the .local domain example should be in ssh_config, not in sshd_config

6.4p1-8 + 0.9.3-1
Add missing documentation link to systemd service files (RHBZ#1181593)
2015-03-11 11:43:08 +01:00 · 2015-01-15 15:27:59 +01:00 · 2015-01-15 15:27:59 +01:00 · 2015-01-15 15:27:59 +01:00 · 2015-01-15 15:27:59 +01:00 · 2015-01-15 15:27:59 +01:00
115 changed files with 14901 additions and 18552 deletions
--- a/.gitignore
+++ b/.gitignore
@ -12,36 +12,3 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
 /openssh-6.2p2.tar.gz
 /openssh-6.3p1.tar.gz
 /openssh-6.4p1.tar.gz
-/openssh-6.6p1.tar.gz
-/openssh-6.7p1.tar.gz
-/openssh-6.8p1.tar.gz
-/openssh-6.9p1.tar.gz
-/openssh-7.0p1.tar.gz
-/openssh-7.1p1.tar.gz
-/openssh-7.1p2.tar.gz
-/pam_ssh_agent_auth-0.10.2.tar.bz2
-/openssh-7.2p1.tar.gz
-/openssh-7.2p2.tar.gz
-/openssh-7.3p1.tar.gz
-/openssh-7.4p1.tar.gz
-/pam_ssh_agent_auth-0.10.3.tar.bz2
-/openssh-7.5p1.tar.gz
-/openssh-7.6p1.tar.gz
-/openssh-7.7p1.tar.gz
-/openssh-7.7p1.tar.gz.asc
-/DJM-GPG-KEY.gpg
-/openssh-7.8p1.tar.gz
-/openssh-7.8p1.tar.gz.asc
-/openssh-7.9p1.tar.gz
-/openssh-7.9p1.tar.gz.asc
-/openssh-8.0p1.tar.gz
-/openssh-8.0p1.tar.gz.asc
-/openssh-8.1p1.tar.gz
-/openssh-8.1p1.tar.gz.asc
-/openssh-8.2p1.tar.gz
-/openssh-8.2p1.tar.gz.asc
-/openssh-8.3p1.tar.gz
-/openssh-8.3p1.tar.gz.asc
-/openssh-8.4p1.tar.gz
-/openssh-8.4p1.tar.gz.asc
-/pam_ssh_agent_auth-0.10.4.tar.gz
--- a/openssh-4.3p2-askpass-grab-info.patch
+++ b/openssh-4.3p2-askpass-grab-info.patch
@ -1,8 +1,7 @@
-diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.grab-info openssh-7.4p1/contrib/gnome-ssh-askpass2.c
--- openssh-7.4p1/contrib/gnome-ssh-askpass2.c.grab-info	2016-12-23 13:31:22.645213115 +0100
-+++ openssh-7.4p1/contrib/gnome-ssh-askpass2.c	2016-12-23 13:31:40.997216691 +0100
-@@ -65,9 +65,12 @@ report_failed_grab (GtkWidget *parent_wi
- 	err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
+--- openssh-4.3p2/contrib/gnome-ssh-askpass2.c.grab-info	2006-07-17 15:10:11.000000000 +0200
+++ openssh-4.3p2/contrib/gnome-ssh-askpass2.c	2006-07-17 15:25:04.000000000 +0200
+@@ -65,9 +65,12 @@
+ 	err = gtk_message_dialog_new(NULL, 0,
 				     GTK_MESSAGE_ERROR,
 				     GTK_BUTTONS_CLOSE,
 -				     "Could not grab %s. "
@ -15,5 +14,5 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.grab-info openssh-7.4p1/cont
 +				     "Either close the application which grabs the %s or "
 +				     "log out and log in again to prevent this from happening.", what, what);
 	gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER);
- 
- 	gtk_dialog_run(GTK_DIALOG(err));
+ 	gtk_label_set_line_wrap(GTK_LABEL((GTK_MESSAGE_DIALOG(err))->label),
+ 				TRUE);
--- a/openssh-5.1p1-askpass-progress.patch
+++ b/openssh-5.1p1-askpass-progress.patch
@ -1,16 +1,16 @@
-diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contrib/gnome-ssh-askpass2.c
--- openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/contrib/gnome-ssh-askpass2.c	2016-12-23 13:31:16.545211926 +0100
+diff -up openssh-5.1p1/contrib/gnome-ssh-askpass2.c.progress openssh-5.1p1/contrib/gnome-ssh-askpass2.c
+--- openssh-5.1p1/contrib/gnome-ssh-askpass2.c.progress	2008-07-23 19:05:26.000000000 +0200
+++ openssh-5.1p1/contrib/gnome-ssh-askpass2.c	2008-07-23 19:05:26.000000000 +0200
@@ -53,6 +53,7 @@
+ #include <string.h>
 #include <unistd.h>
- 
 #include <X11/Xlib.h>
 +#include <glib.h>
 #include <gtk/gtk.h>
 #include <gdk/gdkx.h>
- #include <gdk/gdkkeysyms.h>
-@@ -81,14 +82,25 @@ ok_dialog(GtkWidget *entry, gpointer dia
- 	return 1;
+ 
+@@ -83,13 +84,24 @@ ok_dialog(GtkWidget *entry, gpointer dia
+ 	gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK);
 }
 
 +static void
@ -25,59 +25,55 @@ diff -up openssh-7.4p1/contrib/gnome-ssh-askpass2.c.progress openssh-7.4p1/contr
 +}
 +
 static int
- passphrase_dialog(char *message, int prompt_type)
+ passphrase_dialog(char *message)
 {
 	const char *failed;
 	char *passphrase, *local;
 	int result, grab_tries, grab_server, grab_pointer;
- 	int buttons, default_response;
-	GtkWidget *parent_window, *dialog, *entry;
-+	GtkWidget *parent_window, *dialog, *entry, *progress, *hbox;
+-	GtkWidget *dialog, *entry;
+	GtkWidget *dialog, *entry, *progress, *hbox;
 	GdkGrabStatus status;
- 	GdkColor fg, bg;
- 	int fg_set = 0, bg_set = 0;
-@@ -104,14 +116,19 @@ passphrase_dialog(char *message)
- 		gtk_widget_modify_bg(dialog, GTK_STATE_NORMAL, &bg);
 
- 	if (prompt_type == PROMPT_ENTRY || prompt_type == PROMPT_NONE) {
-+		hbox = gtk_hbox_new(FALSE, 0);
-+		gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), hbox, FALSE,
-+		    FALSE, 0);
-+		gtk_widget_show(hbox);
-+
-		entry = gtk_entry_new();
-		if (fg_set)
-			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
-		if (bg_set)
-			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
-		gtk_box_pack_start(
-		    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
-		    entry, FALSE, FALSE, 0);
-+		    GTK_BOX(hbox), entry, TRUE, FALSE, 0);
-+		gtk_entry_set_width_chars(GTK_ENTRY(entry), 2);
- 		gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
- 		gtk_widget_grab_focus(entry);
- 		if (prompt_type == PROMPT_ENTRY) {
-@@ -130,6 +145,22 @@ passphrase_dialog(char *message)
- 			g_signal_connect(G_OBJECT(entry), "key_press_event",
- 			                 G_CALLBACK(check_none), dialog);
- 		}
-+
-+		hbox = gtk_hbox_new(FALSE, 0);
-+		gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox),
-+		    hbox, FALSE, FALSE, 8);
-+		gtk_widget_show(hbox);
-+
-+		progress = gtk_progress_bar_new();
-+
-+		gtk_progress_bar_set_text(GTK_PROGRESS_BAR(progress),
-+		    "Passphrase length hidden intentionally");
-+		gtk_box_pack_start(GTK_BOX(hbox), progress, TRUE,
-+		    TRUE, 5);
-+		gtk_widget_show(progress);
-+		g_signal_connect(G_OBJECT(entry), "changed",
-+				 G_CALLBACK(move_progress), progress);
-+
- 	}
+ 	grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL);
+@@ -102,13 +114,31 @@ passphrase_dialog(char *message)
+ 					"%s",
+ 					message);
+ 
+	hbox = gtk_hbox_new(FALSE, 0);
+	gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), hbox, FALSE,
+	    FALSE, 0);
+	gtk_widget_show(hbox);
+
+ 	entry = gtk_entry_new();
+-	gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), entry, FALSE,
+	gtk_box_pack_start(GTK_BOX(hbox), entry, TRUE,
+ 	    FALSE, 0);
+	gtk_entry_set_width_chars(GTK_ENTRY(entry), 2);
+ 	gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
+ 	gtk_widget_grab_focus(entry);
+ 	gtk_widget_show(entry);
+ 
+	hbox = gtk_hbox_new(FALSE, 0);
+	gtk_box_pack_start(GTK_BOX(GTK_DIALOG(dialog)->vbox), hbox, FALSE,
+	    FALSE, 8);
+	gtk_widget_show(hbox);
+
+	progress = gtk_progress_bar_new();
+	
+	gtk_progress_bar_set_text(GTK_PROGRESS_BAR(progress), "Passphrase length hidden intentionally");
+	gtk_box_pack_start(GTK_BOX(hbox), progress, TRUE,
+	    TRUE, 5);
+	gtk_widget_show(progress);
+
+ 	gtk_window_set_title(GTK_WINDOW(dialog), "OpenSSH");
+ 	gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER);
+ 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
+@@ -119,6 +149,8 @@ passphrase_dialog(char *message)
+ 	gtk_dialog_set_default_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK);
+ 	g_signal_connect(G_OBJECT(entry), "activate",
+ 			 G_CALLBACK(ok_dialog), dialog);
+	g_signal_connect(G_OBJECT(entry), "changed",
+			 G_CALLBACK(move_progress), progress);
+ 
+ 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
 
- 	/* Grab focus */
--- a/openssh-5.1p1-scp-manpage.patch
+++ b/openssh-5.1p1-scp-manpage.patch
@ -0,0 +1,18 @@
+diff -up openssh-5.1p1/scp.1.manpage openssh-5.1p1/scp.1
+--- openssh-5.1p1/scp.1.manpage	2008-07-12 09:12:49.000000000 +0200
+++ openssh-5.1p1/scp.1	2008-07-23 19:18:15.000000000 +0200
+@@ -66,6 +66,14 @@ treating file names containing
+ as host specifiers.
+ Copies between two remote hosts are also permitted.
+ .Pp
+When copying a source file to a target file which already exists,
+.Nm 
+will replace the contents of the target file (keeping the inode).
+.Pp
+If the target file does not yet exist, an empty file with the target
+file name is created, then filled with the source file contents.
+No attempt is made at "near-atomic" transfer using temporary files.
+.Pp
+ The options are as follows:
+ .Bl -tag -width Ds
+ .It Fl 1
--- a/openssh-5.2p1-allow-ip-opts.patch
+++ b/openssh-5.2p1-allow-ip-opts.patch
@ -0,0 +1,37 @@
+diff -up openssh-5.2p1/canohost.c.ip-opts openssh-5.2p1/canohost.c
+--- openssh-5.2p1/canohost.c.ip-opts	2009-02-14 06:28:21.000000000 +0100
+++ openssh-5.2p1/canohost.c	2009-09-01 15:31:29.000000000 +0200
+@@ -169,12 +169,27 @@ check_ip_options(int sock, char *ipaddr)
+ 	option_size = sizeof(options);
+ 	if (getsockopt(sock, ipproto, IP_OPTIONS, options,
+ 	    &option_size) >= 0 && option_size != 0) {
+-		text[0] = '\0';
+-		for (i = 0; i < option_size; i++)
+-			snprintf(text + i*3, sizeof(text) - i*3,
+-			    " %2.2x", options[i]);
+-		fatal("Connection from %.100s with IP options:%.800s",
+-		    ipaddr, text);
+		i = 0;
+		do {
+			switch (options[i]) {
+				case 0:
+				case 1:
+					++i;
+					break;
+				case 131:
+				case 137:
+				/* Fail, fatally, if we detect either loose or strict
+			 	 * source routing options. */
+					text[0] = '\0';
+					for (i = 0; i < option_size; i++)
+						snprintf(text + i*3, sizeof(text) - i*3,
+							" %2.2x", options[i]);
+					fatal("Connection from %.100s with IP options:%.800s",
+						ipaddr, text);
+				default:
+					i += options[i + 1];
+			}
+		} while (i < option_size);
+ 	}
+ #endif /* IP_OPTIONS */
+ }
--- a/openssh-5.5p1-x11.patch
+++ b/openssh-5.5p1-x11.patch
@ -1,7 +1,7 @@
-diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
--- openssh-7.2p2/channels.c.x11	2016-03-09 19:04:48.000000000 +0100
-+++ openssh-7.2p2/channels.c	2016-06-03 10:42:04.775164520 +0200
-@@ -3990,21 +3990,24 @@ x11_create_display_inet(int x11_display_
+diff -up openssh-5.3p1/channels.c.bz595935 openssh-5.3p1/channels.c
+--- openssh-5.3p1/channels.c.bz595935	2010-08-12 14:19:28.000000000 +0200
+++ openssh-5.3p1/channels.c	2010-08-12 14:33:51.000000000 +0200
+@@ -3185,7 +3185,7 @@ x11_create_display_inet(int x11_display_
 }
 
 static int
@ -10,16 +10,14 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
 {
 	int sock;
 	struct sockaddr_un addr;
- 
-+	if (len <= 0)
-+		return -1;
- 	sock = socket(AF_UNIX, SOCK_STREAM, 0);
- 	if (sock == -1)
+@@ -3195,11 +3195,14 @@ connect_local_xsocket_path(const char *p
 		error("socket: %.100s", strerror(errno));
 	memset(&addr, 0, sizeof(addr));
 	addr.sun_family = AF_UNIX;
 -	strlcpy(addr.sun_path, pathname, sizeof addr.sun_path);
 -	if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0)
+	if (len <= 0)
+		return -1;
 +	if (len > sizeof addr.sun_path)
 +		len = sizeof addr.sun_path;
 +	memcpy(addr.sun_path, pathname, len);
@ -30,13 +28,16 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
 	return -1;
 }
 
-@@ -4012,8 +4015,18 @@ static int
+@@ -3207,8 +3210,21 @@ static int
 connect_local_xsocket(u_int dnr)
 {
 	char buf[1024];
 -	snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr);
 -	return connect_local_xsocket_path(buf);
-+	int len, ret;
+	int len;
+#ifdef linux
+	int ret;
+#endif
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
 +	/* try abstract socket first */
@ -50,4 +51,4 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
 +	return -1;
 }
 
- #ifdef __APPLE__
+ int
--- a/openssh-5.6p1-exit-deadlock.patch
+++ b/openssh-5.6p1-exit-deadlock.patch
@ -0,0 +1,14 @@
+diff -up openssh-5.6p1/channels.c.exit-deadlock openssh-5.6p1/channels.c
+--- openssh-5.6p1/channels.c.exit-deadlock	2010-08-05 15:09:48.000000000 +0200
+++ openssh-5.6p1/channels.c	2010-08-23 12:41:43.000000000 +0200
+@@ -1647,6 +1647,10 @@ channel_handle_wfd(Channel *c, fd_set *r
+ 	u_int dlen, olen = 0;
+ 	int len;
+ 
+	if(c->wfd != -1 && buffer_len(&c->output) > 0 && c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
+		debug("channel %d: forcing write", c->self);
+		FD_SET(c->wfd, writeset);
+	}
+ 	/* Send buffered output data to the socket. */
+ 	if (c->wfd != -1 &&
+ 	    FD_ISSET(c->wfd, writeset) &&
--- a/openssh-5.8p1-getaddrinfo.patch
+++ b/openssh-5.8p1-getaddrinfo.patch
@ -0,0 +1,24 @@
+diff -up openssh-5.6p1/channels.c.getaddrinfo openssh-5.6p1/channels.c
+--- openssh-5.6p1/channels.c.getaddrinfo	2012-02-14 16:12:54.427852524 +0100
+++ openssh-5.6p1/channels.c	2012-02-14 16:13:22.818928690 +0100
+@@ -3275,6 +3275,9 @@ x11_create_display_inet(int x11_display_
+ 		memset(&hints, 0, sizeof(hints));
+ 		hints.ai_family = IPv4or6;
+ 		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
+#ifdef AI_ADDRCONFIG
+		hints.ai_flags |= AI_ADDRCONFIG;
+#endif
+ 		hints.ai_socktype = SOCK_STREAM;
+ 		snprintf(strport, sizeof strport, "%d", port);
+ 		if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
+diff -up openssh-5.6p1/sshconnect.c.getaddrinfo openssh-5.6p1/sshconnect.c
+--- openssh-5.6p1/sshconnect.c.getaddrinfo	2012-02-14 16:09:25.057964291 +0100
+++ openssh-5.6p1/sshconnect.c	2012-02-14 16:09:25.106047007 +0100
+@@ -343,6 +343,7 @@ ssh_connect(const char *host, struct soc
+ 	memset(&hints, 0, sizeof(hints));
+ 	hints.ai_family = family;
+ 	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_flags = AI_V4MAPPED | AI_ADDRCONFIG;
+ 	snprintf(strport, sizeof strport, "%u", port);
+ 	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
+ 		fatal("%s: Could not resolve hostname %.100s: %s", __progname,
--- a/openssh-5.8p1-glob.patch
+++ b/openssh-5.8p1-glob.patch
@ -0,0 +1,10 @@
+diff -up openssh-5.8p1/sftp-glob.c.glob openssh-5.8p1/sftp-glob.c
+--- openssh-5.8p1/sftp-glob.c.glob	2011-03-07 20:17:34.000000000 +0100
+++ openssh-5.8p1/sftp-glob.c	2011-03-07 20:18:47.000000000 +0100
+@@ -145,5 +145,5 @@ remote_glob(struct sftp_conn *conn, cons
+ 	memset(&cur, 0, sizeof(cur));
+ 	cur.conn = conn;
+ 
+-	return(glob(pattern, flags | GLOB_ALTDIRFUNC, errfunc, pglob));
+	return(glob(pattern, flags | GLOB_LIMIT | GLOB_ALTDIRFUNC, errfunc, pglob));
+ }
--- a/openssh-5.8p1-keyperm.patch
+++ b/openssh-5.8p1-keyperm.patch
@ -0,0 +1,25 @@
+diff -up openssh-5.8p1/authfile.c.keyperm openssh-5.8p1/authfile.c
+--- openssh-5.8p1/authfile.c.keyperm	2010-12-01 02:03:39.000000000 +0100
+++ openssh-5.8p1/authfile.c	2011-04-21 16:43:36.859648916 +0200
+@@ -57,6 +57,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <unistd.h>
+#include <grp.h>
+ 
+ #include "xmalloc.h"
+ #include "cipher.h"
+@@ -600,6 +612,13 @@ key_perm_ok(int fd, const char *filename
+ #ifdef HAVE_CYGWIN
+ 	if (check_ntsec(filename))
+ #endif
+	if (st.st_mode & 040) {
+		struct group *gr;
+
+		if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid))
+			st.st_mode &= ~040;
+	}
+
+ 	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
+ 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
+ 		error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");
--- a/openssh-5.8p1-localdomain.patch
+++ b/openssh-5.8p1-localdomain.patch
@ -0,0 +1,11 @@
+diff --git a/ssh_config b/ssh_config
+--- a/ssh_config
+++ b/ssh_config
+@@ -48,3 +48,7 @@
+ #   VisualHostKey no
+ #   ProxyCommand ssh -q -W %h:%p gateway.example.com
+ #   RekeyLimit 1G 1h
+#
+# Uncomment this if you want to use .local domain
+#Host *.local
+#	CheckHostIP no
--- a/openssh-5.8p1-packet.patch
+++ b/openssh-5.8p1-packet.patch
@ -0,0 +1,12 @@
+diff -up openssh-5.8p1/packet.c.packet openssh-5.8p1/packet.c
+--- openssh-5.8p1/packet.c.packet	2011-04-05 13:29:06.998648899 +0200
+++ openssh-5.8p1/packet.c	2011-04-05 13:30:32.967648596 +0200
+@@ -294,6 +294,8 @@ packet_connection_is_on_socket(void)
+ 	struct sockaddr_storage from, to;
+ 	socklen_t fromlen, tolen;
+ 
+	if (!active_state)
+		return 0;
+ 	/* filedescriptors in and out are the same, so it's a socket */
+ 	if (active_state->connection_in == active_state->connection_out)
+ 		return 1;
--- a/openssh-5.8p2-remove-stale-control-socket.patch
+++ b/openssh-5.8p2-remove-stale-control-socket.patch
@ -0,0 +1,13 @@
+diff -up openssh-5.8p2/mux.c.remove_stale openssh-5.8p2/mux.c
+--- openssh-5.8p2/mux.c.remove_stale	2011-01-14 02:01:32.000000000 +0100
+++ openssh-5.8p2/mux.c	2011-06-09 15:27:42.556360291 +0200
+@@ -1867,6 +1867,9 @@ muxclient(const char *path)
+ 			unlink(path);
+ 		} else if (errno == ENOENT) {
+ 			debug("Control socket \"%.100s\" does not exist", path);
+		} else if (errno == ECONNREFUSED) {
+			debug("Removing stale control socket \"%.100s\"", path);
+			unlink(path);
+ 		} else {
+ 			error("Control socket connect(%.100s): %s", path,
+ 			    strerror(errno));
--- a/openssh-5.9p1-edns.patch
+++ b/openssh-5.9p1-edns.patch
@ -0,0 +1,72 @@
+diff -up openssh-5.9p1/dns.c.edns openssh-5.9p1/dns.c
+--- openssh-5.9p1/dns.c.edns	2010-08-31 14:41:14.000000000 +0200
+++ openssh-5.9p1/dns.c	2011-09-09 08:05:27.782440497 +0200
+@@ -177,6 +177,7 @@ verify_host_key_dns(const char *hostname
+ {
+ 	u_int counter;
+ 	int result;
+	unsigned int rrset_flags = 0;
+ 	struct rrsetinfo *fingerprints = NULL;
+ 
+ 	u_int8_t hostkey_algorithm;
+@@ -200,8 +201,19 @@ verify_host_key_dns(const char *hostname
+ 		return -1;
+ 	}
+ 
+	/*
+	 * Original getrrsetbyname function, found on OpenBSD for example,
+	 * doesn't accept any flag and prerequisite for obtaining AD bit in
+	 * DNS response is set by "options edns0" in resolv.conf.
+	 *
+	 * Our version is more clever and use RRSET_FORCE_EDNS0 flag.
+	 */
+#ifndef HAVE_GETRRSETBYNAME
+	rrset_flags |= RRSET_FORCE_EDNS0;
+#endif
+ 	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
+-	    DNS_RDATATYPE_SSHFP, 0, &fingerprints);
+	    DNS_RDATATYPE_SSHFP, rrset_flags, &fingerprints);
+
+ 	if (result) {
+ 		verbose("DNS lookup error: %s", dns_result_totext(result));
+ 		return -1;
+diff -up openssh-5.9p1/openbsd-compat/getrrsetbyname.c.edns openssh-5.9p1/openbsd-compat/getrrsetbyname.c
+--- openssh-5.9p1/openbsd-compat/getrrsetbyname.c.edns	2009-07-13 03:38:23.000000000 +0200
+++ openssh-5.9p1/openbsd-compat/getrrsetbyname.c	2011-09-09 15:03:39.930500801 +0200
+@@ -209,8 +209,8 @@ getrrsetbyname(const char *hostname, uns
+ 		goto fail;
+ 	}
+ 
+-	/* don't allow flags yet, unimplemented */
+-	if (flags) {
+	/* Allow RRSET_FORCE_EDNS0 flag only. */
+	if ((flags & ~RRSET_FORCE_EDNS0) != 0) {
+ 		result = ERRSET_INVAL;
+ 		goto fail;
+ 	}
+@@ -226,9 +226,9 @@ getrrsetbyname(const char *hostname, uns
+ #endif /* DEBUG */
+ 
+ #ifdef RES_USE_DNSSEC
+-	/* turn on DNSSEC if EDNS0 is configured */
+-	if (_resp->options & RES_USE_EDNS0)
+-		_resp->options |= RES_USE_DNSSEC;
+	/* turn on DNSSEC if required  */
+	if (flags & RRSET_FORCE_EDNS0)
+		_resp->options |= (RES_USE_EDNS0|RES_USE_DNSSEC);
+ #endif /* RES_USE_DNSEC */
+ 
+ 	/* make query */
+diff -up openssh-5.9p1/openbsd-compat/getrrsetbyname.h.edns openssh-5.9p1/openbsd-compat/getrrsetbyname.h
+--- openssh-5.9p1/openbsd-compat/getrrsetbyname.h.edns	2007-10-26 08:26:50.000000000 +0200
+++ openssh-5.9p1/openbsd-compat/getrrsetbyname.h	2011-09-09 08:05:27.965438689 +0200
+@@ -72,6 +72,9 @@
+ #ifndef RRSET_VALIDATED
+ # define RRSET_VALIDATED	1
+ #endif
+#ifndef RRSET_FORCE_EDNS0
+# define RRSET_FORCE_EDNS0	0x0001
+#endif
+ 
+ /*
+  * Return codes for getrrsetbyname()
--- a/openssh-5.9p1-randclean.patch
+++ b/openssh-5.9p1-randclean.patch
@ -0,0 +1,13 @@
+diff -up openssh-5.9p0/entropy.c.randclean openssh-5.9p0/entropy.c
+--- openssh-5.9p0/entropy.c.randclean	2011-08-30 13:52:45.000000000 +0200
+++ openssh-5.9p0/entropy.c	2011-08-30 13:57:44.630111338 +0200
+@@ -217,6 +217,9 @@ seed_rng(void)
+ 		fatal("OpenSSL version mismatch. Built against %lx, you "
+ 		    "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
+ 
+	/* clean the PRNG status when exiting the program */
+	atexit(RAND_cleanup);
+
+ #ifndef OPENSSL_PRNG_ONLY
+ 	if (RAND_status() == 1) {
+ 		debug3("RNG is ready, skipping seeding");
--- a/openssh-5.9p1-wIm.patch
+++ b/openssh-5.9p1-wIm.patch
@ -0,0 +1,78 @@
+diff -up openssh-5.9p1/Makefile.in.wIm openssh-5.9p1/Makefile.in
+--- openssh-5.9p1/Makefile.in.wIm	2011-08-05 22:15:18.000000000 +0200
+++ openssh-5.9p1/Makefile.in	2011-09-12 16:24:18.643674014 +0200
+@@ -66,7 +66,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
+ 	cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
+ 	compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
+ 	log.o match.o md-sha256.o moduli.o nchan.o packet.o \
+-	readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
+	readpass.o rsa.o ttymodes.o whereIam.o xmalloc.o addrmatch.o \
+ 	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
+ 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
+ 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
+diff -up openssh-5.9p1/log.h.wIm openssh-5.9p1/log.h
+--- openssh-5.9p1/log.h.wIm	2011-06-20 06:42:23.000000000 +0200
+++ openssh-5.9p1/log.h	2011-09-12 16:34:52.984674326 +0200
+@@ -65,6 +65,8 @@ void     verbose(const char *, ...) __at
+ void     debug(const char *, ...) __attribute__((format(printf, 1, 2)));
+ void     debug2(const char *, ...) __attribute__((format(printf, 1, 2)));
+ void     debug3(const char *, ...) __attribute__((format(printf, 1, 2)));
+void	 _debug_wIm_body(const char *, int, const char *, const char *, int);
+#define	debug_wIm(a,b) _debug_wIm_body(a,b,__func__,__FILE__,__LINE__)
+ 
+ 
+ void	 set_log_handler(log_handler_fn *, void *);
+diff -up openssh-5.9p1/sshd.c.wIm openssh-5.9p1/sshd.c
+--- openssh-5.9p1/sshd.c.wIm	2011-06-23 11:45:51.000000000 +0200
+++ openssh-5.9p1/sshd.c	2011-09-12 16:38:35.787816490 +0200
+@@ -140,6 +140,9 @@ int deny_severity;
+ 
+ extern char *__progname;
+ 
+/* trace of fork processes */
+extern int whereIam;
+
+ /* Server configuration options. */
+ ServerOptions options;
+ 
+@@ -666,6 +669,7 @@ privsep_preauth(Authctxt *authctxt)
+ 		return 1;
+ 	} else {
+ 		/* child */
+		whereIam = 1;
+ 		close(pmonitor->m_sendfd);
+ 		close(pmonitor->m_log_recvfd);
+ 
+@@ -715,6 +719,7 @@ privsep_postauth(Authctxt *authctxt)
+ 
+ 	/* child */
+ 
+	whereIam = 2;
+ 	close(pmonitor->m_sendfd);
+ 	pmonitor->m_sendfd = -1;
+ 
+@@ -1325,6 +1330,8 @@ main(int ac, char **av)
+ 	Key *key;
+ 	Authctxt *authctxt;
+ 
+	whereIam = 0;
+
+ #ifdef HAVE_SECUREWARE
+ 	(void)set_auth_parameters(ac, av);
+ #endif
+diff -up openssh-5.9p1/whereIam.c.wIm openssh-5.9p1/whereIam.c
+--- openssh-5.9p1/whereIam.c.wIm	2011-09-12 16:24:18.722674167 +0200
+++ openssh-5.9p1/whereIam.c	2011-09-12 16:24:18.724674418 +0200
+@@ -0,0 +1,12 @@
+
+int whereIam = -1;
+
+void _debug_wIm_body(const char *txt, int val, const char *func, const char *file, int line)
+{
+	if (txt)
+		debug("%s=%d, %s(%s:%d) wIm = %d, uid=%d, euid=%d", txt, val, func, file, line, whereIam, getuid(), geteuid());
+	else
+		debug("%s(%s:%d) wIm = %d, uid=%d, euid=%d", func, file, line, whereIam, getuid(), geteuid());
+}
+
+
--- a/openssh-6.1p1-askpass-ld.patch
+++ b/openssh-6.1p1-askpass-ld.patch
@ -0,0 +1,18 @@
+diff -up openssh-6.1p1/contrib/Makefile.askpass-ld openssh-6.1p1/contrib/Makefile
+--- openssh-6.1p1/contrib/Makefile.askpass-ld	2012-05-19 07:24:37.000000000 +0200
+++ openssh-6.1p1/contrib/Makefile	2012-09-14 20:35:47.565704718 +0200
+@@ -4,12 +4,12 @@ all:
+ 	@echo "Valid targets: gnome-ssh-askpass1 gnome-ssh-askpass2"
+ 
+ gnome-ssh-askpass1: gnome-ssh-askpass1.c
+-	$(CC) `gnome-config --cflags gnome gnomeui` \
+	$(CC) ${CFLAGS} `gnome-config --cflags gnome gnomeui` \
+ 		gnome-ssh-askpass1.c -o gnome-ssh-askpass1 \
+ 		`gnome-config --libs gnome gnomeui`
+ 
+ gnome-ssh-askpass2: gnome-ssh-askpass2.c
+-	$(CC) `$(PKG_CONFIG) --cflags gtk+-2.0` \
+	$(CC) ${CFLAGS} `$(PKG_CONFIG) --cflags gtk+-2.0` \
+ 		gnome-ssh-askpass2.c -o gnome-ssh-askpass2 \
+ 		`$(PKG_CONFIG) --libs gtk+-2.0 x11`
+ 
--- a/openssh-6.1p1-gssapi-canohost.patch
+++ b/openssh-6.1p1-gssapi-canohost.patch
@ -0,0 +1,21 @@
+diff -up openssh-6.1p1/sshconnect2.c.canohost openssh-6.1p1/sshconnect2.c
+--- openssh-6.1p1/sshconnect2.c.canohost	2012-10-30 10:52:59.593301692 +0100
+++ openssh-6.1p1/sshconnect2.c	2012-10-30 11:01:12.870301632 +0100
+@@ -699,12 +699,15 @@ userauth_gssapi(Authctxt *authctxt)
+ 	static u_int mech = 0;
+ 	OM_uint32 min;
+ 	int ok = 0;
+-	const char *gss_host;
+	const char *gss_host = NULL;
+ 
+ 	if (options.gss_server_identity)
+ 		gss_host = options.gss_server_identity;
+-	else if (options.gss_trust_dns)
+	else if (options.gss_trust_dns) {
+ 		gss_host = get_canonical_hostname(1);
+		if ( strcmp( gss_host, "UNKNOWN" )  == 0 )
+			gss_host = authctxt->host;
+	}
+ 	else
+ 		gss_host = authctxt->host;
+ 
--- a/openssh-7.8p1-UsePAM-warning.patch
+++ b/openssh-7.8p1-UsePAM-warning.patch
@ -1,26 +1,26 @@
-diff --git a/sshd.c b/sshd.c
--- a/sshd.c
-+++ b/sshd.c
-@@ -1701,6 +1701,10 @@ main(int ac, char **av)
+diff -up openssh-6.1p1/sshd.c.log-usepam-no openssh-6.1p1/sshd.c
+--- openssh-6.1p1/sshd.c.log-usepam-no	2012-09-14 20:54:58.000000000 +0200
+++ openssh-6.1p1/sshd.c	2012-09-14 20:55:42.289477749 +0200
+@@ -1617,6 +1617,10 @@ main(int ac, char **av)
 	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL);
+ 	    &cfg, NULL);
 
 +	/* 'UsePAM no' is not supported in Fedora */
 +	if (! options.use_pam)
 +		logit("WARNING: 'UsePAM no' is not supported in Fedora and may cause several problems.");
 +
- 	/* Fill in default values for those options not explicitly set. */
- 	fill_default_server_options(&options);
+ 	seed_rng();
 
-diff --git a/sshd_config b/sshd_config
--- a/sshd_config
-+++ b/sshd_config
-@@ -101,6 +101,8 @@ GSSAPICleanupCredentials no
+ 	/* Fill in default values for those options not explicitly set. */
+diff -up openssh-6.1p1/sshd_config.log-usepam-no openssh-6.1p1/sshd_config
+--- openssh-6.1p1/sshd_config.log-usepam-no	2012-09-14 20:54:58.514255748 +0200
+++ openssh-6.1p1/sshd_config	2012-09-14 20:54:58.551255954 +0200
+@@ -95,6 +95,8 @@ GSSAPICleanupCredentials no
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and ChallengeResponseAuthentication to 'no'.
 +# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
 +# problems.
 #UsePAM no
+ UsePAM yes
 
- #AllowAgentForwarding yes
--- a/openssh-6.2p1-entropy.patch
+++ b/openssh-6.2p1-entropy.patch
@ -0,0 +1,271 @@
+diff -up openssh-6.2p1/entropy.c.entropy openssh-6.2p1/entropy.c
+--- openssh-6.2p1/entropy.c.entropy	2013-03-25 19:31:42.737611051 +0100
+++ openssh-6.2p1/entropy.c	2013-03-25 19:31:42.797611433 +0100
+@@ -237,6 +237,9 @@ seed_rng(void)
+ 	memset(buf, '\0', sizeof(buf));
+ 
+ #endif /* OPENSSL_PRNG_ONLY */
+#ifdef __linux__
+	linux_seed();
+#endif /* __linux__ */
+ 	if (RAND_status() != 1)
+ 		fatal("PRNG is not seeded");
+ }
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.entropy openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.entropy	2013-03-25 19:31:42.798611440 +0100
+++ openssh-6.2p1/openbsd-compat/Makefile.in	2013-03-25 19:33:02.042116876 +0100
+@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
+ 
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ 
+-PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
+ 
+ .c.o:
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
+diff -up openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.2p1/openbsd-compat/port-linux-prng.c
+--- openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy	2013-03-25 19:31:42.798611440 +0100
+++ openssh-6.2p1/openbsd-compat/port-linux-prng.c	2013-03-25 19:31:42.798611440 +0100
+@@ -0,0 +1,59 @@
+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
+
+/*
+ * Copyright (c) 2011 Jan F. Chadima <jchadima@redhat.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Linux-specific portability code - prng support
+ */
+
+#include "includes.h"
+
+#include <errno.h>
+#include <stdarg.h>
+#include <string.h>
+#include <stdio.h>
+#include <openssl/rand.h>
+
+#include "log.h"
+#include "xmalloc.h"
+#include "servconf.h"
+#include "port-linux.h"
+#include "key.h"
+#include "hostfile.h"
+#include "auth.h"
+
+void
+linux_seed(void)
+{
+	int len;
+	char *env = getenv("SSH_USE_STRONG_RNG");
+	char *random = "/dev/random";
+	size_t ienv, randlen = 14;
+
+	if (!env || !strcmp(env, "0"))
+		random = "/dev/urandom";
+	else if ((ienv = atoi(env)) > randlen)
+		randlen = ienv;
+
+	errno = 0;
+	if ((len = RAND_load_file(random, randlen)) != randlen) {
+		if (errno)
+			fatal ("cannot read from %s, %s", random, strerror(errno));
+		else
+			fatal ("EOF reading %s", random);
+	}
+}
+diff -up openssh-6.2p1/ssh-add.0.entropy openssh-6.2p1/ssh-add.0
+--- openssh-6.2p1/ssh-add.0.entropy	2013-03-22 00:38:29.000000000 +0100
+++ openssh-6.2p1/ssh-add.0	2013-03-25 19:31:42.799611446 +0100
+@@ -82,6 +82,16 @@ ENVIRONMENT
+              Identifies the path of a UNIX-domain socket used to communicate
+              with the agent.
+ 
+     SSH_USE_STRONG_RNG
+             The reseeding of the OpenSSL random generator is usually done
+             from /dev/urandom.  If the SSH_USE_STRONG_RNG environment vari-
+             able is set to value other than 0 the OpenSSL random generator is
+             reseeded from /dev/random.  The number of bytes read is defined
+             by the SSH_USE_STRONG_RNG value.  Minimum is 14 bytes.  This set-
+             ting is not recommended on the computers without the hardware
+             random generator because insufficient entropy causes the connec-
+             tion to be blocked until enough entropy is available.
+
+ FILES
+      ~/.ssh/identity
+              Contains the protocol version 1 RSA authentication identity of
+diff -up openssh-6.2p1/ssh-add.1.entropy openssh-6.2p1/ssh-add.1
+--- openssh-6.2p1/ssh-add.1.entropy	2012-12-07 03:06:13.000000000 +0100
+++ openssh-6.2p1/ssh-add.1	2013-03-25 19:31:42.799611446 +0100
+@@ -160,6 +160,20 @@ to make this work.)
+ Identifies the path of a
+ .Ux Ns -domain
+ socket used to communicate with the agent.
+.It Ev SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 14 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+ .El
+ .Sh FILES
+ .Bl -tag -width Ds
+diff -up openssh-6.2p1/ssh-agent.1.entropy openssh-6.2p1/ssh-agent.1
+--- openssh-6.2p1/ssh-agent.1.entropy	2010-12-01 01:50:35.000000000 +0100
+++ openssh-6.2p1/ssh-agent.1	2013-03-25 19:31:42.800611452 +0100
+@@ -198,6 +198,24 @@ sockets used to contain the connection t
+ These sockets should only be readable by the owner.
+ The sockets should get automatically removed when the agent exits.
+ .El
+.Sh ENVIRONMENT
+.Bl -tag -width Ds -compact
+.Pp
+.It Pa SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 14 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+.El
+ .Sh SEE ALSO
+ .Xr ssh 1 ,
+ .Xr ssh-add 1 ,
+diff -up openssh-6.2p1/sshd.8.entropy openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.entropy	2013-03-25 19:31:42.752611146 +0100
+++ openssh-6.2p1/sshd.8	2013-03-25 19:31:42.800611452 +0100
+@@ -945,6 +945,24 @@ concurrently for different ports, this c
+ started last).
+ The content of this file is not sensitive; it can be world-readable.
+ .El
+.Sh ENVIRONMENT
+.Bl -tag -width Ds -compact
+.Pp
+.It Pa SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 14 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+.El
+ .Sh IPV6
+ IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell.
+ .Sh SEE ALSO
+diff -up openssh-6.2p1/ssh-keygen.1.entropy openssh-6.2p1/ssh-keygen.1
+--- openssh-6.2p1/ssh-keygen.1.entropy	2013-01-20 12:35:06.000000000 +0100
+++ openssh-6.2p1/ssh-keygen.1	2013-03-25 19:31:42.801611459 +0100
+@@ -806,6 +806,24 @@ Contains Diffie-Hellman groups used for
+ The file format is described in
+ .Xr moduli 5 .
+ .El
+.Sh ENVIRONMENT
+.Bl -tag -width Ds -compact
+.Pp
+.It Pa SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 14 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+.El
+ .Sh SEE ALSO
+ .Xr ssh 1 ,
+ .Xr ssh-add 1 ,
+diff -up openssh-6.2p1/ssh-keysign.8.entropy openssh-6.2p1/ssh-keysign.8
+--- openssh-6.2p1/ssh-keysign.8.entropy	2010-08-31 14:41:14.000000000 +0200
+++ openssh-6.2p1/ssh-keysign.8	2013-03-25 19:31:42.801611459 +0100
+@@ -78,6 +78,24 @@ must be set-uid root if host-based authe
+ If these files exist they are assumed to contain public certificate
+ information corresponding with the private keys above.
+ .El
+.Sh ENVIRONMENT
+.Bl -tag -width Ds -compact
+.Pp
+.It Pa SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 14 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+.El
+ .Sh SEE ALSO
+ .Xr ssh 1 ,
+ .Xr ssh-keygen 1 ,
+diff -up openssh-6.2p1/ssh.1.entropy openssh-6.2p1/ssh.1
+--- openssh-6.2p1/ssh.1.entropy	2013-03-25 19:31:42.752611146 +0100
+++ openssh-6.2p1/ssh.1	2013-03-25 19:31:42.799611446 +0100
+@@ -1277,6 +1277,23 @@ For more information, see the
+ .Cm PermitUserEnvironment
+ option in
+ .Xr sshd_config 5 .
+.Sh ENVIRONMENT
+.Bl -tag -width Ds -compact
+.It Ev SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 14 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+.El
+ .Sh FILES
+ .Bl -tag -width Ds -compact
+ .It Pa ~/.rhosts
--- a/openssh-6.2p1-vendor.patch
+++ b/openssh-6.2p1-vendor.patch
@ -0,0 +1,158 @@
+diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.vendor	2013-03-25 19:34:01.277495179 +0100
+++ openssh-6.2p1/configure.ac	2013-03-25 19:34:01.377495818 +0100
+@@ -4420,6 +4420,12 @@ AC_ARG_WITH([lastlog],
+ 		fi
+ 	]
+ )
+AC_ARG_ENABLE(vendor-patchlevel,
+  [  --enable-vendor-patchlevel=TAG  specify a vendor patch level],
+  [AC_DEFINE_UNQUOTED(SSH_VENDOR_PATCHLEVEL,[SSH_RELEASE "-" "$enableval"],[Define to your vendor patch level, if it has been modified from the upstream source release.])
+   SSH_VENDOR_PATCHLEVEL="$enableval"],
+  [AC_DEFINE(SSH_VENDOR_PATCHLEVEL,SSH_RELEASE,[Define to your vendor patch level, if it has been modified from the upstream source release.])
+   SSH_VENDOR_PATCHLEVEL=none])
+ 
+ dnl lastlog, [uw]tmpx? detection
+ dnl  NOTE: set the paths in the platform section to avoid the
+@@ -4681,6 +4687,7 @@ echo "           Translate v4 in v6 hack
+ echo "                  BSD Auth support: $BSD_AUTH_MSG"
+ echo "              Random number source: $RAND_MSG"
+ echo "             Privsep sandbox style: $SANDBOX_STYLE"
+echo "                Vendor patch level: $SSH_VENDOR_PATCHLEVEL"
+ 
+ echo ""
+ 
+diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.vendor	2013-03-25 19:34:01.197494668 +0100
+++ openssh-6.2p1/servconf.c	2013-03-25 19:34:01.379495831 +0100
+@@ -128,6 +128,7 @@ initialize_server_options(ServerOptions
+ 	options->max_authtries = -1;
+ 	options->max_sessions = -1;
+ 	options->banner = NULL;
+	options->show_patchlevel = -1;
+ 	options->use_dns = -1;
+ 	options->client_alive_interval = -1;
+ 	options->client_alive_count_max = -1;
+@@ -287,6 +288,9 @@ fill_default_server_options(ServerOption
+ 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
+ 	if (options->version_addendum == NULL)
+ 		options->version_addendum = xstrdup("");
+	if (options->show_patchlevel == -1)
+		options->show_patchlevel = 0;
+
+ 	/* Turn privilege separation on by default */
+ 	if (use_privsep == -1)
+ 		use_privsep = PRIVSEP_NOSANDBOX;
+@@ -324,7 +328,7 @@ typedef enum {
+ 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
+ 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
+ 	sMaxStartups, sMaxAuthTries, sMaxSessions,
+-	sBanner, sUseDNS, sHostbasedAuthentication,
+	sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
+ 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
+ 	sClientAliveCountMax, sAuthorizedKeysFile,
+ 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
+@@ -439,6 +443,7 @@ static struct {
+ 	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
+ 	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
+ 	{ "banner", sBanner, SSHCFG_ALL },
+	{ "showpatchlevel", sShowPatchLevel, SSHCFG_GLOBAL },
+ 	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
+ 	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
+ 	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
+@@ -1163,6 +1168,10 @@ process_server_config_line(ServerOptions
+ 		multistate_ptr = multistate_privsep;
+ 		goto parse_multistate;
+ 
+	case sShowPatchLevel:
+		intptr = &options->show_patchlevel;
+		goto parse_flag;
+
+ 	case sAllowUsers:
+ 		while ((arg = strdelim(&cp)) && *arg != '\0') {
+ 			if (options->num_allow_users >= MAX_ALLOW_USERS)
+@@ -1950,6 +1959,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_fmtint(sUseLogin, o->use_login);
+ 	dump_cfg_fmtint(sCompression, o->compression);
+ 	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
+	dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel);
+ 	dump_cfg_fmtint(sUseDNS, o->use_dns);
+ 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
+ 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
+diff -up openssh-6.2p1/servconf.h.vendor openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.vendor	2013-01-09 05:56:45.000000000 +0100
+++ openssh-6.2p1/servconf.h	2013-03-25 19:34:01.379495831 +0100
+@@ -147,6 +147,7 @@ typedef struct {
+ 	int	max_authtries;
+ 	int	max_sessions;
+ 	char   *banner;			/* SSH-2 banner message */
+	int	show_patchlevel;	/* Show vendor patch level to clients */
+ 	int	use_dns;
+ 	int	client_alive_interval;	/*
+ 					 * poke the client this often to
+diff -up openssh-6.2p1/sshd_config.vendor openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.vendor	2013-03-25 19:34:01.380495837 +0100
+++ openssh-6.2p1/sshd_config	2013-03-25 19:44:43.471296362 +0100
+@@ -118,6 +118,7 @@ UsePrivilegeSeparation sandbox		# Defaul
+ #Compression delayed
+ #ClientAliveInterval 0
+ #ClientAliveCountMax 3
+#ShowPatchLevel no
+ #UseDNS yes
+ #PidFile /var/run/sshd.pid
+ #MaxStartups 10:30:100
+diff -up openssh-6.2p1/sshd_config.0.vendor openssh-6.2p1/sshd_config.0
+--- openssh-6.2p1/sshd_config.0.vendor	2013-03-25 19:34:01.361495716 +0100
+++ openssh-6.2p1/sshd_config.0	2013-03-25 19:34:01.381495844 +0100
+@@ -595,6 +595,11 @@ DESCRIPTION
+              Defines the number of bits in the ephemeral protocol version 1
+              server key.  The minimum value is 512, and the default is 1024.
+ 
+     ShowPatchLevel
+	     Specifies whether sshd will display the specific patch level of
+	     the binary in the server identification string.  The patch level
+	     is set at compile-time.  The default is M-bM-^@M-^\noM-bM-^@M-^].
+
+      StrictModes
+              Specifies whether sshd(8) should check file modes and ownership
+              of the user's files and home directory before accepting login.
+diff -up openssh-6.2p1/sshd_config.5.vendor openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.vendor	2013-03-25 19:34:01.362495722 +0100
+++ openssh-6.2p1/sshd_config.5	2013-03-25 19:34:01.382495850 +0100
+@@ -1019,6 +1019,14 @@ This option applies to protocol version
+ .It Cm ServerKeyBits
+ Defines the number of bits in the ephemeral protocol version 1 server key.
+ The minimum value is 512, and the default is 1024.
+.It Cm ShowPatchLevel 
+Specifies whether 
+.Nm sshd 
+will display the patch level of the binary in the identification string. 
+The patch level is set at compile-time. 
+The default is 
+.Dq no . 
+This option applies to protocol version 1 only. 
+ .It Cm StrictModes
+ Specifies whether
+ .Xr sshd 8
+diff -up openssh-6.2p1/sshd.c.vendor openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.vendor	2013-03-25 19:34:01.332495531 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 19:44:11.864112092 +0100
+@@ -442,7 +442,7 @@ sshd_exchange_identification(int sock_in
+ 	}
+ 
+ 	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
+-	    major, minor, SSH_VERSION,
+	    major, minor, (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
+ 	    *options.version_addendum == '\0' ? "" : " ",
+ 	    options.version_addendum, newline);
+ 
+@@ -1675,7 +1675,8 @@ main(int ac, char **av)
+ 		exit(1);
+ 	}
+ 
+-	debug("sshd version %s, %s", SSH_VERSION,
+	debug("sshd version %s, %s",
+	    (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
+ 	    SSLeay_version(SSLEAY_VERSION));
+ 
+ 	/* Store privilege separation user for later use if required. */
--- a/openssh-6.3p1-coverity.patch
+++ b/openssh-6.3p1-coverity.patch
@ -0,0 +1,788 @@
+diff -up openssh-6.3p1/auth-pam.c.coverity openssh-6.3p1/auth-pam.c
+--- openssh-6.3p1/auth-pam.c.coverity	2013-06-02 00:07:32.000000000 +0200
+++ openssh-6.3p1/auth-pam.c	2013-10-07 13:20:36.288298063 +0200
+@@ -216,7 +216,12 @@ pthread_join(sp_pthread_t thread, void *
+ 	if (sshpam_thread_status != -1)
+ 		return (sshpam_thread_status);
+ 	signal(SIGCHLD, sshpam_oldsig);
+-	waitpid(thread, &status, 0);
+	while (waitpid(thread, &status, 0) < 0) {                     
+		if (errno == EINTR)                                
+			continue;
+		fatal("%s: waitpid: %s", __func__,         
+				strerror(errno));                      
+	}
+ 	return (status);
+ }
+ #endif
+diff -up openssh-6.3p1/channels.c.coverity openssh-6.3p1/channels.c
+--- openssh-6.3p1/channels.c.coverity	2013-09-13 08:19:31.000000000 +0200
+++ openssh-6.3p1/channels.c	2013-10-07 13:20:36.289298058 +0200
+@@ -233,11 +233,11 @@ channel_register_fds(Channel *c, int rfd
+ 	channel_max_fd = MAX(channel_max_fd, wfd);
+ 	channel_max_fd = MAX(channel_max_fd, efd);
+ 
+-	if (rfd != -1)
+	if (rfd >= 0)
+ 		fcntl(rfd, F_SETFD, FD_CLOEXEC);
+-	if (wfd != -1 && wfd != rfd)
+	if (wfd >= 0 && wfd != rfd)
+ 		fcntl(wfd, F_SETFD, FD_CLOEXEC);
+-	if (efd != -1 && efd != rfd && efd != wfd)
+	if (efd >= 0 && efd != rfd && efd != wfd)
+ 		fcntl(efd, F_SETFD, FD_CLOEXEC);
+ 
+ 	c->rfd = rfd;
+@@ -255,11 +255,11 @@ channel_register_fds(Channel *c, int rfd
+ 
+ 	/* enable nonblocking mode */
+ 	if (nonblock) {
+-		if (rfd != -1)
+		if (rfd >= 0)
+ 			set_nonblock(rfd);
+-		if (wfd != -1)
+		if (wfd >= 0)
+ 			set_nonblock(wfd);
+-		if (efd != -1)
+		if (efd >= 0)
+ 			set_nonblock(efd);
+ 	}
+ }
+diff -up openssh-6.3p1/clientloop.c.coverity openssh-6.3p1/clientloop.c
+--- openssh-6.3p1/clientloop.c.coverity	2013-06-10 05:07:12.000000000 +0200
+++ openssh-6.3p1/clientloop.c	2013-10-07 13:20:36.289298058 +0200
+@@ -2068,14 +2068,15 @@ client_input_global_request(int type, u_
+ 	char *rtype;
+ 	int want_reply;
+ 	int success = 0;
+/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
+ 
+ 	rtype = packet_get_string(NULL);
+ 	want_reply = packet_get_char();
+ 	debug("client_input_global_request: rtype %s want_reply %d",
+ 	    rtype, want_reply);
+ 	if (want_reply) {
+-		packet_start(success ?
+-		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
+		packet_start(/*success ?
+		    SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
+ 		packet_send();
+ 		packet_write_wait();
+ 	}
+diff -up openssh-6.3p1/key.c.coverity openssh-6.3p1/key.c
+--- openssh-6.3p1/key.c.coverity	2013-06-01 23:41:51.000000000 +0200
+++ openssh-6.3p1/key.c	2013-10-07 13:20:36.290298054 +0200
+@@ -807,8 +807,10 @@ key_read(Key *ret, char **cpp)
+ 		success = 1;
+ /*XXXX*/
+ 		key_free(k);
+/*XXXX
+ 		if (success != 1)
+ 			break;
+XXXX*/
+ 		/* advance cp: skip whitespace and data */
+ 		while (*cp == ' ' || *cp == '\t')
+ 			cp++;
+diff -up openssh-6.3p1/monitor.c.coverity openssh-6.3p1/monitor.c
+--- openssh-6.3p1/monitor.c.coverity	2013-07-20 05:21:53.000000000 +0200
+++ openssh-6.3p1/monitor.c	2013-10-07 13:54:36.761314042 +0200
+@@ -449,7 +449,7 @@ monitor_child_preauth(Authctxt *_authctx
+ 	mm_get_keystate(pmonitor);
+ 
+ 	/* Drain any buffered messages from the child */
+-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
+ 		;
+ 
+ 	close(pmonitor->m_sendfd);
+@@ -1202,6 +1202,10 @@ mm_answer_keyallowed(int sock, Buffer *m
+ 			break;
+ 		}
+ 	}
+
+	debug3("%s: key %p is %s",
+	    __func__, key, allowed ? "allowed" : "not allowed");
+
+ 	if (key != NULL)
+ 		key_free(key);
+ 
+@@ -1223,9 +1227,6 @@ mm_answer_keyallowed(int sock, Buffer *m
+ 		free(chost);
+ 	}
+ 
+-	debug3("%s: key %p is %s",
+-	    __func__, key, allowed ? "allowed" : "not allowed");
+-
+ 	buffer_clear(m);
+ 	buffer_put_int(m, allowed);
+ 	buffer_put_int(m, forced_command != NULL);
+diff -up openssh-6.3p1/monitor_wrap.c.coverity openssh-6.3p1/monitor_wrap.c
+--- openssh-6.3p1/monitor_wrap.c.coverity	2013-06-02 00:07:32.000000000 +0200
+++ openssh-6.3p1/monitor_wrap.c	2013-10-07 13:20:36.291298049 +0200
+@@ -710,10 +710,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
+ 	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
+ 	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
+ 		error("%s: cannot allocate fds for pty", __func__);
+-		if (tmp1 > 0)
+		if (tmp1 >= 0)
+ 			close(tmp1);
+-		if (tmp2 > 0)
+-			close(tmp2);
+		/*DEAD CODE if (tmp2 >= 0)
+			close(tmp2);*/
+ 		return 0;
+ 	}
+ 	close(tmp1);
+diff -up openssh-6.3p1/openbsd-compat/bindresvport.c.coverity openssh-6.3p1/openbsd-compat/bindresvport.c
+--- openssh-6.3p1/openbsd-compat/bindresvport.c.coverity	2010-12-03 00:50:26.000000000 +0100
+++ openssh-6.3p1/openbsd-compat/bindresvport.c	2013-10-07 13:20:36.291298049 +0200
+@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
+ 	struct sockaddr_in6 *in6;
+ 	u_int16_t *portp;
+ 	u_int16_t port;
+-	socklen_t salen;
+	socklen_t salen = sizeof(struct sockaddr_storage);
+ 	int i;
+ 
+ 	if (sa == NULL) {
+diff -up openssh-6.3p1/packet.c.coverity openssh-6.3p1/packet.c
+--- openssh-6.3p1/packet.c.coverity	2013-07-18 08:12:45.000000000 +0200
+++ openssh-6.3p1/packet.c	2013-10-07 13:20:36.291298049 +0200
+@@ -1199,6 +1199,7 @@ packet_read_poll1(void)
+ 		case DEATTACK_DETECTED:
+ 			packet_disconnect("crc32 compensation attack: "
+ 			    "network attack detected");
+			break;
+ 		case DEATTACK_DOS_DETECTED:
+ 			packet_disconnect("deattack denial of "
+ 			    "service detected");
+diff -up openssh-6.3p1/progressmeter.c.coverity openssh-6.3p1/progressmeter.c
+--- openssh-6.3p1/progressmeter.c.coverity	2013-06-02 15:46:24.000000000 +0200
+++ openssh-6.3p1/progressmeter.c	2013-10-07 13:42:32.377850691 +0200
+@@ -65,7 +65,7 @@ static void update_progress_meter(int);
+ 
+ static time_t start;		/* start progress */
+ static time_t last_update;	/* last progress update */
+-static char *file;		/* name of the file being transferred */
+static const char *file;	/* name of the file being transferred */
+ static off_t end_pos;		/* ending position of transfer */
+ static off_t cur_pos;		/* transfer position as of last refresh */
+ static volatile off_t *counter;	/* progress counter */
+@@ -247,7 +247,7 @@ update_progress_meter(int ignore)
+ }
+ 
+ void
+-start_progress_meter(char *f, off_t filesize, off_t *ctr)
+start_progress_meter(const char *f, off_t filesize, off_t *ctr)
+ {
+ 	start = last_update = monotime();
+ 	file = f;
+diff -up openssh-6.3p1/progressmeter.h.coverity openssh-6.3p1/progressmeter.h
+--- openssh-6.3p1/progressmeter.h.coverity	2006-03-26 05:30:02.000000000 +0200
+++ openssh-6.3p1/progressmeter.h	2013-10-07 13:20:36.292298044 +0200
+@@ -23,5 +23,5 @@
+  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  */
+ 
+-void	start_progress_meter(char *, off_t, off_t *);
+void	start_progress_meter(const char *, off_t, off_t *);
+ void	stop_progress_meter(void);
+diff -up openssh-6.3p1/scp.c.coverity openssh-6.3p1/scp.c
+--- openssh-6.3p1/scp.c.coverity	2013-07-18 08:11:25.000000000 +0200
+++ openssh-6.3p1/scp.c	2013-10-07 13:20:36.292298044 +0200
+@@ -155,7 +155,7 @@ killchild(int signo)
+ {
+ 	if (do_cmd_pid > 1) {
+ 		kill(do_cmd_pid, signo ? signo : SIGTERM);
+-		waitpid(do_cmd_pid, NULL, 0);
+		(void) waitpid(do_cmd_pid, NULL, 0);
+ 	}
+ 
+ 	if (signo)
+diff -up openssh-6.3p1/servconf.c.coverity openssh-6.3p1/servconf.c
+--- openssh-6.3p1/servconf.c.coverity	2013-07-20 05:21:53.000000000 +0200
+++ openssh-6.3p1/servconf.c	2013-10-07 13:20:36.293298039 +0200
+@@ -1323,7 +1323,7 @@ process_server_config_line(ServerOptions
+ 			fatal("%s line %d: Missing subsystem name.",
+ 			    filename, linenum);
+ 		if (!*activep) {
+-			arg = strdelim(&cp);
+			/*arg =*/ (void) strdelim(&cp);
+ 			break;
+ 		}
+ 		for (i = 0; i < options->num_subsystems; i++)
+@@ -1414,8 +1414,9 @@ process_server_config_line(ServerOptions
+ 		if (*activep && *charptr == NULL) {
+ 			*charptr = tilde_expand_filename(arg, getuid());
+ 			/* increase optional counter */
+-			if (intptr != NULL)
+-				*intptr = *intptr + 1;
+			/* DEAD CODE intptr is still NULL ;)
+  			 if (intptr != NULL)
+				*intptr = *intptr + 1; */
+ 		}
+ 		break;
+ 
+diff -up openssh-6.3p1/serverloop.c.coverity openssh-6.3p1/serverloop.c
+--- openssh-6.3p1/serverloop.c.coverity	2013-07-18 08:12:45.000000000 +0200
+++ openssh-6.3p1/serverloop.c	2013-10-07 13:43:36.620537138 +0200
+@@ -147,13 +147,13 @@ notify_setup(void)
+ static void
+ notify_parent(void)
+ {
+-	if (notify_pipe[1] != -1)
+	if (notify_pipe[1] >= 0)
+ 		(void)write(notify_pipe[1], "", 1);
+ }
+ static void
+ notify_prepare(fd_set *readset)
+ {
+-	if (notify_pipe[0] != -1)
+	if (notify_pipe[0] >= 0)
+ 		FD_SET(notify_pipe[0], readset);
+ }
+ static void
+@@ -161,8 +161,8 @@ notify_done(fd_set *readset)
+ {
+ 	char c;
+ 
+-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset))
+-		while (read(notify_pipe[0], &c, 1) != -1)
+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset))
+		while (read(notify_pipe[0], &c, 1) >= 0)
+ 			debug2("notify_done: reading");
+ }
+ 
+@@ -336,7 +336,7 @@ wait_until_can_do_something(fd_set **rea
+ 		 * If we have buffered data, try to write some of that data
+ 		 * to the program.
+ 		 */
+-		if (fdin != -1 && buffer_len(&stdin_buffer) > 0)
+		if (fdin >= 0 && buffer_len(&stdin_buffer) > 0)
+ 			FD_SET(fdin, *writesetp);
+ 	}
+ 	notify_prepare(*readsetp);
+@@ -476,7 +476,7 @@ process_output(fd_set *writeset)
+ 	int len;
+ 
+ 	/* Write buffered data to program stdin. */
+-	if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) {
+	if (!compat20 && fdin >= 0 && FD_ISSET(fdin, writeset)) {
+ 		data = buffer_ptr(&stdin_buffer);
+ 		dlen = buffer_len(&stdin_buffer);
+ 		len = write(fdin, data, dlen);
+@@ -589,7 +589,7 @@ server_loop(pid_t pid, int fdin_arg, int
+ 	set_nonblock(fdin);
+ 	set_nonblock(fdout);
+ 	/* we don't have stderr for interactive terminal sessions, see below */
+-	if (fderr != -1)
+	if (fderr >= 0)
+ 		set_nonblock(fderr);
+ 
+ 	if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin))
+@@ -613,7 +613,7 @@ server_loop(pid_t pid, int fdin_arg, int
+ 	max_fd = MAX(connection_in, connection_out);
+ 	max_fd = MAX(max_fd, fdin);
+ 	max_fd = MAX(max_fd, fdout);
+-	if (fderr != -1)
+	if (fderr >= 0)
+ 		max_fd = MAX(max_fd, fderr);
+ #endif
+ 
+@@ -643,7 +643,7 @@ server_loop(pid_t pid, int fdin_arg, int
+ 		 * If we have received eof, and there is no more pending
+ 		 * input data, cause a real eof by closing fdin.
+ 		 */
+-		if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) {
+		if (stdin_eof && fdin >= 0 && buffer_len(&stdin_buffer) == 0) {
+ 			if (fdin != fdout)
+ 				close(fdin);
+ 			else
+@@ -739,15 +739,15 @@ server_loop(pid_t pid, int fdin_arg, int
+ 	buffer_free(&stderr_buffer);
+ 
+ 	/* Close the file descriptors. */
+-	if (fdout != -1)
+	if (fdout >= 0)
+ 		close(fdout);
+ 	fdout = -1;
+ 	fdout_eof = 1;
+-	if (fderr != -1)
+	if (fderr >= 0)
+ 		close(fderr);
+ 	fderr = -1;
+ 	fderr_eof = 1;
+-	if (fdin != -1)
+	if (fdin >= 0)
+ 		close(fdin);
+ 	fdin = -1;
+ 
+@@ -946,7 +946,7 @@ server_input_window_size(int type, u_int
+ 
+ 	debug("Window change received.");
+ 	packet_check_eom();
+-	if (fdin != -1)
+	if (fdin >= 0)
+ 		pty_change_window_size(fdin, row, col, xpixel, ypixel);
+ }
+ 
+@@ -1006,7 +1006,7 @@ server_request_tun(void)
+ 	}
+ 
+ 	tun = packet_get_int();
+-	if (forced_tun_device != -1) {
+	if (forced_tun_device >= 0) {
+ 		if (tun != SSH_TUNID_ANY && forced_tun_device != tun)
+ 			goto done;
+ 		tun = forced_tun_device;
+diff -up openssh-6.3p1/sftp-client.c.coverity openssh-6.3p1/sftp-client.c
+--- openssh-6.3p1/sftp-client.c.coverity	2013-07-26 00:40:00.000000000 +0200
+++ openssh-6.3p1/sftp-client.c	2013-10-07 13:48:45.885027420 +0200
+@@ -149,7 +149,7 @@ get_msg(struct sftp_conn *conn, Buffer *
+ }
+ 
+ static void
+-send_string_request(struct sftp_conn *conn, u_int id, u_int code, char *s,
+send_string_request(struct sftp_conn *conn, u_int id, u_int code, const char *s,
+     u_int len)
+ {
+ 	Buffer msg;
+@@ -165,7 +165,7 @@ send_string_request(struct sftp_conn *co
+ 
+ static void
+ send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code,
+-    char *s, u_int len, Attrib *a)
+    const char *s, u_int len, Attrib *a)
+ {
+ 	Buffer msg;
+ 
+@@ -422,7 +422,7 @@ sftp_proto_version(struct sftp_conn *con
+ }
+ 
+ int
+-do_close(struct sftp_conn *conn, char *handle, u_int handle_len)
+do_close(struct sftp_conn *conn, const char *handle, u_int handle_len)
+ {
+ 	u_int id, status;
+ 	Buffer msg;
+@@ -447,7 +447,7 @@ do_close(struct sftp_conn *conn, char *h
+ 
+ 
+ static int
+-do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
+do_lsreaddir(struct sftp_conn *conn, const char *path, int printflag,
+     SFTP_DIRENT ***dir)
+ {
+ 	Buffer msg;
+@@ -572,7 +572,7 @@ do_lsreaddir(struct sftp_conn *conn, cha
+ }
+ 
+ int
+-do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir)
+do_readdir(struct sftp_conn *conn, const char *path, SFTP_DIRENT ***dir)
+ {
+ 	return(do_lsreaddir(conn, path, 0, dir));
+ }
+@@ -590,7 +590,7 @@ void free_sftp_dirents(SFTP_DIRENT **s)
+ }
+ 
+ int
+-do_rm(struct sftp_conn *conn, char *path)
+do_rm(struct sftp_conn *conn, const char *path)
+ {
+ 	u_int status, id;
+ 
+@@ -605,7 +605,7 @@ do_rm(struct sftp_conn *conn, char *path
+ }
+ 
+ int
+-do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int printflag)
+do_mkdir(struct sftp_conn *conn, const char *path, Attrib *a, int printflag)
+ {
+ 	u_int status, id;
+ 
+@@ -621,7 +621,7 @@ do_mkdir(struct sftp_conn *conn, char *p
+ }
+ 
+ int
+-do_rmdir(struct sftp_conn *conn, char *path)
+do_rmdir(struct sftp_conn *conn, const char *path)
+ {
+ 	u_int status, id;
+ 
+@@ -637,7 +637,7 @@ do_rmdir(struct sftp_conn *conn, char *p
+ }
+ 
+ Attrib *
+-do_stat(struct sftp_conn *conn, char *path, int quiet)
+do_stat(struct sftp_conn *conn, const char *path, int quiet)
+ {
+ 	u_int id;
+ 
+@@ -651,7 +651,7 @@ do_stat(struct sftp_conn *conn, char *pa
+ }
+ 
+ Attrib *
+-do_lstat(struct sftp_conn *conn, char *path, int quiet)
+do_lstat(struct sftp_conn *conn, const char *path, int quiet)
+ {
+ 	u_int id;
+ 
+@@ -685,7 +685,7 @@ do_fstat(struct sftp_conn *conn, char *h
+ #endif
+ 
+ int
+-do_setstat(struct sftp_conn *conn, char *path, Attrib *a)
+do_setstat(struct sftp_conn *conn, const char *path, Attrib *a)
+ {
+ 	u_int status, id;
+ 
+@@ -702,7 +702,7 @@ do_setstat(struct sftp_conn *conn, char
+ }
+ 
+ int
+-do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len,
+do_fsetstat(struct sftp_conn *conn, const char *handle, u_int handle_len,
+     Attrib *a)
+ {
+ 	u_int status, id;
+@@ -719,7 +719,7 @@ do_fsetstat(struct sftp_conn *conn, char
+ }
+ 
+ char *
+-do_realpath(struct sftp_conn *conn, char *path)
+do_realpath(struct sftp_conn *conn, const char *path)
+ {
+ 	Buffer msg;
+ 	u_int type, expected_id, count, id;
+@@ -768,7 +768,7 @@ do_realpath(struct sftp_conn *conn, char
+ }
+ 
+ int
+-do_rename(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_rename(struct sftp_conn *conn, const char *oldpath, const char *newpath)
+ {
+ 	Buffer msg;
+ 	u_int status, id;
+@@ -802,7 +802,7 @@ do_rename(struct sftp_conn *conn, char *
+ }
+ 
+ int
+-do_hardlink(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_hardlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
+ {
+ 	Buffer msg;
+ 	u_int status, id;
+@@ -835,7 +835,7 @@ do_hardlink(struct sftp_conn *conn, char
+ }
+ 
+ int
+-do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_symlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
+ {
+ 	Buffer msg;
+ 	u_int status, id;
+@@ -987,7 +987,7 @@ send_read_request(struct sftp_conn *conn
+ }
+ 
+ int
+-do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
+do_download(struct sftp_conn *conn, const char *remote_path, const char *local_path,
+     Attrib *a, int pflag, int resume)
+ {
+ 	Attrib junk;
+@@ -1255,7 +1255,7 @@ do_download(struct sftp_conn *conn, char
+ }
+ 
+ static int
+-download_dir_internal(struct sftp_conn *conn, char *src, char *dst,
+download_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+     Attrib *dirattrib, int pflag, int printflag, int depth, int resume)
+ {
+ 	int i, ret = 0;
+@@ -1345,7 +1345,7 @@ download_dir_internal(struct sftp_conn *
+ }
+ 
+ int
+-download_dir(struct sftp_conn *conn, char *src, char *dst,
+download_dir(struct sftp_conn *conn, const char *src, const char *dst,
+     Attrib *dirattrib, int pflag, int printflag, int resume)
+ {
+ 	char *src_canon;
+@@ -1363,7 +1363,7 @@ download_dir(struct sftp_conn *conn, cha
+ }
+ 
+ int
+-do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
+do_upload(struct sftp_conn *conn, const char *local_path, const char *remote_path,
+     int pflag)
+ {
+ 	int local_fd;
+@@ -1548,7 +1548,7 @@ do_upload(struct sftp_conn *conn, char *
+ }
+ 
+ static int
+-upload_dir_internal(struct sftp_conn *conn, char *src, char *dst,
+upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+     int pflag, int printflag, int depth)
+ {
+ 	int ret = 0, status;
+@@ -1639,7 +1639,7 @@ upload_dir_internal(struct sftp_conn *co
+ }
+ 
+ int
+-upload_dir(struct sftp_conn *conn, char *src, char *dst, int printflag,
+upload_dir(struct sftp_conn *conn, const char *src, const char *dst, int printflag,
+     int pflag)
+ {
+ 	char *dst_canon;
+@@ -1656,7 +1656,7 @@ upload_dir(struct sftp_conn *conn, char
+ }
+ 
+ char *
+-path_append(char *p1, char *p2)
+path_append(const char *p1, const char *p2)
+ {
+ 	char *ret;
+ 	size_t len = strlen(p1) + strlen(p2) + 2;
+diff -up openssh-6.3p1/sftp-client.h.coverity openssh-6.3p1/sftp-client.h
+--- openssh-6.3p1/sftp-client.h.coverity	2013-07-25 03:56:52.000000000 +0200
+++ openssh-6.3p1/sftp-client.h	2013-10-07 13:45:10.108080813 +0200
+@@ -56,49 +56,49 @@ struct sftp_conn *do_init(int, int, u_in
+ u_int sftp_proto_version(struct sftp_conn *);
+ 
+ /* Close file referred to by 'handle' */
+-int do_close(struct sftp_conn *, char *, u_int);
+int do_close(struct sftp_conn *, const char *, u_int);
+ 
+ /* Read contents of 'path' to NULL-terminated array 'dir' */
+-int do_readdir(struct sftp_conn *, char *, SFTP_DIRENT ***);
+int do_readdir(struct sftp_conn *, const char *, SFTP_DIRENT ***);
+ 
+ /* Frees a NULL-terminated array of SFTP_DIRENTs (eg. from do_readdir) */
+ void free_sftp_dirents(SFTP_DIRENT **);
+ 
+ /* Delete file 'path' */
+-int do_rm(struct sftp_conn *, char *);
+int do_rm(struct sftp_conn *, const char *);
+ 
+ /* Create directory 'path' */
+-int do_mkdir(struct sftp_conn *, char *, Attrib *, int);
+int do_mkdir(struct sftp_conn *, const char *, Attrib *, int);
+ 
+ /* Remove directory 'path' */
+-int do_rmdir(struct sftp_conn *, char *);
+int do_rmdir(struct sftp_conn *, const char *);
+ 
+ /* Get file attributes of 'path' (follows symlinks) */
+-Attrib *do_stat(struct sftp_conn *, char *, int);
+Attrib *do_stat(struct sftp_conn *, const char *, int);
+ 
+ /* Get file attributes of 'path' (does not follow symlinks) */
+-Attrib *do_lstat(struct sftp_conn *, char *, int);
+Attrib *do_lstat(struct sftp_conn *, const char *, int);
+ 
+ /* Set file attributes of 'path' */
+-int do_setstat(struct sftp_conn *, char *, Attrib *);
+int do_setstat(struct sftp_conn *, const char *, Attrib *);
+ 
+ /* Set file attributes of open file 'handle' */
+-int do_fsetstat(struct sftp_conn *, char *, u_int, Attrib *);
+int do_fsetstat(struct sftp_conn *, const char *, u_int, Attrib *);
+ 
+ /* Canonicalise 'path' - caller must free result */
+-char *do_realpath(struct sftp_conn *, char *);
+char *do_realpath(struct sftp_conn *, const char *);
+ 
+ /* Get statistics for filesystem hosting file at "path" */
+ int do_statvfs(struct sftp_conn *, const char *, struct sftp_statvfs *, int);
+ 
+ /* Rename 'oldpath' to 'newpath' */
+-int do_rename(struct sftp_conn *, char *, char *);
+int do_rename(struct sftp_conn *, const char *, const char *);
+ 
+ /* Link 'oldpath' to 'newpath' */
+-int do_hardlink(struct sftp_conn *, char *, char *);
+int do_hardlink(struct sftp_conn *, const char *, const char *);
+ 
+-/* Rename 'oldpath' to 'newpath' */
+-int do_symlink(struct sftp_conn *, char *, char *);
+/* Symlink 'oldpath' to 'newpath' */
+int do_symlink(struct sftp_conn *, const char *, const char *);
+ 
+ /* XXX: add callbacks to do_download/do_upload so we can do progress meter */
+ 
+@@ -106,27 +106,27 @@ int do_symlink(struct sftp_conn *, char
+  * Download 'remote_path' to 'local_path'. Preserve permissions and times
+  * if 'pflag' is set
+  */
+-int do_download(struct sftp_conn *, char *, char *, Attrib *, int, int);
+int do_download(struct sftp_conn *, const char *, const char *, Attrib *, int, int);
+ 
+ /*
+  * Recursively download 'remote_directory' to 'local_directory'. Preserve 
+  * times if 'pflag' is set
+  */
+-int download_dir(struct sftp_conn *, char *, char *, Attrib *, int, int, int);
+int download_dir(struct sftp_conn *, const char *, const char *, Attrib *, int, int, int);
+ 
+ /*
+  * Upload 'local_path' to 'remote_path'. Preserve permissions and times
+  * if 'pflag' is set
+  */
+-int do_upload(struct sftp_conn *, char *, char *, int);
+int do_upload(struct sftp_conn *, const char *, const char *, int);
+ 
+ /*
+  * Recursively upload 'local_directory' to 'remote_directory'. Preserve 
+  * times if 'pflag' is set
+  */
+-int upload_dir(struct sftp_conn *, char *, char *, int, int);
+int upload_dir(struct sftp_conn *, const char *, const char *, int, int);
+ 
+ /* Concatenate paths, taking care of slashes. Caller must free result. */
+-char *path_append(char *, char *);
+char *path_append(const char *, const char *);
+ 
+ #endif
+diff -up openssh-6.3p1/sftp.c.coverity openssh-6.3p1/sftp.c
+--- openssh-6.3p1/sftp.c.coverity	2013-07-25 03:56:52.000000000 +0200
+++ openssh-6.3p1/sftp.c	2013-10-07 13:49:47.322727449 +0200
+@@ -213,7 +213,7 @@ killchild(int signo)
+ {
+ 	if (sshpid > 1) {
+ 		kill(sshpid, SIGTERM);
+-		waitpid(sshpid, NULL, 0);
+		(void) waitpid(sshpid, NULL, 0);
+ 	}
+ 
+ 	_exit(1);
+@@ -324,7 +324,7 @@ local_do_ls(const char *args)
+ 
+ /* Strip one path (usually the pwd) from the start of another */
+ static char *
+-path_strip(char *path, char *strip)
+path_strip(const char *path, const char *strip)
+ {
+ 	size_t len;
+ 
+@@ -342,7 +342,7 @@ path_strip(char *path, char *strip)
+ }
+ 
+ static char *
+-make_absolute(char *p, char *pwd)
+make_absolute(char *p, const char *pwd)
+ {
+ 	char *abs_str;
+ 
+@@ -493,7 +493,7 @@ parse_df_flags(const char *cmd, char **a
+ }
+ 
+ static int
+-is_dir(char *path)
+is_dir(const char *path)
+ {
+ 	struct stat sb;
+ 
+@@ -505,7 +505,7 @@ is_dir(char *path)
+ }
+ 
+ static int
+-remote_is_dir(struct sftp_conn *conn, char *path)
+remote_is_dir(struct sftp_conn *conn, const char *path)
+ {
+ 	Attrib *a;
+ 
+@@ -519,7 +519,7 @@ remote_is_dir(struct sftp_conn *conn, ch
+ 
+ /* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */
+ static int
+-pathname_is_dir(char *pathname)
+pathname_is_dir(const char *pathname)
+ {
+ 	size_t l = strlen(pathname);
+ 
+@@ -527,7 +527,7 @@ pathname_is_dir(char *pathname)
+ }
+ 
+ static int
+-process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd,
+process_get(struct sftp_conn *conn, const char *src, const char *dst, const char *pwd,
+     int pflag, int rflag, int resume)
+ {
+ 	char *abs_src = NULL;
+@@ -605,7 +605,7 @@ out:
+ }
+ 
+ static int
+-process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd,
+process_put(struct sftp_conn *conn, const char *src, const char *dst, const char *pwd,
+     int pflag, int rflag)
+ {
+ 	char *tmp_dst = NULL;
+@@ -709,7 +709,7 @@ sdirent_comp(const void *aa, const void
+ 
+ /* sftp ls.1 replacement for directories */
+ static int
+-do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
+do_ls_dir(struct sftp_conn *conn, const char *path, const char *strip_path, int lflag)
+ {
+ 	int n;
+ 	u_int c = 1, colspace = 0, columns = 1;
+@@ -794,7 +794,7 @@ do_ls_dir(struct sftp_conn *conn, char *
+ 
+ /* sftp ls.1 replacement which handles path globs */
+ static int
+-do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
+do_globbed_ls(struct sftp_conn *conn, const char *path, const char *strip_path,
+     int lflag)
+ {
+ 	char *fname, *lname;
+@@ -875,7 +875,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
+ }
+ 
+ static int
+-do_df(struct sftp_conn *conn, char *path, int hflag, int iflag)
+do_df(struct sftp_conn *conn, const char *path, int hflag, int iflag)
+ {
+ 	struct sftp_statvfs st;
+ 	char s_used[FMT_SCALED_STRSIZE];
+diff -up openssh-6.3p1/ssh-agent.c.coverity openssh-6.3p1/ssh-agent.c
+--- openssh-6.3p1/ssh-agent.c.coverity	2013-07-20 05:22:49.000000000 +0200
+++ openssh-6.3p1/ssh-agent.c	2013-10-07 13:20:36.296298024 +0200
+@@ -1143,8 +1143,8 @@ main(int ac, char **av)
+ 	sanitise_stdfd();
+ 
+ 	/* drop */
+-	setegid(getgid());
+-	setgid(getgid());
+	(void) setegid(getgid());
+	(void) setgid(getgid());
+ 
+ #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
+ 	/* Disable ptrace on Linux without sgid bit */
+diff -up openssh-6.3p1/sshd.c.coverity openssh-6.3p1/sshd.c
+--- openssh-6.3p1/sshd.c.coverity	2013-07-20 05:21:53.000000000 +0200
+++ openssh-6.3p1/sshd.c	2013-10-07 13:20:36.296298024 +0200
+@@ -699,8 +699,10 @@ privsep_preauth(Authctxt *authctxt)
+ 		if (getuid() == 0 || geteuid() == 0)
+ 			privsep_preauth_child();
+ 		setproctitle("%s", "[net]");
+-		if (box != NULL)
+		if (box != NULL) {
+ 			ssh_sandbox_child(box);
+			free(box);
+		}
+ 
+ 		return 0;
+ 	}
+@@ -1345,6 +1347,9 @@ server_accept_loop(int *sock_in, int *so
+ 		if (num_listen_socks < 0)
+ 			break;
+ 	}
+
+	if (fdset != NULL)
+		free(fdset);
+ }
+ 
+ 
--- a/openssh-6.3p1-ctr-cavstest.patch
+++ b/openssh-6.3p1-ctr-cavstest.patch
@ -1,45 +1,7 @@
-diff -up openssh-6.8p1/Makefile.in.ctr-cavs openssh-6.8p1/Makefile.in
--- openssh-6.8p1/Makefile.in.ctr-cavs	2015-03-18 11:22:05.493289018 +0100
-+++ openssh-6.8p1/Makefile.in	2015-03-18 11:22:44.504196316 +0100
-@@ -28,6 +28,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
- SFTP_SERVER=$(libexecdir)/sftp-server
- SSH_KEYSIGN=$(libexecdir)/ssh-keysign
- SSH_KEYCAT=$(libexecdir)/ssh-keycat
-+CTR_CAVSTEST=$(libexecdir)/ctr-cavstest
- SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
- PRIVSEP_PATH=@PRIVSEP_PATH@
-@@ -66,7 +67,7 @@ EXEEXT=@EXEEXT@
- 
- .SUFFIXES: .lo
- 
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
- 
- XMSS_OBJS=\
- 	ssh-xmss.o \
-@@ -194,6 +195,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
- ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
- 	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
- 
-+ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
-+	$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
-+
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
- 
-@@ -326,6 +330,7 @@ install-files:
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ctr-cavstest$(EXEEXT) $(DESTDIR)$(libexecdir)/ctr-cavstest$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
- 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
--- openssh-6.8p1/ctr-cavstest.c.ctr-cavs	2015-03-18 11:22:05.521288952 +0100
-+++ openssh-6.8p1/ctr-cavstest.c	2015-03-18 11:22:05.521288952 +0100
-@@ -0,0 +1,215 @@
+diff -up openssh-6.2p1/ctr-cavstest.c.ctr-cavs openssh-6.2p1/ctr-cavstest.c
+--- openssh-6.2p1/ctr-cavstest.c.ctr-cavs	2013-03-25 21:35:52.512586671 +0100
+++ openssh-6.2p1/ctr-cavstest.c	2013-03-25 21:35:52.512586671 +0100
+@@ -0,0 +1,208 @@
 +/*
 + *
 + * invocation (all of the following are equal):
@ -60,7 +22,6 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +
 +#include "xmalloc.h"
 +#include "log.h"
-+#include "ssherr.h"
 +#include "cipher.h"
 +
 +/* compatibility with old or broken OpenSSL versions */
@ -134,7 +95,7 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +                        break;
 +
 +                total += n;
-+                buf = xreallocarray(buf, total + READ_CHUNK, 1);
+                buf = xrealloc(buf, total + READ_CHUNK, 1);
 +        } while(total < MAX_READ_SIZE);
 +        return buf;
 +}
@ -142,14 +103,14 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +int main (int argc, char *argv[])
 +{
 +
-+        const struct sshcipher *c;
-+        struct sshcipher_ctx *cc;
+        Cipher *c;
+        CipherContext cc;
 +        char *algo = "aes128-ctr";
 +        char *hexkey = NULL;
 +        char *hexiv = "00000000000000000000000000000000";
 +        char *hexdata = NULL;
 +        char *p;
-+        int i, r;
+        int i;
 +        int encrypt = 1;
 +        void *key;
 +        size_t keylen;
@ -187,7 +148,7 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +                usage();
 +        }
 +
-+	OpenSSL_add_all_algorithms();
+	SSLeay_add_all_algorithms();
 +
 +	c = cipher_by_name(algo);
 +	if (c == NULL) {
@ -222,13 +183,10 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +		return 2;
 +	}
 +
-+	if ((r = cipher_init(&cc, c, key, keylen, iv, ivlen, encrypt)) != 0) {
-+		fprintf(stderr, "Error: cipher_init failed: %s\n", ssh_err(r));
-+		return 2;
-+	}
+	cipher_init(&cc, c, key, keylen, iv, ivlen, encrypt);
 +
-+	free(key);
-+	free(iv);
+        free(key);
+        free(iv);
 +
 +	outdata = malloc(datalen);
 +	if(outdata == NULL) {
@ -236,14 +194,11 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +		return 2;
 +	}
 +
-+	if ((r = cipher_crypt(cc, 0, outdata, data, datalen, 0, 0)) != 0) {
-+		fprintf(stderr, "Error: cipher_crypt failed: %s\n", ssh_err(r));
-+		return 2;
-+	}
+	cipher_crypt(&cc, outdata, data, datalen, 0, 0);
 +
-+	free(data);
+        free(data);
 +
-+	cipher_free(cc);
+	cipher_cleanup(&cc);
 +
 +        for (p = outdata; datalen > 0; ++p, --datalen) {
 +		printf("%02X", (unsigned char)*p);
@ -255,3 +210,41 @@ diff -up openssh-6.8p1/ctr-cavstest.c.ctr-cavs openssh-6.8p1/ctr-cavstest.c
 +        return 0;
 +}
 +
+diff -up openssh-6.2p1/Makefile.in.ctr-cavs openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ctr-cavs	2013-03-25 21:35:52.451586280 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-25 21:37:14.956114584 +0100
+@@ -28,6 +28,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
+ SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
+ SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
+ SSH_KEYCAT=$(libexecdir)/ssh-keycat
+CTR_CAVSTEST=$(libexecdir)/ctr-cavstest
+ SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
+ PRIVSEP_PATH=@PRIVSEP_PATH@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
+@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
+ MANFMT=@MANFMT@
+ INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
+ 
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
+ 
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -174,6 +175,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
+ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keycat.o
+ 	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
+ 
+ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
+	$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
+
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
+ 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
+ 
+@@ -281,6 +285,7 @@ install-files:
+ 		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
+ 	fi
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
+	$(INSTALL) -m 0755 $(STRIP_OPT) ctr-cavstest$(EXEEXT) $(DESTDIR)$(libexecdir)/ctr-cavstest$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
+ 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
--- a/openssh-6.3p1-fingerprint.patch
+++ b/openssh-6.3p1-fingerprint.patch
@ -0,0 +1,406 @@
+diff -up openssh-6.3p1/auth-rsa.c.fingerprint openssh-6.3p1/auth-rsa.c
+diff -up openssh-6.3p1/auth.c.fingerprint openssh-6.3p1/auth.c
+--- openssh-6.3p1/auth.c.fingerprint	2013-10-07 14:02:36.998968153 +0200
+++ openssh-6.3p1/auth.c	2013-10-07 15:42:05.243812405 +0200
+@@ -685,9 +685,10 @@ auth_key_is_revoked(Key *key)
+ 	case 1:
+  revoked:
+ 		/* Key revoked */
+-		key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+		key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
+ 		error("WARNING: authentication attempt with a revoked "
+-		    "%s key %s ", key_type(key), key_fp);
+		    "%s key %s%s ", key_type(key),
+		    key_fingerprint_prefix(), key_fp);
+ 		free(key_fp);
+ 		return 1;
+ 	}
+diff -up openssh-6.3p1/auth2-hostbased.c.fingerprint openssh-6.3p1/auth2-hostbased.c
+--- openssh-6.3p1/auth2-hostbased.c.fingerprint	2013-10-07 14:02:36.998968153 +0200
+++ openssh-6.3p1/auth2-hostbased.c	2013-10-07 15:43:49.747355927 +0200
+@@ -200,16 +200,18 @@ hostbased_key_allowed(struct passwd *pw,
+ 
+ 	if (host_status == HOST_OK) {
+ 		if (key_is_cert(key)) {
+-			fp = key_fingerprint(key->cert->signature_key,
+-			    SSH_FP_MD5, SSH_FP_HEX);
+			fp = key_selected_fingerprint(key->cert->signature_key,
+			    SSH_FP_HEX);		
+ 			verbose("Accepted certificate ID \"%s\" signed by "
+-			    "%s CA %s from %s@%s", key->cert->key_id,
+-			    key_type(key->cert->signature_key), fp,
+			    "%s CA %s%s from %s@%s", key->cert->key_id,
+			    key_type(key->cert->signature_key),
+			    key_fingerprint_prefix(), fp,
+ 			    cuser, lookup);
+ 		} else {
+-			fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+-			verbose("Accepted %s public key %s from %s@%s",
+-			    key_type(key), fp, cuser, lookup);
+			fp = key_selected_fingerprint(key, SSH_FP_HEX);
+			verbose("Accepted %s public key %s%s from %s@%s",
+			    key_type(key), key_fingerprint_prefix(),
+			    fp, cuser, lookup);
+ 		}
+ 		free(fp);
+ 	}
+diff -up openssh-6.3p1/auth2-pubkey.c.fingerprint openssh-6.3p1/auth2-pubkey.c
+--- openssh-6.3p1/auth2-pubkey.c.fingerprint	2013-07-18 08:10:10.000000000 +0200
+++ openssh-6.3p1/auth2-pubkey.c	2013-10-07 15:50:44.617495624 +0200
+@@ -359,10 +359,10 @@ check_authkeys_file(FILE *f, char *file,
+ 				continue;
+ 			if (!key_is_cert_authority)
+ 				continue;
+-			fp = key_fingerprint(found, SSH_FP_MD5,
+-			    SSH_FP_HEX);
+-			debug("matching CA found: file %s, line %lu, %s %s",
+-			    file, linenum, key_type(found), fp);
+			fp = key_selected_fingerprint(found, SSH_FP_HEX);
+			debug("matching CA found: file %s, line %lu, %s %s%s",
+			    file, linenum, key_type(found),
+			    key_fingerprint_prefix(), fp);
+ 			/*
+ 			 * If the user has specified a list of principals as
+ 			 * a key option, then prefer that list to matching
+@@ -400,9 +400,9 @@ check_authkeys_file(FILE *f, char *file,
+ 			if (key_is_cert_authority)
+ 				continue;
+ 			found_key = 1;
+-			fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
+-			debug("matching key found: file %s, line %lu %s %s",
+-			    file, linenum, key_type(found), fp);
+			fp = key_selected_fingerprint(found, SSH_FP_HEX);
+			verbose("Found matching %s key: %s%s",
+			    key_type(found), key_fingerprint_prefix(), fp);
+ 			free(fp);
+ 			break;
+ 		}
+@@ -425,13 +425,13 @@ user_cert_trusted_ca(struct passwd *pw,
+ 	if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
+ 		return 0;
+ 
+-	ca_fp = key_fingerprint(key->cert->signature_key,
+-	    SSH_FP_MD5, SSH_FP_HEX);
+	ca_fp = key_selected_fingerprint(key->cert->signature_key, SSH_FP_HEX);
+ 
+ 	if (key_in_file(key->cert->signature_key,
+ 	    options.trusted_user_ca_keys, 1) != 1) {
+-		debug2("%s: CA %s %s is not listed in %s", __func__,
+-		    key_type(key->cert->signature_key), ca_fp,
+		debug2("%s: CA %s%s %s is not listed in %s", __func__,
+		    key_type(key->cert->signature_key),
+		    key_fingerprint_prefix(), ca_fp,
+ 		    options.trusted_user_ca_keys);
+ 		goto out;
+ 	}
+diff -up openssh-6.3p1/key.c.fingerprint openssh-6.3p1/key.c
+--- openssh-6.3p1/key.c.fingerprint	2013-10-07 14:02:36.971968285 +0200
+++ openssh-6.3p1/key.c	2013-10-07 14:02:36.999968148 +0200
+@@ -598,6 +598,34 @@ key_fingerprint(const Key *k, enum fp_ty
+ 	return retval;
+ }
+ 
+enum fp_type
+key_fingerprint_selection(void)
+{
+	static enum fp_type rv;
+	static char rv_defined = 0;
+	char *env;
+
+	if (!rv_defined) {
+		env = getenv("SSH_FINGERPRINT_TYPE");
+		rv = (env && !strcmp (env, "sha")) ?
+			SSH_FP_SHA1 : SSH_FP_MD5;
+		rv_defined = 1;
+	}
+	return rv;
+}
+
+char *
+key_selected_fingerprint(Key *k, enum fp_rep dgst_rep)
+{
+	return key_fingerprint(k, key_fingerprint_selection(), dgst_rep);
+}
+
+char *
+key_fingerprint_prefix(void)
+{
+	return key_fingerprint_selection() == SSH_FP_SHA1 ? "sha1:" : "";
+}
+
+ /*
+  * Reads a multiple-precision integer in decimal from the buffer, and advances
+  * the pointer.  The integer must already be initialized.  This function is
+diff -up openssh-6.3p1/key.h.fingerprint openssh-6.3p1/key.h
+--- openssh-6.3p1/key.h.fingerprint	2013-10-07 14:02:36.999968148 +0200
+++ openssh-6.3p1/key.h	2013-10-07 15:44:17.574233450 +0200
+@@ -97,6 +97,9 @@ int		 key_equal_public(const Key *, cons
+ int		 key_equal(const Key *, const Key *);
+ char		*key_fingerprint(const Key *, enum fp_type, enum fp_rep);
+ u_char		*key_fingerprint_raw(const Key *, enum fp_type, u_int *);
+enum fp_type	 key_fingerprint_selection(void);
+char		*key_selected_fingerprint(Key *, enum fp_rep);
+char		*key_fingerprint_prefix(void);
+ const char	*key_type(const Key *);
+ const char	*key_cert_type(const Key *);
+ int		 key_write(const Key *, FILE *);
+diff -up openssh-6.3p1/ssh-add.c.fingerprint openssh-6.3p1/ssh-add.c
+--- openssh-6.3p1/ssh-add.c.fingerprint	2013-10-07 14:02:37.000968143 +0200
+++ openssh-6.3p1/ssh-add.c	2013-10-07 14:44:57.466515766 +0200
+@@ -326,10 +326,10 @@ list_identities(AuthenticationConnection
+ 		    key = ssh_get_next_identity(ac, &comment, version)) {
+ 			had_identities = 1;
+ 			if (do_fp) {
+-				fp = key_fingerprint(key, SSH_FP_MD5,
+-				    SSH_FP_HEX);
+-				printf("%d %s %s (%s)\n",
+-				    key_size(key), fp, comment, key_type(key));
+				fp = key_selected_fingerprint(key, SSH_FP_HEX);
+				printf("%d %s%s %s (%s)\n",
+				    key_size(key), key_fingerprint_prefix(),
+				    fp, comment, key_type(key));
+ 				free(fp);
+ 			} else {
+ 				if (!key_write(key, stdout))
+diff -up openssh-6.3p1/ssh-agent.c.fingerprint openssh-6.3p1/ssh-agent.c
+--- openssh-6.3p1/ssh-agent.c.fingerprint	2013-10-07 14:02:37.000968143 +0200
+++ openssh-6.3p1/ssh-agent.c	2013-10-07 15:41:11.627044336 +0200
+@@ -198,9 +198,9 @@ confirm_key(Identity *id)
+ 	char *p;
+ 	int ret = -1;
+ 
+-	p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
+-	if (ask_permission("Allow use of key %s?\nKey fingerprint %s.",
+-	    id->comment, p))
+	p = key_selected_fingerprint(id->key, SSH_FP_HEX);
+	if (ask_permission("Allow use of key %s?\nKey fingerprint %s%s.",
+	    id->comment, key_fingerprint_prefix(), p))
+ 		ret = 0;
+ 	free(p);
+ 
+diff -up openssh-6.3p1/ssh-keygen.c.fingerprint openssh-6.3p1/ssh-keygen.c
+--- openssh-6.3p1/ssh-keygen.c.fingerprint	2013-07-20 05:22:32.000000000 +0200
+++ openssh-6.3p1/ssh-keygen.c	2013-10-07 14:25:52.864145038 +0200
+@@ -767,13 +767,14 @@ do_fingerprint(struct passwd *pw)
+ {
+ 	FILE *f;
+ 	Key *public;
+-	char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
+	char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra, *pfx;
+ 	int i, skip = 0, num = 0, invalid = 1;
+ 	enum fp_rep rep;
+ 	enum fp_type fptype;
+ 	struct stat st;
+ 
+-	fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+	fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fingerprint_selection();
+	pfx =	 print_bubblebabble ? "" : key_fingerprint_prefix();
+ 	rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+ 
+ 	if (!have_identity)
+@@ -785,8 +786,8 @@ do_fingerprint(struct passwd *pw)
+ 	public = key_load_public(identity_file, &comment);
+ 	if (public != NULL) {
+ 		fp = key_fingerprint(public, fptype, rep);
+-		ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
+-		printf("%u %s %s (%s)\n", key_size(public), fp, comment,
+		ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+		printf("%u %s%s %s (%s)\n", key_size(public), pfx, fp, comment,
+ 		    key_type(public));
+ 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ 			printf("%s\n", ra);
+@@ -851,8 +852,8 @@ do_fingerprint(struct passwd *pw)
+ 		}
+ 		comment = *cp ? cp : comment;
+ 		fp = key_fingerprint(public, fptype, rep);
+-		ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
+-		printf("%u %s %s (%s)\n", key_size(public), fp,
+		ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+		printf("%u %s%s %s (%s)\n", key_size(public), pfx, fp,
+ 		    comment ? comment : "no comment", key_type(public));
+ 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ 			printf("%s\n", ra);
+@@ -970,13 +971,15 @@ printhost(FILE *f, const char *name, Key
+ 	if (print_fingerprint) {
+ 		enum fp_rep rep;
+ 		enum fp_type fptype;
+-		char *fp, *ra;
+		char *fp, *ra, *pfx;
+ 
+-		fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+		fptype = print_bubblebabble ? SSH_FP_SHA1 : key_fingerprint_selection();
+		pfx =	 print_bubblebabble ? "" : key_fingerprint_prefix();
+ 		rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+
+ 		fp = key_fingerprint(public, fptype, rep);
+-		ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
+-		printf("%u %s %s (%s)\n", key_size(public), fp, name,
+		ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+		printf("%u %s%s %s (%s)\n", key_size(public), pfx, fp, name,
+ 		    key_type(public));
+ 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ 			printf("%s\n", ra);
+@@ -1855,16 +1858,17 @@ do_show_cert(struct passwd *pw)
+ 		fatal("%s is not a certificate", identity_file);
+ 	v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
+ 
+-	key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+-	ca_fp = key_fingerprint(key->cert->signature_key,
+-	    SSH_FP_MD5, SSH_FP_HEX);
+	key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
+	ca_fp = key_selected_fingerprint(key->cert->signature_key, SSH_FP_HEX);
+ 
+ 	printf("%s:\n", identity_file);
+ 	printf("        Type: %s %s certificate\n", key_ssh_name(key),
+ 	    key_cert_type(key));
+-	printf("        Public key: %s %s\n", key_type(key), key_fp);
+-	printf("        Signing CA: %s %s\n",
+-	    key_type(key->cert->signature_key), ca_fp);
+	printf("        Public key: %s %s%s\n", key_type(key),
+	    key_fingerprint_prefix(), key_fp);
+	printf("        Signing CA: %s %s%s\n",
+	    key_type(key->cert->signature_key),
+	    key_fingerprint_prefix(), ca_fp);
+ 	printf("        Key ID: \"%s\"\n", key->cert->key_id);
+ 	if (!v00) {
+ 		printf("        Serial: %llu\n",
+@@ -2655,13 +2659,12 @@ passphrase_again:
+ 	fclose(f);
+ 
+ 	if (!quiet) {
+-		char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
+-		char *ra = key_fingerprint(public, SSH_FP_MD5,
+-		    SSH_FP_RANDOMART);
+		char *fp = key_selected_fingerprint(public, SSH_FP_HEX);
+		char *ra = key_selected_fingerprint(public, SSH_FP_RANDOMART);
+ 		printf("Your public key has been saved in %s.\n",
+ 		    identity_file);
+ 		printf("The key fingerprint is:\n");
+-		printf("%s %s\n", fp, comment);
+		printf("%s%s %s\n", key_fingerprint_prefix(), fp, comment);
+ 		printf("The key's randomart image is:\n");
+ 		printf("%s\n", ra);
+ 		free(ra);
+diff -up openssh-6.3p1/sshconnect.c.fingerprint openssh-6.3p1/sshconnect.c
+--- openssh-6.3p1/sshconnect.c.fingerprint	2013-06-01 23:31:19.000000000 +0200
+++ openssh-6.3p1/sshconnect.c	2013-10-07 14:43:54.859822036 +0200
+@@ -830,10 +830,10 @@ check_host_key(char *hostname, struct so
+ 				    "key for IP address '%.128s' to the list "
+ 				    "of known hosts.", type, ip);
+ 		} else if (options.visual_host_key) {
+-			fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+-			ra = key_fingerprint(host_key, SSH_FP_MD5,
+-			    SSH_FP_RANDOMART);
+-			logit("Host key fingerprint is %s\n%s\n", fp, ra);
+			fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+			ra = key_selected_fingerprint(host_key, SSH_FP_RANDOMART);
+			logit("Host key fingerprint is %s%s\n%s\n",
+			    key_fingerprint_prefix(), fp, ra);
+ 			free(ra);
+ 			free(fp);
+ 		}
+@@ -871,9 +871,8 @@ check_host_key(char *hostname, struct so
+ 			else
+ 				snprintf(msg1, sizeof(msg1), ".");
+ 			/* The default */
+-			fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+-			ra = key_fingerprint(host_key, SSH_FP_MD5,
+-			    SSH_FP_RANDOMART);
+			fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+			ra = key_selected_fingerprint(host_key, SSH_FP_RANDOMART);
+ 			msg2[0] = '\0';
+ 			if (options.verify_host_key_dns) {
+ 				if (matching_host_key_dns)
+@@ -888,10 +887,11 @@ check_host_key(char *hostname, struct so
+ 			snprintf(msg, sizeof(msg),
+ 			    "The authenticity of host '%.200s (%s)' can't be "
+ 			    "established%s\n"
+-			    "%s key fingerprint is %s.%s%s\n%s"
+			    "%s key fingerprint is %s%s.%s%s\n%s"
+ 			    "Are you sure you want to continue connecting "
+ 			    "(yes/no)? ",
+-			    host, ip, msg1, type, fp,
+			    host, ip, msg1, type,
+			    key_fingerprint_prefix(), fp,
+ 			    options.visual_host_key ? "\n" : "",
+ 			    options.visual_host_key ? ra : "",
+ 			    msg2);
+@@ -1136,8 +1136,9 @@ verify_host_key(char *host, struct socka
+ 	int flags = 0;
+ 	char *fp;
+ 
+-	fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+-	debug("Server host key: %s %s", key_type(host_key), fp);
+	fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+	debug("Server host key: %s %s%s", key_type(host_key),
+	    key_fingerprint_prefix(), fp);
+ 	free(fp);
+ 
+ 	/* XXX certs are not yet supported for DNS */
+@@ -1238,14 +1239,15 @@ show_other_keys(struct hostkeys *hostkey
+ 			continue;
+ 		if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
+ 			continue;
+-		fp = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_HEX);
+-		ra = key_fingerprint(found->key, SSH_FP_MD5, SSH_FP_RANDOMART);
+		fp = key_selected_fingerprint(found->key, SSH_FP_HEX);
+		ra = key_selected_fingerprint(found->key, SSH_FP_RANDOMART);
+ 		logit("WARNING: %s key found for host %s\n"
+ 		    "in %s:%lu\n"
+-		    "%s key fingerprint %s.",
+		    "%s key fingerprint %s%s.",
+ 		    key_type(found->key),
+ 		    found->host, found->file, found->line,
+-		    key_type(found->key), fp);
+		    key_type(found->key),
+		    key_fingerprint_prefix(), fp);
+ 		if (options.visual_host_key)
+ 			logit("%s", ra);
+ 		free(ra);
+@@ -1260,7 +1262,7 @@ warn_changed_key(Key *host_key)
+ {
+ 	char *fp;
+ 
+-	fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+	fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+ 
+ 	error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
+ 	error("@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @");
+@@ -1268,8 +1270,8 @@ warn_changed_key(Key *host_key)
+ 	error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
+ 	error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
+ 	error("It is also possible that a host key has just been changed.");
+-	error("The fingerprint for the %s key sent by the remote host is\n%s.",
+-	    key_type(host_key), fp);
+	error("The fingerprint for the %s key sent by the remote host is\n%s%s.",
+	    key_type(host_key),key_fingerprint_prefix(),  fp);
+ 	error("Please contact your system administrator.");
+ 
+ 	free(fp);
+diff -up openssh-6.3p1/sshconnect2.c.fingerprint openssh-6.3p1/sshconnect2.c
+--- openssh-6.3p1/sshconnect2.c.fingerprint	2013-10-07 14:02:37.001968139 +0200
+++ openssh-6.3p1/sshconnect2.c	2013-10-07 15:20:09.403234714 +0200
+@@ -590,8 +590,9 @@ input_userauth_pk_ok(int type, u_int32_t
+ 		    key->type, pktype);
+ 		goto done;
+ 	}
+-	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+-	debug2("input_userauth_pk_ok: fp %s", fp);
+	fp = key_selected_fingerprint(key, SSH_FP_HEX);
+	debug2("input_userauth_pk_ok: fp %s%s",
+	    key_fingerprint_prefix(), fp);
+ 	free(fp);
+ 
+ 	/*
+@@ -1202,8 +1203,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
+ 	int have_sig = 1;
+ 	char *fp;
+ 
+-	fp = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
+-	debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
+	fp = key_selected_fingerprint(id->key, SSH_FP_HEX);
+	debug3("sign_and_send_pubkey: %s %s%s", key_type(id->key),
+	    key_fingerprint_prefix(), fp);
+ 	free(fp);
+ 
+ 	if (key_to_blob(id->key, &blob, &bloblen) == 0) {
--- a/openssh-6.3p1-fips.patch
+++ b/openssh-6.3p1-fips.patch
@ -0,0 +1,611 @@
+diff -up openssh-6.3p1/Makefile.in.fips openssh-6.3p1/Makefile.in
+--- openssh-6.3p1/Makefile.in.fips	2013-10-11 22:24:32.850031186 +0200
+++ openssh-6.3p1/Makefile.in	2013-10-11 22:24:32.870031092 +0200
+@@ -147,25 +147,25 @@ libssh.a: $(LIBSSH_OBJS)
+ 	$(RANLIB) $@
+ 
+ ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
+-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS) $(GSSLIBS)
+ 
+ sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
+-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
+ 
+ scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
+ 	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 
+ ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
+-	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
+ 
+ ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-agent.o ssh-pkcs11-client.o
+-	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+	$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
+ 
+ ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o
+-	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
+ 
+ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readconf.o
+-	$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+	$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
+ 
+ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
+ 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+@@ -177,7 +177,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
+ 	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
+ 
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
+-	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
+ 
+ sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
+ 	$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+diff -up openssh-6.3p1/auth-rsa.c.fips openssh-6.3p1/auth-rsa.c
+--- openssh-6.3p1/auth-rsa.c.fips	2013-10-24 15:43:46.019999906 +0200
+++ openssh-6.3p1/auth-rsa.c	2013-10-24 15:44:09.262890686 +0200
+@@ -240,7 +240,7 @@ rsa_key_allowed_in_file(struct passwd *p
+ 			    "actual %d vs. announced %d.",
+ 			    file, linenum, BN_num_bits(key->rsa->n), bits);
+ 
+-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+		fp = key_fingerprint(key, FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
+ 		debug("matching key found: file %s, line %lu %s %s",
+ 		    file, linenum, key_type(key), fp);
+ 		free(fp);
+diff -up openssh-6.3p1/auth2-pubkey.c.fips openssh-6.3p1/auth2-pubkey.c
+--- openssh-6.3p1/auth2-pubkey.c.fips	2013-10-24 15:39:05.008319990 +0200
+++ openssh-6.3p1/auth2-pubkey.c	2013-10-24 15:39:05.029319892 +0200
+@@ -209,7 +209,7 @@ pubkey_auth_info(Authctxt *authctxt, con
+ 
+ 	if (key_is_cert(key)) {
+ 		fp = key_fingerprint(key->cert->signature_key,
+-		    SSH_FP_MD5, SSH_FP_HEX);
+		    FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
+ 		auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s", 
+ 		    key_type(key), key->cert->key_id,
+ 		    (unsigned long long)key->cert->serial,
+@@ -217,7 +217,7 @@ pubkey_auth_info(Authctxt *authctxt, con
+ 		    extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
+ 		free(fp);
+ 	} else {
+-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+		fp = key_fingerprint(key, FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX);
+ 		auth_info(authctxt, "%s %s%s%s", key_type(key), fp,
+ 		    extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
+ 		free(fp);
+diff -up openssh-6.3p1/authfile.c.fips openssh-6.3p1/authfile.c
+--- openssh-6.3p1/authfile.c.fips	2013-10-11 22:24:32.857031153 +0200
+++ openssh-6.3p1/authfile.c	2013-10-11 22:24:32.870031092 +0200
+@@ -148,8 +148,14 @@ key_private_rsa1_to_blob(Key *key, Buffe
+ 	/* Allocate space for the private part of the key in the buffer. */
+ 	cp = buffer_append_space(&encrypted, buffer_len(&buffer));
+ 
+-	cipher_set_key_string(&ciphercontext, cipher, passphrase,
+-	    CIPHER_ENCRYPT);
+	if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
+	    CIPHER_ENCRYPT) < 0) {
+		error("cipher_set_key_string failed.");
+		buffer_free(&encrypted);
+		buffer_free(&buffer);
+		return 0;
+	}
+
+ 	cipher_crypt(&ciphercontext, cp,
+ 	    buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
+ 	cipher_cleanup(&ciphercontext);
+@@ -472,8 +478,13 @@ key_parse_private_rsa1(Buffer *blob, con
+ 	cp = buffer_append_space(&decrypted, buffer_len(&copy));
+ 
+ 	/* Rest of the buffer is encrypted.  Decrypt it using the passphrase. */
+-	cipher_set_key_string(&ciphercontext, cipher, passphrase,
+-	    CIPHER_DECRYPT);
+	if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
+	    CIPHER_DECRYPT) < 0) {
+		error("cipher_set_key_string failed.");
+		buffer_free(&decrypted);
+		goto fail;
+	}
+
+ 	cipher_crypt(&ciphercontext, cp,
+ 	    buffer_ptr(&copy), buffer_len(&copy), 0, 0);
+ 	cipher_cleanup(&ciphercontext);
+diff -up openssh-6.3p1/cipher-ctr.c.fips openssh-6.3p1/cipher-ctr.c
+--- openssh-6.3p1/cipher-ctr.c.fips	2013-06-02 00:07:32.000000000 +0200
+++ openssh-6.3p1/cipher-ctr.c	2013-10-11 22:24:32.870031092 +0200
+@@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
+ 	aes_ctr.do_cipher = ssh_aes_ctr;
+ #ifndef SSH_OLD_EVP
+ 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
+-	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
+	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV |
+	    EVP_CIPH_FLAG_FIPS;
+ #endif
+ 	return (&aes_ctr);
+ }
+diff -up openssh-6.3p1/cipher.c.fips openssh-6.3p1/cipher.c
+--- openssh-6.3p1/cipher.c.fips	2013-10-11 22:24:32.820031327 +0200
+++ openssh-6.3p1/cipher.c	2013-10-11 22:24:32.871031087 +0200
+@@ -40,6 +40,7 @@
+ #include <sys/types.h>
+ 
+ #include <openssl/md5.h>
+#include <openssl/fips.h>
+ 
+ #include <string.h>
+ #include <stdarg.h>
+@@ -86,6 +87,27 @@ static const struct Cipher ciphers[] = {
+ 	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
+ };
+ 
+static const struct Cipher fips_ciphers[] = {
+	{ "none",	SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+	{ "des",	SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
+	{ "3des",	SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+	{ "3des-cbc",	SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
+	{ "aes128-cbc",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
+	{ "aes192-cbc",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
+	{ "aes256-cbc",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+	{ "rijndael-cbc@lysator.liu.se",
+			SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+	{ "aes128-ctr",	SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
+	{ "aes192-ctr",	SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
+	{ "aes256-ctr",	SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
+#ifdef OPENSSL_HAVE_EVPGCM
+	{ "aes128-gcm@openssh.com",
+			SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
+	{ "aes256-gcm@openssh.com",
+			SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
+#endif
+	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
+};
+ /*--*/
+ 
+ /* Returns a comma-separated list of supported ciphers. */
+@@ -96,7 +118,7 @@ cipher_alg_list(void)
+ 	size_t nlen, rlen = 0;
+ 	const Cipher *c;
+ 
+-	for (c = ciphers; c->name != NULL; c++) {
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++) {
+ 		if (c->number != SSH_CIPHER_SSH2)
+ 			continue;
+ 		if (ret != NULL)
+@@ -161,7 +183,7 @@ const Cipher *
+ cipher_by_name(const char *name)
+ {
+ 	const Cipher *c;
+-	for (c = ciphers; c->name != NULL; c++)
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
+ 		if (strcmp(c->name, name) == 0)
+ 			return c;
+ 	return NULL;
+@@ -171,7 +193,7 @@ const Cipher *
+ cipher_by_number(int id)
+ {
+ 	const Cipher *c;
+-	for (c = ciphers; c->name != NULL; c++)
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
+ 		if (c->number == id)
+ 			return c;
+ 	return NULL;
+@@ -215,7 +237,7 @@ cipher_number(const char *name)
+ 	const Cipher *c;
+ 	if (name == NULL)
+ 		return -1;
+-	for (c = ciphers; c->name != NULL; c++)
+	for (c = FIPS_mode() ? fips_ciphers : ciphers; c->name != NULL; c++)
+ 		if (strcasecmp(c->name, name) == 0)
+ 			return c->number;
+ 	return -1;
+@@ -374,14 +396,15 @@ cipher_cleanup(CipherContext *cc)
+  * passphrase and using the resulting 16 bytes as the key.
+  */
+ 
+-void
+int
+ cipher_set_key_string(CipherContext *cc, const Cipher *cipher,
+     const char *passphrase, int do_encrypt)
+ {
+ 	MD5_CTX md;
+ 	u_char digest[16];
+ 
+-	MD5_Init(&md);
+	if (MD5_Init(&md) <= 0)
+		return -1;
+ 	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
+ 	MD5_Final(digest, &md);
+ 
+@@ -389,6 +412,7 @@ cipher_set_key_string(CipherContext *cc,
+ 
+ 	memset(digest, 0, sizeof(digest));
+ 	memset(&md, 0, sizeof(md));
+	return 0;
+ }
+ 
+ /*
+diff -up openssh-6.3p1/cipher.h.fips openssh-6.3p1/cipher.h
+--- openssh-6.3p1/cipher.h.fips	2013-10-11 22:24:32.820031327 +0200
+++ openssh-6.3p1/cipher.h	2013-10-11 22:24:32.871031087 +0200
+@@ -92,7 +92,7 @@ void	 cipher_init(CipherContext *, const
+ void	 cipher_crypt(CipherContext *, u_char *, const u_char *,
+     u_int, u_int, u_int);
+ void	 cipher_cleanup(CipherContext *);
+-void	 cipher_set_key_string(CipherContext *, const Cipher *, const char *, int);
+int	 cipher_set_key_string(CipherContext *, const Cipher *, const char *, int);
+ u_int	 cipher_blocksize(const Cipher *);
+ u_int	 cipher_keylen(const Cipher *);
+ u_int	 cipher_authlen(const Cipher *);
+diff -up openssh-6.3p1/key.c.fips openssh-6.3p1/key.c
+--- openssh-6.3p1/key.c.fips	2013-10-11 22:24:32.821031322 +0200
+++ openssh-6.3p1/key.c	2013-10-11 22:24:32.871031087 +0200
+@@ -40,6 +40,7 @@
+ #include <sys/types.h>
+ 
+ #include <openssl/evp.h>
+#include <openssl/fips.h>
+ #include <openbsd-compat/openssl-compat.h>
+ 
+ #include <stdarg.h>
+@@ -606,9 +607,13 @@ key_fingerprint_selection(void)
+ 	char *env;
+ 
+ 	if (!rv_defined) {
+-		env = getenv("SSH_FINGERPRINT_TYPE");
+-		rv = (env && !strcmp (env, "sha")) ?
+-			SSH_FP_SHA1 : SSH_FP_MD5;
+		if (FIPS_mode())
+			rv = SSH_FP_SHA1;
+		else {
+			env = getenv("SSH_FINGERPRINT_TYPE");
+			rv = (env && !strcmp (env, "sha")) ?
+				SSH_FP_SHA1 : SSH_FP_MD5;
+		}
+ 		rv_defined = 1;
+ 	}
+ 	return rv;
+diff -up openssh-6.3p1/mac.c.fips openssh-6.3p1/mac.c
+--- openssh-6.3p1/mac.c.fips	2013-10-11 22:24:32.821031322 +0200
+++ openssh-6.3p1/mac.c	2013-10-11 22:25:35.394737186 +0200
+@@ -28,6 +28,7 @@
+ #include <sys/types.h>
+ 
+ #include <openssl/hmac.h>
+#include <openssl/fips.h>
+ 
+ #include <stdarg.h>
+ #include <string.h>
+@@ -60,7 +61,7 @@ struct macalg {
+ 	int		etm;		/* Encrypt-then-MAC */
+ };
+ 
+-static const struct macalg macs[] = {
+static const struct macalg all_macs[] = {
+ 	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
+ 	{ "hmac-sha1",				SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+ 	{ "hmac-sha1-96",			SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
+@@ -91,6 +92,18 @@ static const struct macalg macs[] = {
+ 	{ NULL,					0, NULL, 0, 0, 0, 0 }
+ };
+ 
+static const struct macalg fips_macs[] = {
+	{ "hmac-sha1",				SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+	{ "hmac-sha1-etm@openssh.com",		SSH_EVP, EVP_sha1, 0, 0, 0, 1 },
+#ifdef HAVE_EVP_SHA256
+	{ "hmac-sha2-256",			SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
+	{ "hmac-sha2-512",			SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
+	{ "hmac-sha2-256-etm@openssh.com",	SSH_EVP, EVP_sha256, 0, 0, 0, 1 },
+	{ "hmac-sha2-512-etm@openssh.com",	SSH_EVP, EVP_sha512, 0, 0, 0, 1 },
+#endif
+	{ NULL,					0, NULL, 0, 0, 0, 0 }
+};
+
+ /* Returns a comma-separated list of supported MACs. */
+ char *
+ mac_alg_list(void)
+@@ -99,7 +112,7 @@ mac_alg_list(void)
+ 	size_t nlen, rlen = 0;
+ 	const struct macalg *m;
+ 
+-	for (m = macs; m->name != NULL; m++) {
+	for (m = FIPS_mode() ? fips_macs : all_macs; m->name != NULL; m++) {
+ 		if (ret != NULL)
+ 			ret[rlen++] = '\n';
+ 		nlen = strlen(m->name);
+@@ -136,7 +149,7 @@ mac_setup(Mac *mac, char *name)
+ {
+ 	const struct macalg *m;
+ 
+-	for (m = macs; m->name != NULL; m++) {
+	for (m = FIPS_mode() ? fips_macs : all_macs; m->name != NULL; m++) {
+ 		if (strcmp(name, m->name) != 0)
+ 			continue;
+ 		if (mac != NULL)
+diff -up openssh-6.3p1/myproposal.h.fips openssh-6.3p1/myproposal.h
+--- openssh-6.3p1/myproposal.h.fips	2013-06-11 04:10:02.000000000 +0200
+++ openssh-6.3p1/myproposal.h	2013-10-11 22:24:32.872031082 +0200
+@@ -114,6 +114,19 @@
+ #define	KEX_DEFAULT_COMP	"none,zlib@openssh.com,zlib"
+ #define	KEX_DEFAULT_LANG	""
+ 
+#define	KEX_FIPS_ENCRYPT \
+	"aes128-ctr,aes192-ctr,aes256-ctr," \
+	"aes128-cbc,3des-cbc," \
+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se"
+#ifdef HAVE_EVP_SHA256
+#define	KEX_FIPS_MAC \
+	"hmac-sha1," \
+	"hmac-sha2-256," \
+	"hmac-sha2-512"
+#else
+#define	KEX_FIPS_MAC \
+	"hmac-sha1"
+#endif
+ 
+ static char *myproposal[PROPOSAL_MAX] = {
+ 	KEX_DEFAULT_KEX,
+diff -up openssh-6.3p1/openbsd-compat/bsd-arc4random.c.fips openssh-6.3p1/openbsd-compat/bsd-arc4random.c
+--- openssh-6.3p1/openbsd-compat/bsd-arc4random.c.fips	2010-03-25 22:52:02.000000000 +0100
+++ openssh-6.3p1/openbsd-compat/bsd-arc4random.c	2013-10-11 22:24:32.872031082 +0200
+@@ -37,25 +37,18 @@
+ #define REKEY_BYTES	(1 << 24)
+ 
+ static int rc4_ready = 0;
+-static RC4_KEY rc4;
+ 
+ unsigned int
+ arc4random(void)
+ {
+ 	unsigned int r = 0;
+-	static int first_time = 1;
+	void *rp = &r;
+ 
+-	if (rc4_ready <= 0) {
+-		if (first_time)
+-			seed_rng();
+-		first_time = 0;
+	if (!rc4_ready) {
+ 		arc4random_stir();
+ 	}
+	RAND_bytes(rp, sizeof(r));
+ 
+-	RC4(&rc4, sizeof(r), (unsigned char *)&r, (unsigned char *)&r);
+-
+-	rc4_ready -= sizeof(r);
+-	
+ 	return(r);
+ }
+ 
+@@ -63,24 +56,11 @@ void
+ arc4random_stir(void)
+ {
+ 	unsigned char rand_buf[SEED_SIZE];
+-	int i;
+ 
+-	memset(&rc4, 0, sizeof(rc4));
+ 	if (RAND_bytes(rand_buf, sizeof(rand_buf)) <= 0)
+ 		fatal("Couldn't obtain random bytes (error %ld)",
+ 		    ERR_get_error());
+-	RC4_set_key(&rc4, sizeof(rand_buf), rand_buf);
+-
+-	/*
+-	 * Discard early keystream, as per recommendations in:
+-	 * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
+-	 */
+-	for(i = 0; i <= 256; i += sizeof(rand_buf))
+-		RC4(&rc4, sizeof(rand_buf), rand_buf, rand_buf);
+-
+-	memset(rand_buf, 0, sizeof(rand_buf));
+-
+-	rc4_ready = REKEY_BYTES;
+	rc4_ready = 1;
+ }
+ #endif /* !HAVE_ARC4RANDOM */
+ 
+diff -up openssh-6.3p1/ssh-keygen.c.fips openssh-6.3p1/ssh-keygen.c
+--- openssh-6.3p1/ssh-keygen.c.fips	2013-10-24 15:45:06.055623916 +0200
+++ openssh-6.3p1/ssh-keygen.c	2013-10-24 15:45:36.906478986 +0200
+@@ -730,7 +730,7 @@ do_download(struct passwd *pw)
+ 	enum fp_type fptype;
+ 	char *fp, *ra;
+ 
+-	fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+	fptype = print_bubblebabble ? SSH_FP_SHA1 : (FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5);
+ 	rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+ 
+ 	pkcs11_init(0);
+@@ -740,7 +740,7 @@ do_download(struct passwd *pw)
+ 	for (i = 0; i < nkeys; i++) {
+ 		if (print_fingerprint) {
+ 			fp = key_fingerprint(keys[i], fptype, rep);
+-			ra = key_fingerprint(keys[i], SSH_FP_MD5,
+			ra = key_fingerprint(keys[i], FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5,
+ 			    SSH_FP_RANDOMART);
+ 			printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
+ 			    fp, key_type(keys[i]));
+diff -up openssh-6.3p1/ssh.c.fips openssh-6.3p1/ssh.c
+--- openssh-6.3p1/ssh.c.fips	2013-07-25 03:55:53.000000000 +0200
+++ openssh-6.3p1/ssh.c	2013-10-11 22:24:32.872031082 +0200
+@@ -73,6 +73,8 @@
+ 
+ #include <openssl/evp.h>
+ #include <openssl/err.h>
+#include <openssl/fips.h>
+#include <fipscheck.h>
+ #include "openbsd-compat/openssl-compat.h"
+ #include "openbsd-compat/sys-queue.h"
+ 
+@@ -253,6 +255,13 @@ main(int ac, char **av)
+ 	sanitise_stdfd();
+ 
+ 	__progname = ssh_get_progname(av[0]);
+        SSLeay_add_all_algorithms();
+	if (access("/etc/system-fips", F_OK) == 0)
+		if (! FIPSCHECK_verify(NULL, NULL))
+			if (FIPS_mode())
+				fatal("FIPS integrity verification test failed.");
+			else
+				logit("FIPS integrity verification test failed.");
+ 
+ #ifndef HAVE_SETPROCTITLE
+ 	/* Prepare for later setproctitle emulation */
+@@ -330,6 +339,9 @@ main(int ac, char **av)
+ 	    "ACD:E:F:I:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) {
+ 		switch (opt) {
+ 		case '1':
+			if (FIPS_mode()) {
+				fatal("Protocol 1 not allowed in the FIPS mode.");
+			}
+ 			options.protocol = SSH_PROTO_1;
+ 			break;
+ 		case '2':
+@@ -647,7 +659,6 @@ main(int ac, char **av)
+ 	if (!host)
+ 		usage();
+ 
+-	OpenSSL_add_all_algorithms();
+ 	ERR_load_crypto_strings();
+ 
+ 	/* Initialize the command to execute on remote host. */
+@@ -748,6 +759,10 @@ main(int ac, char **av)
+ 
+ 	seed_rng();
+ 
+	if (FIPS_mode()) {
+		logit("FIPS mode initialized");
+	}
+
+ 	if (options.user == NULL)
+ 		options.user = xstrdup(pw->pw_name);
+ 
+@@ -816,6 +831,12 @@ main(int ac, char **av)
+ 
+ 	timeout_ms = options.connection_timeout * 1000;
+ 
+	if (FIPS_mode()) {
+		options.protocol &= SSH_PROTO_2;
+		if (options.protocol == 0)
+			fatal("Protocol 2 disabled by configuration but required in the FIPS mode.");
+	}
+
+ 	/* Open a connection to the remote host. */
+ 	if (ssh_connect(host, &hostaddr, options.port,
+ 	    options.address_family, options.connection_attempts, &timeout_ms,
+diff -up openssh-6.3p1/sshconnect2.c.fips openssh-6.3p1/sshconnect2.c
+--- openssh-6.3p1/sshconnect2.c.fips	2013-10-11 22:24:32.810031374 +0200
+++ openssh-6.3p1/sshconnect2.c	2013-10-11 22:24:32.873031077 +0200
+@@ -44,6 +44,8 @@
+ #include <vis.h>
+ #endif
+ 
+#include <openssl/fips.h>
+
+ #include "openbsd-compat/sys-queue.h"
+ 
+ #include "xmalloc.h"
+@@ -170,6 +172,10 @@ ssh_kex2(char *host, struct sockaddr *ho
+ 	if (options.ciphers != NULL) {
+ 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+ 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
+	} else if (FIPS_mode()) {
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+		myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_FIPS_ENCRYPT;
+
+ 	}
+ 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+ 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
+@@ -185,7 +191,11 @@ ssh_kex2(char *host, struct sockaddr *ho
+ 	if (options.macs != NULL) {
+ 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
+ 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
+	} else if (FIPS_mode()) {
+		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
+		myproposal[PROPOSAL_MAC_ALGS_STOC] = KEX_FIPS_MAC;
+ 	}
+
+ 	if (options.hostkeyalgorithms != NULL)
+ 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
+ 		    options.hostkeyalgorithms;
+diff -up openssh-6.4p1/sshd.c.fips openssh-6.4p1/sshd.c
+--- openssh-6.4p1/sshd.c.fips	2014-01-27 16:20:12.751358484 +0100
+++ openssh-6.4p1/sshd.c	2014-01-27 16:21:12.961052163 +0100
+@@ -76,6 +76,8 @@
+ #include <openssl/bn.h>
+ #include <openssl/md5.h>
+ #include <openssl/rand.h>
+#include <openssl/fips.h>
+#include <fipscheck.h>
+ #include "openbsd-compat/openssl-compat.h"
+ 
+ #ifdef HAVE_SECUREWARE
+@@ -1450,6 +1452,18 @@ main(int ac, char **av)
+ #endif
+ 	__progname = ssh_get_progname(av[0]);
+ 
+        SSLeay_add_all_algorithms();
+	if (access("/etc/system-fips", F_OK) == 0)
+		if (! FIPSCHECK_verify(NULL, NULL)) {
+			openlog(__progname, LOG_PID, LOG_AUTHPRIV);
+			if (FIPS_mode()) {
+				syslog(LOG_CRIT, "FIPS integrity verification test failed.");
+				cleanup_exit(255);
+			}
+			else
+				syslog(LOG_INFO, "FIPS integrity verification test failed.");
+			closelog();
+		}
+ 	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
+ 	saved_argc = ac;
+ 	rexec_argc = ac;
+@@ -1601,8 +1615,6 @@ main(int ac, char **av)
+ 	else
+ 		closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
+ 
+-	OpenSSL_add_all_algorithms();
+-
+ 	/* If requested, redirect the logs to the specified logfile. */
+ 	if (logfile != NULL) {
+ 		log_redirect_stderr_to(logfile);
+@@ -1773,6 +1785,10 @@ main(int ac, char **av)
+ 		debug("private host key: #%d type %d %s", i, keytype,
+ 		    key_type(key ? key : pubkey));
+ 	}
+	if ((options.protocol & SSH_PROTO_1) && FIPS_mode()) {
+		logit("Disabling protocol version 1. Not allowed in the FIPS mode.");
+		options.protocol &= ~SSH_PROTO_1;
+	}
+ 	if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
+ 		logit("Disabling protocol version 1. Could not load host key");
+ 		options.protocol &= ~SSH_PROTO_1;
+@@ -1936,6 +1952,10 @@ main(int ac, char **av)
+ 	/* Initialize the random number generator. */
+ 	arc4random_stir();
+ 
+	if (FIPS_mode()) {
+		logit("FIPS mode initialized");
+	}
+
+ 	/* Chdir to the root directory so that the current disk can be
+ 	   unmounted if desired. */
+ 	if (chdir("/") == -1)
+@@ -2498,6 +2518,9 @@ do_ssh2_kex(void)
+ 	if (options.ciphers != NULL) {
+ 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+ 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
+	} else if (FIPS_mode()) {
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+		myproposal[PROPOSAL_ENC_ALGS_STOC] = KEX_FIPS_ENCRYPT;
+ 	}
+ 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+ 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
+@@ -2507,6 +2530,9 @@ do_ssh2_kex(void)
+ 	if (options.macs != NULL) {
+ 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
+ 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
+	} else if (FIPS_mode()) {
+		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
+		myproposal[PROPOSAL_MAC_ALGS_STOC] = KEX_FIPS_MAC;
+ 	}
+ 	if (options.compression == COMP_NONE) {
+ 		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
--- a/openssh-6.3p1-force_krb.patch
+++ b/openssh-6.3p1-force_krb.patch
@ -1,7 +1,6 @@
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 413b845..54dd383 100644
--- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
+diff -up openssh-6.3p1/gss-serv-krb5.c.force_krb openssh-6.3p1/gss-serv-krb5.c
+--- openssh-6.3p1/gss-serv-krb5.c.force_krb	2013-10-11 18:58:51.553948159 +0200
+++ openssh-6.3p1/gss-serv-krb5.c	2013-10-11 21:40:49.972337025 +0200
@@ -32,7 +32,9 @@
 #include <sys/types.h>
 
@ -11,16 +10,21 @@ index 413b845..54dd383 100644
 +#include <unistd.h>
 
 #include "xmalloc.h"
- #include "sshkey.h"
-@@ -45,6 +47,7 @@
+ #include "key.h"
+@@ -40,10 +42,12 @@
+ #include "auth.h"
+ #include "log.h"
+ #include "servconf.h"
+#include "misc.h"
 
+ #include "buffer.h"
 #include "ssh-gss.h"
 
 +extern Authctxt *the_authctxt;
 extern ServerOptions options;
 
 #ifdef HEIMDAL
-@@ -56,6 +59,13 @@ extern ServerOptions options;
+@@ -55,6 +59,13 @@ extern ServerOptions options;
 # include <gssapi/gssapi_krb5.h>
 #endif
 
@ -34,7 +38,7 @@ index 413b845..54dd383 100644
 static krb5_context krb_context = NULL;
 
 /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
-@@ -88,6 +98,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -87,6 +98,7 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
 	krb5_principal princ;
 	int retval;
 	const char *errmsg;
@ -42,7 +46,7 @@ index 413b845..54dd383 100644
 
 	if (ssh_gssapi_krb5_init() == 0)
 		return 0;
-@@ -99,10 +110,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -98,10 +110,22 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
 		krb5_free_error_message(krb_context, errmsg);
 		return 0;
 	}
@ -66,7 +70,7 @@ index 413b845..54dd383 100644
 	} else
 		retval = 0;
 
-@@ -110,6 +133,137 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -109,6 +133,135 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
 	return retval;
 }
 
@ -97,14 +101,13 @@ index 413b845..54dd383 100644
 +{
 +	FILE *fp;
 +	char file[MAXPATHLEN];
-+	char *line = NULL;
+	char line[BUFSIZ];
 +	char kuser[65]; /* match krb5_kuserok() */
 +	struct stat st;
 +	struct passwd *pw = the_authctxt->pw;
 +	int found_principal = 0;
 +	int ncommands = 0, allcommands = 0;
-+	u_long linenum = 0;
-+	size_t linesize = 0;
+	u_long linenum;
 +
 +	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
 +	/* If both .k5login and .k5users DNE, self-login is ok. */
@ -148,9 +151,9 @@ index 413b845..54dd383 100644
 +	k5users_allowed_cmds = xcalloc(++ncommands,
 +	    sizeof(*k5users_allowed_cmds));
 +
-+	/* Check each line.  ksu allows unlimited length lines. */
-+	while (!allcommands && getline(&line, &linesize, fp) != -1) {
-+		linenum++;
+	/* Check each line.  ksu allows unlimited length lines.  We don't. */
+	while (!allcommands && read_keyfile_line(fp, file, line, sizeof(line),
+	    &linenum) != -1) {
 +		char *token;
 +
 +		/* we parse just like ksu, even though we could do better */
@ -164,7 +167,7 @@ index 413b845..54dd383 100644
 +				k5users_allowed_cmds[ncommands-1] =
 +				    xstrdup(pw->pw_shell);
 +				k5users_allowed_cmds =
-+				    xreallocarray(k5users_allowed_cmds, ++ncommands,
+				    xrealloc(k5users_allowed_cmds, ++ncommands,
 +					sizeof(*k5users_allowed_cmds));
 +				break;
 +			}
@ -177,13 +180,12 @@ index 413b845..54dd383 100644
 +				k5users_allowed_cmds[ncommands-1] =
 +				    xstrdup(token);
 +				k5users_allowed_cmds =
-+				    xreallocarray(k5users_allowed_cmds, ++ncommands,
+				    xrealloc(k5users_allowed_cmds, ++ncommands,
 +					sizeof(*k5users_allowed_cmds));
 +				token = strtok(NULL, " \t\n");
 +			}
 +		}
 +       }
-+	free(line);
 +	if (k5users_allowed_cmds) {
 +		/* terminate vector */
 +		k5users_allowed_cmds[ncommands-1] = NULL;
@ -204,20 +206,19 @@ index 413b845..54dd383 100644
 
 /* This writes out any forwarded credentials from the structure populated
  * during userauth. Called after we have setuid to the user */
-diff --git a/session.c b/session.c
-index 28659ec..9c94d8e 100644
--- a/session.c
-+++ b/session.c
-@@ -789,6 +789,29 @@ do_exec(Session *s, const char *command)
- 		command = auth_opts->force_command;
- 		forced = "(key-option)";
+diff -up openssh-6.3p1/session.c.force_krb openssh-6.3p1/session.c
+--- openssh-6.3p1/session.c.force_krb	2013-10-11 18:58:51.487948468 +0200
+++ openssh-6.3p1/session.c	2013-10-11 18:58:51.563948112 +0200
+@@ -823,6 +823,29 @@ do_exec(Session *s, const char *command)
+ 		debug("Forced command (key option) '%.900s'", command);
 	}
+ 
 +#ifdef GSSAPI
 +#ifdef KRB5 /* k5users_allowed_cmds only available w/ GSSAPI+KRB5 */
 +	else if (k5users_allowed_cmds) {
 +		const char *match = command;
 +		int allowed = 0, i = 0;
-+
+ 
 +		if (!match)
 +			match = s->pw->pw_shell;
 +		while (k5users_allowed_cmds[i]) {
@ -235,13 +236,12 @@ index 28659ec..9c94d8e 100644
 +#endif
 +#endif
 +
- 	s->forced = 0;
- 	if (forced != NULL) {
- 		s->forced = 1;
-diff --git a/ssh-gss.h b/ssh-gss.h
-index 0374c88..509109a 100644
--- a/ssh-gss.h
-+++ b/ssh-gss.h
+ #ifdef SSH_AUDIT_EVENTS
+ 	if (s->command != NULL || s->command_handle != -1)
+ 		fatal("do_exec: command already set");
+diff -up openssh-6.3p1/ssh-gss.h.force_krb openssh-6.3p1/ssh-gss.h
+--- openssh-6.3p1/ssh-gss.h.force_krb	2013-10-11 18:58:51.558948136 +0200
+++ openssh-6.3p1/ssh-gss.h	2013-10-11 18:58:51.563948112 +0200
@@ -49,6 +49,10 @@
 #  endif /* !HAVE_DECL_GSS_C_NT_... */
 
@ -253,11 +253,10 @@ index 0374c88..509109a 100644
 #endif /* KRB5 */
 
 /* draft-ietf-secsh-gsskeyex-06 */
-diff --git a/sshd.8 b/sshd.8
-index adcaaf9..824163b 100644
--- a/sshd.8
-+++ b/sshd.8
-@@ -324,6 +324,7 @@ Finally, the server and the client enter an authentication dialog.
+diff -up openssh-6.3p1/sshd.8.force_krb openssh-6.3p1/sshd.8
+--- openssh-6.3p1/sshd.8.force_krb	2013-10-11 18:58:51.537948234 +0200
+++ openssh-6.3p1/sshd.8	2013-10-11 18:58:51.563948112 +0200
+@@ -326,6 +326,7 @@ Finally, the server and the client enter
 The client tries to authenticate itself using
 host-based authentication,
 public key authentication,
@ -265,7 +264,7 @@ index adcaaf9..824163b 100644
 challenge-response authentication,
 or password authentication.
 .Pp
-@@ -800,6 +801,12 @@ This file is used in exactly the same way as
+@@ -797,6 +798,12 @@ This file is used in exactly the same wa
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp
--- a/openssh-6.3p1-gsskex.patch
+++ b/openssh-6.3p1-gsskex.patch
--- a/openssh-6.3p1-increase-size-of-DF-groups.patch
+++ b/openssh-6.3p1-increase-size-of-DF-groups.patch
@ -0,0 +1,65 @@
+diff -U0 openssh-6.3p1/ChangeLog.df openssh-6.3p1/ChangeLog
+--- openssh-6.3p1/ChangeLog.df	2013-10-23 22:38:03.476272461 +0200
+++ openssh-6.3p1/ChangeLog	2013-10-23 22:39:46.051788366 +0200
+@@ -0,0 +1,8 @@
+20131010
+ - dtucker@cvs.openbsd.org 2013/10/08 11:42:13
+   [dh.c dh.h]
+   Increase the size of the Diffie-Hellman groups requested for a each
+   symmetric key size.  New values from NIST Special Publication 800-57 with
+   the upper limit specified by RFC4419.  Pointed out by Peter Backes, ok
+   djm@.
+
+diff -up openssh-6.3p1/dh.c.df openssh-6.3p1/dh.c
+--- openssh-6.3p1/dh.c.df	2013-07-18 08:12:07.000000000 +0200
+++ openssh-6.3p1/dh.c	2013-10-23 22:38:03.476272461 +0200
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: dh.c,v 1.51 2013/07/02 12:31:43 markus Exp $ */
+/* $OpenBSD: dh.c,v 1.52 2013/10/08 11:42:13 dtucker Exp $ */
+ /*
+  * Copyright (c) 2000 Niels Provos.  All rights reserved.
+  *
+@@ -352,17 +352,20 @@ dh_new_group14(void)
+ 
+ /*
+  * Estimates the group order for a Diffie-Hellman group that has an
+- * attack complexity approximately the same as O(2**bits).  Estimate
+- * with:  O(exp(1.9223 * (ln q)^(1/3) (ln ln q)^(2/3)))
+ * attack complexity approximately the same as O(2**bits).
+ * Values from NIST Special Publication 800-57: Recommendation for Key
+ * Management Part 1 (rev 3) limited by the recommended maximum value
+ * from RFC4419 section 3.
+  */
+ 
+ int
+ dh_estimate(int bits)
+ {
+-
+	if (bits <= 112)
+		return 2048;
+ 	if (bits <= 128)
+-		return (1024);	/* O(2**86) */
+		return 3072;
+ 	if (bits <= 192)
+-		return (2048);	/* O(2**116) */
+-	return (4096);		/* O(2**156) */
+		return 7680;
+	return 8192;
+ }
+diff -up openssh-6.3p1/dh.h.df openssh-6.3p1/dh.h
+--- openssh-6.3p1/dh.h.df	2008-06-29 14:47:04.000000000 +0200
+++ openssh-6.3p1/dh.h	2013-10-23 22:38:03.476272461 +0200
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: dh.h,v 1.10 2008/06/26 09:19:40 djm Exp $ */
+/* $OpenBSD: dh.h,v 1.11 2013/10/08 11:42:13 dtucker Exp $ */
+ 
+ /*
+  * Copyright (c) 2000 Niels Provos.  All rights reserved.
+@@ -43,6 +43,7 @@ int	 dh_pub_is_valid(DH *, BIGNUM *);
+ 
+ int	 dh_estimate(int);
+ 
+/* Min and max values from RFC4419. */
+ #define DH_GRP_MIN	1024
+ #define DH_GRP_MAX	8192
+ 
--- a/openssh-6.3p1-keycat.patch
+++ b/openssh-6.3p1-keycat.patch
@ -1,24 +1,6 @@
-diff -up openssh/auth.c.keycat openssh/misc.c
--- openssh/auth.c.keycat	2015-06-24 10:57:50.158849606 +0200
-+++ openssh/auth.c	2015-06-24 11:04:23.989868638 +0200
-@@ -966,6 +966,14 @@ subprocess(const char *tag, struct passw
- 			_exit(1);
- 		}
- 
-+#ifdef WITH_SELINUX
-+		if (sshd_selinux_setup_env_variables() < 0) {
-+			error ("failed to copy environment:  %s",
-+			    strerror(errno));
-+			_exit(127);
-+		}
-+#endif
-+
- 		execve(av[0], av, child_env);
- 		error("%s exec \"%s\": %s", tag, command, strerror(errno));
- 		_exit(127);
-diff -up openssh/HOWTO.ssh-keycat.keycat openssh/HOWTO.ssh-keycat
--- openssh/HOWTO.ssh-keycat.keycat	2015-06-24 10:57:50.157849608 +0200
-+++ openssh/HOWTO.ssh-keycat	2015-06-24 10:57:50.157849608 +0200
+diff -up openssh-6.3p1/HOWTO.ssh-keycat.keycat openssh-6.3p1/HOWTO.ssh-keycat
+--- openssh-6.3p1/HOWTO.ssh-keycat.keycat	2013-10-10 15:16:33.445566916 +0200
+++ openssh-6.3p1/HOWTO.ssh-keycat	2013-10-10 15:16:33.445566916 +0200
@@ -0,0 +1,12 @@
 +The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
 +of an user in any environment. This includes environments with
@ -32,100 +14,75 @@ diff -up openssh/HOWTO.ssh-keycat.keycat openssh/HOWTO.ssh-keycat
 +        PubkeyAuthentication yes
 +
 +
-diff -up openssh/Makefile.in.keycat openssh/Makefile.in
--- openssh/Makefile.in.keycat	2015-06-24 10:57:50.152849621 +0200
-+++ openssh/Makefile.in	2015-06-24 10:57:50.157849608 +0200
+diff -up openssh-6.3p1/Makefile.in.keycat openssh-6.3p1/Makefile.in
+--- openssh-6.3p1/Makefile.in.keycat	2013-10-10 15:16:33.442566930 +0200
+++ openssh-6.3p1/Makefile.in	2013-10-10 15:16:33.445566916 +0200
@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
- ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
- SFTP_SERVER=$(libexecdir)/sftp-server
 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
+ SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
+ SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
 +SSH_KEYCAT=$(libexecdir)/ssh-keycat
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
 PRIVSEP_PATH=@PRIVSEP_PATH@
-@@ -52,6 +52,7 @@ K5LIBS=@K5LIBS@
- K5LIBS=@K5LIBS@
- GSSLIBS=@GSSLIBS@
- SSHDLIBS=@SSHDLIBS@
-+KEYCATLIBS=@KEYCATLIBS@
- LIBEDIT=@LIBEDIT@
- LIBFIDO2=@LIBFIDO2@
- AR=@AR@
-@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
+ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
+@@ -64,7 +65,7 @@ EXEEXT=@EXEEXT@
+ MANFMT=@MANFMT@
+ INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
 
- .SUFFIXES: .lo
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
 
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -172,6 +173,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
+ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
+ 	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
 
- XMSS_OBJS=\
- 	ssh-xmss.o \
-@@ -190,6 +191,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
- ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
- 	$(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
- 
-+ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
-+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS)
+ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keycat.o
+	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
 +
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
+ 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 
-@@ -321,6 +325,7 @@ install-files:
- 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
+@@ -279,6 +283,7 @@ install-files:
+ 		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
+ 		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
+ 	fi
 +	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh/openbsd-compat/port-linux.h.keycat openssh/openbsd-compat/port-linux.h
--- openssh/openbsd-compat/port-linux.h.keycat	2015-06-24 10:57:50.150849626 +0200
-+++ openssh/openbsd-compat/port-linux.h	2015-06-24 10:57:50.160849601 +0200
-@@ -25,8 +25,10 @@ void ssh_selinux_setup_pty(char *, const
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
+diff -up openssh-6.3p1/auth2-pubkey.c.keycat openssh-6.3p1/auth2-pubkey.c
+--- openssh-6.3p1/auth2-pubkey.c.keycat	2013-10-10 15:16:33.429566992 +0200
+++ openssh-6.3p1/auth2-pubkey.c	2013-10-10 15:16:33.445566916 +0200
+@@ -606,6 +606,14 @@ user_key_command_allowed2(struct passwd
+ 			_exit(1);
+ 		}
 
-+int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
-+int sshd_selinux_setup_env_variables(void);
- #endif
+#ifdef WITH_SELINUX
+		if (ssh_selinux_setup_env_variables() < 0) {
+			error ("failed to copy environment:  %s",
+			    strerror(errno));
+			_exit(127);
+		}
+#endif
+
+ 		execl(options.authorized_keys_command,
+ 		    options.authorized_keys_command, user_pw->pw_name, NULL);
 
- #ifdef LINUX_OOM_ADJUST
-diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/port-linux-sshd.c
--- openssh/openbsd-compat/port-linux-sshd.c.keycat	2015-06-24 10:57:50.150849626 +0200
-+++ openssh/openbsd-compat/port-linux-sshd.c	2015-06-24 10:57:50.159849603 +0200
-@@ -54,6 +54,20 @@ extern Authctxt *the_authctxt;
- extern int inetd_flag;
- extern int rexeced_flag;
- 
-+/* Wrapper around is_selinux_enabled() to log its return value once only */
-+int
-+sshd_selinux_enabled(void)
-+{
-+	static int enabled = -1;
-+
-+	if (enabled == -1) {
-+		enabled = (is_selinux_enabled() == 1);
-+		debug("SELinux support %s", enabled ? "enabled" : "disabled");
-+	}
-+
-+	return (enabled);
-+}
-+
- /* Send audit message */
- static int
- sshd_selinux_send_audit_message(int success, security_context_t default_context,
-@@ -308,7 +322,7 @@ sshd_selinux_getctxbyname(char *pwname,
+diff -up openssh-6.3p1/openbsd-compat/port-linux.c.keycat openssh-6.3p1/openbsd-compat/port-linux.c
+--- openssh-6.3p1/openbsd-compat/port-linux.c.keycat	2013-10-10 15:16:33.435566964 +0200
+++ openssh-6.3p1/openbsd-compat/port-linux.c	2013-10-10 15:32:19.946065189 +0200
+@@ -313,7 +313,7 @@ ssh_selinux_getctxbyname(char *pwname,
 
 /* Setup environment variables for pam_selinux */
 static int
-sshd_selinux_setup_pam_variables(void)
-+sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
+-ssh_selinux_setup_pam_variables(void)
+ssh_selinux_setup_variables(int(*set_it)(const char *, const char *))
 {
 	const char *reqlvl;
 	char *role;
-@@ -319,16 +333,16 @@ sshd_selinux_setup_pam_variables(void)
+@@ -324,16 +324,16 @@ ssh_selinux_setup_pam_variables(void)
 
 	ssh_selinux_get_role_level(&role, &reqlvl);
 
@ -145,65 +102,35 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/
 
 	if (role != NULL)
 		free(role);
-@@ -336,6 +350,24 @@ sshd_selinux_setup_pam_variables(void)
+@@ -341,6 +341,24 @@ ssh_selinux_setup_pam_variables(void)
 	return rv;
 }
 
 +static int
-+sshd_selinux_setup_pam_variables(void)
+ssh_selinux_setup_pam_variables(void)
 +{
-+	return sshd_selinux_setup_variables(do_pam_putenv);
+	return ssh_selinux_setup_variables(do_pam_putenv);
 +}
 +
 +static int
-+do_setenv(char *name, const char *value)
+do_setenv(char *name, char *value)
 +{
 +	return setenv(name, value, 1);
 +}
 +
 +int
-+sshd_selinux_setup_env_variables(void)
+ssh_selinux_setup_env_variables(void)
 +{
-+	return sshd_selinux_setup_variables(do_setenv);
+	return ssh_selinux_setup_variables(do_setenv);
 +}
 +
 /* Set the execution context to the default for the specified user */
 void
- sshd_selinux_setup_exec_context(char *pwname)
-@@ -344,7 +376,7 @@ sshd_selinux_setup_exec_context(char *pw
- 	int r = 0;
- 	security_context_t default_ctx = NULL;
- 
-	if (!ssh_selinux_enabled())
-+	if (!sshd_selinux_enabled())
- 		return;
- 
- 	if (options.use_pam) {
-@@ -415,7 +447,7 @@ sshd_selinux_copy_context(void)
- {
- 	security_context_t *ctx;
- 
-	if (!ssh_selinux_enabled())
-+	if (!sshd_selinux_enabled())
- 		return;
- 
- 	if (getexeccon((security_context_t *)&ctx) != 0) {
-diff -up openssh/platform.c.keycat openssh/platform.c
--- openssh/platform.c.keycat	2015-06-24 10:57:50.147849633 +0200
-+++ openssh/platform.c	2015-06-24 10:57:50.160849601 +0200
-@@ -103,7 +103,7 @@ platform_setusercontext(struct passwd *p
- {
- #ifdef WITH_SELINUX
- 	/* Cache selinux status for later use */
-	(void)ssh_selinux_enabled();
-+	(void)sshd_selinux_enabled();
- #endif
- 
- #ifdef USE_SOLARIS_PROJECTS
-diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
--- openssh/ssh-keycat.c.keycat	2015-06-24 10:57:50.161849599 +0200
-+++ openssh/ssh-keycat.c	2015-06-24 10:57:50.161849599 +0200
-@@ -0,0 +1,241 @@
+ ssh_selinux_setup_exec_context(char *pwname)
+diff -up openssh-6.3p1/ssh-keycat.c.keycat openssh-6.3p1/ssh-keycat.c
+--- openssh-6.3p1/ssh-keycat.c.keycat	2013-10-10 15:16:33.446566911 +0200
+++ openssh-6.3p1/ssh-keycat.c	2013-10-10 15:16:33.446566911 +0200
+@@ -0,0 +1,238 @@
 +/*
 + * Redistribution and use in source and binary forms, with or without
 + * modification, are permitted provided that the following conditions
@ -253,9 +180,6 @@ diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
 +#include <pwd.h>
 +#include <fcntl.h>
 +#include <unistd.h>
-+#ifdef HAVE_STDINT_H
-+#include <stdint.h>
-+#endif
 +
 +#include <security/pam_appl.h>
 +
@ -445,41 +369,3 @@ diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
 +	}
 +	return ev;
 +}
-diff --git a/configure.ac b/configure.ac
-index 3bbccfd..6481f1f 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -2952,6 +2952,7 @@ AC_ARG_WITH([pam],
- 			PAM_MSG="yes"
- 
- 			SSHDLIBS="$SSHDLIBS -lpam"
-+			KEYCATLIBS="$KEYCATLIBS -lpam"
- 			AC_DEFINE([USE_PAM], [1],
- 				[Define if you want to enable PAM support])
- 
-@@ -3105,6 +3106,7 @@
- 					;;
- 				*)
- 					SSHDLIBS="$SSHDLIBS -ldl"
-+					KEYCATLIBS="$KEYCATLIBS -ldl"
- 					;;
- 				esac
- 			fi
-@@ -4042,6 +4044,7 @@ AC_ARG_WITH([selinux],
- 	fi ]
- )
- AC_SUBST([SSHDLIBS])
-+AC_SUBST([KEYCATLIBS])
- 
- # Check whether user wants Kerberos 5 support
- KRB5_MSG="no"
-@@ -5031,6 +5034,9 @@ fi
- if test ! -z "${SSHDLIBS}"; then
- echo "         +for sshd: ${SSHDLIBS}"
- fi
-+if test ! -z "${KEYCATLIBS}"; then
-+echo "   +for ssh-keycat: ${KEYCATLIBS}"
-+fi
- 
- echo ""
- 
--- a/openssh-6.3p1-krb5-use-default_ccache_name.patch
+++ b/openssh-6.3p1-krb5-use-default_ccache_name.patch
@ -0,0 +1,247 @@
+diff -up openssh-6.3p1/auth-krb5.c.ccache_name openssh-6.3p1/auth-krb5.c
+--- openssh-6.3p1/auth-krb5.c.ccache_name	2013-10-23 22:03:52.322950759 +0200
+++ openssh-6.3p1/auth-krb5.c	2013-10-23 22:04:24.295799873 +0200
+@@ -50,7 +50,9 @@
+ #include <errno.h>
+ #include <unistd.h>
+ #include <string.h>
+#include <sys/stat.h>
+ #include <krb5.h>
+#include <profile.h>
+ 
+ extern ServerOptions	 options;
+ 
+@@ -91,6 +93,7 @@ auth_krb5_password(Authctxt *authctxt, c
+ #endif
+ 	krb5_error_code problem;
+ 	krb5_ccache ccache = NULL;
+	const char *ccache_type;
+ 	int len;
+ 	char *client, *platform_client;
+ 	const char *errmsg;
+@@ -191,12 +194,30 @@ auth_krb5_password(Authctxt *authctxt, c
+ 		goto out;
+ #endif
+ 
+	ccache_type = krb5_cc_get_type(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
+ 	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
+ 
+-	len = strlen(authctxt->krb5_ticket_file) + 6;
+	if (authctxt->krb5_ticket_file[0] == ':')
+		authctxt->krb5_ticket_file++;
+
+	len = strlen(authctxt->krb5_ticket_file) + strlen(ccache_type) + 2;
+ 	authctxt->krb5_ccname = xmalloc(len);
+-	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
+
+#ifdef USE_CCAPI
+	snprintf(authctxt->krb5_ccname, len, "API:%s",
+ 	    authctxt->krb5_ticket_file);
+#else
+	snprintf(authctxt->krb5_ccname, len, "%s:%s",
+	    ccache_type, authctxt->krb5_ticket_file);
+#endif
+
+	if (strcmp(ccache_type, "DIR") == 0) {
+		char *p;
+		p = strrchr(authctxt->krb5_ccname, '/');
+		if (p)
+			*p = '\0';
+	}
+
+ 
+ #ifdef USE_PAM
+ 	if (options.use_pam)
+@@ -235,10 +256,34 @@ auth_krb5_password(Authctxt *authctxt, c
+ void
+ krb5_cleanup_proc(Authctxt *authctxt)
+ {
+	struct stat krb5_ccname_stat;
+	char krb5_ccname[128], *krb5_ccname_dir_start, *krb5_ccname_dir_end;
+
+ 	debug("krb5_cleanup_proc called");
+ 	if (authctxt->krb5_fwd_ccache) {
+ 		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
+ 		authctxt->krb5_fwd_ccache = NULL;
+
+		strncpy(krb5_ccname, authctxt->krb5_ccname, sizeof(krb5_ccname) - 10);
+		krb5_ccname_dir_start = strchr(krb5_ccname, ':') + 1;
+		*krb5_ccname_dir_start++ = '\0';
+		if (strcmp(krb5_ccname, "DIR") == 0) {
+
+			strcat(krb5_ccname_dir_start, "/primary");
+
+			if (stat(krb5_ccname_dir_start, &krb5_ccname_stat) == 0) {
+				if (unlink(krb5_ccname_dir_start) == 0) {
+					krb5_ccname_dir_end = strrchr(krb5_ccname_dir_start, '/');
+					*krb5_ccname_dir_end = '\0';
+					if (rmdir(krb5_ccname_dir_start) == -1)
+						debug("cache dir '%s' remove failed: %s", krb5_ccname_dir_start, strerror(errno));
+				}
+				else
+					debug("cache primary file '%s', remove failed: %s",
+						krb5_ccname_dir_start, strerror(errno)
+						);
+			}
+		}
+ 	}
+ 	if (authctxt->krb5_user) {
+ 		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
+@@ -250,34 +295,139 @@ krb5_cleanup_proc(Authctxt *authctxt)
+ 	}
+ }
+ 
+int
+ssh_asprintf_append(char **dsc, const char *fmt, ...) {
+	char *src, *old;
+	va_list ap;
+	int i;
+
+	va_start(ap, fmt);
+	i = vasprintf(&src, fmt, ap);
+	va_end(ap);
+
+	if (i == -1 || src == NULL)
+		return -1;
+
+	old = *dsc;
+
+	i = asprintf(dsc, "%s%s", *dsc, src);
+	if (i == -1 || src == NULL) {
+		free(src);
+		return -1;
+	}
+
+	free(old);
+	free(src);
+
+	return i;
+}
+
+int
+ssh_krb5_expand_template(char **result, const char *template) {
+	char *p_n, *p_o, *r, *tmp_template;
+
+	if (template == NULL)
+		return -1;
+
+	tmp_template = p_n = p_o = xstrdup(template);
+	r = xstrdup("");
+
+	while ((p_n = strstr(p_o, "%{")) != NULL) {
+
+		*p_n++ = '\0';
+		if (ssh_asprintf_append(&r, "%s", p_o) == -1)
+			goto cleanup;
+
+		if (strncmp(p_n, "{uid}", 5) == 0 || strncmp(p_n, "{euid}", 6) == 0 ||
+			strncmp(p_n, "{USERID}", 8) == 0) {
+			p_o = strchr(p_n, '}') + 1;
+			if (ssh_asprintf_append(&r, "%d", geteuid()) == -1)
+				goto cleanup;
+			continue;
+		}
+		else if (strncmp(p_n, "{TEMP}", 6) == 0) {
+			p_o = strchr(p_n, '}') + 1;
+			if (ssh_asprintf_append(&r, "/tmp") == -1)
+				goto cleanup;
+			continue;
+		} else {
+			p_o = strchr(p_n, '}') + 1;
+			p_o = '\0';
+			debug("%s: unsupported token %s in %s", __func__, p_n, template);
+			/* unknown token, fallback to the default */
+			goto cleanup;
+		}
+	}
+
+	if (ssh_asprintf_append(&r, "%s", p_o) == -1)
+		goto cleanup;
+
+	*result = r;
+	free(tmp_template);
+	return 0;
+
+cleanup:
+	free(r);
+	free(tmp_template);
+	return -1;
+}
+
+krb5_error_code
+ssh_krb5_get_cctemplate(krb5_context ctx, char **ccname) {
+	profile_t p;
+	int ret = 0;
+	char *value = NULL;
+
+	ret = krb5_get_profile(ctx, &p);
+	if (ret)
+		return ret;
+
+	ret = profile_get_string(p, "libdefaults", "default_ccache_name", NULL, NULL, &value);
+	if (ret)
+		return ret;
+
+	ret = ssh_krb5_expand_template(ccname, value);
+
+	return ret;
+}
+
+ #ifndef HEIMDAL
+ krb5_error_code
+ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
+ 	int tmpfd, ret, oerrno;
+-	char ccname[40];
+	char *ccname;
+#ifdef USE_CCAPI
+	char cctemplate[] = "API:krb5cc_%d";
+#else
+ 	mode_t old_umask;
+	char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";
+ 
+-	ret = snprintf(ccname, sizeof(ccname),
+-	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
+-	if (ret < 0 || (size_t)ret >= sizeof(ccname))
+-		return ENOMEM;
+-
+-	old_umask = umask(0177);
+-	tmpfd = mkstemp(ccname + strlen("FILE:"));
+-	oerrno = errno;
+-	umask(old_umask);
+-	if (tmpfd == -1) {
+-		logit("mkstemp(): %.100s", strerror(oerrno));
+-		return oerrno;
+-	}
+#endif
+
+	ret = ssh_krb5_get_cctemplate(ctx, &ccname);
+ 
+-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
+	if (ret) {
+		ret = asprintf(&ccname, cctemplate, geteuid());
+		if (ret == -1)
+			return ENOMEM;
+		old_umask = umask(0177);
+		tmpfd = mkstemp(ccname + strlen("FILE:"));
+ 		oerrno = errno;
+-		logit("fchmod(): %.100s", strerror(oerrno));
+		umask(old_umask);
+		if (tmpfd == -1) {
+			logit("mkstemp(): %.100s", strerror(oerrno));
+			return oerrno;
+		}
+
+		if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
+			oerrno = errno;
+			logit("fchmod(): %.100s", strerror(oerrno));
+			close(tmpfd);
+			return oerrno;
+		}
+ 		close(tmpfd);
+-		return oerrno;
+ 	}
+-	close(tmpfd);
+	debug("%s: Setting ccname to %s", __func__, ccname);
+ 
+ 	return (krb5_cc_resolve(ctx, ccname, ccache));
+ }
--- a/openssh-6.3p1-ldap.patch
+++ b/openssh-6.3p1-ldap.patch
--- a/openssh-6.3p1-privsep-selinux.patch
+++ b/openssh-6.3p1-privsep-selinux.patch
@ -0,0 +1,104 @@
+diff -up openssh-6.3p1/openbsd-compat/port-linux.c.privsep-selinux openssh-6.3p1/openbsd-compat/port-linux.c
+--- openssh-6.3p1/openbsd-compat/port-linux.c.privsep-selinux	2013-10-10 14:58:20.634762245 +0200
+++ openssh-6.3p1/openbsd-compat/port-linux.c	2013-10-10 15:13:57.864306950 +0200
+@@ -503,6 +503,25 @@ ssh_selinux_change_context(const char *n
+ 	free(newctx);
+ }
+ 
+void
+ssh_selinux_copy_context(void)
+{
+	security_context_t *ctx;
+
+	if (!ssh_selinux_enabled())
+		return;
+
+	if (getexeccon((security_context_t *)&ctx) != 0) {
+		logit("%s: getcon failed with %s", __func__, strerror (errno));
+		return;
+	}
+	if (ctx != NULL) {
+		if (setcon(ctx) != 0)
+			logit("%s: setcon failed with %s", __func__, strerror (errno));
+		freecon(ctx);
+	}
+}
+
+ #endif /* WITH_SELINUX */
+ 
+ #ifdef LINUX_OOM_ADJUST
+diff -up openssh-6.3p1/openbsd-compat/port-linux.h.privsep-selinux openssh-6.3p1/openbsd-compat/port-linux.h
+--- openssh-6.3p1/openbsd-compat/port-linux.h.privsep-selinux	2011-01-25 02:16:18.000000000 +0100
+++ openssh-6.3p1/openbsd-compat/port-linux.h	2013-10-10 14:58:20.634762245 +0200
+@@ -24,6 +24,7 @@ int ssh_selinux_enabled(void);
+ void ssh_selinux_setup_pty(char *, const char *);
+ void ssh_selinux_setup_exec_context(char *);
+ void ssh_selinux_change_context(const char *);
+void ssh_selinux_copy_context(void);
+ void ssh_selinux_setfscreatecon(const char *);
+ #endif
+ 
+diff -up openssh-6.3p1/session.c.privsep-selinux openssh-6.3p1/session.c
+--- openssh-6.3p1/session.c.privsep-selinux	2013-10-10 14:58:20.617762326 +0200
+++ openssh-6.3p1/session.c	2013-10-10 15:13:16.520503590 +0200
+@@ -1522,6 +1522,9 @@ do_setusercontext(struct passwd *pw)
+ 			    pw->pw_uid);
+ 			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
+ 			    "u", pw->pw_name, (char *)NULL);
+#ifdef WITH_SELINUX
+			ssh_selinux_copy_context();
+#endif
+ 			safely_chroot(chroot_path, pw->pw_uid);
+ 			free(tmp);
+ 			free(chroot_path);
+@@ -1544,6 +1547,12 @@ do_setusercontext(struct passwd *pw)
+ 		/* Permanently switch to the desired uid. */
+ 		permanently_set_uid(pw);
+ #endif
+
+#ifdef WITH_SELINUX
+		if (options.chroot_directory == NULL ||
+		    strcasecmp(options.chroot_directory, "none") == 0)
+			ssh_selinux_copy_context();
+#endif
+ 	} else if (options.chroot_directory != NULL &&
+ 	    strcasecmp(options.chroot_directory, "none") != 0) {
+ 		fatal("server lacks privileges to chroot to ChrootDirectory");
+@@ -1808,9 +1817,6 @@ do_child(Session *s, const char *command
+ 		argv[i] = NULL;
+ 		optind = optreset = 1;
+ 		__progname = argv[0];
+-#ifdef WITH_SELINUX
+-		ssh_selinux_change_context("sftpd_t");
+-#endif
+ 		exit(sftp_server_main(i, argv, s->pw));
+ 	}
+ 
+diff -up openssh-6.3p1/sshd.c.privsep-selinux openssh-6.3p1/sshd.c
+--- openssh-6.3p1/sshd.c.privsep-selinux	2013-10-10 14:58:20.632762255 +0200
+++ openssh-6.3p1/sshd.c	2013-10-10 14:58:20.635762241 +0200
+@@ -668,6 +668,10 @@ privsep_preauth_child(void)
+ 	/* Demote the private keys to public keys. */
+ 	demote_sensitive_data();
+ 
+#ifdef WITH_SELINUX
+	ssh_selinux_change_context("sshd_net_t");
+#endif
+
+ 	/* Change our root directory */
+ 	if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
+ 		fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
+@@ -811,6 +815,13 @@ privsep_postauth(Authctxt *authctxt)
+ 	do_setusercontext(authctxt->pw);
+ 
+  skip:
+#ifdef WITH_SELINUX
+	/* switch SELinux content for root too */
+	if (authctxt->pw->pw_uid == 0) {
+		ssh_selinux_copy_context();
+	}
+#endif
+
+ 	/* It is safe now to apply the key state */
+ 	monitor_apply_keystate(pmonitor);
+ 
--- a/openssh-6.3p1-redhat.patch
+++ b/openssh-6.3p1-redhat.patch
@ -0,0 +1,129 @@
+diff -up openssh-6.3p1/ssh_config.redhat openssh-6.3p1/ssh_config
+--- openssh-6.3p1/ssh_config.redhat	2013-10-11 14:51:18.345876648 +0200
+++ openssh-6.3p1/ssh_config	2013-10-11 15:13:05.429829266 +0200
+@@ -46,3 +46,14 @@
+ # Uncomment this if you want to use .local domain
+ #Host *.local
+ #	CheckHostIP no
+Host *
+	GSSAPIAuthentication yes
+# If this option is set to yes then remote X11 clients will have full access
+# to the original X11 display. As virtually no X11 client supports the untrusted
+# mode correctly we set this to yes.
+	ForwardX11Trusted yes
+# Send locale-related environment variables
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+	SendEnv XMODIFIERS
+diff -up openssh-6.3p1/sshd_config.0.redhat openssh-6.3p1/sshd_config.0
+--- openssh-6.3p1/sshd_config.0.redhat	2013-09-13 08:20:43.000000000 +0200
+++ openssh-6.3p1/sshd_config.0	2013-10-11 14:51:18.345876648 +0200
+@@ -653,9 +653,9 @@ DESCRIPTION
+ 
+      SyslogFacility
+              Gives the facility code that is used when logging messages from
+-             sshd(8).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
+-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
+-             default is AUTH.
+             sshd(8).  The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
+             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
+             The default is AUTH.
+ 
+      TCPKeepAlive
+              Specifies whether the system should send TCP keepalive messages
+diff -up openssh-6.3p1/sshd_config.5.redhat openssh-6.3p1/sshd_config.5
+--- openssh-6.3p1/sshd_config.5.redhat	2013-07-20 05:21:53.000000000 +0200
+++ openssh-6.3p1/sshd_config.5	2013-10-11 14:51:18.346876643 +0200
+@@ -1095,7 +1095,7 @@ Note that this option applies to protoco
+ .It Cm SyslogFacility
+ Gives the facility code that is used when logging messages from
+ .Xr sshd 8 .
+-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
+ LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
+ The default is AUTH.
+ .It Cm TCPKeepAlive
+diff -up openssh-6.3p1/sshd_config.redhat openssh-6.3p1/sshd_config
+--- openssh-6.3p1/sshd_config.redhat	2013-10-11 14:51:18.343876657 +0200
+++ openssh-6.3p1/sshd_config	2013-10-11 14:51:18.346876643 +0200
+@@ -10,6 +10,10 @@
+ # possible, but leave them commented.  Uncommented options override the
+ # default value.
+ 
+# If you want to change the port on a SELinux system, you have to tell
+# SELinux about this change.
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
+#
+ #Port 22
+ #AddressFamily any
+ #ListenAddress 0.0.0.0
+@@ -21,9 +25,9 @@
+ # HostKey for protocol version 1
+ #HostKey /etc/ssh/ssh_host_key
+ # HostKeys for protocol version 2
+-#HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_rsa_key
+ #HostKey /etc/ssh/ssh_host_dsa_key
+-#HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+ 
+ # Lifetime and size of ephemeral version 1 server key
+ #KeyRegenerationInterval 1h
+@@ -35,6 +39,7 @@
+ # Logging
+ # obsoletes QuietMode and FascistLogging
+ #SyslogFacility AUTH
+SyslogFacility AUTHPRIV
+ #LogLevel INFO
+ 
+ # Authentication:
+@@ -70,9 +75,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ # To disable tunneled clear text passwords, change to no here!
+ #PasswordAuthentication yes
+ #PermitEmptyPasswords no
+PasswordAuthentication yes
+ 
+ # Change to no to disable s/key passwords
+ #ChallengeResponseAuthentication yes
+ChallengeResponseAuthentication no
+ 
+ # Kerberos options
+ #KerberosAuthentication no
+@@ -82,7 +89,9 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ 
+ # GSSAPI options
+ #GSSAPIAuthentication no
+GSSAPIAuthentication yes
+ #GSSAPICleanupCredentials yes
+GSSAPICleanupCredentials no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing, 
+ # and session processing. If this is enabled, PAM authentication will 
+@@ -94,11 +103,13 @@ AuthorizedKeysFile	.ssh/authorized_keys
+ # PAM authentication, then enable this but set PasswordAuthentication
+ # and ChallengeResponseAuthentication to 'no'.
+ #UsePAM no
+UsePAM yes
+ 
+ #AllowAgentForwarding yes
+ #AllowTcpForwarding yes
+ #GatewayPorts no
+ #X11Forwarding no
+X11Forwarding yes
+ #X11DisplayOffset 10
+ #X11UseLocalhost yes
+ #PrintMotd yes
+@@ -120,6 +131,12 @@ UsePrivilegeSeparation sandbox		# Defaul
+ # no default banner path
+ #Banner none
+ 
+# Accept locale-related environment variables
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+AcceptEnv XMODIFIERS
+
+ # override default of no subsystems
+ Subsystem	sftp	/usr/libexec/sftp-server
+ 
--- a/openssh-6.3p1-role-mls.patch
+++ b/openssh-6.3p1-role-mls.patch
--- a/openssh-6.4p1-CLOCK_BOOTTIME.patch
+++ b/openssh-6.4p1-CLOCK_BOOTTIME.patch
@ -0,0 +1,29 @@
+--- a/misc.c
+++ b/misc.c
+@@ -865,17 +865,24 @@ ms_to_timeval(struct timeval *tv, int ms
+ time_t
+ monotime(void)
+ {
+-#if defined(HAVE_CLOCK_GETTIME) && defined(CLOCK_MONOTONIC)
+#if defined(HAVE_CLOCK_GETTIME) && \
+    (defined(CLOCK_MONOTONIC) || defined(CLOCK_BOOTTIME))
+ 	struct timespec ts;
+ 	static int gettime_failed = 0;
+ 
+ 	if (!gettime_failed) {
+#if defined(CLOCK_BOOTTIME)
+		if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0)
+			return (ts.tv_sec);
+#endif
+#if defined(CLOCK_MONOTONIC)
+ 		if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0)
+ 			return (ts.tv_sec);
+#endif
+ 		debug3("clock_gettime: %s", strerror(errno));
+ 		gettime_failed = 1;
+ 	}
+-#endif
+#endif /* HAVE_CLOCK_GETTIME && (CLOCK_MONOTONIC || CLOCK_BOOTTIME */
+ 
+ 	return time(NULL);
+ }
--- a/openssh-6.4p1-CVE-2014-2653.patch
+++ b/openssh-6.4p1-CVE-2014-2653.patch
@ -0,0 +1,80 @@
+diff --git a/ChangeLog b/ChangeLog
+index 29d70ec..a0fb67e 100644
+--- a/ChangeLog
+++ b/ChangeLog
+@@ -1,3 +1,14 @@
+20140420
+   - djm@cvs.openbsd.org 2014/04/01 03:34:10
+     [sshconnect.c]
+     When using VerifyHostKeyDNS with a DNSSEC resolver, down-convert any
+     certificate keys to plain keys and attempt SSHFP resolution.
+     
+     Prevents a server from skipping SSHFP lookup and forcing a new-hostkey
+     dialog by offering only certificate keys.
+     
+     Reported by mcv21 AT cam.ac.uk
+
+ 20131010
+  - dtucker@cvs.openbsd.org 2013/10/08 11:42:13
+    [dh.c dh.h]
+diff --git a/sshconnect.c b/sshconnect.c
+index ddc167e..4d8c718 100644
+--- a/sshconnect.c
+++ b/sshconnect.c
+@@ -1136,30 +1136,40 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
+ {
+ 	int flags = 0;
+ 	char *fp;
+	Key *plain = NULL;
+ 
+ 	fp = key_selected_fingerprint(host_key, SSH_FP_HEX);
+ 	debug("Server host key: %s %s%s", key_type(host_key),
+ 	    key_fingerprint_prefix(), fp);
+ 	free(fp);
+ 
+-	/* XXX certs are not yet supported for DNS */
+-	if (!key_is_cert(host_key) && options.verify_host_key_dns &&
+-	    verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
+-		if (flags & DNS_VERIFY_FOUND) {
+-
+-			if (options.verify_host_key_dns == 1 &&
+-			    flags & DNS_VERIFY_MATCH &&
+-			    flags & DNS_VERIFY_SECURE)
+-				return 0;
+-
+-			if (flags & DNS_VERIFY_MATCH) {
+-				matching_host_key_dns = 1;
+-			} else {
+-				warn_changed_key(host_key);
+-				error("Update the SSHFP RR in DNS with the new "
+-				    "host key to get rid of this message.");
+	if (options.verify_host_key_dns) {
+		/*
+		 * XXX certs are not yet supported for DNS, so downgrade
+		 * them and try the plain key.
+		 */
+		plain = key_from_private(host_key);
+		if (key_is_cert(plain))
+			key_drop_cert(plain);
+		if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) {
+			if (flags & DNS_VERIFY_FOUND) {
+				if (options.verify_host_key_dns == 1 &&
+				    flags & DNS_VERIFY_MATCH &&
+				    flags & DNS_VERIFY_SECURE) {
+					key_free(plain);
+					return 0;
+				}
+				if (flags & DNS_VERIFY_MATCH) {
+					matching_host_key_dns = 1;
+				} else {
+					warn_changed_key(plain);
+					error("Update the SSHFP RR in DNS "
+					    "with the new host key to get rid "
+					    "of this message.");
+				}
+ 			}
+ 		}
+		key_free(plain);
+ 	}
+ 
+ 	return check_host_key(host, hostaddr, options.port, host_key, RDRW,
--- a/openssh-6.4p1-FIPS-mode-SP800-131A.patch
+++ b/openssh-6.4p1-FIPS-mode-SP800-131A.patch
@ -0,0 +1,206 @@
+diff --git a/dh.h b/dh.h
+index 48f7b68..9ff39f4 100644
+--- a/dh.h
+++ b/dh.h
+@@ -45,6 +45,7 @@ int	 dh_estimate(int);
+ 
+ /* Min and max values from RFC4419. */
+ #define DH_GRP_MIN	1024
+#define DH_GRP_MIN_FIPS	2048
+ #define DH_GRP_MAX	8192
+ 
+ /*
+diff --git a/kex.c b/kex.c
+index a468805..3a0eb16 100644
+--- a/kex.c
+++ b/kex.c
+@@ -34,6 +34,7 @@
+ #include <string.h>
+ 
+ #include <openssl/crypto.h>
+#include <openssl/fips.h>
+ 
+ #include "xmalloc.h"
+ #include "ssh2.h"
+@@ -93,6 +94,20 @@ static const struct kexalg kexalgs[] = {
+ 	{ NULL, -1, -1, NULL},
+ };
+ 
+static const struct kexalg kexalgs_fips[] = {
+	{ KEX_DH14, KEX_DH_GRP14_SHA1, 0, EVP_sha1 },
+	{ KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, EVP_sha1 },
+#ifdef HAVE_EVP_SHA256
+	{ KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, EVP_sha256 },
+#endif
+#ifdef OPENSSL_HAS_ECC
+	{ KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, NID_X9_62_prime256v1, EVP_sha256 },
+	{ KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, EVP_sha384 },
+	{ KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1, EVP_sha512 },
+#endif
+	{ NULL, -1, -1, NULL},
+};
+
+ char *
+ kex_alg_list(void)
+ {
+@@ -116,7 +131,7 @@ kex_alg_by_name(const char *name)
+ {
+ 	const struct kexalg *k;
+ 
+-	for (k = kexalgs; k->name != NULL; k++) {
+	for (k = (FIPS_mode() ? kexalgs_fips : kexalgs); k->name != NULL; k++) {
+ 		if (strcmp(k->name, name) == 0)
+ 			return k;
+ #ifdef GSSAPI
+@@ -141,7 +156,10 @@ kex_names_valid(const char *names)
+ 	for ((p = strsep(&cp, ",")); p && *p != '\0';
+ 	    (p = strsep(&cp, ","))) {
+ 		if (kex_alg_by_name(p) == NULL) {
+-			error("Unsupported KEX algorithm \"%.100s\"", p);
+			if (FIPS_mode())
+				error("\"%.100s\" is not allowed in FIPS mode", p);
+			else
+				error("Unsupported KEX algorithm \"%.100s\"", p);
+ 			free(s);
+ 			return 0;
+ 		}
+diff --git a/kexecdhc.c b/kexecdhc.c
+index 6193836..d435f1f 100644
+--- a/kexecdhc.c
+++ b/kexecdhc.c
+@@ -154,6 +154,7 @@ kexecdh_client(Kex *kex)
+ 
+ 	kex_derive_keys(kex, hash, hashlen, shared_secret);
+ 	BN_clear_free(shared_secret);
+	memset(hash, 0, hashlen);
+ 	kex_finish(kex);
+ }
+ #else /* OPENSSL_HAS_ECC */
+diff --git a/kexecdhs.c b/kexecdhs.c
+index 3a580aa..9a06905 100644
+--- a/kexecdhs.c
+++ b/kexecdhs.c
+@@ -155,6 +155,7 @@ kexecdh_server(Kex *kex)
+ 
+ 	kex_derive_keys(kex, hash, hashlen, shared_secret);
+ 	BN_clear_free(shared_secret);
+	memset(hash, 0, hashlen);
+ 	kex_finish(kex);
+ }
+ #else /* OPENSSL_HAS_ECC */
+diff --git a/kexgexc.c b/kexgexc.c
+index 5a3be20..a931b6e 100644
+--- a/kexgexc.c
+++ b/kexgexc.c
+@@ -26,6 +26,8 @@
+ 
+ #include "includes.h"
+ 
+#include <openssl/fips.h>
+
+ #include <sys/types.h>
+ 
+ #include <openssl/dh.h>
+@@ -64,13 +66,13 @@ kexgex_client(Kex *kex)
+ 		/* Old GEX request */
+ 		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
+ 		packet_put_int(nbits);
+-		min = DH_GRP_MIN;
+		min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
+ 		max = DH_GRP_MAX;
+ 
+ 		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD(%u) sent", nbits);
+ 	} else {
+ 		/* New GEX request */
+-		min = DH_GRP_MIN;
+		min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
+ 		max = DH_GRP_MAX;
+ 		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
+ 		packet_put_int(min);
+diff --git a/kexgexs.c b/kexgexs.c
+index 4e473fc..2ed49bd 100644
+--- a/kexgexs.c
+++ b/kexgexs.c
+@@ -76,16 +76,16 @@ kexgex_server(Kex *kex)
+ 		omin = min = packet_get_int();
+ 		onbits = nbits = packet_get_int();
+ 		omax = max = packet_get_int();
+-		min = MAX(DH_GRP_MIN, min);
+		min = MAX(FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN, min);
+ 		max = MIN(DH_GRP_MAX, max);
+-		nbits = MAX(DH_GRP_MIN, nbits);
+		nbits = MAX(FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN, nbits);
+ 		nbits = MIN(DH_GRP_MAX, nbits);
+ 		break;
+ 	case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
+ 		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
+ 		onbits = nbits = packet_get_int();
+ 		/* unused for old GEX */
+-		omin = min = DH_GRP_MIN;
+		omin = min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
+ 		omax = max = DH_GRP_MAX;
+ 		break;
+ 	default:
+diff --git a/myproposal.h b/myproposal.h
+index ee69ea2..1b68c5b 100644
+--- a/myproposal.h
+++ b/myproposal.h
+@@ -72,6 +72,12 @@
+ 	"diffie-hellman-group14-sha1," \
+ 	"diffie-hellman-group1-sha1"
+ 
+#define KEX_DEFAULT_KEX_FIPS		\
+	KEX_ECDH_METHODS \
+	KEX_SHA256_METHODS \
+	"diffie-hellman-group-exchange-sha1," \
+	"diffie-hellman-group14-sha1"
+
+ #define	KEX_DEFAULT_PK_ALG	\
+ 	HOSTKEY_ECDSA_CERT_METHODS \
+ 	"ssh-rsa-cert-v01@openssh.com," \
+diff --git a/ssh-keygen.c b/ssh-keygen.c
+index cac6762..2569016 100644
+--- a/ssh-keygen.c
+++ b/ssh-keygen.c
+@@ -183,8 +183,14 @@ type_bits_valid(int type, u_int32_t *bitsp)
+ 		fprintf(stderr, "key bits exceeds maximum %d\n", maxbits);
+ 		exit(1);
+ 	}
+-	if (type == KEY_DSA && *bitsp != 1024)
+	if (type == KEY_DSA && FIPS_mode())
+		fatal("DSA keys are not allowed in FIPS mode");
+	else if (type == KEY_DSA && *bitsp != 1024)
+ 		fatal("DSA keys must be 1024 bits");
+	else if (type == KEY_RSA && bits < DEFAULT_BITS && FIPS_mode()) {
+		fprintf(stderr, "RSA keys must be at least %d bits in FIPS mode\n", DEFAULT_BITS);
+		exit(1);
+	}
+ 	else if (type != KEY_ECDSA && *bitsp < 768)
+ 		fatal("Key must at least be 768 bits");
+ 	else if (type == KEY_ECDSA && key_ecdsa_bits_to_nid(*bitsp) == -1)
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 7e48880..3179d82 100644
+--- a/sshconnect2.c
+++ b/sshconnect2.c
+@@ -231,6 +231,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
+ 	}
+ 	if (options.kex_algorithms != NULL)
+ 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+	else if (FIPS_mode())
+		myproposal[PROPOSAL_KEX_ALGS] = KEX_DEFAULT_KEX_FIPS;
+ 
+ #ifdef GSSAPI
+ 	/* If we've got GSSAPI algorithms, then we also support the
+diff --git a/sshd.c b/sshd.c
+index 11adbf6..f5e98bc 100644
+--- a/sshd.c
+++ b/sshd.c
+@@ -2605,6 +2605,8 @@ do_ssh2_kex(void)
+ 	}
+ 	if (options.kex_algorithms != NULL)
+ 		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+	else if (FIPS_mode())
+		myproposal[PROPOSAL_KEX_ALGS] = KEX_DEFAULT_KEX_FIPS;
+ 
+ 	if (options.rekey_limit || options.rekey_interval)
+ 		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
--- a/openssh-6.4p1-GSSAPIEnablek5users.patch
+++ b/openssh-6.4p1-GSSAPIEnablek5users.patch
@ -0,0 +1,137 @@
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index 0a4930e..a7c0c5f 100644
+--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
+@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+ 	FILE *fp;
+ 	char file[MAXPATHLEN];
+ 	char line[BUFSIZ];
+-	char kuser[65]; /* match krb5_kuserok() */
+ 	struct stat st;
+ 	struct passwd *pw = the_authctxt->pw;
+ 	int found_principal = 0;
+@@ -269,7 +268,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+ 
+ 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
+ 	/* If both .k5login and .k5users DNE, self-login is ok. */
+-	if (!k5login_exists && (access(file, F_OK) == -1)) {
+	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
+                 return ssh_krb5_kuserok(krb_context, principal, luser,
+                                         k5login_exists);
+ 	}
+diff --git a/servconf.c b/servconf.c
+index d482e79..ad5869b 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -158,6 +158,7 @@ initialize_server_options(ServerOptions *options)
+ 	options->ip_qos_bulk = -1;
+ 	options->version_addendum = NULL;
+ 	options->use_kuserok = -1;
+	options->enable_k5users = -1;
+ }
+ 
+ void
+@@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options)
+ 		options->show_patchlevel = 0;
+ 	if (options->use_kuserok == -1)
+ 		options->use_kuserok = 1;
+	if (options->enable_k5users == -1)
+		options->enable_k5users = 0;
+ 
+ 	/* Turn privilege separation on by default */
+ 	if (use_privsep == -1)
+@@ -356,7 +359,7 @@ typedef enum {
+ 	sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
+ 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
+ 	sClientAliveCountMax, sAuthorizedKeysFile,
+-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
+	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
+ 	sGssKeyEx, sGssStoreRekey,
+ 	sAcceptEnv, sPermitTunnel,
+ 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+@@ -430,6 +433,7 @@ static struct {
+ 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
+ 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
+ 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
+	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
+ #else
+ 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
+ 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
+@@ -437,6 +441,7 @@ static struct {
+ 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
+	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
+ #endif
+ 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
+@@ -1536,6 +1541,10 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		intptr = &options->use_kuserok;
+ 		goto parse_flag;
+ 
+	case sGssEnablek5users:
+		intptr = &options->enable_k5users;
+		goto parse_flag;
+
+ 	case sPermitOpen:
+ 		arg = strdelim(&cp);
+ 		if (!arg || *arg == '\0')
+@@ -1824,6 +1833,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+ 	M_CP_INTOPT(ip_qos_interactive);
+ 	M_CP_INTOPT(ip_qos_bulk);
+ 	M_CP_INTOPT(use_kuserok);
+	M_CP_INTOPT(enable_k5users);
+ 	M_CP_INTOPT(rekey_limit);
+ 	M_CP_INTOPT(rekey_interval);
+ 
+@@ -2076,6 +2086,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
+ 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
+ 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
+	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
+ 
+ 	/* string arguments */
+ 	dump_cfg_string(sPidFile, o->pid_file);
+diff --git a/servconf.h b/servconf.h
+index 5117dfa..d63cb71 100644
+--- a/servconf.h
+++ b/servconf.h
+@@ -173,7 +173,8 @@ typedef struct {
+ 
+ 	int	num_permitted_opens;
+ 
+-	int	use_kuserok;
+	int		use_kuserok;
+	int		enable_k5users;
+ 	char   *chroot_directory;
+ 	char   *revoked_keys_file;
+ 	char   *trusted_user_ca_keys;
+diff --git a/sshd_config b/sshd_config
+index 43671f6..6ab00ed 100644
+--- a/sshd_config
+++ b/sshd_config
+@@ -94,6 +94,7 @@ GSSAPIAuthentication yes
+ GSSAPICleanupCredentials no
+ #GSSAPIStrictAcceptorCheck yes
+ #GSSAPIKeyExchange no
+#GSSAPIEnablek5users no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing, 
+ # and session processing. If this is enabled, PAM authentication will 
+diff --git a/sshd_config.5 b/sshd_config.5
+index e0e5fff..aa9525d 100644
+--- a/sshd_config.5
+++ b/sshd_config.5
+@@ -505,6 +505,12 @@ on logout.
+ The default is
+ .Dq yes .
+ Note that this option applies to protocol version 2 only.
+.It Cm GSSAPIEnablek5users
+Specifies whether to look at .k5users file for GSSAPI authentication
+access control. Further details are described in
+.Xr ksu 1 .
+The default is
+.Dq no .
+ .It Cm GSSAPIStrictAcceptorCheck
+ Determines whether to be strict about the identity of the GSSAPI acceptor 
+ a client authenticates against. If
--- a/openssh-6.4p1-NI_MAXHOST.patch
+++ b/openssh-6.4p1-NI_MAXHOST.patch
@ -0,0 +1,70 @@
+diff --git a/ChangeLog b/ChangeLog
+index 55dee98..7bcd596 100644
+--- a/ChangeLog
+++ b/ChangeLog
+@@ -1,3 +1,10 @@
+20140703
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2014/07/03 03:34:09
+     [gss-serv.c session.c ssh-keygen.c]
+     standardise on NI_MAXHOST for gethostname() string lengths; about
+     1/2 the cases were using it already. Fixes bz#2239 en passant
+
+ 20140304
+  - OpenBSD CVS Sync
+    - djm@cvs.openbsd.org 2014/03/03 22:22:30
+diff --git a/gss-serv.c b/gss-serv.c
+index e533c3a..7e343db 100644
+--- a/gss-serv.c
+++ b/gss-serv.c
+@@ -83,14 +83,14 @@ static OM_uint32
+ ssh_gssapi_acquire_cred(Gssctxt *ctx)
+ {
+ 	OM_uint32 status;
+-	char lname[MAXHOSTNAMELEN];
+	char lname[NI_MAXHOST];
+ 	gss_OID_set oidset;
+ 
+ 	if (options.gss_strict_acceptor) {
+ 		gss_create_empty_oid_set(&status, &oidset);
+ 		gss_add_oid_set_member(&status, ctx->oid, &oidset);
+ 
+-		if (gethostname(lname, MAXHOSTNAMELEN)) {
+		if (gethostname(lname, sizeof(lname))) {
+ 			gss_release_oid_set(&status, &oidset);
+ 			return (-1);
+ 		}
+diff --git a/session.c b/session.c
+index f5b6848..86da7cf 100644
+--- a/session.c
+++ b/session.c
+@@ -49,6 +49,7 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <grp.h>
+#include <netdb.h>
+ #ifdef HAVE_PATHS_H
+ #include <paths.h>
+ #endif
+@@ -2697,7 +2698,7 @@ session_setup_x11fwd(Session *s)
+ {
+ 	struct stat st;
+ 	char display[512], auth_display[512];
+-	char hostname[MAXHOSTNAMELEN];
+	char hostname[NI_MAXHOST];
+ 	u_int i;
+ 
+ 	if (no_x11_forwarding_flag) {
+diff --git a/ssh-keygen.c b/ssh-keygen.c
+index 2569016..1bddd72 100644
+--- a/ssh-keygen.c
+++ b/ssh-keygen.c
+@@ -153,7 +153,7 @@ char *pkcs11provider = NULL;
+ /* argv0 */
+ extern char *__progname;
+ 
+-char hostname[MAXHOSTNAMELEN];
+char hostname[NI_MAXHOST];
+ 
+ /* moduli.c */
+ int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
--- a/openssh-6.4p1-audit.patch
+++ b/openssh-6.4p1-audit.patch
--- a/openssh-6.4p1-cisco-dh-keys.patch
+++ b/openssh-6.4p1-cisco-dh-keys.patch
@ -0,0 +1,67 @@
+diff -up openssh-6.4p1/compat.c.cisco-dh openssh-6.4p1/compat.c
+--- openssh-6.4p1/compat.c.cisco-dh	2013-06-01 23:31:18.000000000 +0200
+++ openssh-6.4p1/compat.c	2014-12-04 13:28:03.717787655 +0100
+@@ -164,6 +164,7 @@ compat_datafellows(const char *version)
+ 					SSH_BUG_SCANNER },
+ 		{ "Probe-*",
+ 					SSH_BUG_PROBE },
+		{ "Cisco-*",		SSH_BUG_MAX4096DH },
+ 		{ NULL,			0 }
+ 	};
+ 
+diff -up openssh-6.4p1/compat.h.cisco-dh openssh-6.4p1/compat.h
+--- openssh-6.4p1/compat.h.cisco-dh	2014-12-04 13:28:03.717787655 +0100
+++ openssh-6.4p1/compat.h	2014-12-04 13:28:36.579658095 +0100
+@@ -59,6 +59,7 @@
+ #define SSH_BUG_RFWD_ADDR	0x02000000
+ #define SSH_NEW_OPENSSH		0x04000000
+ #define SSH_BUG_DYNAMIC_RPORT	0x08000000
+#define SSH_BUG_MAX4096DH       0x20000000
+ 
+ void     enable_compat13(void);
+ void     enable_compat20(void);
+diff -up openssh-6.4p1/kexgexc.c.cisco-dh openssh-6.4p1/kexgexc.c
+--- openssh-6.4p1/kexgexc.c.cisco-dh	2014-12-04 13:28:03.717787655 +0100
+++ openssh-6.4p1/kexgexc.c	2014-12-04 13:31:03.270079756 +0100
+@@ -60,20 +60,36 @@ kexgex_client(Kex *kex)
+ 	int min, max, nbits;
+ 	DH *dh;
+ 
+	min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
+	max = DH_GRP_MAX;
+
+	/* Servers with MAX4096DH need a preferred size (nbits) <= 4096.
+ 	 * We need to also ensure that min < nbits < max */
+
+	if (datafellows & SSH_BUG_MAX4096DH) {
+		/* The largest min for these servers is 4096 */
+		min = MIN(min, 4096);
+	}
+
+ 	nbits = dh_estimate(kex->we_need * 8);
+	nbits = MIN(nbits, max);
+	nbits = MAX(nbits, min);
+
+	if (datafellows & SSH_BUG_MAX4096DH) {
+		/* Cannot have a nbits > 4096 for these servers */
+		nbits = MIN(nbits, 4096);
+		/* nbits has to be powers of two */
+		if (nbits == 3072)
+			nbits = 4096;
+	}
+ 
+ 	if (datafellows & SSH_OLD_DHGEX) {
+ 		/* Old GEX request */
+ 		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
+ 		packet_put_int(nbits);
+-		min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
+-		max = DH_GRP_MAX;
+-
+ 		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD(%u) sent", nbits);
+ 	} else {
+ 		/* New GEX request */
+-		min = FIPS_mode() ? DH_GRP_MIN_FIPS : DH_GRP_MIN;
+-		max = DH_GRP_MAX;
+ 		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
+ 		packet_put_int(min);
+ 		packet_put_int(nbits);
--- a/openssh-6.4p1-ignore-SIGXFSZ-in-postauth.patch
+++ b/openssh-6.4p1-ignore-SIGXFSZ-in-postauth.patch
@ -0,0 +1,28 @@
+diff --git a/ChangeLog b/ChangeLog
+index 7bcd596..3a0d993 100644
+--- a/ChangeLog
+++ b/ChangeLog
+@@ -1,3 +1,9 @@
+20140823
+ - (djm) [sshd.c] Ignore SIGXFSZ in preauth monitor child; can explode on
+   lastlog writing on platforms with high UIDs; bz#2263
+ - (djm) [monitor.c sshd.c] SIGXFSZ needs to be ignored in postauth
+   monitor, not preauth; bz#2263
+
+ 20140703
+  - OpenBSD CVS Sync
+    - djm@cvs.openbsd.org 2014/07/03 03:34:09
+diff --git a/monitor.c b/monitor.c
+index 453bea3..9dadb4d 100644
+--- a/monitor.c
+++ b/monitor.c
+@@ -524,6 +524,9 @@ monitor_child_postauth(struct monitor *pmonitor)
+ 	signal(SIGHUP, &monitor_child_handler);
+ 	signal(SIGTERM, &monitor_child_handler);
+ 	signal(SIGINT, &monitor_child_handler);
+#ifdef SIGXFSZ
+	signal(SIGXFSZ, SIG_IGN);
+#endif
+ 
+ 	if (compat20) {
+ 		mon_dispatch = mon_dispatch_postauth20;
--- a/openssh-6.4p1-ignore-bad-env-var.patch
+++ b/openssh-6.4p1-ignore-bad-env-var.patch
@ -0,0 +1,37 @@
+diff -U0 openssh-6.4p1/ChangeLog.bad-env-var openssh-6.4p1/ChangeLog
+--- openssh-6.4p1/ChangeLog.bad-env-var	2014-03-19 21:37:36.270509907 +0100
+++ openssh-6.4p1/ChangeLog	2014-03-19 21:37:36.276509878 +0100
+@@ -0,0 +1,7 @@
+20140304
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2014/03/03 22:22:30
+     [session.c]
+     ignore enviornment variables with embedded '=' or '\0' characters;
+     spotted by Jann Horn; ok deraadt@
+
+diff -up openssh-6.4p1/session.c.bad-env-var openssh-6.4p1/session.c
+--- openssh-6.4p1/session.c.bad-env-var	2014-03-19 21:37:36.233510090 +0100
+++ openssh-6.4p1/session.c	2014-03-19 21:37:36.277509873 +0100
+@@ -990,6 +990,11 @@ child_set_env(char ***envp, u_int *envsi
+ 	u_int envsize;
+ 	u_int i, namelen;
+ 
+	if (strchr(name, '=') != NULL) {
+		error("Invalid environment variable \"%.100s\"", name);
+		return;
+	}
+
+ 	/*
+ 	 * If we're passed an uninitialized list, allocate a single null
+ 	 * entry before continuing.
+@@ -2255,8 +2260,8 @@ session_env_req(Session *s)
+ 	char *name, *val;
+ 	u_int name_len, val_len, i;
+ 
+-	name = packet_get_string(&name_len);
+-	val = packet_get_string(&val_len);
+	name = packet_get_cstring(&name_len);
+	val = packet_get_cstring(&val_len);
+ 	packet_check_eom();
+ 
+ 	/* Don't set too many environment variables */
--- a/openssh-6.4p1-ip-port-config-parser.patch
+++ b/openssh-6.4p1-ip-port-config-parser.patch
@ -0,0 +1,24 @@
+diff --git a/misc.c b/misc.c
+index 2f11de4..36402d1 100644
+--- a/misc.c
+++ b/misc.c
+@@ -396,7 +396,7 @@ hpdelim(char **cp)
+ 			return NULL;
+ 		else
+ 			s++;
+-	} else if ((s = strpbrk(s, ":/")) == NULL)
+	} else if ((s = strpbrk(s, ":")) == NULL)
+ 		s = *cp + strlen(*cp); /* skip to end (see first case below) */
+ 
+ 	switch (*s) {
+@@ -405,7 +405,6 @@ hpdelim(char **cp)
+ 		break;
+ 
+ 	case ':':
+-	case '/':
+ 		*s = '\0';	/* terminate */
+ 		*cp = s + 1;
+ 		break;
+-- 
+2.1.0
+
--- a/openssh-6.4p1-kuserok.patch
+++ b/openssh-6.4p1-kuserok.patch
@ -1,7 +1,8 @@
-diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c
--- openssh-7.4p1/auth-krb5.c.kuserok	2016-12-23 14:36:07.640465939 +0100
-+++ openssh-7.4p1/auth-krb5.c	2016-12-23 14:36:07.644465936 +0100
-@@ -56,6 +56,21 @@
+diff --git a/auth-krb5.c b/auth-krb5.c
+index 7c83f59..966b4cb 100644
+--- a/auth-krb5.c
+++ b/auth-krb5.c
+@@ -54,6 +54,21 @@
 
 extern ServerOptions	 options;
 
@ -23,22 +24,22 @@ diff -up openssh-7.4p1/auth-krb5.c.kuserok openssh-7.4p1/auth-krb5.c
 static int
 krb5_init(void *context)
 {
-@@ -160,8 +175,9 @@ auth_krb5_password(Authctxt *authctxt, c
+@@ -157,7 +172,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
 	if (problem)
 		goto out;
 
-	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
-	    authctxt->pw->pw_name)) {
+-	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) {
 +	/* Use !options.use_kuserok here to make ssh_krb5_kuserok() not
 +	 * depend on the existance of .k5login */
-+	if (!ssh_krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, authctxt->pw->pw_name, !options.use_kuserok)) {
+	if (!ssh_krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client, !options.use_kuserok)) {
 		problem = -1;
 		goto out;
 	}
-diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
--- openssh-7.4p1/gss-serv-krb5.c.kuserok	2016-12-23 14:36:07.640465939 +0100
-+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 14:36:07.644465936 +0100
-@@ -67,6 +67,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index b4d479e..a9326a7 100644
+--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
+@@ -67,6 +67,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_principal, const char *, const char *,
     int);
 
 static krb5_context krb_context = NULL;
@ -150,7 +151,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
 static int
 ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
 {
-@@ -116,7 +214,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
+@@ -116,7 +214,8 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
 	/* NOTE: .k5login and .k5users must opened as root, not the user,
 	 * because if they are on a krb5-protected filesystem, user credentials
 	 * to access these files aren't available yet. */
@ -160,7 +161,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
 		retval = 1;
 		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
 		    name, (char *)client->displayname.value);
-@@ -190,9 +289,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
+@@ -171,9 +270,8 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
 	/* If both .k5login and .k5users DNE, self-login is ok. */
 	if (!k5login_exists && (access(file, F_OK) == -1)) {
@ -172,114 +173,115 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
 	}
 	if ((fp = fopen(file, "r")) == NULL) {
 		int saved_errno = errno;
-diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
--- openssh-7.4p1/servconf.c.kuserok	2016-12-23 14:36:07.630465944 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:11:52.278133344 +0100
-@@ -116,6 +116,7 @@ initialize_server_options(ServerOptions
- 	options->gss_strict_acceptor = -1;
- 	options->gss_store_rekey = -1;
- 	options->gss_kex_algorithms = NULL;
+diff --git a/servconf.c b/servconf.c
+index 277b2bd..1e88905 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -157,6 +157,7 @@ initialize_server_options(ServerOptions *options)
+ 	options->ip_qos_interactive = -1;
+ 	options->ip_qos_bulk = -1;
+ 	options->version_addendum = NULL;
 +	options->use_kuserok = -1;
- 	options->password_authentication = -1;
- 	options->kbd_interactive_authentication = -1;
- 	options->challenge_response_authentication = -1;
-@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
- 	if (options->gss_kex_algorithms == NULL)
- 		options->gss_kex_algorithms = strdup(GSS_KEX_DEFAULT_KEX);
- #endif
+ }
+ 
+ void
+@@ -310,6 +311,8 @@ fill_default_server_options(ServerOptions *options)
+ 		options->version_addendum = xstrdup("");
+ 	if (options->show_patchlevel == -1)
+ 		options->show_patchlevel = 0;
 +	if (options->use_kuserok == -1)
 +		options->use_kuserok = 1;
- 	if (options->password_authentication == -1)
- 		options->password_authentication = 1;
- 	if (options->kbd_interactive_authentication == -1)
-@@ -399,7 +402,7 @@ typedef enum {
+ 
+ 	/* Turn privilege separation on by default */
+ 	if (use_privsep == -1)
+@@ -336,7 +339,7 @@ typedef enum {
 	sPermitRootLogin, sLogFacility, sLogLevel,
 	sRhostsRSAAuthentication, sRSAAuthentication,
 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-	sKerberosGetAFSToken, sKerberosUniqueCCache,
-+	sKerberosGetAFSToken, sKerberosUniqueCCache, sKerberosUseKuserok,
- 	sChallengeResponseAuthentication,
+-	sKerberosGetAFSToken,
+	sKerberosGetAFSToken, sKerberosUseKuserok,
+ 	sKerberosTgtPassing, sChallengeResponseAuthentication,
 	sPasswordAuthentication, sKbdInteractiveAuthentication,
 	sListenAddress, sAddressFamily,
-@@ -478,12 +481,14 @@ static struct {
+@@ -409,11 +412,13 @@ static struct {
+ #else
 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 #endif
- 	{ "kerberosuniqueccache", sKerberosUniqueCCache, SSHCFG_GLOBAL },
 +	{ "kerberosusekuserok", sKerberosUseKuserok, SSHCFG_ALL },
 #else
 	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
 	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
 	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
- 	{ "kerberosuniqueccache", sUnsupported, SSHCFG_GLOBAL },
 +	{ "kerberosusekuserok", sUnsupported, SSHCFG_ALL },
 #endif
 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1644,6 +1649,10 @@ process_server_config_line(ServerOptions
- 		*inc_flags &= ~SSHCFG_MATCH_ONLY;
+@@ -1515,6 +1520,10 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		*activep = value;
 		break;
 
 +	case sKerberosUseKuserok:
 +		intptr = &options->use_kuserok;
 +		goto parse_flag;
 +
- 	case sPermitListen:
 	case sPermitOpen:
- 		if (opcode == sPermitListen) {
-@@ -2016,6 +2025,7 @@ copy_set_server_options(ServerOptions *d
- 	M_CP_INTOPT(client_alive_interval);
+ 		arg = strdelim(&cp);
+ 		if (!arg || *arg == '\0')
+@@ -1815,6 +1824,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+ 	M_CP_INTOPT(max_authtries);
 	M_CP_INTOPT(ip_qos_interactive);
 	M_CP_INTOPT(ip_qos_bulk);
 +	M_CP_INTOPT(use_kuserok);
 	M_CP_INTOPT(rekey_limit);
 	M_CP_INTOPT(rekey_interval);
- 	M_CP_INTOPT(log_level);
-@@ -2309,6 +2319,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
- # endif
- 	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
+ 
+@@ -2055,6 +2065,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_fmtint(sUseDNS, o->use_dns);
+ 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
+ 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
 +	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
- #endif
- #ifdef GSSAPI
-	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff -up openssh-7.4p1/servconf.h.kuserok openssh-7.4p1/servconf.h
--- openssh-7.4p1/servconf.h.kuserok	2016-12-23 14:36:07.630465944 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 14:36:07.645465936 +0100
-@@ -118,6 +118,7 @@ typedef struct {
- 						 * authenticated with Kerberos. */
- 	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
- 						 * be stored in per-session ccache */
+ 
+ 	/* string arguments */
+ 	dump_cfg_string(sPidFile, o->pid_file);
+diff --git a/servconf.h b/servconf.h
+index 57752cb..615aaba 100644
+--- a/servconf.h
+++ b/servconf.h
+@@ -174,6 +174,7 @@ typedef struct {
+ 
+ 	int	num_permitted_opens;
+ 
 +	int	use_kuserok;
- 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
- 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
- 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5
--- openssh-7.4p1/sshd_config.5.kuserok	2016-12-23 14:36:07.637465940 +0100
-+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:14:03.117162222 +0100
-@@ -850,6 +850,10 @@ Specifies whether to automatically destr
- .Cm no
- can lead to overwriting previous tickets by subseqent connections to the same
- user account.
+ 	char   *chroot_directory;
+ 	char   *revoked_keys_file;
+ 	char   *trusted_user_ca_keys;
+diff -up openssh-6.3p1/sshd_config.5.kuserok openssh-6.3p1/sshd_config.5
+--- openssh-6.3p1/sshd_config.5.kuserok	2013-10-11 21:41:42.898087571 +0200
+++ openssh-6.3p1/sshd_config.5	2013-10-11 21:41:42.907087528 +0200
+@@ -675,6 +675,10 @@ Specifies whether to automatically destr
+ file on logout.
+ The default is
+ .Dq yes .
 +.It Cm KerberosUseKuserok
 +Specifies whether to look at .k5login file for user's aliases.
 +The default is
-+.Cm yes .
+.Dq yes .
 .It Cm KexAlgorithms
 Specifies the available KEX (Key Exchange) algorithms.
 Multiple algorithms must be comma-separated.
-@@ -1078,6 +1082,7 @@ Available keywords are
- .Cm IPQoS ,
+@@ -833,6 +837,7 @@ Available keywords are
+ .Cm HostbasedUsesNameFromPacketOnly ,
 .Cm KbdInteractiveAuthentication ,
 .Cm KerberosAuthentication ,
 +.Cm KerberosUseKuserok ,
- .Cm LogLevel ,
 .Cm MaxAuthTries ,
 .Cm MaxSessions ,
-diff -up openssh-7.4p1/sshd_config.kuserok openssh-7.4p1/sshd_config
--- openssh-7.4p1/sshd_config.kuserok	2016-12-23 14:36:07.631465943 +0100
-+++ openssh-7.4p1/sshd_config	2016-12-23 14:36:07.646465935 +0100
-@@ -73,6 +73,7 @@ ChallengeResponseAuthentication no
+ .Cm PasswordAuthentication ,
+diff -up openssh-6.3p1/sshd_config.kuserok openssh-6.3p1/sshd_config
+--- openssh-6.3p1/sshd_config.kuserok	2013-10-11 21:41:42.898087571 +0200
+++ openssh-6.3p1/sshd_config	2013-10-11 21:41:42.907087528 +0200
+@@ -86,6 +86,7 @@ ChallengeResponseAuthentication no
 #KerberosOrLocalPasswd yes
 #KerberosTicketCleanup yes
 #KerberosGetAFSToken no
--- a/openssh-6.4p1-legacy-ssh-copy-id.patch
+++ b/openssh-6.4p1-legacy-ssh-copy-id.patch
@ -0,0 +1,57 @@
+diff -up openssh-6.4p1/contrib/ssh-copy-id.1.legacy-ssh-copy-id openssh-6.4p1/contrib/ssh-copy-id.1
+--- openssh-6.4p1/contrib/ssh-copy-id.1.legacy-ssh-copy-id	2013-03-22 00:17:37.000000000 +0100
+++ openssh-6.4p1/contrib/ssh-copy-id.1	2014-01-28 17:12:49.197542425 +0100
+@@ -180,6 +180,19 @@ should prove enlightening (N.B. the mode
+ .Fl W
+ option, rather than
+ .Xr nc 1 ) .
+.Sh ENVIRONMENT
+.Bl -tag -width Ds
+.Pp
+.It Pa SSH_COPY_ID_LEGACY
+If the 
+.Cm SSH_COPY_ID_LEGACY
+environment variable is set, the
+.Nm
+is run in a legacy mode. In this mode, the 
+.Nm
+doesn't check an existence of a private key and doesn't do remote checks
+of the remote server versions or if public keys are already installed.
+.El
+ .Sh "SEE ALSO"
+ .Xr ssh 1 ,
+ .Xr ssh-agent 1 ,
+diff -up openssh-6.4p1/contrib/ssh-copy-id.legacy-ssh-copy-id openssh-6.4p1/contrib/ssh-copy-id
+--- openssh-6.4p1/contrib/ssh-copy-id.legacy-ssh-copy-id	2013-06-05 14:48:45.000000000 +0200
+++ openssh-6.4p1/contrib/ssh-copy-id	2014-01-28 17:11:51.538833032 +0100
+@@ -77,7 +77,7 @@ use_id_file() {
+     PUB_ID_FILE="$L_ID_FILE.pub"
+   fi
+ 
+-  PRIV_ID_FILE=$(dirname "$PUB_ID_FILE")/$(basename "$PUB_ID_FILE" .pub)
+  [ "x$SSH_COPY_ID_LEGACY" != "x" ] || PRIV_ID_FILE=$(dirname "$PUB_ID_FILE")/$(basename "$PUB_ID_FILE" .pub)
+ 
+   # check that the files are readable
+   for f in $PUB_ID_FILE $PRIV_ID_FILE ; do
+@@ -243,7 +243,7 @@ populate_new_ids() {
+   printf '%s: INFO: %d key(s) remain to be installed -- if you are prompted now it is to install the new keys\n' "$0" "$(printf '%s\n' "$NEW_IDS" | wc -l)" >&2
+ }
+ 
+-REMOTE_VERSION=$(ssh -v -o PreferredAuthentications=',' "$@" 2>&1 |
+[ "x$SSH_COPY_ID_LEGACY" != "x" ] || REMOTE_VERSION=$(ssh -v -o PreferredAuthentications=',' "$@" 2>&1 |
+                  sed -ne 's/.*remote software version //p')
+ 
+ case "$REMOTE_VERSION" in
+@@ -268,7 +268,11 @@ case "$REMOTE_VERSION" in
+     ;;
+   *)
+     # Assuming that the remote host treats ~/.ssh/authorized_keys as one might expect
+-    populate_new_ids 0
+    if [ "x$SSH_COPY_ID_LEGACY" != "x" ]; then
+      NEW_IDS=`eval "$GET_ID"`
+    else
+      populate_new_ids 0
+    fi
+     [ "$DRY_RUN" ] || printf '%s\n' "$NEW_IDS" | ssh "$@" "
+ 		umask 077 ;
+ 		mkdir -p .ssh && cat >> .ssh/authorized_keys || exit 1 ;
--- a/openssh-6.4p1-partial-success.patch
+++ b/openssh-6.4p1-partial-success.patch
@ -0,0 +1,16 @@
+diff --git a/auth2.c b/auth2.c
+index 06b672c..8cb9a97 100644
+--- a/auth2.c
+++ b/auth2.c
+@@ -377,8 +377,9 @@ userauth_finish(Authctxt *authctxt, int authenticated, const char *method,
+ 		authctxt->success = 1;
+ 	} else {
+ 
+-		/* Allow initial try of "none" auth without failure penalty */
+-		if (!authctxt->server_caused_failure &&
+		/* Allow initial try of "none" auth without failure penalty
+		 * Partial succes is not failure */
+		if (!authctxt->server_caused_failure && !partial &&
+ 		    (authctxt->attempt > 1 || strcmp(method, "none") != 0))
+ 			authctxt->failures++;
+ 		if (authctxt->failures >= options.max_authtries) {
--- a/openssh-6.6.1p1-scp-non-existing-directory.patch
+++ b/openssh-6.6.1p1-scp-non-existing-directory.patch
@ -10,5 +10,5 @@
 +		}
 		omode = mode;
 		mode |= S_IWUSR;
- 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) == -1) {
+ 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) < 0) {
 -- 
--- a/openssh-6.4p1-servconf-parser.patch
+++ b/openssh-6.4p1-servconf-parser.patch
@ -0,0 +1,31 @@
+diff --git a/servconf.c b/servconf.c
+index 1e88905..f20504b 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -1562,7 +1562,7 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		break;
+ 
+ 	case sForceCommand:
+-		if (cp == NULL)
+		if (cp == NULL || *cp == '\0')
+ 			fatal("%.200s line %d: Missing argument.", filename,
+ 			    linenum);
+ 		len = strspn(cp, WHITESPACE);
+@@ -1607,7 +1607,7 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		break;
+ 
+ 	case sVersionAddendum:
+-		if (cp == NULL)
+		if (cp == NULL || *cp == '\0')
+ 			fatal("%.200s line %d: Missing argument.", filename,
+ 			    linenum);
+ 		len = strspn(cp, WHITESPACE);
+@@ -1642,6 +1642,8 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		break;
+ 
+ 	case sAuthenticationMethods:
+		if (cp == NULL || *cp == '\0')
+			fatal("%.200s line %d: Missing argument.", filename, linenum);
+ 		if (*activep && options->num_auth_methods == 0) {
+ 			while ((arg = strdelim(&cp)) && *arg != '\0') {
+ 				if (options->num_auth_methods >=
--- a/openssh-6.4p1-set_remote_ipaddr.patch
+++ b/openssh-6.4p1-set_remote_ipaddr.patch
@ -0,0 +1,87 @@
+diff --git a/canohost.c b/canohost.c
+index f5cb854..c53cc39 100644
+--- a/canohost.c
+++ b/canohost.c
+@@ -343,6 +343,21 @@ clear_cached_addr(void)
+ 	cached_port = -1;
+ }
+ 
+void set_remote_ipaddr(void) {
+	if (canonical_host_ip != NULL)
+		free(canonical_host_ip);
+
+	if (packet_connection_is_on_socket()) {
+		canonical_host_ip =
+		    get_peer_ipaddr(packet_get_connection_in());
+		if (canonical_host_ip == NULL)
+			cleanup_exit(255);
+	} else {
+		/* If not on socket, return UNKNOWN. */
+		canonical_host_ip = xstrdup("UNKNOWN");
+	}
+}
+
+ /*
+  * Returns the IP-address of the remote host as a string.  The returned
+  * string must not be freed.
+@@ -352,17 +367,9 @@ const char *
+ get_remote_ipaddr(void)
+ {
+ 	/* Check whether we have cached the ipaddr. */
+-	if (canonical_host_ip == NULL) {
+-		if (packet_connection_is_on_socket()) {
+-			canonical_host_ip =
+-			    get_peer_ipaddr(packet_get_connection_in());
+-			if (canonical_host_ip == NULL)
+-				cleanup_exit(255);
+-		} else {
+-			/* If not on socket, return UNKNOWN. */
+-			canonical_host_ip = xstrdup("UNKNOWN");
+-		}
+-	}
+	if (canonical_host_ip == NULL)
+		set_remote_ipaddr();
+
+ 	return canonical_host_ip;
+ }
+ 
+diff --git a/canohost.h b/canohost.h
+index 4c8636f..4079953 100644
+--- a/canohost.h
+++ b/canohost.h
+@@ -13,6 +13,7 @@
+  */
+ 
+ const char	*get_canonical_hostname(int);
+void		 set_remote_ipaddr(void);
+ const char	*get_remote_ipaddr(void);
+ const char	*get_remote_name_or_ip(u_int, int);
+ 
+diff --git a/sshconnect.c b/sshconnect.c
+index 4d8c718..b0b4870 100644
+--- a/sshconnect.c
+++ b/sshconnect.c
+@@ -61,6 +61,7 @@
+ #include "roaming.h"
+ #include "ssh2.h"
+ #include "version.h"
+#include "canohost.h"
+ 
+ char *client_version_string = NULL;
+ char *server_version_string = NULL;
+@@ -172,6 +173,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
+ 	packet_set_connection(pout[0], pin[1]);
+ 	packet_set_timeout(options.server_alive_interval,
+ 	    options.server_alive_count_max);
+	set_remote_ipaddr();
+ 
+ 	/* Indicate OK return */
+ 	return 0;
+@@ -433,6 +435,7 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
+ 	packet_set_connection(sock, sock);
+ 	packet_set_timeout(options.server_alive_interval,
+ 	    options.server_alive_count_max);
+	set_remote_ipaddr();
+ 
+ 	return 0;
+ }
--- a/openssh-6.4p1-sftp-symlink-prepend-relative-links.patch
+++ b/openssh-6.4p1-sftp-symlink-prepend-relative-links.patch
@ -0,0 +1,15 @@
+diff --git a/sftp.c b/sftp.c
+index 4e1a026..6f16f7c 100644
+--- a/sftp.c
+++ b/sftp.c
+@@ -1356,7 +1356,8 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
+ 	case I_SYMLINK:
+ 		sflag = 1;
+ 	case I_LINK:
+-		path1 = make_absolute(path1, *pwd);
+		if (!sflag)
+			path1 = make_absolute(path1, *pwd);
+ 		path2 = make_absolute(path2, *pwd);
+ 		err = (sflag ? do_symlink : do_hardlink)(conn, path1, path2);
+ 		break;
+--
--- a/openssh-6.4p1-utf8-banner.patch
+++ b/openssh-6.4p1-utf8-banner.patch
@ -0,0 +1,994 @@
+diff --git a/Makefile.in b/Makefile.in
+index a82bb07..2c0ada8 100644
+--- a/Makefile.in
+++ b/Makefile.in
+@@ -79,7 +79,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
+ 	kexgssc.o \
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+-	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
+	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o utf8_stringprep.o
+ 
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+ 	sshconnect.o sshconnect1.o sshconnect2.o mux.o \
+diff --git a/misc.h b/misc.h
+index fceb306..379f7f3 100644
+--- a/misc.h
+++ b/misc.h
+@@ -104,4 +104,7 @@ char	*read_passphrase(const char *, int);
+ int	 ask_permission(const char *, ...) __attribute__((format(printf, 1, 2)));
+ int	 read_keyfile_line(FILE *, const char *, char *, size_t, u_long *);
+ 
+/* utf8_stringprep.c */
+int utf8_stringprep(const char *, char *, size_t);
+
+ #endif /* _MISC_H */
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 3179d82..c74644a 100644
+--- a/sshconnect2.c
+++ b/sshconnect2.c
+@@ -33,6 +33,8 @@
+ 
+ #include <errno.h>
+ #include <fcntl.h>
+#include <langinfo.h>
+#include <locale.h>
+ #include <netdb.h>
+ #include <pwd.h>
+ #include <signal.h>
+@@ -542,21 +544,51 @@ input_userauth_error(int type, u_int32_t seq, void *ctxt)
+ 	    "type %d", type);
+ }
+ 
+/* Check whether we can display UTF-8 safely */
+static int
+utf8_ok(void)
+{
+	static int ret = -1;
+	char *cp;
+
+	if (ret == -1) {
+		setlocale(LC_CTYPE, "");
+		cp = nl_langinfo(CODESET);
+		ret = strcmp(cp, "UTF-8") == 0;
+	}
+	return ret;
+}
+
+ /* ARGSUSED */
+ void
+ input_userauth_banner(int type, u_int32_t seq, void *ctxt)
+ {
+ 	char *msg, *raw, *lang;
+-	u_int len;
+	u_int done, len;
+ 
+ 	debug3("input_userauth_banner");
+
+ 	raw = packet_get_string(&len);
+ 	lang = packet_get_string(NULL);
+ 	if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO) {
+ 		if (len > 65536)
+ 			len = 65536;
+ 		msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
+-		strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL|VIS_NOSLASH);
+		done = 0;
+		if (utf8_ok()) {
+			if (utf8_stringprep(raw, msg, len * 4 + 1) == 0)
+				done = 1;
+			else
+				debug2("%s: UTF8 stringprep failed", __func__);
+		}
+		/*
+		 * Fallback to strnvis if UTF8 display not supported or
+		 * conversion failed.
+		 */
+		if (!done) {
+			strnvis(msg, raw, len * 4 + 1,
+			    VIS_SAFE|VIS_OCTAL|VIS_NOSLASH);
+		}
+ 		fprintf(stderr, "%s", msg);
+ 		free(msg);
+ 	}
+diff --git a/stringprep-tables.c b/stringprep-tables.c
+new file mode 100644
+index 0000000..49f4d9d
+--- /dev/null
+++ b/stringprep-tables.c
+@@ -0,0 +1,661 @@
+/* Public domain.  */
+
+/* $OpenBSD$ */
+
+/*
+ * Tables for RFC3454 stringprep algorithm, updated with a table of allocated
+ * characters generated from Unicode.6.2's UnicodeData.txt
+ *
+ * Intended to be included directly from utf8_stringprep.c
+ */
+
+/* Unassigned characters in Unicode 6.2 */
+static const struct u32_range unassigned[] = {
+	{ 0x0378, 0x0379 },
+	{ 0x037F, 0x0383 },
+	{ 0x038B, 0x038B },
+	{ 0x038D, 0x038D },
+	{ 0x03A2, 0x03A2 },
+	{ 0x0528, 0x0530 },
+	{ 0x0557, 0x0558 },
+	{ 0x0560, 0x0560 },
+	{ 0x0588, 0x0588 },
+	{ 0x058B, 0x058E },
+	{ 0x0590, 0x0590 },
+	{ 0x05C8, 0x05CF },
+	{ 0x05EB, 0x05EF },
+	{ 0x05F5, 0x05FF },
+	{ 0x0605, 0x0605 },
+	{ 0x061C, 0x061D },
+	{ 0x070E, 0x070E },
+	{ 0x074B, 0x074C },
+	{ 0x07B2, 0x07BF },
+	{ 0x07FB, 0x07FF },
+	{ 0x082E, 0x082F },
+	{ 0x083F, 0x083F },
+	{ 0x085C, 0x085D },
+	{ 0x085F, 0x089F },
+	{ 0x08A1, 0x08A1 },
+	{ 0x08AD, 0x08E3 },
+	{ 0x08FF, 0x08FF },
+	{ 0x0978, 0x0978 },
+	{ 0x0980, 0x0980 },
+	{ 0x0984, 0x0984 },
+	{ 0x098D, 0x098E },
+	{ 0x0991, 0x0992 },
+	{ 0x09A9, 0x09A9 },
+	{ 0x09B1, 0x09B1 },
+	{ 0x09B3, 0x09B5 },
+	{ 0x09BA, 0x09BB },
+	{ 0x09C5, 0x09C6 },
+	{ 0x09C9, 0x09CA },
+	{ 0x09CF, 0x09D6 },
+	{ 0x09D8, 0x09DB },
+	{ 0x09DE, 0x09DE },
+	{ 0x09E4, 0x09E5 },
+	{ 0x09FC, 0x0A00 },
+	{ 0x0A04, 0x0A04 },
+	{ 0x0A0B, 0x0A0E },
+	{ 0x0A11, 0x0A12 },
+	{ 0x0A29, 0x0A29 },
+	{ 0x0A31, 0x0A31 },
+	{ 0x0A34, 0x0A34 },
+	{ 0x0A37, 0x0A37 },
+	{ 0x0A3A, 0x0A3B },
+	{ 0x0A3D, 0x0A3D },
+	{ 0x0A43, 0x0A46 },
+	{ 0x0A49, 0x0A4A },
+	{ 0x0A4E, 0x0A50 },
+	{ 0x0A52, 0x0A58 },
+	{ 0x0A5D, 0x0A5D },
+	{ 0x0A5F, 0x0A65 },
+	{ 0x0A76, 0x0A80 },
+	{ 0x0A84, 0x0A84 },
+	{ 0x0A8E, 0x0A8E },
+	{ 0x0A92, 0x0A92 },
+	{ 0x0AA9, 0x0AA9 },
+	{ 0x0AB1, 0x0AB1 },
+	{ 0x0AB4, 0x0AB4 },
+	{ 0x0ABA, 0x0ABB },
+	{ 0x0AC6, 0x0AC6 },
+	{ 0x0ACA, 0x0ACA },
+	{ 0x0ACE, 0x0ACF },
+	{ 0x0AD1, 0x0ADF },
+	{ 0x0AE4, 0x0AE5 },
+	{ 0x0AF2, 0x0B00 },
+	{ 0x0B04, 0x0B04 },
+	{ 0x0B0D, 0x0B0E },
+	{ 0x0B11, 0x0B12 },
+	{ 0x0B29, 0x0B29 },
+	{ 0x0B31, 0x0B31 },
+	{ 0x0B34, 0x0B34 },
+	{ 0x0B3A, 0x0B3B },
+	{ 0x0B45, 0x0B46 },
+	{ 0x0B49, 0x0B4A },
+	{ 0x0B4E, 0x0B55 },
+	{ 0x0B58, 0x0B5B },
+	{ 0x0B5E, 0x0B5E },
+	{ 0x0B64, 0x0B65 },
+	{ 0x0B78, 0x0B81 },
+	{ 0x0B84, 0x0B84 },
+	{ 0x0B8B, 0x0B8D },
+	{ 0x0B91, 0x0B91 },
+	{ 0x0B96, 0x0B98 },
+	{ 0x0B9B, 0x0B9B },
+	{ 0x0B9D, 0x0B9D },
+	{ 0x0BA0, 0x0BA2 },
+	{ 0x0BA5, 0x0BA7 },
+	{ 0x0BAB, 0x0BAD },
+	{ 0x0BBA, 0x0BBD },
+	{ 0x0BC3, 0x0BC5 },
+	{ 0x0BC9, 0x0BC9 },
+	{ 0x0BCE, 0x0BCF },
+	{ 0x0BD1, 0x0BD6 },
+	{ 0x0BD8, 0x0BE5 },
+	{ 0x0BFB, 0x0C00 },
+	{ 0x0C04, 0x0C04 },
+	{ 0x0C0D, 0x0C0D },
+	{ 0x0C11, 0x0C11 },
+	{ 0x0C29, 0x0C29 },
+	{ 0x0C34, 0x0C34 },
+	{ 0x0C3A, 0x0C3C },
+	{ 0x0C45, 0x0C45 },
+	{ 0x0C49, 0x0C49 },
+	{ 0x0C4E, 0x0C54 },
+	{ 0x0C57, 0x0C57 },
+	{ 0x0C5A, 0x0C5F },
+	{ 0x0C64, 0x0C65 },
+	{ 0x0C70, 0x0C77 },
+	{ 0x0C80, 0x0C81 },
+	{ 0x0C84, 0x0C84 },
+	{ 0x0C8D, 0x0C8D },
+	{ 0x0C91, 0x0C91 },
+	{ 0x0CA9, 0x0CA9 },
+	{ 0x0CB4, 0x0CB4 },
+	{ 0x0CBA, 0x0CBB },
+	{ 0x0CC5, 0x0CC5 },
+	{ 0x0CC9, 0x0CC9 },
+	{ 0x0CCE, 0x0CD4 },
+	{ 0x0CD7, 0x0CDD },
+	{ 0x0CDF, 0x0CDF },
+	{ 0x0CE4, 0x0CE5 },
+	{ 0x0CF0, 0x0CF0 },
+	{ 0x0CF3, 0x0D01 },
+	{ 0x0D04, 0x0D04 },
+	{ 0x0D0D, 0x0D0D },
+	{ 0x0D11, 0x0D11 },
+	{ 0x0D3B, 0x0D3C },
+	{ 0x0D45, 0x0D45 },
+	{ 0x0D49, 0x0D49 },
+	{ 0x0D4F, 0x0D56 },
+	{ 0x0D58, 0x0D5F },
+	{ 0x0D64, 0x0D65 },
+	{ 0x0D76, 0x0D78 },
+	{ 0x0D80, 0x0D81 },
+	{ 0x0D84, 0x0D84 },
+	{ 0x0D97, 0x0D99 },
+	{ 0x0DB2, 0x0DB2 },
+	{ 0x0DBC, 0x0DBC },
+	{ 0x0DBE, 0x0DBF },
+	{ 0x0DC7, 0x0DC9 },
+	{ 0x0DCB, 0x0DCE },
+	{ 0x0DD5, 0x0DD5 },
+	{ 0x0DD7, 0x0DD7 },
+	{ 0x0DE0, 0x0DF1 },
+	{ 0x0DF5, 0x0E00 },
+	{ 0x0E3B, 0x0E3E },
+	{ 0x0E5C, 0x0E80 },
+	{ 0x0E83, 0x0E83 },
+	{ 0x0E85, 0x0E86 },
+	{ 0x0E89, 0x0E89 },
+	{ 0x0E8B, 0x0E8C },
+	{ 0x0E8E, 0x0E93 },
+	{ 0x0E98, 0x0E98 },
+	{ 0x0EA0, 0x0EA0 },
+	{ 0x0EA4, 0x0EA4 },
+	{ 0x0EA6, 0x0EA6 },
+	{ 0x0EA8, 0x0EA9 },
+	{ 0x0EAC, 0x0EAC },
+	{ 0x0EBA, 0x0EBA },
+	{ 0x0EBE, 0x0EBF },
+	{ 0x0EC5, 0x0EC5 },
+	{ 0x0EC7, 0x0EC7 },
+	{ 0x0ECE, 0x0ECF },
+	{ 0x0EDA, 0x0EDB },
+	{ 0x0EE0, 0x0EFF },
+	{ 0x0F48, 0x0F48 },
+	{ 0x0F6D, 0x0F70 },
+	{ 0x0F98, 0x0F98 },
+	{ 0x0FBD, 0x0FBD },
+	{ 0x0FCD, 0x0FCD },
+	{ 0x0FDB, 0x0FFF },
+	{ 0x10C6, 0x10C6 },
+	{ 0x10C8, 0x10CC },
+	{ 0x10CE, 0x10CF },
+	{ 0x1249, 0x1249 },
+	{ 0x124E, 0x124F },
+	{ 0x1257, 0x1257 },
+	{ 0x1259, 0x1259 },
+	{ 0x125E, 0x125F },
+	{ 0x1289, 0x1289 },
+	{ 0x128E, 0x128F },
+	{ 0x12B1, 0x12B1 },
+	{ 0x12B6, 0x12B7 },
+	{ 0x12BF, 0x12BF },
+	{ 0x12C1, 0x12C1 },
+	{ 0x12C6, 0x12C7 },
+	{ 0x12D7, 0x12D7 },
+	{ 0x1311, 0x1311 },
+	{ 0x1316, 0x1317 },
+	{ 0x135B, 0x135C },
+	{ 0x137D, 0x137F },
+	{ 0x139A, 0x139F },
+	{ 0x13F5, 0x13FF },
+	{ 0x169D, 0x169F },
+	{ 0x16F1, 0x16FF },
+	{ 0x170D, 0x170D },
+	{ 0x1715, 0x171F },
+	{ 0x1737, 0x173F },
+	{ 0x1754, 0x175F },
+	{ 0x176D, 0x176D },
+	{ 0x1771, 0x1771 },
+	{ 0x1774, 0x177F },
+	{ 0x17DE, 0x17DF },
+	{ 0x17EA, 0x17EF },
+	{ 0x17FA, 0x17FF },
+	{ 0x180F, 0x180F },
+	{ 0x181A, 0x181F },
+	{ 0x1878, 0x187F },
+	{ 0x18AB, 0x18AF },
+	{ 0x18F6, 0x18FF },
+	{ 0x191D, 0x191F },
+	{ 0x192C, 0x192F },
+	{ 0x193C, 0x193F },
+	{ 0x1941, 0x1943 },
+	{ 0x196E, 0x196F },
+	{ 0x1975, 0x197F },
+	{ 0x19AC, 0x19AF },
+	{ 0x19CA, 0x19CF },
+	{ 0x19DB, 0x19DD },
+	{ 0x1A1C, 0x1A1D },
+	{ 0x1A5F, 0x1A5F },
+	{ 0x1A7D, 0x1A7E },
+	{ 0x1A8A, 0x1A8F },
+	{ 0x1A9A, 0x1A9F },
+	{ 0x1AAE, 0x1AFF },
+	{ 0x1B4C, 0x1B4F },
+	{ 0x1B7D, 0x1B7F },
+	{ 0x1BF4, 0x1BFB },
+	{ 0x1C38, 0x1C3A },
+	{ 0x1C4A, 0x1C4C },
+	{ 0x1C80, 0x1CBF },
+	{ 0x1CC8, 0x1CCF },
+	{ 0x1CF7, 0x1CFF },
+	{ 0x1DE7, 0x1DFB },
+	{ 0x1F16, 0x1F17 },
+	{ 0x1F1E, 0x1F1F },
+	{ 0x1F46, 0x1F47 },
+	{ 0x1F4E, 0x1F4F },
+	{ 0x1F58, 0x1F58 },
+	{ 0x1F5A, 0x1F5A },
+	{ 0x1F5C, 0x1F5C },
+	{ 0x1F5E, 0x1F5E },
+	{ 0x1F7E, 0x1F7F },
+	{ 0x1FB5, 0x1FB5 },
+	{ 0x1FC5, 0x1FC5 },
+	{ 0x1FD4, 0x1FD5 },
+	{ 0x1FDC, 0x1FDC },
+	{ 0x1FF0, 0x1FF1 },
+	{ 0x1FF5, 0x1FF5 },
+	{ 0x1FFF, 0x1FFF },
+	{ 0x2065, 0x2069 },
+	{ 0x2072, 0x2073 },
+	{ 0x208F, 0x208F },
+	{ 0x209D, 0x209F },
+	{ 0x20BB, 0x20CF },
+	{ 0x20F1, 0x20FF },
+	{ 0x218A, 0x218F },
+	{ 0x23F4, 0x23FF },
+	{ 0x2427, 0x243F },
+	{ 0x244B, 0x245F },
+	{ 0x2700, 0x2700 },
+	{ 0x2B4D, 0x2B4F },
+	{ 0x2B5A, 0x2BFF },
+	{ 0x2C2F, 0x2C2F },
+	{ 0x2C5F, 0x2C5F },
+	{ 0x2CF4, 0x2CF8 },
+	{ 0x2D26, 0x2D26 },
+	{ 0x2D28, 0x2D2C },
+	{ 0x2D2E, 0x2D2F },
+	{ 0x2D68, 0x2D6E },
+	{ 0x2D71, 0x2D7E },
+	{ 0x2D97, 0x2D9F },
+	{ 0x2DA7, 0x2DA7 },
+	{ 0x2DAF, 0x2DAF },
+	{ 0x2DB7, 0x2DB7 },
+	{ 0x2DBF, 0x2DBF },
+	{ 0x2DC7, 0x2DC7 },
+	{ 0x2DCF, 0x2DCF },
+	{ 0x2DD7, 0x2DD7 },
+	{ 0x2DDF, 0x2DDF },
+	{ 0x2E3C, 0x2E7F },
+	{ 0x2E9A, 0x2E9A },
+	{ 0x2EF4, 0x2EFF },
+	{ 0x2FD6, 0x2FEF },
+	{ 0x2FFC, 0x2FFF },
+	{ 0x3040, 0x3040 },
+	{ 0x3097, 0x3098 },
+	{ 0x3100, 0x3104 },
+	{ 0x312E, 0x3130 },
+	{ 0x318F, 0x318F },
+	{ 0x31BB, 0x31BF },
+	{ 0x31E4, 0x31EF },
+	{ 0x321F, 0x321F },
+	{ 0x32FF, 0x32FF },
+	{ 0x4DB6, 0x4DBF },
+	{ 0x9FA6, 0x9FCB },
+	{ 0x9FCD, 0x9FFF },
+	{ 0xA48D, 0xA48F },
+	{ 0xA4C7, 0xA4CF },
+	{ 0xA62C, 0xA63F },
+	{ 0xA698, 0xA69E },
+	{ 0xA6F8, 0xA6FF },
+	{ 0xA78F, 0xA78F },
+	{ 0xA794, 0xA79F },
+	{ 0xA7AB, 0xA7F7 },
+	{ 0xA82C, 0xA82F },
+	{ 0xA83A, 0xA83F },
+	{ 0xA878, 0xA87F },
+	{ 0xA8C5, 0xA8CD },
+	{ 0xA8DA, 0xA8DF },
+	{ 0xA8FC, 0xA8FF },
+	{ 0xA954, 0xA95E },
+	{ 0xA97D, 0xA97F },
+	{ 0xA9CE, 0xA9CE },
+	{ 0xA9DA, 0xA9DD },
+	{ 0xA9E0, 0xA9FF },
+	{ 0xAA37, 0xAA3F },
+	{ 0xAA4E, 0xAA4F },
+	{ 0xAA5A, 0xAA5B },
+	{ 0xAA7C, 0xAA7F },
+	{ 0xAAC3, 0xAADA },
+	{ 0xAAF7, 0xAB00 },
+	{ 0xAB07, 0xAB08 },
+	{ 0xAB0F, 0xAB10 },
+	{ 0xAB17, 0xAB1F },
+	{ 0xAB27, 0xAB27 },
+	{ 0xAB2F, 0xABBF },
+	{ 0xABEE, 0xABEF },
+	{ 0xABFA, 0xABFF },
+	{ 0xD7A4, 0xD7AF },
+	{ 0xD7C7, 0xD7CA },
+	{ 0xD7FC, 0xD7FF },
+	{ 0xFA6E, 0xFA6F },
+	{ 0xFADA, 0xFAFF },
+	{ 0xFB07, 0xFB12 },
+	{ 0xFB18, 0xFB1C },
+	{ 0xFB37, 0xFB37 },
+	{ 0xFB3D, 0xFB3D },
+	{ 0xFB3F, 0xFB3F },
+	{ 0xFB42, 0xFB42 },
+	{ 0xFB45, 0xFB45 },
+	{ 0xFBC2, 0xFBD2 },
+	{ 0xFD40, 0xFD4F },
+	{ 0xFD90, 0xFD91 },
+	{ 0xFDC8, 0xFDCF },
+	{ 0xFDFE, 0xFDFF },
+	{ 0xFE1A, 0xFE1F },
+	{ 0xFE27, 0xFE2F },
+	{ 0xFE53, 0xFE53 },
+	{ 0xFE67, 0xFE67 },
+	{ 0xFE6C, 0xFE6F },
+	{ 0xFE75, 0xFE75 },
+	{ 0xFEFD, 0xFEFE },
+	{ 0xFF00, 0xFF00 },
+	{ 0xFFBF, 0xFFC1 },
+	{ 0xFFC8, 0xFFC9 },
+	{ 0xFFD0, 0xFFD1 },
+	{ 0xFFD8, 0xFFD9 },
+	{ 0xFFDD, 0xFFDF },
+	{ 0xFFE7, 0xFFE7 },
+	{ 0xFFEF, 0xFFF8 },
+	{ 0x1000C, 0x1000C },
+	{ 0x10027, 0x10027 },
+	{ 0x1003B, 0x1003B },
+	{ 0x1003E, 0x1003E },
+	{ 0x1004E, 0x1004F },
+	{ 0x1005E, 0x1007F },
+	{ 0x100FB, 0x100FF },
+	{ 0x10103, 0x10106 },
+	{ 0x10134, 0x10136 },
+	{ 0x1018B, 0x1018F },
+	{ 0x1019C, 0x101CF },
+	{ 0x101FE, 0x1027F },
+	{ 0x1029D, 0x1029F },
+	{ 0x102D1, 0x102FF },
+	{ 0x1031F, 0x1031F },
+	{ 0x10324, 0x1032F },
+	{ 0x1034B, 0x1037F },
+	{ 0x1039E, 0x1039E },
+	{ 0x103C4, 0x103C7 },
+	{ 0x103D6, 0x103FF },
+	{ 0x1049E, 0x1049F },
+	{ 0x104AA, 0x107FF },
+	{ 0x10806, 0x10807 },
+	{ 0x10809, 0x10809 },
+	{ 0x10836, 0x10836 },
+	{ 0x10839, 0x1083B },
+	{ 0x1083D, 0x1083E },
+	{ 0x10856, 0x10856 },
+	{ 0x10860, 0x108FF },
+	{ 0x1091C, 0x1091E },
+	{ 0x1093A, 0x1093E },
+	{ 0x10940, 0x1097F },
+	{ 0x109B8, 0x109BD },
+	{ 0x109C0, 0x109FF },
+	{ 0x10A04, 0x10A04 },
+	{ 0x10A07, 0x10A0B },
+	{ 0x10A14, 0x10A14 },
+	{ 0x10A18, 0x10A18 },
+	{ 0x10A34, 0x10A37 },
+	{ 0x10A3B, 0x10A3E },
+	{ 0x10A48, 0x10A4F },
+	{ 0x10A59, 0x10A5F },
+	{ 0x10A80, 0x10AFF },
+	{ 0x10B36, 0x10B38 },
+	{ 0x10B56, 0x10B57 },
+	{ 0x10B73, 0x10B77 },
+	{ 0x10B80, 0x10BFF },
+	{ 0x10C49, 0x10E5F },
+	{ 0x10E7F, 0x10FFF },
+	{ 0x1104E, 0x11051 },
+	{ 0x11070, 0x1107F },
+	{ 0x110C2, 0x110CF },
+	{ 0x110E9, 0x110EF },
+	{ 0x110FA, 0x110FF },
+	{ 0x11135, 0x11135 },
+	{ 0x11144, 0x1117F },
+	{ 0x111C9, 0x111CF },
+	{ 0x111DA, 0x1167F },
+	{ 0x116B8, 0x116BF },
+	{ 0x116CA, 0x11FFF },
+	{ 0x1236F, 0x123FF },
+	{ 0x12463, 0x1246F },
+	{ 0x12474, 0x12FFF },
+	{ 0x1342F, 0x167FF },
+	{ 0x16A39, 0x16EFF },
+	{ 0x16F45, 0x16F4F },
+	{ 0x16F7F, 0x16F8E },
+	{ 0x16FA0, 0x1AFFF },
+	{ 0x1B002, 0x1CFFF },
+	{ 0x1D0F6, 0x1D0FF },
+	{ 0x1D127, 0x1D128 },
+	{ 0x1D1DE, 0x1D1FF },
+	{ 0x1D246, 0x1D2FF },
+	{ 0x1D357, 0x1D35F },
+	{ 0x1D372, 0x1D3FF },
+	{ 0x1D455, 0x1D455 },
+	{ 0x1D49D, 0x1D49D },
+	{ 0x1D4A0, 0x1D4A1 },
+	{ 0x1D4A3, 0x1D4A4 },
+	{ 0x1D4A7, 0x1D4A8 },
+	{ 0x1D4AD, 0x1D4AD },
+	{ 0x1D4BA, 0x1D4BA },
+	{ 0x1D4BC, 0x1D4BC },
+	{ 0x1D4C4, 0x1D4C4 },
+	{ 0x1D506, 0x1D506 },
+	{ 0x1D50B, 0x1D50C },
+	{ 0x1D515, 0x1D515 },
+	{ 0x1D51D, 0x1D51D },
+	{ 0x1D53A, 0x1D53A },
+	{ 0x1D53F, 0x1D53F },
+	{ 0x1D545, 0x1D545 },
+	{ 0x1D547, 0x1D549 },
+	{ 0x1D551, 0x1D551 },
+	{ 0x1D6A6, 0x1D6A7 },
+	{ 0x1D7CC, 0x1D7CD },
+	{ 0x1D800, 0x1EDFF },
+	{ 0x1EE04, 0x1EE04 },
+	{ 0x1EE20, 0x1EE20 },
+	{ 0x1EE23, 0x1EE23 },
+	{ 0x1EE25, 0x1EE26 },
+	{ 0x1EE28, 0x1EE28 },
+	{ 0x1EE33, 0x1EE33 },
+	{ 0x1EE38, 0x1EE38 },
+	{ 0x1EE3A, 0x1EE3A },
+	{ 0x1EE3C, 0x1EE41 },
+	{ 0x1EE43, 0x1EE46 },
+	{ 0x1EE48, 0x1EE48 },
+	{ 0x1EE4A, 0x1EE4A },
+	{ 0x1EE4C, 0x1EE4C },
+	{ 0x1EE50, 0x1EE50 },
+	{ 0x1EE53, 0x1EE53 },
+	{ 0x1EE55, 0x1EE56 },
+	{ 0x1EE58, 0x1EE58 },
+	{ 0x1EE5A, 0x1EE5A },
+	{ 0x1EE5C, 0x1EE5C },
+	{ 0x1EE5E, 0x1EE5E },
+	{ 0x1EE60, 0x1EE60 },
+	{ 0x1EE63, 0x1EE63 },
+	{ 0x1EE65, 0x1EE66 },
+	{ 0x1EE6B, 0x1EE6B },
+	{ 0x1EE73, 0x1EE73 },
+	{ 0x1EE78, 0x1EE78 },
+	{ 0x1EE7D, 0x1EE7D },
+	{ 0x1EE7F, 0x1EE7F },
+	{ 0x1EE8A, 0x1EE8A },
+	{ 0x1EE9C, 0x1EEA0 },
+	{ 0x1EEA4, 0x1EEA4 },
+	{ 0x1EEAA, 0x1EEAA },
+	{ 0x1EEBC, 0x1EEEF },
+	{ 0x1EEF2, 0x1EFFF },
+	{ 0x1F02C, 0x1F02F },
+	{ 0x1F094, 0x1F09F },
+	{ 0x1F0AF, 0x1F0B0 },
+	{ 0x1F0BF, 0x1F0C0 },
+	{ 0x1F0D0, 0x1F0D0 },
+	{ 0x1F0E0, 0x1F0FF },
+	{ 0x1F10B, 0x1F10F },
+	{ 0x1F12F, 0x1F12F },
+	{ 0x1F16C, 0x1F16F },
+	{ 0x1F19B, 0x1F1E5 },
+	{ 0x1F203, 0x1F20F },
+	{ 0x1F23B, 0x1F23F },
+	{ 0x1F249, 0x1F24F },
+	{ 0x1F252, 0x1F2FF },
+	{ 0x1F321, 0x1F32F },
+	{ 0x1F336, 0x1F336 },
+	{ 0x1F37D, 0x1F37F },
+	{ 0x1F394, 0x1F39F },
+	{ 0x1F3C5, 0x1F3C5 },
+	{ 0x1F3CB, 0x1F3DF },
+	{ 0x1F3F1, 0x1F3FF },
+	{ 0x1F43F, 0x1F43F },
+	{ 0x1F441, 0x1F441 },
+	{ 0x1F4F8, 0x1F4F8 },
+	{ 0x1F4FD, 0x1F4FF },
+	{ 0x1F53E, 0x1F53F },
+	{ 0x1F544, 0x1F54F },
+	{ 0x1F568, 0x1F5FA },
+	{ 0x1F641, 0x1F644 },
+	{ 0x1F650, 0x1F67F },
+	{ 0x1F6C6, 0x1F6FF },
+	{ 0x1F774, 0x1FFFD },
+	{ 0x2A6D7, 0x2A6FF },
+	{ 0x2A701, 0x2B733 },
+	{ 0x2B735, 0x2B73F },
+	{ 0x2B741, 0x2B81C },
+	{ 0x2B81E, 0x2F7FF },
+	{ 0x2FA1E, 0x2FFFD },
+	{ 0x30000, 0x3FFFD },
+	{ 0x40000, 0x4FFFD },
+	{ 0x50000, 0x5FFFD },
+	{ 0x60000, 0x6FFFD },
+	{ 0x70000, 0x7FFFD },
+	{ 0x80000, 0x8FFFD },
+	{ 0x90000, 0x9FFFD },
+	{ 0xA0000, 0xAFFFD },
+	{ 0xB0000, 0xBFFFD },
+	{ 0xC0000, 0xCFFFD },
+	{ 0xD0000, 0xDFFFD },
+	{ 0xE0000, 0xE0000 },
+	{ 0xE0002, 0xE001F },
+	{ 0xE0080, 0xE00FF },
+	{ 0xE01F0, 0xEFFFD },
+};
+
+/* RFC3454 Table B.1 */
+static const struct u32_range map_to_nothing[] = {
+	{ 0x00AD, 0x00AD },
+	{ 0x034F, 0x034F },
+	{ 0x1806, 0x1806 },
+	{ 0x180B, 0x180D },
+	{ 0x200B, 0x200D },
+	{ 0x2060, 0x2060 },
+	{ 0xFE00, 0xFE0F },
+	{ 0xFEFF, 0xFEFF },
+};
+
+/* Local: allow tab, CR and LF */
+static const struct u32_range whitelist[] = {
+	{ 0x09, 0x09 },
+	{ 0x0a, 0x0a },
+	{ 0x0d, 0x0d },
+};
+
+/* RFC3454 Tables in appendix C */
+static const struct u32_range prohibited[] = {
+	/* C.2.1 ASCII control characters */
+	{ 0x0000, 0x001F },
+	{ 0x007F, 0x007F },
+	/* C.2.2 Non-ASCII control characters */
+	{ 0x0080, 0x009F },
+	{ 0x06DD, 0x06DD },
+	{ 0x070F, 0x070F },
+	{ 0x180E, 0x180E },
+	{ 0x200C, 0x200C },
+	{ 0x200D, 0x200D },
+	{ 0x2028, 0x2028 },
+	{ 0x2029, 0x2029 },
+	{ 0x2060, 0x2060 },
+	{ 0x2061, 0x2061 },
+	{ 0x2062, 0x2062 },
+	{ 0x2063, 0x2063 },
+	{ 0x206A, 0x206F },
+	{ 0xFEFF, 0xFEFF },
+	{ 0xFFF9, 0xFFFC },
+	{ 0x1D173, 0x1D17A },
+	/* C.3 Private use */
+	{ 0xE000, 0xF8FF },
+	{ 0xF0000, 0xFFFFD },
+	{ 0x100000, 0x10FFFD },
+	/* C.4 Non-character code points */
+	{ 0xFDD0, 0xFDEF },
+	{ 0xFFFE, 0xFFFF },
+	{ 0x1FFFE, 0x1FFFF },
+	{ 0x2FFFE, 0x2FFFF },
+	{ 0x3FFFE, 0x3FFFF },
+	{ 0x4FFFE, 0x4FFFF },
+	{ 0x5FFFE, 0x5FFFF },
+	{ 0x6FFFE, 0x6FFFF },
+	{ 0x7FFFE, 0x7FFFF },
+	{ 0x8FFFE, 0x8FFFF },
+	{ 0x9FFFE, 0x9FFFF },
+	{ 0xAFFFE, 0xAFFFF },
+	{ 0xBFFFE, 0xBFFFF },
+	{ 0xCFFFE, 0xCFFFF },
+	{ 0xDFFFE, 0xDFFFF },
+	{ 0xEFFFE, 0xEFFFF },
+	{ 0xFFFFE, 0xFFFFF },
+	{ 0x10FFFE, 0x10FFFF },
+	/* C.5 Surrogate codes */
+	{ 0xD800, 0xDFFF },
+	/* C.6 Inappropriate for plain text */
+	{ 0xFFF9, 0xFFF9 },
+	{ 0xFFFA, 0xFFFA },
+	{ 0xFFFB, 0xFFFB },
+	{ 0xFFFC, 0xFFFC },
+	{ 0xFFFD, 0xFFFD },
+	/* C.7 Inappropriate for canonical representation */
+	{ 0x2FF0, 0x2FFB },
+	/* C.8 Change display properties or are deprecated */
+	{ 0x0340, 0x0340 },
+	{ 0x0341, 0x0341 },
+	{ 0x200E, 0x200E },
+	{ 0x200F, 0x200F },
+	{ 0x202A, 0x202A },
+	{ 0x202B, 0x202B },
+	{ 0x202C, 0x202C },
+	{ 0x202D, 0x202D },
+	{ 0x202E, 0x202E },
+	{ 0x206A, 0x206A },
+	{ 0x206B, 0x206B },
+	{ 0x206C, 0x206C },
+	{ 0x206D, 0x206D },
+	{ 0x206E, 0x206E },
+	{ 0x206F, 0x206F },
+	/* C.9 Tagging characters */
+	{ 0xE0001, 0xE0001 },
+	{ 0xE0020, 0xE007F },
+};
+
+diff --git a/utf8_stringprep.c b/utf8_stringprep.c
+new file mode 100644
+index 0000000..bcafae7
+--- /dev/null
+++ b/utf8_stringprep.c
+@@ -0,0 +1,229 @@
+/*
+ * Copyright (c) 2013 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This is a simple RFC3454 stringprep profile to sanitise UTF-8 strings
+ * from untrusted sources.
+ *
+ * It is intended to be used prior to display of untrusted strings only.
+ * It should not be used for logging because of bi-di ambiguity. It
+ * should also not be used in any case where lack of normalisation may
+ * cause problems.
+ *
+ * This profile uses the prohibition and mapping tables from RFC3454
+ * (listed below) but the unassigned character table has been updated to
+ * Unicode 6.2. It uses a local whitelist of whitespace characters (\n,
+ * \a and \t). Unicode normalisation and bi-di testing are not used.
+ *
+ * XXX: implement bi-di handling (needed for logs)
+ * XXX: implement KC normalisation (needed for passing to libs/syscalls)
+ */
+
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <limits.h>
+#include <ctype.h>
+
+#include "misc.h"
+
+struct u32_range {
+	u_int32_t lo, hi;  /* Inclusive */
+};
+
+#include "stringprep-tables.c"
+
+/* Returns 1 if code 'c' appears in the table or 0 otherwise */
+static int
+code_in_table(u_int32_t c, const struct u32_range *table, size_t tlen)
+{
+	const struct u32_range *e, *end = (void *)(tlen + (char *)table);
+
+	for (e = table; e < end; e++) {
+		if (c >= e->lo && c <= e->hi)
+			return 1;
+	}
+	return 0;
+}
+
+/*
+ * Decode the next valid UCS character from a UTF-8 string, skipping past bad
+ * codes. Returns the decoded character or 0 for end-of-string and updates
+ * nextc to point to the start of the next character (if any).
+ * had_error is set if an invalid code was encountered.
+ */
+static u_int32_t
+decode_utf8(const char *in, const char **nextc, int *had_error)
+{
+	int state = 0;
+	size_t i;
+	u_int32_t c, e;
+
+	e = c = 0;
+	for (i = 0; in[i] != '\0'; i++) {
+		e = (u_char)in[i];
+		/* Invalid code point state */
+		if (state == -1) {
+			/*
+			 * Continue eating continuation characters until
+			 * a new start character comes along.
+			 */
+			if ((e & 0xc0) == 0x80)
+				continue;
+			state = 0;
+		}
+
+		/* New code point state */
+		if (state == 0) {
+			if ((e & 0x80) == 0) { /* 7 bit code */
+				c = e & 0x7f;
+				goto have_code;
+			} else if ((e & 0xe0) == 0xc0) { /* 11 bit code point */
+				state = 1;
+				c = (e & 0x1f) << 6;
+			} else if ((e & 0xf0) == 0xe0) { /* 16 bit code point */
+				state = 2;
+				c = (e & 0xf) << 12;
+			} else if ((e & 0xf8) == 0xf0) { /* 21 bit code point */
+				state = 3;
+				c = (e & 0x7) << 18;
+			} else {
+				/* A five or six byte header, or 0xff */
+				goto bad_encoding;
+			}
+			/*
+			 * Check that the header byte has some non-zero data
+			 * after masking off the length marker. If not it is
+			 * an invalid encoding.
+			 */
+			if (c == 0) {
+ bad_encoding:
+				c = 0;
+				state = -1;
+				if (had_error != NULL)
+					*had_error = 1;
+			}
+			continue;
+		}
+
+		/* Sanity check: should never happen */
+		if (state < 1 || state > 5) {
+			*nextc = NULL;
+			if (had_error != NULL)
+				*had_error = 1;
+			return 0;
+		}
+		/* Multibyte code point state */
+		state--;
+		c |= (e & 0x3f) << (state * 6);	
+		if (state > 0)
+			continue;
+
+		/* RFC3629 bans codepoints > U+10FFFF */
+		if (c > 0x10FFFF) {
+			if (had_error != NULL)
+				*had_error = 1;
+			continue;
+		}
+ have_code:
+		*nextc = in + i + 1;
+		return c;
+	}
+	if (state != 0 && had_error != NULL)
+		*had_error = 1;
+	*nextc = in + i;
+	return 0;
+}
+
+/*
+ * Attempt to encode a UCS character as a UTF-8 sequence. Returns the number
+ * of characters used or -1 on error (insufficient space or bad code).
+ */
+static int
+encode_utf8(u_int32_t c, char *s, size_t slen)
+{
+	size_t i, need;
+	u_char h;
+
+	if (c < 0x80) {
+		if (slen >= 1) {
+			s[0] = (char)c;
+		}
+		return 1;
+	} else if (c < 0x800) {
+		need = 2;
+		h = 0xc0;
+	} else if (c < 0x10000) {
+		need = 3;
+		h = 0xe0;
+	} else if (c < 0x200000) {
+		need = 4;
+		h = 0xf0;
+	} else {
+		/* Invalid code point > U+10FFFF */
+		return -1;
+	}
+	if (need > slen)
+		return -1;
+	for (i = 0; i < need; i++) {
+		s[i] = (i == 0 ? h : 0x80);
+		s[i] |= (c >> (need - i - 1) * 6) & 0x3f;
+	}
+	return need;
+}
+
+
+/*
+ * Normalise a UTF-8 string using the RFC3454 stringprep algorithm.
+ * Returns 0 on success or -1 on failure (prohibited code or insufficient
+ * length in the output string.
+ * Requires an output buffer at most the same length as the input.
+ */
+int
+utf8_stringprep(const char *in, char *out, size_t olen)
+{
+	int r;
+	size_t o;
+	u_int32_t c;
+
+	if (olen < 1)
+		return -1;
+
+	for (o = 0; (c = decode_utf8(in, &in, NULL)) != 0;) {
+		/* Mapping */
+		if (code_in_table(c, map_to_nothing, sizeof(map_to_nothing)))
+			continue;
+
+		/* Prohibitied output */
+		if (code_in_table(c, prohibited, sizeof(prohibited)) &&
+		    !code_in_table(c, whitelist, sizeof(whitelist)))
+			return -1;
+
+		/* Map unassigned code points to U+FFFD */
+		if (code_in_table(c, unassigned, sizeof(unassigned)))
+			c = 0xFFFD;
+
+		/* Encode the character */
+		r = encode_utf8(c, out + o, olen - o - 1);
+		if (r < 0)
+			return -1;
+		o += r;
+	}
+	out[o] = '\0';
+	return 0;
+}
+
--- a/openssh-6.6.1p1-log-in-chroot.patch
+++ b/openssh-6.6.1p1-log-in-chroot.patch
@ -1,263 +0,0 @@
-diff -up openssh-7.4p1/log.c.log-in-chroot openssh-7.4p1/log.c
--- openssh-7.4p1/log.c.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/log.c	2016-12-23 15:14:33.330168088 +0100
-@@ -250,6 +250,11 @@ debug3(const char *fmt,...)
- void
- log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
- {
-+	log_init_handler(av0, level, facility, on_stderr, 1);
-+}
-+
-+void
-+log_init_handler(char *av0, LogLevel level, SyslogFacility facility, int on_stderr, int reset_handler) {
- #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
- 	struct syslog_data sdata = SYSLOG_DATA_INIT;
- #endif
-@@ -273,8 +278,10 @@ log_init(char *av0, LogLevel level, Sysl
- 		exit(1);
- 	}
- 
-	log_handler = NULL;
-	log_handler_ctx = NULL;
-+	if (reset_handler) {
-+		log_handler = NULL;
-+		log_handler_ctx = NULL;
-+	}
- 
- 	log_on_stderr = on_stderr;
- 	if (on_stderr)
-diff -up openssh-7.4p1/log.h.log-in-chroot openssh-7.4p1/log.h
--- openssh-7.4p1/log.h.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/log.h	2016-12-23 15:14:33.330168088 +0100
-@@ -49,6 +49,7 @@ typedef enum {
- typedef void (log_handler_fn)(LogLevel, const char *, void *);
- 
- void     log_init(char *, LogLevel, SyslogFacility, int);
-+void     log_init_handler(char *, LogLevel, SyslogFacility, int, int);
- LogLevel log_level_get(void);
- int      log_change_level(LogLevel);
- int      log_is_on_stderr(void);
-diff -up openssh-7.4p1/monitor.c.log-in-chroot openssh-7.4p1/monitor.c
--- openssh-7.4p1/monitor.c.log-in-chroot	2016-12-23 15:14:33.311168085 +0100
-+++ openssh-7.4p1/monitor.c	2016-12-23 15:16:42.154193100 +0100
-@@ -307,6 +307,8 @@ monitor_child_preauth(Authctxt *_authctx
- 		close(pmonitor->m_log_sendfd);
- 	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
- 
-+	pmonitor->m_state = "preauth";
-+
- 	authctxt = (Authctxt *)ssh->authctxt;
- 	memset(authctxt, 0, sizeof(*authctxt));
- 	ssh->authctxt = authctxt;
-@@ -405,6 +407,8 @@ monitor_child_postauth(struct monitor *p
- 	close(pmonitor->m_recvfd);
- 	pmonitor->m_recvfd = -1;
- 
-+	pmonitor->m_state = "postauth";
-+
- 	monitor_set_child_handler(pmonitor->m_pid);
- 	ssh_signal(SIGHUP, &monitor_child_handler);
- 	ssh_signal(SIGTERM, &monitor_child_handler);
-@@ -472,7 +476,7 @@ monitor_read_log(struct monitor *pmonito
- 	if (log_level_name(level) == NULL)
- 		fatal("%s: invalid log level %u (corrupted message?)",
- 		    __func__, level);
-	do_log2(level, "%s [preauth]", msg);
-+	do_log2(level, "%s [%s]", msg, pmonitor->m_state);
- 
- 	sshbuf_free(logmsg);
- 	free(msg);
-@@ -1719,13 +1723,28 @@ monitor_init(void)
- 	mon = xcalloc(1, sizeof(*mon));
- 	monitor_openfds(mon, 1);
- 
-+	mon->m_state = "";
-+
- 	return mon;
- }
- 
- void
-monitor_reinit(struct monitor *mon)
-+monitor_reinit(struct monitor *mon, const char *chroot_dir)
- {
-	monitor_openfds(mon, 0);
-+	struct stat dev_log_stat;
-+	char *dev_log_path;
-+	int do_logfds = 0;
-+
-+	if (chroot_dir != NULL) {
-+		xasprintf(&dev_log_path, "%s/dev/log", chroot_dir);
-+
-+		if (stat(dev_log_path, &dev_log_stat) != 0) {
-+			debug("%s: /dev/log doesn't exist in %s chroot - will try to log via monitor using [postauth] suffix", __func__, chroot_dir);
-+			do_logfds = 1;
-+		}
-+		free(dev_log_path);
-+	}
-+	monitor_openfds(mon, do_logfds);
- }
- 
- #ifdef GSSAPI
-diff -up openssh-7.4p1/monitor.h.log-in-chroot openssh-7.4p1/monitor.h
--- openssh-7.4p1/monitor.h.log-in-chroot	2016-12-23 15:14:33.330168088 +0100
-+++ openssh-7.4p1/monitor.h	2016-12-23 15:16:28.372190424 +0100
-@@ -83,10 +83,11 @@ struct monitor {
- 	int			 m_log_sendfd;
- 	struct kex		**m_pkex;
- 	pid_t			 m_pid;
-+	char		*m_state;
- };
- 
- struct monitor *monitor_init(void);
-void monitor_reinit(struct monitor *);
-+void monitor_reinit(struct monitor *, const char *);
- 
- struct Authctxt;
- void monitor_child_preauth(struct ssh *, struct monitor *);
-diff -up openssh-7.4p1/session.c.log-in-chroot openssh-7.4p1/session.c
--- openssh-7.4p1/session.c.log-in-chroot	2016-12-23 15:14:33.319168086 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 15:18:18.742211853 +0100
-@@ -160,6 +160,7 @@ login_cap_t *lc;
- 
- static int is_child = 0;
- static int in_chroot = 0;
-+static int have_dev_log = 1;
- 
- /* File containing userauth info, if ExposeAuthInfo set */
- static char *auth_info_file = NULL;
-@@ -619,6 +620,7 @@ do_exec(Session *s, const char *command)
- 	int ret;
- 	const char *forced = NULL, *tty = NULL;
- 	char session_type[1024];
-+	struct stat dev_log_stat;
- 
- 	if (options.adm_forced_command) {
- 		original_command = command;
-@@ -676,6 +678,10 @@ do_exec(Session *s, const char *command)
- 			tty += 5;
- 	}
- 
-+	if (lstat("/dev/log", &dev_log_stat) != 0) {
-+		have_dev_log = 0;
-+	}
-+
- 	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
- 	    session_type,
- 	    tty == NULL ? "" : " on ",
-@@ -1486,14 +1492,6 @@ child_close_fds(void)
- 
- 	/* Stop directing logs to a high-numbered fd before we close it */
- 	log_redirect_stderr_to(NULL);
-
-	/*
-	 * Close any extra open file descriptors so that we don't have them
-	 * hanging around in clients.  Note that we want to do this after
-	 * initgroups, because at least on Solaris 2.3 it leaves file
-	 * descriptors open.
-	 */
-	closefrom(STDERR_FILENO + 1);
- }
- 
- /*
-@@ -1629,8 +1627,6 @@ do_child(Session *s, const char *command
- 			exit(1);
- 	}
- 
-	closefrom(STDERR_FILENO + 1);
-
- 	do_rc_files(ssh, s, shell);
- 
- 	/* restore SIGPIPE for child */
-@@ -1653,9 +1649,17 @@ do_child(Session *s, const char *command
- 		argv[i] = NULL;
- 		optind = optreset = 1;
- 		__progname = argv[0];
-		exit(sftp_server_main(i, argv, s->pw));
-+		exit(sftp_server_main(i, argv, s->pw, have_dev_log));
- 	}
- 
-+	/*
-+	 * Close any extra open file descriptors so that we don't have them
-+	 * hanging around in clients.  Note that we want to do this after
-+	 * initgroups, because at least on Solaris 2.3 it leaves file
-+	 * descriptors open.
-+	 */
-+	closefrom(STDERR_FILENO + 1);
-+
- 	fflush(NULL);
- 
- 	/* Get the last component of the shell name. */
-diff -up openssh-7.4p1/sftp.h.log-in-chroot openssh-7.4p1/sftp.h
--- openssh-7.4p1/sftp.h.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/sftp.h	2016-12-23 15:14:33.331168088 +0100
-@@ -97,5 +97,5 @@
- 
- struct passwd;
- 
-int	sftp_server_main(int, char **, struct passwd *);
-+int	sftp_server_main(int, char **, struct passwd *, int);
- void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
-diff -up openssh-7.4p1/sftp-server.c.log-in-chroot openssh-7.4p1/sftp-server.c
--- openssh-7.4p1/sftp-server.c.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/sftp-server.c	2016-12-23 15:14:33.331168088 +0100
-@@ -1497,7 +1497,7 @@ sftp_server_usage(void)
- }
- 
- int
-sftp_server_main(int argc, char **argv, struct passwd *user_pw)
-+sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
- {
- 	fd_set *rset, *wset;
- 	int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;
-@@ -1511,7 +1511,7 @@ sftp_server_main(int argc, char **argv,
- 	extern char *__progname;
- 
- 	__progname = ssh_get_progname(argv[0]);
-	log_init(__progname, log_level, log_facility, log_stderr);
-+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
- 
- 	pw = pwcopy(user_pw);
- 
-@@ -1582,7 +1582,7 @@ sftp_server_main(int argc, char **argv,
- 		}
- 	}
- 
-	log_init(__progname, log_level, log_facility, log_stderr);
-+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
- 
- 	/*
- 	 * On platforms where we can, avoid making /proc/self/{mem,maps}
-diff -up openssh-7.4p1/sftp-server-main.c.log-in-chroot openssh-7.4p1/sftp-server-main.c
--- openssh-7.4p1/sftp-server-main.c.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/sftp-server-main.c	2016-12-23 15:14:33.331168088 +0100
-@@ -49,5 +49,5 @@ main(int argc, char **argv)
- 		return 1;
- 	}
- 
-	return (sftp_server_main(argc, argv, user_pw));
-+	return (sftp_server_main(argc, argv, user_pw, 0));
- }
-diff -up openssh-7.4p1/sshd.c.log-in-chroot openssh-7.4p1/sshd.c
--- openssh-7.4p1/sshd.c.log-in-chroot	2016-12-23 15:14:33.328168088 +0100
-+++ openssh-7.4p1/sshd.c	2016-12-23 15:14:33.332168088 +0100
-@@ -650,7 +650,7 @@ privsep_postauth(Authctxt *authctxt)
- 	}
- 
- 	/* New socket pair */
-	monitor_reinit(pmonitor);
-+	monitor_reinit(pmonitor, options.chroot_directory);
- 
- 	pmonitor->m_pid = fork();
- 	if (pmonitor->m_pid == -1)
-@@ -668,6 +668,11 @@ privsep_postauth(Authctxt *authctxt)
- 
- 	close(pmonitor->m_sendfd);
- 	pmonitor->m_sendfd = -1;
-+	close(pmonitor->m_log_recvfd);
-+	pmonitor->m_log_recvfd = -1;
-+
-+	if (pmonitor->m_log_sendfd != -1)
-+		set_log_handler(mm_log_handler, pmonitor);
- 
- 	/* Demote the private keys to public keys. */
- 	demote_sensitive_data();
--- a/openssh-6.6.1p1-selinux-contexts.patch
+++ b/openssh-6.6.1p1-selinux-contexts.patch
@ -1,132 +0,0 @@
-diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
-index 8f32464..18a2ca4 100644
--- a/openbsd-compat/port-linux-sshd.c
-+++ b/openbsd-compat/port-linux-sshd.c
-@@ -32,6 +32,7 @@
- #include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
- #include "servconf.h"
- #include "port-linux.h"
-+#include "misc.h"
- #include "sshkey.h"
- #include "hostfile.h"
- #include "auth.h"
-@@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
- void
- sshd_selinux_copy_context(void)
- {
-	security_context_t *ctx;
-+	char *ctx;
- 
- 	if (!sshd_selinux_enabled())
- 		return;
-@@ -461,6 +462,72 @@ sshd_selinux_copy_context(void)
- 	}
- }
- 
-+void
-+sshd_selinux_change_privsep_preauth_context(void)
-+{
-+	int len;
-+	char line[1024], *preauth_context = NULL, *cp, *arg;
-+	const char *contexts_path;
-+	FILE *contexts_file;
-+	struct stat sb;
-+
-+	contexts_path = selinux_openssh_contexts_path();
-+	if (contexts_path == NULL) {
-+		debug3("%s: Failed to get the path to SELinux context", __func__);
-+		return;
-+	}
-+
-+	if ((contexts_file = fopen(contexts_path, "r")) == NULL) {
-+		debug("%s: Failed to open SELinux context file", __func__);
-+		return;
-+	}
-+
-+	if (fstat(fileno(contexts_file), &sb) != 0 ||
-+	    sb.st_uid != 0 || (sb.st_mode & 022) != 0) {
-+		logit("%s: SELinux context file needs to be owned by root"
-+		    " and not writable by anyone else", __func__);
-+		fclose(contexts_file);
-+		return;
-+	}
-+
-+	while (fgets(line, sizeof(line), contexts_file)) {
-+		/* Strip trailing whitespace */
-+		for (len = strlen(line) - 1; len > 0; len--) {
-+			if (strchr(" \t\r\n", line[len]) == NULL)
-+				break;
-+			line[len] = '\0';
-+		}
-+
-+		if (line[0] == '\0')
-+			continue;
-+
-+		cp = line;
-+		arg = strdelim(&cp);
-+		if (arg && *arg == '\0')
-+			arg = strdelim(&cp);
-+
-+		if (arg && strcmp(arg, "privsep_preauth") == 0) {
-+			arg = strdelim(&cp);
-+			if (!arg || *arg == '\0') {
-+				debug("%s: privsep_preauth is empty", __func__);
-+				fclose(contexts_file);
-+				return;
-+			}
-+			preauth_context = xstrdup(arg);
-+		}
-+	}
-+	fclose(contexts_file);
-+
-+	if (preauth_context == NULL) {
-+		debug("%s: Unable to find 'privsep_preauth' option in"
-+		    " SELinux context file", __func__);
-+		return;
-+	}
-+
-+	ssh_selinux_change_context(preauth_context);
-+	free(preauth_context);
-+}
-+
- #endif
- #endif
- 
-diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index 22ea8ef..1fc963d 100644
--- a/openbsd-compat/port-linux.c
-+++ b/openbsd-compat/port-linux.c
-@@ -179,7 +179,7 @@ ssh_selinux_change_context(const char *newname)
- 	strlcpy(newctx + len, newname, newlen - len);
- 	if ((cx = index(cx + 1, ':')))
- 		strlcat(newctx, cx, newlen);
-	debug3("%s: setting context from '%s' to '%s'", __func__,
-+	debug("%s: setting context from '%s' to '%s'", __func__,
- 	    oldctx, newctx);
- 	if (setcon(newctx) < 0)
- 		switchlog("%s: setcon %s from %s failed with %s", __func__,
-diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index cb51f99..8b7cda2 100644
--- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -29,6 +29,7 @@ int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
- int sshd_selinux_setup_env_variables(void);
-+void sshd_selinux_change_privsep_preauth_context(void);
- #endif
- 
- #ifdef LINUX_OOM_ADJUST
-diff --git a/sshd.c b/sshd.c
-index 2871fe9..39b9c08 100644
--- a/sshd.c
-+++ b/sshd.c
-@@ -629,7 +629,7 @@ privsep_preauth_child(void)
- 	demote_sensitive_data();
- 
- #ifdef WITH_SELINUX
-	ssh_selinux_change_context("sshd_net_t");
-+	sshd_selinux_change_privsep_preauth_context();
- #endif
- 
- 	/* Demote the child */
--- a/openssh-6.6p1-GSSAPIEnablek5users.patch
+++ b/openssh-6.6p1-GSSAPIEnablek5users.patch
@ -1,131 +0,0 @@
-diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-serv-krb5.c
--- openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
-+++ openssh-7.4p1/gss-serv-krb5.c	2016-12-23 15:18:40.628216102 +0100
-@@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
- 	FILE *fp;
- 	char file[MAXPATHLEN];
- 	char *line = NULL;
-	char kuser[65]; /* match krb5_kuserok() */
- 	struct stat st;
- 	struct passwd *pw = the_authctxt->pw;
- 	int found_principal = 0;
-@@ -288,7 +287,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
- 
- 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
- 	/* If both .k5login and .k5users DNE, self-login is ok. */
-	if (!k5login_exists && (access(file, F_OK) == -1)) {
-+	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
-                 return ssh_krb5_kuserok(krb_context, principal, luser,
-                                         k5login_exists);
- 	}
-diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
--- openssh-7.4p1/servconf.c.GSSAPIEnablek5users	2016-12-23 15:18:40.615216100 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:35:36.354401156 +0100
-@@ -168,6 +168,7 @@ initialize_server_options(ServerOptions
- 	options->gss_store_rekey = -1;
- 	options->gss_kex_algorithms = NULL;
- 	options->use_kuserok = -1;
-+	options->enable_k5users = -1;
- 	options->password_authentication = -1;
- 	options->kbd_interactive_authentication = -1;
- 	options->challenge_response_authentication = -1;
-@@ -345,6 +346,8 @@ fill_default_server_options(ServerOption
- #endif
- 	if (options->use_kuserok == -1)
- 		options->use_kuserok = 1;
-+	if (options->enable_k5users == -1)
-+		options->enable_k5users = 0;
- 	if (options->password_authentication == -1)
- 		options->password_authentication = 1;
- 	if (options->kbd_interactive_authentication == -1)
-@@ -418,7 +421,7 @@ typedef enum {
- 	sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
- 	sHostKeyAlgorithms,
- 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
-+	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
- 	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
- 	sAcceptEnv, sSetEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
-@@ -497,14 +500,16 @@ static struct {
- 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
- 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
- 	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
-+	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
- #else
- 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
- 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapicleanupcreds", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
-+	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
- #endif
- 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
- 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
-@@ -1653,6 +1658,10 @@ process_server_config_line(ServerOptions
- 		intptr = &options->use_kuserok;
- 		goto parse_flag;
- 
-+	case sGssEnablek5users:
-+		intptr = &options->enable_k5users;
-+		goto parse_flag;
-+
- 	case sPermitListen:
- 	case sPermitOpen:
- 		if (opcode == sPermitListen) {
-@@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d
- 	M_CP_INTOPT(ip_qos_interactive);
- 	M_CP_INTOPT(ip_qos_bulk);
- 	M_CP_INTOPT(use_kuserok);
-+	M_CP_INTOPT(enable_k5users);
- 	M_CP_INTOPT(rekey_limit);
- 	M_CP_INTOPT(rekey_interval);
- 	M_CP_INTOPT(log_level);
-@@ -2320,6 +2330,7 @@ dump_config(ServerOptions *o)
- # endif
- 	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
- 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
-+	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
- #endif
- #ifdef GSSAPI
- 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff -up openssh-7.4p1/servconf.h.GSSAPIEnablek5users openssh-7.4p1/servconf.h
--- openssh-7.4p1/servconf.h.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 15:18:40.629216102 +0100
-@@ -174,6 +174,7 @@ typedef struct {
-	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
-						 * be stored in per-session ccache */
- 	int	use_kuserok;
-+	int		enable_k5users;
- 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
- 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
- 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff -up openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users openssh-7.4p1/sshd_config.5
--- openssh-7.4p1/sshd_config.5.GSSAPIEnablek5users	2016-12-23 15:18:40.630216103 +0100
-+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:36:21.607408435 +0100
-@@ -628,6 +628,12 @@ Specifies whether to automatically destr
- on logout.
- The default is
- .Cm yes .
-+.It Cm GSSAPIEnablek5users
-+Specifies whether to look at .k5users file for GSSAPI authentication
-+access control. Further details are described in
-+.Xr ksu 1 .
-+The default is
-+.Cm no .
- .It Cm GSSAPIKeyExchange
- Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
- doesn't rely on ssh keys to verify host identity.
-diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
--- openssh-7.4p1/sshd_config.GSSAPIEnablek5users	2016-12-23 15:18:40.616216100 +0100
-+++ openssh-7.4p1/sshd_config	2016-12-23 15:18:40.631216103 +0100
-@@ -80,6 +80,7 @@ GSSAPIAuthentication yes
- #GSSAPICleanupCredentials yes
- #GSSAPIStrictAcceptorCheck yes
- #GSSAPIKeyExchange no
-+#GSSAPIEnablek5users no
- 
- # Set this to 'yes' to enable PAM authentication, account processing,
- # and session processing. If this is enabled, PAM authentication will
--- a/openssh-6.6p1-allow-ip-opts.patch
+++ b/openssh-6.6p1-allow-ip-opts.patch
@ -1,39 +0,0 @@
-diff -up openssh/sshd.c.ip-opts openssh/sshd.c
--- openssh/sshd.c.ip-opts	2016-07-25 13:58:48.998507834 +0200
-+++ openssh/sshd.c	2016-07-25 14:01:28.346469878 +0200
-@@ -1507,12 +1507,29 @@ check_ip_options(struct ssh *ssh)
- 
- 	if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts,
- 	    &option_size) >= 0 && option_size != 0) {
-		text[0] = '\0';
-		for (i = 0; i < option_size; i++)
-			snprintf(text + i*3, sizeof(text) - i*3,
-			    " %2.2x", opts[i]);
-		fatal("Connection from %.100s port %d with IP opts: %.800s",
-		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text);
-+		i = 0;
-+		do {
-+			switch (opts[i]) {
-+				case 0:
-+				case 1:
-+					++i;
-+					break;
-+				case 130:
-+				case 133:
-+				case 134:
-+					i += opts[i + 1];
-+					break;
-+				default:
-+				/* Fail, fatally, if we detect either loose or strict
-+			 	 * source routing options. */
-+					text[0] = '\0';
-+					for (i = 0; i < option_size; i++)
-+						snprintf(text + i*3, sizeof(text) - i*3,
-+							" %2.2x", opts[i]);
-+					fatal("Connection from %.100s port %d with IP options:%.800s",
-+						ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text);
-+			}
-+		} while (i < option_size);
- 	}
- 	return;
- #endif /* IP_OPTIONS */
--- a/openssh-6.6p1-keyperm.patch
+++ b/openssh-6.6p1-keyperm.patch
@ -1,31 +0,0 @@
-diff -up openssh-8.2p1/authfile.c.keyperm openssh-8.2p1/authfile.c
--- openssh-8.2p1/authfile.c.keyperm	2020-02-14 01:40:54.000000000 +0100
-+++ openssh-8.2p1/authfile.c	2020-02-17 11:55:12.841729758 +0100
-@@ -31,6 +31,7 @@
- 
- #include <errno.h>
- #include <fcntl.h>
-+#include <grp.h>
- #include <stdio.h>
- #include <stdarg.h>
- #include <stdlib.h>
-@@ -101,7 +102,19 @@ sshkey_perm_ok(int fd, const char *filen
- #ifdef HAVE_CYGWIN
- 	if (check_ntsec(filename))
- #endif
-+
- 	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
-+		if (st.st_mode & 040) {
-+			struct group *gr;
-+
-+			if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid)) {
-+				/* The only additional bit is read
-+				 * for ssh_keys group, which is fine */
-+				if ((st.st_mode & 077) == 040 ) {
-+					return 0;
-+				}
-+			}
-+		}
- 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
- 		error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");
- 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
--- a/openssh-6.6p1-privsep-selinux.patch
+++ b/openssh-6.6p1-privsep-selinux.patch
@ -1,121 +0,0 @@
-diff -up openssh-7.4p1/openbsd-compat/port-linux.h.privsep-selinux openssh-7.4p1/openbsd-compat/port-linux.h
--- openssh-7.4p1/openbsd-compat/port-linux.h.privsep-selinux	2016-12-23 18:58:52.972122201 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux.h	2016-12-23 18:58:52.974122201 +0100
-@@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const
- void ssh_selinux_change_context(const char *);
- void ssh_selinux_setfscreatecon(const char *);
- 
-+void sshd_selinux_copy_context(void);
- void sshd_selinux_setup_exec_context(char *);
- #endif
- 
-diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux openssh-7.4p1/openbsd-compat/port-linux-sshd.c
--- openssh-7.4p1/openbsd-compat/port-linux-sshd.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux-sshd.c	2016-12-23 18:58:52.974122201 +0100
-@@ -419,6 +419,28 @@ sshd_selinux_setup_exec_context(char *pw
- 	debug3("%s: done", __func__);
- }
- 
-+void
-+sshd_selinux_copy_context(void)
-+{
-+	security_context_t *ctx;
-+
-+	if (!ssh_selinux_enabled())
-+		return;
-+
-+	if (getexeccon((security_context_t *)&ctx) != 0) {
-+		logit("%s: getexeccon failed with %s", __func__, strerror(errno));
-+		return;
-+	}
-+	if (ctx != NULL) {
-+		/* unset exec context before we will lose this capabililty */
-+		if (setexeccon(NULL) != 0)
-+			fatal("%s: setexeccon failed with %s", __func__, strerror(errno));
-+		if (setcon(ctx) != 0)
-+			fatal("%s: setcon failed with %s", __func__, strerror(errno));
-+		freecon(ctx);
-+	}
-+}
-+
- #endif
- #endif
- 
-diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
--- openssh-7.4p1/session.c.privsep-selinux	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 18:58:52.974122201 +0100
-@@ -1331,7 +1331,7 @@ do_setusercontext(struct passwd *pw)
- 
- 	platform_setusercontext(pw);
- 
-	if (platform_privileged_uidswap()) {
-+	if (platform_privileged_uidswap() && (!is_child || !use_privsep)) {
- #ifdef HAVE_LOGIN_CAP
- 		if (setusercontext(lc, pw, pw->pw_uid,
- 		    (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
-@@ -1361,6 +1361,9 @@ do_setusercontext(struct passwd *pw)
-			    (unsigned long long)pw->pw_uid);
-			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
-			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
-+#ifdef WITH_SELINUX
-+			sshd_selinux_copy_context();
-+#endif
- 			safely_chroot(chroot_path, pw->pw_uid);
- 			free(tmp);
- 			free(chroot_path);
-@@ -1396,6 +1399,11 @@ do_setusercontext(struct passwd *pw)
- 		/* Permanently switch to the desired uid. */
- 		permanently_set_uid(pw);
- #endif
-+
-+#ifdef WITH_SELINUX
-+		if (in_chroot == 0)
-+			sshd_selinux_copy_context();
-+#endif
- 	} else if (options.chroot_directory != NULL &&
- 	    strcasecmp(options.chroot_directory, "none") != 0) {
- 		fatal("server lacks privileges to chroot to ChrootDirectory");
-@@ -1413,9 +1421,6 @@ do_pwchange(Session *s)
- 	if (s->ttyfd != -1) {
- 		fprintf(stderr,
- 		    "You must change your password now and login again!\n");
-#ifdef WITH_SELINUX
-		setexeccon(NULL);
-#endif
- #ifdef PASSWD_NEEDS_USERNAME
- 		execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
- 		    (char *)NULL);
-@@ -1625,9 +1630,6 @@ do_child(Session *s, const char *command
- 		argv[i] = NULL;
- 		optind = optreset = 1;
- 		__progname = argv[0];
-#ifdef WITH_SELINUX
-		ssh_selinux_change_context("sftpd_t");
-#endif
- 		exit(sftp_server_main(i, argv, s->pw));
- 	}
- 
-diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
--- openssh-7.4p1/sshd.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
-+++ openssh-7.4p1/sshd.c	2016-12-23 18:59:13.808124269 +0100
-@@ -540,6 +540,10 @@ privsep_preauth_child(void)
- 	/* Demote the private keys to public keys. */
- 	demote_sensitive_data();
- 
-+#ifdef WITH_SELINUX
-+	ssh_selinux_change_context("sshd_net_t");
-+#endif
-+
- 	/* Demote the child */
- 	if (privsep_chroot) {
- 		/* Change our root directory */
-@@ -633,6 +637,9 @@ privsep_postauth(Authctxt *authctxt)
- {
- #ifdef DISABLE_FD_PASSING
- 	if (1) {
-+#elif defined(WITH_SELINUX)
-+	if (0) {
-+		/* even root user can be confined by SELinux */
- #else
- 	if (authctxt->pw->pw_uid == 0) {
- #endif
--- a/openssh-6.7p1-coverity.patch
+++ b/openssh-6.7p1-coverity.patch
@ -1,185 +0,0 @@
-diff -up openssh-7.4p1/channels.c.coverity openssh-7.4p1/channels.c
--- openssh-7.4p1/channels.c.coverity	2016-12-23 16:40:26.881788686 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 16:42:36.244818763 +0100
-@@ -288,11 +288,11 @@ channel_register_fds(Channel *c, int rfd
- 
- 	/* enable nonblocking mode */
- 	if (nonblock) {
-		if (rfd != -1)
-+		if (rfd >= 0)
- 			set_nonblock(rfd);
-		if (wfd != -1)
-+		if (wfd >= 0)
- 			set_nonblock(wfd);
-		if (efd != -1)
-+		if (efd >= 0)
- 			set_nonblock(efd);
- 	}
- }
-diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
--- openssh-7.4p1/monitor.c.coverity	2016-12-23 16:40:26.888788688 +0100
-+++ openssh-7.4p1/monitor.c	2016-12-23 16:40:26.900788691 +0100
-@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx
- 	mm_get_keystate(ssh, pmonitor);
- 
- 	/* Drain any buffered messages from the child */
-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
- 		;
- 
- 	if (pmonitor->m_recvfd >= 0)
-diff -up openssh-7.4p1/monitor_wrap.c.coverity openssh-7.4p1/monitor_wrap.c
--- openssh-7.4p1/monitor_wrap.c.coverity	2016-12-23 16:40:26.892788689 +0100
-+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:40:26.900788691 +0100
-@@ -525,10 +525,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
- 	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
- 	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
- 		error("%s: cannot allocate fds for pty", __func__);
-		if (tmp1 > 0)
-+		if (tmp1 >= 0)
- 			close(tmp1);
-		if (tmp2 > 0)
-			close(tmp2);
-+		/*DEAD CODE if (tmp2 >= 0)
-+			close(tmp2);*/
- 		return 0;
- 	}
- 	close(tmp1);
-diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
--- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/openbsd-compat/bindresvport.c	2016-12-23 16:40:26.901788691 +0100
-@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
- 	struct sockaddr_in6 *in6;
- 	u_int16_t *portp;
- 	u_int16_t port;
-	socklen_t salen;
-+	socklen_t salen = sizeof(struct sockaddr_storage);
- 	int i;
- 
- 	if (sa == NULL) {
-diff -up openssh-7.4p1/scp.c.coverity openssh-7.4p1/scp.c
--- openssh-7.4p1/scp.c.coverity	2016-12-23 16:40:26.856788681 +0100
-+++ openssh-7.4p1/scp.c	2016-12-23 16:40:26.901788691 +0100
-@@ -157,7 +157,7 @@ killchild(int signo)
- {
- 	if (do_cmd_pid > 1) {
- 		kill(do_cmd_pid, signo ? signo : SIGTERM);
-		waitpid(do_cmd_pid, NULL, 0);
-+		(void) waitpid(do_cmd_pid, NULL, 0);
- 	}
- 
- 	if (signo)
-diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
--- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
-@@ -1547,7 +1547,7 @@ process_server_config_line(ServerOptions
- 			fatal("%s line %d: Missing subsystem name.",
- 			    filename, linenum);
- 		if (!*activep) {
-			arg = strdelim(&cp);
-+			/*arg =*/ (void) strdelim(&cp);
- 			break;
- 		}
- 		for (i = 0; i < options->num_subsystems; i++)
-@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
- 		if (*activep && *charptr == NULL) {
- 			*charptr = tilde_expand_filename(arg, getuid());
- 			/* increase optional counter */
-			if (intptr != NULL)
-				*intptr = *intptr + 1;
-+			/* DEAD CODE intptr is still NULL ;)
-+  			 if (intptr != NULL)
-+				*intptr = *intptr + 1; */
- 		}
- 		break;
- 
-diff -up openssh-7.4p1/serverloop.c.coverity openssh-7.4p1/serverloop.c
--- openssh-7.4p1/serverloop.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/serverloop.c	2016-12-23 16:40:26.902788691 +0100
-@@ -125,13 +125,13 @@ notify_setup(void)
- static void
- notify_parent(void)
- {
-	if (notify_pipe[1] != -1)
-+	if (notify_pipe[1] >= 0)
- 		(void)write(notify_pipe[1], "", 1);
- }
- static void
- notify_prepare(fd_set *readset)
- {
-	if (notify_pipe[0] != -1)
-+	if (notify_pipe[0] >= 0)
- 		FD_SET(notify_pipe[0], readset);
- }
- static void
-@@ -139,8 +139,8 @@ notify_done(fd_set *readset)
- {
- 	char c;
- 
-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset))
-		while (read(notify_pipe[0], &c, 1) != -1)
-+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset))
-+		while (read(notify_pipe[0], &c, 1) >= 0)
- 			debug2("%s: reading", __func__);
- }
- 
-@@ -518,7 +518,7 @@ server_request_tun(void)
- 		debug("%s: invalid tun", __func__);
- 		goto done;
- 	}
-	if (auth_opts->force_tun_device != -1) {
-+	if (auth_opts->force_tun_device >= 0) {
- 		if (tun != SSH_TUNID_ANY &&
- 		    auth_opts->force_tun_device != (int)tun)
- 			goto done;
-diff -up openssh-7.4p1/sftp.c.coverity openssh-7.4p1/sftp.c
--- openssh-7.4p1/sftp.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/sftp.c	2016-12-23 16:40:26.903788691 +0100
-@@ -224,7 +224,7 @@ killchild(int signo)
- 	pid = sshpid;
- 	if (pid > 1) {
- 		kill(pid, SIGTERM);
-		waitpid(pid, NULL, 0);
-+		(void) waitpid(pid, NULL, 0);
- 	}
- 
- 	_exit(1);
-diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
--- openssh-7.4p1/ssh-agent.c.coverity	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/ssh-agent.c	2016-12-23 16:40:26.903788691 +0100
-@@ -1220,8 +1220,8 @@ main(int ac, char **av)
- 	sanitise_stdfd();
- 
- 	/* drop */
-	setegid(getgid());
-	setgid(getgid());
-+	(void) setegid(getgid());
-+	(void) setgid(getgid());
- 
- 	platform_disable_tracing(0);	/* strict=no */
- 
-diff -up openssh-7.4p1/sshd.c.coverity openssh-7.4p1/sshd.c
--- openssh-7.4p1/sshd.c.coverity	2016-12-23 16:40:26.897788690 +0100
-+++ openssh-7.4p1/sshd.c	2016-12-23 16:40:26.904788692 +0100
-@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
- 
- 		privsep_preauth_child(ssh);
- 		setproctitle("%s", "[net]");
-		if (box != NULL)
-+		if (box != NULL) {
- 			ssh_sandbox_child(box);
-+			free(box);
-+		}
- 
- 		return 0;
- 	}
-@@ -1386,6 +1388,9 @@ server_accept_loop(int *sock_in, int *so
- 			explicit_bzero(rnd, sizeof(rnd));
- 		}
- 	}
-+
-+	if (fdset != NULL)
-+		free(fdset);
- }
- 
- /*
--- a/openssh-6.7p1-kdf-cavs.patch
+++ b/openssh-6.7p1-kdf-cavs.patch
@ -1,618 +0,0 @@
-diff -up openssh-6.8p1/Makefile.in.kdf-cavs openssh-6.8p1/Makefile.in
--- openssh-6.8p1/Makefile.in.kdf-cavs	2015-03-18 11:23:46.346049359 +0100
-+++ openssh-6.8p1/Makefile.in	2015-03-18 11:24:20.395968445 +0100
-@@ -29,6 +29,7 @@ SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-h
- SSH_KEYSIGN=$(libexecdir)/ssh-keysign
- SSH_KEYCAT=$(libexecdir)/ssh-keycat
- CTR_CAVSTEST=$(libexecdir)/ctr-cavstest
-+SSH_CAVS=$(libexecdir)/ssh-cavs
- SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
- SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
- PRIVSEP_PATH=@PRIVSEP_PATH@
-@@ -67,7 +68,7 @@ EXEEXT=@EXEEXT@
- 
- .SUFFIXES: .lo
- 
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT) ssh-cavs$(EXEEXT)
- 
- XMSS_OBJS=\
- 	ssh-xmss.o \
-@@ -198,6 +199,9 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHD
- ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
- 	$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
- 
-+ssh-cavs$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-cavs.o $(SKOBJS)
-+	$(LD) -o $@ ssh-cavs.o $(SKOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+
- ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
- 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
- 
-@@ -331,6 +335,8 @@ install-files:
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) ctr-cavstest$(EXEEXT) $(DESTDIR)$(libexecdir)/ctr-cavstest$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-cavs$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-cavs$(EXEEXT)
-+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-cavs_driver.pl $(DESTDIR)$(libexecdir)/ssh-cavs_driver.pl
- 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
- 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
- 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh-6.8p1/ssh-cavs.c.kdf-cavs openssh-6.8p1/ssh-cavs.c
--- openssh-6.8p1/ssh-cavs.c.kdf-cavs	2015-03-18 11:23:46.348049354 +0100
-+++ openssh-6.8p1/ssh-cavs.c	2015-03-18 11:23:46.348049354 +0100
-@@ -0,0 +1,387 @@
-+/*
-+ * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, and the entire permission notice in its entirety,
-+ *    including the disclaimer of warranties.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote
-+ *    products derived from this software without specific prior
-+ *    written permission.
-+ *
-+ * ALTERNATIVELY, this product may be distributed under the terms of
-+ * the GNU General Public License, in which case the provisions of the GPL2
-+ * are required INSTEAD OF the above restrictions.  (This clause is
-+ * necessary due to a potential bad interaction between the GPL and
-+ * the restrictions contained in a BSD-style copyright.)
-+ *
-+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
-+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
-+ * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
-+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
-+ * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
-+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
-+ * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
-+ * DAMAGE.
-+ */
-+
-+#include "includes.h"
-+
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <errno.h>
-+#include <sys/types.h>
-+#include <string.h>
-+
-+#include <openssl/bn.h>
-+
-+#include "xmalloc.h"
-+#include "sshbuf.h"
-+#include "sshkey.h"
-+#include "cipher.h"
-+#include "kex.h"
-+#include "packet.h"
-+#include "digest.h"
-+
-+static int bin_char(unsigned char hex)
-+{
-+	if (48 <= hex && 57 >= hex)
-+		return (hex - 48);
-+	if (65 <= hex && 70 >= hex)
-+		return (hex - 55);
-+	if (97 <= hex && 102 >= hex)
-+		return (hex - 87);
-+	return 0;
-+}
-+
-+/*
-+ * Convert hex representation into binary string
-+ * @hex input buffer with hex representation
-+ * @hexlen length of hex
-+ * @bin output buffer with binary data
-+ * @binlen length of already allocated bin buffer (should be at least
-+ *	   half of hexlen -- if not, only a fraction of hexlen is converted)
-+ */
-+static void hex2bin(const char *hex, size_t hexlen,
-+		    unsigned char *bin, size_t binlen)
-+{
-+	size_t i = 0;
-+	size_t chars = (binlen > (hexlen / 2)) ? (hexlen / 2) : binlen;
-+
-+	for (i = 0; i < chars; i++) {
-+		bin[i] = bin_char(hex[(i*2)]) << 4;
-+		bin[i] |= bin_char(hex[((i*2)+1)]);
-+	}
-+}
-+
-+/*
-+ * Allocate sufficient space for binary representation of hex
-+ * and convert hex into bin
-+ *
-+ * Caller must free bin
-+ * @hex input buffer with hex representation
-+ * @hexlen length of hex
-+ * @bin return value holding the pointer to the newly allocated buffer
-+ * @binlen return value holding the allocated size of bin
-+ *
-+ * return: 0 on success, !0 otherwise
-+ */
-+static int hex2bin_alloc(const char *hex, size_t hexlen,
-+			 unsigned char **bin, size_t *binlen)
-+{
-+	unsigned char *out = NULL;
-+	size_t outlen = 0;
-+
-+	if (!hexlen)
-+		return -EINVAL;
-+
-+	outlen = (hexlen + 1) / 2;
-+
-+	out = calloc(1, outlen);
-+	if (!out)
-+		return -errno;
-+
-+	hex2bin(hex, hexlen, out, outlen);
-+	*bin = out;
-+	*binlen = outlen;
-+	return 0;
-+}
-+
-+static char hex_char_map_l[] = { '0', '1', '2', '3', '4', '5', '6', '7',
-+				 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
-+static char hex_char_map_u[] = { '0', '1', '2', '3', '4', '5', '6', '7',
-+				 '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
-+static char hex_char(unsigned int bin, int u)
-+{
-+	if (bin < sizeof(hex_char_map_l))
-+		return (u) ? hex_char_map_u[bin] : hex_char_map_l[bin];
-+	return 'X';
-+}
-+
-+/*
-+ * Convert binary string into hex representation
-+ * @bin input buffer with binary data
-+ * @binlen length of bin
-+ * @hex output buffer to store hex data
-+ * @hexlen length of already allocated hex buffer (should be at least
-+ *	   twice binlen -- if not, only a fraction of binlen is converted)
-+ * @u case of hex characters (0=>lower case, 1=>upper case)
-+ */
-+static void bin2hex(const unsigned char *bin, size_t binlen,
-+		    char *hex, size_t hexlen, int u)
-+{
-+	size_t i = 0;
-+	size_t chars = (binlen > (hexlen / 2)) ? (hexlen / 2) : binlen;
-+
-+	for (i = 0; i < chars; i++) {
-+		hex[(i*2)] = hex_char((bin[i] >> 4), u);
-+		hex[((i*2)+1)] = hex_char((bin[i] & 0x0f), u);
-+	}
-+}
-+
-+struct kdf_cavs {
-+	unsigned char *K;
-+	size_t Klen;
-+	unsigned char *H;
-+	size_t Hlen;
-+	unsigned char *session_id;
-+	size_t session_id_len;
-+
-+	unsigned int iv_len;
-+	unsigned int ek_len;
-+	unsigned int ik_len;
-+};
-+
-+static int sshkdf_cavs(struct kdf_cavs *test)
-+{
-+	int ret = 0;
-+	struct kex kex;
-+	struct sshbuf *Kb = NULL;
-+	BIGNUM *Kbn = NULL;
-+	int mode = 0;
-+	struct newkeys *ctoskeys;
-+	struct newkeys *stockeys;
-+	struct ssh *ssh = NULL;
-+
-+#define HEXOUTLEN 500
-+	char hex[HEXOUTLEN];
-+
-+	memset(&kex, 0, sizeof(struct kex));
-+
-+	Kbn = BN_new();
-+	BN_bin2bn(test->K, test->Klen, Kbn);
-+	if (!Kbn) {
-+		printf("cannot convert K into bignum\n");
-+		ret = 1;
-+		goto out;
-+	}
-+	Kb = sshbuf_new();
-+	if (!Kb) {
-+		printf("cannot convert K into sshbuf\n");
-+		ret = 1;
-+		goto out;
-+	}
-+	sshbuf_put_bignum2(Kb, Kbn);
-+
-+	kex.session_id = test->session_id;
-+	kex.session_id_len = test->session_id_len;
-+
-+	/* setup kex */
-+
-+	/* select the right hash based on struct ssh_digest digests */
-+	switch (test->ik_len) {
-+		case 20:
-+			kex.hash_alg = SSH_DIGEST_SHA1;
-+			break;
-+		case 32:
-+			kex.hash_alg = SSH_DIGEST_SHA256;
-+			break;
-+		case 48:
-+			kex.hash_alg = SSH_DIGEST_SHA384;
-+			break;
-+		case 64:
-+			kex.hash_alg = SSH_DIGEST_SHA512;
-+			break;
-+		default:
-+			printf("Wrong hash type %u\n", test->ik_len);
-+			ret = 1;
-+			goto out;
-+	}
-+
-+	/* implement choose_enc */
-+	for (mode = 0; mode < 2; mode++) {
-+		kex.newkeys[mode] = calloc(1, sizeof(struct newkeys));
-+		if (!kex.newkeys[mode]) {
-+			printf("allocation of newkeys failed\n");
-+			ret = 1;
-+			goto out;
-+		}
-+		kex.newkeys[mode]->enc.iv_len = test->iv_len;
-+		kex.newkeys[mode]->enc.key_len = test->ek_len;
-+		kex.newkeys[mode]->enc.block_size = (test->iv_len == 64) ? 8 : 16;
-+		kex.newkeys[mode]->mac.key_len = test->ik_len;
-+	}
-+
-+	/* implement kex_choose_conf */
-+	kex.we_need = kex.newkeys[0]->enc.key_len;
-+	if (kex.we_need < kex.newkeys[0]->enc.block_size)
-+		kex.we_need = kex.newkeys[0]->enc.block_size;
-+	if (kex.we_need < kex.newkeys[0]->enc.iv_len)
-+		kex.we_need = kex.newkeys[0]->enc.iv_len;
-+	if (kex.we_need < kex.newkeys[0]->mac.key_len)
-+		kex.we_need = kex.newkeys[0]->mac.key_len;
-+
-+	/* MODE_OUT (1) -> server to client
-+	 * MODE_IN (0) -> client to server */
-+	kex.server = 1;
-+
-+	/* do it */
-+	if ((ssh = ssh_packet_set_connection(NULL, -1, -1)) == NULL){
-+		printf("Allocation error\n");
-+		goto out;
-+	}
-+	ssh->kex = &kex;
-+	kex_derive_keys(ssh, test->H, test->Hlen, Kb);
-+
-+	ctoskeys = kex.newkeys[0];
-+	stockeys = kex.newkeys[1];
-+
-+	/* get data */
-+	memset(hex, 0, HEXOUTLEN);
-+	bin2hex(ctoskeys->enc.iv, (size_t)ctoskeys->enc.iv_len,
-+		hex, HEXOUTLEN, 0);
-+	printf("Initial IV (client to server) = %s\n", hex);
-+	memset(hex, 0, HEXOUTLEN);
-+	bin2hex(stockeys->enc.iv, (size_t)stockeys->enc.iv_len,
-+		hex, HEXOUTLEN, 0);
-+	printf("Initial IV (server to client) = %s\n", hex);
-+
-+	memset(hex, 0, HEXOUTLEN);
-+	bin2hex(ctoskeys->enc.key, (size_t)ctoskeys->enc.key_len,
-+		hex, HEXOUTLEN, 0);
-+	printf("Encryption key (client to server) = %s\n", hex);
-+	memset(hex, 0, HEXOUTLEN);
-+	bin2hex(stockeys->enc.key, (size_t)stockeys->enc.key_len,
-+		hex, HEXOUTLEN, 0);
-+	printf("Encryption key (server to client) = %s\n", hex);
-+
-+	memset(hex, 0, HEXOUTLEN);
-+	bin2hex(ctoskeys->mac.key, (size_t)ctoskeys->mac.key_len,
-+		hex, HEXOUTLEN, 0);
-+	printf("Integrity key (client to server) = %s\n", hex);
-+	memset(hex, 0, HEXOUTLEN);
-+	bin2hex(stockeys->mac.key, (size_t)stockeys->mac.key_len,
-+		hex, HEXOUTLEN, 0);
-+	printf("Integrity key (server to client) = %s\n", hex);
-+
-+out:
-+	if (Kbn)
-+		BN_free(Kbn);
-+	if (Kb)
-+		sshbuf_free(Kb);
-+	if (ssh)
-+		ssh_packet_close(ssh);
-+	return ret;
-+}
-+
-+static void usage(void)
-+{
-+	fprintf(stderr, "\nOpenSSH KDF CAVS Test\n\n");
-+	fprintf(stderr, "Usage:\n");
-+	fprintf(stderr, "\t-K\tShared secret string\n");
-+	fprintf(stderr, "\t-H\tHash string\n");
-+	fprintf(stderr, "\t-s\tSession ID string\n");
-+	fprintf(stderr, "\t-i\tIV length to be generated\n");
-+	fprintf(stderr, "\t-e\tEncryption key length to be generated\n");
-+	fprintf(stderr, "\t-m\tMAC key length to be generated\n");
-+}
-+
-+/*
-+ * Test command example:
-+ * ./ssh-cavs -K 0055d50f2d163cc07cd8a93cc7c3430c30ce786b572c01ad29fec7597000cf8618d664e2ec3dcbc8bb7a1a7eb7ef67f61cdaf291625da879186ac0a5cb27af571b59612d6a6e0627344d846271959fda61c78354aa498773d59762f8ca2d0215ec590d8633de921f920d41e47b3de6ab9a3d0869e1c826d0e4adebf8e3fb646a15dea20a410b44e969f4b791ed6a67f13f1b74234004d5fa5e87eff7abc32d49bbdf44d7b0107e8f10609233b7e2b7eff74a4daf25641de7553975dac6ac1e5117df6f6dbaa1c263d23a6c3e5a3d7d49ae8a828c1e333ac3f85fbbf57b5c1a45be45e43a7be1a4707eac779b8285522d1f531fe23f890fd38a004339932b93eda4 -H d3ab91a850febb417a25d892ec48ed5952c7a5de -s d3ab91a850febb417a25d892ec48ed5952c7a5de -i 8 -e 24 -m 20
-+ *
-+ * Initial IV (client to server) = 4bb320d1679dfd3a
-+ * Initial IV (server to client) = 43dea6fdf263a308
-+ * Encryption key (client to server) = 13048cc600b9d3cf9095aa6cf8e2ff9cf1c54ca0520c89ed
-+ * Encryption key (server to client) = 1e483c5134e901aa11fc4e0a524e7ec7b75556148a222bb0
-+ * Integrity key (client to server) = ecef63a092b0dcc585bdc757e01b2740af57d640
-+ * Integrity key (server to client) = 7424b05f3c44a72b4ebd281fb71f9cbe7b64d479
-+ */
-+int main(int argc, char *argv[])
-+{
-+	struct kdf_cavs test;
-+	int ret = 1;
-+	int opt = 0;
-+
-+	memset(&test, 0, sizeof(struct kdf_cavs));
-+	while((opt = getopt(argc, argv, "K:H:s:i:e:m:")) != -1)
-+	{
-+		size_t len = 0;
-+		switch(opt)
-+		{
-+			/*
-+			 * CAVS K is MPINT
-+			 * we want a hex (i.e. the caller must ensure the
-+			 * following transformations already happened):
-+			 * 	1. cut off first four bytes
-+			 * 	2. if most significant bit of value is
-+			 *	   1, prepend 0 byte
-+			 */
-+			case 'K':
-+				len = strlen(optarg);
-+				ret = hex2bin_alloc(optarg, len,
-+						    &test.K, &test.Klen);
-+				if (ret)
-+					goto out;
-+				break;
-+			case 'H':
-+				len = strlen(optarg);
-+				ret = hex2bin_alloc(optarg, len,
-+						    &test.H, &test.Hlen);
-+				if (ret)
-+					goto out;
-+				break;
-+			case 's':
-+				len = strlen(optarg);
-+				ret = hex2bin_alloc(optarg, len,
-+						    &test.session_id,
-+						    &test.session_id_len);
-+				if (ret)
-+					goto out;
-+				break;
-+			case 'i':
-+				test.iv_len = strtoul(optarg, NULL, 10);
-+				break;
-+			case 'e':
-+				test.ek_len = strtoul(optarg, NULL, 10);
-+				break;
-+			case 'm':
-+				test.ik_len = strtoul(optarg, NULL, 10);
-+				break;
-+			default:
-+				usage();
-+				goto out;
-+		}
-+	}
-+
-+	ret = sshkdf_cavs(&test);
-+
-+out:
-+	if (test.session_id)
-+		free(test.session_id);
-+	if (test.K)
-+		free(test.K);
-+	if (test.H)
-+		free(test.H);
-+	return ret;
-+
-+}
-diff -up openssh-6.8p1/ssh-cavs_driver.pl.kdf-cavs openssh-6.8p1/ssh-cavs_driver.pl
--- openssh-6.8p1/ssh-cavs_driver.pl.kdf-cavs	2015-03-18 11:23:46.348049354 +0100
-+++ openssh-6.8p1/ssh-cavs_driver.pl	2015-03-18 11:23:46.348049354 +0100
-@@ -0,0 +1,184 @@
-+#!/usr/bin/env perl
-+#
-+# CAVS test driver for OpenSSH
-+#
-+# Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
-+#
-+# Permission is hereby granted, free of charge, to any person obtaining a copy
-+# of this software and associated documentation files (the "Software"), to deal
-+# in the Software without restriction, including without limitation the rights
-+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+# copies of the Software, and to permit persons to whom the Software is
-+# furnished to do so, subject to the following conditions:
-+#
-+# The above copyright notice and this permission notice shall be included in
-+# all copies or substantial portions of the Software.
-+#
-+#                            NO WARRANTY
-+#
-+#    BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-+#    FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-+#    OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-+#    PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-+#    OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-+#    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-+#    TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-+#    PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-+#    REPAIR OR CORRECTION.
-+#
-+#    IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-+#    WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-+#    REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-+#    INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-+#    OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-+#    TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-+#    YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-+#    PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-+#    POSSIBILITY OF SUCH DAMAGES.
-+#
-+use strict;
-+use warnings;
-+use IPC::Open2;
-+
-+# Executing a program by feeding STDIN and retrieving
-+# STDOUT
-+# $1: data string to be piped to the app on STDIN
-+# rest: program and args
-+# returns: STDOUT of program as string
-+sub pipe_through_program($@) {
-+	my $in = shift;
-+	my @args = @_;
-+
-+	my ($CO, $CI);
-+	my $pid = open2($CO, $CI, @args);
-+
-+	my $out = "";
-+	my $len = length($in);
-+	my $first = 1;
-+	while (1) {
-+		my $rin = "";
-+		my $win = "";
-+		# Output of prog is FD that we read
-+		vec($rin,fileno($CO),1) = 1;
-+		# Input of prog is FD that we write
-+		# check for $first is needed because we can have NULL input
-+		# that is to be written to the app
-+		if ( $len > 0 || $first) {
-+			(vec($win,fileno($CI),1) = 1);
-+			$first=0;
-+		}
-+		# Let us wait for 100ms
-+		my $nfound = select(my $rout=$rin, my $wout=$win, undef, 0.1);
-+		if ( $wout ) {
-+			my $written = syswrite($CI, $in, $len);
-+			die "broken pipe" if !defined $written;
-+			$len -= $written;
-+			substr($in, 0, $written) = "";
-+			if ($len <= 0) {
-+				close $CI or die "broken pipe: $!";
-+			}
-+		}
-+		if ( $rout ) {
-+			my $tmp_out = "";
-+			my $bytes_read = sysread($CO, $tmp_out, 4096);
-+			$out .= $tmp_out;
-+			last if ($bytes_read == 0);
-+		}
-+	}
-+	close $CO or die "broken pipe: $!";
-+	waitpid $pid, 0;
-+
-+	return $out;
-+}
-+
-+# Parser of CAVS test vector file
-+# $1: Test vector file
-+# $2: Output file for test results
-+# return: nothing
-+sub parse($$) {
-+	my $infile = shift;
-+	my $outfile = shift;
-+
-+	my $out = "";
-+
-+	my $K = "";
-+	my $H = "";
-+	my $session_id = "";
-+	my $ivlen = 0;
-+	my $eklen = "";
-+	my $iklen = "";
-+
-+	open(IN, "<$infile");
-+	while(<IN>) {
-+
-+		my $line = $_;
-+		chomp($line);
-+		$line =~ s/\r//;
-+
-+		if ($line =~ /\[SHA-1\]/) {
-+			$iklen = 20;
-+		} elsif ($line =~ /\[SHA-256\]/) {
-+			$iklen = 32;
-+		} elsif ($line =~ /\[SHA-384\]/) {
-+			$iklen = 48;
-+		} elsif ($line =~ /\[SHA-512\]/) {
-+			$iklen = 64;
-+		} elsif ($line =~ /^\[IV length\s*=\s*(.*)\]/) {
-+			$ivlen = $1;
-+			$ivlen = $ivlen / 8;
-+		} elsif ($line =~ /^\[encryption key length\s*=\s*(.*)\]/) {
-+			$eklen = $1;
-+			$eklen = $eklen / 8;
-+		} elsif ($line =~ /^K\s*=\s*(.*)/) {
-+			$K = $1;
-+			$K = substr($K, 8);
-+			$K = "00" . $K;
-+		} elsif ($line =~ /^H\s*=\s*(.*)/) {
-+			$H = $1;
-+		} elsif ($line =~ /^session_id\s*=\s*(.*)/) {
-+			$session_id = $1;
-+		}
-+		$out .= $line . "\n";
-+
-+		if ($K ne "" && $H ne "" && $session_id ne "" &&
-+		    $ivlen ne "" && $eklen ne "" && $iklen > 0) {
-+			$out .= pipe_through_program("", "./ssh-cavs -H $H -K $K -s $session_id -i $ivlen -e $eklen -m $iklen");
-+
-+			$K = "";
-+			$H = "";
-+			$session_id = "";
-+		}
-+	}
-+	close IN;
-+	$out =~ s/\n/\r\n/g; # make it a dos file
-+	open(OUT, ">$outfile") or die "Cannot create output file $outfile: $?";
-+	print OUT $out;
-+	close OUT;
-+}
-+
-+############################################################
-+#
-+# let us pretend to be C :-)
-+sub main() {
-+
-+	my $infile=$ARGV[0];
-+	die "Error: Test vector file $infile not found" if (! -f $infile);
-+
-+	my $outfile = $infile;
-+	# let us add .rsp regardless whether we could strip .req
-+	$outfile =~ s/\.req$//;
-+	$outfile .= ".rsp";
-+	if (-f $outfile) {
-+		die "Output file $outfile could not be removed: $?"
-+			unless unlink($outfile);
-+	}
-+	print STDERR "Performing tests from source file $infile with results stored in destination file $outfile\n";
-+
-+	# Do the job
-+	parse($infile, $outfile);
-+}
-+
-+###########################################
-+# Call it
-+main();
-+1;
--- a/openssh-6.7p1-sftp-force-permission.patch
+++ b/openssh-6.7p1-sftp-force-permission.patch
@ -1,100 +0,0 @@
-diff -up openssh-7.2p2/sftp-server.8.sftp-force-mode openssh-7.2p2/sftp-server.8
--- openssh-7.2p2/sftp-server.8.sftp-force-mode	2016-03-09 19:04:48.000000000 +0100
-+++ openssh-7.2p2/sftp-server.8	2016-06-23 16:18:20.463854117 +0200
-@@ -38,6 +38,7 @@
- .Op Fl P Ar denied_requests
- .Op Fl p Ar allowed_requests
- .Op Fl u Ar umask
-+.Op Fl m Ar force_file_perms
- .Ek
- .Nm
- .Fl Q Ar protocol_feature
-@@ -138,6 +139,12 @@ Sets an explicit
- .Xr umask 2
- to be applied to newly-created files and directories, instead of the
- user's default mask.
-+.It Fl m Ar force_file_perms
-+Sets explicit file permissions to be applied to newly-created files instead
-+of the default or client requested mode.  Numeric values include:
-+777, 755, 750, 666, 644, 640, etc.  Using both -m and -u switches makes the
-+umask (-u) effective only for newly created directories and explicit mode (-m)
-+for newly created files.
- .El
- .Pp
- On some systems,
-diff -up openssh-7.2p2/sftp-server.c.sftp-force-mode openssh-7.2p2/sftp-server.c
--- openssh-7.2p2/sftp-server.c.sftp-force-mode	2016-06-23 16:18:20.446854128 +0200
-+++ openssh-7.2p2/sftp-server.c	2016-06-23 16:20:37.950766082 +0200
-@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
- /* Version of client */
- static u_int version;
- 
-+/* Force file permissions */
-+int permforce = 0;
-+long permforcemode;
-+
- /* SSH2_FXP_INIT received */
- static int init_done;
- 
-@@ -683,6 +687,7 @@ process_open(u_int32_t id)
- 	Attrib a;
- 	char *name;
- 	int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
-+	mode_t old_umask = 0;
- 
- 	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
- 	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
-@@ -692,6 +697,10 @@ process_open(u_int32_t id)
- 	debug3("request %u: open flags %d", id, pflags);
- 	flags = flags_from_portable(pflags);
- 	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
-+	if (permforce == 1) {   /* Force perm if -m is set */
-+		mode = permforcemode;
-+		old_umask = umask(0); /* so umask does not interfere */
-+	}	
- 	logit("open \"%s\" flags %s mode 0%o",
- 	    name, string_from_portable(pflags), mode);
- 	if (readonly &&
-@@ -713,6 +722,8 @@ process_open(u_int32_t id)
- 			}
- 		}
- 	}
-+	if (permforce == 1)
-+		(void) umask(old_umask); /* restore umask to something sane */
- 	if (status != SSH2_FX_OK)
- 		send_status(id, status);
- 	free(name);
-@@ -1494,7 +1505,7 @@ sftp_server_usage(void)
- 	fprintf(stderr,
- 	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
- 	    "[-l log_level]\n\t[-P denied_requests] "
-	    "[-p allowed_requests] [-u umask]\n"
-+	    "[-p allowed_requests] [-u umask] [-m force_file_perms]\n"
- 	    "       %s -Q protocol_feature\n",
- 	    __progname, __progname);
- 	exit(1);
-@@ -1520,7 +1531,7 @@ sftp_server_main(int argc, char **argv,
- 	pw = pwcopy(user_pw);
- 
- 	while (!skipargs && (ch = getopt(argc, argv,
-	    "d:f:l:P:p:Q:u:cehR")) != -1) {
-+	    "d:f:l:P:p:Q:u:m:cehR")) != -1) {
- 		switch (ch) {
- 		case 'Q':
- 			if (strcasecmp(optarg, "requests") != 0) {
-@@ -1580,6 +1591,15 @@ sftp_server_main(int argc, char **argv,
- 				fatal("Invalid umask \"%s\"", optarg);
- 			(void)umask((mode_t)mask);
- 			break;
-+		case 'm':
-+			/* Force permissions on file received via sftp */
-+			permforce = 1;
-+			permforcemode = strtol(optarg, &cp, 8);
-+			if (permforcemode < 0 || permforcemode > 0777 ||
-+			    *cp != '\0' || (permforcemode == 0 &&
-+			    errno != 0))
-+				fatal("Invalid file mode \"%s\"", optarg);
-+			break;
- 		case 'h':
- 		default:
- 			sftp_server_usage();
--- a/openssh-6.8p1-sshdT-output.patch
+++ b/openssh-6.8p1-sshdT-output.patch
@ -1,12 +0,0 @@
-diff -up openssh/servconf.c.sshdt openssh/servconf.c
--- openssh/servconf.c.sshdt	2015-06-24 11:42:29.041078704 +0200
-+++ openssh/servconf.c	2015-06-24 11:44:39.734745802 +0200
-@@ -2317,7 +2317,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_string(sXAuthLocation, o->xauth_location);
- 	dump_cfg_string(sCiphers, o->ciphers);
- 	dump_cfg_string(sMacs, o->macs);
-	dump_cfg_string(sBanner, o->banner);
-+	dump_cfg_string(sBanner, o->banner != NULL ? o->banner : "none");
- 	dump_cfg_string(sForceCommand, o->adm_forced_command);
- 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
- 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
--- a/openssh-7.1p2-audit-race-condition.patch
+++ b/openssh-7.1p2-audit-race-condition.patch
@ -1,187 +0,0 @@
-diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
--- openssh-7.4p1/monitor_wrap.c.audit-race	2016-12-23 16:35:52.694685771 +0100
-+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:35:52.697685772 +0100
-@@ -1107,4 +1107,50 @@ mm_audit_destroy_sensitive_data(const ch
- 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
- 	sshbuf_free(m);
- }
-+
-+int mm_forward_audit_messages(int fdin)
-+{
-+	u_char buf[4];
-+	u_int blen, msg_len;
-+	struct sshbuf *m;
-+	int r, ret = 0;
-+
-+	debug3("%s: entering", __func__);
-+	if ((m = sshbuf_new()) == NULL)
-+ 		fatal("%s: sshbuf_new failed", __func__);
-+	do {
-+		blen = atomicio(read, fdin, buf, sizeof(buf));
-+		if (blen == 0) /* closed pipe */
-+			break;
-+		if (blen != sizeof(buf)) {
-+			error("%s: Failed to read the buffer from child", __func__);
-+			ret = -1;
-+			break;
-+		}
-+
-+		msg_len = get_u32(buf);
-+		if (msg_len > 256 * 1024)
-+			fatal("%s: read: bad msg_len %d", __func__, msg_len);
-+		sshbuf_reset(m);
-+		if ((r = sshbuf_reserve(m, msg_len, NULL)) != 0)
-+			fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+		if (atomicio(read, fdin, sshbuf_mutable_ptr(m), msg_len) != msg_len) {
-+			error("%s: Failed to read the the buffer content from the child", __func__);
-+			ret = -1;
-+			break;
-+		}
-+		if (atomicio(vwrite, pmonitor->m_recvfd, buf, blen) != blen || 
-+		    atomicio(vwrite, pmonitor->m_recvfd, sshbuf_mutable_ptr(m), msg_len) != msg_len) {
-+			error("%s: Failed to write the message to the monitor", __func__);
-+			ret = -1;
-+			break;
-+		}
-+	} while (1);
-+	sshbuf_free(m);
-+	return ret;
-+}
-+void mm_set_monitor_pipe(int fd)
-+{
-+	pmonitor->m_recvfd = fd;
-+}
- #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-7.4p1/monitor_wrap.h.audit-race openssh-7.4p1/monitor_wrap.h
--- openssh-7.4p1/monitor_wrap.h.audit-race	2016-12-23 16:35:52.694685771 +0100
-+++ openssh-7.4p1/monitor_wrap.h	2016-12-23 16:35:52.698685772 +0100
-@@ -83,6 +83,8 @@ void mm_audit_unsupported_body(int);
- void mm_audit_kex_body(struct ssh *, int, char *, char *, char *, char *, pid_t, uid_t);
- void mm_audit_session_key_free_body(struct ssh *, int, pid_t, uid_t);
- void mm_audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
-+int mm_forward_audit_messages(int);
-+void mm_set_monitor_pipe(int);
- #endif
- 
- struct Session;
-diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
--- openssh-7.4p1/session.c.audit-race	2016-12-23 16:35:52.695685771 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 16:37:26.339730596 +0100
-@@ -162,6 +162,10 @@ static Session *sessions = NULL;
- login_cap_t *lc;
- #endif
- 
-+#ifdef SSH_AUDIT_EVENTS
-+int paudit[2];
-+#endif
-+
- static int is_child = 0;
- static int in_chroot = 0;
- static int have_dev_log = 1;
-@@ -289,6 +293,8 @@ xauth_valid_string(const char *s)
- 	return 1;
- }
- 
-+void child_destory_sensitive_data(struct ssh *ssh);
-+
- #define USE_PIPES 1
- /*
-  * This is called to fork and execute a command when we have no tty.  This
-@@ -424,6 +430,8 @@ do_exec_no_pty(Session *s, const char *c
- 		close(err[0]);
- #endif
- 
-+		child_destory_sensitive_data(ssh);
-+
- 		/* Do processing for the child (exec command etc). */
- 		do_child(ssh, s, command);
- 		/* NOTREACHED */
-@@ -547,6 +555,9 @@ do_exec_pty(Session *s, const char *comm
- 		/* Close the extra descriptor for the pseudo tty. */
- 		close(ttyfd);
- 
-+		/* Do this early, so we will not block large MOTDs */
-+		child_destory_sensitive_data(ssh);
-+
- 		/* record login, etc. similar to login(1) */
- #ifndef HAVE_OSF_SIA
- 		do_login(ssh, s, command);
-@@ -717,6 +728,8 @@ do_exec(Session *s, const char *command)
- 	}
- 	if (s->command != NULL && s->ptyfd == -1)
- 		s->command_handle = PRIVSEP(audit_run_command(ssh, s->command));
-+	if (pipe(paudit) < 0)
-+		fatal("pipe: %s", strerror(errno));
- #endif
- 	if (s->ttyfd != -1)
- 		ret = do_exec_pty(ssh, s, command);
-@@ -732,6 +745,20 @@ do_exec(Session *s, const char *command)
- 	 */
- 	sshbuf_reset(loginmsg);
- 
-+#ifdef SSH_AUDIT_EVENTS
-+	close(paudit[1]);
-+	if (use_privsep && ret == 0) {
-+		/*
-+		 * Read the audit messages from forked child and send them
-+		 * back to monitor. We don't want to communicate directly,
-+		 * because the messages might get mixed up.
-+		 * Continue after the pipe gets closed (all messages sent).
-+		 */
-+		ret = mm_forward_audit_messages(paudit[0]);
-+	}
-+	close(paudit[0]);
-+#endif /* SSH_AUDIT_EVENTS */
-+
- 	return ret;
- }
- 
-@@ -1538,6 +1565,34 @@ child_close_fds(void)
- 	log_redirect_stderr_to(NULL);
- }
- 
-+void
-+child_destory_sensitive_data(struct ssh *ssh)
-+{
-+#ifdef SSH_AUDIT_EVENTS
-+	int pparent = paudit[1];
-+	close(paudit[0]);
-+	/* Hack the monitor pipe to avoid race condition with parent */
-+	if (use_privsep)
-+		mm_set_monitor_pipe(pparent);
-+#endif
-+
-+	/* remove hostkey from the child's memory */
-+	destroy_sensitive_data(ssh, use_privsep);
-+	/*
-+	 * We can audit this, because we hacked the pipe to direct the
-+	 * messages over postauth child. But this message requires answer
-+	 * which we can't do using one-way pipe.
-+	 */
-+	packet_destroy_all(ssh, 0, 1);
-+	/* XXX this will clean the rest but should not audit anymore */
-+	/* packet_clear_keys(ssh); */
-+
-+#ifdef SSH_AUDIT_EVENTS
-+	/* Notify parent that we are done */
-+	close(pparent);
-+#endif
-+}
-+
- /*
-  * Performs common processing for the child, such as setting up the
-  * environment, closing extra file descriptors, setting the user and group
-@@ -1554,13 +1608,6 @@ do_child(Session *s, const char *command
- 
- 	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
- 
-	/* remove hostkey from the child's memory */
-	destroy_sensitive_data(ssh, 1);
-	ssh_packet_clear_keys(ssh);
-	/* Don't audit this - both us and the parent would be talking to the
-	   monitor over a single socket, with no synchronization. */
-	packet_destroy_all(ssh, 0, 1);
-
- 	/* Force a password change */
- 	if (s->authctxt->force_pwchange) {
- 		do_setusercontext(pw);
--- a/openssh-7.2p2-k5login_directory.patch
+++ b/openssh-7.2p2-k5login_directory.patch
@ -1,87 +0,0 @@
-diff --git a/auth-krb5.c b/auth-krb5.c
-index 2b02a04..19b9364 100644
--- a/auth-krb5.c
-+++ b/auth-krb5.c
-@@ -375,5 +375,21 @@ cleanup:
- 		return (krb5_cc_resolve(ctx, ccname, ccache));
- 	}
- }
-+
-+/*
-+ * Reads  k5login_directory  option from the  krb5.conf
-+ */
-+krb5_error_code
-+ssh_krb5_get_k5login_directory(krb5_context ctx, char **k5login_directory) {
-+	profile_t p;
-+	int ret = 0;
-+
-+	ret = krb5_get_profile(ctx, &p);
-+	if (ret)
-+		return ret;
-+
-+	return profile_get_string(p, "libdefaults", "k5login_directory", NULL, NULL,
-+		k5login_directory);
-+}
- #endif /* !HEIMDAL */
- #endif /* KRB5 */
-diff --git a/auth.h b/auth.h
-index f9d191c..c432d2f 100644
--- a/auth.h
-+++ b/auth.h
-@@ -222,6 +222,8 @@ int	 sys_auth_passwd(Authctxt *, const char *);
- 
- #if defined(KRB5) && !defined(HEIMDAL)
- krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
-+krb5_error_code ssh_krb5_get_k5login_directory(krb5_context ctx,
-+	char **k5login_directory);
- #endif
- 
- #endif /* AUTH_H */
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index a7c0c5f..df8cc9a 100644
--- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
-@@ -244,8 +244,27 @@ ssh_gssapi_k5login_exists()
- {
- 	char file[MAXPATHLEN];
- 	struct passwd *pw = the_authctxt->pw;
-+	char *k5login_directory = NULL;
-+	int ret = 0;
-+
-+	ret = ssh_krb5_get_k5login_directory(krb_context, &k5login_directory);
-+	debug3("%s: k5login_directory = %s (rv=%d)", __func__, k5login_directory, ret);
-+	if (k5login_directory == NULL || ret != 0) {
-+		/* If not set, the library will look for  k5login
-+		 * files in the user's home directory, with the filename  .k5login.
-+		 */
-+		snprintf(file, sizeof(file), "%s/.k5login", pw->pw_dir);
-+	} else {
-+		/* If set, the library will look for a local user's k5login file
-+		 * within the named directory, with a filename corresponding to the
-+		 * local username.
-+		 */
-+		snprintf(file, sizeof(file), "%s%s%s", k5login_directory, 
-+			k5login_directory[strlen(k5login_directory)-1] != '/' ? "/" : "",
-+			pw->pw_name);
-+	}
-+	debug("%s: Checking existence of file %s", __func__, file);
- 
-	snprintf(file, sizeof(file), "%s/.k5login", pw->pw_dir);
- 	return access(file, F_OK) == 0;
- }
- 
-diff --git a/sshd.8 b/sshd.8
-index 5c4f15b..135e290 100644
--- a/sshd.8
-+++ b/sshd.8
-@@ -806,6 +806,10 @@ rlogin/rsh.
- These files enforce GSSAPI/Kerberos authentication access control.
- Further details are described in
- .Xr ksu 1 .
-+The location of the k5login file depends on the configuration option
-+.Cm k5login_directory
-+in the
-+.Xr krb5.conf 5 .
- .Pp
- .It Pa ~/.ssh/
- This directory is the default location for all user-specific configuration
--- a/openssh-7.2p2-s390-closefrom.patch
+++ b/openssh-7.2p2-s390-closefrom.patch
@ -1,52 +0,0 @@
-Zseries only: Leave the hardware filedescriptors open.
-
-All filedescriptors above 2 are getting closed when a new
-sshd process to handle a new client connection is
-spawned. As the process also chroot into an empty filesystem
-without any device nodes, there is no chance to reopen the
-files. This patch filters out the reqired fds in the
-closefrom function so these are skipped in the close loop.
-
-Author: Harald Freudenberger <freude@de.ibm.com>
-
---
- openbsd-compat/bsd-closefrom.c |   26 ++++++++++++++++++++++++++
- 1 file changed, 26 insertions(+)
-
--- a/openbsd-compat/bsd-closefrom.c
-+++ b/openbsd-compat/bsd-closefrom.c
-@@ -82,7 +82,33 @@ closefrom(int lowfd)
- 	    fd = strtol(dent->d_name, &endp, 10);
- 	    if (dent->d_name != endp && *endp == '\0' &&
- 		fd >= 0 && fd < INT_MAX && fd >= lowfd && fd != dirfd(dirp))
-+#ifdef __s390__
-+		{
-+		    /*
-+		     * the filedescriptors used to communicate with
-+		     * the device drivers to provide hardware support
-+		     * should survive. HF <freude@de.ibm.com>
-+		     */
-+		    char fpath[PATH_MAX], lpath[PATH_MAX];
-+		    len = snprintf(fpath, sizeof(fpath), "%s/%s",
-+				   fdpath, dent->d_name);
-+		    if (len > 0 && (size_t)len <= sizeof(fpath)) {
-+			len = readlink(fpath, lpath, sizeof(lpath));
-+			if (len > 0) {
-+			    lpath[len] = 0;
-+			    if (strstr(lpath, "dev/z90crypt")
-+				|| strstr(lpath, "dev/zcrypt")
-+				|| strstr(lpath, "dev/prandom")
-+				|| strstr(lpath, "dev/shm/icastats"))
-+				fd = -1;
-+			}
-+		    }
-+		    if (fd >= 0)
-+			(void) close((int) fd);
-+		}
-+#else
- 		(void) close((int) fd);
-+#endif
- 	}
- 	(void) closedir(dirp);
- 	return;
-
--- a/openssh-7.3p1-x11-max-displays.patch
+++ b/openssh-7.3p1-x11-max-displays.patch
@ -1,213 +0,0 @@
-diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
--- openssh-7.4p1/channels.c.x11max	2016-12-23 15:46:32.071506625 +0100
-+++ openssh-7.4p1/channels.c	2016-12-23 15:46:32.139506636 +0100
-@@ -152,8 +152,8 @@ static int all_opens_permitted = 0;
- #define FWD_PERMIT_ANY_HOST	"*"
- 
- /* -- X11 forwarding */
-/* Maximum number of fake X11 displays to try. */
-#define MAX_DISPLAYS  1000
-+/* Minimum port number for X11 forwarding */
-+#define X11_PORT_MIN 6000
- 
- /* Per-channel callback for pre/post select() actions */
- typedef void chan_fn(struct ssh *, Channel *c,
-@@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
-  */
- int
- x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
-    int x11_use_localhost, int single_connection,
-+    int x11_use_localhost, int x11_max_displays, int single_connection,
-     u_int *display_numberp, int **chanids)
- {
- 	Channel *nc = NULL;
-@@ -4240,10 +4241,15 @@ x11_create_display_inet(int x11_display_
- 	if (chanids == NULL)
- 		return -1;
- 
-+	/* Try to bind ports starting at 6000+X11DisplayOffset */
-+	x11_max_displays = x11_max_displays + x11_display_offset;
-+
- 	for (display_number = x11_display_offset;
-	    display_number < MAX_DISPLAYS;
-+	    display_number < x11_max_displays;
- 	    display_number++) {
-		port = 6000 + display_number;
-+		port = X11_PORT_MIN + display_number;
-+		if (port < X11_PORT_MIN) /* overflow */
-+			break;
- 		memset(&hints, 0, sizeof(hints));
- 		hints.ai_family = ssh->chanctxt->IPv4or6;
- 		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
-@@ -4295,7 +4301,7 @@ x11_create_display_inet(int x11_display_
- 		if (num_socks > 0)
- 			break;
- 	}
-	if (display_number >= MAX_DISPLAYS) {
-+	if (display_number >= x11_max_displays || port < X11_PORT_MIN ) {
- 		error("Failed to allocate internet-domain X11 display socket.");
- 		return -1;
- 	}
-@@ -4441,7 +4447,7 @@ x11_connect_display(void)
- 	memset(&hints, 0, sizeof(hints));
- 	hints.ai_family = ssh->chanctxt->IPv4or6;
- 	hints.ai_socktype = SOCK_STREAM;
-	snprintf(strport, sizeof strport, "%u", 6000 + display_number);
-+	snprintf(strport, sizeof strport, "%u", X11_PORT_MIN + display_number);
- 	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
- 		error("%.100s: unknown host. (%s)", buf,
- 		ssh_gai_strerror(gaierr));
-@@ -4457,7 +4463,7 @@ x11_connect_display(void)
- 		/* Connect it to the display. */
- 		if (connect(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
- 			debug2("connect %.100s port %u: %.100s", buf,
-			    6000 + display_number, strerror(errno));
-+			    X11_PORT_MIN + display_number, strerror(errno));
- 			close(sock);
- 			continue;
- 		}
-@@ -4466,8 +4472,8 @@ x11_connect_display(void)
- 	}
- 	freeaddrinfo(aitop);
- 	if (!ai) {
-		error("connect %.100s port %u: %.100s", buf,
-		    6000 + display_number, strerror(errno));
-+		error("connect %.100s port %u: %.100s", buf,
-+		    X11_PORT_MIN + display_number, strerror(errno));
- 		return -1;
- 	}
- 	set_nodelay(sock);
-diff -up openssh-7.4p1/channels.h.x11max openssh-7.4p1/channels.h
--- openssh-7.4p1/channels.h.x11max	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/channels.h	2016-12-23 15:46:32.139506636 +0100
-@@ -293,7 +293,7 @@ int	 permitopen_port(const char *);
- 
- void	 channel_set_x11_refuse_time(struct ssh *, u_int);
- int	 x11_connect_display(struct ssh *);
-int	 x11_create_display_inet(struct ssh *, int, int, int, u_int *, int **);
-+int	 x11_create_display_inet(struct ssh *, int, int, int, int, u_int *, int **);
- void	 x11_request_forwarding_with_spoofing(struct ssh *, int,
- 	    const char *, const char *, const char *, int);
- 
-diff -up openssh-7.4p1/servconf.c.x11max openssh-7.4p1/servconf.c
--- openssh-7.4p1/servconf.c.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.c	2016-12-23 15:47:27.320519121 +0100
-@@ -95,6 +95,7 @@ initialize_server_options(ServerOptions
- 	options->print_lastlog = -1;
- 	options->x11_forwarding = -1;
- 	options->x11_display_offset = -1;
-+	options->x11_max_displays = -1;
- 	options->x11_use_localhost = -1;
- 	options->permit_tty = -1;
- 	options->permit_user_rc = -1;
-@@ -243,6 +244,8 @@ fill_default_server_options(ServerOption
- 		options->x11_forwarding = 0;
- 	if (options->x11_display_offset == -1)
- 		options->x11_display_offset = 10;
-+	if (options->x11_max_displays == -1)
-+		options->x11_max_displays = DEFAULT_MAX_DISPLAYS;
- 	if (options->x11_use_localhost == -1)
- 		options->x11_use_localhost = 1;
- 	if (options->xauth_location == NULL)
-@@ -419,7 +422,7 @@ typedef enum {
- 	sPasswordAuthentication, sKbdInteractiveAuthentication,
- 	sListenAddress, sAddressFamily,
- 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-+	sX11Forwarding, sX11DisplayOffset, sX11MaxDisplays, sX11UseLocalhost,
- 	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
- 	sPermitUserEnvironment, sAllowTcpForwarding, sCompression,
- 	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
-@@ -540,6 +543,7 @@ static struct {
- 	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
- 	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
- 	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
-+	{ "x11maxdisplays", sX11MaxDisplays, SSHCFG_ALL },
- 	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
- 	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
- 	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
-@@ -1316,6 +1320,10 @@ process_server_config_line(ServerOptions
- 			*intptr = value;
- 		break;
- 
-+	case sX11MaxDisplays:
-+		intptr = &options->x11_max_displays;
-+		goto parse_int;
-+
- 	case sX11UseLocalhost:
- 		intptr = &options->x11_use_localhost;
- 		goto parse_flag;
-@@ -2063,6 +2071,7 @@ copy_set_server_options(ServerOptions *d
- 	M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
- 	M_CP_INTOPT(x11_display_offset);
- 	M_CP_INTOPT(x11_forwarding);
-+	M_CP_INTOPT(x11_max_displays);
- 	M_CP_INTOPT(x11_use_localhost);
- 	M_CP_INTOPT(permit_tty);
- 	M_CP_INTOPT(permit_user_rc);
-@@ -2315,6 +2324,7 @@ dump_config(ServerOptions *o)
- #endif
- 	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
- 	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
-+	dump_cfg_int(sX11MaxDisplays, o->x11_max_displays);
- 	dump_cfg_int(sMaxAuthTries, o->max_authtries);
- 	dump_cfg_int(sMaxSessions, o->max_sessions);
- 	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
-diff -up openssh-7.4p1/servconf.h.x11max openssh-7.4p1/servconf.h
--- openssh-7.4p1/servconf.h.x11max	2016-12-23 15:46:32.133506635 +0100
-+++ openssh-7.4p1/servconf.h	2016-12-23 15:46:32.140506636 +0100
-@@ -55,6 +55,7 @@
- 
- #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
- #define DEFAULT_SESSIONS_MAX	10	/* Default for MaxSessions */
-+#define DEFAULT_MAX_DISPLAYS	1000 /* Maximum number of fake X11 displays to try. */
- 
- /* Magic name for internal sftp-server */
- #define INTERNAL_SFTP_NAME	"internal-sftp"
-@@ -85,6 +86,7 @@ typedef struct {
- 	int     x11_forwarding;	/* If true, permit inet (spoofing) X11 fwd. */
- 	int     x11_display_offset;	/* What DISPLAY number to start
- 					 * searching at */
-+	int 	x11_max_displays; /* Number of displays to search */
- 	int     x11_use_localhost;	/* If true, use localhost for fake X11 server. */
- 	char   *xauth_location;	/* Location of xauth program */
- 	int	permit_tty;	/* If false, deny pty allocation */
-diff -up openssh-7.4p1/session.c.x11max openssh-7.4p1/session.c
--- openssh-7.4p1/session.c.x11max	2016-12-23 15:46:32.136506636 +0100
-+++ openssh-7.4p1/session.c	2016-12-23 15:46:32.141506636 +0100
-@@ -2518,8 +2518,9 @@ session_setup_x11fwd(Session *s)
- 		return 0;
- 	}
-	if (x11_create_display_inet(ssh, options.x11_display_offset,
-	    options.x11_use_localhost, s->single_connection,
-	    &s->display_number, &s->x11_chanids) == -1) {
-+	    options.x11_use_localhost, options.x11_max_displays,
-+	    s->single_connection, &s->display_number,
-+	    &s->x11_chanids) == -1) {
- 		debug("x11_create_display_inet failed.");
- 		return 0;
- 	}
-diff -up openssh-7.4p1/sshd_config.5.x11max openssh-7.4p1/sshd_config.5
--- openssh-7.4p1/sshd_config.5.x11max	2016-12-23 15:46:32.134506635 +0100
-+++ openssh-7.4p1/sshd_config.5	2016-12-23 15:46:32.141506636 +0100
-@@ -1133,6 +1133,7 @@ Available keywords are
- .Cm StreamLocalBindUnlink ,
- .Cm TrustedUserCAKeys ,
- .Cm X11DisplayOffset ,
-+.Cm X11MaxDisplays ,
- .Cm X11Forwarding
- and
- .Cm X11UseLocalhost .
-@@ -1566,6 +1567,12 @@ Specifies the first display number avail
- X11 forwarding.
- This prevents sshd from interfering with real X11 servers.
- The default is 10.
-+.It Cm X11MaxDisplays
-+Specifies the maximum number of displays available for
-+.Xr sshd 8 Ns 's
-+X11 forwarding.
-+This prevents sshd from exhausting local ports.
-+The default is 1000.
- .It Cm X11Forwarding
- Specifies whether X11 forwarding is permitted.
- The argument must be
--- a/openssh-7.4p1-systemd.patch
+++ b/openssh-7.4p1-systemd.patch
@ -1,98 +0,0 @@
-commit 0e22b79bfde45a7cf7a2e51a68ec11c4285f3b31
-Author: Jakub Jelen <jjelen@redhat.com>
-Date:   Mon Nov 21 15:04:06 2016 +0100
-
-    systemd stuff
-
-diff --git a/configure.ac b/configure.ac
-index 2ffc369..162ce92 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -4265,6 +4265,30 @@ AC_ARG_WITH([kerberos5],
- AC_SUBST([GSSLIBS])
- AC_SUBST([K5LIBS])
- 
-+# Check whether user wants systemd support
-+SYSTEMD_MSG="no"
-+AC_ARG_WITH(systemd,
-+	[  --with-systemd          Enable systemd support],
-+	[ if test "x$withval" != "xno" ; then
-+		AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
-+		if test "$PKGCONFIG" != "no"; then
-+			AC_MSG_CHECKING([for libsystemd])
-+			if $PKGCONFIG --exists libsystemd; then
-+				SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
-+				SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
-+				CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
-+				SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
-+				AC_MSG_RESULT([yes])
-+				AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
-+				SYSTEMD_MSG="yes"
-+			else
-+				AC_MSG_RESULT([no])
-+			fi
-+		fi
-+	fi ]
-+)
-+
-+
- # Looking for programs, paths and files
- 
- PRIVSEP_PATH=/var/empty
-@@ -5097,6 +5121,7 @@ echo "                   libedit support: $LIBEDIT_MSG"
- echo "  Solaris process contract support: $SPC_MSG"
- echo "           Solaris project support: $SP_MSG"
- echo "         Solaris privilege support: $SPP_MSG"
-+echo "                   systemd support: $SYSTEMD_MSG"
- echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
- echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
- echo "                  BSD Auth support: $BSD_AUTH_MSG"
-diff --git a/contrib/sshd.service b/contrib/sshd.service
-new file mode 100644
-index 0000000..e0d4923
--- /dev/null
-+++ b/contrib/sshd.service
-@@ -0,0 +1,16 @@
-+[Unit]
-+Description=OpenSSH server daemon
-+Documentation=man:sshd(8) man:sshd_config(5)
-+After=network.target
-+
-+[Service]
-+Type=notify
-+ExecStart=/usr/sbin/sshd -D $OPTIONS
-+ExecReload=/bin/kill -HUP $MAINPID
-+KillMode=process
-+Restart=on-failure
-+RestartPreventExitStatus=255
-+
-+[Install]
-+WantedBy=multi-user.target
-+
-diff --git a/sshd.c b/sshd.c
-index 816611c..b8b9d13 100644
--- a/sshd.c
-+++ b/sshd.c
-@@ -85,6 +85,10 @@
- #include <prot.h>
- #endif
- 
-+#ifdef HAVE_SYSTEMD
-+#include <systemd/sd-daemon.h>
-+#endif
-+
- #include "xmalloc.h"
- #include "ssh.h"
- #include "ssh2.h"
-@@ -1888,6 +1892,11 @@ main(int ac, char **av)
- 			}
- 		}
- 
-+#ifdef HAVE_SYSTEMD
-+		/* Signal systemd that we are ready to accept connections */
-+		sd_notify(0, "READY=1");
-+#endif
-+
- 		/* Accept a connection and return in a forked child */
- 		server_accept_loop(&sock_in, &sock_out,
- 		    &newsock, config_s);
--- a/openssh-7.5p1-sandbox.patch
+++ b/openssh-7.5p1-sandbox.patch
@ -1,86 +0,0 @@
-In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
-and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
-implementation) which calls the libraries that will communicate with the
-crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
-this is only need on s390 architecture.
-
-Signed-off-by: Eduardo Barretto <ebarretto@xxxxxxxxxxxxxxxxxx>
---
- sandbox-seccomp-filter.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index ca75cc7..6e7de31 100644
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -166,6 +166,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_exit_group
- 	SC_ALLOW(__NR_exit_group),
- #endif
-+#if defined(__NR_flock) && defined(__s390__)
-+	SC_ALLOW(__NR_flock),
-+#endif
- #ifdef __NR_futex
- 	SC_ALLOW(__NR_futex),
- #endif
-@@ -178,6 +181,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_gettimeofday
- 	SC_ALLOW(__NR_gettimeofday),
- #endif
-+#if defined(__NR_ipc) && defined(__s390__)
-+	SC_ALLOW(__NR_ipc),
-+#endif
- #ifdef __NR_getuid
- 	SC_ALLOW(__NR_getuid),
- #endif
-- 
-1.9.1
-
-getuid and geteuid are needed when using an openssl engine that calls a
-crypto card, e.g. ICA (libica).
-Those syscalls are also needed by the distros for audit code.
-
-Signed-off-by: Eduardo Barretto <ebarretto@xxxxxxxxxxxxxxxxxx>
---
- sandbox-seccomp-filter.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index 6e7de31..e86aa2c 100644
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -175,6 +175,18 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_getpid
- 	SC_ALLOW(__NR_getpid),
- #endif
-+#ifdef __NR_getuid
-+	SC_ALLOW(__NR_getuid),
-+#endif
-+#ifdef __NR_getuid32
-+	SC_ALLOW(__NR_getuid32),
-+#endif
-+#ifdef __NR_geteuid
-+	SC_ALLOW(__NR_geteuid),
-+#endif
-+#ifdef __NR_geteuid32
-+	SC_ALLOW(__NR_geteuid32),
-+#endif
- #ifdef __NR_getrandom
- 	SC_ALLOW(__NR_getrandom),
- #endif
-- 1.9.1
-1.9.1
-diff -up openssh-7.6p1/sandbox-seccomp-filter.c.sandbox openssh-7.6p1/sandbox-seccomp-filter.c
--- openssh-7.6p1/sandbox-seccomp-filter.c.sandbox	2017-12-12 13:59:30.563874059 +0100
-+++ openssh-7.6p1/sandbox-seccomp-filter.c	2017-12-12 13:59:14.842784083 +0100
-@@ -190,6 +190,9 @@ static const struct sock_filter preauth_
- #ifdef __NR_geteuid32
- 	SC_ALLOW(__NR_geteuid32),
- #endif
-+#ifdef __NR_gettid
-+	SC_ALLOW(__NR_gettid),
-+#endif
- #ifdef __NR_getrandom
- 	SC_ALLOW(__NR_getrandom),
- #endif
-
--- a/openssh-7.6p1-audit.patch
+++ b/openssh-7.6p1-audit.patch
--- a/openssh-7.6p1-cleanup-selinux.patch
+++ b/openssh-7.6p1-cleanup-selinux.patch
@ -1,271 +0,0 @@
-diff -up openssh/auth2-pubkey.c.refactor openssh/auth2-pubkey.c
--- openssh/auth2-pubkey.c.refactor	2019-04-04 13:19:12.188821236 +0200
-+++ openssh/auth2-pubkey.c	2019-04-04 13:19:12.276822078 +0200
-@@ -72,6 +72,9 @@
- extern ServerOptions options;
- extern u_char *session_id2;
- extern u_int session_id2_len;
-+extern int inetd_flag;
-+extern int rexeced_flag;
-+extern Authctxt *the_authctxt;
- 
- static char *
- format_key(const struct sshkey *key)
-@@ -511,7 +514,8 @@ match_principals_command(struct ssh *ssh
- 
- 	if ((pid = subprocess("AuthorizedPrincipalsCommand", runas_pw, command,
- 	    ac, av, &f,
-	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD)) == 0)
-+	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
-+	    (inetd_flag && !rexeced_flag), the_authctxt)) == 0)
- 		goto out;
- 
- 	uid_swapped = 1;
-@@ -981,7 +985,8 @@ user_key_command_allowed2(struct ssh *ss
- 
- 	if ((pid = subprocess("AuthorizedKeysCommand", runas_pw, command,
- 	    ac, av, &f,
-	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD)) == 0)
-+	    SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD,
-+	    (inetd_flag && !rexeced_flag), the_authctxt)) == 0)
- 		goto out;
- 
- 	uid_swapped = 1;
-diff -up openssh/auth.c.refactor openssh/auth.c
--- openssh/auth.c.refactor	2019-04-04 13:19:12.235821686 +0200
-+++ openssh/auth.c	2019-04-04 13:19:12.276822078 +0200
-@@ -756,7 +756,8 @@ auth_get_canonical_hostname(struct ssh *
-  */
- pid_t
- subprocess(const char *tag, struct passwd *pw, const char *command,
-    int ac, char **av, FILE **child, u_int flags)
-+    int ac, char **av, FILE **child, u_int flags, int inetd,
-+    void *the_authctxt)
- {
- 	FILE *f = NULL;
- 	struct stat st;
-@@ -872,7 +873,7 @@ subprocess(const char *tag, struct passw
- 		}
- 
- #ifdef WITH_SELINUX
-		if (sshd_selinux_setup_env_variables() < 0) {
-+		if (sshd_selinux_setup_env_variables(inetd, the_authctxt) < 0) {
- 			error ("failed to copy environment:  %s",
- 			    strerror(errno));
- 			_exit(127);
-diff -up openssh/auth.h.refactor openssh/auth.h
--- openssh/auth.h.refactor	2019-04-04 13:19:12.251821839 +0200
-+++ openssh/auth.h	2019-04-04 13:19:12.276822078 +0200
-@@ -235,7 +235,7 @@ struct passwd *fakepw(void);
- #define	SSH_SUBPROCESS_STDOUT_CAPTURE  (1<<1)  /* Redirect stdout */
- #define	SSH_SUBPROCESS_STDERR_DISCARD  (1<<2)  /* Discard stderr */
- pid_t	subprocess(const char *, struct passwd *,
-    const char *, int, char **, FILE **, u_int flags);
-+    const char *, int, char **, FILE **, u_int flags, int, void *);
- 
- int	 sys_auth_passwd(struct ssh *, const char *);
- 
-diff -up openssh/openbsd-compat/port-linux.h.refactor openssh/openbsd-compat/port-linux.h
--- openssh/openbsd-compat/port-linux.h.refactor	2019-04-04 13:19:12.256821887 +0200
-+++ openssh/openbsd-compat/port-linux.h	2019-04-04 13:19:12.276822078 +0200
-@@ -26,8 +26,8 @@ void ssh_selinux_setfscreatecon(const ch
- 
- int sshd_selinux_enabled(void);
- void sshd_selinux_copy_context(void);
-void sshd_selinux_setup_exec_context(char *);
-int sshd_selinux_setup_env_variables(void);
-+void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int);
-+int sshd_selinux_setup_env_variables(int inetd, void *);
- void sshd_selinux_change_privsep_preauth_context(void);
- #endif
- 
-diff -up openssh/openbsd-compat/port-linux-sshd.c.refactor openssh/openbsd-compat/port-linux-sshd.c
--- openssh/openbsd-compat/port-linux-sshd.c.refactor	2019-04-04 13:19:12.256821887 +0200
-+++ openssh/openbsd-compat/port-linux-sshd.c	2019-04-04 13:19:12.276822078 +0200
-@@ -49,11 +49,6 @@
- #include <unistd.h>
- #endif
- 
-extern ServerOptions options;
-extern Authctxt *the_authctxt;
-extern int inetd_flag;
-extern int rexeced_flag;
-
- /* Wrapper around is_selinux_enabled() to log its return value once only */
- int
- sshd_selinux_enabled(void)
-@@ -223,7 +218,8 @@ get_user_context(const char *sename, con
- }
- 
- static void
-ssh_selinux_get_role_level(char **role, const char **level)
-+ssh_selinux_get_role_level(char **role, const char **level,
-+    Authctxt *the_authctxt)
- {
- 	*role = NULL;
- 	*level = NULL;
-@@ -241,8 +237,8 @@ ssh_selinux_get_role_level(char **role,
- 
- /* Return the default security context for the given username */
- static int
-sshd_selinux_getctxbyname(char *pwname,
-	security_context_t *default_sc, security_context_t *user_sc)
-+sshd_selinux_getctxbyname(char *pwname, security_context_t *default_sc,
-+    security_context_t *user_sc, int inetd, Authctxt *the_authctxt)
- {
- 	char *sename, *lvl;
- 	char *role;
-@@ -250,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname,
- 	int r = 0;
- 	context_t con = NULL;
- 
-	ssh_selinux_get_role_level(&role, &reqlvl);
-+	ssh_selinux_get_role_level(&role, &reqlvl, the_authctxt);
- 
- #ifdef HAVE_GETSEUSERBYNAME
- 	if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
-@@ -272,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname,
- 
- 	if (r == 0) {
- 		/* If launched from xinetd, we must use current level */
-		if (inetd_flag && !rexeced_flag) {
-+		if (inetd) {
- 			security_context_t sshdsc=NULL;
- 
- 			if (getcon_raw(&sshdsc) < 0)
-@@ -333,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname,
- 
- /* Setup environment variables for pam_selinux */
- static int
-sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
-+sshd_selinux_setup_variables(int(*set_it)(char *, const char *), int inetd,
-+    Authctxt *the_authctxt)
- {
- 	const char *reqlvl;
- 	char *role;
-@@ -342,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it
- 
- 	debug3("%s: setting execution context", __func__);
- 
-	ssh_selinux_get_role_level(&role, &reqlvl);
-+	ssh_selinux_get_role_level(&role, &reqlvl, the_authctxt);
- 
- 	rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : "");
- 
-	if (inetd_flag && !rexeced_flag) {
-+	if (inetd) {
- 		use_current = "1";
- 	} else {
- 		use_current = "";
-@@ -362,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it
- }
- 
- static int
-sshd_selinux_setup_pam_variables(void)
-+sshd_selinux_setup_pam_variables(int inetd,
-+    int(pam_setenv)(char *, const char *), Authctxt *the_authctxt)
- {
-	return sshd_selinux_setup_variables(do_pam_putenv);
-+	return sshd_selinux_setup_variables(pam_setenv, inetd, the_authctxt);
- }
- 
- static int
-@@ -374,25 +372,28 @@ do_setenv(char *name, const char *value)
- }
- 
- int
-sshd_selinux_setup_env_variables(void)
-+sshd_selinux_setup_env_variables(int inetd, void *the_authctxt)
- {
-	return sshd_selinux_setup_variables(do_setenv);
-+	Authctxt *authctxt = (Authctxt *) the_authctxt;
-+	return sshd_selinux_setup_variables(do_setenv, inetd, authctxt);
- }
- 
- /* Set the execution context to the default for the specified user */
- void
-sshd_selinux_setup_exec_context(char *pwname)
-+sshd_selinux_setup_exec_context(char *pwname, int inetd,
-+    int(pam_setenv)(char *, const char *), void *the_authctxt, int use_pam)
- {
- 	security_context_t user_ctx = NULL;
- 	int r = 0;
- 	security_context_t default_ctx = NULL;
-+	Authctxt *authctxt = (Authctxt *) the_authctxt;
- 
- 	if (!sshd_selinux_enabled())
- 		return;
- 
-	if (options.use_pam) {
-+	if (use_pam) {
- 		/* do not compute context, just setup environment for pam_selinux */
-		if (sshd_selinux_setup_pam_variables()) {
-+		if (sshd_selinux_setup_pam_variables(inetd, pam_setenv, authctxt)) {
- 			switch (security_getenforce()) {
- 			case -1:
- 				fatal("%s: security_getenforce() failed", __func__);
-@@ -410,7 +411,7 @@ sshd_selinux_setup_exec_context(char *pw
- 
- 	debug3("%s: setting execution context", __func__);
- 
-	r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx);
-+	r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx, inetd, authctxt);
- 	if (r >= 0) {
- 		r = setexeccon(user_ctx);
- 		if (r < 0) {
-diff -up openssh/platform.c.refactor openssh/platform.c
--- openssh/platform.c.refactor	2019-04-04 13:19:12.204821389 +0200
-+++ openssh/platform.c	2019-04-04 13:19:12.277822088 +0200
-@@ -32,6 +32,9 @@
- 
- extern int use_privsep;
- extern ServerOptions options;
-+extern int inetd_flag;
-+extern int rexeced_flag;
-+extern Authctxt *the_authctxt;
- 
- void
- platform_pre_listen(void)
-@@ -183,7 +186,9 @@ platform_setusercontext_post_groups(stru
- 	}
- #endif /* HAVE_SETPCRED */
- #ifdef WITH_SELINUX
-	sshd_selinux_setup_exec_context(pw->pw_name);
-+	sshd_selinux_setup_exec_context(pw->pw_name,
-+	    (inetd_flag && !rexeced_flag), do_pam_putenv, the_authctxt,
-+	    options.use_pam);
- #endif
- }
- 
-diff -up openssh/sshd.c.refactor openssh/sshd.c
--- openssh/sshd.c.refactor	2019-04-04 13:19:12.275822068 +0200
-+++ openssh/sshd.c	2019-04-04 13:19:51.270195262 +0200
-@@ -158,7 +158,7 @@ int debug_flag = 0;
- static int test_flag = 0;
- 
- /* Flag indicating that the daemon is being started from inetd. */
-static int inetd_flag = 0;
-+int inetd_flag = 0;
- 
- /* Flag indicating that sshd should not detach and become a daemon. */
- static int no_daemon_flag = 0;
-@@ -171,7 +171,7 @@ static char **saved_argv;
- static int saved_argc;
- 
- /* re-exec */
-static int rexeced_flag = 0;
-+int rexeced_flag = 0;
- static int rexec_flag = 1;
- static int rexec_argc = 0;
- static char **rexec_argv;
-@@ -2192,7 +2192,9 @@ main(int ac, char **av)
- 	}
- #endif
- #ifdef WITH_SELINUX
-	sshd_selinux_setup_exec_context(authctxt->pw->pw_name);
-+	sshd_selinux_setup_exec_context(authctxt->pw->pw_name,
-+	    (inetd_flag && !rexeced_flag), do_pam_putenv, the_authctxt,
-+	    options.use_pam);
- #endif
- #ifdef USE_PAM
- 	if (options.use_pam) {
--- a/openssh-7.7p1-fips.patch
+++ b/openssh-7.7p1-fips.patch
@ -1,457 +0,0 @@
-diff -up openssh-8.0p1/cipher-ctr.c.fips openssh-8.0p1/cipher-ctr.c
--- openssh-8.0p1/cipher-ctr.c.fips	2019-07-23 14:55:45.326525641 +0200
-+++ openssh-8.0p1/cipher-ctr.c	2019-07-23 14:55:45.401526401 +0200
-@@ -179,7 +179,8 @@ evp_aes_128_ctr(void)
- 	aes_ctr.do_cipher = ssh_aes_ctr;
- #ifndef SSH_OLD_EVP
- 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
-	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
-+	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV |
-+	    EVP_CIPH_FLAG_FIPS;
- #endif
- 	return (&aes_ctr);
- }
-diff -up openssh-8.0p1/dh.c.fips openssh-8.0p1/dh.c
--- openssh-8.0p1/dh.c.fips	2019-04-18 00:52:57.000000000 +0200
-+++ openssh-8.0p1/dh.c	2019-07-23 14:55:45.401526401 +0200
-@@ -152,6 +152,12 @@ choose_dh(int min, int wantbits, int max
- 	int best, bestcount, which, linenum;
- 	struct dhgroup dhg;
- 
-+	if (FIPS_mode()) {
-+		logit("Using arbitrary primes is not allowed in FIPS mode."
-+		    " Falling back to known groups.");
-+		return (dh_new_group_fallback(max));
-+	}
-+
- 	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL) {
- 		logit("WARNING: could not open %s (%s), using fixed modulus",
- 		    _PATH_DH_MODULI, strerror(errno));
-@@ -489,4 +495,38 @@ dh_estimate(int bits)
- 	return 8192;
- }
- 
-+/*
-+ * Compares the received DH parameters with known-good groups,
-+ * which might be either from group14, group16 or group18.
-+ */
-+int
-+dh_is_known_group(const DH *dh)
-+{
-+	const BIGNUM *p, *g;
-+	const BIGNUM *known_p, *known_g;
-+	DH *known = NULL;
-+	int bits = 0, rv = 0;
-+
-+	DH_get0_pqg(dh, &p, NULL, &g);
-+	bits = BN_num_bits(p);
-+
-+	if (bits <= 3072) {
-+		known = dh_new_group14();
-+	} else if (bits <= 6144) {
-+		known = dh_new_group16();
-+	} else {
-+		known = dh_new_group18();
-+	}
-+
-+	DH_get0_pqg(known, &known_p, NULL, &known_g);
-+
-+	if (BN_cmp(g, known_g) == 0 &&
-+	    BN_cmp(p, known_p) == 0) {
-+		rv = 1;
-+	}
-+
-+	DH_free(known);
-+	return rv;
-+}
-+
- #endif /* WITH_OPENSSL */
-diff -up openssh-8.0p1/dh.h.fips openssh-8.0p1/dh.h
--- openssh-8.0p1/dh.h.fips	2019-04-18 00:52:57.000000000 +0200
-+++ openssh-8.0p1/dh.h	2019-07-23 14:55:45.401526401 +0200
-@@ -43,6 +43,7 @@ DH	*dh_new_group_fallback(int);
- 
- int	 dh_gen_key(DH *, int);
- int	 dh_pub_is_valid(const DH *, const BIGNUM *);
-+int	 dh_is_known_group(const DH *);
- 
- u_int	 dh_estimate(int);
- 
-diff -up openssh-8.0p1/kex.c.fips openssh-8.0p1/kex.c
--- openssh-8.0p1/kex.c.fips	2019-07-23 14:55:45.395526340 +0200
-+++ openssh-8.0p1/kex.c	2019-07-23 14:55:45.402526411 +0200
-@@ -199,7 +199,10 @@ kex_names_valid(const char *names)
- 	for ((p = strsep(&cp, ",")); p && *p != '\0';
- 	    (p = strsep(&cp, ","))) {
- 		if (kex_alg_by_name(p) == NULL) {
-			error("Unsupported KEX algorithm \"%.100s\"", p);
-+			if (FIPS_mode())
-+				error("\"%.100s\" is not allowed in FIPS mode", p);
-+			else
-+				error("Unsupported KEX algorithm \"%.100s\"", p);
- 			free(s);
- 			return 0;
- 		}
-diff -up openssh-8.0p1/kexgexc.c.fips openssh-8.0p1/kexgexc.c
--- openssh-8.0p1/kexgexc.c.fips	2019-04-18 00:52:57.000000000 +0200
-+++ openssh-8.0p1/kexgexc.c	2019-07-23 14:55:45.402526411 +0200
-@@ -28,6 +28,7 @@
- 
- #ifdef WITH_OPENSSL
- 
-+#include <openssl/crypto.h>
- #include <sys/types.h>
- 
- #include <openssl/dh.h>
-@@ -113,6 +114,10 @@ input_kex_dh_gex_group(int type, u_int32
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
- 	}
-+	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
-+		r = SSH_ERR_INVALID_ARGUMENT;
-+		goto out;
-+	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
- 	/* generate and send 'e', client DH public key */
-diff -up openssh-8.0p1/myproposal.h.fips openssh-8.0p1/myproposal.h
--- openssh-8.0p1/myproposal.h.fips	2019-04-18 00:52:57.000000000 +0200
-+++ openssh-8.0p1/myproposal.h	2019-07-23 14:55:45.402526411 +0200
-@@ -111,6 +111,20 @@
- 	"rsa-sha2-256," \
- 	"ssh-rsa"
- 
-+#define	KEX_FIPS_PK_ALG	\
-+	"ecdsa-sha2-nistp256-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp384-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp521-cert-v01@openssh.com," \
-+	"rsa-sha2-512-cert-v01@openssh.com," \
-+	"rsa-sha2-256-cert-v01@openssh.com," \
-+	"ssh-rsa-cert-v01@openssh.com," \
-+	"ecdsa-sha2-nistp256," \
-+	"ecdsa-sha2-nistp384," \
-+	"ecdsa-sha2-nistp521," \
-+	"rsa-sha2-512," \
-+	"rsa-sha2-256," \
-+	"ssh-rsa"
-+
- #define	KEX_SERVER_ENCRYPT \
- 	"chacha20-poly1305@openssh.com," \
- 	"aes128-ctr,aes192-ctr,aes256-ctr," \
-@@ -134,6 +142,27 @@
- 
- #define KEX_CLIENT_MAC KEX_SERVER_MAC
- 
-+#define	KEX_FIPS_ENCRYPT \
-+	"aes128-ctr,aes192-ctr,aes256-ctr," \
-+	"aes128-cbc,3des-cbc," \
-+	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se," \
-+	"aes128-gcm@openssh.com,aes256-gcm@openssh.com"
-+#define KEX_DEFAULT_KEX_FIPS		\
-+	"ecdh-sha2-nistp256," \
-+	"ecdh-sha2-nistp384," \
-+	"ecdh-sha2-nistp521," \
-+	"diffie-hellman-group-exchange-sha256," \
-+	"diffie-hellman-group16-sha512," \
-+	"diffie-hellman-group18-sha512," \
-+	"diffie-hellman-group14-sha256"
-+#define KEX_FIPS_MAC \
-+	"hmac-sha1," \
-+	"hmac-sha2-256," \
-+	"hmac-sha2-512," \
-+	"hmac-sha1-etm@openssh.com," \
-+	"hmac-sha2-256-etm@openssh.com," \
-+	"hmac-sha2-512-etm@openssh.com"
-+
- /* Not a KEX value, but here so all the algorithm defaults are together */
- #define	SSH_ALLOWED_CA_SIGALGS	\
- 	"ecdsa-sha2-nistp256," \
-diff -up openssh-8.0p1/readconf.c.fips openssh-8.0p1/readconf.c
--- openssh-8.0p1/readconf.c.fips	2019-07-23 14:55:45.334525723 +0200
-+++ openssh-8.0p1/readconf.c	2019-07-23 14:55:45.402526411 +0200
-@@ -2179,11 +2179,16 @@ fill_default_options(Options * options)
- 	all_key = sshkey_alg_list(0, 0, 1, ',');
- 	all_sig = sshkey_alg_list(0, 1, 1, ',');
- 	/* remove unsupported algos from default lists */
-	def_cipher = match_filter_allowlist(KEX_CLIENT_ENCRYPT, all_cipher);
-	def_mac = match_filter_allowlist(KEX_CLIENT_MAC, all_mac);
-	def_kex = match_filter_allowlist(KEX_CLIENT_KEX, all_kex);
-	def_key = match_filter_allowlist(KEX_DEFAULT_PK_ALG, all_key);
-	def_sig = match_filter_allowlist(SSH_ALLOWED_CA_SIGALGS, all_sig);
-+	def_cipher = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_ENCRYPT : KEX_CLIENT_ENCRYPT), all_cipher);
-+	def_mac = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_MAC : KEX_CLIENT_MAC), all_mac);
-+	def_kex = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_DEFAULT_KEX_FIPS : KEX_CLIENT_KEX), all_kex);
-+	def_key = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG), all_key);
-+	def_sig = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
- #define ASSEMBLE(what, defaults, all) \
- 	do { \
- 		if ((r = kex_assemble_names(&options->what, \
-diff -up openssh-8.0p1/sandbox-seccomp-filter.c.fips openssh-8.0p1/sandbox-seccomp-filter.c
--- openssh-8.0p1/sandbox-seccomp-filter.c.fips	2019-07-23 14:55:45.373526117 +0200
-+++ openssh-8.0p1/sandbox-seccomp-filter.c	2019-07-23 14:55:45.402526411 +0200
-@@ -137,6 +137,9 @@ static const struct sock_filter preauth_
- #ifdef __NR_open
- 	SC_DENY(__NR_open, EACCES),
- #endif
-+#ifdef __NR_socket
-+	SC_DENY(__NR_socket, EACCES),
-+#endif
- #ifdef __NR_openat
- 	SC_DENY(__NR_openat, EACCES),
- #endif
-diff -up openssh-8.0p1/servconf.c.fips openssh-8.0p1/servconf.c
--- openssh-8.0p1/servconf.c.fips	2019-07-23 14:55:45.361525996 +0200
-+++ openssh-8.0p1/servconf.c	2019-07-23 14:55:45.403526421 +0200
-@@ -208,11 +208,16 @@ assemble_algorithms(ServerOptions *o)
- 	all_key = sshkey_alg_list(0, 0, 1, ',');
- 	all_sig = sshkey_alg_list(0, 1, 1, ',');
- 	/* remove unsupported algos from default lists */
-	def_cipher = match_filter_allowlist(KEX_SERVER_ENCRYPT, all_cipher);
-	def_mac = match_filter_allowlist(KEX_SERVER_MAC, all_mac);
-	def_kex = match_filter_allowlist(KEX_SERVER_KEX, all_kex);
-	def_key = match_filter_allowlist(KEX_DEFAULT_PK_ALG, all_key);
-	def_sig = match_filter_allowlist(SSH_ALLOWED_CA_SIGALGS, all_sig);
-+	def_cipher = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_ENCRYPT : KEX_SERVER_ENCRYPT), all_cipher);
-+	def_mac = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_MAC : KEX_SERVER_MAC), all_mac);
-+	def_kex = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_DEFAULT_KEX_FIPS : KEX_SERVER_KEX), all_kex);
-+	def_key = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG), all_key);
-+	def_sig = match_filter_allowlist((FIPS_mode() ?
-+	    KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
- #define ASSEMBLE(what, defaults, all) \
- 	do { \
- 		if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
-diff -up openssh-8.0p1/ssh.c.fips openssh-8.0p1/ssh.c
--- openssh-8.0p1/ssh.c.fips	2019-07-23 14:55:45.378526168 +0200
-+++ openssh-8.0p1/ssh.c	2019-07-23 14:55:45.403526421 +0200
-@@ -76,6 +76,7 @@
- #include <openssl/evp.h>
- #include <openssl/err.h>
- #endif
-+#include <openssl/crypto.h>
- #include "openbsd-compat/openssl-compat.h"
- #include "openbsd-compat/sys-queue.h"
- 
-@@ -614,6 +626,10 @@ main(int ac, char **av)
- 		dump_client_config(&options, host);
- 		exit(0);
- 	}
-+
-+	if (FIPS_mode()) {
-+		debug("FIPS mode initialized");
-+	}
- 
- 	/* Expand SecurityKeyProvider if it refers to an environment variable */
- 	if (options.sk_provider != NULL && *options.sk_provider == '$' &&
-diff -up openssh-8.0p1/sshconnect2.c.fips openssh-8.0p1/sshconnect2.c
--- openssh-8.0p1/sshconnect2.c.fips	2019-07-23 14:55:45.336525743 +0200
-+++ openssh-8.0p1/sshconnect2.c	2019-07-23 14:55:45.403526421 +0200
-@@ -44,6 +44,8 @@
- #include <vis.h>
- #endif
- 
-+#include <openssl/crypto.h>
-+
- #include "openbsd-compat/sys-queue.h"
- 
- #include "xmalloc.h"
-@@ -198,36 +203,41 @@ ssh_kex2(struct ssh *ssh, char *host, st
- 
- #if defined(GSSAPI) && defined(WITH_OPENSSL)
- 	if (options.gss_keyex) {
-		/* Add the GSSAPI mechanisms currently supported on this
-		 * client to the key exchange algorithm proposal */
-		orig = myproposal[PROPOSAL_KEX_ALGS];
-
-		if (options.gss_server_identity) {
-			gss_host = xstrdup(options.gss_server_identity);
-		} else if (options.gss_trust_dns) {
-			gss_host = remote_hostname(ssh);
-			/* Fall back to specified host if we are using proxy command
-			 * and can not use DNS on that socket */
-			if (strcmp(gss_host, "UNKNOWN") == 0) {
-				free(gss_host);
-				gss_host = xstrdup(host);
-			}
-		} else {
-			gss_host = xstrdup(host);
-		}
-
-		gss = ssh_gssapi_client_mechanisms(gss_host,
-		    options.gss_client_identity, options.gss_kex_algorithms);
-		if (gss) {
-			debug("Offering GSSAPI proposal: %s", gss);
-			xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
-			    "%s,%s", gss, orig);
-
-			/* If we've got GSSAPI algorithms, then we also support the
-			 * 'null' hostkey, as a last resort */
-			orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
-			xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
-			    "%s,null", orig);
-+		if (FIPS_mode()) {
-+			logit("Disabling GSSAPIKeyExchange. Not usable in FIPS mode");
-+			options.gss_keyex = 0;
-+		} else {
-+			/* Add the GSSAPI mechanisms currently supported on this
-+			 * client to the key exchange algorithm proposal */
-+			orig = myproposal[PROPOSAL_KEX_ALGS];
-+
-+			if (options.gss_server_identity) {
-+				gss_host = xstrdup(options.gss_server_identity);
-+			} else if (options.gss_trust_dns) {
-+				gss_host = remote_hostname(ssh);
-+				/* Fall back to specified host if we are using proxy command
-+				 * and can not use DNS on that socket */
-+				if (strcmp(gss_host, "UNKNOWN") == 0) {
-+					free(gss_host);
-+					gss_host = xstrdup(host);
-+				}
-+			} else {
-+				gss_host = xstrdup(host);
-+			}
-+
-+			gss = ssh_gssapi_client_mechanisms(gss_host,
-+			    options.gss_client_identity, options.gss_kex_algorithms);
-+			if (gss) {
-+				debug("Offering GSSAPI proposal: %s", gss);
-+				xasprintf(&myproposal[PROPOSAL_KEX_ALGS],
-+				    "%s,%s", gss, orig);
-+
-+				/* If we've got GSSAPI algorithms, then we also support the
-+				 * 'null' hostkey, as a last resort */
-+				orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
-+				xasprintf(&myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS],
-+				    "%s,null", orig);
-+			}
- 		}
- 	}
- #endif
-diff -up openssh-8.0p1/sshd.c.fips openssh-8.0p1/sshd.c
--- openssh-8.0p1/sshd.c.fips	2019-07-23 14:55:45.398526371 +0200
-+++ openssh-8.0p1/sshd.c	2019-07-23 14:55:45.403526421 +0200
-@@ -66,6 +66,7 @@
- #include <grp.h>
- #include <pwd.h>
- #include <signal.h>
-+#include <syslog.h>
- #include <stdarg.h>
- #include <stdio.h>
- #include <stdlib.h>
-@@ -77,6 +78,7 @@
- #include <openssl/dh.h>
- #include <openssl/bn.h>
- #include <openssl/rand.h>
-+#include <openssl/crypto.h>
- #include "openbsd-compat/openssl-compat.h"
- #endif
- 
-@@ -1529,6 +1532,7 @@ main(int ac, char **av)
- #endif
- 	__progname = ssh_get_progname(av[0]);
- 
-+	OpenSSL_add_all_algorithms();
- 	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
- 	saved_argc = ac;
- 	rexec_argc = ac;
-@@ -1992,6 +2007,10 @@ main(int ac, char **av)
- 	/* Reinitialize the log (because of the fork above). */
- 	log_init(__progname, options.log_level, options.log_facility, log_stderr);
- 
-+	if (FIPS_mode()) {
-+		debug("FIPS mode initialized");
-+	}
-+
- 	/* Chdir to the root directory so that the current disk can be
- 	   unmounted if desired. */
- 	if (chdir("/") == -1)
-@@ -2382,10 +2401,14 @@ do_ssh2_kex(struct ssh *ssh)
- 	if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0)
- 		orig = NULL;
- 
-	if (options.gss_keyex)
-		gss = ssh_gssapi_server_mechanisms();
-	else
-		gss = NULL;
-+	if (options.gss_keyex) {
-+		if (FIPS_mode()) {
-+			logit("Disabling GSSAPIKeyExchange. Not usable in FIPS mode");
-+			options.gss_keyex = 0;
-+		} else {
-+			gss = ssh_gssapi_server_mechanisms();
-+		}
-+	}
- 
- 	if (gss && orig)
- 		xasprintf(&newstr, "%s,%s", gss, orig);
-diff -up openssh-8.0p1/sshkey.c.fips openssh-8.0p1/sshkey.c
--- openssh-8.0p1/sshkey.c.fips	2019-07-23 14:55:45.398526371 +0200
-+++ openssh-8.0p1/sshkey.c	2019-07-23 14:55:45.404526431 +0200
-@@ -34,6 +34,7 @@
- #include <openssl/evp.h>
- #include <openssl/err.h>
- #include <openssl/pem.h>
-+#include <openssl/crypto.h>
- #endif
- 
- #include "crypto_api.h"
-@@ -57,6 +58,7 @@
- #define SSHKEY_INTERNAL
- #include "sshkey.h"
- #include "match.h"
-+#include "log.h"
- #include "ssh-sk.h"
- 
- #ifdef WITH_XMSS
-@@ -1591,6 +1593,8 @@ rsa_generate_private_key(u_int bits, RSA
- 	}
- 	if (!BN_set_word(f4, RSA_F4) ||
- 	    !RSA_generate_key_ex(private, bits, f4, NULL)) {
-+			if (FIPS_mode())
-+				logit("%s: the key length might be unsupported by FIPS mode approved key generation method", __func__);
- 		ret = SSH_ERR_LIBCRYPTO_ERROR;
- 		goto out;
- 	}
-diff -up openssh-8.0p1/ssh-keygen.c.fips openssh-8.0p1/ssh-keygen.c
--- openssh-8.0p1/ssh-keygen.c.fips	2019-07-23 14:55:45.391526300 +0200
-+++ openssh-8.0p1/ssh-keygen.c	2019-07-23 14:57:54.118830056 +0200
-@@ -199,6 +199,12 @@ type_bits_valid(int type, const char *na
- #endif
- 	}
- #ifdef WITH_OPENSSL
-+	if (FIPS_mode()) {
-+		if (type == KEY_DSA)
-+			fatal("DSA keys are not allowed in FIPS mode");
-+		if (type == KEY_ED25519)
-+			fatal("ED25519 keys are not allowed in FIPS mode");
-+	}
- 	switch (type) {
- 	case KEY_DSA:
- 		if (*bitsp != 1024)
-@@ -1029,9 +1035,17 @@ do_gen_all_hostkeys(struct passwd *pw)
- 			first = 1;
- 			printf("%s: generating new host keys: ", __progname);
- 		}
-+		type = sshkey_type_from_name(key_types[i].key_type);
-+
-+		/* Skip the keys that are not supported in FIPS mode */
-+		if (FIPS_mode() && (type == KEY_DSA || type == KEY_ED25519)) {
-+			logit("Skipping %s key in FIPS mode",
-+			    key_types[i].key_type_display);
-+			goto next;
-+		}
-+
- 		printf("%s ", key_types[i].key_type_display);
- 		fflush(stdout);
-		type = sshkey_type_from_name(key_types[i].key_type);
- 		if ((fd = mkstemp(prv_tmp)) == -1) {
- 			error("Could not save your private key in %s: %s",
-			    prv_tmp, strerror(errno));
--- a/openssh-7.7p1-gssapi-new-unique.patch
+++ b/openssh-7.7p1-gssapi-new-unique.patch
@ -1,647 +0,0 @@
-diff --git a/auth-krb5.c b/auth-krb5.c
-index a5a81ed2..63f877f2 100644
--- a/auth-krb5.c
-+++ b/auth-krb5.c
-@@ -51,6 +51,7 @@
- #include <unistd.h>
- #include <string.h>
- #include <krb5.h>
-+#include <profile.h>
- 
- extern ServerOptions	 options;
- 
-@@ -77,7 +78,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
- #endif
- 	krb5_error_code problem;
- 	krb5_ccache ccache = NULL;
-	int len;
-+	char *ticket_name = NULL;
- 	char *client, *platform_client;
- 	const char *errmsg;
- 
-@@ -163,7 +164,8 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
- 		goto out;
- 	}
- 
-	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);
-+	problem = ssh_krb5_cc_new_unique(authctxt->krb5_ctx,
-+	     &authctxt->krb5_fwd_ccache, &authctxt->krb5_set_env);
- 	if (problem)
- 		goto out;
- 
-@@ -172,21 +174,20 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
- 	if (problem)
- 		goto out;
- 
-	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
-+	problem = krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
- 				 &creds);
- 	if (problem)
- 		goto out;
- #endif
- 
-	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
-+	problem = krb5_cc_get_full_name(authctxt->krb5_ctx,
-+	    authctxt->krb5_fwd_ccache, &ticket_name);
- 
-	len = strlen(authctxt->krb5_ticket_file) + 6;
-	authctxt->krb5_ccname = xmalloc(len);
-	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
-	    authctxt->krb5_ticket_file);
-+	authctxt->krb5_ccname = xstrdup(ticket_name);
-+	krb5_free_string(authctxt->krb5_ctx, ticket_name);
- 
- #ifdef USE_PAM
-	if (options.use_pam)
-+	if (options.use_pam && authctxt->krb5_set_env)
- 		do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);
- #endif
- 
-@@ -222,11 +223,54 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
- void
- krb5_cleanup_proc(Authctxt *authctxt)
- {
-+	struct stat krb5_ccname_stat;
-+	char krb5_ccname[128], *krb5_ccname_dir_start, *krb5_ccname_dir_end;
-+
- 	debug("krb5_cleanup_proc called");
- 	if (authctxt->krb5_fwd_ccache) {
-		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
-+		krb5_context ctx = authctxt->krb5_ctx;
-+		krb5_cccol_cursor cursor;
-+		krb5_ccache ccache;
-+		int ret;
-+
-+		krb5_cc_destroy(ctx, authctxt->krb5_fwd_ccache);
- 		authctxt->krb5_fwd_ccache = NULL;
-+
-+		ret = krb5_cccol_cursor_new(ctx, &cursor);
-+		if (ret)
-+			goto out;
-+
-+		ret = krb5_cccol_cursor_next(ctx, cursor, &ccache);
-+		if (ret == 0 && ccache != NULL) {
-+			/* There is at least one other ccache in collection
-+			 * we can switch to */
-+			krb5_cc_switch(ctx, ccache);
-+		} else if (authctxt->krb5_ccname != NULL) {
-+			/* Clean up the collection too */
-+			strncpy(krb5_ccname, authctxt->krb5_ccname, sizeof(krb5_ccname) - 10);
-+			krb5_ccname_dir_start = strchr(krb5_ccname, ':') + 1;
-+			*krb5_ccname_dir_start++ = '\0';
-+			if (strcmp(krb5_ccname, "DIR") == 0) {
-+
-+				strcat(krb5_ccname_dir_start, "/primary");
-+
-+				if (stat(krb5_ccname_dir_start, &krb5_ccname_stat) == 0) {
-+					if (unlink(krb5_ccname_dir_start) == 0) {
-+						krb5_ccname_dir_end = strrchr(krb5_ccname_dir_start, '/');
-+						*krb5_ccname_dir_end = '\0';
-+						if (rmdir(krb5_ccname_dir_start) == -1)
-+							debug("cache dir '%s' remove failed: %s",
-+							    krb5_ccname_dir_start, strerror(errno));
-+					}
-+					else
-+						debug("cache primary file '%s', remove failed: %s",
-+						    krb5_ccname_dir_start, strerror(errno));
-+				}
-+			}
-+		}
-+		krb5_cccol_cursor_free(ctx, &cursor);
- 	}
-+out:
- 	if (authctxt->krb5_user) {
- 		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
- 		authctxt->krb5_user = NULL;
-@@ -237,36 +281,188 @@ krb5_cleanup_proc(Authctxt *authctxt)
- 	}
- }
- 
-#ifndef HEIMDAL
-+
-+#if !defined(HEIMDAL)
-+int
-+ssh_asprintf_append(char **dsc, const char *fmt, ...) {
-+	char *src, *old;
-+	va_list ap;
-+	int i;
-+
-+	va_start(ap, fmt);
-+	i = vasprintf(&src, fmt, ap);
-+	va_end(ap);
-+
-+	if (i == -1 || src == NULL)
-+		return -1;
-+
-+	old = *dsc;
-+
-+	i = asprintf(dsc, "%s%s", *dsc, src);
-+	if (i == -1 || src == NULL) {
-+		free(src);
-+		return -1;
-+	}
-+
-+	free(old);
-+	free(src);
-+
-+	return i;
-+}
-+
-+int
-+ssh_krb5_expand_template(char **result, const char *template) {
-+	char *p_n, *p_o, *r, *tmp_template;
-+
-+	debug3("%s: called, template = %s", __func__, template);
-+	if (template == NULL)
-+		return -1;
-+
-+	tmp_template = p_n = p_o = xstrdup(template);
-+	r = xstrdup("");
-+
-+	while ((p_n = strstr(p_o, "%{")) != NULL) {
-+
-+		*p_n++ = '\0';
-+		if (ssh_asprintf_append(&r, "%s", p_o) == -1)
-+			goto cleanup;
-+
-+		if (strncmp(p_n, "{uid}", 5) == 0 || strncmp(p_n, "{euid}", 6) == 0 ||
-+			strncmp(p_n, "{USERID}", 8) == 0) {
-+			p_o = strchr(p_n, '}') + 1;
-+			if (ssh_asprintf_append(&r, "%d", geteuid()) == -1)
-+				goto cleanup;
-+			continue;
-+		}
-+		else if (strncmp(p_n, "{TEMP}", 6) == 0) {
-+			p_o = strchr(p_n, '}') + 1;
-+			if (ssh_asprintf_append(&r, "/tmp") == -1)
-+				goto cleanup;
-+			continue;
-+		} else {
-+			p_o = strchr(p_n, '}') + 1;
-+			*p_o = '\0';
-+			debug("%s: unsupported token %s in %s", __func__, p_n, template);
-+			/* unknown token, fallback to the default */
-+			goto cleanup;
-+		}
-+	}
-+
-+	if (ssh_asprintf_append(&r, "%s", p_o) == -1)
-+		goto cleanup;
-+
-+	*result = r;
-+	free(tmp_template);
-+	return 0;
-+
-+cleanup:
-+	free(r);
-+	free(tmp_template);
-+	return -1;
-+}
-+
- krb5_error_code
-ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
-	int tmpfd, ret, oerrno;
-	char ccname[40];
-+ssh_krb5_get_cctemplate(krb5_context ctx, char **ccname) {
-+	profile_t p;
-+	int ret = 0;
-+	char *value = NULL;
-+
-+	debug3("%s: called", __func__);
-+	ret = krb5_get_profile(ctx, &p);
-+	if (ret)
-+		return ret;
-+
-+	ret = profile_get_string(p, "libdefaults", "default_ccache_name", NULL, NULL, &value);
-+	if (ret || !value)
-+		return ret;
-+
-+	ret = ssh_krb5_expand_template(ccname, value);
-+
-+	debug3("%s: returning with ccname = %s", __func__, *ccname);
-+	return ret;
-+}
-+
-+krb5_error_code
-+ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environment) {
-+	int tmpfd, ret, oerrno, type_len;
-+	char *ccname = NULL;
- 	mode_t old_umask;
-+	char *type = NULL, *colon = NULL;
- 
-	ret = snprintf(ccname, sizeof(ccname),
-	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
-	if (ret < 0 || (size_t)ret >= sizeof(ccname))
-		return ENOMEM;
-
-	old_umask = umask(0177);
-	tmpfd = mkstemp(ccname + strlen("FILE:"));
-	oerrno = errno;
-	umask(old_umask);
-	if (tmpfd == -1) {
-		logit("mkstemp(): %.100s", strerror(oerrno));
-		return oerrno;
-	}
-+	debug3("%s: called", __func__);
-+	if (need_environment)
-+		*need_environment = 0;
-+	ret = ssh_krb5_get_cctemplate(ctx, &ccname);
-+	if (ret || !ccname || options.kerberos_unique_ccache) {
-+		/* Otherwise, go with the old method */
-+		if (ccname)
-+			free(ccname);
-+		ccname = NULL;
-+
-+		ret = asprintf(&ccname,
-+		    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
-+		if (ret < 0)
-+			return ENOMEM;
- 
-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
-+		old_umask = umask(0177);
-+		tmpfd = mkstemp(ccname + strlen("FILE:"));
- 		oerrno = errno;
-		logit("fchmod(): %.100s", strerror(oerrno));
-+		umask(old_umask);
-+		if (tmpfd == -1) {
-+			logit("mkstemp(): %.100s", strerror(oerrno));
-+			return oerrno;
-+		}
-+
-+		if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
-+			oerrno = errno;
-+			logit("fchmod(): %.100s", strerror(oerrno));
-+			close(tmpfd);
-+			return oerrno;
-+		}
-+		/* make sure the KRB5CCNAME is set for non-standard location */
-+		if (need_environment)
-+			*need_environment = 1;
- 		close(tmpfd);
-		return oerrno;
- 	}
-	close(tmpfd);
- 
-	return (krb5_cc_resolve(ctx, ccname, ccache));
-+	debug3("%s: setting default ccname to %s", __func__, ccname);
-+	/* set the default with already expanded user IDs */
-+	ret = krb5_cc_set_default_name(ctx, ccname);
-+	if (ret)
-+		return ret;
-+
-+	if ((colon = strstr(ccname, ":")) != NULL) {
-+		type_len = colon - ccname;
-+		type = malloc((type_len + 1) * sizeof(char));
-+		if (type == NULL)
-+			return ENOMEM;
-+		strncpy(type, ccname, type_len);
-+		type[type_len] = 0;
-+	} else {
-+		type = strdup(ccname);
-+	}
-+
-+	/* If we have a credential cache from krb5.conf, we need to switch
-+	 * a primary cache for this collection, if it supports that (non-FILE)
-+	 */
-+	if (krb5_cc_support_switch(ctx, type)) {
-+		debug3("%s: calling cc_new_unique(%s)", __func__, ccname);
-+		ret = krb5_cc_new_unique(ctx, type, NULL, ccache);
-+		free(type);
-+		if (ret)
-+			return ret;
-+
-+		debug3("%s: calling cc_switch()", __func__);
-+		return krb5_cc_switch(ctx, *ccache);
-+	} else {
-+		/* Otherwise, we can not create a unique ccname here (either
-+		 * it is already unique from above or the type does not support
-+		 * collections
-+		 */
-+		free(type);
-+		debug3("%s: calling cc_resolve(%s)", __func__, ccname);
-+		return (krb5_cc_resolve(ctx, ccname, ccache));
-+	}
- }
- #endif /* !HEIMDAL */
- #endif /* KRB5 */
-diff --git a/auth.h b/auth.h
-index 29491df9..fdab5040 100644
--- a/auth.h
-+++ b/auth.h
-@@ -82,6 +82,7 @@ struct Authctxt {
- 	krb5_principal	 krb5_user;
- 	char		*krb5_ticket_file;
- 	char		*krb5_ccname;
-+	int		 krb5_set_env;
- #endif
- 	struct sshbuf	*loginmsg;
- 
-@@ -238,7 +239,7 @@ int	 sys_auth_passwd(struct ssh *, const char *);
- int	 sys_auth_passwd(struct ssh *, const char *);
- 
- #if defined(KRB5) && !defined(HEIMDAL)
-krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
-+krb5_error_code ssh_krb5_cc_new_unique(krb5_context, krb5_ccache *, int *);
- #endif
- 
- #endif /* AUTH_H */
-diff -up openssh-7.9p1/gss-serv-krb5.c.ccache_name openssh-7.9p1/gss-serv-krb5.c
--- openssh-7.9p1/gss-serv-krb5.c.ccache_name	2019-03-01 15:17:42.708611802 +0100
-+++ openssh-7.9p1/gss-serv-krb5.c	2019-03-01 15:17:42.713611844 +0100
-@@ -267,7 +267,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
- /* This writes out any forwarded credentials from the structure populated
-  * during userauth. Called after we have setuid to the user */
- 
-static void
-+static int
- ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
- {
- 	krb5_ccache ccache;
-@@ -276,14 +276,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
- 	OM_uint32 maj_status, min_status;
- 	const char *new_ccname, *new_cctype;
- 	const char *errmsg;
-+	int set_env = 0;
- 
- 	if (client->creds == NULL) {
- 		debug("No credentials stored");
-		return;
-+		return 0;
- 	}
- 
- 	if (ssh_gssapi_krb5_init() == 0)
-		return;
-+		return 0;
- 
- #ifdef HEIMDAL
- # ifdef HAVE_KRB5_CC_NEW_UNIQUE
-@@ -297,14 +298,14 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
- 		krb5_get_err_text(krb_context, problem));
- # endif
- 		krb5_free_error_message(krb_context, errmsg);
-		return;
-+		return 0;
- 	}
- #else
-	if ((problem = ssh_krb5_cc_gen(krb_context, &ccache))) {
-+	if ((problem = ssh_krb5_cc_new_unique(krb_context, &ccache, &set_env)) != 0) {
- 		errmsg = krb5_get_error_message(krb_context, problem);
-		logit("ssh_krb5_cc_gen(): %.100s", errmsg);
-+		logit("ssh_krb5_cc_new_unique(): %.100s", errmsg);
- 		krb5_free_error_message(krb_context, errmsg);
-		return;
-+		return 0;
- 	}
- #endif	/* #ifdef HEIMDAL */
- 
-@@ -313,7 +314,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
- 		errmsg = krb5_get_error_message(krb_context, problem);
- 		logit("krb5_parse_name(): %.100s", errmsg);
- 		krb5_free_error_message(krb_context, errmsg);
-		return;
-+		return 0;
- 	}
- 
- 	if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
-@@ -322,7 +323,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
- 		krb5_free_error_message(krb_context, errmsg);
- 		krb5_free_principal(krb_context, princ);
- 		krb5_cc_destroy(krb_context, ccache);
-		return;
-+		return 0;
- 	}
- 
- 	krb5_free_principal(krb_context, princ);
-@@ -331,32 +332,21 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
- 	    client->creds, ccache))) {
- 		logit("gss_krb5_copy_ccache() failed");
- 		krb5_cc_destroy(krb_context, ccache);
-		return;
-+		return 0;
- 	}
- 
- 	new_cctype = krb5_cc_get_type(krb_context, ccache);
- 	new_ccname = krb5_cc_get_name(krb_context, ccache);
-
-	client->store.envvar = "KRB5CCNAME";
-#ifdef USE_CCAPI
-	xasprintf(&client->store.envval, "API:%s", new_ccname);
-	client->store.filename = NULL;
-#else
-	if (new_ccname[0] == ':')
-		new_ccname++;
- 	xasprintf(&client->store.envval, "%s:%s", new_cctype, new_ccname);
-	if (strcmp(new_cctype, "DIR") == 0) {
-		char *p;
-		p = strrchr(client->store.envval, '/');
-		if (p)
-			*p = '\0';
-+
-+	if (set_env) {
-+		client->store.envvar = "KRB5CCNAME";
- 	}
- 	if ((strcmp(new_cctype, "FILE") == 0) || (strcmp(new_cctype, "DIR") == 0))
- 		client->store.filename = xstrdup(new_ccname);
-#endif
- 
- #ifdef USE_PAM
-	if (options.use_pam)
-+	if (options.use_pam && set_env)
- 		do_pam_putenv(client->store.envvar, client->store.envval);
- #endif
- 
-@@ -361,7 +355,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
- 
- 	client->store.data = krb_context;
- 
-	return;
-+	return set_env;
- }
- 
- int
-diff --git a/gss-serv.c b/gss-serv.c
-index 6cae720e..16e55cbc 100644
--- a/gss-serv.c
-+++ b/gss-serv.c
-@@ -320,13 +320,15 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- }
- 
- /* As user */
-void
-+int
- ssh_gssapi_storecreds(void)
- {
- 	if (gssapi_client.mech && gssapi_client.mech->storecreds) {
-		(*gssapi_client.mech->storecreds)(&gssapi_client);
-+		return (*gssapi_client.mech->storecreds)(&gssapi_client);
- 	} else
- 		debug("ssh_gssapi_storecreds: Not a GSSAPI mechanism");
-+
-+	return 0;
- }
- 
- /* This allows GSSAPI methods to do things to the child's environment based
-@@ -498,9 +500,7 @@ ssh_gssapi_rekey_creds() {
- 	char *envstr;
- #endif
- 
-	if (gssapi_client.store.filename == NULL &&
-	    gssapi_client.store.envval == NULL &&
-	    gssapi_client.store.envvar == NULL)
-+	if (gssapi_client.store.envval == NULL)
- 		return;
- 
- 	ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store));
-diff -up openssh-7.9p1/servconf.c.ccache_name openssh-7.9p1/servconf.c
--- openssh-7.9p1/servconf.c.ccache_name	2019-03-01 15:17:42.704611768 +0100
-+++ openssh-7.9p1/servconf.c	2019-03-01 15:17:42.713611844 +0100
-@@ -123,6 +123,7 @@ initialize_server_options(ServerOptions
- 	options->kerberos_or_local_passwd = -1;
- 	options->kerberos_ticket_cleanup = -1;
- 	options->kerberos_get_afs_token = -1;
-+	options->kerberos_unique_ccache = -1;
- 	options->gss_authentication=-1;
- 	options->gss_keyex = -1;
- 	options->gss_cleanup_creds = -1;
-@@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options)
- 		options->kerberos_ticket_cleanup = 1;
- 	if (options->kerberos_get_afs_token == -1)
- 		options->kerberos_get_afs_token = 0;
-+	if (options->kerberos_unique_ccache == -1)
-+		options->kerberos_unique_ccache = 0;
- 	if (options->gss_authentication == -1)
- 		options->gss_authentication = 0;
- 	if (options->gss_keyex == -1)
-@@ -447,7 +450,8 @@ typedef enum {
- 	sPermitRootLogin, sLogFacility, sLogLevel,
- 	sRhostsRSAAuthentication, sRSAAuthentication,
- 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-	sKerberosGetAFSToken, sChallengeResponseAuthentication,
-+	sKerberosGetAFSToken, sKerberosUniqueCCache,
-+	sChallengeResponseAuthentication,
- 	sPasswordAuthentication, sKbdInteractiveAuthentication,
- 	sListenAddress, sAddressFamily,
- 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-@@ -526,11 +530,13 @@ static struct {
- #else
- 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
- #endif
-+	{ "kerberosuniqueccache", sKerberosUniqueCCache, SSHCFG_GLOBAL },
- #else
- 	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
- 	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
- 	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
- 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
-+	{ "kerberosuniqueccache", sUnsupported, SSHCFG_GLOBAL },
- #endif
- 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
- 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1437,6 +1443,10 @@ process_server_config_line(ServerOptions *options, char *line,
- 		intptr = &options->kerberos_get_afs_token;
- 		goto parse_flag;
- 
-+	case sKerberosUniqueCCache:
-+		intptr = &options->kerberos_unique_ccache;
-+		goto parse_flag;
-+
- 	case sGssAuthentication:
- 		intptr = &options->gss_authentication;
- 		goto parse_flag;
-@@ -2507,6 +2517,7 @@ dump_config(ServerOptions *o)
- # ifdef USE_AFS
- 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
- # endif
-+	dump_cfg_fmtint(sKerberosUniqueCCache, o->kerberos_unique_ccache);
- #endif
- #ifdef GSSAPI
- 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
-diff --git a/servconf.h b/servconf.h
-index db8362c6..4fa42d64 100644
--- a/servconf.h
-+++ b/servconf.h
-@@ -123,6 +123,8 @@ typedef struct {
- 						 * file on logout. */
- 	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
- 						 * authenticated with Kerberos. */
-+	int     kerberos_unique_ccache;		/* If true, the acquired ticket will
-+						 * be stored in per-session ccache */
- 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
- 	int     gss_keyex;		/* If true, permit GSSAPI key exchange */
- 	int     gss_cleanup_creds;	/* If true, destroy cred cache on logout */
-diff --git a/session.c b/session.c
-index 85df6a27..480a5ead 100644
--- a/session.c
-+++ b/session.c
-@@ -1033,7 +1033,8 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
- 	/* Allow any GSSAPI methods that we've used to alter
- 	 * the child's environment as they see fit
- 	 */
-	ssh_gssapi_do_child(&env, &envsize);
-+	if (s->authctxt->krb5_set_env)
-+		ssh_gssapi_do_child(&env, &envsize);
- #endif
- 
- 	/* Set basic environment. */
-@@ -1105,7 +1106,7 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
- 	}
- #endif
- #ifdef KRB5
-	if (s->authctxt->krb5_ccname)
-+	if (s->authctxt->krb5_ccname && s->authctxt->krb5_set_env)
- 		child_set_env(&env, &envsize, "KRB5CCNAME",
- 		    s->authctxt->krb5_ccname);
- #endif
-diff --git a/ssh-gss.h b/ssh-gss.h
-index 6593e422..245178af 100644
--- a/ssh-gss.h
-+++ b/ssh-gss.h
-@@ -83,7 +82,7 @@ typedef struct ssh_gssapi_mech_struct {
- 	int (*dochild) (ssh_gssapi_client *);
- 	int (*userok) (ssh_gssapi_client *, char *);
- 	int (*localname) (ssh_gssapi_client *, char **);
-	void (*storecreds) (ssh_gssapi_client *);
-+	int (*storecreds) (ssh_gssapi_client *);
- 	int (*updatecreds) (ssh_gssapi_ccache *, ssh_gssapi_client *);
- } ssh_gssapi_mech;
- 
-@@ -127,7 +126,7 @@ int ssh_gssapi_userok(char *name);
- OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_do_child(char ***, u_int *);
- void ssh_gssapi_cleanup_creds(void);
-void ssh_gssapi_storecreds(void);
-+int ssh_gssapi_storecreds(void);
- const char *ssh_gssapi_displayname(void);
- 
- char *ssh_gssapi_server_mechanisms(void);
-diff --git a/sshd.c b/sshd.c
-index edbe815c..89514e8a 100644
--- a/sshd.c
-+++ b/sshd.c
-@@ -2162,7 +2162,7 @@ main(int ac, char **av)
- #ifdef GSSAPI
- 	if (options.gss_authentication) {
- 		temporarily_use_uid(authctxt->pw);
-		ssh_gssapi_storecreds();
-+		authctxt->krb5_set_env = ssh_gssapi_storecreds();
- 		restore_uid();
- 	}
- #endif
-diff --git a/sshd_config.5 b/sshd_config.5
-index c0683d4a..2349f477 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -860,6 +860,14 @@ Specifies whether to automatically destroy the user's ticket cache
- file on logout.
- The default is
- .Cm yes .
-+.It Cm KerberosUniqueCCache
-+Specifies whether to store the acquired tickets in the per-session credential
-+cache under /tmp/ or whether to use per-user credential cache as configured in
-+.Pa /etc/krb5.conf .
-+The default value
-+.Cm no
-+can lead to overwriting previous tickets by subseqent connections to the same
-+user account.
- .It Cm KexAlgorithms
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
--- a/openssh-7.7p1-redhat.patch
+++ b/openssh-7.7p1-redhat.patch
@ -1,117 +0,0 @@
-diff -up openssh/ssh_config.redhat openssh/ssh_config
--- openssh/ssh_config.redhat	2020-02-11 23:28:35.000000000 +0100
-+++ openssh/ssh_config	2020-02-13 18:13:39.180641839 +0100
-@@ -43,3 +43,10 @@
- #   ProxyCommand ssh -q -W %h:%p gateway.example.com
- #   RekeyLimit 1G 1h
- #   UserKnownHostsFile ~/.ssh/known_hosts.d/%k
-+#
-+# This system is following system-wide crypto policy.
-+# To modify the crypto properties (Ciphers, MACs, ...), create a  *.conf
-+#  file under  /etc/ssh/ssh_config.d/  which will be automatically
-+# included below. For more information, see manual page for
-+#  update-crypto-policies(8)  and  ssh_config(5).
-+Include /etc/ssh/ssh_config.d/*.conf
-diff -up openssh/ssh_config_redhat.redhat openssh/ssh_config_redhat
--- openssh/ssh_config_redhat.redhat	2020-02-13 18:13:39.180641839 +0100
-+++ openssh/ssh_config_redhat	2020-02-13 18:13:39.180641839 +0100
-@@ -0,0 +1,21 @@
-+# The options here are in the "Match final block" to be applied as the last
-+# options and could be potentially overwritten by the user configuration
-+Match final all
-+	# Follow system-wide Crypto Policy, if defined:
-+	Include /etc/crypto-policies/back-ends/openssh.config
-+
-+	GSSAPIAuthentication yes
-+
-+# If this option is set to yes then remote X11 clients will have full access
-+# to the original X11 display. As virtually no X11 client supports the untrusted
-+# mode correctly we set this to yes.
-+	ForwardX11Trusted yes
-+
-+# Send locale-related environment variables
-+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
-+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
-+	SendEnv XMODIFIERS
-+
-+# Uncomment this if you want to use .local domain
-+# Host *.local
-diff -up openssh/sshd_config.0.redhat openssh/sshd_config.0
--- openssh/sshd_config.0.redhat	2020-02-12 14:30:04.000000000 +0100
-+++ openssh/sshd_config.0	2020-02-13 18:13:39.181641855 +0100
-@@ -970,9 +970,9 @@ DESCRIPTION
- 
-      SyslogFacility
-              Gives the facility code that is used when logging messages from
-             sshd(8).  The possible values are: DAEMON, USER, AUTH, LOCAL0,
-             LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
-             default is AUTH.
-+             sshd(8).  The possible values are: DAEMON, USER, AUTH, AUTHPRIV,
-+             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
-+             The default is AUTH.
- 
-      TCPKeepAlive
-              Specifies whether the system should send TCP keepalive messages
-diff -up openssh/sshd_config.5.redhat openssh/sshd_config.5
--- openssh/sshd_config.5.redhat	2020-02-11 23:28:35.000000000 +0100
-+++ openssh/sshd_config.5	2020-02-13 18:13:39.181641855 +0100
-@@ -1614,7 +1614,7 @@ By default no subsystems are defined.
- .It Cm SyslogFacility
- Gives the facility code that is used when logging messages from
- .Xr sshd 8 .
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
-+The possible values are: DAEMON, USER, AUTH, AUTHPRIV, LOCAL0, LOCAL1, LOCAL2,
- LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
- The default is AUTH.
- .It Cm TCPKeepAlive
-diff -up openssh/sshd_config.redhat openssh/sshd_config
--- openssh/sshd_config.redhat	2020-02-11 23:28:35.000000000 +0100
-+++ openssh/sshd_config	2020-02-13 18:20:16.349913681 +0100
-@@ -10,6 +10,14 @@
- # possible, but leave them commented.  Uncommented options override the
- # default value.
-
-+# To modify the system-wide sshd configuration, create a  *.conf  file under
-+#  /etc/ssh/sshd_config.d/  which will be automatically included below
-+Include /etc/ssh/sshd_config.d/*.conf
-+
-+# If you want to change the port on a SELinux system, you have to tell
-+# SELinux about this change.
-+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
-+#
- #Port 22
- #AddressFamily any
- #ListenAddress 0.0.0.0
-diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
--- openssh/sshd_config_redhat.redhat	2020-02-13 18:14:02.268006439 +0100
-+++ openssh/sshd_config_redhat	2020-02-13 18:19:20.765035947 +0100
-@@ -0,0 +1,28 @@
-+# This system is following system-wide crypto policy. The changes to
-+# crypto properties (Ciphers, MACs, ...) will not have any effect in
-+# this or following included files. To override some configuration option,
-+# write it before this block or include it before this file.
-+# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
-+Include /etc/crypto-policies/back-ends/opensshserver.config
-+
-+SyslogFacility AUTHPRIV
-+
-+ChallengeResponseAuthentication no
-+
-+GSSAPIAuthentication yes
-+GSSAPICleanupCredentials no
-+
-+UsePAM yes
-+
-+X11Forwarding yes
-+
-+# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
-+# as it is more configurable and versatile than the built-in version.
-+PrintMotd no
-+
-+# Accept locale-related environment variables
-+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
-+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
-+AcceptEnv XMODIFIERS
-+
--- a/openssh-7.8p1-scp-ipv6.patch
+++ b/openssh-7.8p1-scp-ipv6.patch
@ -1,16 +0,0 @@
-diff --git a/scp.c b/scp.c
-index 60682c68..9344806e 100644
--- a/scp.c
-+++ b/scp.c
-@@ -714,7 +714,9 @@ toremote(int argc, char **argv)
- 			addargs(&alist, "%s", host);
- 			addargs(&alist, "%s", cmd);
- 			addargs(&alist, "%s", src);
-			addargs(&alist, "%s%s%s:%s",
-+			addargs(&alist,
-+			    /* IPv6 address needs to be enclosed with sqare brackets */
-+			    strchr(host, ':') != NULL ? "%s%s[%s]:%s" : "%s%s%s:%s",
- 			    tuser ? tuser : "", tuser ? "@" : "",
- 			    thost, targ);
- 			if (do_local_cmd(&alist) != 0)
-
--- a/openssh-7.9p1-ssh-copy-id.patch
+++ b/openssh-7.9p1-ssh-copy-id.patch
@ -1,27 +0,0 @@
-From 22bfdcf060b632b5a6ff603f8f42ff166c211a66 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 29 Sep 2020 10:02:45 +0000
-Subject: [PATCH] Fail hard on the first failed attempt to write the
- authorized_keys_file
-
---
- ssh-copy-id | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
-index 392f64f..e69a23f 100755
--- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -251,7 +251,7 @@ installkeys_sh() {
- 	cd;
- 	umask 077;
- 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
-	  { [ -z \`tail -1c ${AUTH_KEY_FILE} 2>/dev/null\` ] || echo >> ${AUTH_KEY_FILE}; } &&
-+	  { [ -z \`tail -1c ${AUTH_KEY_FILE} 2>/dev/null\` ] || echo >> ${AUTH_KEY_FILE} || exit 1; } &&
- 	  cat >> ${AUTH_KEY_FILE} ||
- 	  exit 1;
- 	if type restorecon >/dev/null 2>&1; then
-- 
-GitLab
-
-
--- a/openssh-8.0p1-crypto-policies.patch
+++ b/openssh-8.0p1-crypto-policies.patch
@ -1,502 +0,0 @@
-diff -up openssh-8.2p1/ssh_config.5.crypto-policies openssh-8.2p1/ssh_config.5
--- openssh-8.2p1/ssh_config.5.crypto-policies	2020-03-26 14:40:44.546775605 +0100
-+++ openssh-8.2p1/ssh_config.5	2020-03-26 14:52:20.700649727 +0100
-@@ -359,17 +359,17 @@ or
- .Qq *.c.example.com
- domains.
- .It Cm CASignatureAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies which algorithms are allowed for signing of certificates
- by certificate authorities (CAs).
-The default is:
-.Bd -literal -offset indent
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
-.Ed
-.Pp
- .Xr ssh 1
- will not accept host certificates signed using algorithms other than those
- specified.
-+.Pp
- .It Cm CertificateFile
- Specifies a file from which the user's certificate is read.
- A corresponding private key must be provided separately in order
-@@ -424,20 +424,25 @@ If the option is set to
- .Cm no ,
- the check will not be executed.
- .It Cm Ciphers
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the ciphers allowed and their order of preference.
- Multiple ciphers must be comma-separated.
- If the specified list begins with a
- .Sq +
-character, then the specified ciphers will be appended to the default set
-instead of replacing them.
-+character, then the specified ciphers will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified ciphers (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified ciphers will be placed at the head of the
-default set.
-+built-in openssh default set.
- .Pp
- The supported ciphers are:
- .Bd -literal -offset indent
-@@ -453,13 +458,6 @@ aes256-gcm@openssh.com
- chacha20-poly1305@openssh.com
- .Ed
- .Pp
-The default is:
-.Bd -literal -offset indent
-chacha20-poly1305@openssh.com,
-aes128-ctr,aes192-ctr,aes256-ctr,
-aes128-gcm@openssh.com,aes256-gcm@openssh.com
-.Ed
-.Pp
- The list of available ciphers may also be obtained using
- .Qq ssh -Q cipher .
- .It Cm ClearAllForwardings
-@@ -812,6 +810,11 @@ command line will be passed untouched to
- The default is
- .Dq no .
- .It Cm GSSAPIKexAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- The list of key exchange algorithms that are offered for GSSAPI
- key exchange. Possible values are
- .Bd -literal -offset 3n
-@@ -824,10 +827,8 @@ gss-nistp256-sha256-,
- gss-curve25519-sha256-
- .Ed
- .Pp
-The default is
-.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
-gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
- This option only applies to connections using GSSAPI.
-+.Pp
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
-@@ -1149,29 +1150,25 @@ it may be zero or more of:
- and
- .Cm pam .
- .It Cm KexAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
- If the specified list begins with a
- .Sq +
-character, then the specified methods will be appended to the default set
-instead of replacing them.
-+character, then the specified methods will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified methods (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified methods will be placed at the head of the
-default set.
-The default is:
-.Bd -literal -offset indent
-curve25519-sha256,curve25519-sha256@libssh.org,
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
-diffie-hellman-group-exchange-sha256,
-diffie-hellman-group16-sha512,
-diffie-hellman-group18-sha512,
-diffie-hellman-group14-sha256
-.Ed
-+built-in openssh default set.
- .Pp
- The list of available key exchange algorithms may also be obtained using
- .Qq ssh -Q kex .
-@@ -1231,37 +1228,33 @@ The default is INFO.
- DEBUG and DEBUG1 are equivalent.
- DEBUG2 and DEBUG3 each specify higher levels of verbose output.
- .It Cm MACs
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the MAC (message authentication code) algorithms
- in order of preference.
- The MAC algorithm is used for data integrity protection.
- Multiple algorithms must be comma-separated.
- If the specified list begins with a
- .Sq +
-character, then the specified algorithms will be appended to the default set
-instead of replacing them.
-+character, then the specified algorithms will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified algorithms (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified algorithms will be placed at the head of the
-default set.
-+built-in openssh default set.
- .Pp
- The algorithms that contain
- .Qq -etm
- calculate the MAC after encryption (encrypt-then-mac).
- These are considered safer and their use recommended.
- .Pp
-The default is:
-.Bd -literal -offset indent
-umac-64-etm@openssh.com,umac-128-etm@openssh.com,
-hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
-hmac-sha1-etm@openssh.com,
-umac-64@openssh.com,umac-128@openssh.com,
-hmac-sha2-256,hmac-sha2-512,hmac-sha1
-.Ed
-.Pp
- The list of available MAC algorithms may also be obtained using
- .Qq ssh -Q mac .
- .It Cm NoHostAuthenticationForLocalhost
-@@ -1394,36 +1387,25 @@ instead of continuing to execute and pas
- The default is
- .Cm no .
- .It Cm PubkeyAcceptedKeyTypes
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the key types that will be used for public key authentication
- as a comma-separated list of patterns.
- If the specified list begins with a
- .Sq +
-character, then the key types after it will be appended to the default
-instead of replacing it.
-+character, then the key types after it will be appended to the built-in
-+openssh default instead of replacing it.
- If the specified list begins with a
- .Sq -
- character, then the specified key types (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified key types will be placed at the head of the
-default set.
-The default for this option is:
-.Bd -literal -offset 3n
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-ssh-ed25519-cert-v01@openssh.com,
-sk-ssh-ed25519-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
-ssh-rsa-cert-v01@openssh.com,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ecdsa-sha2-nistp256@openssh.com,
-ssh-ed25519,sk-ssh-ed25519@openssh.com,
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
-.Ed
-+built-in openssh default set.
- .Pp
- The list of available key types may also be obtained using
- .Qq ssh -Q PubkeyAcceptedKeyTypes .
-diff -up openssh-8.2p1/sshd_config.5.crypto-policies openssh-8.2p1/sshd_config.5
--- openssh-8.2p1/sshd_config.5.crypto-policies	2020-03-26 14:40:44.530775355 +0100
-+++ openssh-8.2p1/sshd_config.5	2020-03-26 14:48:56.732468099 +0100
-@@ -375,16 +375,16 @@ If the argument is
- then no banner is displayed.
- By default, no banner is displayed.
- .It Cm CASignatureAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies which algorithms are allowed for signing of certificates
- by certificate authorities (CAs).
-The default is:
-.Bd -literal -offset indent
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
-.Ed
-.Pp
- Certificates signed using other algorithms will not be accepted for
- public key or host-based authentication.
-+.Pp
- .It Cm ChallengeResponseAuthentication
- Specifies whether challenge-response authentication is allowed (e.g. via
- PAM or through authentication styles supported in
-@@ -446,20 +446,25 @@ The default is
- indicating not to
- .Xr chroot 2 .
- .It Cm Ciphers
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the ciphers allowed.
- Multiple ciphers must be comma-separated.
- If the specified list begins with a
- .Sq +
-character, then the specified ciphers will be appended to the default set
-instead of replacing them.
-+character, then the specified ciphers will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified ciphers (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified ciphers will be placed at the head of the
-default set.
-+built-in openssh default set.
- .Pp
- The supported ciphers are:
- .Pp
-@@ -486,13 +491,6 @@ aes256-gcm@openssh.com
- chacha20-poly1305@openssh.com
- .El
- .Pp
-The default is:
-.Bd -literal -offset indent
-chacha20-poly1305@openssh.com,
-aes128-ctr,aes192-ctr,aes256-ctr,
-aes128-gcm@openssh.com,aes256-gcm@openssh.com
-.Ed
-.Pp
- The list of available ciphers may also be obtained using
- .Qq ssh -Q cipher .
- .It Cm ClientAliveCountMax
-@@ -681,22 +679,24 @@ For this to work
- .Cm GSSAPIKeyExchange
- needs to be enabled in the server and also used by the client.
- .It Cm GSSAPIKexAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- The list of key exchange algorithms that are accepted by GSSAPI
- key exchange. Possible values are
- .Bd -literal -offset 3n
-gss-gex-sha1-,
-gss-group1-sha1-,
-gss-group14-sha1-,
-gss-group14-sha256-,
-gss-group16-sha512-,
-gss-nistp256-sha256-,
-+gss-gex-sha1-
-+gss-group1-sha1-
-+gss-group14-sha1-
-+gss-group14-sha256-
-+gss-group16-sha512-
-+gss-nistp256-sha256-
- gss-curve25519-sha256-
- .Ed
-.Pp
-The default is
-.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
-gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
- This option only applies to connections using GSSAPI.
-+.Pp
- .It Cm HostbasedAcceptedKeyTypes
- Specifies the key types that will be accepted for hostbased authentication
- as a list of comma-separated patterns.
-@@ -793,25 +793,13 @@ is specified, the location of the socket
- .Ev SSH_AUTH_SOCK
- environment variable.
- .It Cm HostKeyAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the host key algorithms
- that the server offers.
-The default for this option is:
-.Bd -literal -offset 3n
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-ssh-ed25519-cert-v01@openssh.com,
-sk-ssh-ed25519-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
-ssh-rsa-cert-v01@openssh.com,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ecdsa-sha2-nistp256@openssh.com,
-ssh-ed25519,sk-ssh-ed25519@openssh.com,
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
-.Ed
-.Pp
- The list of available key types may also be obtained using
- .Qq ssh -Q HostKeyAlgorithms .
- .It Cm IgnoreRhosts
-@@ -943,20 +931,25 @@ Specifies whether to look at .k5login fi
- The default is
- .Cm yes .
- .It Cm KexAlgorithms
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
- Alternately if the specified list begins with a
- .Sq +
-character, then the specified methods will be appended to the default set
-instead of replacing them.
-+character, then the specified methods will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified methods (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified methods will be placed at the head of the
-default set.
-+built-in openssh default set.
- The supported algorithms are:
- .Pp
- .Bl -item -compact -offset indent
-@@ -988,15 +981,6 @@ ecdh-sha2-nistp521
- sntrup4591761x25519-sha512@tinyssh.org
- .El
- .Pp
-The default is:
-.Bd -literal -offset indent
-curve25519-sha256,curve25519-sha256@libssh.org,
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
-diffie-hellman-group-exchange-sha256,
-diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
-diffie-hellman-group14-sha256
-.Ed
-.Pp
- The list of available key exchange algorithms may also be obtained using
- .Qq ssh -Q KexAlgorithms .
- .It Cm ListenAddress
-@@ -1065,21 +1049,26 @@ DEBUG and DEBUG1 are equivalent.
- DEBUG2 and DEBUG3 each specify higher levels of debugging output.
- Logging with a DEBUG level violates the privacy of users and is not recommended.
- .It Cm MACs
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the available MAC (message authentication code) algorithms.
- The MAC algorithm is used for data integrity protection.
- Multiple algorithms must be comma-separated.
- If the specified list begins with a
- .Sq +
-character, then the specified algorithms will be appended to the default set
-instead of replacing them.
-+character, then the specified algorithms will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified algorithms (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified algorithms will be placed at the head of the
-default set.
-+built-in openssh default set.
- .Pp
- The algorithms that contain
- .Qq -etm
-@@ -1122,15 +1111,6 @@ umac-64-etm@openssh.com
- umac-128-etm@openssh.com
- .El
- .Pp
-The default is:
-.Bd -literal -offset indent
-umac-64-etm@openssh.com,umac-128-etm@openssh.com,
-hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
-hmac-sha1-etm@openssh.com,
-umac-64@openssh.com,umac-128@openssh.com,
-hmac-sha2-256,hmac-sha2-512,hmac-sha1
-.Ed
-.Pp
- The list of available MAC algorithms may also be obtained using
- .Qq ssh -Q mac .
- .It Cm Match
-@@ -1480,36 +1460,25 @@ or equivalent.)
- The default is
- .Cm yes .
- .It Cm PubkeyAcceptedKeyTypes
-+The default is handled system-wide by
-+.Xr crypto-policies 7 .
-+To see the defaults and how to modify this default, see manual page
-+.Xr update-crypto-policies 8 .
-+.Pp
- Specifies the key types that will be accepted for public key authentication
- as a list of comma-separated patterns.
- Alternately if the specified list begins with a
- .Sq +
-character, then the specified key types will be appended to the default set
-instead of replacing them.
-+character, then the specified key types will be appended to the built-in
-+openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq -
- character, then the specified key types (including wildcards) will be removed
-from the default set instead of replacing them.
-+from the built-in openssh default set instead of replacing them.
- If the specified list begins with a
- .Sq ^
- character, then the specified key types will be placed at the head of the
-default set.
-The default for this option is:
-.Bd -literal -offset 3n
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
-ssh-ed25519-cert-v01@openssh.com,
-sk-ssh-ed25519-cert-v01@openssh.com,
-rsa-sha2-512-cert-v01@openssh.com,
-rsa-sha2-256-cert-v01@openssh.com,
-ssh-rsa-cert-v01@openssh.com,
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
-sk-ecdsa-sha2-nistp256@openssh.com,
-ssh-ed25519,sk-ssh-ed25519@openssh.com,
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
-.Ed
-+built-in openssh default set.
- .Pp
- The list of available key types may also be obtained using
- .Qq ssh -Q PubkeyAcceptedKeyTypes .
--- a/openssh-8.0p1-gssapi-keyex.patch
+++ b/openssh-8.0p1-gssapi-keyex.patch
--- a/openssh-8.0p1-openssl-evp.patch
+++ b/openssh-8.0p1-openssl-evp.patch
@ -1,720 +0,0 @@
-From ed7ec0cdf577ffbb0b15145340cf51596ca3eb89 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 14 May 2019 10:45:45 +0200
-Subject: [PATCH] Use high-level OpenSSL API for signatures
-
---
- digest-openssl.c |  16 ++++
- digest.h         |   6 ++
- ssh-dss.c        |  65 ++++++++++------
- ssh-ecdsa.c      |  69 ++++++++++-------
- ssh-rsa.c        | 193 +++++++++--------------------------------------
- sshkey.c         |  77 +++++++++++++++++++
- sshkey.h         |   4 +
- 7 files changed, 221 insertions(+), 209 deletions(-)
-
-diff --git a/digest-openssl.c b/digest-openssl.c
-index da7ed72bc..6a21d8adb 100644
--- a/digest-openssl.c
-+++ b/digest-openssl.c
-@@ -63,6 +63,22 @@ const struct ssh_digest digests[] = {
- 	{ -1,			NULL,		0,	NULL },
- };
- 
-+const EVP_MD *
-+ssh_digest_to_md(int digest_type)
-+{
-+	switch (digest_type) {
-+	case SSH_DIGEST_SHA1:
-+		return EVP_sha1();
-+	case SSH_DIGEST_SHA256:
-+		return EVP_sha256();
-+	case SSH_DIGEST_SHA384:
-+		return EVP_sha384();
-+	case SSH_DIGEST_SHA512:
-+		return EVP_sha512();
-+	}
-+	return NULL;
-+}
-+
- static const struct ssh_digest *
- ssh_digest_by_alg(int alg)
- {
-diff --git a/digest.h b/digest.h
-index 274574d0e..c7ceeb36f 100644
--- a/digest.h
-+++ b/digest.h
-@@ -32,6 +32,12 @@
- struct sshbuf;
- struct ssh_digest_ctx;
- 
-+#ifdef WITH_OPENSSL
-+#include <openssl/evp.h>
-+/* Converts internal digest representation to the OpenSSL one */
-+const EVP_MD *ssh_digest_to_md(int digest_type);
-+#endif
-+
- /* Looks up a digest algorithm by name */
- int ssh_digest_alg_by_name(const char *name);
- 
-diff --git a/ssh-dss.c b/ssh-dss.c
-index a23c383dc..ea45e7275 100644
--- a/ssh-dss.c
-+++ b/ssh-dss.c
-@@ -52,11 +52,15 @@ int
- ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
-     const u_char *data, size_t datalen, u_int compat)
- {
-+	EVP_PKEY *pkey = NULL;
- 	DSA_SIG *sig = NULL;
- 	const BIGNUM *sig_r, *sig_s;
-	u_char digest[SSH_DIGEST_MAX_LENGTH], sigblob[SIGBLOB_LEN];
-	size_t rlen, slen, len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
-+	u_char sigblob[SIGBLOB_LEN];
-+	size_t rlen, slen;
-+	int len;
- 	struct sshbuf *b = NULL;
-+	u_char *sigb = NULL;
-+	const u_char *psig = NULL;
- 	int ret = SSH_ERR_INVALID_ARGUMENT;
- 
- 	if (lenp != NULL)
-@@ -67,17 +71,24 @@ ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 	if (key == NULL || key->dsa == NULL ||
- 	    sshkey_type_plain(key->type) != KEY_DSA)
- 		return SSH_ERR_INVALID_ARGUMENT;
-	if (dlen == 0)
-		return SSH_ERR_INTERNAL_ERROR;
- 
-	if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
-	    digest, sizeof(digest))) != 0)
-+	if ((pkey = EVP_PKEY_new()) == NULL ||
-+	    EVP_PKEY_set1_DSA(pkey, key->dsa) != 1)
-+		return SSH_ERR_ALLOC_FAIL;
-+	ret = sshkey_calculate_signature(pkey, SSH_DIGEST_SHA1, &sigb, &len,
-+	    data, datalen);
-+	EVP_PKEY_free(pkey);
-+	if (ret < 0) {
- 		goto out;
-+	}
- 
-	if ((sig = DSA_do_sign(digest, dlen, key->dsa)) == NULL) {
-+	psig = sigb;
-+	if ((sig = d2i_DSA_SIG(NULL, &psig, len)) == NULL) {
- 		ret = SSH_ERR_LIBCRYPTO_ERROR;
- 		goto out;
- 	}
-+	free(sigb);
-+	sigb = NULL;
- 
- 	DSA_SIG_get0(sig, &sig_r, &sig_s);
- 	rlen = BN_num_bytes(sig_r);
-@@ -110,7 +121,7 @@ ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 		*lenp = len;
- 	ret = 0;
-  out:
-	explicit_bzero(digest, sizeof(digest));
-+	free(sigb);
- 	DSA_SIG_free(sig);
- 	sshbuf_free(b);
- 	return ret;
-@@ -121,20 +132,20 @@ ssh_dss_verify(const struct sshkey *key,
-     const u_char *signature, size_t signaturelen,
-     const u_char *data, size_t datalen, u_int compat)
- {
-+	EVP_PKEY *pkey = NULL;
- 	DSA_SIG *sig = NULL;
- 	BIGNUM *sig_r = NULL, *sig_s = NULL;
-	u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob = NULL;
-	size_t len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
-+	u_char *sigblob = NULL;
-+	size_t len, slen;
- 	int ret = SSH_ERR_INTERNAL_ERROR;
- 	struct sshbuf *b = NULL;
- 	char *ktype = NULL;
-+	u_char *sigb = NULL, *psig = NULL;
- 
- 	if (key == NULL || key->dsa == NULL ||
- 	    sshkey_type_plain(key->type) != KEY_DSA ||
- 	    signature == NULL || signaturelen == 0)
- 		return SSH_ERR_INVALID_ARGUMENT;
-	if (dlen == 0)
-		return SSH_ERR_INTERNAL_ERROR;
- 
- 	/* fetch signature */
- 	if ((b = sshbuf_from(signature, signaturelen)) == NULL)
-@@ -176,25 +187,31 @@ ssh_dss_verify(const struct sshkey *key,
- 	}
- 	sig_r = sig_s = NULL; /* transferred */
- 
-	/* sha1 the data */
-	if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
-	    digest, sizeof(digest))) != 0)
-+	if ((slen = i2d_DSA_SIG(sig, NULL)) == 0) {
-+		ret = SSH_ERR_LIBCRYPTO_ERROR;
- 		goto out;
-
-	switch (DSA_do_verify(digest, dlen, sig, key->dsa)) {
-	case 1:
-		ret = 0;
-		break;
-	case 0:
-		ret = SSH_ERR_SIGNATURE_INVALID;
-+	}
-+	if ((sigb = malloc(slen)) == NULL) {
-+		ret = SSH_ERR_ALLOC_FAIL;
- 		goto out;
-	default:
-+	}
-+	psig = sigb;
-+	if ((slen = i2d_DSA_SIG(sig, &psig)) == 0) {
- 		ret = SSH_ERR_LIBCRYPTO_ERROR;
- 		goto out;
- 	}
- 
-+	if ((pkey = EVP_PKEY_new()) == NULL ||
-+	    EVP_PKEY_set1_DSA(pkey, key->dsa) != 1) {
-+		ret = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+	ret = sshkey_verify_signature(pkey, SSH_DIGEST_SHA1, data, datalen,
-+	    sigb, slen);
-+	EVP_PKEY_free(pkey);
-+
-  out:
-	explicit_bzero(digest, sizeof(digest));
-+	free(sigb);
- 	DSA_SIG_free(sig);
- 	BN_clear_free(sig_r);
- 	BN_clear_free(sig_s);
-diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
-index 599c7199d..b036796e8 100644
--- a/ssh-ecdsa.c
-+++ b/ssh-ecdsa.c
-@@ -50,11 +50,13 @@ int
- ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
-     const u_char *data, size_t datalen, u_int compat)
- {
-+	EVP_PKEY *pkey = NULL;
- 	ECDSA_SIG *sig = NULL;
-+	unsigned char *sigb = NULL;
-+	const unsigned char *psig;
- 	const BIGNUM *sig_r, *sig_s;
- 	int hash_alg;
-	u_char digest[SSH_DIGEST_MAX_LENGTH];
-	size_t len, dlen;
-+	int len;
- 	struct sshbuf *b = NULL, *bb = NULL;
- 	int ret = SSH_ERR_INTERNAL_ERROR;
- 
-@@ -67,18 +69,24 @@ ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 	    sshkey_type_plain(key->type) != KEY_ECDSA)
- 		return SSH_ERR_INVALID_ARGUMENT;
- 
-	if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
-	    (dlen = ssh_digest_bytes(hash_alg)) == 0)
-+	if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
- 		return SSH_ERR_INTERNAL_ERROR;
-	if ((ret = ssh_digest_memory(hash_alg, data, datalen,
-	    digest, sizeof(digest))) != 0)
-+
-+	if ((pkey = EVP_PKEY_new()) == NULL ||
-+	    EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa) != 1)
-+		return SSH_ERR_ALLOC_FAIL;
-+	ret = sshkey_calculate_signature(pkey, hash_alg, &sigb, &len, data,
-+	    datalen);
-+	EVP_PKEY_free(pkey);
-+	if (ret < 0) {
- 		goto out;
-+	}
- 
-	if ((sig = ECDSA_do_sign(digest, dlen, key->ecdsa)) == NULL) {
-+	psig = sigb;
-+	if ((sig = d2i_ECDSA_SIG(NULL, &psig, len)) == NULL) {
- 		ret = SSH_ERR_LIBCRYPTO_ERROR;
- 		goto out;
- 	}
-
- 	if ((bb = sshbuf_new()) == NULL || (b = sshbuf_new()) == NULL) {
- 		ret = SSH_ERR_ALLOC_FAIL;
- 		goto out;
-@@ -102,7 +110,7 @@ ssh_ecdsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 		*lenp = len;
- 	ret = 0;
-  out:
-	explicit_bzero(digest, sizeof(digest));
-+	free(sigb);
- 	sshbuf_free(b);
- 	sshbuf_free(bb);
- 	ECDSA_SIG_free(sig);
-@@ -115,22 +123,21 @@ ssh_ecdsa_verify(const struct sshkey *key,
-     const u_char *signature, size_t signaturelen,
-     const u_char *data, size_t datalen, u_int compat)
- {
-+	EVP_PKEY *pkey = NULL;
- 	ECDSA_SIG *sig = NULL;
- 	BIGNUM *sig_r = NULL, *sig_s = NULL;
-	int hash_alg;
-	u_char digest[SSH_DIGEST_MAX_LENGTH];
-	size_t dlen;
-+	int hash_alg, len;
- 	int ret = SSH_ERR_INTERNAL_ERROR;
- 	struct sshbuf *b = NULL, *sigbuf = NULL;
- 	char *ktype = NULL;
-+	unsigned char *sigb = NULL, *psig = NULL;
- 
- 	if (key == NULL || key->ecdsa == NULL ||
- 	    sshkey_type_plain(key->type) != KEY_ECDSA ||
- 	    signature == NULL || signaturelen == 0)
- 		return SSH_ERR_INVALID_ARGUMENT;
- 
-	if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 ||
-	    (dlen = ssh_digest_bytes(hash_alg)) == 0)
-+	if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1)
- 		return SSH_ERR_INTERNAL_ERROR;
- 
- 	/* fetch signature */
-@@ -166,28 +173,36 @@ ssh_ecdsa_verify(const struct sshkey *key,
- 	}
- 	sig_r = sig_s = NULL; /* transferred */
- 
-	if (sshbuf_len(sigbuf) != 0) {
-		ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
-+	/* Figure out the length */
-+	if ((len = i2d_ECDSA_SIG(sig, NULL)) == 0) {
-+		ret = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+	if ((sigb = malloc(len)) == NULL) {
-+		ret = SSH_ERR_ALLOC_FAIL;
- 		goto out;
- 	}
-	if ((ret = ssh_digest_memory(hash_alg, data, datalen,
-	    digest, sizeof(digest))) != 0)
-+	psig = sigb;
-+	if ((len = i2d_ECDSA_SIG(sig, &psig)) == 0) {
-+		ret = SSH_ERR_LIBCRYPTO_ERROR;
- 		goto out;
-+	}
- 
-	switch (ECDSA_do_verify(digest, dlen, sig, key->ecdsa)) {
-	case 1:
-		ret = 0;
-		break;
-	case 0:
-		ret = SSH_ERR_SIGNATURE_INVALID;
-+	if (sshbuf_len(sigbuf) != 0) {
-+		ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
- 		goto out;
-	default:
-		ret = SSH_ERR_LIBCRYPTO_ERROR;
-+	}
-+
-+	if ((pkey = EVP_PKEY_new()) == NULL ||
-+	    EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa) != 1) {
-+		ret =  SSH_ERR_ALLOC_FAIL;
- 		goto out;
- 	}
-+	ret = sshkey_verify_signature(pkey, hash_alg, data, datalen, sigb, len);
-+	EVP_PKEY_free(pkey);
- 
-  out:
-	explicit_bzero(digest, sizeof(digest));
-+	free(sigb);
- 	sshbuf_free(sigbuf);
- 	sshbuf_free(b);
- 	ECDSA_SIG_free(sig);
-diff --git a/ssh-rsa.c b/ssh-rsa.c
-index 9b14f9a9a..8ef3a6aca 100644
--- a/ssh-rsa.c
-+++ b/ssh-rsa.c
-@@ -37,7 +37,7 @@
- 
- #include "openbsd-compat/openssl-compat.h"
- 
-static int openssh_RSA_verify(int, u_char *, size_t, u_char *, size_t, RSA *);
-+static int openssh_RSA_verify(int, const u_char *, size_t, u_char *, size_t, EVP_PKEY *);
- 
- static const char *
- rsa_hash_alg_ident(int hash_alg)
-@@ -90,21 +90,6 @@ rsa_hash_id_from_keyname(const char *alg)
- 	return -1;
- }
- 
-static int
-rsa_hash_alg_nid(int type)
-{
-	switch (type) {
-	case SSH_DIGEST_SHA1:
-		return NID_sha1;
-	case SSH_DIGEST_SHA256:
-		return NID_sha256;
-	case SSH_DIGEST_SHA512:
-		return NID_sha512;
-	default:
-		return -1;
-	}
-}
-
- int
- ssh_rsa_complete_crt_parameters(struct sshkey *key, const BIGNUM *iqmp)
- {
-@@ -164,11 +149,10 @@ int
- ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
-     const u_char *data, size_t datalen, const char *alg_ident)
- {
-	const BIGNUM *rsa_n;
-	u_char digest[SSH_DIGEST_MAX_LENGTH], *sig = NULL;
-	size_t slen = 0;
-	u_int dlen, len;
-	int nid, hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
-+	EVP_PKEY *pkey = NULL;
-+	u_char *sig = NULL;
-+	int len, slen = 0;
-+	int hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
- 	struct sshbuf *b = NULL;
- 
- 	if (lenp != NULL)
-@@ -180,33 +164,24 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 		hash_alg = SSH_DIGEST_SHA1;
- 	else
- 		hash_alg = rsa_hash_id_from_keyname(alg_ident);
-+
- 	if (key == NULL || key->rsa == NULL || hash_alg == -1 ||
- 	    sshkey_type_plain(key->type) != KEY_RSA)
- 		return SSH_ERR_INVALID_ARGUMENT;
-	RSA_get0_key(key->rsa, &rsa_n, NULL, NULL);
-	if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
-		return SSH_ERR_KEY_LENGTH;
- 	slen = RSA_size(key->rsa);
-	if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM)
-		return SSH_ERR_INVALID_ARGUMENT;
-
-	/* hash the data */
-	nid = rsa_hash_alg_nid(hash_alg);
-	if ((dlen = ssh_digest_bytes(hash_alg)) == 0)
-		return SSH_ERR_INTERNAL_ERROR;
-	if ((ret = ssh_digest_memory(hash_alg, data, datalen,
-	    digest, sizeof(digest))) != 0)
-		goto out;
-+	if (RSA_bits(key->rsa) < SSH_RSA_MINIMUM_MODULUS_SIZE)
-+		return SSH_ERR_KEY_LENGTH;
- 
-	if ((sig = malloc(slen)) == NULL) {
-		ret = SSH_ERR_ALLOC_FAIL;
-+	if ((pkey = EVP_PKEY_new()) == NULL ||
-+	    EVP_PKEY_set1_RSA(pkey, key->rsa) != 1)
-+		return SSH_ERR_ALLOC_FAIL;
-+	ret = sshkey_calculate_signature(pkey, hash_alg, &sig, &len, data,
-+	    datalen);
-+	EVP_PKEY_free(pkey);
-+	if (ret < 0) {
- 		goto out;
- 	}
- 
-	if (RSA_sign(nid, digest, dlen, sig, &len, key->rsa) != 1) {
-		ret = SSH_ERR_LIBCRYPTO_ERROR;
-		goto out;
-	}
- 	if (len < slen) {
- 		size_t diff = slen - len;
- 		memmove(sig + diff, sig, len);
-@@ -215,6 +190,7 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 		ret = SSH_ERR_INTERNAL_ERROR;
- 		goto out;
- 	}
-+
- 	/* encode signature */
- 	if ((b = sshbuf_new()) == NULL) {
- 		ret = SSH_ERR_ALLOC_FAIL;
-@@ -235,7 +211,6 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
- 		*lenp = len;
- 	ret = 0;
-  out:
-	explicit_bzero(digest, sizeof(digest));
- 	freezero(sig, slen);
- 	sshbuf_free(b);
- 	return ret;
-@@ -246,10 +221,10 @@ ssh_rsa_verify(const struct sshkey *key,
-     const u_char *sig, size_t siglen, const u_char *data, size_t datalen,
-     const char *alg)
- {
-	const BIGNUM *rsa_n;
-+	EVP_PKEY *pkey = NULL;
- 	char *sigtype = NULL;
- 	int hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR;
-	size_t len = 0, diff, modlen, dlen;
-+	size_t len = 0, diff, modlen;
- 	struct sshbuf *b = NULL;
- 	u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL;
- 
-@@ -257,8 +232,7 @@ ssh_rsa_verify(const struct sshkey *key,
- 	    sshkey_type_plain(key->type) != KEY_RSA ||
- 	    sig == NULL || siglen == 0)
- 		return SSH_ERR_INVALID_ARGUMENT;
-	RSA_get0_key(key->rsa, &rsa_n, NULL, NULL);
-	if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
-+	if (RSA_bits(key->rsa) < SSH_RSA_MINIMUM_MODULUS_SIZE)
- 		return SSH_ERR_KEY_LENGTH;
- 
- 	if ((b = sshbuf_from(sig, siglen)) == NULL)
-@@ -310,16 +284,15 @@ ssh_rsa_verify(const struct sshkey *key,
- 		explicit_bzero(sigblob, diff);
- 		len = modlen;
- 	}
-	if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
-		ret = SSH_ERR_INTERNAL_ERROR;
-+
-+	if ((pkey = EVP_PKEY_new()) == NULL ||
-+	    EVP_PKEY_set1_RSA(pkey, key->rsa) != 1) {
-+		ret = SSH_ERR_ALLOC_FAIL;
- 		goto out;
- 	}
-	if ((ret = ssh_digest_memory(hash_alg, data, datalen,
-	    digest, sizeof(digest))) != 0)
-		goto out;
-+	ret = openssh_RSA_verify(hash_alg, data, datalen, sigblob, len, pkey);
-+	EVP_PKEY_free(pkey);
- 
-	ret = openssh_RSA_verify(hash_alg, digest, dlen, sigblob, len,
-	    key->rsa);
-  out:
- 	freezero(sigblob, len);
- 	free(sigtype);
-@@ -328,122 +301,26 @@ ssh_rsa_verify(const struct sshkey *key,
- 	return ret;
- }
- 
-/*
- * See:
- * http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/
- * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn
- */
-
-/*
- * id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
- *	oiw(14) secsig(3) algorithms(2) 26 }
- */
-static const u_char id_sha1[] = {
-	0x30, 0x21, /* type Sequence, length 0x21 (33) */
-	0x30, 0x09, /* type Sequence, length 0x09 */
-	0x06, 0x05, /* type OID, length 0x05 */
-	0x2b, 0x0e, 0x03, 0x02, 0x1a, /* id-sha1 OID */
-	0x05, 0x00, /* NULL */
-	0x04, 0x14  /* Octet string, length 0x14 (20), followed by sha1 hash */
-};
-
-/*
- * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
- * id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
- *      organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
- *      id-sha256(1) }
- */
-static const u_char id_sha256[] = {
-	0x30, 0x31, /* type Sequence, length 0x31 (49) */
-	0x30, 0x0d, /* type Sequence, length 0x0d (13) */
-	0x06, 0x09, /* type OID, length 0x09 */
-	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, /* id-sha256 */
-	0x05, 0x00, /* NULL */
-	0x04, 0x20  /* Octet string, length 0x20 (32), followed by sha256 hash */
-};
-
-/*
- * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
- * id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
- *      organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
- *      id-sha256(3) }
- */
-static const u_char id_sha512[] = {
-	0x30, 0x51, /* type Sequence, length 0x51 (81) */
-	0x30, 0x0d, /* type Sequence, length 0x0d (13) */
-	0x06, 0x09, /* type OID, length 0x09 */
-	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, /* id-sha512 */
-	0x05, 0x00, /* NULL */
-	0x04, 0x40  /* Octet string, length 0x40 (64), followed by sha512 hash */
-};
-
- static int
-rsa_hash_alg_oid(int hash_alg, const u_char **oidp, size_t *oidlenp)
-+openssh_RSA_verify(int hash_alg, const u_char *data, size_t datalen,
-+    u_char *sigbuf, size_t siglen, EVP_PKEY *pkey)
- {
-	switch (hash_alg) {
-	case SSH_DIGEST_SHA1:
-		*oidp = id_sha1;
-		*oidlenp = sizeof(id_sha1);
-		break;
-	case SSH_DIGEST_SHA256:
-		*oidp = id_sha256;
-		*oidlenp = sizeof(id_sha256);
-		break;
-	case SSH_DIGEST_SHA512:
-		*oidp = id_sha512;
-		*oidlenp = sizeof(id_sha512);
-		break;
-	default:
-		return SSH_ERR_INVALID_ARGUMENT;
-	}
-	return 0;
-}
-+	size_t rsasize = 0;
-+	const RSA *rsa;
-+	int ret;
- 
-static int
-openssh_RSA_verify(int hash_alg, u_char *hash, size_t hashlen,
-    u_char *sigbuf, size_t siglen, RSA *rsa)
-{
-	size_t rsasize = 0, oidlen = 0, hlen = 0;
-	int ret, len, oidmatch, hashmatch;
-	const u_char *oid = NULL;
-	u_char *decrypted = NULL;
-
-	if ((ret = rsa_hash_alg_oid(hash_alg, &oid, &oidlen)) != 0)
-		return ret;
-	ret = SSH_ERR_INTERNAL_ERROR;
-	hlen = ssh_digest_bytes(hash_alg);
-	if (hashlen != hlen) {
-		ret = SSH_ERR_INVALID_ARGUMENT;
-		goto done;
-	}
-+	rsa = EVP_PKEY_get0_RSA(pkey);
- 	rsasize = RSA_size(rsa);
- 	if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM ||
- 	    siglen == 0 || siglen > rsasize) {
- 		ret = SSH_ERR_INVALID_ARGUMENT;
- 		goto done;
- 	}
-	if ((decrypted = malloc(rsasize)) == NULL) {
-		ret = SSH_ERR_ALLOC_FAIL;
-		goto done;
-	}
-	if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa,
-	    RSA_PKCS1_PADDING)) < 0) {
-		ret = SSH_ERR_LIBCRYPTO_ERROR;
-		goto done;
-	}
-	if (len < 0 || (size_t)len != hlen + oidlen) {
-		ret = SSH_ERR_INVALID_FORMAT;
-		goto done;
-	}
-	oidmatch = timingsafe_bcmp(decrypted, oid, oidlen) == 0;
-	hashmatch = timingsafe_bcmp(decrypted + oidlen, hash, hlen) == 0;
-	if (!oidmatch || !hashmatch) {
-		ret = SSH_ERR_SIGNATURE_INVALID;
-		goto done;
-	}
-	ret = 0;
-+
-+	ret = sshkey_verify_signature(pkey, hash_alg, data, datalen,
-+	    sigbuf, siglen);
-+
- done:
-	freezero(decrypted, rsasize);
- 	return ret;
- }
- #endif /* WITH_OPENSSL */
-diff --git a/sshkey.c b/sshkey.c
-index ad1957762..b95ed0b10 100644
--- a/sshkey.c
-+++ b/sshkey.c
-@@ -358,6 +358,83 @@ sshkey_type_plain(int type)
- }
- 
- #ifdef WITH_OPENSSL
-+int
-+sshkey_calculate_signature(EVP_PKEY *pkey, int hash_alg, u_char **sigp,
-+    int *lenp, const u_char *data, size_t datalen)
-+{
-+	EVP_MD_CTX *ctx = NULL;
-+	u_char *sig = NULL;
-+	int ret, slen, len;
-+
-+	if (sigp == NULL || lenp == NULL) {
-+		return SSH_ERR_INVALID_ARGUMENT;
-+	}
-+
-+	slen = EVP_PKEY_size(pkey);
-+	if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM)
-+		return SSH_ERR_INVALID_ARGUMENT;
-+
-+	len = slen;
-+	if ((sig = malloc(slen)) == NULL) {
-+		return SSH_ERR_ALLOC_FAIL;
-+	}
-+
-+	if ((ctx = EVP_MD_CTX_new()) == NULL) {
-+		ret = SSH_ERR_ALLOC_FAIL;
-+		goto error;
-+	}
-+	if (EVP_SignInit_ex(ctx, ssh_digest_to_md(hash_alg), NULL) <= 0 ||
-+	    EVP_SignUpdate(ctx, data, datalen) <= 0 ||
-+	    EVP_SignFinal(ctx, sig, &len, pkey) <= 0) {
-+		ret = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto error;
-+	}
-+
-+	*sigp = sig;
-+	*lenp = len;
-+	/* Now owned by the caller */
-+	sig = NULL;
-+	ret = 0;
-+
-+error:
-+	EVP_MD_CTX_free(ctx);
-+	free(sig);
-+	return ret;
-+}
-+
-+int
-+sshkey_verify_signature(EVP_PKEY *pkey, int hash_alg, const u_char *data,
-+    size_t datalen, u_char *sigbuf, int siglen)
-+{
-+	EVP_MD_CTX *ctx = NULL;
-+	int ret;
-+
-+	if ((ctx = EVP_MD_CTX_new()) == NULL) {
-+		return SSH_ERR_ALLOC_FAIL;
-+	}
-+	if (EVP_VerifyInit_ex(ctx, ssh_digest_to_md(hash_alg), NULL) <= 0 ||
-+	    EVP_VerifyUpdate(ctx, data, datalen) <= 0) {
-+		ret = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto done;
-+	}
-+	ret = EVP_VerifyFinal(ctx, sigbuf, siglen, pkey);
-+	switch (ret) {
-+	case 1:
-+		ret = 0;
-+		break;
-+	case 0:
-+		ret = SSH_ERR_SIGNATURE_INVALID;
-+		break;
-+	default:
-+		ret = SSH_ERR_LIBCRYPTO_ERROR;
-+		break;
-+	}
-+
-+done:
-+	EVP_MD_CTX_free(ctx);
-+	return ret;
-+}
-+
- /* XXX: these are really begging for a table-driven approach */
- int
- sshkey_curve_name_to_nid(const char *name)
-diff --git a/sshkey.h b/sshkey.h
-index a91e60436..270901a87 100644
--- a/sshkey.h
-+++ b/sshkey.h
-@@ -179,6 +179,10 @@ const char	*sshkey_ssh_name(const struct sshkey *);
- const char	*sshkey_ssh_name_plain(const struct sshkey *);
- int		 sshkey_names_valid2(const char *, int);
- char		*sshkey_alg_list(int, int, int, char);
-+int		 sshkey_calculate_signature(EVP_PKEY*, int, u_char **,
-+    int *, const u_char *, size_t);
-+int		 sshkey_verify_signature(EVP_PKEY *, int, const u_char *,
-+    size_t, u_char *, int);
- 
- int	 sshkey_from_blob(const u_char *, size_t, struct sshkey **);
- int	 sshkey_fromb(struct sshbuf *, struct sshkey **);
-
--- a/openssh-8.0p1-openssl-kdf.patch
+++ b/openssh-8.0p1-openssl-kdf.patch
@ -1,137 +0,0 @@
-commit 2c3ef499bfffce3cfd315edeebf202850ba4e00a
-Author: Jakub Jelen <jjelen@redhat.com>
-Date:   Tue Apr 16 15:35:18 2019 +0200
-
-    Use the new OpenSSL KDF
-
-diff --git a/configure.ac b/configure.ac
-index 2a455e4e..e01c3d43 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -2712,6 +2712,7 @@ if test "x$openssl" = "xyes" ; then
- 		HMAC_CTX_init \
- 		RSA_generate_key_ex \
- 		RSA_get_default_method \
-+		EVP_KDF_CTX_new_id \
- 	])
- 
- 	# OpenSSL_add_all_algorithms may be a macro.
-diff --git a/kex.c b/kex.c
-index b6f041f4..1fbce2bb 100644
--- a/kex.c
-+++ b/kex.c
-@@ -38,6 +38,9 @@
- #ifdef WITH_OPENSSL
- #include <openssl/crypto.h>
- #include <openssl/dh.h>
-+# ifdef HAVE_EVP_KDF_CTX_NEW_ID
-+# include <openssl/kdf.h>
-+# endif
- #endif
- 
- #include "ssh.h"
-@@ -942,6 +945,95 @@ kex_choose_conf(struct ssh *ssh)
- 	return r;
- }
- 
-+#ifdef HAVE_EVP_KDF_CTX_NEW_ID
-+static const EVP_MD *
-+digest_to_md(int digest_type)
-+{
-+	switch (digest_type) {
-+	case SSH_DIGEST_SHA1:
-+		return EVP_sha1();
-+	case SSH_DIGEST_SHA256:
-+		return EVP_sha256();
-+	case SSH_DIGEST_SHA384:
-+		return EVP_sha384();
-+	case SSH_DIGEST_SHA512:
-+		return EVP_sha512();
-+	}
-+	return NULL;
-+}
-+
-+static int
-+derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
-+    const struct sshbuf *shared_secret, u_char **keyp)
-+{
-+	struct kex *kex = ssh->kex;
-+	EVP_KDF_CTX *ctx = NULL;
-+	u_char *key = NULL;
-+	int r, key_len;
-+
-+	if ((key_len = ssh_digest_bytes(kex->hash_alg)) == 0)
-+		return SSH_ERR_INVALID_ARGUMENT;
-+	key_len = ROUNDUP(need, key_len);
-+	if ((key = calloc(1, key_len)) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
-+		goto out;
-+	}
-+
-+	ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF);
-+	if (!ctx) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+
-+	r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD, digest_to_md(kex->hash_alg));
-+	if (r != 1) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+	r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY,
-+	    sshbuf_ptr(shared_secret), sshbuf_len(shared_secret));
-+	if (r != 1) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+	r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH, hash, hashlen);
-+	if (r != 1) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+	r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, id);
-+	if (r != 1) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+	r = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
-+	    kex->session_id, kex->session_id_len);
-+	if (r != 1) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+	r = EVP_KDF_derive(ctx, key, key_len);
-+	if (r != 1) {
-+		r = SSH_ERR_LIBCRYPTO_ERROR;
-+		goto out;
-+	}
-+#ifdef DEBUG_KEX
-+	fprintf(stderr, "key '%c'== ", id);
-+	dump_digest("key", key, key_len);
-+#endif
-+	*keyp = key;
-+	key = NULL;
-+	r = 0;
-+
-+out:
-+	free (key);
-+	EVP_KDF_CTX_free(ctx);
-+	if (r < 0) {
-+		return r;
-+	}
-+	return 0;
-+}
-+#else
- static int
- derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
-     const struct sshbuf *shared_secret, u_char **keyp)
-@@ -1004,6 +1096,7 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
- 	ssh_digest_free(hashctx);
- 	return r;
- }
-+#endif /* HAVE_OPENSSL_EVP_KDF_CTX_NEW_ID */
- 
- #define NKEYS	6
- int
-
--- a/openssh-8.0p1-pkcs11-uri.patch
+++ b/openssh-8.0p1-pkcs11-uri.patch
--- a/openssh-8.2p1-visibility.patch
+++ b/openssh-8.2p1-visibility.patch
@ -1,40 +0,0 @@
-diff --git a/regress/misc/sk-dummy/sk-dummy.c b/regress/misc/sk-dummy/sk-dummy.c
-index dca158de..afdcb1d2 100644
--- a/regress/misc/sk-dummy/sk-dummy.c
-+++ b/regress/misc/sk-dummy/sk-dummy.c
-@@ -71,7 +71,7 @@ skdebug(const char *func, const char *fmt, ...)
- #endif
- }
- 
-uint32_t
-+uint32_t __attribute__((visibility("default")))
- sk_api_version(void)
- {
- 	return SSH_SK_VERSION_MAJOR;
-@@ -220,7 +220,7 @@ check_options(struct sk_option **options)
- 	return 0;
- }
- 
-int
-+int __attribute__((visibility("default")))
- sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
-     const char *application, uint8_t flags, const char *pin,
-     struct sk_option **options, struct sk_enroll_response **enroll_response)
-@@ -467,7 +467,7 @@ sig_ed25519(const uint8_t *message, size_t message_len,
- 	return ret;
- }
- 
-int
-+int __attribute__((visibility("default")))
- sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
-     const char *application, const uint8_t *key_handle, size_t key_handle_len,
-     uint8_t flags, const char *pin, struct sk_option **options,
-@@ -518,7 +518,7 @@ sk_sign(uint32_t alg, const uint8_t *message, size_t message_len,
- 	return ret;
- }
- 
-int
-+int __attribute__((visibility("default")))
- sk_load_resident_keys(const char *pin, struct sk_option **options,
-     struct sk_resident_key ***rks, size_t *nrks)
- {
--- a/openssh-8.2p1-x11-without-ipv6.patch
+++ b/openssh-8.2p1-x11-without-ipv6.patch
@ -1,30 +0,0 @@
-diff --git a/channels.c b/channels.c
--- a/channels.c
-+++ b/channels.c
-@@ -3933,16 +3933,26 @@ x11_create_display_inet(int x11_display_
- 			if (ai->ai_family == AF_INET6)
- 				sock_set_v6only(sock);
- 			if (x11_use_localhost)
- 				set_reuseaddr(sock);
- 			if (bind(sock, ai->ai_addr, ai->ai_addrlen) == -1) {
- 				debug2("%s: bind port %d: %.100s", __func__,
- 				    port, strerror(errno));
- 				close(sock);
-+
-+				/* do not remove successfully opened
-+				 * sockets if the request failed because
-+				 * the protocol IPv4/6 is not available
-+				 * (e.g. IPv6 may be disabled while being
-+				 * supported)
-+				 */
-+				if (EADDRNOTAVAIL == errno)
-+    					continue;
-+
- 				for (n = 0; n < num_socks; n++)
- 					close(socks[n]);
- 				num_socks = 0;
- 				break;
- 			}
- 			socks[num_socks++] = sock;
- 			if (num_socks == NUM_SOCKS)
- 				break;
--- a/openssh-8.4p1-debian-compat.patch
+++ b/openssh-8.4p1-debian-compat.patch
@ -1,57 +0,0 @@
--- compat.h.orig	2020-10-05 10:09:02.953505129 -0700
-+++ compat.h	2020-10-05 10:10:17.587733113 -0700
-@@ -34,7 +34,7 @@
- 
- #define SSH_BUG_UTF8TTYMODE	0x00000001
- #define SSH_BUG_SIGTYPE		0x00000002
-/* #define unused		0x00000004 */
-+#define SSH_BUG_SIGTYPE74	0x00000004
- /* #define unused		0x00000008 */
- #define SSH_OLD_SESSIONID	0x00000010
- /* #define unused		0x00000020 */
--- compat.c.orig	2020-10-05 10:25:02.088720562 -0700
-+++ compat.c	2020-10-05 10:13:11.637282492 -0700
-@@ -65,11 +65,12 @@
- 		{ "OpenSSH_6.5*,"
- 		  "OpenSSH_6.6*",	SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD|
- 					SSH_BUG_SIGTYPE},
-+		{ "OpenSSH_7.4*",	SSH_NEW_OPENSSH|SSH_BUG_SIGTYPE|
-+		  			SSH_BUG_SIGTYPE74},
- 		{ "OpenSSH_7.0*,"
- 		  "OpenSSH_7.1*,"
- 		  "OpenSSH_7.2*,"
- 		  "OpenSSH_7.3*,"
-		  "OpenSSH_7.4*,"
- 		  "OpenSSH_7.5*,"
- 		  "OpenSSH_7.6*,"
- 		  "OpenSSH_7.7*",	SSH_NEW_OPENSSH|SSH_BUG_SIGTYPE},
--- sshconnect2.c.orig	2020-09-26 07:26:37.618010545 -0700
-+++ sshconnect2.c	2020-10-05 10:47:22.116315148 -0700
-@@ -1305,6 +1305,26 @@
- 			break;
- 	}
- 	free(oallowed);
-+	/*
-+	 * OpenSSH 7.4 supports SHA2 sig types, but fails to indicate its
-+	 * support.  For that release, check the local policy against the
-+	 * SHA2 signature types.
-+	 */
-+	if (alg == NULL &&
-+	    (key->type == KEY_RSA && (datafellows & SSH_BUG_SIGTYPE74))) {
-+		oallowed = allowed = xstrdup(options.pubkey_key_types);
-+		while ((cp = strsep(&allowed, ",")) != NULL) {
-+			if (sshkey_type_from_name(cp) != key->type)
-+				continue;
-+			tmp = match_list(sshkey_sigalg_by_name(cp), "rsa-sha2-256,rsa-sha2-512", NULL);
-+			if (tmp != NULL)
-+				alg = xstrdup(cp);
-+			free(tmp);
-+			if (alg != NULL)
-+				break;
-+		}
-+		free(oallowed);
-+	}
- 	return alg;
- }
- 
-
--- a/openssh-8.4p1-sandbox-seccomp.patch
+++ b/openssh-8.4p1-sandbox-seccomp.patch
@ -1,14 +0,0 @@
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index e0768c06..5065ae7e 100644
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -267,6 +267,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_pselect6
- 	SC_ALLOW(__NR_pselect6),
- #endif
-+#ifdef __NR_pselect6_time64
-+	SC_ALLOW(__NR_pselect6_time64),
-+#endif
- #ifdef __NR_read
- 	SC_ALLOW(__NR_read),
- #endif
--- a/openssh-8.4p1-ssh-copy-id.patch
+++ b/openssh-8.4p1-ssh-copy-id.patch
@ -1,130 +0,0 @@
-From 66f16e5425eb881570e82bfef7baeac2e7accc0a Mon Sep 17 00:00:00 2001
-From: Oleg <Fallmay@users.noreply.github.com>
-Date: Thu, 1 Oct 2020 12:09:08 +0300
-Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
-
---
- contrib/ssh-copy-id | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
-index 392f64f94..a76907717 100644
--- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -247,7 +247,7 @@ installkeys_sh() {
-   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
-   #    the cat adds the keys we're getting via STDIN
-   #    and if available restorecon is used to restore the SELinux context
-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
-+  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
- 	cd;
- 	umask 077;
- 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
-@@ -258,6 +258,7 @@ installkeys_sh() {
- 	  restorecon -F .ssh ${AUTH_KEY_FILE};
- 	fi
- EOF
-+  )
- 
-   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
-   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
-
-From de59a431cdec833e3ec15691dd950402b4c052cf Mon Sep 17 00:00:00 2001
-From: Philip Hands <phil@hands.com>
-Date: Sat, 3 Oct 2020 00:20:07 +0200
-Subject: [PATCH] un-nest $() to make ksh cheerful
-
---
- ssh-copy-id | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-From 02ac2c3c3db5478a440dfb1b90d15f686f2cbfc6 Mon Sep 17 00:00:00 2001
-From: Philip Hands <phil@hands.com>
-Date: Fri, 2 Oct 2020 21:30:10 +0200
-Subject: [PATCH] ksh doesn't grok 'local'
-
-and AFAICT it's not actually doing anything useful in the code, so let's
-see how things go without it.
---
- ssh-copy-id | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
-index a769077..11c9463 100755
--- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -76,7 +76,7 @@ quote() {
- }
- 
- use_id_file() {
-  local L_ID_FILE="$1"
-+  L_ID_FILE="$1"
- 
-   if [ -z "$L_ID_FILE" ] ; then
-     printf '%s: ERROR: no ID file found\n' "$0"
-@@ -94,7 +94,7 @@ use_id_file() {
-   # check that the files are readable
-   for f in "$PUB_ID_FILE" ${PRIV_ID_FILE:+"$PRIV_ID_FILE"} ; do
-     ErrMSG=$( { : < "$f" ; } 2>&1 ) || {
-      local L_PRIVMSG=""
-+      L_PRIVMSG=""
-       [ "$f" = "$PRIV_ID_FILE" ] && L_PRIVMSG="	(to install the contents of '$PUB_ID_FILE' anyway, look at the -f option)"
-       printf "\\n%s: ERROR: failed to open ID file '%s': %s\\n" "$0" "$f" "$(printf '%s\n%s\n' "$ErrMSG" "$L_PRIVMSG" | sed -e 's/.*: *//')"
-       exit 1
-@@ -169,7 +169,7 @@ fi
- # populate_new_ids() uses several global variables ($USER_HOST, $SSH_OPTS ...)
- # and has the side effect of setting $NEW_IDS
- populate_new_ids() {
-  local L_SUCCESS="$1"
-+  L_SUCCESS="$1"
- 
-   # shellcheck disable=SC2086
-   if [ "$FORCED" ] ; then
-@@ -181,13 +181,12 @@ populate_new_ids() {
-   eval set -- "$SSH_OPTS"
- 
-   umask 0177
-  local L_TMP_ID_FILE
-   L_TMP_ID_FILE=$(mktemp ~/.ssh/ssh-copy-id_id.XXXXXXXXXX)
-   if test $? -ne 0 || test "x$L_TMP_ID_FILE" = "x" ; then
-     printf '%s: ERROR: mktemp failed\n' "$0" >&2
-     exit 1
-   fi
-  local L_CLEANUP="rm -f \"$L_TMP_ID_FILE\" \"${L_TMP_ID_FILE}.stderr\""
-+  L_CLEANUP="rm -f \"$L_TMP_ID_FILE\" \"${L_TMP_ID_FILE}.stderr\""
-   # shellcheck disable=SC2064
-   trap "$L_CLEANUP" EXIT TERM INT QUIT
-   printf '%s: INFO: attempting to log in with the new key(s), to filter out any that are already installed\n' "$0" >&2
-@@ -237,7 +236,7 @@ populate_new_ids() {
- #    produce a one-liner to add the keys to remote authorized_keys file
- #    optionally takes an alternative path for authorized_keys
- installkeys_sh() {
-  local AUTH_KEY_FILE=${1:-.ssh/authorized_keys}
-+  AUTH_KEY_FILE=${1:-.ssh/authorized_keys}
- 
-   # In setting INSTALLKEYS_SH:
-   #    the tr puts it all on one line (to placate tcsh)
-- 
-
-diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
-index 11c9463..ee3f637 100755
--- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -237,6 +237,7 @@ populate_new_ids() {
- #    optionally takes an alternative path for authorized_keys
- installkeys_sh() {
-   AUTH_KEY_FILE=${1:-.ssh/authorized_keys}
-+  AUTH_KEY_DIR=$(dirname "${AUTH_KEY_FILE}")
- 
-   # In setting INSTALLKEYS_SH:
-   #    the tr puts it all on one line (to placate tcsh)
-@@ -249,7 +250,7 @@ installkeys_sh() {
-   INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
- 	cd;
- 	umask 077;
-	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
-+	mkdir -p "${AUTH_KEY_DIR}" &&
- 	  { [ -z \`tail -1c ${AUTH_KEY_FILE} 2>/dev/null\` ] || echo >> ${AUTH_KEY_FILE} || exit 1; } &&
- 	  cat >> ${AUTH_KEY_FILE} ||
- 	  exit 1;
-- 
--- a/openssh.rpmlintrc
+++ b/openssh.rpmlintrc
@ -1,21 +0,0 @@
-# I do not know about any better place where to put profile files
-addFilter(r'openssh-askpass.x86_64: W: non-conffile-in-etc /etc/profile.d/gnome-ssh-askpass.c?sh')
-
-# The ssh-keysign is not supposed to have standard permissions
-addFilter(r'openssh.x86_64: E: non-standard-executable-perm /usr/libexec/openssh/ssh-keysign 2555')
-addFilter(r'openssh.x86_64: E: setgid-binary /usr/libexec/openssh/ssh-keysign ssh_keys 2555')
-addFilter(r'openssh.x86_64: W: non-standard-gid /usr/libexec/openssh/ssh-keysign ssh_keys')
-
-# The -cavs subpackage is internal without documentation
-# The -askpass is not intended to be used directly so it is missing documentation
-addFilter(r'openssh-(askpass|cavs).x86_64: W: no-documentation')
-
-# sshd config and sysconfig is not supposed to be world readable
-addFilter(r'non-readable /etc/(ssh/sshd_config|sysconfig/sshd)')
-
-# The /var/empty/sshd is supposed to have the given permissions
-addFilter(r'non-standard-dir-perm /var/empty/sshd 711')
-addFilter(r'non-standard-dir-in-var empty')
-
-# Spelling false-positives
-addFilter(r'spelling-error (Summary\(en_US\)|.* en_US) (mls|su|sudo|rlogin|rsh|untrusted) ')
--- a/openssh.spec
+++ b/openssh.spec
--- a/20
+++ b/20
@ -1,36 +1,20 @@
-authfd.c
-authfd.h
-atomicio.c
 atomicio.h
-bufaux.c
-bufbn.c
+authfd.h
 buffer.h
-buffer.c
-cleanup.c
 cipher.h
 compat.h
-entropy.c
+defines.h
 entropy.h
-fatal.c
 includes.h
 kex.h
-key.c
 key.h
-log.c
 log.h
 match.h
-misc.c
 misc.h
 pathnames.h
 platform.h
 rsa.h
-ssh-dss.c
-ssh-rsa.c
 ssh.h
 ssh2.h
-uidswap.c
-uidswap.h
-uuencode.c
 uuencode.h
-xmalloc.c
 xmalloc.h
--- a/pam_ssh_agent_auth-0.10.2-compat.patch
+++ b/pam_ssh_agent_auth-0.10.2-compat.patch
@ -1,992 +0,0 @@
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/get_command_line.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/get_command_line.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/get_command_line.c.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/get_command_line.c	2020-09-23 10:52:16.424001475 +0200
-@@ -27,6 +27,7 @@
-  * or implied, of Jamie Beverly.
-  */
- 
-+#include <stdlib.h>
- #include <stdio.h>
- #include <errno.h>
- #include <string.h>
-@@ -66,8 +67,8 @@ proc_pid_cmdline(char *** inargv)
-                 case EOF:
-                 case '\0':
-                     if (len > 0) { 
-                        argv = pamsshagentauth_xrealloc(argv, count + 1, sizeof(*argv));
-                        argv[count] = pamsshagentauth_xcalloc(len + 1, sizeof(*argv[count]));
-+                        argv = xreallocarray(argv, count + 1, sizeof(*argv));
-+                        argv[count] = xcalloc(len + 1, sizeof(*argv[count]));
-                         strncpy(argv[count++], argbuf, len);
-                         memset(argbuf, '\0', MAX_LEN_PER_CMDLINE_ARG + 1);
-                         len = 0;
-@@ -106,9 +107,9 @@ pamsshagentauth_free_command_line(char *
- {
-     size_t i;
-     for (i = 0; i < n_args; i++)
-        pamsshagentauth_xfree(argv[i]);
-+        free(argv[i]);
- 
-    pamsshagentauth_xfree(argv);
-+    free(argv);
-     return;
- }
- 
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/identity.h.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/identity.h
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/identity.h.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/identity.h	2020-09-23 10:52:16.424001475 +0200
-@@ -30,8 +30,8 @@
- #include "openbsd-compat/sys-queue.h"
- #include "xmalloc.h"
- #include "log.h"
-#include "buffer.h"
-#include "key.h"
-+#include "sshbuf.h"
-+#include "sshkey.h"
- #include "authfd.h"
- #include <stdio.h>
- 
-@@ -41,7 +41,7 @@ typedef struct idlist Idlist;
- struct identity {
-     TAILQ_ENTRY(identity) next;
-     AuthenticationConnection *ac;   /* set if agent supports key */
-    Key *key;           /* public/private key */
-+    struct sshkey *key;           /* public/private key */
-     char    *filename;      /* comment for agent-only keys */
-     int tried;
-     int isprivate;      /* key points to the private key */
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/iterate_ssh_agent_keys.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/iterate_ssh_agent_keys.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/iterate_ssh_agent_keys.c.psaa-compat	2020-09-23 10:52:16.421001434 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/iterate_ssh_agent_keys.c	2020-09-23 10:52:16.424001475 +0200
-@@ -36,8 +36,8 @@
- #include "openbsd-compat/sys-queue.h"
- #include "xmalloc.h"
- #include "log.h"
-#include "buffer.h"
-#include "key.h"
-+#include "sshbuf.h"
-+#include "sshkey.h"
- #include "authfd.h"
- #include <stdio.h>
- #include <openssl/evp.h>
-@@ -58,6 +58,8 @@
- #include "get_command_line.h"
- extern char **environ;
- 
-+#define PAM_SSH_AGENT_AUTH_REQUESTv1 101
-+
- /* 
-  * Added by Jamie Beverly, ensure socket fd points to a socket owned by the user 
-  * A cursory check is done, but to avoid race conditions, it is necessary 
-@@ -77,7 +79,7 @@ log_action(char ** action, size_t count)
-     if (count == 0)
-         return NULL;
-    
-    buf = pamsshagentauth_xcalloc((count * MAX_LEN_PER_CMDLINE_ARG) + (count * 3), sizeof(*buf));
-+    buf = xcalloc((count * MAX_LEN_PER_CMDLINE_ARG) + (count * 3), sizeof(*buf));
-     for (i = 0; i < count; i++) {
-         strcat(buf, (i > 0) ? " '" : "'");
-         strncat(buf, action[i], MAX_LEN_PER_CMDLINE_ARG);
-@@ -87,21 +89,25 @@ log_action(char ** action, size_t count)
- }
- 
- void
-agent_action(Buffer *buf, char ** action, size_t count)
-+agent_action(struct sshbuf **buf, char ** action, size_t count)
- {
-     size_t i;
-    pamsshagentauth_buffer_init(buf);
-+    int r;
- 
-    pamsshagentauth_buffer_put_int(buf, count);
-+    if ((*buf = sshbuf_new()) == NULL)
-+        fatal("%s: sshbuf_new failed", __func__);
-+    if ((r = sshbuf_put_u32(*buf, count)) != 0)
-+        fatal("%s: buffer error: %s", __func__, ssh_err(r));
- 
-     for (i = 0; i < count; i++) {
-        pamsshagentauth_buffer_put_cstring(buf, action[i]);
-+        if ((r = sshbuf_put_cstring(*buf, action[i])) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
-     }
- }
- 
- 
-void
-pamsshagentauth_session_id2_gen(Buffer * session_id2, const char * user,
-+static void
-+pamsshagentauth_session_id2_gen(struct sshbuf ** session_id2, const char * user,
-                                 const char * ruser, const char * servicename)
- {
-     u_char *cookie = NULL;
-@@ -114,22 +120,23 @@ pamsshagentauth_session_id2_gen(Buffer *
-     char ** reported_argv = NULL;
-     size_t count = 0;
-     char * action_logbuf = NULL;
-    Buffer action_agentbuf;
-+    struct sshbuf *action_agentbuf = NULL;
-     uint8_t free_logbuf = 0;
-     char * retc;
-     int32_t reti;
-+    int r;
- 
-    rnd = pamsshagentauth_arc4random();
-+    rnd = arc4random();
-     cookie_len = ((uint8_t) rnd);
-     while (cookie_len < 16) { 
-         cookie_len += 16;                                          /* Add 16 bytes to the size to ensure that while the length is random, the length is always reasonable; ticket #18 */
-     }
- 
-    cookie = pamsshagentauth_xcalloc(1,cookie_len);
-+    cookie = xcalloc(1, cookie_len);
- 
-     for (i = 0; i < cookie_len; i++) {
-         if (i % 4 == 0) {
-            rnd = pamsshagentauth_arc4random();
-+            rnd = arc4random();
-         }
-         cookie[i] = (u_char) rnd;
-         rnd >>= 8;
-@@ -144,7 +151,8 @@ pamsshagentauth_session_id2_gen(Buffer *
-     }
-     else {
-         action_logbuf = "unknown on this platform";
-        pamsshagentauth_buffer_init(&action_agentbuf); /* stays empty, means unavailable */
-+        if ((action_agentbuf = sshbuf_new()) == NULL) /* stays empty, means unavailable */
-+            fatal("%s: sshbuf_new failed", __func__);
-     }
-     
-     /*
-@@ -161,35 +169,39 @@ pamsshagentauth_session_id2_gen(Buffer *
-     retc = getcwd(pwd, sizeof(pwd) - 1);
-     time(&ts);
- 
-    pamsshagentauth_buffer_init(session_id2);
-+    if ((*session_id2 = sshbuf_new()) == NULL)
-+        fatal("%s: sshbuf_new failed", __func__);
- 
-    pamsshagentauth_buffer_put_int(session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1);
-    /* pamsshagentauth_debug3("cookie: %s", pamsshagentauth_tohex(cookie, cookie_len)); */
-    pamsshagentauth_buffer_put_string(session_id2, cookie, cookie_len);
-    /* pamsshagentauth_debug3("user: %s", user); */
-    pamsshagentauth_buffer_put_cstring(session_id2, user);
-    /* pamsshagentauth_debug3("ruser: %s", ruser); */
-    pamsshagentauth_buffer_put_cstring(session_id2, ruser);
-    /* pamsshagentauth_debug3("servicename: %s", servicename); */
-    pamsshagentauth_buffer_put_cstring(session_id2, servicename);
-    /* pamsshagentauth_debug3("pwd: %s", pwd); */
-    if(retc)
-        pamsshagentauth_buffer_put_cstring(session_id2, pwd);
-    else
-        pamsshagentauth_buffer_put_cstring(session_id2, "");
-    /* pamsshagentauth_debug3("action: %s", action_logbuf); */
-    pamsshagentauth_buffer_put_string(session_id2, action_agentbuf.buf + action_agentbuf.offset, action_agentbuf.end - action_agentbuf.offset);
-+    if ((r = sshbuf_put_u32(*session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1)) != 0 ||
-+        (r = sshbuf_put_string(*session_id2, cookie, cookie_len)) != 0 ||
-+        (r = sshbuf_put_cstring(*session_id2, user)) != 0 ||
-+        (r = sshbuf_put_cstring(*session_id2, ruser)) != 0 ||
-+        (r = sshbuf_put_cstring(*session_id2, servicename)) != 0)
-+        fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+    if (retc) {
-+        if ((r = sshbuf_put_cstring(*session_id2, pwd)) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+    } else {
-+        if ((r = sshbuf_put_cstring(*session_id2, "")) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+    }
-+    if ((r = sshbuf_put_stringb(*session_id2, action_agentbuf)) != 0)
-+        fatal("%s: buffer error: %s", __func__, ssh_err(r));
-     if (free_logbuf) { 
-        pamsshagentauth_xfree(action_logbuf);
-        pamsshagentauth_buffer_free(&action_agentbuf);
-+        free(action_logbuf);
-+        sshbuf_free(action_agentbuf);
-+    }
-+    /* debug3("hostname: %s", hostname); */
-+    if (reti >= 0) {
-+        if ((r = sshbuf_put_cstring(*session_id2, hostname)) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
-+    } else {
-+        if ((r = sshbuf_put_cstring(*session_id2, "")) != 0)
-+            fatal("%s: buffer error: %s", __func__, ssh_err(r));
-     }
-    /* pamsshagentauth_debug3("hostname: %s", hostname); */
-    if(reti >= 0)
-        pamsshagentauth_buffer_put_cstring(session_id2, hostname);
-    else
-        pamsshagentauth_buffer_put_cstring(session_id2, "");
-    /* pamsshagentauth_debug3("ts: %ld", ts); */
-    pamsshagentauth_buffer_put_int64(session_id2, (uint64_t) ts);
-+    /* debug3("ts: %ld", ts); */
-+    if ((r = sshbuf_put_u64(*session_id2, (uint64_t) ts)) != 0)
-+        fatal("%s: buffer error: %s", __func__, ssh_err(r));
- 
-     free(cookie);
-     return;
-@@ -278,7 +290,8 @@ ssh_get_authentication_connection_for_ui
- 
- 	auth = xmalloc(sizeof(*auth));
- 	auth->fd = sock;
-	buffer_init(&auth->identities);
-+	if ((auth->identities = sshbuf_new()) == NULL)
-+           fatal("%s: sshbuf_new failed", __func__);
- 	auth->howmany = 0;
- 
- 	return auth;
-@@ -287,9 +300,9 @@ ssh_get_authentication_connection_for_ui
- int
- pamsshagentauth_find_authorized_keys(const char * user, const char * ruser, const char * servicename)
- {
-    Buffer session_id2 = { 0 };
-+    struct sshbuf *session_id2 = NULL;
-     Identity *id;
-    Key *key;
-+    struct sshkey *key;
-     AuthenticationConnection *ac;
-     char *comment;
-     uint8_t retval = 0;
-@@ -299,31 +312,30 @@ pamsshagentauth_find_authorized_keys(con
-     pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
- 
-     if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
-        pamsshagentauth_verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
-+        verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
-         for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) 
-         {
-             if(key != NULL) {
-                id = pamsshagentauth_xcalloc(1, sizeof(*id));
-+                id = xcalloc(1, sizeof(*id));
-                 id->key = key;
-                 id->filename = comment;
-                 id->ac = ac;
-                if(userauth_pubkey_from_id(ruser, id, &session_id2)) {
-+                if(userauth_pubkey_from_id(ruser, id, session_id2)) {
-                     retval = 1;
-                 }
-                pamsshagentauth_xfree(id->filename);
-                pamsshagentauth_key_free(id->key);
-                pamsshagentauth_xfree(id);
-+                free(id->filename);
-+                key_free(id->key);
-+                free(id);
-                 if(retval == 1)
-                     break;
-             }
-         }
-        pamsshagentauth_buffer_free(&session_id2);
-+        sshbuf_free(session_id2);
-         ssh_close_authentication_connection(ac);
-     }
-     else {
-        pamsshagentauth_verbose("No ssh-agent could be contacted");
-+        verbose("No ssh-agent could be contacted");
-     }
-    /* pamsshagentauth_xfree(session_id2); */
-     EVP_cleanup();
-     return retval;
- }
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.c.psaa-compat	2020-09-23 10:52:16.423001461 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.c	2020-09-23 10:53:10.631727657 +0200
-@@ -106,7 +106,7 @@ pam_sm_authenticate(pam_handle_t * pamh,
-  * a patch 8-)
-  */
- #if ! HAVE___PROGNAME || HAVE_BUNDLE
-    __progname = pamsshagentauth_xstrdup(servicename);
-+    __progname = xstrdup(servicename);
- #endif
- 
-     for(i = argc, argv_ptr = (char **) argv; i > 0; ++argv_ptr, i--) {
-@@ -132,11 +132,11 @@ pam_sm_authenticate(pam_handle_t * pamh,
- #endif
-     }
- 
-    pamsshagentauth_log_init(__progname, log_lvl, facility, getenv("PAM_SSH_AGENT_AUTH_DEBUG") ? 1 : 0);
-+    log_init(__progname, log_lvl, facility, getenv("PAM_SSH_AGENT_AUTH_DEBUG") ? 1 : 0);
-     pam_get_item(pamh, PAM_USER, (void *) &user);
-     pam_get_item(pamh, PAM_RUSER, (void *) &ruser_ptr);
- 
-    pamsshagentauth_verbose("Beginning pam_ssh_agent_auth for user %s", user);
-+    verbose("Beginning pam_ssh_agent_auth for user %s", user);
- 
-     if(ruser_ptr) {
-         strncpy(ruser, ruser_ptr, sizeof(ruser) - 1);
-@@ -151,12 +151,12 @@ pam_sm_authenticate(pam_handle_t * pamh,
- #ifdef ENABLE_SUDO_HACK
-         if( (strlen(sudo_service_name) > 0) && strncasecmp(servicename, sudo_service_name, sizeof(sudo_service_name) - 1) == 0 && getenv("SUDO_USER") ) {
-             strncpy(ruser, getenv("SUDO_USER"), sizeof(ruser) - 1 );
-            pamsshagentauth_verbose( "Using environment variable SUDO_USER (%s)", ruser );
-+            verbose( "Using environment variable SUDO_USER (%s)", ruser );
-         } else
- #endif
-         {
-             if( ! getpwuid(getuid()) ) {
-                pamsshagentauth_verbose("Unable to getpwuid(getuid())");
-+                verbose("Unable to getpwuid(getuid())");
-                 goto cleanexit;
-             }
-             strncpy(ruser, getpwuid(getuid())->pw_name, sizeof(ruser) - 1);
-@@ -165,11 +165,11 @@ pam_sm_authenticate(pam_handle_t * pamh,
- 
-     /* Might as well explicitely confirm the user exists here */
-     if(! getpwnam(ruser) ) {
-        pamsshagentauth_verbose("getpwnam(%s) failed, bailing out", ruser);
-+        verbose("getpwnam(%s) failed, bailing out", ruser);
-         goto cleanexit;
-     }
-     if( ! getpwnam(user) ) {
-        pamsshagentauth_verbose("getpwnam(%s) failed, bailing out", user);
-+        verbose("getpwnam(%s) failed, bailing out", user);
-         goto cleanexit;
-     }
- 
-@@ -179,8 +179,8 @@ pam_sm_authenticate(pam_handle_t * pamh,
-          */
-         parse_authorized_key_file(user, authorized_keys_file_input);
-     } else {
-        pamsshagentauth_verbose("Using default file=/etc/security/authorized_keys");
-        authorized_keys_file = pamsshagentauth_xstrdup("/etc/security/authorized_keys");
-+        verbose("Using default file=/etc/security/authorized_keys");
-+        authorized_keys_file = xstrdup("/etc/security/authorized_keys");
-     }
- 
-     /*
-@@ -189,7 +189,7 @@ pam_sm_authenticate(pam_handle_t * pamh,
-      */
- 
-     if(user && strlen(ruser) > 0) {
-        pamsshagentauth_verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-+        verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file);
- 
-         /*
-          * Attempt to read data from the sshd if we're being called as an auth agent.
-@@ -197,10 +197,10 @@ pam_sm_authenticate(pam_handle_t * pamh,
-         const char* ssh_user_auth = pam_getenv(pamh, "SSH_AUTH_INFO_0");
-         int sshd_service = strncasecmp(servicename, sshd_service_name, sizeof(sshd_service_name) - 1);
-         if (sshd_service == 0 && ssh_user_auth != NULL) {
-            pamsshagentauth_verbose("Got SSH_AUTH_INFO_0: `%.20s...'", ssh_user_auth);
-+            verbose("Got SSH_AUTH_INFO_0: `%.20s...'", ssh_user_auth);
-             if (userauth_pubkey_from_pam(ruser, ssh_user_auth) > 0) {
-                 retval = PAM_SUCCESS;
-                pamsshagentauth_logit("Authenticated (sshd): `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-+                logit("Authenticated (sshd): `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-                 goto cleanexit;
-             }
-         }
-@@ -208,13 +208,13 @@ pam_sm_authenticate(pam_handle_t * pamh,
-          * this pw_uid is used to validate the SSH_AUTH_SOCK, and so must be the uid of the ruser invoking the program, not the target-user
-          */
-         if(pamsshagentauth_find_authorized_keys(user, ruser, servicename)) { /* getpwnam(ruser)->pw_uid)) { */
-            pamsshagentauth_logit("Authenticated (agent): `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-+            logit("Authenticated (agent): `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-             retval = PAM_SUCCESS;
-         } else {
-            pamsshagentauth_logit("Failed Authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-+            logit("Failed Authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file);
-         }
-     } else {
-        pamsshagentauth_logit("No %s specified, cannot continue with this form of authentication", (user) ? "ruser" : "user" );
-+        logit("No %s specified, cannot continue with this form of authentication", (user) ? "ruser" : "user" );
-     }
- 
- cleanexit:
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.c.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.c	2020-09-23 10:52:16.424001475 +0200
-@@ -66,8 +66,8 @@
- #include "xmalloc.h"
- #include "match.h"
- #include "log.h"
-#include "buffer.h"
-#include "key.h"
-+#include "sshbuf.h"
-+#include "sshkey.h"
- #include "misc.h"
- 
- #include "xmalloc.h"
-@@ -77,7 +77,6 @@
- #include "pathnames.h"
- #include "secure_filename.h"
- 
-#include "identity.h"
- #include "pam_user_key_allowed2.h"
- 
- extern char *authorized_keys_file;
-@@ -117,12 +116,12 @@ parse_authorized_key_file(const char *us
-         } else {
-             slash_ptr = strchr(auth_keys_file_buf, '/');
-             if(!slash_ptr)
-                pamsshagentauth_fatal
-+                fatal
-                     ("cannot expand tilde in path without a `/'");
- 
-             owner_uname_len = slash_ptr - auth_keys_file_buf - 1;
-             if(owner_uname_len > (sizeof(owner_uname) - 1))
-                pamsshagentauth_fatal("Username too long");
-+                fatal("Username too long");
- 
-             strncat(owner_uname, auth_keys_file_buf + 1, owner_uname_len);
-             if(!authorized_keys_file_allowed_owner_uid)
-@@ -130,11 +129,11 @@ parse_authorized_key_file(const char *us
-                     getpwnam(owner_uname)->pw_uid;
-         }
-         authorized_keys_file =
-            pamsshagentauth_tilde_expand_filename(auth_keys_file_buf,
-+            tilde_expand_filename(auth_keys_file_buf,
-                                                   authorized_keys_file_allowed_owner_uid);
-         strncpy(auth_keys_file_buf, authorized_keys_file,
-                 sizeof(auth_keys_file_buf) - 1);
-        pamsshagentauth_xfree(authorized_keys_file)        /* when we
-+        free(authorized_keys_file)        /* when we
-                                                               percent_expand
-                                                               later, we'd step
-                                                               on this, so free
-@@ -150,13 +149,13 @@ parse_authorized_key_file(const char *us
-     strncat(hostname, fqdn, strcspn(fqdn, "."));
- #endif
-     authorized_keys_file =
-        pamsshagentauth_percent_expand(auth_keys_file_buf, "h",
-+        percent_expand(auth_keys_file_buf, "h",
-                                        getpwnam(user)->pw_dir, "H", hostname,
-                                        "f", fqdn, "u", user, NULL);
- }
- 
- int
-pam_user_key_allowed(const char *ruser, Key * key)
-+pam_user_key_allowed(const char *ruser, struct sshkey * key)
- {
-     return
-         pamsshagentauth_user_key_allowed2(getpwuid(authorized_keys_file_allowed_owner_uid),
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.h.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.h
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.h.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_authorized_keys.h	2020-09-23 10:52:16.424001475 +0200
-@@ -32,7 +32,7 @@
- #define _PAM_USER_KEY_ALLOWED_H
- 
- #include "identity.h"
-int pam_user_key_allowed(const char *, Key *);
-+int pam_user_key_allowed(const char *, struct sshkey *);
- void parse_authorized_key_file(const char *, const char *);
- 
- #endif
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.c.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.c	2020-09-23 10:52:16.424001475 +0200
-@@ -45,44 +45,46 @@
- #include "xmalloc.h"
- #include "ssh.h"
- #include "ssh2.h"
-#include "buffer.h"
-+#include "sshbuf.h"
- #include "log.h"
- #include "compat.h"
-#include "key.h"
-+#include "digest.h"
-+#include "sshkey.h"
- #include "pathnames.h"
- #include "misc.h"
- #include "secure_filename.h"
- #include "uidswap.h"
-
-#include "identity.h"
-+#include <unistd.h>
- 
- /* return 1 if user allows given key */
- /* Modified slightly from original found in auth2-pubkey.c */
- static int
-pamsshagentauth_check_authkeys_file(FILE * f, char *file, Key * key)
-+pamsshagentauth_check_authkeys_file(FILE * f, char *file, struct sshkey * key)
- {
-    char line[SSH_MAX_PUBKEY_BYTES];
-+    char *line = NULL;
-     int found_key = 0;
-     u_long linenum = 0;
-    Key *found;
-+    struct sshkey *found;
-     char *fp;
-+    size_t linesize = 0;
- 
-     found_key = 0;
-    found = pamsshagentauth_key_new(key->type);
-+    found = sshkey_new(key->type);
- 
-    while(read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
-+    while ((getline(&line, &linesize, f)) != -1) {
-         char *cp = NULL; /* *key_options = NULL; */
- 
-+        linenum++;
-         /* Skip leading whitespace, empty and comment lines. */
-         for(cp = line; *cp == ' ' || *cp == '\t'; cp++);
-         if(!*cp || *cp == '\n' || *cp == '#')
-             continue;
- 
-        if(pamsshagentauth_key_read(found, &cp) != 1) {
-+        if (sshkey_read(found, &cp) != 0) {
-             /* no key? check if there are options for this key */
-             int quoted = 0;
- 
-            pamsshagentauth_verbose("user_key_allowed: check options: '%s'", cp);
-+            verbose("user_key_allowed: check options: '%s'", cp);
-             /* key_options = cp; */
-             for(; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
-                 if(*cp == '\\' && cp[1] == '"')
-@@ -92,26 +94,27 @@ pamsshagentauth_check_authkeys_file(FILE
-             }
-             /* Skip remaining whitespace. */
-             for(; *cp == ' ' || *cp == '\t'; cp++);
-            if(pamsshagentauth_key_read(found, &cp) != 1) {
-                pamsshagentauth_verbose("user_key_allowed: advance: '%s'", cp);
-+            if(sshkey_read(found, &cp) != 0) {
-+                verbose("user_key_allowed: advance: '%s'", cp);
-                 /* still no key? advance to next line */
-                 continue;
-             }
-         }
-        if(pamsshagentauth_key_equal(found, key)) {
-+        if(sshkey_equal(found, key)) {
-             found_key = 1;
-            pamsshagentauth_logit("matching key found: file/command %s, line %lu", file,
-+            logit("matching key found: file/command %s, line %lu", file,
-                                   linenum);
-            fp = pamsshagentauth_key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
-            pamsshagentauth_logit("Found matching %s key: %s",
-                                  pamsshagentauth_key_type(found), fp);
-            pamsshagentauth_xfree(fp);
-+            fp = sshkey_fingerprint(found, SSH_DIGEST_SHA256, SSH_FP_BASE64);
-+            logit("Found matching %s key: %s",
-+                                  sshkey_type(found), fp);
-+            free(fp);
-             break;
-         }
-     }
-    pamsshagentauth_key_free(found);
-+    free(line);
-+    sshkey_free(found);
-     if(!found_key)
-        pamsshagentauth_verbose("key not found");
-+        verbose("key not found");
-     return found_key;
- }
- 
-@@ -120,19 +123,19 @@ pamsshagentauth_check_authkeys_file(FILE
-  * returns 1 if the key is allowed or 0 otherwise.
-  */
- int
-pamsshagentauth_user_key_allowed2(struct passwd *pw, Key * key, char *file)
-+pamsshagentauth_user_key_allowed2(struct passwd *pw, struct sshkey * key, char *file)
- {
-     FILE *f;
-     int found_key = 0;
-     struct stat st;
-    char buf[SSH_MAX_PUBKEY_BYTES];
-+    char buf[256];
- 
-     /* Temporarily use the user's uid. */
-    pamsshagentauth_verbose("trying public key file %s", file);
-+    verbose("trying public key file %s", file);
- 
-     /* Fail not so quietly if file does not exist */
-     if(stat(file, &st) < 0) {
-        pamsshagentauth_verbose("File not found: %s", file);
-+        verbose("File not found: %s", file);
-         return 0;
-     }
- 
-@@ -144,7 +147,7 @@ pamsshagentauth_user_key_allowed2(struct
- 
-     if(pamsshagentauth_secure_filename(f, file, pw, buf, sizeof(buf)) != 0) {
-         fclose(f);
-        pamsshagentauth_logit("Authentication refused: %s", buf);
-+        logit("Authentication refused: %s", buf);
-         return 0;
-     }
- 
-@@ -160,7 +163,7 @@ pamsshagentauth_user_key_allowed2(struct
- int
- pamsshagentauth_user_key_command_allowed2(char *authorized_keys_command,
-                           char *authorized_keys_command_user,
-                          struct passwd *user_pw, Key * key)
-+                          struct passwd *user_pw, struct sshkey * key)
- {
-     FILE *f;
-     int ok, found_key = 0;
-@@ -187,44 +190,44 @@ pamsshagentauth_user_key_command_allowed
-     else {
-         pw = getpwnam(authorized_keys_command_user);
-         if(pw == NULL) {
-            pamsshagentauth_logerror("authorized_keys_command_user \"%s\" not found: %s",
-+            error("authorized_keys_command_user \"%s\" not found: %s",
-                  authorized_keys_command_user, strerror(errno));
-             return 0;
-         }
-     }
- 
-    pamsshagentauth_temporarily_use_uid(pw);
-+    temporarily_use_uid(pw);
- 
-     if(stat(authorized_keys_command, &st) < 0) {
-        pamsshagentauth_logerror
-+        error
-             ("Could not stat AuthorizedKeysCommand \"%s\": %s",
-              authorized_keys_command, strerror(errno));
-         goto out;
-     }
-     if(pamsshagentauth_auth_secure_path
-        (authorized_keys_command, &st, NULL, 0, errmsg, sizeof(errmsg)) != 0) {
-        pamsshagentauth_logerror("Unsafe AuthorizedKeysCommand: %s", errmsg);
-+        error("Unsafe AuthorizedKeysCommand: %s", errmsg);
-         goto out;
-     }
- 
-     /* open the pipe and read the keys */
-     if(pipe(p) != 0) {
-        pamsshagentauth_logerror("%s: pipe: %s", __func__, strerror(errno));
-+        error("%s: pipe: %s", __func__, strerror(errno));
-         goto out;
-     }
- 
-    pamsshagentauth_debug("Running AuthorizedKeysCommand: \"%s\" as \"%s\" with argument: \"%s\"",
-+    debug("Running AuthorizedKeysCommand: \"%s\" as \"%s\" with argument: \"%s\"",
-                           authorized_keys_command, pw->pw_name, username);
- 
-     /* 
-      * Don't want to call this in the child, where it can fatal() and
-      * run cleanup_exit() code.
-      */
-    pamsshagentauth_restore_uid();
-+    restore_uid();
- 
-     switch ((pid = fork())) {
-     case -1:                                              /* error */
-        pamsshagentauth_logerror("%s: fork: %s", __func__, strerror(errno));
-+        error("%s: fork: %s", __func__, strerror(errno));
-         close(p[0]);
-         close(p[1]);
-         return 0;
-@@ -234,13 +237,13 @@ pamsshagentauth_user_key_command_allowed
- 
-         /* do this before the setresuid so thta they can be logged */
-         if((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
-            pamsshagentauth_logerror("%s: open %s: %s", __func__, _PATH_DEVNULL,
-+            error("%s: open %s: %s", __func__, _PATH_DEVNULL,
-                                      strerror(errno));
-             _exit(1);
-         }
-         if(dup2(devnull, STDIN_FILENO) == -1 || dup2(p[1], STDOUT_FILENO) == -1
-            || dup2(devnull, STDERR_FILENO) == -1) {
-            pamsshagentauth_logerror("%s: dup2: %s", __func__, strerror(errno));
-+            error("%s: dup2: %s", __func__, strerror(errno));
-             _exit(1);
-         }
- #if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID)
-@@ -248,7 +251,7 @@ pamsshagentauth_user_key_command_allowed
- #else
-         if (setgid(pw->pw_gid) != 0 || setegid(pw->pw_gid) != 0) {
- #endif
-            pamsshagentauth_logerror("setresgid %u: %s", (u_int) pw->pw_gid,
-+            error("setresgid %u: %s", (u_int) pw->pw_gid,
-                                      strerror(errno));
-             _exit(1);
-         }
-@@ -258,7 +261,7 @@ pamsshagentauth_user_key_command_allowed
- #else
-         if (setuid(pw->pw_uid) != 0 || seteuid(pw->pw_uid) != 0) {
- #endif
-            pamsshagentauth_logerror("setresuid %u: %s", (u_int) pw->pw_uid,
-+            error("setresuid %u: %s", (u_int) pw->pw_uid,
-                                      strerror(errno));
-             _exit(1);
-         }
-@@ -270,18 +273,18 @@ pamsshagentauth_user_key_command_allowed
- 
-         /* pretty sure this will barf because we are now suid, but since we
-            should't reach this anyway, I'll leave it here */
-        pamsshagentauth_logerror("AuthorizedKeysCommand %s exec failed: %s",
-+        error("AuthorizedKeysCommand %s exec failed: %s",
-                                  authorized_keys_command, strerror(errno));
-         _exit(127);
-     default:                                              /* parent */
-         break;
-     }
- 
-    pamsshagentauth_temporarily_use_uid(pw);
-+    temporarily_use_uid(pw);
- 
-     close(p[1]);
-     if((f = fdopen(p[0], "r")) == NULL) {
-        pamsshagentauth_logerror("%s: fdopen: %s", __func__, strerror(errno));
-+        error("%s: fdopen: %s", __func__, strerror(errno));
-         close(p[0]);
-         /* Don't leave zombie child */
-         while(waitpid(pid, NULL, 0) == -1 && errno == EINTR);
-@@ -292,22 +295,22 @@ pamsshagentauth_user_key_command_allowed
- 
-     while(waitpid(pid, &status, 0) == -1) {
-         if(errno != EINTR) {
-            pamsshagentauth_logerror("%s: waitpid: %s", __func__,
-+            error("%s: waitpid: %s", __func__,
-                                      strerror(errno));
-             goto out;
-         }
-     }
-     if(WIFSIGNALED(status)) {
-        pamsshagentauth_logerror("AuthorizedKeysCommand %s exited on signal %d",
-+        error("AuthorizedKeysCommand %s exited on signal %d",
-                                  authorized_keys_command, WTERMSIG(status));
-         goto out;
-     } else if(WEXITSTATUS(status) != 0) {
-        pamsshagentauth_logerror("AuthorizedKeysCommand %s returned status %d",
-+        error("AuthorizedKeysCommand %s returned status %d",
-                                  authorized_keys_command, WEXITSTATUS(status));
-         goto out;
-     }
-     found_key = ok;
-   out:
-    pamsshagentauth_restore_uid();
-+    restore_uid();
-     return found_key;
- }
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.h.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.h
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.h.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_user_key_allowed2.h	2020-09-23 10:52:16.424001475 +0200
-@@ -32,7 +32,7 @@
- #define _PAM_USER_KEY_ALLOWED_H
- 
- #include "identity.h"
-int pamsshagentauth_user_key_allowed2(struct passwd *, Key *, char *);
-int pamsshagentauth_user_key_command_allowed2(char *, char *, struct passwd *, Key *);
-+int pamsshagentauth_user_key_allowed2(struct passwd *, struct sshkey *, char *);
-+int pamsshagentauth_user_key_command_allowed2(char *, char *, struct passwd *, struct sshkey *);
- 
- #endif
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/secure_filename.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/secure_filename.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/secure_filename.c.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/secure_filename.c	2020-09-23 10:52:16.424001475 +0200
-@@ -53,8 +53,8 @@
- #include "xmalloc.h"
- #include "match.h"
- #include "log.h"
-#include "buffer.h"
-#include "key.h"
-+#include "sshbuf.h"
-+#include "sshkey.h"
- #include "misc.h"
- 
- 
-@@ -80,7 +80,7 @@ pamsshagentauth_auth_secure_path(const c
- 	int comparehome = 0;
- 	struct stat st;
- 
-    pamsshagentauth_verbose("auth_secure_filename: checking for uid: %u", uid);
-+    verbose("auth_secure_filename: checking for uid: %u", uid);
- 
- 	if (realpath(name, buf) == NULL) {
- 		snprintf(err, errlen, "realpath %s failed: %s", name,
-@@ -115,9 +115,9 @@ pamsshagentauth_auth_secure_path(const c
- 			snprintf(err, errlen, "dirname() failed");
- 			return -1;
- 		}
-		pamsshagentauth_strlcpy(buf, cp, sizeof(buf));
-+		strlcpy(buf, cp, sizeof(buf));
- 
-		pamsshagentauth_verbose("secure_filename: checking '%s'", buf);
-+		verbose("secure_filename: checking '%s'", buf);
- 		if (stat(buf, &st) < 0 ||
- 		    (st.st_uid != 0 && st.st_uid != uid) ||
- 		    (st.st_mode & 022) != 0) {
-@@ -128,7 +128,7 @@ pamsshagentauth_auth_secure_path(const c
- 
- 		/* If are passed the homedir then we can stop */
- 		if (comparehome && strcmp(homedir, buf) == 0) {
-			pamsshagentauth_verbose("secure_filename: terminating check at '%s'",
-+			verbose("secure_filename: terminating check at '%s'",
- 			    buf);
- 			break;
- 		}
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.c.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.c	2020-09-23 10:52:16.424001475 +0200
-@@ -37,10 +37,11 @@
- #include "xmalloc.h"
- #include "ssh.h"
- #include "ssh2.h"
-#include "buffer.h"
-+#include "sshbuf.h"
- #include "log.h"
- #include "compat.h"
-#include "key.h"
-+#include "sshkey.h"
-+#include "ssherr.h"
- #include "pathnames.h"
- #include "misc.h"
- #include "secure_filename.h"
-@@ -48,54 +49,59 @@
- #include "identity.h"
- #include "pam_user_authorized_keys.h"
- 
-+#define SSH2_MSG_USERAUTH_TRUST_REQUEST          54
-+
- /* extern u_char  *session_id2;
- extern uint8_t  session_id_len;
-  */
- 
- int
-userauth_pubkey_from_id(const char *ruser, Identity * id, Buffer * session_id2)
-+userauth_pubkey_from_id(const char *ruser, Identity * id, struct sshbuf * session_id2)
- {
-    Buffer          b = { 0 };
-+    struct sshbuf  *b = NULL;
-     char           *pkalg = NULL;
-     u_char         *pkblob = NULL, *sig = NULL;
-    u_int           blen = 0, slen = 0;
-    int             authenticated = 0;
-+    size_t          blen = 0, slen = 0;
-+    int             r, authenticated = 0;
- 
-    pkalg = (char *) key_ssh_name(id->key);
-+    pkalg = (char *) sshkey_ssh_name(id->key);
- 
-     /* first test if this key is even allowed */
-     if(! pam_user_key_allowed(ruser, id->key))
-        goto user_auth_clean_exit;
-+        goto user_auth_clean_exit_without_buffer;
- 
-    if(pamsshagentauth_key_to_blob(id->key, &pkblob, &blen) == 0)
-        goto user_auth_clean_exit;
-+    if(sshkey_to_blob(id->key, &pkblob, &blen) != 0)
-+        goto user_auth_clean_exit_without_buffer;
- 
-     /* construct packet to sign and test */
-    pamsshagentauth_buffer_init(&b);
-+    if ((b = sshbuf_new()) == NULL)
-+        fatal("%s: sshbuf_new failed", __func__);
- 
-    pamsshagentauth_buffer_put_string(&b, session_id2->buf + session_id2->offset, session_id2->end - session_id2->offset);
-    pamsshagentauth_buffer_put_char(&b, SSH2_MSG_USERAUTH_TRUST_REQUEST); 
-    pamsshagentauth_buffer_put_cstring(&b, ruser);
-    pamsshagentauth_buffer_put_cstring(&b, "pam_ssh_agent_auth");
-    pamsshagentauth_buffer_put_cstring(&b, "publickey");
-    pamsshagentauth_buffer_put_char(&b, 1);
-    pamsshagentauth_buffer_put_cstring(&b, pkalg);
-    pamsshagentauth_buffer_put_string(&b, pkblob, blen);
-+    if ((r = sshbuf_put_string(b, sshbuf_ptr(session_id2), sshbuf_len(session_id2))) != 0 ||
-+        (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_TRUST_REQUEST)) != 0 ||
-+        (r = sshbuf_put_cstring(b, ruser)) != 0 ||
-+        (r = sshbuf_put_cstring(b, "pam_ssh_agent_auth")) != 0 ||
-+        (r = sshbuf_put_cstring(b, "publickey")) != 0 ||
-+        (r = sshbuf_put_u8(b, 1)) != 0 ||
-+        (r = sshbuf_put_cstring(b, pkalg)) != 0 ||
-+        (r = sshbuf_put_string(b, pkblob, blen)) != 0)
-+        fatal("%s: buffer error: %s", __func__, ssh_err(r));
- 
-    if(ssh_agent_sign(id->ac, id->key, &sig, &slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) != 0)
-+    if (ssh_agent_sign(id->ac, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b)) != 0)
-         goto user_auth_clean_exit;
- 
-     /* test for correct signature */
-    if(pamsshagentauth_key_verify(id->key, sig, slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) == 1)
-+    if (sshkey_verify(id->key, sig, slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0, NULL) == 0)
-         authenticated = 1;
- 
-   user_auth_clean_exit:
-     /* if(&b != NULL) */
-    pamsshagentauth_buffer_free(&b);
-+    sshbuf_free(b);
-+  user_auth_clean_exit_without_buffer:
-     if(sig != NULL)
-        pamsshagentauth_xfree(sig);
-+        free(sig);
-     if(pkblob != NULL)
-        pamsshagentauth_xfree(pkblob);
-+        free(pkblob);
-     CRYPTO_cleanup_all_ex_data();
-     return authenticated;
- }
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.h.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.h
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.h.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_id.h	2020-09-23 10:52:16.424001475 +0200
-@@ -31,7 +31,7 @@
- #ifndef _USERAUTH_PUBKEY_FROM_ID_H
- #define _USERAUTH_PUBKEY_FROM_ID_H
- 
-#include <identity.h>
-int userauth_pubkey_from_id(const char *, Identity *, Buffer *);
-+#include "identity.h"
-+int userauth_pubkey_from_id(const char *, Identity *, struct sshbuf *);
- 
- #endif
-diff -up openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/uuencode.c.psaa-compat openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/uuencode.c
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/uuencode.c.psaa-compat	2019-07-08 18:36:13.000000000 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/uuencode.c	2020-09-23 10:52:16.424001475 +0200
-@@ -56,7 +56,7 @@ pamsshagentauth_uudecode(const char *src
- 	/* and remove trailing whitespace because __b64_pton needs this */
- 	*p = '\0';
- 	len = pamsshagentauth___b64_pton(encoded, target, targsize);
-	pamsshagentauth_xfree(encoded);
-+	xfree(encoded);
- 	return len;
- }
- 
-@@ -70,7 +70,7 @@ pamsshagentauth_dump_base64(FILE *fp, co
- 		fprintf(fp, "dump_base64: len > 65536\n");
- 		return;
- 	}
-	buf = pamsshagentauth_xmalloc(2*len);
-+	buf = malloc(2*len);
- 	n = pamsshagentauth_uuencode(data, len, buf, 2*len);
- 	for (i = 0; i < n; i++) {
- 		fprintf(fp, "%c", buf[i]);
-@@ -79,5 +79,5 @@ pamsshagentauth_dump_base64(FILE *fp, co
- 	}
- 	if (i % 70 != 69)
- 		fprintf(fp, "\n");
-	pamsshagentauth_xfree(buf);
-+	free(buf);
- }
--- openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_pam.c.compat	2020-09-23 11:32:30.783695267 +0200
-+++ openssh/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/userauth_pubkey_from_pam.c	2020-09-23 11:33:21.383389036 +0200
-@@ -33,7 +33,8 @@
- #include <string.h>
- 
- #include "defines.h"
-#include "key.h"
-+#include <includes.h>
-+#include "sshkey.h"
- #include "log.h"
- 
- #include "pam_user_authorized_keys.h"
-@@ -42,28 +42,28 @@
-     int authenticated = 0;
-     const char method[] = "publickey ";
- 
-    char* ai = pamsshagentauth_xstrdup(ssh_auth_info);
-+    char* ai = xstrdup(ssh_auth_info);
-     char* saveptr;
- 
-     char* auth_line = strtok_r(ai, "\n", &saveptr);
-     while (auth_line != NULL) {
-         if (strncmp(auth_line, method, sizeof(method) - 1) == 0) {
-             char* key_str = auth_line + sizeof(method) - 1;
-            Key* key = pamsshagentauth_key_new(KEY_UNSPEC);
-+            struct sshkey* key = sshkey_new(KEY_UNSPEC);
-             if (key == NULL) {
-                 continue;
-             }
-            int r = pamsshagentauth_key_read(key, &key_str);
-+            int r = sshkey_read(key, &key_str);
-             if (r == 1) {
-                 if (pam_user_key_allowed(ruser, key)) {
-                     authenticated = 1;
-                    pamsshagentauth_key_free(key);
-+                    sshkey_free(key);
-                     break;
-                 }
-             } else {
-                pamsshagentauth_verbose("Failed to create key for %s: %d", auth_line, r);
-+                verbose("Failed to create key for %s: %d", auth_line, r);
-             }
-            pamsshagentauth_key_free(key);
-+            sshkey_free(key);
-         }
-         auth_line = strtok_r(NULL, "\n", &saveptr);
-     }
--- a/pam_ssh_agent_auth-0.10.2-dereference.patch
+++ b/pam_ssh_agent_auth-0.10.2-dereference.patch
@ -1,20 +0,0 @@
-diff --git a/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c b/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c
--- a/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c
-+++ b/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c
-@@ -158,11 +158,12 @@ parse_authorized_key_file(const char *user,
- int
- pam_user_key_allowed(const char *ruser, struct sshkey * key)
- {
-+    struct passwd *pw;
-     return
-        pamsshagentauth_user_key_allowed2(getpwuid(authorized_keys_file_allowed_owner_uid),
-                                          key, authorized_keys_file)
-        || pamsshagentauth_user_key_allowed2(getpwuid(0), key,
-                                             authorized_keys_file)
-+        ( (pw = getpwuid(authorized_keys_file_allowed_owner_uid)) &&
-+            pamsshagentauth_user_key_allowed2(pw, key, authorized_keys_file))
-+        || ((pw = getpwuid(0)) &&
-+            pamsshagentauth_user_key_allowed2(pw, key, authorized_keys_file))
-         || pamsshagentauth_user_key_command_allowed2(authorized_keys_command,
-                                                      authorized_keys_command_user,
-                                                      getpwnam(ruser), key);
--- a/pam_ssh_agent_auth-0.10.3-seteuid.patch
+++ b/pam_ssh_agent_auth-0.10.3-seteuid.patch
@ -1,37 +0,0 @@
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-seteuid openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
--- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-seteuid	2017-02-07 15:41:53.172334151 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2017-02-07 15:41:53.174334149 +0100
-@@ -238,17 +238,26 @@ ssh_get_authentication_socket_for_uid(ui
- 	}
- 
- 	errno = 0; 
-	seteuid(uid); /* To ensure a race condition is not used to circumvent the stat
-	             above, we will temporarily drop UID to the caller */
-	if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
-+	/* To ensure a race condition is not used to circumvent the stat
-+	   above, we will temporarily drop UID to the caller */
-+	if (seteuid(uid) == -1) {
- 		close(sock);
-        if(errno == EACCES)
-		fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
-+		error("seteuid(%lu) failed with error: %s",
-+		    (unsigned long) uid, strerror(errno));
- 		return -1;
- 	}
-+	if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
-+		close(sock);
-+		sock = -1;
-+		if(errno == EACCES)
-+			fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
-+	}
- 
-	seteuid(0); /* we now continue the regularly scheduled programming */
-
-+	/* we now continue the regularly scheduled programming */
-+	if (0 != seteuid(0)) {
-+		fatal("setuid(0) failed with error: %s", strerror(errno));
-+		return -1;
-+	}
- 	return sock;
- }
- 
--- a/pam_ssh_agent_auth-0.9.2-seteuid.patch
+++ b/pam_ssh_agent_auth-0.9.2-seteuid.patch
@ -0,0 +1,27 @@
+diff -up pam_ssh_agent_auth-0.9.2/iterate_ssh_agent_keys.c.seteuid pam_ssh_agent_auth-0.9.2/iterate_ssh_agent_keys.c
+--- pam_ssh_agent_auth-0.9.2/iterate_ssh_agent_keys.c.seteuid	2010-09-08 08:54:29.000000000 +0200
+++ pam_ssh_agent_auth-0.9.2/iterate_ssh_agent_keys.c	2010-11-22 08:38:05.000000000 +0100
+@@ -131,13 +131,18 @@ ssh_get_authentication_socket_for_uid(ui
+ 	}
+ 
+ 	errno = 0; 
+-	seteuid(uid); /* To ensure a race condition is not used to circumvent the stat
+-	             above, we will temporarily drop UID to the caller */
+	/* To ensure a race condition is not used to circumvent the stat
+	   above, we will temporarily drop UID to the caller */
+	if (seteuid(uid) == -1) {
+		close(sock);
+		error("seteuid(%lu) failed", (unsigned long) uid);
+		return -1;
+	}
+ 	if (connect(sock, (struct sockaddr *)&sunaddr, sizeof sunaddr) < 0) {
+ 		close(sock);
+-        if(errno == EACCES)
+-		fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
+-		return -1;
+		sock = -1;
+		if(errno == EACCES)
+			fatal("MAJOR SECURITY WARNING: uid %lu made a deliberate and malicious attempt to open an agent socket owned by another user", (unsigned long) uid);
+ 	}
+ 
+ 	seteuid(0); /* we now continue the regularly scheduled programming */
--- a/pam_ssh_agent_auth-0.9.2-visibility.patch
+++ b/pam_ssh_agent_auth-0.9.2-visibility.patch
@ -1,7 +1,7 @@
-diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.psaa-visibility openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c
--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.psaa-visibility	2014-03-31 19:35:17.000000000 +0200
-+++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c	2016-01-22 15:22:40.984469774 +0100
-@@ -72,7 +72,7 @@ char           *__progname;
+diff -up pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c.visibility pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c
+--- pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c.visibility	2009-12-21 20:57:34.000000000 +0100
+++ pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c	2012-06-21 20:01:31.356259429 +0200
+@@ -68,7 +68,7 @@ char           *__progname;
 extern char    *__progname;
 #endif
 
@ -10,7 +10,7 @@ diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.psaa-visib
 pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char **argv)
 {
     char          **argv_ptr;
-@@ -214,7 +214,7 @@ cleanexit:
+@@ -184,7 +184,7 @@ pam_sm_authenticate(pam_handle_t * pamh,
 }
 
 
@ -18,4 +18,4 @@ diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.psaa-visib
 +PAM_EXTERN int __attribute__ ((visibility ("default")))
 pam_sm_setcred(pam_handle_t * pamh, int flags, int argc, const char **argv)
 {
-     UNUSED(pamh);
+     return PAM_SUCCESS;
--- a/pam_ssh_agent_auth-0.9.3-agent_structure.patch
+++ b/pam_ssh_agent_auth-0.9.3-agent_structure.patch
@ -1,96 +0,0 @@
-diff -up openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/identity.h
--- openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-agent	2016-11-13 04:24:32.000000000 +0100
-+++ openssh/pam_ssh_agent_auth-0.10.3/identity.h	2017-09-27 14:25:49.421739027 +0200
-@@ -38,6 +38,12 @@
- typedef struct identity Identity;
- typedef struct idlist Idlist;
- 
-+typedef struct {
-+       int     fd;
-+       struct sshbuf *identities;
-+       int     howmany;
-+}      AuthenticationConnection;
-+
- struct identity {
-     TAILQ_ENTRY(identity) next;
-     AuthenticationConnection *ac;   /* set if agent supports key */
-diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
--- openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent	2017-09-27 14:25:49.420739021 +0200
-+++ openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2017-09-27 14:25:49.421739027 +0200
-@@ -39,6 +39,7 @@
- #include "sshbuf.h"
- #include "sshkey.h"
- #include "authfd.h"
-+#include "ssherr.h"
- #include <stdio.h>
- #include <openssl/evp.h>
- #include "ssh2.h"
-@@ -291,36 +292,43 @@ pamsshagentauth_find_authorized_keys(con
- {
-     struct sshbuf *session_id2 = NULL;
-     Identity *id;
-    struct sshkey *key;
-     AuthenticationConnection *ac;
-    char *comment;
-     uint8_t retval = 0;
-     uid_t uid = getpwnam(ruser)->pw_uid;
-+    struct ssh_identitylist *idlist;
-+    int r;
-+    unsigned int i;
- 
-     OpenSSL_add_all_digests();
-     pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
- 
-     if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
-         verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
-        for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) 
-        {
-            if(key != NULL) {
-+        if ((r = ssh_fetch_identitylist(ac->fd, &idlist)) != 0) {
-+            if (r != SSH_ERR_AGENT_NO_IDENTITIES)
-+               fprintf(stderr, "error fetching identities for "
-+                               "protocol %d: %s\n", 2, ssh_err(r));
-+        } else {
-+            for (i = 0; i < idlist->nkeys; i++)
-+            {
-+              if (idlist->keys[i] != NULL) {
-                 id = xcalloc(1, sizeof(*id));
-                id->key = key;
-                id->filename = comment;
-+                id->key = idlist->keys[i];
-+                id->filename = idlist->comments[i];
-                 id->ac = ac;
-                 if(userauth_pubkey_from_id(ruser, id, session_id2)) {
-                     retval = 1;
-                 }
-                free(id->filename);
-                key_free(id->key);
-                 free(id);
-                 if(retval == 1)
-                     break;
-            }
-        }
-+              }
-+            }
-        sshbuf_free(session_id2);
-        ssh_close_authentication_connection(ac);
-+            sshbuf_free(session_id2);
-+            ssh_free_identitylist(idlist);
-+        }
-+        ssh_close_authentication_socket(ac->fd);
-+        free(ac);
-     }
-     else {
-         verbose("No ssh-agent could be contacted");
-diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
--- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-agent	2017-09-27 14:25:49.420739021 +0200
-+++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2017-09-27 14:25:49.422739032 +0200
-@@ -84,7 +85,7 @@ userauth_pubkey_from_id(const char *ruse
-         (r = sshbuf_put_string(b, pkblob, blen)) != 0)
-         fatal("%s: buffer error: %s", __func__, ssh_err(r));
- 
-    if (ssh_agent_sign(id->ac, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b)) != 0)
-+    if (ssh_agent_sign(id->ac->fd, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0) != 0)
-         goto user_auth_clean_exit;
- 
-     /* test for correct signature */
--- a/pam_ssh_agent_auth-0.9.3-build.patch
+++ b/pam_ssh_agent_auth-0.9.3-build.patch
@ -1,11 +1,12 @@
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-build openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
--- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-build	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2017-02-07 14:29:41.626116675 +0100
-@@ -43,12 +43,31 @@
- #include <openssl/evp.h>
- #include "ssh2.h"
- #include "misc.h"
+diff -up pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c
+--- pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build	2010-01-13 03:17:01.000000000 +0100
+++ pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c	2012-06-21 20:14:56.432527764 +0200
+@@ -37,7 +37,16 @@
+ #include "buffer.h"
+ #include "key.h"
+ #include "authfd.h"
 +#include "ssh.h"
+ #include <stdio.h>
 +#include <sys/types.h>
 +#include <sys/stat.h>
 +#include <sys/socket.h>
@ -14,11 +15,12 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-b
 +#include <stdlib.h>
 +#include <errno.h>
 +#include <fcntl.h>
+ #include <openssl/evp.h>
 
 #include "userauth_pubkey_from_id.h"
- #include "identity.h"
- #include "get_command_line.h"
- extern char **environ;
+@@ -69,6 +78,96 @@ session_id2_gen()
+     return cookie;
+ }
 
 +/* 
 + * Added by Jamie Beverly, ensure socket fd points to a socket owned by the user 
@ -30,31 +32,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-b
 + * race condition; so a more "direct" log message is generated.
 + */
 +
- static char *
- log_action(char ** action, size_t count)
- {
-@@ -85,7 +104,7 @@ void
- pamsshagentauth_session_id2_gen(Buffer * session_id2, const char * user,
-                                 const char * ruser, const char * servicename)
- {
-    char *cookie = NULL;
-+    u_char *cookie = NULL;
-     uint8_t i = 0;
-     uint32_t rnd = 0;
-     uint8_t cookie_len;
-@@ -112,7 +131,7 @@ pamsshagentauth_session_id2_gen(Buffer *
-         if (i % 4 == 0) {
-             rnd = pamsshagentauth_arc4random();
-         }
-        cookie[i] = (char) rnd;
-+        cookie[i] = (u_char) rnd;
-         rnd >>= 8;
-     }
- 
-@@ -177,6 +196,86 @@ pamsshagentauth_session_id2_gen(Buffer *
- }
- 
- int
+int
 +ssh_get_authentication_socket_for_uid(uid_t uid)
 +{
 +	const char *authsocket;
@ -134,54 +112,56 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-b
 +	return auth;
 +}
 +
-+int
- pamsshagentauth_find_authorized_keys(const char * user, const char * ruser, const char * servicename)
+ int
+ find_authorized_keys(uid_t uid)
 {
-     Buffer session_id2 = { 0 };
-@@ -190,7 +289,7 @@ pamsshagentauth_find_authorized_keys(con
+@@ -81,7 +180,7 @@ find_authorized_keys(uid_t uid)
     OpenSSL_add_all_digests();
-     pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
+     session_id2 = session_id2_gen();
 
 -    if ((ac = ssh_get_authentication_connection(uid))) {
 +    if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
-         pamsshagentauth_verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
+         verbose("Contacted ssh-agent of user %s (%u)", getpwuid(uid)->pw_name, uid);
         for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) 
         {
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in.psaa-build openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in
--- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in.psaa-build	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in	2017-02-07 14:40:14.407566921 +0100
-@@ -52,7 +52,7 @@ PATHS=
+@@ -109,3 +208,4 @@ find_authorized_keys(uid_t uid)
+     EVP_cleanup();
+     return retval;
+ }
+
+diff -up pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build pam_ssh_agent_auth-0.9.3/Makefile.in
+--- pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build	2009-10-27 21:19:41.000000000 +0100
+++ pam_ssh_agent_auth-0.9.3/Makefile.in	2012-06-21 20:14:56.432527764 +0200
+@@ -28,7 +28,7 @@ PATHS=
 CC=@CC@
 LD=@LD@
 CFLAGS=@CFLAGS@
 -CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
-+CPPFLAGS=-I.. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
+CPPFLAGS=-I.. -I$(srcdir) -I/usr/include/nss3 -I/usr/include/nspr4 @CPPFLAGS@ $(PATHS) @DEFS@
 LIBS=@LIBS@
 AR=@AR@
 AWK=@AWK@
-@@ -61,8 +61,8 @@ INSTALL=@INSTALL@
+@@ -37,7 +37,7 @@ INSTALL=@INSTALL@
 PERL=@PERL@
 SED=@SED@
 ENT=@ENT@
 -LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
-LDFLAGS_SHARED = @LDFLAGS_SHARED@
 +LDFLAGS=-L.. -L../openbsd-compat/ @LDFLAGS@
-+LDFLAGS_SHARED =-Wl,-z,defs @LDFLAGS_SHARED@
+ LDFLAGS_SHARED = @LDFLAGS_SHARED@
 EXEEXT=@EXEEXT@
 
- INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
-@@ -74,7 +74,7 @@ SSHOBJS=xmalloc.o atomicio.o authfd.o bu
+@@ -48,7 +48,7 @@ PAM_MODULES=pam_ssh_agent_auth.so
 
- ED25519OBJS=ed25519-donna/ed25519.o
+ SSHOBJS=xmalloc.o atomicio.o authfd.o bufaux.o bufbn.o buffer.o cleanup.o entropy.o fatal.o key.o log.o misc.o secure_filename.o ssh-dss.o ssh-rsa.o uuencode.o compat.o
 
-PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o get_command_line.o userauth_pubkey_from_pam.o
-+PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o get_command_line.o userauth_pubkey_from_pam.o secure_filename.o
+-PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o
+PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o secure_filename.o
 
 
 MANPAGES_IN	= pam_ssh_agent_auth.pod
-@@ -94,13 +94,13 @@ $(PAM_MODULES): Makefile.in config.h
+@@ -67,13 +67,13 @@ $(PAM_MODULES): Makefile.in config.h
 .c.o:
- 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
 
 -LIBCOMPAT=openbsd-compat/libopenbsd-compat.a
 +LIBCOMPAT=../openbsd-compat/libopenbsd-compat.a
@ -189,10 +169,11 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in.psaa-build openssh-
 	(cd openbsd-compat && $(MAKE))
 always:
 
-pam_ssh_agent_auth.so: $(LIBCOMPAT) $(SSHOBJS) $(ED25519OBJS) $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o
-	$(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(ED25519OBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat pam_ssh_agent_auth.o $(LIBS) -lpam
-+pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o ../uidswap.o ../ssh-sk-client.o
-+	$(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) ../ssh-sk-client.o $(LDFLAGS) -lssh -lopenbsd-compat pam_ssh_agent_auth.o ../uidswap.o $(LIBS) -lpam
+-pam_ssh_agent_auth.so: $(LIBCOMPAT) $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o
+-	$(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat $(LIBS) -lpam pam_ssh_agent_auth.o
+pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o
+	$(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) -lpam -lnss3 pam_ssh_agent_auth.o
 
 $(MANPAGES): $(MANPAGES_IN)
- 	pod2man --section=8 --release=v0.10.3 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8
+ 	pod2man --section=8 --release=v0.8 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8
+diff -up pam_ssh_agent_auth-0.9.3/pam_user_authorized_keys.c.psaa-build pam_ssh_agent_auth-0.9.3/pam_user_authorized_keys.c
--- a/pam_ssh_agent_auth-0.9.3-no-xfree.patch
+++ b/pam_ssh_agent_auth-0.9.3-no-xfree.patch
@ -0,0 +1,430 @@
+--- pam_ssh_agent_auth-0.9.3.orig/authfd.c	2013-10-30 17:14:26.013615342 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/authfd.c	2013-10-30 17:15:07.353327799 +0100
+@@ -260,7 +260,7 @@ 
+ {
+ 	buffer_free(&auth->identities);
+ 	close(auth->fd);
+-	xfree(auth);
+	free(auth);
+ }
+ 
+ /* Lock/unlock agent */
+@@ -379,7 +379,7 @@ 
+ 		blob = buffer_get_string(&auth->identities, &blen);
+ 		*comment = buffer_get_string(&auth->identities, NULL);
+ 		key = key_from_blob(blob, blen);
+-		xfree(blob);
+		free(blob);
+ 		break;
+ 	default:
+ 		return NULL;
+@@ -472,7 +472,7 @@ 
+ 	buffer_put_string(&msg, blob, blen);
+ 	buffer_put_string(&msg, data, datalen);
+ 	buffer_put_int(&msg, flags);
+-	xfree(blob);
+	free(blob);
+ 
+ 	if (ssh_request_reply(auth, &msg, &msg) == 0) {
+ 		buffer_free(&msg);
+@@ -612,7 +612,7 @@ 
+ 		key_to_blob(key, &blob, &blen);
+ 		buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);
+ 		buffer_put_string(&msg, blob, blen);
+-		xfree(blob);
+		free(blob);
+ 	} else {
+ 		buffer_free(&msg);
+ 		return 0;
+--- pam_ssh_agent_auth-0.9.3.orig/bufaux.c	2013-10-30 17:14:26.014615310 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/bufaux.c	2013-10-30 17:15:07.354327768 +0100
+@@ -176,7 +176,7 @@ 
+ 	/* Get the string. */
+ 	if (buffer_get_ret(buffer, value, len) == -1) {
+ 		logerror("buffer_get_string_ret: buffer_get failed");
+-		xfree(value);
+		free(value);
+ 		return (NULL);
+ 	}
+ 	/* Append a null character to make processing easier. */
+--- pam_ssh_agent_auth-0.9.3.orig/bufbn.c	2013-10-30 17:14:26.014615310 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/bufbn.c	2013-10-30 17:15:07.354327768 +0100
+@@ -69,7 +69,7 @@ 
+ 	if (oi != bin_size) {
+ 		logerror("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d",
+ 		    oi, bin_size);
+-		xfree(buf);
+		free(buf);
+ 		return (-1);
+ 	}
+ 
+@@ -80,7 +80,7 @@ 
+ 	buffer_append(buffer, buf, oi);
+ 
+ 	memset(buf, 0, bin_size);
+-	xfree(buf);
+	free(buf);
+ 
+ 	return (0);
+ }
+@@ -167,13 +167,13 @@ 
+ 	if (oi < 0 || (u_int)oi != bytes - 1) {
+ 		logerror("buffer_put_bignum2_ret: BN_bn2bin() failed: "
+ 		    "oi %d != bin_size %d", oi, bytes);
+-		xfree(buf);
+		free(buf);
+ 		return (-1);
+ 	}
+ 	hasnohigh = (buf[1] & 0x80) ? 0 : 1;
+ 	buffer_put_string(buffer, buf+hasnohigh, bytes-hasnohigh);
+ 	memset(buf, 0, bytes);
+-	xfree(buf);
+	free(buf);
+ 	return (0);
+ }
+ 
+@@ -197,21 +197,21 @@ 
+ 
+ 	if (len > 0 && (bin[0] & 0x80)) {
+ 		logerror("buffer_get_bignum2_ret: negative numbers not supported");
+-		xfree(bin);
+		free(bin);
+ 		return (-1);
+ 	}
+ 	if (len > 8 * 1024) {
+ 		logerror("buffer_get_bignum2_ret: cannot handle BN of size %d",
+ 		    len);
+-		xfree(bin);
+		free(bin);
+ 		return (-1);
+ 	}
+ 	if (BN_bin2bn(bin, len, value) == NULL) {
+ 		logerror("buffer_get_bignum2_ret: BN_bin2bn failed");
+-		xfree(bin);
+		free(bin);
+ 		return (-1);
+ 	}
+-	xfree(bin);
+	free(bin);
+ 	return (0);
+ }
+ 
+--- pam_ssh_agent_auth-0.9.3.orig/buffer.c	2013-10-30 17:14:26.014615310 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/buffer.c	2013-10-30 17:15:07.355327737 +0100
+@@ -50,7 +50,7 @@ 
+ 	if (buffer->alloc > 0) {
+ 		memset(buffer->buf, 0, buffer->alloc);
+ 		buffer->alloc = 0;
+-		xfree(buffer->buf);
+		free(buffer->buf);
+ 	}
+ }
+ 
+--- pam_ssh_agent_auth-0.9.3.orig/iterate_ssh_agent_keys.c	2013-10-30 17:14:26.031614782 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/iterate_ssh_agent_keys.c	2013-10-30 17:15:07.357327674 +0100
+@@ -197,9 +197,9 @@ 
+                 if(userauth_pubkey_from_id(id)) {
+                     retval = 1;
+                 }
+-                xfree(id->filename);
+                free(id->filename);
+                 key_free(id->key);
+-                xfree(id);
+                free(id);
+                 if(retval == 1)
+                     break;
+             }
+@@ -209,7 +209,7 @@ 
+     else {
+         verbose("No ssh-agent could be contacted");
+     }
+-    xfree(session_id2);
+    free(session_id2);
+     EVP_cleanup();
+     return retval;
+ }
+--- pam_ssh_agent_auth-0.9.3.orig/key.c	2013-10-30 17:14:26.017615218 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/key.c	2013-10-30 17:15:07.358327643 +0100
+@@ -154,7 +154,7 @@ 
+ 		fatal("key_free: bad key type %d", k->type);
+ 		break;
+ 	}
+-	xfree(k);
+	free(k);
+ }
+ 
+ int
+@@ -229,7 +229,7 @@ 
+ 		EVP_DigestUpdate(&ctx, blob, len);
+ 		EVP_DigestFinal(&ctx, retval, dgst_raw_length);
+ 		memset(blob, 0, len);
+-		xfree(blob);
+		free(blob);
+ 	} else {
+ 		fatal("key_fingerprint_raw: blob is null");
+ 	}
+@@ -324,7 +324,7 @@ 
+ 		break;
+ 	}
+ 	memset(dgst_raw, 0, dgst_raw_len);
+-	xfree(dgst_raw);
+	free(dgst_raw);
+ 	return retval;
+ }
+ 
+@@ -447,11 +447,11 @@ 
+ 		n = uudecode(cp, blob, len);
+ 		if (n < 0) {
+ 			logerror("key_read: uudecode %s failed", cp);
+-			xfree(blob);
+			free(blob);
+ 			return -1;
+ 		}
+ 		k = key_from_blob(blob, (u_int)n);
+-		xfree(blob);
+		free(blob);
+ 		if (k == NULL) {
+ 			logerror("key_read: key_from_blob %s failed", cp);
+ 			return -1;
+@@ -526,8 +526,8 @@ 
+ 			fprintf(f, "%s %s", key_ssh_name(key), uu);
+ 			success = 1;
+ 		}
+-		xfree(blob);
+-		xfree(uu);
+		free(blob);
+		free(uu);
+ 	}
+ 	return success;
+ }
+@@ -673,12 +673,12 @@ 
+ 		switch (key_type_from_name(p)) {
+ 		case KEY_RSA1:
+ 		case KEY_UNSPEC:
+-			xfree(s);
+			free(s);
+ 			return 0;
+ 		}
+ 	}
+ 	verbose("key names ok: [%s]", names);
+-	xfree(s);
+	free(s);
+ 	return 1;
+ }
+ 
+@@ -743,7 +743,7 @@ 
+ 		logerror("key_from_blob: remaining bytes in key blob %d", rlen);
+  out:
+ 	if (ktype != NULL)
+-		xfree(ktype);
+		free(ktype);
+ 	buffer_free(&b);
+ 	return key;
+ }
+--- pam_ssh_agent_auth-0.9.3.orig/misc.c	2013-10-30 17:14:26.017615218 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/misc.c	2013-10-30 17:15:07.360327581 +0100
+@@ -251,13 +251,13 @@ 
+ 		*remote = SSH_TUNID_ANY;
+ 		sp = xstrdup(s);
+ 		if ((ep = strchr(sp, ':')) == NULL) {
+-			xfree(sp);
+			free(sp);
+ 			return (a2tun(s, NULL));
+ 		}
+ 		ep[0] = '\0'; ep++;
+ 		*remote = a2tun(ep, NULL);
+ 		tun = a2tun(sp, NULL);
+-		xfree(sp);
+		free(sp);
+ 		return (*remote == SSH_TUNID_ERR ? *remote : tun);
+ 	}
+ 
+@@ -490,7 +490,7 @@ 
+ 	if (which >= args->num)
+ 		fatal("replacearg: tried to replace invalid arg %d >= %d",
+ 		    which, args->num);
+-	xfree(args->list[which]);
+	free(args->list[which]);
+ 	args->list[which] = cp;
+ }
+ 
+@@ -501,8 +501,8 @@ 
+ 
+ 	if (args->list != NULL) {
+ 		for (i = 0; i < args->num; i++)
+-			xfree(args->list[i]);
+-		xfree(args->list);
+			free(args->list[i]);
+		free(args->list);
+ 		args->nalloc = args->num = 0;
+ 		args->list = NULL;
+ 	}
+--- pam_ssh_agent_auth-0.9.3.orig/pam_user_authorized_keys.c	2013-10-30 17:14:26.017615218 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/pam_user_authorized_keys.c	2013-10-30 17:15:07.361327550 +0100
+@@ -121,7 +121,7 @@ 
+         }
+         authorized_keys_file = tilde_expand_filename(auth_keys_file_buf, authorized_keys_file_allowed_owner_uid);
+         strncpy(auth_keys_file_buf, authorized_keys_file, sizeof(auth_keys_file_buf) - 1 );
+-        xfree(authorized_keys_file) /* when we percent_expand later, we'd step on this, so free it immediately */;
+        free(authorized_keys_file) /* when we percent_expand later, we'd step on this, so free it immediately */;
+     }
+ 
+     if(strstr(auth_keys_file_buf, "%h")) {
+--- pam_ssh_agent_auth-0.9.3.orig/pam_user_key_allowed2.c	2013-10-30 17:14:26.018615187 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/pam_user_key_allowed2.c	2013-10-30 17:15:07.361327550 +0100
+@@ -121,7 +121,7 @@ 
+ 			fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
+ 			logit("Found matching %s key: %s",
+ 			    key_type(found), fp);
+-			xfree(fp);
+			free(fp);
+ 			break;
+ 		}
+ 	}
+--- pam_ssh_agent_auth-0.9.3.orig/ssh-dss.c	2013-10-30 17:14:26.014615310 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/ssh-dss.c	2013-10-30 17:15:07.361327550 +0100
+@@ -135,17 +135,17 @@ 
+ 		if (strcmp("ssh-dss", ktype) != 0) {
+ 			logerror("ssh_dss_verify: cannot handle type %s", ktype);
+ 			buffer_free(&b);
+-			xfree(ktype);
+			free(ktype);
+ 			return -1;
+ 		}
+-		xfree(ktype);
+		free(ktype);
+ 		sigblob = buffer_get_string(&b, &len);
+ 		rlen = buffer_len(&b);
+ 		buffer_free(&b);
+ 		if (rlen != 0) {
+ 			logerror("ssh_dss_verify: "
+ 			    "remaining bytes in signature %d", rlen);
+-			xfree(sigblob);
+			free(sigblob);
+ 			return -1;
+ 		}
+ 	}
+@@ -167,7 +167,7 @@ 
+ 
+ 	/* clean up */
+ 	memset(sigblob, 0, len);
+-	xfree(sigblob);
+	free(sigblob);
+ 
+ 	/* sha1 the data */
+ 	EVP_DigestInit(&md, evp_md);
+--- pam_ssh_agent_auth-0.9.3.orig/ssh-rsa.c	2013-10-30 17:14:26.015615278 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/ssh-rsa.c	2013-10-30 17:15:07.362327518 +0100
+@@ -70,7 +70,7 @@ 
+ 
+ 		logerror("ssh_rsa_sign: RSA_sign failed: %s",
+ 		    ERR_error_string(ecode, NULL));
+-		xfree(sig);
+		free(sig);
+ 		return -1;
+ 	}
+ 	if (len < slen) {
+@@ -80,7 +80,7 @@ 
+ 		memset(sig, 0, diff);
+ 	} else if (len > slen) {
+ 		logerror("ssh_rsa_sign: slen %u slen2 %u", slen, len);
+-		xfree(sig);
+		free(sig);
+ 		return -1;
+ 	}
+ 	/* encode signature */
+@@ -96,7 +96,7 @@ 
+ 	}
+ 	buffer_free(&b);
+ 	memset(sig, 's', slen);
+-	xfree(sig);
+	free(sig);
+ 
+ 	return 0;
+ }
+@@ -128,23 +128,23 @@ 
+ 	if (strcmp("ssh-rsa", ktype) != 0) {
+ 		logerror("ssh_rsa_verify: cannot handle type %s", ktype);
+ 		buffer_free(&b);
+-		xfree(ktype);
+		free(ktype);
+ 		return -1;
+ 	}
+-	xfree(ktype);
+	free(ktype);
+ 	sigblob = buffer_get_string(&b, &len);
+ 	rlen = buffer_len(&b);
+ 	buffer_free(&b);
+ 	if (rlen != 0) {
+ 		logerror("ssh_rsa_verify: remaining bytes in signature %d", rlen);
+-		xfree(sigblob);
+		free(sigblob);
+ 		return -1;
+ 	}
+ 	/* RSA_verify expects a signature of RSA_size */
+ 	modlen = RSA_size(key->rsa);
+ 	if (len > modlen) {
+ 		logerror("ssh_rsa_verify: len %u > modlen %u", len, modlen);
+-		xfree(sigblob);
+		free(sigblob);
+ 		return -1;
+ 	} else if (len < modlen) {
+ 		u_int diff = modlen - len;
+@@ -158,7 +158,7 @@ 
+ 	nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1;
+ 	if ((evp_md = EVP_get_digestbynid(nid)) == NULL) {
+ 		logerror("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid);
+-		xfree(sigblob);
+		free(sigblob);
+ 		return -1;
+ 	}
+ 	EVP_DigestInit(&md, evp_md);
+@@ -168,7 +168,7 @@ 
+ 	ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa);
+ 	memset(digest, 'd', sizeof(digest));
+ 	memset(sigblob, 's', len);
+-	xfree(sigblob);
+	free(sigblob);
+ 	verbose("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : "");
+ 	return ret;
+ }
+@@ -258,6 +258,6 @@ 
+ 	ret = 1;
+ done:
+ 	if (decrypted)
+-		xfree(decrypted);
+		free(decrypted);
+ 	return ret;
+ }
+--- pam_ssh_agent_auth-0.9.3.orig/userauth_pubkey_from_id.c	2013-10-30 17:14:26.014615310 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/userauth_pubkey_from_id.c	2013-10-30 17:15:07.362327518 +0100
+@@ -92,9 +92,9 @@ 
+     if(&b != NULL)
+         buffer_free(&b);
+     if(sig != NULL)
+-        xfree(sig);
+        free(sig);
+     if(pkblob != NULL)
+-        xfree(pkblob);
+        free(pkblob);
+     CRYPTO_cleanup_all_ex_data();
+     return authenticated;
+ }
+--- pam_ssh_agent_auth-0.9.3.orig/uuencode.c	2013-10-30 17:14:26.015615278 +0100
+++ pam_ssh_agent_auth-0.9.3.orig/uuencode.c	2013-10-30 17:15:07.362327518 +0100
+@@ -56,7 +56,7 @@ 
+ 	/* and remove trailing whitespace because __b64_pton needs this */
+ 	*p = '\0';
+ 	len = __b64_pton(encoded, target, targsize);
+-	xfree(encoded);
+	free(encoded);
+ 	return len;
+ }
+ 
+@@ -79,5 +79,5 @@ 
+ 	}
+ 	if (i % 70 != 69)
+ 		fprintf(fp, "\n");
+-	xfree(buf);
+	free(buf);
+ }
--- a/6
+++ b/6
@ -1,4 +1,2 @@
-SHA512 (openssh-8.4p1.tar.gz) = d65275b082c46c5efe7cf3264fa6794d6e99a36d4a54b50554fc56979d6c0837381587fd5399195e1db680d2a5ad1ef0b99a180eac2b4de5637906cb7a89e9ce
-SHA512 (openssh-8.4p1.tar.gz.asc) = 3d9a026db27729a5a56785db3824230ccf2a3beca4bb48ef465e44d869b944dbc5d443152a1b1be21bc9c213c465d3d7ca1f876a387d0a6b9682a0cfec3e6e32
-SHA512 (pam_ssh_agent_auth-0.10.4.tar.gz) = caccf72174d15e43f4c86a459ac6448682e62116557cf1e1e828955f3d1731595b238df42adec57860e7f341e92daf5d8285020bcb5018f3b8a5145aa32ee1c2
-SHA512 (DJM-GPG-KEY.gpg) = db1191ed9b6495999e05eed2ef863fb5179bdb63e94850f192dad68eed8579836f88fbcfffd9f28524fe1457aff8cd248ee3e0afc112c8f609b99a34b80ecc0d
+9872ca1983e566ff5a89c240529e223d  pam_ssh_agent_auth-0.9.3.tar.bz2
+a62b88b884df0b09b8a8c5789ac9e51b  openssh-6.4p1.tar.gz
--- a/151
+++ b/151
@ -1,40 +1,123 @@
 #!/bin/bash

 # Create the host keys for the OpenSSH server.
-KEYTYPE=$1
-case $KEYTYPE in
-	"dsa") ;& # disabled in FIPS
-	"ed25519")
-		FIPS=/proc/sys/crypto/fips_enabled
-		if [[ -r "$FIPS" && $(cat $FIPS) == "1" ]]; then
-			exit 0
-		fi ;;
-	"rsa") ;; # always ok
-	"ecdsa") ;;
-	*) # wrong argument
-		exit 12 ;;
-esac
-KEY=/etc/ssh/ssh_host_${KEYTYPE}_key
+#
+# The creation is controlled by the $AUTOCREATE_SERVER_KEYS environment
+# variable.
+AUTOCREATE_SERVER_KEYS=NODSA

+# source function library
+. /etc/rc.d/init.d/functions
+
+# Some functions to make the below more readable
 KEYGEN=/usr/bin/ssh-keygen
-if [[ ! -x $KEYGEN ]]; then
-	exit 13
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+
+# pull in sysconfig settings
+[ -f /etc/sysconfig/sshd ] && . /etc/sysconfig/sshd
+
+fips_enabled() {
+	if [ -r /proc/sys/crypto/fips_enabled ]; then
+		cat /proc/sys/crypto/fips_enabled
+	else
+		echo 0
+	fi
+}
+
+do_rsa1_keygen() {
+	if [ ! -s $RSA1_KEY -a `fips_enabled` -eq 0 ]; then
+		echo -n $"Generating SSH1 RSA host key: "
+		rm -f $RSA1_KEY
+		if test ! -f $RSA1_KEY && $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
+			chgrp ssh_keys $RSA1_KEY
+			chmod 640 $RSA1_KEY
+			chmod 644 $RSA1_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $RSA1_KEY.pub
+			fi
+			success $"RSA1 key generation"
+			echo
+		else
+			failure $"RSA1 key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+do_rsa_keygen() {
+	if [ ! -s $RSA_KEY ]; then
+		echo -n $"Generating SSH2 RSA host key: "
+		rm -f $RSA_KEY
+		if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
+			chgrp ssh_keys $RSA_KEY
+			chmod 640 $RSA_KEY
+			chmod 644 $RSA_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $RSA_KEY.pub
+			fi
+			success $"RSA key generation"
+			echo
+		else
+			failure $"RSA key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+do_dsa_keygen() {
+	if [ ! -s $DSA_KEY ]; then
+		echo -n $"Generating SSH2 DSA host key: "
+		rm -f $DSA_KEY
+		if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
+			chgrp ssh_keys $DSA_KEY
+			chmod 640 $DSA_KEY
+			chmod 644 $DSA_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $DSA_KEY.pub
+			fi
+			success $"DSA key generation"
+			echo
+		else
+			failure $"DSA key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+do_ecdsa_keygen() {
+	if [ ! -s $ECDSA_KEY ]; then
+		echo -n $"Generating SSH2 ECDSA host key: "
+		rm -f $ECDSA_KEY
+		if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >&/dev/null; then
+			chgrp ssh_keys $ECDSA_KEY
+			chmod 640 $ECDSA_KEY
+			chmod 644 $ECDSA_KEY.pub
+			if [ -x /sbin/restorecon ]; then
+			    /sbin/restorecon $ECDSA_KEY.pub
+			fi
+			success $"ECDSA key generation"
+			echo
+		else
+			failure $"ECDSA key generation"
+			echo
+			exit 1
+		fi
+	fi
+}
+
+# Create keys if necessary
+if [ "x${AUTOCREATE_SERVER_KEYS}" != xNO ]; then
+	do_rsa_keygen
+	if [ "x${AUTOCREATE_SERVER_KEYS}" != xRSAONLY ]; then
+		do_ecdsa_keygen
+		if [ "x${AUTOCREATE_SERVER_KEYS}" != xNODSA ]; then
+			do_dsa_keygen
+		fi
+	fi
 fi
-
-# remove old keys
-rm -f $KEY{,.pub}
-
-# create new keys
-if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then
-	exit 1
-fi
-
-# sanitize permissions
-/usr/bin/chgrp ssh_keys $KEY
-/usr/bin/chmod 640 $KEY
-/usr/bin/chmod 644 $KEY.pub
-if [[ -x /usr/sbin/restorecon ]]; then
-	/usr/sbin/restorecon $KEY{,.pub}
-fi
-
-exit 0
--- a/sshd-keygen.service
+++ b/sshd-keygen.service
@ -0,0 +1,8 @@
+[Unit]
+Description=OpenSSH Server Key Generation
+ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
+
+[Service]
+ExecStart=/usr/sbin/sshd-keygen
+Type=oneshot
--- a/sshd-keygen.target
+++ b/sshd-keygen.target
@ -1,5 +0,0 @@
-[Unit]
-Wants=sshd-keygen@rsa.service
-Wants=sshd-keygen@ecdsa.service
-Wants=sshd-keygen@ed25519.service
-PartOf=sshd.service
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jakub Jelen	4769e25cb1	the .local domain example should be in ssh_config, not in sshd_config	2015-03-11 11:43:08 +01:00
Jakub Jelen	e3688ed6ab	6.4p1-8 + 0.9.3-1	2015-01-15 15:27:59 +01:00
Jakub Jelen	9718c78d6b	Add missing documentation link to systemd service files (RHBZ#1181593)	2015-01-15 15:27:59 +01:00
Petr Lautrbach	e83e64b469	add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278 (#1170745 )	2015-01-15 15:27:59 +01:00
Jakub Jelen	6d6c363361	Update vendor-patchlevel string	2015-01-15 15:27:59 +01:00
Jakub Jelen	284aebf281	Update ldap extension to resolve #981058	2015-01-15 15:27:59 +01:00
Jakub Jelen	6b64f7566c	Fix config parser for ip:port values (#1130733 )	2015-01-15 15:27:59 +01:00
Jakub Jelen	87ef7b8238	Fix confusing error message in scp (#1142223 )	2015-01-15 15:27:59 +01:00
Petr Lautrbach	11084609c9	increase size of AUDIT_LOG_SIZE to 256	2015-01-15 15:27:59 +01:00
Jakub Jelen	91cb47ec28	backport fix for sftp prepending remote directory to relative symlinks (#825538 )	2015-01-09 17:21:15 +01:00
Petr Lautrbach	2de83b1356	6.4p1-7 + 0.9.3-1	2014-12-04 14:30:46 +01:00
Petr Lautrbach	2f3cd96ab9	use different values for DH for Cisco servers (#1026430 )	2014-12-04 14:30:23 +01:00
Petr Lautrbach	b64b2cc975	6.4p1-6 + 0.9.3-1	2014-11-11 16:06:16 +01:00
Petr Lautrbach	1232a2070b	correct the calculation of bytes for authctxt->krb5_ccname <ams@corefiling.com> (#1161073 )	2014-11-11 16:02:12 +01:00
Petr Lautrbach	c53250668e	change audit trail - do not use (invalid user) - change acct for an unknown user "(unknown)" - don't send login audit event in getpwnamallow()	2014-11-11 16:01:29 +01:00
Petr Lautrbach	4a92081130	fix kuserok patch which checked for the existence of .k5login unconditionally and hence prevented other mechanisms to be used properly	2014-11-11 11:34:18 +01:00
Petr Lautrbach	3c7aefbbeb	Ignore SIGXFSZ in postauth monitor https://bugzilla.mindrot.org/show_bug.cgi?id=2263	2014-11-10 14:39:23 +01:00
Petr Lautrbach	f9f5754ffc	fix parsing of empty arguments in sshd_conf https://bugzilla.mindrot.org/show_bug.cgi?id=2281	2014-11-10 10:58:25 +01:00
Petr Lautrbach	2ab5418106	don't consider a partial success as a failure	2014-11-10 10:53:49 +01:00
Petr Lautrbach	a1fe096ff3	apply RFC3454 stringprep to banners when possible https://bugzilla.mindrot.org/show_bug.cgi?id=2058	2014-11-10 10:51:04 +01:00
Petr Lautrbach	9f170e3ec1	set a client's address right after a connection is set http://bugzilla.mindrot.org/show_bug.cgi?id=2257	2014-11-10 10:30:45 +01:00
Petr Lautrbach	81226fcc51	6.4p1-5 + 0.9.3-1	2014-07-18 08:42:26 +02:00
Petr Lautrbach	66d55f7a69	standardise on NI_MAXHOST for gethostname() string lengths (#1051490 )	2014-07-17 18:30:37 +02:00