitor_reqtype {
+@@ -65,6 +65,8 @@ enum monitor_reqtype {
+ 
         MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
         MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
- 
-+       MONITOR_REQ_AUTHROLE = 154,
 +
++       MONITOR_REQ_AUTHROLE = 154,
  };
  
- struct monitor {
+ struct ssh;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 1865a122a..fd4d7eb3b 100644
+index 8e4c1c1f8..6b3a6251c 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -369,10 +369,10 @@ mm_auth2_read_banner(void)
+@@ -364,10 +364,10 @@ mm_auth2_read_banner(void)
         return (banner);
  }
  
@@ -193,7 +193,7 @@ index 1865a122a..fd4d7eb3b 100644
  {
         struct sshbuf *m;
         int r;
-@@ -382,7 +382,8 @@ mm_inform_authserv(char *service, char *style)
+@@ -377,7 +377,8 @@ mm_inform_authserv(char *service, char *style)
         if ((m = sshbuf_new()) == NULL)
                 fatal("%s: sshbuf_new failed", __func__);
         if ((r = sshbuf_put_cstring(m, service)) != 0 ||
@@ -203,7 +203,7 @@ index 1865a122a..fd4d7eb3b 100644
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
         mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, m);
-@@ -390,6 +391,26 @@ mm_inform_authserv(char *service, char *style)
+@@ -385,6 +386,26 @@ mm_inform_authserv(char *service, char *style)
         sshbuf_free(m);
  }
  
@@ -231,17 +231,17 @@ index 1865a122a..fd4d7eb3b 100644
  int
  mm_auth_password(struct ssh *ssh, char *password)
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 7f93144ff..79e78cc90 100644
+index 69164a8c0..3d0e32d48 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
-@@ -43,7 +43,8 @@ int mm_is_monitor(void);
+@@ -44,7 +44,8 @@ int mm_is_monitor(void);
  DH *mm_choose_dh(int, int, int);
- int mm_sshkey_sign(struct sshkey *, u_char **, size_t *, const u_char *, size_t,
-     const char *, u_int compat);
+ int mm_sshkey_sign(struct ssh *, struct sshkey *, u_char **, size_t *,
+     const u_char *, size_t, const char *, u_int compat);
 -void mm_inform_authserv(char *, char *);
 +void mm_inform_authserv(char *, char *, char *);
 +void mm_inform_authrole(char *);
- struct passwd *mm_getpwnamallow(const char *);
+ struct passwd *mm_getpwnamallow(struct ssh *, const char *);
  char *mm_auth2_read_banner(void);
  int mm_auth_password(struct ssh *, char *);
 diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
@@ -363,10 +363,10 @@ index ea4f9c584..60d72ffe7 100644
  char *platform_krb5_get_principal_name(const char *);
  int platform_sys_dir_uid(uid_t);
 diff --git a/session.c b/session.c
-index 2d0958d11..19f38637e 100644
+index ac3d9d19d..d87ea4d44 100644
 --- a/session.c
 +++ b/session.c
-@@ -1380,7 +1380,7 @@ safely_chroot(const char *path, uid_t uid)
+@@ -1356,7 +1356,7 @@ safely_chroot(const char *path, uid_t uid)
  
  /* Set login name, uid, gid, and groups. */
  void
@@ -375,7 +375,7 @@ index 2d0958d11..19f38637e 100644
  {
         char uidstr[32], *chroot_path, *tmp;
  
-@@ -1408,7 +1408,7 @@ do_setusercontext(struct passwd *pw)
+@@ -1384,7 +1384,7 @@ do_setusercontext(struct passwd *pw)
                 endgrent();
  #endif
  
@@ -384,7 +384,7 @@ index 2d0958d11..19f38637e 100644
  
                 if (!in_chroot && options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
-@@ -1547,7 +1547,7 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+@@ -1525,7 +1525,7 @@ do_child(struct ssh *ssh, Session *s, const char *command)
  
         /* Force a password change */
         if (s->authctxt->force_pwchange) {
@@ -393,7 +393,7 @@ index 2d0958d11..19f38637e 100644
                 child_close_fds(ssh);
                 do_pwchange(s);
                 exit(1);
-@@ -1565,7 +1565,7 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+@@ -1543,7 +1543,7 @@ do_child(struct ssh *ssh, Session *s, const char *command)
         /* When PAM is enabled we rely on it to do the nologin check */
         if (!options.use_pam)
                 do_nologin(pw);
@@ -402,8 +402,8 @@ index 2d0958d11..19f38637e 100644
         /*
          * PAM session modules in do_setusercontext may have
          * generated messages, so if this in an interactive
-@@ -1955,7 +1955,7 @@ session_pty_req(struct ssh *ssh, Session *s)
-        ssh_tty_parse_modes(ssh, s->ttyfd);
+@@ -1942,7 +1942,7 @@ session_pty_req(struct ssh *ssh, Session *s)
+                sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
  
         if (!use_privsep)
 -               pty_setowner(s->pw, s->tty);
@@ -425,10 +425,10 @@ index ce59dabd9..675c91146 100644
  const char     *session_get_remote_name_or_ip(struct ssh *, u_int, int);
  
 diff --git a/sshd.c b/sshd.c
-index 673db87f6..2bc6679e5 100644
+index 46870d3b5..e3e96426e 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -683,7 +683,7 @@ privsep_postauth(Authctxt *authctxt)
+@@ -594,7 +594,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
         reseed_prngs();
  
         /* Drop privileges */
diff --git a/debian/patches/series b/debian/patches/series
index b0da97283..6304f537a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -24,11 +24,4 @@ restore-authorized_keys2.patch
 seccomp-s390-flock-ipc.patch
 seccomp-s390-ioctl-ep11-crypto.patch
 conch-old-privkey-format.patch
-scp-disallow-dot-or-empty-filename.patch
-sanitize-scp-filenames-via-snmprintf.patch
-have-progressmeter-force-update-at-beginning-and-end-transfer.patch
-check-filenames-in-scp-client.patch
-fix-key-type-check.patch
-request-rsa-sha2-cert-signatures.patch
-scp-handle-braces.patch
 revert-ipqos-defaults.patch
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index ad574e829..2224eeead 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From cabad6b7182cd6eaa8b760718200a316e7f578ed Mon Sep 17 00:00:00 2001
+From b019e32a0ee7a79c0a08cb1199229d03b16934a7 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
@@ -16,10 +16,10 @@ Patch-Name: shell-path.patch
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index 6d819279e..700ea6c3c 100644
+index fdcdcd855..103d84e38 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -229,7 +229,7 @@ ssh_proxy_connect(struct ssh *ssh, const char *host, u_short port,
+@@ -257,7 +257,7 @@ ssh_proxy_connect(struct ssh *ssh, const char *host, u_short port,
                 /* Execute the proxy command.  Note that we gave up any
                    extra privileges above. */
                 signal(SIGPIPE, SIG_DFL);
@@ -28,7 +28,7 @@ index 6d819279e..700ea6c3c 100644
                 perror(argv[0]);
                 exit(1);
         }
-@@ -1534,7 +1534,7 @@ ssh_local_cmd(const char *args)
+@@ -1382,7 +1382,7 @@ ssh_local_cmd(const char *args)
         if (pid == 0) {
                 signal(SIGPIPE, SIG_DFL);
                 debug3("Executing %s -c \"%s\"", shell, args);
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index ed6ef3d46..e94e48a03 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 6d4521d39a852dc5627187c045c933f4e1cb4601 Mon Sep 17 00:00:00 2001
+From 9e040aefaefa40bcbe5dcdc0f9f03555cf8fe2d0 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index bb1e10973..a5aa9259a 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From d1064c2689df8d0894a68ac9671d14ab125bc91b Mon Sep 17 00:00:00 2001
+From 23b4cc85184891ad61bb98045629400e48d946dd Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
@@ -18,10 +18,10 @@ Patch-Name: ssh-argv0.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/ssh.1 b/ssh.1
-index 5dfad6daa..ad1ed0f86 100644
+index e4aeae7b4..8d2b08a29 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1585,6 +1585,7 @@ if an error occurred.
+@@ -1584,6 +1584,7 @@ if an error occurred.
  .Xr sftp 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index ca3e090bd..8adc301fc 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -1,4 +1,4 @@
-From eccbd3637a2b8544fdcfdd5d1a00a9dfdac62aeb Mon Sep 17 00:00:00 2001
+From 0138f331a73d692f4543477ce7f64f9ede7d6b08 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:50 +0000
 Subject: Accept obsolete ssh-vulnkey configuration options
@@ -17,10 +17,10 @@ Patch-Name: ssh-vulnkey-compat.patch
  2 files changed, 2 insertions(+)
 
 diff --git a/readconf.c b/readconf.c
-index 36bc5e59a..5e655e924 100644
+index 4d699e5f1..29f3bd98d 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -190,6 +190,7 @@ static struct {
+@@ -192,6 +192,7 @@ static struct {
         { "fallbacktorsh", oDeprecated },
         { "globalknownhostsfile2", oDeprecated },
         { "rhostsauthentication", oDeprecated },
@@ -29,10 +29,10 @@ index 36bc5e59a..5e655e924 100644
         { "useroaming", oDeprecated },
         { "usersh", oDeprecated },
 diff --git a/servconf.c b/servconf.c
-index 4668b8a45..6caf1db38 100644
+index ffdad31e7..c01e0690e 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -600,6 +600,7 @@ static struct {
+@@ -621,6 +621,7 @@ static struct {
         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index 3093a41fb..aa7968090 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -1,4 +1,4 @@
-From e755ec70d62bfb9b02159123f4e870b00010be77 Mon Sep 17 00:00:00 2001
+From 0646a0cd5ea893cf822113d4f10c501540c18e40 Mon Sep 17 00:00:00 2001
 From: Jonathan David Amery <jdamery@ysolde.ucam.org>
 Date: Sun, 9 Feb 2014 16:09:54 +0000
 Subject: "LogLevel SILENT" compatibility
@@ -33,10 +33,10 @@ index d9c2d136c..1749af6d1 100644
         { "FATAL",      SYSLOG_LEVEL_FATAL },
         { "ERROR",      SYSLOG_LEVEL_ERROR },
 diff --git a/ssh.c b/ssh.c
-index 0777c31e4..3140fed4c 100644
+index 42be7d88f..86f143341 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -1258,7 +1258,7 @@ main(int ac, char **av)
+@@ -1265,7 +1265,7 @@ main(int ac, char **av)
         /* Do not allocate a tty if stdin is not a tty. */
         if ((!isatty(fileno(stdin)) || stdin_null_flag) &&
             options.request_tty != REQUEST_TTY_FORCE) {
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
index c5dee41ad..51c7e32de 100644
--- a/debian/patches/systemd-readiness.patch
+++ b/debian/patches/systemd-readiness.patch
@@ -1,4 +1,4 @@
-From da34947128351bee9d2530574432190548f5be58 Mon Sep 17 00:00:00 2001
+From a88f67584ef5889d95c04b0294e92c11ed4904cd Mon Sep 17 00:00:00 2001
 From: Michael Biebl <biebl@debian.org>
 Date: Mon, 21 Dec 2015 16:08:47 +0000
 Subject: Add systemd readiness notification support
@@ -14,10 +14,10 @@ Patch-Name: systemd-readiness.patch
  2 files changed, 33 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 917300b43..8a5db4cb5 100644
+index ce16e7758..de140f578 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4586,6 +4586,29 @@ AC_ARG_WITH([kerberos5],
+@@ -4526,6 +4526,29 @@ AC_ARG_WITH([kerberos5],
  AC_SUBST([GSSLIBS])
  AC_SUBST([K5LIBS])
  
@@ -47,7 +47,7 @@ index 917300b43..8a5db4cb5 100644
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -5392,6 +5415,7 @@ echo "                   libldns support: $LDNS_MSG"
+@@ -5332,6 +5355,7 @@ echo "                   libldns support: $LDNS_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
  echo "         Solaris privilege support: $SPP_MSG"
@@ -56,7 +56,7 @@ index 917300b43..8a5db4cb5 100644
  echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
  echo "                  BSD Auth support: $BSD_AUTH_MSG"
 diff --git a/sshd.c b/sshd.c
-index d7e77d343..a1c3970b3 100644
+index 1e7ece588..48162b629 100644
 --- a/sshd.c
 +++ b/sshd.c
 @@ -85,6 +85,10 @@
@@ -70,7 +70,7 @@ index d7e77d343..a1c3970b3 100644
  #include "xmalloc.h"
  #include "ssh.h"
  #include "ssh2.h"
-@@ -1990,6 +1994,11 @@ main(int ac, char **av)
+@@ -1946,6 +1950,11 @@ main(int ac, char **av)
                         }
                 }
  
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index bc2390e06..899c60123 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From 7b931d36ad36a93d2b1811858ca29408ec44ecae Mon Sep 17 00:00:00 2001
+From e04a43bd5798ba43d910493d179438845e96f631 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability
@@ -13,7 +13,7 @@ default.
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
-Last-Update: 2017-10-04
+Last-Update: 2019-06-05
 
 Patch-Name: user-group-modes.patch
 ---
@@ -51,7 +51,7 @@ index 57296e1f6..546aa0495 100644
                             pw->pw_name, buf);
                         auth_debug_add("Bad file modes for %.200s", buf);
 diff --git a/auth.c b/auth.c
-index d8e6b4a3d..9d1d453f1 100644
+index f7a23afba..8ffd77662 100644
 --- a/auth.c
 +++ b/auth.c
 @@ -473,8 +473,7 @@ check_key_in_hostfiles(struct passwd *pw, struct sshkey *key, const char *host,
@@ -65,10 +65,10 @@ index d8e6b4a3d..9d1d453f1 100644
                             "bad owner or modes for %.200s",
                             pw->pw_name, user_hostfile);
 diff --git a/misc.c b/misc.c
-index bdc06fdb3..5159e6692 100644
+index 009e02bc5..634b5060a 100644
 --- a/misc.c
 +++ b/misc.c
-@@ -58,8 +58,9 @@
+@@ -59,8 +59,9 @@
  #include <netdb.h>
  #ifdef HAVE_PATHS_H
  # include <paths.h>
@@ -79,7 +79,7 @@ index bdc06fdb3..5159e6692 100644
  #ifdef SSH_TUN_OPENBSD
  #include <net/if.h>
  #endif
-@@ -1028,6 +1029,55 @@ percent_expand(const char *string, ...)
+@@ -1103,6 +1104,55 @@ percent_expand(const char *string, ...)
  #undef EXPAND_MAX_KEYS
  }
  
@@ -135,7 +135,7 @@ index bdc06fdb3..5159e6692 100644
  int
  tun_open(int tun, int mode, char **ifname)
  {
-@@ -1786,8 +1836,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir,
+@@ -1860,8 +1910,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir,
                 snprintf(err, errlen, "%s is not a regular file", buf);
                 return -1;
         }
@@ -145,7 +145,7 @@ index bdc06fdb3..5159e6692 100644
                 snprintf(err, errlen, "bad ownership or modes for file %s",
                     buf);
                 return -1;
-@@ -1802,8 +1851,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir,
+@@ -1876,8 +1925,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir,
                 strlcpy(buf, cp, sizeof(buf));
  
                 if (stat(buf, &st) < 0 ||
@@ -156,10 +156,10 @@ index bdc06fdb3..5159e6692 100644
                             "bad ownership or modes for directory %s", buf);
                         return -1;
 diff --git a/misc.h b/misc.h
-index 31b207a8d..aaf966e65 100644
+index 5b4325aba..a4bdee187 100644
 --- a/misc.h
 +++ b/misc.h
-@@ -168,6 +168,8 @@ int  safe_path_fd(int, const char *, struct passwd *,
+@@ -175,6 +175,8 @@ int  safe_path_fd(int, const char *, struct passwd *,
  char   *read_passphrase(const char *, int);
  int     ask_permission(const char *, ...) __attribute__((format(printf, 1, 2)));
  
@@ -169,10 +169,10 @@ index 31b207a8d..aaf966e65 100644
  #define MAXIMUM(a, b)  (((a) > (b)) ? (a) : (b))
  #define ROUNDUP(x, y)   ((((x)+((y)-1))/(y))*(y))
 diff --git a/readconf.c b/readconf.c
-index 052d4b1ac..6b01f20d2 100644
+index 3d0b6ff90..cd60007f8 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -1820,8 +1820,7 @@ read_config_file_depth(const char *filename, struct passwd *pw,
+@@ -1846,8 +1846,7 @@ read_config_file_depth(const char *filename, struct passwd *pw,
  
                 if (fstat(fileno(f), &sb) == -1)
                         fatal("fstat %s: %s", filename, strerror(errno));
@@ -183,10 +183,10 @@ index 052d4b1ac..6b01f20d2 100644
         }
  
 diff --git a/ssh.1 b/ssh.1
-index 7760c3075..81f29af43 100644
+index a1c7d2305..64ead5f57 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1485,6 +1485,8 @@ The file format and configuration options are described in
+@@ -1484,6 +1484,8 @@ The file format and configuration options are described in
  .Xr ssh_config 5 .
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not writable by others.
@@ -196,13 +196,13 @@ index 7760c3075..81f29af43 100644
  .It Pa ~/.ssh/environment
  Contains additional definitions for environment variables; see
 diff --git a/ssh_config.5 b/ssh_config.5
-index 54e143c93..7d55fa820 100644
+index 250c92d04..bd1e9311d 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1835,6 +1835,8 @@ The format of this file is described above.
+@@ -1885,6 +1885,8 @@ The format of this file is described above.
  This file is used by the SSH client.
  Because of the potential for abuse, this file must have strict permissions:
- read/write for the user, and not accessible by others.
+ read/write for the user, and not writable by others.
 +It may be group-writable provided that the group in question contains only
 +the user.
  .It Pa /etc/ssh/ssh_config