diff --git a/.gitignore b/.gitignore
index 09b3faa..ec4bb26 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,5 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
 /openssh-7.7p1.tar.gz
 /openssh-7.7p1.tar.gz.asc
 /DJM-GPG-KEY.gpg
+/openssh-7.8p1.tar.gz
+/openssh-7.8p1.tar.gz.asc
diff --git a/openssh-5.8p1-packet.patch b/openssh-5.8p1-packet.patch
deleted file mode 100644
index 2389903..0000000
--- a/openssh-5.8p1-packet.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up openssh-6.8p1/packet.c.packet openssh-6.8p1/packet.c
---- openssh-6.8p1/packet.c.packet	2015-03-18 10:56:32.286930601 +0100
-+++ openssh-6.8p1/packet.c	2015-03-18 10:58:38.535629739 +0100
-@@ -371,6 +371,8 @@ ssh_packet_connection_is_on_socket(struc
- 	struct sockaddr_storage from, to;
- 	socklen_t fromlen, tolen;
- 
-+	if (!state)
-+		return 0;
- 	if (state->connection_in == -1 || state->connection_out == -1)
- 		return 0;
- 
diff --git a/openssh-6.1p1-gssapi-canohost.patch b/openssh-6.1p1-gssapi-canohost.patch
index 124ac7f..3e6c9cc 100644
--- a/openssh-6.1p1-gssapi-canohost.patch
+++ b/openssh-6.1p1-gssapi-canohost.patch
@@ -4,7 +4,7 @@ diff -up openssh-6.1p1/sshconnect2.c.canohost openssh-6.1p1/sshconnect2.c
 @@ -699,12 +699,15 @@ userauth_gssapi(Authctxt *authctxt)
  	static u_int mech = 0;
  	OM_uint32 min;
- 	int ok = 0;
+ 	int r, ok = 0;
 -	const char *gss_host;
 +	const char *gss_host = NULL;
  
@@ -13,7 +13,7 @@ diff -up openssh-6.1p1/sshconnect2.c.canohost openssh-6.1p1/sshconnect2.c
 -	else if (options.gss_trust_dns)
 +	else if (options.gss_trust_dns) {
  		gss_host = get_canonical_hostname(active_state, 1);
-+		if ( strcmp( gss_host, "UNKNOWN" )  == 0 )
++		if (strcmp(gss_host, "UNKNOWN") == 0)
 +			gss_host = authctxt->host;
 +	}
  	else
diff --git a/openssh-6.2p1-vendor.patch b/openssh-6.2p1-vendor.patch
index 68abb56..1af5e9d 100644
--- a/openssh-6.2p1-vendor.patch
+++ b/openssh-6.2p1-vendor.patch
@@ -34,7 +34,7 @@ diff -up openssh-7.4p1/servconf.c.vendor openssh-7.4p1/servconf.c
  	options->client_alive_interval = -1;
  	options->client_alive_count_max = -1;
 @@ -325,6 +326,8 @@ fill_default_server_options(ServerOption
- 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
+ 		options->ip_qos_bulk = IPTOS_DSCP_CS1;
  	if (options->version_addendum == NULL)
  		options->version_addendum = xstrdup("");
 +	if (options->show_patchlevel == -1)
@@ -71,7 +71,7 @@ diff -up openssh-7.4p1/servconf.c.vendor openssh-7.4p1/servconf.c
  		while ((arg = strdelim(&cp)) && *arg != '\0') {
  			if (match_user(NULL, NULL, NULL, arg) == -1)
 @@ -2269,6 +2277,7 @@ dump_config(ServerOptions *o)
- 	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
+ 	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
  	dump_cfg_fmtint(sCompression, o->compression);
  	dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
 +	dump_cfg_fmtint(sShowPatchLevel, o->show_patchlevel);
@@ -89,28 +89,13 @@ diff -up openssh-7.4p1/servconf.h.vendor openssh-7.4p1/servconf.h
  	int	use_dns;
  	int	client_alive_interval;	/*
  					 * poke the client this often to
-diff -up openssh-7.4p1/sshd_config.0.vendor openssh-7.4p1/sshd_config.0
---- openssh-7.4p1/sshd_config.0.vendor	2016-12-23 13:34:51.695253847 +0100
-+++ openssh-7.4p1/sshd_config.0	2016-12-23 13:36:53.146277511 +0100
-@@ -792,6 +792,11 @@ DESCRIPTION
-              rdomain(4).  If the routing domain is set to %D, then the domain
-              in which the incoming connection was received will be applied.
- 
-+     ShowPatchLevel
-+	     Specifies whether sshd will display the specific patch level of
-+	     the binary in the server identification string.  The patch level
-+	     is set at compile-time.  The default is M-bM-^@M-^\noM-bM-^@M-^].
-+
-      StreamLocalBindMask
-              Sets the octal file creation mode mask (umask) used when creating
-              a Unix-domain socket file for local or remote port forwarding.
 diff -up openssh-7.4p1/sshd_config.5.vendor openssh-7.4p1/sshd_config.5
 --- openssh-7.4p1/sshd_config.5.vendor	2016-12-23 13:34:51.695253847 +0100
 +++ openssh-7.4p1/sshd_config.5	2016-12-23 13:37:17.482282253 +0100
 @@ -1334,6 +1334,13 @@ an OpenSSH Key Revocation List (KRL) as
- If the routing domain is set to
- .Cm \&%D ,
- then the domain in which the incoming connection was received will be applied.
+ .Cm AcceptEnv
+ or
+ .Cm PermitUserEnvironment .
 +.It Cm ShowPatchLevel 
 +Specifies whether 
 +.Nm sshd 
diff --git a/openssh-6.6.1p1-ip-port-config-parser.patch b/openssh-6.6.1p1-ip-port-config-parser.patch
deleted file mode 100644
index 88e1ca2..0000000
--- a/openssh-6.6.1p1-ip-port-config-parser.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-diff --git a/misc.c b/misc.c
-index 874dcc8a..7b7f7a58 100644
---- a/misc.c
-+++ b/misc.c
-@@ -466,7 +466,7 @@ put_host_port(const char *host, u_short port)
-  * The delimiter char, if present, is stored in delim.
-  * If this is the last field, *cp is set to NULL.
-  */
--static char *
-+char *
- hpdelim2(char **cp, char *delim)
- {
- 	char *s, *old;
-diff --git a/misc.h b/misc.h
-index cdafea73..cf9c8f28 100644
---- a/misc.h
-+++ b/misc.h
-@@ -54,6 +54,7 @@ int	 set_rdomain(int, const char *);
- int	 a2port(const char *);
- int	 a2tun(const char *, int *);
- char	*put_host_port(const char *, u_short);
-+char	*hpdelim2(char **, char *);
- char	*hpdelim(char **);
- char	*cleanhostname(char *);
- char	*colon(char *);
-diff --git a/servconf.c b/servconf.c
-index 0f0d0906..1679181e 100644
---- a/servconf.c
-+++ b/servconf.c
-@@ -821,7 +821,7 @@ process_permitopen(struct ssh *ssh, ServerOptions *options)
- {
- 	u_int i;
- 	int port;
--	char *host, *arg, *oarg;
-+	char *host, *arg, *oarg, ch;
- 
- 	channel_clear_adm_permitted_opens(ssh);
- 	if (options->num_permitted_opens == 0)
-@@ -839,8 +839,8 @@ process_permitopen(struct ssh *ssh, ServerOptions *options)
- 	/* Otherwise treat it as a list of permitted host:port */
- 	for (i = 0; i < options->num_permitted_opens; i++) {
- 		oarg = arg = xstrdup(options->permitted_opens[i]);
--		host = hpdelim(&arg);
--		if (host == NULL)
-+		host = hpdelim2(&arg, &ch);
-+		if (host == NULL || ch == '/')
- 			fatal("%s: missing host in PermitOpen", __func__);
- 		host = cleanhostname(host);
- 		if (arg == NULL || ((port = permitopen_port(arg)) < 0))
-@@ -1244,8 +1244,10 @@ process_server_config_line(ServerOptions *options, char *line,
- 			port = 0;
- 			p = arg;
- 		} else {
--			p = hpdelim(&arg);
--			if (p == NULL)
-+			char ch;
-+			arg2 = NULL;
-+			p = hpdelim2(&arg, &ch);
-+			if (p == NULL || ch == '/')
- 				fatal("%s line %d: bad address:port usage",
- 				    filename, linenum);
- 			p = cleanhostname(p);
-@@ -1815,9 +1817,10 @@ process_server_config_line(ServerOptions *options, char *line,
- 			break;
- 		}
- 		for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
-+			char ch;
- 			arg2 = xstrdup(arg);
--			p = hpdelim(&arg);
--			if (p == NULL)
-+			p = hpdelim2(&arg, &ch);
-+			if (p == NULL || ch == '/')
- 				fatal("%s line %d: missing host in PermitOpen",
- 				    filename, linenum);
- 			p = cleanhostname(p);
diff --git a/openssh-6.6.1p1-log-in-chroot.patch b/openssh-6.6.1p1-log-in-chroot.patch
index 99e2e03..7f822ab 100644
--- a/openssh-6.6.1p1-log-in-chroot.patch
+++ b/openssh-6.6.1p1-log-in-chroot.patch
@@ -34,9 +34,9 @@ diff -up openssh-7.4p1/log.h.log-in-chroot openssh-7.4p1/log.h
  
  void     log_init(char *, LogLevel, SyslogFacility, int);
 +void     log_init_handler(char *, LogLevel, SyslogFacility, int, int);
+ LogLevel log_level_get(void);
  int      log_change_level(LogLevel);
  int      log_is_on_stderr(void);
- void     log_redirect_stderr_to(const char *);
 diff -up openssh-7.4p1/monitor.c.log-in-chroot openssh-7.4p1/monitor.c
 --- openssh-7.4p1/monitor.c.log-in-chroot	2016-12-23 15:14:33.311168085 +0100
 +++ openssh-7.4p1/monitor.c	2016-12-23 15:16:42.154193100 +0100
@@ -65,7 +65,7 @@ diff -up openssh-7.4p1/monitor.c.log-in-chroot openssh-7.4p1/monitor.c
 -	do_log2(level, "%s [preauth]", msg);
 +	do_log2(level, "%s [%s]", msg, pmonitor->m_state);
  
- 	buffer_free(&logmsg);
+ 	sshbuf_free(logmsg);
  	free(msg);
 @@ -1719,13 +1723,28 @@ monitor_init(void)
  	mon = xcalloc(1, sizeof(*mon));
diff --git a/openssh-6.6.1p1-selinux-contexts.patch b/openssh-6.6.1p1-selinux-contexts.patch
index ea4cbd1..90e8627 100644
--- a/openssh-6.6.1p1-selinux-contexts.patch
+++ b/openssh-6.6.1p1-selinux-contexts.patch
@@ -7,7 +7,7 @@ index 8f32464..18a2ca4 100644
  #include "servconf.h"
  #include "port-linux.h"
 +#include "misc.h"
- #include "key.h"
+ #include "sshkey.h"
  #include "hostfile.h"
  #include "auth.h"
 @@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
@@ -82,6 +82,14 @@ diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
 index 22ea8ef..1fc963d 100644
 --- a/openbsd-compat/port-linux.c
 +++ b/openbsd-compat/port-linux.c
+@@ -26,6 +26,7 @@
+ #include <stdarg.h>
+ #include <string.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ 
+ #include "log.h"
+ #include "xmalloc.h"
 @@ -179,7 +179,7 @@ ssh_selinux_change_context(const char *newname)
  	strlcpy(newctx + len, newname, newlen - len);
  	if ((cx = index(cx + 1, ':')))
diff --git a/openssh-6.6p1-GSSAPIEnablek5users.patch b/openssh-6.6p1-GSSAPIEnablek5users.patch
index 5dec15b..37e010d 100644
--- a/openssh-6.6p1-GSSAPIEnablek5users.patch
+++ b/openssh-6.6p1-GSSAPIEnablek5users.patch
@@ -4,7 +4,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.GSSAPIEnablek5users openssh-7.4p1/gss-ser
 @@ -279,7 +279,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal pri
  	FILE *fp;
  	char file[MAXPATHLEN];
- 	char line[BUFSIZ] = "";
+ 	char *line = NULL;
 -	char kuser[65]; /* match krb5_kuserok() */
  	struct stat st;
  	struct passwd *pw = the_authctxt->pw;
@@ -44,8 +44,8 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
 -	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
 +	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
- 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+ 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sSetEnv, sPermitTunnel,
+ 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
 @@ -497,12 +500,14 @@ static struct {
  	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
@@ -70,9 +70,9 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
 +		intptr = &options->enable_k5users;
 +		goto parse_flag;
 +
+ 	case sPermitListen:
  	case sPermitOpen:
- 		arg = strdelim(&cp);
- 		if (!arg || *arg == '\0')
+ 		if (opcode == sPermitListen) {
 @@ -2026,6 +2035,7 @@ copy_set_server_options(ServerOptions *d
  	M_CP_INTOPT(ip_qos_interactive);
  	M_CP_INTOPT(ip_qos_bulk);
diff --git a/openssh-6.6p1-ctr-cavstest.patch b/openssh-6.6p1-ctr-cavstest.patch
index 08c6a35..42c399d 100644
--- a/openssh-6.6p1-ctr-cavstest.patch
+++ b/openssh-6.6p1-ctr-cavstest.patch
@@ -19,8 +19,8 @@ diff -up openssh-6.8p1/Makefile.in.ctr-cavs openssh-6.8p1/Makefile.in
  XMSS_OBJS=\
  	ssh-xmss.o \
 @@ -194,6 +195,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
- ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o
- 	$(LD) -o $@ ssh-keycat.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(KEYCATLIBS) $(LIBS)
+ ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
+ 	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(KEYCATLIBS) $(LIBS)
  
 +ctr-cavstest$(EXEEXT): $(LIBCOMPAT) libssh.a ctr-cavstest.o
 +	$(LD) -o $@ ctr-cavstest.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
diff --git a/openssh-6.6p1-entropy.patch b/openssh-6.6p1-entropy.patch
deleted file mode 100644
index 7f6f4d0..0000000
--- a/openssh-6.6p1-entropy.patch
+++ /dev/null
@@ -1,262 +0,0 @@
-diff -up openssh-7.4p1/entropy.c.entropy openssh-7.4p1/entropy.c
---- openssh-7.4p1/entropy.c.entropy	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/entropy.c	2016-12-23 18:34:27.769753570 +0100
-@@ -229,6 +229,9 @@ seed_rng(void)
- 	memset(buf, '\0', sizeof(buf));
- 
- #endif /* OPENSSL_PRNG_ONLY */
-+#ifdef __linux__
-+	linux_seed();
-+#endif /* __linux__ */
- 	if (RAND_status() != 1)
- 		fatal("PRNG is not seeded");
- }
-diff -up openssh-7.4p1/openbsd-compat/Makefile.in.entropy openssh-7.4p1/openbsd-compat/Makefile.in
---- openssh-7.4p1/openbsd-compat/Makefile.in.entropy	2016-12-23 18:34:53.715762155 +0100
-+++ openssh-7.4p1/openbsd-compat/Makefile.in	2016-12-23 18:35:15.890769493 +0100
-@@ -20,7 +20,8 @@ OPENBSD=base64.o basename.o bcrypt_pbkdf
- 	port-solaris.o \
- 	port-net.o \
- 	port-uw.o \
--	port-linux-sshd.o
-+	port-linux-sshd.o \
-+	port-linux-prng.o
- 
- .c.o:
- 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-7.4p1/openbsd-compat/port-linux.h.entropy openssh-7.4p1/openbsd-compat/port-linux.h
---- openssh-7.4p1/openbsd-compat/port-linux.h.entropy	2016-12-23 18:34:27.747753563 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux.h	2016-12-23 18:34:27.769753570 +0100
-@@ -34,4 +34,6 @@ void oom_adjust_restore(void);
- void oom_adjust_setup(void);
- #endif
- 
-+void linux_seed(void);
-+
- #endif /* ! _PORT_LINUX_H */
-diff -up openssh-7.4p1/openbsd-compat/port-linux-prng.c.entropy openssh-7.4p1/openbsd-compat/port-linux-prng.c
---- openssh-7.4p1/openbsd-compat/port-linux-prng.c.entropy	2016-12-23 18:34:27.769753570 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux-prng.c	2016-12-23 18:34:27.769753570 +0100
-@@ -0,0 +1,59 @@
-+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
-+
-+/*
-+ * Copyright (c) 2011 Jan F. Chadima <jchadima@redhat.com>
-+ *
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ */
-+
-+/*
-+ * Linux-specific portability code - prng support
-+ */
-+
-+#include "includes.h"
-+
-+#include <errno.h>
-+#include <stdarg.h>
-+#include <string.h>
-+#include <stdio.h>
-+#include <openssl/rand.h>
-+
-+#include "log.h"
-+#include "xmalloc.h"
-+#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
-+#include "servconf.h"
-+#include "port-linux.h"
-+#include "key.h"
-+#include "hostfile.h"
-+#include "auth.h"
-+
-+void
-+linux_seed(void)
-+{
-+	char *env = getenv("SSH_USE_STRONG_RNG");
-+	char *random = "/dev/random";
-+	size_t len, ienv, randlen = 14;
-+
-+	if (!env || !strcmp(env, "0"))
-+		random = "/dev/urandom";
-+	else if ((ienv = atoi(env)) > randlen)
-+		randlen = ienv;
-+
-+	errno = 0;
-+	if ((len = RAND_load_file(random, randlen)) != randlen) {
-+		if (errno)
-+			fatal ("cannot read from %s, %s", random, strerror(errno));
-+		else
-+			fatal ("EOF reading %s", random);
-+	}
-+}
-diff -up openssh-7.4p1/ssh.1.entropy openssh-7.4p1/ssh.1
---- openssh-7.4p1/ssh.1.entropy	2016-12-23 18:34:27.754753565 +0100
-+++ openssh-7.4p1/ssh.1	2016-12-23 18:34:27.770753571 +0100
-@@ -1441,6 +1441,23 @@ For more information, see the
- .Cm PermitUserEnvironment
- option in
- .Xr sshd_config 5 .
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.It Ev SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 14 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh FILES
- .Bl -tag -width Ds -compact
- .It Pa ~/.rhosts
-diff -up openssh-7.4p1/ssh-add.1.entropy openssh-7.4p1/ssh-add.1
---- openssh-7.4p1/ssh-add.1.entropy	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/ssh-add.1	2016-12-23 18:34:27.770753571 +0100
-@@ -171,6 +171,20 @@ to make this work.)
- Identifies the path of a
- .Ux Ns -domain
- socket used to communicate with the agent.
-+.It Ev SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 14 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
- .El
- .Sh FILES
- .Bl -tag -width Ds
-diff -up openssh-7.4p1/ssh-agent.1.entropy openssh-7.4p1/ssh-agent.1
---- openssh-7.4p1/ssh-agent.1.entropy	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/ssh-agent.1	2016-12-23 18:34:27.770753571 +0100
-@@ -214,6 +214,24 @@ sockets used to contain the connection t
- These sockets should only be readable by the owner.
- The sockets should get automatically removed when the agent exits.
- .El
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.Pp
-+.It Pa SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 14 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh SEE ALSO
- .Xr ssh 1 ,
- .Xr ssh-add 1 ,
-diff -up openssh-7.4p1/sshd.8.entropy openssh-7.4p1/sshd.8
---- openssh-7.4p1/sshd.8.entropy	2016-12-23 18:34:27.755753566 +0100
-+++ openssh-7.4p1/sshd.8	2016-12-23 18:34:27.770753571 +0100
-@@ -920,6 +920,24 @@ concurrently for different ports, this c
- started last).
- The content of this file is not sensitive; it can be world-readable.
- .El
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.Pp
-+.It Pa SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 14 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh IPV6
- IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell.
- .Sh SEE ALSO
-diff -up openssh-7.4p1/ssh-keygen.1.entropy openssh-7.4p1/ssh-keygen.1
---- openssh-7.4p1/ssh-keygen.1.entropy	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/ssh-keygen.1	2016-12-23 18:34:27.770753571 +0100
-@@ -848,6 +848,24 @@ Contains Diffie-Hellman groups used for
- The file format is described in
- .Xr moduli 5 .
- .El
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.Pp
-+.It Pa SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 14 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh SEE ALSO
- .Xr ssh 1 ,
- .Xr ssh-add 1 ,
-diff -up openssh-7.4p1/ssh-keysign.8.entropy openssh-7.4p1/ssh-keysign.8
---- openssh-7.4p1/ssh-keysign.8.entropy	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/ssh-keysign.8	2016-12-23 18:34:27.770753571 +0100
-@@ -80,6 +80,24 @@ must be set-uid root if host-based authe
- If these files exist they are assumed to contain public certificate
- information corresponding with the private keys above.
- .El
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.Pp
-+.It Pa SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the 
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value. 
-+Minimum is 14 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to 
-+be blocked until enough entropy is available.
-+.El
- .Sh SEE ALSO
- .Xr ssh 1 ,
- .Xr ssh-keygen 1 ,
diff --git a/openssh-6.6p1-force_krb.patch b/openssh-6.6p1-force_krb.patch
index ae948f7..288963e 100644
--- a/openssh-6.6p1-force_krb.patch
+++ b/openssh-6.6p1-force_krb.patch
@@ -11,9 +11,9 @@ index 413b845..54dd383 100644
 +#include <unistd.h>
  
  #include "xmalloc.h"
- #include "key.h"
+ #include "sshkey.h"
 @@ -45,6 +47,7 @@
- #include "buffer.h"
+ 
  #include "ssh-gss.h"
  
 +extern Authctxt *the_authctxt;
@@ -66,7 +66,7 @@ index 413b845..54dd383 100644
  	} else
  		retval = 0;
  
-@@ -110,6 +133,135 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+@@ -110,6 +133,137 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  	return retval;
  }
  
@@ -97,13 +97,14 @@ index 413b845..54dd383 100644
 +{
 +	FILE *fp;
 +	char file[MAXPATHLEN];
-+	char line[BUFSIZ] = "";
++	char *line = NULL;
 +	char kuser[65]; /* match krb5_kuserok() */
 +	struct stat st;
 +	struct passwd *pw = the_authctxt->pw;
 +	int found_principal = 0;
 +	int ncommands = 0, allcommands = 0;
 +	u_long linenum;
++	size_t linesize = 0;
 +
 +	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
 +	/* If both .k5login and .k5users DNE, self-login is ok. */
@@ -147,9 +148,9 @@ index 413b845..54dd383 100644
 +	k5users_allowed_cmds = xcalloc(++ncommands,
 +	    sizeof(*k5users_allowed_cmds));
 +
-+	/* Check each line.  ksu allows unlimited length lines.  We don't. */
-+	while (!allcommands && read_keyfile_line(fp, file, line, sizeof(line),
-+	    &linenum) != -1) {
++	/* Check each line.  ksu allows unlimited length lines. */
++	while (!allcommands && getline(&line, &linesize, fp) != -1) {
++		linenum++;
 +		char *token;
 +
 +		/* we parse just like ksu, even though we could do better */
@@ -182,6 +183,7 @@ index 413b845..54dd383 100644
 +			}
 +		}
 +       }
++	free(line);
 +	if (k5users_allowed_cmds) {
 +		/* terminate vector */
 +		k5users_allowed_cmds[ncommands-1] = NULL;
diff --git a/openssh-6.6p1-keycat.patch b/openssh-6.6p1-keycat.patch
index 108f461..e22a5f3 100644
--- a/openssh-6.6p1-keycat.patch
+++ b/openssh-6.6p1-keycat.patch
@@ -64,8 +64,8 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
  ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
  	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lfipscheck $(LIBS) $(LDAPLIBS)
  
-+ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o
-+	$(LD) -o $@ ssh-keycat.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(KEYCATLIBS) $(LIBS)
++ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
++	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(KEYCATLIBS) $(LIBS)
 +
  ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
  	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
diff --git a/openssh-6.6p1-kuserok.patch b/openssh-6.6p1-kuserok.patch
index 23f47ae..81ec2a4 100644
--- a/openssh-6.6p1-kuserok.patch
+++ b/openssh-6.6p1-kuserok.patch
@@ -224,9 +224,9 @@ diff -up openssh-7.4p1/servconf.c.kuserok openssh-7.4p1/servconf.c
 +		intptr = &options->use_kuserok;
 +		goto parse_flag;
 +
+ 	case sPermitListen:
  	case sPermitOpen:
- 		arg = strdelim(&cp);
- 		if (!arg || *arg == '\0')
+ 		if (opcode == sPermitListen) {
 @@ -2016,6 +2025,7 @@ copy_set_server_options(ServerOptions *d
  	M_CP_INTOPT(client_alive_interval);
  	M_CP_INTOPT(ip_qos_interactive);
diff --git a/openssh-6.6p1-privsep-selinux.patch b/openssh-6.6p1-privsep-selinux.patch
index bc2c15d..1365506 100644
--- a/openssh-6.6p1-privsep-selinux.patch
+++ b/openssh-6.6p1-privsep-selinux.patch
@@ -54,9 +54,9 @@ diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
  		if (setusercontext(lc, pw, pw->pw_uid,
  		    (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
 @@ -1361,6 +1361,9 @@ do_setusercontext(struct passwd *pw)
- 			    pw->pw_uid);
- 			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
- 			    "u", pw->pw_name, (char *)NULL);
+			    (unsigned long long)pw->pw_uid);
+			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
+			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
 +#ifdef WITH_SELINUX
 +			sshd_selinux_copy_context();
 +#endif
diff --git a/openssh-6.7p1-coverity.patch b/openssh-6.7p1-coverity.patch
index 253e0ee..0d238dd 100644
--- a/openssh-6.7p1-coverity.patch
+++ b/openssh-6.7p1-coverity.patch
@@ -120,7 +120,7 @@ diff -up openssh-7.4p1/serverloop.c.coverity openssh-7.4p1/serverloop.c
 -		while (read(notify_pipe[0], &c, 1) != -1)
 +	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset))
 +		while (read(notify_pipe[0], &c, 1) >= 0)
- 			debug2("notify_done: reading");
+ 			debug2("%s: reading", __func__);
  }
  
 @@ -518,7 +518,7 @@ server_request_tun(void)
diff --git a/openssh-6.7p1-kdf-cavs.patch b/openssh-6.7p1-kdf-cavs.patch
index 4e5c7a5..f92cb50 100644
--- a/openssh-6.7p1-kdf-cavs.patch
+++ b/openssh-6.7p1-kdf-cavs.patch
@@ -88,8 +88,8 @@ diff -up openssh-6.8p1/ssh-cavs.c.kdf-cavs openssh-6.8p1/ssh-cavs.c
 +#include <openssl/bn.h>
 +
 +#include "xmalloc.h"
-+#include "buffer.h"
-+#include "key.h"
++#include "sshbuf.h"
++#include "sshkey.h"
 +#include "cipher.h"
 +#include "kex.h"
 +#include "packet.h"
diff --git a/openssh-6.7p1-ldap.patch b/openssh-6.7p1-ldap.patch
index ddb3974..328b95e 100644
--- a/openssh-6.7p1-ldap.patch
+++ b/openssh-6.7p1-ldap.patch
@@ -157,7 +157,7 @@ diff -up openssh-6.8p1/Makefile.in.ldap openssh-6.8p1/Makefile.in
  	ssh-xmss.o \
 @@ -112,8 +115,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
  	sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
- 	sandbox-solaris.o
+ 	sandbox-solaris.o uidswap.o
  
 -MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
 -MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
@@ -356,7 +356,7 @@ diff -up openssh-6.8p1/configure.ac.ldap openssh-6.8p1/configure.ac
 diff -up openssh-6.8p1/ldap-helper.c.ldap openssh-6.8p1/ldap-helper.c
 --- openssh-6.8p1/ldap-helper.c.ldap	2015-03-18 11:11:29.030801464 +0100
 +++ openssh-6.8p1/ldap-helper.c	2015-03-18 11:11:29.030801464 +0100
-@@ -0,0 +1,155 @@
+@@ -0,0 +1,151 @@
 +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
 + * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
@@ -390,6 +390,7 @@ diff -up openssh-6.8p1/ldap-helper.c.ldap openssh-6.8p1/ldap-helper.c
 +#include "ldapbody.h"
 +#include <string.h>
 +#include <unistd.h>
++#include <stdlib.h>
 +
 +static int config_debug = 0;
 +int config_exclusive_config_file = 0;
@@ -507,11 +508,6 @@ diff -up openssh-6.8p1/ldap-helper.c.ldap openssh-6.8p1/ldap-helper.c
 +	ldap_do_close();
 +	return 0;
 +}
-+
-+/* Ugly hack */
-+void   *buffer_get_string(Buffer *b, u_int *l) { return NULL; }
-+void    buffer_put_string(Buffer *b, const void *f, u_int l) {}
-+
 diff -up openssh-6.8p1/ldap-helper.h.ldap openssh-6.8p1/ldap-helper.h
 --- openssh-6.8p1/ldap-helper.h.ldap	2015-03-18 11:11:29.031801462 +0100
 +++ openssh-6.8p1/ldap-helper.h	2015-03-18 11:11:29.031801462 +0100
@@ -684,6 +680,7 @@ diff -up openssh-6.8p1/ldapbody.c.ldap openssh-6.8p1/ldapbody.c
 +#include "ldapbody.h"
 +#include <stdio.h>
 +#include <unistd.h>
++#include <stdlib.h>
 +#include "misc.h"
 +
 +#define LDAPSEARCH_FORMAT "(&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)"
@@ -1188,7 +1185,7 @@ diff -up openssh-6.8p1/ldapbody.h.ldap openssh-6.8p1/ldapbody.h
 diff -up openssh-6.8p1/ldapconf.c.ldap openssh-6.8p1/ldapconf.c
 --- openssh-6.8p1/ldapconf.c.ldap	2015-03-18 11:11:29.032801460 +0100
 +++ openssh-6.8p1/ldapconf.c	2015-03-18 11:11:29.032801460 +0100
-@@ -0,0 +1,728 @@
+@@ -0,0 +1,729 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
 + * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
@@ -1222,6 +1219,7 @@ diff -up openssh-6.8p1/ldapconf.c.ldap openssh-6.8p1/ldapconf.c
 +#include "ldapconf.h"
 +#include <unistd.h>
 +#include <string.h>
++#include <stdlib.h>
 +
 +/* Keyword tokens. */
 +
diff --git a/openssh-7.0p1-gssKexAlgorithms.patch b/openssh-7.0p1-gssKexAlgorithms.patch
index d2453d5..2ba360e 100644
--- a/openssh-7.0p1-gssKexAlgorithms.patch
+++ b/openssh-7.0p1-gssKexAlgorithms.patch
@@ -23,9 +23,9 @@ diff -up openssh-7.0p1/gss-genr.c.gsskexalg openssh-7.0p1/gss-genr.c
  ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
 -    const char *host, const char *client) {
 +    const char *host, const char *client, const char *kex) {
- 	Buffer buf;
+ 	struct sshbuf *buf;
  	size_t i;
- 	int oidpos, enclen;
+ 	int oidpos, enclen, r;
 @@ -100,6 +101,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
  	char deroid[2];
  	const EVP_MD *evp_md = EVP_md5();
@@ -35,39 +35,44 @@ diff -up openssh-7.0p1/gss-genr.c.gsskexalg openssh-7.0p1/gss-genr.c
  	if (gss_enc2oid != NULL) {
  		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)
 @@ -113,6 +115,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
- 	buffer_init(&buf);
+ 		fatal("%s: sshbuf_new failed", __func__);
  
  	oidpos = 0;
 +	s = cp = xstrdup(kex);
  	for (i = 0; i < gss_supported->count; i++) {
  		if (gss_supported->elements[i].length < 128 &&
  		    (*check)(NULL, &(gss_supported->elements[i]), host, client)) {
-@@ -131,26 +134,22 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
+@@ -131,28 +134,25 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
  			enclen = __b64_ntop(digest, EVP_MD_size(evp_md),
  			    encoded, EVP_MD_size(evp_md) * 2);
  
 -			if (oidpos != 0)
--				buffer_put_char(&buf, ',');
+-				if ((r = sshbuf_put_u8(buf, ',')) != 0)
+-					fatal("%s: buffer error: %s", __func__, ssh_err(r));
 -
--			buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,
--			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1);
--			buffer_append(&buf, encoded, enclen);
--			buffer_put_char(&buf, ',');
--			buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 
--			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1);
--			buffer_append(&buf, encoded, enclen);
--			buffer_put_char(&buf, ',');
--			buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID,
--			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1);
--			buffer_append(&buf, encoded, enclen);
+-			if ((r = sshbuf_put(buf, KEX_GSS_GEX_SHA1_ID,
+-			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1)) != 0 ||
+-			    (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
+-			    (r = sshbuf_put_u8(buf, ',')) != 0 ||
+-			    (r = sshbuf_put(buf, KEX_GSS_GRP1_SHA1_ID, 
+-			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1)) != 0 ||
+-			    (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
+-			    (r = sshbuf_put_u8(buf, ',')) != 0 ||
+-			    (r = sshbuf_put(buf, KEX_GSS_GRP14_SHA1_ID,
+-			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1)) != 0 ||
+-			    (r = sshbuf_put(buf, encoded, enclen)) != 0)
+-		 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +			cp = strncpy(s, kex, strlen(kex));
 +			for ((p = strsep(&cp, ",")); p && *p != '\0';
 +				(p = strsep(&cp, ","))) {
-+				if (buffer_len(&buf) != 0)
-+					buffer_put_char(&buf, ',');
-+				buffer_append(&buf, p,
-+				    strlen(p));
-+				buffer_append(&buf, encoded, enclen);
++				if (sshbuf_len(buf) != 0)
++					if ((r = sshbuf_put_u8(buf, ',')) != 0)
++			 			fatal("%s: buffer error: %s",
++						    __func__, ssh_err(r));
++				if ((r = sshbuf_put(buf, p, strlen(p))) != 0 ||
++				    (r = sshbuf_put(buf, encoded, enclen)) != 0)
++			 		fatal("%s: buffer error: %s",
++					    __func__, ssh_err(r));
 +			}
  
  			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
@@ -104,7 +109,7 @@ diff -up openssh-7.0p1/kex.c.gsskexalg openssh-7.0p1/kex.c
  #include "ssherr.h"
  #include "sshbuf.h"
 @@ -232,6 +232,29 @@ kex_assemble_names(const char *def, char
- 	return 0;
+ 	return r;
  }
  
 +/* Validate GSS KEX method name list */
@@ -139,7 +144,7 @@ diff -up openssh-7.0p1/kex.h.gsskexalg openssh-7.0p1/kex.h
 @@ -173,6 +173,7 @@ int	 kex_names_valid(const char *);
  char	*kex_alg_list(char);
  char	*kex_names_cat(const char *, const char *);
- int	 kex_assemble_names(const char *, char **);
+ int	 kex_assemble_names(char **, const char *, const char *);
 +int	 gss_kex_names_valid(const char *);
  
  int	 kex_new(struct ssh *, char *[PROPOSAL_MAX], struct kex **);
@@ -162,7 +167,7 @@ diff -up openssh-7.0p1/readconf.c.gsskexalg openssh-7.0p1/readconf.c
 -	oGssServerIdentity, 
 +	oGssServerIdentity, oGssKexAlgorithms,
  	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- 	oSendEnv, oControlPath, oControlMaster, oControlPersist,
+ 	oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
  	oHashKnownHosts,
 @@ -200,6 +201,7 @@ static struct {
  	{ "gssapiclientidentity", oGssClientIdentity },
@@ -263,9 +268,9 @@ diff -up openssh-7.0p1/servconf.c.gsskexalg openssh-7.0p1/servconf.c
  	sHostKeyAlgorithms,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
--	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
-+	sGssKeyEx, sGssStoreRekey, sGssKexAlgorithms, sAcceptEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+-	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sSetEnv, sPermitTunnel,
++	sGssKeyEx, sGssStoreRekey, sGssKexAlgorithms, sAcceptEnv, sSetEnv, sPermitTunnel,
+ 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
  	sHostCertificate,
 @@ -506,6 +510,7 @@ static struct {
@@ -388,7 +393,7 @@ diff -up openssh-7.0p1/sshconnect2.c.gsskexalg openssh-7.0p1/sshconnect2.c
 +This option only applies to protocol version 2 connections using GSSAPI.
  .It Cm HostbasedAcceptedKeyTypes
  Specifies the key types that will be accepted for hostbased authentication
- as a comma-separated pattern list.
+ as a list of comma-separated patterns.
 diff -up openssh-7.0p1/ssh-gss.h.gsskexalg openssh-7.0p1/ssh-gss.h
 --- openssh-7.0p1/ssh-gss.h.gsskexalg	2015-08-19 12:28:38.031518944 +0200
 +++ openssh-7.0p1/ssh-gss.h	2015-08-19 12:28:38.081518832 +0200
diff --git a/openssh-7.0p1-show-more-fingerprints.patch b/openssh-7.0p1-show-more-fingerprints.patch
deleted file mode 100644
index aeb3daa..0000000
--- a/openssh-7.0p1-show-more-fingerprints.patch
+++ /dev/null
@@ -1,324 +0,0 @@
-diff -up openssh/clientloop.c.fingerprint openssh/clientloop.c
---- openssh/clientloop.c.fingerprint	2017-09-26 15:21:22.582477729 +0200
-+++ openssh/clientloop.c	2017-09-26 15:21:22.620477932 +0200
-@@ -1854,7 +1854,7 @@ update_known_hosts(struct hostkeys_updat
- 		if (ctx->keys_seen[i] != 2)
- 			continue;
- 		if ((fp = sshkey_fingerprint(ctx->keys[i],
--		    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
-+		    options.fingerprint_hash[0], SSH_FP_DEFAULT)) == NULL)
- 			fatal("%s: sshkey_fingerprint failed", __func__);
- 		do_log2(loglevel, "Learned new hostkey: %s %s",
- 		    sshkey_type(ctx->keys[i]), fp);
-@@ -1862,7 +1862,7 @@ update_known_hosts(struct hostkeys_updat
- 	}
- 	for (i = 0; i < ctx->nold; i++) {
- 		if ((fp = sshkey_fingerprint(ctx->old_keys[i],
--		    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
-+		    options.fingerprint_hash[0], SSH_FP_DEFAULT)) == NULL)
- 			fatal("%s: sshkey_fingerprint failed", __func__);
- 		do_log2(loglevel, "Deprecating obsolete hostkey: %s %s",
- 		    sshkey_type(ctx->old_keys[i]), fp);
-@@ -1905,7 +1905,7 @@ update_known_hosts(struct hostkeys_updat
- 	    (r = hostfile_replace_entries(options.user_hostfiles[0],
- 	    ctx->host_str, ctx->ip_str, ctx->keys, ctx->nkeys,
- 	    options.hash_known_hosts, 0,
--	    options.fingerprint_hash)) != 0)
-+	    options.fingerprint_hash[0])) != 0)
- 		error("%s: hostfile_replace_entries failed: %s",
- 		    __func__, ssh_err(r));
- }
-@@ -2038,7 +2038,7 @@ client_input_hostkeys(void)
- 			error("%s: parse key: %s", __func__, ssh_err(r));
- 			goto out;
- 		}
--		fp = sshkey_fingerprint(key, options.fingerprint_hash,
-+		fp = sshkey_fingerprint(key, options.fingerprint_hash[0],
- 		    SSH_FP_DEFAULT);
- 		debug3("%s: received %s key %s", __func__,
- 		    sshkey_type(key), fp);
-diff -up openssh/readconf.c.fingerprint openssh/readconf.c
---- openssh/readconf.c.fingerprint	2017-09-26 15:21:22.618477921 +0200
-+++ openssh/readconf.c	2017-09-26 15:21:22.621477937 +0200
-@@ -1681,16 +1681,18 @@ parse_keytypes:
- 		goto parse_string;
- 
- 	case oFingerprintHash:
--		intptr = &options->fingerprint_hash;
--		arg = strdelim(&s);
--		if (!arg || *arg == '\0')
--			fatal("%.200s line %d: Missing argument.",
--			    filename, linenum);
--		if ((value = ssh_digest_alg_by_name(arg)) == -1)
--			fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
--			    filename, linenum, arg);
--		if (*activep && *intptr == -1)
--			*intptr = value;
-+		if (*activep && options->num_fingerprint_hash == 0)
-+			while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
-+				value = ssh_digest_alg_by_name(arg);
-+				if (value == -1)
-+					fatal("%s line %d: unknown fingerprints algorithm specs: %s.",
-+						filename, linenum, arg);
-+				if (options->num_fingerprint_hash >= SSH_DIGEST_MAX)
-+					fatal("%s line %d: too many fingerprints algorithm specs.",
-+						filename, linenum);
-+				options->fingerprint_hash[
-+					options->num_fingerprint_hash++] = value;
-+			}
- 		break;
- 
- 	case oUpdateHostkeys:
-@@ -1917,7 +1919,7 @@ initialize_options(Options * options)
- 	options->canonicalize_fallback_local = -1;
- 	options->canonicalize_hostname = -1;
- 	options->revoked_host_keys = NULL;
--	options->fingerprint_hash = -1;
-+	options->num_fingerprint_hash = 0;
- 	options->update_hostkeys = -1;
- 	options->hostbased_key_types = NULL;
- 	options->pubkey_key_types = NULL;
-@@ -2096,8 +2098,10 @@ fill_default_options(Options * options)
- 		options->canonicalize_fallback_local = 1;
- 	if (options->canonicalize_hostname == -1)
- 		options->canonicalize_hostname = SSH_CANONICALISE_NO;
--	if (options->fingerprint_hash == -1)
--		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
-+	if (options->num_fingerprint_hash == 0) {
-+		options->fingerprint_hash[options->num_fingerprint_hash++] = SSH_DIGEST_SHA256;
-+		options->fingerprint_hash[options->num_fingerprint_hash++] = SSH_DIGEST_MD5;
-+	}
- 	if (options->update_hostkeys == -1)
- 		options->update_hostkeys = 0;
- 	if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
-@@ -2474,6 +2478,17 @@ dump_cfg_strarray(OpCodes code, u_int co
- }
- 
- static void
-+dump_cfg_fmtarray(OpCodes code, u_int count, int *vals)
-+{
-+	u_int i;
-+
-+	printf("%s", lookup_opcode_name(code));
-+	for (i = 0; i < count; i++)
-+		printf(" %s", fmt_intarg(code, vals[i]));
-+	printf("\n");
-+}
-+
-+static void
- dump_cfg_strarray_oneline(OpCodes code, u_int count, char **vals)
- {
- 	u_int i;
-@@ -2549,7 +2564,6 @@ dump_client_config(Options *o, const cha
- 	dump_cfg_fmtint(oEnableSSHKeysign, o->enable_ssh_keysign);
- 	dump_cfg_fmtint(oClearAllForwardings, o->clear_forwardings);
- 	dump_cfg_fmtint(oExitOnForwardFailure, o->exit_on_forward_failure);
--	dump_cfg_fmtint(oFingerprintHash, o->fingerprint_hash);
- 	dump_cfg_fmtint(oForwardAgent, o->forward_agent);
- 	dump_cfg_fmtint(oForwardX11, o->forward_x11);
- 	dump_cfg_fmtint(oForwardX11Trusted, o->forward_x11_trusted);
-@@ -2618,6 +2632,7 @@ dump_client_config(Options *o, const cha
- 	dump_cfg_strarray_oneline(oGlobalKnownHostsFile, o->num_system_hostfiles, o->system_hostfiles);
- 	dump_cfg_strarray_oneline(oUserKnownHostsFile, o->num_user_hostfiles, o->user_hostfiles);
- 	dump_cfg_strarray(oSendEnv, o->num_send_env, o->send_env);
-+	dump_cfg_fmtarray(oFingerprintHash, o->num_fingerprint_hash, o->fingerprint_hash);
- 
- 	/* Special cases */
- 
-diff -up openssh/readconf.h.fingerprint openssh/readconf.h
---- openssh/readconf.h.fingerprint	2017-09-26 15:21:22.618477921 +0200
-+++ openssh/readconf.h	2017-09-26 15:21:22.621477937 +0200
-@@ -21,6 +21,7 @@
- #define MAX_SEND_ENV		256
- #define SSH_MAX_HOSTS_FILES	32
- #define MAX_CANON_DOMAINS	32
-+#define MAX_SSH_DIGESTS	32
- #define PATH_MAX_SUN		(sizeof((struct sockaddr_un *)0)->sun_path)
- 
- struct allowed_cname {
-@@ -157,7 +158,8 @@ typedef struct {
- 
- 	char	*revoked_host_keys;
- 
--	int	 fingerprint_hash;
-+	int num_fingerprint_hash;
-+	int 	fingerprint_hash[MAX_SSH_DIGESTS];
- 
- 	int	 update_hostkeys; /* one of SSH_UPDATE_HOSTKEYS_* */
- 
-diff -up openssh/ssh_config.5.fingerprint openssh/ssh_config.5
---- openssh/ssh_config.5.fingerprint	2017-09-26 15:21:22.618477921 +0200
-+++ openssh/ssh_config.5	2017-09-26 15:21:22.621477937 +0200
-@@ -624,12 +624,13 @@ or
- .Cm no
- (the default).
- .It Cm FingerprintHash
--Specifies the hash algorithm used when displaying key fingerprints.
-+Specifies the hash algorithms used when displaying key fingerprints.
- Valid options are:
- .Cm md5
- and
--.Cm sha256
--(the default).
-+.Cm sha256 .
-+The default is
-+.Cm "sha256 md5".
- .It Cm ForwardAgent
- Specifies whether the connection to the authentication agent (if any)
- will be forwarded to the remote machine.
-diff -up openssh/sshconnect2.c.fingerprint openssh/sshconnect2.c
---- openssh/sshconnect2.c.fingerprint	2017-09-26 15:21:22.619477926 +0200
-+++ openssh/sshconnect2.c	2017-09-26 15:21:50.677628003 +0200
-@@ -679,7 +679,7 @@ input_userauth_pk_ok(int type, u_int32_t
- 		    key->type, pktype);
- 		goto done;
- 	}
--	if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
-+	if ((fp = sshkey_fingerprint(key, options.fingerprint_hash[0],
- 	    SSH_FP_DEFAULT)) == NULL)
- 		goto done;
- 	debug2("input_userauth_pk_ok: fp %s", fp);
-@@ -1198,7 +1198,7 @@ sign_and_send_pubkey(Authctxt *authctxt,
- 	int matched, ret = -1, have_sig = 1;
- 	char *fp;
- 
--	if ((fp = sshkey_fingerprint(id->key, options.fingerprint_hash,
-+	if ((fp = sshkey_fingerprint(id->key, options.fingerprint_hash[0],
- 	    SSH_FP_DEFAULT)) == NULL)
- 		return 0;
- 	debug3("%s: %s %s", __func__, key_type(id->key), fp);
-@@ -1620,7 +1620,7 @@ userauth_pubkey(Authctxt *authctxt)
- 		if (id->key != NULL) {
- 			if (try_identity(id)) {
- 				if ((fp = sshkey_fingerprint(id->key,
--				    options.fingerprint_hash,
-+				    options.fingerprint_hash[0],
- 				    SSH_FP_DEFAULT)) == NULL) {
- 					error("%s: sshkey_fingerprint failed",
- 					    __func__);
-@@ -1914,7 +1914,7 @@ userauth_hostbased(Authctxt *authctxt)
- 		goto out;
- 	}
- 
--	if ((fp = sshkey_fingerprint(private, options.fingerprint_hash,
-+	if ((fp = sshkey_fingerprint(private, options.fingerprint_hash[0],
- 	    SSH_FP_DEFAULT)) == NULL) {
- 		error("%s: sshkey_fingerprint failed", __func__);
- 		goto out;
-diff -up openssh/sshconnect.c.fingerprint openssh/sshconnect.c
---- openssh/sshconnect.c.fingerprint	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/sshconnect.c	2017-09-26 15:21:22.622477943 +0200
-@@ -861,9 +861,9 @@ check_host_key(char *hostname, struct so
- 				    "of known hosts.", type, ip);
- 		} else if (options.visual_host_key) {
- 			fp = sshkey_fingerprint(host_key,
--			    options.fingerprint_hash, SSH_FP_DEFAULT);
-+			    options.fingerprint_hash[0], SSH_FP_DEFAULT);
- 			ra = sshkey_fingerprint(host_key,
--			    options.fingerprint_hash, SSH_FP_RANDOMART);
-+			    options.fingerprint_hash[0], SSH_FP_RANDOMART);
- 			if (fp == NULL || ra == NULL)
- 				fatal("%s: sshkey_fingerprint fail", __func__);
- 			logit("Host key fingerprint is %s\n%s", fp, ra);
-@@ -907,12 +907,6 @@ check_host_key(char *hostname, struct so
- 			else
- 				snprintf(msg1, sizeof(msg1), ".");
- 			/* The default */
--			fp = sshkey_fingerprint(host_key,
--			    options.fingerprint_hash, SSH_FP_DEFAULT);
--			ra = sshkey_fingerprint(host_key,
--			    options.fingerprint_hash, SSH_FP_RANDOMART);
--			if (fp == NULL || ra == NULL)
--				fatal("%s: sshkey_fingerprint fail", __func__);
- 			msg2[0] = '\0';
- 			if (options.verify_host_key_dns) {
- 				if (matching_host_key_dns)
-@@ -926,16 +920,28 @@ check_host_key(char *hostname, struct so
- 			}
- 			snprintf(msg, sizeof(msg),
- 			    "The authenticity of host '%.200s (%s)' can't be "
--			    "established%s\n"
--			    "%s key fingerprint is %s.%s%s\n%s"
-+			    "established%s\n", host, ip, msg1);
-+			for (i = 0; i < (u_int) options.num_fingerprint_hash; i++) {
-+				fp = sshkey_fingerprint(host_key,
-+				    options.fingerprint_hash[i], SSH_FP_DEFAULT);
-+				ra = sshkey_fingerprint(host_key,
-+				    options.fingerprint_hash[i], SSH_FP_RANDOMART);
-+				if (fp == NULL || ra == NULL)
-+					fatal("%s: sshkey_fingerprint fail", __func__);
-+				len = strlen(msg);
-+				snprintf(msg+len, sizeof(msg)-len,
-+				    "%s key fingerprint is %s.%s%s\n%s",
-+				    type, fp,
-+				    options.visual_host_key ? "\n" : "",
-+				    options.visual_host_key ? ra : "",
-+				    msg2);
-+				free(ra);
-+				free(fp);
-+			}
-+			len = strlen(msg);
-+			snprintf(msg+len, sizeof(msg)-len,
- 			    "Are you sure you want to continue connecting "
--			    "(yes/no)? ",
--			    host, ip, msg1, type, fp,
--			    options.visual_host_key ? "\n" : "",
--			    options.visual_host_key ? ra : "",
--			    msg2);
--			free(ra);
--			free(fp);
-+			    "(yes/no)? ");
- 			if (!confirm(msg))
- 				goto fail;
- 			hostkey_trusted = 1; /* user explicitly confirmed */
-@@ -1192,7 +1198,7 @@ verify_host_key(char *host, struct socka
- 	struct sshkey *plain = NULL;
- 
- 	if ((fp = sshkey_fingerprint(host_key,
--	    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
-+	    options.fingerprint_hash[0], SSH_FP_DEFAULT)) == NULL) {
- 		error("%s: fingerprint host key: %s", __func__, ssh_err(r));
- 		r = -1;
- 		goto out;
-@@ -1200,7 +1206,7 @@ verify_host_key(char *host, struct socka
- 
- 	if (sshkey_is_cert(host_key)) {
- 		if ((cafp = sshkey_fingerprint(host_key->cert->signature_key,
--		    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL) {
-+		    options.fingerprint_hash[0], SSH_FP_DEFAULT)) == NULL) {
- 			error("%s: fingerprint CA key: %s",
- 			    __func__, ssh_err(r));
- 			r = -1;
-@@ -1369,9 +1375,9 @@ show_other_keys(struct hostkeys *hostkey
- 		if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
- 			continue;
- 		fp = sshkey_fingerprint(found->key,
--		    options.fingerprint_hash, SSH_FP_DEFAULT);
-+		    options.fingerprint_hash[0], SSH_FP_DEFAULT);
- 		ra = sshkey_fingerprint(found->key,
--		    options.fingerprint_hash, SSH_FP_RANDOMART);
-+		    options.fingerprint_hash[0], SSH_FP_RANDOMART);
- 		if (fp == NULL || ra == NULL)
- 			fatal("%s: sshkey_fingerprint fail", __func__);
- 		logit("WARNING: %s key found for host %s\n"
-@@ -1394,7 +1400,7 @@ warn_changed_key(struct sshkey *host_key
- {
- 	char *fp;
- 
--	fp = sshkey_fingerprint(host_key, options.fingerprint_hash,
-+	fp = sshkey_fingerprint(host_key, options.fingerprint_hash[0],
- 	    SSH_FP_DEFAULT);
- 	if (fp == NULL)
- 		fatal("%s: sshkey_fingerprint fail", __func__);
-diff -up openssh/ssh-keysign.c.fingerprint openssh/ssh-keysign.c
---- openssh/ssh-keysign.c.fingerprint	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/ssh-keysign.c	2017-09-26 15:21:22.622477943 +0200
-@@ -285,7 +285,7 @@ main(int argc, char **argv)
- 		}
- 	}
- 	if (!found) {
--		if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
-+		if ((fp = sshkey_fingerprint(key, options.fingerprint_hash[0],
- 		    SSH_FP_DEFAULT)) == NULL)
- 			fatal("%s: sshkey_fingerprint failed", __progname);
- 		fatal("no matching hostkey found for key %s %s",
diff --git a/openssh-7.1p1-gssapi-documentation.patch b/openssh-7.1p1-gssapi-documentation.patch
index a97cbc4..db689d4 100644
--- a/openssh-7.1p1-gssapi-documentation.patch
+++ b/openssh-7.1p1-gssapi-documentation.patch
@@ -49,4 +49,4 @@ diff -up openssh-7.4p1/sshd_config.5.gss-docs openssh-7.4p1/sshd_config.5
 +needs to be enabled in the server and also used by the client.
  .It Cm HostbasedAcceptedKeyTypes
  Specifies the key types that will be accepted for hostbased authentication
- as a comma-separated pattern list.
+ as a list of comma-separated patterns.
diff --git a/openssh-7.1p2-audit-race-condition.patch b/openssh-7.1p2-audit-race-condition.patch
index d390f63..9a0d917 100644
--- a/openssh-7.1p2-audit-race-condition.patch
+++ b/openssh-7.1p2-audit-race-condition.patch
@@ -1,20 +1,21 @@
 diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
 --- openssh-7.4p1/monitor_wrap.c.audit-race	2016-12-23 16:35:52.694685771 +0100
 +++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:35:52.697685772 +0100
-@@ -1107,4 +1107,48 @@ mm_audit_destroy_sensitive_data(const ch
- 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m);
- 	buffer_free(&m);
+@@ -1107,4 +1107,50 @@ mm_audit_destroy_sensitive_data(const ch
+ 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
+ 	sshbuf_free(m);
  }
 +
 +int mm_forward_audit_messages(int fdin)
 +{
 +	u_char buf[4];
 +	u_int blen, msg_len;
-+	Buffer m;
-+	int ret = 0;
++	struct sshbuf *m;
++	int r, ret = 0;
 +
 +	debug3("%s: entering", __func__);
-+	buffer_init(&m);
++	if ((m = sshbuf_new()) == NULL)
++ 		fatal("%s: sshbuf_new failed", __func__);
 +	do {
 +		blen = atomicio(read, fdin, buf, sizeof(buf));
 +		if (blen == 0) /* closed pipe */
@@ -28,21 +29,22 @@ diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
 +		msg_len = get_u32(buf);
 +		if (msg_len > 256 * 1024)
 +			fatal("%s: read: bad msg_len %d", __func__, msg_len);
-+		buffer_clear(&m);
-+		buffer_append_space(&m, msg_len);
-+		if (atomicio(read, fdin, buffer_ptr(&m), msg_len) != msg_len) {
++		sshbuf_reset(m);
++		if ((r = sshbuf_reserve(m, msg_len, NULL)) != 0)
++			fatal("%s: buffer error: %s", __func__, ssh_err(r));
++		if (atomicio(read, fdin, sshbuf_mutable_ptr(m), msg_len) != msg_len) {
 +			error("%s: Failed to read the the buffer content from the child", __func__);
 +			ret = -1;
 +			break;
 +		}
 +		if (atomicio(vwrite, pmonitor->m_recvfd, buf, blen) != blen || 
-+		    atomicio(vwrite, pmonitor->m_recvfd, buffer_ptr(&m), msg_len) != msg_len) {
++		    atomicio(vwrite, pmonitor->m_recvfd, sshbuf_mutable_ptr(m), msg_len) != msg_len) {
 +			error("%s: Failed to write the message to the monitor", __func__);
 +			ret = -1;
 +			break;
 +		}
 +	} while (1);
-+	buffer_free(&m);
++	sshbuf_free(m);
 +	return ret;
 +}
 +void mm_set_monitor_pipe(int fd)
@@ -115,7 +117,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
  		ret = do_exec_pty(ssh, s, command);
 @@ -732,6 +745,20 @@ do_exec(Session *s, const char *command)
  	 */
- 	buffer_clear(&loginmsg);
+ 	sshbuf_reset(loginmsg);
  
 +#ifdef SSH_AUDIT_EVENTS
 +	close(paudit[1]);
diff --git a/openssh-7.3p1-openssl-1.1.0.patch b/openssh-7.3p1-openssl-1.1.0.patch
index dadde28..42ede48 100644
--- a/openssh-7.3p1-openssl-1.1.0.patch
+++ b/openssh-7.3p1-openssl-1.1.0.patch
@@ -136,7 +136,7 @@ diff -up openssh/dh.c.openssl openssh/dh.c
  	    need > INT_MAX / 2 || 2 * need > pbits)
  		return SSH_ERR_INVALID_ARGUMENT;
  	if (need < 256)
-@@ -271,10 +275,11 @@ dh_gen_key(DH *dh, int need)
+@@ -271,11 +275,11 @@ dh_gen_key(DH *dh, int need)
  	 * Pollard Rho, Big step/Little Step attacks are O(sqrt(n)),
  	 * so double requested need here.
  	 */
@@ -144,6 +144,7 @@ diff -up openssh/dh.c.openssl openssh/dh.c
 -	if (DH_generate_key(dh) == 0 ||
 -	    !dh_pub_is_valid(dh, dh->pub_key)) {
 -		BN_clear_free(dh->priv_key);
+-		dh->priv_key = NULL;
 +	DH_set_length(dh, MINIMUM(need * 2, pbits - 1));
 +	if (DH_generate_key(dh) == 0)
 +		return SSH_ERR_LIBCRYPTO_ERROR;
@@ -300,8 +301,8 @@ diff -up openssh/gss-genr.c.openssl openssh/gss-genr.c
  
  	if (gss_enc2oid != NULL) {
 @@ -113,6 +113,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
- 
- 	buffer_init(&buf);
+ 	if ((buf = sshbuf_new()) == NULL)
+ 		fatal("%s: sshbuf_new failed", __func__);
  
 +	md = EVP_MD_CTX_new();
  	oidpos = 0;
@@ -452,7 +453,7 @@ diff -up openssh/kexdhs.c.openssl openssh/kexdhs.c
  	    hash, &hashlen)) != 0)
  		goto out;
 @@ -197,7 +203,7 @@ input_kex_dh_init(int type, u_int32_t se
- 	/* send server hostkey, DH pubkey 'f' and singed H */
+ 	/* send server hostkey, DH pubkey 'f' and signed H */
  	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_REPLY)) != 0 ||
  	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
 -	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||	/* f */
@@ -599,7 +600,7 @@ diff -up openssh/kexgexs.c.openssl openssh/kexgexs.c
  	    hash, &hashlen)) != 0)
  		goto out;
 @@ -227,7 +236,7 @@ input_kex_dh_gex_init(int type, u_int32_
- 	/* send server hostkey, DH pubkey 'f' and singed H */
+ 	/* send server hostkey, DH pubkey 'f' and signed H */
  	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||
  	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
 -	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||     /* f */
@@ -636,8 +637,8 @@ diff -up openssh/kexgssc.c.openssl openssh/kexgssc.c
  			} else {
  				packet_start(SSH2_MSG_KEXGSS_CONTINUE);
 @@ -282,13 +284,14 @@ kexgss_client(struct ssh *ssh) {
- 		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
- 		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
+ 		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
+ 		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
  		    (serverhostkey ? serverhostkey : empty), slen,
 -		    dh->pub_key,	/* e */
 +		    pub_key,		/* e */
@@ -652,7 +653,7 @@ diff -up openssh/kexgssc.c.openssl openssh/kexgssc.c
  		    ssh->kex->hash_alg,
  		    ssh->kex->client_version_string,
 @@ -297,8 +300,8 @@ kexgss_client(struct ssh *ssh) {
- 		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
+ 		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
  		    (serverhostkey ? serverhostkey : empty), slen,
   		    min, nbits, max,
 -		    dh->p, dh->g,
@@ -695,8 +696,8 @@ diff -up openssh/kexgsss.c.openssl openssh/kexgsss.c
  	switch (ssh->kex->kex_type) {
  	case KEX_GSS_GRP1_SHA1:
 @@ -232,7 +235,7 @@ kexgss_server(struct ssh *ssh)
- 		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
- 		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
+ 		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
+ 		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
  		    NULL, 0, /* Change this if we start sending host keys */
 -		    dh_client_pub, dh->pub_key, shared_secret,
 +		    dh_client_pub, pub_key, shared_secret,
@@ -704,7 +705,7 @@ diff -up openssh/kexgsss.c.openssl openssh/kexgsss.c
  		);
  		break;
 @@ -244,9 +247,9 @@ kexgss_server(struct ssh *ssh)
- 		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
+ 		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
  		    NULL, 0,
  		    cmin, nbits, cmax,
 -		    dh->p, dh->g,
@@ -1241,14 +1242,14 @@ diff -up openssh/monitor.c.openssl openssh/monitor.c
 +		const BIGNUM *p, *g;
 +
 +		DH_get0_pqg(dh, &p, NULL, &g);
- 		buffer_put_char(m, 1);
--		buffer_put_bignum2(m, dh->p);
--		buffer_put_bignum2(m, dh->g);
-+		buffer_put_bignum2(m, p);
-+		buffer_put_bignum2(m, g);
+ 		if ((r = sshbuf_put_u8(m, 1)) != 0 ||
+-		    (r = sshbuf_put_bignum2(m, dh->p)) != 0 ||
+-		    (r = sshbuf_put_bignum2(m, dh->g)) != 0)
++		    (r = sshbuf_put_bignum2(m, p)) != 0 ||
++		    (r = sshbuf_put_bignum2(m, g)) != 0)
+			fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
  		DH_free(dh);
- 	}
 diff -up openssh/openbsd-compat/openssl-compat.c.openssl openssh/openbsd-compat/openssl-compat.c
 --- openssh/openbsd-compat/openssl-compat.c.openssl	2017-09-19 06:26:43.000000000 +0200
 +++ openssh/openbsd-compat/openssl-compat.c	2017-09-26 13:19:31.799249709 +0200
@@ -1404,17 +1405,6 @@ diff -up openssh/regress/unittests/sshkey/test_sshkey.c.openssl openssh/regress/
  	TEST_DONE();
  
  	TEST_START("equal KEY_DSA/demoted KEY_DSA");
-diff -up openssh/sshconnect2.c.openssl openssh/sshconnect2.c
---- openssh/sshconnect2.c.openssl	2017-09-26 13:19:31.786249629 +0200
-+++ openssh/sshconnect2.c	2017-09-26 13:19:31.800249715 +0200
-@@ -306,6 +306,7 @@ ssh_kex2(char *host, struct sockaddr *ho
- 	packet_send();
- 	packet_write_wait();
- #endif
-+	/* XXX free myproposal ?? */
- }
- 
- /*
 diff -up openssh/ssh.c.openssl openssh/ssh.c
 --- openssh/ssh.c.openssl	2017-09-26 13:19:31.786249629 +0200
 +++ openssh/ssh.c	2017-09-26 13:19:31.800249715 +0200
diff --git a/openssh-7.3p1-x11-max-displays.patch b/openssh-7.3p1-x11-max-displays.patch
index b36671d..94dac8f 100644
--- a/openssh-7.3p1-x11-max-displays.patch
+++ b/openssh-7.3p1-x11-max-displays.patch
@@ -10,8 +10,8 @@ diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
 +/* Minimum port number for X11 forwarding */
 +#define X11_PORT_MIN 6000
  
- /*
-  * Data structure for storing which hosts are permitted for forward requests.
+ /* Per-channel callback for pre/post select() actions */
+ typedef void chan_fn(struct ssh *, Channel *c,
 @@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
   */
  int
diff --git a/openssh-7.5p1-gssapi-kex-with-ec.patch b/openssh-7.5p1-gssapi-kex-with-ec.patch
index 437cce6..1e2d650 100644
--- a/openssh-7.5p1-gssapi-kex-with-ec.patch
+++ b/openssh-7.5p1-gssapi-kex-with-ec.patch
@@ -91,7 +91,7 @@ index 132df8b5..ed23f06d 100644
 +	case KEX_GSS_GRP16_SHA512:
  		kex_dh_hash(ssh->kex->hash_alg, ssh->kex->client_version_string, 
  		    ssh->kex->server_version_string,
- 		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
+		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
 diff --git a/kexgsss.c b/kexgsss.c
 index 82a715cc..b7da8823 100644
 --- a/kexgsss.c
@@ -117,7 +117,7 @@ index 82a715cc..b7da8823 100644
 +	case KEX_GSS_GRP16_SHA512:
  		kex_dh_hash(ssh->kex->hash_alg,
  		    ssh->kex->client_version_string, ssh->kex->server_version_string,
- 		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
+		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
 diff --git a/monitor.c b/monitor.c
 index 17046936..d6bc7ac7 100644
 --- a/monitor.c
@@ -674,8 +674,8 @@ index ed23f06d..bdb3109a 100644
 +		kex_c25519_hash(
 +		    kex->hash_alg,
 +		    kex->client_version_string, kex->server_version_string,
-+		    buffer_ptr(kex->my), buffer_len(kex->my),
-+		    buffer_ptr(kex->peer), buffer_len(kex->peer),
++		    sshbuf_ptr(kex->my), sshbuf_len(kex->my),
++		    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
 +		    (serverhostkey ? serverhostkey : empty), slen,
 +		    kex->c25519_client_pubkey, server_pub,
 +		    sshbuf_ptr(c25519_shared_secret), sshbuf_len(c25519_shared_secret),
@@ -1008,8 +1008,8 @@ index b7da8823..a7c42803 100644
 +		kex_c25519_hash(
 +		    kex->hash_alg,
 +		    kex->client_version_string, kex->server_version_string,
-+		    buffer_ptr(kex->peer), buffer_len(kex->peer),
-+		    buffer_ptr(kex->my), buffer_len(kex->my),
++		    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
++		    sshbuf_ptr(kex->my), sshbuf_len(kex->my),
 +		    NULL, 0,
 +		    client_pub, c25519_server_pubkey,
 +		    sshbuf_ptr(c25519_shared_secret), sshbuf_len(c25519_shared_secret),
@@ -1117,8 +1117,8 @@ index d6bc7ac7..b11616c8 100644
  		kex->load_host_public_key=&get_hostkey_public_by_type;
 @@ -1867,7 +1869,8 @@ mm_answer_gss_sign(int socket, Buffer *m)
  
- 	data.value = buffer_get_string(m, &len);
- 	data.length = len;
+ 	if ((r = sshbuf_get_string(m, (u_char **)&data.value, &data.length)) != 0)
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 -	if (data.length != 20) 
 +	/* Lengths of SHA-1, SHA-256 and SHA-512 hashes that are used */
 +	if (data.length != 20 && data.length != 32 && data.length != 64)
diff --git a/openssh-7.5p1-sandbox.patch b/openssh-7.5p1-sandbox.patch
index 7cdb0aa..b761962 100644
--- a/openssh-7.5p1-sandbox.patch
+++ b/openssh-7.5p1-sandbox.patch
@@ -20,8 +20,8 @@ index ca75cc7..6e7de31 100644
 +#if defined(__NR_flock) && defined(__s390__)
 +	SC_ALLOW(__NR_flock),
 +#endif
- #ifdef __NR_getpgid
- 	SC_ALLOW(__NR_getpgid),
+ #ifdef __NR_geteuid
+ 	SC_ALLOW(__NR_geteuid),
  #endif
 @@ -178,6 +181,9 @@ static const struct sock_filter preauth_insns[] = {
  #ifdef __NR_gettimeofday
@@ -30,8 +30,8 @@ index ca75cc7..6e7de31 100644
 +#if defined(__NR_ipc) && defined(__s390__)
 +	SC_ALLOW(__NR_ipc),
 +#endif
- #ifdef __NR_madvise
- 	SC_ALLOW(__NR_madvise),
+ #ifdef __NR_getuid
+ 	SC_ALLOW(__NR_getuid),
  #endif
 -- 
 1.9.1
diff --git a/openssh-7.6p1-audit.patch b/openssh-7.6p1-audit.patch
index c6e30a4..e184894 100644
--- a/openssh-7.6p1-audit.patch
+++ b/openssh-7.6p1-audit.patch
@@ -77,16 +77,8 @@ diff -up openssh-7.6p1/audit-bsm.c.audit openssh-7.6p1/audit-bsm.c
 diff -up openssh-7.6p1/audit.c.audit openssh-7.6p1/audit.c
 --- openssh-7.6p1/audit.c.audit	2017-10-02 21:34:26.000000000 +0200
 +++ openssh-7.6p1/audit.c	2017-10-04 17:18:32.834505048 +0200
-@@ -26,6 +26,7 @@
- 
- #include <stdarg.h>
- #include <string.h>
-+#include <unistd.h>
- 
- #ifdef SSH_AUDIT_EVENTS
- 
 @@ -34,6 +35,12 @@
- #include "key.h"
+ #include "log.h"
  #include "hostfile.h"
  #include "auth.h"
 +#include "ssh-gss.h"
@@ -127,7 +119,7 @@ diff -up openssh-7.6p1/audit.c.audit openssh-7.6p1/audit.c
  }
  
 +void
-+audit_key(int host_user, int *rv, const Key *key)
++audit_key(int host_user, int *rv, const struct sshkey *key)
 +{
 +	char *fp;
 +
@@ -268,7 +260,7 @@ diff -up openssh-7.6p1/audit.h.audit openssh-7.6p1/audit.h
  # define _SSH_AUDIT_H
  
  #include "loginrec.h"
-+#include "key.h"
++#include "sshkey.h"
  
  enum ssh_audit_event_type {
  	SSH_LOGIN_EXCEED_MAXTRIES,
@@ -296,7 +288,7 @@ diff -up openssh-7.6p1/audit.h.audit openssh-7.6p1/audit.h
 +void 	audit_end_command(int, const char *);
  ssh_audit_event_t audit_classify_auth(const char *);
 +int	audit_keyusage(int, char *, int);
-+void	audit_key(int, int *, const Key *);
++void	audit_key(int, int *, const struct sshkey *);
 +void	audit_unsupported(int);
 +void	audit_kex(int, char *, char *, char *, char *);
 +void	audit_unsupported_body(int);
@@ -313,7 +305,7 @@ diff -up openssh-7.6p1/audit-linux.c.audit openssh-7.6p1/audit-linux.c
  
  #include "log.h"
  #include "audit.h"
-+#include "key.h"
++#include "sshkey.h"
 +#include "hostfile.h"
 +#include "auth.h"
 +#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
@@ -596,8 +588,8 @@ diff -up openssh-7.6p1/audit-linux.c.audit openssh-7.6p1/audit-linux.c
 +const static char *direction[] = { "from-server", "from-client", "both" };
 +
 +void
-+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid,
-+	       uid_t uid)
++audit_kex_body(int ctos, char *enc, char *mac, char *compress,
++    char *pfs, pid_t pid, uid_t uid)
 +{
 +#ifdef AUDIT_CRYPTO_SESSION
 +	char buf[AUDIT_LOG_SIZE];
@@ -786,11 +778,11 @@ diff -up openssh-7.6p1/auth2-pubkey.c.audit openssh-7.6p1/auth2-pubkey.c
  		/* test for correct signature */
  		authenticated = 0;
  		if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
--		    PRIVSEP(sshkey_verify(key, sig, slen, sshbuf_ptr(b),
-+		    PRIVSEP(user_key_verify(key, sig, slen, sshbuf_ptr(b),
- 		    sshbuf_len(b), NULL, ssh->compat)) == 0) {
- 			authenticated = 1;
- 		}
+-		    PRIVSEP(sshkey_verify(key, sig, slen,
++		    PRIVSEP(user_key_verify(key, sig, slen,
+ 		    sshbuf_ptr(b), sshbuf_len(b),
+ 		    (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
+ 		    ssh->compat)) == 0) {
 @@ -250,6 +250,19 @@ done:
  	return authenticated;
  }
@@ -882,7 +874,7 @@ diff -up openssh-7.6p1/cipher.c.audit openssh-7.6p1/cipher.c
 -
  static const struct sshcipher ciphers[] = {
  #ifdef WITH_OPENSSL
- 	{ "3des-cbc",		8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
+ #ifndef OPENSSL_NO_DES
 @@ -409,7 +409,7 @@ cipher_get_length(struct sshcipher_ctx *
  void
  cipher_free(struct sshcipher_ctx *cc)
@@ -1032,17 +1024,6 @@ diff -up openssh-7.6p1/kex.h.audit openssh-7.6p1/kex.h
  int	 kex_dh_hash(int, const char *, const char *,
      const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
      const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
-diff -up openssh-7.6p1/key.h.audit openssh-7.6p1/key.h
---- openssh-7.6p1/key.h.audit	2017-10-02 21:34:26.000000000 +0200
-+++ openssh-7.6p1/key.h	2017-10-04 17:18:32.836505059 +0200
-@@ -43,6 +43,7 @@ typedef struct sshkey Key;
- #define key_ssh_name_plain	sshkey_ssh_name_plain
- #define key_type_from_name	sshkey_type_from_name
- #define key_is_cert		sshkey_is_cert
-+#define key_is_private		sshkey_is_private
- #define key_type_plain		sshkey_type_plain
- #endif
- 
 diff -up openssh-7.6p1/mac.c.audit openssh-7.6p1/mac.c
 --- openssh-7.6p1/mac.c.audit	2017-10-02 21:34:26.000000000 +0200
 +++ openssh-7.6p1/mac.c	2017-10-04 17:18:32.836505059 +0200
@@ -1102,7 +1083,7 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  #include "ssherr.h"
  
 @@ -117,6 +118,8 @@ extern Buffer auth_debug;
- extern Buffer loginmsg;
+ extern struct sshbuf *loginmsg;
  extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */
  
 +extern void destroy_sensitive_data(int);
@@ -1112,13 +1093,13 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  
 @@ -167,6 +170,11 @@ int mm_answer_gss_updatecreds(int, Buffe
  #ifdef SSH_AUDIT_EVENTS
- int mm_answer_audit_event(int, Buffer *);
- int mm_answer_audit_command(int, Buffer *);
-+int mm_answer_audit_end_command(int, Buffer *);
-+int mm_answer_audit_unsupported_body(int, Buffer *);
-+int mm_answer_audit_kex_body(int, Buffer *);
-+int mm_answer_audit_session_key_free_body(int, Buffer *);
-+int mm_answer_audit_server_key_free(int, Buffer *);
+ int mm_answer_audit_event(int, struct sshbuf *);
+ int mm_answer_audit_command(int, struct sshbuf *);
++int mm_answer_audit_end_command(int, struct sshbuf *);
++int mm_answer_audit_unsupported_body(int, struct sshbuf *);
++int mm_answer_audit_kex_body(int, struct sshbuf *);
++int mm_answer_audit_session_key_free_body(int, struct sshbuf *);
++int mm_answer_audit_server_key_free(int, struct sshbuf *);
  #endif
  
  static int monitor_read_log(struct monitor *);
@@ -1145,16 +1126,18 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  #endif
      {0, 0, NULL}
  };
-@@ -1396,7 +1413,9 @@ mm_answer_keyverify(int sock, struct ssh
+@@ -1396,8 +1413,10 @@ mm_answer_keyverify(int sock, struct ssh
  	char *sigalg;
  	size_t signaturelen, datalen, bloblen;
  	int r, ret, valid_data = 0, encoded_ret;
 +	int type = 0;
  
-+	type = buffer_get_int(m);
- 	if ((r = sshbuf_get_string(m, &blob, &bloblen)) != 0 ||
+-	if ((r = sshbuf_get_string(m, &blob, &bloblen)) != 0 ||
++	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
++	    (r = sshbuf_get_string(m, &blob, &bloblen)) != 0 ||
  	    (r = sshbuf_get_string(m, &signature, &signaturelen)) != 0 ||
  	    (r = sshbuf_get_string(m, &data, &datalen)) != 0 ||
+ 	    (r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
 @@ -1405,6 +1424,8 @@ mm_answer_keyverify(int sock, struct ssh
  	if (hostbased_cuser == NULL || hostbased_chost == NULL ||
  	  !monitor_allowed_key(blob, bloblen))
@@ -1213,14 +1196,15 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
  		if (errno != EINTR)
  			exit(1);
-@@ -1630,11 +1662,45 @@ mm_answer_audit_command(int socket, Buff
+@@ -1630,12 +1662,47 @@ mm_answer_audit_command(int socket, Buff
  {
- 	u_int len;
  	char *cmd;
+ 	int r;
 +	Session *s;
  
  	debug3("%s entering", __func__);
- 	cmd = buffer_get_string(m, &len);
+ 	if ((r = sshbuf_get_cstring(m, &cmd, NULL)) != 0)
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
  	/* sanity check command, if so how? */
 -	audit_run_command(cmd);
@@ -1232,8 +1216,8 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
 +	s->command_handle = audit_run_command(cmd);
 +#endif
 +
-+	buffer_clear(m);
-+	buffer_put_int(m, s->self);
++	sshbuf_reset(m);
++	sshbuf_put_u32(m, s->self);
 +
 +	mm_request_send(socket, MONITOR_ANS_AUDIT_COMMAND, m);
 +
@@ -1241,16 +1225,17 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
 +}
 +
 +int
-+mm_answer_audit_end_command(int socket, Buffer *m)
++mm_answer_audit_end_command(int socket, struct sshbuf *m)
 +{
-+	int handle;
-+	u_int len;
-+	char *cmd;
++	int handle, r;
++	size_t len;
++	u_char *cmd = NULL;
 +	Session *s;
 +
 +	debug3("%s entering", __func__);
-+	handle = buffer_get_int(m);
-+	cmd = buffer_get_string(m, &len);
++	if ((r = sshbuf_get_u32(m, &handle)) != 0 ||
++	    (r = sshbuf_get_string(m, &cmd, &len)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +	s = session_by_id(handle);
 +	if (s == NULL || s->ttyfd != -1 || s->command == NULL ||
@@ -1264,7 +1249,7 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  void
  mm_get_keystate(struct monitor *pmonitor)
  {
-+	Buffer m;
++	struct sshbuf *m;
  	debug3("%s: Waiting for new keys", __func__);
  
  	if ((child_state = sshbuf_new()) == NULL)
@@ -1274,11 +1259,11 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  	debug3("%s: GOT new keys", __func__);
 +
 +#ifdef SSH_AUDIT_EVENTS
-+	buffer_init(&m);
++	m = sshbuf_new();
 +	mm_request_receive_expect(pmonitor->m_sendfd,
-+				  MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m);
-+	mm_answer_audit_session_key_free_body(pmonitor->m_sendfd, &m);
-+	buffer_free(&m);
++				  MONITOR_REQ_AUDIT_SESSION_KEY_FREE, m);
++	mm_answer_audit_session_key_free_body(pmonitor->m_sendfd, m);
++	sshbuf_free(m);
 +#endif
 +
 +	/* Drain any buffered messages from the child */
@@ -1288,41 +1273,47 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
  }
  
  
-@@ -1976,3 +2056,86 @@ mm_answer_gss_updatecreds(int socket, Bu
+@@ -1976,3 +2056,102 @@ mm_answer_gss_updatecreds(int socket, Bu
  
  #endif /* GSSAPI */
  
 +#ifdef SSH_AUDIT_EVENTS
 +int
-+mm_answer_audit_unsupported_body(int sock, Buffer *m)
++mm_answer_audit_unsupported_body(int sock, struct sshbuf *m)
 +{
-+	int what;
++	int what, r;
 +
-+	what = buffer_get_int(m);
++	if ((r = sshbuf_get_u32(m, &what)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +	audit_unsupported_body(what);
 +
-+	buffer_clear(m);
++	sshbuf_reset(m);
 +
 +	mm_request_send(sock, MONITOR_ANS_AUDIT_UNSUPPORTED, m);
 +	return 0;
 +}
 +
 +int
-+mm_answer_audit_kex_body(int sock, Buffer *m)
++mm_answer_audit_kex_body(int sock, struct sshbuf *m)
 +{
-+	int ctos, len;
++	int ctos, r;
 +	char *cipher, *mac, *compress, *pfs;
++	u_int64_t tmp;
 +	pid_t pid;
 +	uid_t uid;
 +
-+	ctos = buffer_get_int(m);
-+	cipher = buffer_get_string(m, &len);
-+	mac = buffer_get_string(m, &len);
-+	compress = buffer_get_string(m, &len);
-+	pfs = buffer_get_string(m, &len);
-+	pid = buffer_get_int64(m);
-+	uid = buffer_get_int64(m);
++	if ((r = sshbuf_get_u32(m, &ctos)) != 0 ||
++	    (r = sshbuf_get_cstring(m, &cipher, NULL)) != 0 ||
++	    (r = sshbuf_get_cstring(m, &mac, NULL)) != 0 ||
++	    (r = sshbuf_get_cstring(m, &compress, NULL)) != 0 ||
++	    (r = sshbuf_get_cstring(m, &pfs, NULL)) != 0 ||
++	    (r = sshbuf_get_u64(m, &tmp)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	pid = (pid_t) tmp;
++	if ((r = sshbuf_get_u64(m, &tmp)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	uid = (pid_t) tmp;
 +
 +	audit_kex_body(ctos, cipher, mac, compress, pfs, pid, uid);
 +
@@ -1330,47 +1321,57 @@ diff -up openssh-7.6p1/monitor.c.audit openssh-7.6p1/monitor.c
 +	free(mac);
 +	free(compress);
 +	free(pfs);
-+	buffer_clear(m);
++	sshbuf_reset(m);
 +
 +	mm_request_send(sock, MONITOR_ANS_AUDIT_KEX, m);
 +	return 0;
 +}
 +
 +int
-+mm_answer_audit_session_key_free_body(int sock, Buffer *m)
++mm_answer_audit_session_key_free_body(int sock, struct sshbuf *m)
 +{
-+	int ctos;
++	int ctos, r;
++	u_int64_t tmp;
 +	pid_t pid;
 +	uid_t uid;
 +
-+	ctos = buffer_get_int(m);
-+	pid = buffer_get_int64(m);
-+	uid = buffer_get_int64(m);
++	if ((r = sshbuf_get_u32(m, &ctos)) != 0 ||
++	    (r = sshbuf_get_u64(m, &tmp)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	pid = (pid_t) tmp;
++	if ((r = sshbuf_get_u64(m, &tmp)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	uid = (uid_t) tmp;
 +
 +	audit_session_key_free_body(ctos, pid, uid);
 +
-+	buffer_clear(m);
++	sshbuf_reset(m);
 +
 +	mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
 +	return 0;
 +}
 +
 +int
-+mm_answer_audit_server_key_free(int sock, Buffer *m)
++mm_answer_audit_server_key_free(int sock, struct sshbuf *m)
 +{
-+	int len;
++	size_t len, r;
 +	char *fp;
++	u_int64_t tmp;
 +	pid_t pid;
 +	uid_t uid;
 +
-+	fp = buffer_get_string(m, &len);
-+	pid = buffer_get_int64(m);
-+	uid = buffer_get_int64(m);
++	if ((r = sshbuf_get_cstring(m, &fp, &len)) != 0 ||
++	    (r = sshbuf_get_u64(m, &tmp)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	pid = (pid_t) tmp;
++	if ((r = sshbuf_get_u64(m, &tmp)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	uid = (uid_t) tmp;
 +
 +	audit_destroy_sensitive_data(fp, pid, uid);
 +
 +	free(fp);
-+	buffer_clear(m);
++	sshbuf_reset(m);
 +
 +	return 0;
 +}
@@ -1404,15 +1405,17 @@ diff -up openssh-7.6p1/monitor_wrap.c.audit openssh-7.6p1/monitor_wrap.c
 +mm_sshkey_verify(enum mm_keytype type, const struct sshkey *key, const u_char *sig, size_t siglen,
      const u_char *data, size_t datalen, const char *sigalg, u_int compat)
  {
- 	Buffer m;
-@@ -478,6 +478,7 @@ mm_sshkey_verify(const struct sshkey *ke
- 		return (0);
+ 	struct sshbuf *m;
+@@ -478,7 +478,8 @@ mm_sshkey_verify(const struct sshkey *ke
  
- 	buffer_init(&m);
-+	buffer_put_int(&m, type);
- 	buffer_put_string(&m, blob, len);
- 	buffer_put_string(&m, sig, siglen);
- 	buffer_put_string(&m, data, datalen);
+ 	if ((m = sshbuf_new()) == NULL)
+ 		fatal("%s: sshbuf_new failed", __func__);
+-	if ((r = sshkey_puts(key, m)) != 0 ||
++	if ((r = sshbuf_put_u32(m, type)) != 0 ||
++	    (r = sshkey_puts(key, m)) != 0 ||
+ 	    (r = sshbuf_put_string(m, sig, siglen)) != 0 ||
+ 	    (r = sshbuf_put_string(m, data, datalen)) != 0 ||
+ 	    (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
 @@ -497,6 +498,20 @@ mm_sshkey_verify(const struct sshkey *ke
  	return 0;
  }
@@ -1434,27 +1437,29 @@ diff -up openssh-7.6p1/monitor_wrap.c.audit openssh-7.6p1/monitor_wrap.c
  void
  mm_send_keystate(struct monitor *monitor)
  {
-@@ -874,10 +889,11 @@ mm_audit_event(ssh_audit_event_t event)
- 	buffer_free(&m);
+@@ -874,11 +889,12 @@ mm_audit_event(ssh_audit_event_t event)
+ 	sshbuf_free(m);
  }
  
 -void
 +int
  mm_audit_run_command(const char *command)
  {
- 	Buffer m;
+ 	struct sshbuf *m;
+ 	int r;
 +	int handle;
  
  	debug3("%s entering command %s", __func__, command);
  
-@@ -885,6 +901,26 @@ mm_audit_run_command(const char *command
- 	buffer_put_cstring(&m, command);
+@@ -885,6 +901,30 @@ mm_audit_run_command(const char *command
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
- 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_COMMAND, &m);
+ 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);
++	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_COMMAND, m);
 +
-+	handle = buffer_get_int(&m);
-+	buffer_free(&m);
++	if ((r = sshbuf_get_u32(m, &handle)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	sshbuf_free(m);
 +
 +	return (handle);
 +}
@@ -1462,87 +1467,103 @@ diff -up openssh-7.6p1/monitor_wrap.c.audit openssh-7.6p1/monitor_wrap.c
 +void
 +mm_audit_end_command(int handle, const char *command)
 +{
-+	Buffer m;
++	int r;
++	struct sshbuf *m;
 +
 +	debug3("%s entering command %s", __func__, command);
 +
-+	buffer_init(&m);
-+	buffer_put_int(&m, handle);
-+	buffer_put_cstring(&m, command);
++ 	if ((m = sshbuf_new()) == NULL)
++ 		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_u32(m, handle)) != 0 ||
++	    (r = sshbuf_put_cstring(m, command)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_END_COMMAND, &m);
- 	buffer_free(&m);
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_END_COMMAND, m);
+ 	sshbuf_free(m);
  }
  #endif /* SSH_AUDIT_EVENTS */
-@@ -1020,3 +1056,70 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
- 
+@@ -1020,3 +1056,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
+ 	return (ok);
+ }
  #endif /* GSSAPI */
- 
 +#ifdef SSH_AUDIT_EVENTS
 +void
 +mm_audit_unsupported_body(int what)
 +{
-+	Buffer m;
++	int r;
++	struct sshbuf *m;
 +
-+	buffer_init(&m);
-+	buffer_put_int(&m, what);
++ 	if ((m = sshbuf_new()) == NULL)
++ 		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_u32(m, what)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_UNSUPPORTED, &m);
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_UNSUPPORTED, m);
 +	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_UNSUPPORTED,
-+				  &m);
++				  m);
 +
-+	buffer_free(&m);
++	sshbuf_free(m);
 +}
 +
 +void
 +mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, char *fps, pid_t pid,
 +		  uid_t uid)
 +{
-+	Buffer m;
++	int r;
++	struct sshbuf *m;
 +
-+	buffer_init(&m);
-+	buffer_put_int(&m, ctos);
-+	buffer_put_cstring(&m, cipher);
-+	buffer_put_cstring(&m, (mac ? mac : "<implicit>"));
-+	buffer_put_cstring(&m, compress);
-+	buffer_put_cstring(&m, fps);
-+	buffer_put_int64(&m, pid);
-+	buffer_put_int64(&m, uid);
++ 	if ((m = sshbuf_new()) == NULL)
++ 		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_u32(m, ctos)) != 0 ||
++	    (r = sshbuf_put_cstring(m, cipher)) != 0 ||
++	    (r = sshbuf_put_cstring(m, (mac ? mac : "<implicit>"))) != 0 ||
++	    (r = sshbuf_put_cstring(m, compress)) != 0 ||
++	    (r = sshbuf_put_cstring(m, fps)) != 0 ||
++	    (r = sshbuf_put_u64(m, pid)) != 0 ||
++	    (r = sshbuf_put_u64(m, uid)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, &m);
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, m);
 +	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_KEX,
-+				  &m);
++				  m);
 +
-+	buffer_free(&m);
++	sshbuf_free(m);
 +}
 +
 +void
 +mm_audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
 +{
-+	Buffer m;
++	int r;
++	struct sshbuf *m;
 +
-+	buffer_init(&m);
-+	buffer_put_int(&m, ctos);
-+	buffer_put_int64(&m, pid);
-+	buffer_put_int64(&m, uid);
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m);
++ 	if ((m = sshbuf_new()) == NULL)
++ 		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_u32(m, ctos)) != 0 ||
++	    (r = sshbuf_put_u64(m, pid)) != 0 ||
++	    (r = sshbuf_put_u64(m, uid)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SESSION_KEY_FREE, m);
 +	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
-+				  &m);
-+	buffer_free(&m);
++				  m);
++	sshbuf_free(m);
 +}
 +
 +void
 +mm_audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
 +{
-+	Buffer m;
++	int r;
++	struct sshbuf *m;
 +
-+	buffer_init(&m);
-+	buffer_put_cstring(&m, fp);
-+	buffer_put_int64(&m, pid);
-+	buffer_put_int64(&m, uid);
++ 	if ((m = sshbuf_new()) == NULL)
++ 		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_cstring(m, fp)) != 0 ||
++	    (r = sshbuf_put_u64(m, pid)) != 0 ||
++	    (r = sshbuf_put_u64(m, uid)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m);
-+	buffer_free(&m);
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, m);
++	sshbuf_free(m);
 +}
 +#endif /* SSH_AUDIT_EVENTS */
 diff -up openssh-7.6p1/monitor_wrap.h.audit openssh-7.6p1/monitor_wrap.h
@@ -1577,7 +1598,7 @@ diff -up openssh-7.6p1/packet.c.audit openssh-7.6p1/packet.c
 --- openssh-7.6p1/packet.c.audit	2017-10-04 17:18:32.672504220 +0200
 +++ openssh-7.6p1/packet.c	2017-10-04 17:25:48.141741390 +0200
 @@ -67,6 +67,7 @@
- #include "key.h"	/* typedefs XXX */
+ #include <zlib.h>
  
  #include "xmalloc.h"
 +#include "audit.h"
@@ -1642,9 +1663,9 @@ diff -up openssh-7.6p1/packet.c.audit openssh-7.6p1/packet.c
 +			close(state->connection_in);
 +			close(state->connection_out);
 +		}
+ 		free(ssh->local_ipaddr);
+ 		ssh->local_ipaddr = NULL;
  		free(ssh->remote_ipaddr);
- 		ssh->remote_ipaddr = NULL;
- 		free(ssh->state);
 @@ -854,6 +863,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
  		   (unsigned long long)state->p_read.blocks,
  		   (unsigned long long)state->p_send.bytes,
@@ -1685,16 +1706,16 @@ diff -up openssh-7.6p1/packet.c.audit openssh-7.6p1/packet.c
 +	cipher_free(state->receive_context);
 +	cipher_free(state->send_context);
 +
-+	buffer_free(state->input);
++	sshbuf_free(state->input);
 +	state->input = NULL;
-+	buffer_free(state->output);
++	sshbuf_free(state->output);
 +	state->output = NULL;
-+	buffer_free(state->outgoing_packet);
++	sshbuf_free(state->outgoing_packet);
 +	state->outgoing_packet = NULL;
-+	buffer_free(state->incoming_packet);
++	sshbuf_free(state->incoming_packet);
 +	state->incoming_packet = NULL;
-+	if( state->compression_buffer ) {
-+		buffer_free(state->compression_buffer);
++	if (state->compression_buffer) {
++		sshbuf_free(state->compression_buffer);
 +		state->compression_buffer = NULL;
 +	}
 +	newkeys_destroy_and_free(state->newkeys[MODE_IN]);
@@ -1744,7 +1765,7 @@ diff -up openssh-7.6p1/session.c.audit openssh-7.6p1/session.c
  extern int startup_pipe;
 -extern void destroy_sensitive_data(void);
 +extern void destroy_sensitive_data(int);
- extern Buffer loginmsg;
+ extern struct sshbuf *loginmsg;
  extern struct sshauthopt *auth_opts;
  char *tun_fwd_ifnames; /* serverloop.c */
 @@ -605,6 +605,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
@@ -1984,11 +2005,11 @@ diff -up openssh-7.6p1/sshd.c.audit openssh-7.6p1/sshd.c
  		if (sensitive_data.host_keys[i]) {
 +			char *fp;
 +
-+			if (key_is_private(sensitive_data.host_keys[i]))
++			if (sshkey_is_private(sensitive_data.host_keys[i]))
 +				fp = sshkey_fingerprint(sensitive_data.host_keys[i], options.fingerprint_hash, SSH_FP_HEX);
 +			else
 +				fp = NULL;
- 			key_free(sensitive_data.host_keys[i]);
+ 			sshkey_free(sensitive_data.host_keys[i]);
  			sensitive_data.host_keys[i] = NULL;
 +			if (fp != NULL) {
 +#ifdef SSH_AUDIT_EVENTS
@@ -2005,13 +2026,13 @@ diff -up openssh-7.6p1/sshd.c.audit openssh-7.6p1/sshd.c
 -		if (sensitive_data.host_certificates[i]) {
 +		if (sensitive_data.host_certificates
 +		    && sensitive_data.host_certificates[i]) {
- 			key_free(sensitive_data.host_certificates[i]);
+ 			sshkey_free(sensitive_data.host_certificates[i]);
  			sensitive_data.host_certificates[i] = NULL;
  		}
-@@ -499,12 +536,30 @@ demote_sensitive_data(void)
- {
+@@ -499,16 +536,34 @@ demote_sensitive_data(void)
  	struct sshkey *tmp;
  	u_int i;
+ 	int r;
 +#ifdef SSH_AUDIT_EVENTS
 +	pid_t pid;
 +	uid_t uid;
@@ -2023,12 +2044,16 @@ diff -up openssh-7.6p1/sshd.c.audit openssh-7.6p1/sshd.c
  		if (sensitive_data.host_keys[i]) {
 +			char *fp;
 +
-+			if (key_is_private(sensitive_data.host_keys[i]))
++			if (sshkey_is_private(sensitive_data.host_keys[i]))
 +				fp = sshkey_fingerprint(sensitive_data.host_keys[i], options.fingerprint_hash, SSH_FP_HEX);
 +			else
 +				fp = NULL;
- 			tmp = key_demote(sensitive_data.host_keys[i]);
- 			key_free(sensitive_data.host_keys[i]);
+			if ((r = sshkey_demote(sensitive_data.host_keys[i],
+			    &tmp)) != 0)
+				fatal("could not demote host %s key: %s",
+				    sshkey_type(sensitive_data.host_keys[i]),
+				    ssh_err(r));
+			sshkey_free(sensitive_data.host_keys[i]);
  			sensitive_data.host_keys[i] = tmp;
 +			if (fp != NULL) {
 +#ifdef SSH_AUDIT_EVENTS
diff --git a/openssh-7.6p1-pkcs11-ecdsa.patch b/openssh-7.6p1-pkcs11-ecdsa.patch
index b7fd2cf..9b19b68 100644
--- a/openssh-7.6p1-pkcs11-ecdsa.patch
+++ b/openssh-7.6p1-pkcs11-ecdsa.patch
@@ -29,7 +29,7 @@ diff -up openssh-7.6p1/ssh-pkcs11-client.c.pkcs11-ecdsa openssh-7.6p1/ssh-pkcs11
  {
  	static RSA_METHOD helper_rsa;
  
-@@ -152,6 +160,81 @@ wrap_key(RSA *rsa)
+@@ -152,6 +160,85 @@ wrap_key(RSA *rsa)
  	return (0);
  }
  
@@ -38,30 +38,34 @@ diff -up openssh-7.6p1/ssh-pkcs11-client.c.pkcs11-ecdsa openssh-7.6p1/ssh-pkcs11
 +pkcs11_ecdsa_private_sign(const unsigned char *from, int flen,
 +    const BIGNUM *inv, const BIGNUM *rp, EC_KEY * ecdsa)
 +{
-+	Key key;
++	struct sshkey *key;
 +	u_char *blob, *signature = NULL;
-+	u_int blen, slen = 0;
-+	Buffer msg;
++	size_t blen, slen = 0;
++	struct sshbuf *msg;
 +	ECDSA_SIG *ret = NULL;
 +	BIGNUM *r = NULL, *s = NULL;
++	int rv;
 +
-+	key.type = KEY_ECDSA;
-+	key.ecdsa = ecdsa;
-+	key.ecdsa_nid = sshkey_ecdsa_key_to_nid(ecdsa);
-+	if (key_to_blob(&key, &blob, &blen) == 0)
++	key = sshkey_new(KEY_ECDSA);
++	key->ecdsa = ecdsa;
++	key->ecdsa_nid = sshkey_ecdsa_key_to_nid(ecdsa);
++	if (sshkey_to_blob(key, &blob, &blen) == 0)
 +		return NULL;
-+	buffer_init(&msg);
-+	buffer_put_char(&msg, SSH2_AGENTC_SIGN_REQUEST);
-+	buffer_put_string(&msg, blob, blen);
-+	buffer_put_string(&msg, from, flen);
-+	buffer_put_int(&msg, 0);
++	if ((msg = sshbuf_new()) == NULL)
++		fatal("%s: sshbuf_new failed", __func__);
++	if ((rv = sshbuf_put_u8(msg, SSH2_AGENTC_SIGN_REQUEST)) != 0 ||
++	    (rv = sshbuf_put_string(msg, blob, blen)) != 0 ||
++	    (rv = sshbuf_put_string(msg, from, flen)) != 0 ||
++	    (rv = sshbuf_put_u32(msg, 0)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(rv));
 +	free(blob);
-+	send_msg(&msg);
-+	buffer_clear(&msg);
++	send_msg(msg);
++	sshbuf_reset(msg);
 +
-+	if (recv_msg(&msg) == SSH2_AGENT_SIGN_RESPONSE) {
-+		signature = buffer_get_string(&msg, &slen);
-+		if (slen <= (u_int)ECDSA_size(ecdsa)) {
++	if (recv_msg(msg) == SSH2_AGENT_SIGN_RESPONSE) {
++		if ((rv = sshbuf_get_string(msg, &signature, &slen)) != 0)
++			fatal("%s: buffer error: %s", __func__, ssh_err(rv));
++		if (slen <= (size_t)ECDSA_size(ecdsa)) {
 +			int nlen = slen / 2;
 +			ret = ECDSA_SIG_new();
 +			r = BN_new();
@@ -72,7 +76,7 @@ diff -up openssh-7.6p1/ssh-pkcs11-client.c.pkcs11-ecdsa openssh-7.6p1/ssh-pkcs11
 +		}
 +		free(signature);
 +	}
-+	buffer_free(&msg);
++	sshbuf_free(msg);
 +	return (ret);
 +}
 +
@@ -112,9 +116,9 @@ diff -up openssh-7.6p1/ssh-pkcs11-client.c.pkcs11-ecdsa openssh-7.6p1/ssh-pkcs11
  pkcs11_start_helper(void)
  {
 @@ -212,7 +281,15 @@ pkcs11_add_provider(char *name, char *pi
- 			blob = buffer_get_string(&msg, &blen);
- 			free(buffer_get_string(&msg, NULL));
- 			k = key_from_blob(blob, blen);
+ 				    __func__, ssh_err(r));
+ 			if ((r = sshkey_from_blob(blob, blen, &k)) != 0)
+ 				fatal("%s: bad key: %s", __func__, ssh_err(r));
 -			wrap_key(k->rsa);
 +			if(k->type == KEY_RSA) {
 +				 wrap_rsa_key(k->rsa);
diff --git a/openssh-7.6p1-pkcs11-uri.patch b/openssh-7.6p1-pkcs11-uri.patch
index 79c6a00..c032ed5 100644
--- a/openssh-7.6p1-pkcs11-uri.patch
+++ b/openssh-7.6p1-pkcs11-uri.patch
@@ -17,18 +17,18 @@ index ac959c1f..f8ed1781 100644
  	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)
 +	rm -f regress/unittests/pkcs11/*.o
 +	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)
- 	rm -f regress/misc/kexfuzz/*.o
- 	rm -f regress/misc/kexfuzz/kexfuzz$(EXEEXT)
- 	(cd openbsd-compat && $(MAKE) clean)
+	rm -f regress/misc/kexfuzz/*.o
+	rm -f regress/misc/kexfuzz/kexfuzz$(EXEEXT)
+	(cd openbsd-compat && $(MAKE) clean)
 @@ -276,6 +278,8 @@ distclean:	regressclean
  	rm -f regress/unittests/match/test_match
  	rm -f regress/unittests/utf8/*.o
  	rm -f regress/unittests/utf8/test_utf8
 +	rm -f regress/unittests/pkcs11/*.o
 +	rm -f regress/unittests/pkcs11/test_pkcs11
- 	rm -f regress/unittests/misc/kexfuzz
- 	(cd openbsd-compat && $(MAKE) distclean)
- 	if test -d pkg ; then \
+	rm -f regress/misc/kexfuzz/*.o
+	rm -f regress/misc/kexfuzz
+	(cd openbsd-compat && $(MAKE) distclean)
 @@ -437,6 +441,7 @@ regress-prep:
  	$(MKDIR_P) `pwd`/regress/unittests/kex
  	$(MKDIR_P) `pwd`/regress/unittests/match
@@ -72,8 +72,8 @@ index ac959c1f..f8ed1781 100644
  	regress/netcat$(EXEEXT) \
 +	regress/soft-pkcs11.so \
  	regress/check-perm$(EXEEXT) \
+ 	regress/mkdtemp$(EXEEXT) \
  	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
- 	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
 @@ -575,6 +596,7 @@ regress-binaries: regress/modpipe$(EXEEXT) \
  	regress/unittests/kex/test_kex$(EXEEXT) \
  	regress/unittests/match/test_match$(EXEEXT) \
@@ -81,7 +81,7 @@ index ac959c1f..f8ed1781 100644
 +	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
  	regress/misc/kexfuzz/kexfuzz$(EXEEXT)
  
- REGRESSTMP = "$(PWD)/regress"
+ tests interop-tests t-exec unit: regress-prep regress-binaries $(TARGETS)
 diff --git a/authfd.c b/authfd.c
 index 1eff7ba9..35153f47 100644
 --- a/authfd.c
@@ -2717,7 +2717,7 @@ new file mode 100644
 index 00000000..e83aca54
 --- /dev/null
 +++ b/regress/unittests/pkcs11/tests.c
-@@ -0,0 +1,329 @@
+@@ -0,0 +1,330 @@
 +/*
 + * Copyright (c) 2017 Red Hat
 + *
@@ -2743,6 +2743,7 @@ index 00000000..e83aca54
 +
 +#include "../test_helper/test_helper.h"
 +
++#include "sshbuf.h"
 +#include "ssh-pkcs11-uri.h"
 +
 +#define EMPTY_URI compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL)
@@ -3288,12 +3289,12 @@ index a023f5f4..882e8381 100644
  	key.type = KEY_RSA;
  	key.rsa = rsa;
 +	key.ecdsa_nid = 0;
- 	if (key_to_blob(&key, &blob, &blen) == 0)
+ 	if ((r = sshkey_to_blob(&key, &blob, &blen)) != 0) {
+ 		error("%s: sshkey_to_blob: %s", __func__, ssh_err(r));
  		return -1;
- 	buffer_init(&msg);
 @@ -195,6 +196,8 @@ pkcs11_add_provider(char *name, char *pin, Key ***keysp)
- 	u_int blen;
- 	Buffer msg;
+ 	u_int nkeys, i;
+ 	struct sshbuf *msg;
  
 +	debug("%s: called, name = %s", __func__, name);
 +
@@ -3301,19 +3302,19 @@ index a023f5f4..882e8381 100644
  		return (-1);
  
 @@ -208,6 +211,7 @@ pkcs11_add_provider(char *name, char *pin, Key ***keysp)
- 	if (recv_msg(&msg) == SSH2_AGENT_IDENTITIES_ANSWER) {
- 		nkeys = buffer_get_int(&msg);
- 		*keysp = xcalloc(nkeys, sizeof(Key *));
-+		debug("%s: nkeys = %d", __func__, nkeys);
+ 		if ((r = sshbuf_get_u32(msg, &nkeys)) != 0)
+ 			fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 		*keysp = xcalloc(nkeys, sizeof(struct sshkey *));
++		debug("%s: nkeys = %u", __func__, nkeys);
  		for (i = 0; i < nkeys; i++) {
- 			blob = buffer_get_string(&msg, &blen);
- 			free(buffer_get_string(&msg, NULL));
+ 			/* XXX clean up properly instead of fatal() */
+ 			if ((r = sshbuf_get_string(msg, &blob, &blen)) != 0 ||
 diff --git a/ssh-pkcs11-uri.c b/ssh-pkcs11-uri.c
 new file mode 100644
 index 00000000..da15c164
 --- /dev/null
 +++ b/ssh-pkcs11-uri.c
-@@ -0,0 +1,400 @@
+@@ -0,0 +1,401 @@
 +/*
 + * Copyright (c) 2017 Red Hat
 + *
@@ -3340,6 +3341,7 @@ index 00000000..da15c164
 +#include <string.h>
 +
 +#include "sshkey.h"
++#include "sshbuf.h"
 +#include "log.h"
 +
 +#define CRYPTOKI_COMPAT
@@ -4624,7 +4626,7 @@ index d3619fe2..180eb2e0 100644
 +				break;
 +			}
 +#endif
- 			p = tilde_expand_filename(optarg, original_real_uid);
+ 			p = tilde_expand_filename(optarg, getuid());
  			if (stat(p, &st) < 0)
  				fprintf(stderr, "Warning: Identity file %s "
 @@ -1999,6 +2007,45 @@ ssh_session2(struct ssh *ssh, struct passwd *pw)
@@ -4656,7 +4658,7 @@ index d3619fe2..180eb2e0 100644
 +	    (nkeys = pkcs11_add_provider_by_uri(uri, NULL, &keys)) > 0) {
 +		for (i = 0; i < nkeys; i++) {
 +			if (*n_ids >= SSH_MAX_IDENTITY_FILES) {
-+				key_free(keys[i]);
++				sshkey_free(keys[i]);
 +				continue;
 +			}
 +			identity_keys[*n_ids] = keys[i];
@@ -4674,9 +4676,9 @@ index d3619fe2..180eb2e0 100644
  static void
  load_public_identity_files(struct passwd *pw)
 @@ -2011,10 +2058,6 @@ load_public_identity_files(struct passwd *pw)
- 	struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];
  	char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
  	struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
+ 	int certificate_file_userprovided[SSH_MAX_CERTIFICATE_FILES];
 -#ifdef ENABLE_PKCS11
 -	struct sshkey **keys;
 -	int nkeys;
@@ -4684,8 +4686,8 @@ index d3619fe2..180eb2e0 100644
  
  	n_ids = n_certs = 0;
  	memset(identity_files, 0, sizeof(identity_files));
-@@ -2023,35 +2066,48 @@ load_public_identity_files(struct passwd *pw)
- 	memset(certificates, 0, sizeof(certificates));
+@@ -2023,32 +2066,46 @@ load_public_identity_files(struct passwd *pw)
+ 	    sizeof(certificate_file_userprovided));
  
  #ifdef ENABLE_PKCS11
 -	if (options.pkcs11_provider != NULL &&
@@ -4695,7 +4697,7 @@ index d3619fe2..180eb2e0 100644
 -	    &keys)) > 0) {
 -		for (i = 0; i < nkeys; i++) {
 -			if (n_ids >= SSH_MAX_IDENTITY_FILES) {
--				key_free(keys[i]);
+-				sshkey_free(keys[i]);
 -				continue;
 -			}
 -			identity_keys[n_ids] = keys[i];
@@ -4725,8 +4727,6 @@ index d3619fe2..180eb2e0 100644
 +		pkcs11_uri_cleanup(uri);
  	}
  #endif /* ENABLE_PKCS11 */
- 	if ((pw = getpwuid(original_real_uid)) == NULL)
- 		fatal("load_public_identity_files: getpwuid failed");
  	for (i = 0; i < options.num_identity_files; i++) {
 +		char *name = options.identity_files[i];
  		if (n_ids >= SSH_MAX_IDENTITY_FILES ||
@@ -4736,8 +4736,7 @@ index d3619fe2..180eb2e0 100644
  			options.identity_files[i] = NULL;
  			continue;
  		}
--		cp = tilde_expand_filename(options.identity_files[i],
--		    original_real_uid);
+-		cp = tilde_expand_filename(options.identity_files[i], getuid());
 +#ifdef ENABLE_PKCS11
 +		if (strlen(name) >= strlen(PKCS11_URI_SCHEME) &&
 +		    strncmp(name, PKCS11_URI_SCHEME,
@@ -4748,7 +4747,7 @@ index d3619fe2..180eb2e0 100644
 +			continue;
 +		}
 +#endif /* ENABLE_PKCS11 */
-+		cp = tilde_expand_filename(name, original_real_uid);
++		cp = tilde_expand_filename(name, getuid());
  		filename = percent_expand(cp, "d", pw->pw_dir,
  		    "u", pw->pw_name, "l", thishost, "h", host,
  		    "r", options.user, (char *)NULL);
diff --git a/openssh-7.7p1-fips.patch b/openssh-7.7p1-fips.patch
index 6ce05ab..084c903 100644
--- a/openssh-7.7p1-fips.patch
+++ b/openssh-7.7p1-fips.patch
@@ -294,7 +294,7 @@ diff -up openssh-7.7p1/Makefile.in.fips openssh-7.7p1/Makefile.in
 +	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
  
  scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
- 	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
  
  ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
 -	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -308,9 +308,9 @@ diff -up openssh-7.7p1/Makefile.in.fips openssh-7.7p1/Makefile.in
 -	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 +	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
- ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o readconf.o
--	$(LD) -o $@ ssh-keysign.o readconf.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+	$(LD) -o $@ ssh-keysign.o readconf.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
+ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o readconf.o uidswap.o
+-	$(LD) -o $@ ssh-keysign.o readconf.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
++	$(LD) -o $@ ssh-keysign.o readconf.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
  
  ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
  	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
@@ -380,53 +380,35 @@ diff -up openssh-7.7p1/myproposal.h.fips openssh-7.7p1/myproposal.h
  #else /* WITH_OPENSSL */
  
  #define KEX_SERVER_KEX		\
-diff -up openssh-7.7p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.fips openssh-7.7p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c
---- openssh-7.7p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.fips	2018-08-08 10:08:40.649718516 +0200
-+++ openssh-7.7p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c	2018-08-08 10:08:40.823719982 +0200
-@@ -55,6 +55,7 @@
- #include "secure_filename.h"
- #include "uidswap.h"
- #include <unistd.h>
-+#include <openssl/crypto.h>
- 
- #include "identity.h"
- 
-@@ -104,7 +105,8 @@ pamsshagentauth_check_authkeys_file(FILE
-             found_key = 1;
-             logit("matching key found: file/command %s, line %lu", file,
-                                   linenum);
--            fp = sshkey_fingerprint(found, SSH_DIGEST_MD5, SSH_FP_HEX);
-+            fp = sshkey_fingerprint(found, FIPS_mode() ? SSH_DIGEST_SHA1 : SSH_DIGEST_MD5,
-+				SSH_FP_HEX);
-             logit("Found matching %s key: %s",
-                                   sshkey_type(found), fp);
-             free(fp);
 diff -up openssh-7.7p1/readconf.c.fips openssh-7.7p1/readconf.c
 --- openssh-7.7p1/readconf.c.fips	2018-08-08 10:08:40.769719527 +0200
 +++ openssh-7.7p1/readconf.c	2018-08-08 10:08:40.824719990 +0200
-@@ -2081,12 +2081,17 @@ fill_default_options(Options * options)
- 	}
- 	if (options->update_hostkeys == -1)
- 		options->update_hostkeys = 0;
--	if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
--	    kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
--	    kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
--	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
-+	if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_ENCRYPT
-+	        : KEX_CLIENT_ENCRYPT), &options->ciphers) != 0 ||
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_MAC
-+	        : KEX_CLIENT_MAC), &options->macs) != 0 ||
-+	    kex_assemble_names((FIPS_mode() ? KEX_DEFAULT_KEX_FIPS
-+	        : KEX_CLIENT_KEX), &options->kex_algorithms) != 0 ||
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_PK_ALG
-+	        : KEX_DEFAULT_PK_ALG),
- 	    &options->hostbased_key_types) != 0 ||
--	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_PK_ALG
-+	        : KEX_DEFAULT_PK_ALG),
- 	    &options->pubkey_key_types) != 0)
- 		fatal("%s: kex_assemble_names failed", __func__);
- 
+@@ -2081,17 +2081,18 @@ fill_default_options(Options * options)
+ 	all_mac = mac_alg_list(',');
+ 	all_kex = kex_alg_list(',');
+ 	all_key = sshkey_alg_list(0, 0, 1, ',');
+-#define ASSEMBLE(what, defaults, all) \
++#define ASSEMBLE(what, defaults, fips_defaults, all) \
+ 	do { \
+ 		if ((r = kex_assemble_names(&options->what, \
+-		    defaults, all)) != 0) \
++		    (FIPS_mode() ? fips_defaults : defaults), \
++		    all)) != 0) \
+ 			fatal("%s: %s: %s", __func__, #what, ssh_err(r)); \
+ 	} while (0)
+-	ASSEMBLE(ciphers, KEX_SERVER_ENCRYPT, all_cipher);
+-	ASSEMBLE(macs, KEX_SERVER_MAC, all_mac);
+-	ASSEMBLE(kex_algorithms, KEX_SERVER_KEX, all_kex);
+-	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, all_key);
++	ASSEMBLE(ciphers, KEX_SERVER_ENCRYPT, KEX_FIPS_ENCRYPT, all_cipher);
++	ASSEMBLE(macs, KEX_SERVER_MAC, KEX_FIPS_MAC, all_mac);
++	ASSEMBLE(kex_algorithms, KEX_SERVER_KEX, KEX_DEFAULT_KEX_FIPS, all_kex);
++	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
+ #undef ASSEMBLE
+ 	free(all_cipher);
+ 	free(all_mac);
 diff -up openssh-7.7p1/sandbox-seccomp-filter.c.fips openssh-7.7p1/sandbox-seccomp-filter.c
 --- openssh-7.7p1/sandbox-seccomp-filter.c.fips	2018-08-08 10:08:40.794719737 +0200
 +++ openssh-7.7p1/sandbox-seccomp-filter.c	2018-08-08 10:08:40.824719990 +0200
@@ -443,33 +425,33 @@ diff -up openssh-7.7p1/sandbox-seccomp-filter.c.fips openssh-7.7p1/sandbox-secco
 diff -up openssh-7.7p1/servconf.c.fips openssh-7.7p1/servconf.c
 --- openssh-7.7p1/servconf.c.fips	2018-08-08 10:08:40.778719603 +0200
 +++ openssh-7.7p1/servconf.c	2018-08-08 10:08:40.824719990 +0200
-@@ -196,14 +196,20 @@ option_clear_or_none(const char *o)
- static void
- assemble_algorithms(ServerOptions *o)
- {
--	if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
--	    kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
--	    kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
--	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
-+	if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_ENCRYPT
-+	        : KEX_SERVER_ENCRYPT), &o->ciphers) != 0 ||
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_MAC
-+	        : KEX_SERVER_MAC), &o->macs) != 0 ||
-+	    kex_assemble_names((FIPS_mode() ? KEX_DEFAULT_KEX_FIPS
-+	        : KEX_SERVER_KEX), &o->kex_algorithms) != 0 ||
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_PK_ALG
-+	        : KEX_DEFAULT_PK_ALG),
- 	    &o->hostkeyalgorithms) != 0 ||
--	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_PK_ALG
-+	        : KEX_DEFAULT_PK_ALG),
- 	    &o->hostbased_key_types) != 0 ||
--	    kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
-+	    kex_assemble_names((FIPS_mode() ? KEX_FIPS_PK_ALG
-+	        : KEX_DEFAULT_PK_ALG), &o->pubkey_key_types) != 0)
- 		fatal("kex_assemble_names failed");
- }
- 
+@@ -196,17 +196,18 @@ option_clear_or_none(const char *o)
+ 	all_mac = mac_alg_list(',');
+ 	all_kex = kex_alg_list(',');
+ 	all_key = sshkey_alg_list(0, 0, 1, ',');
+-#define ASSEMBLE(what, defaults, all) \
++#define ASSEMBLE(what, defaults, fips_defaults, all) \
+ 	do { \
+-		if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
++		if ((r = kex_assemble_names(&o->what, (FIPS_mode() \
++		    ? fips_defaults : defaults), all)) != 0) \
+ 			fatal("%s: %s: %s", __func__, #what, ssh_err(r)); \
+ 	} while (0)
+-	ASSEMBLE(ciphers, KEX_SERVER_ENCRYPT, all_cipher);
+-	ASSEMBLE(macs, KEX_SERVER_MAC, all_mac);
+-	ASSEMBLE(kex_algorithms, KEX_SERVER_KEX, all_kex);
+-	ASSEMBLE(hostkeyalgorithms, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, all_key);
+-	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, all_key);
++	ASSEMBLE(ciphers, KEX_SERVER_ENCRYPT, KEX_FIPS_ENCRYPT, all_cipher);
++	ASSEMBLE(macs, KEX_SERVER_MAC, KEX_FIPS_MAC, all_mac);
++	ASSEMBLE(kex_algorithms, KEX_SERVER_KEX, KEX_DEFAULT_KEX_FIPS, all_kex);
++	ASSEMBLE(hostkeyalgorithms, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(hostbased_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
++	ASSEMBLE(pubkey_key_types, KEX_DEFAULT_PK_ALG, KEX_FIPS_PK_ALG, all_key);
+ #undef ASSEMBLE
+ 	free(all_cipher);
+ 	free(all_mac);
 diff -up openssh-7.7p1/ssh.c.fips openssh-7.7p1/ssh.c
 --- openssh-7.7p1/ssh.c.fips	2018-08-08 10:08:40.811719881 +0200
 +++ openssh-7.7p1/ssh.c	2018-08-08 10:08:40.825719999 +0200
@@ -581,14 +563,14 @@ diff -up openssh-7.7p1/sshconnect2.c.fips openssh-7.7p1/sshconnect2.c
  	}
  #endif
 @@ -322,14 +330,16 @@ ssh_kex2(char *host, struct sockaddr *ho
- 	myproposal[PROPOSAL_MAC_ALGS_CTOS] =
- 	    myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
  	if (options.hostkeyalgorithms != NULL) {
--		if (kex_assemble_names(KEX_DEFAULT_PK_ALG,
-+		if (kex_assemble_names((FIPS_mode() ? KEX_FIPS_PK_ALG
-+		    : KEX_DEFAULT_PK_ALG),
- 		    &options.hostkeyalgorithms) != 0)
+ 		all_key = sshkey_alg_list(0, 0, 1, ',');
+		if (kex_assemble_names(&options.hostkeyalgorithms,
+-		    KEX_DEFAULT_PK_ALG, all_key) != 0)
++		    (FIPS_mode() ? KEX_FIPS_PK_ALG : KEX_DEFAULT_PK_ALG),
++		    all_key) != 0)
  			fatal("%s: kex_assemble_namelist", __func__);
+ 		free(all_key);
  		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
  		    compat_pkalg_proposal(options.hostkeyalgorithms);
  	} else {
diff --git a/openssh-7.7p1-redhat.patch b/openssh-7.7p1-redhat.patch
index dc38d65..99a4411 100644
--- a/openssh-7.7p1-redhat.patch
+++ b/openssh-7.7p1-redhat.patch
@@ -148,7 +148,7 @@ diff -up openssh-7.7p1/sshd_config.redhat openssh-7.7p1/sshd_config
 +
  #PrintLastLog yes
  #TCPKeepAlive yes
- #UseLogin no
+ #PermitUserEnvironment no
 @@ -106,6 +126,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
  # no default banner path
  #Banner none
diff --git a/openssh-7.7p1-tun-devices.patch b/openssh-7.7p1-tun-devices.patch
deleted file mode 100644
index efd82c3..0000000
--- a/openssh-7.7p1-tun-devices.patch
+++ /dev/null
@@ -1,152 +0,0 @@
-From 4f60e4f66b5880c9f50ef758e8b7f7a9ae786d21 Mon Sep 17 00:00:00 2001
-From: Darren Tucker <dtucker@dtucker.net>
-Date: Fri, 13 Apr 2018 13:13:33 +1000
-Subject: [PATCH 1/5] Revert $REGRESSTMP changes.
-
-Revert 3fd2d229 and subsequent changes as they turned out to be a
-portability hassle.
----
- Makefile.in | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/Makefile.in b/Makefile.in
-index 04e1c8e53..dd942ee7b 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -577,8 +577,6 @@ regress-binaries: regress/modpipe$(EXEEXT) \
- 	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
- 	regress/misc/kexfuzz/kexfuzz$(EXEEXT)
- 
--REGRESSTMP = "$(PWD)/regress"
--
- tests interop-tests t-exec unit: regress-prep regress-binaries $(TARGETS)
- 	BUILDDIR=`pwd`; \
- 	TEST_SSH_SCP="$${BUILDDIR}/scp"; \
-@@ -602,7 +600,7 @@ tests interop-tests t-exec unit: regress-prep regress-binaries $(TARGETS)
- 		.OBJDIR="$${BUILDDIR}/regress" \
- 		.CURDIR="`pwd`" \
- 		BUILDDIR="$${BUILDDIR}" \
--		OBJ="$(REGRESSTMP)" \
-+		OBJ="$${BUILDDIR}/regress/" \
- 		PATH="$${BUILDDIR}:$${PATH}" \
- 		TEST_ENV=MALLOC_OPTIONS="@TEST_MALLOC_OPTIONS@" \
- 		TEST_MALLOC_OPTIONS="@TEST_MALLOC_OPTIONS@" \
-
-From b81b2d120e9c8a83489e241620843687758925ad Mon Sep 17 00:00:00 2001
-From: Damien Miller <djm@mindrot.org>
-Date: Fri, 13 Apr 2018 13:38:06 +1000
-Subject: [PATCH 2/5] Fix tunnel forwarding broken in 7.7p1
-
-bz2855, ok dtucker@
----
- openbsd-compat/port-net.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/openbsd-compat/port-net.c b/openbsd-compat/port-net.c
-index 7050629c3..bb535626f 100644
---- a/openbsd-compat/port-net.c
-+++ b/openbsd-compat/port-net.c
-@@ -185,7 +185,7 @@ sys_tun_open(int tun, int mode, char **ifname)
- 	else
- 		debug("%s: %s mode %d fd %d", __func__, ifr.ifr_name, mode, fd);
- 
--	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)))
-+	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)) == NULL)
- 		goto failed;
- 
- 	return (fd);
-@@ -272,7 +272,7 @@ sys_tun_open(int tun, int mode, char **ifname)
- 			goto failed;
- 	}
- 
--	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)))
-+	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)) == NULL)
- 		goto failed;
- 
- 	close(sock);
-
-From 341727df910e12e26ef161508ed76d91c40a61eb Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Mon, 9 Apr 2018 23:54:49 +0000
-Subject: [PATCH 3/5] upstream: don't kill ssh-agent's listening socket
- entriely if we
-
-fail to accept a connection; bz#2837, patch from Lukas Kuster
-
-OpenBSD-Commit-ID: 52413f5069179bebf30d38f524afe1a2133c738f
----
- ssh-agent.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/ssh-agent.c b/ssh-agent.c
-index 2a4578b03..68de56ce6 100644
---- a/ssh-agent.c
-+++ b/ssh-agent.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: ssh-agent.c,v 1.228 2018/02/23 15:58:37 markus Exp $ */
-+/* $OpenBSD: ssh-agent.c,v 1.229 2018/04/09 23:54:49 djm Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -909,9 +909,8 @@ after_poll(struct pollfd *pfd, size_t npfd)
- 		/* Process events */
- 		switch (sockets[socknum].type) {
- 		case AUTH_SOCKET:
--			if ((pfd[i].revents & (POLLIN|POLLERR)) != 0 &&
--			    handle_socket_read(socknum) != 0)
--				close_socket(&sockets[socknum]);
-+			if ((pfd[i].revents & (POLLIN|POLLERR)) != 0)
-+				handle_socket_read(socknum);
- 			break;
- 		case AUTH_CONNECTION:
- 			if ((pfd[i].revents & (POLLIN|POLLERR)) != 0 &&
-
-From 3402cc607049ac900f6d8574bc2ce657a8cdf4fe Mon Sep 17 00:00:00 2001
-From: Darren Tucker <dtucker@dtucker.net>
-Date: Fri, 13 Apr 2018 13:43:55 +1000
-Subject: [PATCH 4/5] Using "==" in shell tests is not portable.
-
-Patch from rsbecker at nexbridge.com.
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 663062bef..2e84d90b7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1398,7 +1398,7 @@ AC_RUN_IFELSE(
- )
- AC_MSG_RESULT([$func_calloc_0_nonnull])
- 
--if test "x$func_calloc_0_nonnull" == "xyes"; then
-+if test "x$func_calloc_0_nonnull" = "xyes"; then
- 	AC_DEFINE(HAVE_CALLOC, 1, [calloc(0, x) returns non-null])
- else
- 	AC_DEFINE(HAVE_CALLOC, 0, [calloc(0, x) returns NULL])
-
-From 85fe48fd49f2e81fa30902841b362cfbb7f1933b Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Sat, 14 Apr 2018 21:50:41 +0000
-Subject: [PATCH 5/5] upstream: don't free the %C expansion, it's used later
- for
-
-LocalCommand
-
-OpenBSD-Commit-ID: 857b5cb37b2d856bfdfce61289a415257a487fb1
----
- ssh.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/ssh.c b/ssh.c
-index d3619fe29..9c011dd7e 100644
---- a/ssh.c
-+++ b/ssh.c
-@@ -1323,7 +1323,6 @@ main(int ac, char **av)
- 		    (char *)NULL);
- 		free(cp);
- 	}
--	free(conn_hash_hex);
- 
- 	if (config_test) {
- 		dump_client_config(&options, host);
diff --git a/openssh-7.2p2-UsePAM-UseLogin-warning.patch b/openssh-7.8p1-UsePAM-warning.patch
similarity index 97%
rename from openssh-7.2p2-UsePAM-UseLogin-warning.patch
rename to openssh-7.8p1-UsePAM-warning.patch
index b3038ea..da39361 100644
--- a/openssh-7.2p2-UsePAM-UseLogin-warning.patch
+++ b/openssh-7.8p1-UsePAM-warning.patch
@@ -3,7 +3,7 @@ diff --git a/sshd.c b/sshd.c
 +++ b/sshd.c
 @@ -1701,6 +1701,10 @@ main(int ac, char **av)
  	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    &cfg, NULL);
+ 	    cfg, NULL);
  
 +	/* 'UsePAM no' is not supported in Fedora */
 +	if (! options.use_pam)
diff --git a/openssh-7.2p1-gsskex.patch b/openssh-7.8p1-gsskex.patch
similarity index 84%
rename from openssh-7.2p1-gsskex.patch
rename to openssh-7.8p1-gsskex.patch
index c9034e8..dd10d4d 100644
--- a/openssh-7.2p1-gsskex.patch
+++ b/openssh-7.8p1-gsskex.patch
@@ -1,7 +1,7 @@
 diff -up openssh/auth2.c.gsskex openssh/auth2.c
---- openssh/auth2.c.gsskex	2017-09-27 13:54:53.539534068 +0200
-+++ openssh/auth2.c	2017-09-27 13:54:53.590534348 +0200
-@@ -72,6 +72,7 @@ extern Authmethod method_passwd;
+--- openssh/auth2.c.gsskex	2018-08-22 11:47:33.260216045 +0200
++++ openssh/auth2.c	2018-08-22 11:47:33.307216424 +0200
+@@ -74,6 +74,7 @@ extern Authmethod method_passwd;
  extern Authmethod method_kbdint;
  extern Authmethod method_hostbased;
  #ifdef GSSAPI
@@ -9,7 +9,7 @@ diff -up openssh/auth2.c.gsskex openssh/auth2.c
  extern Authmethod method_gssapi;
  #endif
  
-@@ -79,6 +80,7 @@ Authmethod *authmethods[] = {
+@@ -81,6 +82,7 @@ Authmethod *authmethods[] = {
  	&method_none,
  	&method_pubkey,
  #ifdef GSSAPI
@@ -18,8 +18,8 @@ diff -up openssh/auth2.c.gsskex openssh/auth2.c
  #endif
  	&method_passwd,
 diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
---- openssh/auth2-gss.c.gsskex	2017-09-27 13:54:53.539534068 +0200
-+++ openssh/auth2-gss.c	2017-09-27 13:54:53.590534348 +0200
+--- openssh/auth2-gss.c.gsskex	2018-08-22 11:47:33.260216045 +0200
++++ openssh/auth2-gss.c	2018-08-22 13:00:48.722680124 +0200
 @@ -31,6 +31,7 @@
  #include <sys/types.h>
  
@@ -27,8 +27,8 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
 +#include <string.h>
  
  #include "xmalloc.h"
- #include "key.h"
-@@ -53,6 +54,41 @@ static int input_gssapi_mic(int type, u_
+ #include "sshkey.h"
+@@ -54,6 +55,41 @@ static int input_gssapi_mic(int type, u_
  static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
  
@@ -40,7 +40,7 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
 +{
 +	Authctxt *authctxt = ssh->authctxt;
 +	int authenticated = 0;
-+	Buffer b;
++	struct sshbuf *b = NULL;
 +	gss_buffer_desc mic, gssbuf;
 +	u_int len;
 +
@@ -49,11 +49,11 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
 +
 +	packet_check_eom();
 +
-+	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
++	ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
 +	    "gssapi-keyex");
 +
-+	gssbuf.value = buffer_ptr(&b);
-+	gssbuf.length = buffer_len(&b);
++	gssbuf.value = sshbuf_mutable_ptr(b);
++	gssbuf.length = sshbuf_len(b);
 +
 +	/* gss_kex_context is NULL with privsep, so we can't check it here */
 +	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, 
@@ -61,7 +61,7 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
 +		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
 +		    authctxt->pw));
 +	
-+	buffer_free(&b);
++	sshbuf_free(b);
 +	free(mic.value);
 +
 +	return (authenticated);
@@ -70,9 +70,9 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -240,7 +275,8 @@ input_gssapi_exchange_complete(int type,
- 
- 	packet_check_eom();
+@@ -260,7 +296,8 @@ input_gssapi_exchange_complete(int type,
+ 	if ((r = sshpkt_get_end(ssh)) != 0)
+ 		fatal("%s: %s", __func__, ssh_err(r));
  
 -	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
 +	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
@@ -80,8 +80,8 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
  
  	if ((!use_privsep || mm_is_monitor()) &&
  	    (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -288,7 +324,8 @@ input_gssapi_mic(int type, u_int32_t ple
- 	gssbuf.length = buffer_len(&b);
+@@ -313,7 +350,8 @@ input_gssapi_mic(int type, u_int32_t ple
+ 	gssbuf.length = sshbuf_len(b);
  
  	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
 -		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
@@ -90,7 +90,7 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
  	else
  		logit("GSSAPI MIC check failed");
  
-@@ -310,6 +347,12 @@ input_gssapi_mic(int type, u_int32_t ple
+@@ -335,6 +373,12 @@ input_gssapi_mic(int type, u_int32_t ple
  	return 0;
  }
  
@@ -104,9 +104,9 @@ diff -up openssh/auth2-gss.c.gsskex openssh/auth2-gss.c
  	"gssapi-with-mic",
  	userauth_gssapi,
 diff -up openssh/auth.c.gsskex openssh/auth.c
---- openssh/auth.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/auth.c	2017-09-27 13:54:53.591534353 +0200
-@@ -395,6 +395,7 @@ auth_root_allowed(const char *method)
+--- openssh/auth.c.gsskex	2018-08-22 11:47:33.274216158 +0200
++++ openssh/auth.c	2018-08-22 11:47:33.308216432 +0200
+@@ -395,6 +395,7 @@ auth_root_allowed(struct ssh *ssh, const
  	case PERMIT_NO_PASSWD:
  		if (strcmp(method, "publickey") == 0 ||
  		    strcmp(method, "hostbased") == 0 ||
@@ -115,8 +115,8 @@ diff -up openssh/auth.c.gsskex openssh/auth.c
  			return 1;
  		break;
 diff -up openssh/clientloop.c.gsskex openssh/clientloop.c
---- openssh/clientloop.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/clientloop.c	2017-09-27 13:54:53.591534353 +0200
+--- openssh/clientloop.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/clientloop.c	2018-08-22 11:47:33.309216441 +0200
 @@ -112,6 +112,10 @@
  #include "ssherr.h"
  #include "hostfile.h"
@@ -128,7 +128,7 @@ diff -up openssh/clientloop.c.gsskex openssh/clientloop.c
  /* import options */
  extern Options options;
  
-@@ -1349,9 +1353,18 @@ client_loop(struct ssh *ssh, int have_pt
+@@ -1357,9 +1361,18 @@ client_loop(struct ssh *ssh, int have_pt
  			break;
  
  		/* Do channel operations unless rekeying in progress. */
@@ -149,9 +149,9 @@ diff -up openssh/clientloop.c.gsskex openssh/clientloop.c
  		client_process_net_input(readset);
  
 diff -up openssh/configure.ac.gsskex openssh/configure.ac
---- openssh/configure.ac.gsskex	2017-09-27 13:54:53.581534298 +0200
-+++ openssh/configure.ac	2017-09-27 13:54:53.592534359 +0200
-@@ -621,6 +621,30 @@ main() { if (NSVersionOfRunTimeLibrary("
+--- openssh/configure.ac.gsskex	2018-08-22 11:47:33.296216335 +0200
++++ openssh/configure.ac	2018-08-22 11:47:33.309216441 +0200
+@@ -673,6 +673,30 @@ main() { if (NSVersionOfRunTimeLibrary("
  	    [Use tunnel device compatibility to OpenBSD])
  	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
  	    [Prepend the address family to IP tunnel traffic])
@@ -183,16 +183,22 @@ diff -up openssh/configure.ac.gsskex openssh/configure.ac
  	AC_CHECK_DECL([AU_IPv4], [],
  	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
 diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
---- openssh/gss-genr.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/gss-genr.c	2017-09-27 13:54:53.592534359 +0200
-@@ -40,12 +40,167 @@
- #include "buffer.h"
+--- openssh/gss-genr.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/gss-genr.c	2018-08-22 13:18:47.444383602 +0200
+@@ -35,18 +35,177 @@
+ #include <string.h>
+ #include <signal.h>
+ #include <unistd.h>
++#include <openssl/evp.h>
+ 
+ #include "xmalloc.h"
+ #include "ssherr.h"
+ #include "sshbuf.h"
  #include "log.h"
  #include "ssh2.h"
 +#include "cipher.h"
-+#include "key.h"
++#include "sshkey.h"
 +#include "kex.h"
-+#include <openssl/evp.h>
  
  #include "ssh-gss.h"
  
@@ -240,9 +246,9 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +char *
 +ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
 +    const char *host, const char *client) {
-+	Buffer buf;
++	struct sshbuf *buf;
 +	size_t i;
-+	int oidpos, enclen;
++	int oidpos, enclen, r;
 +	char *mechs, *encoded;
 +	u_char digest[EVP_MAX_MD_SIZE];
 +	char deroid[2];
@@ -258,7 +264,8 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *
 +	    (gss_supported->count + 1));
 +
-+	buffer_init(&buf);
++	if ((buf = sshbuf_new()) == NULL)
++		fatal("%s: sshbuf_new failed", __func__);
 +
 +	oidpos = 0;
 +	for (i = 0; i < gss_supported->count; i++) {
@@ -280,19 +287,21 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +			    encoded, EVP_MD_size(evp_md) * 2);
 +
 +			if (oidpos != 0)
-+				buffer_put_char(&buf, ',');
++				if ((r = sshbuf_put_u8(buf, ',')) != 0)
++					fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+			buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,
-+			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1);
-+			buffer_append(&buf, encoded, enclen);
-+			buffer_put_char(&buf, ',');
-+			buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 
-+			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1);
-+			buffer_append(&buf, encoded, enclen);
-+			buffer_put_char(&buf, ',');
-+			buffer_append(&buf, KEX_GSS_GRP14_SHA1_ID,
-+			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1);
-+			buffer_append(&buf, encoded, enclen);
++			if ((r = sshbuf_put(buf, KEX_GSS_GEX_SHA1_ID,
++			    sizeof(KEX_GSS_GEX_SHA1_ID) - 1)) != 0 ||
++			    (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
++			    (r = sshbuf_put_u8(buf, ',')) != 0 ||
++			    (r = sshbuf_put(buf, KEX_GSS_GRP1_SHA1_ID, 
++			    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1)) != 0 ||
++			    (r = sshbuf_put(buf, encoded, enclen)) != 0 ||
++			    (r = sshbuf_put_u8(buf, ',')) != 0 ||
++			    (r = sshbuf_put(buf, KEX_GSS_GRP14_SHA1_ID,
++			    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1)) != 0 ||
++			    (r = sshbuf_put(buf, encoded, enclen)) != 0)
++		 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
 +			gss_enc2oid[oidpos].encoded = encoded;
@@ -302,17 +311,18 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +	gss_enc2oid[oidpos].oid = NULL;
 +	gss_enc2oid[oidpos].encoded = NULL;
 +
-+	buffer_put_char(&buf, '\0');
++	if ((r = sshbuf_put_u8(buf, '\0')) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mechs = xmalloc(buffer_len(&buf));
-+	buffer_get(&buf, mechs, buffer_len(&buf));
-+	buffer_free(&buf);
++	mechs = xmalloc(sshbuf_len(buf));
++	sshbuf_get(buf, mechs, sshbuf_len(buf));
++	sshbuf_free(buf);
 +
 +	if (strlen(mechs) == 0) {
 +		free(mechs);
 +		mechs = NULL;
 +	}
-+	
++
 +	return (mechs);
 +}
 +
@@ -350,10 +360,10 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +	return gss_enc2oid[i].oid;
 +}
 +
- /* Check that the OID in a data stream matches that in the context */
+ /* sshbuf_get for gss_buffer_desc */
  int
- ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)
-@@ -198,7 +353,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int de
+ ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)
+@@ -218,7 +373,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int de
  	}
  
  	ctx->major = gss_init_sec_context(&ctx->minor,
@@ -362,7 +372,7 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
  	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,
  	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);
  
-@@ -228,8 +383,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, con
+@@ -248,8 +403,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, con
  }
  
  OM_uint32
@@ -405,7 +415,7 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
  	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,
  	    GSS_C_QOP_DEFAULT, buffer, hash)))
  		ssh_gssapi_error(ctx);
-@@ -237,6 +426,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer
+@@ -257,6 +446,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer
  	return (ctx->major);
  }
  
@@ -423,9 +433,9 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +}
 +
  void
- ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
+ ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,
      const char *context)
-@@ -250,11 +452,16 @@ ssh_gssapi_buildmic(Buffer *b, const cha
+@@ -273,11 +475,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, co
  }
  
  int
@@ -443,7 +453,7 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
  
  	/* RFC 4462 says we MUST NOT do SPNEGO */
  	if (oid->length == spnego_oid.length && 
-@@ -264,6 +471,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
+@@ -287,6 +494,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  	ssh_gssapi_build_ctx(ctx);
  	ssh_gssapi_set_oid(*ctx, oid);
  	major = ssh_gssapi_import_name(*ctx, host);
@@ -454,7 +464,7 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
  	if (!GSS_ERROR(major)) {
  		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
  		    NULL);
-@@ -273,10 +484,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
+@@ -296,10 +507,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  			    GSS_C_NO_BUFFER);
  	}
  
@@ -523,9 +533,9 @@ diff -up openssh/gss-genr.c.gsskex openssh/gss-genr.c
 +
  #endif /* GSSAPI */
 diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
---- openssh/gss-serv.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/gss-serv.c	2017-09-27 13:54:53.592534359 +0200
-@@ -45,17 +45,19 @@
+--- openssh/gss-serv.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/gss-serv.c	2018-08-22 11:47:33.310216448 +0200
+@@ -44,17 +44,19 @@
  #include "session.h"
  #include "misc.h"
  #include "servconf.h"
@@ -548,7 +558,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  
  #ifdef KRB5
  extern ssh_gssapi_mech gssapi_kerberos_mech;
-@@ -142,6 +144,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss
+@@ -141,6 +143,28 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss
  }
  
  /* Unprivileged */
@@ -577,7 +587,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  void
  ssh_gssapi_supported_oids(gss_OID_set *oidset)
  {
-@@ -151,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *o
+@@ -150,7 +174,9 @@ ssh_gssapi_supported_oids(gss_OID_set *o
  	gss_OID_set supported;
  
  	gss_create_empty_oid_set(&min_status, oidset);
@@ -588,7 +598,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  
  	while (supported_mechs[i]->name != NULL) {
  		if (GSS_ERROR(gss_test_oid_set_member(&min_status,
-@@ -277,8 +303,48 @@ OM_uint32
+@@ -276,8 +302,48 @@ OM_uint32
  ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
  {
  	int i = 0;
@@ -638,7 +648,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  
  	client->mech = NULL;
  
-@@ -293,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
+@@ -292,6 +358,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  	if (client->mech == NULL)
  		return GSS_S_FAILURE;
  
@@ -652,7 +662,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  	if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,
  	    &client->displayname, NULL))) {
  		ssh_gssapi_error(ctx);
-@@ -310,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
+@@ -309,6 +382,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  		return (ctx->major);
  	}
  
@@ -661,7 +671,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  	/* We can't copy this structure, so we just move the pointer to it */
  	client->creds = ctx->client_creds;
  	ctx->client_creds = GSS_C_NO_CREDENTIAL;
-@@ -320,11 +395,20 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
+@@ -319,11 +394,20 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  void
  ssh_gssapi_cleanup_creds(void)
  {
@@ -687,7 +697,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  	}
  }
  
-@@ -357,7 +441,7 @@ ssh_gssapi_do_child(char ***envp, u_int
+@@ -356,7 +440,7 @@ ssh_gssapi_do_child(char ***envp, u_int
  
  /* Privileged */
  int
@@ -696,7 +706,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  {
  	OM_uint32 lmin;
  
-@@ -367,9 +451,11 @@ ssh_gssapi_userok(char *user)
+@@ -366,9 +450,11 @@ ssh_gssapi_userok(char *user)
  		return 0;
  	}
  	if (gssapi_client.mech && gssapi_client.mech->userok)
@@ -710,7 +720,7 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  			/* Destroy delegated credentials if userok fails */
  			gss_release_buffer(&lmin, &gssapi_client.displayname);
  			gss_release_buffer(&lmin, &gssapi_client.exportedname);
-@@ -383,14 +469,89 @@ ssh_gssapi_userok(char *user)
+@@ -382,14 +468,89 @@ ssh_gssapi_userok(char *user)
  	return (0);
  }
  
@@ -807,9 +817,9 @@ diff -up openssh/gss-serv.c.gsskex openssh/gss-serv.c
  
  /* Privileged */
 diff -up openssh/gss-serv-krb5.c.gsskex openssh/gss-serv-krb5.c
---- openssh/gss-serv-krb5.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/gss-serv-krb5.c	2017-09-27 13:54:53.593534364 +0200
-@@ -121,7 +121,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+--- openssh/gss-serv-krb5.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/gss-serv-krb5.c	2018-08-22 11:47:33.311216457 +0200
+@@ -120,7 +120,7 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  	krb5_error_code problem;
  	krb5_principal princ;
  	OM_uint32 maj_status, min_status;
@@ -818,7 +828,7 @@ diff -up openssh/gss-serv-krb5.c.gsskex openssh/gss-serv-krb5.c
  	const char *errmsg;
  
  	if (client->creds == NULL) {
-@@ -181,11 +181,23 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -180,11 +180,23 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  		return;
  	}
  
@@ -846,7 +856,7 @@ diff -up openssh/gss-serv-krb5.c.gsskex openssh/gss-serv-krb5.c
  
  #ifdef USE_PAM
  	if (options.use_pam)
-@@ -194,9 +209,76 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
+@@ -193,9 +205,76 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_cl
  
  	krb5_cc_close(krb_context, ccache);
  
@@ -923,7 +933,7 @@ diff -up openssh/gss-serv-krb5.c.gsskex openssh/gss-serv-krb5.c
  ssh_gssapi_mech gssapi_kerberos_mech = {
  	"toWM5Slw5Ew8Mqkay+al2g==",
  	"Kerberos",
-@@ -204,7 +286,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
+@@ -203,7 +282,8 @@ ssh_gssapi_mech gssapi_kerberos_mech = {
  	NULL,
  	&ssh_gssapi_krb5_userok,
  	NULL,
@@ -934,8 +944,8 @@ diff -up openssh/gss-serv-krb5.c.gsskex openssh/gss-serv-krb5.c
  
  #endif /* KRB5 */
 diff -up openssh/kex.c.gsskex openssh/kex.c
---- openssh/kex.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/kex.c	2017-09-27 13:54:53.593534364 +0200
+--- openssh/kex.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/kex.c	2018-08-22 11:47:33.311216457 +0200
 @@ -54,6 +54,10 @@
  #include "sshbuf.h"
  #include "digest.h"
@@ -973,8 +983,8 @@ diff -up openssh/kex.c.gsskex openssh/kex.c
  	return NULL;
  }
 diff -up openssh/kexgssc.c.gsskex openssh/kexgssc.c
---- openssh/kexgssc.c.gsskex	2017-09-27 13:54:53.593534364 +0200
-+++ openssh/kexgssc.c	2017-09-27 13:54:53.593534364 +0200
+--- openssh/kexgssc.c.gsskex	2018-08-22 11:47:33.311216457 +0200
++++ openssh/kexgssc.c	2018-08-22 11:47:33.311216457 +0200
 @@ -0,0 +1,338 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1012,9 +1022,9 @@ diff -up openssh/kexgssc.c.gsskex openssh/kexgssc.c
 +#include <string.h>
 +
 +#include "xmalloc.h"
-+#include "buffer.h"
++#include "sshbuf.h"
 +#include "ssh2.h"
-+#include "key.h"
++#include "sshkey.h"
 +#include "cipher.h"
 +#include "kex.h"
 +#include "log.h"
@@ -1250,8 +1260,8 @@ diff -up openssh/kexgssc.c.gsskex openssh/kexgssc.c
 +	case KEX_GSS_GRP14_SHA1:
 +		kex_dh_hash(ssh->kex->hash_alg, ssh->kex->client_version_string, 
 +		    ssh->kex->server_version_string,
-+		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
-+		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
++		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
++		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
 +		    (serverhostkey ? serverhostkey : empty), slen,
 +		    dh->pub_key,	/* e */
 +		    dh_server_pub,	/* f */
@@ -1264,8 +1274,8 @@ diff -up openssh/kexgssc.c.gsskex openssh/kexgssc.c
 +		    ssh->kex->hash_alg,
 +		    ssh->kex->client_version_string,
 +		    ssh->kex->server_version_string,
-+		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
-+		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
++		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
++		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
 +		    (serverhostkey ? serverhostkey : empty), slen,
 + 		    min, nbits, max,
 +		    dh->p, dh->g,
@@ -1315,8 +1325,8 @@ diff -up openssh/kexgssc.c.gsskex openssh/kexgssc.c
 +
 +#endif /* GSSAPI */
 diff -up openssh/kexgsss.c.gsskex openssh/kexgsss.c
---- openssh/kexgsss.c.gsskex	2017-09-27 13:54:53.593534364 +0200
-+++ openssh/kexgsss.c	2017-09-27 13:54:53.593534364 +0200
+--- openssh/kexgsss.c.gsskex	2018-08-22 11:47:33.311216457 +0200
++++ openssh/kexgsss.c	2018-08-22 11:47:33.311216457 +0200
 @@ -0,0 +1,297 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1352,9 +1362,9 @@ diff -up openssh/kexgsss.c.gsskex openssh/kexgsss.c
 +#include <openssl/bn.h>
 +
 +#include "xmalloc.h"
-+#include "buffer.h"
++#include "sshbuf.h"
 +#include "ssh2.h"
-+#include "key.h"
++#include "sshkey.h"
 +#include "cipher.h"
 +#include "kex.h"
 +#include "log.h"
@@ -1542,8 +1552,8 @@ diff -up openssh/kexgsss.c.gsskex openssh/kexgsss.c
 +	case KEX_GSS_GRP14_SHA1:
 +		kex_dh_hash(ssh->kex->hash_alg,
 +		    ssh->kex->client_version_string, ssh->kex->server_version_string,
-+		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
-+		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
++		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
++		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
 +		    NULL, 0, /* Change this if we start sending host keys */
 +		    dh_client_pub, dh->pub_key, shared_secret,
 +		    hash, &hashlen
@@ -1553,8 +1563,8 @@ diff -up openssh/kexgsss.c.gsskex openssh/kexgsss.c
 +		kexgex_hash(
 +		    ssh->kex->hash_alg,
 +		    ssh->kex->client_version_string, ssh->kex->server_version_string,
-+		    buffer_ptr(ssh->kex->peer), buffer_len(ssh->kex->peer),
-+		    buffer_ptr(ssh->kex->my), buffer_len(ssh->kex->my),
++		    sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
++		    sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
 +		    NULL, 0,
 +		    cmin, nbits, cmax,
 +		    dh->p, dh->g,
@@ -1616,9 +1626,9 @@ diff -up openssh/kexgsss.c.gsskex openssh/kexgsss.c
 +}
 +#endif /* GSSAPI */
 diff -up openssh/kex.h.gsskex openssh/kex.h
---- openssh/kex.h.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/kex.h	2017-09-27 13:54:53.593534364 +0200
-@@ -99,6 +99,11 @@ enum kex_exchange {
+--- openssh/kex.h.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/kex.h	2018-08-22 11:47:33.311216457 +0200
+@@ -100,6 +100,11 @@ enum kex_exchange {
  	KEX_DH_GEX_SHA256,
  	KEX_ECDH_SHA2,
  	KEX_C25519_SHA256,
@@ -1630,7 +1640,7 @@ diff -up openssh/kex.h.gsskex openssh/kex.h
  	KEX_MAX
  };
  
-@@ -147,6 +152,12 @@ struct kex {
+@@ -148,6 +153,12 @@ struct kex {
  	u_int	flags;
  	int	hash_alg;
  	int	ec_nid;
@@ -1643,7 +1653,7 @@ diff -up openssh/kex.h.gsskex openssh/kex.h
  	char	*client_version_string;
  	char	*server_version_string;
  	char	*failed_choice;
-@@ -196,6 +207,10 @@ int	 kexecdh_client(struct ssh *);
+@@ -197,6 +208,10 @@ int	 kexecdh_client(struct ssh *);
  int	 kexecdh_server(struct ssh *);
  int	 kexc25519_client(struct ssh *);
  int	 kexc25519_server(struct ssh *);
@@ -1655,18 +1665,18 @@ diff -up openssh/kex.h.gsskex openssh/kex.h
  int	 kex_dh_hash(int, const char *, const char *,
      const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
 diff -up openssh/Makefile.in.gsskex openssh/Makefile.in
---- openssh/Makefile.in.gsskex	2017-09-27 13:54:53.588534337 +0200
-+++ openssh/Makefile.in	2017-09-27 13:54:53.594534370 +0200
-@@ -91,6 +91,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+--- openssh/Makefile.in.gsskex	2018-08-22 11:47:33.312216465 +0200
++++ openssh/Makefile.in	2018-08-22 13:19:54.955928277 +0200
+@@ -100,6 +100,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
  	readpass.o ttymodes.o xmalloc.o addrmatch.o \
- 	atomicio.o key.o dispatch.o mac.o uidswap.o uuencode.o misc.o utf8.o \
+ 	atomicio.o dispatch.o mac.o uuencode.o misc.o utf8.o \
  	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
 +	kexgssc.o \
  	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
  	ssh-pkcs11.o smult_curve25519_ref.o \
  	poly1305.o chacha.o cipher-chachapoly.o \
-@@ -112,7 +113,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
- 	auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
+@@ -121,7 +122,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+ 	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
  	auth2-none.o auth2-passwd.o auth2-pubkey.o \
  	monitor.o monitor_wrap.o auth-krb5.o \
 -	auth2-gss.o gss-serv.o gss-serv-krb5.o \
@@ -1675,18 +1685,18 @@ diff -up openssh/Makefile.in.gsskex openssh/Makefile.in
  	sftp-server.o sftp-common.o \
  	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
 diff -up openssh/monitor.c.gsskex openssh/monitor.c
---- openssh/monitor.c.gsskex	2017-09-27 13:54:53.541534079 +0200
-+++ openssh/monitor.c	2017-09-27 13:54:53.594534370 +0200
-@@ -160,6 +160,8 @@ int mm_answer_gss_setup_ctx(int, Buffer
- int mm_answer_gss_accept_ctx(int, Buffer *);
- int mm_answer_gss_userok(int, Buffer *);
- int mm_answer_gss_checkmic(int, Buffer *);
-+int mm_answer_gss_sign(int, Buffer *);
-+int mm_answer_gss_updatecreds(int, Buffer *);
+--- openssh/monitor.c.gsskex	2018-08-22 11:47:33.263216069 +0200
++++ openssh/monitor.c	2018-08-22 13:22:19.589095240 +0200
+@@ -146,6 +146,8 @@ int mm_answer_gss_setup_ctx(int, struct
+ int mm_answer_gss_accept_ctx(int, struct sshbuf *);
+ int mm_answer_gss_userok(int, struct sshbuf *);
+ int mm_answer_gss_checkmic(int, struct sshbuf *);
++int mm_answer_gss_sign(int, struct sshbuf *);
++int mm_answer_gss_updatecreds(int, struct sshbuf *);
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -236,11 +238,18 @@ struct mon_table mon_dispatch_proto20[]
+@@ -219,11 +221,18 @@ struct mon_table mon_dispatch_proto20[]
      {MONITOR_REQ_GSSSTEP, 0, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_ONCE|MON_AUTHDECIDE, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ONCE, mm_answer_gss_checkmic},
@@ -1705,7 +1715,7 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
  #ifdef WITH_OPENSSL
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
  #endif
-@@ -308,6 +317,10 @@ monitor_child_preauth(Authctxt *_authctx
+@@ -293,6 +302,10 @@ monitor_child_preauth(Authctxt *_authctx
  	/* Permit requests for moduli and signatures */
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -1716,7 +1726,7 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
  
  	/* The first few requests do not require asynchronous access */
  	while (!authenticated) {
-@@ -414,6 +427,10 @@ monitor_child_postauth(struct monitor *p
+@@ -405,6 +418,10 @@ monitor_child_postauth(struct monitor *p
  	monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
  	monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -1727,7 +1737,7 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
  
  	if (auth_opts->permit_pty_flag) {
  		monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-@@ -1656,6 +1673,13 @@ monitor_apply_keystate(struct monitor *p
+@@ -1695,6 +1712,13 @@ monitor_apply_keystate(struct monitor *p
  # endif
  #endif /* WITH_OPENSSL */
  		kex->kex[KEX_C25519_SHA256] = kexc25519_server;
@@ -1741,25 +1751,25 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
  		kex->load_host_public_key=&get_hostkey_public_by_type;
  		kex->load_host_private_key=&get_hostkey_private_by_type;
  		kex->host_key_index=&get_hostkey_index;
-@@ -1744,7 +1768,7 @@ mm_answer_gss_setup_ctx(int sock, Buffer
- 	OM_uint32 major;
- 	u_int len;
+@@ -1785,7 +1809,7 @@ mm_answer_gss_setup_ctx(int sock, struct
+ 	u_char *p;
+ 	int r;
  
 -	if (!options.gss_authentication)
 +	if (!options.gss_authentication && !options.gss_keyex)
  		fatal("%s: GSSAPI authentication not enabled", __func__);
  
- 	goid.elements = buffer_get_string(m, &len);
-@@ -1774,7 +1798,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+ 	if ((r = sshbuf_get_string(m, &p, &len)) != 0)
+@@ -1818,7 +1842,7 @@ mm_answer_gss_accept_ctx(int sock, struc
  	OM_uint32 flags = 0; /* GSI needs this */
- 	u_int len;
+ 	int r;
  
 -	if (!options.gss_authentication)
 +	if (!options.gss_authentication && !options.gss_keyex)
  		fatal("%s: GSSAPI authentication not enabled", __func__);
  
- 	in.value = buffer_get_string(m, &len);
-@@ -1794,6 +1818,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+ 	if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0)
+@@ -1839,6 +1863,7 @@ mm_answer_gss_accept_ctx(int sock, struc
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
  		monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -1767,17 +1777,17 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
  	}
  	return (0);
  }
-@@ -1805,7 +1830,7 @@ mm_answer_gss_checkmic(int sock, Buffer
+@@ -1850,7 +1875,7 @@ mm_answer_gss_checkmic(int sock, struct
  	OM_uint32 ret;
- 	u_int len;
+ 	int r;
  
 -	if (!options.gss_authentication)
 +	if (!options.gss_authentication && !options.gss_keyex)
  		fatal("%s: GSSAPI authentication not enabled", __func__);
  
- 	gssbuf.value = buffer_get_string(m, &len);
-@@ -1835,10 +1860,11 @@ mm_answer_gss_userok(int sock, Buffer *m
- 	int authenticated;
+ 	if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 ||
+@@ -1880,10 +1905,11 @@ mm_answer_gss_userok(int sock, struct ss
+ 	int r, authenticated;
  	const char *displayname;
  
 -	if (!options.gss_authentication)
@@ -1788,26 +1798,26 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
 +	authenticated = authctxt->valid &&
 +	    ssh_gssapi_userok(authctxt->user, authctxt->pw);
  
- 	buffer_clear(m);
- 	buffer_put_int(m, authenticated);
-@@ -1854,5 +1880,71 @@ mm_answer_gss_userok(int sock, Buffer *m
+ 	sshbuf_reset(m);
+ 	if ((r = sshbuf_put_u32(m, authenticated)) != 0)
+@@ -1900,5 +1926,74 @@ mm_answer_gss_userok(int sock, struct ss
  	/* Monitor loop will terminate if authenticated */
  	return (authenticated);
  }
 +
 +int 
-+mm_answer_gss_sign(int socket, Buffer *m)
++mm_answer_gss_sign(int socket, struct sshbuf *m)
 +{
 +	gss_buffer_desc data;
 +	gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
 +	OM_uint32 major, minor;
-+	u_int len;
++	int r;
 +
 +	if (!options.gss_authentication && !options.gss_keyex)
 +		fatal("In GSSAPI monitor when GSSAPI is disabled");
 +
-+	data.value = buffer_get_string(m, &len);
-+	data.length = len;
++	if ((r = sshbuf_get_string(m, (u_char **)&data.value, &data.length)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +	if (data.length != 20) 
 +		fatal("%s: data length incorrect: %d", __func__, 
 +		    (int) data.length);
@@ -1822,9 +1832,10 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
 +
 +	free(data.value);
 +
-+	buffer_clear(m);
-+	buffer_put_int(m, major);
-+	buffer_put_string(m, hash.value, hash.length);
++	sshbuf_reset(m);
++	if ((r = sshbuf_put_u32(m, major)) != 0 ||
++	    (r = sshbuf_put_string(m, hash.value, hash.length)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +	mm_request_send(socket, MONITOR_ANS_GSSSIGN, m);
 +
@@ -1840,20 +1851,22 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
 +}
 +
 +int
-+mm_answer_gss_updatecreds(int socket, Buffer *m) {
++mm_answer_gss_updatecreds(int socket, struct sshbuf *m) {
 +	ssh_gssapi_ccache store;
-+	int ok;
++	int ok, r;
 +
-+	store.envvar   = buffer_get_string(m, NULL);
-+	store.envval   = buffer_get_string(m, NULL);
++	if ((r = sshbuf_get_cstring(m, &store.envvar, NULL)) != 0 ||
++	    (r = sshbuf_get_cstring(m, &store.envval, NULL)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +	ok = ssh_gssapi_update_creds(&store);
 +
 +	free(store.envvar);
 +	free(store.envval);
 +
-+	buffer_clear(m);
-+	buffer_put_int(m, ok);
++	sshbuf_reset(m);
++	if ((r = sshbuf_put_u32(m, ok)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
 +	mm_request_send(socket, MONITOR_ANS_GSSUPCREDS, m);
 +
@@ -1863,9 +1876,9 @@ diff -up openssh/monitor.c.gsskex openssh/monitor.c
  #endif /* GSSAPI */
  
 diff -up openssh/monitor.h.gsskex openssh/monitor.h
---- openssh/monitor.h.gsskex	2017-09-27 13:54:53.541534079 +0200
-+++ openssh/monitor.h	2017-09-27 13:54:53.594534370 +0200
-@@ -60,6 +60,8 @@ enum monitor_reqtype {
+--- openssh/monitor.h.gsskex	2018-08-22 11:47:33.263216069 +0200
++++ openssh/monitor.h	2018-08-22 11:47:33.313216473 +0200
+@@ -58,6 +58,8 @@ enum monitor_reqtype {
  #ifdef WITH_SELINUX
  	MONITOR_REQ_AUTHROLE = 80,
  #endif
@@ -1875,18 +1888,18 @@ diff -up openssh/monitor.h.gsskex openssh/monitor.h
  	MONITOR_REQ_PAM_START = 100,
  	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
 diff -up openssh/monitor_wrap.c.gsskex openssh/monitor_wrap.c
---- openssh/monitor_wrap.c.gsskex	2017-09-27 13:54:53.542534084 +0200
-+++ openssh/monitor_wrap.c	2017-09-27 13:54:53.595534375 +0200
-@@ -950,7 +950,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
+--- openssh/monitor_wrap.c.gsskex	2018-08-22 11:47:33.313216473 +0200
++++ openssh/monitor_wrap.c	2018-08-22 13:27:38.665669643 +0200
+@@ -1004,7 +1004,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
  }
  
  int
 -mm_ssh_gssapi_userok(char *user)
 +mm_ssh_gssapi_userok(char *user, struct passwd *pw)
  {
- 	Buffer m;
- 	int authenticated = 0;
-@@ -967,5 +967,49 @@ mm_ssh_gssapi_userok(char *user)
+ 	struct sshbuf *m;
+ 	int r, authenticated = 0;
+@@ -1023,4 +1023,52 @@ mm_ssh_gssapi_userok(char *user)
  	debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
  	return (authenticated);
  }
@@ -1894,21 +1907,23 @@ diff -up openssh/monitor_wrap.c.gsskex openssh/monitor_wrap.c
 +OM_uint32
 +mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
 +{
-+	Buffer m;
++	struct sshbuf *m;
 +	OM_uint32 major;
-+	u_int len;
++	int r;
 +
-+	buffer_init(&m);
-+	buffer_put_string(&m, data->value, data->length);
++	if ((m = sshbuf_new()) == NULL)
++		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_string(m, data->value, data->length)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, m);
++	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, m);
 +
-+	major = buffer_get_int(&m);
-+	hash->value = buffer_get_string(&m, &len);
-+	hash->length = len;
++	if ((r = sshbuf_get_u32(m, &major)) != 0 ||
++	    (r = sshbuf_get_string(m, (u_char **)&hash->value, &hash->length)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	buffer_free(&m);
++	sshbuf_free(m);
 +
 +	return(major);
 +}
@@ -1916,30 +1931,31 @@ diff -up openssh/monitor_wrap.c.gsskex openssh/monitor_wrap.c
 +int
 +mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
 +{
-+	Buffer m;
-+	int ok;
++	struct sshbuf *m;
++	int ok, r;
 +
-+	buffer_init(&m);
++	if ((m = sshbuf_new()) == NULL)
++		fatal("%s: sshbuf_new failed", __func__);
 +
-+	buffer_put_cstring(&m, store->envvar ? store->envvar : "");
-+	buffer_put_cstring(&m, store->envval ? store->envval : "");
++	if ((r = sshbuf_put_cstring(m, store->envvar ? store->envvar : "")) != 0 ||
++	    (r = sshbuf_put_cstring(m, store->envval ? store->envval : "")) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, &m);
-+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, &m);
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUPCREDS, m);
++	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUPCREDS, m);
 +
-+	ok = buffer_get_int(&m);
++	if ((r = sshbuf_get_u32(m, &ok)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 +
-+	buffer_free(&m);
++	sshbuf_free(m);
 +
 +	return (ok);
 +}
-+
  #endif /* GSSAPI */
- 
 diff -up openssh/monitor_wrap.h.gsskex openssh/monitor_wrap.h
---- openssh/monitor_wrap.h.gsskex	2017-09-27 13:54:53.542534084 +0200
-+++ openssh/monitor_wrap.h	2017-09-27 13:54:53.595534375 +0200
-@@ -60,8 +60,10 @@ int mm_sshkey_verify(const struct sshkey
+--- openssh/monitor_wrap.h.gsskex	2018-08-22 11:47:33.263216069 +0200
++++ openssh/monitor_wrap.h	2018-08-22 11:47:33.313216473 +0200
+@@ -63,8 +63,10 @@ int mm_sshkey_verify(const struct sshkey
  OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
  OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
     gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
@@ -1952,18 +1968,18 @@ diff -up openssh/monitor_wrap.h.gsskex openssh/monitor_wrap.h
  
  #ifdef USE_PAM
 diff -up openssh/readconf.c.gsskex openssh/readconf.c
---- openssh/readconf.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/readconf.c	2017-09-27 13:54:53.596534381 +0200
-@@ -160,6 +160,8 @@ typedef enum {
+--- openssh/readconf.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/readconf.c	2018-08-22 13:28:17.487982869 +0200
+@@ -161,6 +161,8 @@ typedef enum {
  	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
  	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
  	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 +	oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
 +	oGssServerIdentity, 
  	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- 	oSendEnv, oControlPath, oControlMaster, oControlPersist,
+ 	oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
  	oHashKnownHosts,
-@@ -199,10 +201,19 @@ static struct {
+@@ -201,10 +203,19 @@ static struct {
  	/* Sometimes-unsupported options */
  #if defined(GSSAPI)
  	{ "gssapiauthentication", oGssAuthentication },
@@ -1983,7 +1999,7 @@ diff -up openssh/readconf.c.gsskex openssh/readconf.c
  #endif
  #ifdef ENABLE_PKCS11
  	{ "smartcarddevice", oPKCS11Provider },
-@@ -976,10 +987,30 @@ parse_time:
+@@ -973,10 +984,30 @@ parse_time:
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2014,7 +2030,7 @@ diff -up openssh/readconf.c.gsskex openssh/readconf.c
  	case oBatchMode:
  		intptr = &options->batch_mode;
  		goto parse_flag;
-@@ -1790,7 +1821,12 @@ initialize_options(Options * options)
+@@ -1817,7 +1848,12 @@ initialize_options(Options * options)
  	options->pubkey_authentication = -1;
  	options->challenge_response_authentication = -1;
  	options->gss_authentication = -1;
@@ -2027,7 +2043,7 @@ diff -up openssh/readconf.c.gsskex openssh/readconf.c
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
-@@ -1930,8 +1966,14 @@ fill_default_options(Options * options)
+@@ -1962,8 +1998,14 @@ fill_default_options(Options * options)
  		options->challenge_response_authentication = 1;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -2043,9 +2059,9 @@ diff -up openssh/readconf.c.gsskex openssh/readconf.c
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
 diff -up openssh/readconf.h.gsskex openssh/readconf.h
---- openssh/readconf.h.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/readconf.h	2017-09-27 13:54:53.596534381 +0200
-@@ -42,7 +42,12 @@ typedef struct {
+--- openssh/readconf.h.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/readconf.h	2018-08-22 11:47:33.314216481 +0200
+@@ -40,7 +40,12 @@ typedef struct {
  	int     challenge_response_authentication;
  					/* Try S/Key or TIS, authentication. */
  	int     gss_authentication;	/* Try GSS authentication */
@@ -2059,9 +2075,9 @@ diff -up openssh/readconf.h.gsskex openssh/readconf.h
  						 * authentication. */
  	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
 diff -up openssh/regress/cert-hostkey.sh.gsskex openssh/regress/cert-hostkey.sh
---- openssh/regress/cert-hostkey.sh.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/regress/cert-hostkey.sh	2017-09-27 13:54:53.596534381 +0200
-@@ -59,7 +59,7 @@ touch $OBJ/host_revoked_plain
+--- openssh/regress/cert-hostkey.sh.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/regress/cert-hostkey.sh	2018-08-22 11:47:33.314216481 +0200
+@@ -66,7 +66,7 @@ touch $OBJ/host_revoked_plain
  touch $OBJ/host_revoked_cert
  cat $OBJ/host_ca_key.pub $OBJ/host_ca_key2.pub > $OBJ/host_revoked_ca
  
@@ -2071,8 +2087,8 @@ diff -up openssh/regress/cert-hostkey.sh.gsskex openssh/regress/cert-hostkey.sh
  if echo "$PLAIN_TYPES" | grep '^rsa$' >/dev/null 2>&1 ; then
  	PLAIN_TYPES="$PLAIN_TYPES rsa-sha2-256 rsa-sha2-512"
 diff -up openssh/regress/cert-userkey.sh.gsskex openssh/regress/cert-userkey.sh
---- openssh/regress/cert-userkey.sh.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/regress/cert-userkey.sh	2017-09-27 13:54:53.596534381 +0200
+--- openssh/regress/cert-userkey.sh.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/regress/cert-userkey.sh	2018-08-22 11:47:33.314216481 +0200
 @@ -7,7 +7,7 @@ rm -f $OBJ/authorized_keys_$USER $OBJ/us
  cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
  cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
@@ -2082,10 +2098,9 @@ diff -up openssh/regress/cert-userkey.sh.gsskex openssh/regress/cert-userkey.sh
  EXTRA_TYPES=""
  
  if echo "$PLAIN_TYPES" | grep '^rsa$' >/dev/null 2>&1 ; then
- 	PLAIN_TYPES="$PLAIN_TYPES rsa-sha2-256 rsa-sha2-512"
 diff -up openssh/regress/kextype.sh.gsskex openssh/regress/kextype.sh
---- openssh/regress/kextype.sh.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/regress/kextype.sh	2017-09-27 13:54:53.596534381 +0200
+--- openssh/regress/kextype.sh.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/regress/kextype.sh	2018-08-22 11:47:33.315216489 +0200
 @@ -14,6 +14,9 @@ echo "KexAlgorithms=$KEXOPT" >> $OBJ/ssh
  
  tries="1 2 3 4"
@@ -2097,8 +2112,8 @@ diff -up openssh/regress/kextype.sh.gsskex openssh/regress/kextype.sh
  	for i in $tries; do
  		${SSH} -F $OBJ/ssh_proxy -o KexAlgorithms=$k x true
 diff -up openssh/regress/rekey.sh.gsskex openssh/regress/rekey.sh
---- openssh/regress/rekey.sh.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/regress/rekey.sh	2017-09-27 13:54:53.596534381 +0200
+--- openssh/regress/rekey.sh.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/regress/rekey.sh	2018-08-22 11:47:33.315216489 +0200
 @@ -38,6 +38,9 @@ increase_datafile_size 300
  
  opts=""
@@ -2120,9 +2135,9 @@ diff -up openssh/regress/rekey.sh.gsskex openssh/regress/rekey.sh
  	ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c
      done
 diff -up openssh/servconf.c.gsskex openssh/servconf.c
---- openssh/servconf.c.gsskex	2017-09-27 13:54:53.581534298 +0200
-+++ openssh/servconf.c	2017-09-27 13:54:53.597534386 +0200
-@@ -113,8 +113,10 @@ initialize_server_options(ServerOptions
+--- openssh/servconf.c.gsskex	2018-08-22 11:47:33.296216335 +0200
++++ openssh/servconf.c	2018-08-22 13:28:41.905179879 +0200
+@@ -124,8 +124,10 @@ initialize_server_options(ServerOptions
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
  	options->gss_authentication=-1;
@@ -2133,7 +2148,7 @@ diff -up openssh/servconf.c.gsskex openssh/servconf.c
  	options->password_authentication = -1;
  	options->kbd_interactive_authentication = -1;
  	options->challenge_response_authentication = -1;
-@@ -269,10 +271,14 @@ fill_default_server_options(ServerOption
+@@ -334,10 +336,14 @@ fill_default_server_options(ServerOption
  		options->kerberos_get_afs_token = 0;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
@@ -2148,16 +2163,16 @@ diff -up openssh/servconf.c.gsskex openssh/servconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -413,7 +419,7 @@ typedef enum {
+@@ -484,7 +490,7 @@ typedef enum {
  	sHostKeyAlgorithms,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
--	sAcceptEnv, sPermitTunnel,
-+	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+-	sAcceptEnv, sSetEnv, sPermitTunnel,
++	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sSetEnv, sPermitTunnel,
+ 	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
  	sHostCertificate,
-@@ -488,11 +494,17 @@ static struct {
+@@ -559,11 +565,17 @@ static struct {
  	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
  	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
@@ -2175,7 +2190,7 @@ diff -up openssh/servconf.c.gsskex openssh/servconf.c
  	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
  	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
  	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1257,6 +1269,10 @@ process_server_config_line(ServerOptions
+@@ -1463,6 +1475,10 @@ process_server_config_line(ServerOptions
  		intptr = &options->gss_authentication;
  		goto parse_flag;
  
@@ -2186,7 +2201,7 @@ diff -up openssh/servconf.c.gsskex openssh/servconf.c
  	case sGssCleanupCreds:
  		intptr = &options->gss_cleanup_creds;
  		goto parse_flag;
-@@ -1265,6 +1281,10 @@ process_server_config_line(ServerOptions
+@@ -1471,6 +1487,10 @@ process_server_config_line(ServerOptions
  		intptr = &options->gss_strict_acceptor;
  		goto parse_flag;
  
@@ -2197,7 +2212,7 @@ diff -up openssh/servconf.c.gsskex openssh/servconf.c
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -2302,6 +2322,9 @@ dump_config(ServerOptions *o)
+@@ -2560,6 +2580,9 @@ dump_config(ServerOptions *o)
  #ifdef GSSAPI
  	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
  	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@@ -2208,9 +2223,9 @@ diff -up openssh/servconf.c.gsskex openssh/servconf.c
  	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
  	dump_cfg_fmtint(sKbdInteractiveAuthentication,
 diff -up openssh/servconf.h.gsskex openssh/servconf.h
---- openssh/servconf.h.gsskex	2017-09-27 13:54:53.582534304 +0200
-+++ openssh/servconf.h	2017-09-27 13:54:53.597534386 +0200
-@@ -119,8 +119,10 @@ typedef struct {
+--- openssh/servconf.h.gsskex	2018-08-22 11:47:33.296216335 +0200
++++ openssh/servconf.h	2018-08-22 11:47:33.316216497 +0200
+@@ -124,8 +124,10 @@ typedef struct {
  	int     kerberos_get_afs_token;		/* If true, try to get AFS token if
  						 * authenticated with Kerberos. */
  	int     gss_authentication;	/* If true, permit GSSAPI authentication */
@@ -2222,9 +2237,9 @@ diff -up openssh/servconf.h.gsskex openssh/servconf.h
  						 * authentication. */
  	int     kbd_interactive_authentication;	/* If true, permit */
 diff -up openssh/ssh_config.5.gsskex openssh/ssh_config.5
---- openssh/ssh_config.5.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/ssh_config.5	2017-09-27 13:54:53.597534386 +0200
-@@ -720,10 +720,40 @@ The default is
+--- openssh/ssh_config.5.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/ssh_config.5	2018-08-22 11:47:33.316216497 +0200
+@@ -718,10 +718,40 @@ The default is
  Specifies whether user authentication based on GSSAPI is allowed.
  The default is
  .Cm no .
@@ -2266,8 +2281,8 @@ diff -up openssh/ssh_config.5.gsskex openssh/ssh_config.5
  Indicates that
  .Xr ssh 1
 diff -up openssh/ssh_config.gsskex openssh/ssh_config
---- openssh/ssh_config.gsskex	2017-09-27 13:54:53.571534243 +0200
-+++ openssh/ssh_config	2017-09-27 13:54:53.597534386 +0200
+--- openssh/ssh_config.gsskex	2018-08-22 11:47:33.289216279 +0200
++++ openssh/ssh_config	2018-08-22 11:47:33.316216497 +0200
 @@ -24,6 +24,8 @@
  #   HostbasedAuthentication no
  #   GSSAPIAuthentication no
@@ -2278,8 +2293,8 @@ diff -up openssh/ssh_config.gsskex openssh/ssh_config
  #   CheckHostIP yes
  #   AddressFamily any
 diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
---- openssh/sshconnect2.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/sshconnect2.c	2017-09-27 13:57:23.418358207 +0200
+--- openssh/sshconnect2.c.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/sshconnect2.c	2018-08-22 13:33:01.674275795 +0200
 @@ -82,6 +82,124 @@ extern char *client_version_string;
  extern char *server_version_string;
  extern Options options;
@@ -2440,7 +2455,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  	if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
  		fatal("%s: kex_names_cat", __func__);
  	myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(s);
-@@ -192,6 +335,17 @@ ssh_kex2(char *host, struct sockaddr *ho
+@@ -194,6 +337,17 @@ ssh_kex2(char *host, struct sockaddr *ho
  		    order_hostkeyalgs(host, hostaddr, port));
  	}
  
@@ -2458,7 +2473,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  	if (options.rekey_limit || options.rekey_interval)
  		packet_set_rekey_limits(options.rekey_limit,
  		    options.rekey_interval);
-@@ -212,11 +366,31 @@ ssh_kex2(char *host, struct sockaddr *ho
+@@ -214,11 +368,31 @@ ssh_kex2(char *host, struct sockaddr *ho
  	kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
  # endif
  #endif
@@ -2490,7 +2505,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  	ssh_dispatch_run_fatal(active_state, DISPATCH_BLOCK, &kex->done);
  
  	/* remove ext-info from the KEX proposals for rekeying */
-@@ -311,6 +485,7 @@ int	input_gssapi_token(int type, u_int32
+@@ -314,6 +488,7 @@ int	input_gssapi_token(int type, u_int32
  int	input_gssapi_hash(int type, u_int32_t, struct ssh *);
  int	input_gssapi_error(int, u_int32_t, struct ssh *);
  int	input_gssapi_errtok(int, u_int32_t, struct ssh *);
@@ -2498,7 +2513,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  #endif
  
  void	userauth(Authctxt *, char *);
-@@ -327,6 +502,11 @@ static char *authmethods_get(void);
+@@ -330,6 +505,11 @@ static char *authmethods_get(void);
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -2510,10 +2525,10 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  	{"gssapi-with-mic",
  		userauth_gssapi,
  		NULL,
-@@ -654,19 +834,31 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -657,19 +837,31 @@ userauth_gssapi(Authctxt *authctxt)
  	static u_int mech = 0;
  	OM_uint32 min;
- 	int ok = 0;
+ 	int r, ok = 0;
 +	const char *gss_host;
 +
 +	if (options.gss_server_identity)
@@ -2537,33 +2552,22 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  	while (mech < gss_supported->count && !ok) {
  		/* My DER encoding requires length<128 */
  		if (gss_supported->elements[mech].length < 128 &&
- 		    ssh_gssapi_check_mechanism(&gssctxt, 
+ 		    ssh_gssapi_check_mechanism(&gssctxt,
 -		    &gss_supported->elements[mech], authctxt->host)) {
 +		    &gss_supported->elements[mech], gss_host, 
 +                    options.gss_client_identity)) {
  			ok = 1; /* Mechanism works */
  		} else {
  			mech++;
-@@ -763,8 +955,8 @@ input_gssapi_response(int type, u_int32_
- {
- 	Authctxt *authctxt = ssh->authctxt;
- 	Gssctxt *gssctxt;
--	int oidlen;
--	char *oidv;
-+	u_int oidlen;
-+	u_char *oidv;
- 
- 	if (authctxt == NULL)
- 		fatal("input_gssapi_response: no authentication context");
-@@ -877,6 +1069,48 @@ input_gssapi_error(int type, u_int32_t p
+@@ -906,6 +1098,48 @@ input_gssapi_error(int type, u_int32_t p
  	free(lang);
- 	return 0;
+ 	return r;
  }
 +
 +int
 +userauth_gsskeyex(Authctxt *authctxt)
 +{
-+	Buffer b;
++	struct sshbuf *b = NULL;
 +	gss_buffer_desc gssbuf;
 +	gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
 +	OM_uint32 ms;
@@ -2577,14 +2581,14 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
 +		return (0);
 +	}
 +
-+	ssh_gssapi_buildmic(&b, authctxt->server_user, authctxt->service,
++	ssh_gssapi_buildmic(b, authctxt->server_user, authctxt->service,
 +	    "gssapi-keyex");
 +
-+	gssbuf.value = buffer_ptr(&b);
-+	gssbuf.length = buffer_len(&b);
++	gssbuf.value = sshbuf_mutable_ptr(b);
++	gssbuf.length = sshbuf_len(b);
 +
 +	if (GSS_ERROR(ssh_gssapi_sign(gss_kex_context, &gssbuf, &mic))) {
-+		buffer_free(&b);
++		sshbuf_free(b);
 +		return (0);
 +	}
 +
@@ -2595,7 +2599,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
 +	packet_put_string(mic.value, mic.length);
 +	packet_send();
 +
-+	buffer_free(&b);
++	sshbuf_free(b);
 +	gss_release_buffer(&ms, &mic);
 +
 +	return (1);
@@ -2605,9 +2609,9 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c
  
  int
 diff -up openssh/sshd.c.gsskex openssh/sshd.c
---- openssh/sshd.c.gsskex	2017-09-27 13:54:53.584534315 +0200
-+++ openssh/sshd.c	2017-09-27 13:54:53.600534403 +0200
-@@ -530,7 +530,7 @@ privsep_preauth_child(void)
+--- openssh/sshd.c.gsskex	2018-08-22 11:47:33.299216360 +0200
++++ openssh/sshd.c	2018-08-22 13:34:28.455975954 +0200
+@@ -537,7 +537,7 @@ privsep_preauth_child(void)
  
  #ifdef GSSAPI
  	/* Cache supported mechanism OIDs for later use */
@@ -2616,7 +2620,7 @@ diff -up openssh/sshd.c.gsskex openssh/sshd.c
  		ssh_gssapi_prepare_supported_oids();
  #endif
  
-@@ -871,8 +871,9 @@ notify_hostkeys(struct ssh *ssh)
+@@ -887,8 +887,9 @@ notify_hostkeys(struct ssh *ssh)
  	}
  	debug3("%s: sent %u hostkeys", __func__, nkeys);
  	if (nkeys == 0)
@@ -2628,17 +2632,17 @@ diff -up openssh/sshd.c.gsskex openssh/sshd.c
  	sshbuf_free(buf);
  }
  
-@@ -1738,7 +1739,8 @@ main(int ac, char **av)
- 		    key ? "private" : "agent", i, sshkey_ssh_name(pubkey), fp);
+@@ -1841,7 +1842,8 @@ main(int ac, char **av)
  		free(fp);
  	}
+ 	accumulate_host_timing_secret(cfg, NULL);
 -	if (!sensitive_data.have_ssh2_key) {
 +	/* The GSSAPI key exchange can run without a host key */
 +	if (!sensitive_data.have_ssh2_key && !options.gss_keyex) {
  		logit("sshd: no hostkeys available -- exiting.");
  		exit(1);
  	}
-@@ -2203,6 +2205,48 @@ do_ssh2_kex(void)
+@@ -2321,6 +2323,48 @@ do_ssh2_kex(void)
  	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = compat_pkalg_proposal(
  	    list_hostkey_types());
  
@@ -2687,7 +2691,7 @@ diff -up openssh/sshd.c.gsskex openssh/sshd.c
  	/* start key exchange */
  	if ((r = kex_setup(active_state, myproposal)) != 0)
  		fatal("kex_setup: %s", ssh_err(r));
-@@ -2220,6 +2264,13 @@ do_ssh2_kex(void)
+@@ -2338,6 +2382,13 @@ do_ssh2_kex(void)
  # endif
  #endif
  	kex->kex[KEX_C25519_SHA256] = kexc25519_server;
@@ -2702,9 +2706,9 @@ diff -up openssh/sshd.c.gsskex openssh/sshd.c
  	kex->client_version_string=client_version_string;
  	kex->server_version_string=server_version_string;
 diff -up openssh/sshd_config.5.gsskex openssh/sshd_config.5
---- openssh/sshd_config.5.gsskex	2017-09-27 13:54:53.582534304 +0200
-+++ openssh/sshd_config.5	2017-09-27 13:54:53.600534403 +0200
-@@ -638,6 +638,11 @@ Specifies whether to automatically destr
+--- openssh/sshd_config.5.gsskex	2018-08-22 11:47:33.297216344 +0200
++++ openssh/sshd_config.5	2018-08-22 13:35:05.531275099 +0200
+@@ -642,6 +642,11 @@ Specifies whether to automatically destr
  on logout.
  The default is
  .Cm yes .
@@ -2716,7 +2720,7 @@ diff -up openssh/sshd_config.5.gsskex openssh/sshd_config.5
  .It Cm GSSAPIStrictAcceptorCheck
  Determines whether to be strict about the identity of the GSSAPI acceptor
  a client authenticates against.
-@@ -652,6 +657,11 @@ machine's default store.
+@@ -656,6 +661,11 @@ machine's default store.
  This facility is provided to assist with operation on multi homed machines.
  The default is
  .Cm yes .
@@ -2727,11 +2731,11 @@ diff -up openssh/sshd_config.5.gsskex openssh/sshd_config.5
 +.Dq no .
  .It Cm HostbasedAcceptedKeyTypes
  Specifies the key types that will be accepted for hostbased authentication
- as a comma-separated pattern list.
+ as a list of comma-separated patterns.
 diff -up openssh/sshd_config.gsskex openssh/sshd_config
---- openssh/sshd_config.gsskex	2017-09-27 13:54:53.585534320 +0200
-+++ openssh/sshd_config	2017-09-27 13:54:53.601534408 +0200
-@@ -86,6 +86,8 @@ ChallengeResponseAuthentication no
+--- openssh/sshd_config.gsskex	2018-08-22 11:47:33.299216360 +0200
++++ openssh/sshd_config	2018-08-22 11:47:33.318216513 +0200
+@@ -85,6 +85,8 @@ ChallengeResponseAuthentication no
  # GSSAPI options
  GSSAPIAuthentication yes
  GSSAPICleanupCredentials no
@@ -2741,10 +2745,10 @@ diff -up openssh/sshd_config.gsskex openssh/sshd_config
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
 diff -up openssh/ssh-gss.h.gsskex openssh/ssh-gss.h
---- openssh/ssh-gss.h.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/ssh-gss.h	2017-09-27 13:54:53.601534408 +0200
+--- openssh/ssh-gss.h.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/ssh-gss.h	2018-08-22 13:36:44.773075793 +0200
 @@ -1,6 +1,6 @@
- /* $OpenBSD: ssh-gss.h,v 1.12 2017/06/24 06:34:38 djm Exp $ */
+ /* $OpenBSD: ssh-gss.h,v 1.14 2018/07/10 09:13:30 djm Exp $ */
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -2807,10 +2811,10 @@ diff -up openssh/ssh-gss.h.gsskex openssh/ssh-gss.h
  
  int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
  void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -119,17 +136,33 @@ void ssh_gssapi_build_ctx(Gssctxt **);
- void ssh_gssapi_delete_ctx(Gssctxt **);
+@@ -123,17 +140,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **);
  OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
- void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
+ void ssh_gssapi_buildmic(struct sshbuf *, const char *,
+     const char *, const char *);
 -int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);
 +int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *, const char *);
 +OM_uint32 ssh_gssapi_client_identity(Gssctxt *, const char *);
@@ -2844,20 +2848,20 @@ diff -up openssh/ssh-gss.h.gsskex openssh/ssh-gss.h
  
  #endif /* _SSH_GSS_H */
 diff -up openssh/sshkey.c.gsskex openssh/sshkey.c
---- openssh/sshkey.c.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/sshkey.c	2017-09-27 13:54:53.601534408 +0200
-@@ -112,6 +112,7 @@ static const struct keytype keytypes[] =
+--- openssh/sshkey.c.gsskex	2018-08-22 11:47:33.319216521 +0200
++++ openssh/sshkey.c	2018-08-22 13:37:18.979351804 +0200
+@@ -140,6 +140,7 @@ static const struct keytype keytypes[] =
  #  endif /* OPENSSL_HAS_NISTP521 */
  # endif /* OPENSSL_HAS_ECC */
  #endif /* WITH_OPENSSL */
-+	{ "null", "null", KEY_NULL, 0, 0, 1 },
- 	{ NULL, NULL, -1, -1, 0, 0 }
++	{ "null", "null", NULL, KEY_NULL, 0, 0, 1 },
+ 	{ NULL, NULL, NULL, -1, -1, 0, 0 }
  };
  
 diff -up openssh/sshkey.h.gsskex openssh/sshkey.h
---- openssh/sshkey.h.gsskex	2017-09-25 01:48:10.000000000 +0200
-+++ openssh/sshkey.h	2017-09-27 13:54:53.602534414 +0200
-@@ -61,6 +61,7 @@ enum sshkey_types {
+--- openssh/sshkey.h.gsskex	2018-08-20 07:57:29.000000000 +0200
++++ openssh/sshkey.h	2018-08-22 11:47:33.320216529 +0200
+@@ -63,6 +63,7 @@ enum sshkey_types {
  	KEY_ED25519_CERT,
  	KEY_XMSS,
  	KEY_XMSS_CERT,
diff --git a/openssh-7.8p1-ip-port-config-parser.patch b/openssh-7.8p1-ip-port-config-parser.patch
new file mode 100644
index 0000000..6ca0cf5
--- /dev/null
+++ b/openssh-7.8p1-ip-port-config-parser.patch
@@ -0,0 +1,72 @@
+diff -up openssh/misc.c.config openssh/misc.c
+--- openssh/misc.c.config	2018-08-22 13:58:54.922807799 +0200
++++ openssh/misc.c	2018-08-22 13:58:55.000808428 +0200
+@@ -485,7 +485,7 @@ put_host_port(const char *host, u_short
+  * The delimiter char, if present, is stored in delim.
+  * If this is the last field, *cp is set to NULL.
+  */
+-static char *
++char *
+ hpdelim2(char **cp, char *delim)
+ {
+ 	char *s, *old;
+diff -up openssh/misc.h.config openssh/misc.h
+--- openssh/misc.h.config	2018-08-20 07:57:29.000000000 +0200
++++ openssh/misc.h	2018-08-22 13:58:55.001808436 +0200
+@@ -54,6 +54,7 @@ int	 set_rdomain(int, const char *);
+ int	 a2port(const char *);
+ int	 a2tun(const char *, int *);
+ char	*put_host_port(const char *, u_short);
++char	*hpdelim2(char **, char *);
+ char	*hpdelim(char **);
+ char	*cleanhostname(char *);
+ char	*colon(char *);
+diff -up openssh/servconf.c.config openssh/servconf.c
+--- openssh/servconf.c.config	2018-08-22 13:58:54.989808340 +0200
++++ openssh/servconf.c	2018-08-22 14:18:49.235443937 +0200
+@@ -886,7 +886,7 @@ process_permitopen_list(struct ssh *ssh,
+ {
+ 	u_int i;
+ 	int port;
+-	char *host, *arg, *oarg;
++	char *host, *arg, *oarg, ch;
+ 	int where = opcode == sPermitOpen ? FORWARD_LOCAL : FORWARD_REMOTE;
+ 	const char *what = lookup_opcode_name(opcode);
+ 
+@@ -904,8 +904,8 @@ process_permitopen_list(struct ssh *ssh,
+ 	/* Otherwise treat it as a list of permitted host:port */
+ 	for (i = 0; i < num_opens; i++) {
+ 		oarg = arg = xstrdup(opens[i]);
+-		host = hpdelim(&arg);
+-		if (host == NULL)
++		host = hpdelim2(&arg, &ch);
++		if (host == NULL || ch == '/')
+ 			fatal("%s: missing host in %s", __func__, what);
+ 		host = cleanhostname(host);
+ 		if (arg == NULL || ((port = permitopen_port(arg)) < 0))
+@@ -1323,8 +1323,10 @@ process_server_config_line(ServerOptions
+ 			port = 0;
+ 			p = arg;
+ 		} else {
+-			p = hpdelim(&arg);
+-			if (p == NULL)
++			char ch;
++			arg2 = NULL;
++			p = hpdelim2(&arg, &ch);
++			if (p == NULL || ch == '/')
+ 				fatal("%s line %d: bad address:port usage",
+ 				    filename, linenum);
+ 			p = cleanhostname(p);
+@@ -1965,9 +1967,10 @@ process_server_config_line(ServerOptions
+ 				 */
+ 				xasprintf(&arg2, "*:%s", arg);
+ 			} else {
++				char ch;
+ 				arg2 = xstrdup(arg);
+-				p = hpdelim(&arg);
+-				if (p == NULL) {
++				p = hpdelim2(&arg, &ch);
++				if (p == NULL || ch == '/') {
+ 					fatal("%s line %d: missing host in %s",
+ 					    filename, linenum,
+ 					    lookup_opcode_name(opcode));
diff --git a/openssh-6.6p1-role-mls.patch b/openssh-7.8p1-role-mls.patch
similarity index 72%
rename from openssh-6.6p1-role-mls.patch
rename to openssh-7.8p1-role-mls.patch
index 37ae70d..4c58d71 100644
--- a/openssh-6.6p1-role-mls.patch
+++ b/openssh-7.8p1-role-mls.patch
@@ -1,7 +1,7 @@
-diff -up openssh-7.4p1/auth2.c.role-mls openssh-7.4p1/auth2.c
---- openssh-7.4p1/auth2.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/auth2.c	2016-12-23 12:19:58.587459379 +0100
-@@ -215,6 +215,9 @@ input_userauth_request(int type, u_int32
+diff -up openssh/auth2.c.role-mls openssh/auth2.c
+--- openssh/auth2.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/auth2.c	2018-08-22 11:14:56.815430916 +0200
+@@ -256,6 +256,9 @@ input_userauth_request(int type, u_int32
  	Authctxt *authctxt = ssh->authctxt;
  	Authmethod *m = NULL;
  	char *user, *service, *method, *style = NULL;
@@ -9,9 +9,9 @@ diff -up openssh-7.4p1/auth2.c.role-mls openssh-7.4p1/auth2.c
 +	char *role = NULL;
 +#endif
  	int authenticated = 0;
+ 	double tstart = monotime_double();
  
- 	if (authctxt == NULL)
-@@ -226,6 +229,11 @@ input_userauth_request(int type, u_int32
+@@ -268,6 +271,11 @@ input_userauth_request(int type, u_int32
  	debug("userauth-request for user %s service %s method %s", user, service, method);
  	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -23,7 +23,7 @@ diff -up openssh-7.4p1/auth2.c.role-mls openssh-7.4p1/auth2.c
  	if ((style = strchr(user, ':')) != NULL)
  		*style++ = 0;
  
-@@ -251,8 +259,15 @@ input_userauth_request(int type, u_int32
+@@ -296,8 +304,15 @@ input_userauth_request(int type, u_int32
  		    use_privsep ? " [net]" : "");
  		authctxt->service = xstrdup(service);
  		authctxt->style = style ? xstrdup(style) : NULL;
@@ -40,49 +40,48 @@ diff -up openssh-7.4p1/auth2.c.role-mls openssh-7.4p1/auth2.c
  		userauth_banner();
  		if (auth2_setup_methods_lists(authctxt) != 0)
  			packet_disconnect("no authentication methods enabled");
-diff -up openssh-7.4p1/auth2-gss.c.role-mls openssh-7.4p1/auth2-gss.c
---- openssh-7.4p1/auth2-gss.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/auth2-gss.c	2016-12-23 12:19:58.586459382 +0100
-@@ -255,6 +255,7 @@ input_gssapi_mic(int type, u_int32_t ple
+diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
+--- openssh/auth2-gss.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/auth2-gss.c	2018-08-22 11:15:42.459799171 +0200
+@@ -281,6 +281,7 @@ input_gssapi_mic(int type, u_int32_t ple
  	Authctxt *authctxt = ssh->authctxt;
  	Gssctxt *gssctxt;
- 	int authenticated = 0;
+ 	int r, authenticated = 0;
 +	char *micuser;
- 	Buffer b;
+ 	struct sshbuf *b;
  	gss_buffer_desc mic, gssbuf;
- 	u_int len;
-@@ -267,7 +268,13 @@ input_gssapi_mic(int type, u_int32_t ple
- 	mic.value = packet_get_string(&len);
+ 	const char *displayname;
+@@ -298,7 +299,13 @@ input_gssapi_mic(int type, u_int32_t ple
+ 		fatal("%s: sshbuf_new failed", __func__);
+ 	mic.value = p;
  	mic.length = len;
- 
--	ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
+-	ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,
 +#ifdef WITH_SELINUX
 +	if (authctxt->role && (strlen(authctxt->role) > 0))
 +		xasprintf(&micuser, "%s/%s", authctxt->user, authctxt->role);
 +	else
 +#endif
 +		micuser = authctxt->user;
-+	ssh_gssapi_buildmic(&b, micuser, authctxt->service,
++	ssh_gssapi_buildmic(b, micuser, authctxt->service,
  	    "gssapi-with-mic");
  
- 	gssbuf.value = buffer_ptr(&b);
-@@ -279,6 +286,8 @@ input_gssapi_mic(int type, u_int32_t ple
+ 	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)
+@@ -311,6 +318,8 @@ input_gssapi_mic(int type, u_int32_t ple
  		logit("GSSAPI MIC check failed");
  
- 	buffer_free(&b);
+ 	sshbuf_free(b);
 +	if (micuser != authctxt->user)
 +		free(micuser);
  	free(mic.value);
  
  	if ((!use_privsep || mm_is_monitor()) &&
-diff -up openssh-7.4p1/auth2-hostbased.c.role-mls openssh-7.4p1/auth2-hostbased.c
---- openssh-7.4p1/auth2-hostbased.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/auth2-hostbased.c	2016-12-23 12:19:58.586459382 +0100
-@@ -121,7 +121,16 @@ userauth_hostbased(Authctxt *authctxt)
+diff -up openssh/auth2-hostbased.c.role-mls openssh/auth2-hostbased.c
+--- openssh/auth2-hostbased.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/auth2-hostbased.c	2018-08-22 11:14:56.816430924 +0200
+@@ -123,7 +123,16 @@ userauth_hostbased(struct ssh *ssh)
  	/* reconstruct packet */
  	if ((r = sshbuf_put_string(b, session_id2, session_id2_len)) != 0 ||
  	    (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
--	    (r = sshbuf_put_cstring(b, authctxt->user)) != 0 ||
 +#ifdef WITH_SELINUX
 +	    (authctxt->role
 +	    ? ( (r = sshbuf_put_u32(b, strlen(authctxt->user)+strlen(authctxt->role)+1)) != 0 ||
@@ -91,16 +90,16 @@ diff -up openssh-7.4p1/auth2-hostbased.c.role-mls openssh-7.4p1/auth2-hostbased.
 +	        (r = sshbuf_put(b, authctxt->role, strlen(authctxt->role))) != 0)
 +	    : (r = sshbuf_put_cstring(b, authctxt->user)) != 0) ||
 +#else
-+	    (r = sshbuf_put_cstring(b, authctxt->user)) != 0 ||
+ 	    (r = sshbuf_put_cstring(b, authctxt->user)) != 0 ||
 +#endif
  	    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
  	    (r = sshbuf_put_cstring(b, "hostbased")) != 0 ||
  	    (r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
-diff -up openssh-7.4p1/auth2-pubkey.c.role-mls openssh-7.4p1/auth2-pubkey.c
---- openssh-7.4p1/auth2-pubkey.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/auth2-pubkey.c	2016-12-23 12:19:58.587459379 +0100
-@@ -151,9 +151,15 @@ userauth_pubkey(Authctxt *authctxt)
- 				    __func__, ssh_err(r));
+diff -up openssh/auth2-pubkey.c.role-mls openssh/auth2-pubkey.c
+--- openssh/auth2-pubkey.c.role-mls	2018-08-22 11:14:56.816430924 +0200
++++ openssh/auth2-pubkey.c	2018-08-22 11:17:07.331483958 +0200
+@@ -169,9 +169,16 @@ userauth_pubkey(struct ssh *ssh)
+ 			goto done;
  		}
  		/* reconstruct packet */
 -		xasprintf(&userstyle, "%s%s%s", authctxt->user,
@@ -110,17 +109,18 @@ diff -up openssh-7.4p1/auth2-pubkey.c.role-mls openssh-7.4p1/auth2-pubkey.c
 +		    authctxt->style ? authctxt->style : "",
 +#ifdef WITH_SELINUX
 +		    authctxt->role ? "/" : "",
-+		    authctxt->role ? authctxt->role : "");
++		    authctxt->role ? authctxt->role : ""
 +#else
-+		    "", "");
++		    "", ""
 +#endif
++		    );
  		if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
  		    (r = sshbuf_put_cstring(b, userstyle)) != 0 ||
  		    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
-diff -up openssh-7.4p1/auth.h.role-mls openssh-7.4p1/auth.h
---- openssh-7.4p1/auth.h.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/auth.h	2016-12-23 12:19:43.478510375 +0100
-@@ -62,6 +62,9 @@ struct Authctxt {
+diff -up openssh/auth.h.role-mls openssh/auth.h
+--- openssh/auth.h.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/auth.h	2018-08-22 11:14:56.816430924 +0200
+@@ -65,6 +65,9 @@ struct Authctxt {
  	char		*service;
  	struct passwd	*pw;		/* set if 'valid' */
  	char		*style;
@@ -130,10 +130,10 @@ diff -up openssh-7.4p1/auth.h.role-mls openssh-7.4p1/auth.h
  
  	/* Method lists for multiple authentication */
  	char		**auth_methods;	/* modified from server config */
-diff -up openssh-7.4p1/auth-pam.c.role-mls openssh-7.4p1/auth-pam.c
---- openssh-7.4p1/auth-pam.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/auth-pam.c	2016-12-23 12:19:43.477510378 +0100
-@@ -1087,7 +1087,7 @@ is_pam_session_open(void)
+diff -up openssh/auth-pam.c.role-mls openssh/auth-pam.c
+--- openssh/auth-pam.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/auth-pam.c	2018-08-22 11:14:56.816430924 +0200
+@@ -1172,7 +1172,7 @@ is_pam_session_open(void)
   * during the ssh authentication process.
   */
  int
@@ -142,10 +142,10 @@ diff -up openssh-7.4p1/auth-pam.c.role-mls openssh-7.4p1/auth-pam.c
  {
  	int ret = 1;
  #ifdef HAVE_PAM_PUTENV
-diff -up openssh-7.4p1/auth-pam.h.role-mls openssh-7.4p1/auth-pam.h
---- openssh-7.4p1/auth-pam.h.role-mls	2016-12-23 12:19:43.478510375 +0100
-+++ openssh-7.4p1/auth-pam.h	2016-12-23 12:21:44.698101234 +0100
-@@ -31,7 +31,7 @@ u_int do_pam_account(void);
+diff -up openssh/auth-pam.h.role-mls openssh/auth-pam.h
+--- openssh/auth-pam.h.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/auth-pam.h	2018-08-22 11:14:56.817430932 +0200
+@@ -33,7 +33,7 @@ u_int do_pam_account(void);
  void do_pam_session(struct ssh *);
  void do_pam_setcred(int );
  void do_pam_chauthtok(void);
@@ -154,10 +154,24 @@ diff -up openssh-7.4p1/auth-pam.h.role-mls openssh-7.4p1/auth-pam.h
  char ** fetch_pam_environment(void);
  char ** fetch_pam_child_environment(void);
  void free_pam_environment(char **);
-diff -up openssh-7.4p1/misc.c.role-mls openssh-7.4p1/misc.c
---- openssh-7.4p1/misc.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/misc.c	2016-12-23 12:19:58.587459379 +0100
-@@ -432,6 +432,7 @@ char *
+diff -up openssh/configure.ac.role-mls openssh/configure.ac
+--- openssh/configure.ac.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/configure.ac	2018-08-22 11:14:56.820430957 +0200
+@@ -4241,10 +4241,7 @@ AC_ARG_WITH([selinux],
+ 			  LIBS="$LIBS -lselinux"
+ 			],
+ 			AC_MSG_ERROR([SELinux support requires libselinux library]))
+-		SSHLIBS="$SSHLIBS $LIBSELINUX"
+-		SSHDLIBS="$SSHDLIBS $LIBSELINUX"
+ 		AC_CHECK_FUNCS([getseuserbyname get_default_context_with_level])
+-		LIBS="$save_LIBS"
+ 	fi ]
+ )
+ AC_SUBST([SSHLIBS])
+diff -up openssh/misc.c.role-mls openssh/misc.c
+--- openssh/misc.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/misc.c	2018-08-22 11:14:56.817430932 +0200
+@@ -542,6 +542,7 @@ char *
  colon(char *cp)
  {
  	int flag = 0;
@@ -165,7 +179,7 @@ diff -up openssh-7.4p1/misc.c.role-mls openssh-7.4p1/misc.c
  
  	if (*cp == ':')		/* Leading colon is part of file name. */
  		return NULL;
-@@ -447,6 +448,13 @@ colon(char *cp)
+@@ -557,6 +558,13 @@ colon(char *cp)
  			return (cp);
  		if (*cp == '/')
  			return NULL;
@@ -179,20 +193,20 @@ diff -up openssh-7.4p1/misc.c.role-mls openssh-7.4p1/misc.c
  	}
  	return NULL;
  }
-diff -up openssh-7.4p1/monitor.c.role-mls openssh-7.4p1/monitor.c
---- openssh-7.4p1/monitor.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/monitor.c	2016-12-23 12:23:03.503835248 +0100
-@@ -127,6 +127,9 @@ int mm_answer_sign(int, Buffer *);
- int mm_answer_pwnamallow(int, Buffer *);
- int mm_answer_auth2_read_banner(int, Buffer *);
- int mm_answer_authserv(int, Buffer *);
+diff -up openssh/monitor.c.role-mls openssh/monitor.c
+--- openssh/monitor.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/monitor.c	2018-08-22 11:19:56.006844867 +0200
+@@ -115,6 +115,9 @@ int mm_answer_sign(int, struct sshbuf *)
+ int mm_answer_pwnamallow(int, struct sshbuf *);
+ int mm_answer_auth2_read_banner(int, struct sshbuf *);
+ int mm_answer_authserv(int, struct sshbuf *);
 +#ifdef WITH_SELINUX
-+int mm_answer_authrole(int, Buffer *);
++int mm_answer_authrole(int, struct sshbuf *);
 +#endif
- int mm_answer_authpassword(int, Buffer *);
- int mm_answer_bsdauthquery(int, Buffer *);
- int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -202,6 +205,9 @@ struct mon_table mon_dispatch_proto20[]
+ int mm_answer_authpassword(int, struct sshbuf *);
+ int mm_answer_bsdauthquery(int, struct sshbuf *);
+ int mm_answer_bsdauthrespond(int, struct sshbuf *);
+@@ -189,6 +192,9 @@ struct mon_table mon_dispatch_proto20[]
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -202,7 +216,7 @@ diff -up openssh-7.4p1/monitor.c.role-mls openssh-7.4p1/monitor.c
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -769,6 +775,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
+@@ -796,6 +802,9 @@ mm_answer_pwnamallow(int sock, struct ss
  
  	/* Allow service/style information on the auth context */
  	monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -212,19 +226,20 @@ diff -up openssh-7.4p1/monitor.c.role-mls openssh-7.4p1/monitor.c
  	monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
  
  #ifdef USE_PAM
-@@ -810,6 +819,25 @@ mm_answer_authserv(int sock, Buffer *m)
+@@ -842,6 +851,26 @@ mm_answer_authserv(int sock, struct sshb
  	return (0);
  }
  
 +#ifdef WITH_SELINUX
 +int
-+mm_answer_authrole(int sock, Buffer *m)
++mm_answer_authrole(int sock, struct sshbuf *m)
 +{
++	int r;
 +	monitor_permit_authentications(1);
 +
-+	authctxt->role = buffer_get_string(m, NULL);
-+	debug3("%s: role=%s",
-+	    __func__, authctxt->role);
++	if ((r = sshbuf_get_cstring(m, &authctxt->role, NULL)) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	debug3("%s: role=%s", __func__, authctxt->role);
 +
 +	if (strlen(authctxt->role) == 0) {
 +		free(authctxt->role);
@@ -236,48 +251,48 @@ diff -up openssh-7.4p1/monitor.c.role-mls openssh-7.4p1/monitor.c
 +#endif
 +
  int
- mm_answer_authpassword(int sock, Buffer *m)
+ mm_answer_authpassword(int sock, struct sshbuf *m)
  {
-@@ -1208,7 +1236,7 @@ monitor_valid_userblob(u_char *data, u_i
+@@ -1218,7 +1247,7 @@ monitor_valid_userblob(u_char *data, u_i
  {
- 	Buffer b;
- 	u_char *p;
+ 	struct sshbuf *b;
+ 	const u_char *p;
 -	char *userstyle, *cp;
-+	char *userstyle, *r, *cp;
- 	u_int len;
- 	int fail = 0;
- 
-@@ -1234,6 +1262,8 @@ monitor_valid_userblob(u_char *data, u_i
- 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
++	char *userstyle, *s, *cp;
+ 	size_t len;
+ 	u_char type;
+ 	int r, fail = 0;
+@@ -1251,6 +1280,8 @@ monitor_valid_userblob(u_char *data, u_i
  		fail++;
- 	cp = buffer_get_cstring(&b, NULL);
-+	if ((r = strchr(cp, '/')) != NULL)
-+		*r = '\0';
+ 	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	if ((s = strchr(cp, '/')) != NULL)
++		*s = '\0';
  	xasprintf(&userstyle, "%s%s%s", authctxt->user,
  	    authctxt->style ? ":" : "",
  	    authctxt->style ? authctxt->style : "");
-@@ -1269,7 +1299,7 @@ monitor_valid_hostbasedblob(u_char *data
-     char *chost)
+@@ -1286,7 +1317,7 @@ monitor_valid_hostbasedblob(u_char *data
  {
- 	Buffer b;
--	char *p, *userstyle;
-+	char *p, *r, *userstyle;
- 	u_int len;
- 	int fail = 0;
- 
-@@ -1286,6 +1316,8 @@ monitor_valid_hostbasedblob(u_char *data
- 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
+ 	struct sshbuf *b;
+ 	const u_char *p;
+-	char *cp, *userstyle;
++	char *cp, *s, *userstyle;
+ 	size_t len;
+ 	int r, fail = 0;
+ 	u_char type;
+@@ -1308,6 +1339,8 @@ monitor_valid_hostbasedblob(u_char *data
  		fail++;
- 	p = buffer_get_cstring(&b, NULL);
-+	if ((r = strchr(p, '/')) != NULL)
-+		*r = '\0';
+ 	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
+ 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	if ((s = strchr(p, '/')) != NULL)
++		*s = '\0';
  	xasprintf(&userstyle, "%s%s%s", authctxt->user,
  	    authctxt->style ? ":" : "",
  	    authctxt->style ? authctxt->style : "");
-diff -up openssh-7.4p1/monitor.h.role-mls openssh-7.4p1/monitor.h
---- openssh-7.4p1/monitor.h.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/monitor.h	2016-12-23 12:19:58.588459376 +0100
-@@ -57,6 +57,10 @@ enum monitor_reqtype {
+diff -up openssh/monitor.h.role-mls openssh/monitor.h
+--- openssh/monitor.h.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/monitor.h	2018-08-22 11:14:56.818430941 +0200
+@@ -55,6 +55,10 @@ enum monitor_reqtype {
  	MONITOR_REQ_GSSCHECKMIC = 48, MONITOR_ANS_GSSCHECKMIC = 49,
  	MONITOR_REQ_TERM = 50,
  
@@ -288,11 +303,11 @@ diff -up openssh-7.4p1/monitor.h.role-mls openssh-7.4p1/monitor.h
  	MONITOR_REQ_PAM_START = 100,
  	MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
  	MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
-diff -up openssh-7.4p1/monitor_wrap.c.role-mls openssh-7.4p1/monitor_wrap.c
---- openssh-7.4p1/monitor_wrap.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 12:19:58.588459376 +0100
-@@ -345,6 +345,25 @@ mm_inform_authserv(char *service, char *
- 	buffer_free(&m);
+diff -up openssh/monitor_wrap.c.role-mls openssh/monitor_wrap.c
+--- openssh/monitor_wrap.c.role-mls	2018-08-22 11:14:56.818430941 +0200
++++ openssh/monitor_wrap.c	2018-08-22 11:21:47.938747968 +0200
+@@ -390,6 +390,27 @@ mm_inform_authserv(char *service, char *
+ 	sshbuf_free(m);
  }
  
 +/* Inform the privileged process about role */
@@ -301,28 +316,30 @@ diff -up openssh-7.4p1/monitor_wrap.c.role-mls openssh-7.4p1/monitor_wrap.c
 +void
 +mm_inform_authrole(char *role)
 +{
-+	Buffer m;
++	int r;
++	struct sshbuf *m;
 +
 +	debug3("%s entering", __func__);
 +
-+	buffer_init(&m);
-+	buffer_put_cstring(&m, role ? role : "");
++	if ((m = sshbuf_new()) == NULL)
++		fatal("%s: sshbuf_new failed", __func__);
++	if ((r = sshbuf_put_cstring(m, role ? role : "")) != 0)
++		fatal("%s: buffer error: %s", __func__, ssh_err(r));
++	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, m);
 +
-+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m);
-+
-+	buffer_free(&m);
++	sshbuf_free(m);
 +}
 +#endif
 +
  /* Do the password authentication */
  int
  mm_auth_password(struct ssh *ssh, char *password)
-diff -up openssh-7.4p1/monitor_wrap.h.role-mls openssh-7.4p1/monitor_wrap.h
---- openssh-7.4p1/monitor_wrap.h.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/monitor_wrap.h	2016-12-23 12:19:58.588459376 +0100
-@@ -42,6 +42,9 @@ int mm_is_monitor(void);
- int mm_key_sign(struct sshkey *, u_char **, u_int *, const u_char *, u_int,
-     const char *);
+diff -up openssh/monitor_wrap.h.role-mls openssh/monitor_wrap.h
+--- openssh/monitor_wrap.h.role-mls	2018-08-22 11:14:56.818430941 +0200
++++ openssh/monitor_wrap.h	2018-08-22 11:22:10.439929513 +0200
+@@ -44,6 +44,9 @@ DH *mm_choose_dh(int, int, int);
+ int mm_sshkey_sign(struct sshkey *, u_char **, size_t *, const u_char *, size_t,
+     const char *, u_int compat);
  void mm_inform_authserv(char *, char *);
 +#ifdef WITH_SELINUX
 +void mm_inform_authrole(char *);
@@ -330,10 +347,10 @@ diff -up openssh-7.4p1/monitor_wrap.h.role-mls openssh-7.4p1/monitor_wrap.h
  struct passwd *mm_getpwnamallow(const char *);
  char *mm_auth2_read_banner(void);
  int mm_auth_password(struct ssh *, char *);
-diff -up openssh-7.4p1/openbsd-compat/Makefile.in.role-mls openssh-7.4p1/openbsd-compat/Makefile.in
---- openssh-7.4p1/openbsd-compat/Makefile.in.role-mls	2016-12-23 12:19:58.588459376 +0100
-+++ openssh-7.4p1/openbsd-compat/Makefile.in	2016-12-23 12:24:06.042643938 +0100
-@@ -20,7 +20,8 @@ OPENBSD=base64.o basename.o bcrypt_pbkdf
+diff -up openssh/openbsd-compat/Makefile.in.role-mls openssh/openbsd-compat/Makefile.in
+--- openssh/openbsd-compat/Makefile.in.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/openbsd-compat/Makefile.in	2018-08-22 11:14:56.819430949 +0200
+@@ -92,7 +92,8 @@ PORTS=	port-aix.o \
  	port-linux.o \
  	port-solaris.o \
  	port-net.o \
@@ -343,10 +360,10 @@ diff -up openssh-7.4p1/openbsd-compat/Makefile.in.role-mls openssh-7.4p1/openbsd
  
  .c.o:
  	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-7.4p1/openbsd-compat/port-linux.c.role-mls openssh-7.4p1/openbsd-compat/port-linux.c
---- openssh-7.4p1/openbsd-compat/port-linux.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux.c	2016-12-23 12:19:58.590459369 +0100
-@@ -101,37 +101,6 @@ ssh_selinux_getctxbyname(char *pwname)
+diff -up openssh/openbsd-compat/port-linux.c.role-mls openssh/openbsd-compat/port-linux.c
+--- openssh/openbsd-compat/port-linux.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/openbsd-compat/port-linux.c	2018-08-22 11:14:56.819430949 +0200
+@@ -100,37 +100,6 @@ ssh_selinux_getctxbyname(char *pwname)
  	return sc;
  }
  
@@ -397,9 +414,9 @@ diff -up openssh-7.4p1/openbsd-compat/port-linux.c.role-mls openssh-7.4p1/openbs
  
  	/* XXX: should these calls fatal() upon failure in enforcing mode? */
  
-diff -up openssh-7.4p1/openbsd-compat/port-linux.h.role-mls openssh-7.4p1/openbsd-compat/port-linux.h
---- openssh-7.4p1/openbsd-compat/port-linux.h.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux.h	2016-12-23 12:19:58.591459365 +0100
+diff -up openssh/openbsd-compat/port-linux.h.role-mls openssh/openbsd-compat/port-linux.h
+--- openssh/openbsd-compat/port-linux.h.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/openbsd-compat/port-linux.h	2018-08-22 11:14:56.819430949 +0200
 @@ -20,9 +20,10 @@
  #ifdef WITH_SELINUX
  int ssh_selinux_enabled(void);
@@ -412,10 +429,10 @@ diff -up openssh-7.4p1/openbsd-compat/port-linux.h.role-mls openssh-7.4p1/openbs
  #endif
  
  #ifdef LINUX_OOM_ADJUST
-diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.role-mls openssh-7.4p1/openbsd-compat/port-linux-sshd.c
---- openssh-7.4p1/openbsd-compat/port-linux-sshd.c.role-mls	2016-12-23 12:19:58.590459369 +0100
-+++ openssh-7.4p1/openbsd-compat/port-linux-sshd.c	2016-12-23 12:19:58.590459369 +0100
-@@ -0,0 +1,424 @@
+diff -up openssh/openbsd-compat/port-linux-sshd.c.role-mls openssh/openbsd-compat/port-linux-sshd.c
+--- openssh/openbsd-compat/port-linux-sshd.c.role-mls	2018-08-22 11:14:56.819430949 +0200
++++ openssh/openbsd-compat/port-linux-sshd.c	2018-08-22 11:14:56.819430949 +0200
+@@ -0,0 +1,425 @@
 +/*
 + * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
 + * Copyright (c) 2014 Petr Lautrbach <plautrba@redhat.com>
@@ -444,13 +461,14 @@ diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.role-mls openssh-7.4p1/o
 +#include <stdarg.h>
 +#include <string.h>
 +#include <stdio.h>
++#include <stdlib.h>
 +
 +#include "log.h"
 +#include "xmalloc.h"
 +#include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
 +#include "servconf.h"
 +#include "port-linux.h"
-+#include "key.h"
++#include "sshkey.h"
 +#include "hostfile.h"
 +#include "auth.h"
 +
@@ -840,10 +858,10 @@ diff -up openssh-7.4p1/openbsd-compat/port-linux-sshd.c.role-mls openssh-7.4p1/o
 +#endif
 +#endif
 +
-diff -up openssh-7.4p1/platform.c.role-mls openssh-7.4p1/platform.c
---- openssh-7.4p1/platform.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/platform.c	2016-12-23 12:19:58.591459365 +0100
-@@ -184,7 +184,7 @@ platform_setusercontext_post_groups(stru
+diff -up openssh/platform.c.role-mls openssh/platform.c
+--- openssh/platform.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/platform.c	2018-08-22 11:14:56.819430949 +0200
+@@ -183,7 +183,7 @@ platform_setusercontext_post_groups(stru
  	}
  #endif /* HAVE_SETPCRED */
  #ifdef WITH_SELINUX
@@ -852,10 +870,10 @@ diff -up openssh-7.4p1/platform.c.role-mls openssh-7.4p1/platform.c
  #endif
  }
  
-diff -up openssh-7.4p1/sshd.c.role-mls openssh-7.4p1/sshd.c
---- openssh-7.4p1/sshd.c.role-mls	2016-12-19 05:59:41.000000000 +0100
-+++ openssh-7.4p1/sshd.c	2016-12-23 12:19:58.591459365 +0100
-@@ -2053,6 +2053,9 @@ main(int ac, char **av)
+diff -up openssh/sshd.c.role-mls openssh/sshd.c
+--- openssh/sshd.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/sshd.c	2018-08-22 11:14:56.820430957 +0200
+@@ -2186,6 +2186,9 @@ main(int ac, char **av)
  		restore_uid();
  	}
  #endif
@@ -865,16 +883,3 @@ diff -up openssh-7.4p1/sshd.c.role-mls openssh-7.4p1/sshd.c
  #ifdef USE_PAM
  	if (options.use_pam) {
  		do_pam_setcred(1);
---- openssh/configure.ac.role-mls	2017-09-27 12:54:52.926425979 +0200
-+++ openssh/configure.ac	2017-09-27 12:57:06.854224956 +0200
-@@ -4158,10 +4158,7 @@
- 			  LIBS="$LIBS -lselinux"
- 			],
- 			AC_MSG_ERROR([SELinux support requires libselinux library]))
--		SSHLIBS="$SSHLIBS $LIBSELINUX"
--		SSHDLIBS="$SSHDLIBS $LIBSELINUX"
- 		AC_CHECK_FUNCS([getseuserbyname get_default_context_with_level])
--		LIBS="$save_LIBS"
- 	fi ]
- )
- AC_SUBST([SSHLIBS])
diff --git a/openssh.spec b/openssh.spec
index 0beae40..a4fb7ad 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -65,10 +65,10 @@
 %endif
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%global openssh_ver 7.7p1
-%global openssh_rel 6
+%global openssh_ver 7.8p1
+%global openssh_rel 1
 %global pam_ssh_agent_ver 0.10.3
-%global pam_ssh_agent_rel 4
+%global pam_ssh_agent_rel 5
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
@@ -100,8 +100,6 @@ Patch100: openssh-6.7p1-coverity.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1894
 #https://bugzilla.redhat.com/show_bug.cgi?id=735889
 #Patch102: openssh-5.8p1-getaddrinfo.patch
-#https://bugzilla.mindrot.org/show_bug.cgi?id=1889
-Patch103: openssh-5.8p1-packet.patch
 # OpenSSL 1.1.0 compatibility
 Patch104: openssh-7.3p1-openssl-1.1.0.patch
 
@@ -129,7 +127,7 @@ Patch306: pam_ssh_agent_auth-0.10.2-compat.patch
 Patch307: pam_ssh_agent_auth-0.10.2-dereference.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
-Patch400: openssh-6.6p1-role-mls.patch
+Patch400: openssh-7.8p1-role-mls.patch
 #https://bugzilla.redhat.com/show_bug.cgi?id=781634
 Patch404: openssh-6.6p1-privsep-selinux.patch
 
@@ -157,12 +155,10 @@ Patch702: openssh-5.1p1-askpass-progress.patch
 Patch703: openssh-4.3p2-askpass-grab-info.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
 Patch707: openssh-7.7p1-redhat.patch
-#https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)
-Patch708: openssh-6.6p1-entropy.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)
 Patch709: openssh-6.2p1-vendor.patch
 # warn users for unsupported UsePAM=no (#757545)
-Patch711: openssh-7.2p2-UsePAM-UseLogin-warning.patch
+Patch711: openssh-7.8p1-UsePAM-warning.patch
 # make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL
 Patch712: openssh-6.3p1-ctr-evp-fast.patch
 # add cavs test binary for the aes-ctr
@@ -173,7 +169,7 @@ Patch714: openssh-6.7p1-kdf-cavs.patch
 
 #http://www.sxw.org.uk/computing/patches/openssh.html
 #changed cache storage type - #848228
-Patch800: openssh-7.2p1-gsskex.patch
+Patch800: openssh-7.8p1-gsskex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
 Patch801: openssh-6.6p1-force_krb.patch
 # add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
@@ -204,7 +200,7 @@ Patch918: openssh-6.6.1p1-log-in-chroot.patch
 # scp file into non-existing directory (#1142223)
 Patch919: openssh-6.6.1p1-scp-non-existing-directory.patch
 # Config parser shouldn't accept ip/port syntax (#1130733)
-Patch920: openssh-6.6.1p1-ip-port-config-parser.patch
+Patch920: openssh-7.8p1-ip-port-config-parser.patch
 # apply upstream patch and make sshd -T more consistent (#1187521)
 Patch922: openssh-6.8p1-sshdT-output.patch
 # Add sftp option to force mode of created files (#1191055)
@@ -213,8 +209,6 @@ Patch926: openssh-6.7p1-sftp-force-permission.patch
 Patch929: openssh-6.9p1-permit-root-login.patch
 # Add GSSAPIKexAlgorithms option for server and client application
 Patch932: openssh-7.0p1-gssKexAlgorithms.patch
-# Possibility to validate legacy systems by more fingerprints (#1249626)(#2439)
-Patch933: openssh-7.0p1-show-more-fingerprints.patch
 # make s390 use /dev/ crypto devices -- ignore closefrom
 Patch939: openssh-7.2p2-s390-closefrom.patch
 # Move MAX_DISPLAYS to a configuration option (#1341302)
@@ -229,8 +223,6 @@ Patch950: openssh-7.5p1-sandbox.patch
 Patch951: openssh-7.6p1-pkcs11-uri.patch
 # PKCS#11 ECDSA keys (upstream #2474, 8th iteration)
 Patch952: openssh-7.6p1-pkcs11-ecdsa.patch
-# Opening tun devices fails + other regressions in OpenSSH v7.7 (#2855, #1567775)
-Patch953: openssh-7.7p1-tun-devices.patch
 
 License: BSD
 Group: Applications/Internet
@@ -326,7 +318,7 @@ Requires: openssh = %{version}-%{release}
 Summary: PAM module for authentication with ssh-agent
 Group: System Environment/Base
 Version: %{pam_ssh_agent_ver}
-Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}.1
+Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}
 License: BSD
 
 %description
@@ -390,7 +382,6 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %endif
 
 # investigate %patch102 -p1 -b .getaddrinfo
-%patch103 -p1 -b .packet
 
 %if %{pam_ssh_agent}
 pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -421,7 +412,6 @@ popd
 %patch702 -p1 -b .progress
 %patch703 -p1 -b .grab-info
 %patch707 -p1 -b .redhat
-%patch708 -p1 -b .entropy
 %patch709 -p1 -b .vendor
 %patch711 -p1 -b .log-usepam-no
 %patch712 -p1 -b .evp-ctr
@@ -447,7 +437,6 @@ popd
 %patch926 -p1 -b .sftp-force-mode
 %patch929 -p1 -b .root-login
 %patch932 -p1 -b .gsskexalg
-%patch933 -p1 -b .fingerprint
 %patch939 -p1 -b .s390-dev
 %patch944 -p1 -b .x11max
 %patch948 -p1 -b .systemd
@@ -456,7 +445,6 @@ popd
 %patch950 -p1 -b .sandbox
 %patch951 -p1 -b .pkcs11-uri
 %patch952 -p1 -b .pkcs11-ecdsa
-%patch953 -p1 -b .tun-devices
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-race
diff --git a/pam_ssh_agent_auth-0.10.2-compat.patch b/pam_ssh_agent_auth-0.10.2-compat.patch
index da5c38c..a7fda5b 100644
--- a/pam_ssh_agent_auth-0.10.2-compat.patch
+++ b/pam_ssh_agent_auth-0.10.2-compat.patch
@@ -1,7 +1,15 @@
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/get_command_line.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/get_command_line.c	2017-02-07 14:41:20.483509205 +0100
-@@ -65,8 +65,8 @@ proc_pid_cmdline(char *** inargv)
+diff -up openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c
+--- openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/get_command_line.c	2018-08-24 10:22:56.281930322 +0200
+@@ -27,6 +27,7 @@
+  * or implied, of Jamie Beverly.
+  */
+ 
++#include <stdlib.h>
+ #include <stdio.h>
+ #include <errno.h>
+ #include <string.h>
+@@ -65,8 +66,8 @@ proc_pid_cmdline(char *** inargv)
                  case EOF:
                  case '\0':
                      if (len > 0) { 
@@ -12,7 +20,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat
                          strncpy(argv[count++], argbuf, len);
                          memset(argbuf, '\0', MAX_LEN_PER_CMDLINE_ARG + 1);
                          len = 0;
-@@ -105,9 +105,9 @@ pamsshagentauth_free_command_line(char *
+@@ -105,9 +106,9 @@ pamsshagentauth_free_command_line(char *
  {
      size_t i;
      for (i = 0; i < n_args; i++)
@@ -24,9 +32,43 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/get_command_line.c.psaa-compat
      return;
  }
  
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat	2017-02-07 14:41:20.479509208 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2017-02-07 14:41:20.481509206 +0100
+diff -up openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/identity.h
+--- openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/identity.h	2018-08-24 10:18:05.009393312 +0200
+@@ -30,8 +30,8 @@
+ #include "openbsd-compat/sys-queue.h"
+ #include "xmalloc.h"
+ #include "log.h"
+-#include "buffer.h"
+-#include "key.h"
++#include "sshbuf.h"
++#include "sshkey.h"
+ #include "authfd.h"
+ #include <stdio.h>
+ 
+@@ -41,7 +41,7 @@ typedef struct idlist Idlist;
+ struct identity {
+     TAILQ_ENTRY(identity) next;
+     AuthenticationConnection *ac;   /* set if agent supports key */
+-    Key *key;           /* public/private key */
++    struct sshkey *key;           /* public/private key */
+     char    *filename;      /* comment for agent-only keys */
+     int tried;
+     int isprivate;      /* key points to the private key */
+diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
+--- openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-compat	2018-08-24 10:18:05.007393297 +0200
++++ openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2018-08-24 10:18:32.937612513 +0200
+@@ -36,8 +36,8 @@
+ #include "openbsd-compat/sys-queue.h"
+ #include "xmalloc.h"
+ #include "log.h"
+-#include "buffer.h"
+-#include "key.h"
++#include "sshbuf.h"
++#include "sshkey.h"
+ #include "authfd.h"
+ #include <stdio.h>
+ #include <openssl/evp.h>
 @@ -58,6 +58,8 @@
  #include "get_command_line.h"
  extern char **environ;
@@ -45,25 +87,48 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-c
      for (i = 0; i < count; i++) {
          strcat(buf, (i > 0) ? " '" : "'");
          strncat(buf, action[i], MAX_LEN_PER_CMDLINE_ARG);
-@@ -90,12 +92,12 @@ void
- agent_action(Buffer *buf, char ** action, size_t count)
+@@ -87,21 +89,25 @@ log_action(char ** action, size_t count)
+ }
+ 
+ void
+-agent_action(Buffer *buf, char ** action, size_t count)
++agent_action(struct sshbuf *buf, char ** action, size_t count)
  {
      size_t i;
 -    pamsshagentauth_buffer_init(buf);
-+    buffer_init(buf);
++    int r;
  
 -    pamsshagentauth_buffer_put_int(buf, count);
-+    buffer_put_int(buf, count);
++    if ((buf = sshbuf_new()) == NULL)
++        fatal("%s: sshbuf_new failed", __func__);
++    if ((r = sshbuf_put_u32(buf, count)) != 0)
++        fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
      for (i = 0; i < count; i++) {
 -        pamsshagentauth_buffer_put_cstring(buf, action[i]);
-+        buffer_put_cstring(buf, action[i]);
++        if ((r = sshbuf_put_cstring(buf, action[i])) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
      }
  }
  
-@@ -119,17 +121,17 @@ pamsshagentauth_session_id2_gen(Buffer *
+ 
+-void
+-pamsshagentauth_session_id2_gen(Buffer * session_id2, const char * user,
++static void
++pamsshagentauth_session_id2_gen(struct sshbuf ** session_id2, const char * user,
+                                 const char * ruser, const char * servicename)
+ {
+     u_char *cookie = NULL;
+@@ -114,22 +116,23 @@ pamsshagentauth_session_id2_gen(Buffer *
+     char ** reported_argv = NULL;
+     size_t count = 0;
+     char * action_logbuf = NULL;
+-    Buffer action_agentbuf;
++    struct sshbuf *action_agentbuf = NULL;
+     uint8_t free_logbuf = 0;
      char * retc;
      int32_t reti;
++    int r;
  
 -    rnd = pamsshagentauth_arc4random();
 +    rnd = arc4random();
@@ -73,7 +138,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-c
      }
  
 -    cookie = pamsshagentauth_xcalloc(1,cookie_len);
-+    cookie = xcalloc(1,cookie_len);
++    cookie = xcalloc(1, cookie_len);
  
      for (i = 0; i < cookie_len; i++) {
          if (i % 4 == 0) {
@@ -82,21 +147,29 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-c
          }
          cookie[i] = (u_char) rnd;
          rnd >>= 8;
-@@ -144,7 +146,7 @@ pamsshagentauth_session_id2_gen(Buffer *
+@@ -139,12 +141,13 @@ pamsshagentauth_session_id2_gen(Buffer *
+     if (count > 0) { 
+         free_logbuf = 1;
+         action_logbuf = log_action(reported_argv, count);
+-        agent_action(&action_agentbuf, reported_argv, count);
++        agent_action(action_agentbuf, reported_argv, count);
+         pamsshagentauth_free_command_line(reported_argv, count);
      }
      else {
          action_logbuf = "unknown on this platform";
 -        pamsshagentauth_buffer_init(&action_agentbuf); /* stays empty, means unavailable */
-+        buffer_init(&action_agentbuf); /* stays empty, means unavailable */
++        if ((action_agentbuf = sshbuf_new()) == NULL) /* stays empty, means unavailable */
++            fatal("%s: sshbuf_new failed", __func__);
      }
      
      /*
-@@ -161,35 +163,35 @@ pamsshagentauth_session_id2_gen(Buffer *
+@@ -161,35 +163,39 @@ pamsshagentauth_session_id2_gen(Buffer *
      retc = getcwd(pwd, sizeof(pwd) - 1);
      time(&ts);
  
 -    pamsshagentauth_buffer_init(session_id2);
-+    buffer_init(session_id2);
++    if ((*session_id2 = sshbuf_new()) == NULL)
++        fatal("%s: sshbuf_new failed", __func__);
  
 -    pamsshagentauth_buffer_put_int(session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1);
 -    /* pamsshagentauth_debug3("cookie: %s", pamsshagentauth_tohex(cookie, cookie_len)); */
@@ -108,49 +181,81 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-c
 -    /* pamsshagentauth_debug3("servicename: %s", servicename); */
 -    pamsshagentauth_buffer_put_cstring(session_id2, servicename);
 -    /* pamsshagentauth_debug3("pwd: %s", pwd); */
-+    buffer_put_int(session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1);
-+    /* debug3("cookie: %s", tohex(cookie, cookie_len)); */
-+    buffer_put_string(session_id2, cookie, cookie_len);
-+    /* debug3("user: %s", user); */
-+    buffer_put_cstring(session_id2, user);
-+    /* debug3("ruser: %s", ruser); */
-+    buffer_put_cstring(session_id2, ruser);
-+    /* debug3("servicename: %s", servicename); */
-+    buffer_put_cstring(session_id2, servicename);
-+    /* debug3("pwd: %s", pwd); */
-     if(retc)
+-    if(retc)
 -        pamsshagentauth_buffer_put_cstring(session_id2, pwd);
-+        buffer_put_cstring(session_id2, pwd);
-     else
+-    else
 -        pamsshagentauth_buffer_put_cstring(session_id2, "");
 -    /* pamsshagentauth_debug3("action: %s", action_logbuf); */
 -    pamsshagentauth_buffer_put_string(session_id2, action_agentbuf.buf + action_agentbuf.offset, action_agentbuf.end - action_agentbuf.offset);
-+        buffer_put_cstring(session_id2, "");
-+    /* debug3("action: %s", action_logbuf); */
-+    buffer_put_string(session_id2, sshbuf_ptr(&action_agentbuf), sshbuf_len(&action_agentbuf));
++    if ((r = sshbuf_put_u32(*session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1)) != 0 ||
++        (r = sshbuf_put_string(*session_id2, cookie, cookie_len)) != 0 ||
++        (r = sshbuf_put_cstring(*session_id2, user)) != 0 ||
++        (r = sshbuf_put_cstring(*session_id2, ruser)) != 0 ||
++        (r = sshbuf_put_cstring(*session_id2, servicename)) != 0)
++        fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    if (retc) {
++        if ((r = sshbuf_put_cstring(*session_id2, pwd)) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    } else {
++        if ((r = sshbuf_put_cstring(*session_id2, "")) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    }
++    if ((r = sshbuf_put_stringb(*session_id2, action_agentbuf)) != 0)
++        fatal("%s: buffer error: %s", __func__, ssh_err(r));
      if (free_logbuf) { 
 -        pamsshagentauth_xfree(action_logbuf);
 -        pamsshagentauth_buffer_free(&action_agentbuf);
 +        free(action_logbuf);
-+        buffer_free(&action_agentbuf);
++        sshbuf_free(action_agentbuf);
      }
 -    /* pamsshagentauth_debug3("hostname: %s", hostname); */
-+    /* debug3("hostname: %s", hostname); */
-     if(reti >= 0)
+-    if(reti >= 0)
 -        pamsshagentauth_buffer_put_cstring(session_id2, hostname);
-+        buffer_put_cstring(session_id2, hostname);
-     else
+-    else
 -        pamsshagentauth_buffer_put_cstring(session_id2, "");
 -    /* pamsshagentauth_debug3("ts: %ld", ts); */
 -    pamsshagentauth_buffer_put_int64(session_id2, (uint64_t) ts);
-+        buffer_put_cstring(session_id2, "");
++    /* debug3("hostname: %s", hostname); */
++    if (reti >= 0) {
++        if ((r = sshbuf_put_cstring(*session_id2, hostname)) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    } else {
++        if ((r = sshbuf_put_cstring(*session_id2, "")) != 0)
++            fatal("%s: buffer error: %s", __func__, ssh_err(r));
++    }
 +    /* debug3("ts: %ld", ts); */
-+    buffer_put_int64(session_id2, (uint64_t) ts);
++    if ((r = sshbuf_put_u64(*session_id2, (uint64_t) ts)) != 0)
++        fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
      free(cookie);
      return;
-@@ -295,29 +297,29 @@ pamsshagentauth_find_authorized_keys(con
-     pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
+@@ -278,7 +280,8 @@ ssh_get_authentication_connection_for_ui
+ 
+ 	auth = xmalloc(sizeof(*auth));
+ 	auth->fd = sock;
+-	buffer_init(&auth->identities);
++	if ((auth->identities = sshbuf_new()) == NULL)
++           fatal("%s: sshbuf_new failed", __func__);
+ 	auth->howmany = 0;
+ 
+ 	return auth;
+@@ -287,43 +289,42 @@ ssh_get_authentication_connection_for_ui
+ int
+ pamsshagentauth_find_authorized_keys(const char * user, const char * ruser, const char * servicename)
+ {
+-    Buffer session_id2 = { 0 };
++    struct sshbuf *session_id2 = NULL;
+     Identity *id;
+-    Key *key;
++    struct sshkey *key;
+     AuthenticationConnection *ac;
+     char *comment;
+     uint8_t retval = 0;
+     uid_t uid = getpwnam(ruser)->pw_uid;
+ 
+     OpenSSL_add_all_digests();
+-    pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
++    pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
  
      if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
 -        pamsshagentauth_verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
@@ -163,7 +268,8 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-c
                  id->key = key;
                  id->filename = comment;
                  id->ac = ac;
-                 if(userauth_pubkey_from_id(ruser, id, &session_id2)) {
+-                if(userauth_pubkey_from_id(ruser, id, &session_id2)) {
++                if(userauth_pubkey_from_id(ruser, id, session_id2)) {
                      retval = 1;
                  }
 -                pamsshagentauth_xfree(id->filename);
@@ -177,18 +283,20 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-c
              }
          }
 -        pamsshagentauth_buffer_free(&session_id2);
-+        buffer_free(&session_id2);
++        sshbuf_free(session_id2);
          ssh_close_authentication_connection(ac);
      }
      else {
 -        pamsshagentauth_verbose("No ssh-agent could be contacted");
 +        verbose("No ssh-agent could be contacted");
      }
-     /* pamsshagentauth_xfree(session_id2); */
+-    /* pamsshagentauth_xfree(session_id2); */
      EVP_cleanup();
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat	2017-02-07 14:41:20.480509207 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c	2017-02-07 14:44:20.549369019 +0100
+     return retval;
+ }
+diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c
+--- openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compat	2018-08-24 10:18:05.008393305 +0200
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c	2018-08-24 10:18:05.009393312 +0200
 @@ -104,7 +104,7 @@ pam_sm_authenticate(pam_handle_t * pamh,
   * a patch 8-)
   */
@@ -276,10 +384,29 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_ssh_agent_auth.c.psaa-compa
      }
  
  cleanexit:
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c	2017-02-07 14:41:20.484509204 +0100
-@@ -117,12 +117,12 @@ parse_authorized_key_file(const char *us
+diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c
+--- openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c	2018-08-24 10:18:05.009393312 +0200
+@@ -66,8 +66,8 @@
+ #include "xmalloc.h"
+ #include "match.h"
+ #include "log.h"
+-#include "buffer.h"
+-#include "key.h"
++#include "sshbuf.h"
++#include "sshkey.h"
+ #include "misc.h"
+ 
+ #include "xmalloc.h"
+@@ -77,7 +77,6 @@
+ #include "pathnames.h"
+ #include "secure_filename.h"
+ 
+-#include "identity.h"
+ #include "pam_user_key_allowed2.h"
+ 
+ extern char *authorized_keys_file;
+@@ -117,12 +116,12 @@ parse_authorized_key_file(const char *us
          } else {
              slash_ptr = strchr(auth_keys_file_buf, '/');
              if(!slash_ptr)
@@ -294,7 +421,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa
  
              strncat(owner_uname, auth_keys_file_buf + 1, owner_uname_len);
              if(!authorized_keys_file_allowed_owner_uid)
-@@ -130,11 +130,11 @@ parse_authorized_key_file(const char *us
+@@ -130,11 +129,11 @@ parse_authorized_key_file(const char *us
                      getpwnam(owner_uname)->pw_uid;
          }
          authorized_keys_file =
@@ -308,7 +435,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa
                                                                percent_expand
                                                                later, we'd step
                                                                on this, so free
-@@ -150,7 +150,7 @@ parse_authorized_key_file(const char *us
+@@ -150,13 +149,13 @@ parse_authorized_key_file(const char *us
      strncat(hostname, fqdn, strcspn(fqdn, "."));
  #endif
      authorized_keys_file =
@@ -317,38 +444,78 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.c.psaa
                                         getpwnam(user)->pw_dir, "H", hostname,
                                         "f", fqdn, "u", user, NULL);
  }
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c	2017-02-07 14:41:20.484509204 +0100
-@@ -48,11 +48,13 @@
- #include "buffer.h"
+ 
+ int
+-pam_user_key_allowed(const char *ruser, Key * key)
++pam_user_key_allowed(const char *ruser, struct sshkey * key)
+ {
+     return
+         pamsshagentauth_user_key_allowed2(getpwuid(authorized_keys_file_allowed_owner_uid),
+diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h
+--- openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_authorized_keys.h	2018-08-24 10:18:05.010393320 +0200
+@@ -32,7 +32,7 @@
+ #define _PAM_USER_KEY_ALLOWED_H
+ 
+ #include "identity.h"
+-int pam_user_key_allowed(const char *, Key *);
++int pam_user_key_allowed(const char *, struct sshkey *);
+ void parse_authorized_key_file(const char *, const char *);
+ 
+ #endif
+diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c
+--- openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c	2018-08-24 10:18:05.010393320 +0200
+@@ -45,44 +45,46 @@
+ #include "xmalloc.h"
+ #include "ssh.h"
+ #include "ssh2.h"
+-#include "buffer.h"
++#include "sshbuf.h"
  #include "log.h"
  #include "compat.h"
+-#include "key.h"
 +#include "digest.h"
- #include "key.h"
++#include "sshkey.h"
  #include "pathnames.h"
  #include "misc.h"
  #include "secure_filename.h"
  #include "uidswap.h"
+-
+-#include "identity.h"
 +#include <unistd.h>
  
- #include "identity.h"
- 
-@@ -68,7 +70,7 @@ pamsshagentauth_check_authkeys_file(FILE
+ /* return 1 if user allows given key */
+ /* Modified slightly from original found in auth2-pubkey.c */
+ static int
+-pamsshagentauth_check_authkeys_file(FILE * f, char *file, Key * key)
++pamsshagentauth_check_authkeys_file(FILE * f, char *file, struct sshkey * key)
+ {
+-    char line[SSH_MAX_PUBKEY_BYTES];
++    char *line = NULL;
+     int found_key = 0;
+     u_long linenum = 0;
+-    Key *found;
++    struct sshkey *found;
      char *fp;
++    size_t linesize = 0;
  
      found_key = 0;
 -    found = pamsshagentauth_key_new(key->type);
-+    found = key_new(key->type);
++    found = sshkey_new(key->type);
  
-     while(read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
+-    while(read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
++    while ((getline(&line, &linesize, f)) != -1) {
          char *cp = NULL; /* *key_options = NULL; */
-@@ -78,11 +80,11 @@ pamsshagentauth_check_authkeys_file(FILE
+ 
++        linenum++;
+         /* Skip leading whitespace, empty and comment lines. */
+         for(cp = line; *cp == ' ' || *cp == '\t'; cp++);
          if(!*cp || *cp == '\n' || *cp == '#')
              continue;
  
 -        if(pamsshagentauth_key_read(found, &cp) != 1) {
-+        if(key_read(found, &cp) != 1) {
++        if (sshkey_read(found, &cp) != 0) {
              /* no key? check if there are options for this key */
              int quoted = 0;
  
@@ -357,20 +524,20 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
              /* key_options = cp; */
              for(; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
                  if(*cp == '\\' && cp[1] == '"')
-@@ -92,26 +94,26 @@ pamsshagentauth_check_authkeys_file(FILE
+@@ -92,26 +94,27 @@ pamsshagentauth_check_authkeys_file(FILE
              }
              /* Skip remaining whitespace. */
              for(; *cp == ' ' || *cp == '\t'; cp++);
 -            if(pamsshagentauth_key_read(found, &cp) != 1) {
 -                pamsshagentauth_verbose("user_key_allowed: advance: '%s'", cp);
-+            if(key_read(found, &cp) != 1) {
++            if(sshkey_read(found, &cp) != 0) {
 +                verbose("user_key_allowed: advance: '%s'", cp);
                  /* still no key? advance to next line */
                  continue;
              }
          }
 -        if(pamsshagentauth_key_equal(found, key)) {
-+        if(key_equal(found, key)) {
++        if(sshkey_equal(found, key)) {
              found_key = 1;
 -            pamsshagentauth_logit("matching key found: file/command %s, line %lu", file,
 +            logit("matching key found: file/command %s, line %lu", file,
@@ -379,23 +546,34 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
 -            pamsshagentauth_logit("Found matching %s key: %s",
 -                                  pamsshagentauth_key_type(found), fp);
 -            pamsshagentauth_xfree(fp);
-+            fp = sshkey_fingerprint(found, SSH_DIGEST_MD5, SSH_FP_HEX);
++            fp = sshkey_fingerprint(found, SSH_DIGEST_SHA256, SSH_FP_BASE64);
 +            logit("Found matching %s key: %s",
-+                                  key_type(found), fp);
++                                  sshkey_type(found), fp);
 +            free(fp);
              break;
          }
      }
 -    pamsshagentauth_key_free(found);
-+    key_free(found);
++    free(line);
++    sshkey_free(found);
      if(!found_key)
 -        pamsshagentauth_verbose("key not found");
 +        verbose("key not found");
      return found_key;
  }
  
-@@ -128,11 +130,11 @@ pamsshagentauth_user_key_allowed2(struct
-     char buf[SSH_MAX_PUBKEY_BYTES];
+@@ -120,19 +123,19 @@ pamsshagentauth_check_authkeys_file(FILE
+  * returns 1 if the key is allowed or 0 otherwise.
+  */
+ int
+-pamsshagentauth_user_key_allowed2(struct passwd *pw, Key * key, char *file)
++pamsshagentauth_user_key_allowed2(struct passwd *pw, struct sshkey * key, char *file)
+ {
+     FILE *f;
+     int found_key = 0;
+     struct stat st;
+-    char buf[SSH_MAX_PUBKEY_BYTES];
++    char buf[256];
  
      /* Temporarily use the user's uid. */
 -    pamsshagentauth_verbose("trying public key file %s", file);
@@ -408,7 +586,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
          return 0;
      }
  
-@@ -144,7 +146,7 @@ pamsshagentauth_user_key_allowed2(struct
+@@ -144,7 +147,7 @@ pamsshagentauth_user_key_allowed2(struct
  
      if(pamsshagentauth_secure_filename(f, file, pw, buf, sizeof(buf)) != 0) {
          fclose(f);
@@ -417,7 +595,16 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
          return 0;
      }
  
-@@ -187,44 +189,44 @@ pamsshagentauth_user_key_command_allowed
+@@ -160,7 +163,7 @@ pamsshagentauth_user_key_allowed2(struct
+ int
+ pamsshagentauth_user_key_command_allowed2(char *authorized_keys_command,
+                           char *authorized_keys_command_user,
+-                          struct passwd *user_pw, Key * key)
++                          struct passwd *user_pw, struct sshkey * key)
+ {
+     FILE *f;
+     int ok, found_key = 0;
+@@ -187,44 +190,44 @@ pamsshagentauth_user_key_command_allowed
      else {
          pw = getpwnam(authorized_keys_command_user);
          if(pw == NULL) {
@@ -470,7 +657,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
          close(p[0]);
          close(p[1]);
          return 0;
-@@ -234,13 +236,13 @@ pamsshagentauth_user_key_command_allowed
+@@ -234,13 +237,13 @@ pamsshagentauth_user_key_command_allowed
  
          /* do this before the setresuid so thta they can be logged */
          if((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
@@ -486,7 +673,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
              _exit(1);
          }
  #if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID)
-@@ -248,7 +250,7 @@ pamsshagentauth_user_key_command_allowed
+@@ -248,7 +251,7 @@ pamsshagentauth_user_key_command_allowed
  #else
          if (setgid(pw->pw_gid) != 0 || setegid(pw->pw_gid) != 0) {
  #endif
@@ -495,7 +682,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
                                       strerror(errno));
              _exit(1);
          }
-@@ -258,7 +260,7 @@ pamsshagentauth_user_key_command_allowed
+@@ -258,7 +261,7 @@ pamsshagentauth_user_key_command_allowed
  #else
          if (setuid(pw->pw_uid) != 0 || seteuid(pw->pw_uid) != 0) {
  #endif
@@ -504,7 +691,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
                                       strerror(errno));
              _exit(1);
          }
-@@ -270,18 +272,18 @@ pamsshagentauth_user_key_command_allowed
+@@ -270,18 +273,18 @@ pamsshagentauth_user_key_command_allowed
  
          /* pretty sure this will barf because we are now suid, but since we
             should't reach this anyway, I'll leave it here */
@@ -526,7 +713,7 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
          close(p[0]);
          /* Don't leave zombie child */
          while(waitpid(pid, NULL, 0) == -1 && errno == EINTR);
-@@ -292,22 +294,22 @@ pamsshagentauth_user_key_command_allowed
+@@ -292,22 +295,22 @@ pamsshagentauth_user_key_command_allowed
  
      while(waitpid(pid, &status, 0) == -1) {
          if(errno != EINTR) {
@@ -553,9 +740,33 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-co
 +    restore_uid();
      return found_key;
  }
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/secure_filename.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/secure_filename.c	2017-02-07 14:41:20.481509206 +0100
+diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h
+--- openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.h	2018-08-24 10:18:05.010393320 +0200
+@@ -32,7 +32,7 @@
+ #define _PAM_USER_KEY_ALLOWED_H
+ 
+ #include "identity.h"
+-int pamsshagentauth_user_key_allowed2(struct passwd *, Key *, char *);
+-int pamsshagentauth_user_key_command_allowed2(char *, char *, struct passwd *, Key *);
++int pamsshagentauth_user_key_allowed2(struct passwd *, struct sshkey *, char *);
++int pamsshagentauth_user_key_command_allowed2(char *, char *, struct passwd *, struct sshkey *);
+ 
+ #endif
+diff -up openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c
+--- openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/secure_filename.c	2018-08-24 10:18:05.010393320 +0200
+@@ -53,8 +53,8 @@
+ #include "xmalloc.h"
+ #include "match.h"
+ #include "log.h"
+-#include "buffer.h"
+-#include "key.h"
++#include "sshbuf.h"
++#include "sshkey.h"
+ #include "misc.h"
+ 
+ 
 @@ -80,7 +80,7 @@ pamsshagentauth_auth_secure_path(const c
  	int comparehome = 0;
  	struct stat st;
@@ -586,10 +797,24 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/secure_filename.c.psaa-compat o
  			    buf);
  			break;
  		}
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2017-02-07 14:41:20.484509204 +0100
-@@ -48,6 +48,8 @@
+diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
+--- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2018-08-24 10:22:13.202657025 +0200
+@@ -37,10 +37,11 @@
+ #include "xmalloc.h"
+ #include "ssh.h"
+ #include "ssh2.h"
+-#include "buffer.h"
++#include "sshbuf.h"
+ #include "log.h"
+ #include "compat.h"
+-#include "key.h"
++#include "sshkey.h"
++#include "ssherr.h"
+ #include "pathnames.h"
+ #include "misc.h"
+ #include "secure_filename.h"
+@@ -48,54 +48,59 @@
  #include "identity.h"
  #include "pam_user_authorized_keys.h"
  
@@ -598,7 +823,22 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-
  /* extern u_char  *session_id2;
  extern uint8_t  session_id_len;
   */
-@@ -65,37 +67,38 @@ userauth_pubkey_from_id(const char *ruse
+ 
+ int
+-userauth_pubkey_from_id(const char *ruser, Identity * id, Buffer * session_id2)
++userauth_pubkey_from_id(const char *ruser, Identity * id, struct sshbuf * session_id2)
+ {
+-    Buffer          b = { 0 };
++    struct sshbuf  *b = NULL;
+     char           *pkalg = NULL;
+     u_char         *pkblob = NULL, *sig = NULL;
+-    u_int           blen = 0, slen = 0;
++    size_t          blen = 0, slen = 0;
+-    int             authenticated = 0;
++    int             r, authenticated = 0;
+ 
+-    pkalg = (char *) key_ssh_name(id->key);
++    pkalg = (char *) sshkey_ssh_name(id->key);
  
      /* first test if this key is even allowed */
      if(! pam_user_key_allowed(ruser, id->key))
@@ -607,12 +847,13 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-
  
 -    if(pamsshagentauth_key_to_blob(id->key, &pkblob, &blen) == 0)
 -        goto user_auth_clean_exit;
-+    if(key_to_blob(id->key, &pkblob, &blen) == 0)
++    if(sshkey_to_blob(id->key, &pkblob, &blen) != 0)
 +        goto user_auth_clean_exit_without_buffer;
  
      /* construct packet to sign and test */
 -    pamsshagentauth_buffer_init(&b);
-+    buffer_init(&b);
++    if ((b = sshbuf_new()) == NULL)
++        fatal("%s: sshbuf_new failed", __func__);
  
 -    pamsshagentauth_buffer_put_string(&b, session_id2->buf + session_id2->offset, session_id2->end - session_id2->offset);
 -    pamsshagentauth_buffer_put_char(&b, SSH2_MSG_USERAUTH_TRUST_REQUEST); 
@@ -622,28 +863,29 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-
 -    pamsshagentauth_buffer_put_char(&b, 1);
 -    pamsshagentauth_buffer_put_cstring(&b, pkalg);
 -    pamsshagentauth_buffer_put_string(&b, pkblob, blen);
-+    buffer_put_string(&b, sshbuf_ptr(session_id2), sshbuf_len(session_id2));
-+    buffer_put_char(&b, SSH2_MSG_USERAUTH_TRUST_REQUEST); 
-+    buffer_put_cstring(&b, ruser);
-+    buffer_put_cstring(&b, "pam_ssh_agent_auth");
-+    buffer_put_cstring(&b, "publickey");
-+    buffer_put_char(&b, 1);
-+    buffer_put_cstring(&b, pkalg);
-+    buffer_put_string(&b, pkblob, blen);
++    if ((r = sshbuf_put_string(b, sshbuf_ptr(session_id2), sshbuf_len(session_id2))) != 0 ||
++        (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_TRUST_REQUEST)) != 0 ||
++        (r = sshbuf_put_cstring(b, ruser)) != 0 ||
++        (r = sshbuf_put_cstring(b, "pam_ssh_agent_auth")) != 0 ||
++        (r = sshbuf_put_cstring(b, "publickey")) != 0 ||
++        (r = sshbuf_put_u8(b, 1)) != 0 ||
++        (r = sshbuf_put_cstring(b, pkalg)) != 0 ||
++        (r = sshbuf_put_string(b, pkblob, blen)) != 0)
++        fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
 -    if(ssh_agent_sign(id->ac, id->key, &sig, &slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) != 0)
-+    if(ssh_agent_sign(id->ac, id->key, &sig, &slen, buffer_ptr(&b), buffer_len(&b)) != 0)
++    if (ssh_agent_sign(id->ac, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b)) != 0)
          goto user_auth_clean_exit;
  
      /* test for correct signature */
 -    if(pamsshagentauth_key_verify(id->key, sig, slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) == 1)
-+    if(key_verify(id->key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
++    if (sshkey_verify(id->key, sig, slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0) == 0)
          authenticated = 1;
  
    user_auth_clean_exit:
      /* if(&b != NULL) */
 -    pamsshagentauth_buffer_free(&b);
-+    buffer_free(&b);
++    sshbuf_free(b);
 +  user_auth_clean_exit_without_buffer:
      if(sig != NULL)
 -        pamsshagentauth_xfree(sig);
@@ -654,9 +896,22 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-
      CRYPTO_cleanup_all_ex_data();
      return authenticated;
  }
-diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/uuencode.c.psaa-compat openssh-7.4p1/pam_ssh_agent_auth-0.10.3/uuencode.c
---- openssh-7.4p1/pam_ssh_agent_auth-0.10.3/uuencode.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
-+++ openssh-7.4p1/pam_ssh_agent_auth-0.10.3/uuencode.c	2017-02-07 14:41:20.484509204 +0100
+diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h
+--- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.h	2018-08-24 10:18:05.010393320 +0200
+@@ -31,7 +31,7 @@
+ #ifndef _USERAUTH_PUBKEY_FROM_ID_H
+ #define _USERAUTH_PUBKEY_FROM_ID_H
+ 
+-#include <identity.h>
+-int userauth_pubkey_from_id(const char *, Identity *, Buffer *);
++#include "identity.h"
++int userauth_pubkey_from_id(const char *, Identity *, struct sshbuf *);
+ 
+ #endif
+diff -up openssh/pam_ssh_agent_auth-0.10.3/uuencode.c.psaa-compat openssh/pam_ssh_agent_auth-0.10.3/uuencode.c
+--- openssh/pam_ssh_agent_auth-0.10.3/uuencode.c.psaa-compat	2016-11-13 04:24:32.000000000 +0100
++++ openssh/pam_ssh_agent_auth-0.10.3/uuencode.c	2018-08-24 10:18:05.010393320 +0200
 @@ -56,7 +56,7 @@ pamsshagentauth_uudecode(const char *src
  	/* and remove trailing whitespace because __b64_pton needs this */
  	*p = '\0';
diff --git a/pam_ssh_agent_auth-0.10.2-dereference.patch b/pam_ssh_agent_auth-0.10.2-dereference.patch
index 351aea8..bf49c37 100644
--- a/pam_ssh_agent_auth-0.10.2-dereference.patch
+++ b/pam_ssh_agent_auth-0.10.2-dereference.patch
@@ -3,7 +3,7 @@ diff --git a/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c b/pam_ssh_agen
 +++ b/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c
 @@ -158,11 +158,12 @@ parse_authorized_key_file(const char *user,
  int
- pam_user_key_allowed(const char *ruser, Key * key)
+ pam_user_key_allowed(const char *ruser, struct sshkey * key)
  {
 +    struct passwd *pw;
      return
diff --git a/pam_ssh_agent_auth-0.9.3-agent_structure.patch b/pam_ssh_agent_auth-0.9.3-agent_structure.patch
index 6ff49d7..26ae902 100644
--- a/pam_ssh_agent_auth-0.9.3-agent_structure.patch
+++ b/pam_ssh_agent_auth-0.9.3-agent_structure.patch
@@ -7,7 +7,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-agent openssh/pam_ssh
  
 +typedef struct {
 +       int     fd;
-+       Buffer  identities;
++       struct sshbuf *identities;
 +       int     howmany;
 +}      AuthenticationConnection;
 +
@@ -18,8 +18,8 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent o
 --- openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent	2017-09-27 14:25:49.420739021 +0200
 +++ openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c	2017-09-27 14:25:49.421739027 +0200
 @@ -39,6 +39,7 @@
- #include "buffer.h"
- #include "key.h"
+ #include "sshbuf.h"
+ #include "sshkey.h"
  #include "authfd.h"
 +#include "ssherr.h"
  #include <stdio.h>
@@ -27,9 +27,9 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent o
  #include "ssh2.h"
 @@ -291,36 +292,43 @@ pamsshagentauth_find_authorized_keys(con
  {
-     Buffer session_id2 = { 0 };
+     struct sshbuf *session_id2 = NULL;
      Identity *id;
--    Key *key;
+-    struct sshkey *key;
      AuthenticationConnection *ac;
 -    char *comment;
      uint8_t retval = 0;
@@ -59,7 +59,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent o
 +                id->key = idlist->keys[i];
 +                id->filename = idlist->comments[i];
                  id->ac = ac;
-                 if(userauth_pubkey_from_id(ruser, id, &session_id2)) {
+                 if(userauth_pubkey_from_id(ruser, id, session_id2)) {
                      retval = 1;
                  }
 -                free(id->filename);
@@ -69,7 +69,7 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent o
                      break;
              }
          }
-         buffer_free(&session_id2);
+         sshbuf_free(session_id2);
 -        ssh_close_authentication_connection(ac);
 +        ssh_free_identitylist(idlist);
 +        ssh_close_authentication_socket(ac->fd);
@@ -78,91 +78,15 @@ diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent o
      }
      else {
          verbose("No ssh-agent could be contacted");
-diff -up openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c
---- openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c.psaa-agent	2017-09-27 14:26:04.277820716 +0200
-+++ openssh/pam_ssh_agent_auth-0.10.3/pam_user_key_allowed2.c	2017-09-27 14:26:34.426986497 +0200
-@@ -70,7 +70,7 @@ pamsshagentauth_check_authkeys_file(FILE
-     char *fp;
- 
-     found_key = 0;
--    found = key_new(key->type);
-+    found = sshkey_new(key->type);
- 
-     while(read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
-         char *cp = NULL; /* *key_options = NULL; */
-@@ -80,7 +80,7 @@ pamsshagentauth_check_authkeys_file(FILE
-         if(!*cp || *cp == '\n' || *cp == '#')
-             continue;
- 
--        if(key_read(found, &cp) != 1) {
-+        if(sshkey_read(found, &cp) != 0) {
-             /* no key? check if there are options for this key */
-             int quoted = 0;
- 
-@@ -94,24 +94,24 @@ pamsshagentauth_check_authkeys_file(FILE
-             }
-             /* Skip remaining whitespace. */
-             for(; *cp == ' ' || *cp == '\t'; cp++);
--            if(key_read(found, &cp) != 1) {
-+            if(sshkey_read(found, &cp) != 0) {
-                 verbose("user_key_allowed: advance: '%s'", cp);
-                 /* still no key? advance to next line */
-                 continue;
-             }
-         }
--        if(key_equal(found, key)) {
-+        if(sshkey_equal(found, key)) {
-             found_key = 1;
-             logit("matching key found: file/command %s, line %lu", file,
-                                   linenum);
-             fp = sshkey_fingerprint(found, SSH_DIGEST_MD5, SSH_FP_HEX);
-             logit("Found matching %s key: %s",
--                                  key_type(found), fp);
-+                                  sshkey_type(found), fp);
-             free(fp);
-             break;
-         }
-     }
--    key_free(found);
-+    sshkey_free(found);
-     if(!found_key)
-         verbose("key not found");
-     return found_key;
 diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
 --- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-agent	2017-09-27 14:25:49.420739021 +0200
 +++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2017-09-27 14:25:49.422739032 +0200
-@@ -57,10 +57,11 @@ extern uint8_t  session_id_len;
- int
- userauth_pubkey_from_id(const char *ruser, Identity * id, Buffer * session_id2)
- {
--    Buffer          b = { 0 };
-+    Buffer          b;
-     char           *pkalg = NULL;
-     u_char         *pkblob = NULL, *sig = NULL;
--    u_int           blen = 0, slen = 0;
-+    u_int           blen = 0;
-+    size_t          slen = 0;
-     int             authenticated = 0;
- 
-     pkalg = (char *) key_ssh_name(id->key);
 @@ -84,7 +85,7 @@ userauth_pubkey_from_id(const char *ruse
-     buffer_put_cstring(&b, pkalg);
-     buffer_put_string(&b, pkblob, blen);
+         (r = sshbuf_put_string(b, pkblob, blen)) != 0)
+         fatal("%s: buffer error: %s", __func__, ssh_err(r));
  
--    if(ssh_agent_sign(id->ac, id->key, &sig, &slen, buffer_ptr(&b), buffer_len(&b)) != 0)
-+    if(ssh_agent_sign(id->ac->fd, id->key, &sig, &slen, buffer_ptr(&b), buffer_len(&b), NULL, 0) != 0)
+-    if (ssh_agent_sign(id->ac, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b)) != 0)
++    if (ssh_agent_sign(id->ac->fd, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0) != 0)
          goto user_auth_clean_exit;
  
      /* test for correct signature */
-diff -up openssh-7.7p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-sshkey openssh-7.7p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
---- openssh-7.7p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-sshkey	2018-04-04 13:55:02.383899631 +0200
-+++ openssh-7.7p1/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c	2018-04-04 13:58:36.759339845 +0200
-@@ -89,7 +89,7 @@ userauth_pubkey_from_id(const char *ruse
-         goto user_auth_clean_exit;
- 
-     /* test for correct signature */
--    if(key_verify(id->key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
-+    if(sshkey_verify(id->key, sig, slen, buffer_ptr(&b), buffer_len(&b), NULL, 0) == 0)
-         authenticated = 1;
- 
-   user_auth_clean_exit:
diff --git a/pam_ssh_agent_auth-0.9.3-build.patch b/pam_ssh_agent_auth-0.9.3-build.patch
index 1a32bf1..f269b97 100644
--- a/pam_ssh_agent_auth-0.9.3-build.patch
+++ b/pam_ssh_agent_auth-0.9.3-build.patch
@@ -189,8 +189,8 @@ diff -up openssh-7.4p1/pam_ssh_agent_auth-0.10.3/Makefile.in.psaa-build openssh-
  
 -pam_ssh_agent_auth.so: $(LIBCOMPAT) $(SSHOBJS) $(ED25519OBJS) $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o
 -	$(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(ED25519OBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat pam_ssh_agent_auth.o $(LIBS) -lpam
-+pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o
-+	$(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat pam_ssh_agent_auth.o $(LIBS) -lpam
++pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS)  pam_ssh_agent_auth.o ../uidswap.o
++	$(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat pam_ssh_agent_auth.o ../uidswap.o $(LIBS) -lpam
  
  $(MANPAGES): $(MANPAGES_IN)
  	pod2man --section=8 --release=v0.10.3 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8
diff --git a/sources b/sources
index b591052..c3723f0 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-SHA512 (openssh-7.7p1.tar.gz) = 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
-SHA512 (openssh-7.7p1.tar.gz.asc) = 9445a589a84538fb0b4eae0f7bf6ce46def51b09254d6fffcc6ed64472f10ccf9e4d5d200387725043039d77ca886e2c8e8f3128e7969c582156fafb0783988d
+SHA512 (openssh-7.8p1.tar.gz) = 8e5b0c8682a9243e4e8b7c374ec989dccd1a752eb6f84e593b67141e8b23dcc8b9a7322b1f7525d18e2ce8830a767d0d9793f997486339db201a57986b910705
+SHA512 (openssh-7.8p1.tar.gz.asc) = 3a7bef84df3c07aa78965a11a6bbd6ca6e5d1e9265ac08871b3e5d304646be651b74f5302a195e86a56e6a83b19d79292e5599c9a9cf6f003a513d4354e8ad2f
 SHA512 (DJM-GPG-KEY.gpg) = db1191ed9b6495999e05eed2ef863fb5179bdb63e94850f192dad68eed8579836f88fbcfffd9f28524fe1457aff8cd248ee3e0afc112c8f609b99a34b80ecc0d
 SHA512 (pam_ssh_agent_auth-0.10.3.tar.bz2) = d75062c4e46b0b011f46aed9704a99049995fea8b5115ff7ee26dad7e93cbcf54a8af7efc6b521109d77dc03c6f5284574d2e1b84c6829cec25610f24fb4bd66