[csw-devel] SF.net SVN: gar:[15689] csw/mgar/pkg/openssh/trunk

chninkel at users.sourceforge.net chninkel at users.sourceforge.net
Tue Sep 20 21:17:16 CEST 2011


Revision: 15689
          http://gar.svn.sourceforge.net/gar/?rev=15689&view=rev
Author:   chninkel
Date:     2011-09-20 19:17:16 +0000 (Tue, 20 Sep 2011)
Log Message:
-----------
openssh: updated gsskex patch

Modified Paths:
--------------
    csw/mgar/pkg/openssh/trunk/Makefile

Added Paths:
-----------
    csw/mgar/pkg/openssh/trunk/files/openssh-5.9p1-gsskex-all-20110920.patch

Removed Paths:
-------------
    csw/mgar/pkg/openssh/trunk/files/openssh-5.8p1-gsskex-all-20110125.patch

Modified: csw/mgar/pkg/openssh/trunk/Makefile
===================================================================
--- csw/mgar/pkg/openssh/trunk/Makefile	2011-09-20 18:53:22 UTC (rev 15688)
+++ csw/mgar/pkg/openssh/trunk/Makefile	2011-09-20 19:17:16 UTC (rev 15689)
@@ -14,8 +14,8 @@
 
 NAME = openssh
 VERSION = 5.9p1
-GSSKEX_PATCH_VERSION = 5.8p1
-GSSKEX_PATCH_DATE = 20110125
+GSSKEX_PATCH_VERSION = 5.9p1
+GSSKEX_PATCH_DATE = 20110920
 CATEGORIES = server
 
 DESCRIPTION = OpenSSH Secure Shell

Deleted: csw/mgar/pkg/openssh/trunk/files/openssh-5.8p1-gsskex-all-20110125.patch
===================================================================
--- csw/mgar/pkg/openssh/trunk/files/openssh-5.8p1-gsskex-all-20110125.patch	2011-09-20 18:53:22 UTC (rev 15688)
+++ csw/mgar/pkg/openssh/trunk/files/openssh-5.8p1-gsskex-all-20110125.patch	2011-09-20 19:17:16 UTC (rev 15689)
@@ -1,3469 +0,0 @@
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ChangeLog.gssapi openssh-5.8p1.new/ChangeLog.gssapi
---- openssh-5.8p1/ChangeLog.gssapi	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/ChangeLog.gssapi	2011-02-12 18:07:10.948345760 +0100
-@@ -0,0 +1,113 @@
-+20110101
-+  - Finally update for OpenSSH 5.6p1
-+  - Add GSSAPIServerIdentity option from Jim Basney
-+ 
-+20100308
-+  - [ Makefile.in, key.c, key.h ]
-+    Updates for OpenSSH 5.4p1
-+  - [ servconf.c ]
-+    Include GSSAPI options in the sshd -T configuration dump, and flag
-+    some older configuration options as being unsupported. Thanks to Colin 
-+    Watson.
-+  -
-+
-+20100124
-+  - [ sshconnect2.c ]
-+    Adapt to deal with additional element in Authmethod structure. Thanks to
-+    Colin Watson
-+
-+20090615
-+  - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c
-+      sshd.c ]
-+    Fix issues identified by Greg Hudson following a code review
-+	Check return value of gss_indicate_mechs
-+	Protect GSSAPI calls in monitor, so they can only be used if enabled
-+	Check return values of bignum functions in key exchange
-+	Use BN_clear_free to clear other side's DH value
-+	Make ssh_gssapi_id_kex more robust
-+	Only configure kex table pointers if GSSAPI is enabled
-+	Don't leak mechanism list, or gss mechanism list
-+	Cast data.length before printing
-+	If serverkey isn't provided, use an empty string, rather than NULL
-+
-+20090201
-+  - [ gss-genr.c gss-serv.c kex.h kexgssc.c readconf.c readconf.h ssh-gss.h
-+      ssh_config.5 sshconnet2.c ]
-+    Add support for the GSSAPIClientIdentity option, which allows the user
-+    to specify which GSSAPI identity to use to contact a given server
-+
-+20080404
-+  - [ gss-serv.c ]
-+    Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow
-+    been omitted from a previous version of this patch. Reported by Borislav
-+    Stoichkov
-+
-+20070317
-+  - [ gss-serv-krb5.c ]
-+    Remove C99ism, where new_ccname was being declared in the middle of a 
-+    function
-+
-+20061220
-+  - [ servconf.c ]
-+    Make default for GSSAPIStrictAcceptorCheck be Yes, to match previous, and 
-+    documented, behaviour. Reported by Dan Watson.
-+
-+20060910
-+  - [ gss-genr.c kexgssc.c kexgsss.c kex.h monitor.c sshconnect2.c sshd.c
-+      ssh-gss.h ]
-+    add support for gss-group14-sha1 key exchange mechanisms
-+  - [ gss-serv.c servconf.c servconf.h sshd_config sshd_config.5 ]
-+    Add GSSAPIStrictAcceptorCheck option to allow the disabling of
-+    acceptor principal checking on multi-homed machines.
-+    <Bugzilla #928>
-+  - [ sshd_config ssh_config ]
-+    Add settings for GSSAPIKeyExchange and GSSAPITrustDNS to the sample
-+    configuration files
-+  - [ kexgss.c kegsss.c sshconnect2.c sshd.c ]
-+    Code cleanup. Replace strlen/xmalloc/snprintf sequences with xasprintf()
-+    Limit length of error messages displayed by client
-+
-+20060909
-+  - [ gss-genr.c gss-serv.c ]
-+    move ssh_gssapi_acquire_cred() and ssh_gssapi_server_ctx to be server
-+    only, where they belong 
-+    <Bugzilla #1225>
-+
-+20060829
-+  - [ gss-serv-krb5.c ]
-+    Fix CCAPI credentials cache name when creating KRB5CCNAME environment 
-+    variable
-+
-+20060828
-+  - [ gss-genr.c ]
-+    Avoid Heimdal context freeing problem
-+    <Fixed upstream 20060829>
-+
-+20060818
-+  - [ gss-genr.c ssh-gss.h sshconnect2.c ]
-+    Make sure that SPENGO is disabled 
-+    <Bugzilla #1218 - Fixed upstream 20060818>
-+
-+20060421
-+  - [ gssgenr.c, sshconnect2.c ]
-+    a few type changes (signed versus unsigned, int versus size_t) to
-+    fix compiler errors/warnings 
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ kexgssc.c, sshconnect2.c ]
-+    fix uninitialized variable warnings
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ gssgenr.c ]
-+    pass oid to gss_display_status (helpful when using GSSAPI mechglue)
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <Bugzilla #1220 >
-+  - [ gss-serv-krb5.c ]
-+    #ifdef HAVE_GSSAPI_KRB5 should be #ifdef HAVE_GSSAPI_KRB5_H
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <Fixed upstream 20060304>
-+  - [ readconf.c, readconf.h, ssh_config.5, sshconnect2.c 
-+    add client-side GssapiKeyExchange option
-+    (from jbasney AT ncsa.uiuc.edu)
-+  - [ sshconnect2.c ]
-+    add support for GssapiTrustDns option for gssapi-with-mic
-+    (from jbasney AT ncsa.uiuc.edu)
-+    <gssapi-with-mic support is Bugzilla #1008>
-diff --speed-large-files --minimal -Nru openssh-5.8p1/Makefile.in openssh-5.8p1.new/Makefile.in
---- openssh-5.8p1/Makefile.in	2011-02-04 01:42:13.000000000 +0100
-+++ openssh-5.8p1.new/Makefile.in	2011-02-12 18:07:10.990611445 +0100
-@@ -75,6 +75,7 @@
- 	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
- 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
- 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
-+	kexgssc.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
- 	schnorr.o ssh-pkcs11.o
- 
-@@ -91,7 +92,7 @@
- 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
- 	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
- 	auth-krb5.o \
--	auth2-gss.o gss-serv.o gss-serv-krb5.o \
-+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o\
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
- 	sftp-server.o sftp-common.o \
- 	roaming_common.o roaming_serv.o
-diff --speed-large-files --minimal -Nru openssh-5.8p1/Makefile.in.orig openssh-5.8p1.new/Makefile.in.orig
---- openssh-5.8p1/Makefile.in.orig	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/Makefile.in.orig	2011-02-04 01:42:13.000000000 +0100
-@@ -0,0 +1,469 @@
-+# $Id: Makefile.in,v 1.320.4.1 2011/02/04 00:42:13 djm Exp $
-+
-+# uncomment if you run a non bourne compatable shell. Ie. csh
-+#SHELL = @SH@
-+
-+AUTORECONF=autoreconf
-+
-+prefix=@prefix@
-+exec_prefix=@exec_prefix@
-+bindir=@bindir@
-+sbindir=@sbindir@
-+libexecdir=@libexecdir@
-+datadir=@datadir@
-+datarootdir=@datarootdir@
-+mandir=@mandir@
-+mansubdir=@mansubdir@
-+sysconfdir=@sysconfdir@
-+piddir=@piddir@
-+srcdir=@srcdir@
-+top_srcdir=@top_srcdir@
-+
-+DESTDIR=
-+VPATH=@srcdir@
-+SSH_PROGRAM=@bindir@/ssh
-+ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
-+SFTP_SERVER=$(libexecdir)/sftp-server
-+SSH_KEYSIGN=$(libexecdir)/ssh-keysign
-+SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
-+RAND_HELPER=$(libexecdir)/ssh-rand-helper
-+PRIVSEP_PATH=@PRIVSEP_PATH@
-+SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-+STRIP_OPT=@STRIP_OPT@
-+
-+PATHS= -DSSHDIR=\"$(sysconfdir)\" \
-+	-D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \
-+	-D_PATH_SSH_ASKPASS_DEFAULT=\"$(ASKPASS_PROGRAM)\" \
-+	-D_PATH_SFTP_SERVER=\"$(SFTP_SERVER)\" \
-+	-D_PATH_SSH_KEY_SIGN=\"$(SSH_KEYSIGN)\" \
-+	-D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \
-+	-D_PATH_SSH_PIDDIR=\"$(piddir)\" \
-+	-D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \
-+	-DSSH_RAND_HELPER=\"$(RAND_HELPER)\"
-+
-+CC=@CC@
-+LD=@LD@
-+CFLAGS=@CFLAGS@
-+CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
-+LIBS=@LIBS@
-+SSHLIBS=@SSHLIBS@
-+SSHDLIBS=@SSHDLIBS@
-+LIBEDIT=@LIBEDIT@
-+AR=@AR@
-+AWK=@AWK@
-+RANLIB=@RANLIB@
-+INSTALL=@INSTALL@
-+PERL=@PERL@
-+SED=@SED@
-+ENT=@ENT@
-+XAUTH_PATH=@XAUTH_PATH@
-+LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
-+EXEEXT=@EXEEXT@
-+MANFMT=@MANFMT@
-+
-+INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
-+INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
-+
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
-+
-+LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
-+	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-+	cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
-+	compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
-+	log.o match.o md-sha256.o moduli.o nchan.o packet.o \
-+	readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
-+	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
-+	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
-+	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
-+	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
-+	schnorr.o ssh-pkcs11.o
-+
-+SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-+	sshconnect.o sshconnect1.o sshconnect2.o mux.o \
-+	roaming_common.o roaming_client.o
-+
-+SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
-+	audit.o audit-bsm.o audit-linux.o platform.o \
-+	sshpty.o sshlogin.o servconf.o serverloop.o \
-+	auth.o auth1.o auth2.o auth-options.o session.o \
-+	auth-chall.o auth2-chall.o groupaccess.o \
-+	auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
-+	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
-+	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
-+	auth-krb5.o \
-+	auth2-gss.o gss-serv.o gss-serv-krb5.o \
-+	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
-+	sftp-server.o sftp-common.o \
-+	roaming_common.o roaming_serv.o
-+
-+MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
-+MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
-+MANTYPE		= @MANTYPE@
-+
-+CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-+CONFIGFILES_IN=sshd_config ssh_config moduli
-+
-+PATHSUBS	= \
-+	-e 's|/etc/ssh/ssh_prng_cmds|$(sysconfdir)/ssh_prng_cmds|g' \
-+	-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
-+	-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
-+	-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
-+	-e 's|/usr/libexec|$(libexecdir)|g' \
-+	-e 's|/etc/shosts.equiv|$(sysconfdir)/shosts.equiv|g' \
-+	-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
-+	-e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \
-+	-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
-+	-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
-+	-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
-+	-e 's|/etc/moduli|$(sysconfdir)/moduli|g' \
-+	-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \
-+	-e 's|/etc/ssh/sshrc|$(sysconfdir)/sshrc|g' \
-+	-e 's|/usr/X11R6/bin/xauth|$(XAUTH_PATH)|g' \
-+	-e 's|/var/empty|$(PRIVSEP_PATH)|g' \
-+	-e 's|/usr/bin:/bin:/usr/sbin:/sbin|@user_path@|g'
-+
-+FIXPATHSCMD	= $(SED) $(PATHSUBS)
-+
-+all: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS)
-+
-+$(LIBSSH_OBJS): Makefile.in config.h
-+$(SSHOBJS): Makefile.in config.h
-+$(SSHDOBJS): Makefile.in config.h
-+
-+.c.o:
-+	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-+
-+LIBCOMPAT=openbsd-compat/libopenbsd-compat.a
-+$(LIBCOMPAT): always
-+	(cd openbsd-compat && $(MAKE))
-+always:
-+
-+libssh.a: $(LIBSSH_OBJS)
-+	$(AR) rv $@ $(LIBSSH_OBJS)
-+	$(RANLIB) $@
-+
-+ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
-+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
-+
-+sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
-+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
-+
-+scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
-+	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
-+	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-agent.o ssh-pkcs11-client.o
-+	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o
-+	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readconf.o
-+	$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
-+	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-+
-+ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
-+	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
-+
-+sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
-+	$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
-+	$(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
-+
-+ssh-rand-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-rand-helper.o
-+	$(LD) -o $@ ssh-rand-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
-+# test driver for the loginrec code - not built by default
-+logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
-+	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-+
-+$(MANPAGES): $(MANPAGES_IN)
-+	if test "$(MANTYPE)" = "cat"; then \
-+		manpage=$(srcdir)/`echo $@ | sed 's/\.[1-9]\.out$$/\.0/'`; \
-+	else \
-+		manpage=$(srcdir)/`echo $@ | sed 's/\.out$$//'`; \
-+	fi; \
-+	if test "$(MANTYPE)" = "man"; then \
-+		$(FIXPATHSCMD) $${manpage} | $(AWK) -f $(srcdir)/mdoc2man.awk > $@; \
-+	else \
-+		$(FIXPATHSCMD) $${manpage} > $@; \
-+	fi
-+
-+$(CONFIGFILES): $(CONFIGFILES_IN)
-+	conffile=`echo $@ | sed 's/.out$$//'`; \
-+	$(FIXPATHSCMD) $(srcdir)/$${conffile} > $@
-+
-+ssh_prng_cmds.out:	ssh_prng_cmds
-+	if test ! -z "$(INSTALL_SSH_PRNG_CMDS)"; then \
-+		$(PERL) $(srcdir)/fixprogs ssh_prng_cmds $(ENT); \
-+	fi
-+
-+# fake rule to stop make trying to compile moduli.o into a binary "moduli.o"
-+moduli:
-+	echo
-+
-+clean:	regressclean
-+	rm -f *.o *.a $(TARGETS) logintest config.cache config.log
-+	rm -f *.out core survey
-+	(cd openbsd-compat && $(MAKE) clean)
-+
-+distclean:	regressclean
-+	rm -f *.o *.a $(TARGETS) logintest config.cache config.log
-+	rm -f *.out core opensshd.init openssh.xml
-+	rm -f Makefile buildpkg.sh config.h config.status ssh_prng_cmds
-+	rm -f survey.sh openbsd-compat/regress/Makefile *~ 
-+	rm -rf autom4te.cache
-+	(cd openbsd-compat && $(MAKE) distclean)
-+	if test -d pkg ; then \
-+		rm -fr pkg ; \
-+	fi
-+
-+veryclean: distclean
-+	rm -f configure config.h.in *.0
-+
-+mrproper: veryclean
-+
-+realclean: veryclean
-+
-+catman-do:
-+	@for f in $(MANPAGES_IN) ; do \
-+		base=`echo $$f | sed 's/\..*$$//'` ; \
-+		echo "$$f -> $$base.0" ; \
-+		$(MANFMT) $$f | cat -v | sed -e 's/.\^H//g' \
-+			>$$base.0 ; \
-+	done
-+
-+distprep: catman-do
-+	$(AUTORECONF)
-+	-rm -rf autom4te.cache
-+
-+install: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config
-+install-nokeys: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS) install-files install-sysconf
-+install-nosysconf: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS) install-files
-+
-+check-config:
-+	-$(DESTDIR)$(sbindir)/sshd -t -f $(DESTDIR)$(sysconfdir)/sshd_config
-+
-+install-files:
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(bindir)
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(sbindir)
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)1
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)5
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)8
-+	$(srcdir)/mkinstalldirs $(DESTDIR)$(libexecdir)
-+	(umask 022 ; $(srcdir)/mkinstalldirs $(DESTDIR)$(PRIVSEP_PATH))
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-add$(EXEEXT) $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent$(EXEEXT) $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
-+	if test ! -z "$(INSTALL_SSH_RAND_HELPER)" ; then \
-+		$(INSTALL) -m 0755 $(STRIP_OPT) ssh-rand-helper$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-rand-helper$(EXEEXT) ; \
-+	fi
-+	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-+	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-+	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-+	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-+	$(INSTALL) -m 644 ssh-agent.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-agent.1
-+	$(INSTALL) -m 644 ssh-keygen.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
-+	$(INSTALL) -m 644 ssh-keyscan.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
-+	$(INSTALL) -m 644 moduli.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/moduli.5
-+	$(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
-+	$(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
-+	$(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
-+	if [ ! -z "$(INSTALL_SSH_RAND_HELPER)" ]; then \
-+		$(INSTALL) -m 644 ssh-rand-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8 ; \
-+	fi
-+	$(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
-+	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-+	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-+	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
-+	-rm -f $(DESTDIR)$(bindir)/slogin
-+	ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-+	ln -s ./ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-+
-+install-sysconf:
-+	if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \
-+		$(srcdir)/mkinstalldirs $(DESTDIR)$(sysconfdir); \
-+	fi
-+	@if [ ! -f $(DESTDIR)$(sysconfdir)/ssh_config ]; then \
-+		$(INSTALL) -m 644 ssh_config.out $(DESTDIR)$(sysconfdir)/ssh_config; \
-+	else \
-+		echo "$(DESTDIR)$(sysconfdir)/ssh_config already exists, install will not overwrite"; \
-+	fi
-+	@if [ ! -f $(DESTDIR)$(sysconfdir)/sshd_config ]; then \
-+		$(INSTALL) -m 644 sshd_config.out $(DESTDIR)$(sysconfdir)/sshd_config; \
-+	else \
-+		echo "$(DESTDIR)$(sysconfdir)/sshd_config already exists, install will not overwrite"; \
-+	fi
-+	@if [ -f ssh_prng_cmds ] && [ ! -z "$(INSTALL_SSH_PRNG_CMDS)" ]; then \
-+		if [ ! -f $(DESTDIR)$(sysconfdir)/ssh_prng_cmds ] ; then \
-+			$(INSTALL) -m 644 ssh_prng_cmds.out $(DESTDIR)$(sysconfdir)/ssh_prng_cmds; \
-+		else \
-+			echo "$(DESTDIR)$(sysconfdir)/ssh_prng_cmds already exists, install will not overwrite"; \
-+		fi ; \
-+	fi
-+	@if [ ! -f $(DESTDIR)$(sysconfdir)/moduli ]; then \
-+		if [ -f $(DESTDIR)$(sysconfdir)/primes ]; then \
-+			echo "moving $(DESTDIR)$(sysconfdir)/primes to $(DESTDIR)$(sysconfdir)/moduli"; \
-+			mv "$(DESTDIR)$(sysconfdir)/primes" "$(DESTDIR)$(sysconfdir)/moduli"; \
-+		else \
-+			$(INSTALL) -m 644 moduli.out $(DESTDIR)$(sysconfdir)/moduli; \
-+		fi ; \
-+	else \
-+		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
-+	fi
-+
-+host-key: ssh-keygen$(EXEEXT)
-+	@if [ -z "$(DESTDIR)" ] ; then \
-+		if [ -f "$(sysconfdir)/ssh_host_key" ] ; then \
-+			echo "$(sysconfdir)/ssh_host_key already exists, skipping." ; \
-+		else \
-+			./ssh-keygen -t rsa1 -f $(sysconfdir)/ssh_host_key -N "" ; \
-+		fi ; \
-+		if [ -f $(sysconfdir)/ssh_host_dsa_key ] ; then \
-+			echo "$(sysconfdir)/ssh_host_dsa_key already exists, skipping." ; \
-+		else \
-+			./ssh-keygen -t dsa -f $(sysconfdir)/ssh_host_dsa_key -N "" ; \
-+		fi ; \
-+		if [ -f $(sysconfdir)/ssh_host_rsa_key ] ; then \
-+			echo "$(sysconfdir)/ssh_host_rsa_key already exists, skipping." ; \
-+		else \
-+			./ssh-keygen -t rsa -f $(sysconfdir)/ssh_host_rsa_key -N "" ; \
-+		fi ; \
-+		if [ -z "@COMMENT_OUT_ECC@" ] ; then \
-+		    if [ -f $(sysconfdir)/ssh_host_ecdsa_key ] ; then \
-+			echo "$(sysconfdir)/ssh_host_ecdsa_key already exists, skipping." ; \
-+		    else \
-+			./ssh-keygen -t ecdsa -f $(sysconfdir)/ssh_host_ecdsa_key -N "" ; \
-+		    fi ; \
-+		fi ; \
-+	fi ;
-+
-+host-key-force: ssh-keygen$(EXEEXT)
-+	./ssh-keygen -t rsa1 -f $(DESTDIR)$(sysconfdir)/ssh_host_key -N ""
-+	./ssh-keygen -t dsa -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key -N ""
-+	./ssh-keygen -t rsa -f $(DESTDIR)$(sysconfdir)/ssh_host_rsa_key -N ""
-+	test -z "@COMMENT_OUT_ECC@" && ./ssh-keygen -t ecdsa -f $(DESTDIR)$(sysconfdir)/ssh_host_ecdsa_key -N ""
-+
-+uninstallall:	uninstall
-+	-rm -f $(DESTDIR)$(sysconfdir)/ssh_config
-+	-rm -f $(DESTDIR)$(sysconfdir)/sshd_config
-+	-rm -f $(DESTDIR)$(sysconfdir)/ssh_prng_cmds
-+	-rmdir $(DESTDIR)$(sysconfdir)
-+	-rmdir $(DESTDIR)$(bindir)
-+	-rmdir $(DESTDIR)$(sbindir)
-+	-rmdir $(DESTDIR)$(mandir)/$(mansubdir)1
-+	-rmdir $(DESTDIR)$(mandir)/$(mansubdir)8
-+	-rmdir $(DESTDIR)$(mandir)
-+	-rmdir $(DESTDIR)$(libexecdir)
-+
-+uninstall:
-+	-rm -f $(DESTDIR)$(bindir)/slogin
-+	-rm -f $(DESTDIR)$(bindir)/ssh$(EXEEXT)
-+	-rm -f $(DESTDIR)$(bindir)/scp$(EXEEXT)
-+	-rm -f $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
-+	-rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
-+	-rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
-+	-rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
-+	-rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
-+	-rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
-+	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-+	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-+	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
-+	-rm -f $(DESTDIR)$(RAND_HELPER)$(EXEEXT)
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-agent.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
-+	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-+
-+tests interop-tests:	$(TARGETS)
-+	BUILDDIR=`pwd`; \
-+	[ -d `pwd`/regress ]  ||  mkdir -p `pwd`/regress; \
-+	[ -f `pwd`/regress/Makefile ]  || \
-+	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile ; \
-+	TEST_SHELL="@TEST_SHELL@"; \
-+	TEST_SSH_SSH="$${BUILDDIR}/ssh"; \
-+	TEST_SSH_SSHD="$${BUILDDIR}/sshd"; \
-+	TEST_SSH_SSHAGENT="$${BUILDDIR}/ssh-agent"; \
-+	TEST_SSH_SSHADD="$${BUILDDIR}/ssh-add"; \
-+	TEST_SSH_SSHKEYGEN="$${BUILDDIR}/ssh-keygen"; \
-+	TEST_SSH_SSHPKCS11HELPER="$${BUILDDIR}/ssh-pkcs11-helper"; \
-+	TEST_SSH_SSHKEYSCAN="$${BUILDDIR}/ssh-keyscan"; \
-+	TEST_SSH_SFTP="$${BUILDDIR}/sftp"; \
-+	TEST_SSH_SFTPSERVER="$${BUILDDIR}/sftp-server"; \
-+	TEST_SSH_PLINK="plink"; \
-+	TEST_SSH_PUTTYGEN="puttygen"; \
-+	TEST_SSH_CONCH="conch"; \
-+	TEST_SSH_IPV6="@TEST_SSH_IPV6@" ; \
-+	TEST_SSH_ECC="@TEST_SSH_ECC@" ; \
-+	TEST_SSH_SHA256="@TEST_SSH_SHA256@" ; \
-+	cd $(srcdir)/regress || exit $$?; \
-+	$(MAKE) \
-+		.OBJDIR="$${BUILDDIR}/regress" \
-+		.CURDIR="`pwd`" \
-+		BUILDDIR="$${BUILDDIR}" \
-+		OBJ="$${BUILDDIR}/regress/" \
-+		PATH="$${BUILDDIR}:$${PATH}" \
-+		TEST_SHELL="$${TEST_SHELL}" \
-+		TEST_SSH_SSH="$${TEST_SSH_SSH}" \
-+		TEST_SSH_SSHD="$${TEST_SSH_SSHD}" \
-+		TEST_SSH_SSHAGENT="$${TEST_SSH_SSHAGENT}" \
-+		TEST_SSH_SSHADD="$${TEST_SSH_SSHADD}" \
-+		TEST_SSH_SSHKEYGEN="$${TEST_SSH_SSHKEYGEN}" \
-+		TEST_SSH_SSHPKCS11HELPER="$${TEST_SSH_SSHPKCS11HELPER}" \
-+		TEST_SSH_SSHKEYSCAN="$${TEST_SSH_SSHKEYSCAN}" \
-+		TEST_SSH_SFTP="$${TEST_SSH_SFTP}" \
-+		TEST_SSH_SFTPSERVER="$${TEST_SSH_SFTPSERVER}" \
-+		TEST_SSH_PLINK="$${TEST_SSH_PLINK}" \
-+		TEST_SSH_PUTTYGEN="$${TEST_SSH_PUTTYGEN}" \
-+		TEST_SSH_CONCH="$${TEST_SSH_CONCH}" \
-+		TEST_SSH_IPV6="$${TEST_SSH_IPV6}" \
-+		TEST_SSH_ECC="$${TEST_SSH_ECC}" \
-+		TEST_SSH_SHA256="$${TEST_SSH_SHA256}" \
-+		EXEEXT="$(EXEEXT)" \
-+		$@ && echo all tests passed
-+
-+compat-tests: $(LIBCOMPAT)
-+	(cd openbsd-compat/regress && $(MAKE))
-+
-+regressclean:
-+	if [ -f regress/Makefile ] && [ -r regress/Makefile ]; then \
-+		(cd regress && $(MAKE) clean) \
-+	fi
-+
-+survey: survey.sh ssh
-+	@$(SHELL) ./survey.sh > survey
-+	@echo 'The survey results have been placed in the file "survey" in the'
-+	@echo 'current directory.  Please review the file then send with'
-+	@echo '"make send-survey".'
-+
-+send-survey:	survey
-+	mail portable-survey at mindrot.org <survey
-+
-+package: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS)
-+	if [ "@MAKE_PACKAGE_SUPPORTED@" = yes ]; then \
-+		sh buildpkg.sh; \
-+	fi
-+
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth-krb5.c openssh-5.8p1.new/auth-krb5.c
---- openssh-5.8p1/auth-krb5.c	2009-12-21 00:49:22.000000000 +0100
-+++ openssh-5.8p1.new/auth-krb5.c	2011-02-12 18:07:11.002529804 +0100
-@@ -170,8 +170,13 @@
- 
- 	len = strlen(authctxt->krb5_ticket_file) + 6;
- 	authctxt->krb5_ccname = xmalloc(len);
-+#ifdef USE_CCAPI
-+	snprintf(authctxt->krb5_ccname, len, "API:%s",
-+	    authctxt->krb5_ticket_file);
-+#else
- 	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
- 	    authctxt->krb5_ticket_file);
-+#endif
- 
- #ifdef USE_PAM
- 	if (options.use_pam)
-@@ -226,15 +231,22 @@
- #ifndef HEIMDAL
- krb5_error_code
- ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
--	int tmpfd, ret;
-+	int ret;
- 	char ccname[40];
- 	mode_t old_umask;
-+#ifdef USE_CCAPI
-+	char cctemplate[] = "API:krb5cc_%d";
-+#else
-+	char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";
-+	int tmpfd;
-+#endif
- 
- 	ret = snprintf(ccname, sizeof(ccname),
--	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
-+	    cctemplate, geteuid());
- 	if (ret < 0 || (size_t)ret >= sizeof(ccname))
- 		return ENOMEM;
- 
-+#ifndef USE_CCAPI
- 	old_umask = umask(0177);
- 	tmpfd = mkstemp(ccname + strlen("FILE:"));
- 	umask(old_umask);
-@@ -249,6 +261,7 @@
- 		return errno;
- 	}
- 	close(tmpfd);
-+#endif
- 
- 	return (krb5_cc_resolve(ctx, ccname, ccache));
- }
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth.h openssh-5.8p1.new/auth.h
---- openssh-5.8p1/auth.h	2010-05-10 03:58:03.000000000 +0200
-+++ openssh-5.8p1.new/auth.h	2011-02-12 18:07:11.017509607 +0100
-@@ -53,6 +53,7 @@
- 	int		 valid;		/* user exists and is allowed to login */
- 	int		 attempt;
- 	int		 failures;
-+	int		 server_caused_failure; 
- 	int		 force_pwchange;
- 	char		*user;		/* username sent by the client */
- 	char		*service;
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth2-gss.c openssh-5.8p1.new/auth2-gss.c
---- openssh-5.8p1/auth2-gss.c	2007-12-02 12:59:45.000000000 +0100
-+++ openssh-5.8p1.new/auth2-gss.c	2011-02-12 18:07:11.030761708 +0100
-@@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -52,6 +52,40 @@
- static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
- static void input_gssapi_errtok(int, u_int32_t, void *);
- 
-+/* 
-+ * The 'gssapi_keyex' userauth mechanism.
-+ */
-+static int
-+userauth_gsskeyex(Authctxt *authctxt)
-+{
-+	int authenticated = 0;
-+	Buffer b;
-+	gss_buffer_desc mic, gssbuf;
-+	u_int len;
-+
-+	mic.value = packet_get_string(&len);
-+	mic.length = len;
-+
-+	packet_check_eom();
-+
-+	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
-+	    "gssapi-keyex");
-+
-+	gssbuf.value = buffer_ptr(&b);
-+	gssbuf.length = buffer_len(&b);
-+
-+	/* gss_kex_context is NULL with privsep, so we can't check it here */
-+	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 
-+	    &gssbuf, &mic))))
-+		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+		    authctxt->pw));
-+	
-+	buffer_free(&b);
-+	xfree(mic.value);
-+
-+	return (authenticated);
-+}
-+
- /*
-  * We only support those mechanisms that we know about (ie ones that we know
-  * how to check local user kuserok and the like)
-@@ -102,6 +136,7 @@
- 
- 	if (!present) {
- 		xfree(doid);
-+		authctxt->server_caused_failure = 1;
- 		return (0);
- 	}
- 
-@@ -109,6 +144,7 @@
- 		if (ctxt != NULL)
- 			ssh_gssapi_delete_ctx(&ctxt);
- 		xfree(doid);
-+		authctxt->server_caused_failure = 1;
- 		return (0);
- 	}
- 
-@@ -242,7 +278,8 @@
- 
- 	packet_check_eom();
- 
--	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+	    authctxt->pw));
- 
- 	authctxt->postponed = 0;
- 	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
-@@ -277,7 +314,8 @@
- 	gssbuf.length = buffer_len(&b);
- 
- 	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
--		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+		authenticated = 
-+		    PRIVSEP(ssh_gssapi_userok(authctxt->user, authctxt->pw));
- 	else
- 		logit("GSSAPI MIC check failed");
- 
-@@ -292,6 +330,12 @@
- 	userauth_finish(authctxt, authenticated, "gssapi-with-mic");
- }
- 
-+Authmethod method_gsskeyex = {
-+	"gssapi-keyex",
-+	userauth_gsskeyex,
-+	&options.gss_authentication
-+};
-+
- Authmethod method_gssapi = {
- 	"gssapi-with-mic",
- 	userauth_gssapi,
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth2.c openssh-5.8p1.new/auth2.c
---- openssh-5.8p1/auth2.c	2010-08-31 14:36:39.000000000 +0200
-+++ openssh-5.8p1.new/auth2.c	2011-02-12 18:07:11.043418162 +0100
-@@ -69,6 +69,7 @@
- extern Authmethod method_kbdint;
- extern Authmethod method_hostbased;
- #ifdef GSSAPI
-+extern Authmethod method_gsskeyex;
- extern Authmethod method_gssapi;
- #endif
- #ifdef JPAKE
-@@ -79,6 +80,7 @@
- 	&method_none,
- 	&method_pubkey,
- #ifdef GSSAPI
-+	&method_gsskeyex,
- 	&method_gssapi,
- #endif
- #ifdef JPAKE
-@@ -274,6 +276,7 @@
- #endif
- 
- 	authctxt->postponed = 0;
-+	authctxt->server_caused_failure = 0;
- 
- 	/* try to authenticate user */
- 	m = authmethod_lookup(method);
-@@ -346,7 +349,8 @@
- 	} else {
- 
- 		/* Allow initial try of "none" auth without failure penalty */
--		if (authctxt->attempt > 1 || strcmp(method, "none") != 0)
-+		if (!authctxt->server_caused_failure &&
-+		    (authctxt->attempt > 1 || strcmp(method, "none") != 0))
- 			authctxt->failures++;
- 		if (authctxt->failures >= options.max_authtries) {
- #ifdef SSH_AUDIT_EVENTS
-diff --speed-large-files --minimal -Nru openssh-5.8p1/clientloop.c openssh-5.8p1.new/clientloop.c
---- openssh-5.8p1/clientloop.c	2011-01-16 13:18:35.000000000 +0100
-+++ openssh-5.8p1.new/clientloop.c	2011-02-12 18:07:11.063578136 +0100
-@@ -111,6 +111,10 @@
- #include "msg.h"
- #include "roaming.h"
- 
-+#ifdef GSSAPI
-+#include "ssh-gss.h"
-+#endif
-+
- /* import options */
- extern Options options;
- 
-@@ -1483,6 +1487,15 @@
- 		/* Do channel operations unless rekeying in progress. */
- 		if (!rekeying) {
- 			channel_after_select(readset, writeset);
-+
-+#ifdef GSSAPI
-+			if (options.gss_renewal_rekey &&
-+			    ssh_gssapi_credentials_updated(GSS_C_NO_CONTEXT)) {
-+				debug("credentials updated - forcing rekey");
-+				need_rekeying = 1;
-+			}
-+#endif
-+
- 			if (need_rekeying || packet_need_rekeying()) {
- 				debug("need rekeying");
- 				xxx_kex->done = 0;
-diff --speed-large-files --minimal -Nru openssh-5.8p1/configure.ac openssh-5.8p1.new/configure.ac
---- openssh-5.8p1/configure.ac	2011-02-04 01:42:14.000000000 +0100
-+++ openssh-5.8p1.new/configure.ac	2011-02-12 18:07:11.092748915 +0100
-@@ -514,6 +514,30 @@
- 	    [Use tunnel device compatibility to OpenBSD])
- 	AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
- 	    [Prepend the address family to IP tunnel traffic])
-+	AC_MSG_CHECKING(if we have the Security Authorization Session API)
-+	AC_TRY_COMPILE([#include <Security/AuthSession.h>],
-+		[SessionCreate(0, 0);],
-+		[ac_cv_use_security_session_api="yes"
-+		 AC_DEFINE(USE_SECURITY_SESSION_API, 1, 
-+			[platform has the Security Authorization Session API])
-+		 LIBS="$LIBS -framework Security"
-+		 AC_MSG_RESULT(yes)],
-+		[ac_cv_use_security_session_api="no"
-+		 AC_MSG_RESULT(no)])
-+	AC_MSG_CHECKING(if we have an in-memory credentials cache)
-+	AC_TRY_COMPILE(
-+		[#include <Kerberos/Kerberos.h>],
-+		[cc_context_t c;
-+		 (void) cc_initialize (&c, 0, NULL, NULL);],
-+		[AC_DEFINE(USE_CCAPI, 1, 
-+			[platform uses an in-memory credentials cache])
-+		 LIBS="$LIBS -framework Security"
-+		 AC_MSG_RESULT(yes)
-+		 if test "x$ac_cv_use_security_session_api" = "xno"; then
-+			AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
-+		fi],
-+		[AC_MSG_RESULT(no)]
-+	)
- 	m4_pattern_allow(AU_IPv)
- 	AC_CHECK_DECL(AU_IPv4, [], 
- 	    AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
-diff --speed-large-files --minimal -Nru openssh-5.8p1/gss-genr.c openssh-5.8p1.new/gss-genr.c
---- openssh-5.8p1/gss-genr.c	2009-06-22 08:11:07.000000000 +0200
-+++ openssh-5.8p1.new/gss-genr.c	2011-02-12 18:07:11.108432434 +0100
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
- 
- /*
-- * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -39,12 +39,167 @@
- #include "buffer.h"
- #include "log.h"
- #include "ssh2.h"
-+#include "cipher.h"
-+#include "key.h"
-+#include "kex.h"
-+#include <openssl/evp.h>
- 
- #include "ssh-gss.h"
- 
- extern u_char *session_id2;
- extern u_int session_id2_len;
- 
-+typedef struct {
-+	char *encoded;
-+	gss_OID oid;
-+} ssh_gss_kex_mapping;
-+
-+/*
-+ * XXX - It would be nice to find a more elegant way of handling the
-+ * XXX   passing of the key exchange context to the userauth routines
-+ */
-+
-+Gssctxt *gss_kex_context = NULL;
-+
-+static ssh_gss_kex_mapping *gss_enc2oid = NULL;
-+
-+int 
-+ssh_gssapi_oid_table_ok() {
-+	return (gss_enc2oid != NULL);
-+}
-+
-+/*
-+ * Return a list of the gss-group1-sha1 mechanisms supported by this program
-+ *
-+ * We test mechanisms to ensure that we can use them, to avoid starting
-+ * a key exchange with a bad mechanism
-+ */
-+
-+char *
-+ssh_gssapi_client_mechanisms(const char *host, const char *client) {
-+	gss_OID_set gss_supported;
-+	OM_uint32 min_status;
-+
-+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))
-+		return NULL;
-+
-+	return(ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,
-+	    host, client));
-+}
-+
-+char *
-+ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
-+    const char *host, const char *client) {
-+	Buffer buf;
-+	size_t i;
-+	int oidpos, enclen;
-+	char *mechs, *encoded;
-+	u_char digest[EVP_MAX_MD_SIZE];
-+	char deroid[2];
-+	const EVP_MD *evp_md = EVP_md5();
-+	EVP_MD_CTX md;
-+
-+	if (gss_enc2oid != NULL) {
-+		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)
-+			xfree(gss_enc2oid[i].encoded);
-+		xfree(gss_enc2oid);
-+	}
-+
-+	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *
-+	    (gss_supported->count + 1));
-+
-+	buffer_init(&buf);
-+
-+	oidpos = 0;
-+	for (i = 0; i < gss_supported->count; i++) {
-+		if (gss_supported->elements[i].length < 128 &&
-+		    (*check)(NULL, &(gss_supported->elements[i]), host, client)) {
-+
-+			deroid[0] = SSH_GSS_OIDTYPE;
-+			deroid[1] = gss_supported->elements[i].length;
-+
-+			EVP_DigestInit(&md, evp_md);
-+			EVP_DigestUpdate(&md, deroid, 2);
-+			EVP_DigestUpdate(&md,
-+			    gss_supported->elements[i].elements,
-+			    gss_supported->elements[i].length);
-+			EVP_DigestFinal(&md, digest, NULL);
-+
-+			encoded = xmalloc(EVP_MD_size(evp_md) * 2);
-+			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),
-+			    encoded, EVP_MD_size(evp_md) * 2);
-+
-+			if (oidpos != 0)
-+				buffer_put_char(&buf, ',');
-+
-+			buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,
-+			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1);
-+			buffer_append(&buf, encoded, enclen);
-+			buffer_put_char(&buf, ',');
-+			buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 
-+			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1);
-+			buffer_append(&buf, encoded, enclen);
-+			buffer_put_char(&buf, ',');
-+			buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID,
-+			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1);
-+			buffer_append(&buf, encoded, enclen);
-+
-+			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
-+			gss_enc2oid[oidpos].encoded = encoded;
-+			oidpos++;
-+		}
-+	}
-+	gss_enc2oid[oidpos].oid = NULL;
-+	gss_enc2oid[oidpos].encoded = NULL;
-+
-+	buffer_put_char(&buf, '\0');
-+
-+	mechs = xmalloc(buffer_len(&buf));
-+	buffer_get(&buf, mechs, buffer_len(&buf));
-+	buffer_free(&buf);
-+
-+	if (strlen(mechs) == 0) {
-+		xfree(mechs);
-+		mechs = NULL;
-+	}
-+	
-+	return (mechs);
-+}
-+
-+gss_OID
-+ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
-+	int i = 0;
-+	
-+	switch (kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+		if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))
-+			return GSS_C_NO_OID;
-+		name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;
-+		break;
-+	case KEX_GSS_GRP14_SHA1:
-+		if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))
-+			return GSS_C_NO_OID;
-+		name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;
-+		break;
-+	case KEX_GSS_GEX_SHA1:
-+		if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))
-+			return GSS_C_NO_OID;
-+		name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;
-+		break;
-+	default:
-+		return GSS_C_NO_OID;
-+	}
-+
-+	while (gss_enc2oid[i].encoded != NULL &&
-+	    strcmp(name, gss_enc2oid[i].encoded) != 0)
-+		i++;
-+
-+	if (gss_enc2oid[i].oid != NULL && ctx != NULL)
-+		ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);
-+
-+	return gss_enc2oid[i].oid;
-+}
-+
- /* Check that the OID in a data stream matches that in the context */
- int
- ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -197,7 +352,7 @@
- 	}
- 
- 	ctx->major = gss_init_sec_context(&ctx->minor,
--	    GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid,
-+	    ctx->client_creds, &ctx->context, ctx->name, ctx->oid,
- 	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
- 	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);
- 
-@@ -227,8 +382,42 @@
- }
- 
- OM_uint32
-+ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)
-+{
-+	gss_buffer_desc gssbuf;
-+	gss_name_t gssname;
-+	OM_uint32 status;
-+	gss_OID_set oidset;
-+
-+	gssbuf.value = (void *) name;
-+	gssbuf.length = strlen(gssbuf.value);
-+
-+	gss_create_empty_oid_set(&status, &oidset);
-+	gss_add_oid_set_member(&status, ctx->oid, &oidset);
-+
-+	ctx->major = gss_import_name(&ctx->minor, &gssbuf,
-+	    GSS_C_NT_USER_NAME, &gssname);
-+
-+	if (!ctx->major)
-+		ctx->major = gss_acquire_cred(&ctx->minor, 
-+		    gssname, 0, oidset, GSS_C_INITIATE, 
-+		    &ctx->client_creds, NULL, NULL);
-+
-+	gss_release_name(&status, &gssname);
-+	gss_release_oid_set(&status, &oidset);
-+
-+	if (ctx->major)
-+		ssh_gssapi_error(ctx);
-+
-+	return(ctx->major);
-+}
-+
-+OM_uint32
- ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
- {
-+	if (ctx == NULL) 
-+		return -1;
-+
- 	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
- 	    GSS_C_QOP_DEFAULT, buffer, hash)))
- 		ssh_gssapi_error(ctx);
-@@ -236,6 +425,19 @@
- 	return (ctx->major);
- }
- 
-+/* Priviledged when used by server */
-+OM_uint32
-+ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
-+{
-+	if (ctx == NULL)
-+		return -1;
-+
-+	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
-+	    gssbuf, gssmic, NULL);
-+
-+	return (ctx->major);
-+}
-+
- void
- ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
-     const char *context)
-@@ -249,11 +451,16 @@
- }
- 
- int
--ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
-+ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host, 
-+    const char *client)
- {
- 	gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
- 	OM_uint32 major, minor;
- 	gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"};
-+	Gssctxt *intctx = NULL;
-+
-+	if (ctx == NULL)
-+		ctx = &intctx;
- 
- 	/* RFC 4462 says we MUST NOT do SPNEGO */
- 	if (oid->length == spnego_oid.length && 
-@@ -263,6 +470,10 @@
- 	ssh_gssapi_build_ctx(ctx);
- 	ssh_gssapi_set_oid(*ctx, oid);
- 	major = ssh_gssapi_import_name(*ctx, host);
-+
-+	if (!GSS_ERROR(major) && client)
-+		major = ssh_gssapi_client_identity(*ctx, client);
-+
- 	if (!GSS_ERROR(major)) {
- 		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
- 		    NULL);
-@@ -272,10 +483,67 @@
- 			    GSS_C_NO_BUFFER);
- 	}
- 
--	if (GSS_ERROR(major)) 
-+	if (GSS_ERROR(major) || intctx != NULL) 
- 		ssh_gssapi_delete_ctx(ctx);
- 
- 	return (!GSS_ERROR(major));
- }
- 
-+int
-+ssh_gssapi_credentials_updated(Gssctxt *ctxt) {
-+	static gss_name_t saved_name = GSS_C_NO_NAME;
-+	static OM_uint32 saved_lifetime = 0;
-+	static gss_OID saved_mech = GSS_C_NO_OID;
-+	static gss_name_t name;
-+	static OM_uint32 last_call = 0;
-+	OM_uint32 lifetime, now, major, minor;
-+	int equal;
-+	gss_cred_usage_t usage = GSS_C_INITIATE;
-+	
-+	now = time(NULL);
-+
-+	if (ctxt) {
-+		debug("Rekey has happened - updating saved versions");
-+
-+		if (saved_name != GSS_C_NO_NAME)
-+			gss_release_name(&minor, &saved_name);
-+
-+		major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,
-+		    &saved_name, &saved_lifetime, NULL, NULL);
-+
-+		if (!GSS_ERROR(major)) {
-+			saved_mech = ctxt->oid;
-+		        saved_lifetime+= now;
-+		} else {
-+			/* Handle the error */
-+		}
-+		return 0;
-+	}
-+
-+	if (now - last_call < 10)
-+		return 0;
-+
-+	last_call = now;
-+
-+	if (saved_mech == GSS_C_NO_OID)
-+		return 0;
-+	
-+	major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL, 
-+	    &name, &lifetime, NULL, NULL);
-+	if (major == GSS_S_CREDENTIALS_EXPIRED)
-+		return 0;
-+	else if (GSS_ERROR(major))
-+		return 0;
-+
-+	major = gss_compare_name(&minor, saved_name, name, &equal);
-+	gss_release_name(&minor, &name);
-+	if (GSS_ERROR(major))
-+		return 0;
-+
-+	if (equal && (saved_lifetime < lifetime + now - 10))
-+		return 1;
-+
-+	return 0;
-+}
-+
- #endif /* GSSAPI */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/gss-serv-krb5.c openssh-5.8p1.new/gss-serv-krb5.c
---- openssh-5.8p1/gss-serv-krb5.c	2006-09-01 07:38:36.000000000 +0200
-+++ openssh-5.8p1.new/gss-serv-krb5.c	2011-02-12 18:07:11.123072516 +0100
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -120,6 +120,7 @@
- 	krb5_principal princ;
- 	OM_uint32 maj_status, min_status;
- 	int len;
-+	const char *new_ccname;
- 
- 	if (client->creds == NULL) {
- 		debug("No credentials stored");
-@@ -168,11 +169,16 @@
- 		return;
- 	}
- 
--	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
-+	new_ccname = krb5_cc_get_name(krb_context, ccache);
-+
- 	client->store.envvar = "KRB5CCNAME";
--	len = strlen(client->store.filename) + 6;
--	client->store.envval = xmalloc(len);
--	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
-+#ifdef USE_CCAPI
-+	xasprintf(&client->store.envval, "API:%s", new_ccname);
-+	client->store.filename = NULL;
-+#else
-+	xasprintf(&client->store.envval, "FILE:%s", new_ccname);
-+	client->store.filename = xstrdup(new_ccname);
-+#endif
- 
- #ifdef USE_PAM
- 	if (options.use_pam)
-@@ -184,6 +190,71 @@
- 	return;
- }
- 
-+int
-+ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store, 
-+    ssh_gssapi_client *client)
-+{
-+	krb5_ccache ccache = NULL;
-+	krb5_principal principal = NULL;
-+	char *name = NULL;
-+	krb5_error_code problem;
-+	OM_uint32 maj_status, min_status;
-+
-+   	if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
-+                logit("krb5_cc_resolve(): %.100s",
-+                    krb5_get_err_text(krb_context, problem));
-+                return 0;
-+       	}
-+	
-+	/* Find out who the principal in this cache is */
-+	if ((problem = krb5_cc_get_principal(krb_context, ccache, 
-+	    &principal))) {
-+		logit("krb5_cc_get_principal(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	if ((problem = krb5_unparse_name(krb_context, principal, &name))) {
-+		logit("krb5_unparse_name(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+
-+	if (strcmp(name,client->exportedname.value)!=0) {
-+		debug("Name in local credentials cache differs. Not storing");
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		krb5_free_unparsed_name(krb_context, name);
-+		return 0;
-+	}
-+	krb5_free_unparsed_name(krb_context, name);
-+
-+	/* Name matches, so lets get on with it! */
-+
-+	if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) {
-+		logit("krb5_cc_initialize(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	krb5_free_principal(krb_context, principal);
-+
-+	if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds,
-+	    ccache))) {
-+		logit("gss_krb5_copy_ccache() failed. Sorry!");
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
- ssh_gssapi_mech gssapi_kerberos_mech = {
- 	"toWM5Slw5Ew8Mqkay+al2g==",
- 	"Kerberos",
-@@ -191,7 +262,8 @@
- 	NULL,
- 	&ssh_gssapi_krb5_userok,
- 	NULL,
--	&ssh_gssapi_krb5_storecreds
-+	&ssh_gssapi_krb5_storecreds,
-+	&ssh_gssapi_krb5_updatecreds
- };
- 
- #endif /* KRB5 */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/gss-serv.c openssh-5.8p1.new/gss-serv.c
---- openssh-5.8p1/gss-serv.c	2008-05-19 07:05:07.000000000 +0200
-+++ openssh-5.8p1.new/gss-serv.c	2011-02-12 18:07:11.135178913 +0100
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -45,15 +45,20 @@
- #include "channels.h"
- #include "session.h"
- #include "misc.h"
-+#include "servconf.h"
-+#include "uidswap.h"
- 
- #include "ssh-gss.h"
-+#include "monitor_wrap.h"
-+
-+extern ServerOptions options;
- 
- static ssh_gssapi_client gssapi_client =
-     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
--    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}};
-+    GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,  NULL, {NULL, NULL, NULL}, 0, 0};
- 
- ssh_gssapi_mech gssapi_null_mech =
--    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};
-+    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
- 
- #ifdef KRB5
- extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -81,25 +86,32 @@
- 	char lname[MAXHOSTNAMELEN];
- 	gss_OID_set oidset;
- 
--	gss_create_empty_oid_set(&status, &oidset);
--	gss_add_oid_set_member(&status, ctx->oid, &oidset);
-+	if (options.gss_strict_acceptor) {
-+		gss_create_empty_oid_set(&status, &oidset);
-+		gss_add_oid_set_member(&status, ctx->oid, &oidset);
- 
--	if (gethostname(lname, MAXHOSTNAMELEN)) {
--		gss_release_oid_set(&status, &oidset);
--		return (-1);
--	}
-+		if (gethostname(lname, MAXHOSTNAMELEN)) {
-+			gss_release_oid_set(&status, &oidset);
-+			return (-1);
-+		}
-+
-+		if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
-+			gss_release_oid_set(&status, &oidset);
-+			return (ctx->major);
-+		}
-+
-+		if ((ctx->major = gss_acquire_cred(&ctx->minor,
-+		    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, 
-+		    NULL, NULL)))
-+			ssh_gssapi_error(ctx);
- 
--	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
- 		gss_release_oid_set(&status, &oidset);
- 		return (ctx->major);
-+	} else {
-+		ctx->name = GSS_C_NO_NAME;
-+		ctx->creds = GSS_C_NO_CREDENTIAL;
- 	}
--
--	if ((ctx->major = gss_acquire_cred(&ctx->minor,
--	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
--		ssh_gssapi_error(ctx);
--
--	gss_release_oid_set(&status, &oidset);
--	return (ctx->major);
-+	return GSS_S_COMPLETE;
- }
- 
- /* Privileged */
-@@ -114,6 +126,29 @@
- }
- 
- /* Unprivileged */
-+char *
-+ssh_gssapi_server_mechanisms() {
-+	gss_OID_set	supported;
-+
-+	ssh_gssapi_supported_oids(&supported);
-+	return (ssh_gssapi_kex_mechs(supported, &ssh_gssapi_server_check_mech,
-+	    NULL, NULL));
-+}
-+
-+/* Unprivileged */
-+int
-+ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data,
-+    const char *dummy) {
-+	Gssctxt *ctx = NULL;
-+	int res;
-+ 
-+	res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid)));
-+	ssh_gssapi_delete_ctx(&ctx);
-+
-+	return (res);
-+}
-+
-+/* Unprivileged */
- void
- ssh_gssapi_supported_oids(gss_OID_set *oidset)
- {
-@@ -123,7 +158,9 @@
- 	gss_OID_set supported;
- 
- 	gss_create_empty_oid_set(&min_status, oidset);
--	gss_indicate_mechs(&min_status, &supported);
-+
-+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported)))
-+		return;
- 
- 	while (supported_mechs[i]->name != NULL) {
- 		if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -247,8 +284,48 @@
- ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- {
- 	int i = 0;
-+	int equal = 0;
-+	gss_name_t new_name = GSS_C_NO_NAME;
-+	gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;
- 
--	gss_buffer_desc ename;
-+	if (options.gss_store_rekey && client->used && ctx->client_creds) {
-+		if (client->mech->oid.length != ctx->oid->length ||
-+		    (memcmp(client->mech->oid.elements,
-+		     ctx->oid->elements, ctx->oid->length) !=0)) {
-+			debug("Rekeyed credentials have different mechanism");
-+			return GSS_S_COMPLETE;
-+		}
-+
-+		if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, 
-+		    ctx->client_creds, ctx->oid, &new_name, 
-+		    NULL, NULL, NULL))) {
-+			ssh_gssapi_error(ctx);
-+			return (ctx->major);
-+		}
-+
-+		ctx->major = gss_compare_name(&ctx->minor, client->name, 
-+		    new_name, &equal);
-+
-+		if (GSS_ERROR(ctx->major)) {
-+			ssh_gssapi_error(ctx);
-+			return (ctx->major);
-+		}
-+ 
-+		if (!equal) {
-+			debug("Rekeyed credentials have different name");
-+			return GSS_S_COMPLETE;
-+		}
-+
-+		debug("Marking rekeyed credentials for export");
-+
-+		gss_release_name(&ctx->minor, &client->name);
-+		gss_release_cred(&ctx->minor, &client->creds);
-+		client->name = new_name;
-+		client->creds = ctx->client_creds;
-+        	ctx->client_creds = GSS_C_NO_CREDENTIAL;
-+		client->updated = 1;
-+		return GSS_S_COMPLETE;
-+	}
- 
- 	client->mech = NULL;
- 
-@@ -263,6 +340,13 @@
- 	if (client->mech == NULL)
- 		return GSS_S_FAILURE;
- 
-+	if (ctx->client_creds &&
-+	    (ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
-+	     ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) {
-+		ssh_gssapi_error(ctx);
-+		return (ctx->major);
-+	}
-+
- 	if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
- 	    &client->displayname, NULL))) {
- 		ssh_gssapi_error(ctx);
-@@ -280,6 +364,8 @@
- 		return (ctx->major);
- 	}
- 
-+	gss_release_buffer(&ctx->minor, &ename);
-+
- 	/* We can't copy this structure, so we just move the pointer to it */
- 	client->creds = ctx->client_creds;
- 	ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -327,7 +413,7 @@
- 
- /* Privileged */
- int
--ssh_gssapi_userok(char *user)
-+ssh_gssapi_userok(char *user, struct passwd *pw)
- {
- 	OM_uint32 lmin;
- 
-@@ -337,9 +423,11 @@
- 		return 0;
- 	}
- 	if (gssapi_client.mech && gssapi_client.mech->userok)
--		if ((*gssapi_client.mech->userok)(&gssapi_client, user))
-+		if ((*gssapi_client.mech->userok)(&gssapi_client, user)) {
-+			gssapi_client.used = 1;
-+			gssapi_client.store.owner = pw;
- 			return 1;
--		else {
-+		} else {
- 			/* Destroy delegated credentials if userok fails */
- 			gss_release_buffer(&lmin, &gssapi_client.displayname);
- 			gss_release_buffer(&lmin, &gssapi_client.exportedname);
-@@ -352,14 +440,90 @@
- 	return (0);
- }
- 
--/* Privileged */
--OM_uint32
--ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
-+/* These bits are only used for rekeying. The unpriviledged child is running 
-+ * as the user, the monitor is root.
-+ *
-+ * In the child, we want to :
-+ *    *) Ask the monitor to store our credentials into the store we specify
-+ *    *) If it succeeds, maybe do a PAM update
-+ */
-+
-+/* Stuff for PAM */
-+
-+#ifdef USE_PAM
-+static int ssh_gssapi_simple_conv(int n, const struct pam_message **msg, 
-+    struct pam_response **resp, void *data)
- {
--	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
--	    gssbuf, gssmic, NULL);
-+	return (PAM_CONV_ERR);
-+}
-+#endif
- 
--	return (ctx->major);
-+void
-+ssh_gssapi_rekey_creds() {
-+	int ok;
-+	int ret;
-+#ifdef USE_PAM
-+	pam_handle_t *pamh = NULL;
-+	struct pam_conv pamconv = {ssh_gssapi_simple_conv, NULL};
-+	char *envstr;
-+#endif
-+
-+	if (gssapi_client.store.filename == NULL && 
-+	    gssapi_client.store.envval == NULL &&
-+	    gssapi_client.store.envvar == NULL)
-+		return;
-+ 
-+	ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store));
-+
-+	if (!ok)
-+		return;
-+
-+	debug("Rekeyed credentials stored successfully");
-+
-+	/* Actually managing to play with the ssh pam stack from here will
-+	 * be next to impossible. In any case, we may want different options
-+	 * for rekeying. So, use our own :)
-+	 */
-+#ifdef USE_PAM	
-+	if (!use_privsep) {
-+		debug("Not even going to try and do PAM with privsep disabled");
-+		return;
-+	}
-+
-+	ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name,
-+ 	    &pamconv, &pamh);
-+	if (ret)
-+		return;
-+
-+	xasprintf(&envstr, "%s=%s", gssapi_client.store.envvar, 
-+	    gssapi_client.store.envval);
-+
-+	ret = pam_putenv(pamh, envstr);
-+	if (!ret)
-+		pam_setcred(pamh, PAM_REINITIALIZE_CRED);
-+	pam_end(pamh, PAM_SUCCESS);
-+#endif
-+}
-+
-+int 
-+ssh_gssapi_update_creds(ssh_gssapi_ccache *store) {
-+	int ok = 0;
-+
-+	/* Check we've got credentials to store */
-+	if (!gssapi_client.updated)
-+		return 0;
-+
-+	gssapi_client.updated = 0;
-+
-+	temporarily_use_uid(gssapi_client.store.owner);
-+	if (gssapi_client.mech && gssapi_client.mech->updatecreds)
-+		ok = (*gssapi_client.mech->updatecreds)(store, &gssapi_client);
-+	else
-+		debug("No update function for this mechanism");
-+
-+	restore_uid();
-+
-+	return ok;
- }
- 
- #endif
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kex.c openssh-5.8p1.new/kex.c
---- openssh-5.8p1/kex.c	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.8p1.new/kex.c	2011-02-12 18:07:11.149564726 +0100
-@@ -50,6 +50,10 @@
- #include "monitor.h"
- #include "roaming.h"
- 
-+#ifdef GSSAPI
-+#include "ssh-gss.h"
-+#endif
-+
- #if OPENSSL_VERSION_NUMBER >= 0x00907000L
- # if defined(HAVE_EVP_SHA256)
- # define evp_ssh_sha256 EVP_sha256
-@@ -358,6 +362,20 @@
-  		k->kex_type = KEX_ECDH_SHA2;
- 		k->evp_md = kex_ecdh_name_to_evpmd(k->name);
- #endif
-+#ifdef GSSAPI
-+	} else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,
-+	    sizeof(KEX_GSS_GEX_SHA1_ID) - 1) == 0) {
-+		k->kex_type = KEX_GSS_GEX_SHA1;
-+		k->evp_md = EVP_sha1();
-+	} else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID,
-+	    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1) == 0) {
-+		k->kex_type = KEX_GSS_GRP1_SHA1;
-+		k->evp_md = EVP_sha1();
-+	} else if (strncmp(k->name, KEX_GSS_GRP14_SHA1_ID,
-+	    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1) == 0) {
-+		k->kex_type = KEX_GSS_GRP14_SHA1;
-+		k->evp_md = EVP_sha1();
-+#endif
- 	} else
- 		fatal("bad kex alg %s", k->name);
- }
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kex.h openssh-5.8p1.new/kex.h
---- openssh-5.8p1/kex.h	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.8p1.new/kex.h	2011-02-12 18:07:11.161650596 +0100
-@@ -73,6 +73,9 @@
- 	KEX_DH_GEX_SHA1,
- 	KEX_DH_GEX_SHA256,
- 	KEX_ECDH_SHA2,
-+	KEX_GSS_GRP1_SHA1,
-+	KEX_GSS_GRP14_SHA1,
-+	KEX_GSS_GEX_SHA1,
- 	KEX_MAX
- };
- 
-@@ -129,6 +132,12 @@
- 	sig_atomic_t done;
- 	int	flags;
- 	const EVP_MD *evp_md;
-+#ifdef GSSAPI
-+	int	gss_deleg_creds;
-+	int	gss_trust_dns;
-+	char    *gss_host;
-+	char	*gss_client;
-+#endif
- 	char	*client_version_string;
- 	char	*server_version_string;
- 	int	(*verify_host_key)(Key *);
-@@ -156,6 +165,11 @@
- void	 kexecdh_client(Kex *);
- void	 kexecdh_server(Kex *);
- 
-+#ifdef GSSAPI
-+void	kexgss_client(Kex *);
-+void	kexgss_server(Kex *);
-+#endif
-+
- void
- kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
-     BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kexgssc.c openssh-5.8p1.new/kexgssc.c
---- openssh-5.8p1/kexgssc.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/kexgssc.c	2011-02-12 18:07:11.176741991 +0100
-@@ -0,0 +1,334 @@
-+/*
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "includes.h"
-+
-+#ifdef GSSAPI
-+
-+#include "includes.h"
-+
-+#include <openssl/crypto.h>
-+#include <openssl/bn.h>
-+
-+#include <string.h>
-+
-+#include "xmalloc.h"
-+#include "buffer.h"
-+#include "ssh2.h"
-+#include "key.h"
-+#include "cipher.h"
-+#include "kex.h"
-+#include "log.h"
-+#include "packet.h"
-+#include "dh.h"
-+
-+#include "ssh-gss.h"
-+
-+void
-+kexgss_client(Kex *kex) {
-+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-+	gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
-+	Gssctxt *ctxt;
-+	OM_uint32 maj_status, min_status, ret_flags;
-+	u_int klen, kout, slen = 0, hashlen, strlen;
-+	DH *dh; 
-+	BIGNUM *dh_server_pub = NULL;
-+	BIGNUM *shared_secret = NULL;
-+	BIGNUM *p = NULL;
-+	BIGNUM *g = NULL;	
-+	u_char *kbuf, *hash;
-+	u_char *serverhostkey = NULL;
-+	u_char *empty = "";
-+	char *msg;
-+	char *lang;
-+	int type = 0;
-+	int first = 1;
-+	int nbits = 0, min = DH_GRP_MIN, max = DH_GRP_MAX;
-+
-+	/* Initialise our GSSAPI world */	
-+	ssh_gssapi_build_ctx(&ctxt);
-+	if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type) 
-+	    == GSS_C_NO_OID)
-+		fatal("Couldn't identify host exchange");
-+
-+	if (ssh_gssapi_import_name(ctxt, kex->gss_host))
-+		fatal("Couldn't import hostname");
-+
-+	if (kex->gss_client && 
-+	    ssh_gssapi_client_identity(ctxt, kex->gss_client))
-+		fatal("Couldn't acquire client credentials");
-+
-+	switch (kex->kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+		dh = dh_new_group1();
-+		break;
-+	case KEX_GSS_GRP14_SHA1:
-+		dh = dh_new_group14();
-+		break;
-+	case KEX_GSS_GEX_SHA1:
-+		debug("Doing group exchange\n");
-+		nbits = dh_estimate(kex->we_need * 8);
-+		packet_start(SSH2_MSG_KEXGSS_GROUPREQ);
-+		packet_put_int(min);
-+		packet_put_int(nbits);
-+		packet_put_int(max);
-+
-+		packet_send();
-+
-+		packet_read_expect(SSH2_MSG_KEXGSS_GROUP);
-+
-+		if ((p = BN_new()) == NULL)
-+			fatal("BN_new() failed");
-+		packet_get_bignum2(p);
-+		if ((g = BN_new()) == NULL)
-+			fatal("BN_new() failed");
-+		packet_get_bignum2(g);
-+		packet_check_eom();
-+
-+		if (BN_num_bits(p) < min || BN_num_bits(p) > max)
-+			fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
-+			    min, BN_num_bits(p), max);
-+
-+		dh = dh_new_group(g, p);
-+		break;
-+	default:
-+		fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+	}
-+	
-+	/* Step 1 - e is dh->pub_key */
-+	dh_gen_key(dh, kex->we_need * 8);
-+
-+	/* This is f, we initialise it now to make life easier */
-+	dh_server_pub = BN_new();
-+	if (dh_server_pub == NULL)
-+		fatal("dh_server_pub == NULL");
-+
-+	token_ptr = GSS_C_NO_BUFFER;
-+			 
-+	do {
-+		debug("Calling gss_init_sec_context");
-+		
-+		maj_status = ssh_gssapi_init_ctx(ctxt,
-+		    kex->gss_deleg_creds, token_ptr, &send_tok,
-+		    &ret_flags);
-+
-+		if (GSS_ERROR(maj_status)) {
-+			if (send_tok.length != 0) {
-+				packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+				packet_put_string(send_tok.value,
-+				    send_tok.length);
-+			}
-+			fatal("gss_init_context failed");
-+		}
-+
-+		/* If we've got an old receive buffer get rid of it */
-+		if (token_ptr != GSS_C_NO_BUFFER)
-+			xfree(recv_tok.value);
-+
-+		if (maj_status == GSS_S_COMPLETE) {
-+			/* If mutual state flag is not true, kex fails */
-+			if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-+				fatal("Mutual authentication failed");
-+
-+			/* If integ avail flag is not true kex fails */
-+			if (!(ret_flags & GSS_C_INTEG_FLAG))
-+				fatal("Integrity check failed");
-+		}
-+
-+		/* 
-+		 * If we have data to send, then the last message that we
-+		 * received cannot have been a 'complete'. 
-+		 */
-+		if (send_tok.length != 0) {
-+			if (first) {
-+				packet_start(SSH2_MSG_KEXGSS_INIT);
-+				packet_put_string(send_tok.value,
-+				    send_tok.length);
-+				packet_put_bignum2(dh->pub_key);
-+				first = 0;
-+			} else {
-+				packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+				packet_put_string(send_tok.value,
-+				    send_tok.length);
-+			}
-+			packet_send();
-+			gss_release_buffer(&min_status, &send_tok);
-+
-+			/* If we've sent them data, they should reply */
-+			do {	
-+				type = packet_read();
-+				if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
-+					debug("Received KEXGSS_HOSTKEY");
-+					if (serverhostkey)
-+						fatal("Server host key received more than once");
-+					serverhostkey = 
-+					    packet_get_string(&slen);
-+				}
-+			} while (type == SSH2_MSG_KEXGSS_HOSTKEY);
-+
-+			switch (type) {
-+			case SSH2_MSG_KEXGSS_CONTINUE:
-+				debug("Received GSSAPI_CONTINUE");
-+				if (maj_status == GSS_S_COMPLETE) 
-+					fatal("GSSAPI Continue received from server when complete");
-+				recv_tok.value = packet_get_string(&strlen);
-+				recv_tok.length = strlen; 
-+				break;
-+			case SSH2_MSG_KEXGSS_COMPLETE:
-+				debug("Received GSSAPI_COMPLETE");
-+				packet_get_bignum2(dh_server_pub);
-+				msg_tok.value =  packet_get_string(&strlen);
-+				msg_tok.length = strlen; 
-+
-+				/* Is there a token included? */
-+				if (packet_get_char()) {
-+					recv_tok.value=
-+					    packet_get_string(&strlen);
-+					recv_tok.length = strlen;
-+					/* If we're already complete - protocol error */
-+					if (maj_status == GSS_S_COMPLETE)
-+						packet_disconnect("Protocol error: received token when complete");
-+					} else {
-+						/* No token included */
-+						if (maj_status != GSS_S_COMPLETE)
-+							packet_disconnect("Protocol error: did not receive final token");
-+				}
-+				break;
-+			case SSH2_MSG_KEXGSS_ERROR:
-+				debug("Received Error");
-+				maj_status = packet_get_int();
-+				min_status = packet_get_int();
-+				msg = packet_get_string(NULL);
-+				lang = packet_get_string(NULL);
-+				fatal("GSSAPI Error: \n%.400s",msg);
-+			default:
-+				packet_disconnect("Protocol error: didn't expect packet type %d",
-+		    		type);
-+			}
-+			token_ptr = &recv_tok;
-+		} else {
-+			/* No data, and not complete */
-+			if (maj_status != GSS_S_COMPLETE)
-+				fatal("Not complete, and no token output");
-+		}
-+	} while (maj_status & GSS_S_CONTINUE_NEEDED);
-+
-+	/* 
-+	 * We _must_ have received a COMPLETE message in reply from the 
-+	 * server, which will have set dh_server_pub and msg_tok 
-+	 */
-+
-+	if (type != SSH2_MSG_KEXGSS_COMPLETE)
-+		fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
-+
-+	/* Check f in range [1, p-1] */
-+	if (!dh_pub_is_valid(dh, dh_server_pub))
-+		packet_disconnect("bad server public DH value");
-+
-+	/* compute K=f^x mod p */
-+	klen = DH_size(dh);
-+	kbuf = xmalloc(klen);
-+	kout = DH_compute_key(kbuf, dh_server_pub, dh);
-+	if (kout < 0)
-+		fatal("DH_compute_key: failed");
-+
-+	shared_secret = BN_new();
-+	if (shared_secret == NULL)
-+		fatal("kexgss_client: BN_new failed");
-+
-+	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
-+		fatal("kexdh_client: BN_bin2bn failed");
-+
-+	memset(kbuf, 0, klen);
-+	xfree(kbuf);
-+
-+	switch (kex->kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+	case KEX_GSS_GRP14_SHA1:
-+		kex_dh_hash( kex->client_version_string, 
-+		    kex->server_version_string,
-+		    buffer_ptr(&kex->my), buffer_len(&kex->my),
-+		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-+		    (serverhostkey ? serverhostkey : empty), slen,
-+		    dh->pub_key,	/* e */
-+		    dh_server_pub,	/* f */
-+		    shared_secret,	/* K */
-+		    &hash, &hashlen
-+		);
-+		break;
-+	case KEX_GSS_GEX_SHA1:
-+		kexgex_hash(
-+		    kex->evp_md,
-+		    kex->client_version_string,
-+		    kex->server_version_string,
-+		    buffer_ptr(&kex->my), buffer_len(&kex->my),
-+		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-+		    (serverhostkey ? serverhostkey : empty), slen,
-+ 		    min, nbits, max,
-+		    dh->p, dh->g,
-+		    dh->pub_key,
-+		    dh_server_pub,
-+		    shared_secret,
-+		    &hash, &hashlen
-+		);
-+		break;
-+	default:
-+		fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+	}
-+
-+	gssbuf.value = hash;
-+	gssbuf.length = hashlen;
-+
-+	/* Verify that the hash matches the MIC we just got. */
-+	if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
-+		packet_disconnect("Hash's MIC didn't verify");
-+
-+	xfree(msg_tok.value);
-+
-+	DH_free(dh);
-+	if (serverhostkey)
-+		xfree(serverhostkey);
-+	BN_clear_free(dh_server_pub);
-+
-+	/* save session id */
-+	if (kex->session_id == NULL) {
-+		kex->session_id_len = hashlen;
-+		kex->session_id = xmalloc(kex->session_id_len);
-+		memcpy(kex->session_id, hash, kex->session_id_len);
-+	}
-+
-+	if (kex->gss_deleg_creds)
-+		ssh_gssapi_credentials_updated(ctxt);
-+
-+	if (gss_kex_context == NULL)
-+		gss_kex_context = ctxt;
-+	else
-+		ssh_gssapi_delete_ctx(&ctxt);
-+
-+	kex_derive_keys(kex, hash, hashlen, shared_secret);
-+	BN_clear_free(shared_secret);
-+	kex_finish(kex);
-+}
-+
-+#endif /* GSSAPI */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kexgsss.c openssh-5.8p1.new/kexgsss.c
---- openssh-5.8p1/kexgsss.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/kexgsss.c	2011-02-12 18:07:11.186584789 +0100
-@@ -0,0 +1,288 @@
-+/*
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "includes.h"
-+
-+#ifdef GSSAPI
-+
-+#include <string.h>
-+
-+#include <openssl/crypto.h>
-+#include <openssl/bn.h>
-+
-+#include "xmalloc.h"
-+#include "buffer.h"
-+#include "ssh2.h"
-+#include "key.h"
-+#include "cipher.h"
-+#include "kex.h"
-+#include "log.h"
-+#include "packet.h"
-+#include "dh.h"
-+#include "ssh-gss.h"
-+#include "monitor_wrap.h"
-+#include "servconf.h"
-+
-+extern ServerOptions options;
-+
-+void
-+kexgss_server(Kex *kex)
-+{
-+	OM_uint32 maj_status, min_status;
-+	
-+	/* 
-+	 * Some GSSAPI implementations use the input value of ret_flags (an
-+ 	 * output variable) as a means of triggering mechanism specific 
-+ 	 * features. Initializing it to zero avoids inadvertently 
-+ 	 * activating this non-standard behaviour.
-+	 */
-+
-+	OM_uint32 ret_flags = 0;
-+	gss_buffer_desc gssbuf, recv_tok, msg_tok;
-+	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-+	Gssctxt *ctxt = NULL;
-+	u_int slen, klen, kout, hashlen;
-+	u_char *kbuf, *hash;
-+	DH *dh;
-+	int min = -1, max = -1, nbits = -1;
-+	BIGNUM *shared_secret = NULL;
-+	BIGNUM *dh_client_pub = NULL;
-+	int type = 0;
-+	gss_OID oid;
-+	char *mechs;
-+
-+	/* Initialise GSSAPI */
-+
-+	/* If we're rekeying, privsep means that some of the private structures
-+	 * in the GSSAPI code are no longer available. This kludges them back
-+	 * into life
-+	 */
-+	if (!ssh_gssapi_oid_table_ok()) 
-+		if ((mechs = ssh_gssapi_server_mechanisms()))
-+			xfree(mechs);
-+
-+	debug2("%s: Identifying %s", __func__, kex->name);
-+	oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
-+	if (oid == GSS_C_NO_OID)
-+	   fatal("Unknown gssapi mechanism");
-+
-+	debug2("%s: Acquiring credentials", __func__);
-+
-+	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
-+		fatal("Unable to acquire credentials for the server");
-+
-+	switch (kex->kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+		dh = dh_new_group1();
-+		break;
-+	case KEX_GSS_GRP14_SHA1:
-+		dh = dh_new_group14();
-+		break;
-+	case KEX_GSS_GEX_SHA1:
-+		debug("Doing group exchange");
-+		packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);
-+		min = packet_get_int();
-+		nbits = packet_get_int();
-+		max = packet_get_int();
-+		min = MAX(DH_GRP_MIN, min);
-+		max = MIN(DH_GRP_MAX, max);
-+		packet_check_eom();
-+		if (max < min || nbits < min || max < nbits)
-+			fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
-+			    min, nbits, max);
-+		dh = PRIVSEP(choose_dh(min, nbits, max));
-+		if (dh == NULL)
-+			packet_disconnect("Protocol error: no matching group found");
-+
-+		packet_start(SSH2_MSG_KEXGSS_GROUP);
-+		packet_put_bignum2(dh->p);
-+		packet_put_bignum2(dh->g);
-+		packet_send();
-+
-+		packet_write_wait();
-+		break;
-+	default:
-+		fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+	}
-+
-+	dh_gen_key(dh, kex->we_need * 8);
-+
-+	do {
-+		debug("Wait SSH2_MSG_GSSAPI_INIT");
-+		type = packet_read();
-+		switch(type) {
-+		case SSH2_MSG_KEXGSS_INIT:
-+			if (dh_client_pub != NULL) 
-+				fatal("Received KEXGSS_INIT after initialising");
-+			recv_tok.value = packet_get_string(&slen);
-+			recv_tok.length = slen; 
-+
-+			if ((dh_client_pub = BN_new()) == NULL)
-+				fatal("dh_client_pub == NULL");
-+
-+			packet_get_bignum2(dh_client_pub);
-+
-+			/* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
-+			break;
-+		case SSH2_MSG_KEXGSS_CONTINUE:
-+			recv_tok.value = packet_get_string(&slen);
-+			recv_tok.length = slen; 
-+			break;
-+		default:
-+			packet_disconnect(
-+			    "Protocol error: didn't expect packet type %d",
-+			    type);
-+		}
-+
-+		maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, 
-+		    &send_tok, &ret_flags));
-+
-+		xfree(recv_tok.value);
-+
-+		if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
-+			fatal("Zero length token output when incomplete");
-+
-+		if (dh_client_pub == NULL)
-+			fatal("No client public key");
-+		
-+		if (maj_status & GSS_S_CONTINUE_NEEDED) {
-+			debug("Sending GSSAPI_CONTINUE");
-+			packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+			packet_put_string(send_tok.value, send_tok.length);
-+			packet_send();
-+			gss_release_buffer(&min_status, &send_tok);
-+		}
-+	} while (maj_status & GSS_S_CONTINUE_NEEDED);
-+
-+	if (GSS_ERROR(maj_status)) {
-+		if (send_tok.length > 0) {
-+			packet_start(SSH2_MSG_KEXGSS_CONTINUE);
-+			packet_put_string(send_tok.value, send_tok.length);
-+			packet_send();
-+		}
-+		fatal("accept_ctx died");
-+	}
-+
-+	if (!(ret_flags & GSS_C_MUTUAL_FLAG))
-+		fatal("Mutual Authentication flag wasn't set");
-+
-+	if (!(ret_flags & GSS_C_INTEG_FLAG))
-+		fatal("Integrity flag wasn't set");
-+	
-+	if (!dh_pub_is_valid(dh, dh_client_pub))
-+		packet_disconnect("bad client public DH value");
-+
-+	klen = DH_size(dh);
-+	kbuf = xmalloc(klen); 
-+	kout = DH_compute_key(kbuf, dh_client_pub, dh);
-+	if (kout < 0)
-+		fatal("DH_compute_key: failed");
-+
-+	shared_secret = BN_new();
-+	if (shared_secret == NULL)
-+		fatal("kexgss_server: BN_new failed");
-+
-+	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
-+		fatal("kexgss_server: BN_bin2bn failed");
-+
-+	memset(kbuf, 0, klen);
-+	xfree(kbuf);
-+
-+	switch (kex->kex_type) {
-+	case KEX_GSS_GRP1_SHA1:
-+	case KEX_GSS_GRP14_SHA1:
-+		kex_dh_hash(
-+		    kex->client_version_string, kex->server_version_string,
-+		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-+		    buffer_ptr(&kex->my), buffer_len(&kex->my),
-+		    NULL, 0, /* Change this if we start sending host keys */
-+		    dh_client_pub, dh->pub_key, shared_secret,
-+		    &hash, &hashlen
-+		);
-+		break;
-+	case KEX_GSS_GEX_SHA1:
-+		kexgex_hash(
-+		    kex->evp_md,
-+		    kex->client_version_string, kex->server_version_string,
-+		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-+		    buffer_ptr(&kex->my), buffer_len(&kex->my),
-+		    NULL, 0,
-+		    min, nbits, max,
-+		    dh->p, dh->g,
-+		    dh_client_pub,
-+		    dh->pub_key,
-+		    shared_secret,
-+		    &hash, &hashlen
-+		);
-+		break;
-+	default:
-+		fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
-+	}
-+
-+	BN_clear_free(dh_client_pub);
-+
-+	if (kex->session_id == NULL) {
-+		kex->session_id_len = hashlen;
-+		kex->session_id = xmalloc(kex->session_id_len);
-+		memcpy(kex->session_id, hash, kex->session_id_len);
-+	}
-+
-+	gssbuf.value = hash;
-+	gssbuf.length = hashlen;
-+
-+	if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok))))
-+		fatal("Couldn't get MIC");
-+
-+	packet_start(SSH2_MSG_KEXGSS_COMPLETE);
-+	packet_put_bignum2(dh->pub_key);
-+	packet_put_string(msg_tok.value,msg_tok.length);
-+
-+	if (send_tok.length != 0) {
-+		packet_put_char(1); /* true */
-+		packet_put_string(send_tok.value, send_tok.length);
-+	} else {
-+		packet_put_char(0); /* false */
-+	}
-+	packet_send();
-+
-+	gss_release_buffer(&min_status, &send_tok);
-+	gss_release_buffer(&min_status, &msg_tok);
-+
-+	if (gss_kex_context == NULL)
-+		gss_kex_context = ctxt;
-+	else 
-+		ssh_gssapi_delete_ctx(&ctxt);
-+
-+	DH_free(dh);
-+
-+	kex_derive_keys(kex, hash, hashlen, shared_secret);
-+	BN_clear_free(shared_secret);
-+	kex_finish(kex);
-+
-+	/* If this was a rekey, then save out any delegated credentials we
-+	 * just exchanged.  */
-+	if (options.gss_store_rekey)
-+		ssh_gssapi_rekey_creds();
-+}
-+#endif /* GSSAPI */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/key.c openssh-5.8p1.new/key.c
---- openssh-5.8p1/key.c	2011-02-04 01:48:34.000000000 +0100
-+++ openssh-5.8p1.new/key.c	2011-02-12 18:07:11.202089386 +0100
-@@ -971,6 +971,8 @@
- 		}
- 		break;
- #endif /* OPENSSL_HAS_ECC */
-+	case KEY_NULL:
-+		return "null";
- 	}
- 	return "ssh-unknown";
- }
-@@ -1276,6 +1278,8 @@
- 	    strcmp(name, "ecdsa-sha2-nistp521-cert-v01 at openssh.com") == 0) {
- 		return KEY_ECDSA_CERT;
- #endif
-+	} else if (strcmp(name, "null") == 0) {
-+		return KEY_NULL;
- 	}
- 
- 	debug2("key_type_from_name: unknown key type '%s'", name);
-diff --speed-large-files --minimal -Nru openssh-5.8p1/key.h openssh-5.8p1.new/key.h
---- openssh-5.8p1/key.h	2010-11-05 00:19:49.000000000 +0100
-+++ openssh-5.8p1.new/key.h	2011-02-12 18:07:11.216270794 +0100
-@@ -44,6 +44,7 @@
- 	KEY_ECDSA_CERT,
- 	KEY_RSA_CERT_V00,
- 	KEY_DSA_CERT_V00,
-+	KEY_NULL,
- 	KEY_UNSPEC
- };
- enum fp_type {
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor.c openssh-5.8p1.new/monitor.c
---- openssh-5.8p1/monitor.c	2010-09-10 03:23:34.000000000 +0200
-+++ openssh-5.8p1.new/monitor.c	2011-02-12 18:07:11.241713537 +0100
-@@ -172,6 +172,8 @@
- int mm_answer_gss_accept_ctx(int, Buffer *);
- int mm_answer_gss_userok(int, Buffer *);
- int mm_answer_gss_checkmic(int, Buffer *);
-+int mm_answer_gss_sign(int, Buffer *);
-+int mm_answer_gss_updatecreds(int, Buffer *);
- #endif
- 
- #ifdef SSH_AUDIT_EVENTS
-@@ -241,6 +243,7 @@
-     {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
-     {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
-     {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
-+    {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},
- #endif
- #ifdef JPAKE
-     {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata},
-@@ -253,6 +256,12 @@
- };
- 
- struct mon_table mon_dispatch_postauth20[] = {
-+#ifdef GSSAPI
-+    {MONITOR_REQ_GSSSETUP, 0, mm_answer_gss_setup_ctx},
-+    {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
-+    {MONITOR_REQ_GSSSIGN, 0, mm_answer_gss_sign},
-+    {MONITOR_REQ_GSSUPCREDS, 0, mm_answer_gss_updatecreds},
-+#endif
-     {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
-     {MONITOR_REQ_SIGN, 0, mm_answer_sign},
-     {MONITOR_REQ_PTY, 0, mm_answer_pty},
-@@ -357,6 +366,10 @@
- 		/* Permit requests for moduli and signatures */
- 		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
-+#ifdef GSSAPI
-+		/* and for the GSSAPI key exchange */
-+		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
-+#endif
- 	} else {
- 		mon_dispatch = mon_dispatch_proto15;
- 
-@@ -443,6 +456,10 @@
- 		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-+#ifdef GSSAPI
-+		/* and for the GSSAPI key exchange */
-+		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSETUP, 1);
-+#endif		
- 	} else {
- 		mon_dispatch = mon_dispatch_postauth15;
- 		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1692,6 +1709,13 @@
- 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
- 	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
- 	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
-+#ifdef GSSAPI
-+	if (options.gss_keyex) {
-+		kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
-+		kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
-+		kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
-+	}
-+#endif
- 	kex->server = 1;
- 	kex->hostkey_type = buffer_get_int(m);
- 	kex->kex_type = buffer_get_int(m);
-@@ -1898,6 +1922,9 @@
- 	OM_uint32 major;
- 	u_int len;
- 
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("In GSSAPI monitor when GSSAPI is disabled");
-+
- 	goid.elements = buffer_get_string(m, &len);
- 	goid.length = len;
- 
-@@ -1925,6 +1952,9 @@
- 	OM_uint32 flags = 0; /* GSI needs this */
- 	u_int len;
- 
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("In GSSAPI monitor when GSSAPI is disabled");
-+
- 	in.value = buffer_get_string(m, &len);
- 	in.length = len;
- 	major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -1942,6 +1972,7 @@
- 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
- 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
-+		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSIGN, 1);
- 	}
- 	return (0);
- }
-@@ -1953,6 +1984,9 @@
- 	OM_uint32 ret;
- 	u_int len;
- 
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("In GSSAPI monitor when GSSAPI is disabled");
-+
- 	gssbuf.value = buffer_get_string(m, &len);
- 	gssbuf.length = len;
- 	mic.value = buffer_get_string(m, &len);
-@@ -1979,7 +2013,11 @@
- {
- 	int authenticated;
- 
--	authenticated = authctxt->valid && ssh_gssapi_userok(authctxt->user);
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("In GSSAPI monitor when GSSAPI is disabled");
-+
-+	authenticated = authctxt->valid && 
-+	    ssh_gssapi_userok(authctxt->user, authctxt->pw);
- 
- 	buffer_clear(m);
- 	buffer_put_int(m, authenticated);
-@@ -1992,6 +2030,74 @@
- 	/* Monitor loop will terminate if authenticated */
- 	return (authenticated);
- }
-+
-+int 
-+mm_answer_gss_sign(int socket, Buffer *m)
-+{
-+	gss_buffer_desc data;
-+	gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
-+	OM_uint32 major, minor;
-+	u_int len;
-+
-+	if (!options.gss_authentication && !options.gss_keyex)
-+		fatal("In GSSAPI monitor when GSSAPI is disabled");
-+
-+	data.value = buffer_get_string(m, &len);
-+	data.length = len;
-+	if (data.length != 20) 
-+		fatal("%s: data length incorrect: %d", __func__, 
-+		    (int) data.length);
-+
-+	/* Save the session ID on the first time around */
-+	if (session_id2_len == 0) {
-+		session_id2_len = data.length;
-+		session_id2 = xmalloc(session_id2_len);
-+		memcpy(session_id2, data.value, session_id2_len);
-+	}
-+	major = ssh_gssapi_sign(gsscontext, &data, &hash);
-+
-+	xfree(data.value);
-+
-+	buffer_clear(m);
-+	buffer_put_int(m, major);
-+	buffer_put_string(m, hash.value, hash.length);
-+
-+	mm_request_send(socket, MONITOR_ANS_GSSSIGN, m);
-+
-+	gss_release_buffer(&minor, &hash);
-+
-+	/* Turn on getpwnam permissions */
-+	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
-+	
-+	/* And credential updating, for when rekeying */
-+	monitor_permit(mon_dispatch, MONITOR_REQ_GSSUPCREDS, 1);
-+
-+	return (0);
-+}
-+
-+int
-+mm_answer_gss_updatecreds(int socket, Buffer *m) {
-+	ssh_gssapi_ccache store;
-+	int ok;
-+
-+	store.filename = buffer_get_string(m, NULL);
-+	store.envvar   = buffer_get_string(m, NULL);
-+	store.envval   = buffer_get_string(m, NULL);
-+
-+	ok = ssh_gssapi_update_creds(&store);
-+
-+	xfree(store.filename);
-+	xfree(store.envvar);
-+	xfree(store.envval);
-+
-+	buffer_clear(m);
-+	buffer_put_int(m, ok);
-+
-+	mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m);
-+
-+	return(0);
-+}
-+
- #endif /* GSSAPI */
- 
- #ifdef JPAKE
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor.h openssh-5.8p1.new/monitor.h
---- openssh-5.8p1/monitor.h	2008-11-05 06:20:46.000000000 +0100
-+++ openssh-5.8p1.new/monitor.h	2011-02-12 18:07:11.311728071 +0100
-@@ -53,6 +53,8 @@
- 	MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
- 	MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
- 	MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
-+	MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
-+	MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
- 	MONITOR_REQ_PAM_START,
- 	MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
- 	MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor_wrap.c openssh-5.8p1.new/monitor_wrap.c
---- openssh-5.8p1/monitor_wrap.c	2010-08-31 14:41:14.000000000 +0200
-+++ openssh-5.8p1.new/monitor_wrap.c	2011-02-12 18:07:11.359631731 +0100
-@@ -1232,7 +1232,7 @@
- }
- 
- int
--mm_ssh_gssapi_userok(char *user)
-+mm_ssh_gssapi_userok(char *user, struct passwd *pw)
- {
- 	Buffer m;
- 	int authenticated = 0;
-@@ -1249,6 +1249,51 @@
- 	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
- 	return (authenticated);
- }
-+
-+OM_uint32
-+mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
-+{
-+	Buffer m;
-+	OM_uint32 major;
-+	u_int len;
-+
-+	buffer_init(&m);
-+	buffer_put_string(&m, data->value, data->length);
-+
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
-+
-+	major = buffer_get_int(&m);
-+	hash->value = buffer_get_string(&m, &len);
-+	hash->length = len;
-+
-+	buffer_free(&m);
-+
-+	return(major);
-+}
-+
-+int
-+mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
-+{
-+	Buffer m;
-+	int ok;
-+
-+	buffer_init(&m);
-+
-+	buffer_put_cstring(&m, store->filename ? store->filename : "");
-+	buffer_put_cstring(&m, store->envvar ? store->envvar : "");
-+	buffer_put_cstring(&m, store->envval ? store->envval : "");
-+	
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, &m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, &m);
-+
-+	ok = buffer_get_int(&m);
-+
-+	buffer_free(&m);
-+	
-+	return (ok);
-+}
-+
- #endif /* GSSAPI */
- 
- #ifdef JPAKE
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor_wrap.h openssh-5.8p1.new/monitor_wrap.h
---- openssh-5.8p1/monitor_wrap.h	2009-03-05 14:58:22.000000000 +0100
-+++ openssh-5.8p1.new/monitor_wrap.h	2011-02-12 18:07:11.407619296 +0100
-@@ -57,8 +57,10 @@
- OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
- OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
-    gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
--int mm_ssh_gssapi_userok(char *user);
-+int mm_ssh_gssapi_userok(char *user, struct passwd *);
- OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
-+OM_uint32 mm_ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
-+int mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *);
- #endif
- 
- #ifdef USE_PAM
-diff --speed-large-files --minimal -Nru openssh-5.8p1/readconf.c openssh-5.8p1.new/readconf.c
---- openssh-5.8p1/readconf.c	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/readconf.c	2011-02-12 18:07:11.460306621 +0100
-@@ -129,6 +129,8 @@
- 	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
- 	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
- 	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
-+	oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
-+	oGssServerIdentity, 
- 	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- 	oSendEnv, oControlPath, oControlMaster, oControlPersist,
- 	oHashKnownHosts,
-@@ -169,10 +171,19 @@
- 	{ "afstokenpassing", oUnsupported },
- #if defined(GSSAPI)
- 	{ "gssapiauthentication", oGssAuthentication },
-+	{ "gssapikeyexchange", oGssKeyEx },
- 	{ "gssapidelegatecredentials", oGssDelegateCreds },
-+	{ "gssapitrustdns", oGssTrustDns },
-+	{ "gssapiclientidentity", oGssClientIdentity },
-+	{ "gssapiserveridentity", oGssServerIdentity },
-+	{ "gssapirenewalforcesrekey", oGssRenewalRekey },
- #else
- 	{ "gssapiauthentication", oUnsupported },
-+	{ "gssapikeyexchange", oUnsupported },
- 	{ "gssapidelegatecredentials", oUnsupported },
-+	{ "gssapitrustdns", oUnsupported },
-+	{ "gssapiclientidentity", oUnsupported },
-+	{ "gssapirenewalforcesrekey", oUnsupported },
- #endif
- 	{ "fallbacktorsh", oDeprecated },
- 	{ "usersh", oDeprecated },
-@@ -479,10 +490,30 @@
- 		intptr = &options->gss_authentication;
- 		goto parse_flag;
- 
-+	case oGssKeyEx:
-+		intptr = &options->gss_keyex;
-+		goto parse_flag;
-+
- 	case oGssDelegateCreds:
- 		intptr = &options->gss_deleg_creds;
- 		goto parse_flag;
- 
-+	case oGssTrustDns:
-+		intptr = &options->gss_trust_dns;
-+		goto parse_flag;
-+
-+	case oGssClientIdentity:
-+		charptr = &options->gss_client_identity;
-+		goto parse_string;
-+
-+	case oGssServerIdentity:
-+		charptr = &options->gss_server_identity;
-+		goto parse_string;
-+
-+	case oGssRenewalRekey:
-+		intptr = &options->gss_renewal_rekey;
-+		goto parse_flag;
-+
- 	case oBatchMode:
- 		intptr = &options->batch_mode;
- 		goto parse_flag;
-@@ -1092,7 +1123,12 @@
- 	options->pubkey_authentication = -1;
- 	options->challenge_response_authentication = -1;
- 	options->gss_authentication = -1;
-+	options->gss_keyex = -1;
- 	options->gss_deleg_creds = -1;
-+	options->gss_trust_dns = -1;
-+	options->gss_renewal_rekey = -1;
-+	options->gss_client_identity = NULL;
-+	options->gss_server_identity = NULL;
- 	options->password_authentication = -1;
- 	options->kbd_interactive_authentication = -1;
- 	options->kbd_interactive_devices = NULL;
-@@ -1193,8 +1229,14 @@
- 		options->challenge_response_authentication = 1;
- 	if (options->gss_authentication == -1)
- 		options->gss_authentication = 0;
-+	if (options->gss_keyex == -1)
-+		options->gss_keyex = 0;
- 	if (options->gss_deleg_creds == -1)
- 		options->gss_deleg_creds = 0;
-+	if (options->gss_trust_dns == -1)
-+		options->gss_trust_dns = 0;
-+	if (options->gss_renewal_rekey == -1)
-+		options->gss_renewal_rekey = 0;
- 	if (options->password_authentication == -1)
- 		options->password_authentication = 1;
- 	if (options->kbd_interactive_authentication == -1)
-diff --speed-large-files --minimal -Nru openssh-5.8p1/readconf.h openssh-5.8p1.new/readconf.h
---- openssh-5.8p1/readconf.h	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/readconf.h	2011-02-12 18:07:11.507187275 +0100
-@@ -46,7 +46,12 @@
- 	int     challenge_response_authentication;
- 					/* Try S/Key or TIS, authentication. */
- 	int     gss_authentication;	/* Try GSS authentication */
-+	int     gss_keyex;		/* Try GSS key exchange */
- 	int     gss_deleg_creds;	/* Delegate GSS credentials */
-+	int	gss_trust_dns;		/* Trust DNS for GSS canonicalization */
-+	int	gss_renewal_rekey;	/* Credential renewal forces rekey */
-+	char    *gss_client_identity;   /* Principal to initiate GSSAPI with */
-+	char    *gss_server_identity;   /* GSSAPI target principal */
- 	int     password_authentication;	/* Try password
- 						 * authentication. */
- 	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/servconf.c openssh-5.8p1.new/servconf.c
---- openssh-5.8p1/servconf.c	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/servconf.c	2011-02-12 18:07:11.533252334 +0100
-@@ -97,7 +97,10 @@
- 	options->kerberos_ticket_cleanup = -1;
- 	options->kerberos_get_afs_token = -1;
- 	options->gss_authentication=-1;
-+	options->gss_keyex = -1;
- 	options->gss_cleanup_creds = -1;
-+	options->gss_strict_acceptor = -1;
-+	options->gss_store_rekey = -1;
- 	options->password_authentication = -1;
- 	options->kbd_interactive_authentication = -1;
- 	options->challenge_response_authentication = -1;
-@@ -226,8 +229,14 @@
- 		options->kerberos_get_afs_token = 0;
- 	if (options->gss_authentication == -1)
- 		options->gss_authentication = 0;
-+	if (options->gss_keyex == -1)
-+		options->gss_keyex = 0;
- 	if (options->gss_cleanup_creds == -1)
- 		options->gss_cleanup_creds = 1;
-+	if (options->gss_strict_acceptor == -1)
-+		options->gss_strict_acceptor = 1;
-+	if (options->gss_store_rekey == -1)
-+		options->gss_store_rekey = 0;
- 	if (options->password_authentication == -1)
- 		options->password_authentication = 1;
- 	if (options->kbd_interactive_authentication == -1)
-@@ -322,7 +331,9 @@
- 	sBanner, sUseDNS, sHostbasedAuthentication,
- 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
- 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
--	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
-+	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
-+	sGssKeyEx, sGssStoreRekey,
-+	sAcceptEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
- 	sUsePrivilegeSeparation, sAllowAgentForwarding,
- 	sZeroKnowledgePasswordAuthentication, sHostCertificate,
-@@ -386,10 +397,20 @@
- #ifdef GSSAPI
- 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
- 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
-+	{ "gssapicleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL },
-+	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
-+	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
-+	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
- #else
- 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
- 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
- #endif
-+	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
- 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
- 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
- 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -944,10 +965,22 @@
- 		intptr = &options->gss_authentication;
- 		goto parse_flag;
- 
-+	case sGssKeyEx:
-+		intptr = &options->gss_keyex;
-+		goto parse_flag;
-+
- 	case sGssCleanupCreds:
- 		intptr = &options->gss_cleanup_creds;
- 		goto parse_flag;
- 
-+	case sGssStrictAcceptor:
-+		intptr = &options->gss_strict_acceptor;
-+		goto parse_flag;
-+
-+	case sGssStoreRekey:
-+		intptr = &options->gss_store_rekey;
-+		goto parse_flag;
-+
- 	case sPasswordAuthentication:
- 		intptr = &options->password_authentication;
- 		goto parse_flag;
-@@ -1704,7 +1737,10 @@
- #endif
- #ifdef GSSAPI
- 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-+	dump_cfg_fmtint(sGssKeyEx, o->gss_keyex);
- 	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
-+	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
-+	dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
- #endif
- #ifdef JPAKE
- 	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
-diff --speed-large-files --minimal -Nru openssh-5.8p1/servconf.h openssh-5.8p1.new/servconf.h
---- openssh-5.8p1/servconf.h	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/servconf.h	2011-02-12 18:07:11.548572408 +0100
-@@ -97,7 +97,10 @@
- 	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
- 						 * authenticated with Kerberos. */
- 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
-+	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
- 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-+	int 	gss_strict_acceptor;	/* If true, restrict the GSSAPI acceptor name */
-+	int 	gss_store_rekey;
- 	int     password_authentication;	/* If true, permit password
- 						 * authentication. */
- 	int     kbd_interactive_authentication;	/* If true, permit */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ssh-gss.h openssh-5.8p1.new/ssh-gss.h
---- openssh-5.8p1/ssh-gss.h	2007-06-12 15:40:39.000000000 +0200
-+++ openssh-5.8p1.new/ssh-gss.h	2011-02-12 18:07:11.567306608 +0100
-@@ -1,6 +1,6 @@
- /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -60,10 +60,22 @@
- 
- #define SSH_GSS_OIDTYPE 0x06
- 
-+#define SSH2_MSG_KEXGSS_INIT                            30
-+#define SSH2_MSG_KEXGSS_CONTINUE                        31
-+#define SSH2_MSG_KEXGSS_COMPLETE                        32
-+#define SSH2_MSG_KEXGSS_HOSTKEY                         33
-+#define SSH2_MSG_KEXGSS_ERROR                           34
-+#define SSH2_MSG_KEXGSS_GROUPREQ			40
-+#define SSH2_MSG_KEXGSS_GROUP				41
-+#define KEX_GSS_GRP1_SHA1_ID				"gss-group1-sha1-"
-+#define KEX_GSS_GRP14_SHA1_ID				"gss-group14-sha1-"
-+#define KEX_GSS_GEX_SHA1_ID				"gss-gex-sha1-"
-+
- typedef struct {
- 	char *filename;
- 	char *envvar;
- 	char *envval;
-+	struct passwd *owner;
- 	void *data;
- } ssh_gssapi_ccache;
- 
-@@ -71,8 +83,11 @@
- 	gss_buffer_desc displayname;
- 	gss_buffer_desc exportedname;
- 	gss_cred_id_t creds;
-+	gss_name_t name;
- 	struct ssh_gssapi_mech_struct *mech;
- 	ssh_gssapi_ccache store;
-+	int used;
-+	int updated;
- } ssh_gssapi_client;
- 
- typedef struct ssh_gssapi_mech_struct {
-@@ -83,6 +98,7 @@
- 	int (*userok) (ssh_gssapi_client *, char *);
- 	int (*localname) (ssh_gssapi_client *, char **);
- 	void (*storecreds) (ssh_gssapi_client *);
-+	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
- } ssh_gssapi_mech;
- 
- typedef struct {
-@@ -93,10 +109,11 @@
- 	gss_OID		oid; /* client */
- 	gss_cred_id_t	creds; /* server */
- 	gss_name_t	client; /* server */
--	gss_cred_id_t	client_creds; /* server */
-+	gss_cred_id_t	client_creds; /* both */
- } Gssctxt;
- 
- extern ssh_gssapi_mech *supported_mechs[];
-+extern Gssctxt *gss_kex_context;
- 
- int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
- void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -116,16 +133,30 @@
- void ssh_gssapi_delete_ctx(Gssctxt **);
- OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
--int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
-+int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
-+OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
-+int ssh_gssapi_credentials_updated(Gssctxt *);
- 
- /* In the server */
-+typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *, 
-+    const char *);
-+char *ssh_gssapi_client_mechanisms(const char *, const char *);
-+char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
-+    const char *);
-+gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
-+int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *, 
-+    const char *);
- OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
--int ssh_gssapi_userok(char *name);
-+int ssh_gssapi_userok(char *name, struct passwd *);
- OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_do_child(char ***, u_int *);
- void ssh_gssapi_cleanup_creds(void);
- void ssh_gssapi_storecreds(void);
- 
-+char *ssh_gssapi_server_mechanisms(void);
-+int ssh_gssapi_oid_table_ok();
-+
-+int ssh_gssapi_update_creds(ssh_gssapi_ccache *store);
- #endif /* GSSAPI */
- 
- #endif /* _SSH_GSS_H */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ssh_config openssh-5.8p1.new/ssh_config
---- openssh-5.8p1/ssh_config	2010-01-12 09:40:27.000000000 +0100
-+++ openssh-5.8p1.new/ssh_config	2011-02-12 18:07:11.580240516 +0100
-@@ -26,6 +26,8 @@
- #   HostbasedAuthentication no
- #   GSSAPIAuthentication no
- #   GSSAPIDelegateCredentials no
-+#   GSSAPIKeyExchange no
-+#   GSSAPITrustDNS no
- #   BatchMode no
- #   CheckHostIP yes
- #   AddressFamily any
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ssh_config.5 openssh-5.8p1.new/ssh_config.5
---- openssh-5.8p1/ssh_config.5	2010-12-26 04:26:48.000000000 +0100
-+++ openssh-5.8p1.new/ssh_config.5	2011-02-12 18:07:11.600266821 +0100
-@@ -508,11 +508,43 @@
- The default is
- .Dq no .
- Note that this option applies to protocol version 2 only.
-+.It Cm GSSAPIKeyExchange
-+Specifies whether key exchange based on GSSAPI may be used. When using
-+GSSAPI key exchange the server need not have a host key.
-+The default is
-+.Dq no .
-+Note that this option applies to protocol version 2 only.
-+.It Cm GSSAPIClientIdentity
-+If set, specifies the GSSAPI client identity that ssh should use when 
-+connecting to the server. The default is unset, which means that the default 
-+identity will be used.
-+.It Cm GSSAPIServerIdentity
-+If set, specifies the GSSAPI server identity that ssh should expect when 
-+connecting to the server. The default is unset, which means that the
-+expected GSSAPI server identity will be determined from the target
-+hostname.
- .It Cm GSSAPIDelegateCredentials
- Forward (delegate) credentials to the server.
- The default is
- .Dq no .
--Note that this option applies to protocol version 2 only.
-+Note that this option applies to protocol version 2 connections using GSSAPI.
-+.It Cm GSSAPIRenewalForcesRekey
-+If set to 
-+.Dq yes
-+then renewal of the client's GSSAPI credentials will force the rekeying of the
-+ssh connection. With a compatible server, this can delegate the renewed 
-+credentials to a session on the server.
-+The default is
-+.Dq no .
-+.It Cm GSSAPITrustDns
-+Set to 
-+.Dq yes to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If 
-+.Dq no, the hostname entered on the

@@ Diff output truncated at 100000 characters. @@
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.



More information about the devel mailing list