--- openssh-6.3p1-gsskex-all-20130920.patch.orig	2014-02-15 17:07:51.000000000 -0800
+++ openssh-6.3p1-gsskex-all-20130920.patch	2014-02-15 17:31:47.000000000 -0800
@@ -1,6 +1,6 @@
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ChangeLog.gssapi openssh-5.8p1.new/ChangeLog.gssapi
---- openssh-5.8p1/ChangeLog.gssapi	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/ChangeLog.gssapi	2011-02-12 18:07:10.948345760 +0100
+diff -Nrup openssh-6.5p1/ChangeLog.gssapi openssh-6.5p1.patched/ChangeLog.gssapi
+--- openssh-6.5p1/ChangeLog.gssapi	1969-12-31 16:00:00.000000000 -0800
++++ openssh-6.5p1.patched/ChangeLog.gssapi	2014-02-15 16:50:46.000000000 -0800
 @@ -0,0 +1,113 @@
 +20110101
 +  - Finally update for OpenSSH 5.6p1
@@ -115,30 +115,30 @@
 +    add support for GssapiTrustDns option for gssapi-with-mic
 +    (from jbasney AT ncsa.uiuc.edu)
 +    <gssapi-with-mic support is Bugzilla #1008>
-diff --speed-large-files --minimal -Nru openssh-5.8p1/Makefile.in openssh-5.8p1.new/Makefile.in
---- openssh-5.8p1/Makefile.in	2011-02-04 01:42:13.000000000 +0100
-+++ openssh-5.8p1.new/Makefile.in	2011-02-12 18:07:10.990611445 +0100
-@@ -75,6 +75,7 @@
+diff -Nrup openssh-6.5p1/Makefile.in openssh-6.5p1.patched/Makefile.in
+--- openssh-6.5p1/Makefile.in	2014-01-26 22:35:04.000000000 -0800
++++ openssh-6.5p1.patched/Makefile.in	2014-02-15 16:51:24.000000000 -0800
+@@ -72,6 +72,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
  	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
  	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
  	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
 +	kexgssc.o \
  	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
- 	jpake.o schnorr.o ssh-pkcs11.o kr1.o
- 
-@@ -91,7 +92,7 @@
+ 	jpake.o schnorr.o ssh-pkcs11.o krl.o smult_curve25519_ref.o \
+ 	kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
+@@ -91,7 +92,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
  	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
  	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
- 	auth-krb5.o \
+ 	kexc25519s.o auth-krb5.o \
 -	auth2-gss.o gss-serv.o gss-serv-krb5.o \
-+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o\
++	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
  	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
  	sftp-server.o sftp-common.o \
- 	roaming_common.o roaming_serv.o
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth-krb5.c openssh-5.8p1.new/auth-krb5.c
---- openssh-5.8p1/auth-krb5.c	2009-12-21 00:49:22.000000000 +0100
-+++ openssh-5.8p1.new/auth-krb5.c	2011-02-12 18:07:11.002529804 +0100
-@@ -170,8 +170,13 @@
+ 	roaming_common.o roaming_serv.o \
+diff -Nrup openssh-6.5p1/auth-krb5.c openssh-6.5p1.patched/auth-krb5.c
+--- openssh-6.5p1/auth-krb5.c	2013-10-23 16:53:02.000000000 -0700
++++ openssh-6.5p1.patched/auth-krb5.c	2014-02-15 16:50:46.000000000 -0800
+@@ -182,8 +182,13 @@ auth_krb5_password(Authctxt *authctxt, c
  
  	len = strlen(authctxt->krb5_ticket_file) + 6;
  	authctxt->krb5_ccname = xmalloc(len);
@@ -152,7 +152,7 @@
  
  #ifdef USE_PAM
  	if (options.use_pam)
-@@ -226,15 +231,22 @@
+@@ -240,15 +245,22 @@ krb5_cleanup_proc(Authctxt *authctxt)
  #ifndef HEIMDAL
  krb5_error_code
  ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
@@ -177,7 +177,7 @@
  	old_umask = umask(0177);
  	tmpfd = mkstemp(ccname + strlen("FILE:"));
  	oerrno = errno;
-@@ -249,6 +261,7 @@
+@@ -265,6 +277,7 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_c
  		return oerrno;
  	}
  	close(tmpfd);
@@ -185,11 +185,11 @@
  
  	return (krb5_cc_resolve(ctx, ccname, ccache));
  }
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth2-gss.c openssh-5.8p1.new/auth2-gss.c
---- openssh-5.8p1/auth2-gss.c	2007-12-02 12:59:45.000000000 +0100
-+++ openssh-5.8p1.new/auth2-gss.c	2011-02-12 18:07:11.030761708 +0100
+diff -Nrup openssh-6.5p1/auth2-gss.c openssh-6.5p1.patched/auth2-gss.c
+--- openssh-6.5p1/auth2-gss.c	2013-06-01 14:31:18.000000000 -0700
++++ openssh-6.5p1.patched/auth2-gss.c	2014-02-15 16:50:46.000000000 -0800
 @@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */
+ /* $OpenBSD: auth2-gss.c,v 1.20 2013/05/17 00:13:13 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -197,7 +197,7 @@
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -52,6 +52,40 @@
+@@ -52,6 +52,40 @@ static void input_gssapi_mic(int type, u
  static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
  static void input_gssapi_errtok(int, u_int32_t, void *);
  
@@ -238,7 +238,7 @@
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -242,7 +278,8 @@
+@@ -240,7 +274,8 @@ input_gssapi_exchange_complete(int type,
  
  	packet_check_eom();
  
@@ -248,7 +248,7 @@
  
  	authctxt->postponed = 0;
  	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
-@@ -277,7 +314,8 @@
+@@ -275,7 +310,8 @@ input_gssapi_mic(int type, u_int32_t ple
  	gssbuf.length = buffer_len(&b);
  
  	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
@@ -258,8 +258,8 @@
  	else
  		logit("GSSAPI MIC check failed");
  
-@@ -292,6 +330,12 @@
- 	userauth_finish(authctxt, authenticated, "gssapi-with-mic");
+@@ -290,6 +326,12 @@ input_gssapi_mic(int type, u_int32_t ple
+ 	userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
  }
  
 +Authmethod method_gsskeyex = {
@@ -271,10 +271,10 @@
  Authmethod method_gssapi = {
  	"gssapi-with-mic",
  	userauth_gssapi,
-diff --speed-large-files --minimal -Nru openssh-5.8p1/auth2.c openssh-5.8p1.new/auth2.c
---- openssh-5.8p1/auth2.c	2010-08-31 14:36:39.000000000 +0200
-+++ openssh-5.8p1.new/auth2.c	2011-02-12 18:07:11.043418162 +0100
-@@ -69,6 +69,7 @@
+diff -Nrup openssh-6.5p1/auth2.c openssh-6.5p1.patched/auth2.c
+--- openssh-6.5p1/auth2.c	2013-06-01 14:41:51.000000000 -0700
++++ openssh-6.5p1.patched/auth2.c	2014-02-15 16:50:46.000000000 -0800
+@@ -69,6 +69,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -282,7 +282,7 @@
  extern Authmethod method_gssapi;
  #endif
  #ifdef JPAKE
-@@ -79,6 +80,7 @@
+@@ -79,6 +80,7 @@ Authmethod *authmethods[] = {
  	&method_none,
  	&method_pubkey,
  #ifdef GSSAPI
@@ -290,9 +290,9 @@
  	&method_gssapi,
  #endif
  #ifdef JPAKE
-diff --speed-large-files --minimal -Nru openssh-5.8p1/clientloop.c openssh-5.8p1.new/clientloop.c
---- openssh-5.8p1/clientloop.c	2011-01-16 13:18:35.000000000 +0100
-+++ openssh-5.8p1.new/clientloop.c	2011-02-12 18:07:11.063578136 +0100
+diff -Nrup openssh-6.5p1/clientloop.c openssh-6.5p1.patched/clientloop.c
+--- openssh-6.5p1/clientloop.c	2013-11-20 18:57:15.000000000 -0800
++++ openssh-6.5p1.patched/clientloop.c	2014-02-15 16:50:46.000000000 -0800
 @@ -111,6 +111,10 @@
  #include "msg.h"
  #include "roaming.h"
@@ -304,7 +304,7 @@
  /* import options */
  extern Options options;
  
-@@ -1483,6 +1487,15 @@
+@@ -1608,6 +1612,15 @@ client_loop(int have_pty, int escape_cha
  		/* Do channel operations unless rekeying in progress. */
  		if (!rekeying) {
  			channel_after_select(readset, writeset);
@@ -320,10 +320,10 @@
  			if (need_rekeying || packet_need_rekeying()) {
  				debug("need rekeying");
  				xxx_kex->done = 0;
-diff --speed-large-files --minimal -Nru openssh-5.8p1/configure.ac openssh-5.8p1.new/configure.ac
---- openssh-5.8p1/configure.ac	2011-02-04 01:42:14.000000000 +0100
-+++ openssh-5.8p1.new/configure.ac	2011-02-12 18:07:11.092748915 +0100
-@@ -514,6 +514,30 @@
+diff -Nrup openssh-6.5p1/configure.ac openssh-6.5p1.patched/configure.ac
+--- openssh-6.5p1/configure.ac	2014-01-29 16:26:46.000000000 -0800
++++ openssh-6.5p1.patched/configure.ac	2014-02-15 16:50:46.000000000 -0800
+@@ -584,6 +584,30 @@ main() { if (NSVersionOfRunTimeLibrary("
  	    [Use tunnel device compatibility to OpenBSD])
  	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
  	    [Prepend the address family to IP tunnel traffic])
@@ -353,12 +353,12 @@
 +	)
  	m4_pattern_allow([AU_IPv])
  	AC_CHECK_DECL([AU_IPv4], [], 
- 	    AC_DEFINE([AU_IPv4], 0, [System only supports IPv4 audit records])
-diff --speed-large-files --minimal -Nru openssh-5.8p1/gss-genr.c openssh-5.8p1.new/gss-genr.c
---- openssh-5.8p1/gss-genr.c	2009-06-22 08:11:07.000000000 +0200
-+++ openssh-5.8p1.new/gss-genr.c	2011-02-12 18:07:11.108432434 +0100
+ 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
+diff -Nrup openssh-6.5p1/gss-genr.c openssh-6.5p1.patched/gss-genr.c
+--- openssh-6.5p1/gss-genr.c	2013-11-07 17:19:57.000000000 -0800
++++ openssh-6.5p1.patched/gss-genr.c	2014-02-15 17:23:28.000000000 -0800
 @@ -1,7 +1,7 @@
- /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
+ /* $OpenBSD: gss-genr.c,v 1.22 2013/11/08 00:39:15 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
@@ -534,7 +534,7 @@
  /* Check that the OID in a data stream matches that in the context */
  int
  ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -197,7 +352,7 @@
+@@ -197,7 +352,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int de
  	}
  
  	ctx->major = gss_init_sec_context(&ctx->minor,
@@ -543,7 +543,7 @@
  	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
  	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -227,8 +382,42 @@
+@@ -227,8 +382,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, con
  }
  
  OM_uint32
@@ -586,7 +586,7 @@
  	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
  	    GSS_C_QOP_DEFAULT, buffer, hash)))
  		ssh_gssapi_error(ctx);
-@@ -236,6 +425,19 @@
+@@ -236,6 +425,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer
  	return (ctx->major);
  }
  
@@ -606,7 +606,7 @@
  void
  ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
      const char *context)
-@@ -249,11 +451,16 @@
+@@ -249,11 +451,16 @@ ssh_gssapi_buildmic(Buffer *b, const cha
  }
  
  int
@@ -624,7 +624,7 @@
  
  	/* RFC 4462 says we MUST NOT do SPNEGO */
  	if (oid->length == spnego_oid.length && 
-@@ -263,6 +470,10 @@
+@@ -263,6 +470,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  	ssh_gssapi_build_ctx(ctx);
  	ssh_gssapi_set_oid(*ctx, oid);
  	major = ssh_gssapi_import_name(*ctx, host);
@@ -635,7 +635,7 @@
  	if (!GSS_ERROR(major)) {
  		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
  		    NULL);
-@@ -272,10 +483,67 @@
+@@ -272,10 +483,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  			    GSS_C_NO_BUFFER);
  	}
  
@@ -655,8 +655,7 @@
 +	static OM_uint32 last_call = 0;
 +	OM_uint32 lifetime, now, major, minor;
 +	int equal;
-+	gss_cred_usage_t usage = GSS_C_INITIATE;
-+	
++
 +	now = time(NULL);
 +
 +	if (ctxt) {
@@ -704,11 +703,11 @@
 +}
 +
  #endif /* GSSAPI */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/gss-serv-krb5.c openssh-5.8p1.new/gss-serv-krb5.c
---- openssh-5.8p1/gss-serv-krb5.c	2006-09-01 07:38:36.000000000 +0200
-+++ openssh-5.8p1.new/gss-serv-krb5.c	2011-02-12 18:07:11.123072516 +0100
+diff -Nrup openssh-6.5p1/gss-serv-krb5.c openssh-6.5p1.patched/gss-serv-krb5.c
+--- openssh-6.5p1/gss-serv-krb5.c	2014-01-19 18:18:09.000000000 -0800
++++ openssh-6.5p1.patched/gss-serv-krb5.c	2014-02-15 16:50:46.000000000 -0800
 @@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
+ /* $OpenBSD: gss-serv-krb5.c,v 1.8 2013/07/20 01:55:13 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -716,15 +715,15 @@
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -120,6 +120,7 @@
+@@ -122,6 +122,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  	OM_uint32 maj_status, min_status;
  	int len;
-	const char *errmsg;
+ 	const char *errmsg;
 +	const char *new_ccname;
  
  	if (client->creds == NULL) {
  		debug("No credentials stored");
-@@ -168,11 +169,16 @@
+@@ -180,11 +181,16 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  		return;
  	}
  
@@ -745,7 +744,7 @@
  
  #ifdef USE_PAM
  	if (options.use_pam)
-@@ -184,6 +190,71 @@
+@@ -196,6 +202,71 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  	return;
  }
  
@@ -817,7 +816,7 @@
  ssh_gssapi_mech gssapi_kerberos_mech = {
  	"toWM5Slw5Ew8Mqkay+al2g==",
  	"Kerberos",
-@@ -191,7 +262,8 @@
+@@ -203,7 +274,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
  	NULL,
  	&ssh_gssapi_krb5_userok,
  	NULL,
@@ -827,11 +826,11 @@
  };
  
  #endif /* KRB5 */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/gss-serv.c openssh-5.8p1.new/gss-serv.c
---- openssh-5.8p1/gss-serv.c	2008-05-19 07:05:07.000000000 +0200
-+++ openssh-5.8p1.new/gss-serv.c	2011-02-12 18:07:11.135178913 +0100
+diff -Nrup openssh-6.5p1/gss-serv.c openssh-6.5p1.patched/gss-serv.c
+--- openssh-6.5p1/gss-serv.c	2013-07-19 20:35:45.000000000 -0700
++++ openssh-6.5p1.patched/gss-serv.c	2014-02-15 16:50:46.000000000 -0800
 @@ -1,7 +1,7 @@
- /* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */
+ /* $OpenBSD: gss-serv.c,v 1.24 2013/07/20 01:55:13 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -862,7 +861,7 @@
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -81,25 +86,32 @@
+@@ -81,25 +86,32 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx)
  	char lname[MAXHOSTNAMELEN];
  	gss_OID_set oidset;
  
@@ -871,16 +870,16 @@
 +	if (options.gss_strict_acceptor) {
 +		gss_create_empty_oid_set(&status, &oidset);
 +		gss_add_oid_set_member(&status, ctx->oid, &oidset);
++
++		if (gethostname(lname, MAXHOSTNAMELEN)) {
++			gss_release_oid_set(&status, &oidset);
++			return (-1);
++		}
  
 -	if (gethostname(lname, MAXHOSTNAMELEN)) {
 -		gss_release_oid_set(&status, &oidset);
 -		return (-1);
 -	}
-+		if (gethostname(lname, MAXHOSTNAMELEN)) {
-+			gss_release_oid_set(&status, &oidset);
-+			return (-1);
-+		}
-+
 +		if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
 +			gss_release_oid_set(&status, &oidset);
 +			return (ctx->major);
@@ -909,7 +908,7 @@
  }
  
  /* Privileged */
-@@ -114,6 +126,29 @@
+@@ -114,6 +126,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss
  }
  
  /* Unprivileged */
@@ -939,7 +938,7 @@
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
  {
-@@ -123,7 +158,9 @@
+@@ -123,7 +158,9 @@ ssh_gssapi_supported_oids(gss_OID_set *o
  	gss_OID_set supported;
  
  	gss_create_empty_oid_set(&min_status, oidset);
@@ -950,15 +949,14 @@
  
  	while (supported_mechs[i]->name != NULL) {
  		if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -247,8 +284,48 @@
+@@ -249,8 +286,48 @@ OM_uint32
  ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  {
  	int i = 0;
 +	int equal = 0;
 +	gss_name_t new_name = GSS_C_NO_NAME;
 +	gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;
- 
--	gss_buffer_desc ename;
++
 +	if (options.gss_store_rekey && client->used && ctx->client_creds) {
 +		if (client->mech->oid.length != ctx->oid->length ||
 +		    (memcmp(client->mech->oid.elements,
@@ -976,7 +974,8 @@
 +
 +		ctx->major = gss_compare_name(&ctx->minor, client->name, 
 +		    new_name, &equal);
-+
+ 
+-	gss_buffer_desc ename;
 +		if (GSS_ERROR(ctx->major)) {
 +			ssh_gssapi_error(ctx);
 +			return (ctx->major);
@@ -1000,7 +999,7 @@
  
  	client->mech = NULL;
  
-@@ -263,6 +340,13 @@
+@@ -265,6 +342,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  	if (client->mech == NULL)
  		return GSS_S_FAILURE;
  
@@ -1014,7 +1013,7 @@
  	if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
  	    &client->displayname, NULL))) {
  		ssh_gssapi_error(ctx);
-@@ -280,6 +364,8 @@
+@@ -282,6 +366,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  		return (ctx->major);
  	}
  
@@ -1023,7 +1022,7 @@
  	/* We can't copy this structure, so we just move the pointer to it */
  	client->creds = ctx->client_creds;
  	ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -327,7 +413,7 @@
+@@ -329,7 +415,7 @@ ssh_gssapi_do_child(char ***envp, u_int 
  
  /* Privileged */
  int
@@ -1032,7 +1031,7 @@
  {
  	OM_uint32 lmin;
  
-@@ -337,9 +423,11 @@
+@@ -339,9 +425,11 @@ ssh_gssapi_userok(char *user)
  		return 0;
  	}
  	if (gssapi_client.mech && gssapi_client.mech->userok)
@@ -1046,7 +1045,7 @@
  			/* Destroy delegated credentials if userok fails */
  			gss_release_buffer(&lmin, &gssapi_client.displayname);
  			gss_release_buffer(&lmin, &gssapi_client.exportedname);
-@@ -352,14 +440,90 @@
+@@ -354,14 +442,90 @@ ssh_gssapi_userok(char *user)
  	return (0);
  }
  
@@ -1143,12 +1142,12 @@
  }
  
  #endif
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kex.c openssh-5.8p1.new/kex.c
---- openssh-5.8p1/kex.c	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.8p1.new/kex.c	2011-02-12 18:07:11.149564726 +0100
-@@ -50,6 +50,10 @@
- #include "monitor.h"
+diff -Nrup openssh-6.5p1/kex.c openssh-6.5p1.patched/kex.c
+--- openssh-6.5p1/kex.c	2014-01-25 14:38:04.000000000 -0800
++++ openssh-6.5p1.patched/kex.c	2014-02-15 17:24:33.000000000 -0800
+@@ -51,6 +51,10 @@
  #include "roaming.h"
+ #include "digest.h"
  
 +#ifdef GSSAPI
 +#include "ssh-gss.h"
@@ -1157,34 +1156,34 @@
  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
  # if defined(HAVE_EVP_SHA256)
  # define evp_ssh_sha256 EVP_sha256
-@@ -80,6 +84,11 @@
- 	{ KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, EVP_sha384 },
- 	{ KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1, EVP_sha512 },
+@@ -90,6 +94,11 @@ static const struct kexalg kexalgs[] = {
+ #ifdef HAVE_EVP_SHA256
+ 	{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
  #endif
 +#ifdef GSSAPI
-+	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, EVP_sha1 },
-+	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, EVP_sha1 },
-+	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, EVP_sha1 },
++	{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
++	{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
++	{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
 +#endif
- 	{ NULL, -1, -1, NULL},
+ 	{ NULL, -1, -1, -1},
  };
  
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kex.h openssh-5.8p1.new/kex.h
---- openssh-5.8p1/kex.h	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.8p1.new/kex.h	2011-02-12 18:07:11.161650596 +0100
-@@ -73,6 +73,9 @@
- 	KEX_DH_GEX_SHA1,
+diff -Nrup openssh-6.5p1/kex.h openssh-6.5p1.patched/kex.h
+--- openssh-6.5p1/kex.h	2014-01-25 14:37:26.000000000 -0800
++++ openssh-6.5p1.patched/kex.h	2014-02-15 16:52:30.000000000 -0800
+@@ -76,6 +76,9 @@ enum kex_exchange {
  	KEX_DH_GEX_SHA256,
  	KEX_ECDH_SHA2,
+ 	KEX_C25519_SHA256,
 +	KEX_GSS_GRP1_SHA1,
 +	KEX_GSS_GRP14_SHA1,
 +	KEX_GSS_GEX_SHA1,
  	KEX_MAX
  };
  
-@@ -129,6 +132,12 @@
+@@ -136,6 +139,12 @@ struct Kex {
  	int	flags;
- 	const EVP_MD *evp_md;
+ 	int	hash_alg;
  	int	ec_nid;
 +#ifdef GSSAPI
 +	int	gss_deleg_creds;
@@ -1195,9 +1194,9 @@
  	char	*client_version_string;
  	char	*server_version_string;
  	int	(*verify_host_key)(Key *);
-@@ -156,6 +165,11 @@
- void	 kexecdh_client(Kex *);
- void	 kexecdh_server(Kex *);
+@@ -168,6 +177,11 @@ void	 kexecdh_server(Kex *);
+ void	 kexc25519_client(Kex *);
+ void	 kexc25519_server(Kex *);
  
 +#ifdef GSSAPI
 +void	kexgss_client(Kex *);
@@ -1207,10 +1206,10 @@
  void
  kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
      BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kexgssc.c openssh-5.8p1.new/kexgssc.c
---- openssh-5.8p1/kexgssc.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/kexgssc.c	2011-02-12 18:07:11.176741991 +0100
-@@ -0,0 +1,334 @@
+diff -Nrup openssh-6.5p1/kexgssc.c openssh-6.5p1.patched/kexgssc.c
+--- openssh-6.5p1/kexgssc.c	1969-12-31 16:00:00.000000000 -0800
++++ openssh-6.5p1.patched/kexgssc.c	2014-02-15 17:17:35.000000000 -0800
+@@ -0,0 +1,339 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1268,6 +1267,7 @@
 +	DH *dh; 
 +	BIGNUM *dh_server_pub = NULL;
 +	BIGNUM *shared_secret = NULL;
++	Buffer shared_secret_buffer;
 +	BIGNUM *p = NULL;
 +	BIGNUM *g = NULL;	
 +	u_char *kbuf, *hash;
@@ -1492,7 +1492,7 @@
 +		break;
 +	case KEX_GSS_GEX_SHA1:
 +		kexgex_hash(
-+		    kex->evp_md,
++		    kex->hash_alg,
 +		    kex->client_version_string,
 +		    kex->server_version_string,
 +		    buffer_ptr(&kex->my), buffer_len(&kex->my),
@@ -1539,16 +1539,20 @@
 +	else
 +		ssh_gssapi_delete_ctx(&ctxt);
 +
-+	kex_derive_keys(kex, hash, hashlen, shared_secret);
++	buffer_init(&shared_secret_buffer);
++	buffer_put_bignum2(&shared_secret_buffer, shared_secret);
++	kex_derive_keys(kex, hash, hashlen, buffer_ptr(&shared_secret_buffer),
++			buffer_len(&shared_secret_buffer));
++	buffer_free(&shared_secret_buffer);
 +	BN_clear_free(shared_secret);
 +	kex_finish(kex);
 +}
 +
 +#endif /* GSSAPI */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/kexgsss.c openssh-5.8p1.new/kexgsss.c
---- openssh-5.8p1/kexgsss.c	1970-01-01 01:00:00.000000000 +0100
-+++ openssh-5.8p1.new/kexgsss.c	2011-02-12 18:07:11.186584789 +0100
-@@ -0,0 +1,288 @@
+diff -Nrup openssh-6.5p1/kexgsss.c openssh-6.5p1.patched/kexgsss.c
+--- openssh-6.5p1/kexgsss.c	1969-12-31 16:00:00.000000000 -0800
++++ openssh-6.5p1.patched/kexgsss.c	2014-02-15 17:31:24.000000000 -0800
+@@ -0,0 +1,293 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -1618,6 +1622,7 @@
 +	DH *dh;
 +	int min = -1, max = -1, nbits = -1;
 +	BIGNUM *shared_secret = NULL;
++	Buffer shared_secret_buffer;
 +	BIGNUM *dh_client_pub = NULL;
 +	int type = 0;
 +	gss_OID oid;
@@ -1774,7 +1779,7 @@
 +		break;
 +	case KEX_GSS_GEX_SHA1:
 +		kexgex_hash(
-+		    kex->evp_md,
++		    kex->hash_alg,
 +		    kex->client_version_string, kex->server_version_string,
 +		    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
 +		    buffer_ptr(&kex->my), buffer_len(&kex->my),
@@ -1827,7 +1832,11 @@
 +
 +	DH_free(dh);
 +
-+	kex_derive_keys(kex, hash, hashlen, shared_secret);
++	buffer_init(&shared_secret_buffer);
++	buffer_put_bignum2(&shared_secret_buffer, shared_secret);
++	kex_derive_keys(kex, hash, hashlen, buffer_ptr(&shared_secret_buffer),
++			buffer_len(&shared_secret_buffer));
++	buffer_free(&shared_secret_buffer);
 +	BN_clear_free(shared_secret);
 +	kex_finish(kex);
 +
@@ -1837,32 +1846,32 @@
 +		ssh_gssapi_rekey_creds();
 +}
 +#endif /* GSSAPI */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/key.c openssh-5.8p1.new/key.c
---- openssh-5.8p1/key.c	2011-02-04 01:48:34.000000000 +0100
-+++ openssh-5.8p1.new/key.c	2011-02-12 18:07:11.202089386 +0100
-@@ -929,6 +929,7 @@
- 	{ "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT",
+diff -Nrup openssh-6.5p1/key.c openssh-6.5p1.patched/key.c
+--- openssh-6.5p1/key.c	2014-01-09 15:58:53.000000000 -0800
++++ openssh-6.5p1.patched/key.c	2014-02-15 16:50:46.000000000 -0800
+@@ -979,6 +979,7 @@ static const struct keytype keytypes[] =
  	    KEY_ECDSA_CERT, NID_secp521r1, 1 },
+ # endif
  #endif /* OPENSSL_HAS_ECC */
 +	{ "null", "null", KEY_NULL, 0, 0 },
  	{ "ssh-rsa-cert-v00@openssh.com", "RSA-CERT-V00",
  	    KEY_RSA_CERT_V00, 0, 1 },
  	{ "ssh-dss-cert-v00@openssh.com", "DSA-CERT-V00",
-diff --speed-large-files --minimal -Nru openssh-5.8p1/key.h openssh-5.8p1.new/key.h
---- openssh-5.8p1/key.h	2010-11-05 00:19:49.000000000 +0100
-+++ openssh-5.8p1.new/key.h	2011-02-12 18:07:11.216270794 +0100
-@@ -44,6 +44,7 @@
- 	KEY_ECDSA_CERT,
+diff -Nrup openssh-6.5p1/key.h openssh-6.5p1.patched/key.h
+--- openssh-6.5p1/key.h	2014-01-09 15:58:53.000000000 -0800
++++ openssh-6.5p1.patched/key.h	2014-02-15 16:50:46.000000000 -0800
+@@ -46,6 +46,7 @@ enum types {
+ 	KEY_ED25519_CERT,
  	KEY_RSA_CERT_V00,
  	KEY_DSA_CERT_V00,
 +	KEY_NULL,
  	KEY_UNSPEC
  };
  enum fp_type {
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor.c openssh-5.8p1.new/monitor.c
---- openssh-5.8p1/monitor.c	2010-09-10 03:23:34.000000000 +0200
-+++ openssh-5.8p1.new/monitor.c	2011-02-12 18:07:11.241713537 +0100
-@@ -172,6 +172,8 @@
+diff -Nrup openssh-6.5p1/monitor.c openssh-6.5p1.patched/monitor.c
+--- openssh-6.5p1/monitor.c	2013-11-06 18:32:52.000000000 -0800
++++ openssh-6.5p1.patched/monitor.c	2014-02-15 16:53:04.000000000 -0800
+@@ -181,6 +181,8 @@ int mm_answer_gss_setup_ctx(int, Buffer 
  int mm_answer_gss_accept_ctx(int, Buffer *);
  int mm_answer_gss_userok(int, Buffer *);
  int mm_answer_gss_checkmic(int, Buffer *);
@@ -1871,7 +1880,7 @@
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -241,6 +243,7 @@
+@@ -253,6 +255,7 @@ struct mon_table mon_dispatch_proto20[] 
      {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
@@ -1879,7 +1888,7 @@
  #endif
  #ifdef JPAKE
      {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata},
-@@ -253,6 +256,12 @@
+@@ -265,6 +268,12 @@ struct mon_table mon_dispatch_proto20[] 
  };
  
  struct mon_table mon_dispatch_postauth20[] = {
@@ -1892,7 +1901,7 @@
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
      {MONITOR_REQ_SIGN, 0, mm_answer_sign},
      {MONITOR_REQ_PTY, 0, mm_answer_pty},
-@@ -357,6 +366,10 @@
+@@ -373,6 +382,10 @@ monitor_child_preauth(Authctxt *_authctx
  		/* Permit requests for moduli and signatures */
  		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -1903,7 +1912,7 @@
  	} else {
  		mon_dispatch = mon_dispatch_proto15;
  
-@@ -443,6 +456,10 @@
+@@ -487,6 +500,10 @@ monitor_child_postauth(struct monitor *p
  		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -1914,10 +1923,10 @@
  	} else {
  		mon_dispatch = mon_dispatch_postauth15;
  		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1692,6 +1709,13 @@
- 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+@@ -1856,6 +1873,13 @@ mm_get_kex(Buffer *m)
  	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
  	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+ 	kex->kex[KEX_C25519_SHA256] = kexc25519_server;
 +#ifdef GSSAPI
 +	if (options.gss_keyex) {
 +		kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
@@ -1928,7 +1937,7 @@
  	kex->server = 1;
  	kex->hostkey_type = buffer_get_int(m);
  	kex->kex_type = buffer_get_int(m);
-@@ -1898,6 +1922,9 @@
+@@ -2063,6 +2087,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
  	OM_uint32 major;
  	u_int len;
  
@@ -1938,7 +1947,7 @@
  	goid.elements = buffer_get_string(m, &len);
  	goid.length = len;
  
-@@ -1925,6 +1952,9 @@
+@@ -2090,6 +2117,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
  	OM_uint32 flags = 0; /* GSI needs this */
  	u_int len;
  
@@ -1948,7 +1957,7 @@
  	in.value = buffer_get_string(m, &len);
  	in.length = len;
  	major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -1942,6 +1972,7 @@
+@@ -2107,6 +2137,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -1956,7 +1965,7 @@
  	}
  	return (0);
  }
-@@ -1953,6 +1984,9 @@
+@@ -2118,6 +2149,9 @@ mm_answer_gss_checkmic(int sock, Buffer 
  	OM_uint32 ret;
  	u_int len;
  
@@ -1966,7 +1975,7 @@
  	gssbuf.value = buffer_get_string(m, &len);
  	gssbuf.length = len;
  	mic.value = buffer_get_string(m, &len);
-@@ -1979,7 +2013,11 @@
+@@ -2144,7 +2178,11 @@ mm_answer_gss_userok(int sock, Buffer *m
  {
  	int authenticated;
  
@@ -1979,7 +1988,7 @@
  
  	buffer_clear(m);
  	buffer_put_int(m, authenticated);
-@@ -1992,6 +2030,74 @@
+@@ -2157,6 +2195,74 @@ mm_answer_gss_userok(int sock, Buffer *m
  	/* Monitor loop will terminate if authenticated */
  	return (authenticated);
  }
@@ -2054,24 +2063,23 @@
  #endif /* GSSAPI */
  
  #ifdef JPAKE
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor.h openssh-5.8p1.new/monitor.h
---- openssh-5.8p1/monitor.h	2008-11-05 06:20:46.000000000 +0100
-+++ openssh-5.8p1.new/monitor.h	2011-02-12 18:07:11.311728071 +0100
-@@ -53,6 +53,9 @@
-	MONITOR_REQ_JPAKE_STEP2 = 56, MONITOR_ANS_JPAKE_STEP2 = 57,
-	MONITOR_REQ_JPAKE_KEY_CONFIRM = 58, MONITOR_ANS_JPAKE_KEY_CONFIRM = 59,
-	MONITOR_REQ_JPAKE_CHECK_CONFIRM = 60, MONITOR_ANS_JPAKE_CHECK_CONFIRM = 61,
-+
+diff -Nrup openssh-6.5p1/monitor.h openssh-6.5p1.patched/monitor.h
+--- openssh-6.5p1/monitor.h	2012-12-02 14:53:21.000000000 -0800
++++ openssh-6.5p1.patched/monitor.h	2014-02-15 16:50:46.000000000 -0800
+@@ -62,6 +62,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_JPAKE_KEY_CONFIRM = 58, MONITOR_ANS_JPAKE_KEY_CONFIRM = 59,
+ 	MONITOR_REQ_JPAKE_CHECK_CONFIRM = 60, MONITOR_ANS_JPAKE_CHECK_CONFIRM = 61,
+ 
 +	MONITOR_REQ_GSSSIGN = 62, MONITOR_ANS_GSSSIGN = 63,
 +	MONITOR_REQ_GSSUPCREDS = 64, MONITOR_ANS_GSSUPCREDS = 65,
-
-	MONITOR_REQ_PAM_START = 100,
-	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
-	MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor_wrap.c openssh-5.8p1.new/monitor_wrap.c
---- openssh-5.8p1/monitor_wrap.c	2010-08-31 14:41:14.000000000 +0200
-+++ openssh-5.8p1.new/monitor_wrap.c	2011-02-12 18:07:11.359631731 +0100
-@@ -1232,7 +1232,7 @@
++
+ 	MONITOR_REQ_PAM_START = 100,
+ 	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+ 	MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
+diff -Nrup openssh-6.5p1/monitor_wrap.c openssh-6.5p1.patched/monitor_wrap.c
+--- openssh-6.5p1/monitor_wrap.c	2013-11-06 18:35:39.000000000 -0800
++++ openssh-6.5p1.patched/monitor_wrap.c	2014-02-15 16:50:46.000000000 -0800
+@@ -1273,7 +1273,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
  }
  
  int
@@ -2080,7 +2088,7 @@
  {
  	Buffer m;
  	int authenticated = 0;
-@@ -1249,6 +1249,51 @@
+@@ -1290,6 +1290,51 @@ mm_ssh_gssapi_userok(char *user)
  	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
  	return (authenticated);
  }
@@ -2132,10 +2140,10 @@
  #endif /* GSSAPI */
  
  #ifdef JPAKE
-diff --speed-large-files --minimal -Nru openssh-5.8p1/monitor_wrap.h openssh-5.8p1.new/monitor_wrap.h
---- openssh-5.8p1/monitor_wrap.h	2009-03-05 14:58:22.000000000 +0100
-+++ openssh-5.8p1.new/monitor_wrap.h	2011-02-12 18:07:11.407619296 +0100
-@@ -57,8 +57,10 @@
+diff -Nrup openssh-6.5p1/monitor_wrap.h openssh-6.5p1.patched/monitor_wrap.h
+--- openssh-6.5p1/monitor_wrap.h	2011-06-19 21:42:23.000000000 -0700
++++ openssh-6.5p1.patched/monitor_wrap.h	2014-02-15 16:50:46.000000000 -0800
+@@ -58,8 +58,10 @@ BIGNUM *mm_auth_rsa_generate_challenge(K
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
     gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
@@ -2147,10 +2155,10 @@
  #endif
  
  #ifdef USE_PAM
-diff --speed-large-files --minimal -Nru openssh-5.8p1/readconf.c openssh-5.8p1.new/readconf.c
---- openssh-5.8p1/readconf.c	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/readconf.c	2011-02-12 18:07:11.460306621 +0100
-@@ -129,6 +129,8 @@
+diff -Nrup openssh-6.5p1/readconf.c openssh-6.5p1.patched/readconf.c
+--- openssh-6.5p1/readconf.c	2014-01-17 05:03:57.000000000 -0800
++++ openssh-6.5p1.patched/readconf.c	2014-02-15 16:50:46.000000000 -0800
+@@ -140,6 +140,8 @@ typedef enum {
  	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
  	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
  	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
@@ -2159,7 +2167,7 @@
  	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
  	oSendEnv, oControlPath, oControlMaster, oControlPersist,
  	oHashKnownHosts,
-@@ -169,10 +171,19 @@
+@@ -182,10 +184,19 @@ static struct {
  	{ "afstokenpassing", oUnsupported },
  #if defined(GSSAPI)
  	{ "gssapiauthentication", oGssAuthentication },
@@ -2179,7 +2187,7 @@
  #endif
  	{ "fallbacktorsh", oDeprecated },
  	{ "usersh", oDeprecated },
-@@ -479,10 +490,30 @@
+@@ -839,10 +850,30 @@ parse_time:
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2210,7 +2218,7 @@
  	case oBatchMode:
  		intptr = &options->batch_mode;
  		goto parse_flag;
-@@ -1092,7 +1123,12 @@
+@@ -1488,7 +1519,12 @@ initialize_options(Options * options)
  	options->pubkey_authentication = -1;
  	options->challenge_response_authentication = -1;
  	options->gss_authentication = -1;
@@ -2223,7 +2231,7 @@
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
-@@ -1193,8 +1229,14 @@
+@@ -1594,8 +1630,14 @@ fill_default_options(Options * options)
  		options->challenge_response_authentication = 1;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -2238,10 +2246,10 @@
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-diff --speed-large-files --minimal -Nru openssh-5.8p1/readconf.h openssh-5.8p1.new/readconf.h
---- openssh-5.8p1/readconf.h	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/readconf.h	2011-02-12 18:07:11.507187275 +0100
-@@ -46,7 +46,12 @@
+diff -Nrup openssh-6.5p1/readconf.h openssh-6.5p1.patched/readconf.h
+--- openssh-6.5p1/readconf.h	2013-10-16 17:48:14.000000000 -0700
++++ openssh-6.5p1.patched/readconf.h	2014-02-15 16:50:46.000000000 -0800
+@@ -54,7 +54,12 @@ typedef struct {
  	int     challenge_response_authentication;
  					/* Try S/Key or TIS, authentication. */
  	int     gss_authentication;	/* Try GSS authentication */
@@ -2254,10 +2262,10 @@
  	int     password_authentication;	/* Try password
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/servconf.c openssh-5.8p1.new/servconf.c
---- openssh-5.8p1/servconf.c	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/servconf.c	2011-02-12 18:07:11.533252334 +0100
-@@ -97,7 +97,10 @@
+diff -Nrup openssh-6.5p1/servconf.c openssh-6.5p1.patched/servconf.c
+--- openssh-6.5p1/servconf.c	2013-12-06 16:24:02.000000000 -0800
++++ openssh-6.5p1.patched/servconf.c	2014-02-15 16:50:46.000000000 -0800
+@@ -108,7 +108,10 @@ initialize_server_options(ServerOptions 
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
  	options->gss_authentication=-1;
@@ -2268,7 +2276,7 @@
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->challenge_response_authentication = -1;
-@@ -226,8 +229,14 @@
+@@ -245,8 +248,14 @@ fill_default_server_options(ServerOption
  		options->kerberos_get_afs_token = 0;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -2283,7 +2291,7 @@
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -322,7 +331,9 @@
+@@ -343,7 +352,9 @@ typedef enum {
  	sBanner, sUseDNS, sHostbasedAuthentication,
  	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
  	sClientAliveCountMax, sAuthorizedKeysFile,
@@ -2294,7 +2302,7 @@
  	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
  	sZeroKnowledgePasswordAuthentication, sHostCertificate,
-@@ -386,10 +397,20 @@
+@@ -410,10 +421,20 @@ static struct {
  #ifdef GSSAPI
  	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -2315,7 +2323,7 @@
  	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
  	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
  	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -944,10 +965,22 @@
+@@ -1094,10 +1115,22 @@ process_server_config_line(ServerOptions
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2338,7 +2346,7 @@
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -1704,7 +1737,10 @@
+@@ -2008,7 +2041,10 @@ dump_config(ServerOptions *o)
  #endif
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
@@ -2349,10 +2357,10 @@
  #endif
  #ifdef JPAKE
  	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
-diff --speed-large-files --minimal -Nru openssh-5.8p1/servconf.h openssh-5.8p1.new/servconf.h
---- openssh-5.8p1/servconf.h	2010-11-20 05:19:38.000000000 +0100
-+++ openssh-5.8p1.new/servconf.h	2011-02-12 18:07:11.548572408 +0100
-@@ -97,7 +97,10 @@
+diff -Nrup openssh-6.5p1/servconf.h openssh-6.5p1.patched/servconf.h
+--- openssh-6.5p1/servconf.h	2013-12-04 19:07:28.000000000 -0800
++++ openssh-6.5p1.patched/servconf.h	2014-02-15 16:50:46.000000000 -0800
+@@ -112,7 +112,10 @@ typedef struct {
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@@ -2363,9 +2371,9 @@
  	int     password_authentication;	/* If true, permit password
  						 * authentication. */
  	int     kbd_interactive_authentication;	/* If true, permit */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ssh-gss.h openssh-5.8p1.new/ssh-gss.h
---- openssh-5.8p1/ssh-gss.h	2007-06-12 15:40:39.000000000 +0200
-+++ openssh-5.8p1.new/ssh-gss.h	2011-02-12 18:07:11.567306608 +0100
+diff -Nrup openssh-6.5p1/ssh-gss.h openssh-6.5p1.patched/ssh-gss.h
+--- openssh-6.5p1/ssh-gss.h	2013-02-24 16:24:44.000000000 -0800
++++ openssh-6.5p1.patched/ssh-gss.h	2014-02-15 16:50:46.000000000 -0800
 @@ -1,6 +1,6 @@
  /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
  /*
@@ -2374,7 +2382,7 @@
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -60,10 +60,22 @@
+@@ -61,10 +61,22 @@
  
  #define SSH_GSS_OIDTYPE 0x06
  
@@ -2397,7 +2405,7 @@
  	void *data;
  } ssh_gssapi_ccache;
  
-@@ -71,8 +83,11 @@
+@@ -72,8 +84,11 @@ typedef struct {
  	gss_buffer_desc displayname;
  	gss_buffer_desc exportedname;
  	gss_cred_id_t creds;
@@ -2409,7 +2417,7 @@
  } ssh_gssapi_client;
  
  typedef struct ssh_gssapi_mech_struct {
-@@ -83,6 +98,7 @@
+@@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct {
  	int (*userok) (ssh_gssapi_client *, char *);
  	int (*localname) (ssh_gssapi_client *, char **);
  	void (*storecreds) (ssh_gssapi_client *);
@@ -2417,7 +2425,7 @@
  } ssh_gssapi_mech;
  
  typedef struct {
-@@ -93,10 +109,11 @@
+@@ -94,10 +110,11 @@ typedef struct {
  	gss_OID		oid; /* client */
  	gss_cred_id_t	creds; /* server */
  	gss_name_t	client; /* server */
@@ -2430,7 +2438,7 @@
  
  int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
  void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -116,16 +133,30 @@
+@@ -117,16 +134,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
  void ssh_gssapi_delete_ctx(Gssctxt **);
  OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
@@ -2463,9 +2471,9 @@
  #endif /* GSSAPI */
  
  #endif /* _SSH_GSS_H */
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ssh_config openssh-5.8p1.new/ssh_config
---- openssh-5.8p1/ssh_config	2010-01-12 09:40:27.000000000 +0100
-+++ openssh-5.8p1.new/ssh_config	2011-02-12 18:07:11.580240516 +0100
+diff -Nrup openssh-6.5p1/ssh_config openssh-6.5p1.patched/ssh_config
+--- openssh-6.5p1/ssh_config	2013-10-09 16:24:12.000000000 -0700
++++ openssh-6.5p1.patched/ssh_config	2014-02-15 16:50:46.000000000 -0800
 @@ -26,6 +26,8 @@
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
@@ -2475,10 +2483,10 @@
  #   BatchMode no
  #   CheckHostIP yes
  #   AddressFamily any
-diff --speed-large-files --minimal -Nru openssh-5.8p1/ssh_config.5 openssh-5.8p1.new/ssh_config.5
---- openssh-5.8p1/ssh_config.5	2010-12-26 04:26:48.000000000 +0100
-+++ openssh-5.8p1.new/ssh_config.5	2011-02-12 18:07:11.600266821 +0100
-@@ -508,11 +508,43 @@
+diff -Nrup openssh-6.5p1/ssh_config.5 openssh-6.5p1.patched/ssh_config.5
+--- openssh-6.5p1/ssh_config.5	2014-01-19 03:36:14.000000000 -0800
++++ openssh-6.5p1.patched/ssh_config.5	2014-02-15 16:50:46.000000000 -0800
+@@ -676,11 +676,43 @@ Specifies whether user authentication ba
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
@@ -2523,10 +2531,10 @@
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-diff --speed-large-files --minimal -Nru openssh-5.8p1/sshconnect2.c openssh-5.8p1.new/sshconnect2.c
---- openssh-5.8p1/sshconnect2.c	2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1.new/sshconnect2.c	2011-02-12 18:07:11.623078773 +0100
-@@ -159,9 +159,34 @@
+diff -Nrup openssh-6.5p1/sshconnect2.c openssh-6.5p1.patched/sshconnect2.c
+--- openssh-6.5p1/sshconnect2.c	2014-01-09 15:58:53.000000000 -0800
++++ openssh-6.5p1.patched/sshconnect2.c	2014-02-15 16:54:12.000000000 -0800
+@@ -160,9 +160,34 @@ ssh_kex2(char *host, struct sockaddr *ho
  {
  	Kex *kex;
  
@@ -2561,7 +2569,7 @@
  	if (options.ciphers == (char *)-1) {
  		logit("No valid ciphers for protocol version 2 given, using defaults.");
  		options.ciphers = NULL;
-@@ -196,6 +221,17 @@
+@@ -198,6 +223,17 @@ ssh_kex2(char *host, struct sockaddr *ho
  	if (options.kex_algorithms != NULL)
  		myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
  
@@ -2578,8 +2586,8 @@
 +
  	if (options.rekey_limit || options.rekey_interval)
  		packet_set_rekey_limits((u_int32_t)options.rekey_limit,
- 
-@@ -206,10 +242,30 @@
+ 		    (time_t)options.rekey_interval);
+@@ -209,11 +245,31 @@ ssh_kex2(char *host, struct sockaddr *ho
  	kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
  	kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
  	kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
@@ -2590,6 +2598,7 @@
 +		kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
 +	}
 +#endif
+ 	kex->kex[KEX_C25519_SHA256] = kexc25519_client;
  	kex->client_version_string=client_version_string;
  	kex->server_version_string=server_version_string;
  	kex->verify_host_key=&verify_host_key_callback;
@@ -2603,14 +2612,14 @@
 +			kex->gss_host = options.gss_server_identity;
 +		} else {
 +			kex->gss_host = gss_host;
-+        }
++		}
 +	}
 +#endif
 +
  	xxx_kex = kex;
  
  	dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-@@ -304,6 +360,7 @@
+@@ -309,6 +365,7 @@ void	input_gssapi_token(int type, u_int3
  void	input_gssapi_hash(int type, u_int32_t, void *);
  void	input_gssapi_error(int, u_int32_t, void *);
  void	input_gssapi_errtok(int, u_int32_t, void *);
@@ -2618,7 +2627,7 @@
  #endif
  
  void	userauth(Authctxt *, char *);
-@@ -319,6 +376,11 @@
+@@ -324,6 +381,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -2630,7 +2639,7 @@
  	{"gssapi-with-mic",
  		userauth_gssapi,
  		NULL,
-@@ -625,19 +687,31 @@
+@@ -627,19 +689,31 @@ userauth_gssapi(Authctxt *authctxt)
  	static u_int mech = 0;
  	OM_uint32 min;
  	int ok = 0;
@@ -2664,7 +2673,7 @@
  			ok = 1; /* Mechanism works */
  		} else {
  			mech++;
-@@ -734,8 +808,8 @@
+@@ -736,8 +810,8 @@ input_gssapi_response(int type, u_int32_
  {
  	Authctxt *authctxt = ctxt;
  	Gssctxt *gssctxt;
@@ -2675,7 +2684,7 @@
  
  	if (authctxt == NULL)
  		fatal("input_gssapi_response: no authentication context");
-@@ -845,6 +919,48 @@
+@@ -846,6 +920,48 @@ input_gssapi_error(int type, u_int32_t p
  	free(msg);
  	free(lang);
  }
@@ -2724,11 +2733,11 @@
  #endif /* GSSAPI */
  
  int
-diff --speed-large-files --minimal -Nru openssh-5.8p1/sshd.c openssh-5.8p1.new/sshd.c
---- openssh-5.8p1/sshd.c	2011-01-11 07:20:31.000000000 +0100
-+++ openssh-5.8p1.new/sshd.c	2011-02-12 18:07:11.656005267 +0100
-@@ -120,6 +120,10 @@
- #include "roaming.h"
+diff -Nrup openssh-6.5p1/sshd.c openssh-6.5p1.patched/sshd.c
+--- openssh-6.5p1/sshd.c	2014-01-27 20:08:13.000000000 -0800
++++ openssh-6.5p1.patched/sshd.c	2014-02-15 16:54:54.000000000 -0800
+@@ -122,6 +122,10 @@
+ #include "ssh-sandbox.h"
  #include "version.h"
  
 +#ifdef USE_SECURITY_SESSION_API
@@ -2738,7 +2747,7 @@
  #ifdef LIBWRAP
  #include <tcpd.h>
  #include <syslog.h>
-@@ -1590,10 +1594,13 @@
+@@ -1721,10 +1725,13 @@ main(int ac, char **av)
  		logit("Disabling protocol version 1. Could not load host key");
  		options.protocol &= ~SSH_PROTO_1;
  	}
@@ -2752,9 +2761,9 @@
  	if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
  		logit("sshd: no hostkeys available -- exiting.");
  		exit(1);
-@@ -1922,6 +1929,60 @@
- 	/* Log the connection. */
- 	verbose("Connection from %.500s port %d", remote_ip, remote_port);
+@@ -2051,6 +2058,60 @@ main(int ac, char **av)
+ 	    remote_ip, remote_port,
+ 	    get_local_ipaddr(sock_in), get_local_port());
  
 +#ifdef USE_SECURITY_SESSION_API
 +	/*
@@ -2813,9 +2822,9 @@
  	/*
  	 * We don't want to listen forever unless the other side
  	 * successfully authenticates itself.  So we set up an alarm which is
-@@ -2303,6 +2364,48 @@
- 
- 	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
+@@ -2456,6 +2517,48 @@ do_ssh2_kex(void)
+ 	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
+ 	    list_hostkey_types());
  
 +#ifdef GSSAPI
 +	{
@@ -2862,10 +2871,10 @@
  	/* start key exchange */
  	kex = kex_setup(myproposal);
  	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-@@ -2310,6 +2413,13 @@
- 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+@@ -2464,6 +2567,13 @@ do_ssh2_kex(void)
  	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
  	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+ 	kex->kex[KEX_C25519_SHA256] = kexc25519_server;
 +#ifdef GSSAPI
 +	if (options.gss_keyex) {
 +		kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
@@ -2876,22 +2885,22 @@
  	kex->server = 1;
  	kex->client_version_string=client_version_string;
  	kex->server_version_string=server_version_string;
-diff --speed-large-files --minimal -Nru openssh-5.8p1/sshd_config openssh-5.8p1.new/sshd_config
---- openssh-5.8p1/sshd_config	2010-09-10 03:20:12.000000000 +0200
-+++ openssh-5.8p1.new/sshd_config	2011-02-12 18:07:11.668077725 +0100
-@@ -72,6 +72,8 @@
+diff -Nrup openssh-6.5p1/sshd_config openssh-6.5p1.patched/sshd_config
+--- openssh-6.5p1/sshd_config	2014-01-12 00:20:47.000000000 -0800
++++ openssh-6.5p1.patched/sshd_config	2014-02-15 16:50:46.000000000 -0800
+@@ -84,6 +84,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
  # GSSAPI options
  #GSSAPIAuthentication no
  #GSSAPICleanupCredentials yes
 +#GSSAPIStrictAcceptorCheck yes
 +#GSSAPIKeyExchange no
  
- # Set this to 'yes' to enable PAM authentication, account processing, 
- # and session processing. If this is enabled, PAM authentication will 
-diff --speed-large-files --minimal -Nru openssh-5.8p1/sshd_config.5 openssh-5.8p1.new/sshd_config.5
---- openssh-5.8p1/sshd_config.5	2010-12-26 04:26:48.000000000 +0100
-+++ openssh-5.8p1.new/sshd_config.5	2011-02-12 18:07:11.685676774 +0100
-@@ -423,12 +423,40 @@
+ # Set this to 'yes' to enable PAM authentication, account processing,
+ # and session processing. If this is enabled, PAM authentication will
+diff -Nrup openssh-6.5p1/sshd_config.5 openssh-6.5p1.patched/sshd_config.5
+--- openssh-6.5p1/sshd_config.5	2013-12-17 22:47:03.000000000 -0800
++++ openssh-6.5p1.patched/sshd_config.5	2014-02-15 16:50:46.000000000 -0800
+@@ -493,12 +493,40 @@ Specifies whether user authentication ba
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
