From 5c316063420e90396c8b8d4b3a0243806df723ae Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Aug 28 2024 11:10:19 +0000
Subject: Merge patches from gsskex regressions


Related: RHEL-42635

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---

diff --git a/openssh-8.0p1-gssapi-keyex.patch b/openssh-8.0p1-gssapi-keyex.patch
index c609a00..1e5b888 100644
--- a/openssh-8.0p1-gssapi-keyex.patch
+++ b/openssh-8.0p1-gssapi-keyex.patch
@@ -1,55 +1,37 @@
-diff --git a/Makefile.in b/Makefile.in
-index e7549470..b68c1710 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
- 	kexgexc.o kexgexs.o \
- 	kexsntrup761x25519.o sntrup761.o kexgen.o \
-+	kexgssc.o \
- 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
- 	sshbuf-io.o
+diff --color -ruNp a/auth2.c b/auth2.c
+--- a/auth2.c	2024-08-28 12:35:01.189659493 +0200
++++ b/auth2.c	2024-08-28 12:35:41.246432045 +0200
+@@ -71,6 +71,7 @@ extern Authmethod method_passwd;
+ extern Authmethod method_kbdint;
+ extern Authmethod method_hostbased;
+ #ifdef GSSAPI
++extern Authmethod method_gsskeyex;
+ extern Authmethod method_gssapi;
+ #endif
  
-@@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
- 	auth2-chall.o groupaccess.o \
- 	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
- 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
--	monitor.o monitor_wrap.o auth-krb5.o \
-+	monitor.o monitor_wrap.o auth-krb5.o kexgsss.o \
- 	auth2-gss.o gss-serv.o gss-serv-krb5.o \
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
- 	sftp-server.o sftp-common.o \
-@@ -523,7 +523,7 @@ regress-prep:
- 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
+@@ -78,6 +79,7 @@ Authmethod *authmethods[] = {
+ 	&method_none,
+ 	&method_pubkey,
+ #ifdef GSSAPI
++	&method_gsskeyex,
+ 	&method_gssapi,
+ #endif
+ 	&method_passwd,
+diff --color -ruNp a/auth2-gss.c b/auth2-gss.c
+--- a/auth2-gss.c	2024-08-28 12:35:01.189659493 +0200
++++ b/auth2-gss.c	2024-08-28 12:35:41.265432411 +0200
+@@ -51,6 +51,7 @@
+ #define SSH_GSSAPI_MAX_MECHS	2048
  
- REGRESSLIBS=libssh.a $(LIBCOMPAT)
--TESTLIBS=$(LIBS) $(CHANNELLIBS)
-+TESTLIBS=$(LIBS) $(CHANNELLIBS) $(GSSLIBS)
+ extern ServerOptions options;
++extern struct authmethod_cfg methodcfg_gsskeyex;
+ extern struct authmethod_cfg methodcfg_gssapi;
  
- regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS)
- 	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \
-diff -up a/auth.c.gsskex b/auth.c
---- a/auth.c.gsskex	2021-08-20 06:03:49.000000000 +0200
-+++ b/auth.c	2021-08-27 12:41:51.262788953 +0200
-@@ -402,7 +402,8 @@ auth_root_allowed(struct ssh *ssh, const
- 	case PERMIT_NO_PASSWD:
- 		if (strcmp(method, "publickey") == 0 ||
- 		    strcmp(method, "hostbased") == 0 ||
--		    strcmp(method, "gssapi-with-mic") == 0)
-+		    strcmp(method, "gssapi-with-mic") == 0 ||
-+		    strcmp(method, "gssapi-keyex") == 0)
- 			return 1;
- 		break;
- 	case PERMIT_FORCED_ONLY:
-diff --git a/auth2-gss.c b/auth2-gss.c
-index 9351e042..d6446c0c 100644
---- a/auth2-gss.c
-+++ b/auth2-gss.c
-@@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
- static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
+ static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);
+@@ -59,6 +60,48 @@ static int input_gssapi_exchange_complet
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
  
-+/*
+ /*
 + * The 'gssapi_keyex' userauth mechanism.
 + */
 +static int
@@ -91,10 +73,11 @@ index 9351e042..d6446c0c 100644
 +	return (authenticated);
 +}
 +
- /*
++/*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -260,7 +302,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+  */
+@@ -267,7 +310,7 @@ input_gssapi_exchange_complete(int type,
  	if ((r = sshpkt_get_end(ssh)) != 0)
  		fatal_fr(r, "parse packet");
  
@@ -103,7 +86,7 @@ index 9351e042..d6446c0c 100644
  
  	authctxt->postponed = 0;
  	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
-@@ -306,7 +349,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -315,7 +358,7 @@ input_gssapi_mic(int type, u_int32_t ple
  	gssbuf.length = sshbuf_len(b);
  
  	if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))
@@ -112,16 +95,10 @@ index 9351e042..d6446c0c 100644
  	else
  		logit("GSSAPI MIC check failed");
  
-@@ -326,6 +370,17 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+@@ -333,6 +376,11 @@ input_gssapi_mic(int type, u_int32_t ple
  	return 0;
  }
  
-+struct authmethod_cfg methodcfg_gsskeyex = {
-+	"gssapi-keyex",
-+	NULL,
-+	&options.gss_authentication
-+};
-+
 +Authmethod method_gsskeyex = {
 +	&methodcfg_gsskeyex,
 +	userauth_gsskeyex,
@@ -130,30 +107,45 @@ index 9351e042..d6446c0c 100644
  Authmethod method_gssapi = {
  	&methodcfg_gssapi,
  	userauth_gssapi,
-diff --git a/auth2.c b/auth2.c
-index 0e776224..1c217268 100644
---- a/auth2.c
-+++ b/auth2.c
-@@ -73,6 +73,7 @@ extern Authmethod method_passwd;
- extern Authmethod method_kbdint;
- extern Authmethod method_hostbased;
+diff --color -ruNp a/auth2-methods.c b/auth2-methods.c
+--- a/auth2-methods.c	2024-07-01 06:36:28.000000000 +0200
++++ b/auth2-methods.c	2024-08-28 12:35:41.265432411 +0200
+@@ -50,6 +50,11 @@ struct authmethod_cfg methodcfg_pubkey =
+ 	&options.pubkey_authentication
+ };
  #ifdef GSSAPI
-+extern Authmethod method_gsskeyex;
- extern Authmethod method_gssapi;
- #endif
- 
-@@ -80,6 +81,7 @@ Authmethod *authmethods[] = {
- 	&method_none,
- 	&method_pubkey,
++struct authmethod_cfg methodcfg_gsskeyex = {
++	"gssapi-keyex",
++	NULL,
++	&options.gss_authentication
++};
+ struct authmethod_cfg methodcfg_gssapi = {
+ 	"gssapi-with-mic",
+ 	NULL,
+@@ -76,6 +81,7 @@ static struct authmethod_cfg *authmethod
+ 	&methodcfg_none,
+ 	&methodcfg_pubkey,
  #ifdef GSSAPI
-+	&method_gsskeyex,
- 	&method_gssapi,
++	&methodcfg_gsskeyex,
+ 	&methodcfg_gssapi,
  #endif
- 	&method_passwd,
-diff --git a/canohost.c b/canohost.c
-index abea9c6e..8e81b519 100644
---- a/canohost.c
-+++ b/canohost.c
+ 	&methodcfg_passwd,
+diff --color -ruNp a/auth.c b/auth.c
+--- a/auth.c	2024-07-01 06:36:28.000000000 +0200
++++ b/auth.c	2024-08-28 12:35:41.245432026 +0200
+@@ -356,7 +356,8 @@ auth_root_allowed(struct ssh *ssh, const
+ 	case PERMIT_NO_PASSWD:
+ 		if (strcmp(method, "publickey") == 0 ||
+ 		    strcmp(method, "hostbased") == 0 ||
+-		    strcmp(method, "gssapi-with-mic") == 0)
++		    strcmp(method, "gssapi-with-mic") == 0 ||
++		    strcmp(method, "gssapi-keyex") == 0)
+ 			return 1;
+ 		break;
+ 	case PERMIT_FORCED_ONLY:
+diff --color -ruNp a/canohost.c b/canohost.c
+--- a/canohost.c	2024-07-01 06:36:28.000000000 +0200
++++ b/canohost.c	2024-08-28 12:35:41.246432045 +0200
 @@ -35,6 +35,99 @@
  #include "canohost.h"
  #include "misc.h"
@@ -254,10 +246,9 @@ index abea9c6e..8e81b519 100644
  void
  ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
  {
-diff --git a/canohost.h b/canohost.h
-index 26d62855..0cadc9f1 100644
---- a/canohost.h
-+++ b/canohost.h
+diff --color -ruNp a/canohost.h b/canohost.h
+--- a/canohost.h	2024-07-01 06:36:28.000000000 +0200
++++ b/canohost.h	2024-08-28 12:35:41.246432045 +0200
 @@ -15,6 +15,9 @@
  #ifndef _CANOHOST_H
  #define _CANOHOST_H
@@ -268,11 +259,10 @@ index 26d62855..0cadc9f1 100644
  char		*get_peer_ipaddr(int);
  int		 get_peer_port(int);
  char		*get_local_ipaddr(int);
-diff --git a/clientloop.c b/clientloop.c
-index ebd0dbca..1bdac6a4 100644
---- a/clientloop.c
-+++ b/clientloop.c
-@@ -112,6 +112,10 @@
+diff --color -ruNp a/clientloop.c b/clientloop.c
+--- a/clientloop.c	2024-07-01 06:36:28.000000000 +0200
++++ b/clientloop.c	2024-08-28 12:35:41.246432045 +0200
+@@ -115,6 +115,10 @@
  #include "ssherr.h"
  #include "hostfile.h"
  
@@ -283,7 +273,7 @@ index ebd0dbca..1bdac6a4 100644
  /* Permitted RSA signature algorithms for UpdateHostkeys proofs */
  #define HOSTKEY_PROOF_RSA_ALGS	"rsa-sha2-512,rsa-sha2-256"
  
-@@ -1379,6 +1383,14 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
+@@ -1590,6 +1594,14 @@ client_loop(struct ssh *ssh, int have_pt
  		/* Do channel operations. */
  		channel_after_poll(ssh, pfd, npfd_active);
  
@@ -298,11 +288,10 @@ index ebd0dbca..1bdac6a4 100644
  		/* Buffer input from the connection.  */
  		if (conn_in_ready)
  			client_process_net_input(ssh);
-diff --git a/configure.ac b/configure.ac
-index b689db4b..efafb6bd 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -674,6 +674,30 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+diff --color -ruNp a/configure.ac b/configure.ac
+--- a/configure.ac	2024-08-28 12:35:01.202659743 +0200
++++ b/configure.ac	2024-08-28 12:35:41.247432064 +0200
+@@ -774,6 +774,30 @@ int main(void) { if (NSVersionOfRunTimeL
  	    [Use tunnel device compatibility to OpenBSD])
  	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
  	    [Prepend the address family to IP tunnel traffic])
@@ -333,11 +322,10 @@ index b689db4b..efafb6bd 100644
  	m4_pattern_allow([AU_IPv])
  	AC_CHECK_DECL([AU_IPv4], [],
  	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
-diff --git a/gss-genr.c b/gss-genr.c
-index d56257b4..763a63ff 100644
---- a/gss-genr.c
-+++ b/gss-genr.c
-@@ -41,9 +41,33 @@
+diff --color -ruNp a/gss-genr.c b/gss-genr.c
+--- a/gss-genr.c	2024-07-01 06:36:28.000000000 +0200
++++ b/gss-genr.c	2024-08-28 12:35:41.248432084 +0200
+@@ -42,9 +42,33 @@
  #include "sshbuf.h"
  #include "log.h"
  #include "ssh2.h"
@@ -371,7 +359,7 @@ index d56257b4..763a63ff 100644
  /* sshbuf_get for gss_buffer_desc */
  int
  ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
-@@ -62,6 +86,159 @@ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
+@@ -60,6 +84,159 @@ ssh_gssapi_get_buffer_desc(struct sshbuf
  	return 0;
  }
  
@@ -531,7 +519,7 @@ index d56257b4..763a63ff 100644
  /* Check that the OID in a data stream matches that in the context */
  int
  ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -218,7 +398,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
+@@ -216,7 +393,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int de
  	}
  
  	ctx->major = gss_init_sec_context(&ctx->minor,
@@ -540,11 +528,10 @@ index d56257b4..763a63ff 100644
  	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
  	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -247,9 +427,43 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
- 	return (ctx->major);
+@@ -246,8 +423,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, con
  }
  
-+OM_uint32
+ OM_uint32
 +ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)
 +{
 +	gss_buffer_desc gssbuf;
@@ -575,7 +562,7 @@ index d56257b4..763a63ff 100644
 +	return(ctx->major);
 +}
 +
- OM_uint32
++OM_uint32
  ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
  {
 +	if (ctx == NULL)
@@ -584,7 +571,7 @@ index d56257b4..763a63ff 100644
  	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
  	    GSS_C_QOP_DEFAULT, buffer, hash)))
  		ssh_gssapi_error(ctx);
-@@ -257,6 +471,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
+@@ -255,6 +466,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer
  	return (ctx->major);
  }
  
@@ -604,7 +591,7 @@ index d56257b4..763a63ff 100644
  void
  ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
      const char *context, const struct sshbuf *session_id)
-@@ -273,11 +500,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
+@@ -271,11 +495,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, co
  }
  
  int
@@ -622,7 +609,7 @@ index d56257b4..763a63ff 100644
  
  	/* RFC 4462 says we MUST NOT do SPNEGO */
  	if (oid->length == spnego_oid.length &&
-@@ -500,6 +500,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -285,6 +514,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  	ssh_gssapi_build_ctx(ctx);
  	ssh_gssapi_set_oid(*ctx, oid);
  	major = ssh_gssapi_import_name(*ctx, host);
@@ -633,7 +620,7 @@ index d56257b4..763a63ff 100644
  	if (!GSS_ERROR(major)) {
  		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token,
  		    NULL);
-@@ -527,10 +527,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
+@@ -294,10 +527,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  			    GSS_C_NO_BUFFER);
  	}
  
@@ -701,150 +688,9 @@ index d56257b4..763a63ff 100644
 +}
 +
  #endif /* GSSAPI */
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index a151bc1e..8d2b677f 100644
---- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv-krb5.c,v 1.9 2018/07/09 21:37:55 markus Exp $ */
- 
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -120,7 +120,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- 	krb5_error_code problem;
- 	krb5_principal princ;
- 	OM_uint32 maj_status, min_status;
--	int len;
-+	const char *new_ccname, *new_cctype;
- 	const char *errmsg;
- 
- 	if (client->creds == NULL) {
-@@ -180,11 +180,26 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- 		return;
- 	}
- 
--	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
-+	new_cctype = krb5_cc_get_type(krb_context, ccache);
-+	new_ccname = krb5_cc_get_name(krb_context, ccache);
-+
- 	client->store.envvar = "KRB5CCNAME";
--	len = strlen(client->store.filename) + 6;
--	client->store.envval = xmalloc(len);
--	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
-+#ifdef USE_CCAPI
-+	xasprintf(&client->store.envval, "API:%s", new_ccname);
-+	client->store.filename = NULL;
-+#else
-+	if (new_ccname[0] == ':')
-+		new_ccname++;
-+	xasprintf(&client->store.envval, "%s:%s", new_cctype, new_ccname);
-+	if (strcmp(new_cctype, "DIR") == 0) {
-+		char *p;
-+		p = strrchr(client->store.envval, '/');
-+		if (p)
-+			*p = '\0';
-+	}
-+	if ((strcmp(new_cctype, "FILE") == 0) || (strcmp(new_cctype, "DIR") == 0))
-+		client->store.filename = xstrdup(new_ccname);
-+#endif
- 
- #ifdef USE_PAM
- 	if (options.use_pam)
-@@ -193,9 +208,76 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- 
- 	krb5_cc_close(krb_context, ccache);
- 
-+	client->store.data = krb_context;
-+
- 	return;
- }
- 
-+int
-+ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store,
-+    ssh_gssapi_client *client)
-+{
-+	krb5_ccache ccache = NULL;
-+	krb5_principal principal = NULL;
-+	char *name = NULL;
-+	krb5_error_code problem;
-+	OM_uint32 maj_status, min_status;
-+
-+	if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
-+                logit("krb5_cc_resolve(): %.100s",
-+                    krb5_get_err_text(krb_context, problem));
-+                return 0;
-+	}
-+
-+	/* Find out who the principal in this cache is */
-+	if ((problem = krb5_cc_get_principal(krb_context, ccache,
-+	    &principal))) {
-+		logit("krb5_cc_get_principal(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	if ((problem = krb5_unparse_name(krb_context, principal, &name))) {
-+		logit("krb5_unparse_name(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+
-+	if (strcmp(name,client->exportedname.value)!=0) {
-+		debug("Name in local credentials cache differs. Not storing");
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		krb5_free_unparsed_name(krb_context, name);
-+		return 0;
-+	}
-+	krb5_free_unparsed_name(krb_context, name);
-+
-+	/* Name matches, so lets get on with it! */
-+
-+	if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) {
-+		logit("krb5_cc_initialize(): %.100s",
-+		    krb5_get_err_text(krb_context, problem));
-+		krb5_free_principal(krb_context, principal);
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	krb5_free_principal(krb_context, principal);
-+
-+	if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds,
-+	    ccache))) {
-+		logit("gss_krb5_copy_ccache() failed. Sorry!");
-+		krb5_cc_close(krb_context, ccache);
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
- ssh_gssapi_mech gssapi_kerberos_mech = {
- 	"toWM5Slw5Ew8Mqkay+al2g==",
- 	"Kerberos",
-@@ -203,7 +285,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
- 	NULL,
- 	&ssh_gssapi_krb5_userok,
- 	NULL,
--	&ssh_gssapi_krb5_storecreds
-+	&ssh_gssapi_krb5_storecreds,
-+	&ssh_gssapi_krb5_updatecreds
- };
- 
- #endif /* KRB5 */
-diff --git a/gss-serv.c b/gss-serv.c
-index ab3a15f0..6ce56e92 100644
---- a/gss-serv.c
-+++ b/gss-serv.c
+diff --color -ruNp a/gss-serv.c b/gss-serv.c
+--- a/gss-serv.c	2024-07-01 06:36:28.000000000 +0200
++++ b/gss-serv.c	2024-08-28 12:35:41.248432084 +0200
 @@ -1,7 +1,7 @@
  /* $OpenBSD: gss-serv.c,v 1.32 2020/03/13 03:17:07 djm Exp $ */
  
@@ -877,11 +723,10 @@ index ab3a15f0..6ce56e92 100644
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -140,6 +142,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
- 	return (ssh_gssapi_acquire_cred(*ctx));
+@@ -141,6 +143,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss
  }
  
-+/* Unprivileged */
+ /* Unprivileged */
 +char *
 +ssh_gssapi_server_mechanisms(void) {
 +	if (supported_oids == NULL)
@@ -904,10 +749,11 @@ index ab3a15f0..6ce56e92 100644
 +	return (res);
 +}
 +
- /* Unprivileged */
++/* Unprivileged */
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
-@@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
+ {
+@@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *o
  	gss_OID_set supported;
  
  	gss_create_empty_oid_set(&min_status, oidset);
@@ -933,15 +779,15 @@ index ab3a15f0..6ce56e92 100644
 +			debug("Rekeyed credentials have different mechanism");
 +			return GSS_S_COMPLETE;
 +		}
-+
+ 
+-	gss_buffer_desc ename;
 +		if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor,
 +		    ctx->client_creds, ctx->oid, &new_name,
 +		    NULL, NULL, NULL))) {
 +			ssh_gssapi_error(ctx);
 +			return (ctx->major);
 +		}
- 
--	gss_buffer_desc ename;
++
 +		ctx->major = gss_compare_name(&ctx->minor, client->name,
 +		    new_name, &equal);
 +
@@ -968,7 +814,7 @@ index ab3a15f0..6ce56e92 100644
  
  	client->mech = NULL;
  
-@@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  	if (client->mech == NULL)
  		return GSS_S_FAILURE;
  
@@ -982,7 +828,7 @@ index ab3a15f0..6ce56e92 100644
  	if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
  	    &client->displayname, NULL))) {
  		ssh_gssapi_error(ctx);
-@@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  		return (ctx->major);
  	}
  
@@ -991,7 +837,7 @@ index ab3a15f0..6ce56e92 100644
  	/* We can't copy this structure, so we just move the pointer to it */
  	client->creds = ctx->client_creds;
  	ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -319,11 +395,20 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
+@@ -319,11 +395,20 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  void
  ssh_gssapi_cleanup_creds(void)
  {
@@ -1017,7 +863,7 @@ index ab3a15f0..6ce56e92 100644
  	}
  }
  
-@@ -356,19 +441,23 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
+@@ -356,19 +441,23 @@ ssh_gssapi_do_child(char ***envp, u_int
  
  /* Privileged */
  int
@@ -1136,199 +982,162 @@ index ab3a15f0..6ce56e92 100644
  }
  
  /* Privileged */
-diff --git a/kex.c b/kex.c
-index a5ae6ac0..fe714141 100644
---- a/kex.c
-+++ b/kex.c
-@@ -698,6 +755,9 @@ kex_free(struct kex *kex)
- 	sshbuf_free(kex->server_version);
- 	sshbuf_free(kex->client_pub);
- 	sshbuf_free(kex->session_id);
-+#ifdef GSSAPI
-+	free(kex->gss_host);
-+#endif /* GSSAPI */
- 	sshbuf_free(kex->initial_sig);
- 	sshkey_free(kex->initial_hostkey);
- 	free(kex->failed_choice);
-diff --git a/kex-names.c b/kex-names.c
-index ce85f043..574c7609 100644
---- a/kex-names.c
-+++ b/kex-names.c
-@@ -57,6 +57,10 @@
- #include "ssherr.h"
- #include "xmalloc.h"
+diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
+--- a/gss-serv-krb5.c	2024-07-01 06:36:28.000000000 +0200
++++ b/gss-serv-krb5.c	2024-08-28 12:35:41.248432084 +0200
+@@ -1,7 +1,7 @@
+ /* $OpenBSD: gss-serv-krb5.c,v 1.9 2018/07/09 21:37:55 markus Exp $ */
  
-+#ifdef GSSAPI
-+#include "ssh-gss.h"
-+#endif
-+
- struct kexalg {
- 	char *name;
- 	u_int type;
-@@ -115,15 +120,28 @@ static const struct kexalg kexalgs[] = {
- #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
- 	{ NULL, 0, -1, -1},
- };
-+static const struct kexalg gss_kexalgs[] = {
-+#ifdef GSSAPI
-+	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
-+	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
-+	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
-+	{ KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
-+	{ KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
-+	{ KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256,
-+	    NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
-+	{ KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
+ /*
+- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
++ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+@@ -120,7 +120,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+ 	krb5_error_code problem;
+ 	krb5_principal princ;
+ 	OM_uint32 maj_status, min_status;
+-	int len;
++	const char *new_ccname, *new_cctype;
+ 	const char *errmsg;
+ 
+ 	if (client->creds == NULL) {
+@@ -180,11 +180,26 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+ 		return;
+ 	}
+ 
+-	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
++	new_cctype = krb5_cc_get_type(krb_context, ccache);
++	new_ccname = krb5_cc_get_name(krb_context, ccache);
++
+ 	client->store.envvar = "KRB5CCNAME";
+-	len = strlen(client->store.filename) + 6;
+-	client->store.envval = xmalloc(len);
+-	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
++#ifdef USE_CCAPI
++	xasprintf(&client->store.envval, "API:%s", new_ccname);
++	client->store.filename = NULL;
++#else
++	if (new_ccname[0] == ':')
++		new_ccname++;
++	xasprintf(&client->store.envval, "%s:%s", new_cctype, new_ccname);
++	if (strcmp(new_cctype, "DIR") == 0) {
++		char *p;
++		p = strrchr(client->store.envval, '/');
++		if (p)
++			*p = '\0';
++	}
++	if ((strcmp(new_cctype, "FILE") == 0) || (strcmp(new_cctype, "DIR") == 0))
++		client->store.filename = xstrdup(new_ccname);
 +#endif
-+	{ NULL, 0, -1, -1},
-+};
  
--char *
--kex_alg_list(char sep)
-+static char *
-+kex_alg_list_internal(char sep, const struct kexalg *algs)
- {
- 	char *ret = NULL, *tmp;
- 	size_t nlen, rlen = 0;
- 	const struct kexalg *k;
+ #ifdef USE_PAM
+ 	if (options.use_pam)
+@@ -193,9 +208,76 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  
--	for (k = kexalgs; k->name != NULL; k++) {
-+	for (k = algs; k->name != NULL; k++) {
- 		if (ret != NULL)
- 			ret[rlen++] = sep;
- 		nlen = strlen(k->name);
-@@ -138,6 +156,18 @@ kex_alg_list(char sep)
- 	return ret;
- }
+ 	krb5_cc_close(krb_context, ccache);
  
-+char *
-+kex_alg_list(char sep)
-+{
-+	return kex_alg_list_internal(sep, kexalgs);
-+}
-+
-+char *
-+kex_gss_alg_list(char sep)
-+{
-+	return kex_alg_list_internal(sep, gss_kexalgs);
-+}
++	client->store.data = krb_context;
 +
- static const struct kexalg *
- kex_alg_by_name(const char *name)
- {
-@@ -147,6 +177,10 @@ kex_alg_by_name(const char *name)
- 		if (strcmp(k->name, name) == 0)
- 			return k;
- 	}
-+	for (k = gss_kexalgs; k->name != NULL; k++) {
-+		if (strncmp(k->name, name, strlen(k->name)) == 0)
-+			return k;
-+	}
- 	return NULL;
+ 	return;
  }
  
-@@ -315,3 +349,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
- 	free(ret);
- 	return r;
- }
-+ 
-+/* Validate GSS KEX method name list */
 +int
-+kex_gss_names_valid(const char *names)
++ssh_gssapi_krb5_updatecreds(ssh_gssapi_ccache *store,
++    ssh_gssapi_client *client)
 +{
-+	char *s, *cp, *p;
++	krb5_ccache ccache = NULL;
++	krb5_principal principal = NULL;
++	char *name = NULL;
++	krb5_error_code problem;
++	OM_uint32 maj_status, min_status;
 +
-+	if (names == NULL || *names == '\0')
++	if ((problem = krb5_cc_resolve(krb_context, store->envval, &ccache))) {
++                logit("krb5_cc_resolve(): %.100s",
++                    krb5_get_err_text(krb_context, problem));
++                return 0;
++	}
++
++	/* Find out who the principal in this cache is */
++	if ((problem = krb5_cc_get_principal(krb_context, ccache,
++	    &principal))) {
++		logit("krb5_cc_get_principal(): %.100s",
++		    krb5_get_err_text(krb_context, problem));
++		krb5_cc_close(krb_context, ccache);
 +		return 0;
-+	s = cp = xstrdup(names);
-+	for ((p = strsep(&cp, ",")); p && *p != '\0';
-+	    (p = strsep(&cp, ","))) {
-+		if (strncmp(p, "gss-", 4) != 0
-+		  || kex_alg_by_name(p) == NULL) {
-+			error("Unsupported KEX algorithm \"%.100s\"", p);
-+			free(s);
-+			return 0;
-+		}
 +	}
-+	debug3("gss kex names ok: [%s]", names);
-+	free(s);
++
++	if ((problem = krb5_unparse_name(krb_context, principal, &name))) {
++		logit("krb5_unparse_name(): %.100s",
++		    krb5_get_err_text(krb_context, problem));
++		krb5_free_principal(krb_context, principal);
++		krb5_cc_close(krb_context, ccache);
++		return 0;
++	}
++
++
++	if (strcmp(name,client->exportedname.value)!=0) {
++		debug("Name in local credentials cache differs. Not storing");
++		krb5_free_principal(krb_context, principal);
++		krb5_cc_close(krb_context, ccache);
++		krb5_free_unparsed_name(krb_context, name);
++		return 0;
++	}
++	krb5_free_unparsed_name(krb_context, name);
++
++	/* Name matches, so lets get on with it! */
++
++	if ((problem = krb5_cc_initialize(krb_context, ccache, principal))) {
++		logit("krb5_cc_initialize(): %.100s",
++		    krb5_get_err_text(krb_context, problem));
++		krb5_free_principal(krb_context, principal);
++		krb5_cc_close(krb_context, ccache);
++		return 0;
++	}
++
++	krb5_free_principal(krb_context, principal);
++
++	if ((maj_status = gss_krb5_copy_ccache(&min_status, client->creds,
++	    ccache))) {
++		logit("gss_krb5_copy_ccache() failed. Sorry!");
++		krb5_cc_close(krb_context, ccache);
++		return 0;
++	}
++
 +	return 1;
 +}
-diff --git a/kex.h b/kex.h
-index a5ae6ac0..fe714141 100644
---- a/kex.h
-+++ b/kex.h
-@@ -102,6 +102,15 @@ enum kex_exchange {
- 	KEX_ECDH_SHA2,
- 	KEX_C25519_SHA256,
- 	KEX_KEM_SNTRUP761X25519_SHA512,
-+#ifdef GSSAPI
-+	KEX_GSS_GRP1_SHA1,
-+	KEX_GSS_GRP14_SHA1,
-+	KEX_GSS_GRP14_SHA256,
-+	KEX_GSS_GRP16_SHA512,
-+	KEX_GSS_GEX_SHA1,
-+	KEX_GSS_NISTP256_SHA256,
-+	KEX_GSS_C25519_SHA256,
-+#endif
- 	KEX_MAX
++
+ ssh_gssapi_mech gssapi_kerberos_mech = {
+ 	"toWM5Slw5Ew8Mqkay+al2g==",
+ 	"Kerberos",
+@@ -203,7 +285,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
+ 	NULL,
+ 	&ssh_gssapi_krb5_userok,
+ 	NULL,
+-	&ssh_gssapi_krb5_storecreds
++	&ssh_gssapi_krb5_storecreds,
++	&ssh_gssapi_krb5_updatecreds
  };
  
-@@ -153,6 +162,12 @@ struct kex {
- 	u_int	flags;
- 	int	hash_alg;
- 	int	ec_nid;
+ #endif /* KRB5 */
+diff --color -ruNp a/kex.c b/kex.c
+--- a/kex.c	2024-07-01 06:36:28.000000000 +0200
++++ b/kex.c	2024-08-28 12:35:41.249432103 +0200
+@@ -737,6 +737,9 @@ kex_free(struct kex *kex)
+ 	sshbuf_free(kex->server_version);
+ 	sshbuf_free(kex->client_pub);
+ 	sshbuf_free(kex->session_id);
 +#ifdef GSSAPI
-+	int	gss_deleg_creds;
-+	int	gss_trust_dns;
-+	char    *gss_host;
-+	char	*gss_client;
-+#endif
- 	char	*failed_choice;
- 	int	(*verify_host_key)(struct sshkey *, struct ssh *);
- 	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
-@@ -174,8 +189,10 @@ struct kex {
- int	 kex_nid_from_name(const char *);
- int	 kex_names_valid(const char *);
- char	*kex_alg_list(char);
-+char	*kex_gss_alg_list(char);
- char	*kex_names_cat(const char *, const char *);
- int	 kex_has_any_alg(const char *, const char *);
-+int	 kex_gss_names_valid(const char *);
- int	 kex_assemble_names(char **, const char *, const char *);
- void	 kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX],
-     const char *, const char *, const char *, const char *, const char *);
-@@ -202,6 +219,12 @@ int	 kexgex_client(struct ssh *);
- int	 kexgex_server(struct ssh *);
- int	 kex_gen_client(struct ssh *);
- int	 kex_gen_server(struct ssh *);
-+#if defined(GSSAPI) && defined(WITH_OPENSSL)
-+int	 kexgssgex_client(struct ssh *);
-+int	 kexgssgex_server(struct ssh *);
-+int	 kexgss_client(struct ssh *);
-+int	 kexgss_server(struct ssh *);
-+#endif
- 
- int	 kex_dh_keypair(struct kex *);
- int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
-@@ -234,6 +257,12 @@ int	 kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
-     const BIGNUM *, const u_char *, size_t,
-     u_char *, size_t *);
- 
-+int	 kex_gen_hash(int hash_alg, const struct sshbuf *client_version,
-+    const struct sshbuf *server_version, const struct sshbuf *client_kexinit,
-+    const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob,
-+    const struct sshbuf *client_pub, const struct sshbuf *server_pub,
-+    const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen);
-+
- void	kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
- 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
- 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
-diff --git a/kexdh.c b/kexdh.c
-index 67133e33..edaa4676 100644
---- a/kexdh.c
-+++ b/kexdh.c
-@@ -48,13 +48,23 @@ kex_dh_keygen(struct kex *kex)
++	free(kex->gss_host);
++#endif /* GSSAPI */
+ 	sshbuf_free(kex->initial_sig);
+ 	sshkey_free(kex->initial_hostkey);
+ 	free(kex->failed_choice);
+diff --color -ruNp a/kexdh.c b/kexdh.c
+--- a/kexdh.c	2024-07-01 06:36:28.000000000 +0200
++++ b/kexdh.c	2024-08-28 12:35:41.249432103 +0200
+@@ -49,13 +49,23 @@ kex_dh_keygen(struct kex *kex)
  {
  	switch (kex->kex_type) {
  	case KEX_DH_GRP1_SHA1:
@@ -1352,10 +1161,9 @@ index 67133e33..edaa4676 100644
  		kex->dh = dh_new_group16();
  		break;
  	case KEX_DH_GRP18_SHA512:
-diff --git a/kexgen.c b/kexgen.c
-index 69348b96..c0e8c2f4 100644
---- a/kexgen.c
-+++ b/kexgen.c
+diff --color -ruNp a/kexgen.c b/kexgen.c
+--- a/kexgen.c	2024-07-01 06:36:28.000000000 +0200
++++ b/kexgen.c	2024-08-28 12:35:41.249432103 +0200
 @@ -44,7 +44,7 @@
  static int input_kex_gen_init(int, u_int32_t, struct ssh *);
  static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
@@ -1365,11 +1173,9 @@ index 69348b96..c0e8c2f4 100644
  kex_gen_hash(
      int hash_alg,
      const struct sshbuf *client_version,
-diff --git a/kexgssc.c b/kexgssc.c
-new file mode 100644
-index 00000000..f6e1405e
---- /dev/null
-+++ b/kexgssc.c
+diff --color -ruNp a/kexgssc.c b/kexgssc.c
+--- a/kexgssc.c	1970-01-01 01:00:00.000000000 +0100
++++ b/kexgssc.c	2024-08-28 12:35:41.250432122 +0200
 @@ -0,0 +1,612 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1983,11 +1789,9 @@ index 00000000..f6e1405e
 +}
 +
 +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
-diff --git a/kexgsss.c b/kexgsss.c
-new file mode 100644
-index 00000000..60bc02de
---- /dev/null
-+++ b/kexgsss.c
+diff --color -ruNp a/kexgsss.c b/kexgsss.c
+--- a/kexgsss.c	1970-01-01 01:00:00.000000000 +0100
++++ b/kexgsss.c	2024-08-28 12:35:41.250432122 +0200
 @@ -0,0 +1,482 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -2471,21 +2275,221 @@ index 00000000..60bc02de
 +	return r;
 +}
 +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
-diff --git a/monitor.c b/monitor.c
-index 2ce89fe9..ebf76c7f 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -148,6 +148,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *);
- int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
- int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
- int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
-+int mm_answer_gss_sign(struct ssh *, int, struct sshbuf *);
-+int mm_answer_gss_updatecreds(struct ssh *, int, struct sshbuf *);
- #endif
- 
- #ifdef SSH_AUDIT_EVENTS
-@@ -220,11 +222,18 @@ struct mon_table mon_dispatch_proto20[] = {
-     {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
+diff --color -ruNp a/kex.h b/kex.h
+--- a/kex.h	2024-07-01 06:36:28.000000000 +0200
++++ b/kex.h	2024-08-28 12:35:41.249432103 +0200
+@@ -102,6 +102,15 @@ enum kex_exchange {
+ 	KEX_ECDH_SHA2,
+ 	KEX_C25519_SHA256,
+ 	KEX_KEM_SNTRUP761X25519_SHA512,
++#ifdef GSSAPI
++	KEX_GSS_GRP1_SHA1,
++	KEX_GSS_GRP14_SHA1,
++	KEX_GSS_GRP14_SHA256,
++	KEX_GSS_GRP16_SHA512,
++	KEX_GSS_GEX_SHA1,
++	KEX_GSS_NISTP256_SHA256,
++	KEX_GSS_C25519_SHA256,
++#endif
+ 	KEX_MAX
+ };
+ 
+@@ -164,6 +173,12 @@ struct kex {
+ 	u_int	flags;
+ 	int	hash_alg;
+ 	int	ec_nid;
++#ifdef GSSAPI
++	int	gss_deleg_creds;
++	int	gss_trust_dns;
++	char    *gss_host;
++	char	*gss_client;
++#endif
+ 	char	*failed_choice;
+ 	int	(*verify_host_key)(struct sshkey *, struct ssh *);
+ 	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
+@@ -189,8 +204,10 @@ int	 kex_hash_from_name(const char *);
+ int	 kex_nid_from_name(const char *);
+ int	 kex_names_valid(const char *);
+ char	*kex_alg_list(char);
++char	*kex_gss_alg_list(char);
+ char	*kex_names_cat(const char *, const char *);
+ int	 kex_has_any_alg(const char *, const char *);
++int	 kex_gss_names_valid(const char *);
+ int	 kex_assemble_names(char **, const char *, const char *);
+ void	 kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX],
+     const char *, const char *, const char *, const char *, const char *);
+@@ -224,6 +241,12 @@ int	 kexgex_client(struct ssh *);
+ int	 kexgex_server(struct ssh *);
+ int	 kex_gen_client(struct ssh *);
+ int	 kex_gen_server(struct ssh *);
++#if defined(GSSAPI) && defined(WITH_OPENSSL)
++int	 kexgssgex_client(struct ssh *);
++int	 kexgssgex_server(struct ssh *);
++int	 kexgss_client(struct ssh *);
++int	 kexgss_server(struct ssh *);
++#endif
+ 
+ int	 kex_dh_keypair(struct kex *);
+ int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
+@@ -256,6 +279,12 @@ int	 kexgex_hash(int, const struct sshbu
+     const BIGNUM *, const u_char *, size_t,
+     u_char *, size_t *);
+ 
++int	 kex_gen_hash(int hash_alg, const struct sshbuf *client_version,
++    const struct sshbuf *server_version, const struct sshbuf *client_kexinit,
++    const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob,
++    const struct sshbuf *client_pub, const struct sshbuf *server_pub,
++    const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen);
++
+ void	kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
+ 	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+ 	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+diff --color -ruNp a/kex-names.c b/kex-names.c
+--- a/kex-names.c	2024-07-01 06:36:28.000000000 +0200
++++ b/kex-names.c	2024-08-28 12:35:41.249432103 +0200
+@@ -45,6 +45,10 @@
+ #include "ssherr.h"
+ #include "xmalloc.h"
+ 
++#ifdef GSSAPI
++#include "ssh-gss.h"
++#endif
++
+ struct kexalg {
+ 	char *name;
+ 	u_int type;
+@@ -83,15 +87,28 @@ static const struct kexalg kexalgs[] = {
+ #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
+ 	{ NULL, 0, -1, -1},
+ };
++static const struct kexalg gss_kexalgs[] = {
++#ifdef GSSAPI
++	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
++	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
++	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
++	{ KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
++	{ KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
++	{ KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256,
++	    NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
++	{ KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
++#endif
++	{ NULL, 0, -1, -1},
++};
+ 
+-char *
+-kex_alg_list(char sep)
++static char *
++kex_alg_list_internal(char sep, const struct kexalg *algs)
+ {
+ 	char *ret = NULL, *tmp;
+ 	size_t nlen, rlen = 0;
+ 	const struct kexalg *k;
+ 
+-	for (k = kexalgs; k->name != NULL; k++) {
++	for (k = algs; k->name != NULL; k++) {
+ 		if (ret != NULL)
+ 			ret[rlen++] = sep;
+ 		nlen = strlen(k->name);
+@@ -106,6 +123,18 @@ kex_alg_list(char sep)
+ 	return ret;
+ }
+ 
++char *
++kex_alg_list(char sep)
++{
++	return kex_alg_list_internal(sep, kexalgs);
++}
++
++char *
++kex_gss_alg_list(char sep)
++{
++	return kex_alg_list_internal(sep, gss_kexalgs);
++}
++
+ static const struct kexalg *
+ kex_alg_by_name(const char *name)
+ {
+@@ -115,6 +144,10 @@ kex_alg_by_name(const char *name)
+ 		if (strcmp(k->name, name) == 0)
+ 			return k;
+ 	}
++	for (k = gss_kexalgs; k->name != NULL; k++) {
++		if (strncmp(k->name, name, strlen(k->name)) == 0)
++			return k;
++	}
+ 	return NULL;
+ }
+ 
+@@ -328,3 +361,26 @@ kex_assemble_names(char **listp, const c
+ 	free(ret);
+ 	return r;
+ }
++ 
++/* Validate GSS KEX method name list */
++int
++kex_gss_names_valid(const char *names)
++{
++	char *s, *cp, *p;
++
++	if (names == NULL || *names == '\0')
++		return 0;
++	s = cp = xstrdup(names);
++	for ((p = strsep(&cp, ",")); p && *p != '\0';
++	    (p = strsep(&cp, ","))) {
++		if (strncmp(p, "gss-", 4) != 0
++		  || kex_alg_by_name(p) == NULL) {
++			error("Unsupported KEX algorithm \"%.100s\"", p);
++			free(s);
++			return 0;
++		}
++	}
++	debug3("gss kex names ok: [%s]", names);
++	free(s);
++	return 1;
++}
+diff --color -ruNp a/Makefile.in b/Makefile.in
+--- a/Makefile.in	2024-08-28 12:35:01.200659705 +0200
++++ b/Makefile.in	2024-08-28 12:35:41.244432006 +0200
+@@ -114,6 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
+ 	kexgexc.o kexgexs.o \
+ 	kexsntrup761x25519.o sntrup761.o kexgen.o \
++	kexgssc.o \
+ 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
+ 	sshbuf-io.o
+ 
+@@ -135,7 +136,7 @@ SSHD_SESSION_OBJS=sshd-session.o auth-rh
+ 	auth2-chall.o groupaccess.o \
+ 	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
+ 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
+-	monitor.o monitor_wrap.o auth-krb5.o \
++	monitor.o monitor_wrap.o auth-krb5.o kexgsss.o \
+ 	auth2-gss.o gss-serv.o gss-serv-krb5.o \
+ 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
+ 	sftp-server.o sftp-common.o \
+@@ -529,7 +530,7 @@ regress-prep:
+ 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
+ 
+ REGRESSLIBS=libssh.a $(LIBCOMPAT)
+-TESTLIBS=$(LIBS) $(CHANNELLIBS)
++TESTLIBS=$(LIBS) $(CHANNELLIBS) $(GSSLIBS)
+ 
+ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS)
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \
+diff --color -ruNp a/monitor.c b/monitor.c
+--- a/monitor.c	2024-08-28 12:35:01.192659551 +0200
++++ b/monitor.c	2024-08-28 12:35:41.251432142 +0200
+@@ -143,6 +143,8 @@ int mm_answer_gss_setup_ctx(struct ssh *
+ int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *);
+ int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *);
++int mm_answer_gss_sign(struct ssh *, int, struct sshbuf *);
++int mm_answer_gss_updatecreds(struct ssh *, int, struct sshbuf *);
+ #endif
+ 
+ #ifdef SSH_AUDIT_EVENTS
+@@ -219,11 +221,18 @@ struct mon_table mon_dispatch_proto20[]
+     {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
 +    {MONITOR_REQ_GSSSIGN, MON_ONCE, mm_answer_gss_sign},
@@ -2503,7 +2507,7 @@ index 2ce89fe9..ebf76c7f 100644
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -293,6 +302,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor)
+@@ -292,6 +301,10 @@ monitor_child_preauth(struct ssh *ssh, s
  	/* Permit requests for moduli and signatures */
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2514,7 +2518,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	/* The first few requests do not require asynchronous access */
  	while (!authenticated) {
-@@ -376,8 +376,15 @@ monitor_child_preauth(struct ssh *ssh, s
+@@ -344,8 +357,15 @@ monitor_child_preauth(struct ssh *ssh, s
  		if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
  			auth_log(ssh, authenticated, partial,
  			    auth_method, auth_submethod);
@@ -2531,7 +2535,7 @@ index 2ce89fe9..ebf76c7f 100644
  			if (authenticated || partial) {
  				auth2_update_session_info(authctxt,
  				    auth_method, auth_submethod);
-@@ -406,6 +419,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor)
+@@ -413,6 +433,10 @@ monitor_child_postauth(struct ssh *ssh,
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2542,7 +2546,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if (auth_opts->permit_pty_flag) {
  		monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1713,6 +1730,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
+@@ -1793,6 +1817,17 @@ monitor_apply_keystate(struct ssh *ssh,
  # ifdef OPENSSL_HAS_ECC
  	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
  # endif
@@ -2560,7 +2564,7 @@ index 2ce89fe9..ebf76c7f 100644
  #endif /* WITH_OPENSSL */
  	kex->kex[KEX_C25519_SHA256] = kex_gen_server;
  	kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
-@@ -1806,8 +1834,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1885,8 +1920,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh,
  	u_char *p;
  	int r;
  
@@ -2571,7 +2575,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
  		fatal_fr(r, "parse");
-@@ -1839,8 +1867,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1918,8 +1953,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh
  	OM_uint32 flags = 0; /* GSI needs this */
  	int r;
  
@@ -2582,7 +2586,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
  		fatal_fr(r, "ssh_gssapi_get_buffer_desc");
-@@ -1860,6 +1888,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1939,6 +1974,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2590,7 +2594,7 @@ index 2ce89fe9..ebf76c7f 100644
  	}
  	return (0);
  }
-@@ -1871,8 +1900,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1950,8 +1986,8 @@ mm_answer_gss_checkmic(struct ssh *ssh,
  	OM_uint32 ret;
  	int r;
  
@@ -2601,7 +2605,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
  	    (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0)
-@@ -1898,13 +1927,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1977,13 +2013,17 @@ mm_answer_gss_checkmic(struct ssh *ssh,
  int
  mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
  {
@@ -2623,7 +2627,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	sshbuf_reset(m);
  	if ((r = sshbuf_put_u32(m, authenticated)) != 0)
-@@ -1913,7 +1946,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -1992,7 +2032,11 @@ mm_answer_gss_userok(struct ssh *ssh, in
  	debug3_f("sending result %d", authenticated);
  	mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
  
@@ -2636,7 +2640,7 @@ index 2ce89fe9..ebf76c7f 100644
  
  	if ((displayname = ssh_gssapi_displayname()) != NULL)
  		auth2_record_info(authctxt, "%s", displayname);
-@@ -1921,5 +1958,84 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m)
+@@ -2000,5 +2044,84 @@ mm_answer_gss_userok(struct ssh *ssh, in
  	/* Monitor loop will terminate if authenticated */
  	return (authenticated);
  }
@@ -2721,11 +2725,10 @@ index 2ce89fe9..ebf76c7f 100644
 +
  #endif /* GSSAPI */
  
-diff --git a/monitor.h b/monitor.h
-index 683e5e07..2b1a2d59 100644
---- a/monitor.h
-+++ b/monitor.h
-@@ -63,6 +63,8 @@ enum monitor_reqtype {
+diff --color -ruNp a/monitor.h b/monitor.h
+--- a/monitor.h	2024-08-28 12:35:01.192659551 +0200
++++ b/monitor.h	2024-08-28 12:35:41.251432142 +0200
+@@ -67,6 +67,8 @@ enum monitor_reqtype {
  	MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
  	MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
  
@@ -2734,11 +2737,10 @@ index 683e5e07..2b1a2d59 100644
  };
  
  struct ssh;
-diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 001a8fa1..6edb509a 100644
---- a/monitor_wrap.c
-+++ b/monitor_wrap.c
-@@ -993,13 +993,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+diff --color -ruNp a/monitor_wrap.c b/monitor_wrap.c
+--- a/monitor_wrap.c	2024-08-28 12:35:01.192659551 +0200
++++ b/monitor_wrap.c	2024-08-28 12:35:41.251432142 +0200
+@@ -1075,13 +1075,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
  }
  
  int
@@ -2755,7 +2757,7 @@ index 001a8fa1..6edb509a 100644
  
  	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
  	mm_request_receive_expect(pmonitor->m_recvfd,
-@@ -1012,6 +1014,59 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1094,6 +1096,59 @@ mm_ssh_gssapi_userok(char *user)
  	debug3_f("user %sauthenticated", authenticated ? "" : "not ");
  	return (authenticated);
  }
@@ -2815,11 +2817,10 @@ index 001a8fa1..6edb509a 100644
  #endif /* GSSAPI */
  
  /*
-diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 23ab096a..485590c1 100644
---- a/monitor_wrap.h
-+++ b/monitor_wrap.h
-@@ -64,8 +64,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t,
+diff --color -ruNp a/monitor_wrap.h b/monitor_wrap.h
+--- a/monitor_wrap.h	2024-08-28 12:35:01.193659570 +0200
++++ b/monitor_wrap.h	2024-08-28 12:35:41.251432142 +0200
+@@ -67,8 +67,10 @@ void mm_decode_activate_server_options(s
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
     gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
@@ -2831,10 +2832,54 @@ index 23ab096a..485590c1 100644
  #endif
  
  #ifdef USE_PAM
-diff -up a/readconf.c.gsskex b/readconf.c
---- a/readconf.c.gsskex	2021-08-20 06:03:49.000000000 +0200
-+++ b/readconf.c	2021-08-27 12:25:42.556421509 +0200
-@@ -67,6 +67,7 @@
+diff --color -ruNp a/packet.c b/packet.c
+--- a/packet.c	2024-07-01 06:36:28.000000000 +0200
++++ b/packet.c	2024-08-28 12:35:41.260432315 +0200
+@@ -1517,6 +1517,29 @@ ssh_packet_read(struct ssh *ssh)
+ 	return type;
+ }
+ 
++/*
++ * Waits until a packet has been received, verifies that its type matches
++ * that given, and gives a fatal error and exits if there is a mismatch.
++ */
++
++int
++ssh_packet_read_expect(struct ssh *ssh, u_int expected_type)
++{
++	int r;
++	u_char type;
++
++	if ((r = ssh_packet_read_seqnr(ssh, &type, NULL)) != 0)
++		return r;
++	if (type != expected_type) {
++		if ((r = sshpkt_disconnect(ssh,
++		    "Protocol error: expected packet type %d, got %d",
++		    expected_type, type)) != 0)
++			return r;
++		return SSH_ERR_PROTOCOL_ERROR;
++	}
++	return 0;
++}
++
+ static int
+ ssh_packet_read_poll2_mux(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ {
+diff --color -ruNp a/packet.h b/packet.h
+--- a/packet.h	2024-07-01 06:36:28.000000000 +0200
++++ b/packet.h	2024-08-28 12:35:41.260432315 +0200
+@@ -124,6 +124,7 @@ int	 ssh_packet_send2_wrapped(struct ssh
+ int	 ssh_packet_send2(struct ssh *);
+ 
+ int      ssh_packet_read(struct ssh *);
++int	 ssh_packet_read_expect(struct ssh *, u_int type);
+ int ssh_packet_read_poll2(struct ssh *, u_char *, u_int32_t *seqnr_p);
+ int	 ssh_packet_process_incoming(struct ssh *, const char *buf, u_int len);
+ int	 ssh_packet_process_read(struct ssh *, int);
+diff --color -ruNp a/readconf.c b/readconf.c
+--- a/readconf.c	2024-07-01 06:36:28.000000000 +0200
++++ b/readconf.c	2024-08-28 12:35:41.253432180 +0200
+@@ -70,6 +70,7 @@
  #include "uidswap.h"
  #include "myproposal.h"
  #include "digest.h"
@@ -2842,7 +2887,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  
  /* Format of the configuration file:
  
-@@ -161,6 +162,8 @@ typedef enum {
+@@ -164,6 +165,8 @@ typedef enum {
  	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
  	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
  	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
@@ -2851,7 +2896,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
  	oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
  	oHashKnownHosts,
-@@ -206,10 +209,22 @@ static struct {
+@@ -210,10 +213,22 @@ static struct {
  	/* Sometimes-unsupported options */
  #if defined(GSSAPI)
  	{ "gssapiauthentication", oGssAuthentication },
@@ -2874,7 +2919,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  #endif
  #ifdef ENABLE_PKCS11
  	{ "pkcs11provider", oPKCS11Provider },
-@@ -1113,10 +1128,42 @@ parse_time:
+@@ -1227,10 +1242,42 @@ parse_time:
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2917,7 +2962,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  	case oBatchMode:
  		intptr = &options->batch_mode;
  		goto parse_flag;
-@@ -2306,7 +2353,13 @@ initialize_options(Options * options)
+@@ -2542,7 +2589,13 @@ initialize_options(Options * options)
  	options->fwd_opts.streamlocal_bind_unlink = -1;
  	options->pubkey_authentication = -1;
  	options->gss_authentication = -1;
@@ -2931,7 +2976,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
-@@ -2463,8 +2516,18 @@ fill_default_options(Options * options)
+@@ -2705,8 +2758,18 @@ fill_default_options(Options * options)
  		options->pubkey_authentication = SSH_PUBKEY_AUTH_ALL;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -2950,7 +2995,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -3246,7 +3309,14 @@ dump_client_config(Options *o, const cha
+@@ -3533,7 +3596,14 @@ dump_client_config(Options *o, const cha
  	dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
  #ifdef GSSAPI
  	dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
@@ -2965,10 +3010,10 @@ diff -up a/readconf.c.gsskex b/readconf.c
  #endif /* GSSAPI */
  	dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
  	dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
-diff -up a/readconf.h.gsskex b/readconf.h
---- a/readconf.h.gsskex	2021-08-27 12:05:29.248142431 +0200
-+++ b/readconf.h	2021-08-27 12:22:19.270679852 +0200
-@@ -39,7 +39,13 @@ typedef struct {
+diff --color -ruNp a/readconf.h b/readconf.h
+--- a/readconf.h	2024-07-01 06:36:28.000000000 +0200
++++ b/readconf.h	2024-08-28 12:35:41.254432199 +0200
+@@ -40,7 +40,13 @@ typedef struct {
  	int     pubkey_authentication;	/* Try ssh2 pubkey authentication. */
  	int     hostbased_authentication;	/* ssh2's rhosts_rsa */
  	int     gss_authentication;	/* Try GSS authentication */
@@ -2982,10 +3027,10 @@ diff -up a/readconf.h.gsskex b/readconf.h
  	int     password_authentication;	/* Try password
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff -up a/servconf.c.gsskex b/servconf.c
---- a/servconf.c.gsskex	2021-08-20 06:03:49.000000000 +0200
-+++ b/servconf.c	2021-08-27 12:28:15.887735189 +0200
-@@ -70,6 +70,7 @@
+diff --color -ruNp a/servconf.c b/servconf.c
+--- a/servconf.c	2024-07-01 06:36:28.000000000 +0200
++++ b/servconf.c	2024-08-28 12:35:41.255432218 +0200
+@@ -68,6 +68,7 @@
  #include "auth.h"
  #include "myproposal.h"
  #include "digest.h"
@@ -2993,7 +3038,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  
  #if !defined(SSHD_PAM_SERVICE)
  # define SSHD_PAM_SERVICE		"sshd"
-@@ -136,8 +137,11 @@ initialize_server_options(ServerOptions
+@@ -137,8 +138,11 @@ initialize_server_options(ServerOptions
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
  	options->gss_authentication=-1;
@@ -3005,7 +3050,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->permit_empty_passwd = -1;
-@@ -356,10 +360,18 @@ fill_default_server_options(ServerOption
+@@ -376,10 +380,18 @@ fill_default_server_options(ServerOption
  		options->kerberos_get_afs_token = 0;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -3024,7 +3069,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -506,6 +518,7 @@ typedef enum {
+@@ -558,6 +570,7 @@ typedef enum {
  	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
@@ -3032,7 +3077,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  	sAcceptEnv, sSetEnv, sPermitTunnel,
  	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -587,12 +600,22 @@ static struct {
+@@ -643,12 +656,22 @@ static struct {
  #ifdef GSSAPI
  	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -3055,7 +3100,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
  	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
  	{ "challengeresponseauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, /* alias */
-@@ -1576,6 +1599,10 @@ process_server_config_line_depth(ServerO
+@@ -1585,6 +1608,10 @@ process_server_config_line_depth(ServerO
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -3066,7 +3111,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  	case sGssCleanupCreds:
  		intptr = &options->gss_cleanup_creds;
  		goto parse_flag;
-@@ -1584,6 +1611,22 @@ process_server_config_line_depth(ServerO
+@@ -1593,6 +1620,22 @@ process_server_config_line_depth(ServerO
  		intptr = &options->gss_strict_acceptor;
  		goto parse_flag;
  
@@ -3089,7 +3134,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -2892,6 +2935,10 @@ dump_config(ServerOptions *o)
+@@ -3178,6 +3221,10 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
  	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@@ -3100,11 +3145,10 @@ diff -up a/servconf.c.gsskex b/servconf.c
  #endif
  	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
  	dump_cfg_fmtint(sKbdInteractiveAuthentication,
-diff --git a/servconf.h b/servconf.h
-index 4202a2d0..3f47ea25 100644
---- a/servconf.h
-+++ b/servconf.h
-@@ -132,8 +132,11 @@ typedef struct {
+diff --color -ruNp a/servconf.h b/servconf.h
+--- a/servconf.h	2024-07-01 06:36:28.000000000 +0200
++++ b/servconf.h	2024-08-28 12:35:41.255432218 +0200
+@@ -149,8 +149,11 @@ typedef struct {
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@@ -3116,11 +3160,10 @@ index 4202a2d0..3f47ea25 100644
  	int     password_authentication;	/* If true, permit password
  						 * authentication. */
  	int     kbd_interactive_authentication;	/* If true, permit */
-diff --git a/session.c b/session.c
-index 8c0e54f7..06a33442 100644
---- a/session.c
-+++ b/session.c
-@@ -2678,13 +2678,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
+diff --color -ruNp a/session.c b/session.c
+--- a/session.c	2024-08-28 12:35:01.197659647 +0200
++++ b/session.c	2024-08-28 12:35:41.255432218 +0200
+@@ -2674,13 +2674,19 @@ do_cleanup(struct ssh *ssh, Authctxt *au
  
  #ifdef KRB5
  	if (options.kerberos_ticket_cleanup &&
@@ -3142,127 +3185,10 @@ index 8c0e54f7..06a33442 100644
  #endif
  
  	/* remove agent socket */
-diff --git a/ssh-gss.h b/ssh-gss.h
-index 36180d07..70dd3665 100644
---- a/ssh-gss.h
-+++ b/ssh-gss.h
-@@ -61,10 +61,34 @@
- 
- #define SSH_GSS_OIDTYPE 0x06
- 
-+#define SSH2_MSG_KEXGSS_INIT                            30
-+#define SSH2_MSG_KEXGSS_CONTINUE                        31
-+#define SSH2_MSG_KEXGSS_COMPLETE                        32
-+#define SSH2_MSG_KEXGSS_HOSTKEY                         33
-+#define SSH2_MSG_KEXGSS_ERROR                           34
-+#define SSH2_MSG_KEXGSS_GROUPREQ			40
-+#define SSH2_MSG_KEXGSS_GROUP				41
-+#define KEX_GSS_GRP1_SHA1_ID				"gss-group1-sha1-"
-+#define KEX_GSS_GRP14_SHA1_ID				"gss-group14-sha1-"
-+#define KEX_GSS_GRP14_SHA256_ID			"gss-group14-sha256-"
-+#define KEX_GSS_GRP16_SHA512_ID			"gss-group16-sha512-"
-+#define KEX_GSS_GEX_SHA1_ID				"gss-gex-sha1-"
-+#define KEX_GSS_NISTP256_SHA256_ID			"gss-nistp256-sha256-"
-+#define KEX_GSS_C25519_SHA256_ID			"gss-curve25519-sha256-"
-+
-+#define        GSS_KEX_DEFAULT_KEX \
-+	KEX_GSS_GRP14_SHA256_ID "," \
-+	KEX_GSS_GRP16_SHA512_ID	"," \
-+	KEX_GSS_NISTP256_SHA256_ID "," \
-+	KEX_GSS_C25519_SHA256_ID "," \
-+	KEX_GSS_GRP14_SHA1_ID "," \
-+	KEX_GSS_GEX_SHA1_ID
-+
- typedef struct {
- 	char *filename;
- 	char *envvar;
- 	char *envval;
-+	struct passwd *owner;
- 	void *data;
- } ssh_gssapi_ccache;
- 
-@@ -72,8 +92,11 @@ typedef struct {
- 	gss_buffer_desc displayname;
- 	gss_buffer_desc exportedname;
- 	gss_cred_id_t creds;
-+	gss_name_t name;
- 	struct ssh_gssapi_mech_struct *mech;
- 	ssh_gssapi_ccache store;
-+	int used;
-+	int updated;
- } ssh_gssapi_client;
- 
- typedef struct ssh_gssapi_mech_struct {
-@@ -84,6 +107,7 @@ typedef struct ssh_gssapi_mech_struct {
- 	int (*userok) (ssh_gssapi_client *, char *);
- 	int (*localname) (ssh_gssapi_client *, char **);
- 	void (*storecreds) (ssh_gssapi_client *);
-+	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
- } ssh_gssapi_mech;
- 
- typedef struct {
-@@ -94,10 +118,11 @@ typedef struct {
- 	gss_OID		oid; /* client */
- 	gss_cred_id_t	creds; /* server */
- 	gss_name_t	client; /* server */
--	gss_cred_id_t	client_creds; /* server */
-+	gss_cred_id_t	client_creds; /* both */
- } Gssctxt;
- 
- extern ssh_gssapi_mech *supported_mechs[];
-+extern Gssctxt *gss_kex_context;
- 
- int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
- void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -109,6 +134,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *);
- 
- struct sshbuf;
- int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
-+int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *);
- 
- OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
- OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
-@@ -123,17 +149,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
- OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_buildmic(struct sshbuf *, const char *,
-     const char *, const char *, const struct sshbuf *);
--int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
-+int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
-+OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
-+int ssh_gssapi_credentials_updated(Gssctxt *);
- 
- /* In the server */
-+typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *,
-+    const char *);
-+char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *);
-+char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
-+    const char *, const char *);
-+gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
-+int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *,
-+    const char *);
- OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
--int ssh_gssapi_userok(char *name);
-+int ssh_gssapi_userok(char *name, struct passwd *, int kex);
- OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_do_child(char ***, u_int *);
- void ssh_gssapi_cleanup_creds(void);
- void ssh_gssapi_storecreds(void);
- const char *ssh_gssapi_displayname(void);
- 
-+char *ssh_gssapi_server_mechanisms(void);
-+int ssh_gssapi_oid_table_ok(void);
-+
-+int ssh_gssapi_update_creds(ssh_gssapi_ccache *store);
-+void ssh_gssapi_rekey_creds(void);
-+
- #endif /* GSSAPI */
- 
- #endif /* _SSH_GSS_H */
-diff --git a/ssh.1 b/ssh.1
-index 60de6087..db5c65bc 100644
---- a/ssh.1
-+++ b/ssh.1
-@@ -503,7 +503,13 @@ For full details of the options listed below, and their possible values, see
+diff --color -ruNp a/ssh.1 b/ssh.1
+--- a/ssh.1	2024-08-28 12:35:01.207659840 +0200
++++ b/ssh.1	2024-08-28 12:35:41.256432238 +0200
+@@ -536,7 +536,13 @@ For full details of the options listed b
  .It GatewayPorts
  .It GlobalKnownHostsFile
  .It GSSAPIAuthentication
@@ -3276,7 +3202,7 @@ index 60de6087..db5c65bc 100644
  .It HashKnownHosts
  .It Host
  .It HostbasedAcceptedAlgorithms
-@@ -624,6 +624,8 @@
+@@ -624,6 +630,8 @@ flag),
  (supported message integrity codes),
  .Ar kex
  (key exchange algorithms),
@@ -3285,11 +3211,10 @@ index 60de6087..db5c65bc 100644
  .Ar key
  (key types),
  .Ar key-ca-sign
-diff --git a/ssh.c b/ssh.c
-index 15aee569..110cf9c1 100644
---- a/ssh.c
-+++ b/ssh.c
-@@ -747,6 +747,8 @@ main(int ac, char **av)
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2024-07-01 06:36:28.000000000 +0200
++++ b/ssh.c	2024-08-28 12:35:41.256432238 +0200
+@@ -827,6 +827,8 @@ main(int ac, char **av)
  			else if (strcmp(optarg, "kex") == 0 ||
  			    strcasecmp(optarg, "KexAlgorithms") == 0)
  				cp = kex_alg_list('\n');
@@ -3298,7 +3223,7 @@ index 15aee569..110cf9c1 100644
  			else if (strcmp(optarg, "key") == 0)
  				cp = sshkey_alg_list(0, 0, 0, '\n');
  			else if (strcmp(optarg, "key-cert") == 0)
-@@ -772,8 +774,8 @@ main(int ac, char **av)
+@@ -857,8 +859,8 @@ main(int ac, char **av)
  			} else if (strcmp(optarg, "help") == 0) {
  				cp = xstrdup(
  				    "cipher\ncipher-auth\ncompression\nkex\n"
@@ -3309,10 +3234,9 @@ index 15aee569..110cf9c1 100644
  			}
  			if (cp == NULL)
  				fatal("Unsupported query \"%s\"", optarg);
-diff --git a/ssh_config b/ssh_config
-index 5e8ef548..1ff999b6 100644
---- a/ssh_config
-+++ b/ssh_config
+diff --color -ruNp a/ssh_config b/ssh_config
+--- a/ssh_config	2024-08-28 12:35:01.216660014 +0200
++++ b/ssh_config	2024-08-28 12:35:41.256432238 +0200
 @@ -24,6 +24,8 @@
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
@@ -3322,11 +3246,10 @@ index 5e8ef548..1ff999b6 100644
  #   BatchMode no
  #   CheckHostIP no
  #   AddressFamily any
-diff --git a/ssh_config.5 b/ssh_config.5
-index 06a32d31..3f490697 100644
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -766,10 +766,68 @@ The default is
+diff --color -ruNp a/ssh_config.5 b/ssh_config.5
+--- a/ssh_config.5	2024-07-01 06:36:28.000000000 +0200
++++ b/ssh_config.5	2024-08-28 12:35:41.257432257 +0200
+@@ -938,10 +938,68 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -3395,11 +3318,10 @@ index 06a32d31..3f490697 100644
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-diff --git a/sshconnect2.c b/sshconnect2.c
-index af00fb30..03bc87eb 100644
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -163,6 +161,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
+--- a/sshconnect2.c	2024-07-01 06:36:28.000000000 +0200
++++ b/sshconnect2.c	2024-08-28 12:35:41.258432276 +0200
+@@ -222,6 +222,11 @@ ssh_kex2(struct ssh *ssh, char *host, st
  	char *all_key, *hkalgs = NULL;
  	int r, use_known_hosts_order = 0;
  
@@ -3411,11 +3333,10 @@ index af00fb30..03bc87eb 100644
  	xxx_host = host;
  	xxx_hostaddr = hostaddr;
  	xxx_conn_info = cinfo;
-@@ -206,6 +209,42 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- 	    options.kex_algorithms, options.ciphers, options.macs,
+@@ -255,6 +260,42 @@ ssh_kex2(struct ssh *ssh, char *host, st
  	    compression_alg_list(options.compression),
  	    hkalgs ? hkalgs : options.hostkeyalgorithms);
-+
+ 
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +	if (options.gss_keyex) {
 +		/* Add the GSSAPI mechanisms currently supported on this
@@ -3451,10 +3372,11 @@ index af00fb30..03bc87eb 100644
 +		}
 +	}
 +#endif
- 
++
  	free(hkalgs);
  
-@@ -224,14 +256,44 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+ 	/* start key exchange */
+@@ -271,14 +312,44 @@ ssh_kex2(struct ssh *ssh, char *host, st
  # ifdef OPENSSL_HAS_ECC
  	ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
  # endif
@@ -3500,7 +3422,7 @@ index af00fb30..03bc87eb 100644
  #ifdef DEBUG_KEXDH
  	/* send 1st encrypted/maced/compressed message */
  	if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 ||
-@@ -330,6 +392,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
+@@ -368,6 +439,7 @@ static int input_gssapi_response(int typ
  static int input_gssapi_token(int type, u_int32_t, struct ssh *);
  static int input_gssapi_error(int, u_int32_t, struct ssh *);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
@@ -3508,7 +3430,7 @@ index af00fb30..03bc87eb 100644
  #endif
  
  void	userauth(struct ssh *, char *);
-@@ -346,6 +409,11 @@ static char *authmethods_get(void);
+@@ -384,6 +456,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -3520,7 +3442,7 @@ index af00fb30..03bc87eb 100644
  	{"gssapi-with-mic",
  		userauth_gssapi,
  		userauth_gssapi_cleanup,
-@@ -716,12 +784,32 @@ userauth_gssapi(struct ssh *ssh)
+@@ -755,12 +832,32 @@ userauth_gssapi(struct ssh *ssh)
  	OM_uint32 min;
  	int r, ok = 0;
  	gss_OID mech = NULL;
@@ -3554,7 +3476,7 @@ index af00fb30..03bc87eb 100644
  
  	/* Check to see whether the mechanism is usable before we offer it */
  	while (authctxt->mech_tried < authctxt->gss_supported_mechs->count &&
-@@ -730,13 +811,15 @@ userauth_gssapi(struct ssh *ssh)
+@@ -769,13 +866,15 @@ userauth_gssapi(struct ssh *ssh)
  		    elements[authctxt->mech_tried];
  		/* My DER encoding requires length<128 */
  		if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt,
@@ -3571,7 +3493,7 @@ index af00fb30..03bc87eb 100644
  	if (!ok || mech == NULL)
  		return 0;
  
-@@ -976,6 +1059,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh)
+@@ -1009,6 +1108,55 @@ input_gssapi_error(int type, u_int32_t p
  	free(lang);
  	return r;
  }
@@ -3627,11 +3549,10 @@ index af00fb30..03bc87eb 100644
  #endif /* GSSAPI */
  
  static int
-diff --git a/sshd.c b/sshd.c
-index 60b2aaf7..d92f03aa 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -1852,7 +1852,8 @@ main(int ac, char **av)
+diff --color -ruNp a/sshd.c b/sshd.c
+--- a/sshd.c	2024-07-01 06:36:28.000000000 +0200
++++ b/sshd.c	2024-08-28 12:35:41.258432276 +0200
+@@ -1551,7 +1551,8 @@ main(int ac, char **av)
  		free(fp);
  	}
  	accumulate_host_timing_secret(cfg, NULL);
@@ -3641,11 +3562,70 @@ index 60b2aaf7..d92f03aa 100644
  		logit("sshd: no hostkeys available -- exiting.");
  		exit(1);
  	}
-diff --git a/sshd-session.c b/sshd-session.c
-index 60b2aaf7..d92f03aa 100644
---- a/sshd-session.c
-+++ b/sshd-session.c
-@@ -817,8 +817,8 @@ notify_hostkeys(struct ssh *ssh)
+diff --color -ruNp a/sshd_config b/sshd_config
+--- a/sshd_config	2024-08-28 12:35:01.221660110 +0200
++++ b/sshd_config	2024-08-28 12:35:41.259432296 +0200
+@@ -77,6 +77,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ # GSSAPI options
+ #GSSAPIAuthentication no
+ #GSSAPICleanupCredentials yes
++#GSSAPIStrictAcceptorCheck yes
++#GSSAPIKeyExchange no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing,
+ # and session processing. If this is enabled, PAM authentication will
+diff --color -ruNp a/sshd_config.5 b/sshd_config.5
+--- a/sshd_config.5	2024-08-28 12:35:01.218660052 +0200
++++ b/sshd_config.5	2024-08-28 12:35:41.259432296 +0200
+@@ -739,6 +739,11 @@ Specifies whether to automatically destr
+ on logout.
+ The default is
+ .Cm yes .
++.It Cm GSSAPIKeyExchange
++Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
++doesn't rely on ssh keys to verify host identity.
++The default is
++.Cm no .
+ .It Cm GSSAPIStrictAcceptorCheck
+ Determines whether to be strict about the identity of the GSSAPI acceptor
+ a client authenticates against.
+@@ -753,6 +758,32 @@ machine's default store.
+ This facility is provided to assist with operation on multi homed machines.
+ The default is
+ .Cm yes .
++.It Cm GSSAPIStoreCredentialsOnRekey
++Controls whether the user's GSSAPI credentials should be updated following a
++successful connection rekeying. This option can be used to accepted renewed
++or updated credentials from a compatible client. The default is
++.Dq no .
++.Pp
++For this to work
++.Cm GSSAPIKeyExchange
++needs to be enabled in the server and also used by the client.
++.It Cm GSSAPIKexAlgorithms
++The list of key exchange algorithms that are accepted by GSSAPI
++key exchange. Possible values are
++.Bd -literal -offset 3n
++gss-gex-sha1-,
++gss-group1-sha1-,
++gss-group14-sha1-,
++gss-group14-sha256-,
++gss-group16-sha512-,
++gss-nistp256-sha256-,
++gss-curve25519-sha256-
++.Ed
++.Pp
++The default is
++.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
++gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
++This option only applies to connections using GSSAPI.
+ .It Cm HostbasedAcceptedAlgorithms
+ Specifies the signature algorithms that will be accepted for hostbased
+ authentication as a list of comma-separated patterns.
+diff --color -ruNp a/sshd-session.c b/sshd-session.c
+--- a/sshd-session.c	2024-08-28 12:35:01.221660110 +0200
++++ b/sshd-session.c	2024-08-28 12:35:41.263432373 +0200
+@@ -660,8 +660,8 @@ notify_hostkeys(struct ssh *ssh)
  	}
  	debug3_f("sent %u hostkeys", nkeys);
  	if (nkeys == 0)
@@ -3656,7 +3636,19 @@ index 60b2aaf7..d92f03aa 100644
  		sshpkt_fatal(ssh, r, "%s: send", __func__);
  	sshbuf_free(buf);
  }
-@@ -2347,6 +2348,48 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -1180,8 +1180,9 @@ main(int ac, char **av)
+ 			break;
+ 		}
+ 	}
+-	if (!have_key)
+-		fatal("internal error: monitor received no hostkeys");
++	/* The GSSAPI key exchange can run without a host key */
++	if (!have_key && !options.gss_keyex)
++		fatal("internal error: monitor received no hostkeys and GSS KEX is not configured");
+ 
+ 	/* Ensure that umask disallows at least group and world write */
+ 	new_umask = umask(0077) | 0022;
+@@ -1462,6 +1463,48 @@ do_ssh2_kex(struct ssh *ssh)
  
  	free(hkalgs);
  
@@ -3683,7 +3675,7 @@ index 60b2aaf7..d92f03aa 100644
 +	if (gss && orig)
 +		xasprintf(&newstr, "%s,%s", gss, orig);
 +	else if (gss)
-+		newstr = gss;
++		xasprintf(&newstr, "%s,%s", gss, "kex-strict-s-v00@openssh.com");
 +	else if (orig)
 +		newstr = orig;
 +
@@ -3693,7 +3685,7 @@ index 60b2aaf7..d92f03aa 100644
 +	 * host key algorithm we support
 +	 */
 +	if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0)
-+		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null";
++		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = xstrdup("null");
 +
 +	if (newstr)
 +		myproposal[PROPOSAL_KEX_ALGS] = newstr;
@@ -3705,7 +3697,7 @@ index 60b2aaf7..d92f03aa 100644
  	/* start key exchange */
  	if ((r = kex_setup(ssh, myproposal)) != 0)
  		fatal_r(r, "kex_setup");
-@@ -2362,7 +2405,18 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -1479,7 +1522,18 @@ do_ssh2_kex(struct ssh *ssh)
   #ifdef OPENSSL_HAS_ECC
  	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
   #endif
@@ -3725,77 +3717,128 @@ index 60b2aaf7..d92f03aa 100644
  	kex->kex[KEX_C25519_SHA256] = kex_gen_server;
  	kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server;
  	kex->load_host_public_key=&get_hostkey_public_by_type;
-diff --git a/sshd_config b/sshd_config
-index 19b7c91a..2c48105f 100644
---- a/sshd_config
-+++ b/sshd_config
-@@ -69,6 +69,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
- # GSSAPI options
- #GSSAPIAuthentication no
- #GSSAPICleanupCredentials yes
-+#GSSAPIStrictAcceptorCheck yes
-+#GSSAPIKeyExchange no
+diff --color -ruNp a/ssh-gss.h b/ssh-gss.h
+--- a/ssh-gss.h	2024-07-01 06:36:28.000000000 +0200
++++ b/ssh-gss.h	2024-08-28 12:35:41.256432238 +0200
+@@ -61,10 +61,34 @@
  
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
-diff --git a/sshd_config.5 b/sshd_config.5
-index 70ccea44..f6b41a2f 100644
---- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -646,6 +646,11 @@ Specifies whether to automatically destroy the user's credentials cache
- on logout.
- The default is
- .Cm yes .
-+.It Cm GSSAPIKeyExchange
-+Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
-+doesn't rely on ssh keys to verify host identity.
-+The default is
-+.Cm no .
- .It Cm GSSAPIStrictAcceptorCheck
- Determines whether to be strict about the identity of the GSSAPI acceptor
- a client authenticates against.
-@@ -660,6 +665,32 @@ machine's default store.
- This facility is provided to assist with operation on multi homed machines.
- The default is
- .Cm yes .
-+.It Cm GSSAPIStoreCredentialsOnRekey
-+Controls whether the user's GSSAPI credentials should be updated following a
-+successful connection rekeying. This option can be used to accepted renewed
-+or updated credentials from a compatible client. The default is
-+.Dq no .
-+.Pp
-+For this to work
-+.Cm GSSAPIKeyExchange
-+needs to be enabled in the server and also used by the client.
-+.It Cm GSSAPIKexAlgorithms
-+The list of key exchange algorithms that are accepted by GSSAPI
-+key exchange. Possible values are
-+.Bd -literal -offset 3n
-+gss-gex-sha1-,
-+gss-group1-sha1-,
-+gss-group14-sha1-,
-+gss-group14-sha256-,
-+gss-group16-sha512-,
-+gss-nistp256-sha256-,
-+gss-curve25519-sha256-
-+.Ed
-+.Pp
-+The default is
-+.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
-+gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
-+This option only applies to connections using GSSAPI.
- .It Cm HostbasedAcceptedAlgorithms
- Specifies the signature algorithms that will be accepted for hostbased
- authentication as a list of comma-separated patterns.
-diff --git a/sshkey.c b/sshkey.c
-index 57995ee6..fd5b7724 100644
---- a/sshkey.c
-+++ b/sshkey.c
-@@ -127,6 +127,75 @@ static const struct keytype keytypes[] = {
- extern const struct sshkey_impl sshkey_xmss_impl;
+ #define SSH_GSS_OIDTYPE 0x06
+ 
++#define SSH2_MSG_KEXGSS_INIT                            30
++#define SSH2_MSG_KEXGSS_CONTINUE                        31
++#define SSH2_MSG_KEXGSS_COMPLETE                        32
++#define SSH2_MSG_KEXGSS_HOSTKEY                         33
++#define SSH2_MSG_KEXGSS_ERROR                           34
++#define SSH2_MSG_KEXGSS_GROUPREQ			40
++#define SSH2_MSG_KEXGSS_GROUP				41
++#define KEX_GSS_GRP1_SHA1_ID				"gss-group1-sha1-"
++#define KEX_GSS_GRP14_SHA1_ID				"gss-group14-sha1-"
++#define KEX_GSS_GRP14_SHA256_ID			"gss-group14-sha256-"
++#define KEX_GSS_GRP16_SHA512_ID			"gss-group16-sha512-"
++#define KEX_GSS_GEX_SHA1_ID				"gss-gex-sha1-"
++#define KEX_GSS_NISTP256_SHA256_ID			"gss-nistp256-sha256-"
++#define KEX_GSS_C25519_SHA256_ID			"gss-curve25519-sha256-"
++
++#define        GSS_KEX_DEFAULT_KEX \
++	KEX_GSS_GRP14_SHA256_ID "," \
++	KEX_GSS_GRP16_SHA512_ID	"," \
++	KEX_GSS_NISTP256_SHA256_ID "," \
++	KEX_GSS_C25519_SHA256_ID "," \
++	KEX_GSS_GRP14_SHA1_ID "," \
++	KEX_GSS_GEX_SHA1_ID
++
+ typedef struct {
+ 	char *filename;
+ 	char *envvar;
+ 	char *envval;
++	struct passwd *owner;
+ 	void *data;
+ } ssh_gssapi_ccache;
+ 
+@@ -72,8 +96,11 @@ typedef struct {
+ 	gss_buffer_desc displayname;
+ 	gss_buffer_desc exportedname;
+ 	gss_cred_id_t creds;
++	gss_name_t name;
+ 	struct ssh_gssapi_mech_struct *mech;
+ 	ssh_gssapi_ccache store;
++	int used;
++	int updated;
+ } ssh_gssapi_client;
+ 
+ typedef struct ssh_gssapi_mech_struct {
+@@ -84,6 +111,7 @@ typedef struct ssh_gssapi_mech_struct {
+ 	int (*userok) (ssh_gssapi_client *, char *);
+ 	int (*localname) (ssh_gssapi_client *, char **);
+ 	void (*storecreds) (ssh_gssapi_client *);
++	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
+ } ssh_gssapi_mech;
+ 
+ typedef struct {
+@@ -94,10 +122,11 @@ typedef struct {
+ 	gss_OID		oid; /* client */
+ 	gss_cred_id_t	creds; /* server */
+ 	gss_name_t	client; /* server */
+-	gss_cred_id_t	client_creds; /* server */
++	gss_cred_id_t	client_creds; /* both */
+ } Gssctxt;
+ 
+ extern ssh_gssapi_mech *supported_mechs[];
++extern Gssctxt *gss_kex_context;
+ 
+ int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
+ void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
+@@ -108,6 +137,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(
+ 
+ struct sshbuf;
+ int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *);
++int ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *, gss_buffer_desc *);
+ 
+ OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
+ OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
+@@ -122,17 +152,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
+ OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
+ void ssh_gssapi_buildmic(struct sshbuf *, const char *,
+     const char *, const char *, const struct sshbuf *);
+-int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
++int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
++OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
++int ssh_gssapi_credentials_updated(Gssctxt *);
+ 
+ /* In the server */
++typedef int ssh_gssapi_check_fn(Gssctxt **, gss_OID, const char *,
++    const char *);
++char *ssh_gssapi_client_mechanisms(const char *, const char *, const char *);
++char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, const char *,
++    const char *, const char *);
++gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int);
++int ssh_gssapi_server_check_mech(Gssctxt **,gss_OID, const char *,
++    const char *);
+ OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
+-int ssh_gssapi_userok(char *name);
++int ssh_gssapi_userok(char *name, struct passwd *, int kex);
+ OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
+ void ssh_gssapi_do_child(char ***, u_int *);
+ void ssh_gssapi_cleanup_creds(void);
+ void ssh_gssapi_storecreds(void);
+ const char *ssh_gssapi_displayname(void);
+ 
++char *ssh_gssapi_server_mechanisms(void);
++int ssh_gssapi_oid_table_ok(void);
++
++int ssh_gssapi_update_creds(ssh_gssapi_ccache *store);
++void ssh_gssapi_rekey_creds(void);
++
+ #endif /* GSSAPI */
+ 
+ #endif /* _SSH_GSS_H */
+diff --color -ruNp a/sshkey.c b/sshkey.c
+--- a/sshkey.c	2024-07-01 06:36:28.000000000 +0200
++++ b/sshkey.c	2024-08-28 12:35:41.260432315 +0200
+@@ -131,6 +131,75 @@ extern const struct sshkey_impl sshkey_x
  extern const struct sshkey_impl sshkey_xmss_cert_impl;
  #endif
-+
+ 
 +static int ssh_gss_equal(const struct sshkey *, const struct sshkey *)
 +{
 +	return SSH_ERR_FEATURE_UNSUPPORTED;
@@ -3864,10 +3907,11 @@ index 57995ee6..fd5b7724 100644
 +	/* .keybits = */	0, /* FIXME */
 +	/* .funcs = */		&sshkey_gss_funcs,
 +};
- 
++
  const struct sshkey_impl * const keyimpls[] = {
  	&sshkey_ed25519_impl,
-@@ -154,6 +154,7 @@ static const struct keytype keytypes[] = {
+ 	&sshkey_ed25519_cert_impl,
+@@ -169,6 +238,7 @@ const struct sshkey_impl * const keyimpl
  	&sshkey_xmss_impl,
  	&sshkey_xmss_cert_impl,
  #endif
@@ -3875,7 +3919,7 @@ index 57995ee6..fd5b7724 100644
  	NULL
  };
  
-@@ -255,7 +256,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
+@@ -324,7 +394,7 @@ sshkey_alg_list(int certs_only, int plai
  
  	for (i = 0; keyimpls[i] != NULL; i++) {
  		impl = keyimpls[i];
@@ -3884,11 +3928,10 @@ index 57995ee6..fd5b7724 100644
  			continue;
  		if (!include_sigonly && impl->sigonly)
  			continue;
-diff --git a/sshkey.h b/sshkey.h
-index 71a3fddc..37a43a67 100644
---- a/sshkey.h
-+++ b/sshkey.h
-@@ -69,6 +69,7 @@ enum sshkey_types {
+diff --color -ruNp a/sshkey.h b/sshkey.h
+--- a/sshkey.h	2024-07-01 06:36:28.000000000 +0200
++++ b/sshkey.h	2024-08-28 12:35:41.260432315 +0200
+@@ -71,6 +71,7 @@ enum sshkey_types {
  	KEY_ECDSA_SK_CERT,
  	KEY_ED25519_SK,
  	KEY_ED25519_SK_CERT,
@@ -3896,47 +3939,3 @@ index 71a3fddc..37a43a67 100644
  	KEY_UNSPEC
  };
  
-diff --git a/packet.h b/packet.h
---- a/packet.h	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/packet.h	(date 1703172586447)
-@@ -124,6 +124,7 @@
- int	 ssh_packet_send2(struct ssh *);
-
- int      ssh_packet_read(struct ssh *);
-+int	 ssh_packet_read_expect(struct ssh *, u_int type);
- int ssh_packet_read_poll2(struct ssh *, u_char *, u_int32_t *seqnr_p);
- int	 ssh_packet_process_incoming(struct ssh *, const char *buf, u_int len);
- int	 ssh_packet_process_read(struct ssh *, int);
-diff --git a/packet.c b/packet.c
---- a/packet.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
-+++ b/packet.c	(date 1703172586447)
-@@ -1425,6 +1416,29 @@
- 	return type;
- }
-
-+/*
-+ * Waits until a packet has been received, verifies that its type matches
-+ * that given, and gives a fatal error and exits if there is a mismatch.
-+ */
-+
-+int
-+ssh_packet_read_expect(struct ssh *ssh, u_int expected_type)
-+{
-+	int r;
-+	u_char type;
-+
-+	if ((r = ssh_packet_read_seqnr(ssh, &type, NULL)) != 0)
-+		return r;
-+	if (type != expected_type) {
-+		if ((r = sshpkt_disconnect(ssh,
-+		    "Protocol error: expected packet type %d, got %d",
-+		    expected_type, type)) != 0)
-+			return r;
-+		return SSH_ERR_PROTOCOL_ERROR;
-+	}
-+	return 0;
-+}
-+
- static int
- ssh_packet_read_poll2_mux(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
- {
diff --git a/openssh.spec b/openssh.spec
index 64d401a..6240116 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -202,9 +202,6 @@ Patch1014: openssh-8.7p1-nohostsha1proof.patch
 
 Patch1015: openssh-9.6p1-pam-rhost.patch
 
-Patch1016: openssh-9.8p1-gsskex-regression.patch
-Patch1017: openssh-9.8p1-gsskeyex-authmethod.patch
-
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
 
@@ -382,9 +379,6 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 
 %patch -P 100 -p1 -b .coverity
 
-%patch -P 1016 -p1 -b .gss-regression
-%patch -P 1017 -p1 -b .gsskeyex-authmethod
-
 autoreconf
 
 %build