29 files changed, 464 insertions, 687 deletions

diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index 84a14cfb8..491656be2 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -1,4 +1,4 @@
-From 1ecd5db58295874d8b9a7ce98fe1880ab08fbcaf Mon Sep 17 00:00:00 2001
+From c9c2ebb4680ea6872218b1e4519fe31a2043a27a Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:02 +0000
 Subject: Quieten logs when multiple from= restrictions are used
@@ -16,10 +16,10 @@ Patch-Name: auth-log-verbosity.patch
  4 files changed, 32 insertions(+), 9 deletions(-)
 
 diff --git a/auth-options.c b/auth-options.c
-index f3d9c9d..d4d22d7 100644
+index 4f0da9c..3fa236e 100644
 --- a/auth-options.c
 +++ b/auth-options.c
-@@ -54,9 +54,20 @@ int forced_tun_device = -1;
+@@ -58,9 +58,20 @@ int forced_tun_device = -1;
  /* "principals=" option. */
  char *authorized_principals = NULL;
  
@@ -40,7 +40,7 @@ index f3d9c9d..d4d22d7 100644
  auth_clear_options(void)
  {
         no_agent_forwarding_flag = 0;
-@@ -284,10 +295,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
+@@ -288,10 +299,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                                 /* FALLTHROUGH */
                         case 0:
                                 free(patterns);
@@ -58,7 +58,7 @@ index f3d9c9d..d4d22d7 100644
                                 auth_debug_add("Your host '%.200s' is not "
                                     "permitted to use this key for login.",
                                     remote_host);
-@@ -511,11 +525,14 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
+@@ -514,11 +528,14 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw,
                                         break;
                                 case 0:
                                         /* no match */
@@ -79,7 +79,7 @@ index f3d9c9d..d4d22d7 100644
                                             "is not permitted to use this "
                                             "certificate for login.",
 diff --git a/auth-options.h b/auth-options.h
-index 7455c94..a3f0a02 100644
+index 34852e5..1653855 100644
 --- a/auth-options.h
 +++ b/auth-options.h
 @@ -33,6 +33,7 @@ extern int forced_tun_device;
@@ -89,12 +89,12 @@ index 7455c94..a3f0a02 100644
 +void   auth_start_parse_options(void);
  int    auth_parse_options(struct passwd *, char *, char *, u_long);
  void   auth_clear_options(void);
- int    auth_cert_options(Key *, struct passwd *);
+ int    auth_cert_options(struct sshkey *, struct passwd *);
 diff --git a/auth-rsa.c b/auth-rsa.c
-index e9f4ede..5d7bdcb 100644
+index cbd971b..4cf2163 100644
 --- a/auth-rsa.c
 +++ b/auth-rsa.c
-@@ -179,6 +179,8 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,
+@@ -181,6 +181,8 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,
         if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL)
                 return 0;
  
@@ -104,10 +104,10 @@ index e9f4ede..5d7bdcb 100644
          * Go though the accepted keys, looking for the current key.  If
          * found, perform a challenge-response dialog to verify that the
 diff --git a/auth2-pubkey.c b/auth2-pubkey.c
-index f3ca965..f78b046 100644
+index d943efa..0bda5c9 100644
 --- a/auth2-pubkey.c
 +++ b/auth2-pubkey.c
-@@ -263,6 +263,7 @@ match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert)
+@@ -282,6 +282,7 @@ match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert)
                 restore_uid();
                 return 0;
         }
@@ -115,7 +115,7 @@ index f3ca965..f78b046 100644
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 /* Skip leading whitespace. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-@@ -324,6 +325,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
+@@ -343,6 +344,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
         found_key = 0;
  
         found = NULL;
@@ -123,7 +123,7 @@ index f3ca965..f78b046 100644
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp, *key_options = NULL;
                 if (found != NULL)
-@@ -459,6 +461,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
+@@ -482,6 +484,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
         if (key_cert_check_authority(key, 0, 1,
             principals_file == NULL ? pw->pw_name : NULL, &reason) != 0)
                 goto fail_reason;
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 6afb0420b..eb398f6a4 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From 19b0441502c07401dd6d418f8f81cc7f1a44ccb1 Mon Sep 17 00:00:00 2001
+From 8a1a563ee326222155c74454e11e6ed62297c403 Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
@@ -13,10 +13,10 @@ Patch-Name: authorized-keys-man-symlink.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/Makefile.in b/Makefile.in
-index c4cb8ea..a4402e9 100644
+index c406aec..37cb023 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -309,6 +309,7 @@ install-files:
+@@ -325,6 +325,7 @@ install-files:
         $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
         $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
         $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/consolekit.patch b/debian/patches/consolekit.patch
index e50c77f62..0438b8f74 100644
--- a/debian/patches/consolekit.patch
+++ b/debian/patches/consolekit.patch
@@ -1,15 +1,14 @@
-From f51fe0c55e54c12db952624e980d18f39c41e581 Mon Sep 17 00:00:00 2001
+From 8b3111d597316954caaf8ddf2e7746491976c248 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:57 +0000
 Subject: Add support for registering ConsoleKit sessions on login
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1450
-Last-Updated: 2014-10-07
+Last-Updated: 2015-08-19
 
 Patch-Name: consolekit.patch
 ---
  Makefile.in    |   3 +-
- configure      | 132 +++++++++++++++++++++++++++++++
  configure.ac   |  25 ++++++
  consolekit.c   | 241 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  consolekit.h   |  24 ++++++
@@ -19,15 +18,15 @@ Patch-Name: consolekit.patch
  monitor_wrap.h |   4 +
  session.c      |  13 ++++
  session.h      |   6 ++
- 11 files changed, 521 insertions(+), 1 deletion(-)
+ 10 files changed, 389 insertions(+), 1 deletion(-)
  create mode 100644 consolekit.c
  create mode 100644 consolekit.h
 
 diff --git a/Makefile.in b/Makefile.in
-index 086d8dd..c4cb8ea 100644
+index 3d2a328..c406aec 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -107,7 +107,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
+@@ -111,7 +111,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
         sftp-server.o sftp-common.o \
         roaming_common.o roaming_serv.o \
         sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
@@ -37,175 +36,11 @@ index 086d8dd..c4cb8ea 100644
  
  MANPAGES       = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
  MANPAGES_IN    = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
-diff --git a/configure b/configure
-index ea5f200..7be478a 100755
---- a/configure
-+++ b/configure
-@@ -739,6 +739,7 @@ with_privsep_user
- with_sandbox
- with_selinux
- with_kerberos5
-+with_consolekit
- with_privsep_path
- with_xauth
- enable_strip
-@@ -1430,6 +1431,7 @@ Optional Packages:
-   --with-sandbox=style    Specify privilege separation sandbox (no, darwin, rlimit, systrace, seccomp_filter, capsicum)
-   --with-selinux          Enable SELinux support
-   --with-kerberos5=PATH   Enable Kerberos 5 support
-+  --with-consolekit       Enable ConsoleKit support
-   --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)
-   --with-xauth=PATH       Specify path to xauth program
-   --with-maildir=/path/to/mail    Specify your system mail directory
-@@ -17211,6 +17213,135 @@ fi
- 
- 
- 
-+# Check whether user wants ConsoleKit support
-+CONSOLEKIT_MSG="no"
-+LIBCK_CONNECTOR=""
-+
-+# Check whether --with-consolekit was given.
-+if test "${with_consolekit+set}" = set; then :
-+  withval=$with_consolekit;  if test "x$withval" != "xno" ; then
-+               if test -n "$ac_tool_prefix"; then
-+  # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args.
-+set dummy ${ac_tool_prefix}pkg-config; ac_word=$2
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-+$as_echo_n "checking for $ac_word... " >&6; }
-+if ${ac_cv_path_PKGCONFIG+:} false; then :
-+  $as_echo_n "(cached) " >&6
-+else
-+  case $PKGCONFIG in
-+  [\\/]* | ?:[\\/]*)
-+  ac_cv_path_PKGCONFIG="$PKGCONFIG" # Let the user override the test with a path.
-+  ;;
-+  *)
-+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-+for as_dir in $PATH
-+do
-+  IFS=$as_save_IFS
-+  test -z "$as_dir" && as_dir=.
-+    for ac_exec_ext in '' $ac_executable_extensions; do
-+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
-+    ac_cv_path_PKGCONFIG="$as_dir/$ac_word$ac_exec_ext"
-+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-+    break 2
-+  fi
-+done
-+  done
-+IFS=$as_save_IFS
-+
-+  ;;
-+esac
-+fi
-+PKGCONFIG=$ac_cv_path_PKGCONFIG
-+if test -n "$PKGCONFIG"; then
-+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PKGCONFIG" >&5
-+$as_echo "$PKGCONFIG" >&6; }
-+else
-+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-+$as_echo "no" >&6; }
-+fi
-+
-+
-+fi
-+if test -z "$ac_cv_path_PKGCONFIG"; then
-+  ac_pt_PKGCONFIG=$PKGCONFIG
-+  # Extract the first word of "pkg-config", so it can be a program name with args.
-+set dummy pkg-config; ac_word=$2
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-+$as_echo_n "checking for $ac_word... " >&6; }
-+if ${ac_cv_path_ac_pt_PKGCONFIG+:} false; then :
-+  $as_echo_n "(cached) " >&6
-+else
-+  case $ac_pt_PKGCONFIG in
-+  [\\/]* | ?:[\\/]*)
-+  ac_cv_path_ac_pt_PKGCONFIG="$ac_pt_PKGCONFIG" # Let the user override the test with a path.
-+  ;;
-+  *)
-+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-+for as_dir in $PATH
-+do
-+  IFS=$as_save_IFS
-+  test -z "$as_dir" && as_dir=.
-+    for ac_exec_ext in '' $ac_executable_extensions; do
-+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
-+    ac_cv_path_ac_pt_PKGCONFIG="$as_dir/$ac_word$ac_exec_ext"
-+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-+    break 2
-+  fi
-+done
-+  done
-+IFS=$as_save_IFS
-+
-+  ;;
-+esac
-+fi
-+ac_pt_PKGCONFIG=$ac_cv_path_ac_pt_PKGCONFIG
-+if test -n "$ac_pt_PKGCONFIG"; then
-+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKGCONFIG" >&5
-+$as_echo "$ac_pt_PKGCONFIG" >&6; }
-+else
-+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-+$as_echo "no" >&6; }
-+fi
-+
-+  if test "x$ac_pt_PKGCONFIG" = x; then
-+    PKGCONFIG="no"
-+  else
-+    case $cross_compiling:$ac_tool_warned in
-+yes:)
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
-+ac_tool_warned=yes ;;
-+esac
-+    PKGCONFIG=$ac_pt_PKGCONFIG
-+  fi
-+else
-+  PKGCONFIG="$ac_cv_path_PKGCONFIG"
-+fi
-+
-+               if test "$PKGCONFIG" != "no"; then
-+                       { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ck-connector" >&5
-+$as_echo_n "checking for ck-connector... " >&6; }
-+                       if $PKGCONFIG --exists ck-connector; then
-+                               CKCON_CFLAGS=`$PKGCONFIG --cflags ck-connector`
-+                               CKCON_LIBS=`$PKGCONFIG --libs ck-connector`
-+                               CPPFLAGS="$CPPFLAGS $CKCON_CFLAGS"
-+                               SSHDLIBS="$SSHDLIBS $CKCON_LIBS"
-+                               { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-+$as_echo "yes" >&6; }
-+
-+$as_echo "#define USE_CONSOLEKIT 1" >>confdefs.h
-+
-+                               CONSOLEKIT_MSG="yes"
-+                       else
-+                               { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-+$as_echo "no" >&6; }
-+                       fi
-+               fi
-+       fi
-+
-+fi
-+
-+
- # Looking for programs, paths and files
- 
- PRIVSEP_PATH=/var/empty
-@@ -19739,6 +19870,7 @@ echo "              MD5 password support: $MD5_MSG"
- echo "                   libedit support: $LIBEDIT_MSG"
- echo "  Solaris process contract support: $SPC_MSG"
- echo "           Solaris project support: $SP_MSG"
-+echo "                ConsoleKit support: $CONSOLEKIT_MSG"
- echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
- echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
- echo "                  BSD Auth support: $BSD_AUTH_MSG"
 diff --git a/configure.ac b/configure.ac
-index 7f160f1..f5c65c5 100644
+index 5f606ea..f7ce777 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4113,6 +4113,30 @@ AC_ARG_WITH([kerberos5],
+@@ -4180,6 +4180,30 @@ AC_ARG_WITH([kerberos5],
  AC_SUBST([GSSLIBS])
  AC_SUBST([K5LIBS])
  
@@ -236,7 +71,7 @@ index 7f160f1..f5c65c5 100644
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -4914,6 +4938,7 @@ echo "              MD5 password support: $MD5_MSG"
+@@ -4981,6 +5005,7 @@ echo "              MD5 password support: $MD5_MSG"
  echo "                   libedit support: $LIBEDIT_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
@@ -522,20 +357,20 @@ index 0000000..8ce3716
 +
 +#endif /* USE_CONSOLEKIT */
 diff --git a/monitor.c b/monitor.c
-index 94b194d..cc15ce4 100644
+index 6ff05e4..ce7ba07 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -100,6 +100,9 @@
- #include "ssh2.h"
- #include "roaming.h"
+@@ -104,6 +104,9 @@
  #include "authfd.h"
+ #include "match.h"
+ #include "ssherr.h"
 +#ifdef USE_CONSOLEKIT
 +#include "consolekit.h"
 +#endif
  
  #ifdef GSSAPI
  static Gssctxt *gsscontext = NULL;
-@@ -190,6 +193,10 @@ int mm_answer_audit_command(int, Buffer *);
+@@ -169,6 +172,10 @@ int mm_answer_audit_command(int, Buffer *);
  
  static int monitor_read_log(struct monitor *);
  
@@ -546,7 +381,7 @@ index 94b194d..cc15ce4 100644
  static Authctxt *authctxt;
  
  #ifdef WITH_SSH1
-@@ -282,6 +289,9 @@ struct mon_table mon_dispatch_postauth20[] = {
+@@ -261,6 +268,9 @@ struct mon_table mon_dispatch_postauth20[] = {
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
  #endif
@@ -556,7 +391,7 @@ index 94b194d..cc15ce4 100644
      {0, 0, NULL}
  };
  
-@@ -327,6 +337,9 @@ struct mon_table mon_dispatch_postauth15[] = {
+@@ -306,6 +316,9 @@ struct mon_table mon_dispatch_postauth15[] = {
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
  #endif
@@ -566,7 +401,7 @@ index 94b194d..cc15ce4 100644
  #endif /* WITH_SSH1 */
      {0, 0, NULL}
  };
-@@ -509,6 +522,9 @@ monitor_child_postauth(struct monitor *pmonitor)
+@@ -488,6 +501,9 @@ monitor_child_postauth(struct monitor *pmonitor)
                 monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1);
         }
@@ -576,7 +411,7 @@ index 94b194d..cc15ce4 100644
  
         for (;;)
                 monitor_read(pmonitor, mon_dispatch, NULL);
-@@ -2296,3 +2312,29 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) {
+@@ -2187,3 +2203,29 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) {
  
  #endif /* GSSAPI */
  
@@ -607,7 +442,7 @@ index 94b194d..cc15ce4 100644
 +}
 +#endif /* USE_CONSOLEKIT */
 diff --git a/monitor.h b/monitor.h
-index 4d5e8fa..10ba59e 100644
+index 2d82b8b..fd8d92c 100644
 --- a/monitor.h
 +++ b/monitor.h
 @@ -70,6 +70,8 @@ enum monitor_reqtype {
@@ -620,10 +455,10 @@ index 4d5e8fa..10ba59e 100644
  
  struct mm_master;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 6dc890a..4c57d4d 100644
+index 5aa9c47..a5f4e9d 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -1363,3 +1363,33 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
+@@ -1150,3 +1150,33 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
  
  #endif /* GSSAPI */
  
@@ -658,11 +493,11 @@ index 6dc890a..4c57d4d 100644
 +}
 +#endif /* USE_CONSOLEKIT */
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 9c2ee49..00e93fe 100644
+index 4d1e899..f99c31c 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
-@@ -111,4 +111,8 @@ void *mm_zalloc(struct mm_master *, u_int, u_int);
- void mm_zfree(struct mm_master *, void *);
+@@ -108,4 +108,8 @@ int mm_skey_respond(void *, u_int, char **);
+ /* zlib allocation hooks */
  void mm_init_compression(struct mm_master *);
  
 +#ifdef USE_CONSOLEKIT
@@ -671,10 +506,10 @@ index 9c2ee49..00e93fe 100644
 +
  #endif /* _MM_WRAP_H_ */
 diff --git a/session.c b/session.c
-index 6f389ac..6250c20 100644
+index d4b7725..785833f 100644
 --- a/session.c
 +++ b/session.c
-@@ -93,6 +93,7 @@
+@@ -94,6 +94,7 @@
  #include "kex.h"
  #include "monitor_wrap.h"
  #include "sftp.h"
@@ -682,7 +517,7 @@ index 6f389ac..6250c20 100644
  
  #if defined(KRB5) && defined(USE_AFS)
  #include <kafs.h>
-@@ -1143,6 +1144,9 @@ do_setup_env(Session *s, const char *shell)
+@@ -1144,6 +1145,9 @@ do_setup_env(Session *s, const char *shell)
  #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
         char *path = NULL;
  #endif
@@ -692,7 +527,7 @@ index 6f389ac..6250c20 100644
  
         /* Initialize the environment. */
         envsize = 100;
-@@ -1287,6 +1291,11 @@ do_setup_env(Session *s, const char *shell)
+@@ -1288,6 +1292,11 @@ do_setup_env(Session *s, const char *shell)
                 child_set_env(&env, &envsize, "KRB5CCNAME",
                     s->authctxt->krb5_ccname);
  #endif
@@ -704,7 +539,7 @@ index 6f389ac..6250c20 100644
  #ifdef USE_PAM
         /*
          * Pull in any environment variables that may have
-@@ -2350,6 +2359,10 @@ session_pty_cleanup2(Session *s)
+@@ -2351,6 +2360,10 @@ session_pty_cleanup2(Session *s)
  
         debug("session_pty_cleanup: session %d release %s", s->self, s->tty);
  
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index ab64cbed5..5bc70a566 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From 114c8a8fb488cbe39507edb75c51198a4b9e8b24 Mon Sep 17 00:00:00 2001
+From 2c31a85436f1eac46e185382c2aa15406ae6c0ac Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
@@ -8,7 +8,7 @@ initial protocol handshake, for those scared by package-versioning.patch.
 
 Bug-Debian: http://bugs.debian.org/562048
 Forwarded: not-needed
-Last-Update: 2014-10-07
+Last-Update: 2015-08-19
 
 Patch-Name: debian-banner.patch
 ---
@@ -19,45 +19,45 @@ Patch-Name: debian-banner.patch
  4 files changed, 18 insertions(+), 1 deletion(-)
 
 diff --git a/servconf.c b/servconf.c
-index a252487..6c7741a 100644
+index b3a2841..bec53e0 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -160,6 +160,7 @@ initialize_server_options(ServerOptions *options)
-        options->ip_qos_interactive = -1;
+@@ -166,6 +166,7 @@ initialize_server_options(ServerOptions *options)
         options->ip_qos_bulk = -1;
         options->version_addendum = NULL;
+        options->fingerprint_hash = -1;
 +       options->debian_banner = -1;
  }
  
- void
-@@ -321,6 +322,8 @@ fill_default_server_options(ServerOptions *options)
-                options->fwd_opts.streamlocal_bind_mask = 0177;
-        if (options->fwd_opts.streamlocal_bind_unlink == -1)
+ /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
+@@ -342,6 +343,8 @@ fill_default_server_options(ServerOptions *options)
                 options->fwd_opts.streamlocal_bind_unlink = 0;
+        if (options->fingerprint_hash == -1)
+                options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
 +       if (options->debian_banner == -1)
 +               options->debian_banner = 1;
         /* Turn privilege separation on by default */
         if (use_privsep == -1)
                 use_privsep = PRIVSEP_NOSANDBOX;
-@@ -373,6 +376,7 @@ typedef enum {
+@@ -412,6 +415,7 @@ typedef enum {
         sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
         sStreamLocalBindMask, sStreamLocalBindUnlink,
-        sAllowStreamLocalForwarding,
+        sAllowStreamLocalForwarding, sFingerprintHash,
 +       sDebianBanner,
         sDeprecated, sUnsupported
  } ServerOpCodes;
  
-@@ -514,6 +518,7 @@ static struct {
-        { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL },
+@@ -556,6 +560,7 @@ static struct {
         { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
         { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
+        { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
 +       { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
  };
  
-@@ -1697,6 +1702,10 @@ process_server_config_line(ServerOptions *options, char *line,
-                intptr = &options->fwd_opts.streamlocal_bind_unlink;
-                goto parse_flag;
+@@ -1777,6 +1782,10 @@ process_server_config_line(ServerOptions *options, char *line,
+                        options->fingerprint_hash = value;
+                break;
  
 +       case sDebianBanner:
 +               intptr = &options->debian_banner;
@@ -67,23 +67,23 @@ index a252487..6c7741a 100644
                 logit("%s line %d: Deprecated option %s",
                     filename, linenum, arg);
 diff --git a/servconf.h b/servconf.h
-index f8265a8..fa48804 100644
+index d2ed4d7..ed0f171 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -188,6 +188,8 @@ typedef struct {
- 
-        u_int   num_auth_methods;
+@@ -192,6 +192,8 @@ typedef struct {
         char   *auth_methods[MAX_AUTH_METHODS];
+ 
+        int     fingerprint_hash;
 +
 +       int     debian_banner;
  }       ServerOptions;
  
  /* Information about the incoming connection as used by Match */
 diff --git a/sshd.c b/sshd.c
-index 1710e71..87331c1 100644
+index c362209..5435968 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -443,7 +443,8 @@ sshd_exchange_identification(int sock_in, int sock_out)
+@@ -442,7 +442,8 @@ sshd_exchange_identification(int sock_in, int sock_out)
         }
  
         xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -94,10 +94,10 @@ index 1710e71..87331c1 100644
             options.version_addendum, newline);
  
 diff --git a/sshd_config.5 b/sshd_config.5
-index 2843048..58997d3 100644
+index d14576e..ec58635 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -447,6 +447,11 @@ or
+@@ -476,6 +476,11 @@ or
  .Dq no .
  The default is
  .Dq delayed .
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index f995717fa..a346ba678 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 581424965d2d722a991c3247d4c0bb5950cb4fc5 Mon Sep 17 00:00:00 2001
+From 8698446b972003b63dfe5dcbdb86acfe986afb85 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
@@ -22,7 +22,7 @@ debian/openssh-server.postinst.
 
 Author: Russ Allbery <rra@debian.org>
 Forwarded: not-needed
-Last-Update: 2015-03-22
+Last-Update: 2015-08-19
 
 Patch-Name: debian-config.patch
 ---
@@ -34,10 +34,10 @@ Patch-Name: debian-config.patch
  5 files changed, 51 insertions(+), 3 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index 0648867..29338b6 100644
+index 2ef8d7b..66a62f2 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -1681,7 +1681,7 @@ fill_default_options(Options * options)
+@@ -1748,7 +1748,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
@@ -71,10 +71,10 @@ index 228e5ab..c9386aa 100644
 +    GSSAPIAuthentication yes
 +    GSSAPIDelegateCredentials no
 diff --git a/ssh_config.5 b/ssh_config.5
-index a1005ba..da3c177 100644
+index 3bd80fd..da8e544 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -71,6 +71,22 @@ Since the first obtained value for each parameter is used, more
+@@ -74,6 +74,22 @@ Since the first obtained value for each parameter is used, more
  host-specific declarations should be given near the beginning of the
  file, and general defaults at the end.
  .Pp
@@ -97,7 +97,7 @@ index a1005ba..da3c177 100644
  The configuration file has the following format:
  .Pp
  Empty lines and lines starting with
-@@ -673,7 +689,8 @@ token used for the session will be set to expire after 20 minutes.
+@@ -715,7 +731,8 @@ token used for the session will be set to expire after 20 minutes.
  Remote clients will be refused access after this time.
  .Pp
  The default is
@@ -108,7 +108,7 @@ index a1005ba..da3c177 100644
  See the X11 SECURITY extension specification for full details on
  the restrictions imposed on untrusted clients.
 diff --git a/sshd_config b/sshd_config
-index d9b8594..4db32f5 100644
+index a71ad19..3391233 100644
 --- a/sshd_config
 +++ b/sshd_config
 @@ -41,6 +41,7 @@
@@ -120,7 +120,7 @@ index d9b8594..4db32f5 100644
  #StrictModes yes
  #MaxAuthTries 6
 diff --git a/sshd_config.5 b/sshd_config.5
-index 7396b23..7aa7b47 100644
+index 453d741..db1f2fd 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
 @@ -57,6 +57,31 @@ Arguments may optionally be enclosed in double quotes
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index 0212ea841..97fe79aef 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From 4ac9937c1d9f1901ab0694114d76e59a138aae96 Mon Sep 17 00:00:00 2001
+From 5cbcc7353649b84b5a7528e583458ee9473fd527 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
@@ -18,10 +18,10 @@ Patch-Name: dnssec-sshfp.patch
  3 files changed, 21 insertions(+), 6 deletions(-)
 
 diff --git a/dns.c b/dns.c
-index c4d073c..e5872c1 100644
+index f201b60..a406f58 100644
 --- a/dns.c
 +++ b/dns.c
-@@ -203,6 +203,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
+@@ -206,6 +206,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
  {
         u_int counter;
         int result;
@@ -29,7 +29,7 @@ index c4d073c..e5872c1 100644
         struct rrsetinfo *fingerprints = NULL;
  
         u_int8_t hostkey_algorithm;
-@@ -226,8 +227,19 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
+@@ -229,8 +230,19 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
                 return -1;
         }
  
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 8e6cfa575..35d589353 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From 2fd0b3814e27d584efa6df92845a7354e7c2de6c Mon Sep 17 00:00:00 2001
+From b0146d5a8c1b9d87f4255cbee40b31c938fea2f8 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
@@ -13,10 +13,10 @@ Patch-Name: doc-hash-tab-completion.patch
  1 file changed, 3 insertions(+)
 
 diff --git a/ssh_config.5 b/ssh_config.5
-index d68b45a..a1005ba 100644
+index 8abcf40..3bd80fd 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -759,6 +759,9 @@ Note that existing names and addresses in known hosts files
+@@ -801,6 +801,9 @@ Note that existing names and addresses in known hosts files
  will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch
index c1ce1bcae..8002929ab 100644
--- a/debian/patches/doc-upstart.patch
+++ b/debian/patches/doc-upstart.patch
@@ -1,4 +1,4 @@
-From 252e76b3ad6e83a798e479a2beba5be7000ff85e Mon Sep 17 00:00:00 2001
+From c679bacbff13edaa44255c4f4c32ef5bc0f4ccbc Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:12 +0000
 Subject: Refer to ssh's Upstart job as well as its init script
@@ -12,7 +12,7 @@ Patch-Name: doc-upstart.patch
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/sshd.8 b/sshd.8
-index 3538208..f8f9eac 100644
+index 8dba6cf..e198017 100644
 --- a/sshd.8
 +++ b/sshd.8
 @@ -67,7 +67,10 @@ over an insecure network.
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index 84fe03acc..79efb8971 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From 1195b028cb9f402633cfdcae6ec34bf63b4ab771 Mon Sep 17 00:00:00 2001
+From 02662744e60e6bbe532ff22c7f563026a7424b6c Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index e8cbc1083..b3c437194 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -1,4 +1,4 @@
-From 1c1b6fa17982eb622e2c4e8f4a279f2113f57413 Mon Sep 17 00:00:00 2001
+From 06879e71614170580ffa7568ec5c009f60a9d084 Mon Sep 17 00:00:00 2001
 From: Simon Wilkinson <simon@sxw.org.uk>
 Date: Sun, 9 Feb 2014 16:09:48 +0000
 Subject: GSSAPI key exchange support
@@ -17,26 +17,25 @@ have it merged into the main openssh package rather than having separate
 security history.
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2014-10-07
+Last-Updated: 2015-08-19
 
 Patch-Name: gssapi.patch
 ---
  ChangeLog.gssapi | 113 +++++++++++++++++++
- Makefile.in      |   3 +-
+ Makefile.in      |   5 +-
  auth-krb5.c      |  17 ++-
  auth2-gss.c      |  48 +++++++-
  auth2.c          |   2 +
  clientloop.c     |  13 +++
  config.h.in      |   6 +
- configure        |  57 ++++++++++
  configure.ac     |  24 ++++
  gss-genr.c       | 275 ++++++++++++++++++++++++++++++++++++++++++++-
  gss-serv-krb5.c  |  85 ++++++++++++--
  gss-serv.c       | 221 +++++++++++++++++++++++++++++++-----
  kex.c            |  16 +++
  kex.h            |  14 +++
- kexgssc.c        | 332 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
- kexgsss.c        | 290 ++++++++++++++++++++++++++++++++++++++++++++++++
+ kexgssc.c        | 336 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ kexgsss.c        | 295 ++++++++++++++++++++++++++++++++++++++++++++++++
  monitor.c        | 108 +++++++++++++++++-
  monitor.h        |   3 +
  monitor_wrap.c   |  47 +++++++-
@@ -48,13 +47,13 @@ Patch-Name: gssapi.patch
  ssh-gss.h        |  41 ++++++-
  ssh_config       |   2 +
  ssh_config.5     |  34 +++++-
- sshconnect2.c    | 124 ++++++++++++++++++++-
+ sshconnect2.c    | 124 +++++++++++++++++++-
  sshd.c           | 110 ++++++++++++++++++
  sshd_config      |   2 +
  sshd_config.5    |  28 +++++
  sshkey.c         |   3 +-
  sshkey.h         |   1 +
- 33 files changed, 2052 insertions(+), 59 deletions(-)
+ 32 files changed, 2005 insertions(+), 60 deletions(-)
  create mode 100644 ChangeLog.gssapi
  create mode 100644 kexgssc.c
  create mode 100644 kexgsss.c
@@ -179,21 +178,23 @@ index 0000000..f117a33
 +    (from jbasney AT ncsa.uiuc.edu)
 +    <gssapi-with-mic support is Bugzilla #1008>
 diff --git a/Makefile.in b/Makefile.in
-index 06be3d5..086d8dd 100644
+index 40cc7aa..3d2a328 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -82,6 +82,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
-        atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
-        monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
-        kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
-+       kexgssc.o \
-        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
-        ssh-pkcs11.o krl.o smult_curve25519_ref.o \
-        kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
-@@ -101,7 +102,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
+@@ -91,7 +91,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+        sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \
+        kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
+        kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \
+-       kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o
++       kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \
++       kexgssc.o
+ 
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+        sshconnect.o sshconnect1.o sshconnect2.o mux.o \
+@@ -105,7 +106,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
+        auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
         auth2-none.o auth2-passwd.o auth2-pubkey.o \
-        monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
-        kexc25519s.o auth-krb5.o \
+        monitor_mm.o monitor.o monitor_wrap.o auth-krb5.o \
 -       auth2-gss.o gss-serv.o gss-serv-krb5.o \
 +       auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
         loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
@@ -251,11 +252,11 @@ index 0089b18..ec47869 100644
         return (krb5_cc_resolve(ctx, ccname, ccache));
  }
 diff --git a/auth2-gss.c b/auth2-gss.c
-index 447f896..284f364 100644
+index 1ca8357..3b5036d 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.21 2014/02/26 20:28:44 djm Exp $ */
+ /* $OpenBSD: auth2-gss.c,v 1.22 2015/01/19 20:07:45 markus Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -263,9 +264,9 @@ index 447f896..284f364 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -53,6 +53,40 @@ static void input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
- static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
- static void input_gssapi_errtok(int, u_int32_t, void *);
+@@ -53,6 +53,40 @@ static int input_gssapi_mic(int type, u_int32_t plen, void *ctxt);
+ static int input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
+ static int input_gssapi_errtok(int, u_int32_t, void *);
  
 +/* 
 + * The 'gssapi_keyex' userauth mechanism.
@@ -304,7 +305,7 @@ index 447f896..284f364 100644
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -236,7 +270,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
+@@ -238,7 +272,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
  
         packet_check_eom();
  
@@ -314,7 +315,7 @@ index 447f896..284f364 100644
  
         authctxt->postponed = 0;
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
-@@ -271,7 +306,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
+@@ -274,7 +309,8 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
         gssbuf.length = buffer_len(&b);
  
         if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
@@ -324,8 +325,8 @@ index 447f896..284f364 100644
         else
                 logit("GSSAPI MIC check failed");
  
-@@ -286,6 +322,12 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
-        userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
+@@ -290,6 +326,12 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
+        return 0;
  }
  
 +Authmethod method_gsskeyex = {
@@ -338,7 +339,7 @@ index 447f896..284f364 100644
         "gssapi-with-mic",
         userauth_gssapi,
 diff --git a/auth2.c b/auth2.c
-index d9b440a..2f0d565 100644
+index 7177962..3f49bdc 100644
 --- a/auth2.c
 +++ b/auth2.c
 @@ -70,6 +70,7 @@ extern Authmethod method_passwd;
@@ -358,12 +359,12 @@ index d9b440a..2f0d565 100644
  #endif
         &method_passwd,
 diff --git a/clientloop.c b/clientloop.c
-index 397c965..f9175e3 100644
+index a9c8a90..7df9413 100644
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -111,6 +111,10 @@
- #include "msg.h"
- #include "roaming.h"
+@@ -114,6 +114,10 @@
+ #include "ssherr.h"
+ #include "hostfile.h"
  
 +#ifdef GSSAPI
 +#include "ssh-gss.h"
@@ -387,12 +388,12 @@ index 397c965..f9175e3 100644
 +
                         if (need_rekeying || packet_need_rekeying()) {
                                 debug("need rekeying");
-                                xxx_kex->done = 0;
+                                active_state->kex->done = 0;
 diff --git a/config.h.in b/config.h.in
-index 16d6206..a9a8b7a 100644
+index 7e7e38e..6c7de98 100644
 --- a/config.h.in
 +++ b/config.h.in
-@@ -1622,6 +1622,9 @@
+@@ -1623,6 +1623,9 @@
  /* Use btmp to log bad logins */
  #undef USE_BTMP
  
@@ -402,7 +403,7 @@ index 16d6206..a9a8b7a 100644
  /* Use libedit for sftp */
  #undef USE_LIBEDIT
  
-@@ -1637,6 +1640,9 @@
+@@ -1638,6 +1641,9 @@
  /* Use PIPES instead of a socketpair() */
  #undef USE_PIPES
  
@@ -412,79 +413,11 @@ index 16d6206..a9a8b7a 100644
  /* Define if you have Solaris process contracts */
  #undef USE_SOLARIS_PROCESS_CONTRACTS
  
-diff --git a/configure b/configure
-index 6815388..ea5f200 100755
---- a/configure
-+++ b/configure
-@@ -7168,6 +7168,63 @@ $as_echo "#define SSH_TUN_COMPAT_AF 1" >>confdefs.h
- 
- $as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
- 
-+       { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we have the Security Authorization Session API" >&5
-+$as_echo_n "checking if we have the Security Authorization Session API... " >&6; }
-+       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h.  */
-+#include <Security/AuthSession.h>
-+int
-+main ()
-+{
-+SessionCreate(0, 0);
-+  ;
-+  return 0;
-+}
-+_ACEOF
-+if ac_fn_c_try_compile "$LINENO"; then :
-+  ac_cv_use_security_session_api="yes"
-+
-+$as_echo "#define USE_SECURITY_SESSION_API 1" >>confdefs.h
-+
-+                LIBS="$LIBS -framework Security"
-+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-+$as_echo "yes" >&6; }
-+else
-+  ac_cv_use_security_session_api="no"
-+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-+$as_echo "no" >&6; }
-+fi
-+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-+       { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we have an in-memory credentials cache" >&5
-+$as_echo_n "checking if we have an in-memory credentials cache... " >&6; }
-+       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-+/* end confdefs.h.  */
-+#include <Kerberos/Kerberos.h>
-+int
-+main ()
-+{
-+cc_context_t c;
-+                (void) cc_initialize (&c, 0, NULL, NULL);
-+  ;
-+  return 0;
-+}
-+_ACEOF
-+if ac_fn_c_try_compile "$LINENO"; then :
-+
-+$as_echo "#define USE_CCAPI 1" >>confdefs.h
-+
-+                LIBS="$LIBS -framework Security"
-+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-+$as_echo "yes" >&6; }
-+                if test "x$ac_cv_use_security_session_api" = "xno"; then
-+                       as_fn_error $? "*** Need a security framework to use the credentials cache API ***" "$LINENO" 5
-+               fi
-+else
-+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-+$as_echo "no" >&6; }
-+
-+fi
-+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- 
-        ac_fn_c_check_decl "$LINENO" "AU_IPv4" "ac_cv_have_decl_AU_IPv4" "$ac_includes_default"
- if test "x$ac_cv_have_decl_AU_IPv4" = xyes; then :
 diff --git a/configure.ac b/configure.ac
-index 67c4486..90e81e1 100644
+index b4d6598..216a9fd 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -584,6 +584,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+@@ -620,6 +620,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
             [Use tunnel device compatibility to OpenBSD])
         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
             [Prepend the address family to IP tunnel traffic])
@@ -516,11 +449,11 @@ index 67c4486..90e81e1 100644
         AC_CHECK_DECL([AU_IPv4], [], 
             AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 diff --git a/gss-genr.c b/gss-genr.c
-index b39281b..1e569ad 100644
+index 60ac65f..5610f0b 100644
 --- a/gss-genr.c
 +++ b/gss-genr.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: gss-genr.c,v 1.22 2013/11/08 00:39:15 djm Exp $ */
+ /* $OpenBSD: gss-genr.c,v 1.23 2015/01/20 23:14:00 deraadt Exp $ */
  
  /*
 - * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
@@ -528,7 +461,7 @@ index b39281b..1e569ad 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -39,12 +39,167 @@
+@@ -40,12 +40,167 @@
  #include "buffer.h"
  #include "log.h"
  #include "ssh2.h"
@@ -696,7 +629,7 @@ index b39281b..1e569ad 100644
  /* Check that the OID in a data stream matches that in the context */
  int
  ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -197,7 +352,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
+@@ -198,7 +353,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
         }
  
         ctx->major = gss_init_sec_context(&ctx->minor,
@@ -705,7 +638,7 @@ index b39281b..1e569ad 100644
             GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
             0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -227,8 +382,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
+@@ -228,8 +383,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
  }
  
  OM_uint32
@@ -748,7 +681,7 @@ index b39281b..1e569ad 100644
         if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
             GSS_C_QOP_DEFAULT, buffer, hash)))
                 ssh_gssapi_error(ctx);
-@@ -236,6 +425,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
+@@ -237,6 +426,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
         return (ctx->major);
  }
  
@@ -768,7 +701,7 @@ index b39281b..1e569ad 100644
  void
  ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
      const char *context)
-@@ -249,11 +451,16 @@ ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
+@@ -250,11 +452,16 @@ ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
  }
  
  int
@@ -786,7 +719,7 @@ index b39281b..1e569ad 100644
  
         /* RFC 4462 says we MUST NOT do SPNEGO */
         if (oid->length == spnego_oid.length && 
-@@ -263,6 +470,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -264,6 +471,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
         ssh_gssapi_build_ctx(ctx);
         ssh_gssapi_set_oid(*ctx, oid);
         major = ssh_gssapi_import_name(*ctx, host);
@@ -797,7 +730,7 @@ index b39281b..1e569ad 100644
         if (!GSS_ERROR(major)) {
                 major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
                     NULL);
-@@ -272,10 +483,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -273,10 +484,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
                             GSS_C_NO_BUFFER);
         }
  
@@ -992,11 +925,11 @@ index 795992d..fd8b371 100644
  
  #endif /* KRB5 */
 diff --git a/gss-serv.c b/gss-serv.c
-index 5c59924..50fa438 100644
+index e7b8c52..539862d 100644
 --- a/gss-serv.c
 +++ b/gss-serv.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv.c,v 1.27 2014/07/03 03:34:09 djm Exp $ */
+ /* $OpenBSD: gss-serv.c,v 1.28 2015/01/20 23:14:00 deraadt Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -1004,7 +937,7 @@ index 5c59924..50fa438 100644
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -45,15 +45,21 @@
+@@ -44,15 +44,21 @@
  #include "channels.h"
  #include "session.h"
  #include "misc.h"
@@ -1028,7 +961,7 @@ index 5c59924..50fa438 100644
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -100,25 +106,32 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx)
+@@ -99,25 +105,32 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx)
         char lname[NI_MAXHOST];
         gss_OID_set oidset;
  
@@ -1075,7 +1008,7 @@ index 5c59924..50fa438 100644
  }
  
  /* Privileged */
-@@ -133,6 +146,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+@@ -132,6 +145,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
  }
  
  /* Unprivileged */
@@ -1105,7 +1038,7 @@ index 5c59924..50fa438 100644
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
  {
-@@ -142,7 +178,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
+@@ -141,7 +177,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
         gss_OID_set supported;
  
         gss_create_empty_oid_set(&min_status, oidset);
@@ -1116,7 +1049,7 @@ index 5c59924..50fa438 100644
  
         while (supported_mechs[i]->name != NULL) {
                 if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -268,8 +306,48 @@ OM_uint32
+@@ -267,8 +305,48 @@ OM_uint32
  ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  {
         int i = 0;
@@ -1166,7 +1099,7 @@ index 5c59924..50fa438 100644
  
         client->mech = NULL;
  
-@@ -284,6 +362,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -283,6 +361,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
         if (client->mech == NULL)
                 return GSS_S_FAILURE;
  
@@ -1180,7 +1113,7 @@ index 5c59924..50fa438 100644
         if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
             &client->displayname, NULL))) {
                 ssh_gssapi_error(ctx);
-@@ -301,6 +386,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -300,6 +385,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
                 return (ctx->major);
         }
  
@@ -1189,7 +1122,7 @@ index 5c59924..50fa438 100644
         /* We can't copy this structure, so we just move the pointer to it */
         client->creds = ctx->client_creds;
         ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -348,7 +435,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+@@ -347,7 +434,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
  
  /* Privileged */
  int
@@ -1198,7 +1131,7 @@ index 5c59924..50fa438 100644
  {
         OM_uint32 lmin;
  
-@@ -358,9 +445,11 @@ ssh_gssapi_userok(char *user)
+@@ -357,9 +444,11 @@ ssh_gssapi_userok(char *user)
                 return 0;
         }
         if (gssapi_client.mech && gssapi_client.mech->userok)
@@ -1212,7 +1145,7 @@ index 5c59924..50fa438 100644
                         /* Destroy delegated credentials if userok fails */
                         gss_release_buffer(&lmin, &gssapi_client.displayname);
                         gss_release_buffer(&lmin, &gssapi_client.exportedname);
-@@ -374,14 +463,90 @@ ssh_gssapi_userok(char *user)
+@@ -373,14 +462,90 @@ ssh_gssapi_userok(char *user)
         return (0);
  }
  
@@ -1310,11 +1243,11 @@ index 5c59924..50fa438 100644
  
  #endif
 diff --git a/kex.c b/kex.c
-index a173e70..891852b 100644
+index 8c2b001..be938ad 100644
 --- a/kex.c
 +++ b/kex.c
-@@ -53,6 +53,10 @@
- #include "roaming.h"
+@@ -55,6 +55,10 @@
+ #include "sshbuf.h"
  #include "digest.h"
  
 +#ifdef GSSAPI
@@ -1324,8 +1257,8 @@ index a173e70..891852b 100644
  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
  # if defined(HAVE_EVP_SHA256)
  # define evp_ssh_sha256 EVP_sha256
-@@ -96,6 +100,14 @@ static const struct kexalg kexalgs[] = {
- #endif /* HAVE_EVP_SHA256 */
+@@ -97,6 +101,14 @@ static const struct kexalg kexalgs[] = {
+ #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
         { NULL, -1, -1, -1},
  };
 +static const struct kexalg kexalg_prefixes[] = {
@@ -1339,7 +1272,7 @@ index a173e70..891852b 100644
  
  char *
  kex_alg_list(char sep)
-@@ -124,6 +136,10 @@ kex_alg_by_name(const char *name)
+@@ -129,6 +141,10 @@ kex_alg_by_name(const char *name)
                 if (strcmp(k->name, name) == 0)
                         return k;
         }
@@ -1351,10 +1284,10 @@ index a173e70..891852b 100644
  }
  
 diff --git a/kex.h b/kex.h
-index 4c40ec8..c179a4d 100644
+index f70b81f..7194b14 100644
 --- a/kex.h
 +++ b/kex.h
-@@ -76,6 +76,9 @@ enum kex_exchange {
+@@ -93,6 +93,9 @@ enum kex_exchange {
         KEX_DH_GEX_SHA256,
         KEX_ECDH_SHA2,
         KEX_C25519_SHA256,
@@ -1364,8 +1297,8 @@ index 4c40ec8..c179a4d 100644
         KEX_MAX
  };
  
-@@ -135,6 +138,12 @@ struct Kex {
-        int     flags;
+@@ -139,6 +142,12 @@ struct kex {
+        u_int   flags;
         int     hash_alg;
         int     ec_nid;
 +#ifdef GSSAPI
@@ -1376,25 +1309,25 @@ index 4c40ec8..c179a4d 100644
 +#endif
         char    *client_version_string;
         char    *server_version_string;
-        int     (*verify_host_key)(Key *);
-@@ -167,6 +176,11 @@ void        kexecdh_server(Kex *);
- void    kexc25519_client(Kex *);
- void    kexc25519_server(Kex *);
+        int     (*verify_host_key)(struct sshkey *, struct ssh *);
+@@ -184,6 +193,11 @@ int         kexecdh_server(struct ssh *);
+ int     kexc25519_client(struct ssh *);
+ int     kexc25519_server(struct ssh *);
  
 +#ifdef GSSAPI
-+void   kexgss_client(Kex *);
-+void   kexgss_server(Kex *);
++int     kexgss_client(struct ssh *);
++int     kexgss_server(struct ssh *);
 +#endif
 +
- void
- kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
-     BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
+ int     kex_dh_hash(const char *, const char *,
+     const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+     const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
 diff --git a/kexgssc.c b/kexgssc.c
 new file mode 100644
-index 0000000..92a31c5
+index 0000000..a49bac2
 --- /dev/null
 +++ b/kexgssc.c
-@@ -0,0 +1,332 @@
+@@ -0,0 +1,336 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1439,43 +1372,46 @@ index 0000000..92a31c5
 +#include "log.h"
 +#include "packet.h"
 +#include "dh.h"
++#include "digest.h"
 +
 +#include "ssh-gss.h"
 +
-+void
-+kexgss_client(Kex *kex) {
++int
++kexgss_client(struct ssh *ssh) {
 +       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +       gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
 +       Gssctxt *ctxt;
 +       OM_uint32 maj_status, min_status, ret_flags;
-+       u_int klen, kout, slen = 0, hashlen, strlen;
++       u_int klen, kout, slen = 0, strlen;
 +       DH *dh; 
 +       BIGNUM *dh_server_pub = NULL;
 +       BIGNUM *shared_secret = NULL;
 +       BIGNUM *p = NULL;
 +       BIGNUM *g = NULL;       
-+       u_char *kbuf, *hash;
++       u_char *kbuf;
 +       u_char *serverhostkey = NULL;
 +       u_char *empty = "";
 +       char *msg;
 +       int type = 0;
 +       int first = 1;
 +       int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
++       u_char hash[SSH_DIGEST_MAX_LENGTH];
++       size_t hashlen;
 +
 +       /* Initialise our GSSAPI world */       
 +       ssh_gssapi_build_ctx(&ctxt);
-+       if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type) 
++       if (ssh_gssapi_id_kex(ctxt, ssh->kex->name, ssh->kex->kex_type) 
 +           == GSS_C_NO_OID)
 +               fatal("Couldn't identify host exchange");
 +
-+       if (ssh_gssapi_import_name(ctxt, kex->gss_host))
++       if (ssh_gssapi_import_name(ctxt, ssh->kex->gss_host))
 +               fatal("Couldn't import hostname");
 +
-+       if (kex->gss_client && 
-+           ssh_gssapi_client_identity(ctxt, kex->gss_client))
++       if (ssh->kex->gss_client && 
++           ssh_gssapi_client_identity(ctxt, ssh->kex->gss_client))
 +               fatal("Couldn't acquire client credentials");
 +
-+       switch (kex->kex_type) {
++       switch (ssh->kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
 +               dh = dh_new_group1();
 +               break;
@@ -1484,7 +1420,7 @@ index 0000000..92a31c5
 +               break;
 +       case KEX_GSS_GEX_SHA1:
 +               debug("Doing group exchange\n");
-+               nbits = dh_estimate(kex->we_need * 8);
++               nbits = dh_estimate(ssh->kex->we_need * 8);
 +               packet_start(SSH2_MSG_KEXGSS_GROUPREQ);
 +               packet_put_int(min);
 +               packet_put_int(nbits);
@@ -1509,11 +1445,11 @@ index 0000000..92a31c5
 +               dh = dh_new_group(g, p);
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
 +       }
 +       
 +       /* Step 1 - e is dh->pub_key */
-+       dh_gen_key(dh, kex->we_need * 8);
++       dh_gen_key(dh, ssh->kex->we_need * 8);
 +
 +       /* This is f, we initialise it now to make life easier */
 +       dh_server_pub = BN_new();
@@ -1526,7 +1462,7 @@ index 0000000..92a31c5
 +               debug("Calling gss_init_sec_context");
 +               
 +               maj_status = ssh_gssapi_init_ctx(ctxt,
-+                   kex->gss_deleg_creds, token_ptr, &send_tok,
++                   ssh->kex->gss_deleg_creds, token_ptr, &send_tok,
 +                   &ret_flags);
 +
 +               if (GSS_ERROR(maj_status)) {
@@ -1659,38 +1595,39 @@ index 0000000..92a31c5
 +       memset(kbuf, 0, klen);
 +       free(kbuf);
 +
-+       switch (kex->kex_type) {
++       hashlen = sizeof(hash);
++       switch (ssh->kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
 +       case KEX_GSS_GRP14_SHA1:
-+               kex_dh_hash( kex->client_version_string, 
-+                   kex->server_version_string,
-+                   buffer_ptr(&kex->my), buffer_len(&kex->my),
-+                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
++               kex_dh_hash( ssh->kex->client_version_string, 
++                   ssh->kex->server_version_string,
++                   buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
++                   buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
 +                   (serverhostkey ? serverhostkey : empty), slen,
 +                   dh->pub_key,        /* e */
 +                   dh_server_pub,      /* f */
 +                   shared_secret,      /* K */
-+                   &hash, &hashlen
++                   hash, &hashlen
 +               );
 +               break;
 +       case KEX_GSS_GEX_SHA1:
 +               kexgex_hash(
-+                   kex->hash_alg,
-+                   kex->client_version_string,
-+                   kex->server_version_string,
-+                   buffer_ptr(&kex->my), buffer_len(&kex->my),
-+                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
++                   ssh->kex->hash_alg,
++                   ssh->kex->client_version_string,
++                   ssh->kex->server_version_string,
++                   buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
++                   buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
 +                   (serverhostkey ? serverhostkey : empty), slen,
 +                   min, nbits, max,
 +                   dh->p, dh->g,
 +                   dh->pub_key,
 +                   dh_server_pub,
 +                   shared_secret,
-+                   &hash, &hashlen
++                   hash, &hashlen
 +               );
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
 +       }
 +
 +       gssbuf.value = hash;
@@ -1707,13 +1644,13 @@ index 0000000..92a31c5
 +       BN_clear_free(dh_server_pub);
 +
 +       /* save session id */
-+       if (kex->session_id == NULL) {
-+               kex->session_id_len = hashlen;
-+               kex->session_id = xmalloc(kex->session_id_len);
-+               memcpy(kex->session_id, hash, kex->session_id_len);
++       if (ssh->kex->session_id == NULL) {
++               ssh->kex->session_id_len = hashlen;
++               ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);
++               memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);
 +       }
 +
-+       if (kex->gss_deleg_creds)
++       if (ssh->kex->gss_deleg_creds)
 +               ssh_gssapi_credentials_updated(ctxt);
 +
 +       if (gss_kex_context == NULL)
@@ -1721,18 +1658,18 @@ index 0000000..92a31c5
 +       else
 +               ssh_gssapi_delete_ctx(&ctxt);
 +
-+       kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
++       kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);
 +       BN_clear_free(shared_secret);
-+       kex_finish(kex);
++       return kex_send_newkeys(ssh);
 +}
 +
 +#endif /* GSSAPI */
 diff --git a/kexgsss.c b/kexgsss.c
 new file mode 100644
-index 0000000..6a0ece8
+index 0000000..0847469
 --- /dev/null
 +++ b/kexgsss.c
-@@ -0,0 +1,290 @@
+@@ -0,0 +1,295 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1779,11 +1716,12 @@ index 0000000..6a0ece8
 +#include "monitor_wrap.h"
 +#include "misc.h"
 +#include "servconf.h"
++#include "digest.h"
 +
 +extern ServerOptions options;
 +
-+void
-+kexgss_server(Kex *kex)
++int
++kexgss_server(struct ssh *ssh)
 +{
 +       OM_uint32 maj_status, min_status;
 +       
@@ -1798,8 +1736,8 @@ index 0000000..6a0ece8
 +       gss_buffer_desc gssbuf, recv_tok, msg_tok;
 +       gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +       Gssctxt *ctxt = NULL;
-+       u_int slen, klen, kout, hashlen;
-+       u_char *kbuf, *hash;
++       u_int slen, klen, kout;
++       u_char *kbuf;
 +       DH *dh;
 +       int min = -1, max = -1, nbits = -1;
 +       BIGNUM *shared_secret = NULL;
@@ -1807,6 +1745,8 @@ index 0000000..6a0ece8
 +       int type = 0;
 +       gss_OID oid;
 +       char *mechs;
++       u_char hash[SSH_DIGEST_MAX_LENGTH];
++       size_t hashlen;
 +
 +       /* Initialise GSSAPI */
 +
@@ -1819,8 +1759,8 @@ index 0000000..6a0ece8
 +               free(mechs);
 +       }
 +
-+       debug2("%s: Identifying %s", __func__, kex->name);
-+       oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
++       debug2("%s: Identifying %s", __func__, ssh->kex->name);
++       oid = ssh_gssapi_id_kex(NULL, ssh->kex->name, ssh->kex->kex_type);
 +       if (oid == GSS_C_NO_OID)
 +          fatal("Unknown gssapi mechanism");
 +
@@ -1829,7 +1769,7 @@ index 0000000..6a0ece8
 +       if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
 +               fatal("Unable to acquire credentials for the server");
 +
-+       switch (kex->kex_type) {
++       switch (ssh->kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
 +               dh = dh_new_group1();
 +               break;
@@ -1860,10 +1800,10 @@ index 0000000..6a0ece8
 +               packet_write_wait();
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
 +       }
 +
-+       dh_gen_key(dh, kex->we_need * 8);
++       dh_gen_key(dh, ssh->kex->we_need * 8);
 +
 +       do {
 +               debug("Wait SSH2_MSG_GSSAPI_INIT");
@@ -1946,43 +1886,44 @@ index 0000000..6a0ece8
 +       memset(kbuf, 0, klen);
 +       free(kbuf);
 +
-+       switch (kex->kex_type) {
++       hashlen = sizeof(hash);
++       switch (ssh->kex->kex_type) {
 +       case KEX_GSS_GRP1_SHA1:
 +       case KEX_GSS_GRP14_SHA1:
 +               kex_dh_hash(
-+                   kex->client_version_string, kex->server_version_string,
-+                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-+                   buffer_ptr(&kex->my), buffer_len(&kex->my),
++                   ssh->kex->client_version_string, ssh->kex->server_version_string,
++                   buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
++                   buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
 +                   NULL, 0, /* Change this if we start sending host keys */
 +                   dh_client_pub, dh->pub_key, shared_secret,
-+                   &hash, &hashlen
++                   hash, &hashlen
 +               );
 +               break;
 +       case KEX_GSS_GEX_SHA1:
 +               kexgex_hash(
-+                   kex->hash_alg,
-+                   kex->client_version_string, kex->server_version_string,
-+                   buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-+                   buffer_ptr(&kex->my), buffer_len(&kex->my),
++                   ssh->kex->hash_alg,
++                   ssh->kex->client_version_string, ssh->kex->server_version_string,
++                   buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
++                   buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
 +                   NULL, 0,
 +                   min, nbits, max,
 +                   dh->p, dh->g,
 +                   dh_client_pub,
 +                   dh->pub_key,
 +                   shared_secret,
-+                   &hash, &hashlen
++                   hash, &hashlen
 +               );
 +               break;
 +       default:
-+               fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
++               fatal("%s: Unexpected KEX type %d", __func__, ssh->kex->kex_type);
 +       }
 +
 +       BN_clear_free(dh_client_pub);
 +
-+       if (kex->session_id == NULL) {
-+               kex->session_id_len = hashlen;
-+               kex->session_id = xmalloc(kex->session_id_len);
-+               memcpy(kex->session_id, hash, kex->session_id_len);
++       if (ssh->kex->session_id == NULL) {
++               ssh->kex->session_id_len = hashlen;
++               ssh->kex->session_id = xmalloc(ssh->kex->session_id_len);
++               memcpy(ssh->kex->session_id, hash, ssh->kex->session_id_len);
 +       }
 +
 +       gssbuf.value = hash;
@@ -2013,21 +1954,22 @@ index 0000000..6a0ece8
 +
 +       DH_free(dh);
 +
-+       kex_derive_keys_bn(kex, hash, hashlen, shared_secret);
++       kex_derive_keys_bn(ssh, hash, hashlen, shared_secret);
 +       BN_clear_free(shared_secret);
-+       kex_finish(kex);
++       kex_send_newkeys(ssh);
 +
 +       /* If this was a rekey, then save out any delegated credentials we
 +        * just exchanged.  */
 +       if (options.gss_store_rekey)
 +               ssh_gssapi_rekey_creds();
++       return 0;
 +}
 +#endif /* GSSAPI */
 diff --git a/monitor.c b/monitor.c
-index dbe29f1..b0896ef 100644
+index bab6ce8..a2027e5 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -178,6 +178,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *);
+@@ -157,6 +157,8 @@ int mm_answer_gss_setup_ctx(int, Buffer *);
  int mm_answer_gss_accept_ctx(int, Buffer *);
  int mm_answer_gss_userok(int, Buffer *);
  int mm_answer_gss_checkmic(int, Buffer *);
@@ -2036,7 +1978,7 @@ index dbe29f1..b0896ef 100644
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -255,11 +257,18 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -234,11 +236,18 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
@@ -2055,7 +1997,7 @@ index dbe29f1..b0896ef 100644
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -374,6 +383,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
+@@ -353,6 +362,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
                 /* Permit requests for moduli and signatures */
                 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2066,7 +2008,7 @@ index dbe29f1..b0896ef 100644
         } else {
                 mon_dispatch = mon_dispatch_proto15;
  
-@@ -482,6 +495,10 @@ monitor_child_postauth(struct monitor *pmonitor)
+@@ -461,6 +474,10 @@ monitor_child_postauth(struct monitor *pmonitor)
                 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2077,21 +2019,21 @@ index dbe29f1..b0896ef 100644
         } else {
                 mon_dispatch = mon_dispatch_postauth15;
                 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1861,6 +1878,13 @@ mm_get_kex(Buffer *m)
-        kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
- #endif
-        kex->kex[KEX_C25519_SHA256] = kexc25519_server;
+@@ -1860,6 +1877,13 @@ monitor_apply_keystate(struct monitor *pmonitor)
+ # endif
+ #endif /* WITH_OPENSSL */
+                kex->kex[KEX_C25519_SHA256] = kexc25519_server;
 +#ifdef GSSAPI
-+       if (options.gss_keyex) {
-+               kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
-+               kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+               kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
-+       }
++               if (options.gss_keyex) {
++                       kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
++                       kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
++                       kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
++               }
 +#endif
-        kex->server = 1;
-        kex->hostkey_type = buffer_get_int(m);
-        kex->kex_type = buffer_get_int(m);
-@@ -2068,6 +2092,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
+                kex->load_host_public_key=&get_hostkey_public_by_type;
+                kex->load_host_private_key=&get_hostkey_private_by_type;
+                kex->host_key_index=&get_hostkey_index;
+@@ -1959,6 +1983,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
         OM_uint32 major;
         u_int len;
  
@@ -2101,7 +2043,7 @@ index dbe29f1..b0896ef 100644
         goid.elements = buffer_get_string(m, &len);
         goid.length = len;
  
-@@ -2095,6 +2122,9 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
+@@ -1986,6 +2013,9 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
         OM_uint32 flags = 0; /* GSI needs this */
         u_int len;
  
@@ -2111,7 +2053,7 @@ index dbe29f1..b0896ef 100644
         in.value = buffer_get_string(m, &len);
         in.length = len;
         major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -2112,6 +2142,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
+@@ -2003,6 +2033,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2119,7 +2061,7 @@ index dbe29f1..b0896ef 100644
         }
         return (0);
  }
-@@ -2123,6 +2154,9 @@ mm_answer_gss_checkmic(int sock, Buffer *m)
+@@ -2014,6 +2045,9 @@ mm_answer_gss_checkmic(int sock, Buffer *m)
         OM_uint32 ret;
         u_int len;
  
@@ -2129,7 +2071,7 @@ index dbe29f1..b0896ef 100644
         gssbuf.value = buffer_get_string(m, &len);
         gssbuf.length = len;
         mic.value = buffer_get_string(m, &len);
-@@ -2149,7 +2183,11 @@ mm_answer_gss_userok(int sock, Buffer *m)
+@@ -2040,7 +2074,11 @@ mm_answer_gss_userok(int sock, Buffer *m)
  {
         int authenticated;
  
@@ -2142,7 +2084,7 @@ index dbe29f1..b0896ef 100644
  
         buffer_clear(m);
         buffer_put_int(m, authenticated);
-@@ -2162,5 +2200,73 @@ mm_answer_gss_userok(int sock, Buffer *m)
+@@ -2053,5 +2091,73 @@ mm_answer_gss_userok(int sock, Buffer *m)
         /* Monitor loop will terminate if authenticated */
         return (authenticated);
  }
@@ -2217,7 +2159,7 @@ index dbe29f1..b0896ef 100644
  #endif /* GSSAPI */
  
 diff --git a/monitor.h b/monitor.h
-index 5bc41b5..7f32b0c 100644
+index 93b8b66..bc50ade 100644
 --- a/monitor.h
 +++ b/monitor.h
 @@ -65,6 +65,9 @@ enum monitor_reqtype {
@@ -2231,10 +2173,10 @@ index 5bc41b5..7f32b0c 100644
  
  struct mm_master;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 45dc169..e476f0d 100644
+index b379f05..b667218 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -1281,7 +1281,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+@@ -1068,7 +1068,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
  }
  
  int
@@ -2243,7 +2185,7 @@ index 45dc169..e476f0d 100644
  {
         Buffer m;
         int authenticated = 0;
-@@ -1298,5 +1298,50 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1085,5 +1085,50 @@ mm_ssh_gssapi_userok(char *user)
         debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
         return (authenticated);
  }
@@ -2295,7 +2237,7 @@ index 45dc169..e476f0d 100644
  #endif /* GSSAPI */
  
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 18c2501..a4e9d24 100644
+index e18784a..0c770e8 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
 @@ -58,8 +58,10 @@ BIGNUM *mm_auth_rsa_generate_challenge(Key *);
@@ -2311,10 +2253,10 @@ index 18c2501..a4e9d24 100644
  
  #ifdef USE_PAM
 diff --git a/readconf.c b/readconf.c
-index 7948ce1..9127e93 100644
+index 42a2961..254dbce 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -142,6 +142,8 @@ typedef enum {
+@@ -147,6 +147,8 @@ typedef enum {
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
@@ -2323,7 +2265,7 @@ index 7948ce1..9127e93 100644
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
         oSendEnv, oControlPath, oControlMaster, oControlPersist,
         oHashKnownHosts,
-@@ -185,10 +187,19 @@ static struct {
+@@ -191,10 +193,19 @@ static struct {
         { "afstokenpassing", oUnsupported },
  #if defined(GSSAPI)
         { "gssapiauthentication", oGssAuthentication },
@@ -2343,7 +2285,7 @@ index 7948ce1..9127e93 100644
  #endif
         { "fallbacktorsh", oDeprecated },
         { "usersh", oDeprecated },
-@@ -865,10 +876,30 @@ parse_time:
+@@ -892,10 +903,30 @@ parse_time:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2374,7 +2316,7 @@ index 7948ce1..9127e93 100644
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
-@@ -1538,7 +1569,12 @@ initialize_options(Options * options)
+@@ -1601,7 +1632,12 @@ initialize_options(Options * options)
         options->pubkey_authentication = -1;
         options->challenge_response_authentication = -1;
         options->gss_authentication = -1;
@@ -2387,7 +2329,7 @@ index 7948ce1..9127e93 100644
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
-@@ -1661,8 +1697,14 @@ fill_default_options(Options * options)
+@@ -1728,8 +1764,14 @@ fill_default_options(Options * options)
                 options->challenge_response_authentication = 1;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2403,7 +2345,7 @@ index 7948ce1..9127e93 100644
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
 diff --git a/readconf.h b/readconf.h
-index 0b9cb77..0e29889 100644
+index 576b9e3..ef39c4c 100644
 --- a/readconf.h
 +++ b/readconf.h
 @@ -45,7 +45,12 @@ typedef struct {
@@ -2420,10 +2362,10 @@ index 0b9cb77..0e29889 100644
                                                  * authentication. */
         int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff --git a/servconf.c b/servconf.c
-index b7f3294..cb3c831 100644
+index 3185462..f68c0d0 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -109,7 +109,10 @@ initialize_server_options(ServerOptions *options)
+@@ -114,7 +114,10 @@ initialize_server_options(ServerOptions *options)
         options->kerberos_ticket_cleanup = -1;
         options->kerberos_get_afs_token = -1;
         options->gss_authentication=-1;
@@ -2434,7 +2376,7 @@ index b7f3294..cb3c831 100644
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
-@@ -250,8 +253,14 @@ fill_default_server_options(ServerOptions *options)
+@@ -269,8 +272,14 @@ fill_default_server_options(ServerOptions *options)
                 options->kerberos_get_afs_token = 0;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2449,10 +2391,10 @@ index b7f3294..cb3c831 100644
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
-@@ -352,7 +361,9 @@ typedef enum {
+@@ -391,7 +400,9 @@ typedef enum {
         sBanner, sUseDNS, sHostbasedAuthentication,
-        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
-        sClientAliveCountMax, sAuthorizedKeysFile,
+        sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
+        sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
 -       sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
 +       sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
 +       sGssKeyEx, sGssStoreRekey,
@@ -2460,7 +2402,7 @@ index b7f3294..cb3c831 100644
         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
         sUsePrivilegeSeparation, sAllowAgentForwarding,
         sHostCertificate,
-@@ -421,10 +432,20 @@ static struct {
+@@ -462,10 +473,20 @@ static struct {
  #ifdef GSSAPI
         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -2481,7 +2423,7 @@ index b7f3294..cb3c831 100644
         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1104,10 +1125,22 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -1166,10 +1187,22 @@ process_server_config_line(ServerOptions *options, char *line,
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2504,7 +2446,7 @@ index b7f3294..cb3c831 100644
         case sPasswordAuthentication:
                 intptr = &options->password_authentication;
                 goto parse_flag;
-@@ -2042,7 +2075,10 @@ dump_config(ServerOptions *o)
+@@ -2125,7 +2158,10 @@ dump_config(ServerOptions *o)
  #endif
  #ifdef GSSAPI
         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
@@ -2516,10 +2458,10 @@ index b7f3294..cb3c831 100644
         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
         dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff --git a/servconf.h b/servconf.h
-index 766db3a..f8265a8 100644
+index 9922f0c..d2ed4d7 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -113,7 +113,10 @@ typedef struct {
+@@ -115,7 +115,10 @@ typedef struct {
         int     kerberos_get_afs_token;         /* If true, try to get AFS token if
                                                  * authenticated with Kerberos. */
         int     gss_authentication;     /* If true, permit GSSAPI authentication */
@@ -2647,10 +2589,10 @@ index 03a228f..228e5ab 100644
  #   CheckHostIP yes
  #   AddressFamily any
 diff --git a/ssh_config.5 b/ssh_config.5
-index f9ede7a..e6649ac 100644
+index 140d0ba..4476171 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -701,11 +701,43 @@ Specifies whether user authentication based on GSSAPI is allowed.
+@@ -743,11 +743,43 @@ Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
@@ -2696,12 +2638,12 @@ index f9ede7a..e6649ac 100644
  Indicates that
  .Xr ssh 1
 diff --git a/sshconnect2.c b/sshconnect2.c
-index 68f7f4f..7b478f1 100644
+index ba56f64..faa8ec5 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -159,9 +159,34 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
-        char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
-        Kex *kex;
+@@ -160,9 +160,34 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+        struct kex *kex;
+        int r;
  
 +#ifdef GSSAPI
 +       char *orig = NULL, *gss = NULL;
@@ -2734,7 +2676,7 @@ index 68f7f4f..7b478f1 100644
         if (options.ciphers == (char *)-1) {
                 logit("No valid ciphers for protocol version 2 given, using defaults.");
                 options.ciphers = NULL;
-@@ -199,6 +224,17 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+@@ -200,6 +225,17 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
         myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
             myproposal[PROPOSAL_KEX_ALGS]);
  
@@ -2752,8 +2694,8 @@ index 68f7f4f..7b478f1 100644
         if (options.rekey_limit || options.rekey_interval)
                 packet_set_rekey_limits((u_int32_t)options.rekey_limit,
                     (time_t)options.rekey_interval);
-@@ -213,10 +249,30 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
-        kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
+@@ -218,10 +254,30 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+ # endif
  #endif
         kex->kex[KEX_C25519_SHA256] = kexc25519_client;
 +#ifdef GSSAPI
@@ -2780,18 +2722,18 @@ index 68f7f4f..7b478f1 100644
 +       }
 +#endif
 +
-        xxx_kex = kex;
+        dispatch_run(DISPATCH_BLOCK, &kex->done, active_state);
  
-        dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-@@ -306,6 +362,7 @@ void        input_gssapi_token(int type, u_int32_t, void *);
- void   input_gssapi_hash(int type, u_int32_t, void *);
- void   input_gssapi_error(int, u_int32_t, void *);
- void   input_gssapi_errtok(int, u_int32_t, void *);
+        if (options.use_roaming && !kex->roaming) {
+@@ -313,6 +369,7 @@ int input_gssapi_token(int type, u_int32_t, void *);
+ int    input_gssapi_hash(int type, u_int32_t, void *);
+ int    input_gssapi_error(int, u_int32_t, void *);
+ int    input_gssapi_errtok(int, u_int32_t, void *);
 +int    userauth_gsskeyex(Authctxt *authctxt);
  #endif
  
  void   userauth(Authctxt *, char *);
-@@ -321,6 +378,11 @@ static char *authmethods_get(void);
+@@ -328,6 +385,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -2803,7 +2745,7 @@ index 68f7f4f..7b478f1 100644
         {"gssapi-with-mic",
                 userauth_gssapi,
                 NULL,
-@@ -617,19 +679,31 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -634,19 +696,31 @@ userauth_gssapi(Authctxt *authctxt)
         static u_int mech = 0;
         OM_uint32 min;
         int ok = 0;
@@ -2837,7 +2779,7 @@ index 68f7f4f..7b478f1 100644
                         ok = 1; /* Mechanism works */
                 } else {
                         mech++;
-@@ -726,8 +800,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
+@@ -743,8 +817,8 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
  {
         Authctxt *authctxt = ctxt;
         Gssctxt *gssctxt;
@@ -2848,9 +2790,9 @@ index 68f7f4f..7b478f1 100644
  
         if (authctxt == NULL)
                 fatal("input_gssapi_response: no authentication context");
-@@ -836,6 +910,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
-        free(msg);
+@@ -857,6 +931,48 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
         free(lang);
+        return 0;
  }
 +
 +int
@@ -2898,12 +2840,12 @@ index 68f7f4f..7b478f1 100644
  
  int
 diff --git a/sshd.c b/sshd.c
-index 481d001..e6706a8 100644
+index e1c767c..cf38bae 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -123,6 +123,10 @@
- #include "ssh-sandbox.h"
+@@ -125,6 +125,10 @@
  #include "version.h"
+ #include "ssherr.h"
  
 +#ifdef USE_SECURITY_SESSION_API
 +#include <Security/AuthSession.h>
@@ -2912,7 +2854,7 @@ index 481d001..e6706a8 100644
  #ifndef O_NOCTTY
  #define O_NOCTTY       0
  #endif
-@@ -1745,10 +1749,13 @@ main(int ac, char **av)
+@@ -1815,10 +1819,13 @@ main(int ac, char **av)
                 logit("Disabling protocol version 1. Could not load host key");
                 options.protocol &= ~SSH_PROTO_1;
         }
@@ -2926,7 +2868,7 @@ index 481d001..e6706a8 100644
         if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
                 logit("sshd: no hostkeys available -- exiting.");
                 exit(1);
-@@ -2060,6 +2067,60 @@ main(int ac, char **av)
+@@ -2132,6 +2139,60 @@ main(int ac, char **av)
             remote_ip, remote_port,
             get_local_ipaddr(sock_in), get_local_port());
  
@@ -2987,7 +2929,7 @@ index 481d001..e6706a8 100644
         /*
          * We don't want to listen forever unless the other side
          * successfully authenticates itself.  So we set up an alarm which is
-@@ -2482,6 +2543,48 @@ do_ssh2_kex(void)
+@@ -2561,6 +2622,48 @@ do_ssh2_kex(void)
         myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
             list_hostkey_types());
  
@@ -3034,10 +2976,10 @@ index 481d001..e6706a8 100644
 +#endif
 +
         /* start key exchange */
-        kex = kex_setup(myproposal);
- #ifdef WITH_OPENSSL
-@@ -2492,6 +2595,13 @@ do_ssh2_kex(void)
-        kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+        if ((r = kex_setup(active_state, myproposal)) != 0)
+                fatal("kex_setup: %s", ssh_err(r));
+@@ -2575,6 +2678,13 @@ do_ssh2_kex(void)
+ # endif
  #endif
         kex->kex[KEX_C25519_SHA256] = kexc25519_server;
 +#ifdef GSSAPI
@@ -3051,7 +2993,7 @@ index 481d001..e6706a8 100644
         kex->client_version_string=client_version_string;
         kex->server_version_string=server_version_string;
 diff --git a/sshd_config b/sshd_config
-index e9045bc..d9b8594 100644
+index c9042ac..a71ad19 100644
 --- a/sshd_config
 +++ b/sshd_config
 @@ -84,6 +84,8 @@ AuthorizedKeysFile    .ssh/authorized_keys
@@ -3064,10 +3006,10 @@ index e9045bc..d9b8594 100644
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff --git a/sshd_config.5 b/sshd_config.5
-index fd44abe..c8b43da 100644
+index 6dce0c7..0331496 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -527,12 +527,40 @@ Specifies whether user authentication based on GSSAPI is allowed.
+@@ -564,12 +564,40 @@ Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
@@ -3105,14 +3047,14 @@ index fd44abe..c8b43da 100644
 +successful connection rekeying. This option can be used to accepted renewed 
 +or updated credentials from a compatible client. The default is
 +.Dq no .
- .It Cm HostbasedAuthentication
- Specifies whether rhosts or /etc/hosts.equiv authentication together
- with successful public key client host authentication is allowed
+ .It Cm HostbasedAcceptedKeyTypes
+ Specifies the key types that will be accepted for hostbased authentication
+ as a comma-separated pattern list.
 diff --git a/sshkey.c b/sshkey.c
-index fdd0c8a..1a96eae 100644
+index 4768790..cd5992e 100644
 --- a/sshkey.c
 +++ b/sshkey.c
-@@ -110,6 +110,7 @@ static const struct keytype keytypes[] = {
+@@ -116,6 +116,7 @@ static const struct keytype keytypes[] = {
         { "ssh-dss-cert-v00@openssh.com", "DSA-CERT-V00",
             KEY_DSA_CERT_V00, 0, 1 },
  #endif /* WITH_OPENSSL */
@@ -3120,7 +3062,7 @@ index fdd0c8a..1a96eae 100644
         { NULL, NULL, -1, -1, 0 }
  };
  
-@@ -198,7 +199,7 @@ key_alg_list(int certs_only, int plain_only)
+@@ -204,7 +205,7 @@ key_alg_list(int certs_only, int plain_only)
         const struct keytype *kt;
  
         for (kt = keytypes; kt->type != -1; kt++) {
@@ -3130,7 +3072,7 @@ index fdd0c8a..1a96eae 100644
                 if ((certs_only && !kt->cert) || (plain_only && kt->cert))
                         continue;
 diff --git a/sshkey.h b/sshkey.h
-index 450b30c..b573e7f 100644
+index 62c1c3e..9314e85 100644
 --- a/sshkey.h
 +++ b/sshkey.h
 @@ -64,6 +64,7 @@ enum sshkey_types {
diff --git a/debian/patches/helpful-wait-terminate.patch b/debian/patches/helpful-wait-terminate.patch
index de43f2a80..6ea643210 100644
--- a/debian/patches/helpful-wait-terminate.patch
+++ b/debian/patches/helpful-wait-terminate.patch
@@ -1,4 +1,4 @@
-From aca34215fc0e85d6b49e04f0a3cd0db79732125e Mon Sep 17 00:00:00 2001
+From 9a440da8025dbc120803ee09c2a7ac8c638d31c2 Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:09:56 +0000
 Subject: Mention ~& when waiting for forwarded connections to terminate
@@ -12,7 +12,7 @@ Patch-Name: helpful-wait-terminate.patch
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/serverloop.c b/serverloop.c
-index e92f9e2..813e5bf 100644
+index 306ac36..68f0251 100644
 --- a/serverloop.c
 +++ b/serverloop.c
 @@ -687,7 +687,7 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 15acabc0e..0adfbd2b5 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -1,4 +1,4 @@
-From bd3abc2f732da3a61e4158b915480808957a4357 Mon Sep 17 00:00:00 2001
+From 7efad61f1e562f504a5ff3fb0ae90ac05a208e66 Mon Sep 17 00:00:00 2001
 From: Richard Kettlewell <rjk@greenend.org.uk>
 Date: Sun, 9 Feb 2014 16:09:52 +0000
 Subject: Various keepalive extensions
@@ -16,7 +16,7 @@ keepalives.
 Author: Ian Jackson <ian@chiark.greenend.org.uk>
 Author: Matthew Vernon <matthew@debian.org>
 Author: Colin Watson <cjwatson@debian.org>
-Last-Update: 2014-10-07
+Last-Update: 2015-08-19
 
 Patch-Name: keepalive-extensions.patch
 ---
@@ -26,27 +26,27 @@ Patch-Name: keepalive-extensions.patch
  3 files changed, 34 insertions(+), 4 deletions(-)
 
 diff --git a/readconf.c b/readconf.c
-index bc879eb..337818c 100644
+index 278fe15..1d2d596 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -153,6 +153,7 @@ typedef enum {
-        oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
+@@ -159,6 +159,7 @@ typedef enum {
         oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
-        oStreamLocalBindMask, oStreamLocalBindUnlink,
+        oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
+        oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
 +       oProtocolKeepAlives, oSetupTimeOut,
         oIgnoredUnknownOption, oDeprecated, oUnsupported
  } OpCodes;
  
-@@ -278,6 +279,8 @@ static struct {
-        { "streamlocalbindmask", oStreamLocalBindMask },
-        { "streamlocalbindunlink", oStreamLocalBindUnlink },
+@@ -288,6 +289,8 @@ static struct {
+        { "updatehostkeys", oUpdateHostkeys },
+        { "hostbasedkeytypes", oHostbasedKeyTypes },
         { "ignoreunknown", oIgnoreUnknown },
 +       { "protocolkeepalives", oProtocolKeepAlives },
 +       { "setuptimeout", oSetupTimeOut },
  
         { NULL, oBadOption }
  };
-@@ -1271,6 +1274,8 @@ parse_int:
+@@ -1299,6 +1302,8 @@ parse_int:
                 goto parse_flag;
  
         case oServerAliveInterval:
@@ -55,7 +55,7 @@ index bc879eb..337818c 100644
                 intptr = &options->server_alive_interval;
                 goto parse_time;
  
-@@ -1791,8 +1796,13 @@ fill_default_options(Options * options)
+@@ -1858,8 +1863,13 @@ fill_default_options(Options * options)
                 options->rekey_interval = 0;
         if (options->verify_host_key_dns == -1)
                 options->verify_host_key_dns = 0;
@@ -72,10 +72,10 @@ index bc879eb..337818c 100644
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
 diff --git a/ssh_config.5 b/ssh_config.5
-index 01f1f7f..ea92ea8 100644
+index dd35dd8..250c0d1 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -205,8 +205,12 @@ Valid arguments are
+@@ -233,8 +233,12 @@ Valid arguments are
  If set to
  .Dq yes ,
  passphrase/password querying will be disabled.
@@ -89,7 +89,7 @@ index 01f1f7f..ea92ea8 100644
  The argument must be
  .Dq yes
  or
-@@ -1336,8 +1340,15 @@ from the server,
+@@ -1420,8 +1424,15 @@ from the server,
  will send a message through the encrypted
  channel to request a response from the server.
  The default
@@ -106,7 +106,7 @@ index 01f1f7f..ea92ea8 100644
  .It Cm StreamLocalBindMask
  Sets the octal file creation mode mask
  .Pq umask
-@@ -1403,6 +1414,12 @@ Specifies whether the system should send TCP keepalive messages to the
+@@ -1487,6 +1498,12 @@ Specifies whether the system should send TCP keepalive messages to the
  other side.
  If they are sent, death of the connection or crash of one
  of the machines will be properly noticed.
@@ -120,10 +120,10 @@ index 01f1f7f..ea92ea8 100644
  connections will die if the route is down temporarily, and some people
  find it annoying.
 diff --git a/sshd_config.5 b/sshd_config.5
-index c8b43da..2843048 100644
+index 0331496..d14576e 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -1307,6 +1307,9 @@ This avoids infinitely hanging sessions.
+@@ -1392,6 +1392,9 @@ This avoids infinitely hanging sessions.
  .Pp
  To disable TCP keepalive messages, the value should be set to
  .Dq no .
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
index 81b924e35..7aa035726 100644
--- a/debian/patches/lintian-symlink-pickiness.patch
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -1,4 +1,4 @@
-From 248d3bb8de371b55aaf3a8f544c15f3a25eb7339 Mon Sep 17 00:00:00 2001
+From 90fc009420a03c598d6f003df5466191ab4d12b2 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:08 +0000
 Subject: Fix picky lintian errors about slogin symlinks
@@ -15,10 +15,10 @@ Patch-Name: lintian-symlink-pickiness.patch
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/Makefile.in b/Makefile.in
-index a4402e9..4eab574 100644
+index 37cb023..f52f903 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -315,9 +315,9 @@ install-files:
+@@ -331,9 +331,9 @@ install-files:
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
         -rm -f $(DESTDIR)$(bindir)/slogin
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index f90c7e2b1..127ed9f9e 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From 064453886f4c3d8ac0b0c8d015ad614c8bce3b42 Mon Sep 17 00:00:00 2001
+From aedcf9cb37f512b929ce895ba1fccc9ca39166b0 Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
@@ -13,10 +13,10 @@ Patch-Name: mention-ssh-keygen-on-keychange.patch
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index 26116d2..ab83d0c 100644
+index 0073c6e..6065dff 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -1066,9 +1066,12 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
+@@ -1078,9 +1078,12 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
                         error("%s. This could either mean that", key_msg);
                         error("DNS SPOOFING is happening or the IP address for the host");
                         error("and its host key have changed at the same time.");
@@ -30,7 +30,7 @@ index 26116d2..ab83d0c 100644
                 }
                 /* The host key has changed. */
                 warn_changed_key(host_key);
-@@ -1076,6 +1079,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
+@@ -1088,6 +1091,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
                     user_hostfiles[0]);
                 error("Offending %s key in %s:%lu", key_type(host_found->key),
                     host_found->file, host_found->line);
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index dfcef83b0..f4d8bca66 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From 37fd625165d0df302e441d9cad9bcc742378eef5 Mon Sep 17 00:00:00 2001
+From 6b85aa42144010401906754b98f9876651669163 Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
@@ -23,10 +23,10 @@ Patch-Name: no-openssl-version-status.patch
  2 files changed, 4 insertions(+), 3 deletions(-)
 
 diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
-index 36570e4..defd5fb 100644
+index 63a660c..3f62403 100644
 --- a/openbsd-compat/openssl-compat.c
 +++ b/openbsd-compat/openssl-compat.c
-@@ -34,7 +34,7 @@
+@@ -36,7 +36,7 @@
  /*
   * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
   * We match major, minor, fix and status (not patch) for <1.0.0.
@@ -35,7 +35,7 @@ index 36570e4..defd5fb 100644
   * allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
   * within a patch series.
   */
-@@ -55,10 +55,10 @@ ssh_compatible_openssl(long headerver, long libver)
+@@ -57,10 +57,10 @@ ssh_compatible_openssl(long headerver, long libver)
         }
         
         /*
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index 37ad675d4..f5b96f4a1 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From 0b9407d3023938b02bccf7dd1874a871d0cc8eb5 Mon Sep 17 00:00:00 2001
+From 96c2797aaa79d687e75dc56f40f7102131d87fb1 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
@@ -44,10 +44,10 @@ index ef0de08..149846c 100644
  .Sh SEE ALSO
  .Xr ssh-keygen 1 ,
 diff --git a/ssh-keygen.1 b/ssh-keygen.1
-index 723a016..79b948c 100644
+index 9b93666..19bed1e 100644
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -172,9 +172,7 @@ key in
+@@ -174,9 +174,7 @@ key in
  .Pa ~/.ssh/id_ed25519
  or
  .Pa ~/.ssh/id_rsa .
@@ -58,7 +58,7 @@ index 723a016..79b948c 100644
  .Pp
  Normally this program generates the key and asks for a file in which
  to store the private key.
-@@ -221,9 +219,7 @@ For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519)
+@@ -223,9 +221,7 @@ For each of the key types (rsa1, rsa, dsa, ecdsa and ed25519)
  for which host keys
  do not exist, generate the host keys with the default key file path,
  an empty passphrase, default bits for the key type, and default comment.
@@ -69,7 +69,7 @@ index 723a016..79b948c 100644
  .It Fl a Ar rounds
  When saving a new-format private key (i.e. an ed25519 key or any SSH protocol
  2 key when the
-@@ -628,7 +624,7 @@ option.
+@@ -638,7 +634,7 @@ option.
  Valid generator values are 2, 3, and 5.
  .Pp
  Screened DH groups may be installed in
@@ -78,7 +78,7 @@ index 723a016..79b948c 100644
  It is important that this file contains moduli of a range of bit lengths and
  that both ends of a connection share common moduli.
  .Sh CERTIFICATES
-@@ -827,7 +823,7 @@ on all machines
+@@ -837,7 +833,7 @@ on all machines
  where the user wishes to log in using public key authentication.
  There is no need to keep the contents of this file secret.
  .Pp
@@ -88,10 +88,10 @@ index 723a016..79b948c 100644
  The file format is described in
  .Xr moduli 5 .
 diff --git a/ssh.1 b/ssh.1
-index 7f6ab77..de178cd 100644
+index 53c711a..04de6cf 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -753,6 +753,10 @@ Protocol 1 is restricted to using only RSA keys,
+@@ -766,6 +766,10 @@ Protocol 1 is restricted to using only RSA keys,
  but protocol 2 may use any.
  The HISTORY section of
  .Xr ssl 8
@@ -103,7 +103,7 @@ index 7f6ab77..de178cd 100644
  .Pp
  The file
 diff --git a/sshd.8 b/sshd.8
-index eaeac45..3538208 100644
+index fc2154c..8dba6cf 100644
 --- a/sshd.8
 +++ b/sshd.8
 @@ -67,7 +67,7 @@ over an insecure network.
@@ -133,10 +133,10 @@ index eaeac45..3538208 100644
  .Xr sshd_config 5 ,
  .Xr inetd 8 ,
 diff --git a/sshd_config.5 b/sshd_config.5
-index 58997d3..7396b23 100644
+index ec58635..453d741 100644
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -303,8 +303,7 @@ This option is only available for protocol version 2.
+@@ -322,8 +322,7 @@ This option is only available for protocol version 2.
  By default, no banner is displayed.
  .It Cm ChallengeResponseAuthentication
  Specifies whether challenge-response authentication is allowed (e.g. via
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 07a28af9a..11674a915 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From 8679c96f74ee7dbea6c15c764b036fbab7372740 Mon Sep 17 00:00:00 2001
+From 9f6aded97671ee8b9164f0524b3ac622d827dcde Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
@@ -19,10 +19,10 @@ Patch-Name: package-versioning.patch
  3 files changed, 9 insertions(+), 4 deletions(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index ab83d0c..563405e 100644
+index 6065dff..a6c9e20 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -521,10 +521,10 @@ send_client_banner(int connection_out, int minor1)
+@@ -524,10 +524,10 @@ send_client_banner(int connection_out, int minor1)
         /* Send our own protocol version identification. */
         if (compat20) {
                 xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
@@ -36,10 +36,10 @@ index ab83d0c..563405e 100644
         if (roaming_atomicio(vwrite, connection_out, client_version_string,
             strlen(client_version_string)) != strlen(client_version_string))
 diff --git a/sshd.c b/sshd.c
-index 48a14dd..1710e71 100644
+index 3b4e97c..c362209 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -443,7 +443,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
+@@ -442,7 +442,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
         }
  
         xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -49,11 +49,11 @@ index 48a14dd..1710e71 100644
             options.version_addendum, newline);
  
 diff --git a/version.h b/version.h
-index cc8a079..0fee7c3 100644
+index dfe3ee9..94569ac 100644
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION    "OpenSSH_6.7"
+ #define SSH_VERSION    "OpenSSH_6.8"
  
  #define SSH_PORTABLE   "p1"
 -#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index 6d9a2f9c0..ff16b9850 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -1,4 +1,4 @@
-From dc028c5992b4b14cca380b6ad2115fcc6907a8b7 Mon Sep 17 00:00:00 2001
+From 34592a434851697537873eed1eb83ba0a640c5c8 Mon Sep 17 00:00:00 2001
 From: Peter Samuelson <peter@p12n.org>
 Date: Sun, 9 Feb 2014 16:09:55 +0000
 Subject: Reduce severity of "Killed by signal %d"
@@ -22,10 +22,10 @@ Patch-Name: quieter-signals.patch
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/clientloop.c b/clientloop.c
-index 046ca8b..0180774 100644
+index 156a196..45cef88 100644
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -1705,8 +1705,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
+@@ -1707,8 +1707,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                 exit_status = 0;
         }
  
diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch
index c590f52ce..c9da26f7d 100644
--- a/debian/patches/restore-tcp-wrappers.patch
+++ b/debian/patches/restore-tcp-wrappers.patch
@@ -1,4 +1,4 @@
-From b25d6dd3b6b5a2cb93723586c56d6fa0277ea56a Mon Sep 17 00:00:00 2001
+From 7df209aed8ded9a6cab34e704576998786bdc890 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Tue, 7 Oct 2014 13:22:41 +0100
 Subject: Restore TCP wrappers support
@@ -28,10 +28,10 @@ Patch-Name: restore-tcp-wrappers.patch
  3 files changed, 89 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 90e81e1..7f160f1 100644
+index 216a9fd..5f606ea 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1404,6 +1404,62 @@ AC_ARG_WITH([skey],
+@@ -1440,6 +1440,62 @@ AC_ARG_WITH([skey],
         ]
  )
  
@@ -94,7 +94,7 @@ index 90e81e1..7f160f1 100644
  # Check whether user wants to use ldns
  LDNS_MSG="no"
  AC_ARG_WITH(ldns,
-@@ -4853,6 +4909,7 @@ echo "                 KerberosV support: $KRB5_MSG"
+@@ -4920,6 +4976,7 @@ echo "                 KerberosV support: $KRB5_MSG"
  echo "                   SELinux support: $SELINUX_MSG"
  echo "                 Smartcard support: $SCARD_MSG"
  echo "                     S/KEY support: $SKEY_MSG"
@@ -103,7 +103,7 @@ index 90e81e1..7f160f1 100644
  echo "                   libedit support: $LIBEDIT_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
 diff --git a/sshd.8 b/sshd.8
-index 01459d6..eaeac45 100644
+index 3c53f7c..fc2154c 100644
 --- a/sshd.8
 +++ b/sshd.8
 @@ -851,6 +851,12 @@ the user's home directory becomes accessible.
@@ -128,10 +128,10 @@ index 01459d6..eaeac45 100644
  .Xr moduli 5 ,
  .Xr sshd_config 5 ,
 diff --git a/sshd.c b/sshd.c
-index e6706a8..3a6be65 100644
+index cf38bae..9cbe8c4 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -127,6 +127,13 @@
+@@ -129,6 +129,13 @@
  #include <Security/AuthSession.h>
  #endif
  
@@ -145,7 +145,7 @@ index e6706a8..3a6be65 100644
  #ifndef O_NOCTTY
  #define O_NOCTTY       0
  #endif
-@@ -2061,6 +2068,24 @@ main(int ac, char **av)
+@@ -2133,6 +2140,24 @@ main(int ac, char **av)
  #ifdef SSH_AUDIT_EVENTS
         audit_connection_from(remote_ip, remote_port);
  #endif
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index ee006da93..52e709112 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From fd174c13c46191abdb33c0a45545573a8e06b061 Mon Sep 17 00:00:00 2001
+From 4f55e60d2296feba17b473b2146a75debe29993a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
@@ -17,10 +17,10 @@ Patch-Name: scp-quoting.patch
  1 file changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/scp.c b/scp.c
-index 1ec3b70..a1b318b 100644
+index 887b014..afa4a2f 100644
 --- a/scp.c
 +++ b/scp.c
-@@ -189,8 +189,16 @@ do_local_cmd(arglist *a)
+@@ -190,8 +190,16 @@ do_local_cmd(arglist *a)
  
         if (verbose_mode) {
                 fprintf(stderr, "Executing:");
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 1fa0bf928..da53671e3 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -1,4 +1,4 @@
-From c9638aa44d787849cea1ae273f0908c6313fd19b Mon Sep 17 00:00:00 2001
+From b9e97e15e25e4c836cb550213e3ee59b19096f9d Mon Sep 17 00:00:00 2001
 From: Manoj Srivastava <srivasta@debian.org>
 Date: Sun, 9 Feb 2014 16:09:49 +0000
 Subject: Handle SELinux authorisation roles
@@ -9,7 +9,7 @@ SELinux maintainer, so we'll keep it until we have something better.
 
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
 Bug-Debian: http://bugs.debian.org/394795
-Last-Update: 2013-09-14
+Last-Update: 2015-08-19
 
 Patch-Name: selinux-role.patch
 ---
@@ -32,10 +32,10 @@ Patch-Name: selinux-role.patch
  16 files changed, 104 insertions(+), 31 deletions(-)
 
 diff --git a/auth.h b/auth.h
-index d081c94..f099e98 100644
+index db86037..4985cd8 100644
 --- a/auth.h
 +++ b/auth.h
-@@ -59,6 +59,7 @@ struct Authctxt {
+@@ -62,6 +62,7 @@ struct Authctxt {
         char            *service;
         struct passwd   *pw;            /* set if 'valid' */
         char            *style;
@@ -44,10 +44,10 @@ index d081c94..f099e98 100644
         char            *info;          /* Extra info for next auth_log */
  #ifdef BSD_AUTH
 diff --git a/auth1.c b/auth1.c
-index 5038828..52b17db 100644
+index 5073c49..dd00648 100644
 --- a/auth1.c
 +++ b/auth1.c
-@@ -381,7 +381,7 @@ void
+@@ -383,7 +383,7 @@ void
  do_authentication(Authctxt *authctxt)
  {
         u_int ulen;
@@ -56,7 +56,7 @@ index 5038828..52b17db 100644
  
         /* Get the name of the user that we wish to log in as. */
         packet_read_expect(SSH_CMSG_USER);
-@@ -390,11 +390,17 @@ do_authentication(Authctxt *authctxt)
+@@ -392,11 +392,17 @@ do_authentication(Authctxt *authctxt)
         user = packet_get_cstring(&ulen);
         packet_check_eom();
  
@@ -75,10 +75,10 @@ index 5038828..52b17db 100644
         /* Verify that the user is a valid user. */
         if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
 diff --git a/auth2.c b/auth2.c
-index 2f0d565..fa1a588 100644
+index 3f49bdc..6eb3cc7 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -217,7 +217,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
+@@ -216,7 +216,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
  {
         Authctxt *authctxt = ctxt;
         Authmethod *m = NULL;
@@ -87,7 +87,7 @@ index 2f0d565..fa1a588 100644
         int authenticated = 0;
  
         if (authctxt == NULL)
-@@ -229,8 +229,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
+@@ -228,8 +228,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
         debug("userauth-request for user %s service %s method %s", user, service, method);
         debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -101,7 +101,7 @@ index 2f0d565..fa1a588 100644
  
         if (authctxt->attempt++ == 0) {
                 /* setup auth context */
-@@ -254,8 +259,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
+@@ -253,8 +258,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                     use_privsep ? " [net]" : "");
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
@@ -113,10 +113,10 @@ index 2f0d565..fa1a588 100644
                 if (auth2_setup_methods_lists(authctxt) != 0)
                         packet_disconnect("no authentication methods enabled");
 diff --git a/monitor.c b/monitor.c
-index b0896ef..94b194d 100644
+index a2027e5..6ff05e4 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -148,6 +148,7 @@ int mm_answer_sign(int, Buffer *);
+@@ -127,6 +127,7 @@ int mm_answer_sign(int, Buffer *);
  int mm_answer_pwnamallow(int, Buffer *);
  int mm_answer_auth2_read_banner(int, Buffer *);
  int mm_answer_authserv(int, Buffer *);
@@ -124,7 +124,7 @@ index b0896ef..94b194d 100644
  int mm_answer_authpassword(int, Buffer *);
  int mm_answer_bsdauthquery(int, Buffer *);
  int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -229,6 +230,7 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -208,6 +209,7 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -132,7 +132,7 @@ index b0896ef..94b194d 100644
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -841,6 +843,7 @@ mm_answer_pwnamallow(int sock, Buffer *m)
+@@ -879,6 +881,7 @@ mm_answer_pwnamallow(int sock, Buffer *m)
         else {
                 /* Allow service/style information on the auth context */
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -140,7 +140,7 @@ index b0896ef..94b194d 100644
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
         }
  #ifdef USE_PAM
-@@ -871,14 +874,37 @@ mm_answer_authserv(int sock, Buffer *m)
+@@ -909,14 +912,37 @@ mm_answer_authserv(int sock, Buffer *m)
  
         authctxt->service = buffer_get_string(m, NULL);
         authctxt->style = buffer_get_string(m, NULL);
@@ -180,7 +180,7 @@ index b0896ef..94b194d 100644
         return (0);
  }
  
-@@ -1485,7 +1511,7 @@ mm_answer_pty(int sock, Buffer *m)
+@@ -1540,7 +1566,7 @@ mm_answer_pty(int sock, Buffer *m)
         res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
         if (res == 0)
                 goto error;
@@ -190,7 +190,7 @@ index b0896ef..94b194d 100644
         buffer_put_int(m, 1);
         buffer_put_cstring(m, s->tty);
 diff --git a/monitor.h b/monitor.h
-index 7f32b0c..4d5e8fa 100644
+index bc50ade..2d82b8b 100644
 --- a/monitor.h
 +++ b/monitor.h
 @@ -68,6 +68,8 @@ enum monitor_reqtype {
@@ -203,10 +203,10 @@ index 7f32b0c..4d5e8fa 100644
  
  struct mm_master;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index e476f0d..6dc890a 100644
+index b667218..5aa9c47 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -324,10 +324,10 @@ mm_auth2_read_banner(void)
+@@ -329,10 +329,10 @@ mm_auth2_read_banner(void)
         return (banner);
  }
  
@@ -219,7 +219,7 @@ index e476f0d..6dc890a 100644
  {
         Buffer m;
  
-@@ -336,12 +336,30 @@ mm_inform_authserv(char *service, char *style)
+@@ -341,12 +341,30 @@ mm_inform_authserv(char *service, char *style)
         buffer_init(&m);
         buffer_put_cstring(&m, service);
         buffer_put_cstring(&m, style ? style : "");
@@ -251,13 +251,13 @@ index e476f0d..6dc890a 100644
  int
  mm_auth_password(Authctxt *authctxt, char *password)
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index a4e9d24..9c2ee49 100644
+index 0c770e8..4d1e899 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
 @@ -41,7 +41,8 @@ void mm_log_handler(LogLevel, const char *, void *);
  int mm_is_monitor(void);
  DH *mm_choose_dh(int, int, int);
- int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
+ int mm_key_sign(Key *, u_char **, u_int *, const u_char *, u_int);
 -void mm_inform_authserv(char *, char *);
 +void mm_inform_authserv(char *, char *, char *);
 +void mm_inform_authrole(char *);
@@ -396,10 +396,10 @@ index 1c7a45d..436ae7c 100644
  char *platform_krb5_get_principal_name(const char *);
  int platform_sys_dir_uid(uid_t);
 diff --git a/session.c b/session.c
-index 3e96557..6f389ac 100644
+index 54bac36..d4b7725 100644
 --- a/session.c
 +++ b/session.c
-@@ -1486,7 +1486,7 @@ safely_chroot(const char *path, uid_t uid)
+@@ -1487,7 +1487,7 @@ safely_chroot(const char *path, uid_t uid)
  
  /* Set login name, uid, gid, and groups. */
  void
@@ -408,7 +408,7 @@ index 3e96557..6f389ac 100644
  {
         char *chroot_path, *tmp;
  #ifdef USE_LIBIAF
-@@ -1517,7 +1517,7 @@ do_setusercontext(struct passwd *pw)
+@@ -1518,7 +1518,7 @@ do_setusercontext(struct passwd *pw)
                 endgrent();
  #endif
  
@@ -417,7 +417,7 @@ index 3e96557..6f389ac 100644
  
                 if (options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
-@@ -1676,7 +1676,7 @@ do_child(Session *s, const char *command)
+@@ -1677,7 +1677,7 @@ do_child(Session *s, const char *command)
  
         /* Force a password change */
         if (s->authctxt->force_pwchange) {
@@ -426,7 +426,7 @@ index 3e96557..6f389ac 100644
                 child_close_fds();
                 do_pwchange(s);
                 exit(1);
-@@ -1703,7 +1703,7 @@ do_child(Session *s, const char *command)
+@@ -1704,7 +1704,7 @@ do_child(Session *s, const char *command)
                 /* When PAM is enabled we rely on it to do the nologin check */
                 if (!options.use_pam)
                         do_nologin(pw);
@@ -435,7 +435,7 @@ index 3e96557..6f389ac 100644
                 /*
                  * PAM session modules in do_setusercontext may have
                  * generated messages, so if this in an interactive
-@@ -2114,7 +2114,7 @@ session_pty_req(Session *s)
+@@ -2115,7 +2115,7 @@ session_pty_req(Session *s)
         tty_parse_modes(s->ttyfd, &n_bytes);
  
         if (!use_privsep)
@@ -458,10 +458,10 @@ index 6a2f35e..ef6593c 100644
                        const char *value);
  
 diff --git a/sshd.c b/sshd.c
-index 3a6be65..48a14dd 100644
+index 9cbe8c4..3b4e97c 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -772,7 +772,7 @@ privsep_postauth(Authctxt *authctxt)
+@@ -781,7 +781,7 @@ privsep_postauth(Authctxt *authctxt)
         explicit_bzero(rnd, sizeof(rnd));
  
         /* Drop privileges */
@@ -471,7 +471,7 @@ index 3a6be65..48a14dd 100644
   skip:
         /* It is safe now to apply the key state */
 diff --git a/sshpty.c b/sshpty.c
-index a2059b7..3512ec8 100644
+index d2ff8c1..f7b1f6d 100644
 --- a/sshpty.c
 +++ b/sshpty.c
 @@ -187,7 +187,7 @@ pty_change_window_size(int ptyfd, u_int row, u_int col,
@@ -483,7 +483,7 @@ index a2059b7..3512ec8 100644
  {
         struct group *grp;
         gid_t gid;
-@@ -214,7 +214,7 @@ pty_setowner(struct passwd *pw, const char *tty)
+@@ -209,7 +209,7 @@ pty_setowner(struct passwd *pw, const char *tty)
                     strerror(errno));
  
  #ifdef WITH_SELINUX
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 07e20f03d..549ef38dd 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From 66377fbb52584b41bd7f6f19116107fbbad41058 Mon Sep 17 00:00:00 2001
+From 8a8bbc66b8eefd7c679d5769f087209188deafe7 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
@@ -16,10 +16,10 @@ Patch-Name: shell-path.patch
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/sshconnect.c b/sshconnect.c
-index ac09eae..26116d2 100644
+index 9e51506..0073c6e 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -228,7 +228,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
+@@ -231,7 +231,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
                 /* Execute the proxy command.  Note that we gave up any
                    extra privileges above. */
                 signal(SIGPIPE, SIG_DFL);
@@ -28,7 +28,7 @@ index ac09eae..26116d2 100644
                 perror(argv[0]);
                 exit(1);
         }
-@@ -1416,7 +1416,7 @@ ssh_local_cmd(const char *args)
+@@ -1470,7 +1470,7 @@ ssh_local_cmd(const char *args)
         if (pid == 0) {
                 signal(SIGPIPE, SIG_DFL);
                 debug3("Executing %s -c \"%s\"", shell, args);
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
index 1eaa7758b..80e775dc1 100644
--- a/debian/patches/sigstop.patch
+++ b/debian/patches/sigstop.patch
@@ -1,4 +1,4 @@
-From 689f465c66059e527974c6d4ea8e95f04d5abab7 Mon Sep 17 00:00:00 2001
+From a8e779107942d044d281461c609ec29129dec51e Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:17 +0000
 Subject: Support synchronisation with service supervisor using SIGSTOP
@@ -13,10 +13,10 @@ Patch-Name: sigstop.patch
  1 file changed, 10 insertions(+)
 
 diff --git a/sshd.c b/sshd.c
-index 87331c1..23d5a64 100644
+index 5435968..f8db3ae 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -1958,6 +1958,16 @@ main(int ac, char **av)
+@@ -2030,6 +2030,16 @@ main(int ac, char **av)
                         }
                 }
  
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index 9c3ddc86e..b382252a3 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 78dd041bb6ad29ceb35f05b539b09ccf761eaee2 Mon Sep 17 00:00:00 2001
+From 101d1dd7f95d75f1862c541a5b8d4032d4623d53 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
@@ -13,10 +13,10 @@ Patch-Name: ssh-agent-setgid.patch
  1 file changed, 15 insertions(+)
 
 diff --git a/ssh-agent.1 b/ssh-agent.1
-index a1e634f..f2c4080 100644
+index 6759afe..25de326 100644
 --- a/ssh-agent.1
 +++ b/ssh-agent.1
-@@ -172,6 +172,21 @@ environment variable holds the agent's process ID.
+@@ -181,6 +181,21 @@ environment variable holds the agent's process ID.
  .Pp
  The agent exits automatically when the command given on the command
  line terminates.
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 0ccf7c42b..0fe3b6da4 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From cbd5cb03866f6df50c82d26588b73135d05bf245 Mon Sep 17 00:00:00 2001
+From fac628fd57d3d357b86d77987f896d6289240345 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
@@ -18,10 +18,10 @@ Patch-Name: ssh-argv0.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/ssh.1 b/ssh.1
-index de178cd..2606b15 100644
+index 04de6cf..c8892fe 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1458,6 +1458,7 @@ if an error occurred.
+@@ -1471,6 +1471,7 @@ if an error occurred.
  .Xr sftp 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index 427ee6be1..28b98f527 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -1,4 +1,4 @@
-From e6836d7c98c75d3252de56c2f3ea07e12c817e00 Mon Sep 17 00:00:00 2001
+From d027dea6b4b659a7ad537e452db563763302eabd Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:50 +0000
 Subject: Accept obsolete ssh-vulnkey configuration options
@@ -17,10 +17,10 @@ Patch-Name: ssh-vulnkey-compat.patch
  2 files changed, 2 insertions(+)
 
 diff --git a/readconf.c b/readconf.c
-index 9127e93..bc879eb 100644
+index 254dbce..278fe15 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -174,6 +174,7 @@ static struct {
+@@ -180,6 +180,7 @@ static struct {
         { "passwordauthentication", oPasswordAuthentication },
         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
         { "kbdinteractivedevices", oKbdInteractiveDevices },
@@ -29,10 +29,10 @@ index 9127e93..bc879eb 100644
         { "pubkeyauthentication", oPubkeyAuthentication },
         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
 diff --git a/servconf.c b/servconf.c
-index cb3c831..a252487 100644
+index f68c0d0..b3a2841 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -462,6 +462,7 @@ static struct {
+@@ -503,6 +503,7 @@ static struct {
         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
diff --git a/debian/patches/ssh1-keepalive.patch b/debian/patches/ssh1-keepalive.patch
index 2e5fa306d..e6bc72440 100644
--- a/debian/patches/ssh1-keepalive.patch
+++ b/debian/patches/ssh1-keepalive.patch
@@ -1,4 +1,4 @@
-From cbbc8577950b93090171c7394bcdeb68b7c3cd0c Mon Sep 17 00:00:00 2001
+From 396f7d932b391fc92ac7ccdf8813f49564e2bbab Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:51 +0000
 Subject: Partial server keep-alive implementation for SSH1
@@ -13,10 +13,10 @@ Patch-Name: ssh1-keepalive.patch
  2 files changed, 19 insertions(+), 11 deletions(-)
 
 diff --git a/clientloop.c b/clientloop.c
-index f9175e3..046ca8b 100644
+index 7df9413..156a196 100644
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -563,16 +563,21 @@ client_global_request_reply(int type, u_int32_t seq, void *ctxt)
+@@ -564,16 +564,21 @@ client_global_request_reply(int type, u_int32_t seq, void *ctxt)
  static void
  server_alive_check(void)
  {
@@ -47,7 +47,7 @@ index f9175e3..046ca8b 100644
  }
  
  /*
-@@ -634,7 +639,7 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
+@@ -635,7 +640,7 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
          */
  
         timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */
@@ -57,10 +57,10 @@ index f9175e3..046ca8b 100644
                 server_alive_time = now + options.server_alive_interval;
         }
 diff --git a/ssh_config.5 b/ssh_config.5
-index e6649ac..01f1f7f 100644
+index 4476171..dd35dd8 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1325,7 +1325,10 @@ If, for example,
+@@ -1409,7 +1409,10 @@ If, for example,
  .Cm ServerAliveCountMax
  is left at the default, if the server becomes unresponsive,
  ssh will disconnect after approximately 45 seconds.
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index bfc236927..d760e6c19 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -1,4 +1,4 @@
-From 69f7c00e04d1baa01a9038eeb764cfed0830fb19 Mon Sep 17 00:00:00 2001
+From fbe5bd9e957ea90404158b3a3c11a6b91fe6f010 Mon Sep 17 00:00:00 2001
 From: Jonathan David Amery <jdamery@ysolde.ucam.org>
 Date: Sun, 9 Feb 2014 16:09:54 +0000
 Subject: "LogLevel SILENT" compatibility
@@ -33,10 +33,10 @@ index 32e1d2e..53e7b65 100644
         { "FATAL",      SYSLOG_LEVEL_FATAL },
         { "ERROR",      SYSLOG_LEVEL_ERROR },
 diff --git a/ssh.c b/ssh.c
-index 26e9681..5bce695 100644
+index 0ad82f0..e8be6fe 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -989,7 +989,7 @@ main(int ac, char **av)
+@@ -1107,7 +1107,7 @@ main(int ac, char **av)
         /* Do not allocate a tty if stdin is not a tty. */
         if ((!isatty(fileno(stdin)) || stdin_null_flag) &&
             options.request_tty != REQUEST_TTY_FORCE) {
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index e4e4657f3..8ce3d1f71 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From 28ea747089f695e58a476a2849133402d4f86b92 Mon Sep 17 00:00:00 2001
+From 39b2121148a0aa016a648446823c8f02c5fd95b3 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability
@@ -28,10 +28,10 @@ Patch-Name: user-group-modes.patch
  8 files changed, 82 insertions(+), 29 deletions(-)
 
 diff --git a/auth-rhosts.c b/auth-rhosts.c
-index b5bedee..11fcca6 100644
+index ee9e827..2ff2cff 100644
 --- a/auth-rhosts.c
 +++ b/auth-rhosts.c
-@@ -256,8 +256,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
+@@ -271,8 +271,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
                 return 0;
         }
         if (options.strict_modes &&
@@ -41,7 +41,7 @@ index b5bedee..11fcca6 100644
                 logit("Rhosts authentication refused for %.100s: "
                     "bad ownership or modes for home directory.", pw->pw_name);
                 auth_debug_add("Rhosts authentication refused for %.100s: "
-@@ -283,8 +282,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
+@@ -298,8 +297,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
                  * allowing access to their account by anyone.
                  */
                 if (options.strict_modes &&
@@ -52,10 +52,10 @@ index b5bedee..11fcca6 100644
                             pw->pw_name, buf);
                         auth_debug_add("Bad file modes for %.200s", buf);
 diff --git a/auth.c b/auth.c
-index 5e60682..18de51a 100644
+index f9b7673..41e3876 100644
 --- a/auth.c
 +++ b/auth.c
-@@ -421,8 +421,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
+@@ -423,8 +423,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
                 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
                 if (options.strict_modes &&
                     (stat(user_hostfile, &st) == 0) &&
@@ -65,7 +65,7 @@ index 5e60682..18de51a 100644
                         logit("Authentication refused for %.100s: "
                             "bad owner or modes for %.200s",
                             pw->pw_name, user_hostfile);
-@@ -484,8 +483,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
+@@ -486,8 +485,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
                 snprintf(err, errlen, "%s is not a regular file", buf);
                 return -1;
         }
@@ -75,7 +75,7 @@ index 5e60682..18de51a 100644
                 snprintf(err, errlen, "bad ownership or modes for file %s",
                     buf);
                 return -1;
-@@ -500,8 +498,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
+@@ -502,8 +500,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
                 strlcpy(buf, cp, sizeof(buf));
  
                 if (stat(buf, &st) < 0 ||
@@ -86,7 +86,7 @@ index 5e60682..18de51a 100644
                             "bad ownership or modes for directory %s", buf);
                         return -1;
 diff --git a/misc.c b/misc.c
-index 94b05b0..c25ccd8 100644
+index 38af3df..d745480 100644
 --- a/misc.c
 +++ b/misc.c
 @@ -50,8 +50,9 @@
@@ -216,10 +216,10 @@ index f35ec39..9a23e6e 100644
 -       return 0;
 -}
 diff --git a/readconf.c b/readconf.c
-index 337818c..0648867 100644
+index 1d2d596..2ef8d7b 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -38,6 +38,8 @@
+@@ -39,6 +39,8 @@
  #include <stdio.h>
  #include <string.h>
  #include <unistd.h>
@@ -228,7 +228,7 @@ index 337818c..0648867 100644
  #ifdef HAVE_UTIL_H
  #include <util.h>
  #endif
-@@ -1516,8 +1518,7 @@ read_config_file(const char *filename, struct passwd *pw, const char *host,
+@@ -1579,8 +1581,7 @@ read_config_file(const char *filename, struct passwd *pw, const char *host,
  
                 if (fstat(fileno(f), &sb) == -1)
                         fatal("fstat %s: %s", filename, strerror(errno));
@@ -239,10 +239,10 @@ index 337818c..0648867 100644
         }
  
 diff --git a/ssh.1 b/ssh.1
-index fa5cfb2..7f6ab77 100644
+index da64b71..53c711a 100644
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1342,6 +1342,8 @@ The file format and configuration options are described in
+@@ -1355,6 +1355,8 @@ The file format and configuration options are described in
  .Xr ssh_config 5 .
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not writable by others.
@@ -252,10 +252,10 @@ index fa5cfb2..7f6ab77 100644
  .It Pa ~/.ssh/environment
  Contains additional definitions for environment variables; see
 diff --git a/ssh_config.5 b/ssh_config.5
-index ea92ea8..d68b45a 100644
+index 250c0d1..8abcf40 100644
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1587,6 +1587,8 @@ The format of this file is described above.
+@@ -1701,6 +1701,8 @@ The format of this file is described above.
  This file is used by the SSH client.
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not accessible by others.