Update to 8.4p1

4 files changed, 33 insertions, 3895 deletions

diff --git a/.SRCINFO b/.SRCINFO
index b1db5fdd46bb..f2c5d987934d 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,18 +1,24 @@
 pkgbase = openssh-gssapi
 	pkgdesc = Premier connectivity tool for remote login with the SSH protocol
-	pkgver = 8.2p1
+	pkgver = 8.4p1
 	pkgrel = 1
 	url = https://www.openssh.com/portable.html
 	install = install
 	arch = x86_64
 	license = custom:BSD
+	checkdepends = inetutils
 	makedepends = linux-headers
-	makedepends = git
 	makedepends = libfido2
+	makedepends = git
+	depends = glibc
 	depends = krb5
 	depends = openssl
 	depends = libedit
 	depends = ldns
+	depends = libxcrypt
+	depends = libcrypt.so
+	depends = zlib
+	depends = pam
 	optdepends = xorg-xauth: X11 forwarding
 	optdepends = x11-ssh-askpass: input passphrase in X
 	optdepends = libfido2: FIDO/U2F support
@@ -21,23 +27,23 @@ pkgbase = openssh-gssapi
 	backup = etc/ssh/ssh_config
 	backup = etc/ssh/sshd_config
 	backup = etc/pam.d/sshd
-	source = https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.2p1.tar.gz
-	source = https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.2p1.tar.gz.asc
+	source = https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz
+	source = https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.4p1.tar.gz.asc
+	source = https://sources.debian.org/data/main/o/openssh/1:8.4p1-5/debian/patches/gssapi.patch
 	source = sshdgenkeys.service
 	source = sshd.service
 	source = sshd.conf
 	source = sshd.pam
 	source = glibc-2.31.patch
-	source = openssh-gssapi-debian.patch
 	validpgpkeys = 59C2118ED206D927E667EBE3D3E5F56B6D920D30
-	sha256sums = 43925151e6cf6cee1450190c0e9af4dc36b41c12737619edff8bcebdff64e671
+	sha256sums = 5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24
 	sha256sums = SKIP
+	sha256sums = 15139c42894dd0ebd182608ecd7151a9eef6158aed30c676e7685e8407c6d1cb
 	sha256sums = 4031577db6416fcbaacf8a26a024ecd3939e5c10fe6a86ee3f0eea5093d533b7
 	sha256sums = e40f8b7c8e5e2ecf3084b3511a6c36d5b5c9f9e61f2bb13e3726c71dc7d4fbc7
 	sha256sums = 4effac1186cc62617f44385415103021f72f674f8b8e26447fc1139c670090f6
 	sha256sums = 64576021515c0a98b0aaf0a0ae02e0f5ebe8ee525b1e647ab68f369f81ecd846
 	sha256sums = 25b4a4d9e2d9d3289ef30636a30e85fa1c71dd930d5efd712cca1a01a5019f93
-	sha256sums = 9c3e3fb636809b8973db971d89fca0d347b4558ee447c111d6a66199aadeb7e9
 
 pkgname = openssh-gssapi
 
diff --git a/.gitignore b/.gitignore
index 13d706a30bcc..e840d3f49e8f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /*.tar.*
 /pkg/
 /src/
+/gssapi.patch
diff --git a/PKGBUILD b/PKGBUILD
index 960e9f407839..d1ed6ca3b92a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,11 +1,13 @@
-# Maintainer: Gaetan Bisson <bisson@archlinux.org>
+# Maintainer: Christoph Gysin <christoph.gysin@gmail.com>
+# Contributor: Levente Polyak <anthraxx[at]archlinux[dot]org>
+# Contributor: Giancarlo Razzolini <grazzolini@archlinux.org>
+# Contributor: Gaetan Bisson <bisson@archlinux.org>
 # Contributor: Aaron Griffin <aaron@archlinux.org>
 # Contributor: judd <jvinet@zeroflux.org>
-# Contributor: Christoph Gysin <christoph.gysin@gmail.com>
 
 pkgname=openssh-gssapi
 _pkgname=openssh
-pkgver=8.2p1
+pkgver=8.4p1
 pkgrel=1
 pkgdesc='Premier connectivity tool for remote login with the SSH protocol'
 url='https://www.openssh.com/portable.html'
@@ -13,27 +15,30 @@ license=('custom:BSD')
 conflicts=(${_pkgname})
 provides=(${_pkgname})
 arch=('x86_64')
-makedepends=('linux-headers' 'git' 'libfido2')
-depends=('krb5' 'openssl' 'libedit' 'ldns')
+depends=('glibc' 'krb5' 'openssl' 'libedit' 'ldns' 'libxcrypt' 'libcrypt.so' 'zlib' 'pam')
+makedepends=('linux-headers' 'libfido2' 'git')
+checkdepends=('inetutils')
 optdepends=('xorg-xauth: X11 forwarding'
             'x11-ssh-askpass: input passphrase in X'
             'libfido2: FIDO/U2F support')
+
 validpgpkeys=('59C2118ED206D927E667EBE3D3E5F56B6D920D30')
+#source=("git://anongit.mindrot.org/openssh.git?signed#tag=V_8_2_P1"
 source=("https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/${_pkgname}-${pkgver}.tar.gz"{,.asc}
+        "https://sources.debian.org/data/main/o/openssh/1:${pkgver}-5/debian/patches/gssapi.patch"
         'sshdgenkeys.service'
         'sshd.service'
         'sshd.conf'
         'sshd.pam'
-        'glibc-2.31.patch'
-        'openssh-gssapi-debian.patch')
-sha256sums=('43925151e6cf6cee1450190c0e9af4dc36b41c12737619edff8bcebdff64e671'
+        'glibc-2.31.patch')
+sha256sums=('5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24'
             'SKIP'
+            '15139c42894dd0ebd182608ecd7151a9eef6158aed30c676e7685e8407c6d1cb'
             '4031577db6416fcbaacf8a26a024ecd3939e5c10fe6a86ee3f0eea5093d533b7'
             'e40f8b7c8e5e2ecf3084b3511a6c36d5b5c9f9e61f2bb13e3726c71dc7d4fbc7'
             '4effac1186cc62617f44385415103021f72f674f8b8e26447fc1139c670090f6'
             '64576021515c0a98b0aaf0a0ae02e0f5ebe8ee525b1e647ab68f369f81ecd846'
-            '25b4a4d9e2d9d3289ef30636a30e85fa1c71dd930d5efd712cca1a01a5019f93'
-            '10441cbd6116b45f409afd95aa0b682b1ed389c771996a8d9eb117633131f6fa')
+            '25b4a4d9e2d9d3289ef30636a30e85fa1c71dd930d5efd712cca1a01a5019f93')
 
 backup=('etc/ssh/ssh_config' 'etc/ssh/sshd_config' 'etc/pam.d/sshd')
 
@@ -41,8 +46,10 @@ install=install
 
 prepare() {
     cd "${srcdir}/${_pkgname}-${pkgver}"
+
     patch -p1 -i ../glibc-2.31.patch
-    patch -p1 -i ../openssh-gssapi-debian.patch
+    patch -p1 -i ../gssapi.patch
+
     autoreconf
 }
 
@@ -73,6 +80,7 @@ build() {
 
 check() {
     cd "${srcdir}/${_pkgname}-${pkgver}"
+
     # Tests require openssh to be already installed system-wide,
     # also connectivity tests will fail under makechrootpkg since
     # it runs as nobody which has /bin/false as login shell.
diff --git a/openssh-gssapi-debian.patch b/openssh-gssapi-debian.patch
deleted file mode 100644
index 3bea8807e020..000000000000
--- a/openssh-gssapi-debian.patch
+++ /dev/null
@@ -1,3877 +0,0 @@
-diff --git a/Makefile.in b/Makefile.in
-index e7549470..b68c1710 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
- 	kexgexc.o kexgexs.o \
- 	sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
-+	kexgssc.o \
- 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
- 	sshbuf-io.o
- 
-@@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
- 	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
- 	auth2-none.o auth2-passwd.o auth2-pubkey.o \
- 	monitor.o monitor_wrap.o auth-krb5.o \
--	auth2-gss.o gss-serv.o gss-serv-krb5.o \
-+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
- 	sftp-server.o sftp-common.o \
- 	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
-diff --git a/auth.c b/auth.c
-index 086b8ebb..687c57b4 100644
---- a/auth.c
-+++ b/auth.c
-@@ -400,7 +400,8 @@ auth_root_allowed(struct ssh *ssh, const char *method)
- 	case PERMIT_NO_PASSWD:
- 		if (strcmp(method, "publickey") == 0 ||
- 		    strcmp(method, "hostbased") == 0 ||
--		    strcmp(method, "gssapi-with-mic") == 0)
-+		    strcmp(method, "gssapi-with-mic") == 0 ||
-+		    strcmp(method, "gssapi-keyex") == 0)
- 			return 1;
- 		break;
- 	case PERMIT_FORCED_ONLY:
-@@ -724,99 +725,6 @@ fakepw(void)
- 	return (&fake);
- }
- 
--/*
-- * Returns the remote DNS hostname as a string. The returned string must not
-- * be freed. NB. this will usually trigger a DNS query the first time it is
-- * called.
-- * This function does additional checks on the hostname to mitigate some
-- * attacks on legacy rhosts-style authentication.
-- * XXX is RhostsRSAAuthentication vulnerable to these?
-- * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
-- */
--
--static char *
--remote_hostname(struct ssh *ssh)
--{
--	struct sockaddr_storage from;
--	socklen_t fromlen;
--	struct addrinfo hints, *ai, *aitop;
--	char name[NI_MAXHOST], ntop2[NI_MAXHOST];
--	const char *ntop = ssh_remote_ipaddr(ssh);
--
--	/* Get IP address of client. */
--	fromlen = sizeof(from);
--	memset(&from, 0, sizeof(from));
--	if (getpeername(ssh_packet_get_connection_in(ssh),
--	    (struct sockaddr *)&from, &fromlen) == -1) {
--		debug("getpeername failed: %.100s", strerror(errno));
--		return xstrdup(ntop);
--	}
--
--	ipv64_normalise_mapped(&from, &fromlen);
--	if (from.ss_family == AF_INET6)
--		fromlen = sizeof(struct sockaddr_in6);
--
--	debug3("Trying to reverse map address %.100s.", ntop);
--	/* Map the IP address to a host name. */
--	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
--	    NULL, 0, NI_NAMEREQD) != 0) {
--		/* Host name not found.  Use ip address. */
--		return xstrdup(ntop);
--	}
--
--	/*
--	 * if reverse lookup result looks like a numeric hostname,
--	 * someone is trying to trick us by PTR record like following:
--	 *	1.1.1.10.in-addr.arpa.	IN PTR	2.3.4.5
--	 */
--	memset(&hints, 0, sizeof(hints));
--	hints.ai_socktype = SOCK_DGRAM;	/*dummy*/
--	hints.ai_flags = AI_NUMERICHOST;
--	if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
--		logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
--		    name, ntop);
--		freeaddrinfo(ai);
--		return xstrdup(ntop);
--	}
--
--	/* Names are stored in lowercase. */
--	lowercase(name);
--
--	/*
--	 * Map it back to an IP address and check that the given
--	 * address actually is an address of this host.  This is
--	 * necessary because anyone with access to a name server can
--	 * define arbitrary names for an IP address. Mapping from
--	 * name to IP address can be trusted better (but can still be
--	 * fooled if the intruder has access to the name server of
--	 * the domain).
--	 */
--	memset(&hints, 0, sizeof(hints));
--	hints.ai_family = from.ss_family;
--	hints.ai_socktype = SOCK_STREAM;
--	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
--		logit("reverse mapping checking getaddrinfo for %.700s "
--		    "[%s] failed.", name, ntop);
--		return xstrdup(ntop);
--	}
--	/* Look for the address from the list of addresses. */
--	for (ai = aitop; ai; ai = ai->ai_next) {
--		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
--		    sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
--		    (strcmp(ntop, ntop2) == 0))
--				break;
--	}
--	freeaddrinfo(aitop);
--	/* If we reached the end of the list, the address was not there. */
--	if (ai == NULL) {
--		/* Address not found for the host name. */
--		logit("Address %.100s maps to %.600s, but this does not "
--		    "map back to the address.", ntop, name);
--		return xstrdup(ntop);
--	}
--	return xstrdup(name);
--}
--
- /*
-  * Return the canonical name of the host in the other side of the current
-  * connection.  The host name is cached, so it is efficient to call this
-diff --git a/auth2-gss.c b/auth2-gss.c
-index 9351e042..d6446c0c 100644
---- a/auth2-gss.c
-+++ b/auth2-gss.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.29 2018/07/31 03:10:27 djm Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
- static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
- static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
- 
-+/*
-+ * The 'gssapi_keyex' userauth mechanism.
-+ */
-+static int
-+userauth_gsskeyex(struct ssh *ssh)
-+{
-+	Authctxt *authctxt = ssh->authctxt;
-+	int r, authenticated = 0;
-+	struct sshbuf *b = NULL;
-+	gss_buffer_desc mic, gssbuf;
-+	u_char *p;
-+	size_t len;
-+
-+	if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
-+	    (r = sshpkt_get_end(ssh)) != 0)
-+		fatal("%s: %s", __func__, ssh_err(r));
-+
-+	if ((b = sshbuf_new()) == NULL)
-+		fatal("%s: sshbuf_new failed", __func__);
-+
-+	mic.value = p;
-+	mic.length = len;
-+
-+	ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
-+	    "gssapi-keyex");
-+
-+	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
-+		fatal("%s: sshbuf_mutable_ptr failed", __func__);
-+	gssbuf.length = sshbuf_len(b);
-+
-+	/* gss_kex_context is NULL with privsep, so we can't check it here */
-+	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context,
-+	    &gssbuf, &mic))))
-+		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+		    authctxt->pw, 1));
-+
-+	sshbuf_free(b);
-+	free(mic.value);
-+
-+	return (authenticated);
-+}
-+
- /*
-  * We only support those mechanisms that we know about (ie ones that we know
-  * how to check local user kuserok and the like)
-@@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
- 	if ((r = sshpkt_get_end(ssh)) != 0)
- 		fatal("%s: %s", __func__, ssh_err(r));
- 
--	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+	    authctxt->pw, 1));
- 
- 	if ((!use_privsep || mm_is_monitor()) &&
- 	    (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
- 	gssbuf.length = sshbuf_len(b);
- 
- 	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
--		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+		    authctxt->pw, 0));
- 	else
- 		logit("GSSAPI MIC check failed");
- 
-@@ -326,6 +370,12 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
- 	return 0;
- }
- 
-+Authmethod method_gsskeyex = {
-+	"gssapi-keyex",
-+	userauth_gsskeyex,
-+	&options.gss_authentication
-+};
-+
- Authmethod method_gssapi = {
- 	"gssapi-with-mic",
- 	userauth_gssapi,
-diff --git a/auth2.c b/auth2.c
-index 0e776224..1c217268 100644
---- a/auth2.c
-+++ b/auth2.c
-@@ -73,6 +73,7 @@ extern Authmethod method_passwd;
- extern Authmethod method_kbdint;
- extern Authmethod method_hostbased;
- #ifdef GSSAPI
-+extern Authmethod method_gsskeyex;
- extern Authmethod method_gssapi;
- #endif
- 
-@@ -80,6 +81,7 @@ Authmethod *authmethods[] = {
- 	&method_none,
- 	&method_pubkey,
- #ifdef GSSAPI
-+	&method_gsskeyex,
- 	&method_gssapi,
- #endif
- 	&method_passwd,
-diff --git a/canohost.c b/canohost.c
-index abea9c6e..8e81b519 100644
---- a/canohost.c
-+++ b/canohost.c
-@@ -35,6 +35,99 @@
- #include "canohost.h"
- #include "misc.h"
- 
-+/*
-+ * Returns the remote DNS hostname as a string. The returned string must not
-+ * be freed. NB. this will usually trigger a DNS query the first time it is
-+ * called.
-+ * This function does additional checks on the hostname to mitigate some
-+ * attacks on legacy rhosts-style authentication.
-+ * XXX is RhostsRSAAuthentication vulnerable to these?
-+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
-+ */
-+
-+char *
-+remote_hostname(struct ssh *ssh)
-+{
-+	struct sockaddr_storage from;
-+	socklen_t fromlen;
-+	struct addrinfo hints, *ai, *aitop;
-+	char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-+	const char *ntop = ssh_remote_ipaddr(ssh);
-+
-+	/* Get IP address of client. */
-+	fromlen = sizeof(from);
-+	memset(&from, 0, sizeof(from));
-+	if (getpeername(ssh_packet_get_connection_in(ssh),
-+	    (struct sockaddr *)&from, &fromlen) == -1) {
-+		debug("getpeername failed: %.100s", strerror(errno));
-+		return xstrdup(ntop);
-+	}
-+
-+	ipv64_normalise_mapped(&from, &fromlen);
-+	if (from.ss_family == AF_INET6)
-+		fromlen = sizeof(struct sockaddr_in6);
-+
-+	debug3("Trying to reverse map address %.100s.", ntop);
-+	/* Map the IP address to a host name. */
-+	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-+	    NULL, 0, NI_NAMEREQD) != 0) {
-+		/* Host name not found.  Use ip address. */
-+		return xstrdup(ntop);
-+	}
-+
-+	/*
-+	 * if reverse lookup result looks like a numeric hostname,
-+	 * someone is trying to trick us by PTR record like following:
-+	 *	1.1.1.10.in-addr.arpa.	IN PTR	2.3.4.5
-+	 */
-+	memset(&hints, 0, sizeof(hints));
-+	hints.ai_socktype = SOCK_DGRAM;	/*dummy*/
-+	hints.ai_flags = AI_NUMERICHOST;
-+	if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-+		logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-+		    name, ntop);
-+		freeaddrinfo(ai);
-+		return xstrdup(ntop);
-+	}
-+
-+	/* Names are stored in lowercase. */
-+	lowercase(name);
-+
-+	/*
-+	 * Map it back to an IP address and check that the given
-+	 * address actually is an address of this host.  This is
-+	 * necessary because anyone with access to a name server can
-+	 * define arbitrary names for an IP address. Mapping from
-+	 * name to IP address can be trusted better (but can still be
-+	 * fooled if the intruder has access to the name server of
-+	 * the domain).
-+	 */
-+	memset(&hints, 0, sizeof(hints));
-+	hints.ai_family = from.ss_family;
-+	hints.ai_socktype = SOCK_STREAM;
-+	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-+		logit("reverse mapping checking getaddrinfo for %.700s "
-+		    "[%s] failed.", name, ntop);
-+		return xstrdup(ntop);
-+	}
-+	/* Look for the address from the list of addresses. */
-+	for (ai = aitop; ai; ai = ai->ai_next) {
-+		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-+		    sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-+		    (strcmp(ntop, ntop2) == 0))
-+				break;
-+	}
-+	freeaddrinfo(aitop);
-+	/* If we reached the end of the list, the address was not there. */
-+	if (ai == NULL) {
-+		/* Address not found for the host name. */
-+		logit("Address %.100s maps to %.600s, but this does not "
-+		    "map back to the address.", ntop, name);
-+		return xstrdup(ntop);
-+	}
-+	return xstrdup(name);
-+}
-+
- void
- ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
- {
-diff --git a/canohost.h b/canohost.h
-index 26d62855..0cadc9f1 100644
---- a/canohost.h
-+++ b/canohost.h
-@@ -15,6 +15,9 @@
- #ifndef _CANOHOST_H
- #define _CANOHOST_H
- 
-+struct ssh;
-+
-+char		*remote_hostname(struct ssh *);
- char		*get_peer_ipaddr(int);
- int		 get_peer_port(int);
- char		*get_local_ipaddr(int);
-diff --git a/clientloop.c b/clientloop.c
-index ebd0dbca..1bdac6a4 100644
---- a/clientloop.c
-+++ b/clientloop.c
-@@ -112,6 +112,10 @@
- #include "ssherr.h"
- #include "hostfile.h"
- 
-+#ifdef GSSAPI
-+#include "ssh-gss.h"
-+#endif
-+
- /* import options */
- extern Options options;
- 
-@@ -1379,9 +1383,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
- 			break;
- 
- 		/* Do channel operations unless rekeying in progress. */
--		if (!ssh_packet_is_rekeying(ssh))
-+		if (!ssh_packet_is_rekeying(ssh)) {
- 			channel_after_select(ssh, readset, writeset);
- 
-+#ifdef GSSAPI
-+			if (options.gss_renewal_rekey &&
-+			    ssh_gssapi_credentials_updated(NULL)) {
-+				debug("credentials updated - forcing rekey");
-+				need_rekeying = 1;
-+			}
-+#endif
-+		}
-+
- 		/* Buffer input from the connection.  */
- 		client_process_net_input(ssh, readset);
- 
-diff --git a/configure.ac b/configure.ac
-index b689db4b..efafb6bd 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -674,6 +674,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
- 	    [Use tunnel device compatibility to OpenBSD])
- 	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
- 	    [Prepend the address family to IP tunnel traffic])
-+	AC_MSG_CHECKING([if we have the Security Authorization Session API])
-+	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
-+		[SessionCreate(0, 0);],
-+		[ac_cv_use_security_session_api="yes"
-+		 AC_DEFINE([USE_SECURITY_SESSION_API], [1],
-+			[platform has the Security Authorization Session API])
-+		 LIBS="$LIBS -framework Security"
-+		 AC_MSG_RESULT([yes])],
-+		[ac_cv_use_security_session_api="no"
-+		 AC_MSG_RESULT([no])])
-+	AC_MSG_CHECKING([if we have an in-memory credentials cache])
-+	AC_TRY_COMPILE(
-+		[#include <Kerberos/Kerberos.h>],
-+		[cc_context_t c;
-+		 (void) cc_initialize (&c, 0, NULL, NULL);],
-+		[AC_DEFINE([USE_CCAPI], [1],
-+			[platform uses an in-memory credentials cache])
-+		 LIBS="$LIBS -framework Security"
-+		 AC_MSG_RESULT([yes])
-+		 if test "x$ac_cv_use_security_session_api" = "xno"; then
-+			AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***])
-+		fi],
-+		[AC_MSG_RESULT([no])]
-+	)
- 	m4_pattern_allow([AU_IPv])
- 	AC_CHECK_DECL([AU_IPv4], [],
- 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
-diff --git a/gss-genr.c b/gss-genr.c
-index d56257b4..763a63ff 100644
---- a/gss-genr.c
-+++ b/gss-genr.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-genr.c,v 1.26 2018/07/10 09:13:30 djm Exp $ */
- 
- /*
-- * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -41,12 +41,36 @@
- #include "sshbuf.h"
- #include "log.h"
- #include "ssh2.h"
-+#include "cipher.h"
-+#include "sshkey.h"
-+#include "kex.h"
-+#include "digest.h"
-+#include "packet.h"
- 
- #include "ssh-gss.h"
- 
- extern u_char *session_id2;
- extern u_int session_id2_len;
- 
-+typedef struct {
-+	char *encoded;
-+	gss_OID oid;
-+} ssh_gss_kex_mapping;
-+
-+/*
-+ * XXX - It would be nice to find a more elegant way of handling the
-+ * XXX   passing of the key exchange context to the userauth routines
-+ */
-+
-+Gssctxt *gss_kex_context = NULL;
-+
-+static ssh_gss_kex_mapping *gss_enc2oid = NULL;
-+
-+int
-+ssh_gssapi_oid_table_ok(void) {
-+	return (gss_enc2oid != NULL);
-+}
-+
- /* sshbuf_get for gss_buffer_desc */
- int
- ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
-@@ -62,6 +86,162 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
- 	return 0;
- }
- 
-+/* sshpkt_get of gss_buffer_desc */
-+int
-+ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *ssh, gss_buffer_desc *g)
-+{
-+	int r;
-+	u_char *p;
-+	size_t len;
-+
-+	if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)
-+		return r;
-+	g->value = p;
-+	g->length = len;
-+	return 0;
-+}
-+
-+/*
-+ * Return a list of the gss-group1-sha1 mechanisms supported by this program
-+ *
-+ * We test mechanisms to ensure that we can use them, to avoid starting
-+ * a key exchange with a bad mechanism
-+ */
-+
-+char *
-+ssh_gssapi_client_mechanisms(const char *host, const char *client,
-+    const char *kex) {
-+	gss_OID_set gss_supported = NULL;
-+	OM_uint32 min_status;
-+
-+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))
-+		return NULL;
-+
-+	return ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
-+	    host, client, kex);
-+}
-+
-+char *
-+ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
-+    const char *host, const char *client, const char *kex) {
-+	struct sshbuf *buf = NULL;
-+	size_t i;
-+	int r = SSH_ERR_ALLOC_FAIL;
-+	int oidpos, enclen;
-+	char *mechs, *encoded;
-+	u_char digest[SSH_DIGEST_MAX_LENGTH];
-+	char deroid[2];
-+	struct ssh_digest_ctx *md = NULL;
-+	char *s, *cp, *p;
-+
-+	if (gss_enc2oid != NULL) {
-+		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)
-+			free(gss_enc2oid[i].encoded);
-+		free(gss_enc2oid);
-+	}
-+
-+	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *
-+	    (gss_supported->count + 1));
-+
-+	if ((buf = sshbuf_new()) == NULL)
-+		fatal("%s: sshbuf_new failed", __func__);
-+
-+	oidpos = 0;
-+	s = cp = xstrdup(kex);
-+	for (i = 0; i < gss_supported->count; i++) {
-+		if (gss_supported->elements[i].length < 128 &&
-+		    (*check)(NULL, &(gss_supported->elements[i]), host, client)) {
-+
-+			deroid[0] = SSH_GSS_OIDTYPE;
-+			deroid[1] = gss_supported->elements[i].length;
-+
-+			if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
-+			    (r = ssh_digest_update(md, deroid, 2)) != 0 ||
-+			    (r = ssh_digest_update(md,
-+			        gss_supported->elements[i].elements,
-+			        gss_supported->elements[i].length)) != 0 ||
-+			    (r = ssh_digest_final(md, digest, sizeof(digest))) != 0)
-+				fatal("%s: digest failed: %s", __func__,
-+				    ssh_err(r));
-+			ssh_digest_free(md);
-+			md = NULL;
-+
-+			encoded = xmalloc(ssh_digest_bytes(SSH_DIGEST_MD5)
-+			    * 2);
-+			enclen = __b64_ntop(digest,
-+			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
-+			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
-+
-+			cp = strncpy(s, kex, strlen(kex));
-+			for ((p = strsep(&cp, ",")); p && *p != '\0';
-+				(p = strsep(&cp, ","))) {
-+				if (sshbuf_len(buf) != 0 &&
-+				    (r = sshbuf_put_u8(buf, ',')) != 0)
-+					fatal("%s: sshbuf_put_u8 error: %s",
-+					    __func__, ssh_err(r));
-+				if ((r = sshbuf_put(buf, p, strlen(p))) != 0 ||
-+				    (r = sshbuf_put(buf, encoded, enclen)) != 0)
-+					fatal("%s: sshbuf_put error: %s",
-+					    __func__, ssh_err(r));
-+			}
-+
-+			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
-+			gss_enc2oid[oidpos].encoded = encoded;
-+			oidpos++;
-+		}
-+	}
-+	free(s);
-+	gss_enc2oid[oidpos].oid = NULL;
-+	gss_enc2oid[oidpos].encoded = NULL;
-+
-+	if ((mechs = sshbuf_dup_string(buf)) == NULL)
-+		fatal("%s: sshbuf_dup_string failed", __func__);
-+
-+	sshbuf_free(buf);
-+
-+	if (strlen(mechs) == 0) {
-+		free(mechs);
-+		mechs = NULL;
-+	}
-+
-+	return (mechs);
-+}
-+
-+gss_OID
-+ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
-+	int i = 0;
-+
-+#define SKIP_KEX_NAME(type) \
-+	case type: \
-+		if (strlen(name) < sizeof(type##_ID)) \
-+			return GSS_C_NO_OID; \
-+		name += sizeof(type##_ID) - 1; \
-+		break;
-+
-+	switch (kex_type) {
-+	SKIP_KEX_NAME(KEX_GSS_GRP1_SHA1)
-+	SKIP_KEX_NAME(KEX_GSS_GRP14_SHA1)
-+	SKIP_KEX_NAME(KEX_GSS_GRP14_SHA256)
-+	SKIP_KEX_NAME(KEX_GSS_GRP16_SHA512)
-+	SKIP_KEX_NAME(KEX_GSS_GEX_SHA1)
-+	SKIP_KEX_NAME(KEX_GSS_NISTP256_SHA256)
-+	SKIP_KEX_NAME(KEX_GSS_C25519_SHA256)
-+	default:
-+		return GSS_C_NO_OID;
-+	}
-+
-+#undef SKIP_KEX_NAME
-+
-+	while (gss_enc2oid[i].encoded != NULL &&
-+	    strcmp(name, gss_enc2oid[i].encoded) != 0)
-+		i++;
-+
-+	if (gss_enc2oid[i].oid != NULL && ctx != NULL)
-+		ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);
-+
-+	return gss_enc2oid[i].oid;
-+}
-+
- /* Check that the OID in a data stream matches that in the context */
- int
- ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -218,7 +398,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
- 	}
- 
- 	ctx->major = gss_init_sec_context(&ctx->minor,
--	    GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid,
-+	    ctx->client_creds, &ctx->context, ctx->name, ctx->oid,
- 	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
- 	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);
- 
-@@ -247,9 +427,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
- 	return (ctx->major);
- }
- 
-+OM_uint32
-+ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)
-+{
-+	gss_buffer_desc gssbuf;
-+	gss_name_t gssname;
-+	OM_uint32 status;
-+	gss_OID_set oidset;
-+
-+	gssbuf.value = (void *) name;
-+	gssbuf.length = strlen(gssbuf.value);
-+
-+	gss_create_empty_oid_set(&status, &oidset);
-+	gss_add_oid_set_member(&status, ctx->oid, &oidset);
-+
-+	ctx->major = gss_import_name(&ctx->minor, &gssbuf,
-+	    GSS_C_NT_USER_NAME, &gssname);
-+
-+	if (!ctx->major)
-+		ctx->major = gss_acquire_cred(&ctx->minor,
-+		    gssname, 0, oidset, GSS_C_INITIATE,
-+		    &ctx->client_creds, NULL, NULL);
-+
-+	gss_release_name(&status, &gssname);
-+	gss_release_oid_set(&status, &oidset);
-+
-+	if (ctx->major)
-+		ssh_gssapi_error(ctx);
-+
-+	return(ctx->major);
-+}
-+
- OM_uint32
- ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
- {
-+	if (ctx == NULL)
-+		return -1;
-+
- 	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
- 	    GSS_C_QOP_DEFAULT, buffer, hash)))
- 		ssh_gssapi_error(ctx);
-@@ -257,6 +471,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
- 	return (ctx->major);
- }
- 
-+/* Priviledged when used by server */
-+OM_uint32
-+ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
-+{
-+	if (ctx == NULL)
-+		return -1;
-+
-+	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
-+	    gssbuf, gssmic, NULL);
-+
-+	return (ctx->major);
-+}
-+
- void
- ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
-     const char *context)
-@@ -273,11 +500,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
- }
- 
- int
--ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
-+ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host,
-+    const char *client)
- {
- 	gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
- 	OM_uint32 major, minor;
- 	gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"};
-+	Gssctxt *intctx = NULL;
-+
-+	if (ctx == NULL)
-+		ctx = &intctx;
- 
- 	/* RFC 4462 says we MUST NOT do SPNEGO */
- 	if (oid->length == spnego_oid.length && 
-@@ -287,6 +519,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
- 	ssh_gssapi_build_ctx(ctx);
- 	ssh_gssapi_set_oid(*ctx, oid);
- 	major = ssh_gssapi_import_name(*ctx, host);
-+
-+	if (!GSS_ERROR(major) && client)
-+		major = ssh_gssapi_client_identity(*ctx, client);
-+
- 	if (!GSS_ERROR(major)) {
- 		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
- 		    NULL);
-@@ -296,10 +532,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
- 			    GSS_C_NO_BUFFER);
- 	}
- 
--	if (GSS_ERROR(major)) 
-+	if (GSS_ERROR(major) || intctx != NULL)
- 		ssh_gssapi_delete_ctx(ctx);
- 
- 	return (!GSS_ERROR(major));
- }
- 
-+int
-+ssh_gssapi_credentials_updated(Gssctxt *ctxt) {
-+	static gss_name_t saved_name = GSS_C_NO_NAME;
-+	static OM_uint32 saved_lifetime = 0;
-+	static gss_OID saved_mech = GSS_C_NO_OID;
-+	static gss_name_t name;
-+	static OM_uint32 last_call = 0;
-+	OM_uint32 lifetime, now, major, minor;
-+	int equal;
-+
-+	now = time(NULL);
-+
-+	if (ctxt) {
-+		debug("Rekey has happened - updating saved versions");
-+
-+		if (saved_name != GSS_C_NO_NAME)
-+			gss_release_name(&minor, &saved_name);
-+
-+		major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,
-+		    &saved_name, &saved_lifetime, NULL, NULL);
-+
-+		if (!GSS_ERROR(major)) {
-+			saved_mech = ctxt->oid;
-+		        saved_lifetime+= now;
-+		} else {
-+			/* Handle the error */
-+		}
-+		return 0;
-+	}
-+
-+	if (now - last_call < 10)
-+		return 0;
-+
-+	last_call = now;
-+
-+	if (saved_mech == GSS_C_NO_OID)
-+		return 0;
-+
-+	major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,
-+	    &name, &lifetime, NULL, NULL);
-+	if (major == GSS_S_CREDENTIALS_EXPIRED)
-+		return 0;
-+	else if (GSS_ERROR(major))
-+		return 0;
-+
-+	major = gss_compare_name(&minor, saved_name, name, &equal);
-+	gss_release_name(&minor, &name);
-+	if (GSS_ERROR(major))
-+		return 0;
-+
-+	if (equal && (saved_lifetime < lifetime + now - 10))
-+		return 1;
-+
-+	return 0;
-+}
-+
- #endif /* GSSAPI */
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index a151bc1e..ef9beb67 100644
---- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv-krb5.c,v 1.9 2018/07/09 21:37:55 markus Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -120,8 +120,8 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- 	krb5_error_code problem;
- 	krb5_principal princ;
- 	OM_uint32 maj_status, min_status;
--	int len;
- 	const char *errmsg;
-+	const char *new_ccname;
- 
- 	if (client->creds == NULL) {
- 		debug("No credentials stored");
-@@ -180,11 +180,16 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- 		return;
- 	}
- 
--	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
-+	new_ccname = krb5_cc_get_name(krb_context, ccache);
-+
- 	client->store.envvar = "KRB5CCNAME";
--	len = strlen(client->store.filename) + 6;
--	client->store.envval = xmalloc(len);
--	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
-+#ifdef USE_CCAPI
-+	xasprintf(&client->store.envval, "API:%s", new_ccname);
-+	client->store.filename = NULL;
-+#else
-+	xasprintf(&client->store.envval, "FILE:%s", new_ccname);
-+	client->store.filename = xstrdup(new_ccname);
-+#endif
- 
- #ifdef USE_PAM
- 	if (options.use_pam)
-@@ -196,6 +201,71 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- 	return;
- }
- 
-+int
-+ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store,
-+    ssh_gssapi_client *client)
-+{
-+	krb5_ccache ccache = NULL;
-+	krb5_principal principal = NULL;
-+	char *name = NULL;
-+	krb5_error_code problem;
-+	OM_uint32 maj_status, min_status;
-+
-+	if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
-+                logit("krb5_cc_resolve(): %.100s",
-+                    krb5_get_err_text(krb_context, problem));
-+                return 0;
-+	}
-+
-+	/* Find out who the principal in this cache is */
-+	if ((problem = krb5_cc_get_principal(krb_context, ccache,
-+	    &principal))) {
-+		logit("krb5_cc_get_principal(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	if ((problem = krb5_unparse_name(krb_context, principal, &name))) {
-+		logit("krb5_unparse_name(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+
-+	if (strcmp(name,client->exportedname.value)!=0) {
-+		debug("Name in local credentials cache differs. Not storing");
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		krb5_free_unparsed_name(krb_context, name);
-+		return 0;
-+	}
-+	krb5_free_unparsed_name(krb_context, name);
-+
-+	/* Name matches, so lets get on with it! */
-+
-+	if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) {
-+		logit("krb5_cc_initialize(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	krb5_free_principal(krb_context, principal);
-+
-+	if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds,
-+	    ccache))) {
-+		logit("gss_krb5_copy_ccache() failed. Sorry!");
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
- ssh_gssapi_mech gssapi_kerberos_mech = {
- 	"toWM5Slw5Ew8Mqkay+al2g==",
- 	"Kerberos",
-@@ -203,7 +273,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
- 	NULL,
- 	&ssh_gssapi_krb5_userok,
- 	NULL,
--	&ssh_gssapi_krb5_storecreds
-+	&ssh_gssapi_krb5_storecreds,
-+	&ssh_gssapi_krb5_updatecreds
- };
- 
- #endif /* KRB5 */
-diff --git a/gss-serv.c b/gss-serv.c
-index ab3a15f0..1d47870e 100644
---- a/gss-serv.c
-+++ b/gss-serv.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv.c,v 1.31 2018/07/09 21:37:55 markus Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -44,17 +44,19 @@
- #include "session.h"
- #include "misc.h"
- #include "servconf.h"
-+#include "uidswap.h"
- 
- #include "ssh-gss.h"
-+#include "monitor_wrap.h"
- 
- extern ServerOptions options;
- 
- static ssh_gssapi_client gssapi_client =
--    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
--    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};
-+    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
-+    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
- 
- ssh_gssapi_mech gssapi_null_mech =
--    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
-+    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
- 
- #ifdef KRB5
- extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -140,6 +142,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
- 	return (ssh_gssapi_acquire_cred(*ctx));
- }
- 
-+/* Unprivileged */
-+char *
-+ssh_gssapi_server_mechanisms(void) {
-+	if (supported_oids == NULL)
-+		ssh_gssapi_prepare_supported_oids();
-+	return (ssh_gssapi_kex_mechs(supported_oids,
-+	    &ssh_gssapi_server_check_mech, NULL, NULL,
-+	    options.gss_kex_algorithms));
-+}
-+
-+/* Unprivileged */
-+int
-+ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data,
-+    const char *dummy) {
-+	Gssctxt *ctx = NULL;
-+	int res;
-+
-+	res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));
-+	ssh_gssapi_delete_ctx(&ctx);
-+
-+	return (res);
-+}
-+
- /* Unprivileged */
- void
- ssh_gssapi_supported_oids(gss_OID_set *oidset)
-@@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
- 	gss_OID_set supported;
- 
- 	gss_create_empty_oid_set(&min_status, oidset);
--	gss_indicate_mechs(&min_status, &supported);
-+
-+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported)))
-+		return;
- 
- 	while (supported_mechs[i]->name != NULL) {
- 		if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -276,8 +303,48 @@ OM_uint32
- ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- {
- 	int i = 0;
-+	int equal = 0;
-+	gss_name_t new_name = GSS_C_NO_NAME;
-+	gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;
- 
--	gss_buffer_desc ename;
-+	if (options.gss_store_rekey && client->used && ctx->client_creds) {
-+		if (client->mech->oid.length != ctx->oid->length ||
-+		    (memcmp(client->mech->oid.elements,
-+		     ctx->oid->elements, ctx->oid->length) !=0)) {
-+			debug("Rekeyed credentials have different mechanism");
-+			return GSS_S_COMPLETE;
-+		}
-+
-+		if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
-+		    ctx->client_creds, ctx->oid, &new_name,
-+		    NULL, NULL, NULL))) {
-+			ssh_gssapi_error(ctx);
-+			return (ctx->major);
-+		}
-+
-+		ctx->major = gss_compare_name(&ctx->minor, client->name,
-+		    new_name, &equal);
-+
-+		if (GSS_ERROR(ctx->major)) {
-+			ssh_gssapi_error(ctx);
-+			return (ctx->major);
-+		}
-+
-+		if (!equal) {
-+			debug("Rekeyed credentials have different name");
-+			return GSS_S_COMPLETE;
-+		}
-+
-+		debug("Marking rekeyed credentials for export");
-+
-+		gss_release_name(&ctx->minor, &client->name);
-+		gss_release_cred(&ctx->minor, &client->creds);
-+		client->name = new_name;
-+		client->creds = ctx->client_creds;
-+		ctx->client_creds = GSS_C_NO_CREDENTIAL;
-+		client->updated = 1;
-+		return GSS_S_COMPLETE;
-+	}
- 
- 	client->mech = NULL;
- 
-@@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- 	if (client->mech == NULL)
- 		return GSS_S_FAILURE;
- 
-+	if (ctx->client_creds &&
-+	    (ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
-+	     ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) {
-+		ssh_gssapi_error(ctx);
-+		return (ctx->major);
-+	}
-+
- 	if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
- 	    &client->displayname, NULL))) {
- 		ssh_gssapi_error(ctx);
-@@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- 		return (ctx->major);
- 	}
- 
-+	gss_release_buffer(&ctx->minor, &ename);
-+
- 	/* We can't copy this structure, so we just move the pointer to it */
- 	client->creds = ctx->client_creds;
- 	ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -356,19 +432,23 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
- 
- /* Privileged */
- int
--ssh_gssapi_userok(char *user)
-+ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
- {
- 	OM_uint32 lmin;
- 
-+	(void) kex; /* used in privilege separation */
-+
- 	if (gssapi_client.exportedname.length == 0 ||
- 	    gssapi_client.exportedname.value == NULL) {
- 		debug("No suitable client data");
- 		return 0;
- 	}
- 	if (gssapi_client.mech && gssapi_client.mech->userok)
--		if ((*gssapi_client.mech->userok)(&gssapi_client, user))
-+		if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
-+			gssapi_client.used = 1;
-+			gssapi_client.store.owner = pw;
- 			return 1;
--		else {
-+		} else {
- 			/* Destroy delegated credentials if userok fails */
- 			gss_release_buffer(&lmin, &gssapi_client.displayname);
- 			gss_release_buffer(&lmin, &gssapi_client.exportedname);
-@@ -382,14 +462,90 @@ ssh_gssapi_userok(char *user)
- 	return (0);
- }
- 
--/* Privileged */
--OM_uint32
--ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
--{
--	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
--	    gssbuf, gssmic, NULL);
-+/* These bits are only used for rekeying. The unpriviledged child is running
-+ * as the user, the monitor is root.
-+ *
-+ * In the child, we want to :
-+ *    *) Ask the monitor to store our credentials into the store we specify
-+ *    *) If it succeeds, maybe do a PAM update
-+ */
- 
--	return (ctx->major);
-+/* Stuff for PAM */
-+
-+#ifdef USE_PAM
-+static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg,
-+    struct pam_response **resp, void *data)
-+{
-+	return (PAM_CONV_ERR);
-+}
-+#endif
-+
-+void
-+ssh_gssapi_rekey_creds(void) {
-+	int ok;
-+#ifdef USE_PAM
-+	int ret;
-+	pam_handle_t *pamh = NULL;
-+	struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
-+	char *envstr;
-+#endif
-+
-+	if (gssapi_client.store.filename == NULL &&
-+	    gssapi_client.store.envval == NULL &&
-+	    gssapi_client.store.envvar == NULL)
-+		return;
-+
-+	ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store));
-+
-+	if (!ok)
-+		return;
-+
-+	debug("Rekeyed credentials stored successfully");
-+
-+	/* Actually managing to play with the ssh pam stack from here will
-+	 * be next to impossible. In any case, we may want different options
-+	 * for rekeying. So, use our own :)
-+	 */
-+#ifdef USE_PAM	
-+	if (!use_privsep) {
-+		debug("Not even going to try and do PAM with privsep disabled");
-+		return;
-+	}
-+
-+	ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name,
-+ 	    &pamconv, &pamh);
-+	if (ret)
-+		return;
-+
-+	xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar,
-+	    gssapi_client.store.envval);
-+
-+	ret = pam_putenv(pamh, envstr);
-+	if (!ret)
-+		pam_setcred(pamh, PAM_REINITIALIZE_CRED);
-+	pam_end(pamh, PAM_SUCCESS);
-+#endif
-+}
-+
-+int
-+ssh_gssapi_update_creds(ssh_gssapi_ccache *store) {
-+	int ok = 0;
-+
-+	/* Check we've got credentials to store */
-+	if (!gssapi_client.updated)
-+		return 0;
-+
-+	gssapi_client.updated = 0;
-+
-+	temporarily_use_uid(gssapi_client.store.owner);
-+	if (gssapi_client.mech && gssapi_client.mech->updatecreds)
-+		ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client);
-+	else
-+		debug("No update function for this mechanism");
-+
-+	restore_uid();
-+
-+	return ok;
- }
- 
- /* Privileged */
-diff --git a/kex.c b/kex.c
-index ce85f043..574c7609 100644
---- a/kex.c
-+++ b/kex.c
-@@ -57,11 +57,16 @@
- #include "misc.h"
- #include "dispatch.h"
- #include "monitor.h"
-+#include "xmalloc.h"
- 
- #include "ssherr.h"
- #include "sshbuf.h"
- #include "digest.h"
- 
-+#ifdef GSSAPI
-+#include "ssh-gss.h"
-+#endif
-+
- /* prototype */
- static int kex_choose_conf(struct ssh *);
- static int kex_input_newkeys(int, u_int32_t, struct ssh *);
-@@ -115,15 +120,28 @@ static const struct kexalg kexalgs[] = {
- #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
- 	{ NULL, 0, -1, -1},
- };
-+static const struct kexalg gss_kexalgs[] = {
-+#ifdef GSSAPI
-+	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
-+	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
-+	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
-+	{ KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
-+	{ KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
-+	{ KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256,
-+	    NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
-+	{ KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
-+#endif
-+	{ NULL, 0, -1, -1},
-+};
- 
--char *
--kex_alg_list(char sep)
-+static char *
-+kex_alg_list_internal(char sep, const struct kexalg *algs)
- {
- 	char *ret = NULL, *tmp;
- 	size_t nlen, rlen = 0;
- 	const struct kexalg *k;
- 
--	for (k = kexalgs; k->name != NULL; k++) {
-+	for (k = algs; k->name != NULL; k++) {
- 		if (ret != NULL)
- 			ret[rlen++] = sep;
- 		nlen = strlen(k->name);
-@@ -138,6 +156,18 @@ kex_alg_list(char sep)
- 	return ret;
- }
- 
-+char *
-+kex_alg_list(char sep)
-+{
-+	return kex_alg_list_internal(sep, kexalgs);
-+}
-+
-+char *
-+kex_gss_alg_list(char sep)
-+{
-+	return kex_alg_list_internal(sep, gss_kexalgs);
-+}
-+
- static const struct kexalg *
- kex_alg_by_name(const char *name)
- {
-@@ -147,6 +177,10 @@ kex_alg_by_name(const char *name)
- 		if (strcmp(k->name, name) == 0)
- 			return k;
- 	}
-+	for (k = gss_kexalgs; k->name != NULL; k++) {
-+		if (strncmp(k->name, name, strlen(k->name)) == 0)
-+			return k;
-+	}
- 	return NULL;
- }
- 
-@@ -315,6 +349,29 @@ kex_assemble_names(char **listp, const char *def, const char *all)
- 	return r;
- }
- 
-+/* Validate GSS KEX method name list */
-+int
-+kex_gss_names_valid(const char *names)
-+{
-+	char *s, *cp, *p;
-+
-+	if (names == NULL || *names == '\0')
-+		return 0;
-+	s = cp = xstrdup(names);
-+	for ((p = strsep(&cp, ",")); p && *p != '\0';
-+	    (p = strsep(&cp, ","))) {
-+		if (strncmp(p, "gss-", 4) != 0
-+		  || kex_alg_by_name(p) == NULL) {
-+			error("Unsupported KEX algorithm \"%.100s\"", p);
-+			free(s);
-+			return 0;
-+		}
-+	}
-+	debug3("gss kex names ok: [%s]", names);
-+	free(s);
-+	return 1;
-+}
-+
- /* put algorithm proposal into buffer */
- int
- kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX])
-@@ -698,6 +755,9 @@ kex_free(struct kex *kex)
- 	sshbuf_free(kex->server_version);
- 	sshbuf_free(kex->client_pub);
- 	free(kex->session_id);
-+#ifdef GSSAPI
-+	free(kex->gss_host);
-+#endif /* GSSAPI */
- 	free(kex->failed_choice);
- 	free(kex->hostkey_alg);
- 	free(kex->name);
-diff --git a/kex.h b/kex.h
-index a5ae6ac0..fe714141 100644
---- a/kex.h
-+++ b/kex.h
-@@ -102,6 +102,15 @@ enum kex_exchange {
- 	KEX_ECDH_SHA2,
- 	KEX_C25519_SHA256,
- 	KEX_KEM_SNTRUP4591761X25519_SHA512,
-+#ifdef GSSAPI
-+	KEX_GSS_GRP1_SHA1,
-+	KEX_GSS_GRP14_SHA1,
-+	KEX_GSS_GRP14_SHA256,
-+	KEX_GSS_GRP16_SHA512,
-+	KEX_GSS_GEX_SHA1,
-+	KEX_GSS_NISTP256_SHA256,
-+	KEX_GSS_C25519_SHA256,
-+#endif
- 	KEX_MAX
- };
- 
-@@ -153,6 +162,12 @@ struct kex {
- 	u_int	flags;
- 	int	hash_alg;
- 	int	ec_nid;
-+#ifdef GSSAPI
-+	int	gss_deleg_creds;
-+	int	gss_trust_dns;
-+	char    *gss_host;
-+	char	*gss_client;
-+#endif
- 	char	*failed_choice;
- 	int	(*verify_host_key)(struct sshkey *, struct ssh *);
- 	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
-@@ -174,8 +189,10 @@ struct kex {
- 
- int	 kex_names_valid(const char *);
- char	*kex_alg_list(char);
-+char	*kex_gss_alg_list(char);
- char	*kex_names_cat(const char *, const char *);
- int	 kex_assemble_names(char **, const char *, const char *);
-+int	 kex_gss_names_valid(const char *);
- 
- int	 kex_exchange_identification(struct ssh *, int, const char *);
- 
-@@ -202,6 +219,12 @@ int	 kexgex_client(struct ssh *);
- int	 kexgex_server(struct ssh *);
- int	 kex_gen_client(struct ssh *);
- int	 kex_gen_server(struct ssh *);
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+int	 kexgssgex_client(struct ssh *);
-+int	 kexgssgex_server(struct ssh *);
-+int	 kexgss_client(struct ssh *);
-+int	 kexgss_server(struct ssh *);
-+#endif
- 
- int	 kex_dh_keypair(struct kex *);
- int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
-@@ -234,6 +257,12 @@ int	 kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
-     const BIGNUM *, const u_char *, size_t,
-     u_char *, size_t *);
- 
-+int	 kex_gen_hash(int hash_alg, const struct sshbuf *client_version,
-+    const struct sshbuf *server_version, const struct sshbuf *client_kexinit,
-+    const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob,
-+    const struct sshbuf *client_pub, const struct sshbuf *server_pub,
-+    const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen);
-+
- void	kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
- 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
- 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
-diff --git a/kexdh.c b/kexdh.c
-index 67133e33..edaa4676 100644
---- a/kexdh.c
-+++ b/kexdh.c
-@@ -48,13 +48,23 @@ kex_dh_keygen(struct kex *kex)
- {
- 	switch (kex->kex_type) {
- 	case KEX_DH_GRP1_SHA1:
-+#ifdef GSSAPI
-+	case KEX_GSS_GRP1_SHA1:
-+#endif
- 		kex->dh = dh_new_group1();
- 		break;
- 	case KEX_DH_GRP14_SHA1:
- 	case KEX_DH_GRP14_SHA256:
-+#ifdef GSSAPI
-+	case KEX_GSS_GRP14_SHA1:
-+	case KEX_GSS_GRP14_SHA256:
-+#endif
- 		kex->dh = dh_new_group14();
- 		break;
- 	case KEX_DH_GRP16_SHA512:
-+#ifdef GSSAPI
-+	case KEX_GSS_GRP16_SHA512:
-+#endif
- 		kex->dh = dh_new_group16();
- 		break;
- 	case KEX_DH_GRP18_SHA512:
-diff --git a/kexgen.c b/kexgen.c
-index 69348b96..c0e8c2f4 100644
---- a/kexgen.c
-+++ b/kexgen.c
-@@ -44,7 +44,7 @@
- static int input_kex_gen_init(int, u_int32_t, struct ssh *);
- static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
- 
--static int
-+int
- kex_gen_hash(
-     int hash_alg,
-     const struct sshbuf *client_version,
-diff --git a/kexgssc.c b/kexgssc.c
-new file mode 100644
-index 00000000..f6e1405e
---- /dev/null
-+++ b/kexgssc.c
-@@ -0,0 +1,606 @@
-+/*
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "includes.h"
-+
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+
-+#include "includes.h"
-+
-+#include <openssl/crypto.h>
-+#include <openssl/bn.h>
-+
-+#include <string.h>
-+
-+#include "xmalloc.h"
-+#include "sshbuf.h"
-+#include "ssh2.h"
-+#include "sshkey.h"
-+#include "cipher.h"
-+#include "kex.h"
-+#include "log.h"
-+#include "packet.h"
-+#include "dh.h"
-+#include "digest.h"
-+#include "ssherr.h"
-+
-+#include "ssh-gss.h"
-+
-+int
-+kexgss_client(struct ssh *ssh)
-+{
-+	struct kex *kex = ssh->kex;
-+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
-+	    recv_tok = GSS_C_EMPTY_BUFFER,
-+	    gssbuf, msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
-+	Gssctxt *ctxt;
-+	OM_uint32 maj_status, min_status, ret_flags;
-+	struct sshbuf *server_blob = NULL;
-+	struct sshbuf *shared_secret = NULL;
-+	struct sshbuf *server_host_key_blob = NULL;
-+	struct sshbuf *empty = NULL;
-+	u_char *msg;
-+	int type = 0;
-+	int first = 1;
-+	u_char hash[SSH_DIGEST_MAX_LENGTH];
-+	size_t hashlen;
-+	u_char c;
-+	int r;
-+
-+	/* Initialise our GSSAPI world */
-+	ssh_gssapi_build_ctx(&ctxt);
-+	if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
-+	    == GSS_C_NO_OID)
-+		fatal("Couldn't identify host exchange");
-+
-+	if (ssh_gssapi_import_name(ctxt, kex->gss_host))
-+		fatal("Couldn't import hostname");
-+
-+	if (kex->gss_client &&
-+	    ssh_gssapi_client_identity(ctxt, kex->gss_client))
-+		fatal("Couldn't acquire client credentials");
-+
-+	/* Step 1 */
-+	switch (kex->kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+	case KEX_GSS_GRP14_SHA1:
-+	case KEX_GSS_GRP14_SHA256:
-+	case KEX_GSS_GRP16_SHA512:
-+		r = kex_dh_keypair(kex);
-+		break;
-+	case KEX_GSS_NISTP256_SHA256:
-+		r = kex_ecdh_keypair(kex);
-+		break;
-+	case KEX_GSS_C25519_SHA256:
-+		r = kex_c25519_keypair(kex);
-+		break;
-+	default:
-+		fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+	}
-+	if (r != 0)
-+		return r;
-+
-+	token_ptr = GSS_C_NO_BUFFER;
-+
-+	do {
-+		debug("Calling gss_init_sec_context");
-+
-+		maj_status = ssh_gssapi_init_ctx(ctxt,
-+		    kex->gss_deleg_creds, token_ptr, &send_tok,
-+		    &ret_flags);
-+
-+		if (GSS_ERROR(maj_status)) {
-+			/* XXX Useles code: Missing send? */
-+			if (send_tok.length != 0) {
-+				if ((r = sshpkt_start(ssh,
-+				        SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+				    (r = sshpkt_put_string(ssh, send_tok.value,
-+				        send_tok.length)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+			}
-+			fatal("gss_init_context failed");
-+		}
-+
-+		/* If we've got an old receive buffer get rid of it */
-+		if (token_ptr != GSS_C_NO_BUFFER)
-+			gss_release_buffer(&min_status, &recv_tok);
-+
-+		if (maj_status == GSS_S_COMPLETE) {
-+			/* If mutual state flag is not true, kex fails */
-+			if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-+				fatal("Mutual authentication failed");
-+
-+			/* If integ avail flag is not true kex fails */
-+			if (!(ret_flags & GSS_C_INTEG_FLAG))
-+				fatal("Integrity check failed");
-+		}
-+
-+		/*
-+		 * If we have data to send, then the last message that we
-+		 * received cannot have been a 'complete'.
-+		 */
-+		if (send_tok.length != 0) {
-+			if (first) {
-+				if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 ||
-+				    (r = sshpkt_put_string(ssh, send_tok.value,
-+				        send_tok.length)) != 0 ||
-+				    (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0)
-+					fatal("failed to construct packet: %s", ssh_err(r));
-+				first = 0;
-+			} else {
-+				if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+				    (r = sshpkt_put_string(ssh, send_tok.value,
-+				        send_tok.length)) != 0)
-+					fatal("failed to construct packet: %s", ssh_err(r));
-+			}
-+			if ((r = sshpkt_send(ssh)) != 0)
-+				fatal("failed to send packet: %s", ssh_err(r));
-+			gss_release_buffer(&min_status, &send_tok);
-+
-+			/* If we've sent them data, they should reply */
-+			do {
-+				type = ssh_packet_read(ssh);
-+				if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
-+					debug("Received KEXGSS_HOSTKEY");
-+					if (server_host_key_blob)
-+						fatal("Server host key received more than once");
-+					if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
-+						fatal("Failed to read server host key: %s", ssh_err(r));
-+				}
-+			} while (type == SSH2_MSG_KEXGSS_HOSTKEY);
-+
-+			switch (type) {
-+			case SSH2_MSG_KEXGSS_CONTINUE:
-+				debug("Received GSSAPI_CONTINUE");
-+				if (maj_status == GSS_S_COMPLETE)
-+					fatal("GSSAPI Continue received from server when complete");
-+				if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+				        &recv_tok)) != 0 ||
-+				    (r = sshpkt_get_end(ssh)) != 0)
-+					fatal("Failed to read token: %s", ssh_err(r));
-+				break;
-+			case SSH2_MSG_KEXGSS_COMPLETE:
-+				debug("Received GSSAPI_COMPLETE");
-+				if (msg_tok.value != NULL)
-+				        fatal("Received GSSAPI_COMPLETE twice?");
-+				if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
-+				    (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+				        &msg_tok)) != 0)
-+					fatal("Failed to read message: %s", ssh_err(r));
-+
-+				/* Is there a token included? */
-+				if ((r = sshpkt_get_u8(ssh, &c)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+				if (c) {
-+					if ((r = ssh_gssapi_sshpkt_get_buffer_desc(
-+					    ssh, &recv_tok)) != 0)
-+						fatal("Failed to read token: %s", ssh_err(r));
-+					/* If we're already complete - protocol error */
-+					if (maj_status == GSS_S_COMPLETE)
-+						sshpkt_disconnect(ssh, "Protocol error: received token when complete");
-+				} else {
-+					/* No token included */
-+					if (maj_status != GSS_S_COMPLETE)
-+						sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
-+				}
-+				if ((r = sshpkt_get_end(ssh)) != 0) {
-+					fatal("Expecting end of packet.");
-+				}
-+				break;
-+			case SSH2_MSG_KEXGSS_ERROR:
-+				debug("Received Error");
-+				if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 ||
-+				    (r = sshpkt_get_u32(ssh, &min_status)) != 0 ||
-+				    (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
-+				    (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */
-+				    (r = sshpkt_get_end(ssh)) != 0)
-+					fatal("sshpkt_get failed: %s", ssh_err(r));
-+				fatal("GSSAPI Error: \n%.400s", msg);
-+			default:
-+				sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
-+				    type);
-+			}
-+			token_ptr = &recv_tok;
-+		} else {
-+			/* No data, and not complete */
-+			if (maj_status != GSS_S_COMPLETE)
-+				fatal("Not complete, and no token output");
-+		}
-+	} while (maj_status & GSS_S_CONTINUE_NEEDED);
-+
-+	/*
-+	 * We _must_ have received a COMPLETE message in reply from the
-+	 * server, which will have set server_blob and msg_tok
-+	 */
-+
-+	if (type != SSH2_MSG_KEXGSS_COMPLETE)
-+		fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
-+
-+	/* compute shared secret */
-+	switch (kex->kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+	case KEX_GSS_GRP14_SHA1:
-+	case KEX_GSS_GRP14_SHA256:
-+	case KEX_GSS_GRP16_SHA512:
-+		r = kex_dh_dec(kex, server_blob, &shared_secret);
-+		break;
-+	case KEX_GSS_C25519_SHA256:
-+		if (sshbuf_ptr(server_blob)[sshbuf_len(server_blob)] & 0x80)
-+			fatal("The received key has MSB of last octet set!");
-+		r = kex_c25519_dec(kex, server_blob, &shared_secret);
-+		break;
-+	case KEX_GSS_NISTP256_SHA256:
-+		if (sshbuf_len(server_blob) != 65)
-+			fatal("The received NIST-P256 key did not match"
-+			    "expected length (expected 65, got %zu)", sshbuf_len(server_blob));
-+
-+		if (sshbuf_ptr(server_blob)[0] != POINT_CONVERSION_UNCOMPRESSED)
-+			fatal("The received NIST-P256 key does not have first octet 0x04");
-+
-+		r = kex_ecdh_dec(kex, server_blob, &shared_secret);
-+		break;
-+	default:
-+		r = SSH_ERR_INVALID_ARGUMENT;
-+		break;
-+	}
-+	if (r != 0)
-+		goto out;
-+
-+	if ((empty = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+
-+	hashlen = sizeof(hash);
-+	if ((r = kex_gen_hash(
-+	    kex->hash_alg,
-+	    kex->client_version,
-+	    kex->server_version,
-+	    kex->my,
-+	    kex->peer,
-+	    (server_host_key_blob ? server_host_key_blob : empty),
-+	    kex->client_pub,
-+	    server_blob,
-+	    shared_secret,
-+	    hash, &hashlen)) != 0)
-+		fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+
-+	gssbuf.value = hash;
-+	gssbuf.length = hashlen;
-+
-+	/* Verify that the hash matches the MIC we just got. */
-+	if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
-+		sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
-+
-+	gss_release_buffer(&min_status, &msg_tok);
-+
-+	if (kex->gss_deleg_creds)
-+		ssh_gssapi_credentials_updated(ctxt);
-+
-+	if (gss_kex_context == NULL)
-+		gss_kex_context = ctxt;
-+	else
-+		ssh_gssapi_delete_ctx(&ctxt);
-+
-+	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
-+		r = kex_send_newkeys(ssh);
-+
-+out:
-+	explicit_bzero(hash, sizeof(hash));
-+	explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
-+	sshbuf_free(empty);
-+	sshbuf_free(server_host_key_blob);
-+	sshbuf_free(server_blob);
-+	sshbuf_free(shared_secret);
-+	sshbuf_free(kex->client_pub);
-+	kex->client_pub = NULL;
-+	return r;
-+}
-+
-+int
-+kexgssgex_client(struct ssh *ssh)
-+{
-+	struct kex *kex = ssh->kex;
-+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
-+	    recv_tok = GSS_C_EMPTY_BUFFER, gssbuf,
-+            msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
-+	Gssctxt *ctxt;
-+	OM_uint32 maj_status, min_status, ret_flags;
-+	struct sshbuf *shared_secret = NULL;
-+	BIGNUM *p = NULL;
-+	BIGNUM *g = NULL;
-+	struct sshbuf *buf = NULL;
-+	struct sshbuf *server_host_key_blob = NULL;
-+	struct sshbuf *server_blob = NULL;
-+	BIGNUM *dh_server_pub = NULL;
-+	u_char *msg;
-+	int type = 0;
-+	int first = 1;
-+	u_char hash[SSH_DIGEST_MAX_LENGTH];
-+	size_t hashlen;
-+	const BIGNUM *pub_key, *dh_p, *dh_g;
-+	int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
-+	struct sshbuf *empty = NULL;
-+	u_char c;
-+	int r;
-+
-+	/* Initialise our GSSAPI world */
-+	ssh_gssapi_build_ctx(&ctxt);
-+	if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
-+	    == GSS_C_NO_OID)
-+		fatal("Couldn't identify host exchange");
-+
-+	if (ssh_gssapi_import_name(ctxt, kex->gss_host))
-+		fatal("Couldn't import hostname");
-+
-+	if (kex->gss_client &&
-+	    ssh_gssapi_client_identity(ctxt, kex->gss_client))
-+		fatal("Couldn't acquire client credentials");
-+
-+	debug("Doing group exchange");
-+	nbits = dh_estimate(kex->dh_need * 8);
-+
-+	kex->min = DH_GRP_MIN;
-+	kex->max = DH_GRP_MAX;
-+	kex->nbits = nbits;
-+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUPREQ)) != 0 ||
-+	    (r = sshpkt_put_u32(ssh, min)) != 0 ||
-+	    (r = sshpkt_put_u32(ssh, nbits)) != 0 ||
-+	    (r = sshpkt_put_u32(ssh, max)) != 0 ||
-+	    (r = sshpkt_send(ssh)) != 0)
-+		fatal("Failed to construct a packet: %s", ssh_err(r));
-+
-+	if ((r = ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0)
-+		fatal("Error: %s", ssh_err(r));
-+
-+	if ((r = sshpkt_get_bignum2(ssh, &p)) != 0 ||
-+	    (r = sshpkt_get_bignum2(ssh, &g)) != 0 ||
-+	    (r = sshpkt_get_end(ssh)) != 0)
-+		fatal("shpkt_get_bignum2 failed: %s", ssh_err(r));
-+
-+	if (BN_num_bits(p) < min || BN_num_bits(p) > max)
-+		fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
-+		    min, BN_num_bits(p), max);
-+
-+	if ((kex->dh = dh_new_group(g, p)) == NULL)
-+		fatal("dn_new_group() failed");
-+	p = g = NULL; /* belong to kex->dh now */
-+
-+	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
-+		goto out;
-+	DH_get0_key(kex->dh, &pub_key, NULL);
-+
-+	token_ptr = GSS_C_NO_BUFFER;
-+
-+	do {
-+		/* Step 2 - call GSS_Init_sec_context() */
-+		debug("Calling gss_init_sec_context");
-+
-+		maj_status = ssh_gssapi_init_ctx(ctxt,
-+		    kex->gss_deleg_creds, token_ptr, &send_tok,
-+		    &ret_flags);
-+
-+		if (GSS_ERROR(maj_status)) {
-+			/* XXX Useles code: Missing send? */
-+			if (send_tok.length != 0) {
-+				if ((r = sshpkt_start(ssh,
-+				        SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+				    (r = sshpkt_put_string(ssh, send_tok.value,
-+				        send_tok.length)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+			}
-+			fatal("gss_init_context failed");
-+		}
-+
-+		/* If we've got an old receive buffer get rid of it */
-+		if (token_ptr != GSS_C_NO_BUFFER)
-+			gss_release_buffer(&min_status, &recv_tok);
-+
-+		if (maj_status == GSS_S_COMPLETE) {
-+			/* If mutual state flag is not true, kex fails */
-+			if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-+				fatal("Mutual authentication failed");
-+
-+			/* If integ avail flag is not true kex fails */
-+			if (!(ret_flags & GSS_C_INTEG_FLAG))
-+				fatal("Integrity check failed");
-+		}
-+
-+		/*
-+		 * If we have data to send, then the last message that we
-+		 * received cannot have been a 'complete'.
-+		 */
-+		if (send_tok.length != 0) {
-+			if (first) {
-+				if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_INIT)) != 0 ||
-+				    (r = sshpkt_put_string(ssh, send_tok.value,
-+				        send_tok.length)) != 0 ||
-+				    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+				first = 0;
-+			} else {
-+				if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+				    (r = sshpkt_put_string(ssh,send_tok.value,
-+				        send_tok.length)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+			}
-+			if ((r = sshpkt_send(ssh)) != 0)
-+				fatal("sshpkt_send failed: %s", ssh_err(r));
-+			gss_release_buffer(&min_status, &send_tok);
-+
-+			/* If we've sent them data, they should reply */
-+			do {
-+				type = ssh_packet_read(ssh);
-+				if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
-+					debug("Received KEXGSS_HOSTKEY");
-+					if (server_host_key_blob)
-+						fatal("Server host key received more than once");
-+					if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
-+						fatal("sshpkt failed: %s", ssh_err(r));
-+				}
-+			} while (type == SSH2_MSG_KEXGSS_HOSTKEY);
-+
-+			switch (type) {
-+			case SSH2_MSG_KEXGSS_CONTINUE:
-+				debug("Received GSSAPI_CONTINUE");
-+				if (maj_status == GSS_S_COMPLETE)
-+					fatal("GSSAPI Continue received from server when complete");
-+				if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+				        &recv_tok)) != 0 ||
-+				    (r = sshpkt_get_end(ssh)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+				break;
-+			case SSH2_MSG_KEXGSS_COMPLETE:
-+				debug("Received GSSAPI_COMPLETE");
-+				if (msg_tok.value != NULL)
-+				        fatal("Received GSSAPI_COMPLETE twice?");
-+				if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
-+				    (r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+				        &msg_tok)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+
-+				/* Is there a token included? */
-+				if ((r = sshpkt_get_u8(ssh, &c)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+				if (c) {
-+					if ((r = ssh_gssapi_sshpkt_get_buffer_desc(
-+					        ssh, &recv_tok)) != 0 ||
-+					    (r = sshpkt_get_end(ssh)) != 0)
-+						fatal("sshpkt failed: %s", ssh_err(r));
-+					/* If we're already complete - protocol error */
-+					if (maj_status == GSS_S_COMPLETE)
-+						sshpkt_disconnect(ssh, "Protocol error: received token when complete");
-+				} else {
-+					/* No token included */
-+					if (maj_status != GSS_S_COMPLETE)
-+						sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
-+				}
-+				break;
-+			case SSH2_MSG_KEXGSS_ERROR:
-+				debug("Received Error");
-+				if ((r = sshpkt_get_u32(ssh, &maj_status)) != 0 ||
-+				    (r = sshpkt_get_u32(ssh, &min_status)) != 0 ||
-+				    (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
-+				    (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* lang tag */
-+				    (r = sshpkt_get_end(ssh)) != 0)
-+					fatal("sshpkt failed: %s", ssh_err(r));
-+				fatal("GSSAPI Error: \n%.400s", msg);
-+			default:
-+				sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
-+				    type);
-+			}
-+			token_ptr = &recv_tok;
-+		} else {
-+			/* No data, and not complete */
-+			if (maj_status != GSS_S_COMPLETE)
-+				fatal("Not complete, and no token output");
-+		}
-+	} while (maj_status & GSS_S_CONTINUE_NEEDED);
-+
-+	/*
-+	 * We _must_ have received a COMPLETE message in reply from the
-+	 * server, which will have set dh_server_pub and msg_tok
-+	 */
-+
-+	if (type != SSH2_MSG_KEXGSS_COMPLETE)
-+		fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
-+
-+	/* 7. C verifies that the key Q_S is valid */
-+	/* 8. C computes shared secret */
-+	if ((buf = sshbuf_new()) == NULL ||
-+	    (r = sshbuf_put_stringb(buf, server_blob)) != 0 ||
-+	    (r = sshbuf_get_bignum2(buf, &dh_server_pub)) != 0)
-+		goto out;
-+	sshbuf_free(buf);
-+	buf = NULL;
-+
-+	if ((shared_secret = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+
-+	if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0)
-+		goto out;
-+	if ((empty = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+
-+	DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
-+	hashlen = sizeof(hash);
-+	if ((r = kexgex_hash(
-+	    kex->hash_alg,
-+	    kex->client_version,
-+	    kex->server_version,
-+	    kex->my,
-+	    kex->peer,
-+	    (server_host_key_blob ? server_host_key_blob : empty),
-+ 	    kex->min, kex->nbits, kex->max,
-+	    dh_p, dh_g,
-+	    pub_key,
-+	    dh_server_pub,
-+	    sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
-+	    hash, &hashlen)) != 0)
-+		fatal("Failed to calculate hash: %s", ssh_err(r));
-+
-+	gssbuf.value = hash;
-+	gssbuf.length = hashlen;
-+
-+	/* Verify that the hash matches the MIC we just got. */
-+	if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
-+		sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
-+
-+	gss_release_buffer(&min_status, &msg_tok);
-+
-+	/* save session id */
-+	if (kex->session_id == NULL) {
-+		kex->session_id_len = hashlen;
-+		kex->session_id = xmalloc(kex->session_id_len);
-+		memcpy(kex->session_id, hash, kex->session_id_len);
-+	}
-+
-+	if (kex->gss_deleg_creds)
-+		ssh_gssapi_credentials_updated(ctxt);
-+
-+	if (gss_kex_context == NULL)
-+		gss_kex_context = ctxt;
-+	else
-+		ssh_gssapi_delete_ctx(&ctxt);
-+
-+	/* Finally derive the keys and send them */
-+	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
-+		r = kex_send_newkeys(ssh);
-+out:
-+	sshbuf_free(buf);
-+	sshbuf_free(server_blob);
-+	sshbuf_free(empty);
-+	explicit_bzero(hash, sizeof(hash));
-+	DH_free(kex->dh);
-+	kex->dh = NULL;
-+	BN_clear_free(dh_server_pub);
-+	sshbuf_free(shared_secret);
-+	sshbuf_free(server_host_key_blob);
-+	return r;
-+}
-+#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
-diff --git a/kexgsss.c b/kexgsss.c
-new file mode 100644
-index 00000000..60bc02de
---- /dev/null
-+++ b/kexgsss.c
-@@ -0,0 +1,474 @@
-+/*
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "includes.h"
-+
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+
-+#include <string.h>
-+
-+#include <openssl/crypto.h>
-+#include <openssl/bn.h>
-+
-+#include "xmalloc.h"
-+#include "sshbuf.h"
-+#include "ssh2.h"
-+#include "sshkey.h"
-+#include "cipher.h"
-+#include "kex.h"
-+#include "log.h"
-+#include "packet.h"
-+#include "dh.h"
-+#include "ssh-gss.h"
-+#include "monitor_wrap.h"
-+#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
-+#include "servconf.h"
-+#include "ssh-gss.h"
-+#include "digest.h"
-+#include "ssherr.h"
-+
-+extern ServerOptions options;
-+
-+int
-+kexgss_server(struct ssh *ssh)
-+{
-+	struct kex *kex = ssh->kex;
-+	OM_uint32 maj_status, min_status;
-+
-+	/*
-+	 * Some GSSAPI implementations use the input value of ret_flags (an
-+	 * output variable) as a means of triggering mechanism specific
-+	 * features. Initializing it to zero avoids inadvertently
-+	 * activating this non-standard behaviour.
-+	 */
-+
-+	OM_uint32 ret_flags = 0;
-+	gss_buffer_desc gssbuf, recv_tok, msg_tok;
-+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-+	Gssctxt *ctxt = NULL;
-+	struct sshbuf *shared_secret = NULL;
-+	struct sshbuf *client_pubkey = NULL;
-+	struct sshbuf *server_pubkey = NULL;
-+	struct sshbuf *empty = sshbuf_new();
-+	int type = 0;
-+	gss_OID oid;
-+	char *mechs;
-+	u_char hash[SSH_DIGEST_MAX_LENGTH];
-+	size_t hashlen;
-+	int r;
-+
-+	/* Initialise GSSAPI */
-+
-+	/* If we're rekeying, privsep means that some of the private structures
-+	 * in the GSSAPI code are no longer available. This kludges them back
-+	 * into life
-+	 */
-+	if (!ssh_gssapi_oid_table_ok()) {
-+		mechs = ssh_gssapi_server_mechanisms();
-+		free(mechs);
-+	}
-+
-+	debug2("%s: Identifying %s", __func__, kex->name);
-+	oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
-+	if (oid == GSS_C_NO_OID)
-+	   fatal("Unknown gssapi mechanism");
-+
-+	debug2("%s: Acquiring credentials", __func__);
-+
-+	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
-+		fatal("Unable to acquire credentials for the server");
-+
-+	do {
-+		debug("Wait SSH2_MSG_KEXGSS_INIT");
-+		type = ssh_packet_read(ssh);
-+		switch(type) {
-+		case SSH2_MSG_KEXGSS_INIT:
-+			if (client_pubkey != NULL)
-+				fatal("Received KEXGSS_INIT after initialising");
-+			if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+			        &recv_tok)) != 0 ||
-+			    (r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 ||
-+			    (r = sshpkt_get_end(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+
-+			switch (kex->kex_type) {
-+			case KEX_GSS_GRP1_SHA1:
-+			case KEX_GSS_GRP14_SHA1:
-+			case KEX_GSS_GRP14_SHA256:
-+			case KEX_GSS_GRP16_SHA512:
-+				r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
-+				    &shared_secret);
-+				break;
-+			case KEX_GSS_NISTP256_SHA256:
-+				r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
-+				    &shared_secret);
-+				break;
-+			case KEX_GSS_C25519_SHA256:
-+				r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
-+				    &shared_secret);
-+				break;
-+			default:
-+				fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+			}
-+			if (r != 0)
-+				goto out;
-+
-+			/* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
-+			break;
-+		case SSH2_MSG_KEXGSS_CONTINUE:
-+			if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+			        &recv_tok)) != 0 ||
-+			    (r = sshpkt_get_end(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+			break;
-+		default:
-+			sshpkt_disconnect(ssh,
-+			    "Protocol error: didn't expect packet type %d",
-+			    type);
-+		}
-+
-+		maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
-+		    &send_tok, &ret_flags));
-+
-+		gss_release_buffer(&min_status, &recv_tok);
-+
-+		if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
-+			fatal("Zero length token output when incomplete");
-+
-+		if (client_pubkey == NULL)
-+			fatal("No client public key");
-+
-+		if (maj_status & GSS_S_CONTINUE_NEEDED) {
-+			debug("Sending GSSAPI_CONTINUE");
-+			if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+			    (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
-+			    (r = sshpkt_send(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+			gss_release_buffer(&min_status, &send_tok);
-+		}
-+	} while (maj_status & GSS_S_CONTINUE_NEEDED);
-+
-+	if (GSS_ERROR(maj_status)) {
-+		if (send_tok.length > 0) {
-+			if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+			    (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
-+			    (r = sshpkt_send(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+		}
-+		fatal("accept_ctx died");
-+	}
-+
-+	if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-+		fatal("Mutual Authentication flag wasn't set");
-+
-+	if (!(ret_flags & GSS_C_INTEG_FLAG))
-+		fatal("Integrity flag wasn't set");
-+
-+	hashlen = sizeof(hash);
-+	if ((r = kex_gen_hash(
-+	    kex->hash_alg,
-+	    kex->client_version,
-+	    kex->server_version,
-+	    kex->peer,
-+	    kex->my,
-+	    empty,
-+	    client_pubkey,
-+	    server_pubkey,
-+	    shared_secret,
-+	    hash, &hashlen)) != 0)
-+		goto out;
-+
-+	gssbuf.value = hash;
-+	gssbuf.length = hashlen;
-+
-+	if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))))
-+		fatal("Couldn't get MIC");
-+
-+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 ||
-+	    (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
-+	    (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0)
-+		fatal("sshpkt failed: %s", ssh_err(r));
-+
-+	if (send_tok.length != 0) {
-+		if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */
-+		    (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0)
-+			fatal("sshpkt failed: %s", ssh_err(r));
-+	} else {
-+		if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */
-+			fatal("sshpkt failed: %s", ssh_err(r));
-+	}
-+	if ((r = sshpkt_send(ssh)) != 0)
-+		fatal("sshpkt_send failed: %s", ssh_err(r));
-+
-+	gss_release_buffer(&min_status, &send_tok);
-+	gss_release_buffer(&min_status, &msg_tok);
-+
-+	if (gss_kex_context == NULL)
-+		gss_kex_context = ctxt;
-+	else
-+		ssh_gssapi_delete_ctx(&ctxt);
-+
-+	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
-+		r = kex_send_newkeys(ssh);
-+
-+	/* If this was a rekey, then save out any delegated credentials we
-+	 * just exchanged.  */
-+	if (options.gss_store_rekey)
-+		ssh_gssapi_rekey_creds();
-+out:
-+	sshbuf_free(empty);
-+	explicit_bzero(hash, sizeof(hash));
-+	sshbuf_free(shared_secret);
-+	sshbuf_free(client_pubkey);
-+	sshbuf_free(server_pubkey);
-+	return r;
-+}
-+
-+int
-+kexgssgex_server(struct ssh *ssh)
-+{
-+	struct kex *kex = ssh->kex;
-+	OM_uint32 maj_status, min_status;
-+
-+	/*
-+	 * Some GSSAPI implementations use the input value of ret_flags (an
-+	 * output variable) as a means of triggering mechanism specific
-+	 * features. Initializing it to zero avoids inadvertently
-+	 * activating this non-standard behaviour.
-+	 */
-+
-+	OM_uint32 ret_flags = 0;
-+	gss_buffer_desc gssbuf, recv_tok, msg_tok;
-+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-+	Gssctxt *ctxt = NULL;
-+	struct sshbuf *shared_secret = NULL;
-+	int type = 0;
-+	gss_OID oid;
-+	char *mechs;
-+	u_char hash[SSH_DIGEST_MAX_LENGTH];
-+	size_t hashlen;
-+	BIGNUM *dh_client_pub = NULL;
-+	const BIGNUM *pub_key, *dh_p, *dh_g;
-+	int min = -1, max = -1, nbits = -1;
-+	int cmin = -1, cmax = -1; /* client proposal */
-+	struct sshbuf *empty = sshbuf_new();
-+	int r;
-+
-+	/* Initialise GSSAPI */
-+
-+	/* If we're rekeying, privsep means that some of the private structures
-+	 * in the GSSAPI code are no longer available. This kludges them back
-+	 * into life
-+	 */
-+	if (!ssh_gssapi_oid_table_ok())
-+		if ((mechs = ssh_gssapi_server_mechanisms()))
-+			free(mechs);
-+
-+	debug2("%s: Identifying %s", __func__, kex->name);
-+	oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
-+	if (oid == GSS_C_NO_OID)
-+	   fatal("Unknown gssapi mechanism");
-+
-+	debug2("%s: Acquiring credentials", __func__);
-+
-+	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
-+		fatal("Unable to acquire credentials for the server");
-+
-+	/* 5. S generates an ephemeral key pair (do the allocations early) */
-+	debug("Doing group exchange");
-+	ssh_packet_read_expect(ssh, SSH2_MSG_KEXGSS_GROUPREQ);
-+	/* store client proposal to provide valid signature */
-+	if ((r = sshpkt_get_u32(ssh, &cmin)) != 0 ||
-+	    (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
-+	    (r = sshpkt_get_u32(ssh, &cmax)) != 0 ||
-+	    (r = sshpkt_get_end(ssh)) != 0)
-+		fatal("sshpkt failed: %s", ssh_err(r));
-+	kex->nbits = nbits;
-+	kex->min = cmin;
-+	kex->max = cmax;
-+	min = MAX(DH_GRP_MIN, cmin);
-+	max = MIN(DH_GRP_MAX, cmax);
-+	nbits = MAXIMUM(DH_GRP_MIN, nbits);
-+	nbits = MINIMUM(DH_GRP_MAX, nbits);
-+	if (max < min || nbits < min || max < nbits)
-+		fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
-+		    min, nbits, max);
-+	kex->dh = PRIVSEP(choose_dh(min, nbits, max));
-+	if (kex->dh == NULL) {
-+		sshpkt_disconnect(ssh, "Protocol error: no matching group found");
-+		fatal("Protocol error: no matching group found");
-+	}
-+
-+	DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
-+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 ||
-+	    (r = sshpkt_put_bignum2(ssh, dh_p)) != 0 ||
-+	    (r = sshpkt_put_bignum2(ssh, dh_g)) != 0 ||
-+	    (r = sshpkt_send(ssh)) != 0)
-+		fatal("sshpkt failed: %s", ssh_err(r));
-+
-+	if ((r = ssh_packet_write_wait(ssh)) != 0)
-+		fatal("ssh_packet_write_wait: %s", ssh_err(r));
-+
-+	/* Compute our exchange value in parallel with the client */
-+	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
-+		goto out;
-+
-+	do {
-+		debug("Wait SSH2_MSG_GSSAPI_INIT");
-+		type = ssh_packet_read(ssh);
-+		switch(type) {
-+		case SSH2_MSG_KEXGSS_INIT:
-+			if (dh_client_pub != NULL)
-+				fatal("Received KEXGSS_INIT after initialising");
-+			if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+			        &recv_tok)) != 0 ||
-+			    (r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 ||
-+			    (r = sshpkt_get_end(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+
-+			/* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
-+			break;
-+		case SSH2_MSG_KEXGSS_CONTINUE:
-+			if ((r = ssh_gssapi_sshpkt_get_buffer_desc(ssh,
-+			        &recv_tok)) != 0 ||
-+			    (r = sshpkt_get_end(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+			break;
-+		default:
-+			sshpkt_disconnect(ssh,
-+			    "Protocol error: didn't expect packet type %d",
-+			    type);
-+		}
-+
-+		maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
-+		    &send_tok, &ret_flags));
-+
-+		gss_release_buffer(&min_status, &recv_tok);
-+
-+		if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
-+			fatal("Zero length token output when incomplete");
-+
-+		if (dh_client_pub == NULL)
-+			fatal("No client public key");
-+
-+		if (maj_status & GSS_S_CONTINUE_NEEDED) {
-+			debug("Sending GSSAPI_CONTINUE");
-+			if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+			    (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
-+			    (r = sshpkt_send(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+			gss_release_buffer(&min_status, &send_tok);
-+		}
-+	} while (maj_status & GSS_S_CONTINUE_NEEDED);
-+
-+	if (GSS_ERROR(maj_status)) {
-+		if (send_tok.length > 0) {
-+			if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_CONTINUE)) != 0 ||
-+			    (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0 ||
-+			    (r = sshpkt_send(ssh)) != 0)
-+				fatal("sshpkt failed: %s", ssh_err(r));
-+		}
-+		fatal("accept_ctx died");
-+	}
-+
-+	if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-+		fatal("Mutual Authentication flag wasn't set");
-+
-+	if (!(ret_flags & GSS_C_INTEG_FLAG))
-+		fatal("Integrity flag wasn't set");
-+
-+	/* calculate shared secret */
-+	if ((shared_secret = sshbuf_new()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+	if ((r = kex_dh_compute_key(kex, dh_client_pub, shared_secret)) != 0)
-+		goto out;
-+
-+	DH_get0_key(kex->dh, &pub_key, NULL);
-+	DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
-+	hashlen = sizeof(hash);
-+	if ((r = kexgex_hash(
-+	    kex->hash_alg,
-+	    kex->client_version,
-+	    kex->server_version,
-+	    kex->peer,
-+	    kex->my,
-+	    empty,
-+	    cmin, nbits, cmax,
-+	    dh_p, dh_g,
-+	    dh_client_pub,
-+	    pub_key,
-+	    sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
-+	    hash, &hashlen)) != 0)
-+		fatal("kexgex_hash failed: %s", ssh_err(r));
-+
-+	gssbuf.value = hash;
-+	gssbuf.length = hashlen;
-+
-+	if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))))
-+		fatal("Couldn't get MIC");
-+
-+	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 ||
-+	    (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||
-+	    (r = sshpkt_put_string(ssh, msg_tok.value, msg_tok.length)) != 0)
-+		fatal("sshpkt failed: %s", ssh_err(r));
-+
-+	if (send_tok.length != 0) {
-+		if ((r = sshpkt_put_u8(ssh, 1)) != 0 || /* true */
-+		    (r = sshpkt_put_string(ssh, send_tok.value, send_tok.length)) != 0)
-+			fatal("sshpkt failed: %s", ssh_err(r));
-+	} else {
-+		if ((r = sshpkt_put_u8(ssh, 0)) != 0) /* false */
-+			fatal("sshpkt failed: %s", ssh_err(r));
-+	}
-+	if ((r = sshpkt_send(ssh)) != 0)
-+		fatal("sshpkt failed: %s", ssh_err(r));
-+
-+	gss_release_buffer(&min_status, &send_tok);
-+	gss_release_buffer(&min_status, &msg_tok);
-+
-+	if (gss_kex_context == NULL)
-+		gss_kex_context = ctxt;
-+	else
-+		ssh_gssapi_delete_ctx(&ctxt);
-+
-+	/* Finally derive the keys and send them */
-+	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
-+		r = kex_send_newkeys(ssh);
-+
-+	/* If this was a rekey, then save out any delegated credentials we
-+	 * just exchanged.  */
-+	if (options.gss_store_rekey)
-+		ssh_gssapi_rekey_creds();
-+out:
-+	sshbuf_free(empty);
-+	explicit_bzero(hash, sizeof(hash));
-+	DH_free(kex->dh);
-+	kex->dh = NULL;
-+	BN_clear_free(dh_client_pub);
-+	sshbuf_free(shared_secret);
-+	return r;
-+}
-+#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
-diff --git a/monitor.c b/monitor.c
-index 2ce89fe9..ebf76c7f 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -148,6 +148,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
- int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
- int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
- int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
-+int mm_answer_gss_sign(struct ssh *, int, struct sshbuf *);
-+int mm_answer_gss_updatecreds(struct ssh *, int, struct sshbuf *);
- #endif
- 
- #ifdef SSH_AUDIT_EVENTS
-@@ -220,11 +222,18 @@ struct mon_table mon_dispatch_proto20[] = {
-     {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
-     {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
-     {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
-+    {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},
- #endif
-     {0, 0, NULL}
- };
- 
- struct mon_table mon_dispatch_postauth20[] = {
-+#ifdef GSSAPI
-+    {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx},
-+    {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
-+    {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},
-+    {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds},
-+#endif
- #ifdef WITH_OPENSSL
-     {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
- #endif
-@@ -293,6 +302,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
- 	/* Permit requests for moduli and signatures */
- 	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
- 	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
-+#ifdef GSSAPI
-+	/* and for the GSSAPI key exchange */
-+	monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
-+#endif
- 
- 	/* The first few requests do not require asynchronous access */
- 	while (!authenticated) {
-@@ -406,6 +419,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
- 	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
- 	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
- 	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-+#ifdef GSSAPI
-+	/* and for the GSSAPI key exchange */
-+	monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
-+#endif
- 
- 	if (auth_opts->permit_pty_flag) {
- 		monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1713,6 +1730,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
- # ifdef OPENSSL_HAS_ECC
- 		kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
- # endif
-+# ifdef GSSAPI
-+		if (options.gss_keyex) {
-+			kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
-+			kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+			kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
-+			kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
-+			kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server;
-+			kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server;
-+			kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
-+		}
-+# endif
- #endif /* WITH_OPENSSL */
- 		kex->kex[KEX_C25519_SHA256] = kex_gen_server;
- 		kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
-@@ -1806,8 +1834,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
- 	u_char *p;
- 	int r;
- 
--	if (!options.gss_authentication)
--		fatal("%s: GSSAPI authentication not enabled", __func__);
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("%s: GSSAPI not enabled", __func__);
- 
- 	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1839,8 +1867,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
- 	OM_uint32 flags = 0; /* GSI needs this */
- 	int r;
- 
--	if (!options.gss_authentication)
--		fatal("%s: GSSAPI authentication not enabled", __func__);
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("%s: GSSAPI not enabled", __func__);
- 
- 	if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-@@ -1860,6 +1888,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
- 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
-+		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1);
- 	}
- 	return (0);
- }
-@@ -1871,8 +1900,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
- 	OM_uint32 ret;
- 	int r;
- 
--	if (!options.gss_authentication)
--		fatal("%s: GSSAPI authentication not enabled", __func__);
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("%s: GSSAPI not enabled", __func__);
- 
- 	if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
- 	    (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -1898,13 +1927,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
- int
- mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
- {
--	int r, authenticated;
-+	int r, authenticated, kex;
- 	const char *displayname;
- 
--	if (!options.gss_authentication)
--		fatal("%s: GSSAPI authentication not enabled", __func__);
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("%s: GSSAPI not enabled", __func__);
- 
--	authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user);
-+	if ((r = sshbuf_get_u32(m, &kex)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	authenticated = authctxt->valid &&
-+	    ssh_gssapi_userok(authctxt->user, authctxt->pw, kex);
- 
- 	sshbuf_reset(m);
- 	if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -1913,7 +1946,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
- 	debug3("%s: sending result %d", __func__, authenticated);
- 	mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
- 
--	auth_method = "gssapi-with-mic";
-+	if (kex) {
-+		auth_method = "gssapi-keyex";
-+	} else {
-+		auth_method = "gssapi-with-mic";
-+	}
- 
- 	if ((displayname = ssh_gssapi_displayname()) != NULL)
- 		auth2_record_info(authctxt, "%s", displayname);
-@@ -1921,5 +1958,85 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
- 	/* Monitor loop will terminate if authenticated */
- 	return (authenticated);
- }
-+
-+int
-+mm_answer_gss_sign(struct ssh *ssh, int socket, struct sshbuf *m)
-+{
-+	gss_buffer_desc data;
-+	gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
-+	OM_uint32 major, minor;
-+	size_t len;
-+	u_char *p = NULL;
-+	int r;
-+
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("%s: GSSAPI not enabled", __func__);
-+
-+	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+	data.value = p;
-+	data.length = len;
-+	/* Lengths of SHA-1, SHA-256 and SHA-512 hashes that are used */
-+	if (data.length != 20 && data.length != 32 && data.length != 64)
-+		fatal("%s: data length incorrect: %d", __func__,
-+		    (int) data.length);
-+
-+	/* Save the session ID on the first time around */
-+	if (session_id2_len == 0) {
-+		session_id2_len = data.length;
-+		session_id2 = xmalloc(session_id2_len);
-+		memcpy(session_id2, data.value, session_id2_len);
-+	}
-+	major = ssh_gssapi_sign(gsscontext, &data, &hash);
-+
-+	free(data.value);
-+
-+	sshbuf_reset(m);
-+
-+	if ((r = sshbuf_put_u32(m, major)) != 0 ||
-+	    (r = sshbuf_put_string(m, hash.value, hash.length)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	mm_request_send(socket, MONITOR_ANS_GSSSIGN, m);
-+
-+	gss_release_buffer(&minor, &hash);
-+
-+	/* Turn on getpwnam permissions */
-+	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
-+
-+	/* And credential updating, for when rekeying */
-+	monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1);
-+
-+	return (0);
-+}
-+
-+int
-+mm_answer_gss_updatecreds(struct ssh *ssh, int socket, struct sshbuf *m) {
-+	ssh_gssapi_ccache store;
-+	int r, ok;
-+
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("%s: GSSAPI not enabled", __func__);
-+
-+	if ((r = sshbuf_get_string(m, (u_char **)&store.filename, NULL)) != 0 ||
-+	    (r = sshbuf_get_string(m, (u_char **)&store.envvar, NULL)) != 0 ||
-+	    (r = sshbuf_get_string(m, (u_char **)&store.envval, NULL)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	ok = ssh_gssapi_update_creds(&store);
-+
-+	free(store.filename);
-+	free(store.envvar);
-+	free(store.envval);
-+
-+	sshbuf_reset(m);
-+	if ((r = sshbuf_put_u32(m, ok)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m);
-+
-+	return(0);
-+}
-+
- #endif /* GSSAPI */
- 
-diff --git a/monitor.h b/monitor.h
-index 683e5e07..2b1a2d59 100644
---- a/monitor.h
-+++ b/monitor.h
-@@ -63,6 +63,8 @@ enum monitor_reqtype {
- 	MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
- 	MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
- 
-+	MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
-+	MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
- };
- 
- struct ssh;
-diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 001a8fa1..6edb509a 100644
---- a/monitor_wrap.c
-+++ b/monitor_wrap.c
-@@ -993,13 +993,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
- }
- 
- int
--mm_ssh_gssapi_userok(char *user)
-+mm_ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
- {
- 	struct sshbuf *m;
- 	int r, authenticated = 0;
- 
- 	if ((m = sshbuf_new()) == NULL)
- 		fatal("%s: sshbuf_new failed", __func__);
-+	if ((r = sshbuf_put_u32(m, kex)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
- 
- 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
- 	mm_request_receive_expect(pmonitor->m_recvfd,
-@@ -1012,4 +1014,57 @@ mm_ssh_gssapi_userok(char *user)
- 	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
- 	return (authenticated);
- }
-+
-+OM_uint32
-+mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
-+{
-+	struct sshbuf *m;
-+	OM_uint32 major;
-+	int r;
-+
-+	if ((m = sshbuf_new()) == NULL)
-+		fatal("%s: sshbuf_new failed", __func__);
-+	if ((r = sshbuf_put_string(m, data->value, data->length)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, m);
-+
-+	if ((r = sshbuf_get_u32(m, &major)) != 0 ||
-+	    (r = ssh_gssapi_get_buffer_desc(m, hash)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	sshbuf_free(m);
-+
-+	return (major);
-+}
-+
-+int
-+mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
-+{
-+	struct sshbuf *m;
-+	int r, ok;
-+
-+	if ((m = sshbuf_new()) == NULL)
-+		fatal("%s: sshbuf_new failed", __func__);
-+
-+	if ((r = sshbuf_put_cstring(m,
-+	    store->filename ? store->filename : "")) != 0 ||
-+	    (r = sshbuf_put_cstring(m,
-+	    store->envvar ? store->envvar : "")) != 0 ||
-+	    (r = sshbuf_put_cstring(m,
-+	    store->envval ? store->envval : "")) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, m);
-+
-+	if ((r = sshbuf_get_u32(m, &ok)) != 0)
-+		fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+
-+	sshbuf_free(m);
-+
-+	return (ok);
-+}
-+
- #endif /* GSSAPI */
-diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 23ab096a..485590c1 100644
---- a/monitor_wrap.h
-+++ b/monitor_wrap.h
-@@ -64,8 +64,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
- OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
- OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
-    gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
--int mm_ssh_gssapi_userok(char *user);
-+int mm_ssh_gssapi_userok(char *user, struct passwd *, int kex);
- OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
-+OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
-+int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *);
- #endif
- 
- #ifdef USE_PAM
-diff --git a/readconf.c b/readconf.c
-index f3cac6b3..da8022dd 100644
---- a/readconf.c
-+++ b/readconf.c
-@@ -67,6 +67,7 @@
- #include "uidswap.h"
- #include "myproposal.h"
- #include "digest.h"
-+#include "ssh-gss.h"
- 
- /* Format of the configuration file:
- 
-@@ -160,6 +161,8 @@ typedef enum {
- 	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
- 	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
- 	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
-+	oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
-+	oGssServerIdentity, oGssKexAlgorithms,
- 	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- 	oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
- 	oHashKnownHosts,
-@@ -204,10 +207,22 @@ static struct {
- 	/* Sometimes-unsupported options */
- #if defined(GSSAPI)
- 	{ "gssapiauthentication", oGssAuthentication },
-+	{ "gssapikeyexchange", oGssKeyEx },
- 	{ "gssapidelegatecredentials", oGssDelegateCreds },
-+	{ "gssapitrustdns", oGssTrustDns },
-+	{ "gssapiclientidentity", oGssClientIdentity },
-+	{ "gssapiserveridentity", oGssServerIdentity },
-+	{ "gssapirenewalforcesrekey", oGssRenewalRekey },
-+	{ "gssapikexalgorithms", oGssKexAlgorithms },
- # else
- 	{ "gssapiauthentication", oUnsupported },
-+	{ "gssapikeyexchange", oUnsupported },
- 	{ "gssapidelegatecredentials", oUnsupported },
-+	{ "gssapitrustdns", oUnsupported },
-+	{ "gssapiclientidentity", oUnsupported },
-+	{ "gssapiserveridentity", oUnsupported },
-+	{ "gssapirenewalforcesrekey", oUnsupported },
-+	{ "gssapikexalgorithms", oUnsupported },
- #endif
- #ifdef ENABLE_PKCS11
- 	{ "pkcs11provider", oPKCS11Provider },
-@@ -1029,10 +1044,42 @@ parse_time:
- 		intptr = &options->gss_authentication;
- 		goto parse_flag;
- 
-+	case oGssKeyEx:
-+		intptr = &options->gss_keyex;
-+		goto parse_flag;
-+
- 	case oGssDelegateCreds:
- 		intptr = &options->gss_deleg_creds;
- 		goto parse_flag;
- 
-+	case oGssTrustDns:
-+		intptr = &options->gss_trust_dns;
-+		goto parse_flag;
-+
-+	case oGssClientIdentity:
-+		charptr = &options->gss_client_identity;
-+		goto parse_string;
-+
-+	case oGssServerIdentity:
-+		charptr = &options->gss_server_identity;
-+		goto parse_string;
-+
-+	case oGssRenewalRekey:
-+		intptr = &options->gss_renewal_rekey;
-+		goto parse_flag;
-+
-+	case oGssKexAlgorithms:
-+		arg = strdelim(&s);
-+		if (!arg || *arg == '\0')
-+			fatal("%.200s line %d: Missing argument.",
-+			    filename, linenum);
-+		if (!kex_gss_names_valid(arg))
-+			fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.",
-+			    filename, linenum, arg ? arg : "<NONE>");
-+		if (*activep && options->gss_kex_algorithms == NULL)
-+			options->gss_kex_algorithms = xstrdup(arg);
-+		break;
-+
- 	case oBatchMode:
- 		intptr = &options->batch_mode;
- 		goto parse_flag;
-@@ -1911,7 +1958,13 @@ initialize_options(Options * options)
- 	options->pubkey_authentication = -1;
- 	options->challenge_response_authentication = -1;
- 	options->gss_authentication = -1;
-+	options->gss_keyex = -1;
- 	options->gss_deleg_creds = -1;
-+	options->gss_trust_dns = -1;
-+	options->gss_renewal_rekey = -1;
-+	options->gss_client_identity = NULL;
-+	options->gss_server_identity = NULL;
-+	options->gss_kex_algorithms = NULL;
- 	options->password_authentication = -1;
- 	options->kbd_interactive_authentication = -1;
- 	options->kbd_interactive_devices = NULL;
-@@ -2059,8 +2112,18 @@ fill_default_options(Options * options)
- 		options->challenge_response_authentication = 1;
- 	if (options->gss_authentication == -1)
- 		options->gss_authentication = 0;
-+	if (options->gss_keyex == -1)
-+		options->gss_keyex = 0;
- 	if (options->gss_deleg_creds == -1)
- 		options->gss_deleg_creds = 0;
-+	if (options->gss_trust_dns == -1)
-+		options->gss_trust_dns = 0;
-+	if (options->gss_renewal_rekey == -1)
-+		options->gss_renewal_rekey = 0;
-+#ifdef GSSAPI
-+	if (options->gss_kex_algorithms == NULL)
-+		options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
-+#endif
- 	if (options->password_authentication == -1)
- 		options->password_authentication = 1;
- 	if (options->kbd_interactive_authentication == -1)
-@@ -2702,7 +2765,14 @@ dump_client_config(Options *o, const char *host)
- 	dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
- #ifdef GSSAPI
- 	dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
-+	dump_cfg_fmtint(oGssKeyEx, o->gss_keyex);
- 	dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
-+	dump_cfg_fmtint(oGssTrustDns, o->gss_trust_dns);
-+	dump_cfg_fmtint(oGssRenewalRekey, o->gss_renewal_rekey);
-+	dump_cfg_string(oGssClientIdentity, o->gss_client_identity);
-+	dump_cfg_string(oGssServerIdentity, o->gss_server_identity);
-+	dump_cfg_string(oGssKexAlgorithms, o->gss_kex_algorithms ?
-+	    o->gss_kex_algorithms : GSS_KEX_DEFAULT_KEX);
- #endif /* GSSAPI */
- 	dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
- 	dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
-diff --git a/readconf.h b/readconf.h
-index feedb3d2..a8a8870d 100644
---- a/readconf.h
-+++ b/readconf.h
-@@ -41,7 +41,13 @@ typedef struct {
- 	int     challenge_response_authentication;
- 					/* Try S/Key or TIS, authentication. */
- 	int     gss_authentication;	/* Try GSS authentication */
-+	int     gss_keyex;		/* Try GSS key exchange */
- 	int     gss_deleg_creds;	/* Delegate GSS credentials */
-+	int	gss_trust_dns;		/* Trust DNS for GSS canonicalization */
-+	int	gss_renewal_rekey;	/* Credential renewal forces rekey */
-+	char    *gss_client_identity;   /* Principal to initiate GSSAPI with */
-+	char    *gss_server_identity;   /* GSSAPI target principal */
-+	char    *gss_kex_algorithms;	/* GSSAPI kex methods to be offered by client. */
- 	int     password_authentication;	/* Try password
- 						 * authentication. */
- 	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff --git a/servconf.c b/servconf.c
-index 70f5f73f..191575a1 100644
---- a/servconf.c
-+++ b/servconf.c
-@@ -69,6 +69,7 @@
- #include "auth.h"
- #include "myproposal.h"
- #include "digest.h"
-+#include "ssh-gss.h"
- 
- static void add_listen_addr(ServerOptions *, const char *,
-     const char *, int);
-@@ -133,8 +134,11 @@ initialize_server_options(ServerOptions *options)
- 	options->kerberos_ticket_cleanup = -1;
- 	options->kerberos_get_afs_token = -1;
- 	options->gss_authentication=-1;
-+	options->gss_keyex = -1;
- 	options->gss_cleanup_creds = -1;
- 	options->gss_strict_acceptor = -1;
-+	options->gss_store_rekey = -1;
-+	options->gss_kex_algorithms = NULL;
- 	options->password_authentication = -1;
- 	options->kbd_interactive_authentication = -1;
- 	options->challenge_response_authentication = -1;
-@@ -375,10 +379,18 @@ fill_default_server_options(ServerOptions *options)
- 		options->kerberos_get_afs_token = 0;
- 	if (options->gss_authentication == -1)
- 		options->gss_authentication = 0;
-+	if (options->gss_keyex == -1)
-+		options->gss_keyex = 0;
- 	if (options->gss_cleanup_creds == -1)
- 		options->gss_cleanup_creds = 1;
- 	if (options->gss_strict_acceptor == -1)
- 		options->gss_strict_acceptor = 1;
-+	if (options->gss_store_rekey == -1)
-+		options->gss_store_rekey = 0;
-+#ifdef GSSAPI
-+	if (options->gss_kex_algorithms == NULL)
-+		options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
-+#endif
- 	if (options->password_authentication == -1)
- 		options->password_authentication = 1;
- 	if (options->kbd_interactive_authentication == -1)
-@@ -531,6 +543,7 @@ typedef enum {
- 	sHostKeyAlgorithms,
- 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
- 	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
-+	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
- 	sAcceptEnv, sSetEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
- 	sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -607,12 +620,22 @@ static struct {
- #ifdef GSSAPI
- 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
- 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
-+	{ "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL },
- 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
-+	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
-+	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
-+	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
- #else
- 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
- 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
- #endif
-+	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
- 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
- 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
- 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1548,6 +1571,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- 		intptr = &options->gss_authentication;
- 		goto parse_flag;
- 
-+	case sGssKeyEx:
-+		intptr = &options->gss_keyex;
-+		goto parse_flag;
-+
- 	case sGssCleanupCreds:
- 		intptr = &options->gss_cleanup_creds;
- 		goto parse_flag;
-@@ -1556,6 +1583,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
- 		intptr = &options->gss_strict_acceptor;
- 		goto parse_flag;
- 
-+	case sGssStoreRekey:
-+		intptr = &options->gss_store_rekey;
-+		goto parse_flag;
-+
-+	case sGssKexAlgorithms:
-+		arg = strdelim(&cp);
-+		if (!arg || *arg == '\0')
-+			fatal("%.200s line %d: Missing argument.",
-+			    filename, linenum);
-+		if (!kex_gss_names_valid(arg))
-+			fatal("%.200s line %d: Bad GSSAPI KexAlgorithms '%s'.",
-+			    filename, linenum, arg ? arg : "<NONE>");
-+		if (*activep && options->gss_kex_algorithms == NULL)
-+			options->gss_kex_algorithms = xstrdup(arg);
-+		break;
-+
- 	case sPasswordAuthentication:
- 		intptr = &options->password_authentication;
- 		goto parse_flag;
-@@ -2777,6 +2820,10 @@ dump_config(ServerOptions *o)
- #ifdef GSSAPI
- 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
- 	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
-+	dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
-+	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
-+	dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
-+	dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
- #endif
- 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
- 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
-diff --git a/servconf.h b/servconf.h
-index 4202a2d0..3f47ea25 100644
---- a/servconf.h
-+++ b/servconf.h
-@@ -132,8 +132,11 @@ typedef struct {
- 	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
- 						 * authenticated with Kerberos. */
- 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
-+	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
- 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
- 	int     gss_strict_acceptor;	/* If true, restrict the GSSAPI acceptor name */
-+	int 	gss_store_rekey;
-+	char   *gss_kex_algorithms;	/* GSSAPI kex methods to be offered by client. */
- 	int     password_authentication;	/* If true, permit password
- 						 * authentication. */
- 	int     kbd_interactive_authentication;	/* If true, permit */
-diff --git a/session.c b/session.c
-index 8c0e54f7..06a33442 100644
---- a/session.c
-+++ b/session.c
-@@ -2678,13 +2678,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
- 
- #ifdef KRB5
- 	if (options.kerberos_ticket_cleanup &&
--	    authctxt->krb5_ctx)
-+	    authctxt->krb5_ctx) {
-+		temporarily_use_uid(authctxt->pw);
- 		krb5_cleanup_proc(authctxt);
-+		restore_uid();
-+	}
- #endif
- 
- #ifdef GSSAPI
--	if (options.gss_cleanup_creds)
-+	if (options.gss_cleanup_creds) {
-+		temporarily_use_uid(authctxt->pw);
- 		ssh_gssapi_cleanup_creds();
-+		restore_uid();
-+	}
- #endif
- 
- 	/* remove agent socket */
-diff --git a/ssh-gss.h b/ssh-gss.h
-index 36180d07..70dd3665 100644
---- a/ssh-gss.h
-+++ b/ssh-gss.h
-@@ -1,6 +1,6 @@
- /* $OpenBSD: ssh-gss.h,v 1.14 2018/07/10 09:13:30 djm Exp $ */
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -61,10 +61,30 @@
- 
- #define SSH_GSS_OIDTYPE 0x06
- 
-+#define SSH2_MSG_KEXGSS_INIT                            30
-+#define SSH2_MSG_KEXGSS_CONTINUE                        31
-+#define SSH2_MSG_KEXGSS_COMPLETE                        32
-+#define SSH2_MSG_KEXGSS_HOSTKEY                         33
-+#define SSH2_MSG_KEXGSS_ERROR                           34
-+#define SSH2_MSG_KEXGSS_GROUPREQ			40
-+#define SSH2_MSG_KEXGSS_GROUP				41
-+#define KEX_GSS_GRP1_SHA1_ID				"gss-group1-sha1-"
-+#define KEX_GSS_GRP14_SHA1_ID				"gss-group14-sha1-"
-+#define KEX_GSS_GRP14_SHA256_ID			"gss-group14-sha256-"
-+#define KEX_GSS_GRP16_SHA512_ID			"gss-group16-sha512-"
-+#define KEX_GSS_GEX_SHA1_ID				"gss-gex-sha1-"
-+#define KEX_GSS_NISTP256_SHA256_ID			"gss-nistp256-sha256-"
-+#define KEX_GSS_C25519_SHA256_ID			"gss-curve25519-sha256-"
-+
-+#define        GSS_KEX_DEFAULT_KEX \
-+	KEX_GSS_GEX_SHA1_ID "," \
-+	KEX_GSS_GRP14_SHA1_ID
-+
- typedef struct {
- 	char *filename;
- 	char *envvar;
- 	char *envval;
-+	struct passwd *owner;
- 	void *data;
- } ssh_gssapi_ccache;
- 
-@@ -72,8 +92,11 @@ typedef struct {
- 	gss_buffer_desc displayname;
- 	gss_buffer_desc exportedname;
- 	gss_cred_id_t creds;
-+	gss_name_t name;
- 	struct ssh_gssapi_mech_struct *mech;
- 	ssh_gssapi_ccache store;
-+	int used;
-+	int updated;
- } ssh_gssapi_client;
- 
- typedef struct ssh_gssapi_mech_struct {
-@@ -84,6 +107,7 @@ typedef struct ssh_gssapi_mech_struct {
- 	int (*userok) (ssh_gssapi_client *, char *);
- 	int (*localname) (ssh_gssapi_client *, char **);
- 	void (*storecreds) (ssh_gssapi_client *);
-+	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
- } ssh_gssapi_mech;
- 
- typedef struct {
-@@ -94,10 +118,11 @@ typedef struct {
- 	gss_OID		oid; /* client */
- 	gss_cred_id_t	creds; /* server */
- 	gss_name_t	client; /* server */
--	gss_cred_id_t	client_creds; /* server */
-+	gss_cred_id_t	client_creds; /* both */
- } Gssctxt;
- 
- extern ssh_gssapi_mech *supported_mechs[];
-+extern Gssctxt *gss_kex_context;
- 
- int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
- void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -109,6 +134,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
- 
- struct sshbuf;
- int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
-+int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *);
- 
- OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
- OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
-@@ -123,17 +149,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
- OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_buildmic(struct sshbuf *, const char *,
-     const char *, const char *);
--int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
-+int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
-+OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
-+int ssh_gssapi_credentials_updated(Gssctxt *);
- 
- /* In the server */
-+typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *,
-+    const char *);
-+char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *);
-+char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
-+    const char *, const char *);
-+gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
-+int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *,
-+    const char *);
- OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
--int ssh_gssapi_userok(char *name);
-+int ssh_gssapi_userok(char *name, struct passwd *, int kex);
- OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_do_child(char ***, u_int *);
- void ssh_gssapi_cleanup_creds(void);
- void ssh_gssapi_storecreds(void);
- const char *ssh_gssapi_displayname(void);
- 
-+char *ssh_gssapi_server_mechanisms(void);
-+int ssh_gssapi_oid_table_ok(void);
-+
-+int ssh_gssapi_update_creds(ssh_gssapi_ccache *store);
-+void ssh_gssapi_rekey_creds(void);
-+
- #endif /* GSSAPI */
- 
- #endif /* _SSH_GSS_H */
-diff --git a/ssh.1 b/ssh.1
-index 60de6087..db5c65bc 100644
---- a/ssh.1
-+++ b/ssh.1
-@@ -503,7 +503,13 @@ For full details of the options listed below, and their possible values, see
- .It GatewayPorts
- .It GlobalKnownHostsFile
- .It GSSAPIAuthentication
-+.It GSSAPIKeyExchange
-+.It GSSAPIClientIdentity
- .It GSSAPIDelegateCredentials
-+.It GSSAPIKexAlgorithms
-+.It GSSAPIRenewalForcesRekey
-+.It GSSAPIServerIdentity
-+.It GSSAPITrustDns
- .It HashKnownHosts
- .It Host
- .It HostbasedAuthentication
-@@ -579,6 +585,8 @@ flag),
- (supported message integrity codes),
- .Ar kex
- (key exchange algorithms),
-+.Ar kex-gss
-+(GSSAPI key exchange algorithms),
- .Ar key
- (key types),
- .Ar key-cert
-diff --git a/ssh.c b/ssh.c
-index 15aee569..110cf9c1 100644
---- a/ssh.c
-+++ b/ssh.c
-@@ -747,6 +747,8 @@ main(int ac, char **av)
- 			else if (strcmp(optarg, "kex") == 0 ||
- 			    strcasecmp(optarg, "KexAlgorithms") == 0)
- 				cp = kex_alg_list('\n');
-+			else if (strcmp(optarg, "kex-gss") == 0)
-+				cp = kex_gss_alg_list('\n');
- 			else if (strcmp(optarg, "key") == 0)
- 				cp = sshkey_alg_list(0, 0, 0, '\n');
- 			else if (strcmp(optarg, "key-cert") == 0)
-@@ -772,8 +774,8 @@ main(int ac, char **av)
- 			} else if (strcmp(optarg, "help") == 0) {
- 				cp = xstrdup(
- 				    "cipher\ncipher-auth\ncompression\nkex\n"
--				    "key\nkey-cert\nkey-plain\nkey-sig\nmac\n"
--				    "protocol-version\nsig");
-+				    "kex-gss\nkey\nkey-cert\nkey-plain\n"
-+				    "key-sig\nmac\nprotocol-version\nsig");
- 			}
- 			if (cp == NULL)
- 				fatal("Unsupported query \"%s\"", optarg);
-diff --git a/ssh_config b/ssh_config
-index 5e8ef548..1ff999b6 100644
---- a/ssh_config
-+++ b/ssh_config
-@@ -24,6 +24,8 @@
- #   HostbasedAuthentication no
- #   GSSAPIAuthentication no
- #   GSSAPIDelegateCredentials no
-+#   GSSAPIKeyExchange no
-+#   GSSAPITrustDNS no
- #   BatchMode no
- #   CheckHostIP yes
- #   AddressFamily any
-diff --git a/ssh_config.5 b/ssh_config.5
-index 06a32d31..3f490697 100644
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -766,10 +766,67 @@ The default is
- Specifies whether user authentication based on GSSAPI is allowed.
- The default is
- .Cm no .
-+.It Cm GSSAPIClientIdentity
-+If set, specifies the GSSAPI client identity that ssh should use when
-+connecting to the server. The default is unset, which means that the default
-+identity will be used.
- .It Cm GSSAPIDelegateCredentials
- Forward (delegate) credentials to the server.
- The default is
- .Cm no .
-+.It Cm GSSAPIKeyExchange
-+Specifies whether key exchange based on GSSAPI may be used. When using
-+GSSAPI key exchange the server need not have a host key.
-+The default is
-+.Dq no .
-+.It Cm GSSAPIRenewalForcesRekey
-+If set to
-+.Dq yes
-+then renewal of the client's GSSAPI credentials will force the rekeying of the
-+ssh connection. With a compatible server, this will delegate the renewed
-+credentials to a session on the server.
-+.Pp
-+Checks are made to ensure that credentials are only propagated when the new
-+credentials match the old ones on the originating client and where the
-+receiving server still has the old set in its cache.
-+.Pp
-+The default is
-+.Dq no .
-+.Pp
-+For this to work
-+.Cm GSSAPIKeyExchange
-+needs to be enabled in the server and also used by the client.
-+.It Cm GSSAPIServerIdentity
-+If set, specifies the GSSAPI server identity that ssh should expect when
-+connecting to the server. The default is unset, which means that the
-+expected GSSAPI server identity will be determined from the target
-+hostname.
-+.It Cm GSSAPITrustDns
-+Set to
-+.Dq yes
-+to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If
-+.Dq no ,
-+the hostname entered on the
-+command line will be passed untouched to the GSSAPI library.
-+The default is
-+.Dq no .
-+.It Cm GSSAPIKexAlgorithms
-+The list of key exchange algorithms that are offered for GSSAPI
-+key exchange. Possible values are
-+.Bd -literal -offset 3n
-+gss-gex-sha1-,
-+gss-group1-sha1-,
-+gss-group14-sha1-,
-+gss-group14-sha256-,
-+gss-group16-sha512-,
-+gss-nistp256-sha256-,
-+gss-curve25519-sha256-
-+.Ed
-+.Pp
-+The default is
-+.Dq gss-gex-sha1-,gss-group14-sha1- .
-+This option only applies to protocol version 2 connections using GSSAPI.
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
-diff --git a/sshconnect2.c b/sshconnect2.c
-index af00fb30..03bc87eb 100644
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -80,8 +80,6 @@
- #endif
- 
- /* import */
--extern char *client_version_string;
--extern char *server_version_string;
- extern Options options;
- 
- /*
-@@ -163,6 +161,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- 	char *s, *all_key;
- 	int r, use_known_hosts_order = 0;
- 
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+	char *orig = NULL, *gss = NULL;
-+	char *gss_host = NULL;
-+#endif
-+
- 	xxx_host = host;
- 	xxx_hostaddr = hostaddr;
- 
-@@ -206,6 +209,35 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- 		    compat_pkalg_proposal(options.hostkeyalgorithms);
- 	}
- 
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+	if (options.gss_keyex) {
-+		/* Add the GSSAPI mechanisms currently supported on this
-+		 * client to the key exchange algorithm proposal */
-+		orig = myproposal[PROPOSAL_KEX_ALGS];
-+
-+		if (options.gss_server_identity)
-+			gss_host = xstrdup(options.gss_server_identity);
-+		else if (options.gss_trust_dns)
-+			gss_host = remote_hostname(ssh);
-+		else
-+			gss_host = xstrdup(host);
-+
-+		gss = ssh_gssapi_client_mechanisms(gss_host,
-+		    options.gss_client_identity, options.gss_kex_algorithms);
-+		if (gss) {
-+			debug("Offering GSSAPI proposal: %s", gss);
-+			xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
-+			    "%s,%s", gss, orig);
-+
-+			/* If we've got GSSAPI algorithms, then we also support the
-+			 * 'null' hostkey, as a last resort */
-+			orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
-+			xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
-+			    "%s,null", orig);
-+		}
-+	}
-+#endif
-+
- 	if (options.rekey_limit || options.rekey_interval)
- 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
- 		    options.rekey_interval);
-@@ -224,16 +256,46 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- # ifdef OPENSSL_HAS_ECC
- 	ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
- # endif
--#endif
-+# ifdef GSSAPI
-+	if (options.gss_keyex) {
-+		ssh->kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
-+		ssh->kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
-+		ssh->kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_client;
-+		ssh->kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_client;
-+		ssh->kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_client;
-+		ssh->kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_client;
-+		ssh->kex->kex[KEX_GSS_C25519_SHA256] = kexgss_client;
-+	}
-+# endif
-+#endif /* WITH_OPENSSL */
- 	ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client;
- 	ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_client;
- 	ssh->kex->verify_host_key=&verify_host_key_callback;
- 
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+	if (options.gss_keyex) {
-+		ssh->kex->gss_deleg_creds = options.gss_deleg_creds;
-+		ssh->kex->gss_trust_dns = options.gss_trust_dns;
-+		ssh->kex->gss_client = options.gss_client_identity;
-+		ssh->kex->gss_host = gss_host;
-+	}
-+#endif
-+
- 	ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done);
- 
- 	/* remove ext-info from the KEX proposals for rekeying */
- 	myproposal[PROPOSAL_KEX_ALGS] =
- 	    compat_kex_proposal(options.kex_algorithms);
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+	/* repair myproposal after it was crumpled by the */
-+	/* ext-info removal above */
-+	if (gss) {
-+		orig = myproposal[PROPOSAL_KEX_ALGS];
-+		xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
-+		    "%s,%s", gss, orig);
-+		free(gss);
-+	}
-+#endif
- 	if ((r = kex_prop2buf(ssh->kex->my, myproposal)) != 0)
- 		fatal("kex_prop2buf: %s", ssh_err(r));
- 
-@@ -330,6 +392,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
- static int input_gssapi_token(int type, u_int32_t, struct ssh *);
- static int input_gssapi_error(int, u_int32_t, struct ssh *);
- static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
-+static int userauth_gsskeyex(struct ssh *);
- #endif
- 
- void	userauth(struct ssh *, char *);
-@@ -346,6 +409,11 @@ static char *authmethods_get(void);
- 
- Authmethod authmethods[] = {
- #ifdef GSSAPI
-+	{"gssapi-keyex",
-+		userauth_gsskeyex,
-+		NULL,
-+		&options.gss_keyex,
-+		NULL},
- 	{"gssapi-with-mic",
- 		userauth_gssapi,
- 		userauth_gssapi_cleanup,
-@@ -716,12 +784,25 @@ userauth_gssapi(struct ssh *ssh)
- 	OM_uint32 min;
- 	int r, ok = 0;
- 	gss_OID mech = NULL;
-+	char *gss_host;
-+
-+	if (options.gss_server_identity)
-+		gss_host = xstrdup(options.gss_server_identity);
-+	else if (options.gss_trust_dns)
-+		gss_host = remote_hostname(ssh);
-+	else
-+		gss_host = xstrdup(authctxt->host);
- 
- 	/* Try one GSSAPI method at a time, rather than sending them all at
- 	 * once. */
- 
- 	if (authctxt->gss_supported_mechs == NULL)
--		gss_indicate_mechs(&min, &authctxt->gss_supported_mechs);
-+		if (GSS_ERROR(gss_indicate_mechs(&min,
-+		    &authctxt->gss_supported_mechs))) {
-+			authctxt->gss_supported_mechs = NULL;
-+			free(gss_host);
-+			return 0;
-+		}
- 
- 	/* Check to see whether the mechanism is usable before we offer it */
- 	while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
-@@ -730,13 +811,15 @@ userauth_gssapi(struct ssh *ssh)
- 		    elements[authctxt->mech_tried];
- 		/* My DER encoding requires length<128 */
- 		if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
--		    mech, authctxt->host)) {
-+		    mech, gss_host, options.gss_client_identity)) {
- 			ok = 1; /* Mechanism works */
- 		} else {
- 			authctxt->mech_tried++;
- 		}
- 	}
- 
-+	free(gss_host);
-+
- 	if (!ok || mech == NULL)
- 		return 0;
- 
-@@ -976,6 +1059,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
- 	free(lang);
- 	return r;
- }
-+
-+int
-+userauth_gsskeyex(struct ssh *ssh)
-+{
-+	struct sshbuf *b = NULL;
-+	Authctxt *authctxt = ssh->authctxt;
-+	gss_buffer_desc gssbuf;
-+	gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
-+	OM_uint32 ms;
-+	int r;
-+
-+	static int attempt = 0;
-+	if (attempt++ >= 1)
-+		return (0);
-+
-+	if (gss_kex_context == NULL) {
-+		debug("No valid Key exchange context");
-+		return (0);
-+	}
-+
-+	if ((b = sshbuf_new()) == NULL)
-+		fatal("%s: sshbuf_new failed", __func__);
-+
-+	ssh_gssapi_buildmic(b, authctxt->server_user, authctxt->service,
-+	    "gssapi-keyex");
-+
-+	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
-+		fatal("%s: sshbuf_mutable_ptr failed", __func__);
-+	gssbuf.length = sshbuf_len(b);
-+
-+	if (GSS_ERROR(ssh_gssapi_sign(gss_kex_context, &gssbuf, &mic))) {
-+		sshbuf_free(b);
-+		return (0);
-+	}
-+
-+	if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
-+	    (r = sshpkt_put_cstring(ssh, authctxt->server_user)) != 0 ||
-+	    (r = sshpkt_put_cstring(ssh, authctxt->service)) != 0 ||
-+	    (r = sshpkt_put_cstring(ssh, authctxt->method->name)) != 0 ||
-+	    (r = sshpkt_put_string(ssh, mic.value, mic.length)) != 0 ||
-+	    (r = sshpkt_send(ssh)) != 0)
-+		fatal("%s: %s", __func__, ssh_err(r));
-+
-+	sshbuf_free(b);
-+	gss_release_buffer(&ms, &mic);
-+
-+	return (1);
-+}
-+
- #endif /* GSSAPI */
- 
- static int
-diff --git a/sshd.c b/sshd.c
-index 60b2aaf7..d92f03aa 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -817,8 +817,8 @@ notify_hostkeys(struct ssh *ssh)
- 	}
- 	debug3("%s: sent %u hostkeys", __func__, nkeys);
- 	if (nkeys == 0)
--		fatal("%s: no hostkeys", __func__);
--	if ((r = sshpkt_send(ssh)) != 0)
-+		debug3("%s: no hostkeys", __func__);
-+	else if ((r = sshpkt_send(ssh)) != 0)
- 		sshpkt_fatal(ssh, r, "%s: send", __func__);
- 	sshbuf_free(buf);
- }
-@@ -1852,7 +1852,8 @@ main(int ac, char **av)
- 		free(fp);
- 	}
- 	accumulate_host_timing_secret(cfg, NULL);
--	if (!sensitive_data.have_ssh2_key) {
-+	/* The GSSAPI key exchange can run without a host key */
-+	if (!sensitive_data.have_ssh2_key && !options.gss_keyex) {
- 		logit("sshd: no hostkeys available -- exiting.");
- 		exit(1);
- 	}
-@@ -2347,6 +2348,48 @@ do_ssh2_kex(struct ssh *ssh)
- 	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
- 	    list_hostkey_types());
- 
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+	{
-+	char *orig;
-+	char *gss = NULL;
-+	char *newstr = NULL;
-+	orig = myproposal[PROPOSAL_KEX_ALGS];
-+
-+	/*
-+	 * If we don't have a host key, then there's no point advertising
-+	 * the other key exchange algorithms
-+	 */
-+
-+	if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0)
-+		orig = NULL;
-+
-+	if (options.gss_keyex)
-+		gss = ssh_gssapi_server_mechanisms();
-+	else
-+		gss = NULL;
-+
-+	if (gss && orig)
-+		xasprintf(&newstr, "%s,%s", gss, orig);
-+	else if (gss)
-+		newstr = gss;
-+	else if (orig)
-+		newstr = orig;
-+
-+	/*
-+	 * If we've got GSSAPI mechanisms, then we've got the 'null' host
-+	 * key alg, but we can't tell people about it unless its the only
-+	 * host key algorithm we support
-+	 */
-+	if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0)
-+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null";
-+
-+	if (newstr)
-+		myproposal[PROPOSAL_KEX_ALGS] = newstr;
-+	else
-+		fatal("No supported key exchange algorithms");
-+	}
-+#endif
-+
- 	/* start key exchange */
- 	if ((r = kex_setup(ssh, myproposal)) != 0)
- 		fatal("kex_setup: %s", ssh_err(r));
-@@ -2362,7 +2405,18 @@ do_ssh2_kex(struct ssh *ssh)
- # ifdef OPENSSL_HAS_ECC
- 	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
- # endif
--#endif
-+# ifdef GSSAPI
-+	if (options.gss_keyex) {
-+		kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
-+		kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+		kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
-+		kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
-+		kex->kex[KEX_GSS_GEX_SHA1] = kexgssgex_server;
-+		kex->kex[KEX_GSS_NISTP256_SHA256] = kexgss_server;
-+		kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server;
-+	}
-+# endif
-+#endif /* WITH_OPENSSL */
- 	kex->kex[KEX_C25519_SHA256] = kex_gen_server;
- 	kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_server;
- 	kex->load_host_public_key=&get_hostkey_public_by_type;
-diff --git a/sshd_config b/sshd_config
-index 19b7c91a..2c48105f 100644
---- a/sshd_config
-+++ b/sshd_config
-@@ -69,6 +69,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
- # GSSAPI options
- #GSSAPIAuthentication no
- #GSSAPICleanupCredentials yes
-+#GSSAPIStrictAcceptorCheck yes
-+#GSSAPIKeyExchange no
- 
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
-diff --git a/sshd_config.5 b/sshd_config.5
-index 70ccea44..f6b41a2f 100644
---- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -646,6 +646,11 @@ Specifies whether to automatically destroy the user's credentials cache
- on logout.
- The default is
- .Cm yes .
-+.It Cm GSSAPIKeyExchange
-+Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
-+doesn't rely on ssh keys to verify host identity.
-+The default is
-+.Cm no .
- .It Cm GSSAPIStrictAcceptorCheck
- Determines whether to be strict about the identity of the GSSAPI acceptor
- a client authenticates against.
-@@ -660,6 +665,31 @@ machine's default store.
- This facility is provided to assist with operation on multi homed machines.
- The default is
- .Cm yes .
-+.It Cm GSSAPIStoreCredentialsOnRekey
-+Controls whether the user's GSSAPI credentials should be updated following a
-+successful connection rekeying. This option can be used to accepted renewed
-+or updated credentials from a compatible client. The default is
-+.Dq no .
-+.Pp
-+For this to work
-+.Cm GSSAPIKeyExchange
-+needs to be enabled in the server and also used by the client.
-+.It Cm GSSAPIKexAlgorithms
-+The list of key exchange algorithms that are accepted by GSSAPI
-+key exchange. Possible values are
-+.Bd -literal -offset 3n
-+gss-gex-sha1-,
-+gss-group1-sha1-,
-+gss-group14-sha1-,
-+gss-group14-sha256-,
-+gss-group16-sha512-,
-+gss-nistp256-sha256-,
-+gss-curve25519-sha256-
-+.Ed
-+.Pp
-+The default is
-+.Dq gss-gex-sha1-,gss-group14-sha1- .
-+This option only applies to protocol version 2 connections using GSSAPI.
- .It Cm HostbasedAcceptedKeyTypes
- Specifies the key types that will be accepted for hostbased authentication
- as a list of comma-separated patterns.
-diff --git a/sshkey.c b/sshkey.c
-index 57995ee6..fd5b7724 100644
---- a/sshkey.c
-+++ b/sshkey.c
-@@ -154,6 +154,7 @@ static const struct keytype keytypes[] = {
- 	    KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 },
- # endif /* OPENSSL_HAS_ECC */
- #endif /* WITH_OPENSSL */
-+	{ "null", "null", NULL, KEY_NULL, 0, 0, 0 },
- 	{ NULL, NULL, NULL, -1, -1, 0, 0 }
- };
- 
-@@ -255,7 +256,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
- 	const struct keytype *kt;
- 
- 	for (kt = keytypes; kt->type != -1; kt++) {
--		if (kt->name == NULL)
-+		if (kt->name == NULL || kt->type == KEY_NULL)
- 			continue;
- 		if (!include_sigonly && kt->sigonly)
- 			continue;
-diff --git a/sshkey.h b/sshkey.h
-index 71a3fddc..37a43a67 100644
---- a/sshkey.h
-+++ b/sshkey.h
-@@ -69,6 +69,7 @@ enum sshkey_types {
- 	KEY_ECDSA_SK_CERT,
- 	KEY_ED25519_SK,
- 	KEY_ED25519_SK_CERT,
-+	KEY_NULL,
- 	KEY_UNSPEC
- };
-