rebase to openssh-6.2p1 (#924727)

ACSS was removed from upstream sources
2013-04-04 16:42:32 +02:00 · 2013-04-04 16:42:32 +02:00 · 8a29dedfa7
commit 8a29dedfa7
parent 811ec1dd36
20 changed files with 1141 additions and 1151 deletions
--- a/.gitignore
+++ b/.gitignore
@ -8,3 +8,4 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
 /pam_ssh_agent_auth-0.9.3.tar.bz2
 /openssh-6.0p1-noacss.tar.bz2
 /openssh-6.1p1-noacss.tar.bz2
+/openssh-6.2p1.tar.gz
--- a/openssh-6.2p1-audit1.patch
+++ b/openssh-6.2p1-audit1.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/audit-bsm.c.audit1 openssh-6.0p1/audit-bsm.c
--- openssh-6.0p1/audit-bsm.c.audit1	2012-02-24 00:40:43.000000000 +0100
-+++ openssh-6.0p1/audit-bsm.c	2012-08-06 20:33:24.416382804 +0200
+diff -up openssh-6.2p1/audit-bsm.c.audit1 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit1	2012-02-24 00:40:43.000000000 +0100
+++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:18:30.934758118 +0100
@@ -375,10 +375,23 @@ audit_connection_from(const char *host,
 #endif
 }
@ -26,9 +26,9 @@ diff -up openssh-6.0p1/audit-bsm.c.audit1 openssh-6.0p1/audit-bsm.c
 }
 
 void
-diff -up openssh-6.0p1/audit.c.audit1 openssh-6.0p1/audit.c
--- openssh-6.0p1/audit.c.audit1	2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit.c	2012-08-06 20:33:24.417382801 +0200
+diff -up openssh-6.2p1/audit.c.audit1 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit1	2011-01-17 11:15:30.000000000 +0100
+++ openssh-6.2p1/audit.c	2013-03-25 17:18:30.934758118 +0100
@@ -140,6 +140,17 @@ audit_event(ssh_audit_event_t event)
 }
 
@ -79,9 +79,9 @@ diff -up openssh-6.0p1/audit.c.audit1 openssh-6.0p1/audit.c
 +
 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/audit.h.audit1 openssh-6.0p1/audit.h
--- openssh-6.0p1/audit.h.audit1	2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit.h	2012-08-06 20:33:24.417382801 +0200
+diff -up openssh-6.2p1/audit.h.audit1 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit1	2011-01-17 11:15:30.000000000 +0100
+++ openssh-6.2p1/audit.h	2013-03-25 17:18:30.934758118 +0100
@@ -49,9 +49,11 @@ typedef enum ssh_audit_event_type ssh_au
 
 void	audit_connection_from(const char *, int);
@ -95,9 +95,9 @@ diff -up openssh-6.0p1/audit.h.audit1 openssh-6.0p1/audit.h
 ssh_audit_event_t audit_classify_auth(const char *);
 
 #endif /* _SSH_AUDIT_H */
-diff -up openssh-6.0p1/audit-linux.c.audit1 openssh-6.0p1/audit-linux.c
--- openssh-6.0p1/audit-linux.c.audit1	2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit-linux.c	2012-08-06 20:33:24.416382804 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit1 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit1	2011-01-17 11:15:30.000000000 +0100
+++ openssh-6.2p1/audit-linux.c	2013-03-25 17:18:30.934758118 +0100
@@ -35,13 +35,20 @@
 
 #include "log.h"
@ -313,9 +313,9 @@ diff -up openssh-6.0p1/audit-linux.c.audit1 openssh-6.0p1/audit-linux.c
 		break;
 
 	default:
-diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
--- openssh-6.0p1/monitor.c.audit1	2012-08-06 20:33:24.410382828 +0200
-+++ openssh-6.0p1/monitor.c	2012-08-06 20:33:24.418382797 +0200
+diff -up openssh-6.2p1/monitor.c.audit1 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit1	2013-03-25 17:18:30.913757986 +0100
+++ openssh-6.2p1/monitor.c	2013-03-25 17:18:30.935758124 +0100
@@ -185,6 +185,7 @@ int mm_answer_gss_checkmic(int, Buffer *
 #ifdef SSH_AUDIT_EVENTS
 int mm_answer_audit_event(int, Buffer *);
@ -340,7 +340,7 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -1427,6 +1430,12 @@ mm_session_close(Session *s)
+@@ -1433,6 +1436,12 @@ mm_session_close(Session *s)
 		debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
 		session_pty_cleanup2(s);
 	}
@ -353,7 +353,7 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
 	session_unused(s->self);
 }
 
-@@ -1751,11 +1760,44 @@ mm_answer_audit_command(int socket, Buff
+@@ -1755,11 +1764,44 @@ mm_answer_audit_command(int socket, Buff
 {
 	u_int len;
 	char *cmd;
@ -399,21 +399,24 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
 	xfree(cmd);
 	return (0);
 }
-diff -up openssh-6.0p1/monitor.h.audit1 openssh-6.0p1/monitor.h
--- openssh-6.0p1/monitor.h.audit1	2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.0p1/monitor.h	2012-08-06 20:33:24.418382797 +0200
-@@ -60,6 +60,7 @@ enum monitor_reqtype {
- 	MONITOR_REQ_PAM_RESPOND, MONITOR_ANS_PAM_RESPOND,
- 	MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
- 	MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
-+	MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
--- openssh-6.0p1/monitor_wrap.c.audit1	2012-08-06 20:33:24.384382930 +0200
-+++ openssh-6.0p1/monitor_wrap.c	2012-08-06 20:33:24.419382793 +0200
-@@ -1188,10 +1188,11 @@ mm_audit_event(ssh_audit_event_t event)
+diff -up openssh-6.2p1/monitor.h.audit1 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit1	2013-03-25 17:18:30.935758124 +0100
+++ openssh-6.2p1/monitor.h	2013-03-25 17:24:53.474078078 +0100
+@@ -68,7 +68,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
+ 	MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
+ 	MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+-	MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
+	MONITOR_REQ_AUDIT_EVENT = 112,
+	MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+	MONITOR_REQ_AUDIT_END_COMMAND = 116
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit1 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit1	2013-03-25 17:18:30.913757986 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:18:30.936758131 +0100
+@@ -1189,10 +1189,11 @@ mm_audit_event(ssh_audit_event_t event)
 	buffer_free(&m);
 }
 
@ -426,7 +429,7 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
 
 	debug3("%s entering command %s", __func__, command);
 
-@@ -1199,6 +1200,26 @@ mm_audit_run_command(const char *command
+@@ -1200,6 +1201,26 @@ mm_audit_run_command(const char *command
 	buffer_put_cstring(&m, command);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
@ -453,9 +456,9 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
 	buffer_free(&m);
 }
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor_wrap.h.audit1 openssh-6.0p1/monitor_wrap.h
--- openssh-6.0p1/monitor_wrap.h.audit1	2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.0p1/monitor_wrap.h	2012-08-06 20:33:24.419382793 +0200
+diff -up openssh-6.2p1/monitor_wrap.h.audit1 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit1	2011-06-20 06:42:23.000000000 +0200
+++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:18:30.936758131 +0100
@@ -74,7 +74,8 @@ void mm_sshpam_free_ctx(void *);
 #ifdef SSH_AUDIT_EVENTS
 #include "audit.h"
@ -466,10 +469,10 @@ diff -up openssh-6.0p1/monitor_wrap.h.audit1 openssh-6.0p1/monitor_wrap.h
 #endif
 
 struct Session;
-diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
--- openssh-6.0p1/session.c.audit1	2011-11-04 00:55:24.000000000 +0100
-+++ openssh-6.0p1/session.c	2012-08-06 20:33:24.420382789 +0200
-@@ -742,6 +742,14 @@ do_exec_pty(Session *s, const char *comm
+diff -up openssh-6.2p1/session.c.audit1 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit1	2013-03-15 01:22:37.000000000 +0100
+++ openssh-6.2p1/session.c	2013-03-25 17:18:30.937758137 +0100
+@@ -745,6 +745,14 @@ do_exec_pty(Session *s, const char *comm
 	/* Parent.  Close the slave side of the pseudo tty. */
 	close(ttyfd);
 
@ -484,7 +487,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 	/* Enter interactive session. */
 	s->ptymaster = ptymaster;
 	packet_set_interactive(1, 
-@@ -813,15 +821,19 @@ do_exec(Session *s, const char *command)
+@@ -816,15 +824,19 @@ do_exec(Session *s, const char *command)
 	}
 
 #ifdef SSH_AUDIT_EVENTS
@ -506,7 +509,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 #endif
 	if (s->ttyfd != -1)
 		ret = do_exec_pty(s, command);
-@@ -1848,6 +1860,7 @@ session_unused(int id)
+@@ -1856,6 +1868,7 @@ session_unused(int id)
 	sessions[id].ttyfd = -1;
 	sessions[id].ptymaster = -1;
 	sessions[id].x11_chanids = NULL;
@ -514,7 +517,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 	sessions[id].next_unused = sessions_first_unused;
 	sessions_first_unused = id;
 }
-@@ -1930,6 +1943,19 @@ session_open(Authctxt *authctxt, int cha
+@@ -1938,6 +1951,19 @@ session_open(Authctxt *authctxt, int cha
 }
 
 Session *
@ -534,7 +537,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 session_by_tty(char *tty)
 {
 	int i;
-@@ -2455,6 +2481,30 @@ session_exit_message(Session *s, int sta
+@@ -2463,6 +2489,30 @@ session_exit_message(Session *s, int sta
 		chan_write_failed(c);
 }
 
@ -565,7 +568,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 void
 session_close(Session *s)
 {
-@@ -2463,6 +2513,10 @@ session_close(Session *s)
+@@ -2471,6 +2521,10 @@ session_close(Session *s)
 	debug("session_close: session %d pid %ld", s->self, (long)s->pid);
 	if (s->ttyfd != -1)
 		session_pty_cleanup(s);
@ -576,7 +579,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 	if (s->term)
 		xfree(s->term);
 	if (s->display)
-@@ -2682,6 +2736,15 @@ do_authenticated2(Authctxt *authctxt)
+@@ -2690,6 +2744,15 @@ do_authenticated2(Authctxt *authctxt)
 	server_loop2(authctxt);
 }
 
@ -592,16 +595,16 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
 void
 do_cleanup(Authctxt *authctxt)
 {
-@@ -2730,5 +2793,5 @@ do_cleanup(Authctxt *authctxt)
+@@ -2738,5 +2801,5 @@ do_cleanup(Authctxt *authctxt)
 	 * or if running in monitor.
 	 */
 	if (!use_privsep || mm_is_monitor())
 -		session_destroy_all(session_pty_cleanup2);
 +		session_destroy_all(do_cleanup_one_session);
 }
-diff -up openssh-6.0p1/session.h.audit1 openssh-6.0p1/session.h
--- openssh-6.0p1/session.h.audit1	2008-05-19 07:34:50.000000000 +0200
-+++ openssh-6.0p1/session.h	2012-08-06 20:33:24.420382789 +0200
+diff -up openssh-6.2p1/session.h.audit1 openssh-6.2p1/session.h
+--- openssh-6.2p1/session.h.audit1	2008-05-19 07:34:50.000000000 +0200
+++ openssh-6.2p1/session.h	2013-03-25 17:18:30.937758137 +0100
@@ -60,6 +60,12 @@ struct Session {
 		char	*name;
 		char	*val;
@ -626,10 +629,10 @@ diff -up openssh-6.0p1/session.h.audit1 openssh-6.0p1/session.h
 Session	*session_by_tty(char *);
 void	 session_close(Session *);
 void	 do_setusercontext(struct passwd *);
-diff -up openssh-6.0p1/sshd.c.audit1 openssh-6.0p1/sshd.c
--- openssh-6.0p1/sshd.c.audit1	2012-08-06 20:33:24.392382898 +0200
-+++ openssh-6.0p1/sshd.c	2012-08-06 20:33:24.421382785 +0200
-@@ -2381,7 +2381,8 @@ cleanup_exit(int i)
+diff -up openssh-6.2p1/sshd.c.audit1 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit1	2013-03-25 17:18:30.919758024 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 17:18:30.937758137 +0100
+@@ -2409,7 +2409,8 @@ cleanup_exit(int i)
 	}
 #ifdef SSH_AUDIT_EVENTS
 	/* done after do_cleanup so it can cancel the PAM auth 'thread' */
--- a/openssh-6.2p1-audit3.patch
+++ b/openssh-6.2p1-audit3.patch
@ -1,19 +1,7 @@
-diff -up openssh-5.9p1/Makefile.in.audit3 openssh-5.9p1/Makefile.in
--- openssh-5.9p1/Makefile.in.audit3	2011-08-05 22:15:18.000000000 +0200
-+++ openssh-5.9p1/Makefile.in	2011-09-14 07:05:58.337520327 +0200
-@@ -71,7 +71,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
- 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
- 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
-	schnorr.o ssh-pkcs11.o
-+	schnorr.o ssh-pkcs11.o auditstub.o
- 
- SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
- 	sshconnect.o sshconnect1.o sshconnect2.o mux.o \
-diff -up openssh-5.9p1/audit-bsm.c.audit3 openssh-5.9p1/audit-bsm.c
--- openssh-5.9p1/audit-bsm.c.audit3	2011-09-14 07:05:56.719459048 +0200
-+++ openssh-5.9p1/audit-bsm.c	2011-09-14 07:05:58.430520147 +0200
-@@ -396,4 +396,16 @@ audit_event(ssh_audit_event_t event)
+diff -up openssh-6.2p1/audit-bsm.c.audit3 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit3	2013-03-25 17:30:41.329102631 +0100
+++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:30:41.338102682 +0100
+@@ -473,4 +473,16 @@ audit_event(ssh_audit_event_t event)
 		debug("%s: unhandled event %d", __func__, event);
 	}
 }
@ -30,9 +18,88 @@ diff -up openssh-5.9p1/audit-bsm.c.audit3 openssh-5.9p1/audit-bsm.c
 +	/* not implemented */
 +}
 #endif /* BSM */
-diff -up openssh-5.9p1/audit-linux.c.audit3 openssh-5.9p1/audit-linux.c
--- openssh-5.9p1/audit-linux.c.audit3	2011-09-14 07:05:56.820460613 +0200
-+++ openssh-5.9p1/audit-linux.c	2011-09-14 07:07:29.651459660 +0200
+diff -up openssh-6.2p1/audit.c.audit3 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit3	2013-03-25 17:30:41.330102636 +0100
+++ openssh-6.2p1/audit.c	2013-03-25 17:30:41.339102688 +0100
+@@ -28,6 +28,7 @@
+ 
+ #include <stdarg.h>
+ #include <string.h>
+#include <unistd.h>
+ 
+ #ifdef SSH_AUDIT_EVENTS
+ 
+@@ -36,6 +37,8 @@
+ #include "key.h"
+ #include "hostfile.h"
+ #include "auth.h"
+#include "ssh-gss.h"
+#include "monitor_wrap.h"
+ #include "xmalloc.h"
+ 
+ /*
+@@ -128,6 +131,18 @@ audit_key(int host_user, int *rv, const
+ 	xfree(fp);
+ }
+ 
+void
+audit_unsupported(int what)
+{
+	PRIVSEP(audit_unsupported_body(what));
+}
+
+void
+audit_kex(int ctos, char *enc, char *mac, char *comp)
+{
+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
+}
+
+ # ifndef CUSTOM_SSH_AUDIT_EVENTS
+ /*
+  * Null implementations of audit functions.
+@@ -238,5 +253,26 @@ audit_keyusage(int host_user, const char
+ 		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,
+ 		key_fingerprint_prefix(), fp, rv);
+ }
+
+/*
+ * This will be called when the protocol negotiation fails.
+ */
+void
+audit_unsupported_body(int what)
+{
+	debug("audit unsupported protocol euid %d type %d", geteuid(), what);
+}
+
+/*
+ * This will be called on succesfull protocol negotiation.
+ */
+void
+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
+	       uid_t uid)
+{
+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
+		(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
+	        (unsigned)uid);
+}
+ # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
+ #endif /* SSH_AUDIT_EVENTS */
+diff -up openssh-6.2p1/audit.h.audit3 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit3	2013-03-25 17:30:41.330102636 +0100
+++ openssh-6.2p1/audit.h	2013-03-25 17:30:41.339102688 +0100
+@@ -58,5 +58,9 @@ void 	audit_end_command(int, const char
+ ssh_audit_event_t audit_classify_auth(const char *);
+ int	audit_keyusage(int, const char *, unsigned, char *, int);
+ void	audit_key(int, int *, const Key *);
+void	audit_unsupported(int);
+void	audit_kex(int, char *, char *, char *);
+void	audit_unsupported_body(int);
+void	audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
+ 
+ #endif /* _SSH_AUDIT_H */
+diff -up openssh-6.2p1/audit-linux.c.audit3 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit3	2013-03-25 17:30:41.331102642 +0100
+++ openssh-6.2p1/audit-linux.c	2013-03-25 17:30:41.339102688 +0100
@@ -40,6 +40,8 @@
 #include "auth.h"
 #include "servconf.h"
@ -103,88 +170,9 @@ diff -up openssh-5.9p1/audit-linux.c.audit3 openssh-5.9p1/audit-linux.c
 +}
 +
 #endif /* USE_LINUX_AUDIT */
-diff -up openssh-5.9p1/audit.c.audit3 openssh-5.9p1/audit.c
--- openssh-5.9p1/audit.c.audit3	2011-09-14 07:05:56.937585272 +0200
-+++ openssh-5.9p1/audit.c	2011-09-14 07:05:58.646521393 +0200
-@@ -28,6 +28,7 @@
- 
- #include <stdarg.h>
- #include <string.h>
-+#include <unistd.h>
- 
- #ifdef SSH_AUDIT_EVENTS
- 
-@@ -36,6 +37,8 @@
- #include "key.h"
- #include "hostfile.h"
- #include "auth.h"
-+#include "ssh-gss.h"
-+#include "monitor_wrap.h"
- #include "xmalloc.h"
- 
- /*
-@@ -128,6 +131,18 @@ audit_key(int host_user, int *rv, const
- 	xfree(fp);
- }
- 
-+void
-+audit_unsupported(int what)
-+{
-+	PRIVSEP(audit_unsupported_body(what));
-+}
-+
-+void
-+audit_kex(int ctos, char *enc, char *mac, char *comp)
-+{
-+	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
-+}
-+
- # ifndef CUSTOM_SSH_AUDIT_EVENTS
- /*
-  * Null implementations of audit functions.
-@@ -238,5 +253,26 @@ audit_keyusage(int host_user, const char
- 		host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits,
- 		key_fingerprint_prefix(), fp, rv);
- }
-+
-+/*
-+ * This will be called when the protocol negotiation fails.
-+ */
-+void
-+audit_unsupported_body(int what)
-+{
-+	debug("audit unsupported protocol euid %d type %d", geteuid(), what);
-+}
-+
-+/*
-+ * This will be called on succesfull protocol negotiation.
-+ */
-+void
-+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
-+	       uid_t uid)
-+{
-+	debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s from pid %ld uid %u",
-+		(unsigned)geteuid(), ctos, enc, mac, compress, (long)pid,
-+	        (unsigned)uid);
-+}
- # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
- #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/audit.h.audit3 openssh-5.9p1/audit.h
--- openssh-5.9p1/audit.h.audit3	2011-09-14 07:05:57.391522394 +0200
-+++ openssh-5.9p1/audit.h	2011-09-14 07:05:58.766586362 +0200
-@@ -58,5 +58,9 @@ void 	audit_end_command(int, const char
- ssh_audit_event_t audit_classify_auth(const char *);
- int	audit_keyusage(int, const char *, unsigned, char *, int);
- void	audit_key(int, int *, const Key *);
-+void	audit_unsupported(int);
-+void	audit_kex(int, char *, char *, char *);
-+void	audit_unsupported_body(int);
-+void	audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
- 
- #endif /* _SSH_AUDIT_H */
-diff -up openssh-5.9p1/auditstub.c.audit3 openssh-5.9p1/auditstub.c
--- openssh-5.9p1/auditstub.c.audit3	2011-09-14 07:05:58.866461077 +0200
-+++ openssh-5.9p1/auditstub.c	2011-09-14 07:05:58.870569033 +0200
+diff -up openssh-6.2p1/auditstub.c.audit3 openssh-6.2p1/auditstub.c
+--- openssh-6.2p1/auditstub.c.audit3	2013-03-25 17:30:41.340102694 +0100
+++ openssh-6.2p1/auditstub.c	2013-03-25 17:30:41.340102694 +0100
@@ -0,0 +1,39 @@
 +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
 +
@ -225,30 +213,32 @@ diff -up openssh-5.9p1/auditstub.c.audit3 openssh-5.9p1/auditstub.c
 +{
 +}
 +
-diff -up openssh-5.9p1/cipher.c.audit3 openssh-5.9p1/cipher.c
--- openssh-5.9p1/cipher.c.audit3	2011-09-07 15:05:09.000000000 +0200
-+++ openssh-5.9p1/cipher.c	2011-09-14 07:05:58.955582581 +0200
-@@ -60,15 +60,7 @@ extern void ssh1_3des_iv(EVP_CIPHER_CTX
- extern const EVP_CIPHER *evp_aes_128_ctr(void);
- extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+diff -up openssh-6.2p1/cipher.c.audit3 openssh-6.2p1/cipher.c
+--- openssh-6.2p1/cipher.c.audit3	2013-03-25 17:30:41.340102694 +0100
+++ openssh-6.2p1/cipher.c	2013-03-25 17:32:33.117743548 +0100
+@@ -58,17 +58,7 @@ extern const EVP_CIPHER *evp_ssh1_bf(voi
+ extern const EVP_CIPHER *evp_ssh1_3des(void);
+ extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
 
 -struct Cipher {
 -	char	*name;
 -	int	number;		/* for ssh1 only */
 -	u_int	block_size;
 -	u_int	key_len;
+-	u_int	iv_len;		/* defaults to block_size */
+-	u_int	auth_len;
 -	u_int	discard_len;
 -	u_int	cbc_mode;
 -	const EVP_CIPHER	*(*evptype)(void);
 -} ciphers[] = {
 +struct Cipher ciphers[] = {
- 	{ "none",		SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
- 	{ "des",		SSH_CIPHER_DES, 8, 8, 0, 1, EVP_des_cbc },
- 	{ "3des",		SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
-diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
--- openssh-5.9p1/cipher.h.audit3	2009-01-28 06:38:41.000000000 +0100
-+++ openssh-5.9p1/cipher.h	2011-09-14 07:05:59.063459363 +0200
-@@ -61,7 +61,16 @@
+ 	{ "none",	SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+ 	{ "des",	SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
+ 	{ "3des",	SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+diff -up openssh-6.2p1/cipher.h.audit3 openssh-6.2p1/cipher.h
+--- openssh-6.2p1/cipher.h.audit3	2013-03-25 17:30:41.341102699 +0100
+++ openssh-6.2p1/cipher.h	2013-03-25 17:32:45.338813408 +0100
+@@ -61,7 +61,18 @@
 typedef struct Cipher Cipher;
 typedef struct CipherContext CipherContext;
 
@ -258,6 +248,8 @@ diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
 +	int	number;		/* for ssh1 only */
 +	u_int	block_size;
 +	u_int	key_len;
+	u_int	iv_len;		/* defaults to block_size */
+	u_int	auth_len;
 +	u_int	discard_len;
 +	u_int	cbc_mode;
 +	const EVP_CIPHER	*(*evptype)(void);
@ -265,10 +257,10 @@ diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
 +
 struct CipherContext {
 	int	plaintext;
- 	EVP_CIPHER_CTX evp;
-diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
--- openssh-5.9p1/kex.c.audit3	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.9p1/kex.c	2011-09-14 07:05:59.171457800 +0200
+ 	int	encrypt;
+diff -up openssh-6.2p1/kex.c.audit3 openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.audit3	2013-01-09 06:12:19.000000000 +0100
+++ openssh-6.2p1/kex.c	2013-03-25 17:33:40.352129450 +0100
@@ -49,6 +49,7 @@
 #include "dispatch.h"
 #include "monitor.h"
@ -277,7 +269,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
 
 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
 # if defined(HAVE_EVP_SHA256)
-@@ -286,9 +287,13 @@ static void
+@@ -296,9 +297,13 @@ static void
 choose_enc(Enc *enc, char *client, char *server)
 {
 	char *name = match_list(client, server, NULL);
@ -292,7 +284,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
 	if ((enc->cipher = cipher_by_name(name)) == NULL)
 		fatal("matching cipher is not supported: %s", name);
 	enc->name = name;
-@@ -303,9 +308,13 @@ static void
+@@ -314,9 +319,13 @@ static void
 choose_mac(Mac *mac, char *client, char *server)
 {
 	char *name = match_list(client, server, NULL);
@ -307,7 +299,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
 	if (mac_setup(mac, name) < 0)
 		fatal("unsupported mac %s", name);
 	/* truncate the key */
-@@ -320,8 +329,12 @@ static void
+@@ -331,8 +340,12 @@ static void
 choose_comp(Comp *comp, char *client, char *server)
 {
 	char *name = match_list(client, server, NULL);
@ -321,9 +313,9 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
 	if (strcmp(name, "zlib@openssh.com") == 0) {
 		comp->type = COMP_DELAYED;
 	} else if (strcmp(name, "zlib") == 0) {
-@@ -446,6 +459,9 @@ kex_choose_conf(Kex *kex)
+@@ -460,6 +473,9 @@ kex_choose_conf(Kex *kex)
 		    newkeys->enc.name,
- 		    newkeys->mac.name,
+ 		    authlen == 0 ? newkeys->mac.name : "<implicit>",
 		    newkeys->comp.name);
 +#ifdef SSH_AUDIT_EVENTS
 +		audit_kex(ctos, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name);
@ -331,9 +323,21 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
 	}
 	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
 	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
-diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
--- openssh-5.9p1/monitor.c.audit3	2011-09-14 07:05:57.952459820 +0200
-+++ openssh-5.9p1/monitor.c	2011-09-14 07:05:59.272520466 +0200
+diff -up openssh-6.2p1/Makefile.in.audit3 openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.audit3	2013-03-25 17:30:41.337102676 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-25 17:33:18.833004685 +0100
+@@ -73,7 +73,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
+ 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
+ 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+-	jpake.o schnorr.o ssh-pkcs11.o krl.o
+	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
+ 
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+ 	sshconnect.o sshconnect1.o sshconnect2.o mux.o \
+diff -up openssh-6.2p1/monitor.c.audit3 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit3	2013-03-25 17:30:41.333102653 +0100
+++ openssh-6.2p1/monitor.c	2013-03-25 17:30:41.344102717 +0100
@@ -97,6 +97,7 @@
 #include "ssh2.h"
 #include "jpake.h"
@ -342,7 +346,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 
 #ifdef GSSAPI
 static Gssctxt *gsscontext = NULL;
-@@ -187,6 +188,8 @@ int mm_answer_gss_checkmic(int, Buffer *
+@@ -186,6 +187,8 @@ int mm_answer_gss_checkmic(int, Buffer *
 int mm_answer_audit_event(int, Buffer *);
 int mm_answer_audit_command(int, Buffer *);
 int mm_answer_audit_end_command(int, Buffer *);
@ -360,7 +364,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 #endif
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -275,6 +280,8 @@ struct mon_table mon_dispatch_postauth20
+@@ -274,6 +279,8 @@ struct mon_table mon_dispatch_postauth20
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
     {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
     {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
@ -369,7 +373,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -306,6 +313,8 @@ struct mon_table mon_dispatch_proto15[]
+@@ -305,6 +312,8 @@ struct mon_table mon_dispatch_proto15[]
 #endif
 #ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@ -378,7 +382,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -318,6 +327,8 @@ struct mon_table mon_dispatch_postauth15
+@@ -317,6 +326,8 @@ struct mon_table mon_dispatch_postauth15
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
     {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
     {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
@ -387,7 +391,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -2383,3 +2394,47 @@ mm_answer_jpake_check_confirm(int sock,
+@@ -2397,3 +2408,47 @@ mm_answer_jpake_check_confirm(int sock,
 }
 
 #endif /* JPAKE */
@ -435,22 +439,24 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
 +}
 +
 +#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/monitor.h.audit3 openssh-5.9p1/monitor.h
--- openssh-5.9p1/monitor.h.audit3	2011-09-14 07:05:55.510580908 +0200
-+++ openssh-5.9p1/monitor.h	2011-09-14 07:05:59.378647273 +0200
-@@ -61,6 +61,8 @@ enum monitor_reqtype {
- 	MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
- 	MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
- 	MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
-+	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
-+	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-5.9p1/monitor_wrap.c.audit3 openssh-5.9p1/monitor_wrap.c
--- openssh-5.9p1/monitor_wrap.c.audit3	2011-09-14 07:05:58.059501118 +0200
-+++ openssh-5.9p1/monitor_wrap.c	2011-09-14 07:05:59.511503364 +0200
-@@ -1505,3 +1505,41 @@ mm_jpake_check_confirm(const BIGNUM *k,
+diff -up openssh-6.2p1/monitor.h.audit3 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit3	2013-03-25 17:30:41.345102722 +0100
+++ openssh-6.2p1/monitor.h	2013-03-25 17:31:57.314538661 +0100
+@@ -70,7 +70,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+ 	MONITOR_REQ_AUDIT_EVENT = 112,
+ 	MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+-	MONITOR_REQ_AUDIT_END_COMMAND = 116
+	MONITOR_REQ_AUDIT_END_COMMAND = 116,
+	MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit3 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit3	2013-03-25 17:30:41.334102659 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:30:41.346102728 +0100
+@@ -1486,3 +1486,41 @@ mm_jpake_check_confirm(const BIGNUM *k,
 	return success;
 }
 #endif /* JPAKE */
@ -492,10 +498,10 @@ diff -up openssh-5.9p1/monitor_wrap.c.audit3 openssh-5.9p1/monitor_wrap.c
 +	buffer_free(&m);
 +}
 +#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/monitor_wrap.h.audit3 openssh-5.9p1/monitor_wrap.h
--- openssh-5.9p1/monitor_wrap.h.audit3	2011-09-14 07:05:58.171521245 +0200
-+++ openssh-5.9p1/monitor_wrap.h	2011-09-14 07:05:59.624646515 +0200
-@@ -78,6 +78,8 @@ void mm_sshpam_free_ctx(void *);
+diff -up openssh-6.2p1/monitor_wrap.h.audit3 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit3	2013-03-25 17:30:41.334102659 +0100
+++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:30:41.346102728 +0100
+@@ -77,6 +77,8 @@ void mm_sshpam_free_ctx(void *);
 void mm_audit_event(ssh_audit_event_t);
 int mm_audit_run_command(const char *);
 void mm_audit_end_command(int, const char *);
@ -504,9 +510,9 @@ diff -up openssh-5.9p1/monitor_wrap.h.audit3 openssh-5.9p1/monitor_wrap.h
 #endif
 
 struct Session;
-diff -up openssh-5.9p1/sshd.c.audit3 openssh-5.9p1/sshd.c
--- openssh-5.9p1/sshd.c.audit3	2011-09-14 07:05:56.554583874 +0200
-+++ openssh-5.9p1/sshd.c	2011-09-14 07:05:59.828466112 +0200
+diff -up openssh-6.2p1/sshd.c.audit3 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit3	2013-03-25 17:30:41.326102613 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 17:30:41.348102740 +0100
@@ -118,6 +118,7 @@
 #endif
 #include "monitor_wrap.h"
@ -515,7 +521,7 @@ diff -up openssh-5.9p1/sshd.c.audit3 openssh-5.9p1/sshd.c
 #include "ssh-sandbox.h"
 #include "version.h"
 
-@@ -2209,6 +2210,10 @@ do_ssh1_kex(void)
+@@ -2241,6 +2242,10 @@ do_ssh1_kex(void)
 		if (cookie[i] != packet_get_char())
 			packet_disconnect("IP Spoofing check bytes do not match.");
 
--- a/openssh-6.2p1-audit4.patch
+++ b/openssh-6.2p1-audit4.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/audit-bsm.c.audit4 openssh-6.1p1/audit-bsm.c
--- openssh-6.1p1/audit-bsm.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit-bsm.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit-bsm.c.audit4 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit4	2013-03-25 17:34:16.034337746 +0100
+++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:34:16.042337793 +0100
@@ -485,4 +485,10 @@ audit_kex_body(int ctos, char *enc, char
 {
 	/* not implemented */
@ -12,9 +12,9 @@ diff -up openssh-6.1p1/audit-bsm.c.audit4 openssh-6.1p1/audit-bsm.c
 +	/* not implemented */
 +}
 #endif /* BSM */
-diff -up openssh-6.1p1/audit.c.audit4 openssh-6.1p1/audit.c
--- openssh-6.1p1/audit.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit.c.audit4 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit4	2013-03-25 17:34:16.035337752 +0100
+++ openssh-6.2p1/audit.c	2013-03-25 17:34:16.042337793 +0100
@@ -143,6 +143,12 @@ audit_kex(int ctos, char *enc, char *mac
 	PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
 }
@ -44,9 +44,9 @@ diff -up openssh-6.1p1/audit.c.audit4 openssh-6.1p1/audit.c
 +}
 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/audit.h.audit4 openssh-6.1p1/audit.h
--- openssh-6.1p1/audit.h.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit.h	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit.h.audit4 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit4	2013-03-25 17:34:16.035337752 +0100
+++ openssh-6.2p1/audit.h	2013-03-25 17:34:16.043337799 +0100
@@ -62,5 +62,7 @@ void	audit_unsupported(int);
 void	audit_kex(int, char *, char *, char *);
 void	audit_unsupported_body(int);
@ -55,9 +55,9 @@ diff -up openssh-6.1p1/audit.h.audit4 openssh-6.1p1/audit.h
 +void	audit_session_key_free_body(int ctos, pid_t, uid_t);
 
 #endif /* _SSH_AUDIT_H */
-diff -up openssh-6.1p1/audit-linux.c.audit4 openssh-6.1p1/audit-linux.c
--- openssh-6.1p1/audit-linux.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit-linux.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit-linux.c.audit4 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit4	2013-03-25 17:34:16.035337752 +0100
+++ openssh-6.2p1/audit-linux.c	2013-03-25 17:34:16.043337799 +0100
@@ -294,6 +294,8 @@ audit_unsupported_body(int what)
 #endif
 }
@ -108,9 +108,9 @@ diff -up openssh-6.1p1/audit-linux.c.audit4 openssh-6.1p1/audit-linux.c
 +}
 +
 #endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.1p1/auditstub.c.audit4 openssh-6.1p1/auditstub.c
--- openssh-6.1p1/auditstub.c.audit4	2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/auditstub.c	2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/auditstub.c.audit4 openssh-6.2p1/auditstub.c
+--- openssh-6.2p1/auditstub.c.audit4	2013-03-25 17:34:16.035337752 +0100
+++ openssh-6.2p1/auditstub.c	2013-03-25 17:34:16.043337799 +0100
@@ -27,6 +27,8 @@
  * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
  */
@ -133,10 +133,10 @@ diff -up openssh-6.1p1/auditstub.c.audit4 openssh-6.1p1/auditstub.c
 +audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
 +{
 +}
-diff -up openssh-6.1p1/kex.c.audit4 openssh-6.1p1/kex.c
--- openssh-6.1p1/kex.c.audit4	2012-11-28 14:20:38.991185818 +0100
-+++ openssh-6.1p1/kex.c	2012-11-28 14:20:38.995185800 +0100
-@@ -624,3 +624,34 @@ dump_digest(char *msg, u_char *digest, i
+diff -up openssh-6.2p1/kex.c.audit4 openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.audit4	2013-03-25 17:34:16.036337758 +0100
+++ openssh-6.2p1/kex.c	2013-03-25 17:34:16.044337804 +0100
+@@ -640,3 +640,34 @@ dump_digest(char *msg, u_char *digest, i
 	fprintf(stderr, "\n");
 }
 #endif
@ -171,10 +171,10 @@ diff -up openssh-6.1p1/kex.c.audit4 openssh-6.1p1/kex.c
 +	memset(&newkeys->comp, 0, sizeof(newkeys->comp));
 +}
 +
-diff -up openssh-6.1p1/kex.h.audit4 openssh-6.1p1/kex.h
--- openssh-6.1p1/kex.h.audit4	2010-09-24 14:11:14.000000000 +0200
-+++ openssh-6.1p1/kex.h	2012-11-28 14:20:38.996185795 +0100
-@@ -156,6 +156,8 @@ void	 kexgex_server(Kex *);
+diff -up openssh-6.2p1/kex.h.audit4 openssh-6.2p1/kex.h
+--- openssh-6.2p1/kex.h.audit4	2013-01-09 06:12:19.000000000 +0100
+++ openssh-6.2p1/kex.h	2013-03-25 17:34:16.044337804 +0100
+@@ -158,6 +158,8 @@ void	 kexgex_server(Kex *);
 void	 kexecdh_client(Kex *);
 void	 kexecdh_server(Kex *);
 
@ -183,10 +183,10 @@ diff -up openssh-6.1p1/kex.h.audit4 openssh-6.1p1/kex.h
 void
 kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
     BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-diff -up openssh-6.1p1/mac.c.audit4 openssh-6.1p1/mac.c
--- openssh-6.1p1/mac.c.audit4	2012-06-30 00:34:59.000000000 +0200
-+++ openssh-6.1p1/mac.c	2012-11-28 14:20:38.996185795 +0100
-@@ -169,6 +169,20 @@ mac_clear(Mac *mac)
+diff -up openssh-6.2p1/mac.c.audit4 openssh-6.2p1/mac.c
+--- openssh-6.2p1/mac.c.audit4	2012-12-12 01:00:37.000000000 +0100
+++ openssh-6.2p1/mac.c	2013-03-25 17:34:16.044337804 +0100
+@@ -199,6 +199,20 @@ mac_clear(Mac *mac)
 	mac->umac_ctx = NULL;
 }
 
@ -207,17 +207,17 @@ diff -up openssh-6.1p1/mac.c.audit4 openssh-6.1p1/mac.c
 /* XXX copied from ciphers_valid */
 #define	MAC_SEP	","
 int
-diff -up openssh-6.1p1/mac.h.audit4 openssh-6.1p1/mac.h
--- openssh-6.1p1/mac.h.audit4	2007-06-11 06:01:42.000000000 +0200
-+++ openssh-6.1p1/mac.h	2012-11-28 14:20:38.996185795 +0100
+diff -up openssh-6.2p1/mac.h.audit4 openssh-6.2p1/mac.h
+--- openssh-6.2p1/mac.h.audit4	2007-06-11 06:01:42.000000000 +0200
+++ openssh-6.2p1/mac.h	2013-03-25 17:34:16.045337810 +0100
@@ -28,3 +28,4 @@ int	 mac_setup(Mac *, char *);
 int	 mac_init(Mac *);
 u_char	*mac_compute(Mac *, u_int32_t, u_char *, int);
 void	 mac_clear(Mac *);
 +void	 mac_destroy(Mac *);
-diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
--- openssh-6.1p1/monitor.c.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor.c	2012-11-28 17:02:17.677045093 +0100
+diff -up openssh-6.2p1/monitor.c.audit4 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit4	2013-03-25 17:34:16.037337763 +0100
+++ openssh-6.2p1/monitor.c	2013-03-25 17:34:16.046337816 +0100
@@ -189,6 +189,7 @@ int mm_answer_audit_command(int, Buffer
 int mm_answer_audit_end_command(int, Buffer *);
 int mm_answer_audit_unsupported_body(int, Buffer *);
@ -226,7 +226,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 #endif
 
 static int monitor_read_log(struct monitor *);
-@@ -241,6 +242,7 @@ struct mon_table mon_dispatch_proto20[]
+@@ -242,6 +243,7 @@ struct mon_table mon_dispatch_proto20[]
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
     {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
     {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@ -234,7 +234,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 #endif
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -280,6 +282,7 @@ struct mon_table mon_dispatch_postauth20
+@@ -281,6 +283,7 @@ struct mon_table mon_dispatch_postauth20
     {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
     {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
     {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@ -242,7 +242,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -313,6 +316,7 @@ struct mon_table mon_dispatch_proto15[]
+@@ -314,6 +317,7 @@ struct mon_table mon_dispatch_proto15[]
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
     {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
     {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@ -250,7 +250,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -327,6 +331,7 @@ struct mon_table mon_dispatch_postauth15
+@@ -328,6 +332,7 @@ struct mon_table mon_dispatch_postauth15
     {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
     {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
     {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@ -258,18 +258,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -448,10 +453,6 @@ monitor_child_preauth(Authctxt *_authctx
- #endif
- 	}
- 
-	/* Drain any buffered messages from the child */
-	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
-		;
-
- 	if (!authctxt->valid)
- 		fatal("%s: authenticated invalid user", __func__);
- 	if (strcmp(auth_method, "unknown") == 0)
-@@ -1950,11 +1951,13 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -1957,11 +1962,13 @@ mm_get_keystate(struct monitor *pmonitor
 
 	blob = buffer_get_string(&m, &bloblen);
 	current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
@ -283,7 +272,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 	xfree(blob);
 
 	/* Now get sequence numbers for the packets */
-@@ -2000,6 +2003,21 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -2007,6 +2014,21 @@ mm_get_keystate(struct monitor *pmonitor
 	}
 
 	buffer_free(&m);
@ -305,7 +294,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 }
 
 
-@@ -2444,4 +2462,22 @@ mm_answer_audit_kex_body(int sock, Buffe
+@@ -2451,4 +2473,22 @@ mm_answer_audit_kex_body(int sock, Buffe
 	return 0;
 }
 
@ -328,21 +317,23 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
 +	return 0;
 +}
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/monitor.h.audit4 openssh-6.1p1/monitor.h
--- openssh-6.1p1/monitor.h.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor.h	2012-11-28 14:20:38.997185790 +0100
-@@ -63,6 +63,7 @@ enum monitor_reqtype {
- 	MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
- 	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
- 	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
-+	MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
--- openssh-6.1p1/monitor_wrap.c.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor_wrap.c	2012-11-28 14:20:38.997185790 +0100
-@@ -653,12 +653,14 @@ mm_send_keystate(struct monitor *monitor
+diff -up openssh-6.2p1/monitor.h.audit4 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit4	2013-03-25 17:34:16.046337816 +0100
+++ openssh-6.2p1/monitor.h	2013-03-25 17:35:01.408602217 +0100
+@@ -72,7 +72,8 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+ 	MONITOR_REQ_AUDIT_END_COMMAND = 116,
+ 	MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+-	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121
+	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121,
+	MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit4 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit4	2013-03-25 17:34:16.038337769 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:34:16.047337822 +0100
+@@ -654,12 +654,14 @@ mm_send_keystate(struct monitor *monitor
 		fatal("%s: conversion of newkeys failed", __func__);
 
 	buffer_put_string(&m, blob, bloblen);
@ -357,7 +348,7 @@ diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
 	xfree(blob);
 
 	packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
-@@ -1522,4 +1524,19 @@ mm_audit_kex_body(int ctos, char *cipher
+@@ -1523,4 +1525,19 @@ mm_audit_kex_body(int ctos, char *cipher
 
 	buffer_free(&m);
 }
@ -377,9 +368,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
 +	buffer_free(&m);
 +}
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/monitor_wrap.h.audit4 openssh-6.1p1/monitor_wrap.h
--- openssh-6.1p1/monitor_wrap.h.audit4	2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor_wrap.h	2012-11-28 14:20:38.997185790 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.audit4 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit4	2013-03-25 17:34:16.039337775 +0100
+++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:34:16.047337822 +0100
@@ -79,6 +79,7 @@ int mm_audit_run_command(const char *);
 void mm_audit_end_command(int, const char *);
 void mm_audit_unsupported_body(int);
@ -388,9 +379,9 @@ diff -up openssh-6.1p1/monitor_wrap.h.audit4 openssh-6.1p1/monitor_wrap.h
 #endif
 
 struct Session;
-diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
--- openssh-6.1p1/packet.c.audit4	2012-11-28 14:20:38.973185902 +0100
-+++ openssh-6.1p1/packet.c	2012-11-28 14:20:38.998185785 +0100
+diff -up openssh-6.2p1/packet.c.audit4 openssh-6.2p1/packet.c
+--- openssh-6.2p1/packet.c.audit4	2013-03-25 17:34:16.014337629 +0100
+++ openssh-6.2p1/packet.c	2013-03-25 17:42:26.519176337 +0100
@@ -60,6 +60,7 @@
 #include <signal.h>
 
@ -472,7 +463,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 void
 set_newkeys(int mode)
 {
-@@ -754,18 +782,9 @@ set_newkeys(int mode)
+@@ -754,21 +782,9 @@ set_newkeys(int mode)
 	}
 	if (active_state->newkeys[mode] != NULL) {
 		debug("set_newkeys: rekeying");
@ -482,6 +473,9 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 -		mac  = &active_state->newkeys[mode]->mac;
 -		comp = &active_state->newkeys[mode]->comp;
 -		mac_clear(mac);
+-		memset(enc->iv,  0, enc->iv_len);
+-		memset(enc->key, 0, enc->key_len);
+-		memset(mac->key, 0, mac->key_len);
 -		xfree(enc->name);
 -		xfree(enc->iv);
 -		xfree(enc->key);
@ -493,7 +487,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 	}
 	active_state->newkeys[mode] = kex_get_newkeys(mode);
 	if (active_state->newkeys[mode] == NULL)
-@@ -1921,6 +1940,47 @@ packet_get_newkeys(int mode)
+@@ -1971,6 +1987,47 @@ packet_get_newkeys(int mode)
 	return (void *)active_state->newkeys[mode];
 }
 
@ -541,7 +535,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 /*
  * Save the state for the real connection, and use a separate state when
  * resuming a suspended connection.
-@@ -1928,18 +1988,12 @@ packet_get_newkeys(int mode)
+@@ -1978,18 +2035,12 @@ packet_get_newkeys(int mode)
 void
 packet_backup_state(void)
 {
@ -561,7 +555,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 }
 
 /*
-@@ -1956,9 +2010,7 @@ packet_restore_state(void)
+@@ -2006,9 +2057,7 @@ packet_restore_state(void)
 	backup_state = active_state;
 	active_state = tmp;
 	active_state->connection_in = backup_state->connection_in;
@ -571,7 +565,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 	len = buffer_len(&backup_state->input);
 	if (len > 0) {
 		buf = buffer_ptr(&backup_state->input);
-@@ -1966,4 +2018,10 @@ packet_restore_state(void)
+@@ -2016,4 +2065,10 @@ packet_restore_state(void)
 		buffer_clear(&backup_state->input);
 		add_recv_bytes(len);
 	}
@ -582,19 +576,19 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
 +	backup_state = NULL;
 }
 +
-diff -up openssh-6.1p1/packet.h.audit4 openssh-6.1p1/packet.h
--- openssh-6.1p1/packet.h.audit4	2012-02-10 22:19:21.000000000 +0100
-+++ openssh-6.1p1/packet.h	2012-11-28 14:20:38.998185785 +0100
+diff -up openssh-6.2p1/packet.h.audit4 openssh-6.2p1/packet.h
+--- openssh-6.2p1/packet.h.audit4	2012-02-10 22:19:21.000000000 +0100
+++ openssh-6.2p1/packet.h	2013-03-25 17:34:16.049337834 +0100
@@ -123,4 +123,5 @@ void	 packet_restore_state(void);
 void	*packet_get_input(void);
 void	*packet_get_output(void);
 
 +void	 packet_destroy_all(int, int);
 #endif				/* PACKET_H */
-diff -up openssh-6.1p1/session.c.audit4 openssh-6.1p1/session.c
--- openssh-6.1p1/session.c.audit4	2012-11-28 14:20:38.983185855 +0100
-+++ openssh-6.1p1/session.c	2012-11-28 14:20:38.998185785 +0100
-@@ -1634,6 +1634,9 @@ do_child(Session *s, const char *command
+diff -up openssh-6.2p1/session.c.audit4 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit4	2013-03-25 17:34:16.023337682 +0100
+++ openssh-6.2p1/session.c	2013-03-25 17:34:16.050337839 +0100
+@@ -1642,6 +1642,9 @@ do_child(Session *s, const char *command
 
 	/* remove hostkey from the child's memory */
 	destroy_sensitive_data();
@ -604,10 +598,10 @@ diff -up openssh-6.1p1/session.c.audit4 openssh-6.1p1/session.c
 
 	/* Force a password change */
 	if (s->authctxt->force_pwchange) {
-diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
--- openssh-6.1p1/sshd.c.audit4	2012-11-28 14:20:38.993185808 +0100
-+++ openssh-6.1p1/sshd.c	2012-11-28 14:20:38.999185780 +0100
-@@ -692,6 +692,8 @@ privsep_preauth(Authctxt *authctxt)
+diff -up openssh-6.2p1/sshd.c.audit4 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit4	2013-03-25 17:34:16.039337775 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 17:34:16.050337839 +0100
+@@ -701,6 +701,8 @@ privsep_preauth(Authctxt *authctxt)
 	}
 }
 
@ -616,7 +610,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
 static void
 privsep_postauth(Authctxt *authctxt)
 {
-@@ -716,6 +718,10 @@ privsep_postauth(Authctxt *authctxt)
+@@ -725,6 +727,10 @@ privsep_postauth(Authctxt *authctxt)
 	else if (pmonitor->m_pid != 0) {
 		verbose("User child is on pid %ld", (long)pmonitor->m_pid);
 		buffer_clear(&loginmsg);
@ -627,7 +621,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
 		monitor_child_postauth(pmonitor);
 
 		/* NEVERREACHED */
-@@ -2016,6 +2022,7 @@ main(int ac, char **av)
+@@ -2033,6 +2039,7 @@ main(int ac, char **av)
 	 */
 	if (use_privsep) {
 		mm_send_keystate(pmonitor);
@ -635,7 +629,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
 		exit(0);
 	}
 
-@@ -2068,6 +2075,8 @@ main(int ac, char **av)
+@@ -2085,6 +2092,8 @@ main(int ac, char **av)
 	do_authenticated(authctxt);
 
 	/* The connection has been terminated. */
@ -644,7 +638,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
 	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
 	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
 	verbose("Transferred: sent %llu, received %llu bytes",
-@@ -2385,6 +2394,16 @@ do_ssh2_kex(void)
+@@ -2402,6 +2411,16 @@ do_ssh2_kex(void)
 void
 cleanup_exit(int i)
 {
@ -661,7 +655,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
 	if (the_authctxt) {
 		do_cleanup(the_authctxt);
 		if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
-@@ -2395,6 +2414,8 @@ cleanup_exit(int i)
+@@ -2412,6 +2431,8 @@ cleanup_exit(int i)
 				    pmonitor->m_pid, strerror(errno));
 		}
 	}
--- a/openssh-6.2p1-audit5.patch
+++ b/openssh-6.2p1-audit5.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/audit-bsm.c.audit5 openssh-6.0p1/audit-bsm.c
--- openssh-6.0p1/audit-bsm.c.audit5	2012-08-06 20:37:50.036345216 +0200
-+++ openssh-6.0p1/audit-bsm.c	2012-08-06 20:37:50.046345177 +0200
+diff -up openssh-6.2p1/audit-bsm.c.audit5 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit5	2013-03-25 17:43:27.495526587 +0100
+++ openssh-6.2p1/audit-bsm.c	2013-03-25 17:43:27.502526627 +0100
@@ -491,4 +491,22 @@ audit_session_key_free_body(int ctos, pi
 {
 	/* not implemented */
@ -24,9 +24,9 @@ diff -up openssh-6.0p1/audit-bsm.c.audit5 openssh-6.0p1/audit-bsm.c
 +	/* not implemented */
 +}
 #endif /* BSM */
-diff -up openssh-6.0p1/audit.c.audit5 openssh-6.0p1/audit.c
--- openssh-6.0p1/audit.c.audit5	2012-08-06 20:37:50.036345216 +0200
-+++ openssh-6.0p1/audit.c	2012-08-06 20:37:50.047345173 +0200
+diff -up openssh-6.2p1/audit.c.audit5 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit5	2013-03-25 17:43:27.495526587 +0100
+++ openssh-6.2p1/audit.c	2013-03-25 17:43:27.502526627 +0100
@@ -290,5 +290,24 @@ audit_session_key_free_body(int ctos, pi
 	debug("audit session key discard euid %u direction %d from pid %ld uid %u",
 		(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
@ -52,9 +52,9 @@ diff -up openssh-6.0p1/audit.c.audit5 openssh-6.0p1/audit.c
 +}
 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/audit.h.audit5 openssh-6.0p1/audit.h
--- openssh-6.0p1/audit.h.audit5	2012-08-06 20:37:50.037345212 +0200
-+++ openssh-6.0p1/audit.h	2012-08-06 20:37:50.047345173 +0200
+diff -up openssh-6.2p1/audit.h.audit5 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit5	2013-03-25 17:43:27.496526593 +0100
+++ openssh-6.2p1/audit.h	2013-03-25 17:43:27.502526627 +0100
@@ -48,6 +48,8 @@ enum ssh_audit_event_type {
 };
 typedef enum ssh_audit_event_type ssh_audit_event_t;
@ -72,9 +72,9 @@ diff -up openssh-6.0p1/audit.h.audit5 openssh-6.0p1/audit.h
 +void	audit_generate_ephemeral_server_key(const char *);
 
 #endif /* _SSH_AUDIT_H */
-diff -up openssh-6.0p1/audit-linux.c.audit5 openssh-6.0p1/audit-linux.c
--- openssh-6.0p1/audit-linux.c.audit5	2012-08-06 20:37:50.037345212 +0200
-+++ openssh-6.0p1/audit-linux.c	2012-08-06 20:37:50.046345177 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit5 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit5	2013-03-25 17:43:27.496526593 +0100
+++ openssh-6.2p1/audit-linux.c	2013-03-25 17:43:27.503526633 +0100
@@ -356,4 +356,50 @@ audit_session_key_free_body(int ctos, pi
 		error("cannot write into audit");
 }
@ -126,10 +126,10 @@ diff -up openssh-6.0p1/audit-linux.c.audit5 openssh-6.0p1/audit-linux.c
 +		error("cannot write into audit");
 +}
 #endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.0p1/key.c.audit5 openssh-6.0p1/key.c
--- openssh-6.0p1/key.c.audit5	2012-08-06 20:37:49.992345388 +0200
-+++ openssh-6.0p1/key.c	2012-08-06 20:37:50.048345169 +0200
-@@ -1794,6 +1794,30 @@ key_demote(const Key *k)
+diff -up openssh-6.2p1/key.c.audit5 openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.audit5	2013-03-25 17:43:27.465526415 +0100
+++ openssh-6.2p1/key.c	2013-03-25 17:43:27.503526633 +0100
+@@ -1809,6 +1809,30 @@ key_demote(const Key *k)
 }
 
 int
@ -160,10 +160,10 @@ diff -up openssh-6.0p1/key.c.audit5 openssh-6.0p1/key.c
 key_is_cert(const Key *k)
 {
 	if (k == NULL)
-diff -up openssh-6.0p1/key.h.audit5 openssh-6.0p1/key.h
--- openssh-6.0p1/key.h.audit5	2012-08-06 20:37:49.993345384 +0200
-+++ openssh-6.0p1/key.h	2012-08-06 20:37:50.049345165 +0200
-@@ -109,6 +109,7 @@ Key	*key_generate(int, u_int);
+diff -up openssh-6.2p1/key.h.audit5 openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.audit5	2013-03-25 17:43:27.465526415 +0100
+++ openssh-6.2p1/key.h	2013-03-25 17:43:27.503526633 +0100
+@@ -110,6 +110,7 @@ Key	*key_generate(int, u_int);
 Key	*key_from_private(const Key *);
 int	 key_type_from_name(char *);
 int	 key_is_cert(const Key *);
@ -171,9 +171,9 @@ diff -up openssh-6.0p1/key.h.audit5 openssh-6.0p1/key.h
 int	 key_type_plain(int);
 int	 key_to_certified(Key *, int);
 int	 key_drop_cert(Key *);
-diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
--- openssh-6.0p1/monitor.c.audit5	2012-08-06 20:37:50.040345200 +0200
-+++ openssh-6.0p1/monitor.c	2012-08-06 20:37:50.049345165 +0200
+diff -up openssh-6.2p1/monitor.c.audit5 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit5	2013-03-25 17:43:27.497526599 +0100
+++ openssh-6.2p1/monitor.c	2013-03-25 17:43:27.504526639 +0100
@@ -114,6 +114,8 @@ extern Buffer auth_debug;
 extern int auth_debug_init;
 extern Buffer loginmsg;
@ -223,7 +223,7 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -1744,6 +1751,8 @@ mm_answer_term(int sock, Buffer *req)
+@@ -1752,6 +1759,8 @@ mm_answer_term(int sock, Buffer *req)
 		sshpam_cleanup();
 #endif
 
@ -232,7 +232,7 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
 	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
 		if (errno != EINTR)
 			exit(1);
-@@ -2485,4 +2494,25 @@ mm_answer_audit_session_key_free_body(in
+@@ -2491,4 +2500,25 @@ mm_answer_audit_session_key_free_body(in
 	mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
 	return 0;
 }
@ -258,21 +258,23 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
 +	return 0;
 +}
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor.h.audit5 openssh-6.0p1/monitor.h
--- openssh-6.0p1/monitor.h.audit5	2012-08-06 20:37:50.040345200 +0200
-+++ openssh-6.0p1/monitor.h	2012-08-06 20:37:50.050345161 +0200
-@@ -64,6 +64,7 @@ enum monitor_reqtype {
- 	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
- 	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
- 	MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
-+	MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
- 	MONITOR_REQ_TERM,
- 	MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- 	MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.0p1/monitor_wrap.c.audit5 openssh-6.0p1/monitor_wrap.c
--- openssh-6.0p1/monitor_wrap.c.audit5	2012-08-06 20:37:50.041345196 +0200
-+++ openssh-6.0p1/monitor_wrap.c	2012-08-06 20:37:50.050345161 +0200
-@@ -1539,4 +1539,20 @@ mm_audit_session_key_free_body(int ctos,
+diff -up openssh-6.2p1/monitor.h.audit5 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit5	2013-03-25 17:43:27.504526639 +0100
+++ openssh-6.2p1/monitor.h	2013-03-25 17:44:08.717763090 +0100
+@@ -73,7 +73,8 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_AUDIT_END_COMMAND = 116,
+ 	MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+ 	MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121,
+-	MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123
+	MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123,
+	MONITOR_REQ_AUDIT_SERVER_KEY_FREE = 124, MONITOR_ANS_AUDIT_SERVER_KEY_FREE = 125
+ 
+ };
+ 
+diff -up openssh-6.2p1/monitor_wrap.c.audit5 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit5	2013-03-25 17:43:27.498526604 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:43:27.505526645 +0100
+@@ -1540,4 +1540,20 @@ mm_audit_session_key_free_body(int ctos,
 				  &m);
 	buffer_free(&m);
 }
@ -293,9 +295,9 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit5 openssh-6.0p1/monitor_wrap.c
 +	buffer_free(&m);
 +}
 #endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor_wrap.h.audit5 openssh-6.0p1/monitor_wrap.h
--- openssh-6.0p1/monitor_wrap.h.audit5	2012-08-06 20:37:50.041345196 +0200
-+++ openssh-6.0p1/monitor_wrap.h	2012-08-06 20:37:50.051345157 +0200
+diff -up openssh-6.2p1/monitor_wrap.h.audit5 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit5	2013-03-25 17:43:27.498526604 +0100
+++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:43:27.505526645 +0100
@@ -80,6 +80,7 @@ void mm_audit_end_command(int, const cha
 void mm_audit_unsupported_body(int);
 void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
@ -304,9 +306,9 @@ diff -up openssh-6.0p1/monitor_wrap.h.audit5 openssh-6.0p1/monitor_wrap.h
 #endif
 
 struct Session;
-diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
--- openssh-6.0p1/session.c.audit5	2012-08-06 20:37:50.043345189 +0200
-+++ openssh-6.0p1/session.c	2012-08-06 20:37:50.052345153 +0200
+diff -up openssh-6.2p1/session.c.audit5 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit5	2013-03-25 17:43:27.499526610 +0100
+++ openssh-6.2p1/session.c	2013-03-25 17:43:27.506526650 +0100
@@ -136,7 +136,7 @@ extern int log_stderr;
 extern int debug_flag;
 extern u_int utmp_len;
@ -316,7 +318,7 @@ diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
 extern Buffer loginmsg;
 
 /* original command from peer. */
-@@ -1633,7 +1633,7 @@ do_child(Session *s, const char *command
+@@ -1641,7 +1641,7 @@ do_child(Session *s, const char *command
 	int r = 0;
 
 	/* remove hostkey from the child's memory */
@ -325,9 +327,9 @@ diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
 	/* Don't audit this - both us and the parent would be talking to the
 	   monitor over a single socket, with no synchronization. */
 	packet_destroy_all(0, 1);
-diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
--- openssh-6.0p1/sshd.c.audit5	2012-08-06 20:37:50.044345185 +0200
-+++ openssh-6.0p1/sshd.c	2012-08-06 20:37:50.053345149 +0200
+diff -up openssh-6.2p1/sshd.c.audit5 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit5	2013-03-25 17:43:27.500526616 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 17:43:27.506526650 +0100
@@ -255,7 +255,7 @@ Buffer loginmsg;
 struct passwd *privsep_pw = NULL;
 
@ -353,7 +355,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 static void
 close_startup_pipes(void)
 {
-@@ -534,22 +543,47 @@ sshd_exchange_identification(int sock_in
+@@ -545,22 +554,47 @@ sshd_exchange_identification(int sock_in
 	}
 }
 
@ -404,7 +406,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 			key_free(sensitive_data.host_certificates[i]);
 			sensitive_data.host_certificates[i] = NULL;
 		}
-@@ -563,6 +597,8 @@ void
+@@ -574,6 +608,8 @@ void
 demote_sensitive_data(void)
 {
 	Key *tmp;
@ -413,7 +415,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 	int i;
 
 	if (sensitive_data.server_key) {
-@@ -571,13 +607,27 @@ demote_sensitive_data(void)
+@@ -582,13 +618,27 @@ demote_sensitive_data(void)
 		sensitive_data.server_key = tmp;
 	}
 
@ -441,7 +443,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 		}
 		/* Certs do not need demotion */
 	}
-@@ -1149,6 +1199,7 @@ server_accept_loop(int *sock_in, int *so
+@@ -1160,6 +1210,7 @@ server_accept_loop(int *sock_in, int *so
 		if (received_sigterm) {
 			logit("Received signal %d; terminating.",
 			    (int) received_sigterm);
@ -449,7 +451,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 			close_listen_socks();
 			unlink(options.pid_file);
 			exit(received_sigterm == SIGTERM ? 0 : 255);
-@@ -2054,7 +2105,7 @@ main(int ac, char **av)
+@@ -2082,7 +2133,7 @@ main(int ac, char **av)
 		privsep_postauth(authctxt);
 		/* the monitor process [priv] will not return */
 		if (!compat20)
@ -458,7 +460,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 	}
 
 	packet_set_timeout(options.client_alive_interval,
-@@ -2065,6 +2116,7 @@ main(int ac, char **av)
+@@ -2093,6 +2144,7 @@ main(int ac, char **av)
 
 	/* The connection has been terminated. */
 	packet_destroy_all(1, 1);
@ -466,7 +468,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 
 	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
 	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
-@@ -2293,7 +2345,7 @@ do_ssh1_kex(void)
+@@ -2321,7 +2373,7 @@ do_ssh1_kex(void)
 			session_id[i] = session_key[i] ^ session_key[i + 16];
 	}
 	/* Destroy the private and public keys. No longer. */
@ -475,7 +477,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
 
 	if (use_privsep)
 		mm_ssh1_session_id(session_id);
-@@ -2404,6 +2456,8 @@ cleanup_exit(int i)
+@@ -2432,6 +2484,8 @@ cleanup_exit(int i)
 		}
 	}
 	is_privsep_child = use_privsep && pmonitor != NULL && !mm_is_monitor();
--- a/openssh-6.2p1-coverity.patch
+++ b/openssh-6.2p1-coverity.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c
--- openssh-6.1p1/auth-pam.c.coverity	2009-07-12 14:07:21.000000000 +0200
-+++ openssh-6.1p1/auth-pam.c	2012-09-14 21:16:41.264906486 +0200
+diff -up openssh-6.2p1/auth-pam.c.coverity openssh-6.2p1/auth-pam.c
+--- openssh-6.2p1/auth-pam.c.coverity	2009-07-12 14:07:21.000000000 +0200
+++ openssh-6.2p1/auth-pam.c	2013-03-22 09:49:37.341595458 +0100
@@ -216,7 +216,12 @@ pthread_join(sp_pthread_t thread, void *
 	if (sshpam_thread_status != -1)
 		return (sshpam_thread_status);
@ -15,30 +15,9 @@ diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c
 	return (status);
 }
 #endif
-diff -up openssh-6.1p1/clientloop.c.coverity openssh-6.1p1/clientloop.c
--- openssh-6.1p1/clientloop.c.coverity	2012-06-20 14:31:27.000000000 +0200
-+++ openssh-6.1p1/clientloop.c	2012-09-14 21:16:41.267906501 +0200
-@@ -2006,14 +2006,15 @@ client_input_global_request(int type, u_
- 	char *rtype;
- 	int want_reply;
- 	int success = 0;
-+/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
- 
- 	rtype = packet_get_string(NULL);
- 	want_reply = packet_get_char();
- 	debug("client_input_global_request: rtype %s want_reply %d",
- 	    rtype, want_reply);
- 	if (want_reply) {
-		packet_start(success ?
-		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
-+		packet_start(/*success ?
-+		    SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
- 		packet_send();
- 		packet_write_wait();
- 	}
-diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c
--- openssh-6.1p1/channels.c.coverity	2012-04-23 10:21:05.000000000 +0200
-+++ openssh-6.1p1/channels.c	2012-09-14 21:16:41.272906528 +0200
+diff -up openssh-6.2p1/channels.c.coverity openssh-6.2p1/channels.c
+--- openssh-6.2p1/channels.c.coverity	2012-12-02 23:50:55.000000000 +0100
+++ openssh-6.2p1/channels.c	2013-03-22 09:49:37.344595444 +0100
@@ -232,11 +232,11 @@ channel_register_fds(Channel *c, int rfd
 	channel_max_fd = MAX(channel_max_fd, wfd);
 	channel_max_fd = MAX(channel_max_fd, efd);
@ -69,9 +48,30 @@ diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c
 			set_nonblock(efd);
 	}
 }
-diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c
--- openssh-6.1p1/key.c.coverity	2012-06-30 12:05:02.000000000 +0200
-+++ openssh-6.1p1/key.c	2012-09-14 21:16:41.274906537 +0200
+diff -up openssh-6.2p1/clientloop.c.coverity openssh-6.2p1/clientloop.c
+--- openssh-6.2p1/clientloop.c.coverity	2013-01-09 05:55:51.000000000 +0100
+++ openssh-6.2p1/clientloop.c	2013-03-22 09:49:37.342595453 +0100
+@@ -2061,14 +2061,15 @@ client_input_global_request(int type, u_
+ 	char *rtype;
+ 	int want_reply;
+ 	int success = 0;
+/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
+ 
+ 	rtype = packet_get_string(NULL);
+ 	want_reply = packet_get_char();
+ 	debug("client_input_global_request: rtype %s want_reply %d",
+ 	    rtype, want_reply);
+ 	if (want_reply) {
+-		packet_start(success ?
+-		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
+		packet_start(/*success ?
+		    SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
+ 		packet_send();
+ 		packet_write_wait();
+ 	}
+diff -up openssh-6.2p1/key.c.coverity openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.coverity	2013-01-18 01:44:05.000000000 +0100
+++ openssh-6.2p1/key.c	2013-03-22 09:49:37.345595440 +0100
@@ -808,8 +808,10 @@ key_read(Key *ret, char **cpp)
 		success = 1;
 /*XXXX*/
@ -83,19 +83,19 @@ diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c
 		/* advance cp: skip whitespace and data */
 		while (*cp == ' ' || *cp == '\t')
 			cp++;
-diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
--- openssh-6.1p1/monitor.c.coverity	2012-06-30 00:33:17.000000000 +0200
-+++ openssh-6.1p1/monitor.c	2012-09-14 21:16:41.277906552 +0200
-@@ -420,7 +420,7 @@ monitor_child_preauth(Authctxt *_authctx
- 	}
+diff -up openssh-6.2p1/monitor.c.coverity openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.coverity	2012-12-12 00:44:39.000000000 +0100
+++ openssh-6.2p1/monitor.c	2013-03-22 12:19:55.189921353 +0100
+@@ -449,7 +449,7 @@ monitor_child_preauth(Authctxt *_authctx
+ 	mm_get_keystate(pmonitor);
 
 	/* Drain any buffered messages from the child */
 -	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
 +	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
 		;
 
- 	if (!authctxt->valid)
-@@ -1159,6 +1159,10 @@ mm_answer_keyallowed(int sock, Buffer *m
+ 	close(pmonitor->m_sendfd);
+@@ -1194,6 +1194,10 @@ mm_answer_keyallowed(int sock, Buffer *m
 			break;
 		}
 	}
@ -106,7 +106,7 @@ diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
 	if (key != NULL)
 		key_free(key);
 
-@@ -1180,9 +1184,6 @@ mm_answer_keyallowed(int sock, Buffer *m
+@@ -1216,9 +1220,6 @@ mm_answer_keyallowed(int sock, Buffer *m
 		xfree(chost);
 	}
 
@ -116,10 +116,10 @@ diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
 	buffer_clear(m);
 	buffer_put_int(m, allowed);
 	buffer_put_int(m, forced_command != NULL);
-diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c
--- openssh-6.1p1/monitor_wrap.c.coverity	2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.1p1/monitor_wrap.c	2012-09-14 21:16:41.280906568 +0200
-@@ -707,10 +707,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
+diff -up openssh-6.2p1/monitor_wrap.c.coverity openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.coverity	2013-01-09 06:12:19.000000000 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-22 09:49:37.347595431 +0100
+@@ -708,10 +708,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
 	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
 	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
 		error("%s: cannot allocate fds for pty", __func__);
@ -133,9 +133,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c
 		return 0;
 	}
 	close(tmp1);
-diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/openbsd-compat/bindresvport.c
--- openssh-6.1p1/openbsd-compat/bindresvport.c.coverity	2010-12-03 00:50:26.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/bindresvport.c	2012-09-14 21:16:41.281906573 +0200
+diff -up openssh-6.2p1/openbsd-compat/bindresvport.c.coverity openssh-6.2p1/openbsd-compat/bindresvport.c
+--- openssh-6.2p1/openbsd-compat/bindresvport.c.coverity	2010-12-03 00:50:26.000000000 +0100
+++ openssh-6.2p1/openbsd-compat/bindresvport.c	2013-03-22 09:49:37.347595431 +0100
@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
 	struct sockaddr_in6 *in6;
 	u_int16_t *portp;
@ -145,10 +145,10 @@ diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/open
 	int i;
 
 	if (sa == NULL) {
-diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
--- openssh-6.1p1/packet.c.coverity	2012-03-09 00:28:07.000000000 +0100
-+++ openssh-6.1p1/packet.c	2012-09-14 21:16:41.284906588 +0200
-@@ -1177,6 +1177,7 @@ packet_read_poll1(void)
+diff -up openssh-6.2p1/packet.c.coverity openssh-6.2p1/packet.c
+--- openssh-6.2p1/packet.c.coverity	2013-02-12 01:03:59.000000000 +0100
+++ openssh-6.2p1/packet.c	2013-03-22 09:49:37.348595426 +0100
+@@ -1192,6 +1192,7 @@ packet_read_poll1(void)
 		case DEATTACK_DETECTED:
 			packet_disconnect("crc32 compensation attack: "
 			    "network attack detected");
@ -156,7 +156,7 @@ diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
 		case DEATTACK_DOS_DETECTED:
 			packet_disconnect("deattack denial of "
 			    "service detected");
-@@ -1678,7 +1679,7 @@ void
+@@ -1728,7 +1729,7 @@ void
 packet_write_wait(void)
 {
 	fd_set *setp;
@ -165,9 +165,9 @@ diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
 	struct timeval start, timeout, *timeoutp = NULL;
 
 	setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1,
-diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c
--- openssh-6.1p1/progressmeter.c.coverity	2006-08-05 04:39:40.000000000 +0200
-+++ openssh-6.1p1/progressmeter.c	2012-09-14 21:16:41.285906593 +0200
+diff -up openssh-6.2p1/progressmeter.c.coverity openssh-6.2p1/progressmeter.c
+--- openssh-6.2p1/progressmeter.c.coverity	2006-08-05 04:39:40.000000000 +0200
+++ openssh-6.2p1/progressmeter.c	2013-03-22 09:49:37.349595422 +0100
@@ -65,7 +65,7 @@ static void update_progress_meter(int);
 
 static time_t start;		/* start progress */
@ -186,9 +186,9 @@ diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c
 {
 	start = last_update = time(NULL);
 	file = f;
-diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h
--- openssh-6.1p1/progressmeter.h.coverity	2006-03-26 05:30:02.000000000 +0200
-+++ openssh-6.1p1/progressmeter.h	2012-09-14 21:16:41.286906598 +0200
+diff -up openssh-6.2p1/progressmeter.h.coverity openssh-6.2p1/progressmeter.h
+--- openssh-6.2p1/progressmeter.h.coverity	2006-03-26 05:30:02.000000000 +0200
+++ openssh-6.2p1/progressmeter.h	2013-03-22 09:49:37.349595422 +0100
@@ -23,5 +23,5 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
@ -196,9 +196,9 @@ diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h
 -void	start_progress_meter(char *, off_t, off_t *);
 +void	start_progress_meter(const char *, off_t, off_t *);
 void	stop_progress_meter(void);
-diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c
--- openssh-6.1p1/scp.c.coverity	2011-09-22 13:38:01.000000000 +0200
-+++ openssh-6.1p1/scp.c	2012-09-14 21:16:41.288906608 +0200
+diff -up openssh-6.2p1/scp.c.coverity openssh-6.2p1/scp.c
+--- openssh-6.2p1/scp.c.coverity	2013-03-20 02:55:15.000000000 +0100
+++ openssh-6.2p1/scp.c	2013-03-22 09:49:37.349595422 +0100
@@ -155,7 +155,7 @@ killchild(int signo)
 {
 	if (do_cmd_pid > 1) {
@ -208,10 +208,10 @@ diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c
 	}
 
 	if (signo)
-diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
--- openssh-6.1p1/servconf.c.coverity	2012-07-31 04:22:38.000000000 +0200
-+++ openssh-6.1p1/servconf.c	2012-09-14 21:16:41.291906623 +0200
-@@ -1249,7 +1249,7 @@ process_server_config_line(ServerOptions
+diff -up openssh-6.2p1/servconf.c.coverity openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.coverity	2013-02-12 01:02:08.000000000 +0100
+++ openssh-6.2p1/servconf.c	2013-03-22 09:49:37.350595418 +0100
+@@ -1268,7 +1268,7 @@ process_server_config_line(ServerOptions
 			fatal("%s line %d: Missing subsystem name.",
 			    filename, linenum);
 		if (!*activep) {
@ -220,7 +220,7 @@ diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
 			break;
 		}
 		for (i = 0; i < options->num_subsystems; i++)
-@@ -1340,8 +1340,9 @@ process_server_config_line(ServerOptions
+@@ -1359,8 +1359,9 @@ process_server_config_line(ServerOptions
 		if (*activep && *charptr == NULL) {
 			*charptr = tilde_expand_filename(arg, getuid());
 			/* increase optional counter */
@ -232,9 +232,9 @@ diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
 		}
 		break;
 
-diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
--- openssh-6.1p1/serverloop.c.coverity	2012-06-20 14:31:27.000000000 +0200
-+++ openssh-6.1p1/serverloop.c	2012-09-14 21:16:41.294906638 +0200
+diff -up openssh-6.2p1/serverloop.c.coverity openssh-6.2p1/serverloop.c
+--- openssh-6.2p1/serverloop.c.coverity	2012-12-07 03:07:47.000000000 +0100
+++ openssh-6.2p1/serverloop.c	2013-03-22 09:49:37.351595413 +0100
@@ -147,13 +147,13 @@ notify_setup(void)
 static void
 notify_parent(void)
@ -335,7 +335,7 @@ diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
 		pty_change_window_size(fdin, row, col, xpixel, ypixel);
 }
 
-@@ -996,7 +996,7 @@ server_request_tun(void)
+@@ -1003,7 +1003,7 @@ server_request_tun(void)
 	}
 
 	tun = packet_get_int();
@ -344,10 +344,10 @@ diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
 		if (tun != SSH_TUNID_ANY && forced_tun_device != tun)
 			goto done;
 		tun = forced_tun_device;
-diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
--- openssh-6.1p1/sftp.c.coverity	2012-06-30 00:33:32.000000000 +0200
-+++ openssh-6.1p1/sftp.c	2012-09-14 21:16:41.297906653 +0200
-@@ -206,7 +206,7 @@ killchild(int signo)
+diff -up openssh-6.2p1/sftp.c.coverity openssh-6.2p1/sftp.c
+--- openssh-6.2p1/sftp.c.coverity	2013-02-22 23:12:24.000000000 +0100
+++ openssh-6.2p1/sftp.c	2013-03-22 09:49:37.352595409 +0100
+@@ -202,7 +202,7 @@ killchild(int signo)
 {
 	if (sshpid > 1) {
 		kill(sshpid, SIGTERM);
@ -356,7 +356,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 	}
 
 	_exit(1);
-@@ -316,7 +316,7 @@ local_do_ls(const char *args)
+@@ -312,7 +312,7 @@ local_do_ls(const char *args)
 
 /* Strip one path (usually the pwd) from the start of another */
 static char *
@ -365,7 +365,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	size_t len;
 
-@@ -334,7 +334,7 @@ path_strip(char *path, char *strip)
+@@ -330,7 +330,7 @@ path_strip(char *path, char *strip)
 }
 
 static char *
@ -374,7 +374,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	char *abs_str;
 
-@@ -482,7 +482,7 @@ parse_df_flags(const char *cmd, char **a
+@@ -478,7 +478,7 @@ parse_df_flags(const char *cmd, char **a
 }
 
 static int
@ -383,7 +383,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	struct stat sb;
 
-@@ -494,7 +494,7 @@ is_dir(char *path)
+@@ -490,7 +490,7 @@ is_dir(char *path)
 }
 
 static int
@ -392,7 +392,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	Attrib *a;
 
-@@ -508,7 +508,7 @@ remote_is_dir(struct sftp_conn *conn, ch
+@@ -504,7 +504,7 @@ remote_is_dir(struct sftp_conn *conn, ch
 
 /* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */
 static int
@ -401,7 +401,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	size_t l = strlen(pathname);
 
-@@ -516,7 +516,7 @@ pathname_is_dir(char *pathname)
+@@ -512,7 +512,7 @@ pathname_is_dir(char *pathname)
 }
 
 static int
@ -410,7 +410,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
     int pflag, int rflag)
 {
 	char *abs_src = NULL;
-@@ -590,7 +590,7 @@ out:
+@@ -586,7 +586,7 @@ out:
 }
 
 static int
@ -419,7 +419,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
     int pflag, int rflag)
 {
 	char *tmp_dst = NULL;
-@@ -695,7 +695,7 @@ sdirent_comp(const void *aa, const void
+@@ -691,7 +691,7 @@ sdirent_comp(const void *aa, const void
 
 /* sftp ls.1 replacement for directories */
 static int
@ -428,7 +428,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	int n;
 	u_int c = 1, colspace = 0, columns = 1;
-@@ -780,7 +780,7 @@ do_ls_dir(struct sftp_conn *conn, char *
+@@ -776,7 +776,7 @@ do_ls_dir(struct sftp_conn *conn, char *
 
 /* sftp ls.1 replacement which handles path globs */
 static int
@ -437,7 +437,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
     int lflag)
 {
 	char *fname, *lname;
-@@ -861,7 +861,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
+@@ -857,7 +857,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
 }
 
 static int
@ -446,9 +446,9 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
 {
 	struct sftp_statvfs st;
 	char s_used[FMT_SCALED_STRSIZE];
-diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c
--- openssh-6.1p1/sftp-client.c.coverity	2012-07-02 14:15:39.000000000 +0200
-+++ openssh-6.1p1/sftp-client.c	2012-09-14 21:18:16.891332281 +0200
+diff -up openssh-6.2p1/sftp-client.c.coverity openssh-6.2p1/sftp-client.c
+--- openssh-6.2p1/sftp-client.c.coverity	2012-07-02 14:15:39.000000000 +0200
+++ openssh-6.2p1/sftp-client.c	2013-03-22 09:49:37.353595404 +0100
@@ -149,7 +149,7 @@ get_msg(struct sftp_conn *conn, Buffer *
 }
 
@ -656,9 +656,9 @@ diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c
 {
 	char *ret;
 	size_t len = strlen(p1) + strlen(p2) + 2;
-diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h
--- openssh-6.1p1/sftp-client.h.coverity	2010-12-04 23:02:48.000000000 +0100
-+++ openssh-6.1p1/sftp-client.h	2012-09-14 21:16:41.301906674 +0200
+diff -up openssh-6.2p1/sftp-client.h.coverity openssh-6.2p1/sftp-client.h
+--- openssh-6.2p1/sftp-client.h.coverity	2010-12-04 23:02:48.000000000 +0100
+++ openssh-6.2p1/sftp-client.h	2013-03-22 09:49:37.353595404 +0100
@@ -56,49 +56,49 @@ struct sftp_conn *do_init(int, int, u_in
 u_int sftp_proto_version(struct sftp_conn *);
 
@ -756,9 +756,9 @@ diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h
 +char *path_append(const char *, const char *);
 
 #endif
-diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c
--- openssh-6.1p1/ssh-agent.c.coverity	2011-06-03 06:14:16.000000000 +0200
-+++ openssh-6.1p1/ssh-agent.c	2012-09-14 21:16:41.303906683 +0200
+diff -up openssh-6.2p1/ssh-agent.c.coverity openssh-6.2p1/ssh-agent.c
+--- openssh-6.2p1/ssh-agent.c.coverity	2011-06-03 06:14:16.000000000 +0200
+++ openssh-6.2p1/ssh-agent.c	2013-03-22 09:49:37.354595400 +0100
@@ -1147,8 +1147,8 @@ main(int ac, char **av)
 	sanitise_stdfd();
 
@ -770,10 +770,10 @@ diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c
 
 #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
 	/* Disable ptrace on Linux without sgid bit */
-diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
--- openssh-6.1p1/sshd.c.coverity	2012-07-31 04:21:34.000000000 +0200
-+++ openssh-6.1p1/sshd.c	2012-09-14 21:16:41.307906705 +0200
-@@ -682,8 +682,10 @@ privsep_preauth(Authctxt *authctxt)
+diff -up openssh-6.2p1/sshd.c.coverity openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.coverity	2013-02-12 01:04:48.000000000 +0100
+++ openssh-6.2p1/sshd.c	2013-03-22 09:49:37.355595396 +0100
+@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
 		if (getuid() == 0 || geteuid() == 0)
 			privsep_preauth_child();
 		setproctitle("%s", "[net]");
@ -785,7 +785,7 @@ diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
 
 		return 0;
 	}
-@@ -1311,6 +1313,9 @@ server_accept_loop(int *sock_in, int *so
+@@ -1320,6 +1322,9 @@ server_accept_loop(int *sock_in, int *so
 		if (num_listen_socks < 0)
 			break;
 	}
@ -795,7 +795,7 @@ diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
 }
 
 
-@@ -1768,7 +1773,7 @@ main(int ac, char **av)
+@@ -1806,7 +1811,7 @@ main(int ac, char **av)
 
 	/* Chdir to the root directory so that the current disk can be
 	   unmounted if desired. */
--- a/openssh-6.2p1-ctr-cavstest.patch
+++ b/openssh-6.2p1-ctr-cavstest.patch
@ -1,6 +1,6 @@
-diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
--- openssh-5.9p1/ctr-cavstest.c.ctr-cavs	2012-01-13 15:59:06.584283289 +0100
-+++ openssh-5.9p1/ctr-cavstest.c	2012-01-13 18:21:33.791941027 +0100
+diff -up openssh-6.2p1/ctr-cavstest.c.ctr-cavs openssh-6.2p1/ctr-cavstest.c
+--- openssh-6.2p1/ctr-cavstest.c.ctr-cavs	2013-03-25 21:35:52.512586671 +0100
+++ openssh-6.2p1/ctr-cavstest.c	2013-03-25 21:35:52.512586671 +0100
@@ -0,0 +1,208 @@
 +/*
 + *
@ -194,7 +194,7 @@ diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
 +		return 2;
 +	}
 +
-+	cipher_crypt(&cc, outdata, data, datalen);
+	cipher_crypt(&cc, outdata, data, datalen, 0, 0);
 +
 +        xfree(data);
 +
@ -210,9 +210,9 @@ diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
 +        return 0;
 +}
 +
-diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
--- openssh-5.9p1/Makefile.in.ctr-cavs	2012-01-13 15:59:06.539282357 +0100
-+++ openssh-5.9p1/Makefile.in	2012-01-13 15:59:06.588283373 +0100
+diff -up openssh-6.2p1/Makefile.in.ctr-cavs openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ctr-cavs	2013-03-25 21:35:52.451586280 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-25 21:37:14.956114584 +0100
@@ -28,6 +28,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
 SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
@ -221,16 +221,16 @@ diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
 PRIVSEP_PATH=@PRIVSEP_PATH@
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -63,7 +64,7 @@ EXEEXT=@EXEEXT@
+@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
 MANFMT=@MANFMT@
 INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
 
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
 
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -171,6 +172,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -174,6 +175,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
 ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keycat.o
 	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
 
@ -240,7 +240,7 @@ diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
 
-@@ -271,6 +275,7 @@ install-files:
+@@ -281,6 +285,7 @@ install-files:
 		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
 	fi
 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
--- a/openssh-6.2p1-entropy.patch
+++ b/openssh-6.2p1-entropy.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c
--- openssh-6.0p1/entropy.c.entropy	2012-08-06 20:51:59.131033413 +0200
-+++ openssh-6.0p1/entropy.c	2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/entropy.c.entropy openssh-6.2p1/entropy.c
+--- openssh-6.2p1/entropy.c.entropy	2013-03-25 19:31:42.737611051 +0100
+++ openssh-6.2p1/entropy.c	2013-03-25 19:31:42.797611433 +0100
@@ -237,6 +237,9 @@ seed_rng(void)
 	memset(buf, '\0', sizeof(buf));
 
@ -11,21 +11,21 @@ diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c
 	if (RAND_status() != 1)
 		fatal("PRNG is not seeded");
 }
-diff -up openssh-6.0p1/openbsd-compat/Makefile.in.entropy openssh-6.0p1/openbsd-compat/Makefile.in
--- openssh-6.0p1/openbsd-compat/Makefile.in.entropy	2012-08-06 20:51:59.100033534 +0200
-+++ openssh-6.0p1/openbsd-compat/Makefile.in	2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.entropy openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.entropy	2013-03-25 19:31:42.798611440 +0100
+++ openssh-6.2p1/openbsd-compat/Makefile.in	2013-03-25 19:33:02.042116876 +0100
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
 
- COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
 
 -PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
 +PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
 
 .c.o:
 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/openbsd-compat/port-linux-prng.c
--- openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy	2012-08-06 20:51:59.171033257 +0200
-+++ openssh-6.0p1/openbsd-compat/port-linux-prng.c	2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.2p1/openbsd-compat/port-linux-prng.c
+--- openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy	2013-03-25 19:31:42.798611440 +0100
+++ openssh-6.2p1/openbsd-compat/port-linux-prng.c	2013-03-25 19:31:42.798611440 +0100
@@ -0,0 +1,59 @@
 +/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
 +
@ -86,37 +86,10 @@ diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/op
 +			fatal ("EOF reading %s", random);
 +	}
 +}
-diff -up openssh-6.0p1/ssh.1.entropy openssh-6.0p1/ssh.1
--- openssh-6.0p1/ssh.1.entropy	2012-08-06 20:51:59.139033382 +0200
-+++ openssh-6.0p1/ssh.1	2012-08-06 20:51:59.174033245 +0200
-@@ -1269,6 +1269,23 @@ For more information, see the
- .Cm PermitUserEnvironment
- option in
- .Xr sshd_config 5 .
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.It Ev SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 6 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh FILES
- .Bl -tag -width Ds -compact
- .It Pa ~/.rhosts
-diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0
--- openssh-6.1p1/ssh-add.0.entropy	2012-11-12 13:11:42.717393364 +0100
-+++ openssh-6.1p1/ssh-add.0	2012-11-12 13:12:46.288108790 +0100
-@@ -81,6 +81,16 @@ ENVIRONMENT
+diff -up openssh-6.2p1/ssh-add.0.entropy openssh-6.2p1/ssh-add.0
+--- openssh-6.2p1/ssh-add.0.entropy	2013-03-22 00:38:29.000000000 +0100
+++ openssh-6.2p1/ssh-add.0	2013-03-25 19:31:42.799611446 +0100
+@@ -82,6 +82,16 @@ ENVIRONMENT
              Identifies the path of a UNIX-domain socket used to communicate
              with the agent.
 
@ -133,9 +106,9 @@ diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0
 FILES
      ~/.ssh/identity
              Contains the protocol version 1 RSA authentication identity of
-diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1
--- openssh-6.1p1/ssh-add.1.entropy	2011-10-18 07:06:33.000000000 +0200
-+++ openssh-6.1p1/ssh-add.1	2012-11-12 13:11:24.711476108 +0100
+diff -up openssh-6.2p1/ssh-add.1.entropy openssh-6.2p1/ssh-add.1
+--- openssh-6.2p1/ssh-add.1.entropy	2012-12-07 03:06:13.000000000 +0100
+++ openssh-6.2p1/ssh-add.1	2013-03-25 19:31:42.799611446 +0100
@@ -160,6 +160,20 @@ to make this work.)
 Identifies the path of a
 .Ux Ns -domain
@ -157,10 +130,9 @@ diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1
 .El
 .Sh FILES
 .Bl -tag -width Ds
- .It Pa ~/.ssh/identity
-diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1
--- openssh-6.0p1/ssh-agent.1.entropy	2010-12-01 01:50:35.000000000 +0100
-+++ openssh-6.0p1/ssh-agent.1	2012-08-06 20:51:59.172033253 +0200
+diff -up openssh-6.2p1/ssh-agent.1.entropy openssh-6.2p1/ssh-agent.1
+--- openssh-6.2p1/ssh-agent.1.entropy	2010-12-01 01:50:35.000000000 +0100
+++ openssh-6.2p1/ssh-agent.1	2013-03-25 19:31:42.800611452 +0100
@@ -198,6 +198,24 @@ sockets used to contain the connection t
 These sockets should only be readable by the owner.
 The sockets should get automatically removed when the agent exits.
@ -186,10 +158,10 @@ diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-add 1 ,
-diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8
--- openssh-6.0p1/sshd.8.entropy	2012-08-06 20:51:59.139033382 +0200
-+++ openssh-6.0p1/sshd.8	2012-08-06 20:51:59.174033245 +0200
-@@ -943,6 +943,24 @@ concurrently for different ports, this c
+diff -up openssh-6.2p1/sshd.8.entropy openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.entropy	2013-03-25 19:31:42.752611146 +0100
+++ openssh-6.2p1/sshd.8	2013-03-25 19:31:42.800611452 +0100
+@@ -945,6 +945,24 @@ concurrently for different ports, this c
 started last).
 The content of this file is not sensitive; it can be world-readable.
 .El
@ -214,10 +186,10 @@ diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8
 .Sh IPV6
 IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell.
 .Sh SEE ALSO
-diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1
--- openssh-6.0p1/ssh-keygen.1.entropy	2011-10-18 07:05:21.000000000 +0200
-+++ openssh-6.0p1/ssh-keygen.1	2012-08-06 20:51:59.173033249 +0200
-@@ -675,6 +675,24 @@ Contains Diffie-Hellman groups used for
+diff -up openssh-6.2p1/ssh-keygen.1.entropy openssh-6.2p1/ssh-keygen.1
+--- openssh-6.2p1/ssh-keygen.1.entropy	2013-01-20 12:35:06.000000000 +0100
+++ openssh-6.2p1/ssh-keygen.1	2013-03-25 19:31:42.801611459 +0100
+@@ -806,6 +806,24 @@ Contains Diffie-Hellman groups used for
 The file format is described in
 .Xr moduli 5 .
 .El
@ -242,9 +214,9 @@ diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-add 1 ,
-diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8
--- openssh-6.0p1/ssh-keysign.8.entropy	2010-08-31 14:41:14.000000000 +0200
-+++ openssh-6.0p1/ssh-keysign.8	2012-08-06 20:51:59.173033249 +0200
+diff -up openssh-6.2p1/ssh-keysign.8.entropy openssh-6.2p1/ssh-keysign.8
+--- openssh-6.2p1/ssh-keysign.8.entropy	2010-08-31 14:41:14.000000000 +0200
+++ openssh-6.2p1/ssh-keysign.8	2013-03-25 19:31:42.801611459 +0100
@@ -78,6 +78,24 @@ must be set-uid root if host-based authe
 If these files exist they are assumed to contain public certificate
 information corresponding with the private keys above.
@ -270,3 +242,30 @@ diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-keygen 1 ,
+diff -up openssh-6.2p1/ssh.1.entropy openssh-6.2p1/ssh.1
+--- openssh-6.2p1/ssh.1.entropy	2013-03-25 19:31:42.752611146 +0100
+++ openssh-6.2p1/ssh.1	2013-03-25 19:31:42.799611446 +0100
+@@ -1277,6 +1277,23 @@ For more information, see the
+ .Cm PermitUserEnvironment
+ option in
+ .Xr sshd_config 5 .
+.Sh ENVIRONMENT
+.Bl -tag -width Ds -compact
+.It Ev SSH_USE_STRONG_RNG
+The reseeding of the OpenSSL random generator is usually done from
+.Cm /dev/urandom .
+If the 
+.Cm SSH_USE_STRONG_RNG
+environment variable is set to value other than
+.Cm 0
+the OpenSSL random generator is reseeded from
+.Cm /dev/random .
+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
+Minimum is 6 bytes.
+This setting is not recommended on the computers without the hardware
+random generator because insufficient entropy causes the connection to 
+be blocked until enough entropy is available.
+.El
+ .Sh FILES
+ .Bl -tag -width Ds -compact
+ .It Pa ~/.rhosts
--- a/openssh-6.2p1-fingerprint.patch
+++ b/openssh-6.2p1-fingerprint.patch
@ -1,6 +1,6 @@
-diff -up openssh-5.8p1/auth2-hostbased.c.fingerprint openssh-5.8p1/auth2-hostbased.c
--- openssh-5.8p1/auth2-hostbased.c.fingerprint	2010-08-05 05:04:50.000000000 +0200
-+++ openssh-5.8p1/auth2-hostbased.c	2011-02-25 09:17:18.000000000 +0100
+diff -up openssh-6.2p1/auth2-hostbased.c.fingerprint openssh-6.2p1/auth2-hostbased.c
+--- openssh-6.2p1/auth2-hostbased.c.fingerprint	2010-08-05 05:04:50.000000000 +0200
+++ openssh-6.2p1/auth2-hostbased.c	2013-03-22 12:20:49.009685008 +0100
@@ -196,16 +196,18 @@ hostbased_key_allowed(struct passwd *pw,
 
 	if (host_status == HOST_OK) {
@ -27,10 +27,10 @@ diff -up openssh-5.8p1/auth2-hostbased.c.fingerprint openssh-5.8p1/auth2-hostbas
 		}
 		xfree(fp);
 	}
-diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
--- openssh-5.8p1/auth2-pubkey.c.fingerprint	2010-12-01 01:50:14.000000000 +0100
-+++ openssh-5.8p1/auth2-pubkey.c	2011-02-25 09:17:18.000000000 +0100
-@@ -319,10 +319,10 @@ user_key_allowed2(struct passwd *pw, Key
+diff -up openssh-6.2p1/auth2-pubkey.c.fingerprint openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.fingerprint	2013-02-15 00:28:56.000000000 +0100
+++ openssh-6.2p1/auth2-pubkey.c	2013-03-22 12:20:49.009685008 +0100
+@@ -317,10 +317,10 @@ check_authkeys_file(FILE *f, char *file,
 				continue;
 			if (!key_is_cert_authority)
 				continue;
@ -45,7 +45,7 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
 			/*
 			 * If the user has specified a list of principals as
 			 * a key option, then prefer that list to matching
-@@ -362,9 +362,9 @@ user_key_allowed2(struct passwd *pw, Key
+@@ -360,9 +360,9 @@ check_authkeys_file(FILE *f, char *file,
 			found_key = 1;
 			debug("matching key found: file %s, line %lu",
 			    file, linenum);
@ -58,7 +58,7 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
 			xfree(fp);
 			break;
 		}
-@@ -388,13 +388,13 @@ user_cert_trusted_ca(struct passwd *pw, 
+@@ -384,13 +384,13 @@ user_cert_trusted_ca(struct passwd *pw,
 	if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
 		return 0;
 
@ -76,12 +76,12 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
 		    options.trusted_user_ca_keys);
 		goto out;
 	}
-diff -up openssh-5.8p1/auth.c.fingerprint openssh-5.8p1/auth.c
--- openssh-5.8p1/auth.c.fingerprint	2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1/auth.c	2011-02-25 09:17:18.000000000 +0100
-@@ -639,9 +639,10 @@ auth_key_is_revoked(Key *key)
- 		return 1;
+diff -up openssh-6.2p1/auth.c.fingerprint openssh-6.2p1/auth.c
+--- openssh-6.2p1/auth.c.fingerprint	2013-03-12 01:31:05.000000000 +0100
+++ openssh-6.2p1/auth.c	2013-03-22 12:22:32.515230386 +0100
+@@ -663,9 +663,10 @@ auth_key_is_revoked(Key *key)
 	case 1:
+  revoked:
 		/* Key revoked */
 -		key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
 +		key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
@ -92,10 +92,10 @@ diff -up openssh-5.8p1/auth.c.fingerprint openssh-5.8p1/auth.c
 		xfree(key_fp);
 		return 1;
 	}
-diff -up openssh-5.8p1/auth-rsa.c.fingerprint openssh-5.8p1/auth-rsa.c
--- openssh-5.8p1/auth-rsa.c.fingerprint	2010-12-04 23:01:47.000000000 +0100
-+++ openssh-5.8p1/auth-rsa.c	2011-02-25 09:17:18.000000000 +0100
-@@ -318,9 +318,9 @@ auth_rsa(Authctxt *authctxt, BIGNUM *cli
+diff -up openssh-6.2p1/auth-rsa.c.fingerprint openssh-6.2p1/auth-rsa.c
+--- openssh-6.2p1/auth-rsa.c.fingerprint	2012-10-30 22:58:59.000000000 +0100
+++ openssh-6.2p1/auth-rsa.c	2013-03-22 12:20:49.011684999 +0100
+@@ -328,9 +328,9 @@ auth_rsa(Authctxt *authctxt, BIGNUM *cli
 	 * options; this will be reset if the options cause the
 	 * authentication to be rejected.
 	 */
@ -108,10 +108,10 @@ diff -up openssh-5.8p1/auth-rsa.c.fingerprint openssh-5.8p1/auth-rsa.c
 	xfree(fp);
 	key_free(key);
 
-diff -up openssh-5.8p1/key.c.fingerprint openssh-5.8p1/key.c
--- openssh-5.8p1/key.c.fingerprint	2011-02-04 01:48:34.000000000 +0100
-+++ openssh-5.8p1/key.c	2011-02-25 09:18:16.000000000 +0100
-@@ -594,6 +594,34 @@ key_fingerprint(Key *k, enum fp_type dgs
+diff -up openssh-6.2p1/key.c.fingerprint openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.fingerprint	2013-03-22 12:20:48.971685175 +0100
+++ openssh-6.2p1/key.c	2013-03-22 12:20:49.012684995 +0100
+@@ -599,6 +599,34 @@ key_fingerprint(Key *k, enum fp_type dgs
 	return retval;
 }
 
@ -146,23 +146,23 @@ diff -up openssh-5.8p1/key.c.fingerprint openssh-5.8p1/key.c
 /*
  * Reads a multiple-precision integer in decimal from the buffer, and advances
  * the pointer.  The integer must already be initialized.  This function is
-diff -up openssh-5.8p1/key.h.fingerprint openssh-5.8p1/key.h
--- openssh-5.8p1/key.h.fingerprint	2010-11-05 00:19:49.000000000 +0100
-+++ openssh-5.8p1/key.h	2011-02-25 09:17:18.000000000 +0100
-@@ -96,6 +96,9 @@ int		 key_equal_public(const Key *, cons
+diff -up openssh-6.2p1/key.h.fingerprint openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.fingerprint	2013-01-18 01:44:05.000000000 +0100
+++ openssh-6.2p1/key.h	2013-03-22 12:23:35.308954528 +0100
+@@ -97,6 +97,9 @@ int		 key_equal_public(const Key *, cons
 int		 key_equal(const Key *, const Key *);
 char		*key_fingerprint(Key *, enum fp_type, enum fp_rep);
- u_char		*key_fingerprint_raw(Key *, enum fp_type, u_int *);
+ u_char		*key_fingerprint_raw(const Key *, enum fp_type, u_int *);
 +enum fp_type	 key_fingerprint_selection(void);
 +char		*key_selected_fingerprint(Key *, enum fp_rep);
 +char		*key_fingerprint_prefix(void);
 const char	*key_type(const Key *);
 const char	*key_cert_type(const Key *);
 int		 key_write(const Key *, FILE *);
-diff -up openssh-5.8p1/ssh-add.c.fingerprint openssh-5.8p1/ssh-add.c
--- openssh-5.8p1/ssh-add.c.fingerprint	2010-11-11 04:17:02.000000000 +0100
-+++ openssh-5.8p1/ssh-add.c	2011-02-25 09:17:18.000000000 +0100
-@@ -280,10 +280,10 @@ list_identities(AuthenticationConnection
+diff -up openssh-6.2p1/ssh-add.c.fingerprint openssh-6.2p1/ssh-add.c
+--- openssh-6.2p1/ssh-add.c.fingerprint	2012-12-07 03:07:03.000000000 +0100
+++ openssh-6.2p1/ssh-add.c	2013-03-22 12:20:49.029684920 +0100
+@@ -326,10 +326,10 @@ list_identities(AuthenticationConnection
 		    key = ssh_get_next_identity(ac, &comment, version)) {
 			had_identities = 1;
 			if (do_fp) {
@ -177,9 +177,9 @@ diff -up openssh-5.8p1/ssh-add.c.fingerprint openssh-5.8p1/ssh-add.c
 				xfree(fp);
 			} else {
 				if (!key_write(key, stdout))
-diff -up openssh-5.8p1/ssh-agent.c.fingerprint openssh-5.8p1/ssh-agent.c
--- openssh-5.8p1/ssh-agent.c.fingerprint	2010-12-01 01:50:35.000000000 +0100
-+++ openssh-5.8p1/ssh-agent.c	2011-02-25 09:17:18.000000000 +0100
+diff -up openssh-6.2p1/ssh-agent.c.fingerprint openssh-6.2p1/ssh-agent.c
+--- openssh-6.2p1/ssh-agent.c.fingerprint	2013-03-22 12:20:48.979685140 +0100
+++ openssh-6.2p1/ssh-agent.c	2013-03-22 12:20:49.030684916 +0100
@@ -199,9 +199,9 @@ confirm_key(Identity *id)
 	char *p;
 	int ret = -1;
@ -193,10 +193,10 @@ diff -up openssh-5.8p1/ssh-agent.c.fingerprint openssh-5.8p1/ssh-agent.c
 		ret = 0;
 	xfree(p);
 
-diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
--- openssh-5.8p1/sshconnect2.c.fingerprint	2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1/sshconnect2.c	2011-02-25 09:17:18.000000000 +0100
-@@ -590,8 +590,9 @@ input_userauth_pk_ok(int type, u_int32_t
+diff -up openssh-6.2p1/sshconnect2.c.fingerprint openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.fingerprint	2013-03-20 02:55:15.000000000 +0100
+++ openssh-6.2p1/sshconnect2.c	2013-03-22 12:20:49.031684912 +0100
+@@ -592,8 +592,9 @@ input_userauth_pk_ok(int type, u_int32_t
 		    key->type, pktype);
 		goto done;
 	}
@ -208,7 +208,7 @@ diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
 	xfree(fp);
 
 	/*
-@@ -1203,8 +1204,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
+@@ -1205,8 +1206,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
 	int have_sig = 1;
 	char *fp;
 
@ -220,10 +220,10 @@ diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
 	xfree(fp);
 
 	if (key_to_blob(id->key, &blob, &bloblen) == 0) {
-diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
--- openssh-5.8p1/sshconnect.c.fingerprint	2011-01-16 13:17:59.000000000 +0100
-+++ openssh-5.8p1/sshconnect.c	2011-02-25 09:17:18.000000000 +0100
-@@ -798,10 +798,10 @@ check_host_key(char *hostname, struct so
+diff -up openssh-6.2p1/sshconnect.c.fingerprint openssh-6.2p1/sshconnect.c
+--- openssh-6.2p1/sshconnect.c.fingerprint	2012-09-17 05:25:44.000000000 +0200
+++ openssh-6.2p1/sshconnect.c	2013-03-22 12:20:49.032684907 +0100
+@@ -824,10 +824,10 @@ check_host_key(char *hostname, struct so
 				    "key for IP address '%.128s' to the list "
 				    "of known hosts.", type, ip);
 		} else if (options.visual_host_key) {
@ -238,7 +238,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 			xfree(ra);
 			xfree(fp);
 		}
-@@ -838,9 +838,8 @@ check_host_key(char *hostname, struct so
+@@ -865,9 +865,8 @@ check_host_key(char *hostname, struct so
 			else
 				snprintf(msg1, sizeof(msg1), ".");
 			/* The default */
@ -250,7 +250,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 			msg2[0] = '\0';
 			if (options.verify_host_key_dns) {
 				if (matching_host_key_dns)
-@@ -855,10 +854,11 @@ check_host_key(char *hostname, struct so
+@@ -882,10 +881,11 @@ check_host_key(char *hostname, struct so
 			snprintf(msg, sizeof(msg),
 			    "The authenticity of host '%.200s (%s)' can't be "
 			    "established%s\n"
@ -264,7 +264,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 			    options.visual_host_key ? "\n" : "",
 			    options.visual_host_key ? ra : "",
 			    msg2);
-@@ -1104,8 +1104,9 @@ verify_host_key(char *host, struct socka
+@@ -1130,8 +1130,9 @@ verify_host_key(char *host, struct socka
 	int flags = 0;
 	char *fp;
 
@ -276,7 +276,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 	xfree(fp);
 
 	/* XXX certs are not yet supported for DNS */
-@@ -1214,14 +1215,15 @@ show_other_keys(struct hostkeys *hostkey
+@@ -1232,14 +1233,15 @@ show_other_keys(struct hostkeys *hostkey
 			continue;
 		if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
 			continue;
@ -296,7 +296,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 		if (options.visual_host_key)
 			logit("%s", ra);
 		xfree(ra);
-@@ -1236,7 +1238,7 @@ warn_changed_key(Key *host_key)
+@@ -1254,7 +1256,7 @@ warn_changed_key(Key *host_key)
 {
 	char *fp;
 
@ -305,7 +305,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 
 	error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
 	error("@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @");
-@@ -1244,8 +1246,8 @@ warn_changed_key(Key *host_key)
+@@ -1262,8 +1264,8 @@ warn_changed_key(Key *host_key)
 	error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
 	error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
 	error("It is also possible that a host key has just been changed.");
@ -316,10 +316,10 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
 	error("Please contact your system administrator.");
 
 	xfree(fp);
-diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
--- openssh-5.8p1/ssh-keygen.c.fingerprint	2011-01-11 07:20:31.000000000 +0100
-+++ openssh-5.8p1/ssh-keygen.c	2011-02-25 09:17:18.000000000 +0100
-@@ -714,13 +714,14 @@ do_fingerprint(struct passwd *pw)
+diff -up openssh-6.2p1/ssh-keygen.c.fingerprint openssh-6.2p1/ssh-keygen.c
+--- openssh-6.2p1/ssh-keygen.c.fingerprint	2013-02-12 01:03:36.000000000 +0100
+++ openssh-6.2p1/ssh-keygen.c	2013-03-22 12:20:49.033684903 +0100
+@@ -767,13 +767,14 @@ do_fingerprint(struct passwd *pw)
 {
 	FILE *f;
 	Key *public;
@ -336,7 +336,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
 	rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
 
 	if (!have_identity)
-@@ -732,8 +733,8 @@ do_fingerprint(struct passwd *pw)
+@@ -785,8 +786,8 @@ do_fingerprint(struct passwd *pw)
 	public = key_load_public(identity_file, &comment);
 	if (public != NULL) {
 		fp = key_fingerprint(public, fptype, rep);
@ -347,7 +347,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
 		    key_type(public));
 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
 			printf("%s\n", ra);
-@@ -798,8 +799,8 @@ do_fingerprint(struct passwd *pw)
+@@ -851,8 +852,8 @@ do_fingerprint(struct passwd *pw)
 		}
 		comment = *cp ? cp : comment;
 		fp = key_fingerprint(public, fptype, rep);
@ -358,7 +358,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
 		    comment ? comment : "no comment", key_type(public));
 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
 			printf("%s\n", ra);
-@@ -823,13 +824,15 @@ printhost(FILE *f, const char *name, Key
+@@ -970,13 +971,15 @@ printhost(FILE *f, const char *name, Key
 	if (print_fingerprint) {
 		enum fp_rep rep;
 		enum fp_type fptype;
@ -378,7 +378,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
 		    key_type(public));
 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
 			printf("%s\n", ra);
-@@ -1695,16 +1698,17 @@ do_show_cert(struct passwd *pw)
+@@ -1854,16 +1857,17 @@ do_show_cert(struct passwd *pw)
 		fatal("%s is not a certificate", identity_file);
 	v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
 
@ -402,7 +402,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
 	printf("        Key ID: \"%s\"\n", key->cert->key_id);
 	if (!v00) {
 		printf("        Serial: %llu\n",
-@@ -2249,13 +2253,12 @@ passphrase_again:
+@@ -2651,13 +2655,12 @@ passphrase_again:
 	fclose(f);
 
 	if (!quiet) {
--- a/openssh-6.2p1-fips.patch
+++ b/openssh-6.2p1-fips.patch
@ -1,6 +1,6 @@
-diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
--- openssh-5.9p1/authfile.c.fips	2012-07-17 20:57:35.078155160 +0200
-+++ openssh-5.9p1/authfile.c	2012-07-17 20:57:35.086155338 +0200
+diff -up openssh-6.2p1/authfile.c.fips openssh-6.2p1/authfile.c
+--- openssh-6.2p1/authfile.c.fips	2013-03-27 13:14:49.164683482 +0100
+++ openssh-6.2p1/authfile.c	2013-03-27 13:14:49.177683431 +0100
@@ -148,8 +148,14 @@ key_private_rsa1_to_blob(Key *key, Buffe
 	/* Allocate space for the private part of the key in the buffer. */
 	cp = buffer_append_space(&encrypted, buffer_len(&buffer));
@ -16,7 +16,7 @@ diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
 +	}
 +
 	cipher_crypt(&ciphercontext, cp,
- 	    buffer_ptr(&buffer), buffer_len(&buffer));
+ 	    buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
 	cipher_cleanup(&ciphercontext);
@@ -472,8 +478,13 @@ key_parse_private_rsa1(Buffer *blob, con
 	cp = buffer_append_space(&decrypted, buffer_len(&copy));
@ -32,11 +32,11 @@ diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
 +	}
 +
 	cipher_crypt(&ciphercontext, cp,
- 	    buffer_ptr(&copy), buffer_len(&copy));
+ 	    buffer_ptr(&copy), buffer_len(&copy), 0, 0);
 	cipher_cleanup(&ciphercontext);
-diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
--- openssh-5.9p1/cipher.c.fips	2012-07-17 20:57:34.988153164 +0200
-+++ openssh-5.9p1/cipher.c	2012-07-17 20:57:35.086155338 +0200
+diff -up openssh-6.2p1/cipher.c.fips openssh-6.2p1/cipher.c
+--- openssh-6.2p1/cipher.c.fips	2013-03-27 13:14:49.087683788 +0100
+++ openssh-6.2p1/cipher.c	2013-03-27 13:14:49.177683431 +0100
@@ -40,6 +40,7 @@
 #include <sys/types.h>
 
@ -45,30 +45,35 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
 
 #include <string.h>
 #include <stdarg.h>
-@@ -86,6 +87,22 @@ struct Cipher ciphers[] = {
- 	{ NULL,			SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
+@@ -89,6 +90,27 @@ struct Cipher ciphers[] = {
+ 	{ NULL,		SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
 };
 
 +struct Cipher fips_ciphers[] = {
-+	{ "none",		SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
-+	{ "3des",		SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
+	{ "none",		SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+	{ "3des",		SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
 +
-+	{ "3des-cbc",		SSH_CIPHER_SSH2, 8, 24, 0, 1, EVP_des_ede3_cbc },
-+	{ "aes128-cbc",		SSH_CIPHER_SSH2, 16, 16, 0, 1, EVP_aes_128_cbc },
-+	{ "aes192-cbc",		SSH_CIPHER_SSH2, 16, 24, 0, 1, EVP_aes_192_cbc },
-+	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
+	{ "3des-cbc",		SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
+	{ "aes128-cbc",		SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
+	{ "aes192-cbc",		SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
+	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
 +	{ "rijndael-cbc@lysator.liu.se",
-+				SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
-+	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
-+	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
-+	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
-+	{ NULL,			SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
+				SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
+	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_128_ctr },
+	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_128_ctr },
+#ifdef OPENSSL_HAVE_EVPGCM
+	{ "aes128-gcm@openssh.com",
+			SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
+	{ "aes256-gcm@openssh.com",
+			SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
+#endif
+	{ NULL,			SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, NULL }
 +};
-+
 /*--*/
 
 u_int
-@@ -128,7 +145,7 @@ Cipher *
+@@ -143,7 +165,7 @@ Cipher *
 cipher_by_name(const char *name)
 {
 	Cipher *c;
@ -77,7 +82,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
 		if (strcmp(c->name, name) == 0)
 			return c;
 	return NULL;
-@@ -138,7 +155,7 @@ Cipher *
+@@ -153,7 +175,7 @@ Cipher *
 cipher_by_number(int id)
 {
 	Cipher *c;
@ -86,7 +91,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
 		if (c->number == id)
 			return c;
 	return NULL;
-@@ -182,7 +199,7 @@ cipher_number(const char *name)
+@@ -197,7 +219,7 @@ cipher_number(const char *name)
 	Cipher *c;
 	if (name == NULL)
 		return -1;
@ -95,7 +100,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
 		if (strcasecmp(c->name, name) == 0)
 			return c->number;
 	return -1;
-@@ -289,14 +306,15 @@ cipher_cleanup(CipherContext *cc)
+@@ -356,14 +378,15 @@ cipher_cleanup(CipherContext *cc)
  * passphrase and using the resulting 16 bytes as the key.
  */
 
@ -113,7 +118,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
 	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
 	MD5_Final(digest, &md);
 
-@@ -304,6 +322,7 @@ cipher_set_key_string(CipherContext *cc,
+@@ -371,6 +394,7 @@ cipher_set_key_string(CipherContext *cc,
 
 	memset(digest, 0, sizeof(digest));
 	memset(&md, 0, sizeof(md));
@ -121,10 +126,10 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
 }
 
 /*
-diff -up openssh-5.9p1/cipher-ctr.c.fips openssh-5.9p1/cipher-ctr.c
--- openssh-5.9p1/cipher-ctr.c.fips	2010-10-07 13:06:42.000000000 +0200
-+++ openssh-5.9p1/cipher-ctr.c	2012-07-17 20:57:35.086155338 +0200
-@@ -140,7 +140,8 @@ evp_aes_128_ctr(void)
+diff -up openssh-6.2p1/cipher-ctr.c.fips openssh-6.2p1/cipher-ctr.c
+--- openssh-6.2p1/cipher-ctr.c.fips	2013-01-20 12:31:30.000000000 +0100
+++ openssh-6.2p1/cipher-ctr.c	2013-03-27 13:14:49.177683431 +0100
+@@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
 	aes_ctr.do_cipher = ssh_aes_ctr;
 #ifndef SSH_OLD_EVP
 	aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
@ -134,21 +139,21 @@ diff -up openssh-5.9p1/cipher-ctr.c.fips openssh-5.9p1/cipher-ctr.c
 #endif
 	return (&aes_ctr);
 }
-diff -up openssh-5.9p1/cipher.h.fips openssh-5.9p1/cipher.h
--- openssh-5.9p1/cipher.h.fips	2012-07-17 20:57:34.989153186 +0200
-+++ openssh-5.9p1/cipher.h	2012-07-17 20:57:35.087155360 +0200
-@@ -87,7 +87,7 @@ void	 cipher_init(CipherContext *, Ciphe
-     const u_char *, u_int, int);
- void	 cipher_crypt(CipherContext *, u_char *, const u_char *, u_int);
+diff -up openssh-6.2p1/cipher.h.fips openssh-6.2p1/cipher.h
+--- openssh-6.2p1/cipher.h.fips	2013-03-27 13:14:49.088683784 +0100
+++ openssh-6.2p1/cipher.h	2013-03-27 13:14:49.177683431 +0100
+@@ -91,7 +91,7 @@ void	 cipher_init(CipherContext *, Ciphe
+ void	 cipher_crypt(CipherContext *, u_char *, const u_char *,
+     u_int, u_int, u_int);
 void	 cipher_cleanup(CipherContext *);
 -void	 cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
 +int	 cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
 u_int	 cipher_blocksize(const Cipher *);
 u_int	 cipher_keylen(const Cipher *);
- u_int	 cipher_is_cbc(const Cipher *);
-diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
--- openssh-5.9p1/key.c.fips	2012-07-17 20:57:35.007153585 +0200
-+++ openssh-5.9p1/key.c	2012-07-17 20:57:35.087155360 +0200
+ u_int	 cipher_authlen(const Cipher *);
+diff -up openssh-6.2p1/key.c.fips openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.fips	2013-03-27 13:14:49.100683736 +0100
+++ openssh-6.2p1/key.c	2013-03-27 13:14:49.178683427 +0100
@@ -40,6 +40,7 @@
 #include <sys/types.h>
 
@ -157,7 +162,7 @@ diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
 #include <openbsd-compat/openssl-compat.h>
 
 #include <stdarg.h>
-@@ -602,9 +603,13 @@ key_fingerprint_selection(void)
+@@ -607,9 +608,13 @@ key_fingerprint_selection(void)
 	char *env;
 
 	if (!rv_defined) {
@ -174,9 +179,9 @@ diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
 		rv_defined = 1;
 	}
 	return rv;
-diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
--- openssh-5.9p1/mac.c.fips	2012-07-17 20:57:34.996153341 +0200
-+++ openssh-5.9p1/mac.c	2012-07-17 20:58:35.584497499 +0200
+diff -up openssh-6.2p1/mac.c.fips openssh-6.2p1/mac.c
+--- openssh-6.2p1/mac.c.fips	2013-03-27 13:14:49.093683764 +0100
+++ openssh-6.2p1/mac.c	2013-03-27 13:16:33.524266158 +0100
@@ -28,6 +28,7 @@
 #include <sys/types.h>
 
@ -185,32 +190,35 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
 
 #include <stdarg.h>
 #include <string.h>
-@@ -47,14 +48,14 @@
- #define SSH_EVP		1	/* OpenSSL EVP-based MAC */
+@@ -50,7 +51,7 @@
 #define SSH_UMAC	2	/* UMAC (not integrated with OpenSSL) */
+ #define SSH_UMAC128	3
 
 -struct {
 +struct Macs {
 	char		*name;
 	int		type;
 	const EVP_MD *	(*mdfunc)(void);
- 	int		truncatebits;	/* truncate digest if != 0 */
+@@ -58,7 +59,9 @@ struct {
 	int		key_len;	/* just for UMAC */
 	int		len;		/* just for UMAC */
+ 	int		etm;		/* Encrypt-then-MAC */
 -} macs[] = {
-+} all_macs[] = {
- 	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, -1, -1 },
- 	{ "hmac-sha1-96",		SSH_EVP, EVP_sha1, 96, -1, -1 },
- #ifdef HAVE_EVP_SHA256
-@@ -71,9 +72,19 @@ struct {
- 	{ NULL,				0, NULL, 0, -1, -1 }
+};
+
+struct Macs all_macs[] = {
+ 	/* Encrypt-and-MAC (encrypt-and-authenticate) variants */
+ 	{ "hmac-sha1",				SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+ 	{ "hmac-sha1-96",			SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
+@@ -89,9 +92,19 @@ struct {
+ 	{ NULL,					0, NULL, 0, 0, 0, 0 }
 };
 
 +struct Macs fips_macs[] = {
-+	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, -1, -1 },
+	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
 +#ifdef HAVE_EVP_SHA256
-+	{ "hmac-sha2-256",		SSH_EVP, EVP_sha256, 0, -1, -1 },
-+	{ "hmac-sha2-512",		SSH_EVP, EVP_sha512, 0, -1, -1 },
+	{ "hmac-sha2-256",		SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
+	{ "hmac-sha2-512",		SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
 +#endif
 +	{ NULL,				0, NULL, 0, -1, -1 }
 +};
@ -222,7 +230,7 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
 	int evp_len;
 	mac->type = macs[which].type;
 	if (mac->type == SSH_EVP) {
-@@ -94,6 +105,7 @@ int
+@@ -113,6 +126,7 @@ int
 mac_setup(Mac *mac, char *name)
 {
 	int i;
@ -230,19 +238,19 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
 
 	for (i = 0; macs[i].name; i++) {
 		if (strcmp(name, macs[i].name) == 0) {
-diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
--- openssh-5.9p1/Makefile.in.fips	2012-07-17 20:57:35.069154962 +0200
-+++ openssh-5.9p1/Makefile.in	2012-07-17 20:57:35.086155338 +0200
-@@ -142,25 +142,25 @@ libssh.a: $(LIBSSH_OBJS)
+diff -up openssh-6.2p1/Makefile.in.fips openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.fips	2013-03-27 13:14:49.155683518 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-27 13:14:49.178683427 +0100
+@@ -145,25 +145,25 @@ libssh.a: $(LIBSSH_OBJS)
 	$(RANLIB) $@
 
 ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
-+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS)
+-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS) $(GSSLIBS)
 
 sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
-+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS)
+-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
 
 scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
 	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@ -265,7 +273,7 @@ diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
 
 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-@@ -172,7 +172,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
+@@ -175,7 +175,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
 	$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
 
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
@ -274,10 +282,10 @@ diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
 
 sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
 	$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-diff -up openssh-5.9p1/myproposal.h.fips openssh-5.9p1/myproposal.h
--- openssh-5.9p1/myproposal.h.fips	2011-08-17 02:29:03.000000000 +0200
-+++ openssh-5.9p1/myproposal.h	2012-07-17 21:01:12.685982807 +0200
-@@ -97,6 +97,19 @@
+diff -up openssh-6.2p1/myproposal.h.fips openssh-6.2p1/myproposal.h
+--- openssh-6.2p1/myproposal.h.fips	2013-01-09 06:12:19.000000000 +0100
+++ openssh-6.2p1/myproposal.h	2013-03-27 13:14:49.178683427 +0100
+@@ -106,6 +106,19 @@
 #define	KEX_DEFAULT_COMP	"none,zlib@openssh.com,zlib"
 #define	KEX_DEFAULT_LANG	""
 
@ -297,9 +305,9 @@ diff -up openssh-5.9p1/myproposal.h.fips openssh-5.9p1/myproposal.h
 
 static char *myproposal[PROPOSAL_MAX] = {
 	KEX_DEFAULT_KEX,
-diff -up openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.9p1/openbsd-compat/bsd-arc4random.c
--- openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips	2010-03-25 22:52:02.000000000 +0100
-+++ openssh-5.9p1/openbsd-compat/bsd-arc4random.c	2012-07-17 20:57:35.087155360 +0200
+diff -up openssh-6.2p1/openbsd-compat/bsd-arc4random.c.fips openssh-6.2p1/openbsd-compat/bsd-arc4random.c
+--- openssh-6.2p1/openbsd-compat/bsd-arc4random.c.fips	2010-03-25 22:52:02.000000000 +0100
+++ openssh-6.2p1/openbsd-compat/bsd-arc4random.c	2013-03-27 13:14:49.179683423 +0100
@@ -37,25 +37,18 @@
 #define REKEY_BYTES	(1 << 24)
 
@ -355,9 +363,9 @@ diff -up openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.9p1/openbs
 }
 #endif /* !HAVE_ARC4RANDOM */
 
-diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
--- openssh-5.9p1/ssh.c.fips	2011-08-05 22:18:16.000000000 +0200
-+++ openssh-5.9p1/ssh.c	2012-07-17 20:57:35.088155382 +0200
+diff -up openssh-6.2p1/ssh.c.fips openssh-6.2p1/ssh.c
+--- openssh-6.2p1/ssh.c.fips	2012-07-06 05:45:01.000000000 +0200
+++ openssh-6.2p1/ssh.c	2013-03-27 13:14:49.179683423 +0100
@@ -73,6 +73,8 @@
 
 #include <openssl/evp.h>
@ -388,7 +396,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
 			options.protocol = SSH_PROTO_1;
 			break;
 		case '2':
-@@ -630,7 +639,6 @@ main(int ac, char **av)
+@@ -632,7 +641,6 @@ main(int ac, char **av)
 	if (!host)
 		usage();
 
@ -396,7 +404,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
 	ERR_load_crypto_strings();
 
 	/* Initialize the command to execute on remote host. */
-@@ -721,6 +729,10 @@ main(int ac, char **av)
+@@ -722,6 +730,10 @@ main(int ac, char **av)
 
 	seed_rng();
 
@ -407,7 +415,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
 	if (options.user == NULL)
 		options.user = xstrdup(pw->pw_name);
 
-@@ -789,6 +801,12 @@ main(int ac, char **av)
+@@ -790,6 +802,12 @@ main(int ac, char **av)
 
 	timeout_ms = options.connection_timeout * 1000;
 
@ -420,9 +428,9 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
 	/* Open a connection to the remote host. */
 	if (ssh_connect(host, &hostaddr, options.port,
 	    options.address_family, options.connection_attempts, &timeout_ms,
-diff -up openssh-5.9p1/sshconnect2.c.fips openssh-5.9p1/sshconnect2.c
--- openssh-5.9p1/sshconnect2.c.fips	2012-07-17 20:57:34.955152432 +0200
-+++ openssh-5.9p1/sshconnect2.c	2012-07-17 20:57:35.088155382 +0200
+diff -up openssh-6.2p1/sshconnect2.c.fips openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.fips	2013-03-27 13:14:49.066683871 +0100
+++ openssh-6.2p1/sshconnect2.c	2013-03-27 13:14:49.179683423 +0100
@@ -44,6 +44,8 @@
 #include <vis.h>
 #endif
@ -455,9 +463,9 @@ diff -up openssh-5.9p1/sshconnect2.c.fips openssh-5.9p1/sshconnect2.c
 	if (options.hostkeyalgorithms != NULL)
 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
 		    options.hostkeyalgorithms;
-diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
--- openssh-5.9p1/sshd.c.fips	2012-07-17 20:57:35.049154517 +0200
-+++ openssh-5.9p1/sshd.c	2012-07-17 20:57:35.089155405 +0200
+diff -up openssh-6.2p1/sshd.c.fips openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.fips	2013-03-27 13:14:49.146683554 +0100
+++ openssh-6.2p1/sshd.c	2013-03-27 13:14:49.180683419 +0100
@@ -76,6 +76,8 @@
 #include <openssl/bn.h>
 #include <openssl/md5.h>
@ -467,7 +475,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
 #include "openbsd-compat/openssl-compat.h"
 
 #ifdef HAVE_SECUREWARE
-@@ -1395,6 +1397,11 @@ main(int ac, char **av)
+@@ -1423,6 +1425,11 @@ main(int ac, char **av)
 #endif
 	__progname = ssh_get_progname(av[0]);
 
@ -479,7 +487,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
 	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
 	saved_argc = ac;
 	rexec_argc = ac;
-@@ -1554,8 +1561,6 @@ main(int ac, char **av)
+@@ -1571,8 +1578,6 @@ main(int ac, char **av)
 	else
 		closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
 
@ -488,7 +496,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
 	/*
 	 * Force logging to stderr until we have loaded the private host
 	 * key (unless started from inetd)
-@@ -1673,6 +1678,10 @@ main(int ac, char **av)
+@@ -1715,6 +1720,10 @@ main(int ac, char **av)
 		debug("private host key: #%d type %d %s", i, key->type,
 		    key_type(key));
 	}
@ -499,7 +507,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
 	if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
 		logit("Disabling protocol version 1. Could not load host key");
 		options.protocol &= ~SSH_PROTO_1;
-@@ -1837,6 +1846,10 @@ main(int ac, char **av)
+@@ -1878,6 +1887,10 @@ main(int ac, char **av)
 	/* Initialize the random number generator. */
 	arc4random_stir();
 
@ -510,7 +518,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
 	/* Chdir to the root directory so that the current disk can be
 	   unmounted if desired. */
 	(void) chdir("/");
-@@ -2379,6 +2392,9 @@ do_ssh2_kex(void)
+@@ -2420,6 +2433,9 @@ do_ssh2_kex(void)
 	if (options.ciphers != NULL) {
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@ -520,7 +528,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
 	}
 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
-@@ -2388,6 +2404,9 @@ do_ssh2_kex(void)
+@@ -2429,6 +2445,9 @@ do_ssh2_kex(void)
 	if (options.macs != NULL) {
 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
--- a/openssh-6.2p1-force_krb.patch
+++ b/openssh-6.2p1-force_krb.patch
@ -1,6 +1,6 @@
-diff -up openssh-5.8p2/gss-serv-krb5.c.force_krb openssh-5.8p2/gss-serv-krb5.c
--- openssh-5.8p2/gss-serv-krb5.c.force_krb	2006-09-01 07:38:36.000000000 +0200
-+++ openssh-5.8p2/gss-serv-krb5.c	2011-05-19 03:41:45.801109545 +0200
+diff -up openssh-6.2p1/gss-serv-krb5.c.force_krb openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.force_krb	2013-03-25 20:04:53.807817333 +0100
+++ openssh-6.2p1/gss-serv-krb5.c	2013-03-25 20:04:53.818817403 +0100
@@ -32,7 +32,9 @@
 #include <sys/types.h>
 
@ -216,10 +216,10 @@ diff -up openssh-5.8p2/gss-serv-krb5.c.force_krb openssh-5.8p2/gss-serv-krb5.c
 
 /* This writes out any forwarded credentials from the structure populated
  * during userauth. Called after we have setuid to the user */
-diff -up openssh-5.8p2/session.c.force_krb openssh-5.8p2/session.c
--- openssh-5.8p2/session.c.force_krb	2011-05-19 03:41:41.000000000 +0200
-+++ openssh-5.8p2/session.c	2011-05-19 03:43:32.437173662 +0200
-@@ -820,6 +820,29 @@ do_exec(Session *s, const char *command)
+diff -up openssh-6.2p1/session.c.force_krb openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.force_krb	2013-03-25 20:04:53.724816810 +0100
+++ openssh-6.2p1/session.c	2013-03-25 20:04:53.818817403 +0100
+@@ -823,6 +823,29 @@ do_exec(Session *s, const char *command)
 		debug("Forced command (key option) '%.900s'", command);
 	}
 
@ -249,9 +249,9 @@ diff -up openssh-5.8p2/session.c.force_krb openssh-5.8p2/session.c
 #ifdef SSH_AUDIT_EVENTS
 	if (s->command != NULL || s->command_handle != -1)
 		fatal("do_exec: command already set");
-diff -up openssh-5.8p2/sshd.8.force_krb openssh-5.8p2/sshd.8
--- openssh-5.8p2/sshd.8.force_krb	2011-05-19 03:41:30.582114401 +0200
-+++ openssh-5.8p2/sshd.8	2011-05-19 03:41:46.159106308 +0200
+diff -up openssh-6.2p1/sshd.8.force_krb openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.force_krb	2013-03-25 20:04:53.787817207 +0100
+++ openssh-6.2p1/sshd.8	2013-03-25 20:04:53.819817409 +0100
@@ -323,6 +323,7 @@ Finally, the server and the client enter
 The client tries to authenticate itself using
 host-based authentication,
@ -273,13 +273,13 @@ diff -up openssh-5.8p2/sshd.8.force_krb openssh-5.8p2/sshd.8
 .It Pa ~/.ssh/
 This directory is the default location for all user-specific configuration
 and authentication information.
-diff -up openssh-5.8p2/ssh-gss.h.force_krb openssh-5.8p2/ssh-gss.h
--- openssh-5.8p2/ssh-gss.h.force_krb	2007-06-12 15:40:39.000000000 +0200
-+++ openssh-5.8p2/ssh-gss.h	2011-05-19 03:41:46.302234118 +0200
-@@ -48,6 +48,10 @@
- #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
- #endif /* GSS_C_NT_... */
- #endif /* !HEIMDAL */
+diff -up openssh-6.2p1/ssh-gss.h.force_krb openssh-6.2p1/ssh-gss.h
+--- openssh-6.2p1/ssh-gss.h.force_krb	2013-03-25 20:04:53.819817409 +0100
+++ openssh-6.2p1/ssh-gss.h	2013-03-25 20:05:26.463023197 +0100
+@@ -49,6 +49,10 @@
+ #  endif /* !HAVE_DECL_GSS_C_NT_... */
+ 
+ # endif /* !HEIMDAL */
 +
 +/* .k5users support */
 +extern char **k5users_allowed_cmds;
--- a/openssh-6.2p1-gsskex.patch
+++ b/openssh-6.2p1-gsskex.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth2.c.gsskex openssh-6.1p1/auth2.c
--- openssh-6.1p1/auth2.c.gsskex	2012-11-30 13:58:08.871298935 +0100
-+++ openssh-6.1p1/auth2.c	2012-11-30 13:58:08.946298649 +0100
+diff -up openssh-6.2p1/auth2.c.gsskex openssh-6.2p1/auth2.c
+--- openssh-6.2p1/auth2.c.gsskex	2013-03-27 13:19:11.062624591 +0100
+++ openssh-6.2p1/auth2.c	2013-03-27 13:19:11.140624271 +0100
@@ -69,6 +69,7 @@ extern Authmethod method_passwd;
 extern Authmethod method_kbdint;
 extern Authmethod method_hostbased;
@ -17,9 +17,9 @@ diff -up openssh-6.1p1/auth2.c.gsskex openssh-6.1p1/auth2.c
 	&method_gssapi,
 #endif
 #ifdef JPAKE
-diff -up openssh-6.1p1/auth2-gss.c.gsskex openssh-6.1p1/auth2-gss.c
--- openssh-6.1p1/auth2-gss.c.gsskex	2012-11-30 13:58:08.871298935 +0100
-+++ openssh-6.1p1/auth2-gss.c	2012-11-30 13:59:19.622985133 +0100
+diff -up openssh-6.2p1/auth2-gss.c.gsskex openssh-6.2p1/auth2-gss.c
+--- openssh-6.2p1/auth2-gss.c.gsskex	2013-03-27 13:19:11.062624591 +0100
+++ openssh-6.2p1/auth2-gss.c	2013-03-27 13:19:11.141624267 +0100
@@ -52,6 +52,40 @@ static void input_gssapi_mic(int type, u
 static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
 static void input_gssapi_errtok(int, u_int32_t, void *);
@ -94,9 +94,9 @@ diff -up openssh-6.1p1/auth2-gss.c.gsskex openssh-6.1p1/auth2-gss.c
 Authmethod method_gssapi = {
 	"gssapi-with-mic",
 	userauth_gssapi,
-diff -up openssh-6.1p1/auth-krb5.c.gsskex openssh-6.1p1/auth-krb5.c
--- openssh-6.1p1/auth-krb5.c.gsskex	2012-04-26 01:52:15.000000000 +0200
-+++ openssh-6.1p1/auth-krb5.c	2012-11-30 13:58:08.947298647 +0100
+diff -up openssh-6.2p1/auth-krb5.c.gsskex openssh-6.2p1/auth-krb5.c
+--- openssh-6.2p1/auth-krb5.c.gsskex	2012-04-26 01:52:15.000000000 +0200
+++ openssh-6.2p1/auth-krb5.c	2013-03-27 13:19:11.140624271 +0100
@@ -50,6 +50,7 @@
 #include <errno.h>
 #include <unistd.h>
@ -203,9 +203,9 @@ diff -up openssh-6.1p1/auth-krb5.c.gsskex openssh-6.1p1/auth-krb5.c
 
 	return (krb5_cc_resolve(ctx, ccname, ccache));
 }
-diff -up openssh-6.1p1/ChangeLog.gssapi.gsskex openssh-6.1p1/ChangeLog.gssapi
--- openssh-6.1p1/ChangeLog.gssapi.gsskex	2012-11-30 13:58:08.947298647 +0100
-+++ openssh-6.1p1/ChangeLog.gssapi	2012-11-30 13:58:08.947298647 +0100
+diff -up openssh-6.2p1/ChangeLog.gssapi.gsskex openssh-6.2p1/ChangeLog.gssapi
+--- openssh-6.2p1/ChangeLog.gssapi.gsskex	2013-03-27 13:19:11.143624259 +0100
+++ openssh-6.2p1/ChangeLog.gssapi	2013-03-27 13:19:11.143624259 +0100
@@ -0,0 +1,113 @@
 +20110101
 +  - Finally update for OpenSSH 5.6p1
@ -320,9 +320,9 @@ diff -up openssh-6.1p1/ChangeLog.gssapi.gsskex openssh-6.1p1/ChangeLog.gssapi
 +    add support for GssapiTrustDns option for gssapi-with-mic
 +    (from jbasney AT ncsa.uiuc.edu)
 +    <gssapi-with-mic support is Bugzilla #1008>
-diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
--- openssh-6.1p1/clientloop.c.gsskex	2012-11-30 13:58:08.781299279 +0100
-+++ openssh-6.1p1/clientloop.c	2012-11-30 13:58:08.948298644 +0100
+diff -up openssh-6.2p1/clientloop.c.gsskex openssh-6.2p1/clientloop.c
+--- openssh-6.2p1/clientloop.c.gsskex	2013-03-27 13:19:11.001624842 +0100
+++ openssh-6.2p1/clientloop.c	2013-03-27 13:19:11.141624267 +0100
@@ -111,6 +111,10 @@
 #include "msg.h"
 #include "roaming.h"
@ -334,7 +334,7 @@ diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
 /* import options */
 extern Options options;
 
-@@ -1544,6 +1548,15 @@ client_loop(int have_pty, int escape_cha
+@@ -1599,6 +1603,15 @@ client_loop(int have_pty, int escape_cha
 		/* Do channel operations unless rekeying in progress. */
 		if (!rekeying) {
 			channel_after_select(readset, writeset);
@ -350,10 +350,10 @@ diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
 			if (need_rekeying || packet_need_rekeying()) {
 				debug("need rekeying");
 				xxx_kex->done = 0;
-diff -up openssh-6.1p1/configure.ac.gsskex openssh-6.1p1/configure.ac
--- openssh-6.1p1/configure.ac.gsskex	2012-11-30 13:58:08.934298697 +0100
-+++ openssh-6.1p1/configure.ac	2012-11-30 13:58:08.949298640 +0100
-@@ -545,6 +545,30 @@ main() { if (NSVersionOfRunTimeLibrary("
+diff -up openssh-6.2p1/configure.ac.gsskex openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.gsskex	2013-03-27 13:19:11.128624320 +0100
+++ openssh-6.2p1/configure.ac	2013-03-27 13:19:11.142624263 +0100
+@@ -533,6 +533,30 @@ main() { if (NSVersionOfRunTimeLibrary("
 	    [Use tunnel device compatibility to OpenBSD])
 	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
 	    [Prepend the address family to IP tunnel traffic])
@ -384,9 +384,9 @@ diff -up openssh-6.1p1/configure.ac.gsskex openssh-6.1p1/configure.ac
 	m4_pattern_allow([AU_IPv])
 	AC_CHECK_DECL([AU_IPv4], [], 
 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
-diff -up openssh-6.1p1/gss-genr.c.gsskex openssh-6.1p1/gss-genr.c
--- openssh-6.1p1/gss-genr.c.gsskex	2009-06-22 08:11:07.000000000 +0200
-+++ openssh-6.1p1/gss-genr.c	2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-genr.c.gsskex openssh-6.2p1/gss-genr.c
+--- openssh-6.2p1/gss-genr.c.gsskex	2009-06-22 08:11:07.000000000 +0200
+++ openssh-6.2p1/gss-genr.c	2013-03-27 13:19:11.142624263 +0100
@@ -1,7 +1,7 @@
 /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
 
@ -734,9 +734,9 @@ diff -up openssh-6.1p1/gss-genr.c.gsskex openssh-6.1p1/gss-genr.c
 +}
 +
 #endif /* GSSAPI */
-diff -up openssh-6.1p1/gss-serv.c.gsskex openssh-6.1p1/gss-serv.c
--- openssh-6.1p1/gss-serv.c.gsskex	2011-08-05 22:16:46.000000000 +0200
-+++ openssh-6.1p1/gss-serv.c	2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-serv.c.gsskex openssh-6.2p1/gss-serv.c
+--- openssh-6.2p1/gss-serv.c.gsskex	2011-08-05 22:16:46.000000000 +0200
+++ openssh-6.2p1/gss-serv.c	2013-03-27 13:19:11.142624263 +0100
@@ -45,15 +45,20 @@
 #include "channels.h"
 #include "session.h"
@ -1075,9 +1075,9 @@ diff -up openssh-6.1p1/gss-serv.c.gsskex openssh-6.1p1/gss-serv.c
 }
 
 #endif
-diff -up openssh-6.1p1/gss-serv-krb5.c.gsskex openssh-6.1p1/gss-serv-krb5.c
--- openssh-6.1p1/gss-serv-krb5.c.gsskex	2006-09-01 07:38:36.000000000 +0200
-+++ openssh-6.1p1/gss-serv-krb5.c	2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-serv-krb5.c.gsskex openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.gsskex	2006-09-01 07:38:36.000000000 +0200
+++ openssh-6.2p1/gss-serv-krb5.c	2013-03-27 13:19:11.143624259 +0100
@@ -1,7 +1,7 @@
 /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
 
@ -1200,9 +1200,9 @@ diff -up openssh-6.1p1/gss-serv-krb5.c.gsskex openssh-6.1p1/gss-serv-krb5.c
 };
 
 #endif /* KRB5 */
-diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
--- openssh-6.1p1/kex.c.gsskex	2012-11-30 13:58:08.820299131 +0100
-+++ openssh-6.1p1/kex.c	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kex.c.gsskex openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.gsskex	2013-03-27 13:19:11.039624686 +0100
+++ openssh-6.2p1/kex.c	2013-03-27 13:19:11.143624259 +0100
@@ -51,6 +51,10 @@
 #include "roaming.h"
 #include "audit.h"
@ -1214,7 +1214,7 @@ diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
 # if defined(HAVE_EVP_SHA256)
 # define evp_ssh_sha256 EVP_sha256
-@@ -371,6 +375,20 @@ choose_kex(Kex *k, char *client, char *s
+@@ -382,6 +386,20 @@ choose_kex(Kex *k, char *client, char *s
  		k->kex_type = KEX_ECDH_SHA2;
 		k->evp_md = kex_ecdh_name_to_evpmd(k->name);
 #endif
@ -1235,9 +1235,9 @@ diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
 	} else
 		fatal("bad kex alg %s", k->name);
 }
-diff -up openssh-6.1p1/kexgssc.c.gsskex openssh-6.1p1/kexgssc.c
--- openssh-6.1p1/kexgssc.c.gsskex	2012-11-30 13:58:08.950298635 +0100
-+++ openssh-6.1p1/kexgssc.c	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kexgssc.c.gsskex openssh-6.2p1/kexgssc.c
+--- openssh-6.2p1/kexgssc.c.gsskex	2013-03-27 13:19:11.143624259 +0100
+++ openssh-6.2p1/kexgssc.c	2013-03-27 13:19:11.143624259 +0100
@@ -0,0 +1,334 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -1573,9 +1573,9 @@ diff -up openssh-6.1p1/kexgssc.c.gsskex openssh-6.1p1/kexgssc.c
 +}
 +
 +#endif /* GSSAPI */
-diff -up openssh-6.1p1/kexgsss.c.gsskex openssh-6.1p1/kexgsss.c
--- openssh-6.1p1/kexgsss.c.gsskex	2012-11-30 13:58:08.950298635 +0100
-+++ openssh-6.1p1/kexgsss.c	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kexgsss.c.gsskex openssh-6.2p1/kexgsss.c
+--- openssh-6.2p1/kexgsss.c.gsskex	2013-03-27 13:19:11.144624254 +0100
+++ openssh-6.2p1/kexgsss.c	2013-03-27 13:19:11.144624254 +0100
@@ -0,0 +1,288 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -1865,9 +1865,9 @@ diff -up openssh-6.1p1/kexgsss.c.gsskex openssh-6.1p1/kexgsss.c
 +		ssh_gssapi_rekey_creds();
 +}
 +#endif /* GSSAPI */
-diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
--- openssh-6.1p1/kex.h.gsskex	2012-11-30 13:58:08.820299131 +0100
-+++ openssh-6.1p1/kex.h	2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kex.h.gsskex openssh-6.2p1/kex.h
+--- openssh-6.2p1/kex.h.gsskex	2013-03-27 13:19:11.039624686 +0100
+++ openssh-6.2p1/kex.h	2013-03-27 13:19:11.144624254 +0100
@@ -73,6 +73,9 @@ enum kex_exchange {
 	KEX_DH_GEX_SHA1,
 	KEX_DH_GEX_SHA256,
@ -1878,7 +1878,7 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
 	KEX_MAX
 };
 
-@@ -129,6 +132,12 @@ struct Kex {
+@@ -131,6 +134,12 @@ struct Kex {
 	sig_atomic_t done;
 	int	flags;
 	const EVP_MD *evp_md;
@ -1891,7 +1891,7 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
 	char	*client_version_string;
 	char	*server_version_string;
 	int	(*verify_host_key)(Key *);
-@@ -156,6 +165,11 @@ void	 kexgex_server(Kex *);
+@@ -158,6 +167,11 @@ void	 kexgex_server(Kex *);
 void	 kexecdh_client(Kex *);
 void	 kexecdh_server(Kex *);
 
@ -1903,9 +1903,9 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
 void	newkeys_destroy(Newkeys *newkeys);
 
 void
-diff -up openssh-6.1p1/key.c.gsskex openssh-6.1p1/key.c
--- openssh-6.1p1/key.c.gsskex	2012-11-30 13:58:08.912298779 +0100
-+++ openssh-6.1p1/key.c	2012-11-30 13:58:08.951298630 +0100
+diff -up openssh-6.2p1/key.c.gsskex openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.gsskex	2013-03-27 13:19:11.102624427 +0100
+++ openssh-6.2p1/key.c	2013-03-27 13:19:11.144624254 +0100
@@ -1011,6 +1011,8 @@ key_ssh_name_from_type_nid(int type, int
 		}
 		break;
@ -1924,9 +1924,9 @@ diff -up openssh-6.1p1/key.c.gsskex openssh-6.1p1/key.c
 	}
 
 	debug2("key_type_from_name: unknown key type '%s'", name);
-diff -up openssh-6.1p1/key.h.gsskex openssh-6.1p1/key.h
--- openssh-6.1p1/key.h.gsskex	2012-11-30 13:58:08.827299104 +0100
-+++ openssh-6.1p1/key.h	2012-11-30 13:58:08.951298630 +0100
+diff -up openssh-6.2p1/key.h.gsskex openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.gsskex	2013-03-27 13:19:11.046624657 +0100
+++ openssh-6.2p1/key.h	2013-03-27 13:19:11.145624250 +0100
@@ -44,6 +44,7 @@ enum types {
 	KEY_ECDSA_CERT,
 	KEY_RSA_CERT_V00,
@ -1935,18 +1935,18 @@ diff -up openssh-6.1p1/key.h.gsskex openssh-6.1p1/key.h
 	KEY_UNSPEC
 };
 enum fp_type {
-diff -up openssh-6.1p1/Makefile.in.gsskex openssh-6.1p1/Makefile.in
--- openssh-6.1p1/Makefile.in.gsskex	2012-11-30 13:58:08.945298652 +0100
-+++ openssh-6.1p1/Makefile.in	2012-11-30 13:58:08.951298630 +0100
-@@ -75,6 +75,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
+diff -up openssh-6.2p1/Makefile.in.gsskex openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.gsskex	2013-03-27 13:19:11.138624279 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-27 13:19:11.145624250 +0100
+@@ -77,6 +77,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
 	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
 	kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
 +	kexgssc.o \
- 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
- 	schnorr.o ssh-pkcs11.o auditstub.o
+ 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+ 	jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
 
-@@ -91,7 +92,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+@@ -93,7 +94,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
 	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
 	monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
 	auth-krb5.o \
@ -1955,9 +1955,9 @@ diff -up openssh-6.1p1/Makefile.in.gsskex openssh-6.1p1/Makefile.in
 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
 	sftp-server.o sftp-common.o \
 	roaming_common.o roaming_serv.o \
-diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
--- openssh-6.1p1/monitor.c.gsskex	2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor.c	2012-11-30 13:58:08.952298626 +0100
+diff -up openssh-6.2p1/monitor.c.gsskex openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.gsskex	2013-03-27 13:19:11.063624587 +0100
+++ openssh-6.2p1/monitor.c	2013-03-27 13:19:11.145624250 +0100
@@ -186,6 +186,8 @@ int mm_answer_gss_setup_ctx(int, Buffer
 int mm_answer_gss_accept_ctx(int, Buffer *);
 int mm_answer_gss_userok(int, Buffer *);
@ -1999,7 +1999,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	} else {
 		mon_dispatch = mon_dispatch_proto15;
 
-@@ -516,6 +529,10 @@ monitor_child_postauth(struct monitor *p
+@@ -519,6 +532,10 @@ monitor_child_postauth(struct monitor *p
 		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
 		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
 		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@ -2010,7 +2010,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	} else {
 		mon_dispatch = mon_dispatch_postauth15;
 		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1948,6 +1965,13 @@ mm_get_kex(Buffer *m)
+@@ -1950,6 +1967,13 @@ mm_get_kex(Buffer *m)
 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
 	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@ -2024,7 +2024,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	kex->server = 1;
 	kex->hostkey_type = buffer_get_int(m);
 	kex->kex_type = buffer_get_int(m);
-@@ -2171,6 +2195,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
+@@ -2173,6 +2197,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
 	OM_uint32 major;
 	u_int len;
 
@ -2034,7 +2034,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	goid.elements = buffer_get_string(m, &len);
 	goid.length = len;
 
-@@ -2198,6 +2225,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+@@ -2200,6 +2227,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
 	OM_uint32 flags = 0; /* GSI needs this */
 	u_int len;
 
@ -2044,7 +2044,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	in.value = buffer_get_string(m, &len);
 	in.length = len;
 	major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -2215,6 +2245,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+@@ -2217,6 +2247,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
 		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@ -2052,7 +2052,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	}
 	return (0);
 }
-@@ -2226,6 +2257,9 @@ mm_answer_gss_checkmic(int sock, Buffer
+@@ -2228,6 +2259,9 @@ mm_answer_gss_checkmic(int sock, Buffer
 	OM_uint32 ret;
 	u_int len;
 
@ -2062,7 +2062,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 	gssbuf.value = buffer_get_string(m, &len);
 	gssbuf.length = len;
 	mic.value = buffer_get_string(m, &len);
-@@ -2252,7 +2286,11 @@ mm_answer_gss_userok(int sock, Buffer *m
+@@ -2254,7 +2288,11 @@ mm_answer_gss_userok(int sock, Buffer *m
 {
 	int authenticated;
 
@ -2075,7 +2075,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 
 	buffer_clear(m);
 	buffer_put_int(m, authenticated);
-@@ -2265,6 +2303,74 @@ mm_answer_gss_userok(int sock, Buffer *m
+@@ -2267,6 +2305,74 @@ mm_answer_gss_userok(int sock, Buffer *m
 	/* Monitor loop will terminate if authenticated */
 	return (authenticated);
 }
@ -2150,22 +2150,22 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
 #endif /* GSSAPI */
 
 #ifdef JPAKE
-diff -up openssh-6.1p1/monitor.h.gsskex openssh-6.1p1/monitor.h
--- openssh-6.1p1/monitor.h.gsskex	2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor.h	2012-11-30 13:58:08.952298626 +0100
-@@ -56,6 +56,8 @@ enum monitor_reqtype {
- 	MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
- 	MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
- 	MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
-+	MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
-+	MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
- 	MONITOR_REQ_PAM_START,
- 	MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
- 	MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
-diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
--- openssh-6.1p1/monitor_wrap.c.gsskex	2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor_wrap.c	2012-11-30 13:58:08.952298626 +0100
-@@ -1326,7 +1326,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
+diff -up openssh-6.2p1/monitor.h.gsskex openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.gsskex	2013-03-27 13:19:11.063624587 +0100
+++ openssh-6.2p1/monitor.h	2013-03-27 13:19:11.146624246 +0100
+@@ -64,6 +64,8 @@ enum monitor_reqtype {
+ #ifdef WITH_SELINUX
+ 	MONITOR_REQ_AUTHROLE = 80,
+ #endif
+	MONITOR_REQ_GSSSIGN = 82, MONITOR_ANS_GSSSIGN = 83,
+	MONITOR_REQ_GSSUPCREDS = 84, MONITOR_ANS_GSSUPCREDS = 85,
+ 
+ 	MONITOR_REQ_PAM_START = 100,
+ 	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+diff -up openssh-6.2p1/monitor_wrap.c.gsskex openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.gsskex	2013-03-27 13:19:11.064624583 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-27 13:19:11.146624246 +0100
+@@ -1327,7 +1327,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
 }
 
 int
@ -2174,7 +2174,7 @@ diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
 {
 	Buffer m;
 	int authenticated = 0;
-@@ -1343,6 +1343,51 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1344,6 +1344,51 @@ mm_ssh_gssapi_userok(char *user)
 	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
 	return (authenticated);
 }
@ -2226,9 +2226,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
 #endif /* GSSAPI */
 
 #ifdef JPAKE
-diff -up openssh-6.1p1/monitor_wrap.h.gsskex openssh-6.1p1/monitor_wrap.h
--- openssh-6.1p1/monitor_wrap.h.gsskex	2012-11-30 13:58:08.874298923 +0100
-+++ openssh-6.1p1/monitor_wrap.h	2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.gsskex openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.gsskex	2013-03-27 13:19:11.064624583 +0100
+++ openssh-6.2p1/monitor_wrap.h	2013-03-27 13:19:11.146624246 +0100
@@ -62,8 +62,10 @@ BIGNUM *mm_auth_rsa_generate_challenge(K
 OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
 OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
@ -2241,9 +2241,9 @@ diff -up openssh-6.1p1/monitor_wrap.h.gsskex openssh-6.1p1/monitor_wrap.h
 #endif
 
 #ifdef USE_PAM
-diff -up openssh-6.1p1/readconf.c.gsskex openssh-6.1p1/readconf.c
--- openssh-6.1p1/readconf.c.gsskex	2011-10-02 09:59:03.000000000 +0200
-+++ openssh-6.1p1/readconf.c	2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/readconf.c.gsskex openssh-6.2p1/readconf.c
+--- openssh-6.2p1/readconf.c.gsskex	2011-10-02 09:59:03.000000000 +0200
+++ openssh-6.2p1/readconf.c	2013-03-27 13:19:11.147624242 +0100
@@ -129,6 +129,8 @@ typedef enum {
 	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
 	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
@ -2332,9 +2332,9 @@ diff -up openssh-6.1p1/readconf.c.gsskex openssh-6.1p1/readconf.c
 	if (options->password_authentication == -1)
 		options->password_authentication = 1;
 	if (options->kbd_interactive_authentication == -1)
-diff -up openssh-6.1p1/readconf.h.gsskex openssh-6.1p1/readconf.h
--- openssh-6.1p1/readconf.h.gsskex	2011-10-02 09:59:03.000000000 +0200
-+++ openssh-6.1p1/readconf.h	2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/readconf.h.gsskex openssh-6.2p1/readconf.h
+--- openssh-6.2p1/readconf.h.gsskex	2011-10-02 09:59:03.000000000 +0200
+++ openssh-6.2p1/readconf.h	2013-03-27 13:19:11.147624242 +0100
@@ -48,7 +48,12 @@ typedef struct {
 	int     challenge_response_authentication;
 					/* Try S/Key or TIS, authentication. */
@ -2348,9 +2348,9 @@ diff -up openssh-6.1p1/readconf.h.gsskex openssh-6.1p1/readconf.h
 	int     password_authentication;	/* Try password
 						 * authentication. */
 	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
--- openssh-6.1p1/servconf.c.gsskex	2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/servconf.c	2012-11-30 13:58:08.954298621 +0100
+diff -up openssh-6.2p1/servconf.c.gsskex openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.gsskex	2013-03-27 13:19:11.128624320 +0100
+++ openssh-6.2p1/servconf.c	2013-03-27 13:19:11.147624242 +0100
@@ -102,7 +102,10 @@ initialize_server_options(ServerOptions
 	options->kerberos_ticket_cleanup = -1;
 	options->kerberos_get_afs_token = -1;
@ -2409,7 +2409,7 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1046,10 +1067,22 @@ process_server_config_line(ServerOptions
+@@ -1054,10 +1075,22 @@ process_server_config_line(ServerOptions
 		intptr = &options->gss_authentication;
 		goto parse_flag;
 
@ -2432,7 +2432,7 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
 	case sPasswordAuthentication:
 		intptr = &options->password_authentication;
 		goto parse_flag;
-@@ -1929,6 +1962,9 @@ dump_config(ServerOptions *o)
+@@ -1938,6 +1971,9 @@ dump_config(ServerOptions *o)
 #ifdef GSSAPI
 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
 	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@ -2442,10 +2442,10 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
 #endif
 #ifdef JPAKE
 	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
-diff -up openssh-6.1p1/servconf.h.gsskex openssh-6.1p1/servconf.h
--- openssh-6.1p1/servconf.h.gsskex	2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/servconf.h	2012-11-30 13:58:08.954298621 +0100
-@@ -104,7 +104,10 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.gsskex openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.gsskex	2013-03-27 13:19:11.128624320 +0100
+++ openssh-6.2p1/servconf.h	2013-03-27 13:19:11.147624242 +0100
+@@ -110,7 +110,10 @@ typedef struct {
 	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
 						 * authenticated with Kerberos. */
 	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@ -2456,10 +2456,10 @@ diff -up openssh-6.1p1/servconf.h.gsskex openssh-6.1p1/servconf.h
 	int     password_authentication;	/* If true, permit password
 						 * authentication. */
 	int     kbd_interactive_authentication;	/* If true, permit */
-diff -up openssh-6.1p1/ssh_config.5.gsskex openssh-6.1p1/ssh_config.5
--- openssh-6.1p1/ssh_config.5.gsskex	2012-07-02 10:53:38.000000000 +0200
-+++ openssh-6.1p1/ssh_config.5	2012-11-30 13:58:08.954298621 +0100
-@@ -527,11 +527,43 @@ Specifies whether user authentication ba
+diff -up openssh-6.2p1/ssh_config.5.gsskex openssh-6.2p1/ssh_config.5
+--- openssh-6.2p1/ssh_config.5.gsskex	2013-01-09 06:12:19.000000000 +0100
+++ openssh-6.2p1/ssh_config.5	2013-03-27 13:19:11.148624238 +0100
+@@ -530,11 +530,43 @@ Specifies whether user authentication ba
 The default is
 .Dq no .
 Note that this option applies to protocol version 2 only.
@ -2504,9 +2504,9 @@ diff -up openssh-6.1p1/ssh_config.5.gsskex openssh-6.1p1/ssh_config.5
 .It Cm HashKnownHosts
 Indicates that
 .Xr ssh 1
-diff -up openssh-6.1p1/ssh_config.gsskex openssh-6.1p1/ssh_config
--- openssh-6.1p1/ssh_config.gsskex	2012-11-30 13:58:08.927298724 +0100
-+++ openssh-6.1p1/ssh_config	2012-11-30 13:58:08.954298621 +0100
+diff -up openssh-6.2p1/ssh_config.gsskex openssh-6.2p1/ssh_config
+--- openssh-6.2p1/ssh_config.gsskex	2013-03-27 13:19:11.120624353 +0100
+++ openssh-6.2p1/ssh_config	2013-03-27 13:19:11.148624238 +0100
@@ -26,6 +26,8 @@
 #   HostbasedAuthentication no
 #   GSSAPIAuthentication no
@ -2516,9 +2516,9 @@ diff -up openssh-6.1p1/ssh_config.gsskex openssh-6.1p1/ssh_config
 #   BatchMode no
 #   CheckHostIP yes
 #   AddressFamily any
-diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
--- openssh-6.1p1/sshconnect2.c.gsskex	2012-11-30 13:58:08.913298775 +0100
-+++ openssh-6.1p1/sshconnect2.c	2012-11-30 13:58:08.955298617 +0100
+diff -up openssh-6.2p1/sshconnect2.c.gsskex openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.gsskex	2013-03-27 13:19:11.104624419 +0100
+++ openssh-6.2p1/sshconnect2.c	2013-03-27 13:19:11.149624234 +0100
@@ -162,9 +162,34 @@ ssh_kex2(char *host, struct sockaddr *ho
 {
 	Kex *kex;
@ -2603,7 +2603,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
 	xxx_kex = kex;
 
 	dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-@@ -315,6 +371,7 @@ void	input_gssapi_token(int type, u_int3
+@@ -316,6 +372,7 @@ void	input_gssapi_token(int type, u_int3
 void	input_gssapi_hash(int type, u_int32_t, void *);
 void	input_gssapi_error(int, u_int32_t, void *);
 void	input_gssapi_errtok(int, u_int32_t, void *);
@ -2611,7 +2611,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
 #endif
 
 void	userauth(Authctxt *, char *);
-@@ -330,6 +387,11 @@ static char *authmethods_get(void);
+@@ -331,6 +388,11 @@ static char *authmethods_get(void);
 
 Authmethod authmethods[] = {
 #ifdef GSSAPI
@ -2623,7 +2623,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
 	{"gssapi-with-mic",
 		userauth_gssapi,
 		NULL,
-@@ -637,19 +699,31 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -638,19 +700,31 @@ userauth_gssapi(Authctxt *authctxt)
 	static u_int mech = 0;
 	OM_uint32 min;
 	int ok = 0;
@ -2657,7 +2657,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
 			ok = 1; /* Mechanism works */
 		} else {
 			mech++;
-@@ -746,8 +820,8 @@ input_gssapi_response(int type, u_int32_
+@@ -747,8 +821,8 @@ input_gssapi_response(int type, u_int32_
 {
 	Authctxt *authctxt = ctxt;
 	Gssctxt *gssctxt;
@ -2668,7 +2668,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
 
 	if (authctxt == NULL)
 		fatal("input_gssapi_response: no authentication context");
-@@ -857,6 +931,48 @@ input_gssapi_error(int type, u_int32_t p
+@@ -858,6 +932,48 @@ input_gssapi_error(int type, u_int32_t p
 	xfree(msg);
 	xfree(lang);
 }
@ -2717,9 +2717,9 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
 #endif /* GSSAPI */
 
 int
-diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
--- openssh-6.1p1/sshd.c.gsskex	2012-11-30 13:58:08.940298674 +0100
-+++ openssh-6.1p1/sshd.c	2012-11-30 13:58:08.955298617 +0100
+diff -up openssh-6.2p1/sshd.c.gsskex openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.gsskex	2013-03-27 13:19:11.133624300 +0100
+++ openssh-6.2p1/sshd.c	2013-03-27 13:19:11.149624234 +0100
@@ -124,6 +124,10 @@
 #include "ssh-sandbox.h"
 #include "version.h"
@ -2731,7 +2731,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
 #ifdef LIBWRAP
 #include <tcpd.h>
 #include <syslog.h>
-@@ -1723,10 +1727,13 @@ main(int ac, char **av)
+@@ -1733,10 +1737,13 @@ main(int ac, char **av)
 		logit("Disabling protocol version 1. Could not load host key");
 		options.protocol &= ~SSH_PROTO_1;
 	}
@ -2745,7 +2745,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
 	if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
 		logit("sshd: no hostkeys available -- exiting.");
 		exit(1);
-@@ -2058,6 +2065,60 @@ main(int ac, char **av)
+@@ -2068,6 +2075,60 @@ main(int ac, char **av)
 	/* Log the connection. */
 	verbose("Connection from %.500s port %d", remote_ip, remote_port);
 
@ -2806,7 +2806,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
 	/*
 	 * We don't want to listen forever unless the other side
 	 * successfully authenticates itself.  So we set up an alarm which is
-@@ -2456,6 +2517,48 @@ do_ssh2_kex(void)
+@@ -2466,6 +2527,48 @@ do_ssh2_kex(void)
 
 	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
 
@ -2855,7 +2855,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
 	/* start key exchange */
 	kex = kex_setup(myproposal);
 	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-@@ -2463,6 +2566,13 @@ do_ssh2_kex(void)
+@@ -2473,6 +2576,13 @@ do_ssh2_kex(void)
 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
 	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 	kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@ -2869,10 +2869,10 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
 	kex->server = 1;
 	kex->client_version_string=client_version_string;
 	kex->server_version_string=server_version_string;
-diff -up openssh-6.1p1/sshd_config.5.gsskex openssh-6.1p1/sshd_config.5
--- openssh-6.1p1/sshd_config.5.gsskex	2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/sshd_config.5	2012-11-30 13:58:08.956298613 +0100
-@@ -462,12 +462,40 @@ Specifies whether user authentication ba
+diff -up openssh-6.2p1/sshd_config.5.gsskex openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.gsskex	2013-03-27 13:19:11.129624316 +0100
+++ openssh-6.2p1/sshd_config.5	2013-03-27 13:19:11.150624230 +0100
+@@ -481,12 +481,40 @@ Specifies whether user authentication ba
 The default is
 .Dq no .
 Note that this option applies to protocol version 2 only.
@ -2913,9 +2913,9 @@ diff -up openssh-6.1p1/sshd_config.5.gsskex openssh-6.1p1/sshd_config.5
 .It Cm HostbasedAuthentication
 Specifies whether rhosts or /etc/hosts.equiv authentication together
 with successful public key client host authentication is allowed
-diff -up openssh-6.1p1/sshd_config.gsskex openssh-6.1p1/sshd_config
--- openssh-6.1p1/sshd_config.gsskex	2012-11-30 13:58:08.940298674 +0100
-+++ openssh-6.1p1/sshd_config	2012-11-30 13:58:08.956298613 +0100
+diff -up openssh-6.2p1/sshd_config.gsskex openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.gsskex	2013-03-27 13:19:11.133624300 +0100
+++ openssh-6.2p1/sshd_config	2013-03-27 13:19:11.150624230 +0100
@@ -89,6 +89,8 @@ ChallengeResponseAuthentication no
 GSSAPIAuthentication yes
 #GSSAPICleanupCredentials yes
@ -2925,9 +2925,9 @@ diff -up openssh-6.1p1/sshd_config.gsskex openssh-6.1p1/sshd_config
 
 # Set this to 'yes' to enable PAM authentication, account processing, 
 # and session processing. If this is enabled, PAM authentication will 
-diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
--- openssh-6.1p1/ssh-gss.h.gsskex	2007-06-12 15:40:39.000000000 +0200
-+++ openssh-6.1p1/ssh-gss.h	2012-11-30 13:58:08.956298613 +0100
+diff -up openssh-6.2p1/ssh-gss.h.gsskex openssh-6.2p1/ssh-gss.h
+--- openssh-6.2p1/ssh-gss.h.gsskex	2013-02-25 01:24:44.000000000 +0100
+++ openssh-6.2p1/ssh-gss.h	2013-03-27 13:19:11.150624230 +0100
@@ -1,6 +1,6 @@
 /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
 /*
@ -2936,7 +2936,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
-@@ -60,10 +60,22 @@
+@@ -61,10 +61,22 @@
 
 #define SSH_GSS_OIDTYPE 0x06
 
@ -2959,7 +2959,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
 	void *data;
 } ssh_gssapi_ccache;
 
-@@ -71,8 +83,11 @@ typedef struct {
+@@ -72,8 +84,11 @@ typedef struct {
 	gss_buffer_desc displayname;
 	gss_buffer_desc exportedname;
 	gss_cred_id_t creds;
@ -2971,7 +2971,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
 } ssh_gssapi_client;
 
 typedef struct ssh_gssapi_mech_struct {
-@@ -83,6 +98,7 @@ typedef struct ssh_gssapi_mech_struct {
+@@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct {
 	int (*userok) (ssh_gssapi_client *, char *);
 	int (*localname) (ssh_gssapi_client *, char **);
 	void (*storecreds) (ssh_gssapi_client *);
@ -2979,7 +2979,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
 } ssh_gssapi_mech;
 
 typedef struct {
-@@ -93,10 +109,11 @@ typedef struct {
+@@ -94,10 +110,11 @@ typedef struct {
 	gss_OID		oid; /* client */
 	gss_cred_id_t	creds; /* server */
 	gss_name_t	client; /* server */
@ -2992,7 +2992,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
 
 int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
 void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -116,16 +133,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
+@@ -117,16 +134,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
 void ssh_gssapi_delete_ctx(Gssctxt **);
 OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
 void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
--- a/openssh-6.2p1-keycat.patch
+++ b/openssh-6.2p1-keycat.patch
@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/auth2-pubkey.c.keycat openssh-6.1p1/auth2-pubkey.c
--- openssh-6.1p1/auth2-pubkey.c.keycat	2013-02-14 17:39:21.000000000 +0100
-+++ openssh-6.1p1/auth2-pubkey.c	2013-02-14 17:40:42.600050510 +0100
-@@ -571,6 +571,14 @@ user_key_command_allowed2(struct passwd
+diff -up openssh-6.2p1/auth2-pubkey.c.keycat openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.keycat	2013-03-25 21:34:17.779978851 +0100
+++ openssh-6.2p1/auth2-pubkey.c	2013-03-25 21:34:17.798978973 +0100
+@@ -573,6 +573,14 @@ user_key_command_allowed2(struct passwd
 			_exit(1);
 		}
 
@ -16,9 +16,9 @@ diff -up openssh-6.1p1/auth2-pubkey.c.keycat openssh-6.1p1/auth2-pubkey.c
 		execl(options.authorized_keys_command,
 		    options.authorized_keys_command, user_pw->pw_name, NULL);
 
-diff -up openssh-6.1p1/HOWTO.ssh-keycat.keycat openssh-6.1p1/HOWTO.ssh-keycat
--- openssh-6.1p1/HOWTO.ssh-keycat.keycat	2013-02-14 17:39:21.148382013 +0100
-+++ openssh-6.1p1/HOWTO.ssh-keycat	2013-02-14 17:39:21.148382013 +0100
+diff -up openssh-6.2p1/HOWTO.ssh-keycat.keycat openssh-6.2p1/HOWTO.ssh-keycat
+--- openssh-6.2p1/HOWTO.ssh-keycat.keycat	2013-03-25 21:34:17.798978973 +0100
+++ openssh-6.2p1/HOWTO.ssh-keycat	2013-03-25 21:34:17.798978973 +0100
@@ -0,0 +1,12 @@
 +The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
 +of an user in any environment. This includes environments with
@ -32,9 +32,9 @@ diff -up openssh-6.1p1/HOWTO.ssh-keycat.keycat openssh-6.1p1/HOWTO.ssh-keycat
 +        PubkeyAuthentication yes
 +
 +
-diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
--- openssh-6.1p1/Makefile.in.keycat	2013-02-14 17:39:21.143382033 +0100
-+++ openssh-6.1p1/Makefile.in	2013-02-14 17:39:21.148382013 +0100
+diff -up openssh-6.2p1/Makefile.in.keycat openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.keycat	2013-03-25 21:34:17.793978941 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-25 21:35:48.282559562 +0100
@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
@ -43,16 +43,16 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
 PRIVSEP_PATH=@PRIVSEP_PATH@
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -62,7 +63,7 @@ EXEEXT=@EXEEXT@
+@@ -64,7 +65,7 @@ EXEEXT=@EXEEXT@
 MANFMT=@MANFMT@
 INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
 
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
 
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -168,6 +169,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -170,6 +171,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
 ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
 	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
 
@ -62,7 +62,7 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 
-@@ -267,6 +271,7 @@ install-files:
+@@ -276,6 +280,7 @@ install-files:
 		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
 		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
 	fi
@ -70,9 +70,9 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh-6.1p1/openbsd-compat/port-linux.c.keycat openssh-6.1p1/openbsd-compat/port-linux.c
--- openssh-6.1p1/openbsd-compat/port-linux.c.keycat	2013-02-14 17:39:21.126382101 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux.c	2013-02-14 17:39:21.149382009 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux.c.keycat openssh-6.2p1/openbsd-compat/port-linux.c
+--- openssh-6.2p1/openbsd-compat/port-linux.c.keycat	2013-03-25 21:34:17.785978890 +0100
+++ openssh-6.2p1/openbsd-compat/port-linux.c	2013-03-25 21:34:17.800978986 +0100
@@ -315,7 +315,7 @@ ssh_selinux_getctxbyname(char *pwname,
 
 /* Setup environment variables for pam_selinux */
@ -127,9 +127,9 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux.c.keycat openssh-6.1p1/openbsd-
 /* Set the execution context to the default for the specified user */
 void
 ssh_selinux_setup_exec_context(char *pwname)
-diff -up openssh-6.1p1/ssh-keycat.c.keycat openssh-6.1p1/ssh-keycat.c
--- openssh-6.1p1/ssh-keycat.c.keycat	2013-02-14 17:39:21.149382009 +0100
-+++ openssh-6.1p1/ssh-keycat.c	2013-02-14 17:39:21.149382009 +0100
+diff -up openssh-6.2p1/ssh-keycat.c.keycat openssh-6.2p1/ssh-keycat.c
+--- openssh-6.2p1/ssh-keycat.c.keycat	2013-03-25 21:34:17.800978986 +0100
+++ openssh-6.2p1/ssh-keycat.c	2013-03-25 21:34:17.800978986 +0100
@@ -0,0 +1,238 @@
 +/*
 + * Redistribution and use in source and binary forms, with or without
--- a/openssh-6.2p1-kuserok.patch
+++ b/openssh-6.2p1-kuserok.patch
@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c
--- openssh-6.1p1/auth-krb5.c.kuserok	2012-09-14 21:08:16.941496194 +0200
-+++ openssh-6.1p1/auth-krb5.c	2012-09-14 21:08:17.063496896 +0200
+diff -up openssh-6.2p1/auth-krb5.c.kuserok openssh-6.2p1/auth-krb5.c
+--- openssh-6.2p1/auth-krb5.c.kuserok	2013-03-25 20:06:51.295558062 +0100
+++ openssh-6.2p1/auth-krb5.c	2013-03-25 20:06:51.318558207 +0100
@@ -55,6 +55,20 @@
 
 extern ServerOptions	 options;
@ -31,9 +31,9 @@ diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c
 		problem = -1;
 		goto out;
 	}
-diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c
--- openssh-6.1p1/gss-serv-krb5.c.kuserok	2012-09-14 21:08:17.019496642 +0200
-+++ openssh-6.1p1/gss-serv-krb5.c	2012-09-14 21:08:17.065496906 +0200
+diff -up openssh-6.2p1/gss-serv-krb5.c.kuserok openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.kuserok	2013-03-25 20:06:51.311558163 +0100
+++ openssh-6.2p1/gss-serv-krb5.c	2013-03-25 20:06:51.319558214 +0100
@@ -68,6 +68,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr
     int);
 
@ -51,10 +51,10 @@ diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c
 		retval = 1;
 		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
 		    luser, (char *)client->displayname.value);
-diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
--- openssh-6.1p1/servconf.c.kuserok	2012-09-14 21:08:16.989496471 +0200
-+++ openssh-6.1p1/servconf.c	2012-09-14 21:09:30.864868698 +0200
-@@ -152,6 +152,7 @@ initialize_server_options(ServerOptions
+diff -up openssh-6.2p1/servconf.c.kuserok openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.kuserok	2013-03-25 20:06:51.305558125 +0100
+++ openssh-6.2p1/servconf.c	2013-03-25 20:06:51.319558214 +0100
+@@ -150,6 +150,7 @@ initialize_server_options(ServerOptions
 	options->ip_qos_interactive = -1;
 	options->ip_qos_bulk = -1;
 	options->version_addendum = NULL;
@ -62,7 +62,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 }
 
 void
-@@ -301,6 +302,8 @@ fill_default_server_options(ServerOption
+@@ -299,6 +300,8 @@ fill_default_server_options(ServerOption
 		options->version_addendum = xstrdup("");
 	if (options->show_patchlevel == -1)
 		options->show_patchlevel = 0;
@ -71,7 +71,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 
 	/* Turn privilege separation on by default */
 	if (use_privsep == -1)
-@@ -327,7 +330,7 @@ typedef enum {
+@@ -325,7 +328,7 @@ typedef enum {
 	sPermitRootLogin, sLogFacility, sLogLevel,
 	sRhostsRSAAuthentication, sRSAAuthentication,
 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
@ -80,7 +80,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 	sKerberosTgtPassing, sChallengeResponseAuthentication,
 	sPasswordAuthentication, sKbdInteractiveAuthentication,
 	sListenAddress, sAddressFamily,
-@@ -399,11 +402,13 @@ static struct {
+@@ -397,11 +400,13 @@ static struct {
 #else
 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 #endif
@ -94,7 +94,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 #endif
 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1486,6 +1491,10 @@ process_server_config_line(ServerOptions
+@@ -1460,6 +1465,10 @@ process_server_config_line(ServerOptions
 		*activep = value;
 		break;
 
@ -105,7 +105,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 	case sPermitOpen:
 		arg = strdelim(&cp);
 		if (!arg || *arg == '\0')
-@@ -1769,6 +1778,7 @@ copy_set_server_options(ServerOptions *d
+@@ -1761,6 +1770,7 @@ copy_set_server_options(ServerOptions *d
 	M_CP_INTOPT(max_authtries);
 	M_CP_INTOPT(ip_qos_interactive);
 	M_CP_INTOPT(ip_qos_bulk);
@ -113,7 +113,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 
 	/* See comment in servconf.h */
 	COPY_MATCH_STRING_OPTS();
-@@ -2005,6 +2015,7 @@ dump_config(ServerOptions *o)
+@@ -1999,6 +2009,7 @@ dump_config(ServerOptions *o)
 	dump_cfg_fmtint(sUseDNS, o->use_dns);
 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
@ -121,10 +121,10 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
 
 	/* string arguments */
 	dump_cfg_string(sPidFile, o->pid_file);
-diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h
--- openssh-6.1p1/servconf.h.kuserok	2012-09-14 21:08:16.990496476 +0200
-+++ openssh-6.1p1/servconf.h	2012-09-14 21:08:17.071496942 +0200
-@@ -169,6 +169,7 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.kuserok openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.kuserok	2013-03-25 20:06:51.305558125 +0100
+++ openssh-6.2p1/servconf.h	2013-03-25 20:06:51.320558220 +0100
+@@ -173,6 +173,7 @@ typedef struct {
 
 	int	num_permitted_opens;
 
@ -132,10 +132,10 @@ diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h
 	char   *chroot_directory;
 	char   *revoked_keys_file;
 	char   *trusted_user_ca_keys;
-diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config
--- openssh-6.1p1/sshd_config.kuserok	2012-09-14 21:08:17.002496545 +0200
-+++ openssh-6.1p1/sshd_config	2012-09-14 21:08:17.074496957 +0200
-@@ -79,6 +79,7 @@ ChallengeResponseAuthentication no
+diff -up openssh-6.2p1/sshd_config.kuserok openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.kuserok	2013-03-25 20:06:51.308558144 +0100
+++ openssh-6.2p1/sshd_config	2013-03-25 20:06:51.320558220 +0100
+@@ -83,6 +83,7 @@ ChallengeResponseAuthentication no
 #KerberosOrLocalPasswd yes
 #KerberosTicketCleanup yes
 #KerberosGetAFSToken no
@ -143,10 +143,10 @@ diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config
 
 # GSSAPI options
 #GSSAPIAuthentication no
-diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5
--- openssh-6.1p1/sshd_config.5.kuserok	2012-09-14 21:08:17.004496556 +0200
-+++ openssh-6.1p1/sshd_config.5	2012-09-14 21:08:17.073496952 +0200
-@@ -618,6 +618,10 @@ Specifies whether to automatically destr
+diff -up openssh-6.2p1/sshd_config.5.kuserok openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.kuserok	2013-03-25 20:06:51.308558144 +0100
+++ openssh-6.2p1/sshd_config.5	2013-03-25 20:08:34.249207272 +0100
+@@ -660,6 +660,10 @@ Specifies whether to automatically destr
 file on logout.
 The default is
 .Dq yes .
@ -157,11 +157,11 @@ diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5
 .It Cm KexAlgorithms
 Specifies the available KEX (Key Exchange) algorithms.
 Multiple algorithms must be comma-separated.
-@@ -767,6 +771,7 @@ Available keywords are
+@@ -819,6 +823,7 @@ Available keywords are
 .Cm HostbasedUsesNameFromPacketOnly ,
 .Cm KbdInteractiveAuthentication ,
 .Cm KerberosAuthentication ,
 +.Cm KerberosUseKuserok ,
 .Cm MaxAuthTries ,
 .Cm MaxSessions ,
- .Cm PubkeyAuthentication ,
+ .Cm PasswordAuthentication ,
--- a/openssh-6.2p1-ldap.patch
+++ b/openssh-6.2p1-ldap.patch
@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/configure.ac.ldap openssh-6.1p1/configure.ac
--- openssh-6.1p1/configure.ac.ldap	2012-07-06 03:49:29.000000000 +0200
-+++ openssh-6.1p1/configure.ac	2012-11-01 13:35:14.830280116 +0100
-@@ -1512,6 +1512,106 @@ AC_ARG_WITH([audit],
+diff -up openssh-6.2p1/configure.ac.ldap openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.ldap	2013-03-20 02:55:15.000000000 +0100
+++ openssh-6.2p1/configure.ac	2013-03-25 21:27:15.888248071 +0100
+@@ -1509,6 +1509,106 @@ AC_ARG_WITH([audit],
 	esac ]
 )
 
@ -108,9 +108,9 @@ diff -up openssh-6.1p1/configure.ac.ldap openssh-6.1p1/configure.ac
 dnl    Checks for library functions. Please keep in alphabetical order
 AC_CHECK_FUNCS([ \
 	arc4random \
-diff -up openssh-6.1p1/HOWTO.ldap-keys.ldap openssh-6.1p1/HOWTO.ldap-keys
--- openssh-6.1p1/HOWTO.ldap-keys.ldap	2012-11-01 12:57:17.915280385 +0100
-+++ openssh-6.1p1/HOWTO.ldap-keys	2012-11-01 12:57:17.915280385 +0100
+diff -up openssh-6.2p1/HOWTO.ldap-keys.ldap openssh-6.2p1/HOWTO.ldap-keys
+--- openssh-6.2p1/HOWTO.ldap-keys.ldap	2013-03-25 21:27:15.889248078 +0100
+++ openssh-6.2p1/HOWTO.ldap-keys	2013-03-25 21:27:15.889248078 +0100
@@ -0,0 +1,108 @@
 +
 +HOW TO START
@ -220,9 +220,9 @@ diff -up openssh-6.1p1/HOWTO.ldap-keys.ldap openssh-6.1p1/HOWTO.ldap-keys
 +5) Author
 +    Jan F. Chadima <jchadima@redhat.com>
 +
-diff -up openssh-6.1p1/ldapbody.c.ldap openssh-6.1p1/ldapbody.c
--- openssh-6.1p1/ldapbody.c.ldap	2012-11-01 12:57:17.916280385 +0100
-+++ openssh-6.1p1/ldapbody.c	2012-11-01 12:57:17.916280385 +0100
+diff -up openssh-6.2p1/ldapbody.c.ldap openssh-6.2p1/ldapbody.c
+--- openssh-6.2p1/ldapbody.c.ldap	2013-03-25 21:27:15.889248078 +0100
+++ openssh-6.2p1/ldapbody.c	2013-03-25 21:27:15.889248078 +0100
@@ -0,0 +1,494 @@
 +/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -718,9 +718,9 @@ diff -up openssh-6.1p1/ldapbody.c.ldap openssh-6.1p1/ldapbody.c
 +	return;
 +}
 +
-diff -up openssh-6.1p1/ldapbody.h.ldap openssh-6.1p1/ldapbody.h
--- openssh-6.1p1/ldapbody.h.ldap	2012-11-01 12:57:17.916280385 +0100
-+++ openssh-6.1p1/ldapbody.h	2012-11-01 12:57:17.916280385 +0100
+diff -up openssh-6.2p1/ldapbody.h.ldap openssh-6.2p1/ldapbody.h
+--- openssh-6.2p1/ldapbody.h.ldap	2013-03-25 21:27:15.889248078 +0100
+++ openssh-6.2p1/ldapbody.h	2013-03-25 21:27:15.889248078 +0100
@@ -0,0 +1,37 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -759,9 +759,9 @@ diff -up openssh-6.1p1/ldapbody.h.ldap openssh-6.1p1/ldapbody.h
 +
 +#endif /* LDAPBODY_H */
 +
-diff -up openssh-6.1p1/ldapconf.c.ldap openssh-6.1p1/ldapconf.c
--- openssh-6.1p1/ldapconf.c.ldap	2012-11-01 12:57:17.917280385 +0100
-+++ openssh-6.1p1/ldapconf.c	2012-11-01 12:57:17.917280385 +0100
+diff -up openssh-6.2p1/ldapconf.c.ldap openssh-6.2p1/ldapconf.c
+--- openssh-6.2p1/ldapconf.c.ldap	2013-03-25 21:27:15.890248084 +0100
+++ openssh-6.2p1/ldapconf.c	2013-03-25 21:27:15.890248084 +0100
@@ -0,0 +1,682 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1445,9 +1445,9 @@ diff -up openssh-6.1p1/ldapconf.c.ldap openssh-6.1p1/ldapconf.c
 +	dump_cfg_string(lSSH_Filter, options.ssh_filter);
 +}
 +
-diff -up openssh-6.1p1/ldapconf.h.ldap openssh-6.1p1/ldapconf.h
--- openssh-6.1p1/ldapconf.h.ldap	2012-11-01 12:57:17.918280385 +0100
-+++ openssh-6.1p1/ldapconf.h	2012-11-01 12:57:17.918280385 +0100
+diff -up openssh-6.2p1/ldapconf.h.ldap openssh-6.2p1/ldapconf.h
+--- openssh-6.2p1/ldapconf.h.ldap	2013-03-25 21:27:15.891248091 +0100
+++ openssh-6.2p1/ldapconf.h	2013-03-25 21:27:15.891248091 +0100
@@ -0,0 +1,71 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1520,9 +1520,9 @@ diff -up openssh-6.1p1/ldapconf.h.ldap openssh-6.1p1/ldapconf.h
 +void dump_config(void);
 +
 +#endif /* LDAPCONF_H */
-diff -up openssh-6.1p1/ldap.conf.ldap openssh-6.1p1/ldap.conf
--- openssh-6.1p1/ldap.conf.ldap	2012-11-01 12:57:17.918280385 +0100
-+++ openssh-6.1p1/ldap.conf	2012-11-01 12:57:17.918280385 +0100
+diff -up openssh-6.2p1/ldap.conf.ldap openssh-6.2p1/ldap.conf
+--- openssh-6.2p1/ldap.conf.ldap	2013-03-25 21:27:15.891248091 +0100
+++ openssh-6.2p1/ldap.conf	2013-03-25 21:27:15.891248091 +0100
@@ -0,0 +1,88 @@
 +# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
 +#
@ -1612,9 +1612,9 @@ diff -up openssh-6.1p1/ldap.conf.ldap openssh-6.1p1/ldap.conf
 +#tls_cert
 +#tls_key
 +
-diff -up openssh-6.1p1/ldap-helper.c.ldap openssh-6.1p1/ldap-helper.c
--- openssh-6.1p1/ldap-helper.c.ldap	2012-11-01 12:57:17.919280385 +0100
-+++ openssh-6.1p1/ldap-helper.c	2012-11-01 12:57:17.919280385 +0100
+diff -up openssh-6.2p1/ldap-helper.c.ldap openssh-6.2p1/ldap-helper.c
+--- openssh-6.2p1/ldap-helper.c.ldap	2013-03-25 21:27:15.892248097 +0100
+++ openssh-6.2p1/ldap-helper.c	2013-03-25 21:27:15.892248097 +0100
@@ -0,0 +1,155 @@
 +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1771,9 +1771,9 @@ diff -up openssh-6.1p1/ldap-helper.c.ldap openssh-6.1p1/ldap-helper.c
 +void   *buffer_get_string(Buffer *b, u_int *l) { return NULL; }
 +void    buffer_put_string(Buffer *b, const void *f, u_int l) {}
 +
-diff -up openssh-6.1p1/ldap-helper.h.ldap openssh-6.1p1/ldap-helper.h
--- openssh-6.1p1/ldap-helper.h.ldap	2012-11-01 12:57:17.919280385 +0100
-+++ openssh-6.1p1/ldap-helper.h	2012-11-01 12:57:17.919280385 +0100
+diff -up openssh-6.2p1/ldap-helper.h.ldap openssh-6.2p1/ldap-helper.h
+--- openssh-6.2p1/ldap-helper.h.ldap	2013-03-25 21:27:15.892248097 +0100
+++ openssh-6.2p1/ldap-helper.h	2013-03-25 21:27:15.892248097 +0100
@@ -0,0 +1,32 @@
 +/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1807,9 +1807,9 @@ diff -up openssh-6.1p1/ldap-helper.h.ldap openssh-6.1p1/ldap-helper.h
 +extern int config_warning_config_file;
 +
 +#endif /* LDAP_HELPER_H */
-diff -up openssh-6.1p1/ldapincludes.h.ldap openssh-6.1p1/ldapincludes.h
--- openssh-6.1p1/ldapincludes.h.ldap	2012-11-01 12:57:17.920280385 +0100
-+++ openssh-6.1p1/ldapincludes.h	2012-11-01 12:57:17.920280385 +0100
+diff -up openssh-6.2p1/ldapincludes.h.ldap openssh-6.2p1/ldapincludes.h
+--- openssh-6.2p1/ldapincludes.h.ldap	2013-03-25 21:27:15.892248097 +0100
+++ openssh-6.2p1/ldapincludes.h	2013-03-25 21:27:15.892248097 +0100
@@ -0,0 +1,41 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1852,9 +1852,9 @@ diff -up openssh-6.1p1/ldapincludes.h.ldap openssh-6.1p1/ldapincludes.h
 +#endif
 +
 +#endif /* LDAPINCLUDES_H */
-diff -up openssh-6.1p1/ldapmisc.c.ldap openssh-6.1p1/ldapmisc.c
--- openssh-6.1p1/ldapmisc.c.ldap	2012-11-01 12:57:17.920280385 +0100
-+++ openssh-6.1p1/ldapmisc.c	2012-11-01 12:57:17.920280385 +0100
+diff -up openssh-6.2p1/ldapmisc.c.ldap openssh-6.2p1/ldapmisc.c
+--- openssh-6.2p1/ldapmisc.c.ldap	2013-03-25 21:27:15.893248104 +0100
+++ openssh-6.2p1/ldapmisc.c	2013-03-25 21:27:15.893248104 +0100
@@ -0,0 +1,79 @@
 +
 +#include "ldapincludes.h"
@ -1935,9 +1935,9 @@ diff -up openssh-6.1p1/ldapmisc.c.ldap openssh-6.1p1/ldapmisc.c
 +}
 +#endif
 +
-diff -up openssh-6.1p1/ldapmisc.h.ldap openssh-6.1p1/ldapmisc.h
--- openssh-6.1p1/ldapmisc.h.ldap	2012-11-01 12:57:17.921280385 +0100
-+++ openssh-6.1p1/ldapmisc.h	2012-11-01 12:57:17.921280385 +0100
+diff -up openssh-6.2p1/ldapmisc.h.ldap openssh-6.2p1/ldapmisc.h
+--- openssh-6.2p1/ldapmisc.h.ldap	2013-03-25 21:27:15.893248104 +0100
+++ openssh-6.2p1/ldapmisc.h	2013-03-25 21:27:15.893248104 +0100
@@ -0,0 +1,35 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1974,9 +1974,9 @@ diff -up openssh-6.1p1/ldapmisc.h.ldap openssh-6.1p1/ldapmisc.h
 +
 +#endif /* LDAPMISC_H */
 +
-diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
--- openssh-6.1p1/Makefile.in.ldap	2012-11-01 12:57:17.750280385 +0100
-+++ openssh-6.1p1/Makefile.in	2012-11-01 12:57:17.922280385 +0100
+diff -up openssh-6.2p1/Makefile.in.ldap openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ldap	2013-03-25 21:27:15.850247822 +0100
+++ openssh-6.2p1/Makefile.in	2013-03-25 21:27:57.356518817 +0100
@@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh
 ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
 SFTP_SERVER=$(libexecdir)/sftp-server
@ -1986,7 +1986,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
 PRIVSEP_PATH=@PRIVSEP_PATH@
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -58,8 +60,9 @@ XAUTH_PATH=@XAUTH_PATH@
+@@ -60,8 +62,9 @@ XAUTH_PATH=@XAUTH_PATH@
 LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
 EXEEXT=@EXEEXT@
 MANFMT=@MANFMT@
@ -1995,9 +1995,9 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
 
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -93,8 +96,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-aes.o \
+@@ -95,8 +98,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
 	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
 	sandbox-seccomp-filter.o
 
@ -2008,7 +2008,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 MANTYPE		= @MANTYPE@
 
 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -162,6 +165,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
+@@ -164,6 +167,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
 	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
 
@ -2018,7 +2018,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 
-@@ -257,6 +263,10 @@ install-files:
+@@ -266,6 +272,10 @@ install-files:
 	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -2029,7 +2029,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-@@ -273,6 +283,10 @@ install-files:
+@@ -282,6 +292,10 @@ install-files:
 	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
 	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
 	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@ -2040,7 +2040,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 	-rm -f $(DESTDIR)$(bindir)/slogin
 	ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -302,6 +316,13 @@ install-sysconf:
+@@ -311,6 +325,13 @@ install-sysconf:
 	else \
 		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
 	fi
@ -2054,7 +2054,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 
 host-key: ssh-keygen$(EXEEXT)
 	@if [ -z "$(DESTDIR)" ] ; then \
-@@ -359,6 +380,8 @@ uninstall:
+@@ -368,6 +389,8 @@ uninstall:
 	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
 	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
 	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -2063,17 +2063,17 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -370,6 +393,7 @@ uninstall:
+@@ -379,6 +402,7 @@ uninstall:
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
 +	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
 
- tests interop-tests:	$(TARGETS)
-diff -up openssh-6.1p1/openssh-lpk-openldap.schema.ldap openssh-6.1p1/openssh-lpk-openldap.schema
--- openssh-6.1p1/openssh-lpk-openldap.schema.ldap	2012-11-01 12:57:17.922280385 +0100
-+++ openssh-6.1p1/openssh-lpk-openldap.schema	2012-11-01 12:57:17.922280385 +0100
+ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
+diff -up openssh-6.2p1/openssh-lpk-openldap.schema.ldap openssh-6.2p1/openssh-lpk-openldap.schema
+--- openssh-6.2p1/openssh-lpk-openldap.schema.ldap	2013-03-25 21:27:15.894248110 +0100
+++ openssh-6.2p1/openssh-lpk-openldap.schema	2013-03-25 21:27:15.894248110 +0100
@@ -0,0 +1,21 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2096,9 +2096,9 @@ diff -up openssh-6.1p1/openssh-lpk-openldap.schema.ldap openssh-6.1p1/openssh-lp
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff -up openssh-6.1p1/openssh-lpk-sun.schema.ldap openssh-6.1p1/openssh-lpk-sun.schema
--- openssh-6.1p1/openssh-lpk-sun.schema.ldap	2012-11-01 12:57:17.922280385 +0100
-+++ openssh-6.1p1/openssh-lpk-sun.schema	2012-11-01 12:57:17.922280385 +0100
+diff -up openssh-6.2p1/openssh-lpk-sun.schema.ldap openssh-6.2p1/openssh-lpk-sun.schema
+--- openssh-6.2p1/openssh-lpk-sun.schema.ldap	2013-03-25 21:27:15.894248110 +0100
+++ openssh-6.2p1/openssh-lpk-sun.schema	2013-03-25 21:27:15.894248110 +0100
@@ -0,0 +1,23 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2123,9 +2123,9 @@ diff -up openssh-6.1p1/openssh-lpk-sun.schema.ldap openssh-6.1p1/openssh-lpk-sun
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff -up openssh-6.1p1/ssh-ldap.conf.5.ldap openssh-6.1p1/ssh-ldap.conf.5
--- openssh-6.1p1/ssh-ldap.conf.5.ldap	2012-11-01 12:57:17.923280385 +0100
-+++ openssh-6.1p1/ssh-ldap.conf.5	2012-11-01 12:57:17.923280385 +0100
+diff -up openssh-6.2p1/ssh-ldap.conf.5.ldap openssh-6.2p1/ssh-ldap.conf.5
+--- openssh-6.2p1/ssh-ldap.conf.5.ldap	2013-03-25 21:27:15.895248117 +0100
+++ openssh-6.2p1/ssh-ldap.conf.5	2013-03-25 21:27:15.895248117 +0100
@@ -0,0 +1,376 @@
 +.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
@ -2503,9 +2503,9 @@ diff -up openssh-6.1p1/ssh-ldap.conf.5.ldap openssh-6.1p1/ssh-ldap.conf.5
 +OpenSSH 5.5 + PKA-LDAP .
 +.Sh AUTHORS
 +.An Jan F. Chadima Aq jchadima@redhat.com
-diff -up openssh-6.1p1/ssh-ldap-helper.8.ldap openssh-6.1p1/ssh-ldap-helper.8
--- openssh-6.1p1/ssh-ldap-helper.8.ldap	2012-11-01 12:57:17.924280385 +0100
-+++ openssh-6.1p1/ssh-ldap-helper.8	2012-11-01 12:57:17.924280385 +0100
+diff -up openssh-6.2p1/ssh-ldap-helper.8.ldap openssh-6.2p1/ssh-ldap-helper.8
+--- openssh-6.2p1/ssh-ldap-helper.8.ldap	2013-03-25 21:27:15.895248117 +0100
+++ openssh-6.2p1/ssh-ldap-helper.8	2013-03-25 21:27:15.895248117 +0100
@@ -0,0 +1,79 @@
 +.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
@ -2586,9 +2586,9 @@ diff -up openssh-6.1p1/ssh-ldap-helper.8.ldap openssh-6.1p1/ssh-ldap-helper.8
 +OpenSSH 5.5 + PKA-LDAP .
 +.Sh AUTHORS
 +.An Jan F. Chadima Aq jchadima@redhat.com
-diff -up openssh-6.1p1/ssh-ldap-wrapper.ldap openssh-6.1p1/ssh-ldap-wrapper
--- openssh-6.1p1/ssh-ldap-wrapper.ldap	2012-11-01 12:57:17.924280385 +0100
-+++ openssh-6.1p1/ssh-ldap-wrapper	2012-11-01 12:57:17.924280385 +0100
+diff -up openssh-6.2p1/ssh-ldap-wrapper.ldap openssh-6.2p1/ssh-ldap-wrapper
+--- openssh-6.2p1/ssh-ldap-wrapper.ldap	2013-03-25 21:27:15.896248124 +0100
+++ openssh-6.2p1/ssh-ldap-wrapper	2013-03-25 21:27:15.896248124 +0100
@@ -0,0 +1,4 @@
 +#!/bin/sh
 +
--- a/openssh-6.2p1-role-mls.patch
+++ b/openssh-6.2p1-role-mls.patch
@ -1,7 +1,44 @@
-diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
--- openssh-6.1p1/auth1.c.role-mls	2012-11-28 17:06:43.657990103 +0100
-+++ openssh-6.1p1/auth1.c	2012-11-28 17:06:43.699989959 +0100
-@@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt)
+diff -up openssh-6.2p1/auth.h.role-mls openssh-6.2p1/auth.h
+--- openssh-6.2p1/auth.h.role-mls	2013-03-25 17:47:00.565746862 +0100
+++ openssh-6.2p1/auth.h	2013-03-25 17:47:00.602747073 +0100
+@@ -59,6 +59,9 @@ struct Authctxt {
+ 	char		*service;
+ 	struct passwd	*pw;		/* set if 'valid' */
+ 	char		*style;
+#ifdef WITH_SELINUX
+	char		*role;
+#endif
+ 	void		*kbdintctxt;
+ 	void		*jpake_ctx;
+ #ifdef BSD_AUTH
+diff -up openssh-6.2p1/auth-pam.c.role-mls openssh-6.2p1/auth-pam.c
+--- openssh-6.2p1/auth-pam.c.role-mls	2013-03-25 17:47:00.535746690 +0100
+++ openssh-6.2p1/auth-pam.c	2013-03-25 17:47:00.602747073 +0100
+@@ -1074,7 +1074,7 @@ is_pam_session_open(void)
+  * during the ssh authentication process.
+  */
+ int
+-do_pam_putenv(char *name, char *value)
+do_pam_putenv(char *name, const char *value)
+ {
+ 	int ret = 1;
+ #ifdef HAVE_PAM_PUTENV
+diff -up openssh-6.2p1/auth-pam.h.role-mls openssh-6.2p1/auth-pam.h
+--- openssh-6.2p1/auth-pam.h.role-mls	2004-09-11 14:17:26.000000000 +0200
+++ openssh-6.2p1/auth-pam.h	2013-03-25 17:47:00.602747073 +0100
+@@ -38,7 +38,7 @@ void do_pam_session(void);
+ void do_pam_set_tty(const char *);
+ void do_pam_setcred(int );
+ void do_pam_chauthtok(void);
+-int do_pam_putenv(char *, char *);
+int do_pam_putenv(char *, const char *);
+ char ** fetch_pam_environment(void);
+ char ** fetch_pam_child_environment(void);
+ void free_pam_environment(char **);
+diff -up openssh-6.2p1/auth1.c.role-mls openssh-6.2p1/auth1.c
+--- openssh-6.2p1/auth1.c.role-mls	2012-12-02 23:53:20.000000000 +0100
+++ openssh-6.2p1/auth1.c	2013-03-25 17:47:00.600747062 +0100
+@@ -386,6 +386,9 @@ do_authentication(Authctxt *authctxt)
 {
 	u_int ulen;
 	char *user, *style = NULL;
@ -11,7 +48,7 @@ diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
 
 	/* Get the name of the user that we wish to log in as. */
 	packet_read_expect(SSH_CMSG_USER);
-@@ -392,11 +395,24 @@ do_authentication(Authctxt *authctxt)
+@@ -394,11 +397,24 @@ do_authentication(Authctxt *authctxt)
 	user = packet_get_cstring(&ulen);
 	packet_check_eom();
 
@ -36,9 +73,9 @@ diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
 
 	/* Verify that the user is a valid user. */
 	if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
-diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c
--- openssh-6.1p1/auth2.c.role-mls	2012-11-28 17:06:43.661990089 +0100
-+++ openssh-6.1p1/auth2.c	2012-11-28 17:11:09.058916613 +0100
+diff -up openssh-6.2p1/auth2.c.role-mls openssh-6.2p1/auth2.c
+--- openssh-6.2p1/auth2.c.role-mls	2013-03-25 17:47:00.556746810 +0100
+++ openssh-6.2p1/auth2.c	2013-03-25 17:47:00.600747062 +0100
@@ -218,6 +218,9 @@ input_userauth_request(int type, u_int32
 	Authctxt *authctxt = ctxt;
 	Authmethod *m = NULL;
@ -78,9 +115,9 @@ diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c
 		userauth_banner();
 		if (auth2_setup_methods_lists(authctxt) != 0)
 			packet_disconnect("no authentication methods enabled");
-diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c
--- openssh-6.1p1/auth2-gss.c.role-mls	2011-05-05 06:04:11.000000000 +0200
-+++ openssh-6.1p1/auth2-gss.c	2012-11-28 17:06:43.700989956 +0100
+diff -up openssh-6.2p1/auth2-gss.c.role-mls openssh-6.2p1/auth2-gss.c
+--- openssh-6.2p1/auth2-gss.c.role-mls	2012-12-02 23:53:20.000000000 +0100
+++ openssh-6.2p1/auth2-gss.c	2013-03-25 17:47:00.601747067 +0100
@@ -260,6 +260,7 @@ input_gssapi_mic(int type, u_int32_t ple
 	Authctxt *authctxt = ctxt;
 	Gssctxt *gssctxt;
@ -113,9 +150,9 @@ diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c
 	xfree(mic.value);
 
 	authctxt->postponed = 0;
-diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.c
--- openssh-6.1p1/auth2-hostbased.c.role-mls	2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth2-hostbased.c	2012-11-28 17:06:43.700989956 +0100
+diff -up openssh-6.2p1/auth2-hostbased.c.role-mls openssh-6.2p1/auth2-hostbased.c
+--- openssh-6.2p1/auth2-hostbased.c.role-mls	2013-03-25 17:47:00.565746862 +0100
+++ openssh-6.2p1/auth2-hostbased.c	2013-03-25 17:47:00.601747067 +0100
@@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt)
 	buffer_put_string(&b, session_id2, session_id2_len);
 	/* reconstruct packet */
@ -133,10 +170,10 @@ diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.
 	buffer_put_cstring(&b, service);
 	buffer_put_cstring(&b, "hostbased");
 	buffer_put_string(&b, pkalg, alen);
-diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c
--- openssh-6.1p1/auth2-pubkey.c.role-mls	2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth2-pubkey.c	2012-11-28 17:06:43.700989956 +0100
-@@ -121,7 +121,15 @@ userauth_pubkey(Authctxt *authctxt)
+diff -up openssh-6.2p1/auth2-pubkey.c.role-mls openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.role-mls	2013-03-25 17:47:00.565746862 +0100
+++ openssh-6.2p1/auth2-pubkey.c	2013-03-25 17:47:00.601747067 +0100
+@@ -127,7 +127,15 @@ userauth_pubkey(Authctxt *authctxt)
 		}
 		/* reconstruct packet */
 		buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
@ -153,46 +190,9 @@ diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c
 		buffer_put_cstring(&b,
 		    datafellows & SSH_BUG_PKSERVICE ?
 		    "ssh-userauth" :
-diff -up openssh-6.1p1/auth.h.role-mls openssh-6.1p1/auth.h
--- openssh-6.1p1/auth.h.role-mls	2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth.h	2012-11-28 17:06:43.699989959 +0100
-@@ -59,6 +59,9 @@ struct Authctxt {
- 	char		*service;
- 	struct passwd	*pw;		/* set if 'valid' */
- 	char		*style;
-+#ifdef WITH_SELINUX
-+	char		*role;
-+#endif
- 	void		*kbdintctxt;
- 	void		*jpake_ctx;
- #ifdef BSD_AUTH
-diff -up openssh-6.1p1/auth-pam.c.role-mls openssh-6.1p1/auth-pam.c
--- openssh-6.1p1/auth-pam.c.role-mls	2012-11-28 17:06:43.638990168 +0100
-+++ openssh-6.1p1/auth-pam.c	2012-11-28 17:06:43.699989959 +0100
-@@ -1074,7 +1074,7 @@ is_pam_session_open(void)
-  * during the ssh authentication process.
-  */
- int
-do_pam_putenv(char *name, char *value)
-+do_pam_putenv(char *name, const char *value)
- {
- 	int ret = 1;
- #ifdef HAVE_PAM_PUTENV
-diff -up openssh-6.1p1/auth-pam.h.role-mls openssh-6.1p1/auth-pam.h
--- openssh-6.1p1/auth-pam.h.role-mls	2004-09-11 14:17:26.000000000 +0200
-+++ openssh-6.1p1/auth-pam.h	2012-11-28 17:06:43.699989959 +0100
-@@ -38,7 +38,7 @@ void do_pam_session(void);
- void do_pam_set_tty(const char *);
- void do_pam_setcred(int );
- void do_pam_chauthtok(void);
-int do_pam_putenv(char *, char *);
-+int do_pam_putenv(char *, const char *);
- char ** fetch_pam_environment(void);
- char ** fetch_pam_child_environment(void);
- void free_pam_environment(char **);
-diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c
--- openssh-6.1p1/misc.c.role-mls	2011-09-22 13:34:36.000000000 +0200
-+++ openssh-6.1p1/misc.c	2012-11-28 17:06:43.701989952 +0100
+diff -up openssh-6.2p1/misc.c.role-mls openssh-6.2p1/misc.c
+--- openssh-6.2p1/misc.c.role-mls	2011-09-22 13:34:36.000000000 +0200
+++ openssh-6.2p1/misc.c	2013-03-25 17:47:00.603747079 +0100
@@ -427,6 +427,7 @@ char *
 colon(char *cp)
 {
@ -215,9 +215,9 @@ diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c
 	}
 	return NULL;
 }
-diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
--- openssh-6.1p1/monitor.c.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor.c	2012-11-28 17:06:43.701989952 +0100
+diff -up openssh-6.2p1/monitor.c.role-mls openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.role-mls	2013-03-25 17:47:00.587746987 +0100
+++ openssh-6.2p1/monitor.c	2013-03-25 17:47:00.604747085 +0100
@@ -148,6 +148,9 @@ int mm_answer_sign(int, Buffer *);
 int mm_answer_pwnamallow(int, Buffer *);
 int mm_answer_auth2_read_banner(int, Buffer *);
@ -228,7 +228,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 int mm_answer_authpassword(int, Buffer *);
 int mm_answer_bsdauthquery(int, Buffer *);
 int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -231,6 +234,9 @@ struct mon_table mon_dispatch_proto20[]
+@@ -232,6 +235,9 @@ struct mon_table mon_dispatch_proto20[]
     {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
     {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
     {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@ -238,7 +238,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
     {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
     {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
 #ifdef USE_PAM
-@@ -838,6 +844,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
+@@ -846,6 +852,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
 	else {
 		/* Allow service/style information on the auth context */
 		monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@ -248,7 +248,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 		monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
 	}
 #ifdef USE_PAM
-@@ -881,6 +890,25 @@ mm_answer_authserv(int sock, Buffer *m)
+@@ -889,6 +898,25 @@ mm_answer_authserv(int sock, Buffer *m)
 	return (0);
 }
 
@ -274,7 +274,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 int
 mm_answer_authpassword(int sock, Buffer *m)
 {
-@@ -1251,7 +1279,7 @@ static int
+@@ -1262,7 +1290,7 @@ static int
 monitor_valid_userblob(u_char *data, u_int datalen)
 {
 	Buffer b;
@ -283,7 +283,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 	u_int len;
 	int fail = 0;
 
-@@ -1277,6 +1305,8 @@ monitor_valid_userblob(u_char *data, u_i
+@@ -1288,6 +1316,8 @@ monitor_valid_userblob(u_char *data, u_i
 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
 		fail++;
 	p = buffer_get_string(&b, NULL);
@ -292,7 +292,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 	if (strcmp(authctxt->user, p) != 0) {
 		logit("wrong user name passed to monitor: expected %s != %.100s",
 		    authctxt->user, p);
-@@ -1308,7 +1338,7 @@ monitor_valid_hostbasedblob(u_char *data
+@@ -1319,7 +1349,7 @@ monitor_valid_hostbasedblob(u_char *data
     char *chost)
 {
 	Buffer b;
@ -301,7 +301,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 	u_int len;
 	int fail = 0;
 
-@@ -1325,6 +1355,8 @@ monitor_valid_hostbasedblob(u_char *data
+@@ -1336,6 +1366,8 @@ monitor_valid_hostbasedblob(u_char *data
 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
 		fail++;
 	p = buffer_get_string(&b, NULL);
@ -310,22 +310,22 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
 	if (strcmp(authctxt->user, p) != 0) {
 		logit("wrong user name passed to monitor: expected %s != %.100s",
 		    authctxt->user, p);
-diff -up openssh-6.1p1/monitor.h.role-mls openssh-6.1p1/monitor.h
--- openssh-6.1p1/monitor.h.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor.h	2012-11-28 17:06:43.701989952 +0100
-@@ -31,6 +31,9 @@
- enum monitor_reqtype {
- 	MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
- 	MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
+diff -up openssh-6.2p1/monitor.h.role-mls openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.role-mls	2013-03-25 17:47:00.605747090 +0100
+++ openssh-6.2p1/monitor.h	2013-03-25 17:50:00.824775483 +0100
+@@ -61,6 +61,9 @@ enum monitor_reqtype {
+ 	MONITOR_REQ_JPAKE_STEP2 = 56, MONITOR_ANS_JPAKE_STEP2 = 57,
+ 	MONITOR_REQ_JPAKE_KEY_CONFIRM = 58, MONITOR_ANS_JPAKE_KEY_CONFIRM = 59,
+ 	MONITOR_REQ_JPAKE_CHECK_CONFIRM = 60, MONITOR_ANS_JPAKE_CHECK_CONFIRM = 61,
 +#ifdef WITH_SELINUX
-+	MONITOR_REQ_AUTHROLE,
+	MONITOR_REQ_AUTHROLE = 80,
 +#endif
- 	MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
- 	MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
- 	MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
-diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c
--- openssh-6.1p1/monitor_wrap.c.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor_wrap.c	2012-11-28 17:06:43.702989948 +0100
+ 
+ 	MONITOR_REQ_PAM_START = 100,
+ 	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+diff -up openssh-6.2p1/monitor_wrap.c.role-mls openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.role-mls	2013-03-25 17:47:00.588746993 +0100
+++ openssh-6.2p1/monitor_wrap.c	2013-03-25 17:47:00.605747090 +0100
@@ -336,6 +336,25 @@ mm_inform_authserv(char *service, char *
 	buffer_free(&m);
 }
@ -352,9 +352,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c
 /* Do the password authentication */
 int
 mm_auth_password(Authctxt *authctxt, char *password)
-diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h
--- openssh-6.1p1/monitor_wrap.h.role-mls	2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor_wrap.h	2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.role-mls openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.role-mls	2013-03-25 17:47:00.588746993 +0100
+++ openssh-6.2p1/monitor_wrap.h	2013-03-25 17:47:00.605747090 +0100
@@ -42,6 +42,9 @@ int mm_is_monitor(void);
 DH *mm_choose_dh(int, int, int);
 int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
@ -365,21 +365,21 @@ diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h
 struct passwd *mm_getpwnamallow(const char *);
 char *mm_auth2_read_banner(void);
 int mm_auth_password(struct Authctxt *, char *);
-diff -up openssh-6.1p1/openbsd-compat/Makefile.in.role-mls openssh-6.1p1/openbsd-compat/Makefile.in
--- openssh-6.1p1/openbsd-compat/Makefile.in.role-mls	2011-11-04 01:25:25.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/Makefile.in	2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.role-mls openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.role-mls	2013-03-25 17:47:00.606747096 +0100
+++ openssh-6.2p1/openbsd-compat/Makefile.in	2013-03-25 17:50:36.024979473 +0100
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
 
- COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
 
 -PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
 +PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
 
 .c.o:
 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbsd-compat/port-linux.c
--- openssh-6.1p1/openbsd-compat/port-linux.c.role-mls	2012-03-09 00:25:18.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux.c	2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux.c.role-mls openssh-6.2p1/openbsd-compat/port-linux.c
+--- openssh-6.2p1/openbsd-compat/port-linux.c.role-mls	2012-03-09 00:25:18.000000000 +0100
+++ openssh-6.2p1/openbsd-compat/port-linux.c	2013-03-25 17:47:00.606747096 +0100
@@ -31,68 +31,271 @@
 
 #include "log.h"
@ -840,9 +840,9 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbs
 #endif /* WITH_SELINUX */
 
 #ifdef LINUX_OOM_ADJUST
-diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1/openbsd-compat/port-linux_part_2.c
--- openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls	2012-11-28 17:06:43.703989944 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux_part_2.c	2012-11-28 17:06:43.703989944 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.2p1/openbsd-compat/port-linux_part_2.c
+--- openssh-6.2p1/openbsd-compat/port-linux_part_2.c.role-mls	2013-03-25 17:47:00.607747102 +0100
+++ openssh-6.2p1/openbsd-compat/port-linux_part_2.c	2013-03-25 17:47:00.607747102 +0100
@@ -0,0 +1,75 @@
 +/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
 +
@ -919,10 +919,10 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1
 +#endif /* WITH_SELINUX */
 +
 +#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
-diff -up openssh-6.1p1/sshd.c.role-mls openssh-6.1p1/sshd.c
--- openssh-6.1p1/sshd.c.role-mls	2012-11-28 17:06:43.688989996 +0100
-+++ openssh-6.1p1/sshd.c	2012-11-28 17:06:43.703989944 +0100
-@@ -2101,6 +2101,9 @@ main(int ac, char **av)
+diff -up openssh-6.2p1/sshd.c.role-mls openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.role-mls	2013-03-25 17:47:00.589746999 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 17:47:00.607747102 +0100
+@@ -2118,6 +2118,9 @@ main(int ac, char **av)
 		restore_uid();
 	}
 #endif
--- a/openssh-6.2p1-vendor.patch
+++ b/openssh-6.2p1-vendor.patch
@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
--- openssh-6.1p1/configure.ac.vendor	2012-09-14 20:36:49.153085211 +0200
-+++ openssh-6.1p1/configure.ac	2012-09-14 20:36:49.559088133 +0200
-@@ -4303,6 +4303,12 @@ AC_ARG_WITH([lastlog],
+diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.vendor	2013-03-25 19:34:01.277495179 +0100
+++ openssh-6.2p1/configure.ac	2013-03-25 19:34:01.377495818 +0100
+@@ -4420,6 +4420,12 @@ AC_ARG_WITH([lastlog],
 		fi
 	]
 )
@ -14,7 +14,7 @@ diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
 
 dnl lastlog, [uw]tmpx? detection
 dnl  NOTE: set the paths in the platform section to avoid the
-@@ -4529,6 +4535,7 @@ echo "           Translate v4 in v6 hack
+@@ -4681,6 +4687,7 @@ echo "           Translate v4 in v6 hack
 echo "                  BSD Auth support: $BSD_AUTH_MSG"
 echo "              Random number source: $RAND_MSG"
 echo "             Privsep sandbox style: $SANDBOX_STYLE"
@ -22,9 +22,9 @@ diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
 
 echo ""
 
-diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
--- openssh-6.1p1/servconf.c.vendor	2012-09-14 20:36:49.124085002 +0200
-+++ openssh-6.1p1/servconf.c	2012-09-14 20:50:34.995972516 +0200
+diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.vendor	2013-03-25 19:34:01.197494668 +0100
+++ openssh-6.2p1/servconf.c	2013-03-25 19:34:01.379495831 +0100
@@ -128,6 +128,7 @@ initialize_server_options(ServerOptions
 	options->max_authtries = -1;
 	options->max_sessions = -1;
@ -33,7 +33,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
 	options->use_dns = -1;
 	options->client_alive_interval = -1;
 	options->client_alive_count_max = -1;
-@@ -289,6 +290,9 @@ fill_default_server_options(ServerOption
+@@ -287,6 +288,9 @@ fill_default_server_options(ServerOption
 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
 	if (options->version_addendum == NULL)
 		options->version_addendum = xstrdup("");
@ -43,7 +43,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
 	/* Turn privilege separation on by default */
 	if (use_privsep == -1)
 		use_privsep = PRIVSEP_NOSANDBOX;
-@@ -326,7 +330,7 @@ typedef enum {
+@@ -324,7 +328,7 @@ typedef enum {
 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
 	sMaxStartups, sMaxAuthTries, sMaxSessions,
@ -52,7 +52,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
 	sClientAliveCountMax, sAuthorizedKeysFile,
 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
-@@ -441,6 +445,7 @@ static struct {
+@@ -439,6 +443,7 @@ static struct {
 	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
 	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
 	{ "banner", sBanner, SSHCFG_ALL },
@ -60,7 +60,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
 	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
 	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
 	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
-@@ -1162,6 +1167,10 @@ process_server_config_line(ServerOptions
+@@ -1163,6 +1168,10 @@ process_server_config_line(ServerOptions
 		multistate_ptr = multistate_privsep;
 		goto parse_multistate;
 
@ -71,7 +71,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
 	case sAllowUsers:
 		while ((arg = strdelim(&cp)) && *arg != '\0') {
 			if (options->num_allow_users >= MAX_ALLOW_USERS)
-@@ -1956,6 +1965,7 @@ dump_config(ServerOptions *o)
+@@ -1950,6 +1959,7 @@ dump_config(ServerOptions *o)
 	dump_cfg_fmtint(sUseLogin, o->use_login);
 	dump_cfg_fmtint(sCompression, o->compression);
 	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
@ -79,10 +79,10 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
 	dump_cfg_fmtint(sUseDNS, o->use_dns);
 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
-diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h
--- openssh-6.1p1/servconf.h.vendor	2012-09-14 20:36:49.125085009 +0200
-+++ openssh-6.1p1/servconf.h	2012-09-14 20:36:49.564088168 +0200
-@@ -140,6 +140,7 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.vendor openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.vendor	2013-01-09 05:56:45.000000000 +0100
+++ openssh-6.2p1/servconf.h	2013-03-25 19:34:01.379495831 +0100
+@@ -147,6 +147,7 @@ typedef struct {
 	int	max_authtries;
 	int	max_sessions;
 	char   *banner;			/* SSH-2 banner message */
@ -90,21 +90,21 @@ diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h
 	int	use_dns;
 	int	client_alive_interval;	/*
 					 * poke the client this often to
-diff -up openssh-6.1p1/sshd_config.vendor openssh-6.1p1/sshd_config
--- openssh-6.1p1/sshd_config.vendor	2012-09-14 20:36:49.507087759 +0200
-+++ openssh-6.1p1/sshd_config	2012-09-14 20:36:49.565088175 +0200
-@@ -114,6 +114,7 @@ UsePrivilegeSeparation sandbox		# Defaul
+diff -up openssh-6.2p1/sshd_config.vendor openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.vendor	2013-03-25 19:34:01.380495837 +0100
+++ openssh-6.2p1/sshd_config	2013-03-25 19:44:43.471296362 +0100
+@@ -118,6 +118,7 @@ UsePrivilegeSeparation sandbox		# Defaul
 #Compression delayed
 #ClientAliveInterval 0
 #ClientAliveCountMax 3
 +#ShowPatchLevel no
 #UseDNS yes
 #PidFile /var/run/sshd.pid
- #MaxStartups 10
-diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0
--- openssh-6.1p1/sshd_config.0.vendor	2012-09-14 20:36:49.510087780 +0200
-+++ openssh-6.1p1/sshd_config.0	2012-09-14 20:36:49.567088190 +0200
-@@ -558,6 +558,11 @@ DESCRIPTION
+ #MaxStartups 10:30:100
+diff -up openssh-6.2p1/sshd_config.0.vendor openssh-6.2p1/sshd_config.0
+--- openssh-6.2p1/sshd_config.0.vendor	2013-03-25 19:34:01.361495716 +0100
+++ openssh-6.2p1/sshd_config.0	2013-03-25 19:34:01.381495844 +0100
+@@ -595,6 +595,11 @@ DESCRIPTION
              Defines the number of bits in the ephemeral protocol version 1
              server key.  The minimum value is 512, and the default is 1024.
 
@ -116,10 +116,10 @@ diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0
      StrictModes
              Specifies whether sshd(8) should check file modes and ownership
              of the user's files and home directory before accepting login.
-diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5
--- openssh-6.1p1/sshd_config.5.vendor	2012-09-14 20:36:49.512087794 +0200
-+++ openssh-6.1p1/sshd_config.5	2012-09-14 20:36:49.568088198 +0200
-@@ -978,6 +978,14 @@ This option applies to protocol version
+diff -up openssh-6.2p1/sshd_config.5.vendor openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.vendor	2013-03-25 19:34:01.362495722 +0100
+++ openssh-6.2p1/sshd_config.5	2013-03-25 19:34:01.382495850 +0100
+@@ -1019,6 +1019,14 @@ This option applies to protocol version
 .It Cm ServerKeyBits
 Defines the number of bits in the ephemeral protocol version 1 server key.
 The minimum value is 512, and the default is 1024.
@ -134,10 +134,10 @@ diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5
 .It Cm StrictModes
 Specifies whether
 .Xr sshd 8
-diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c
--- openssh-6.1p1/sshd.c.vendor	2012-09-14 20:36:49.399086981 +0200
-+++ openssh-6.1p1/sshd.c	2012-09-14 20:47:30.696088744 +0200
-@@ -433,7 +433,7 @@ sshd_exchange_identification(int sock_in
+diff -up openssh-6.2p1/sshd.c.vendor openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.vendor	2013-03-25 19:34:01.332495531 +0100
+++ openssh-6.2p1/sshd.c	2013-03-25 19:44:11.864112092 +0100
+@@ -442,7 +442,7 @@ sshd_exchange_identification(int sock_in
 	}
 
 	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@ -146,13 +146,13 @@ diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c
 	    *options.version_addendum == '\0' ? "" : " ",
 	    options.version_addendum, newline);
 
-@@ -1635,7 +1635,8 @@ main(int ac, char **av)
+@@ -1675,7 +1675,8 @@ main(int ac, char **av)
 		exit(1);
 	}
 
-	debug("sshd version %.100s", SSH_RELEASE);
-+	debug("sshd version %.100s",
-+	      (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE);
+-	debug("sshd version %s, %s", SSH_VERSION,
+	debug("sshd version %s, %s",
+	    (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
+ 	    SSLeay_version(SSLEAY_VERSION));
 
 	/* Store privilege separation user for later use if required. */
- 	if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
--- a/openssh-nukeacss.sh
+++ b/openssh-nukeacss.sh
@ -1,21 +0,0 @@
-#!/bin/sh
-#
-#  Remove the ACSS implementation from OpenSSH, and disable its use so that the
-#  rest of the package can still be built.
-#
-> acss.c
-patch -sp0 << EOF
--- cipher.c.orig       2005-07-17 09:02:10.000000000 +0200
-+++ cipher.c    2005-09-06 14:52:06.000000000 +0200
-@@ -45,6 +45,9 @@
-
- /* compatibility with old or broken OpenSSL versions */
- #include "openbsd-compat/openssl-compat.h"
-+#undef USE_CIPHER_ACSS
-+#undef EVP_acss
-+#define EVP_acss NULL
-
- extern const EVP_CIPHER *evp_ssh1_bf(void);
- extern const EVP_CIPHER *evp_ssh1_3des(void);
-EOF
-echo "Well done."
--- a/openssh.spec
+++ b/openssh.spec
@ -66,10 +66,10 @@
 %endif

 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%define openssh_ver 6.1p1
-%define openssh_rel 7
+%define openssh_ver 6.2p1
+%define openssh_rel 1
 %define pam_ssh_agent_ver 0.9.3
-%define pam_ssh_agent_rel 3
+%define pam_ssh_agent_rel 4

 Summary: An open source implementation of SSH protocol versions 1 and 2
 Name: openssh
@ -82,8 +82,7 @@ URL: http://www.openssh.com/portable.html
 # This package differs from the upstream OpenSSH tarball in that
 # the ACSS cipher is removed by running openssh-nukeacss.sh in
 # the unpacked source directory.
-Source0: openssh-%{version}-noacss.tar.bz2
-Source1: openssh-nukeacss.sh
+Source0: openssh-%{version}.tar.gz
 Source2: sshd.pam
 Source3: sshd.init
 Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
@ -100,9 +99,9 @@ Source13: sshd-keygen
 Patch0: openssh-5.9p1-wIm.patch

 #?
-Patch100: openssh-6.1p1-coverity.patch
+Patch100: openssh-6.2p1-coverity.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1872
-Patch101: openssh-5.8p1-fingerprint.patch
+Patch101: openssh-6.2p1-fingerprint.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1894
 #https://bugzilla.redhat.com/show_bug.cgi?id=735889
 Patch102: openssh-5.8p1-getaddrinfo.patch
@ -114,15 +113,15 @@ Patch104: openssh-6.1p1-authenticationmethods.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1402
 Patch200: openssh-5.8p1-audit0.patch
 # -"-
-Patch201: openssh-6.0p1-audit1.patch
+Patch201: openssh-6.2p1-audit1.patch
 # -"-
 Patch202: openssh-5.9p1-audit2.patch
 # -"-
-Patch203: openssh-5.9p1-audit3.patch
+Patch203: openssh-6.2p1-audit3.patch
 # -"-
-Patch204: openssh-6.1p1-audit4.patch
+Patch204: openssh-6.2p1-audit4.patch
 # -"-
-Patch205: openssh-6.0p1-audit5.patch
+Patch205: openssh-6.2p1-audit5.patch

 # --- pam_ssh-agent ---
 # make it build reusing the openssh sources
@ -132,7 +131,7 @@ Patch301: pam_ssh_agent_auth-0.9.2-seteuid.patch
 # explicitly make pam callbacks visible
 Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
-Patch400: openssh-6.1p1-role-mls.patch
+Patch400: openssh-6.2p1-role-mls.patch
 #?
 #Patch402: openssh-5.9p1-sftp-chroot.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1940
@ -143,9 +142,9 @@ Patch404: openssh-6.1p1-privsep-selinux.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1663
 Patch500: openssh-6.1p1-akc.patch
 #?-- unwanted child :(
-Patch501: openssh-6.0p1-ldap.patch
+Patch501: openssh-6.2p1-ldap.patch
 #?
-Patch502: openssh-5.9p1-keycat.patch
+Patch502: openssh-6.2p1-keycat.patch

 #https://bugzilla.mindrot.org/show_bug.cgi?id=1668
 #Patch600: openssh-5.9p1-keygen.patch
@ -169,7 +168,7 @@ Patch608: openssh-6.1p1-askpass-ld.patch
 Patch609: openssh-5.5p1-x11.patch

 #?
-Patch700: openssh-5.9p1-fips.patch
+Patch700: openssh-6.2p1-fips.patch
 #?
 Patch701: openssh-5.6p1-exit-deadlock.patch
 #?
@ -185,9 +184,9 @@ Patch706: openssh-5.8p1-localdomain.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
 Patch707: openssh-6.1p1-redhat.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)
-Patch708: openssh-6.0p1-entropy.patch
+Patch708: openssh-6.2p1-entropy.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)
-Patch709: openssh-6.1p1-vendor.patch
+Patch709: openssh-6.2p1-vendor.patch
 #?
 Patch710: openssh-5.9p1-copy-id-restorecon.patch
 # warn users for unsupported UsePAM=no (#757545)
@ -195,17 +194,17 @@ Patch711: openssh-6.1p1-log-usepam-no.patch
 # make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL
 Patch712: openssh-5.9p1-ctr-evp-fast.patch
 # add cavs test binary for the aes-ctr
-Patch713: openssh-5.9p1-ctr-cavstest.patch
+Patch713: openssh-6.2p1-ctr-cavstest.patch


 #http://www.sxw.org.uk/computing/patches/openssh.html
 #changed cache storage type - #848228
-Patch800: openssh-6.1p1-gsskex.patch
+Patch800: openssh-6.2p1-gsskex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
-Patch801: openssh-5.8p2-force_krb.patch
+Patch801: openssh-6.2p1-force_krb.patch
 Patch900: openssh-6.1p1-gssapi-canohost.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1780
-Patch901: openssh-6.1p1-kuserok.patch
+Patch901: openssh-6.2p1-kuserok.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=841065
 Patch902: openssh-6.1p1-man-moduli.patch
 # obsolete RequiredAuthentications options
@ -393,7 +392,7 @@ The module is most useful for su and sudo service stacks.
 %patch101 -p1 -b .fingerprint
 %patch102 -p1 -b .getaddrinfo
 %patch103 -p1 -b .packet
-%patch104 -p1 -b .authenticationmethods
+# %patch104 -p1 -b .authenticationmethods

 %patch200 -p1 -b .audit0
 %patch201 -p1 -b .audit1
@ -414,18 +413,18 @@ popd

 %if %{WITH_SELINUX}
 %patch400 -p1 -b .role-mls
-#%patch402 -p1 -b .sftp-chroot
-#%patch403 -p1 -b .sesandbox
+# %patch402 -p1 -b .sftp-chroot
+# %patch403 -p1 -b .sesandbox
 %patch404 -p1 -b .privsep-selinux
 %endif

-%patch500 -p1 -b .akc
+# %patch500 -p1 -b .akc
 %if %{ldap}
 %patch501 -p1 -b .ldap
 %endif
 %patch502 -p1 -b .keycat

-#%patch600 -p1 -b .keygen
+# %patch600 -p1 -b .keygen
 %patch601 -p1 -b .ip-opts
 %patch602 -p1 -b .randclean
 %patch603 -p1 -b .glob
@ -446,7 +445,7 @@ popd
 %patch707 -p1 -b .redhat
 %patch708 -p1 -b .entropy
 %patch709 -p1 -b .vendor
-%patch710 -p1 -b .restorecon
+# %patch710 -p1 -b .restorecon
 %patch711 -p1 -b .log-usepam-no
 %patch712 -p1 -b .evp-ctr
 %patch713 -p1 -b .ctr-cavs
@ -456,9 +455,9 @@ popd

 %patch900 -p1 -b .canohost
 %patch901 -p1 -b .kuserok
-%patch902 -p1 -b .man-moduli
-%patch903 -p1 -b .required-authentication
-%patch904 -p1 -b .max-startups
+# %patch902 -p1 -b .man-moduli
+# %patch903 -p1 -b .required-authentication
+# %patch904 -p1 -b .max-startups

 %if 0
 # Nothing here yet
--- a/3
+++ b/3
@ -1,2 +1 @@
-9872ca1983e566ff5a89c240529e223d  pam_ssh_agent_auth-0.9.3.tar.bz2
-688b37a843ea1c9217f45b1f5c21b791  openssh-6.1p1-noacss.tar.bz2
+7b2d9dd75b5cf267ea1737ec75500316  openssh-6.2p1.tar.gz