diff --color -ruNp a/auth2.c b/auth2.c

--- a/auth2.c	2024-08-28 12:35:01.189659493 +0200

+++ b/auth2.c	2024-08-28 12:35:41.246432045 +0200

@@ -71,6 +71,7 @@ extern Authmethod method_passwd;

 extern Authmethod method_kbdint;

 extern Authmethod method_hostbased;

 #ifdef GSSAPI

+extern Authmethod method_gsskeyex;

 extern Authmethod method_gssapi;

 #endif

@@ -78,6 +79,7 @@ Authmethod *authmethods[] = {

 	&method_none,

 	&method_pubkey,

 #ifdef GSSAPI

+	&method_gsskeyex,

 	&method_gssapi,

 #endif

 	&method_passwd,

diff --color -ruNp a/auth2-gss.c b/auth2-gss.c

--- a/auth2-gss.c	2024-08-28 12:35:01.189659493 +0200

+++ b/auth2-gss.c	2024-08-28 12:35:41.265432411 +0200

@@ -51,6 +51,7 @@

 #define SSH_GSSAPI_MAX_MECHS	2048

 extern ServerOptions options;

+extern struct authmethod_cfg methodcfg_gsskeyex;

 extern struct authmethod_cfg methodcfg_gssapi;

 static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh);

@@ -59,6 +60,48 @@ static int input_gssapi_exchange_complet

 static int input_gssapi_errtok(int, u_int32_t, struct ssh *);

 /*

+ * The 'gssapi_keyex' userauth mechanism.

+ */

+static int

+userauth_gsskeyex(struct ssh *ssh, const char *method)

+{

+	Authctxt *authctxt = ssh->authctxt;

+	int r, authenticated = 0;

+	struct sshbuf *b = NULL;

+	gss_buffer_desc mic, gssbuf;

+	u_char *p;

+	size_t len;

+

+	if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||

+	    (r = sshpkt_get_end(ssh)) != 0)

+		fatal_fr(r, "parsing");

+

+	if ((b = sshbuf_new()) == NULL)

+		fatal_f("sshbuf_new failed");

+

+	mic.value = p;

+	mic.length = len;

+

+	ssh_gssapi_buildmic(b, authctxt->user, authctxt->service,

+	    "gssapi-keyex", ssh->kex->session_id);

+

+	if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL)

+		fatal_f("sshbuf_mutable_ptr failed");

+	gssbuf.length = sshbuf_len(b);

+

+	/* gss_kex_context is NULL with privsep, so we can't check it here */

+	if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gss_kex_context,

+	    &gssbuf, &mic)))

+		authenticated = mm_ssh_gssapi_userok(authctxt->user,

+		    authctxt->pw, 1);

+

+	sshbuf_free(b);

+	free(mic.value);

+

+	return (authenticated);

+}

+

+/*

  * We only support those mechanisms that we know about (ie ones that we know

  * how to check local user kuserok and the like)

  */

@@ -267,7 +310,7 @@ input_gssapi_exchange_complete(int type,

 	if ((r = sshpkt_get_end(ssh)) != 0)

 		fatal_fr(r, "parse packet");

-	authenticated = mm_ssh_gssapi_userok(authctxt->user);

+ 	authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 1);

 	authctxt->postponed = 0;

 	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);

@@ -315,7 +358,7 @@ input_gssapi_mic(int type, u_int32_t ple

 	gssbuf.length = sshbuf_len(b);

 	if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))

-		authenticated = mm_ssh_gssapi_userok(authctxt->user);

+		authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 0);

 	else

 		logit("GSSAPI MIC check failed");

@@ -333,6 +376,11 @@ input_gssapi_mic(int type, u_int32_t ple

 	return 0;

 }

+Authmethod method_gsskeyex = {

+	&methodcfg_gsskeyex,

+	userauth_gsskeyex,

+};

+

 Authmethod method_gssapi = {

 	&methodcfg_gssapi,

 	userauth_gssapi,

diff --color -ruNp a/auth2-methods.c b/auth2-methods.c

--- a/auth2-methods.c	2024-07-01 06:36:28.000000000 +0200

+++ b/auth2-methods.c	2024-08-28 12:35:41.265432411 +0200

@@ -50,6 +50,11 @@ struct authmethod_cfg methodcfg_pubkey =

 	&options.pubkey_authentication

 };

 #ifdef GSSAPI

+struct authmethod_cfg methodcfg_gsskeyex = {

+	"gssapi-keyex",

+	NULL,

+	&options.gss_authentication

+};

 struct authmethod_cfg methodcfg_gssapi = {

 	"gssapi-with-mic",

 	NULL,

@@ -76,6 +81,7 @@ static struct authmethod_cfg *authmethod

 	&methodcfg_none,

 	&methodcfg_pubkey,

 #ifdef GSSAPI

+	&methodcfg_gsskeyex,

 	&methodcfg_gssapi,

 #endif

 	&methodcfg_passwd,

diff --color -ruNp a/auth.c b/auth.c

--- a/auth.c	2024-07-01 06:36:28.000000000 +0200

+++ b/auth.c	2024-08-28 12:35:41.245432026 +0200

@@ -356,7 +356,8 @@ auth_root_allowed(struct ssh *ssh, const

 	case PERMIT_NO_PASSWD:

 		if (strcmp(method, "publickey") == 0 ||

 		    strcmp(method, "hostbased") == 0 ||

-		    strcmp(method, "gssapi-with-mic") == 0)

+		    strcmp(method, "gssapi-with-mic") == 0 ||

+		    strcmp(method, "gssapi-keyex") == 0)

 			return 1;

 		break;

 	case PERMIT_FORCED_ONLY:

diff --color -ruNp a/canohost.c b/canohost.c

--- a/canohost.c	2024-07-01 06:36:28.000000000 +0200

+++ b/canohost.c	2024-08-28 12:35:41.246432045 +0200

@@ -35,6 +35,99 @@

 #include "canohost.h"

 #include "misc.h"

+/*

+ * Returns the remote DNS hostname as a string. The returned string must not

+ * be freed. NB. this will usually trigger a DNS query the first time it is

+ * called.

+ * This function does additional checks on the hostname to mitigate some

+ * attacks on legacy rhosts-style authentication.

+ * XXX is RhostsRSAAuthentication vulnerable to these?

+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)

+ */

+

+char *

+remote_hostname(struct ssh *ssh)

+{

+	struct sockaddr_storage from;

+	socklen_t fromlen;

+	struct addrinfo hints, *ai, *aitop;

+	char name[NI_MAXHOST], ntop2[NI_MAXHOST];

+	const char *ntop = ssh_remote_ipaddr(ssh);

+

+	/* Get IP address of client. */

+	fromlen = sizeof(from);

+	memset(&from, 0, sizeof(from));

+	if (getpeername(ssh_packet_get_connection_in(ssh),

+	    (struct sockaddr *)&from, &fromlen) == -1) {

+		debug("getpeername failed: %.100s", strerror(errno));

+		return xstrdup(ntop);

+	}

+

+	ipv64_normalise_mapped(&from, &fromlen);

+	if (from.ss_family == AF_INET6)

+		fromlen = sizeof(struct sockaddr_in6);

+

+	debug3("Trying to reverse map address %.100s.", ntop);

+	/* Map the IP address to a host name. */

+	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),

+	    NULL, 0, NI_NAMEREQD) != 0) {

+		/* Host name not found.  Use ip address. */

+		return xstrdup(ntop);

+	}

+

+	/*

+	 * if reverse lookup result looks like a numeric hostname,

+	 * someone is trying to trick us by PTR record like following:

+	 *	1.1.1.10.in-addr.arpa.	IN PTR	2.3.4.5

+	 */

+	memset(&hints, 0, sizeof(hints));

+	hints.ai_socktype = SOCK_DGRAM;	/*dummy*/

+	hints.ai_flags = AI_NUMERICHOST;

+	if (getaddrinfo(name, NULL, &hints, &ai) == 0) {

+		logit("Nasty PTR record \"%s\" is set up for %s, ignoring",

+		    name, ntop);

+		freeaddrinfo(ai);

+		return xstrdup(ntop);

+	}

+

+	/* Names are stored in lowercase. */

+	lowercase(name);

+

+	/*

+	 * Map it back to an IP address and check that the given

+	 * address actually is an address of this host.  This is

+	 * necessary because anyone with access to a name server can

+	 * define arbitrary names for an IP address. Mapping from

+	 * name to IP address can be trusted better (but can still be

+	 * fooled if the intruder has access to the name server of

+	 * the domain).

+	 */

+	memset(&hints, 0, sizeof(hints));

+	hints.ai_family = from.ss_family;

+	hints.ai_socktype = SOCK_STREAM;

+	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {

+		logit("reverse mapping checking getaddrinfo for %.700s "

+		    "[%s] failed.", name, ntop);

+		return xstrdup(ntop);

+	}

+	/* Look for the address from the list of addresses. */

+	for (ai = aitop; ai; ai = ai->ai_next) {

+		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,

+		    sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&

+		    (strcmp(ntop, ntop2) == 0))

+				break;

+	}

+	freeaddrinfo(aitop);

+	/* If we reached the end of the list, the address was not there. */

+	if (ai == NULL) {

+		/* Address not found for the host name. */

+		logit("Address %.100s maps to %.600s, but this does not "

+		    "map back to the address.", ntop, name);

+		return xstrdup(ntop);

+	}

+	return xstrdup(name);

+}

+

 void

 ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)

 {

diff --color -ruNp a/canohost.h b/canohost.h

--- a/canohost.h	2024-07-01 06:36:28.000000000 +0200

+++ b/canohost.h	2024-08-28 12:35:41.246432045 +0200

@@ -15,6 +15,9 @@

 #ifndef _CANOHOST_H

 #define _CANOHOST_H

+struct ssh;

+

+char		*remote_hostname(struct ssh *);

 char		*get_peer_ipaddr(int);

 int		 get_peer_port(int);

 char		*get_local_ipaddr(int);

diff --color -ruNp a/clientloop.c b/clientloop.c

--- a/clientloop.c	2024-07-01 06:36:28.000000000 +0200

+++ b/clientloop.c	2024-08-28 12:35:41.246432045 +0200

@@ -115,6 +115,10 @@

 #include "ssherr.h"

 #include "hostfile.h"

+#ifdef GSSAPI

+#include "ssh-gss.h"

+#endif

+

 /* Permitted RSA signature algorithms for UpdateHostkeys proofs */

 #define HOSTKEY_PROOF_RSA_ALGS	"rsa-sha2-512,rsa-sha2-256"

@@ -1590,6 +1594,14 @@ client_loop(struct ssh *ssh, int have_pt

 		/* Do channel operations. */

 		channel_after_poll(ssh, pfd, npfd_active);

+#ifdef GSSAPI

+			if (options.gss_renewal_rekey &&

+			    ssh_gssapi_credentials_updated(NULL)) {

+				debug("credentials updated - forcing rekey");

+				need_rekeying = 1;

+			}

+#endif

+

 		/* Buffer input from the connection.  */

 		if (conn_in_ready)

 			client_process_net_input(ssh);

diff --color -ruNp a/configure.ac b/configure.ac

--- a/configure.ac	2024-08-28 12:35:01.202659743 +0200

+++ b/configure.ac	2024-08-28 12:35:41.247432064 +0200

@@ -774,6 +774,30 @@ int main(void) { if (NSVersionOfRunTimeL

 	    [Use tunnel device compatibility to OpenBSD])

 	AC_DEFINE([SSH_TUN_PREPEND_AF], [1],

 	    [Prepend the address family to IP tunnel traffic])

+	AC_MSG_CHECKING([if we have the Security Authorization Session API])

+	AC_TRY_COMPILE([#include <Security/AuthSession.h>],

+		[SessionCreate(0, 0);],

+		[ac_cv_use_security_session_api="yes"

+		 AC_DEFINE([USE_SECURITY_SESSION_API], [1],

+			[platform has the Security Authorization Session API])

+		 LIBS="$LIBS -framework Security"

+		 AC_MSG_RESULT([yes])],

+		[ac_cv_use_security_session_api="no"

+		 AC_MSG_RESULT([no])])

+	AC_MSG_CHECKING([if we have an in-memory credentials cache])

+	AC_TRY_COMPILE(

+		[#include <Kerberos/Kerberos.h>],

+		[cc_context_t c;

+		 (void) cc_initialize (&c, 0, NULL, NULL);],

+		[AC_DEFINE([USE_CCAPI], [1],

+			[platform uses an in-memory credentials cache])

+		 LIBS="$LIBS -framework Security"

+		 AC_MSG_RESULT([yes])

+		 if test "x$ac_cv_use_security_session_api" = "xno"; then

+			AC_MSG_ERROR([*** Need a security framework to use the credentials cache API ***])

+		fi],

+		[AC_MSG_RESULT([no])]

+	)

 	m4_pattern_allow([AU_IPv])

 	AC_CHECK_DECL([AU_IPv4], [],

 	    AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])

diff --color -ruNp a/gss-genr.c b/gss-genr.c

--- a/gss-genr.c	2024-07-01 06:36:28.000000000 +0200

+++ b/gss-genr.c	2024-08-28 12:35:41.248432084 +0200

@@ -42,9 +42,33 @@

 #include "sshbuf.h"

 #include "log.h"

 #include "ssh2.h"

+#include "cipher.h"

+#include "sshkey.h"

+#include "kex.h"

+#include "digest.h"

+#include "packet.h"

 #include "ssh-gss.h"

+typedef struct {

+	char *encoded;

+	gss_OID oid;

+} ssh_gss_kex_mapping;

+

+/*

+ * XXX - It would be nice to find a more elegant way of handling the

+ * XXX   passing of the key exchange context to the userauth routines

+ */

+

+Gssctxt *gss_kex_context = NULL;

+

+static ssh_gss_kex_mapping *gss_enc2oid = NULL;

+

+int

+ssh_gssapi_oid_table_ok(void) {

+	return (gss_enc2oid != NULL);

+}

+

 /* sshbuf_get for gss_buffer_desc */

 int

 ssh_gssapi_get_buffer_desc(struct sshbuf *b, gss_buffer_desc *g)

@@ -60,6 +84,159 @@ ssh_gssapi_get_buffer_desc(struct sshbuf

 	return 0;

 }

+/* sshpkt_get of gss_buffer_desc */

+int

+ssh_gssapi_sshpkt_get_buffer_desc(struct ssh *ssh, gss_buffer_desc *g)

+{

+	int r;

+	u_char *p;

+	size_t len;

+

+	if ((r = sshpkt_get_string(ssh, &p, &len)) != 0)

+		return r;

+	g->value = p;

+	g->length = len;

+	return 0;

+}

+

+/*

+ * Return a list of the gss-group1-sha1 mechanisms supported by this program

+ *

+ * We test mechanisms to ensure that we can use them, to avoid starting

+ * a key exchange with a bad mechanism

+ */

+

+char *

+ssh_gssapi_client_mechanisms(const char *host, const char *client,

+    const char *kex) {

+	gss_OID_set gss_supported = NULL;

+	OM_uint32 min_status;

+

+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &gss_supported)))

+		return NULL;

+

+	return ssh_gssapi_kex_mechs(gss_supported, ssh_gssapi_check_mechanism,

+	    host, client, kex);

+}

+

+char *

+ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,

+    const char *host, const char *client, const char *kex) {

+	struct sshbuf *buf = NULL;

+	size_t i;

+	int r = SSH_ERR_ALLOC_FAIL;

+	int oidpos, enclen;

+	char *mechs, *encoded;

+	u_char digest[SSH_DIGEST_MAX_LENGTH];

+	char deroid[2];

+	struct ssh_digest_ctx *md = NULL;

+	char *s, *cp, *p;

+

+	if (gss_enc2oid != NULL) {

+		for (i = 0; gss_enc2oid[i].encoded != NULL; i++)

+			free(gss_enc2oid[i].encoded);

+		free(gss_enc2oid);

+	}

+

+	gss_enc2oid = xmalloc(sizeof(ssh_gss_kex_mapping) *

+	    (gss_supported->count + 1));

+

+	if ((buf = sshbuf_new()) == NULL)

+		fatal_f("sshbuf_new failed");

+

+	oidpos = 0;

+	s = cp = xstrdup(kex);

+	for (i = 0; i < gss_supported->count; i++) {

+		if (gss_supported->elements[i].length < 128 &&

+		    (*check)(NULL, &(gss_supported->elements[i]), host, client)) {

+

+			deroid[0] = SSH_GSS_OIDTYPE;

+			deroid[1] = gss_supported->elements[i].length;

+

+			if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||

+			    (r = ssh_digest_update(md, deroid, 2)) != 0 ||

+			    (r = ssh_digest_update(md,

+			        gss_supported->elements[i].elements,

+			        gss_supported->elements[i].length)) != 0 ||

+			    (r = ssh_digest_final(md, digest, sizeof(digest))) != 0)

+				fatal_fr(r, "digest failed");

+			ssh_digest_free(md);

+			md = NULL;

+

+			encoded = xmalloc(ssh_digest_bytes(SSH_DIGEST_MD5)

+			    * 2);

+			enclen = __b64_ntop(digest,

+			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,

+			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);

+

+			cp = strncpy(s, kex, strlen(kex));

+			for ((p = strsep(&cp, ",")); p && *p != '\0';

+				(p = strsep(&cp, ","))) {

+				if (sshbuf_len(buf) != 0 &&

+				    (r = sshbuf_put_u8(buf, ',')) != 0)

+					fatal_fr(r, "sshbuf_put_u8 error");

+				if ((r = sshbuf_put(buf, p, strlen(p))) != 0 ||

+				    (r = sshbuf_put(buf, encoded, enclen)) != 0)

+					fatal_fr(r, "sshbuf_put error");

+			}

+

+			gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);

+			gss_enc2oid[oidpos].encoded = encoded;

+			oidpos++;

+		}

+	}

+	free(s);

+	gss_enc2oid[oidpos].oid = NULL;

+	gss_enc2oid[oidpos].encoded = NULL;

+

+	if ((mechs = sshbuf_dup_string(buf)) == NULL)

+		fatal_f("sshbuf_dup_string failed");

+

+	sshbuf_free(buf);

+

+	if (strlen(mechs) == 0) {

+		free(mechs);

+		mechs = NULL;

+	}

+

+	return (mechs);

+}

+

+gss_OID

+ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {

+	int i = 0;

+

+#define SKIP_KEX_NAME(type) \

+	case type: \

+		if (strlen(name) < sizeof(type##_ID)) \

+			return GSS_C_NO_OID; \

+		name += sizeof(type##_ID) - 1; \

+		break;

+

+	switch (kex_type) {

+	SKIP_KEX_NAME(KEX_GSS_GRP1_SHA1)

+	SKIP_KEX_NAME(KEX_GSS_GRP14_SHA1)

+	SKIP_KEX_NAME(KEX_GSS_GRP14_SHA256)

+	SKIP_KEX_NAME(KEX_GSS_GRP16_SHA512)

+	SKIP_KEX_NAME(KEX_GSS_GEX_SHA1)

+	SKIP_KEX_NAME(KEX_GSS_NISTP256_SHA256)

+	SKIP_KEX_NAME(KEX_GSS_C25519_SHA256)

+	default:

+		return GSS_C_NO_OID;

+	}

+

+#undef SKIP_KEX_NAME

+

+	while (gss_enc2oid[i].encoded != NULL &&

+	    strcmp(name, gss_enc2oid[i].encoded) != 0)

+		i++;

+

+	if (gss_enc2oid[i].oid != NULL && ctx != NULL)

+		ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);

+

+	return gss_enc2oid[i].oid;

+}

+

 /* Check that the OID in a data stream matches that in the context */

 int

 ssh_gssapi_check_oid(Gssctxt *ctx, void *data, size_t len)

@@ -216,7 +393,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int de

 	}

 	ctx->major = gss_init_sec_context(&ctx->minor,

-	    GSS_C_NO_CREDENTIAL, &ctx->context, ctx->name, ctx->oid,

+	    ctx->client_creds, &ctx->context, ctx->name, ctx->oid,

 	    GSS_C_MUTUAL_FLAG | GSS_C_INTEG_FLAG | deleg_flag,

 	    0, NULL, recv_tok, NULL, send_tok, flags, NULL);

@@ -246,8 +423,42 @@ ssh_gssapi_import_name(Gssctxt *ctx, con

 }

 OM_uint32

+ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)

+{

+	gss_buffer_desc gssbuf;

+	gss_name_t gssname;

+	OM_uint32 status;

+	gss_OID_set oidset;

+

+	gssbuf.value = (void *) name;

+	gssbuf.length = strlen(gssbuf.value);

+

+	gss_create_empty_oid_set(&status, &oidset);

+	gss_add_oid_set_member(&status, ctx->oid, &oidset);

+

+	ctx->major = gss_import_name(&ctx->minor, &gssbuf,

+	    GSS_C_NT_USER_NAME, &gssname);

+

+	if (!ctx->major)

+		ctx->major = gss_acquire_cred(&ctx->minor,

+		    gssname, 0, oidset, GSS_C_INITIATE,

+		    &ctx->client_creds, NULL, NULL);

+

+	gss_release_name(&status, &gssname);

+	gss_release_oid_set(&status, &oidset);

+

+	if (ctx->major)

+		ssh_gssapi_error(ctx);

+

+	return(ctx->major);

+}

+

+OM_uint32

 ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)

 {

+	if (ctx == NULL)

+		return -1;

+

 	if ((ctx->major = gss_get_mic(&ctx->minor, ctx->context,

 	    GSS_C_QOP_DEFAULT, buffer, hash)))

 		ssh_gssapi_error(ctx);

@@ -255,6 +466,19 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer

 	return (ctx->major);

 }

+/* Priviledged when used by server */

+OM_uint32

+ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)

+{

+	if (ctx == NULL)

+		return -1;

+

+	ctx->major = gss_verify_mic(&ctx->minor, ctx->context,

+	    gssbuf, gssmic, NULL);

+

+	return (ctx->major);

+}

+

 void

 ssh_gssapi_buildmic(struct sshbuf *b, const char *user, const char *service,

     const char *context, const struct sshbuf *session_id)

@@ -271,11 +495,16 @@ ssh_gssapi_buildmic(struct sshbuf *b, co

 }

 int

-ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)

+ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host,

+    const char *client)

 {

 	gss_buffer_desc token = GSS_C_EMPTY_BUFFER;

 	OM_uint32 major, minor;

 	gss_OID_desc spnego_oid = {6, (void *)"\x2B\x06\x01\x05\x05\x02"};

+	Gssctxt *intctx = NULL;

+

+	if (ctx == NULL)

+		ctx = &intct;;

 	/* RFC 4462 says we MUST NOT do SPNEGO */

 	if (oid->length == spnego_oid.length &&

@@ -285,6 +514,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx

 	ssh_gssapi_build_ctx(ctx);

 	ssh_gssapi_set_oid(*ctx, oid);

 	major = ssh_gssapi_import_name(*ctx, host);

+

+	if (!GSS_ERROR(major) && client)

+		major = ssh_gssapi_client_identity(*ctx, client);

+

 	if (!GSS_ERROR(major)) {

 		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token,

 		    NULL);

@@ -294,10 +527,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx

 			    GSS_C_NO_BUFFER);

 	}

-	if (GSS_ERROR(major))

+	if (GSS_ERROR(major) || intctx != NULL)

 		ssh_gssapi_delete_ctx(ctx);

 	return (!GSS_ERROR(major));

 }

+int

+ssh_gssapi_credentials_updated(Gssctxt *ctxt) {

+	static gss_name_t saved_name = GSS_C_NO_NAME;

+	static OM_uint32 saved_lifetime = 0;

+	static gss_OID saved_mech = GSS_C_NO_OID;

+	static gss_name_t name;

+	static OM_uint32 last_call = 0;

+	OM_uint32 lifetime, now, major, minor;

+	int equal;

+

+	now = time(NULL);

+

+	if (ctxt) {

+		debug("Rekey has happened - updating saved versions");

+

+		if (saved_name != GSS_C_NO_NAME)

+			gss_release_name(&minor, &saved_name);

+

+		major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,

+		    &saved_name, &saved_lifetime, NULL, NULL);

+

+		if (!GSS_ERROR(major)) {

+			saved_mech = ctxt->oid;

+		        saved_lifetime+= now;

+		} else {

+			/* Handle the error */

+		}

+		return 0;

+	}

+

+	if (now - last_call < 10)

+		return 0;

+

+	last_call = now;

+

+	if (saved_mech == GSS_C_NO_OID)

+		return 0;

+

+	major = gss_inquire_cred(&minor, GSS_C_NO_CREDENTIAL,

+	    &name, &lifetime, NULL, NULL);

+	if (major == GSS_S_CREDENTIALS_EXPIRED)

+		return 0;

+	else if (GSS_ERROR(major))

+		return 0;

+

+	major = gss_compare_name(&minor, saved_name, name, &equal);

+	gss_release_name(&minor, &name);

+	if (GSS_ERROR(major))

+		return 0;

+

+	if (equal && (saved_lifetime < lifetime + now - 10))

+		return 1;

+

+	return 0;

+}

+

 #endif /* GSSAPI */

diff --color -ruNp a/gss-serv.c b/gss-serv.c

--- a/gss-serv.c	2024-07-01 06:36:28.000000000 +0200

+++ b/gss-serv.c	2024-08-28 12:35:41.248432084 +0200

@@ -1,7 +1,7 @@

 /* $OpenBSD: gss-serv.c,v 1.32 2020/03/13 03:17:07 djm Exp $ */

 /*

- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.

+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

@@ -44,17 +44,19 @@

 #include "session.h"

 #include "misc.h"

 #include "servconf.h"

+#include "uidswap.h"

 #include "ssh-gss.h"

+#include "monitor_wrap.h"

 extern ServerOptions options;

 static ssh_gssapi_client gssapi_client =

-    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,

-    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}};

+    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,

+    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};

 ssh_gssapi_mech gssapi_null_mech =

-    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL};

+    { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};

 #ifdef KRB5

 extern ssh_gssapi_mech gssapi_kerberos_mech;

@@ -141,6 +143,29 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss

 }

 /* Unprivileged */

+char *

+ssh_gssapi_server_mechanisms(void) {

+	if (supported_oids == NULL)

+		ssh_gssapi_prepare_supported_oids();

+	return (ssh_gssapi_kex_mechs(supported_oids,

+	    &ssh_gssapi_server_check_mech, NULL, NULL,

+	    options.gss_kex_algorithms));

+}

+

+/* Unprivileged */

+int

+ssh_gssapi_server_check_mech(Gssctxt **dum, gss_OID oid, const char *data,

+    const char *dummy) {

+	Gssctxt *ctx = NULL;

+	int res;

+

+	res = !GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctx, oid));

+	ssh_gssapi_delete_ctx(&ctx;;

+

+	return (res);

+}

+

+/* Unprivileged */

 void

 ssh_gssapi_supported_oids(gss_OID_set *oidset)

 {

@@ -150,7 +175,9 @@ ssh_gssapi_supported_oids(gss_OID_set *o

 	gss_OID_set supported;

 	gss_create_empty_oid_set(&min_status, oidset);

-	gss_indicate_mechs(&min_status, &supported);

+

+	if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported)))

+		return;

 	while (supported_mechs[i]->name != NULL) {

 		if (GSS_ERROR(gss_test_oid_set_member(&min_status,

@@ -276,8 +303,48 @@ OM_uint32

 ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)

 {

 	int i = 0;

+	int equal = 0;

+	gss_name_t new_name = GSS_C_NO_NAME;

+	gss_buffer_desc ename = GSS_C_EMPTY_BUFFER;

+

+	if (options.gss_store_rekey && client->used && ctx->client_creds) {

+		if (client->mech->oid.length != ctx->oid->length ||

+		    (memcmp(client->mech->oid.elements,

+		     ctx->oid->elements, ctx->oid->length) !=0)) {

+			debug("Rekeyed credentials have different mechanism");

+			return GSS_S_COMPLETE;

+		}

-	gss_buffer_desc ename;

+		if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor,

+		    ctx->client_creds, ctx->oid, &new_name,

+		    NULL, NULL, NULL))) {

+			ssh_gssapi_error(ctx);

+			return (ctx->major);

+		}

+

+		ctx->major = gss_compare_name(&ctx->minor, client->name,

+		    new_name, &equal);

+

+		if (GSS_ERROR(ctx->major)) {

+			ssh_gssapi_error(ctx);

+			return (ctx->major);

+		}

+

+		if (!equal) {

+			debug("Rekeyed credentials have different name");

+			return GSS_S_COMPLETE;

+		}

+

+		debug("Marking rekeyed credentials for export");

+

+		gss_release_name(&ctx->minor, &client->name);

+		gss_release_cred(&ctx->minor, &client->creds);

+		client->name = new_name;

+		client->creds = ctx->client_creds;

+		ctx->client_creds = GSS_C_NO_CREDENTIAL;

+		client->updated = 1;

+		return GSS_S_COMPLETE;

+	}

 	client->mech = NULL;

@@ -292,6 +359,13 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g

 	if (client->mech == NULL)

 		return GSS_S_FAILURE;

+	if (ctx->client_creds &&

+	    (ctx->major = gss_inquire_cred_by_mech(&ctx->minor,

+	     ctx->client_creds, ctx->oid, &client->name, NULL, NULL, NULL))) {

+		ssh_gssapi_error(ctx);

+		return (ctx->major);

+	}

+

 	if ((ctx->major = gss_display_name(&ctx->minor, ctx->client,

 	    &client->displayname, NULL))) {

 		ssh_gssapi_error(ctx);

@@ -309,6 +383,8 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g

 		return (ctx->major);

 	}

+	gss_release_buffer(&ctx->minor, &ename);

+

 	/* We can't copy this structure, so we just move the pointer to it */

 	client->creds = ctx->client_creds;

 	ctx->client_creds = GSS_C_NO_CREDENTIAL;

@@ -319,11 +395,20 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g

 void

 ssh_gssapi_cleanup_creds(void)

 {

-	if (gssapi_client.store.filename != NULL) {

-		/* Unlink probably isn't sufficient */

-		debug("removing gssapi cred file\"%s\"",

-		    gssapi_client.store.filename);

-		unlink(gssapi_client.store.filename);

+	krb5_ccache ccache = NULL;

+	krb5_error_code problem;

+

+	if (gssapi_client.store.data != NULL) {

+		if ((problem = krb5_cc_resolve(gssapi_client.store.data, gssapi_client.store.envval, &ccache))) {

+			debug_f("krb5_cc_resolve(): %.100s",

+				krb5_get_err_text(gssapi_client.store.data, problem));

+		} else if ((problem = krb5_cc_destroy(gssapi_client.store.data, ccache))) {

+			debug_f("krb5_cc_destroy(): %.100s",

+				krb5_get_err_text(gssapi_client.store.data, problem));

+		} else {

+			krb5_free_context(gssapi_client.store.data);

+			gssapi_client.store.data = NULL;

+		}

 	}

 }

@@ -356,19 +441,23 @@ ssh_gssapi_do_child(char ***envp, u_int

 /* Privileged */

 int

-ssh_gssapi_userok(char *user)

+ssh_gssapi_userok(char *user, struct passwd *pw, int kex)

 {

 	OM_uint32 lmin;

+	(void) kex; /* used in privilege separation */

+

 	if (gssapi_client.exportedname.length == 0 ||

 	    gssapi_client.exportedname.value == NULL) {