diff --git a/.gitignore b/.gitignore
index 02a374d..cc44a91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
 /pam_ssh_agent_auth-0.9.3.tar.bz2
 /openssh-6.0p1-noacss.tar.bz2
 /openssh-6.1p1-noacss.tar.bz2
+/openssh-6.2p1.tar.gz
diff --git a/openssh-6.0p1-audit1.patch b/openssh-6.2p1-audit1.patch
similarity index 82%
rename from openssh-6.0p1-audit1.patch
rename to openssh-6.2p1-audit1.patch
index 9c927b0..ae06ba1 100644
--- a/openssh-6.0p1-audit1.patch
+++ b/openssh-6.2p1-audit1.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/audit-bsm.c.audit1 openssh-6.0p1/audit-bsm.c
---- openssh-6.0p1/audit-bsm.c.audit1	2012-02-24 00:40:43.000000000 +0100
-+++ openssh-6.0p1/audit-bsm.c	2012-08-06 20:33:24.416382804 +0200
+diff -up openssh-6.2p1/audit-bsm.c.audit1 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit1	2012-02-24 00:40:43.000000000 +0100
++++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:18:30.934758118 +0100
 @@ -375,10 +375,23 @@ audit_connection_from(const char *host,
  #endif
  }
@@ -26,9 +26,9 @@ diff -up openssh-6.0p1/audit-bsm.c.audit1 openssh-6.0p1/audit-bsm.c
  }
  
  void
-diff -up openssh-6.0p1/audit.c.audit1 openssh-6.0p1/audit.c
---- openssh-6.0p1/audit.c.audit1	2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit.c	2012-08-06 20:33:24.417382801 +0200
+diff -up openssh-6.2p1/audit.c.audit1 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit1	2011-01-17 11:15:30.000000000 +0100
++++ openssh-6.2p1/audit.c	2013-03-25 17:18:30.934758118 +0100
 @@ -140,6 +140,17 @@ audit_event(ssh_audit_event_t event)
  }
  
@@ -79,9 +79,9 @@ diff -up openssh-6.0p1/audit.c.audit1 openssh-6.0p1/audit.c
 +
  # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/audit.h.audit1 openssh-6.0p1/audit.h
---- openssh-6.0p1/audit.h.audit1	2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit.h	2012-08-06 20:33:24.417382801 +0200
+diff -up openssh-6.2p1/audit.h.audit1 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit1	2011-01-17 11:15:30.000000000 +0100
++++ openssh-6.2p1/audit.h	2013-03-25 17:18:30.934758118 +0100
 @@ -49,9 +49,11 @@ typedef enum ssh_audit_event_type ssh_au
  
  void	audit_connection_from(const char *, int);
@@ -95,9 +95,9 @@ diff -up openssh-6.0p1/audit.h.audit1 openssh-6.0p1/audit.h
  ssh_audit_event_t audit_classify_auth(const char *);
  
  #endif /* _SSH_AUDIT_H */
-diff -up openssh-6.0p1/audit-linux.c.audit1 openssh-6.0p1/audit-linux.c
---- openssh-6.0p1/audit-linux.c.audit1	2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit-linux.c	2012-08-06 20:33:24.416382804 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit1 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit1	2011-01-17 11:15:30.000000000 +0100
++++ openssh-6.2p1/audit-linux.c	2013-03-25 17:18:30.934758118 +0100
 @@ -35,13 +35,20 @@
  
  #include "log.h"
@@ -313,9 +313,9 @@ diff -up openssh-6.0p1/audit-linux.c.audit1 openssh-6.0p1/audit-linux.c
  		break;
  
  	default:
-diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
---- openssh-6.0p1/monitor.c.audit1	2012-08-06 20:33:24.410382828 +0200
-+++ openssh-6.0p1/monitor.c	2012-08-06 20:33:24.418382797 +0200
+diff -up openssh-6.2p1/monitor.c.audit1 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit1	2013-03-25 17:18:30.913757986 +0100
++++ openssh-6.2p1/monitor.c	2013-03-25 17:18:30.935758124 +0100
 @@ -185,6 +185,7 @@ int mm_answer_gss_checkmic(int, Buffer *
  #ifdef SSH_AUDIT_EVENTS
  int mm_answer_audit_event(int, Buffer *);
@@ -340,7 +340,7 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -1427,6 +1430,12 @@ mm_session_close(Session *s)
+@@ -1433,6 +1436,12 @@ mm_session_close(Session *s)
  		debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
  		session_pty_cleanup2(s);
  	}
@@ -353,7 +353,7 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
  	session_unused(s->self);
  }
  
-@@ -1751,11 +1760,44 @@ mm_answer_audit_command(int socket, Buff
+@@ -1755,11 +1764,44 @@ mm_answer_audit_command(int socket, Buff
  {
  	u_int len;
  	char *cmd;
@@ -399,21 +399,24 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
  	xfree(cmd);
  	return (0);
  }
-diff -up openssh-6.0p1/monitor.h.audit1 openssh-6.0p1/monitor.h
---- openssh-6.0p1/monitor.h.audit1	2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.0p1/monitor.h	2012-08-06 20:33:24.418382797 +0200
-@@ -60,6 +60,7 @@ enum monitor_reqtype {
- 	MONITOR_REQ_PAM_RESPOND, MONITOR_ANS_PAM_RESPOND,
- 	MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
- 	MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
-+	MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
---- openssh-6.0p1/monitor_wrap.c.audit1	2012-08-06 20:33:24.384382930 +0200
-+++ openssh-6.0p1/monitor_wrap.c	2012-08-06 20:33:24.419382793 +0200
-@@ -1188,10 +1188,11 @@ mm_audit_event(ssh_audit_event_t event)
+diff -up openssh-6.2p1/monitor.h.audit1 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit1	2013-03-25 17:18:30.935758124 +0100
++++ openssh-6.2p1/monitor.h	2013-03-25 17:24:53.474078078 +0100
+@@ -68,7 +68,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
+ 	MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
+ 	MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+-	MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
++	MONITOR_REQ_AUDIT_EVENT = 112,
++	MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
++	MONITOR_REQ_AUDIT_END_COMMAND = 116
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit1 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit1	2013-03-25 17:18:30.913757986 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:18:30.936758131 +0100
+@@ -1189,10 +1189,11 @@ mm_audit_event(ssh_audit_event_t event)
  	buffer_free(&m);
  }
  
@@ -426,7 +429,7 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
  
  	debug3("%s entering command %s", __func__, command);
  
-@@ -1199,6 +1200,26 @@ mm_audit_run_command(const char *command
+@@ -1200,6 +1201,26 @@ mm_audit_run_command(const char *command
  	buffer_put_cstring(&m, command);
  
  	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
@@ -453,9 +456,9 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
  	buffer_free(&m);
  }
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor_wrap.h.audit1 openssh-6.0p1/monitor_wrap.h
---- openssh-6.0p1/monitor_wrap.h.audit1	2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.0p1/monitor_wrap.h	2012-08-06 20:33:24.419382793 +0200
+diff -up openssh-6.2p1/monitor_wrap.h.audit1 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit1	2011-06-20 06:42:23.000000000 +0200
++++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:18:30.936758131 +0100
 @@ -74,7 +74,8 @@ void mm_sshpam_free_ctx(void *);
  #ifdef SSH_AUDIT_EVENTS
  #include "audit.h"
@@ -466,10 +469,10 @@ diff -up openssh-6.0p1/monitor_wrap.h.audit1 openssh-6.0p1/monitor_wrap.h
  #endif
  
  struct Session;
-diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
---- openssh-6.0p1/session.c.audit1	2011-11-04 00:55:24.000000000 +0100
-+++ openssh-6.0p1/session.c	2012-08-06 20:33:24.420382789 +0200
-@@ -742,6 +742,14 @@ do_exec_pty(Session *s, const char *comm
+diff -up openssh-6.2p1/session.c.audit1 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit1	2013-03-15 01:22:37.000000000 +0100
++++ openssh-6.2p1/session.c	2013-03-25 17:18:30.937758137 +0100
+@@ -745,6 +745,14 @@ do_exec_pty(Session *s, const char *comm
  	/* Parent.  Close the slave side of the pseudo tty. */
  	close(ttyfd);
  
@@ -484,7 +487,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  	/* Enter interactive session. */
  	s->ptymaster = ptymaster;
  	packet_set_interactive(1, 
-@@ -813,15 +821,19 @@ do_exec(Session *s, const char *command)
+@@ -816,15 +824,19 @@ do_exec(Session *s, const char *command)
  	}
  
  #ifdef SSH_AUDIT_EVENTS
@@ -506,7 +509,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  #endif
  	if (s->ttyfd != -1)
  		ret = do_exec_pty(s, command);
-@@ -1848,6 +1860,7 @@ session_unused(int id)
+@@ -1856,6 +1868,7 @@ session_unused(int id)
  	sessions[id].ttyfd = -1;
  	sessions[id].ptymaster = -1;
  	sessions[id].x11_chanids = NULL;
@@ -514,7 +517,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  	sessions[id].next_unused = sessions_first_unused;
  	sessions_first_unused = id;
  }
-@@ -1930,6 +1943,19 @@ session_open(Authctxt *authctxt, int cha
+@@ -1938,6 +1951,19 @@ session_open(Authctxt *authctxt, int cha
  }
  
  Session *
@@ -534,7 +537,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  session_by_tty(char *tty)
  {
  	int i;
-@@ -2455,6 +2481,30 @@ session_exit_message(Session *s, int sta
+@@ -2463,6 +2489,30 @@ session_exit_message(Session *s, int sta
  		chan_write_failed(c);
  }
  
@@ -565,7 +568,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  void
  session_close(Session *s)
  {
-@@ -2463,6 +2513,10 @@ session_close(Session *s)
+@@ -2471,6 +2521,10 @@ session_close(Session *s)
  	debug("session_close: session %d pid %ld", s->self, (long)s->pid);
  	if (s->ttyfd != -1)
  		session_pty_cleanup(s);
@@ -576,7 +579,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  	if (s->term)
  		xfree(s->term);
  	if (s->display)
-@@ -2682,6 +2736,15 @@ do_authenticated2(Authctxt *authctxt)
+@@ -2690,6 +2744,15 @@ do_authenticated2(Authctxt *authctxt)
  	server_loop2(authctxt);
  }
  
@@ -592,16 +595,16 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
  void
  do_cleanup(Authctxt *authctxt)
  {
-@@ -2730,5 +2793,5 @@ do_cleanup(Authctxt *authctxt)
+@@ -2738,5 +2801,5 @@ do_cleanup(Authctxt *authctxt)
  	 * or if running in monitor.
  	 */
  	if (!use_privsep || mm_is_monitor())
 -		session_destroy_all(session_pty_cleanup2);
 +		session_destroy_all(do_cleanup_one_session);
  }
-diff -up openssh-6.0p1/session.h.audit1 openssh-6.0p1/session.h
---- openssh-6.0p1/session.h.audit1	2008-05-19 07:34:50.000000000 +0200
-+++ openssh-6.0p1/session.h	2012-08-06 20:33:24.420382789 +0200
+diff -up openssh-6.2p1/session.h.audit1 openssh-6.2p1/session.h
+--- openssh-6.2p1/session.h.audit1	2008-05-19 07:34:50.000000000 +0200
++++ openssh-6.2p1/session.h	2013-03-25 17:18:30.937758137 +0100
 @@ -60,6 +60,12 @@ struct Session {
  		char	*name;
  		char	*val;
@@ -626,10 +629,10 @@ diff -up openssh-6.0p1/session.h.audit1 openssh-6.0p1/session.h
  Session	*session_by_tty(char *);
  void	 session_close(Session *);
  void	 do_setusercontext(struct passwd *);
-diff -up openssh-6.0p1/sshd.c.audit1 openssh-6.0p1/sshd.c
---- openssh-6.0p1/sshd.c.audit1	2012-08-06 20:33:24.392382898 +0200
-+++ openssh-6.0p1/sshd.c	2012-08-06 20:33:24.421382785 +0200
-@@ -2381,7 +2381,8 @@ cleanup_exit(int i)
+diff -up openssh-6.2p1/sshd.c.audit1 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit1	2013-03-25 17:18:30.919758024 +0100
++++ openssh-6.2p1/sshd.c	2013-03-25 17:18:30.937758137 +0100
+@@ -2409,7 +2409,8 @@ cleanup_exit(int i)
  	}
  #ifdef SSH_AUDIT_EVENTS
  	/* done after do_cleanup so it can cancel the PAM auth 'thread' */
diff --git a/openssh-5.9p1-audit3.patch b/openssh-6.2p1-audit3.patch
similarity index 73%
rename from openssh-5.9p1-audit3.patch
rename to openssh-6.2p1-audit3.patch
index da59660..9c8b4f3 100644
--- a/openssh-5.9p1-audit3.patch
+++ b/openssh-6.2p1-audit3.patch
@@ -1,19 +1,7 @@
-diff -up openssh-5.9p1/Makefile.in.audit3 openssh-5.9p1/Makefile.in
---- openssh-5.9p1/Makefile.in.audit3	2011-08-05 22:15:18.000000000 +0200
-+++ openssh-5.9p1/Makefile.in	2011-09-14 07:05:58.337520327 +0200
-@@ -71,7 +71,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
- 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
- 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
--	schnorr.o ssh-pkcs11.o
-+	schnorr.o ssh-pkcs11.o auditstub.o
- 
- SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
- 	sshconnect.o sshconnect1.o sshconnect2.o mux.o \
-diff -up openssh-5.9p1/audit-bsm.c.audit3 openssh-5.9p1/audit-bsm.c
---- openssh-5.9p1/audit-bsm.c.audit3	2011-09-14 07:05:56.719459048 +0200
-+++ openssh-5.9p1/audit-bsm.c	2011-09-14 07:05:58.430520147 +0200
-@@ -396,4 +396,16 @@ audit_event(ssh_audit_event_t event)
+diff -up openssh-6.2p1/audit-bsm.c.audit3 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit3	2013-03-25 17:30:41.329102631 +0100
++++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:30:41.338102682 +0100
+@@ -473,4 +473,16 @@ audit_event(ssh_audit_event_t event)
  		debug("%s: unhandled event %d", __func__, event);
  	}
  }
@@ -30,9 +18,88 @@ diff -up openssh-5.9p1/audit-bsm.c.audit3 openssh-5.9p1/audit-bsm.c
 +	/* not implemented */
 +}
  #endif /* BSM */
-diff -up openssh-5.9p1/audit-linux.c.audit3 openssh-5.9p1/audit-linux.c
---- openssh-5.9p1/audit-linux.c.audit3	2011-09-14 07:05:56.820460613 +0200
-+++ openssh-5.9p1/audit-linux.c	2011-09-14 07:07:29.651459660 +0200
+diff -up openssh-6.2p1/audit.c.audit3 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit3	2013-03-25 17:30:41.330102636 +0100
++++ openssh-6.2p1/audit.c	2013-03-25 17:30:41.339102688 +0100
+@@ -28,6 +28,7 @@
+ 
+ #include <stdarg.h>
+ #include <string.h>
++#include <unistd.h>
+ 
+ #ifdef SSH_AUDIT_EVENTS
+ 
+@@ -36,6 +37,8 @@
+ #include "key.h"
+ #include "hostfile.h"
+ #include "auth.h"
++#include "ssh-gss.h"
++#include "monitor_wrap.h"
+ #include "xmalloc.h"
+ 
+ /*
+@@ -128,6 +131,18 @@ audit_key(int host_user, int *rv, const
+ 	xfree(fp);
+ }
+ 
++void
++audit_unsupported(int what)
++{
++	PRIVSEP(audit_unsupported_body(what));
++}
++
++void
++audit_kex(int ctos, char *enc, char *mac, char *comp)
++{
++	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
++}
++
+ # ifndef CUSTOM_SSH_AUDIT_EVENTS
+ /*
+  * Null implementations of audit functions.
+@@ -238,5 +253,26 @@ audit_keyusage(int host_user, const char
+ 		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,
+ 		key_fingerprint_prefix(), fp, rv);
+ }
++
++/*
++ * This will be called when the protocol negotiation fails.
++ */
++void
++audit_unsupported_body(int what)
++{
++	debug("audit unsupported protocol euid %d type %d", geteuid(), what);
++}
++
++/*
++ * This will be called on succesfull protocol negotiation.
++ */
++void
++audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
++	       uid_t uid)
++{
++	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
++		(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
++	        (unsigned)uid);
++}
+ # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
+ #endif /* SSH_AUDIT_EVENTS */
+diff -up openssh-6.2p1/audit.h.audit3 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit3	2013-03-25 17:30:41.330102636 +0100
++++ openssh-6.2p1/audit.h	2013-03-25 17:30:41.339102688 +0100
+@@ -58,5 +58,9 @@ void 	audit_end_command(int, const char
+ ssh_audit_event_t audit_classify_auth(const char *);
+ int	audit_keyusage(int, const char *, unsigned, char *, int);
+ void	audit_key(int, int *, const Key *);
++void	audit_unsupported(int);
++void	audit_kex(int, char *, char *, char *);
++void	audit_unsupported_body(int);
++void	audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
+ 
+ #endif /* _SSH_AUDIT_H */
+diff -up openssh-6.2p1/audit-linux.c.audit3 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit3	2013-03-25 17:30:41.331102642 +0100
++++ openssh-6.2p1/audit-linux.c	2013-03-25 17:30:41.339102688 +0100
 @@ -40,6 +40,8 @@
  #include "auth.h"
  #include "servconf.h"
@@ -103,88 +170,9 @@ diff -up openssh-5.9p1/audit-linux.c.audit3 openssh-5.9p1/audit-linux.c
 +}
 +
  #endif /* USE_LINUX_AUDIT */
-diff -up openssh-5.9p1/audit.c.audit3 openssh-5.9p1/audit.c
---- openssh-5.9p1/audit.c.audit3	2011-09-14 07:05:56.937585272 +0200
-+++ openssh-5.9p1/audit.c	2011-09-14 07:05:58.646521393 +0200
-@@ -28,6 +28,7 @@
- 
- #include <stdarg.h>
- #include <string.h>
-+#include <unistd.h>
- 
- #ifdef SSH_AUDIT_EVENTS
- 
-@@ -36,6 +37,8 @@
- #include "key.h"
- #include "hostfile.h"
- #include "auth.h"
-+#include "ssh-gss.h"
-+#include "monitor_wrap.h"
- #include "xmalloc.h"
- 
- /*
-@@ -128,6 +131,18 @@ audit_key(int host_user, int *rv, const
- 	xfree(fp);
- }
- 
-+void
-+audit_unsupported(int what)
-+{
-+	PRIVSEP(audit_unsupported_body(what));
-+}
-+
-+void
-+audit_kex(int ctos, char *enc, char *mac, char *comp)
-+{
-+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
-+}
-+
- # ifndef CUSTOM_SSH_AUDIT_EVENTS
- /*
-  * Null implementations of audit functions.
-@@ -238,5 +253,26 @@ audit_keyusage(int host_user, const char
- 		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,
- 		key_fingerprint_prefix(), fp, rv);
- }
-+
-+/*
-+ * This will be called when the protocol negotiation fails.
-+ */
-+void
-+audit_unsupported_body(int what)
-+{
-+	debug("audit unsupported protocol euid %d type %d", geteuid(), what);
-+}
-+
-+/*
-+ * This will be called on succesfull protocol negotiation.
-+ */
-+void
-+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
-+	       uid_t uid)
-+{
-+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
-+		(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
-+	        (unsigned)uid);
-+}
- # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
- #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/audit.h.audit3 openssh-5.9p1/audit.h
---- openssh-5.9p1/audit.h.audit3	2011-09-14 07:05:57.391522394 +0200
-+++ openssh-5.9p1/audit.h	2011-09-14 07:05:58.766586362 +0200
-@@ -58,5 +58,9 @@ void 	audit_end_command(int, const char
- ssh_audit_event_t audit_classify_auth(const char *);
- int	audit_keyusage(int, const char *, unsigned, char *, int);
- void	audit_key(int, int *, const Key *);
-+void	audit_unsupported(int);
-+void	audit_kex(int, char *, char *, char *);
-+void	audit_unsupported_body(int);
-+void	audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
- 
- #endif /* _SSH_AUDIT_H */
-diff -up openssh-5.9p1/auditstub.c.audit3 openssh-5.9p1/auditstub.c
---- openssh-5.9p1/auditstub.c.audit3	2011-09-14 07:05:58.866461077 +0200
-+++ openssh-5.9p1/auditstub.c	2011-09-14 07:05:58.870569033 +0200
+diff -up openssh-6.2p1/auditstub.c.audit3 openssh-6.2p1/auditstub.c
+--- openssh-6.2p1/auditstub.c.audit3	2013-03-25 17:30:41.340102694 +0100
++++ openssh-6.2p1/auditstub.c	2013-03-25 17:30:41.340102694 +0100
 @@ -0,0 +1,39 @@
 +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
 +
@@ -225,30 +213,32 @@ diff -up openssh-5.9p1/auditstub.c.audit3 openssh-5.9p1/auditstub.c
 +{
 +}
 +
-diff -up openssh-5.9p1/cipher.c.audit3 openssh-5.9p1/cipher.c
---- openssh-5.9p1/cipher.c.audit3	2011-09-07 15:05:09.000000000 +0200
-+++ openssh-5.9p1/cipher.c	2011-09-14 07:05:58.955582581 +0200
-@@ -60,15 +60,7 @@ extern void ssh1_3des_iv(EVP_CIPHER_CTX
- extern const EVP_CIPHER *evp_aes_128_ctr(void);
- extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+diff -up openssh-6.2p1/cipher.c.audit3 openssh-6.2p1/cipher.c
+--- openssh-6.2p1/cipher.c.audit3	2013-03-25 17:30:41.340102694 +0100
++++ openssh-6.2p1/cipher.c	2013-03-25 17:32:33.117743548 +0100
+@@ -58,17 +58,7 @@ extern const EVP_CIPHER *evp_ssh1_bf(voi
+ extern const EVP_CIPHER *evp_ssh1_3des(void);
+ extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
  
 -struct Cipher {
 -	char	*name;
 -	int	number;		/* for ssh1 only */
 -	u_int	block_size;
 -	u_int	key_len;
+-	u_int	iv_len;		/* defaults to block_size */
+-	u_int	auth_len;
 -	u_int	discard_len;
 -	u_int	cbc_mode;
 -	const EVP_CIPHER	*(*evptype)(void);
 -} ciphers[] = {
 +struct Cipher ciphers[] = {
- 	{ "none",		SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
- 	{ "des",		SSH_CIPHER_DES, 8, 8, 0, 1, EVP_des_cbc },
- 	{ "3des",		SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
-diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
---- openssh-5.9p1/cipher.h.audit3	2009-01-28 06:38:41.000000000 +0100
-+++ openssh-5.9p1/cipher.h	2011-09-14 07:05:59.063459363 +0200
-@@ -61,7 +61,16 @@
+ 	{ "none",	SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+ 	{ "des",	SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
+ 	{ "3des",	SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+diff -up openssh-6.2p1/cipher.h.audit3 openssh-6.2p1/cipher.h
+--- openssh-6.2p1/cipher.h.audit3	2013-03-25 17:30:41.341102699 +0100
++++ openssh-6.2p1/cipher.h	2013-03-25 17:32:45.338813408 +0100
+@@ -61,7 +61,18 @@
  typedef struct Cipher Cipher;
  typedef struct CipherContext CipherContext;
  
@@ -258,6 +248,8 @@ diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
 +	int	number;		/* for ssh1 only */
 +	u_int	block_size;
 +	u_int	key_len;
++	u_int	iv_len;		/* defaults to block_size */
++	u_int	auth_len;
 +	u_int	discard_len;
 +	u_int	cbc_mode;
 +	const EVP_CIPHER	*(*evptype)(void);
@@ -265,10 +257,10 @@ diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
 +
  struct CipherContext {
  	int	plaintext;
- 	EVP_CIPHER_CTX evp;
-diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
---- openssh-5.9p1/kex.c.audit3	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.9p1/kex.c	2011-09-14 07:05:59.171457800 +0200
+ 	int	encrypt;
+diff -up openssh-6.2p1/kex.c.audit3 openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.audit3	2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/kex.c	2013-03-25 17:33:40.352129450 +0100
 @@ -49,6 +49,7 @@
  #include "dispatch.h"
  #include "monitor.h"
@@ -277,7 +269,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
  
  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
  # if defined(HAVE_EVP_SHA256)
-@@ -286,9 +287,13 @@ static void
+@@ -296,9 +297,13 @@ static void
  choose_enc(Enc *enc, char *client, char *server)
  {
  	char *name = match_list(client, server, NULL);
@@ -292,7 +284,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
  	if ((enc->cipher = cipher_by_name(name)) == NULL)
  		fatal("matching cipher is not supported: %s", name);
  	enc->name = name;
-@@ -303,9 +308,13 @@ static void
+@@ -314,9 +319,13 @@ static void
  choose_mac(Mac *mac, char *client, char *server)
  {
  	char *name = match_list(client, server, NULL);
@@ -307,7 +299,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
  	if (mac_setup(mac, name) < 0)
  		fatal("unsupported mac %s", name);
  	/* truncate the key */
-@@ -320,8 +329,12 @@ static void
+@@ -331,8 +340,12 @@ static void
  choose_comp(Comp *comp, char *client, char *server)
  {
  	char *name = match_list(client, server, NULL);
@@ -321,9 +313,9 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
  	if (strcmp(name, "zlib@openssh.com") == 0) {
  		comp->type = COMP_DELAYED;
  	} else if (strcmp(name, "zlib") == 0) {
-@@ -446,6 +459,9 @@ kex_choose_conf(Kex *kex)
+@@ -460,6 +473,9 @@ kex_choose_conf(Kex *kex)
  		    newkeys->enc.name,
- 		    newkeys->mac.name,
+ 		    authlen == 0 ? newkeys->mac.name : "<implicit>",
  		    newkeys->comp.name);
 +#ifdef SSH_AUDIT_EVENTS
 +		audit_kex(ctos, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name);
@@ -331,9 +323,21 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
  	}
  	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
  	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
-diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
---- openssh-5.9p1/monitor.c.audit3	2011-09-14 07:05:57.952459820 +0200
-+++ openssh-5.9p1/monitor.c	2011-09-14 07:05:59.272520466 +0200
+diff -up openssh-6.2p1/Makefile.in.audit3 openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.audit3	2013-03-25 17:30:41.337102676 +0100
++++ openssh-6.2p1/Makefile.in	2013-03-25 17:33:18.833004685 +0100
+@@ -73,7 +73,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
+ 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
+ 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+-	jpake.o schnorr.o ssh-pkcs11.o krl.o
++	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
+ 
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+ 	sshconnect.o sshconnect1.o sshconnect2.o mux.o \
+diff -up openssh-6.2p1/monitor.c.audit3 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit3	2013-03-25 17:30:41.333102653 +0100
++++ openssh-6.2p1/monitor.c	2013-03-25 17:30:41.344102717 +0100
 @@ -97,6 +97,7 @@
  #include "ssh2.h"
  #include "jpake.h"
@@ -342,7 +346,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
  
  #ifdef GSSAPI
  static Gssctxt *gsscontext = NULL;
-@@ -187,6 +188,8 @@ int mm_answer_gss_checkmic(int, Buffer *
+@@ -186,6 +187,8 @@ int mm_answer_gss_checkmic(int, Buffer *
  int mm_answer_audit_event(int, Buffer *);
  int mm_answer_audit_command(int, Buffer *);
  int mm_answer_audit_end_command(int, Buffer *);
@@ -360,7 +364,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
  #endif
  #ifdef BSD_AUTH
      {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -275,6 +280,8 @@ struct mon_table mon_dispatch_postauth20
+@@ -274,6 +279,8 @@ struct mon_table mon_dispatch_postauth20
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
      {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
@@ -369,7 +373,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -306,6 +313,8 @@ struct mon_table mon_dispatch_proto15[]
+@@ -305,6 +312,8 @@ struct mon_table mon_dispatch_proto15[]
  #endif
  #ifdef SSH_AUDIT_EVENTS
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@@ -378,7 +382,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -318,6 +327,8 @@ struct mon_table mon_dispatch_postauth15
+@@ -317,6 +326,8 @@ struct mon_table mon_dispatch_postauth15
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
      {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
@@ -387,7 +391,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -2383,3 +2394,47 @@ mm_answer_jpake_check_confirm(int sock,
+@@ -2397,3 +2408,47 @@ mm_answer_jpake_check_confirm(int sock,
  }
  
  #endif /* JPAKE */
@@ -435,22 +439,24 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 +}
 +
 +#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/monitor.h.audit3 openssh-5.9p1/monitor.h
---- openssh-5.9p1/monitor.h.audit3	2011-09-14 07:05:55.510580908 +0200
-+++ openssh-5.9p1/monitor.h	2011-09-14 07:05:59.378647273 +0200
-@@ -61,6 +61,8 @@ enum monitor_reqtype {
- 	MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
- 	MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
- 	MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
-+	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
-+	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-5.9p1/monitor_wrap.c.audit3 openssh-5.9p1/monitor_wrap.c
---- openssh-5.9p1/monitor_wrap.c.audit3	2011-09-14 07:05:58.059501118 +0200
-+++ openssh-5.9p1/monitor_wrap.c	2011-09-14 07:05:59.511503364 +0200
-@@ -1505,3 +1505,41 @@ mm_jpake_check_confirm(const BIGNUM *k,
+diff -up openssh-6.2p1/monitor.h.audit3 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit3	2013-03-25 17:30:41.345102722 +0100
++++ openssh-6.2p1/monitor.h	2013-03-25 17:31:57.314538661 +0100
+@@ -70,7 +70,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+ 	MONITOR_REQ_AUDIT_EVENT = 112,
+ 	MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+-	MONITOR_REQ_AUDIT_END_COMMAND = 116
++	MONITOR_REQ_AUDIT_END_COMMAND = 116,
++	MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
++	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit3 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit3	2013-03-25 17:30:41.334102659 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:30:41.346102728 +0100
+@@ -1486,3 +1486,41 @@ mm_jpake_check_confirm(const BIGNUM *k,
  	return success;
  }
  #endif /* JPAKE */
@@ -492,10 +498,10 @@ diff -up openssh-5.9p1/monitor_wrap.c.audit3 openssh-5.9p1/monitor_wrap.c
 +	buffer_free(&m);
 +}
 +#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/monitor_wrap.h.audit3 openssh-5.9p1/monitor_wrap.h
---- openssh-5.9p1/monitor_wrap.h.audit3	2011-09-14 07:05:58.171521245 +0200
-+++ openssh-5.9p1/monitor_wrap.h	2011-09-14 07:05:59.624646515 +0200
-@@ -78,6 +78,8 @@ void mm_sshpam_free_ctx(void *);
+diff -up openssh-6.2p1/monitor_wrap.h.audit3 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit3	2013-03-25 17:30:41.334102659 +0100
++++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:30:41.346102728 +0100
+@@ -77,6 +77,8 @@ void mm_sshpam_free_ctx(void *);
  void mm_audit_event(ssh_audit_event_t);
  int mm_audit_run_command(const char *);
  void mm_audit_end_command(int, const char *);
@@ -504,9 +510,9 @@ diff -up openssh-5.9p1/monitor_wrap.h.audit3 openssh-5.9p1/monitor_wrap.h
  #endif
  
  struct Session;
-diff -up openssh-5.9p1/sshd.c.audit3 openssh-5.9p1/sshd.c
---- openssh-5.9p1/sshd.c.audit3	2011-09-14 07:05:56.554583874 +0200
-+++ openssh-5.9p1/sshd.c	2011-09-14 07:05:59.828466112 +0200
+diff -up openssh-6.2p1/sshd.c.audit3 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit3	2013-03-25 17:30:41.326102613 +0100
++++ openssh-6.2p1/sshd.c	2013-03-25 17:30:41.348102740 +0100
 @@ -118,6 +118,7 @@
  #endif
  #include "monitor_wrap.h"
@@ -515,7 +521,7 @@ diff -up openssh-5.9p1/sshd.c.audit3 openssh-5.9p1/sshd.c
  #include "ssh-sandbox.h"
  #include "version.h"
  
-@@ -2209,6 +2210,10 @@ do_ssh1_kex(void)
+@@ -2241,6 +2242,10 @@ do_ssh1_kex(void)
  		if (cookie[i] != packet_get_char())
  			packet_disconnect("IP Spoofing check bytes do not match.");
  
diff --git a/openssh-6.1p1-audit4.patch b/openssh-6.2p1-audit4.patch
similarity index 74%
rename from openssh-6.1p1-audit4.patch
rename to openssh-6.2p1-audit4.patch
index 4f7abac..0469828 100644
--- a/openssh-6.1p1-audit4.patch
+++ b/openssh-6.2p1-audit4.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/audit-bsm.c.audit4 openssh-6.1p1/audit-bsm.c
---- openssh-6.1p1/audit-bsm.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit-bsm.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit-bsm.c.audit4 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit4	2013-03-25 17:34:16.034337746 +0100
++++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:34:16.042337793 +0100
 @@ -485,4 +485,10 @@ audit_kex_body(int ctos, char *enc, char
  {
  	/* not implemented */
@@ -12,9 +12,9 @@ diff -up openssh-6.1p1/audit-bsm.c.audit4 openssh-6.1p1/audit-bsm.c
 +	/* not implemented */
 +}
  #endif /* BSM */
-diff -up openssh-6.1p1/audit.c.audit4 openssh-6.1p1/audit.c
---- openssh-6.1p1/audit.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit.c.audit4 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit4	2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/audit.c	2013-03-25 17:34:16.042337793 +0100
 @@ -143,6 +143,12 @@ audit_kex(int ctos, char *enc, char *mac
  	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
  }
@@ -44,9 +44,9 @@ diff -up openssh-6.1p1/audit.c.audit4 openssh-6.1p1/audit.c
 +}
  # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/audit.h.audit4 openssh-6.1p1/audit.h
---- openssh-6.1p1/audit.h.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit.h	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit.h.audit4 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit4	2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/audit.h	2013-03-25 17:34:16.043337799 +0100
 @@ -62,5 +62,7 @@ void	audit_unsupported(int);
  void	audit_kex(int, char *, char *, char *);
  void	audit_unsupported_body(int);
@@ -55,9 +55,9 @@ diff -up openssh-6.1p1/audit.h.audit4 openssh-6.1p1/audit.h
 +void	audit_session_key_free_body(int ctos, pid_t, uid_t);
  
  #endif /* _SSH_AUDIT_H */
-diff -up openssh-6.1p1/audit-linux.c.audit4 openssh-6.1p1/audit-linux.c
---- openssh-6.1p1/audit-linux.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit-linux.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit-linux.c.audit4 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit4	2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/audit-linux.c	2013-03-25 17:34:16.043337799 +0100
 @@ -294,6 +294,8 @@ audit_unsupported_body(int what)
  #endif
  }
@@ -108,9 +108,9 @@ diff -up openssh-6.1p1/audit-linux.c.audit4 openssh-6.1p1/audit-linux.c
 +}
 +
  #endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.1p1/auditstub.c.audit4 openssh-6.1p1/auditstub.c
---- openssh-6.1p1/auditstub.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/auditstub.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/auditstub.c.audit4 openssh-6.2p1/auditstub.c
+--- openssh-6.2p1/auditstub.c.audit4	2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/auditstub.c	2013-03-25 17:34:16.043337799 +0100
 @@ -27,6 +27,8 @@
   * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
   */
@@ -133,10 +133,10 @@ diff -up openssh-6.1p1/auditstub.c.audit4 openssh-6.1p1/auditstub.c
 +audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
 +{
 +}
-diff -up openssh-6.1p1/kex.c.audit4 openssh-6.1p1/kex.c
---- openssh-6.1p1/kex.c.audit4	2012-11-28 14:20:38.991185818 +0100
-+++ openssh-6.1p1/kex.c	2012-11-28 14:20:38.995185800 +0100
-@@ -624,3 +624,34 @@ dump_digest(char *msg, u_char *digest, i
+diff -up openssh-6.2p1/kex.c.audit4 openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.audit4	2013-03-25 17:34:16.036337758 +0100
++++ openssh-6.2p1/kex.c	2013-03-25 17:34:16.044337804 +0100
+@@ -640,3 +640,34 @@ dump_digest(char *msg, u_char *digest, i
  	fprintf(stderr, "\n");
  }
  #endif
@@ -171,10 +171,10 @@ diff -up openssh-6.1p1/kex.c.audit4 openssh-6.1p1/kex.c
 +	memset(&newkeys->comp, 0, sizeof(newkeys->comp));
 +}
 +
-diff -up openssh-6.1p1/kex.h.audit4 openssh-6.1p1/kex.h
---- openssh-6.1p1/kex.h.audit4	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-6.1p1/kex.h	2012-11-28 14:20:38.996185795 +0100
-@@ -156,6 +156,8 @@ void	 kexgex_server(Kex *);
+diff -up openssh-6.2p1/kex.h.audit4 openssh-6.2p1/kex.h
+--- openssh-6.2p1/kex.h.audit4	2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/kex.h	2013-03-25 17:34:16.044337804 +0100
+@@ -158,6 +158,8 @@ void	 kexgex_server(Kex *);
  void	 kexecdh_client(Kex *);
  void	 kexecdh_server(Kex *);
  
@@ -183,10 +183,10 @@ diff -up openssh-6.1p1/kex.h.audit4 openssh-6.1p1/kex.h
  void
  kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
      BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-diff -up openssh-6.1p1/mac.c.audit4 openssh-6.1p1/mac.c
---- openssh-6.1p1/mac.c.audit4	2012-06-30 00:34:59.000000000 +0200
-+++ openssh-6.1p1/mac.c	2012-11-28 14:20:38.996185795 +0100
-@@ -169,6 +169,20 @@ mac_clear(Mac *mac)
+diff -up openssh-6.2p1/mac.c.audit4 openssh-6.2p1/mac.c
+--- openssh-6.2p1/mac.c.audit4	2012-12-12 01:00:37.000000000 +0100
++++ openssh-6.2p1/mac.c	2013-03-25 17:34:16.044337804 +0100
+@@ -199,6 +199,20 @@ mac_clear(Mac *mac)
  	mac->umac_ctx = NULL;
  }
  
@@ -207,17 +207,17 @@ diff -up openssh-6.1p1/mac.c.audit4 openssh-6.1p1/mac.c
  /* XXX copied from ciphers_valid */
  #define	MAC_SEP	","
  int
-diff -up openssh-6.1p1/mac.h.audit4 openssh-6.1p1/mac.h
---- openssh-6.1p1/mac.h.audit4	2007-06-11 06:01:42.000000000 +0200
-+++ openssh-6.1p1/mac.h	2012-11-28 14:20:38.996185795 +0100
+diff -up openssh-6.2p1/mac.h.audit4 openssh-6.2p1/mac.h
+--- openssh-6.2p1/mac.h.audit4	2007-06-11 06:01:42.000000000 +0200
++++ openssh-6.2p1/mac.h	2013-03-25 17:34:16.045337810 +0100
 @@ -28,3 +28,4 @@ int	 mac_setup(Mac *, char *);
  int	 mac_init(Mac *);
  u_char	*mac_compute(Mac *, u_int32_t, u_char *, int);
  void	 mac_clear(Mac *);
 +void	 mac_destroy(Mac *);
-diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor.c	2012-11-28 17:02:17.677045093 +0100
+diff -up openssh-6.2p1/monitor.c.audit4 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit4	2013-03-25 17:34:16.037337763 +0100
++++ openssh-6.2p1/monitor.c	2013-03-25 17:34:16.046337816 +0100
 @@ -189,6 +189,7 @@ int mm_answer_audit_command(int, Buffer
  int mm_answer_audit_end_command(int, Buffer *);
  int mm_answer_audit_unsupported_body(int, Buffer *);
@@ -226,7 +226,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  #endif
  
  static int monitor_read_log(struct monitor *);
-@@ -241,6 +242,7 @@ struct mon_table mon_dispatch_proto20[]
+@@ -242,6 +243,7 @@ struct mon_table mon_dispatch_proto20[]
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
      {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -234,7 +234,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  #endif
  #ifdef BSD_AUTH
      {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -280,6 +282,7 @@ struct mon_table mon_dispatch_postauth20
+@@ -281,6 +283,7 @@ struct mon_table mon_dispatch_postauth20
      {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
      {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
      {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -242,7 +242,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -313,6 +316,7 @@ struct mon_table mon_dispatch_proto15[]
+@@ -314,6 +317,7 @@ struct mon_table mon_dispatch_proto15[]
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
      {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -250,7 +250,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -327,6 +331,7 @@ struct mon_table mon_dispatch_postauth15
+@@ -328,6 +332,7 @@ struct mon_table mon_dispatch_postauth15
      {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
      {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
      {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -258,18 +258,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -448,10 +453,6 @@ monitor_child_preauth(Authctxt *_authctx
- #endif
- 	}
- 
--	/* Drain any buffered messages from the child */
--	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
--		;
--
- 	if (!authctxt->valid)
- 		fatal("%s: authenticated invalid user", __func__);
- 	if (strcmp(auth_method, "unknown") == 0)
-@@ -1950,11 +1951,13 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -1957,11 +1962,13 @@ mm_get_keystate(struct monitor *pmonitor
  
  	blob = buffer_get_string(&m, &bloblen);
  	current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
@@ -283,7 +272,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  	xfree(blob);
  
  	/* Now get sequence numbers for the packets */
-@@ -2000,6 +2003,21 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -2007,6 +2014,21 @@ mm_get_keystate(struct monitor *pmonitor
  	}
  
  	buffer_free(&m);
@@ -305,7 +294,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
  }
  
  
-@@ -2444,4 +2462,22 @@ mm_answer_audit_kex_body(int sock, Buffe
+@@ -2451,4 +2473,22 @@ mm_answer_audit_kex_body(int sock, Buffe
  	return 0;
  }
  
@@ -328,21 +317,23 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 +	return 0;
 +}
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/monitor.h.audit4 openssh-6.1p1/monitor.h
---- openssh-6.1p1/monitor.h.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor.h	2012-11-28 14:20:38.997185790 +0100
-@@ -63,6 +63,7 @@ enum monitor_reqtype {
- 	MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
- 	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
- 	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
-+	MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor_wrap.c	2012-11-28 14:20:38.997185790 +0100
-@@ -653,12 +653,14 @@ mm_send_keystate(struct monitor *monitor
+diff -up openssh-6.2p1/monitor.h.audit4 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit4	2013-03-25 17:34:16.046337816 +0100
++++ openssh-6.2p1/monitor.h	2013-03-25 17:35:01.408602217 +0100
+@@ -72,7 +72,8 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+ 	MONITOR_REQ_AUDIT_END_COMMAND = 116,
+ 	MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+-	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121
++	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121,
++	MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit4 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit4	2013-03-25 17:34:16.038337769 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:34:16.047337822 +0100
+@@ -654,12 +654,14 @@ mm_send_keystate(struct monitor *monitor
  		fatal("%s: conversion of newkeys failed", __func__);
  
  	buffer_put_string(&m, blob, bloblen);
@@ -357,7 +348,7 @@ diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
  	xfree(blob);
  
  	packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
-@@ -1522,4 +1524,19 @@ mm_audit_kex_body(int ctos, char *cipher
+@@ -1523,4 +1525,19 @@ mm_audit_kex_body(int ctos, char *cipher
  
  	buffer_free(&m);
  }
@@ -377,9 +368,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
 +	buffer_free(&m);
 +}
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/monitor_wrap.h.audit4 openssh-6.1p1/monitor_wrap.h
---- openssh-6.1p1/monitor_wrap.h.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor_wrap.h	2012-11-28 14:20:38.997185790 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.audit4 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit4	2013-03-25 17:34:16.039337775 +0100
++++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:34:16.047337822 +0100
 @@ -79,6 +79,7 @@ int mm_audit_run_command(const char *);
  void mm_audit_end_command(int, const char *);
  void mm_audit_unsupported_body(int);
@@ -388,9 +379,9 @@ diff -up openssh-6.1p1/monitor_wrap.h.audit4 openssh-6.1p1/monitor_wrap.h
  #endif
  
  struct Session;
-diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
---- openssh-6.1p1/packet.c.audit4	2012-11-28 14:20:38.973185902 +0100
-+++ openssh-6.1p1/packet.c	2012-11-28 14:20:38.998185785 +0100
+diff -up openssh-6.2p1/packet.c.audit4 openssh-6.2p1/packet.c
+--- openssh-6.2p1/packet.c.audit4	2013-03-25 17:34:16.014337629 +0100
++++ openssh-6.2p1/packet.c	2013-03-25 17:42:26.519176337 +0100
 @@ -60,6 +60,7 @@
  #include <signal.h>
  
@@ -472,7 +463,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
  void
  set_newkeys(int mode)
  {
-@@ -754,18 +782,9 @@ set_newkeys(int mode)
+@@ -754,21 +782,9 @@ set_newkeys(int mode)
  	}
  	if (active_state->newkeys[mode] != NULL) {
  		debug("set_newkeys: rekeying");
@@ -482,6 +473,9 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 -		mac  = &active_state->newkeys[mode]->mac;
 -		comp = &active_state->newkeys[mode]->comp;
 -		mac_clear(mac);
+-		memset(enc->iv,  0, enc->iv_len);
+-		memset(enc->key, 0, enc->key_len);
+-		memset(mac->key, 0, mac->key_len);
 -		xfree(enc->name);
 -		xfree(enc->iv);
 -		xfree(enc->key);
@@ -493,7 +487,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
  	}
  	active_state->newkeys[mode] = kex_get_newkeys(mode);
  	if (active_state->newkeys[mode] == NULL)
-@@ -1921,6 +1940,47 @@ packet_get_newkeys(int mode)
+@@ -1971,6 +1987,47 @@ packet_get_newkeys(int mode)
  	return (void *)active_state->newkeys[mode];
  }
  
@@ -541,7 +535,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
  /*
   * Save the state for the real connection, and use a separate state when
   * resuming a suspended connection.
-@@ -1928,18 +1988,12 @@ packet_get_newkeys(int mode)
+@@ -1978,18 +2035,12 @@ packet_get_newkeys(int mode)
  void
  packet_backup_state(void)
  {
@@ -561,7 +555,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
  }
  
  /*
-@@ -1956,9 +2010,7 @@ packet_restore_state(void)
+@@ -2006,9 +2057,7 @@ packet_restore_state(void)
  	backup_state = active_state;
  	active_state = tmp;
  	active_state->connection_in = backup_state->connection_in;
@@ -571,7 +565,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
  	len = buffer_len(&backup_state->input);
  	if (len > 0) {
  		buf = buffer_ptr(&backup_state->input);
-@@ -1966,4 +2018,10 @@ packet_restore_state(void)
+@@ -2016,4 +2065,10 @@ packet_restore_state(void)
  		buffer_clear(&backup_state->input);
  		add_recv_bytes(len);
  	}
@@ -582,19 +576,19 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 +	backup_state = NULL;
  }
 +
-diff -up openssh-6.1p1/packet.h.audit4 openssh-6.1p1/packet.h
---- openssh-6.1p1/packet.h.audit4	2012-02-10 22:19:21.000000000 +0100
-+++ openssh-6.1p1/packet.h	2012-11-28 14:20:38.998185785 +0100
+diff -up openssh-6.2p1/packet.h.audit4 openssh-6.2p1/packet.h
+--- openssh-6.2p1/packet.h.audit4	2012-02-10 22:19:21.000000000 +0100
++++ openssh-6.2p1/packet.h	2013-03-25 17:34:16.049337834 +0100
 @@ -123,4 +123,5 @@ void	 packet_restore_state(void);
  void	*packet_get_input(void);
  void	*packet_get_output(void);
  
 +void	 packet_destroy_all(int, int);
  #endif				/* PACKET_H */
-diff -up openssh-6.1p1/session.c.audit4 openssh-6.1p1/session.c
---- openssh-6.1p1/session.c.audit4	2012-11-28 14:20:38.983185855 +0100
-+++ openssh-6.1p1/session.c	2012-11-28 14:20:38.998185785 +0100
-@@ -1634,6 +1634,9 @@ do_child(Session *s, const char *command
+diff -up openssh-6.2p1/session.c.audit4 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit4	2013-03-25 17:34:16.023337682 +0100
++++ openssh-6.2p1/session.c	2013-03-25 17:34:16.050337839 +0100
+@@ -1642,6 +1642,9 @@ do_child(Session *s, const char *command
  
  	/* remove hostkey from the child's memory */
  	destroy_sensitive_data();
@@ -604,10 +598,10 @@ diff -up openssh-6.1p1/session.c.audit4 openssh-6.1p1/session.c
  
  	/* Force a password change */
  	if (s->authctxt->force_pwchange) {
-diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.audit4	2012-11-28 14:20:38.993185808 +0100
-+++ openssh-6.1p1/sshd.c	2012-11-28 14:20:38.999185780 +0100
-@@ -692,6 +692,8 @@ privsep_preauth(Authctxt *authctxt)
+diff -up openssh-6.2p1/sshd.c.audit4 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit4	2013-03-25 17:34:16.039337775 +0100
++++ openssh-6.2p1/sshd.c	2013-03-25 17:34:16.050337839 +0100
+@@ -701,6 +701,8 @@ privsep_preauth(Authctxt *authctxt)
  	}
  }
  
@@ -616,7 +610,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
  static void
  privsep_postauth(Authctxt *authctxt)
  {
-@@ -716,6 +718,10 @@ privsep_postauth(Authctxt *authctxt)
+@@ -725,6 +727,10 @@ privsep_postauth(Authctxt *authctxt)
  	else if (pmonitor->m_pid != 0) {
  		verbose("User child is on pid %ld", (long)pmonitor->m_pid);
  		buffer_clear(&loginmsg);
@@ -627,7 +621,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
  		monitor_child_postauth(pmonitor);
  
  		/* NEVERREACHED */
-@@ -2016,6 +2022,7 @@ main(int ac, char **av)
+@@ -2033,6 +2039,7 @@ main(int ac, char **av)
  	 */
  	if (use_privsep) {
  		mm_send_keystate(pmonitor);
@@ -635,7 +629,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
  		exit(0);
  	}
  
-@@ -2068,6 +2075,8 @@ main(int ac, char **av)
+@@ -2085,6 +2092,8 @@ main(int ac, char **av)
  	do_authenticated(authctxt);
  
  	/* The connection has been terminated. */
@@ -644,7 +638,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
  	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
  	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
  	verbose("Transferred: sent %llu, received %llu bytes",
-@@ -2385,6 +2394,16 @@ do_ssh2_kex(void)
+@@ -2402,6 +2411,16 @@ do_ssh2_kex(void)
  void
  cleanup_exit(int i)
  {
@@ -661,7 +655,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
  	if (the_authctxt) {
  		do_cleanup(the_authctxt);
  		if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
-@@ -2395,6 +2414,8 @@ cleanup_exit(int i)
+@@ -2412,6 +2431,8 @@ cleanup_exit(int i)
  				    pmonitor->m_pid, strerror(errno));
  		}
  	}
diff --git a/openssh-6.0p1-audit5.patch b/openssh-6.2p1-audit5.patch
similarity index 77%
rename from openssh-6.0p1-audit5.patch
rename to openssh-6.2p1-audit5.patch
index 70aa3ff..6f212df 100644
--- a/openssh-6.0p1-audit5.patch
+++ b/openssh-6.2p1-audit5.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/audit-bsm.c.audit5 openssh-6.0p1/audit-bsm.c
---- openssh-6.0p1/audit-bsm.c.audit5	2012-08-06 20:37:50.036345216 +0200
-+++ openssh-6.0p1/audit-bsm.c	2012-08-06 20:37:50.046345177 +0200
+diff -up openssh-6.2p1/audit-bsm.c.audit5 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit5	2013-03-25 17:43:27.495526587 +0100
++++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:43:27.502526627 +0100
 @@ -491,4 +491,22 @@ audit_session_key_free_body(int ctos, pi
  {
  	/* not implemented */
@@ -24,9 +24,9 @@ diff -up openssh-6.0p1/audit-bsm.c.audit5 openssh-6.0p1/audit-bsm.c
 +	/* not implemented */
 +}
  #endif /* BSM */
-diff -up openssh-6.0p1/audit.c.audit5 openssh-6.0p1/audit.c
---- openssh-6.0p1/audit.c.audit5	2012-08-06 20:37:50.036345216 +0200
-+++ openssh-6.0p1/audit.c	2012-08-06 20:37:50.047345173 +0200
+diff -up openssh-6.2p1/audit.c.audit5 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit5	2013-03-25 17:43:27.495526587 +0100
++++ openssh-6.2p1/audit.c	2013-03-25 17:43:27.502526627 +0100
 @@ -290,5 +290,24 @@ audit_session_key_free_body(int ctos, pi
  	debug("audit session key discard euid %u direction %d from pid %ld uid %u",
  		(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
@@ -52,9 +52,9 @@ diff -up openssh-6.0p1/audit.c.audit5 openssh-6.0p1/audit.c
 +}
  # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/audit.h.audit5 openssh-6.0p1/audit.h
---- openssh-6.0p1/audit.h.audit5	2012-08-06 20:37:50.037345212 +0200
-+++ openssh-6.0p1/audit.h	2012-08-06 20:37:50.047345173 +0200
+diff -up openssh-6.2p1/audit.h.audit5 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit5	2013-03-25 17:43:27.496526593 +0100
++++ openssh-6.2p1/audit.h	2013-03-25 17:43:27.502526627 +0100
 @@ -48,6 +48,8 @@ enum ssh_audit_event_type {
  };
  typedef enum ssh_audit_event_type ssh_audit_event_t;
@@ -72,9 +72,9 @@ diff -up openssh-6.0p1/audit.h.audit5 openssh-6.0p1/audit.h
 +void	audit_generate_ephemeral_server_key(const char *);
  
  #endif /* _SSH_AUDIT_H */
-diff -up openssh-6.0p1/audit-linux.c.audit5 openssh-6.0p1/audit-linux.c
---- openssh-6.0p1/audit-linux.c.audit5	2012-08-06 20:37:50.037345212 +0200
-+++ openssh-6.0p1/audit-linux.c	2012-08-06 20:37:50.046345177 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit5 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit5	2013-03-25 17:43:27.496526593 +0100
++++ openssh-6.2p1/audit-linux.c	2013-03-25 17:43:27.503526633 +0100
 @@ -356,4 +356,50 @@ audit_session_key_free_body(int ctos, pi
  		error("cannot write into audit");
  }
@@ -126,10 +126,10 @@ diff -up openssh-6.0p1/audit-linux.c.audit5 openssh-6.0p1/audit-linux.c
 +		error("cannot write into audit");
 +}
  #endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.0p1/key.c.audit5 openssh-6.0p1/key.c
---- openssh-6.0p1/key.c.audit5	2012-08-06 20:37:49.992345388 +0200
-+++ openssh-6.0p1/key.c	2012-08-06 20:37:50.048345169 +0200
-@@ -1794,6 +1794,30 @@ key_demote(const Key *k)
+diff -up openssh-6.2p1/key.c.audit5 openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.audit5	2013-03-25 17:43:27.465526415 +0100
++++ openssh-6.2p1/key.c	2013-03-25 17:43:27.503526633 +0100
+@@ -1809,6 +1809,30 @@ key_demote(const Key *k)
  }
  
  int
@@ -160,10 +160,10 @@ diff -up openssh-6.0p1/key.c.audit5 openssh-6.0p1/key.c
  key_is_cert(const Key *k)
  {
  	if (k == NULL)
-diff -up openssh-6.0p1/key.h.audit5 openssh-6.0p1/key.h
---- openssh-6.0p1/key.h.audit5	2012-08-06 20:37:49.993345384 +0200
-+++ openssh-6.0p1/key.h	2012-08-06 20:37:50.049345165 +0200
-@@ -109,6 +109,7 @@ Key	*key_generate(int, u_int);
+diff -up openssh-6.2p1/key.h.audit5 openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.audit5	2013-03-25 17:43:27.465526415 +0100
++++ openssh-6.2p1/key.h	2013-03-25 17:43:27.503526633 +0100
+@@ -110,6 +110,7 @@ Key	*key_generate(int, u_int);
  Key	*key_from_private(const Key *);
  int	 key_type_from_name(char *);
  int	 key_is_cert(const Key *);
@@ -171,9 +171,9 @@ diff -up openssh-6.0p1/key.h.audit5 openssh-6.0p1/key.h
  int	 key_type_plain(int);
  int	 key_to_certified(Key *, int);
  int	 key_drop_cert(Key *);
-diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
---- openssh-6.0p1/monitor.c.audit5	2012-08-06 20:37:50.040345200 +0200
-+++ openssh-6.0p1/monitor.c	2012-08-06 20:37:50.049345165 +0200
+diff -up openssh-6.2p1/monitor.c.audit5 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit5	2013-03-25 17:43:27.497526599 +0100
++++ openssh-6.2p1/monitor.c	2013-03-25 17:43:27.504526639 +0100
 @@ -114,6 +114,8 @@ extern Buffer auth_debug;
  extern int auth_debug_init;
  extern Buffer loginmsg;
@@ -223,7 +223,7 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -1744,6 +1751,8 @@ mm_answer_term(int sock, Buffer *req)
+@@ -1752,6 +1759,8 @@ mm_answer_term(int sock, Buffer *req)
  		sshpam_cleanup();
  #endif
  
@@ -232,7 +232,7 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
  	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
  		if (errno != EINTR)
  			exit(1);
-@@ -2485,4 +2494,25 @@ mm_answer_audit_session_key_free_body(in
+@@ -2491,4 +2500,25 @@ mm_answer_audit_session_key_free_body(in
  	mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
  	return 0;
  }
@@ -258,21 +258,23 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
 +	return 0;
 +}
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor.h.audit5 openssh-6.0p1/monitor.h
---- openssh-6.0p1/monitor.h.audit5	2012-08-06 20:37:50.040345200 +0200
-+++ openssh-6.0p1/monitor.h	2012-08-06 20:37:50.050345161 +0200
-@@ -64,6 +64,7 @@ enum monitor_reqtype {
- 	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
- 	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
- 	MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
-+	MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.0p1/monitor_wrap.c.audit5 openssh-6.0p1/monitor_wrap.c
---- openssh-6.0p1/monitor_wrap.c.audit5	2012-08-06 20:37:50.041345196 +0200
-+++ openssh-6.0p1/monitor_wrap.c	2012-08-06 20:37:50.050345161 +0200
-@@ -1539,4 +1539,20 @@ mm_audit_session_key_free_body(int ctos,
+diff -up openssh-6.2p1/monitor.h.audit5 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit5	2013-03-25 17:43:27.504526639 +0100
++++ openssh-6.2p1/monitor.h	2013-03-25 17:44:08.717763090 +0100
+@@ -73,7 +73,8 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_AUDIT_END_COMMAND = 116,
+ 	MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+ 	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121,
+-	MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123
++	MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123,
++	MONITOR_REQ_AUDIT_SERVER_KEY_FREE = 124, MONITOR_ANS_AUDIT_SERVER_KEY_FREE = 125
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit5 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit5	2013-03-25 17:43:27.498526604 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:43:27.505526645 +0100
+@@ -1540,4 +1540,20 @@ mm_audit_session_key_free_body(int ctos,
  				  &m);
  	buffer_free(&m);
  }
@@ -293,9 +295,9 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit5 openssh-6.0p1/monitor_wrap.c
 +	buffer_free(&m);
 +}
  #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor_wrap.h.audit5 openssh-6.0p1/monitor_wrap.h
---- openssh-6.0p1/monitor_wrap.h.audit5	2012-08-06 20:37:50.041345196 +0200
-+++ openssh-6.0p1/monitor_wrap.h	2012-08-06 20:37:50.051345157 +0200
+diff -up openssh-6.2p1/monitor_wrap.h.audit5 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit5	2013-03-25 17:43:27.498526604 +0100
++++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:43:27.505526645 +0100
 @@ -80,6 +80,7 @@ void mm_audit_end_command(int, const cha
  void mm_audit_unsupported_body(int);
  void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
@@ -304,9 +306,9 @@ diff -up openssh-6.0p1/monitor_wrap.h.audit5 openssh-6.0p1/monitor_wrap.h
  #endif
  
  struct Session;
-diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
---- openssh-6.0p1/session.c.audit5	2012-08-06 20:37:50.043345189 +0200
-+++ openssh-6.0p1/session.c	2012-08-06 20:37:50.052345153 +0200
+diff -up openssh-6.2p1/session.c.audit5 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit5	2013-03-25 17:43:27.499526610 +0100
++++ openssh-6.2p1/session.c	2013-03-25 17:43:27.506526650 +0100
 @@ -136,7 +136,7 @@ extern int log_stderr;
  extern int debug_flag;
  extern u_int utmp_len;
@@ -316,7 +318,7 @@ diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
  extern Buffer loginmsg;
  
  /* original command from peer. */
-@@ -1633,7 +1633,7 @@ do_child(Session *s, const char *command
+@@ -1641,7 +1641,7 @@ do_child(Session *s, const char *command
  	int r = 0;
  
  	/* remove hostkey from the child's memory */
@@ -325,9 +327,9 @@ diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
  	/* Don't audit this - both us and the parent would be talking to the
  	   monitor over a single socket, with no synchronization. */
  	packet_destroy_all(0, 1);
-diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
---- openssh-6.0p1/sshd.c.audit5	2012-08-06 20:37:50.044345185 +0200
-+++ openssh-6.0p1/sshd.c	2012-08-06 20:37:50.053345149 +0200
+diff -up openssh-6.2p1/sshd.c.audit5 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit5	2013-03-25 17:43:27.500526616 +0100
++++ openssh-6.2p1/sshd.c	2013-03-25 17:43:27.506526650 +0100
 @@ -255,7 +255,7 @@ Buffer loginmsg;
  struct passwd *privsep_pw = NULL;
  
@@ -353,7 +355,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  static void
  close_startup_pipes(void)
  {
-@@ -534,22 +543,47 @@ sshd_exchange_identification(int sock_in
+@@ -545,22 +554,47 @@ sshd_exchange_identification(int sock_in
  	}
  }
  
@@ -404,7 +406,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  			key_free(sensitive_data.host_certificates[i]);
  			sensitive_data.host_certificates[i] = NULL;
  		}
-@@ -563,6 +597,8 @@ void
+@@ -574,6 +608,8 @@ void
  demote_sensitive_data(void)
  {
  	Key *tmp;
@@ -413,7 +415,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  	int i;
  
  	if (sensitive_data.server_key) {
-@@ -571,13 +607,27 @@ demote_sensitive_data(void)
+@@ -582,13 +618,27 @@ demote_sensitive_data(void)
  		sensitive_data.server_key = tmp;
  	}
  
@@ -441,7 +443,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  		}
  		/* Certs do not need demotion */
  	}
-@@ -1149,6 +1199,7 @@ server_accept_loop(int *sock_in, int *so
+@@ -1160,6 +1210,7 @@ server_accept_loop(int *sock_in, int *so
  		if (received_sigterm) {
  			logit("Received signal %d; terminating.",
  			    (int) received_sigterm);
@@ -449,7 +451,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  			close_listen_socks();
  			unlink(options.pid_file);
  			exit(received_sigterm == SIGTERM ? 0 : 255);
-@@ -2054,7 +2105,7 @@ main(int ac, char **av)
+@@ -2082,7 +2133,7 @@ main(int ac, char **av)
  		privsep_postauth(authctxt);
  		/* the monitor process [priv] will not return */
  		if (!compat20)
@@ -458,7 +460,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  	}
  
  	packet_set_timeout(options.client_alive_interval,
-@@ -2065,6 +2116,7 @@ main(int ac, char **av)
+@@ -2093,6 +2144,7 @@ main(int ac, char **av)
  
  	/* The connection has been terminated. */
  	packet_destroy_all(1, 1);
@@ -466,7 +468,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  
  	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
  	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
-@@ -2293,7 +2345,7 @@ do_ssh1_kex(void)
+@@ -2321,7 +2373,7 @@ do_ssh1_kex(void)
  			session_id[i] = session_key[i] ^ session_key[i + 16];
  	}
  	/* Destroy the private and public keys. No longer. */
@@ -475,7 +477,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
  
  	if (use_privsep)
  		mm_ssh1_session_id(session_id);
-@@ -2404,6 +2456,8 @@ cleanup_exit(int i)
+@@ -2432,6 +2484,8 @@ cleanup_exit(int i)
  		}
  	}
  	is_privsep_child = use_privsep && pmonitor != NULL && !mm_is_monitor();
diff --git a/openssh-6.1p1-coverity.patch b/openssh-6.2p1-coverity.patch
similarity index 80%
rename from openssh-6.1p1-coverity.patch
rename to openssh-6.2p1-coverity.patch
index 0c8fb23..98e70d3 100644
--- a/openssh-6.1p1-coverity.patch
+++ b/openssh-6.2p1-coverity.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c
---- openssh-6.1p1/auth-pam.c.coverity	2009-07-12 14:07:21.000000000 +0200
-+++ openssh-6.1p1/auth-pam.c	2012-09-14 21:16:41.264906486 +0200
+diff -up openssh-6.2p1/auth-pam.c.coverity openssh-6.2p1/auth-pam.c
+--- openssh-6.2p1/auth-pam.c.coverity	2009-07-12 14:07:21.000000000 +0200
++++ openssh-6.2p1/auth-pam.c	2013-03-22 09:49:37.341595458 +0100
 @@ -216,7 +216,12 @@ pthread_join(sp_pthread_t thread, void *
  	if (sshpam_thread_status != -1)
  		return (sshpam_thread_status);
@@ -15,30 +15,9 @@ diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c
  	return (status);
  }
  #endif
-diff -up openssh-6.1p1/clientloop.c.coverity openssh-6.1p1/clientloop.c
---- openssh-6.1p1/clientloop.c.coverity	2012-06-20 14:31:27.000000000 +0200
-+++ openssh-6.1p1/clientloop.c	2012-09-14 21:16:41.267906501 +0200
-@@ -2006,14 +2006,15 @@ client_input_global_request(int type, u_
- 	char *rtype;
- 	int want_reply;
- 	int success = 0;
-+/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
- 
- 	rtype = packet_get_string(NULL);
- 	want_reply = packet_get_char();
- 	debug("client_input_global_request: rtype %s want_reply %d",
- 	    rtype, want_reply);
- 	if (want_reply) {
--		packet_start(success ?
--		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
-+		packet_start(/*success ?
-+		    SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
- 		packet_send();
- 		packet_write_wait();
- 	}
-diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c
---- openssh-6.1p1/channels.c.coverity	2012-04-23 10:21:05.000000000 +0200
-+++ openssh-6.1p1/channels.c	2012-09-14 21:16:41.272906528 +0200
+diff -up openssh-6.2p1/channels.c.coverity openssh-6.2p1/channels.c
+--- openssh-6.2p1/channels.c.coverity	2012-12-02 23:50:55.000000000 +0100
++++ openssh-6.2p1/channels.c	2013-03-22 09:49:37.344595444 +0100
 @@ -232,11 +232,11 @@ channel_register_fds(Channel *c, int rfd
  	channel_max_fd = MAX(channel_max_fd, wfd);
  	channel_max_fd = MAX(channel_max_fd, efd);
@@ -69,9 +48,30 @@ diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c
  			set_nonblock(efd);
  	}
  }
-diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c
---- openssh-6.1p1/key.c.coverity	2012-06-30 12:05:02.000000000 +0200
-+++ openssh-6.1p1/key.c	2012-09-14 21:16:41.274906537 +0200
+diff -up openssh-6.2p1/clientloop.c.coverity openssh-6.2p1/clientloop.c
+--- openssh-6.2p1/clientloop.c.coverity	2013-01-09 05:55:51.000000000 +0100
++++ openssh-6.2p1/clientloop.c	2013-03-22 09:49:37.342595453 +0100
+@@ -2061,14 +2061,15 @@ client_input_global_request(int type, u_
+ 	char *rtype;
+ 	int want_reply;
+ 	int success = 0;
++/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
+ 
+ 	rtype = packet_get_string(NULL);
+ 	want_reply = packet_get_char();
+ 	debug("client_input_global_request: rtype %s want_reply %d",
+ 	    rtype, want_reply);
+ 	if (want_reply) {
+-		packet_start(success ?
+-		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
++		packet_start(/*success ?
++		    SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
+ 		packet_send();
+ 		packet_write_wait();
+ 	}
+diff -up openssh-6.2p1/key.c.coverity openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.coverity	2013-01-18 01:44:05.000000000 +0100
++++ openssh-6.2p1/key.c	2013-03-22 09:49:37.345595440 +0100
 @@ -808,8 +808,10 @@ key_read(Key *ret, char **cpp)
  		success = 1;
  /*XXXX*/
@@ -83,19 +83,19 @@ diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c
  		/* advance cp: skip whitespace and data */
  		while (*cp == ' ' || *cp == '\t')
  			cp++;
-diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.coverity	2012-06-30 00:33:17.000000000 +0200
-+++ openssh-6.1p1/monitor.c	2012-09-14 21:16:41.277906552 +0200
-@@ -420,7 +420,7 @@ monitor_child_preauth(Authctxt *_authctx
- 	}
+diff -up openssh-6.2p1/monitor.c.coverity openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.coverity	2012-12-12 00:44:39.000000000 +0100
++++ openssh-6.2p1/monitor.c	2013-03-22 12:19:55.189921353 +0100
+@@ -449,7 +449,7 @@ monitor_child_preauth(Authctxt *_authctx
+ 	mm_get_keystate(pmonitor);
  
  	/* Drain any buffered messages from the child */
 -	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
 +	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
  		;
  
- 	if (!authctxt->valid)
-@@ -1159,6 +1159,10 @@ mm_answer_keyallowed(int sock, Buffer *m
+ 	close(pmonitor->m_sendfd);
+@@ -1194,6 +1194,10 @@ mm_answer_keyallowed(int sock, Buffer *m
  			break;
  		}
  	}
@@ -106,7 +106,7 @@ diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
  	if (key != NULL)
  		key_free(key);
  
-@@ -1180,9 +1184,6 @@ mm_answer_keyallowed(int sock, Buffer *m
+@@ -1216,9 +1220,6 @@ mm_answer_keyallowed(int sock, Buffer *m
  		xfree(chost);
  	}
  
@@ -116,10 +116,10 @@ diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
  	buffer_clear(m);
  	buffer_put_int(m, allowed);
  	buffer_put_int(m, forced_command != NULL);
-diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.coverity	2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.1p1/monitor_wrap.c	2012-09-14 21:16:41.280906568 +0200
-@@ -707,10 +707,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
+diff -up openssh-6.2p1/monitor_wrap.c.coverity openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.coverity	2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-22 09:49:37.347595431 +0100
+@@ -708,10 +708,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
  	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
  	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
  		error("%s: cannot allocate fds for pty", __func__);
@@ -133,9 +133,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c
  		return 0;
  	}
  	close(tmp1);
-diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/openbsd-compat/bindresvport.c
---- openssh-6.1p1/openbsd-compat/bindresvport.c.coverity	2010-12-03 00:50:26.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/bindresvport.c	2012-09-14 21:16:41.281906573 +0200
+diff -up openssh-6.2p1/openbsd-compat/bindresvport.c.coverity openssh-6.2p1/openbsd-compat/bindresvport.c
+--- openssh-6.2p1/openbsd-compat/bindresvport.c.coverity	2010-12-03 00:50:26.000000000 +0100
++++ openssh-6.2p1/openbsd-compat/bindresvport.c	2013-03-22 09:49:37.347595431 +0100
 @@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
  	struct sockaddr_in6 *in6;
  	u_int16_t *portp;
@@ -145,10 +145,10 @@ diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/open
  	int i;
  
  	if (sa == NULL) {
-diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
---- openssh-6.1p1/packet.c.coverity	2012-03-09 00:28:07.000000000 +0100
-+++ openssh-6.1p1/packet.c	2012-09-14 21:16:41.284906588 +0200
-@@ -1177,6 +1177,7 @@ packet_read_poll1(void)
+diff -up openssh-6.2p1/packet.c.coverity openssh-6.2p1/packet.c
+--- openssh-6.2p1/packet.c.coverity	2013-02-12 01:03:59.000000000 +0100
++++ openssh-6.2p1/packet.c	2013-03-22 09:49:37.348595426 +0100
+@@ -1192,6 +1192,7 @@ packet_read_poll1(void)
  		case DEATTACK_DETECTED:
  			packet_disconnect("crc32 compensation attack: "
  			    "network attack detected");
@@ -156,7 +156,7 @@ diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
  		case DEATTACK_DOS_DETECTED:
  			packet_disconnect("deattack denial of "
  			    "service detected");
-@@ -1678,7 +1679,7 @@ void
+@@ -1728,7 +1729,7 @@ void
  packet_write_wait(void)
  {
  	fd_set *setp;
@@ -165,9 +165,9 @@ diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
  	struct timeval start, timeout, *timeoutp = NULL;
  
  	setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1,
-diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c
---- openssh-6.1p1/progressmeter.c.coverity	2006-08-05 04:39:40.000000000 +0200
-+++ openssh-6.1p1/progressmeter.c	2012-09-14 21:16:41.285906593 +0200
+diff -up openssh-6.2p1/progressmeter.c.coverity openssh-6.2p1/progressmeter.c
+--- openssh-6.2p1/progressmeter.c.coverity	2006-08-05 04:39:40.000000000 +0200
++++ openssh-6.2p1/progressmeter.c	2013-03-22 09:49:37.349595422 +0100
 @@ -65,7 +65,7 @@ static void update_progress_meter(int);
  
  static time_t start;		/* start progress */
@@ -186,9 +186,9 @@ diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c
  {
  	start = last_update = time(NULL);
  	file = f;
-diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h
---- openssh-6.1p1/progressmeter.h.coverity	2006-03-26 05:30:02.000000000 +0200
-+++ openssh-6.1p1/progressmeter.h	2012-09-14 21:16:41.286906598 +0200
+diff -up openssh-6.2p1/progressmeter.h.coverity openssh-6.2p1/progressmeter.h
+--- openssh-6.2p1/progressmeter.h.coverity	2006-03-26 05:30:02.000000000 +0200
++++ openssh-6.2p1/progressmeter.h	2013-03-22 09:49:37.349595422 +0100
 @@ -23,5 +23,5 @@
   * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   */
@@ -196,9 +196,9 @@ diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h
 -void	start_progress_meter(char *, off_t, off_t *);
 +void	start_progress_meter(const char *, off_t, off_t *);
  void	stop_progress_meter(void);
-diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c
---- openssh-6.1p1/scp.c.coverity	2011-09-22 13:38:01.000000000 +0200
-+++ openssh-6.1p1/scp.c	2012-09-14 21:16:41.288906608 +0200
+diff -up openssh-6.2p1/scp.c.coverity openssh-6.2p1/scp.c
+--- openssh-6.2p1/scp.c.coverity	2013-03-20 02:55:15.000000000 +0100
++++ openssh-6.2p1/scp.c	2013-03-22 09:49:37.349595422 +0100
 @@ -155,7 +155,7 @@ killchild(int signo)
  {
  	if (do_cmd_pid > 1) {
@@ -208,10 +208,10 @@ diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c
  	}
  
  	if (signo)
-diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.coverity	2012-07-31 04:22:38.000000000 +0200
-+++ openssh-6.1p1/servconf.c	2012-09-14 21:16:41.291906623 +0200
-@@ -1249,7 +1249,7 @@ process_server_config_line(ServerOptions
+diff -up openssh-6.2p1/servconf.c.coverity openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.coverity	2013-02-12 01:02:08.000000000 +0100
++++ openssh-6.2p1/servconf.c	2013-03-22 09:49:37.350595418 +0100
+@@ -1268,7 +1268,7 @@ process_server_config_line(ServerOptions
  			fatal("%s line %d: Missing subsystem name.",
  			    filename, linenum);
  		if (!*activep) {
@@ -220,7 +220,7 @@ diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
  			break;
  		}
  		for (i = 0; i < options->num_subsystems; i++)
-@@ -1340,8 +1340,9 @@ process_server_config_line(ServerOptions
+@@ -1359,8 +1359,9 @@ process_server_config_line(ServerOptions
  		if (*activep && *charptr == NULL) {
  			*charptr = tilde_expand_filename(arg, getuid());
  			/* increase optional counter */
@@ -232,9 +232,9 @@ diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
  		}
  		break;
  
-diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
---- openssh-6.1p1/serverloop.c.coverity	2012-06-20 14:31:27.000000000 +0200
-+++ openssh-6.1p1/serverloop.c	2012-09-14 21:16:41.294906638 +0200
+diff -up openssh-6.2p1/serverloop.c.coverity openssh-6.2p1/serverloop.c
+--- openssh-6.2p1/serverloop.c.coverity	2012-12-07 03:07:47.000000000 +0100
++++ openssh-6.2p1/serverloop.c	2013-03-22 09:49:37.351595413 +0100
 @@ -147,13 +147,13 @@ notify_setup(void)
  static void
  notify_parent(void)
@@ -335,7 +335,7 @@ diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
  		pty_change_window_size(fdin, row, col, xpixel, ypixel);
  }
  
-@@ -996,7 +996,7 @@ server_request_tun(void)
+@@ -1003,7 +1003,7 @@ server_request_tun(void)
  	}
  
  	tun = packet_get_int();
@@ -344,10 +344,10 @@ diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
  		if (tun != SSH_TUNID_ANY && forced_tun_device != tun)
  			goto done;
  		tun = forced_tun_device;
-diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
---- openssh-6.1p1/sftp.c.coverity	2012-06-30 00:33:32.000000000 +0200
-+++ openssh-6.1p1/sftp.c	2012-09-14 21:16:41.297906653 +0200
-@@ -206,7 +206,7 @@ killchild(int signo)
+diff -up openssh-6.2p1/sftp.c.coverity openssh-6.2p1/sftp.c
+--- openssh-6.2p1/sftp.c.coverity	2013-02-22 23:12:24.000000000 +0100
++++ openssh-6.2p1/sftp.c	2013-03-22 09:49:37.352595409 +0100
+@@ -202,7 +202,7 @@ killchild(int signo)
  {
  	if (sshpid > 1) {
  		kill(sshpid, SIGTERM);
@@ -356,7 +356,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  	}
  
  	_exit(1);
-@@ -316,7 +316,7 @@ local_do_ls(const char *args)
+@@ -312,7 +312,7 @@ local_do_ls(const char *args)
  
  /* Strip one path (usually the pwd) from the start of another */
  static char *
@@ -365,7 +365,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	size_t len;
  
-@@ -334,7 +334,7 @@ path_strip(char *path, char *strip)
+@@ -330,7 +330,7 @@ path_strip(char *path, char *strip)
  }
  
  static char *
@@ -374,7 +374,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	char *abs_str;
  
-@@ -482,7 +482,7 @@ parse_df_flags(const char *cmd, char **a
+@@ -478,7 +478,7 @@ parse_df_flags(const char *cmd, char **a
  }
  
  static int
@@ -383,7 +383,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	struct stat sb;
  
-@@ -494,7 +494,7 @@ is_dir(char *path)
+@@ -490,7 +490,7 @@ is_dir(char *path)
  }
  
  static int
@@ -392,7 +392,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	Attrib *a;
  
-@@ -508,7 +508,7 @@ remote_is_dir(struct sftp_conn *conn, ch
+@@ -504,7 +504,7 @@ remote_is_dir(struct sftp_conn *conn, ch
  
  /* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */
  static int
@@ -401,7 +401,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	size_t l = strlen(pathname);
  
-@@ -516,7 +516,7 @@ pathname_is_dir(char *pathname)
+@@ -512,7 +512,7 @@ pathname_is_dir(char *pathname)
  }
  
  static int
@@ -410,7 +410,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
      int pflag, int rflag)
  {
  	char *abs_src = NULL;
-@@ -590,7 +590,7 @@ out:
+@@ -586,7 +586,7 @@ out:
  }
  
  static int
@@ -419,7 +419,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
      int pflag, int rflag)
  {
  	char *tmp_dst = NULL;
-@@ -695,7 +695,7 @@ sdirent_comp(const void *aa, const void
+@@ -691,7 +691,7 @@ sdirent_comp(const void *aa, const void
  
  /* sftp ls.1 replacement for directories */
  static int
@@ -428,7 +428,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	int n;
  	u_int c = 1, colspace = 0, columns = 1;
-@@ -780,7 +780,7 @@ do_ls_dir(struct sftp_conn *conn, char *
+@@ -776,7 +776,7 @@ do_ls_dir(struct sftp_conn *conn, char *
  
  /* sftp ls.1 replacement which handles path globs */
  static int
@@ -437,7 +437,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
      int lflag)
  {
  	char *fname, *lname;
-@@ -861,7 +861,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
+@@ -857,7 +857,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
  }
  
  static int
@@ -446,9 +446,9 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
  {
  	struct sftp_statvfs st;
  	char s_used[FMT_SCALED_STRSIZE];
-diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c
---- openssh-6.1p1/sftp-client.c.coverity	2012-07-02 14:15:39.000000000 +0200
-+++ openssh-6.1p1/sftp-client.c	2012-09-14 21:18:16.891332281 +0200
+diff -up openssh-6.2p1/sftp-client.c.coverity openssh-6.2p1/sftp-client.c
+--- openssh-6.2p1/sftp-client.c.coverity	2012-07-02 14:15:39.000000000 +0200
++++ openssh-6.2p1/sftp-client.c	2013-03-22 09:49:37.353595404 +0100
 @@ -149,7 +149,7 @@ get_msg(struct sftp_conn *conn, Buffer *
  }
  
@@ -656,9 +656,9 @@ diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c
  {
  	char *ret;
  	size_t len = strlen(p1) + strlen(p2) + 2;
-diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h
---- openssh-6.1p1/sftp-client.h.coverity	2010-12-04 23:02:48.000000000 +0100
-+++ openssh-6.1p1/sftp-client.h	2012-09-14 21:16:41.301906674 +0200
+diff -up openssh-6.2p1/sftp-client.h.coverity openssh-6.2p1/sftp-client.h
+--- openssh-6.2p1/sftp-client.h.coverity	2010-12-04 23:02:48.000000000 +0100
++++ openssh-6.2p1/sftp-client.h	2013-03-22 09:49:37.353595404 +0100
 @@ -56,49 +56,49 @@ struct sftp_conn *do_init(int, int, u_in
  u_int sftp_proto_version(struct sftp_conn *);
  
@@ -756,9 +756,9 @@ diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h
 +char *path_append(const char *, const char *);
  
  #endif
-diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c
---- openssh-6.1p1/ssh-agent.c.coverity	2011-06-03 06:14:16.000000000 +0200
-+++ openssh-6.1p1/ssh-agent.c	2012-09-14 21:16:41.303906683 +0200
+diff -up openssh-6.2p1/ssh-agent.c.coverity openssh-6.2p1/ssh-agent.c
+--- openssh-6.2p1/ssh-agent.c.coverity	2011-06-03 06:14:16.000000000 +0200
++++ openssh-6.2p1/ssh-agent.c	2013-03-22 09:49:37.354595400 +0100
 @@ -1147,8 +1147,8 @@ main(int ac, char **av)
  	sanitise_stdfd();
  
@@ -770,10 +770,10 @@ diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c
  
  #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
  	/* Disable ptrace on Linux without sgid bit */
-diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.coverity	2012-07-31 04:21:34.000000000 +0200
-+++ openssh-6.1p1/sshd.c	2012-09-14 21:16:41.307906705 +0200
-@@ -682,8 +682,10 @@ privsep_preauth(Authctxt *authctxt)
+diff -up openssh-6.2p1/sshd.c.coverity openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.coverity	2013-02-12 01:04:48.000000000 +0100
++++ openssh-6.2p1/sshd.c	2013-03-22 09:49:37.355595396 +0100
+@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
  		if (getuid() == 0 || geteuid() == 0)
  			privsep_preauth_child();
  		setproctitle("%s", "[net]");
@@ -785,7 +785,7 @@ diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
  
  		return 0;
  	}
-@@ -1311,6 +1313,9 @@ server_accept_loop(int *sock_in, int *so
+@@ -1320,6 +1322,9 @@ server_accept_loop(int *sock_in, int *so
  		if (num_listen_socks < 0)
  			break;
  	}
@@ -795,7 +795,7 @@ diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
  }
  
  
-@@ -1768,7 +1773,7 @@ main(int ac, char **av)
+@@ -1806,7 +1811,7 @@ main(int ac, char **av)
  
  	/* Chdir to the root directory so that the current disk can be
  	   unmounted if desired. */
diff --git a/openssh-5.9p1-ctr-cavstest.patch b/openssh-6.2p1-ctr-cavstest.patch
similarity index 91%
rename from openssh-5.9p1-ctr-cavstest.patch
rename to openssh-6.2p1-ctr-cavstest.patch
index c260925..1376a3f 100644
--- a/openssh-5.9p1-ctr-cavstest.patch
+++ b/openssh-6.2p1-ctr-cavstest.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
---- openssh-5.9p1/ctr-cavstest.c.ctr-cavs	2012-01-13 15:59:06.584283289 +0100
-+++ openssh-5.9p1/ctr-cavstest.c	2012-01-13 18:21:33.791941027 +0100
+diff -up openssh-6.2p1/ctr-cavstest.c.ctr-cavs openssh-6.2p1/ctr-cavstest.c
+--- openssh-6.2p1/ctr-cavstest.c.ctr-cavs	2013-03-25 21:35:52.512586671 +0100
++++ openssh-6.2p1/ctr-cavstest.c	2013-03-25 21:35:52.512586671 +0100
 @@ -0,0 +1,208 @@
 +/*
 + *
@@ -194,7 +194,7 @@ diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
 +		return 2;
 +	}
 +
-+	cipher_crypt(&cc, outdata, data, datalen);
++	cipher_crypt(&cc, outdata, data, datalen, 0, 0);
 +
 +        xfree(data);
 +
@@ -210,9 +210,9 @@ diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
 +        return 0;
 +}
 +
-diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
---- openssh-5.9p1/Makefile.in.ctr-cavs	2012-01-13 15:59:06.539282357 +0100
-+++ openssh-5.9p1/Makefile.in	2012-01-13 15:59:06.588283373 +0100
+diff -up openssh-6.2p1/Makefile.in.ctr-cavs openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ctr-cavs	2013-03-25 21:35:52.451586280 +0100
++++ openssh-6.2p1/Makefile.in	2013-03-25 21:37:14.956114584 +0100
 @@ -28,6 +28,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
  SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
  SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
@@ -221,16 +221,16 @@ diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
  SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -63,7 +64,7 @@ EXEEXT=@EXEEXT@
+@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
  MANFMT=@MANFMT@
  INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
  
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
  
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -171,6 +172,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -174,6 +175,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
  ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keycat.o
  	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
  
@@ -240,7 +240,7 @@ diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
  	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
  
-@@ -271,6 +275,7 @@ install-files:
+@@ -281,6 +285,7 @@ install-files:
  		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
  	fi
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
diff --git a/openssh-6.0p1-entropy.patch b/openssh-6.2p1-entropy.patch
similarity index 76%
rename from openssh-6.0p1-entropy.patch
rename to openssh-6.2p1-entropy.patch
index 79f05f4..7b9faeb 100644
--- a/openssh-6.0p1-entropy.patch
+++ b/openssh-6.2p1-entropy.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c
---- openssh-6.0p1/entropy.c.entropy	2012-08-06 20:51:59.131033413 +0200
-+++ openssh-6.0p1/entropy.c	2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/entropy.c.entropy openssh-6.2p1/entropy.c
+--- openssh-6.2p1/entropy.c.entropy	2013-03-25 19:31:42.737611051 +0100
++++ openssh-6.2p1/entropy.c	2013-03-25 19:31:42.797611433 +0100
 @@ -237,6 +237,9 @@ seed_rng(void)
  	memset(buf, '\0', sizeof(buf));
  
@@ -11,21 +11,21 @@ diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c
  	if (RAND_status() != 1)
  		fatal("PRNG is not seeded");
  }
-diff -up openssh-6.0p1/openbsd-compat/Makefile.in.entropy openssh-6.0p1/openbsd-compat/Makefile.in
---- openssh-6.0p1/openbsd-compat/Makefile.in.entropy	2012-08-06 20:51:59.100033534 +0200
-+++ openssh-6.0p1/openbsd-compat/Makefile.in	2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.entropy openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.entropy	2013-03-25 19:31:42.798611440 +0100
++++ openssh-6.2p1/openbsd-compat/Makefile.in	2013-03-25 19:33:02.042116876 +0100
 @@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
  
- COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
  
 -PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
 +PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
  
  .c.o:
  	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/openbsd-compat/port-linux-prng.c
---- openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy	2012-08-06 20:51:59.171033257 +0200
-+++ openssh-6.0p1/openbsd-compat/port-linux-prng.c	2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.2p1/openbsd-compat/port-linux-prng.c
+--- openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy	2013-03-25 19:31:42.798611440 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux-prng.c	2013-03-25 19:31:42.798611440 +0100
 @@ -0,0 +1,59 @@
 +/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
 +
@@ -86,37 +86,10 @@ diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/op
 +			fatal ("EOF reading %s", random);
 +	}
 +}
-diff -up openssh-6.0p1/ssh.1.entropy openssh-6.0p1/ssh.1
---- openssh-6.0p1/ssh.1.entropy	2012-08-06 20:51:59.139033382 +0200
-+++ openssh-6.0p1/ssh.1	2012-08-06 20:51:59.174033245 +0200
-@@ -1269,6 +1269,23 @@ For more information, see the
- .Cm PermitUserEnvironment
- option in
- .Xr sshd_config 5 .
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.It Ev SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 6 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh FILES
- .Bl -tag -width Ds -compact
- .It Pa ~/.rhosts
-diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0
---- openssh-6.1p1/ssh-add.0.entropy	2012-11-12 13:11:42.717393364 +0100
-+++ openssh-6.1p1/ssh-add.0	2012-11-12 13:12:46.288108790 +0100
-@@ -81,6 +81,16 @@ ENVIRONMENT
+diff -up openssh-6.2p1/ssh-add.0.entropy openssh-6.2p1/ssh-add.0
+--- openssh-6.2p1/ssh-add.0.entropy	2013-03-22 00:38:29.000000000 +0100
++++ openssh-6.2p1/ssh-add.0	2013-03-25 19:31:42.799611446 +0100
+@@ -82,6 +82,16 @@ ENVIRONMENT
               Identifies the path of a UNIX-domain socket used to communicate
               with the agent.
  
@@ -133,9 +106,9 @@ diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0
  FILES
       ~/.ssh/identity
               Contains the protocol version 1 RSA authentication identity of
-diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1
---- openssh-6.1p1/ssh-add.1.entropy	2011-10-18 07:06:33.000000000 +0200
-+++ openssh-6.1p1/ssh-add.1	2012-11-12 13:11:24.711476108 +0100
+diff -up openssh-6.2p1/ssh-add.1.entropy openssh-6.2p1/ssh-add.1
+--- openssh-6.2p1/ssh-add.1.entropy	2012-12-07 03:06:13.000000000 +0100
++++ openssh-6.2p1/ssh-add.1	2013-03-25 19:31:42.799611446 +0100
 @@ -160,6 +160,20 @@ to make this work.)
  Identifies the path of a
  .Ux Ns -domain
@@ -157,10 +130,9 @@ diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1
  .El
  .Sh FILES
  .Bl -tag -width Ds
- .It Pa ~/.ssh/identity
-diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1
---- openssh-6.0p1/ssh-agent.1.entropy	2010-12-01 01:50:35.000000000 +0100
-+++ openssh-6.0p1/ssh-agent.1	2012-08-06 20:51:59.172033253 +0200
+diff -up openssh-6.2p1/ssh-agent.1.entropy openssh-6.2p1/ssh-agent.1
+--- openssh-6.2p1/ssh-agent.1.entropy	2010-12-01 01:50:35.000000000 +0100
++++ openssh-6.2p1/ssh-agent.1	2013-03-25 19:31:42.800611452 +0100
 @@ -198,6 +198,24 @@ sockets used to contain the connection t
  These sockets should only be readable by the owner.
  The sockets should get automatically removed when the agent exits.
@@ -186,10 +158,10 @@ diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1
  .Sh SEE ALSO
  .Xr ssh 1 ,
  .Xr ssh-add 1 ,
-diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8
---- openssh-6.0p1/sshd.8.entropy	2012-08-06 20:51:59.139033382 +0200
-+++ openssh-6.0p1/sshd.8	2012-08-06 20:51:59.174033245 +0200
-@@ -943,6 +943,24 @@ concurrently for different ports, this c
+diff -up openssh-6.2p1/sshd.8.entropy openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.entropy	2013-03-25 19:31:42.752611146 +0100
++++ openssh-6.2p1/sshd.8	2013-03-25 19:31:42.800611452 +0100
+@@ -945,6 +945,24 @@ concurrently for different ports, this c
  started last).
  The content of this file is not sensitive; it can be world-readable.
  .El
@@ -214,10 +186,10 @@ diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8
  .Sh IPV6
  IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell.
  .Sh SEE ALSO
-diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1
---- openssh-6.0p1/ssh-keygen.1.entropy	2011-10-18 07:05:21.000000000 +0200
-+++ openssh-6.0p1/ssh-keygen.1	2012-08-06 20:51:59.173033249 +0200
-@@ -675,6 +675,24 @@ Contains Diffie-Hellman groups used for
+diff -up openssh-6.2p1/ssh-keygen.1.entropy openssh-6.2p1/ssh-keygen.1
+--- openssh-6.2p1/ssh-keygen.1.entropy	2013-01-20 12:35:06.000000000 +0100
++++ openssh-6.2p1/ssh-keygen.1	2013-03-25 19:31:42.801611459 +0100
+@@ -806,6 +806,24 @@ Contains Diffie-Hellman groups used for
  The file format is described in
  .Xr moduli 5 .
  .El
@@ -242,9 +214,9 @@ diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1
  .Sh SEE ALSO
  .Xr ssh 1 ,
  .Xr ssh-add 1 ,
-diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8
---- openssh-6.0p1/ssh-keysign.8.entropy	2010-08-31 14:41:14.000000000 +0200
-+++ openssh-6.0p1/ssh-keysign.8	2012-08-06 20:51:59.173033249 +0200
+diff -up openssh-6.2p1/ssh-keysign.8.entropy openssh-6.2p1/ssh-keysign.8
+--- openssh-6.2p1/ssh-keysign.8.entropy	2010-08-31 14:41:14.000000000 +0200
++++ openssh-6.2p1/ssh-keysign.8	2013-03-25 19:31:42.801611459 +0100
 @@ -78,6 +78,24 @@ must be set-uid root if host-based authe
  If these files exist they are assumed to contain public certificate
  information corresponding with the private keys above.
@@ -270,3 +242,30 @@ diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8
  .Sh SEE ALSO
  .Xr ssh 1 ,
  .Xr ssh-keygen 1 ,
+diff -up openssh-6.2p1/ssh.1.entropy openssh-6.2p1/ssh.1
+--- openssh-6.2p1/ssh.1.entropy	2013-03-25 19:31:42.752611146 +0100
++++ openssh-6.2p1/ssh.1	2013-03-25 19:31:42.799611446 +0100
+@@ -1277,6 +1277,23 @@ For more information, see the
+ .Cm PermitUserEnvironment
+ option in
+ .Xr sshd_config 5 .
++.Sh ENVIRONMENT
++.Bl -tag -width Ds -compact
++.It Ev SSH_USE_STRONG_RNG
++The reseeding of the OpenSSL random generator is usually done from
++.Cm /dev/urandom .
++If the 
++.Cm SSH_USE_STRONG_RNG
++environment variable is set to value other than
++.Cm 0
++the OpenSSL random generator is reseeded from
++.Cm /dev/random .
++The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
++Minimum is 6 bytes.
++This setting is not recommended on the computers without the hardware
++random generator because insufficient entropy causes the connection to 
++be blocked until enough entropy is available.
++.El
+ .Sh FILES
+ .Bl -tag -width Ds -compact
+ .It Pa ~/.rhosts
diff --git a/openssh-5.8p1-fingerprint.patch b/openssh-6.2p1-fingerprint.patch
similarity index 78%
rename from openssh-5.8p1-fingerprint.patch
rename to openssh-6.2p1-fingerprint.patch
index a0438ff..92f8a4c 100644
--- a/openssh-5.8p1-fingerprint.patch
+++ b/openssh-6.2p1-fingerprint.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.8p1/auth2-hostbased.c.fingerprint openssh-5.8p1/auth2-hostbased.c
---- openssh-5.8p1/auth2-hostbased.c.fingerprint	2010-08-05 05:04:50.000000000 +0200
-+++ openssh-5.8p1/auth2-hostbased.c	2011-02-25 09:17:18.000000000 +0100
+diff -up openssh-6.2p1/auth2-hostbased.c.fingerprint openssh-6.2p1/auth2-hostbased.c
+--- openssh-6.2p1/auth2-hostbased.c.fingerprint	2010-08-05 05:04:50.000000000 +0200
++++ openssh-6.2p1/auth2-hostbased.c	2013-03-22 12:20:49.009685008 +0100
 @@ -196,16 +196,18 @@ hostbased_key_allowed(struct passwd *pw,
  
  	if (host_status == HOST_OK) {
@@ -27,10 +27,10 @@ diff -up openssh-5.8p1/auth2-hostbased.c.fingerprint openssh-5.8p1/auth2-hostbas
  		}
  		xfree(fp);
  	}
-diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
---- openssh-5.8p1/auth2-pubkey.c.fingerprint	2010-12-01 01:50:14.000000000 +0100
-+++ openssh-5.8p1/auth2-pubkey.c	2011-02-25 09:17:18.000000000 +0100
-@@ -319,10 +319,10 @@ user_key_allowed2(struct passwd *pw, Key
+diff -up openssh-6.2p1/auth2-pubkey.c.fingerprint openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.fingerprint	2013-02-15 00:28:56.000000000 +0100
++++ openssh-6.2p1/auth2-pubkey.c	2013-03-22 12:20:49.009685008 +0100
+@@ -317,10 +317,10 @@ check_authkeys_file(FILE *f, char *file,
  				continue;
  			if (!key_is_cert_authority)
  				continue;
@@ -45,7 +45,7 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
  			/*
  			 * If the user has specified a list of principals as
  			 * a key option, then prefer that list to matching
-@@ -362,9 +362,9 @@ user_key_allowed2(struct passwd *pw, Key
+@@ -360,9 +360,9 @@ check_authkeys_file(FILE *f, char *file,
  			found_key = 1;
  			debug("matching key found: file %s, line %lu",
  			    file, linenum);
@@ -58,7 +58,7 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
  			xfree(fp);
  			break;
  		}
-@@ -388,13 +388,13 @@ user_cert_trusted_ca(struct passwd *pw, 
+@@ -384,13 +384,13 @@ user_cert_trusted_ca(struct passwd *pw,
  	if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
  		return 0;
  
@@ -76,12 +76,12 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
  		    options.trusted_user_ca_keys);
  		goto out;
  	}
-diff -up openssh-5.8p1/auth.c.fingerprint openssh-5.8p1/auth.c
---- openssh-5.8p1/auth.c.fingerprint	2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1/auth.c	2011-02-25 09:17:18.000000000 +0100
-@@ -639,9 +639,10 @@ auth_key_is_revoked(Key *key)
- 		return 1;
+diff -up openssh-6.2p1/auth.c.fingerprint openssh-6.2p1/auth.c
+--- openssh-6.2p1/auth.c.fingerprint	2013-03-12 01:31:05.000000000 +0100
++++ openssh-6.2p1/auth.c	2013-03-22 12:22:32.515230386 +0100
+@@ -663,9 +663,10 @@ auth_key_is_revoked(Key *key)
  	case 1:
+  revoked:
  		/* Key revoked */
 -		key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
 +		key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
@@ -92,10 +92,10 @@ diff -up openssh-5.8p1/auth.c.fingerprint openssh-5.8p1/auth.c
  		xfree(key_fp);
  		return 1;
  	}
-diff -up openssh-5.8p1/auth-rsa.c.fingerprint openssh-5.8p1/auth-rsa.c
---- openssh-5.8p1/auth-rsa.c.fingerprint	2010-12-04 23:01:47.000000000 +0100
-+++ openssh-5.8p1/auth-rsa.c	2011-02-25 09:17:18.000000000 +0100
-@@ -318,9 +318,9 @@ auth_rsa(Authctxt *authctxt, BIGNUM *cli
+diff -up openssh-6.2p1/auth-rsa.c.fingerprint openssh-6.2p1/auth-rsa.c
+--- openssh-6.2p1/auth-rsa.c.fingerprint	2012-10-30 22:58:59.000000000 +0100
++++ openssh-6.2p1/auth-rsa.c	2013-03-22 12:20:49.011684999 +0100
+@@ -328,9 +328,9 @@ auth_rsa(Authctxt *authctxt, BIGNUM *cli
  	 * options; this will be reset if the options cause the
  	 * authentication to be rejected.
  	 */
@@ -108,10 +108,10 @@ diff -up openssh-5.8p1/auth-rsa.c.fingerprint openssh-5.8p1/auth-rsa.c
  	xfree(fp);
  	key_free(key);
  
-diff -up openssh-5.8p1/key.c.fingerprint openssh-5.8p1/key.c
---- openssh-5.8p1/key.c.fingerprint	2011-02-04 01:48:34.000000000 +0100
-+++ openssh-5.8p1/key.c	2011-02-25 09:18:16.000000000 +0100
-@@ -594,6 +594,34 @@ key_fingerprint(Key *k, enum fp_type dgs
+diff -up openssh-6.2p1/key.c.fingerprint openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.fingerprint	2013-03-22 12:20:48.971685175 +0100
++++ openssh-6.2p1/key.c	2013-03-22 12:20:49.012684995 +0100
+@@ -599,6 +599,34 @@ key_fingerprint(Key *k, enum fp_type dgs
  	return retval;
  }
  
@@ -146,23 +146,23 @@ diff -up openssh-5.8p1/key.c.fingerprint openssh-5.8p1/key.c
  /*
   * Reads a multiple-precision integer in decimal from the buffer, and advances
   * the pointer.  The integer must already be initialized.  This function is
-diff -up openssh-5.8p1/key.h.fingerprint openssh-5.8p1/key.h
---- openssh-5.8p1/key.h.fingerprint	2010-11-05 00:19:49.000000000 +0100
-+++ openssh-5.8p1/key.h	2011-02-25 09:17:18.000000000 +0100
-@@ -96,6 +96,9 @@ int		 key_equal_public(const Key *, cons
+diff -up openssh-6.2p1/key.h.fingerprint openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.fingerprint	2013-01-18 01:44:05.000000000 +0100
++++ openssh-6.2p1/key.h	2013-03-22 12:23:35.308954528 +0100
+@@ -97,6 +97,9 @@ int		 key_equal_public(const Key *, cons
  int		 key_equal(const Key *, const Key *);
  char		*key_fingerprint(Key *, enum fp_type, enum fp_rep);
- u_char		*key_fingerprint_raw(Key *, enum fp_type, u_int *);
+ u_char		*key_fingerprint_raw(const Key *, enum fp_type, u_int *);
 +enum fp_type	 key_fingerprint_selection(void);
 +char		*key_selected_fingerprint(Key *, enum fp_rep);
 +char		*key_fingerprint_prefix(void);
  const char	*key_type(const Key *);
  const char	*key_cert_type(const Key *);
  int		 key_write(const Key *, FILE *);
-diff -up openssh-5.8p1/ssh-add.c.fingerprint openssh-5.8p1/ssh-add.c
---- openssh-5.8p1/ssh-add.c.fingerprint	2010-11-11 04:17:02.000000000 +0100
-+++ openssh-5.8p1/ssh-add.c	2011-02-25 09:17:18.000000000 +0100
-@@ -280,10 +280,10 @@ list_identities(AuthenticationConnection
+diff -up openssh-6.2p1/ssh-add.c.fingerprint openssh-6.2p1/ssh-add.c
+--- openssh-6.2p1/ssh-add.c.fingerprint	2012-12-07 03:07:03.000000000 +0100
++++ openssh-6.2p1/ssh-add.c	2013-03-22 12:20:49.029684920 +0100
+@@ -326,10 +326,10 @@ list_identities(AuthenticationConnection
  		    key = ssh_get_next_identity(ac, &comment, version)) {
  			had_identities = 1;
  			if (do_fp) {
@@ -177,9 +177,9 @@ diff -up openssh-5.8p1/ssh-add.c.fingerprint openssh-5.8p1/ssh-add.c
  				xfree(fp);
  			} else {
  				if (!key_write(key, stdout))
-diff -up openssh-5.8p1/ssh-agent.c.fingerprint openssh-5.8p1/ssh-agent.c
---- openssh-5.8p1/ssh-agent.c.fingerprint	2010-12-01 01:50:35.000000000 +0100
-+++ openssh-5.8p1/ssh-agent.c	2011-02-25 09:17:18.000000000 +0100
+diff -up openssh-6.2p1/ssh-agent.c.fingerprint openssh-6.2p1/ssh-agent.c
+--- openssh-6.2p1/ssh-agent.c.fingerprint	2013-03-22 12:20:48.979685140 +0100
++++ openssh-6.2p1/ssh-agent.c	2013-03-22 12:20:49.030684916 +0100
 @@ -199,9 +199,9 @@ confirm_key(Identity *id)
  	char *p;
  	int ret = -1;
@@ -193,10 +193,10 @@ diff -up openssh-5.8p1/ssh-agent.c.fingerprint openssh-5.8p1/ssh-agent.c
  		ret = 0;
  	xfree(p);
  
-diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
---- openssh-5.8p1/sshconnect2.c.fingerprint	2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1/sshconnect2.c	2011-02-25 09:17:18.000000000 +0100
-@@ -590,8 +590,9 @@ input_userauth_pk_ok(int type, u_int32_t
+diff -up openssh-6.2p1/sshconnect2.c.fingerprint openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.fingerprint	2013-03-20 02:55:15.000000000 +0100
++++ openssh-6.2p1/sshconnect2.c	2013-03-22 12:20:49.031684912 +0100
+@@ -592,8 +592,9 @@ input_userauth_pk_ok(int type, u_int32_t
  		    key->type, pktype);
  		goto done;
  	}
@@ -208,7 +208,7 @@ diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
  	xfree(fp);
  
  	/*
-@@ -1203,8 +1204,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
+@@ -1205,8 +1206,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
  	int have_sig = 1;
  	char *fp;
  
@@ -220,10 +220,10 @@ diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
  	xfree(fp);
  
  	if (key_to_blob(id->key, &blob, &bloblen) == 0) {
-diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
---- openssh-5.8p1/sshconnect.c.fingerprint	2011-01-16 13:17:59.000000000 +0100
-+++ openssh-5.8p1/sshconnect.c	2011-02-25 09:17:18.000000000 +0100
-@@ -798,10 +798,10 @@ check_host_key(char *hostname, struct so
+diff -up openssh-6.2p1/sshconnect.c.fingerprint openssh-6.2p1/sshconnect.c
+--- openssh-6.2p1/sshconnect.c.fingerprint	2012-09-17 05:25:44.000000000 +0200
++++ openssh-6.2p1/sshconnect.c	2013-03-22 12:20:49.032684907 +0100
+@@ -824,10 +824,10 @@ check_host_key(char *hostname, struct so
  				    "key for IP address '%.128s' to the list "
  				    "of known hosts.", type, ip);
  		} else if (options.visual_host_key) {
@@ -238,7 +238,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  			xfree(ra);
  			xfree(fp);
  		}
-@@ -838,9 +838,8 @@ check_host_key(char *hostname, struct so
+@@ -865,9 +865,8 @@ check_host_key(char *hostname, struct so
  			else
  				snprintf(msg1, sizeof(msg1), ".");
  			/* The default */
@@ -250,7 +250,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  			msg2[0] = '\0';
  			if (options.verify_host_key_dns) {
  				if (matching_host_key_dns)
-@@ -855,10 +854,11 @@ check_host_key(char *hostname, struct so
+@@ -882,10 +881,11 @@ check_host_key(char *hostname, struct so
  			snprintf(msg, sizeof(msg),
  			    "The authenticity of host '%.200s (%s)' can't be "
  			    "established%s\n"
@@ -264,7 +264,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  			    options.visual_host_key ? "\n" : "",
  			    options.visual_host_key ? ra : "",
  			    msg2);
-@@ -1104,8 +1104,9 @@ verify_host_key(char *host, struct socka
+@@ -1130,8 +1130,9 @@ verify_host_key(char *host, struct socka
  	int flags = 0;
  	char *fp;
  
@@ -276,7 +276,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  	xfree(fp);
  
  	/* XXX certs are not yet supported for DNS */
-@@ -1214,14 +1215,15 @@ show_other_keys(struct hostkeys *hostkey
+@@ -1232,14 +1233,15 @@ show_other_keys(struct hostkeys *hostkey
  			continue;
  		if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
  			continue;
@@ -296,7 +296,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  		if (options.visual_host_key)
  			logit("%s", ra);
  		xfree(ra);
-@@ -1236,7 +1238,7 @@ warn_changed_key(Key *host_key)
+@@ -1254,7 +1256,7 @@ warn_changed_key(Key *host_key)
  {
  	char *fp;
  
@@ -305,7 +305,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  
  	error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
  	error("@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @");
-@@ -1244,8 +1246,8 @@ warn_changed_key(Key *host_key)
+@@ -1262,8 +1264,8 @@ warn_changed_key(Key *host_key)
  	error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
  	error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
  	error("It is also possible that a host key has just been changed.");
@@ -316,10 +316,10 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
  	error("Please contact your system administrator.");
  
  	xfree(fp);
-diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
---- openssh-5.8p1/ssh-keygen.c.fingerprint	2011-01-11 07:20:31.000000000 +0100
-+++ openssh-5.8p1/ssh-keygen.c	2011-02-25 09:17:18.000000000 +0100
-@@ -714,13 +714,14 @@ do_fingerprint(struct passwd *pw)
+diff -up openssh-6.2p1/ssh-keygen.c.fingerprint openssh-6.2p1/ssh-keygen.c
+--- openssh-6.2p1/ssh-keygen.c.fingerprint	2013-02-12 01:03:36.000000000 +0100
++++ openssh-6.2p1/ssh-keygen.c	2013-03-22 12:20:49.033684903 +0100
+@@ -767,13 +767,14 @@ do_fingerprint(struct passwd *pw)
  {
  	FILE *f;
  	Key *public;
@@ -336,7 +336,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
  	rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
  
  	if (!have_identity)
-@@ -732,8 +733,8 @@ do_fingerprint(struct passwd *pw)
+@@ -785,8 +786,8 @@ do_fingerprint(struct passwd *pw)
  	public = key_load_public(identity_file, &comment);
  	if (public != NULL) {
  		fp = key_fingerprint(public, fptype, rep);
@@ -347,7 +347,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
  		    key_type(public));
  		if (log_level >= SYSLOG_LEVEL_VERBOSE)
  			printf("%s\n", ra);
-@@ -798,8 +799,8 @@ do_fingerprint(struct passwd *pw)
+@@ -851,8 +852,8 @@ do_fingerprint(struct passwd *pw)
  		}
  		comment = *cp ? cp : comment;
  		fp = key_fingerprint(public, fptype, rep);
@@ -358,7 +358,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
  		    comment ? comment : "no comment", key_type(public));
  		if (log_level >= SYSLOG_LEVEL_VERBOSE)
  			printf("%s\n", ra);
-@@ -823,13 +824,15 @@ printhost(FILE *f, const char *name, Key
+@@ -970,13 +971,15 @@ printhost(FILE *f, const char *name, Key
  	if (print_fingerprint) {
  		enum fp_rep rep;
  		enum fp_type fptype;
@@ -378,7 +378,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
  		    key_type(public));
  		if (log_level >= SYSLOG_LEVEL_VERBOSE)
  			printf("%s\n", ra);
-@@ -1695,16 +1698,17 @@ do_show_cert(struct passwd *pw)
+@@ -1854,16 +1857,17 @@ do_show_cert(struct passwd *pw)
  		fatal("%s is not a certificate", identity_file);
  	v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
  
@@ -402,7 +402,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
  	printf("        Key ID: \"%s\"\n", key->cert->key_id);
  	if (!v00) {
  		printf("        Serial: %llu\n",
-@@ -2249,13 +2253,12 @@ passphrase_again:
+@@ -2651,13 +2655,12 @@ passphrase_again:
  	fclose(f);
  
  	if (!quiet) {
diff --git a/openssh-5.9p1-fips.patch b/openssh-6.2p1-fips.patch
similarity index 69%
rename from openssh-5.9p1-fips.patch
rename to openssh-6.2p1-fips.patch
index 6918b82..6cbc983 100644
--- a/openssh-5.9p1-fips.patch
+++ b/openssh-6.2p1-fips.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
---- openssh-5.9p1/authfile.c.fips	2012-07-17 20:57:35.078155160 +0200
-+++ openssh-5.9p1/authfile.c	2012-07-17 20:57:35.086155338 +0200
+diff -up openssh-6.2p1/authfile.c.fips openssh-6.2p1/authfile.c
+--- openssh-6.2p1/authfile.c.fips	2013-03-27 13:14:49.164683482 +0100
++++ openssh-6.2p1/authfile.c	2013-03-27 13:14:49.177683431 +0100
 @@ -148,8 +148,14 @@ key_private_rsa1_to_blob(Key *key, Buffe
  	/* Allocate space for the private part of the key in the buffer. */
  	cp = buffer_append_space(&encrypted, buffer_len(&buffer));
@@ -9,14 +9,14 @@ diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
 -	    CIPHER_ENCRYPT);
 +	if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
 +	    CIPHER_ENCRYPT) < 0) {
-+	    error("cipher_set_key_string failed.");
-+	    buffer_free(&encrypted);
-+	    buffer_free(&buffer);
-+	    return 0;
++		error("cipher_set_key_string failed.");
++		buffer_free(&encrypted);
++		buffer_free(&buffer);
++		return 0;
 +	}
 +
  	cipher_crypt(&ciphercontext, cp,
- 	    buffer_ptr(&buffer), buffer_len(&buffer));
+ 	    buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
  	cipher_cleanup(&ciphercontext);
 @@ -472,8 +478,13 @@ key_parse_private_rsa1(Buffer *blob, con
  	cp = buffer_append_space(&decrypted, buffer_len(&copy));
@@ -26,17 +26,17 @@ diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
 -	    CIPHER_DECRYPT);
 +	if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
 +	    CIPHER_DECRYPT) < 0) {
-+	    error("cipher_set_key_string failed.");
-+	    buffer_free(&decrypted);
-+	    goto fail;
++		error("cipher_set_key_string failed.");
++		buffer_free(&decrypted);
++		goto fail;
 +	}
 +
  	cipher_crypt(&ciphercontext, cp,
- 	    buffer_ptr(&copy), buffer_len(&copy));
+ 	    buffer_ptr(&copy), buffer_len(&copy), 0, 0);
  	cipher_cleanup(&ciphercontext);
-diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
---- openssh-5.9p1/cipher.c.fips	2012-07-17 20:57:34.988153164 +0200
-+++ openssh-5.9p1/cipher.c	2012-07-17 20:57:35.086155338 +0200
+diff -up openssh-6.2p1/cipher.c.fips openssh-6.2p1/cipher.c
+--- openssh-6.2p1/cipher.c.fips	2013-03-27 13:14:49.087683788 +0100
++++ openssh-6.2p1/cipher.c	2013-03-27 13:14:49.177683431 +0100
 @@ -40,6 +40,7 @@
  #include <sys/types.h>
  
@@ -45,30 +45,35 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
  
  #include <string.h>
  #include <stdarg.h>
-@@ -86,6 +87,22 @@ struct Cipher ciphers[] = {
- 	{ NULL,			SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
+@@ -89,6 +90,27 @@ struct Cipher ciphers[] = {
+ 	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
  };
  
 +struct Cipher fips_ciphers[] = {
-+	{ "none",		SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
-+	{ "3des",		SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
++	{ "none",		SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
++	{ "3des",		SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
 +
-+	{ "3des-cbc",		SSH_CIPHER_SSH2, 8, 24, 0, 1, EVP_des_ede3_cbc },
-+	{ "aes128-cbc",		SSH_CIPHER_SSH2, 16, 16, 0, 1, EVP_aes_128_cbc },
-+	{ "aes192-cbc",		SSH_CIPHER_SSH2, 16, 24, 0, 1, EVP_aes_192_cbc },
-+	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
++	{ "3des-cbc",		SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
++	{ "aes128-cbc",		SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
++	{ "aes192-cbc",		SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
++	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
 +	{ "rijndael-cbc@lysator.liu.se",
-+				SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
-+	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
-+	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
-+	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
-+	{ NULL,			SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
++				SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
++	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
++	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_128_ctr },
++	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_128_ctr },
++#ifdef OPENSSL_HAVE_EVPGCM
++	{ "aes128-gcm@openssh.com",
++			SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
++	{ "aes256-gcm@openssh.com",
++			SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
++#endif
++	{ NULL,			SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, NULL }
 +};
-+
  /*--*/
  
  u_int
-@@ -128,7 +145,7 @@ Cipher *
+@@ -143,7 +165,7 @@ Cipher *
  cipher_by_name(const char *name)
  {
  	Cipher *c;
@@ -77,7 +82,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
  		if (strcmp(c->name, name) == 0)
  			return c;
  	return NULL;
-@@ -138,7 +155,7 @@ Cipher *
+@@ -153,7 +175,7 @@ Cipher *
  cipher_by_number(int id)
  {
  	Cipher *c;
@@ -86,7 +91,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
  		if (c->number == id)
  			return c;
  	return NULL;
-@@ -182,7 +199,7 @@ cipher_number(const char *name)
+@@ -197,7 +219,7 @@ cipher_number(const char *name)
  	Cipher *c;
  	if (name == NULL)
  		return -1;
@@ -95,7 +100,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
  		if (strcasecmp(c->name, name) == 0)
  			return c->number;
  	return -1;
-@@ -289,14 +306,15 @@ cipher_cleanup(CipherContext *cc)
+@@ -356,14 +378,15 @@ cipher_cleanup(CipherContext *cc)
   * passphrase and using the resulting 16 bytes as the key.
   */
  
@@ -113,7 +118,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
  	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
  	MD5_Final(digest, &md);
  
-@@ -304,6 +322,7 @@ cipher_set_key_string(CipherContext *cc,
+@@ -371,6 +394,7 @@ cipher_set_key_string(CipherContext *cc,
  
  	memset(digest, 0, sizeof(digest));
  	memset(&md, 0, sizeof(md));
@@ -121,10 +126,10 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
  }
  
  /*
-diff -up openssh-5.9p1/cipher-ctr.c.fips openssh-5.9p1/cipher-ctr.c
---- openssh-5.9p1/cipher-ctr.c.fips	2010-10-07 13:06:42.000000000 +0200
-+++ openssh-5.9p1/cipher-ctr.c	2012-07-17 20:57:35.086155338 +0200
-@@ -140,7 +140,8 @@ evp_aes_128_ctr(void)
+diff -up openssh-6.2p1/cipher-ctr.c.fips openssh-6.2p1/cipher-ctr.c
+--- openssh-6.2p1/cipher-ctr.c.fips	2013-01-20 12:31:30.000000000 +0100
++++ openssh-6.2p1/cipher-ctr.c	2013-03-27 13:14:49.177683431 +0100
+@@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
  	aes_ctr.do_cipher = ssh_aes_ctr;
  #ifndef SSH_OLD_EVP
  	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
@@ -134,21 +139,21 @@ diff -up openssh-5.9p1/cipher-ctr.c.fips openssh-5.9p1/cipher-ctr.c
  #endif
  	return (&aes_ctr);
  }
-diff -up openssh-5.9p1/cipher.h.fips openssh-5.9p1/cipher.h
---- openssh-5.9p1/cipher.h.fips	2012-07-17 20:57:34.989153186 +0200
-+++ openssh-5.9p1/cipher.h	2012-07-17 20:57:35.087155360 +0200
-@@ -87,7 +87,7 @@ void	 cipher_init(CipherContext *, Ciphe
-     const u_char *, u_int, int);
- void	 cipher_crypt(CipherContext *, u_char *, const u_char *, u_int);
+diff -up openssh-6.2p1/cipher.h.fips openssh-6.2p1/cipher.h
+--- openssh-6.2p1/cipher.h.fips	2013-03-27 13:14:49.088683784 +0100
++++ openssh-6.2p1/cipher.h	2013-03-27 13:14:49.177683431 +0100
+@@ -91,7 +91,7 @@ void	 cipher_init(CipherContext *, Ciphe
+ void	 cipher_crypt(CipherContext *, u_char *, const u_char *,
+     u_int, u_int, u_int);
  void	 cipher_cleanup(CipherContext *);
 -void	 cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
 +int	 cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
  u_int	 cipher_blocksize(const Cipher *);
  u_int	 cipher_keylen(const Cipher *);
- u_int	 cipher_is_cbc(const Cipher *);
-diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
---- openssh-5.9p1/key.c.fips	2012-07-17 20:57:35.007153585 +0200
-+++ openssh-5.9p1/key.c	2012-07-17 20:57:35.087155360 +0200
+ u_int	 cipher_authlen(const Cipher *);
+diff -up openssh-6.2p1/key.c.fips openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.fips	2013-03-27 13:14:49.100683736 +0100
++++ openssh-6.2p1/key.c	2013-03-27 13:14:49.178683427 +0100
 @@ -40,6 +40,7 @@
  #include <sys/types.h>
  
@@ -157,7 +162,7 @@ diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
  #include <openbsd-compat/openssl-compat.h>
  
  #include <stdarg.h>
-@@ -602,9 +603,13 @@ key_fingerprint_selection(void)
+@@ -607,9 +608,13 @@ key_fingerprint_selection(void)
  	char *env;
  
  	if (!rv_defined) {
@@ -174,9 +179,9 @@ diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
  		rv_defined = 1;
  	}
  	return rv;
-diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
---- openssh-5.9p1/mac.c.fips	2012-07-17 20:57:34.996153341 +0200
-+++ openssh-5.9p1/mac.c	2012-07-17 20:58:35.584497499 +0200
+diff -up openssh-6.2p1/mac.c.fips openssh-6.2p1/mac.c
+--- openssh-6.2p1/mac.c.fips	2013-03-27 13:14:49.093683764 +0100
++++ openssh-6.2p1/mac.c	2013-03-27 13:16:33.524266158 +0100
 @@ -28,6 +28,7 @@
  #include <sys/types.h>
  
@@ -185,32 +190,35 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
  
  #include <stdarg.h>
  #include <string.h>
-@@ -47,14 +48,14 @@
- #define SSH_EVP		1	/* OpenSSL EVP-based MAC */
+@@ -50,7 +51,7 @@
  #define SSH_UMAC	2	/* UMAC (not integrated with OpenSSL) */
+ #define SSH_UMAC128	3
  
 -struct {
 +struct Macs {
  	char		*name;
  	int		type;
  	const EVP_MD *	(*mdfunc)(void);
- 	int		truncatebits;	/* truncate digest if != 0 */
+@@ -58,7 +59,9 @@ struct {
  	int		key_len;	/* just for UMAC */
  	int		len;		/* just for UMAC */
+ 	int		etm;		/* Encrypt-then-MAC */
 -} macs[] = {
-+} all_macs[] = {
- 	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, -1, -1 },
- 	{ "hmac-sha1-96",		SSH_EVP, EVP_sha1, 96, -1, -1 },
- #ifdef HAVE_EVP_SHA256
-@@ -71,9 +72,19 @@ struct {
- 	{ NULL,				0, NULL, 0, -1, -1 }
++};
++
++struct Macs all_macs[] = {
+ 	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
+ 	{ "hmac-sha1",				SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+ 	{ "hmac-sha1-96",			SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
+@@ -89,9 +92,19 @@ struct {
+ 	{ NULL,					0, NULL, 0, 0, 0, 0 }
  };
  
 +struct Macs fips_macs[] = {
-+	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, -1, -1 },
++	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
 +#ifdef HAVE_EVP_SHA256
-+	{ "hmac-sha2-256",		SSH_EVP, EVP_sha256, 0, -1, -1 },
-+	{ "hmac-sha2-512",		SSH_EVP, EVP_sha512, 0, -1, -1 },
++	{ "hmac-sha2-256",		SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
++	{ "hmac-sha2-512",		SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
 +#endif
 +	{ NULL,				0, NULL, 0, -1, -1 }
 +};
@@ -222,7 +230,7 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
  	int evp_len;
  	mac->type = macs[which].type;
  	if (mac->type == SSH_EVP) {
-@@ -94,6 +105,7 @@ int
+@@ -113,6 +126,7 @@ int
  mac_setup(Mac *mac, char *name)
  {
  	int i;
@@ -230,19 +238,19 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
  
  	for (i = 0; macs[i].name; i++) {
  		if (strcmp(name, macs[i].name) == 0) {
-diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
---- openssh-5.9p1/Makefile.in.fips	2012-07-17 20:57:35.069154962 +0200
-+++ openssh-5.9p1/Makefile.in	2012-07-17 20:57:35.086155338 +0200
-@@ -142,25 +142,25 @@ libssh.a: $(LIBSSH_OBJS)
+diff -up openssh-6.2p1/Makefile.in.fips openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.fips	2013-03-27 13:14:49.155683518 +0100
++++ openssh-6.2p1/Makefile.in	2013-03-27 13:14:49.178683427 +0100
+@@ -145,25 +145,25 @@ libssh.a: $(LIBSSH_OBJS)
  	$(RANLIB) $@
  
  ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
--	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
-+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS)
+-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
++	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS) $(GSSLIBS)
  
  sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
--	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
-+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS)
+-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
++	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
  
  scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
  	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -265,7 +273,7 @@ diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
  
  ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
  	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-@@ -172,7 +172,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
+@@ -175,7 +175,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
  	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
  
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
@@ -274,10 +282,10 @@ diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
  
  sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
  	$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-diff -up openssh-5.9p1/myproposal.h.fips openssh-5.9p1/myproposal.h
---- openssh-5.9p1/myproposal.h.fips	2011-08-17 02:29:03.000000000 +0200
-+++ openssh-5.9p1/myproposal.h	2012-07-17 21:01:12.685982807 +0200
-@@ -97,6 +97,19 @@
+diff -up openssh-6.2p1/myproposal.h.fips openssh-6.2p1/myproposal.h
+--- openssh-6.2p1/myproposal.h.fips	2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/myproposal.h	2013-03-27 13:14:49.178683427 +0100
+@@ -106,6 +106,19 @@
  #define	KEX_DEFAULT_COMP	"none,zlib@openssh.com,zlib"
  #define	KEX_DEFAULT_LANG	""
  
@@ -297,9 +305,9 @@ diff -up openssh-5.9p1/myproposal.h.fips openssh-5.9p1/myproposal.h
  
  static char *myproposal[PROPOSAL_MAX] = {
  	KEX_DEFAULT_KEX,
-diff -up openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.9p1/openbsd-compat/bsd-arc4random.c
---- openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips	2010-03-25 22:52:02.000000000 +0100
-+++ openssh-5.9p1/openbsd-compat/bsd-arc4random.c	2012-07-17 20:57:35.087155360 +0200
+diff -up openssh-6.2p1/openbsd-compat/bsd-arc4random.c.fips openssh-6.2p1/openbsd-compat/bsd-arc4random.c
+--- openssh-6.2p1/openbsd-compat/bsd-arc4random.c.fips	2010-03-25 22:52:02.000000000 +0100
++++ openssh-6.2p1/openbsd-compat/bsd-arc4random.c	2013-03-27 13:14:49.179683423 +0100
 @@ -37,25 +37,18 @@
  #define REKEY_BYTES	(1 << 24)
  
@@ -355,9 +363,9 @@ diff -up openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.9p1/openbs
  }
  #endif /* !HAVE_ARC4RANDOM */
  
-diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
---- openssh-5.9p1/ssh.c.fips	2011-08-05 22:18:16.000000000 +0200
-+++ openssh-5.9p1/ssh.c	2012-07-17 20:57:35.088155382 +0200
+diff -up openssh-6.2p1/ssh.c.fips openssh-6.2p1/ssh.c
+--- openssh-6.2p1/ssh.c.fips	2012-07-06 05:45:01.000000000 +0200
++++ openssh-6.2p1/ssh.c	2013-03-27 13:14:49.179683423 +0100
 @@ -73,6 +73,8 @@
  
  #include <openssl/evp.h>
@@ -388,7 +396,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
  			options.protocol = SSH_PROTO_1;
  			break;
  		case '2':
-@@ -630,7 +639,6 @@ main(int ac, char **av)
+@@ -632,7 +641,6 @@ main(int ac, char **av)
  	if (!host)
  		usage();
  
@@ -396,7 +404,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
  	ERR_load_crypto_strings();
  
  	/* Initialize the command to execute on remote host. */
-@@ -721,6 +729,10 @@ main(int ac, char **av)
+@@ -722,6 +730,10 @@ main(int ac, char **av)
  
  	seed_rng();
  
@@ -407,7 +415,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
  	if (options.user == NULL)
  		options.user = xstrdup(pw->pw_name);
  
-@@ -789,6 +801,12 @@ main(int ac, char **av)
+@@ -790,6 +802,12 @@ main(int ac, char **av)
  
  	timeout_ms = options.connection_timeout * 1000;
  
@@ -420,9 +428,9 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
  	/* Open a connection to the remote host. */
  	if (ssh_connect(host, &hostaddr, options.port,
  	    options.address_family, options.connection_attempts, &timeout_ms,
-diff -up openssh-5.9p1/sshconnect2.c.fips openssh-5.9p1/sshconnect2.c
---- openssh-5.9p1/sshconnect2.c.fips	2012-07-17 20:57:34.955152432 +0200
-+++ openssh-5.9p1/sshconnect2.c	2012-07-17 20:57:35.088155382 +0200
+diff -up openssh-6.2p1/sshconnect2.c.fips openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.fips	2013-03-27 13:14:49.066683871 +0100
++++ openssh-6.2p1/sshconnect2.c	2013-03-27 13:14:49.179683423 +0100
 @@ -44,6 +44,8 @@
  #include <vis.h>
  #endif
@@ -455,9 +463,9 @@ diff -up openssh-5.9p1/sshconnect2.c.fips openssh-5.9p1/sshconnect2.c
  	if (options.hostkeyalgorithms != NULL)
  		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
  		    options.hostkeyalgorithms;
-diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
---- openssh-5.9p1/sshd.c.fips	2012-07-17 20:57:35.049154517 +0200
-+++ openssh-5.9p1/sshd.c	2012-07-17 20:57:35.089155405 +0200
+diff -up openssh-6.2p1/sshd.c.fips openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.fips	2013-03-27 13:14:49.146683554 +0100
++++ openssh-6.2p1/sshd.c	2013-03-27 13:14:49.180683419 +0100
 @@ -76,6 +76,8 @@
  #include <openssl/bn.h>
  #include <openssl/md5.h>
@@ -467,7 +475,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
  #include "openbsd-compat/openssl-compat.h"
  
  #ifdef HAVE_SECUREWARE
-@@ -1395,6 +1397,11 @@ main(int ac, char **av)
+@@ -1423,6 +1425,11 @@ main(int ac, char **av)
  #endif
  	__progname = ssh_get_progname(av[0]);
  
@@ -479,7 +487,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
  	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
  	saved_argc = ac;
  	rexec_argc = ac;
-@@ -1554,8 +1561,6 @@ main(int ac, char **av)
+@@ -1571,8 +1578,6 @@ main(int ac, char **av)
  	else
  		closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
  
@@ -488,7 +496,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
  	/*
  	 * Force logging to stderr until we have loaded the private host
  	 * key (unless started from inetd)
-@@ -1673,6 +1678,10 @@ main(int ac, char **av)
+@@ -1715,6 +1720,10 @@ main(int ac, char **av)
  		debug("private host key: #%d type %d %s", i, key->type,
  		    key_type(key));
  	}
@@ -499,7 +507,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
  	if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
  		logit("Disabling protocol version 1. Could not load host key");
  		options.protocol &= ~SSH_PROTO_1;
-@@ -1837,6 +1846,10 @@ main(int ac, char **av)
+@@ -1878,6 +1887,10 @@ main(int ac, char **av)
  	/* Initialize the random number generator. */
  	arc4random_stir();
  
@@ -510,7 +518,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
  	/* Chdir to the root directory so that the current disk can be
  	   unmounted if desired. */
  	(void) chdir("/");
-@@ -2379,6 +2392,9 @@ do_ssh2_kex(void)
+@@ -2420,6 +2433,9 @@ do_ssh2_kex(void)
  	if (options.ciphers != NULL) {
  		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
  		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@@ -520,7 +528,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
  	}
  	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
  	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
-@@ -2388,6 +2404,9 @@ do_ssh2_kex(void)
+@@ -2429,6 +2445,9 @@ do_ssh2_kex(void)
  	if (options.macs != NULL) {
  		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
  		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
diff --git a/openssh-5.8p2-force_krb.patch b/openssh-6.2p1-force_krb.patch
similarity index 89%
rename from openssh-5.8p2-force_krb.patch
rename to openssh-6.2p1-force_krb.patch
index c3860ce..5423171 100644
--- a/openssh-5.8p2-force_krb.patch
+++ b/openssh-6.2p1-force_krb.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.8p2/gss-serv-krb5.c.force_krb openssh-5.8p2/gss-serv-krb5.c
---- openssh-5.8p2/gss-serv-krb5.c.force_krb	2006-09-01 07:38:36.000000000 +0200
-+++ openssh-5.8p2/gss-serv-krb5.c	2011-05-19 03:41:45.801109545 +0200
+diff -up openssh-6.2p1/gss-serv-krb5.c.force_krb openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.force_krb	2013-03-25 20:04:53.807817333 +0100
++++ openssh-6.2p1/gss-serv-krb5.c	2013-03-25 20:04:53.818817403 +0100
 @@ -32,7 +32,9 @@
  #include <sys/types.h>
  
@@ -216,10 +216,10 @@ diff -up openssh-5.8p2/gss-serv-krb5.c.force_krb openssh-5.8p2/gss-serv-krb5.c
  
  /* This writes out any forwarded credentials from the structure populated
   * during userauth. Called after we have setuid to the user */
-diff -up openssh-5.8p2/session.c.force_krb openssh-5.8p2/session.c
---- openssh-5.8p2/session.c.force_krb	2011-05-19 03:41:41.000000000 +0200
-+++ openssh-5.8p2/session.c	2011-05-19 03:43:32.437173662 +0200
-@@ -820,6 +820,29 @@ do_exec(Session *s, const char *command)
+diff -up openssh-6.2p1/session.c.force_krb openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.force_krb	2013-03-25 20:04:53.724816810 +0100
++++ openssh-6.2p1/session.c	2013-03-25 20:04:53.818817403 +0100
+@@ -823,6 +823,29 @@ do_exec(Session *s, const char *command)
  		debug("Forced command (key option) '%.900s'", command);
  	}
  
@@ -249,9 +249,9 @@ diff -up openssh-5.8p2/session.c.force_krb openssh-5.8p2/session.c
  #ifdef SSH_AUDIT_EVENTS
  	if (s->command != NULL || s->command_handle != -1)
  		fatal("do_exec: command already set");
-diff -up openssh-5.8p2/sshd.8.force_krb openssh-5.8p2/sshd.8
---- openssh-5.8p2/sshd.8.force_krb	2011-05-19 03:41:30.582114401 +0200
-+++ openssh-5.8p2/sshd.8	2011-05-19 03:41:46.159106308 +0200
+diff -up openssh-6.2p1/sshd.8.force_krb openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.force_krb	2013-03-25 20:04:53.787817207 +0100
++++ openssh-6.2p1/sshd.8	2013-03-25 20:04:53.819817409 +0100
 @@ -323,6 +323,7 @@ Finally, the server and the client enter
  The client tries to authenticate itself using
  host-based authentication,
@@ -273,13 +273,13 @@ diff -up openssh-5.8p2/sshd.8.force_krb openssh-5.8p2/sshd.8
  .It Pa ~/.ssh/
  This directory is the default location for all user-specific configuration
  and authentication information.
-diff -up openssh-5.8p2/ssh-gss.h.force_krb openssh-5.8p2/ssh-gss.h
---- openssh-5.8p2/ssh-gss.h.force_krb	2007-06-12 15:40:39.000000000 +0200
-+++ openssh-5.8p2/ssh-gss.h	2011-05-19 03:41:46.302234118 +0200
-@@ -48,6 +48,10 @@
- #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
- #endif /* GSS_C_NT_... */
- #endif /* !HEIMDAL */
+diff -up openssh-6.2p1/ssh-gss.h.force_krb openssh-6.2p1/ssh-gss.h
+--- openssh-6.2p1/ssh-gss.h.force_krb	2013-03-25 20:04:53.819817409 +0100
++++ openssh-6.2p1/ssh-gss.h	2013-03-25 20:05:26.463023197 +0100
+@@ -49,6 +49,10 @@
+ #  endif /* !HAVE_DECL_GSS_C_NT_... */
+ 
+ # endif /* !HEIMDAL */
 +
 +/* .k5users support */
 +extern char **k5users_allowed_cmds;
diff --git a/openssh-6.1p1-gsskex.patch b/openssh-6.2p1-gsskex.patch
similarity index 91%
rename from openssh-6.1p1-gsskex.patch
rename to openssh-6.2p1-gsskex.patch
index 9b0bad9..3934dcf 100644
--- a/openssh-6.1p1-gsskex.patch
+++ b/openssh-6.2p1-gsskex.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth2.c.gsskex openssh-6.1p1/auth2.c
---- openssh-6.1p1/auth2.c.gsskex	2012-11-30 13:58:08.871298935 +0100
-+++ openssh-6.1p1/auth2.c	2012-11-30 13:58:08.946298649 +0100
+diff -up openssh-6.2p1/auth2.c.gsskex openssh-6.2p1/auth2.c
+--- openssh-6.2p1/auth2.c.gsskex	2013-03-27 13:19:11.062624591 +0100
++++ openssh-6.2p1/auth2.c	2013-03-27 13:19:11.140624271 +0100
 @@ -69,6 +69,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
@@ -17,9 +17,9 @@ diff -up openssh-6.1p1/auth2.c.gsskex openssh-6.1p1/auth2.c
  	&method_gssapi,
  #endif
  #ifdef JPAKE
-diff -up openssh-6.1p1/auth2-gss.c.gsskex openssh-6.1p1/auth2-gss.c
---- openssh-6.1p1/auth2-gss.c.gsskex	2012-11-30 13:58:08.871298935 +0100
-+++ openssh-6.1p1/auth2-gss.c	2012-11-30 13:59:19.622985133 +0100
+diff -up openssh-6.2p1/auth2-gss.c.gsskex openssh-6.2p1/auth2-gss.c
+--- openssh-6.2p1/auth2-gss.c.gsskex	2013-03-27 13:19:11.062624591 +0100
++++ openssh-6.2p1/auth2-gss.c	2013-03-27 13:19:11.141624267 +0100
 @@ -52,6 +52,40 @@ static void input_gssapi_mic(int type, u
  static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
  static void input_gssapi_errtok(int, u_int32_t, void *);
@@ -94,9 +94,9 @@ diff -up openssh-6.1p1/auth2-gss.c.gsskex openssh-6.1p1/auth2-gss.c
  Authmethod method_gssapi = {
  	"gssapi-with-mic",
  	userauth_gssapi,
-diff -up openssh-6.1p1/auth-krb5.c.gsskex openssh-6.1p1/auth-krb5.c
---- openssh-6.1p1/auth-krb5.c.gsskex	2012-04-26 01:52:15.000000000 +0200
-+++ openssh-6.1p1/auth-krb5.c	2012-11-30 13:58:08.947298647 +0100
+diff -up openssh-6.2p1/auth-krb5.c.gsskex openssh-6.2p1/auth-krb5.c
+--- openssh-6.2p1/auth-krb5.c.gsskex	2012-04-26 01:52:15.000000000 +0200
++++ openssh-6.2p1/auth-krb5.c	2013-03-27 13:19:11.140624271 +0100
 @@ -50,6 +50,7 @@
  #include <errno.h>
  #include <unistd.h>
@@ -203,9 +203,9 @@ diff -up openssh-6.1p1/auth-krb5.c.gsskex openssh-6.1p1/auth-krb5.c
  
  	return (krb5_cc_resolve(ctx, ccname, ccache));
  }
-diff -up openssh-6.1p1/ChangeLog.gssapi.gsskex openssh-6.1p1/ChangeLog.gssapi
---- openssh-6.1p1/ChangeLog.gssapi.gsskex	2012-11-30 13:58:08.947298647 +0100
-+++ openssh-6.1p1/ChangeLog.gssapi	2012-11-30 13:58:08.947298647 +0100
+diff -up openssh-6.2p1/ChangeLog.gssapi.gsskex openssh-6.2p1/ChangeLog.gssapi
+--- openssh-6.2p1/ChangeLog.gssapi.gsskex	2013-03-27 13:19:11.143624259 +0100
++++ openssh-6.2p1/ChangeLog.gssapi	2013-03-27 13:19:11.143624259 +0100
 @@ -0,0 +1,113 @@
 +20110101
 +  - Finally update for OpenSSH 5.6p1
@@ -320,9 +320,9 @@ diff -up openssh-6.1p1/ChangeLog.gssapi.gsskex openssh-6.1p1/ChangeLog.gssapi
 +    add support for GssapiTrustDns option for gssapi-with-mic
 +    (from jbasney AT ncsa.uiuc.edu)
 +    <gssapi-with-mic support is Bugzilla #1008>
-diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
---- openssh-6.1p1/clientloop.c.gsskex	2012-11-30 13:58:08.781299279 +0100
-+++ openssh-6.1p1/clientloop.c	2012-11-30 13:58:08.948298644 +0100
+diff -up openssh-6.2p1/clientloop.c.gsskex openssh-6.2p1/clientloop.c
+--- openssh-6.2p1/clientloop.c.gsskex	2013-03-27 13:19:11.001624842 +0100
++++ openssh-6.2p1/clientloop.c	2013-03-27 13:19:11.141624267 +0100
 @@ -111,6 +111,10 @@
  #include "msg.h"
  #include "roaming.h"
@@ -334,7 +334,7 @@ diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
  /* import options */
  extern Options options;
  
-@@ -1544,6 +1548,15 @@ client_loop(int have_pty, int escape_cha
+@@ -1599,6 +1603,15 @@ client_loop(int have_pty, int escape_cha
  		/* Do channel operations unless rekeying in progress. */
  		if (!rekeying) {
  			channel_after_select(readset, writeset);
@@ -350,10 +350,10 @@ diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
  			if (need_rekeying || packet_need_rekeying()) {
  				debug("need rekeying");
  				xxx_kex->done = 0;
-diff -up openssh-6.1p1/configure.ac.gsskex openssh-6.1p1/configure.ac
---- openssh-6.1p1/configure.ac.gsskex	2012-11-30 13:58:08.934298697 +0100
-+++ openssh-6.1p1/configure.ac	2012-11-30 13:58:08.949298640 +0100
-@@ -545,6 +545,30 @@ main() { if (NSVersionOfRunTimeLibrary("
+diff -up openssh-6.2p1/configure.ac.gsskex openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.gsskex	2013-03-27 13:19:11.128624320 +0100
++++ openssh-6.2p1/configure.ac	2013-03-27 13:19:11.142624263 +0100
+@@ -533,6 +533,30 @@ main() { if (NSVersionOfRunTimeLibrary("
  	    [Use tunnel device compatibility to OpenBSD])
  	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
  	    [Prepend the address family to IP tunnel traffic])
@@ -384,9 +384,9 @@ diff -up openssh-6.1p1/configure.ac.gsskex openssh-6.1p1/configure.ac
  	m4_pattern_allow([AU_IPv])
  	AC_CHECK_DECL([AU_IPv4], [], 
  	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
-diff -up openssh-6.1p1/gss-genr.c.gsskex openssh-6.1p1/gss-genr.c
---- openssh-6.1p1/gss-genr.c.gsskex	2009-06-22 08:11:07.000000000 +0200
-+++ openssh-6.1p1/gss-genr.c	2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-genr.c.gsskex openssh-6.2p1/gss-genr.c
+--- openssh-6.2p1/gss-genr.c.gsskex	2009-06-22 08:11:07.000000000 +0200
++++ openssh-6.2p1/gss-genr.c	2013-03-27 13:19:11.142624263 +0100
 @@ -1,7 +1,7 @@
  /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
  
@@ -734,9 +734,9 @@ diff -up openssh-6.1p1/gss-genr.c.gsskex openssh-6.1p1/gss-genr.c
 +}
 +
  #endif /* GSSAPI */
-diff -up openssh-6.1p1/gss-serv.c.gsskex openssh-6.1p1/gss-serv.c
---- openssh-6.1p1/gss-serv.c.gsskex	2011-08-05 22:16:46.000000000 +0200
-+++ openssh-6.1p1/gss-serv.c	2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-serv.c.gsskex openssh-6.2p1/gss-serv.c
+--- openssh-6.2p1/gss-serv.c.gsskex	2011-08-05 22:16:46.000000000 +0200
++++ openssh-6.2p1/gss-serv.c	2013-03-27 13:19:11.142624263 +0100
 @@ -45,15 +45,20 @@
  #include "channels.h"
  #include "session.h"
@@ -1075,9 +1075,9 @@ diff -up openssh-6.1p1/gss-serv.c.gsskex openssh-6.1p1/gss-serv.c
  }
  
  #endif
-diff -up openssh-6.1p1/gss-serv-krb5.c.gsskex openssh-6.1p1/gss-serv-krb5.c
---- openssh-6.1p1/gss-serv-krb5.c.gsskex	2006-09-01 07:38:36.000000000 +0200
-+++ openssh-6.1p1/gss-serv-krb5.c	2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-serv-krb5.c.gsskex openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.gsskex	2006-09-01 07:38:36.000000000 +0200
++++ openssh-6.2p1/gss-serv-krb5.c	2013-03-27 13:19:11.143624259 +0100
 @@ -1,7 +1,7 @@
  /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
  
@@ -1200,9 +1200,9 @@ diff -up openssh-6.1p1/gss-serv-krb5.c.gsskex openssh-6.1p1/gss-serv-krb5.c
  };
  
  #endif /* KRB5 */
-diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
---- openssh-6.1p1/kex.c.gsskex	2012-11-30 13:58:08.820299131 +0100
-+++ openssh-6.1p1/kex.c	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kex.c.gsskex openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.gsskex	2013-03-27 13:19:11.039624686 +0100
++++ openssh-6.2p1/kex.c	2013-03-27 13:19:11.143624259 +0100
 @@ -51,6 +51,10 @@
  #include "roaming.h"
  #include "audit.h"
@@ -1214,7 +1214,7 @@ diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
  # if defined(HAVE_EVP_SHA256)
  # define evp_ssh_sha256 EVP_sha256
-@@ -371,6 +375,20 @@ choose_kex(Kex *k, char *client, char *s
+@@ -382,6 +386,20 @@ choose_kex(Kex *k, char *client, char *s
   		k->kex_type = KEX_ECDH_SHA2;
  		k->evp_md = kex_ecdh_name_to_evpmd(k->name);
  #endif
@@ -1235,9 +1235,9 @@ diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
  	} else
  		fatal("bad kex alg %s", k->name);
  }
-diff -up openssh-6.1p1/kexgssc.c.gsskex openssh-6.1p1/kexgssc.c
---- openssh-6.1p1/kexgssc.c.gsskex	2012-11-30 13:58:08.950298635 +0100
-+++ openssh-6.1p1/kexgssc.c	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kexgssc.c.gsskex openssh-6.2p1/kexgssc.c
+--- openssh-6.2p1/kexgssc.c.gsskex	2013-03-27 13:19:11.143624259 +0100
++++ openssh-6.2p1/kexgssc.c	2013-03-27 13:19:11.143624259 +0100
 @@ -0,0 +1,334 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1573,9 +1573,9 @@ diff -up openssh-6.1p1/kexgssc.c.gsskex openssh-6.1p1/kexgssc.c
 +}
 +
 +#endif /* GSSAPI */
-diff -up openssh-6.1p1/kexgsss.c.gsskex openssh-6.1p1/kexgsss.c
---- openssh-6.1p1/kexgsss.c.gsskex	2012-11-30 13:58:08.950298635 +0100
-+++ openssh-6.1p1/kexgsss.c	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kexgsss.c.gsskex openssh-6.2p1/kexgsss.c
+--- openssh-6.2p1/kexgsss.c.gsskex	2013-03-27 13:19:11.144624254 +0100
++++ openssh-6.2p1/kexgsss.c	2013-03-27 13:19:11.144624254 +0100
 @@ -0,0 +1,288 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1865,9 +1865,9 @@ diff -up openssh-6.1p1/kexgsss.c.gsskex openssh-6.1p1/kexgsss.c
 +		ssh_gssapi_rekey_creds();
 +}
 +#endif /* GSSAPI */
-diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
---- openssh-6.1p1/kex.h.gsskex	2012-11-30 13:58:08.820299131 +0100
-+++ openssh-6.1p1/kex.h	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kex.h.gsskex openssh-6.2p1/kex.h
+--- openssh-6.2p1/kex.h.gsskex	2013-03-27 13:19:11.039624686 +0100
++++ openssh-6.2p1/kex.h	2013-03-27 13:19:11.144624254 +0100
 @@ -73,6 +73,9 @@ enum kex_exchange {
  	KEX_DH_GEX_SHA1,
  	KEX_DH_GEX_SHA256,
@@ -1878,7 +1878,7 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
  	KEX_MAX
  };
  
-@@ -129,6 +132,12 @@ struct Kex {
+@@ -131,6 +134,12 @@ struct Kex {
  	sig_atomic_t done;
  	int	flags;
  	const EVP_MD *evp_md;
@@ -1891,7 +1891,7 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
  	char	*client_version_string;
  	char	*server_version_string;
  	int	(*verify_host_key)(Key *);
-@@ -156,6 +165,11 @@ void	 kexgex_server(Kex *);
+@@ -158,6 +167,11 @@ void	 kexgex_server(Kex *);
  void	 kexecdh_client(Kex *);
  void	 kexecdh_server(Kex *);
  
@@ -1903,9 +1903,9 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
  void	newkeys_destroy(Newkeys *newkeys);
  
  void
-diff -up openssh-6.1p1/key.c.gsskex openssh-6.1p1/key.c
---- openssh-6.1p1/key.c.gsskex	2012-11-30 13:58:08.912298779 +0100
-+++ openssh-6.1p1/key.c	2012-11-30 13:58:08.951298630 +0100
+diff -up openssh-6.2p1/key.c.gsskex openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.gsskex	2013-03-27 13:19:11.102624427 +0100
++++ openssh-6.2p1/key.c	2013-03-27 13:19:11.144624254 +0100
 @@ -1011,6 +1011,8 @@ key_ssh_name_from_type_nid(int type, int
  		}
  		break;
@@ -1924,9 +1924,9 @@ diff -up openssh-6.1p1/key.c.gsskex openssh-6.1p1/key.c
  	}
  
  	debug2("key_type_from_name: unknown key type '%s'", name);
-diff -up openssh-6.1p1/key.h.gsskex openssh-6.1p1/key.h
---- openssh-6.1p1/key.h.gsskex	2012-11-30 13:58:08.827299104 +0100
-+++ openssh-6.1p1/key.h	2012-11-30 13:58:08.951298630 +0100
+diff -up openssh-6.2p1/key.h.gsskex openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.gsskex	2013-03-27 13:19:11.046624657 +0100
++++ openssh-6.2p1/key.h	2013-03-27 13:19:11.145624250 +0100
 @@ -44,6 +44,7 @@ enum types {
  	KEY_ECDSA_CERT,
  	KEY_RSA_CERT_V00,
@@ -1935,18 +1935,18 @@ diff -up openssh-6.1p1/key.h.gsskex openssh-6.1p1/key.h
  	KEY_UNSPEC
  };
  enum fp_type {
-diff -up openssh-6.1p1/Makefile.in.gsskex openssh-6.1p1/Makefile.in
---- openssh-6.1p1/Makefile.in.gsskex	2012-11-30 13:58:08.945298652 +0100
-+++ openssh-6.1p1/Makefile.in	2012-11-30 13:58:08.951298630 +0100
-@@ -75,6 +75,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
+diff -up openssh-6.2p1/Makefile.in.gsskex openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.gsskex	2013-03-27 13:19:11.138624279 +0100
++++ openssh-6.2p1/Makefile.in	2013-03-27 13:19:11.145624250 +0100
+@@ -77,6 +77,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
  	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
  	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
  	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
 +	kexgssc.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
- 	schnorr.o ssh-pkcs11.o auditstub.o
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+ 	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
  
-@@ -91,7 +92,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+@@ -93,7 +94,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
  	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
  	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
  	auth-krb5.o \
@@ -1955,9 +1955,9 @@ diff -up openssh-6.1p1/Makefile.in.gsskex openssh-6.1p1/Makefile.in
  	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
  	sftp-server.o sftp-common.o \
  	roaming_common.o roaming_serv.o \
-diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.gsskex	2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor.c	2012-11-30 13:58:08.952298626 +0100
+diff -up openssh-6.2p1/monitor.c.gsskex openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.gsskex	2013-03-27 13:19:11.063624587 +0100
++++ openssh-6.2p1/monitor.c	2013-03-27 13:19:11.145624250 +0100
 @@ -186,6 +186,8 @@ int mm_answer_gss_setup_ctx(int, Buffer
  int mm_answer_gss_accept_ctx(int, Buffer *);
  int mm_answer_gss_userok(int, Buffer *);
@@ -1999,7 +1999,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	} else {
  		mon_dispatch = mon_dispatch_proto15;
  
-@@ -516,6 +529,10 @@ monitor_child_postauth(struct monitor *p
+@@ -519,6 +532,10 @@ monitor_child_postauth(struct monitor *p
  		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2010,7 +2010,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	} else {
  		mon_dispatch = mon_dispatch_postauth15;
  		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1948,6 +1965,13 @@ mm_get_kex(Buffer *m)
+@@ -1950,6 +1967,13 @@ mm_get_kex(Buffer *m)
  	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
  	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
  	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -2024,7 +2024,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	kex->server = 1;
  	kex->hostkey_type = buffer_get_int(m);
  	kex->kex_type = buffer_get_int(m);
-@@ -2171,6 +2195,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
+@@ -2173,6 +2197,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
  	OM_uint32 major;
  	u_int len;
  
@@ -2034,7 +2034,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	goid.elements = buffer_get_string(m, &len);
  	goid.length = len;
  
-@@ -2198,6 +2225,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+@@ -2200,6 +2227,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
  	OM_uint32 flags = 0; /* GSI needs this */
  	u_int len;
  
@@ -2044,7 +2044,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	in.value = buffer_get_string(m, &len);
  	in.length = len;
  	major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -2215,6 +2245,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+@@ -2217,6 +2247,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2052,7 +2052,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	}
  	return (0);
  }
-@@ -2226,6 +2257,9 @@ mm_answer_gss_checkmic(int sock, Buffer
+@@ -2228,6 +2259,9 @@ mm_answer_gss_checkmic(int sock, Buffer
  	OM_uint32 ret;
  	u_int len;
  
@@ -2062,7 +2062,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  	gssbuf.value = buffer_get_string(m, &len);
  	gssbuf.length = len;
  	mic.value = buffer_get_string(m, &len);
-@@ -2252,7 +2286,11 @@ mm_answer_gss_userok(int sock, Buffer *m
+@@ -2254,7 +2288,11 @@ mm_answer_gss_userok(int sock, Buffer *m
  {
  	int authenticated;
  
@@ -2075,7 +2075,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  
  	buffer_clear(m);
  	buffer_put_int(m, authenticated);
-@@ -2265,6 +2303,74 @@ mm_answer_gss_userok(int sock, Buffer *m
+@@ -2267,6 +2305,74 @@ mm_answer_gss_userok(int sock, Buffer *m
  	/* Monitor loop will terminate if authenticated */
  	return (authenticated);
  }
@@ -2150,22 +2150,22 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
  #endif /* GSSAPI */
  
  #ifdef JPAKE
-diff -up openssh-6.1p1/monitor.h.gsskex openssh-6.1p1/monitor.h
---- openssh-6.1p1/monitor.h.gsskex	2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor.h	2012-11-30 13:58:08.952298626 +0100
-@@ -56,6 +56,8 @@ enum monitor_reqtype {
- 	MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
- 	MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
- 	MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
-+	MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
-+	MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
- 	MONITOR_REQ_PAM_START,
- 	MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
- 	MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
-diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.gsskex	2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor_wrap.c	2012-11-30 13:58:08.952298626 +0100
-@@ -1326,7 +1326,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
+diff -up openssh-6.2p1/monitor.h.gsskex openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.gsskex	2013-03-27 13:19:11.063624587 +0100
++++ openssh-6.2p1/monitor.h	2013-03-27 13:19:11.146624246 +0100
+@@ -64,6 +64,8 @@ enum monitor_reqtype {
+ #ifdef WITH_SELINUX
+ 	MONITOR_REQ_AUTHROLE = 80,
+ #endif
++	MONITOR_REQ_GSSSIGN = 82, MONITOR_ANS_GSSSIGN = 83,
++	MONITOR_REQ_GSSUPCREDS = 84, MONITOR_ANS_GSSUPCREDS = 85,
+ 
+ 	MONITOR_REQ_PAM_START = 100,
+ 	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+diff -up openssh-6.2p1/monitor_wrap.c.gsskex openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.gsskex	2013-03-27 13:19:11.064624583 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-27 13:19:11.146624246 +0100
+@@ -1327,7 +1327,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
  }
  
  int
@@ -2174,7 +2174,7 @@ diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
  {
  	Buffer m;
  	int authenticated = 0;
-@@ -1343,6 +1343,51 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1344,6 +1344,51 @@ mm_ssh_gssapi_userok(char *user)
  	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
  	return (authenticated);
  }
@@ -2226,9 +2226,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
  #endif /* GSSAPI */
  
  #ifdef JPAKE
-diff -up openssh-6.1p1/monitor_wrap.h.gsskex openssh-6.1p1/monitor_wrap.h
---- openssh-6.1p1/monitor_wrap.h.gsskex	2012-11-30 13:58:08.874298923 +0100
-+++ openssh-6.1p1/monitor_wrap.h	2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.gsskex openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.gsskex	2013-03-27 13:19:11.064624583 +0100
++++ openssh-6.2p1/monitor_wrap.h	2013-03-27 13:19:11.146624246 +0100
 @@ -62,8 +62,10 @@ BIGNUM *mm_auth_rsa_generate_challenge(K
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
@@ -2241,9 +2241,9 @@ diff -up openssh-6.1p1/monitor_wrap.h.gsskex openssh-6.1p1/monitor_wrap.h
  #endif
  
  #ifdef USE_PAM
-diff -up openssh-6.1p1/readconf.c.gsskex openssh-6.1p1/readconf.c
---- openssh-6.1p1/readconf.c.gsskex	2011-10-02 09:59:03.000000000 +0200
-+++ openssh-6.1p1/readconf.c	2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/readconf.c.gsskex openssh-6.2p1/readconf.c
+--- openssh-6.2p1/readconf.c.gsskex	2011-10-02 09:59:03.000000000 +0200
++++ openssh-6.2p1/readconf.c	2013-03-27 13:19:11.147624242 +0100
 @@ -129,6 +129,8 @@ typedef enum {
  	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
  	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
@@ -2332,9 +2332,9 @@ diff -up openssh-6.1p1/readconf.c.gsskex openssh-6.1p1/readconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-diff -up openssh-6.1p1/readconf.h.gsskex openssh-6.1p1/readconf.h
---- openssh-6.1p1/readconf.h.gsskex	2011-10-02 09:59:03.000000000 +0200
-+++ openssh-6.1p1/readconf.h	2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/readconf.h.gsskex openssh-6.2p1/readconf.h
+--- openssh-6.2p1/readconf.h.gsskex	2011-10-02 09:59:03.000000000 +0200
++++ openssh-6.2p1/readconf.h	2013-03-27 13:19:11.147624242 +0100
 @@ -48,7 +48,12 @@ typedef struct {
  	int     challenge_response_authentication;
  					/* Try S/Key or TIS, authentication. */
@@ -2348,9 +2348,9 @@ diff -up openssh-6.1p1/readconf.h.gsskex openssh-6.1p1/readconf.h
  	int     password_authentication;	/* Try password
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.gsskex	2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/servconf.c	2012-11-30 13:58:08.954298621 +0100
+diff -up openssh-6.2p1/servconf.c.gsskex openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.gsskex	2013-03-27 13:19:11.128624320 +0100
++++ openssh-6.2p1/servconf.c	2013-03-27 13:19:11.147624242 +0100
 @@ -102,7 +102,10 @@ initialize_server_options(ServerOptions
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
@@ -2409,7 +2409,7 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
  	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
  	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
  	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1046,10 +1067,22 @@ process_server_config_line(ServerOptions
+@@ -1054,10 +1075,22 @@ process_server_config_line(ServerOptions
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2432,7 +2432,7 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -1929,6 +1962,9 @@ dump_config(ServerOptions *o)
+@@ -1938,6 +1971,9 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
  	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@@ -2442,10 +2442,10 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
  #endif
  #ifdef JPAKE
  	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
-diff -up openssh-6.1p1/servconf.h.gsskex openssh-6.1p1/servconf.h
---- openssh-6.1p1/servconf.h.gsskex	2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/servconf.h	2012-11-30 13:58:08.954298621 +0100
-@@ -104,7 +104,10 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.gsskex openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.gsskex	2013-03-27 13:19:11.128624320 +0100
++++ openssh-6.2p1/servconf.h	2013-03-27 13:19:11.147624242 +0100
+@@ -110,7 +110,10 @@ typedef struct {
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@@ -2456,10 +2456,10 @@ diff -up openssh-6.1p1/servconf.h.gsskex openssh-6.1p1/servconf.h
  	int     password_authentication;	/* If true, permit password
  						 * authentication. */
  	int     kbd_interactive_authentication;	/* If true, permit */
-diff -up openssh-6.1p1/ssh_config.5.gsskex openssh-6.1p1/ssh_config.5
---- openssh-6.1p1/ssh_config.5.gsskex	2012-07-02 10:53:38.000000000 +0200
-+++ openssh-6.1p1/ssh_config.5	2012-11-30 13:58:08.954298621 +0100
-@@ -527,11 +527,43 @@ Specifies whether user authentication ba
+diff -up openssh-6.2p1/ssh_config.5.gsskex openssh-6.2p1/ssh_config.5
+--- openssh-6.2p1/ssh_config.5.gsskex	2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/ssh_config.5	2013-03-27 13:19:11.148624238 +0100
+@@ -530,11 +530,43 @@ Specifies whether user authentication ba
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
@@ -2504,9 +2504,9 @@ diff -up openssh-6.1p1/ssh_config.5.gsskex openssh-6.1p1/ssh_config.5
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-diff -up openssh-6.1p1/ssh_config.gsskex openssh-6.1p1/ssh_config
---- openssh-6.1p1/ssh_config.gsskex	2012-11-30 13:58:08.927298724 +0100
-+++ openssh-6.1p1/ssh_config	2012-11-30 13:58:08.954298621 +0100
+diff -up openssh-6.2p1/ssh_config.gsskex openssh-6.2p1/ssh_config
+--- openssh-6.2p1/ssh_config.gsskex	2013-03-27 13:19:11.120624353 +0100
++++ openssh-6.2p1/ssh_config	2013-03-27 13:19:11.148624238 +0100
 @@ -26,6 +26,8 @@
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
@@ -2516,9 +2516,9 @@ diff -up openssh-6.1p1/ssh_config.gsskex openssh-6.1p1/ssh_config
  #   BatchMode no
  #   CheckHostIP yes
  #   AddressFamily any
-diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
---- openssh-6.1p1/sshconnect2.c.gsskex	2012-11-30 13:58:08.913298775 +0100
-+++ openssh-6.1p1/sshconnect2.c	2012-11-30 13:58:08.955298617 +0100
+diff -up openssh-6.2p1/sshconnect2.c.gsskex openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.gsskex	2013-03-27 13:19:11.104624419 +0100
++++ openssh-6.2p1/sshconnect2.c	2013-03-27 13:19:11.149624234 +0100
 @@ -162,9 +162,34 @@ ssh_kex2(char *host, struct sockaddr *ho
  {
  	Kex *kex;
@@ -2603,7 +2603,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
  	xxx_kex = kex;
  
  	dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-@@ -315,6 +371,7 @@ void	input_gssapi_token(int type, u_int3
+@@ -316,6 +372,7 @@ void	input_gssapi_token(int type, u_int3
  void	input_gssapi_hash(int type, u_int32_t, void *);
  void	input_gssapi_error(int, u_int32_t, void *);
  void	input_gssapi_errtok(int, u_int32_t, void *);
@@ -2611,7 +2611,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
  #endif
  
  void	userauth(Authctxt *, char *);
-@@ -330,6 +387,11 @@ static char *authmethods_get(void);
+@@ -331,6 +388,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -2623,7 +2623,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
  	{"gssapi-with-mic",
  		userauth_gssapi,
  		NULL,
-@@ -637,19 +699,31 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -638,19 +700,31 @@ userauth_gssapi(Authctxt *authctxt)
  	static u_int mech = 0;
  	OM_uint32 min;
  	int ok = 0;
@@ -2657,7 +2657,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
  			ok = 1; /* Mechanism works */
  		} else {
  			mech++;
-@@ -746,8 +820,8 @@ input_gssapi_response(int type, u_int32_
+@@ -747,8 +821,8 @@ input_gssapi_response(int type, u_int32_
  {
  	Authctxt *authctxt = ctxt;
  	Gssctxt *gssctxt;
@@ -2668,7 +2668,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
  
  	if (authctxt == NULL)
  		fatal("input_gssapi_response: no authentication context");
-@@ -857,6 +931,48 @@ input_gssapi_error(int type, u_int32_t p
+@@ -858,6 +932,48 @@ input_gssapi_error(int type, u_int32_t p
  	xfree(msg);
  	xfree(lang);
  }
@@ -2717,9 +2717,9 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
  #endif /* GSSAPI */
  
  int
-diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.gsskex	2012-11-30 13:58:08.940298674 +0100
-+++ openssh-6.1p1/sshd.c	2012-11-30 13:58:08.955298617 +0100
+diff -up openssh-6.2p1/sshd.c.gsskex openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.gsskex	2013-03-27 13:19:11.133624300 +0100
++++ openssh-6.2p1/sshd.c	2013-03-27 13:19:11.149624234 +0100
 @@ -124,6 +124,10 @@
  #include "ssh-sandbox.h"
  #include "version.h"
@@ -2731,7 +2731,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
  #ifdef LIBWRAP
  #include <tcpd.h>
  #include <syslog.h>
-@@ -1723,10 +1727,13 @@ main(int ac, char **av)
+@@ -1733,10 +1737,13 @@ main(int ac, char **av)
  		logit("Disabling protocol version 1. Could not load host key");
  		options.protocol &= ~SSH_PROTO_1;
  	}
@@ -2745,7 +2745,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
  	if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
  		logit("sshd: no hostkeys available -- exiting.");
  		exit(1);
-@@ -2058,6 +2065,60 @@ main(int ac, char **av)
+@@ -2068,6 +2075,60 @@ main(int ac, char **av)
  	/* Log the connection. */
  	verbose("Connection from %.500s port %d", remote_ip, remote_port);
  
@@ -2806,7 +2806,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
  	/*
  	 * We don't want to listen forever unless the other side
  	 * successfully authenticates itself.  So we set up an alarm which is
-@@ -2456,6 +2517,48 @@ do_ssh2_kex(void)
+@@ -2466,6 +2527,48 @@ do_ssh2_kex(void)
  
  	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
  
@@ -2855,7 +2855,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
  	/* start key exchange */
  	kex = kex_setup(myproposal);
  	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-@@ -2463,6 +2566,13 @@ do_ssh2_kex(void)
+@@ -2473,6 +2576,13 @@ do_ssh2_kex(void)
  	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
  	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
  	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -2869,10 +2869,10 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
  	kex->server = 1;
  	kex->client_version_string=client_version_string;
  	kex->server_version_string=server_version_string;
-diff -up openssh-6.1p1/sshd_config.5.gsskex openssh-6.1p1/sshd_config.5
---- openssh-6.1p1/sshd_config.5.gsskex	2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/sshd_config.5	2012-11-30 13:58:08.956298613 +0100
-@@ -462,12 +462,40 @@ Specifies whether user authentication ba
+diff -up openssh-6.2p1/sshd_config.5.gsskex openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.gsskex	2013-03-27 13:19:11.129624316 +0100
++++ openssh-6.2p1/sshd_config.5	2013-03-27 13:19:11.150624230 +0100
+@@ -481,12 +481,40 @@ Specifies whether user authentication ba
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
@@ -2913,9 +2913,9 @@ diff -up openssh-6.1p1/sshd_config.5.gsskex openssh-6.1p1/sshd_config.5
  .It Cm HostbasedAuthentication
  Specifies whether rhosts or /etc/hosts.equiv authentication together
  with successful public key client host authentication is allowed
-diff -up openssh-6.1p1/sshd_config.gsskex openssh-6.1p1/sshd_config
---- openssh-6.1p1/sshd_config.gsskex	2012-11-30 13:58:08.940298674 +0100
-+++ openssh-6.1p1/sshd_config	2012-11-30 13:58:08.956298613 +0100
+diff -up openssh-6.2p1/sshd_config.gsskex openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.gsskex	2013-03-27 13:19:11.133624300 +0100
++++ openssh-6.2p1/sshd_config	2013-03-27 13:19:11.150624230 +0100
 @@ -89,6 +89,8 @@ ChallengeResponseAuthentication no
  GSSAPIAuthentication yes
  #GSSAPICleanupCredentials yes
@@ -2925,9 +2925,9 @@ diff -up openssh-6.1p1/sshd_config.gsskex openssh-6.1p1/sshd_config
  
  # Set this to 'yes' to enable PAM authentication, account processing, 
  # and session processing. If this is enabled, PAM authentication will 
-diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
---- openssh-6.1p1/ssh-gss.h.gsskex	2007-06-12 15:40:39.000000000 +0200
-+++ openssh-6.1p1/ssh-gss.h	2012-11-30 13:58:08.956298613 +0100
+diff -up openssh-6.2p1/ssh-gss.h.gsskex openssh-6.2p1/ssh-gss.h
+--- openssh-6.2p1/ssh-gss.h.gsskex	2013-02-25 01:24:44.000000000 +0100
++++ openssh-6.2p1/ssh-gss.h	2013-03-27 13:19:11.150624230 +0100
 @@ -1,6 +1,6 @@
  /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
  /*
@@ -2936,7 +2936,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -60,10 +60,22 @@
+@@ -61,10 +61,22 @@
  
  #define SSH_GSS_OIDTYPE 0x06
  
@@ -2959,7 +2959,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
  	void *data;
  } ssh_gssapi_ccache;
  
-@@ -71,8 +83,11 @@ typedef struct {
+@@ -72,8 +84,11 @@ typedef struct {
  	gss_buffer_desc displayname;
  	gss_buffer_desc exportedname;
  	gss_cred_id_t creds;
@@ -2971,7 +2971,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
  } ssh_gssapi_client;
  
  typedef struct ssh_gssapi_mech_struct {
-@@ -83,6 +98,7 @@ typedef struct ssh_gssapi_mech_struct {
+@@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct {
  	int (*userok) (ssh_gssapi_client *, char *);
  	int (*localname) (ssh_gssapi_client *, char **);
  	void (*storecreds) (ssh_gssapi_client *);
@@ -2979,7 +2979,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
  } ssh_gssapi_mech;
  
  typedef struct {
-@@ -93,10 +109,11 @@ typedef struct {
+@@ -94,10 +110,11 @@ typedef struct {
  	gss_OID		oid; /* client */
  	gss_cred_id_t	creds; /* server */
  	gss_name_t	client; /* server */
@@ -2992,7 +2992,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
  
  int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
  void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -116,16 +133,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
+@@ -117,16 +134,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
  void ssh_gssapi_delete_ctx(Gssctxt **);
  OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
diff --git a/openssh-5.9p1-keycat.patch b/openssh-6.2p1-keycat.patch
similarity index 87%
rename from openssh-5.9p1-keycat.patch
rename to openssh-6.2p1-keycat.patch
index 1630c39..41770b3 100644
--- a/openssh-5.9p1-keycat.patch
+++ b/openssh-6.2p1-keycat.patch
@@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/auth2-pubkey.c.keycat openssh-6.1p1/auth2-pubkey.c
---- openssh-6.1p1/auth2-pubkey.c.keycat	2013-02-14 17:39:21.000000000 +0100
-+++ openssh-6.1p1/auth2-pubkey.c	2013-02-14 17:40:42.600050510 +0100
-@@ -571,6 +571,14 @@ user_key_command_allowed2(struct passwd
+diff -up openssh-6.2p1/auth2-pubkey.c.keycat openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.keycat	2013-03-25 21:34:17.779978851 +0100
++++ openssh-6.2p1/auth2-pubkey.c	2013-03-25 21:34:17.798978973 +0100
+@@ -573,6 +573,14 @@ user_key_command_allowed2(struct passwd
  			_exit(1);
  		}
  
@@ -16,9 +16,9 @@ diff -up openssh-6.1p1/auth2-pubkey.c.keycat openssh-6.1p1/auth2-pubkey.c
  		execl(options.authorized_keys_command,
  		    options.authorized_keys_command, user_pw->pw_name, NULL);
  
-diff -up openssh-6.1p1/HOWTO.ssh-keycat.keycat openssh-6.1p1/HOWTO.ssh-keycat
---- openssh-6.1p1/HOWTO.ssh-keycat.keycat	2013-02-14 17:39:21.148382013 +0100
-+++ openssh-6.1p1/HOWTO.ssh-keycat	2013-02-14 17:39:21.148382013 +0100
+diff -up openssh-6.2p1/HOWTO.ssh-keycat.keycat openssh-6.2p1/HOWTO.ssh-keycat
+--- openssh-6.2p1/HOWTO.ssh-keycat.keycat	2013-03-25 21:34:17.798978973 +0100
++++ openssh-6.2p1/HOWTO.ssh-keycat	2013-03-25 21:34:17.798978973 +0100
 @@ -0,0 +1,12 @@
 +The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
 +of an user in any environment. This includes environments with
@@ -32,9 +32,9 @@ diff -up openssh-6.1p1/HOWTO.ssh-keycat.keycat openssh-6.1p1/HOWTO.ssh-keycat
 +        PubkeyAuthentication yes
 +
 +
-diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
---- openssh-6.1p1/Makefile.in.keycat	2013-02-14 17:39:21.143382033 +0100
-+++ openssh-6.1p1/Makefile.in	2013-02-14 17:39:21.148382013 +0100
+diff -up openssh-6.2p1/Makefile.in.keycat openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.keycat	2013-03-25 21:34:17.793978941 +0100
++++ openssh-6.2p1/Makefile.in	2013-03-25 21:35:48.282559562 +0100
 @@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
  SSH_KEYSIGN=$(libexecdir)/ssh-keysign
  SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
@@ -43,16 +43,16 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
  SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -62,7 +63,7 @@ EXEEXT=@EXEEXT@
+@@ -64,7 +65,7 @@ EXEEXT=@EXEEXT@
  MANFMT=@MANFMT@
  INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
  
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
  
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -168,6 +169,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -170,6 +171,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
  ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
  	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
@@ -62,7 +62,7 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
  	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
-@@ -267,6 +271,7 @@ install-files:
+@@ -276,6 +280,7 @@ install-files:
  		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
  		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
  	fi
@@ -70,9 +70,9 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh-6.1p1/openbsd-compat/port-linux.c.keycat openssh-6.1p1/openbsd-compat/port-linux.c
---- openssh-6.1p1/openbsd-compat/port-linux.c.keycat	2013-02-14 17:39:21.126382101 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux.c	2013-02-14 17:39:21.149382009 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux.c.keycat openssh-6.2p1/openbsd-compat/port-linux.c
+--- openssh-6.2p1/openbsd-compat/port-linux.c.keycat	2013-03-25 21:34:17.785978890 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux.c	2013-03-25 21:34:17.800978986 +0100
 @@ -315,7 +315,7 @@ ssh_selinux_getctxbyname(char *pwname,
  
  /* Setup environment variables for pam_selinux */
@@ -127,9 +127,9 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux.c.keycat openssh-6.1p1/openbsd-
  /* Set the execution context to the default for the specified user */
  void
  ssh_selinux_setup_exec_context(char *pwname)
-diff -up openssh-6.1p1/ssh-keycat.c.keycat openssh-6.1p1/ssh-keycat.c
---- openssh-6.1p1/ssh-keycat.c.keycat	2013-02-14 17:39:21.149382009 +0100
-+++ openssh-6.1p1/ssh-keycat.c	2013-02-14 17:39:21.149382009 +0100
+diff -up openssh-6.2p1/ssh-keycat.c.keycat openssh-6.2p1/ssh-keycat.c
+--- openssh-6.2p1/ssh-keycat.c.keycat	2013-03-25 21:34:17.800978986 +0100
++++ openssh-6.2p1/ssh-keycat.c	2013-03-25 21:34:17.800978986 +0100
 @@ -0,0 +1,238 @@
 +/*
 + * Redistribution and use in source and binary forms, with or without
diff --git a/openssh-6.1p1-kuserok.patch b/openssh-6.2p1-kuserok.patch
similarity index 70%
rename from openssh-6.1p1-kuserok.patch
rename to openssh-6.2p1-kuserok.patch
index 7b695e0..641ad03 100644
--- a/openssh-6.1p1-kuserok.patch
+++ b/openssh-6.2p1-kuserok.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c
---- openssh-6.1p1/auth-krb5.c.kuserok	2012-09-14 21:08:16.941496194 +0200
-+++ openssh-6.1p1/auth-krb5.c	2012-09-14 21:08:17.063496896 +0200
+diff -up openssh-6.2p1/auth-krb5.c.kuserok openssh-6.2p1/auth-krb5.c
+--- openssh-6.2p1/auth-krb5.c.kuserok	2013-03-25 20:06:51.295558062 +0100
++++ openssh-6.2p1/auth-krb5.c	2013-03-25 20:06:51.318558207 +0100
 @@ -55,6 +55,20 @@
  
  extern ServerOptions	 options;
@@ -31,9 +31,9 @@ diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c
  		problem = -1;
  		goto out;
  	}
-diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c
---- openssh-6.1p1/gss-serv-krb5.c.kuserok	2012-09-14 21:08:17.019496642 +0200
-+++ openssh-6.1p1/gss-serv-krb5.c	2012-09-14 21:08:17.065496906 +0200
+diff -up openssh-6.2p1/gss-serv-krb5.c.kuserok openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.kuserok	2013-03-25 20:06:51.311558163 +0100
++++ openssh-6.2p1/gss-serv-krb5.c	2013-03-25 20:06:51.319558214 +0100
 @@ -68,6 +68,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr
      int);
  
@@ -51,10 +51,10 @@ diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c
  		retval = 1;
  		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
  		    luser, (char *)client->displayname.value);
-diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.kuserok	2012-09-14 21:08:16.989496471 +0200
-+++ openssh-6.1p1/servconf.c	2012-09-14 21:09:30.864868698 +0200
-@@ -152,6 +152,7 @@ initialize_server_options(ServerOptions
+diff -up openssh-6.2p1/servconf.c.kuserok openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.kuserok	2013-03-25 20:06:51.305558125 +0100
++++ openssh-6.2p1/servconf.c	2013-03-25 20:06:51.319558214 +0100
+@@ -150,6 +150,7 @@ initialize_server_options(ServerOptions
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->version_addendum = NULL;
@@ -62,7 +62,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  }
  
  void
-@@ -301,6 +302,8 @@ fill_default_server_options(ServerOption
+@@ -299,6 +300,8 @@ fill_default_server_options(ServerOption
  		options->version_addendum = xstrdup("");
  	if (options->show_patchlevel == -1)
  		options->show_patchlevel = 0;
@@ -71,7 +71,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  
  	/* Turn privilege separation on by default */
  	if (use_privsep == -1)
-@@ -327,7 +330,7 @@ typedef enum {
+@@ -325,7 +328,7 @@ typedef enum {
  	sPermitRootLogin, sLogFacility, sLogLevel,
  	sRhostsRSAAuthentication, sRSAAuthentication,
  	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
@@ -80,7 +80,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  	sKerberosTgtPassing, sChallengeResponseAuthentication,
  	sPasswordAuthentication, sKbdInteractiveAuthentication,
  	sListenAddress, sAddressFamily,
-@@ -399,11 +402,13 @@ static struct {
+@@ -397,11 +400,13 @@ static struct {
  #else
  	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
  #endif
@@ -94,7 +94,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  #endif
  	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
  	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1486,6 +1491,10 @@ process_server_config_line(ServerOptions
+@@ -1460,6 +1465,10 @@ process_server_config_line(ServerOptions
  		*activep = value;
  		break;
  
@@ -105,7 +105,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  	case sPermitOpen:
  		arg = strdelim(&cp);
  		if (!arg || *arg == '\0')
-@@ -1769,6 +1778,7 @@ copy_set_server_options(ServerOptions *d
+@@ -1761,6 +1770,7 @@ copy_set_server_options(ServerOptions *d
  	M_CP_INTOPT(max_authtries);
  	M_CP_INTOPT(ip_qos_interactive);
  	M_CP_INTOPT(ip_qos_bulk);
@@ -113,7 +113,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  
  	/* See comment in servconf.h */
  	COPY_MATCH_STRING_OPTS();
-@@ -2005,6 +2015,7 @@ dump_config(ServerOptions *o)
+@@ -1999,6 +2009,7 @@ dump_config(ServerOptions *o)
  	dump_cfg_fmtint(sUseDNS, o->use_dns);
  	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
  	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
@@ -121,10 +121,10 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
  
  	/* string arguments */
  	dump_cfg_string(sPidFile, o->pid_file);
-diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h
---- openssh-6.1p1/servconf.h.kuserok	2012-09-14 21:08:16.990496476 +0200
-+++ openssh-6.1p1/servconf.h	2012-09-14 21:08:17.071496942 +0200
-@@ -169,6 +169,7 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.kuserok openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.kuserok	2013-03-25 20:06:51.305558125 +0100
++++ openssh-6.2p1/servconf.h	2013-03-25 20:06:51.320558220 +0100
+@@ -173,6 +173,7 @@ typedef struct {
  
  	int	num_permitted_opens;
  
@@ -132,10 +132,10 @@ diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h
  	char   *chroot_directory;
  	char   *revoked_keys_file;
  	char   *trusted_user_ca_keys;
-diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config
---- openssh-6.1p1/sshd_config.kuserok	2012-09-14 21:08:17.002496545 +0200
-+++ openssh-6.1p1/sshd_config	2012-09-14 21:08:17.074496957 +0200
-@@ -79,6 +79,7 @@ ChallengeResponseAuthentication no
+diff -up openssh-6.2p1/sshd_config.kuserok openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.kuserok	2013-03-25 20:06:51.308558144 +0100
++++ openssh-6.2p1/sshd_config	2013-03-25 20:06:51.320558220 +0100
+@@ -83,6 +83,7 @@ ChallengeResponseAuthentication no
  #KerberosOrLocalPasswd yes
  #KerberosTicketCleanup yes
  #KerberosGetAFSToken no
@@ -143,10 +143,10 @@ diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config
  
  # GSSAPI options
  #GSSAPIAuthentication no
-diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5
---- openssh-6.1p1/sshd_config.5.kuserok	2012-09-14 21:08:17.004496556 +0200
-+++ openssh-6.1p1/sshd_config.5	2012-09-14 21:08:17.073496952 +0200
-@@ -618,6 +618,10 @@ Specifies whether to automatically destr
+diff -up openssh-6.2p1/sshd_config.5.kuserok openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.kuserok	2013-03-25 20:06:51.308558144 +0100
++++ openssh-6.2p1/sshd_config.5	2013-03-25 20:08:34.249207272 +0100
+@@ -660,6 +660,10 @@ Specifies whether to automatically destr
  file on logout.
  The default is
  .Dq yes .
@@ -157,11 +157,11 @@ diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5
  .It Cm KexAlgorithms
  Specifies the available KEX (Key Exchange) algorithms.
  Multiple algorithms must be comma-separated.
-@@ -767,6 +771,7 @@ Available keywords are
+@@ -819,6 +823,7 @@ Available keywords are
  .Cm HostbasedUsesNameFromPacketOnly ,
  .Cm KbdInteractiveAuthentication ,
  .Cm KerberosAuthentication ,
 +.Cm KerberosUseKuserok ,
  .Cm MaxAuthTries ,
  .Cm MaxSessions ,
- .Cm PubkeyAuthentication ,
+ .Cm PasswordAuthentication ,
diff --git a/openssh-6.0p1-ldap.patch b/openssh-6.2p1-ldap.patch
similarity index 95%
rename from openssh-6.0p1-ldap.patch
rename to openssh-6.2p1-ldap.patch
index b6f19ba..c8795b5 100644
--- a/openssh-6.0p1-ldap.patch
+++ b/openssh-6.2p1-ldap.patch
@@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/configure.ac.ldap openssh-6.1p1/configure.ac
---- openssh-6.1p1/configure.ac.ldap	2012-07-06 03:49:29.000000000 +0200
-+++ openssh-6.1p1/configure.ac	2012-11-01 13:35:14.830280116 +0100
-@@ -1512,6 +1512,106 @@ AC_ARG_WITH([audit],
+diff -up openssh-6.2p1/configure.ac.ldap openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.ldap	2013-03-20 02:55:15.000000000 +0100
++++ openssh-6.2p1/configure.ac	2013-03-25 21:27:15.888248071 +0100
+@@ -1509,6 +1509,106 @@ AC_ARG_WITH([audit],
  	esac ]
  )
  
@@ -108,9 +108,9 @@ diff -up openssh-6.1p1/configure.ac.ldap openssh-6.1p1/configure.ac
  dnl    Checks for library functions. Please keep in alphabetical order
  AC_CHECK_FUNCS([ \
  	arc4random \
-diff -up openssh-6.1p1/HOWTO.ldap-keys.ldap openssh-6.1p1/HOWTO.ldap-keys
---- openssh-6.1p1/HOWTO.ldap-keys.ldap	2012-11-01 12:57:17.915280385 +0100
-+++ openssh-6.1p1/HOWTO.ldap-keys	2012-11-01 12:57:17.915280385 +0100
+diff -up openssh-6.2p1/HOWTO.ldap-keys.ldap openssh-6.2p1/HOWTO.ldap-keys
+--- openssh-6.2p1/HOWTO.ldap-keys.ldap	2013-03-25 21:27:15.889248078 +0100
++++ openssh-6.2p1/HOWTO.ldap-keys	2013-03-25 21:27:15.889248078 +0100
 @@ -0,0 +1,108 @@
 +
 +HOW TO START
@@ -220,9 +220,9 @@ diff -up openssh-6.1p1/HOWTO.ldap-keys.ldap openssh-6.1p1/HOWTO.ldap-keys
 +5) Author
 +    Jan F. Chadima <jchadima@redhat.com>
 +
-diff -up openssh-6.1p1/ldapbody.c.ldap openssh-6.1p1/ldapbody.c
---- openssh-6.1p1/ldapbody.c.ldap	2012-11-01 12:57:17.916280385 +0100
-+++ openssh-6.1p1/ldapbody.c	2012-11-01 12:57:17.916280385 +0100
+diff -up openssh-6.2p1/ldapbody.c.ldap openssh-6.2p1/ldapbody.c
+--- openssh-6.2p1/ldapbody.c.ldap	2013-03-25 21:27:15.889248078 +0100
++++ openssh-6.2p1/ldapbody.c	2013-03-25 21:27:15.889248078 +0100
 @@ -0,0 +1,494 @@
 +/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -718,9 +718,9 @@ diff -up openssh-6.1p1/ldapbody.c.ldap openssh-6.1p1/ldapbody.c
 +	return;
 +}
 +
-diff -up openssh-6.1p1/ldapbody.h.ldap openssh-6.1p1/ldapbody.h
---- openssh-6.1p1/ldapbody.h.ldap	2012-11-01 12:57:17.916280385 +0100
-+++ openssh-6.1p1/ldapbody.h	2012-11-01 12:57:17.916280385 +0100
+diff -up openssh-6.2p1/ldapbody.h.ldap openssh-6.2p1/ldapbody.h
+--- openssh-6.2p1/ldapbody.h.ldap	2013-03-25 21:27:15.889248078 +0100
++++ openssh-6.2p1/ldapbody.h	2013-03-25 21:27:15.889248078 +0100
 @@ -0,0 +1,37 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -759,9 +759,9 @@ diff -up openssh-6.1p1/ldapbody.h.ldap openssh-6.1p1/ldapbody.h
 +
 +#endif /* LDAPBODY_H */
 +
-diff -up openssh-6.1p1/ldapconf.c.ldap openssh-6.1p1/ldapconf.c
---- openssh-6.1p1/ldapconf.c.ldap	2012-11-01 12:57:17.917280385 +0100
-+++ openssh-6.1p1/ldapconf.c	2012-11-01 12:57:17.917280385 +0100
+diff -up openssh-6.2p1/ldapconf.c.ldap openssh-6.2p1/ldapconf.c
+--- openssh-6.2p1/ldapconf.c.ldap	2013-03-25 21:27:15.890248084 +0100
++++ openssh-6.2p1/ldapconf.c	2013-03-25 21:27:15.890248084 +0100
 @@ -0,0 +1,682 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1445,9 +1445,9 @@ diff -up openssh-6.1p1/ldapconf.c.ldap openssh-6.1p1/ldapconf.c
 +	dump_cfg_string(lSSH_Filter, options.ssh_filter);
 +}
 +
-diff -up openssh-6.1p1/ldapconf.h.ldap openssh-6.1p1/ldapconf.h
---- openssh-6.1p1/ldapconf.h.ldap	2012-11-01 12:57:17.918280385 +0100
-+++ openssh-6.1p1/ldapconf.h	2012-11-01 12:57:17.918280385 +0100
+diff -up openssh-6.2p1/ldapconf.h.ldap openssh-6.2p1/ldapconf.h
+--- openssh-6.2p1/ldapconf.h.ldap	2013-03-25 21:27:15.891248091 +0100
++++ openssh-6.2p1/ldapconf.h	2013-03-25 21:27:15.891248091 +0100
 @@ -0,0 +1,71 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1520,9 +1520,9 @@ diff -up openssh-6.1p1/ldapconf.h.ldap openssh-6.1p1/ldapconf.h
 +void dump_config(void);
 +
 +#endif /* LDAPCONF_H */
-diff -up openssh-6.1p1/ldap.conf.ldap openssh-6.1p1/ldap.conf
---- openssh-6.1p1/ldap.conf.ldap	2012-11-01 12:57:17.918280385 +0100
-+++ openssh-6.1p1/ldap.conf	2012-11-01 12:57:17.918280385 +0100
+diff -up openssh-6.2p1/ldap.conf.ldap openssh-6.2p1/ldap.conf
+--- openssh-6.2p1/ldap.conf.ldap	2013-03-25 21:27:15.891248091 +0100
++++ openssh-6.2p1/ldap.conf	2013-03-25 21:27:15.891248091 +0100
 @@ -0,0 +1,88 @@
 +# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
 +#
@@ -1612,9 +1612,9 @@ diff -up openssh-6.1p1/ldap.conf.ldap openssh-6.1p1/ldap.conf
 +#tls_cert
 +#tls_key
 +
-diff -up openssh-6.1p1/ldap-helper.c.ldap openssh-6.1p1/ldap-helper.c
---- openssh-6.1p1/ldap-helper.c.ldap	2012-11-01 12:57:17.919280385 +0100
-+++ openssh-6.1p1/ldap-helper.c	2012-11-01 12:57:17.919280385 +0100
+diff -up openssh-6.2p1/ldap-helper.c.ldap openssh-6.2p1/ldap-helper.c
+--- openssh-6.2p1/ldap-helper.c.ldap	2013-03-25 21:27:15.892248097 +0100
++++ openssh-6.2p1/ldap-helper.c	2013-03-25 21:27:15.892248097 +0100
 @@ -0,0 +1,155 @@
 +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1771,9 +1771,9 @@ diff -up openssh-6.1p1/ldap-helper.c.ldap openssh-6.1p1/ldap-helper.c
 +void   *buffer_get_string(Buffer *b, u_int *l) { return NULL; }
 +void    buffer_put_string(Buffer *b, const void *f, u_int l) {}
 +
-diff -up openssh-6.1p1/ldap-helper.h.ldap openssh-6.1p1/ldap-helper.h
---- openssh-6.1p1/ldap-helper.h.ldap	2012-11-01 12:57:17.919280385 +0100
-+++ openssh-6.1p1/ldap-helper.h	2012-11-01 12:57:17.919280385 +0100
+diff -up openssh-6.2p1/ldap-helper.h.ldap openssh-6.2p1/ldap-helper.h
+--- openssh-6.2p1/ldap-helper.h.ldap	2013-03-25 21:27:15.892248097 +0100
++++ openssh-6.2p1/ldap-helper.h	2013-03-25 21:27:15.892248097 +0100
 @@ -0,0 +1,32 @@
 +/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1807,9 +1807,9 @@ diff -up openssh-6.1p1/ldap-helper.h.ldap openssh-6.1p1/ldap-helper.h
 +extern int config_warning_config_file;
 +
 +#endif /* LDAP_HELPER_H */
-diff -up openssh-6.1p1/ldapincludes.h.ldap openssh-6.1p1/ldapincludes.h
---- openssh-6.1p1/ldapincludes.h.ldap	2012-11-01 12:57:17.920280385 +0100
-+++ openssh-6.1p1/ldapincludes.h	2012-11-01 12:57:17.920280385 +0100
+diff -up openssh-6.2p1/ldapincludes.h.ldap openssh-6.2p1/ldapincludes.h
+--- openssh-6.2p1/ldapincludes.h.ldap	2013-03-25 21:27:15.892248097 +0100
++++ openssh-6.2p1/ldapincludes.h	2013-03-25 21:27:15.892248097 +0100
 @@ -0,0 +1,41 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1852,9 +1852,9 @@ diff -up openssh-6.1p1/ldapincludes.h.ldap openssh-6.1p1/ldapincludes.h
 +#endif
 +
 +#endif /* LDAPINCLUDES_H */
-diff -up openssh-6.1p1/ldapmisc.c.ldap openssh-6.1p1/ldapmisc.c
---- openssh-6.1p1/ldapmisc.c.ldap	2012-11-01 12:57:17.920280385 +0100
-+++ openssh-6.1p1/ldapmisc.c	2012-11-01 12:57:17.920280385 +0100
+diff -up openssh-6.2p1/ldapmisc.c.ldap openssh-6.2p1/ldapmisc.c
+--- openssh-6.2p1/ldapmisc.c.ldap	2013-03-25 21:27:15.893248104 +0100
++++ openssh-6.2p1/ldapmisc.c	2013-03-25 21:27:15.893248104 +0100
 @@ -0,0 +1,79 @@
 +
 +#include "ldapincludes.h"
@@ -1935,9 +1935,9 @@ diff -up openssh-6.1p1/ldapmisc.c.ldap openssh-6.1p1/ldapmisc.c
 +}
 +#endif
 +
-diff -up openssh-6.1p1/ldapmisc.h.ldap openssh-6.1p1/ldapmisc.h
---- openssh-6.1p1/ldapmisc.h.ldap	2012-11-01 12:57:17.921280385 +0100
-+++ openssh-6.1p1/ldapmisc.h	2012-11-01 12:57:17.921280385 +0100
+diff -up openssh-6.2p1/ldapmisc.h.ldap openssh-6.2p1/ldapmisc.h
+--- openssh-6.2p1/ldapmisc.h.ldap	2013-03-25 21:27:15.893248104 +0100
++++ openssh-6.2p1/ldapmisc.h	2013-03-25 21:27:15.893248104 +0100
 @@ -0,0 +1,35 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@@ -1974,9 +1974,9 @@ diff -up openssh-6.1p1/ldapmisc.h.ldap openssh-6.1p1/ldapmisc.h
 +
 +#endif /* LDAPMISC_H */
 +
-diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
---- openssh-6.1p1/Makefile.in.ldap	2012-11-01 12:57:17.750280385 +0100
-+++ openssh-6.1p1/Makefile.in	2012-11-01 12:57:17.922280385 +0100
+diff -up openssh-6.2p1/Makefile.in.ldap openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ldap	2013-03-25 21:27:15.850247822 +0100
++++ openssh-6.2p1/Makefile.in	2013-03-25 21:27:57.356518817 +0100
 @@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh
  ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
  SFTP_SERVER=$(libexecdir)/sftp-server
@@ -1986,7 +1986,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  PRIVSEP_PATH=@PRIVSEP_PATH@
  SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -58,8 +60,9 @@ XAUTH_PATH=@XAUTH_PATH@
+@@ -60,8 +62,9 @@ XAUTH_PATH=@XAUTH_PATH@
  LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
  EXEEXT=@EXEEXT@
  MANFMT=@MANFMT@
@@ -1995,9 +1995,9 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
  
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -93,8 +96,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -95,8 +98,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
  	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
  	sandbox-seccomp-filter.o
  
@@ -2008,7 +2008,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  MANTYPE		= @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -162,6 +165,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
+@@ -164,6 +167,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
  ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
  	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
  
@@ -2018,7 +2018,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
  	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
  
-@@ -257,6 +263,10 @@ install-files:
+@@ -266,6 +272,10 @@ install-files:
  	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
  	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@@ -2029,7 +2029,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
  	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-@@ -273,6 +283,10 @@ install-files:
+@@ -282,6 +292,10 @@ install-files:
  	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
  	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
  	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -2040,7 +2040,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  	-rm -f $(DESTDIR)$(bindir)/slogin
  	ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -302,6 +316,13 @@ install-sysconf:
+@@ -311,6 +325,13 @@ install-sysconf:
  	else \
  		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
  	fi
@@ -2054,7 +2054,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  
  host-key: ssh-keygen$(EXEEXT)
  	@if [ -z "$(DESTDIR)" ] ; then \
-@@ -359,6 +380,8 @@ uninstall:
+@@ -368,6 +389,8 @@ uninstall:
  	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
  	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
  	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@@ -2063,17 +2063,17 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -370,6 +393,7 @@ uninstall:
+@@ -379,6 +402,7 @@ uninstall:
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
 +	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
  	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
  
- tests interop-tests:	$(TARGETS)
-diff -up openssh-6.1p1/openssh-lpk-openldap.schema.ldap openssh-6.1p1/openssh-lpk-openldap.schema
---- openssh-6.1p1/openssh-lpk-openldap.schema.ldap	2012-11-01 12:57:17.922280385 +0100
-+++ openssh-6.1p1/openssh-lpk-openldap.schema	2012-11-01 12:57:17.922280385 +0100
+ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
+diff -up openssh-6.2p1/openssh-lpk-openldap.schema.ldap openssh-6.2p1/openssh-lpk-openldap.schema
+--- openssh-6.2p1/openssh-lpk-openldap.schema.ldap	2013-03-25 21:27:15.894248110 +0100
++++ openssh-6.2p1/openssh-lpk-openldap.schema	2013-03-25 21:27:15.894248110 +0100
 @@ -0,0 +1,21 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -2096,9 +2096,9 @@ diff -up openssh-6.1p1/openssh-lpk-openldap.schema.ldap openssh-6.1p1/openssh-lp
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff -up openssh-6.1p1/openssh-lpk-sun.schema.ldap openssh-6.1p1/openssh-lpk-sun.schema
---- openssh-6.1p1/openssh-lpk-sun.schema.ldap	2012-11-01 12:57:17.922280385 +0100
-+++ openssh-6.1p1/openssh-lpk-sun.schema	2012-11-01 12:57:17.922280385 +0100
+diff -up openssh-6.2p1/openssh-lpk-sun.schema.ldap openssh-6.2p1/openssh-lpk-sun.schema
+--- openssh-6.2p1/openssh-lpk-sun.schema.ldap	2013-03-25 21:27:15.894248110 +0100
++++ openssh-6.2p1/openssh-lpk-sun.schema	2013-03-25 21:27:15.894248110 +0100
 @@ -0,0 +1,23 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -2123,9 +2123,9 @@ diff -up openssh-6.1p1/openssh-lpk-sun.schema.ldap openssh-6.1p1/openssh-lpk-sun
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff -up openssh-6.1p1/ssh-ldap.conf.5.ldap openssh-6.1p1/ssh-ldap.conf.5
---- openssh-6.1p1/ssh-ldap.conf.5.ldap	2012-11-01 12:57:17.923280385 +0100
-+++ openssh-6.1p1/ssh-ldap.conf.5	2012-11-01 12:57:17.923280385 +0100
+diff -up openssh-6.2p1/ssh-ldap.conf.5.ldap openssh-6.2p1/ssh-ldap.conf.5
+--- openssh-6.2p1/ssh-ldap.conf.5.ldap	2013-03-25 21:27:15.895248117 +0100
++++ openssh-6.2p1/ssh-ldap.conf.5	2013-03-25 21:27:15.895248117 +0100
 @@ -0,0 +1,376 @@
 +.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
@@ -2503,9 +2503,9 @@ diff -up openssh-6.1p1/ssh-ldap.conf.5.ldap openssh-6.1p1/ssh-ldap.conf.5
 +OpenSSH 5.5 + PKA-LDAP .
 +.Sh AUTHORS
 +.An Jan F. Chadima Aq jchadima@redhat.com
-diff -up openssh-6.1p1/ssh-ldap-helper.8.ldap openssh-6.1p1/ssh-ldap-helper.8
---- openssh-6.1p1/ssh-ldap-helper.8.ldap	2012-11-01 12:57:17.924280385 +0100
-+++ openssh-6.1p1/ssh-ldap-helper.8	2012-11-01 12:57:17.924280385 +0100
+diff -up openssh-6.2p1/ssh-ldap-helper.8.ldap openssh-6.2p1/ssh-ldap-helper.8
+--- openssh-6.2p1/ssh-ldap-helper.8.ldap	2013-03-25 21:27:15.895248117 +0100
++++ openssh-6.2p1/ssh-ldap-helper.8	2013-03-25 21:27:15.895248117 +0100
 @@ -0,0 +1,79 @@
 +.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
@@ -2586,9 +2586,9 @@ diff -up openssh-6.1p1/ssh-ldap-helper.8.ldap openssh-6.1p1/ssh-ldap-helper.8
 +OpenSSH 5.5 + PKA-LDAP .
 +.Sh AUTHORS
 +.An Jan F. Chadima Aq jchadima@redhat.com
-diff -up openssh-6.1p1/ssh-ldap-wrapper.ldap openssh-6.1p1/ssh-ldap-wrapper
---- openssh-6.1p1/ssh-ldap-wrapper.ldap	2012-11-01 12:57:17.924280385 +0100
-+++ openssh-6.1p1/ssh-ldap-wrapper	2012-11-01 12:57:17.924280385 +0100
+diff -up openssh-6.2p1/ssh-ldap-wrapper.ldap openssh-6.2p1/ssh-ldap-wrapper
+--- openssh-6.2p1/ssh-ldap-wrapper.ldap	2013-03-25 21:27:15.896248124 +0100
++++ openssh-6.2p1/ssh-ldap-wrapper	2013-03-25 21:27:15.896248124 +0100
 @@ -0,0 +1,4 @@
 +#!/bin/sh
 +
diff --git a/openssh-6.1p1-role-mls.patch b/openssh-6.2p1-role-mls.patch
similarity index 83%
rename from openssh-6.1p1-role-mls.patch
rename to openssh-6.2p1-role-mls.patch
index 4de3dae..3635fef 100644
--- a/openssh-6.1p1-role-mls.patch
+++ b/openssh-6.2p1-role-mls.patch
@@ -1,7 +1,44 @@
-diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
---- openssh-6.1p1/auth1.c.role-mls	2012-11-28 17:06:43.657990103 +0100
-+++ openssh-6.1p1/auth1.c	2012-11-28 17:06:43.699989959 +0100
-@@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt)
+diff -up openssh-6.2p1/auth.h.role-mls openssh-6.2p1/auth.h
+--- openssh-6.2p1/auth.h.role-mls	2013-03-25 17:47:00.565746862 +0100
++++ openssh-6.2p1/auth.h	2013-03-25 17:47:00.602747073 +0100
+@@ -59,6 +59,9 @@ struct Authctxt {
+ 	char		*service;
+ 	struct passwd	*pw;		/* set if 'valid' */
+ 	char		*style;
++#ifdef WITH_SELINUX
++	char		*role;
++#endif
+ 	void		*kbdintctxt;
+ 	void		*jpake_ctx;
+ #ifdef BSD_AUTH
+diff -up openssh-6.2p1/auth-pam.c.role-mls openssh-6.2p1/auth-pam.c
+--- openssh-6.2p1/auth-pam.c.role-mls	2013-03-25 17:47:00.535746690 +0100
++++ openssh-6.2p1/auth-pam.c	2013-03-25 17:47:00.602747073 +0100
+@@ -1074,7 +1074,7 @@ is_pam_session_open(void)
+  * during the ssh authentication process.
+  */
+ int
+-do_pam_putenv(char *name, char *value)
++do_pam_putenv(char *name, const char *value)
+ {
+ 	int ret = 1;
+ #ifdef HAVE_PAM_PUTENV
+diff -up openssh-6.2p1/auth-pam.h.role-mls openssh-6.2p1/auth-pam.h
+--- openssh-6.2p1/auth-pam.h.role-mls	2004-09-11 14:17:26.000000000 +0200
++++ openssh-6.2p1/auth-pam.h	2013-03-25 17:47:00.602747073 +0100
+@@ -38,7 +38,7 @@ void do_pam_session(void);
+ void do_pam_set_tty(const char *);
+ void do_pam_setcred(int );
+ void do_pam_chauthtok(void);
+-int do_pam_putenv(char *, char *);
++int do_pam_putenv(char *, const char *);
+ char ** fetch_pam_environment(void);
+ char ** fetch_pam_child_environment(void);
+ void free_pam_environment(char **);
+diff -up openssh-6.2p1/auth1.c.role-mls openssh-6.2p1/auth1.c
+--- openssh-6.2p1/auth1.c.role-mls	2012-12-02 23:53:20.000000000 +0100
++++ openssh-6.2p1/auth1.c	2013-03-25 17:47:00.600747062 +0100
+@@ -386,6 +386,9 @@ do_authentication(Authctxt *authctxt)
  {
  	u_int ulen;
  	char *user, *style = NULL;
@@ -11,7 +48,7 @@ diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
  
  	/* Get the name of the user that we wish to log in as. */
  	packet_read_expect(SSH_CMSG_USER);
-@@ -392,11 +395,24 @@ do_authentication(Authctxt *authctxt)
+@@ -394,11 +397,24 @@ do_authentication(Authctxt *authctxt)
  	user = packet_get_cstring(&ulen);
  	packet_check_eom();
  
@@ -36,9 +73,9 @@ diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
  
  	/* Verify that the user is a valid user. */
  	if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
-diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c
---- openssh-6.1p1/auth2.c.role-mls	2012-11-28 17:06:43.661990089 +0100
-+++ openssh-6.1p1/auth2.c	2012-11-28 17:11:09.058916613 +0100
+diff -up openssh-6.2p1/auth2.c.role-mls openssh-6.2p1/auth2.c
+--- openssh-6.2p1/auth2.c.role-mls	2013-03-25 17:47:00.556746810 +0100
++++ openssh-6.2p1/auth2.c	2013-03-25 17:47:00.600747062 +0100
 @@ -218,6 +218,9 @@ input_userauth_request(int type, u_int32
  	Authctxt *authctxt = ctxt;
  	Authmethod *m = NULL;
@@ -78,9 +115,9 @@ diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c
  		userauth_banner();
  		if (auth2_setup_methods_lists(authctxt) != 0)
  			packet_disconnect("no authentication methods enabled");
-diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c
---- openssh-6.1p1/auth2-gss.c.role-mls	2011-05-05 06:04:11.000000000 +0200
-+++ openssh-6.1p1/auth2-gss.c	2012-11-28 17:06:43.700989956 +0100
+diff -up openssh-6.2p1/auth2-gss.c.role-mls openssh-6.2p1/auth2-gss.c
+--- openssh-6.2p1/auth2-gss.c.role-mls	2012-12-02 23:53:20.000000000 +0100
++++ openssh-6.2p1/auth2-gss.c	2013-03-25 17:47:00.601747067 +0100
 @@ -260,6 +260,7 @@ input_gssapi_mic(int type, u_int32_t ple
  	Authctxt *authctxt = ctxt;
  	Gssctxt *gssctxt;
@@ -113,9 +150,9 @@ diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c
  	xfree(mic.value);
  
  	authctxt->postponed = 0;
-diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.c
---- openssh-6.1p1/auth2-hostbased.c.role-mls	2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth2-hostbased.c	2012-11-28 17:06:43.700989956 +0100
+diff -up openssh-6.2p1/auth2-hostbased.c.role-mls openssh-6.2p1/auth2-hostbased.c
+--- openssh-6.2p1/auth2-hostbased.c.role-mls	2013-03-25 17:47:00.565746862 +0100
++++ openssh-6.2p1/auth2-hostbased.c	2013-03-25 17:47:00.601747067 +0100
 @@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt)
  	buffer_put_string(&b, session_id2, session_id2_len);
  	/* reconstruct packet */
@@ -133,10 +170,10 @@ diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.
  	buffer_put_cstring(&b, service);
  	buffer_put_cstring(&b, "hostbased");
  	buffer_put_string(&b, pkalg, alen);
-diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c
---- openssh-6.1p1/auth2-pubkey.c.role-mls	2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth2-pubkey.c	2012-11-28 17:06:43.700989956 +0100
-@@ -121,7 +121,15 @@ userauth_pubkey(Authctxt *authctxt)
+diff -up openssh-6.2p1/auth2-pubkey.c.role-mls openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.role-mls	2013-03-25 17:47:00.565746862 +0100
++++ openssh-6.2p1/auth2-pubkey.c	2013-03-25 17:47:00.601747067 +0100
+@@ -127,7 +127,15 @@ userauth_pubkey(Authctxt *authctxt)
  		}
  		/* reconstruct packet */
  		buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
@@ -153,46 +190,9 @@ diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c
  		buffer_put_cstring(&b,
  		    datafellows & SSH_BUG_PKSERVICE ?
  		    "ssh-userauth" :
-diff -up openssh-6.1p1/auth.h.role-mls openssh-6.1p1/auth.h
---- openssh-6.1p1/auth.h.role-mls	2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth.h	2012-11-28 17:06:43.699989959 +0100
-@@ -59,6 +59,9 @@ struct Authctxt {
- 	char		*service;
- 	struct passwd	*pw;		/* set if 'valid' */
- 	char		*style;
-+#ifdef WITH_SELINUX
-+	char		*role;
-+#endif
- 	void		*kbdintctxt;
- 	void		*jpake_ctx;
- #ifdef BSD_AUTH
-diff -up openssh-6.1p1/auth-pam.c.role-mls openssh-6.1p1/auth-pam.c
---- openssh-6.1p1/auth-pam.c.role-mls	2012-11-28 17:06:43.638990168 +0100
-+++ openssh-6.1p1/auth-pam.c	2012-11-28 17:06:43.699989959 +0100
-@@ -1074,7 +1074,7 @@ is_pam_session_open(void)
-  * during the ssh authentication process.
-  */
- int
--do_pam_putenv(char *name, char *value)
-+do_pam_putenv(char *name, const char *value)
- {
- 	int ret = 1;
- #ifdef HAVE_PAM_PUTENV
-diff -up openssh-6.1p1/auth-pam.h.role-mls openssh-6.1p1/auth-pam.h
---- openssh-6.1p1/auth-pam.h.role-mls	2004-09-11 14:17:26.000000000 +0200
-+++ openssh-6.1p1/auth-pam.h	2012-11-28 17:06:43.699989959 +0100
-@@ -38,7 +38,7 @@ void do_pam_session(void);
- void do_pam_set_tty(const char *);
- void do_pam_setcred(int );
- void do_pam_chauthtok(void);
--int do_pam_putenv(char *, char *);
-+int do_pam_putenv(char *, const char *);
- char ** fetch_pam_environment(void);
- char ** fetch_pam_child_environment(void);
- void free_pam_environment(char **);
-diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c
---- openssh-6.1p1/misc.c.role-mls	2011-09-22 13:34:36.000000000 +0200
-+++ openssh-6.1p1/misc.c	2012-11-28 17:06:43.701989952 +0100
+diff -up openssh-6.2p1/misc.c.role-mls openssh-6.2p1/misc.c
+--- openssh-6.2p1/misc.c.role-mls	2011-09-22 13:34:36.000000000 +0200
++++ openssh-6.2p1/misc.c	2013-03-25 17:47:00.603747079 +0100
 @@ -427,6 +427,7 @@ char *
  colon(char *cp)
  {
@@ -215,9 +215,9 @@ diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c
  	}
  	return NULL;
  }
-diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor.c	2012-11-28 17:06:43.701989952 +0100
+diff -up openssh-6.2p1/monitor.c.role-mls openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.role-mls	2013-03-25 17:47:00.587746987 +0100
++++ openssh-6.2p1/monitor.c	2013-03-25 17:47:00.604747085 +0100
 @@ -148,6 +148,9 @@ int mm_answer_sign(int, Buffer *);
  int mm_answer_pwnamallow(int, Buffer *);
  int mm_answer_auth2_read_banner(int, Buffer *);
@@ -228,7 +228,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  int mm_answer_authpassword(int, Buffer *);
  int mm_answer_bsdauthquery(int, Buffer *);
  int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -231,6 +234,9 @@ struct mon_table mon_dispatch_proto20[]
+@@ -232,6 +235,9 @@ struct mon_table mon_dispatch_proto20[]
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -238,7 +238,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -838,6 +844,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
+@@ -846,6 +852,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
  	else {
  		/* Allow service/style information on the auth context */
  		monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -248,7 +248,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  		monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
  	}
  #ifdef USE_PAM
-@@ -881,6 +890,25 @@ mm_answer_authserv(int sock, Buffer *m)
+@@ -889,6 +898,25 @@ mm_answer_authserv(int sock, Buffer *m)
  	return (0);
  }
  
@@ -274,7 +274,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  int
  mm_answer_authpassword(int sock, Buffer *m)
  {
-@@ -1251,7 +1279,7 @@ static int
+@@ -1262,7 +1290,7 @@ static int
  monitor_valid_userblob(u_char *data, u_int datalen)
  {
  	Buffer b;
@@ -283,7 +283,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  	u_int len;
  	int fail = 0;
  
-@@ -1277,6 +1305,8 @@ monitor_valid_userblob(u_char *data, u_i
+@@ -1288,6 +1316,8 @@ monitor_valid_userblob(u_char *data, u_i
  	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
  		fail++;
  	p = buffer_get_string(&b, NULL);
@@ -292,7 +292,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  	if (strcmp(authctxt->user, p) != 0) {
  		logit("wrong user name passed to monitor: expected %s != %.100s",
  		    authctxt->user, p);
-@@ -1308,7 +1338,7 @@ monitor_valid_hostbasedblob(u_char *data
+@@ -1319,7 +1349,7 @@ monitor_valid_hostbasedblob(u_char *data
      char *chost)
  {
  	Buffer b;
@@ -301,7 +301,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  	u_int len;
  	int fail = 0;
  
-@@ -1325,6 +1355,8 @@ monitor_valid_hostbasedblob(u_char *data
+@@ -1336,6 +1366,8 @@ monitor_valid_hostbasedblob(u_char *data
  	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
  		fail++;
  	p = buffer_get_string(&b, NULL);
@@ -310,22 +310,22 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
  	if (strcmp(authctxt->user, p) != 0) {
  		logit("wrong user name passed to monitor: expected %s != %.100s",
  		    authctxt->user, p);
-diff -up openssh-6.1p1/monitor.h.role-mls openssh-6.1p1/monitor.h
---- openssh-6.1p1/monitor.h.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor.h	2012-11-28 17:06:43.701989952 +0100
-@@ -31,6 +31,9 @@
- enum monitor_reqtype {
- 	MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
- 	MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
+diff -up openssh-6.2p1/monitor.h.role-mls openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.role-mls	2013-03-25 17:47:00.605747090 +0100
++++ openssh-6.2p1/monitor.h	2013-03-25 17:50:00.824775483 +0100
+@@ -61,6 +61,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_JPAKE_STEP2 = 56, MONITOR_ANS_JPAKE_STEP2 = 57,
+ 	MONITOR_REQ_JPAKE_KEY_CONFIRM = 58, MONITOR_ANS_JPAKE_KEY_CONFIRM = 59,
+ 	MONITOR_REQ_JPAKE_CHECK_CONFIRM = 60, MONITOR_ANS_JPAKE_CHECK_CONFIRM = 61,
 +#ifdef WITH_SELINUX
-+	MONITOR_REQ_AUTHROLE,
++	MONITOR_REQ_AUTHROLE = 80,
 +#endif
- 	MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
- 	MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
- 	MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
-diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor_wrap.c	2012-11-28 17:06:43.702989948 +0100
+ 
+ 	MONITOR_REQ_PAM_START = 100,
+ 	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+diff -up openssh-6.2p1/monitor_wrap.c.role-mls openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.role-mls	2013-03-25 17:47:00.588746993 +0100
++++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:47:00.605747090 +0100
 @@ -336,6 +336,25 @@ mm_inform_authserv(char *service, char *
  	buffer_free(&m);
  }
@@ -352,9 +352,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c
  /* Do the password authentication */
  int
  mm_auth_password(Authctxt *authctxt, char *password)
-diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h
---- openssh-6.1p1/monitor_wrap.h.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor_wrap.h	2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.role-mls openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.role-mls	2013-03-25 17:47:00.588746993 +0100
++++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:47:00.605747090 +0100
 @@ -42,6 +42,9 @@ int mm_is_monitor(void);
  DH *mm_choose_dh(int, int, int);
  int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
@@ -365,21 +365,21 @@ diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h
  struct passwd *mm_getpwnamallow(const char *);
  char *mm_auth2_read_banner(void);
  int mm_auth_password(struct Authctxt *, char *);
-diff -up openssh-6.1p1/openbsd-compat/Makefile.in.role-mls openssh-6.1p1/openbsd-compat/Makefile.in
---- openssh-6.1p1/openbsd-compat/Makefile.in.role-mls	2011-11-04 01:25:25.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/Makefile.in	2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.role-mls openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.role-mls	2013-03-25 17:47:00.606747096 +0100
++++ openssh-6.2p1/openbsd-compat/Makefile.in	2013-03-25 17:50:36.024979473 +0100
 @@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
  
- COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
  
 -PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
 +PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
  
  .c.o:
  	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbsd-compat/port-linux.c
---- openssh-6.1p1/openbsd-compat/port-linux.c.role-mls	2012-03-09 00:25:18.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux.c	2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux.c.role-mls openssh-6.2p1/openbsd-compat/port-linux.c
+--- openssh-6.2p1/openbsd-compat/port-linux.c.role-mls	2012-03-09 00:25:18.000000000 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux.c	2013-03-25 17:47:00.606747096 +0100
 @@ -31,68 +31,271 @@
  
  #include "log.h"
@@ -840,9 +840,9 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbs
  #endif /* WITH_SELINUX */
  
  #ifdef LINUX_OOM_ADJUST
-diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1/openbsd-compat/port-linux_part_2.c
---- openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls	2012-11-28 17:06:43.703989944 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux_part_2.c	2012-11-28 17:06:43.703989944 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.2p1/openbsd-compat/port-linux_part_2.c
+--- openssh-6.2p1/openbsd-compat/port-linux_part_2.c.role-mls	2013-03-25 17:47:00.607747102 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux_part_2.c	2013-03-25 17:47:00.607747102 +0100
 @@ -0,0 +1,75 @@
 +/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
 +
@@ -919,10 +919,10 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1
 +#endif /* WITH_SELINUX */
 +
 +#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
-diff -up openssh-6.1p1/sshd.c.role-mls openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.role-mls	2012-11-28 17:06:43.688989996 +0100
-+++ openssh-6.1p1/sshd.c	2012-11-28 17:06:43.703989944 +0100
-@@ -2101,6 +2101,9 @@ main(int ac, char **av)
+diff -up openssh-6.2p1/sshd.c.role-mls openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.role-mls	2013-03-25 17:47:00.589746999 +0100
++++ openssh-6.2p1/sshd.c	2013-03-25 17:47:00.607747102 +0100
+@@ -2118,6 +2118,9 @@ main(int ac, char **av)
  		restore_uid();
  	}
  #endif
diff --git a/openssh-6.1p1-vendor.patch b/openssh-6.2p1-vendor.patch
similarity index 67%
rename from openssh-6.1p1-vendor.patch
rename to openssh-6.2p1-vendor.patch
index 9cb326d..ddccd2c 100644
--- a/openssh-6.1p1-vendor.patch
+++ b/openssh-6.2p1-vendor.patch
@@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
---- openssh-6.1p1/configure.ac.vendor	2012-09-14 20:36:49.153085211 +0200
-+++ openssh-6.1p1/configure.ac	2012-09-14 20:36:49.559088133 +0200
-@@ -4303,6 +4303,12 @@ AC_ARG_WITH([lastlog],
+diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.vendor	2013-03-25 19:34:01.277495179 +0100
++++ openssh-6.2p1/configure.ac	2013-03-25 19:34:01.377495818 +0100
+@@ -4420,6 +4420,12 @@ AC_ARG_WITH([lastlog],
  		fi
  	]
  )
@@ -14,7 +14,7 @@ diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
  
  dnl lastlog, [uw]tmpx? detection
  dnl  NOTE: set the paths in the platform section to avoid the
-@@ -4529,6 +4535,7 @@ echo "           Translate v4 in v6 hack
+@@ -4681,6 +4687,7 @@ echo "           Translate v4 in v6 hack
  echo "                  BSD Auth support: $BSD_AUTH_MSG"
  echo "              Random number source: $RAND_MSG"
  echo "             Privsep sandbox style: $SANDBOX_STYLE"
@@ -22,9 +22,9 @@ diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
  
  echo ""
  
-diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.vendor	2012-09-14 20:36:49.124085002 +0200
-+++ openssh-6.1p1/servconf.c	2012-09-14 20:50:34.995972516 +0200
+diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.vendor	2013-03-25 19:34:01.197494668 +0100
++++ openssh-6.2p1/servconf.c	2013-03-25 19:34:01.379495831 +0100
 @@ -128,6 +128,7 @@ initialize_server_options(ServerOptions
  	options->max_authtries = -1;
  	options->max_sessions = -1;
@@ -33,7 +33,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
  	options->use_dns = -1;
  	options->client_alive_interval = -1;
  	options->client_alive_count_max = -1;
-@@ -289,6 +290,9 @@ fill_default_server_options(ServerOption
+@@ -287,6 +288,9 @@ fill_default_server_options(ServerOption
  		options->ip_qos_bulk = IPTOS_THROUGHPUT;
  	if (options->version_addendum == NULL)
  		options->version_addendum = xstrdup("");
@@ -43,7 +43,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
  	/* Turn privilege separation on by default */
  	if (use_privsep == -1)
  		use_privsep = PRIVSEP_NOSANDBOX;
-@@ -326,7 +330,7 @@ typedef enum {
+@@ -324,7 +328,7 @@ typedef enum {
  	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
  	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
  	sMaxStartups, sMaxAuthTries, sMaxSessions,
@@ -52,7 +52,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
  	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
  	sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
-@@ -441,6 +445,7 @@ static struct {
+@@ -439,6 +443,7 @@ static struct {
  	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
  	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
  	{ "banner", sBanner, SSHCFG_ALL },
@@ -60,7 +60,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
  	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
  	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
  	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
-@@ -1162,6 +1167,10 @@ process_server_config_line(ServerOptions
+@@ -1163,6 +1168,10 @@ process_server_config_line(ServerOptions
  		multistate_ptr = multistate_privsep;
  		goto parse_multistate;
  
@@ -71,7 +71,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
  	case sAllowUsers:
  		while ((arg = strdelim(&cp)) && *arg != '\0') {
  			if (options->num_allow_users >= MAX_ALLOW_USERS)
-@@ -1956,6 +1965,7 @@ dump_config(ServerOptions *o)
+@@ -1950,6 +1959,7 @@ dump_config(ServerOptions *o)
  	dump_cfg_fmtint(sUseLogin, o->use_login);
  	dump_cfg_fmtint(sCompression, o->compression);
  	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
@@ -79,10 +79,10 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
  	dump_cfg_fmtint(sUseDNS, o->use_dns);
  	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
  	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
-diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h
---- openssh-6.1p1/servconf.h.vendor	2012-09-14 20:36:49.125085009 +0200
-+++ openssh-6.1p1/servconf.h	2012-09-14 20:36:49.564088168 +0200
-@@ -140,6 +140,7 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.vendor openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.vendor	2013-01-09 05:56:45.000000000 +0100
++++ openssh-6.2p1/servconf.h	2013-03-25 19:34:01.379495831 +0100
+@@ -147,6 +147,7 @@ typedef struct {
  	int	max_authtries;
  	int	max_sessions;
  	char   *banner;			/* SSH-2 banner message */
@@ -90,21 +90,21 @@ diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h
  	int	use_dns;
  	int	client_alive_interval;	/*
  					 * poke the client this often to
-diff -up openssh-6.1p1/sshd_config.vendor openssh-6.1p1/sshd_config
---- openssh-6.1p1/sshd_config.vendor	2012-09-14 20:36:49.507087759 +0200
-+++ openssh-6.1p1/sshd_config	2012-09-14 20:36:49.565088175 +0200
-@@ -114,6 +114,7 @@ UsePrivilegeSeparation sandbox		# Defaul
+diff -up openssh-6.2p1/sshd_config.vendor openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.vendor	2013-03-25 19:34:01.380495837 +0100
++++ openssh-6.2p1/sshd_config	2013-03-25 19:44:43.471296362 +0100
+@@ -118,6 +118,7 @@ UsePrivilegeSeparation sandbox		# Defaul
  #Compression delayed
  #ClientAliveInterval 0
  #ClientAliveCountMax 3
 +#ShowPatchLevel no
  #UseDNS yes
  #PidFile /var/run/sshd.pid
- #MaxStartups 10
-diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0
---- openssh-6.1p1/sshd_config.0.vendor	2012-09-14 20:36:49.510087780 +0200
-+++ openssh-6.1p1/sshd_config.0	2012-09-14 20:36:49.567088190 +0200
-@@ -558,6 +558,11 @@ DESCRIPTION
+ #MaxStartups 10:30:100
+diff -up openssh-6.2p1/sshd_config.0.vendor openssh-6.2p1/sshd_config.0
+--- openssh-6.2p1/sshd_config.0.vendor	2013-03-25 19:34:01.361495716 +0100
++++ openssh-6.2p1/sshd_config.0	2013-03-25 19:34:01.381495844 +0100
+@@ -595,6 +595,11 @@ DESCRIPTION
               Defines the number of bits in the ephemeral protocol version 1
               server key.  The minimum value is 512, and the default is 1024.
  
@@ -116,10 +116,10 @@ diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0
       StrictModes
               Specifies whether sshd(8) should check file modes and ownership
               of the user's files and home directory before accepting login.
-diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5
---- openssh-6.1p1/sshd_config.5.vendor	2012-09-14 20:36:49.512087794 +0200
-+++ openssh-6.1p1/sshd_config.5	2012-09-14 20:36:49.568088198 +0200
-@@ -978,6 +978,14 @@ This option applies to protocol version
+diff -up openssh-6.2p1/sshd_config.5.vendor openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.vendor	2013-03-25 19:34:01.362495722 +0100
++++ openssh-6.2p1/sshd_config.5	2013-03-25 19:34:01.382495850 +0100
+@@ -1019,6 +1019,14 @@ This option applies to protocol version
  .It Cm ServerKeyBits
  Defines the number of bits in the ephemeral protocol version 1 server key.
  The minimum value is 512, and the default is 1024.
@@ -134,10 +134,10 @@ diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5
  .It Cm StrictModes
  Specifies whether
  .Xr sshd 8
-diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.vendor	2012-09-14 20:36:49.399086981 +0200
-+++ openssh-6.1p1/sshd.c	2012-09-14 20:47:30.696088744 +0200
-@@ -433,7 +433,7 @@ sshd_exchange_identification(int sock_in
+diff -up openssh-6.2p1/sshd.c.vendor openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.vendor	2013-03-25 19:34:01.332495531 +0100
++++ openssh-6.2p1/sshd.c	2013-03-25 19:44:11.864112092 +0100
+@@ -442,7 +442,7 @@ sshd_exchange_identification(int sock_in
  	}
  
  	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -146,13 +146,13 @@ diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c
  	    *options.version_addendum == '\0' ? "" : " ",
  	    options.version_addendum, newline);
  
-@@ -1635,7 +1635,8 @@ main(int ac, char **av)
+@@ -1675,7 +1675,8 @@ main(int ac, char **av)
  		exit(1);
  	}
  
--	debug("sshd version %.100s", SSH_RELEASE);
-+	debug("sshd version %.100s",
-+	      (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE);
+-	debug("sshd version %s, %s", SSH_VERSION,
++	debug("sshd version %s, %s",
++	    (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
+ 	    SSLeay_version(SSLEAY_VERSION));
  
  	/* Store privilege separation user for later use if required. */
- 	if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
diff --git a/openssh-nukeacss.sh b/openssh-nukeacss.sh
deleted file mode 100755
index ecb90f3..0000000
--- a/openssh-nukeacss.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh
-#
-#  Remove the ACSS implementation from OpenSSH, and disable its use so that the
-#  rest of the package can still be built.
-#
-> acss.c
-patch -sp0 << EOF
---- cipher.c.orig       2005-07-17 09:02:10.000000000 +0200
-+++ cipher.c    2005-09-06 14:52:06.000000000 +0200
-@@ -45,6 +45,9 @@
-
- /* compatibility with old or broken OpenSSL versions */
- #include "openbsd-compat/openssl-compat.h"
-+#undef USE_CIPHER_ACSS
-+#undef EVP_acss
-+#define EVP_acss NULL
-
- extern const EVP_CIPHER *evp_ssh1_bf(void);
- extern const EVP_CIPHER *evp_ssh1_3des(void);
-EOF
-echo "Well done."
diff --git a/openssh.spec b/openssh.spec
index 1cca739..924aabc 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -66,10 +66,10 @@
 %endif
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%define openssh_ver 6.1p1
-%define openssh_rel 7
+%define openssh_ver 6.2p1
+%define openssh_rel 1
 %define pam_ssh_agent_ver 0.9.3
-%define pam_ssh_agent_rel 3
+%define pam_ssh_agent_rel 4
 
 Summary: An open source implementation of SSH protocol versions 1 and 2
 Name: openssh
@@ -82,8 +82,7 @@ URL: http://www.openssh.com/portable.html
 # This package differs from the upstream OpenSSH tarball in that
 # the ACSS cipher is removed by running openssh-nukeacss.sh in
 # the unpacked source directory.
-Source0: openssh-%{version}-noacss.tar.bz2
-Source1: openssh-nukeacss.sh
+Source0: openssh-%{version}.tar.gz
 Source2: sshd.pam
 Source3: sshd.init
 Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
@@ -100,9 +99,9 @@ Source13: sshd-keygen
 Patch0: openssh-5.9p1-wIm.patch
 
 #?
-Patch100: openssh-6.1p1-coverity.patch
+Patch100: openssh-6.2p1-coverity.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1872
-Patch101: openssh-5.8p1-fingerprint.patch
+Patch101: openssh-6.2p1-fingerprint.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1894
 #https://bugzilla.redhat.com/show_bug.cgi?id=735889
 Patch102: openssh-5.8p1-getaddrinfo.patch
@@ -114,15 +113,15 @@ Patch104: openssh-6.1p1-authenticationmethods.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1402
 Patch200: openssh-5.8p1-audit0.patch
 # -"-
-Patch201: openssh-6.0p1-audit1.patch
+Patch201: openssh-6.2p1-audit1.patch
 # -"-
 Patch202: openssh-5.9p1-audit2.patch
 # -"-
-Patch203: openssh-5.9p1-audit3.patch
+Patch203: openssh-6.2p1-audit3.patch
 # -"-
-Patch204: openssh-6.1p1-audit4.patch
+Patch204: openssh-6.2p1-audit4.patch
 # -"-
-Patch205: openssh-6.0p1-audit5.patch
+Patch205: openssh-6.2p1-audit5.patch
 
 # --- pam_ssh-agent ---
 # make it build reusing the openssh sources
@@ -132,7 +131,7 @@ Patch301: pam_ssh_agent_auth-0.9.2-seteuid.patch
 # explicitly make pam callbacks visible
 Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
-Patch400: openssh-6.1p1-role-mls.patch
+Patch400: openssh-6.2p1-role-mls.patch
 #?
 #Patch402: openssh-5.9p1-sftp-chroot.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1940
@@ -143,9 +142,9 @@ Patch404: openssh-6.1p1-privsep-selinux.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1663
 Patch500: openssh-6.1p1-akc.patch
 #?-- unwanted child :(
-Patch501: openssh-6.0p1-ldap.patch
+Patch501: openssh-6.2p1-ldap.patch
 #?
-Patch502: openssh-5.9p1-keycat.patch
+Patch502: openssh-6.2p1-keycat.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1668
 #Patch600: openssh-5.9p1-keygen.patch
@@ -169,7 +168,7 @@ Patch608: openssh-6.1p1-askpass-ld.patch
 Patch609: openssh-5.5p1-x11.patch
 
 #?
-Patch700: openssh-5.9p1-fips.patch
+Patch700: openssh-6.2p1-fips.patch
 #?
 Patch701: openssh-5.6p1-exit-deadlock.patch
 #?
@@ -185,9 +184,9 @@ Patch706: openssh-5.8p1-localdomain.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
 Patch707: openssh-6.1p1-redhat.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)
-Patch708: openssh-6.0p1-entropy.patch
+Patch708: openssh-6.2p1-entropy.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)
-Patch709: openssh-6.1p1-vendor.patch
+Patch709: openssh-6.2p1-vendor.patch
 #?
 Patch710: openssh-5.9p1-copy-id-restorecon.patch
 # warn users for unsupported UsePAM=no (#757545)
@@ -195,17 +194,17 @@ Patch711: openssh-6.1p1-log-usepam-no.patch
 # make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL
 Patch712: openssh-5.9p1-ctr-evp-fast.patch
 # add cavs test binary for the aes-ctr
-Patch713: openssh-5.9p1-ctr-cavstest.patch
+Patch713: openssh-6.2p1-ctr-cavstest.patch
 
 
 #http://www.sxw.org.uk/computing/patches/openssh.html
 #changed cache storage type - #848228
-Patch800: openssh-6.1p1-gsskex.patch
+Patch800: openssh-6.2p1-gsskex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
-Patch801: openssh-5.8p2-force_krb.patch
+Patch801: openssh-6.2p1-force_krb.patch
 Patch900: openssh-6.1p1-gssapi-canohost.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1780
-Patch901: openssh-6.1p1-kuserok.patch
+Patch901: openssh-6.2p1-kuserok.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=841065
 Patch902: openssh-6.1p1-man-moduli.patch
 # obsolete RequiredAuthentications options
@@ -393,7 +392,7 @@ The module is most useful for su and sudo service stacks.
 %patch101 -p1 -b .fingerprint
 %patch102 -p1 -b .getaddrinfo
 %patch103 -p1 -b .packet
-%patch104 -p1 -b .authenticationmethods
+# %patch104 -p1 -b .authenticationmethods
 
 %patch200 -p1 -b .audit0
 %patch201 -p1 -b .audit1
@@ -414,18 +413,18 @@ popd
 
 %if %{WITH_SELINUX}
 %patch400 -p1 -b .role-mls
-#%patch402 -p1 -b .sftp-chroot
-#%patch403 -p1 -b .sesandbox
+# %patch402 -p1 -b .sftp-chroot
+# %patch403 -p1 -b .sesandbox
 %patch404 -p1 -b .privsep-selinux
 %endif
 
-%patch500 -p1 -b .akc
+# %patch500 -p1 -b .akc
 %if %{ldap}
 %patch501 -p1 -b .ldap
 %endif
 %patch502 -p1 -b .keycat
 
-#%patch600 -p1 -b .keygen
+# %patch600 -p1 -b .keygen
 %patch601 -p1 -b .ip-opts
 %patch602 -p1 -b .randclean
 %patch603 -p1 -b .glob
@@ -446,7 +445,7 @@ popd
 %patch707 -p1 -b .redhat
 %patch708 -p1 -b .entropy
 %patch709 -p1 -b .vendor
-%patch710 -p1 -b .restorecon
+# %patch710 -p1 -b .restorecon
 %patch711 -p1 -b .log-usepam-no
 %patch712 -p1 -b .evp-ctr
 %patch713 -p1 -b .ctr-cavs
@@ -456,9 +455,9 @@ popd
 
 %patch900 -p1 -b .canohost
 %patch901 -p1 -b .kuserok
-%patch902 -p1 -b .man-moduli
-%patch903 -p1 -b .required-authentication
-%patch904 -p1 -b .max-startups
+# %patch902 -p1 -b .man-moduli
+# %patch903 -p1 -b .required-authentication
+# %patch904 -p1 -b .max-startups
 
 %if 0
 # Nothing here yet
diff --git a/sources b/sources
index b4df87f..ea348d1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
-9872ca1983e566ff5a89c240529e223d  pam_ssh_agent_auth-0.9.3.tar.bz2
-688b37a843ea1c9217f45b1f5c21b791  openssh-6.1p1-noacss.tar.bz2
+7b2d9dd75b5cf267ea1737ec75500316  openssh-6.2p1.tar.gz