3 files changed, 52 insertions, 17 deletions

diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index 152d30af5956..4e29781b7e66 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -39,7 +39,6 @@ x509_CONFLICTS_INSTALL=		openssh-portable openssh-portable-hpn \
 				openssh-portable-gssapi
 x509_PKGNAMESUFFIX=		-portable-x509
 
-gssapi_BROKEN=		GSSAPI not yet updated for ${DISTVERSION}
 x509_BROKEN=		X509 not yet updated for ${DISTVERSION} - Does anyone use this? Contact maintainer bdrewery@FreeBSD.org
 OPTIONS_DEFINE=		DOCS PAM TCP_WRAPPERS LIBEDIT BSM \
 			HPN X509 KERB_GSSAPI \
@@ -101,7 +100,7 @@ ETCDIR?=		${PREFIX}/etc/ssh
 
 .include <bsd.port.pre.mk>
 
-PATCH_SITES+=		http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,x509,hpn,gsskex
+PATCH_SITES+=	http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,x509,hpn,gsskex
 
 # X509 patch includes TCP Wrapper support already
 .if ${PORT_OPTIONS:MX509}
@@ -111,16 +110,19 @@ EXTRA_PATCHES:=		${EXTRA_PATCHES:N${TCP_WRAPPERS_EXTRA_PATCHES}}
 # Must add this patch before HPN due to conflicts
 .if ${PORT_OPTIONS:MKERB_GSSAPI}
 #BROKEN=	KERB_GSSAPI No patch for ${DISTVERSION} yet.
-# Patch from:
-# https://sources.debian.org/data/main/o/openssh/1:7.7p1-2/debian/patches/gssapi.patch
-# which was originally based on 5.7 patch from
-# http://www.sxw.org.uk/computing/patches/
-# It is mirrored simply to apply gzip -9.
 .  if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER}
 # Needed glue for applying HPN patch without conflict
 EXTRA_PATCHES+=	${FILESDIR}/extra-patch-hpn-gss-glue
 .  endif
-PATCHFILES+=	openssh-7.9p1-gsskex-all-20141021-debian-rh-20181020.patch.gz:-p1:gsskex
+# - See https://sources.debian.org/data/main/o/openssh/ for which subdir to
+# pull from.
+GSSAPI_DEBIAN_SUBDIR=	${DISTVERSION}-3
+# - Debian does not use a versioned filename so we trick fetch to make one for
+# us with the ?<anything>=/ trick.
+PATCH_SITES+=	https://sources.debian.org/data/main/o/openssh/1:${GSSAPI_DEBIAN_SUBDIR}/debian/patches/gssapi.patch?dummy=/:gsskex
+# Bump this when updating the patch location
+GSSAPI_UPDATE_DATE=	20190719
+PATCHFILES+=	openssh-${DISTVERSION}-gsskex-all-20141021-debian-rh-${GSSAPI_UPDATE_DATE}.patch:-p1:gsskex
 .endif
 
 # https://www.psc.edu/hpn-ssh https://github.com/rapier1/openssh-portable/tree/hpn-openssl1.1-7_7_P1
diff --git a/security/openssh-portable/distinfo b/security/openssh-portable/distinfo
index d957d0d10a1f..83a81cddafa9 100644
--- a/security/openssh-portable/distinfo
+++ b/security/openssh-portable/distinfo
@@ -3,5 +3,5 @@ SHA256 (openssh-8.0p1.tar.gz) = bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0
 SIZE (openssh-8.0p1.tar.gz) = 1597697
 SHA256 (openssh-7.9p1+x509-11.5.diff.gz) = 1d15099ce54614f158f10f55b6b4992d915353f92a05e179a64b0655650c00bb
 SIZE (openssh-7.9p1+x509-11.5.diff.gz) = 594995
-SHA256 (openssh-7.9p1-gsskex-all-20141021-debian-rh-20181020.patch.gz) = a9fe46bc97ebb6f32dad44c6e62e712b224392463b2084300835736fe848eabc
-SIZE (openssh-7.9p1-gsskex-all-20141021-debian-rh-20181020.patch.gz) = 27612
+SHA256 (openssh-8.0p1-gsskex-all-20141021-debian-rh-20190719.patch) = 6e07d74626915246d500eeaf9bfb23b1329d6e204d81ba67c09c9c237626c250
+SIZE (openssh-8.0p1-gsskex-all-20141021-debian-rh-20190719.patch) = 128374
diff --git a/security/openssh-portable/files/extra-patch-hpn-gss-glue b/security/openssh-portable/files/extra-patch-hpn-gss-glue
index 630b7a1bbbd2..57b47e8b023a 100644
--- a/security/openssh-portable/files/extra-patch-hpn-gss-glue
+++ b/security/openssh-portable/files/extra-patch-hpn-gss-glue
@@ -1,10 +1,10 @@
---- sshconnect2.c.orig	2016-01-19 18:10:12.550854000 -0800
-+++ sshconnect2.c	2016-01-19 18:10:27.290409000 -0800
-@@ -160,11 +160,6 @@ ssh_kex2(char *host, struct sockaddr *ho
- 	struct kex *kex;
+--- sshconnect2.c.orig	2019-07-19 11:53:14.918867000 -0700
++++ sshconnect2.c	2019-07-19 11:53:16.911086000 -0700
+@@ -159,11 +159,6 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr 
+ 	char *s, *all_key;
  	int r;
  
--#ifdef GSSAPI
+-#if defined(GSSAPI) && defined(WITH_OPENSSL)
 -	char *orig = NULL, *gss = NULL;
 -	char *gss_host = NULL;
 -#endif
@@ -12,13 +12,46 @@
  	xxx_host = host;
  	xxx_hostaddr = hostaddr;
  
-@@ -199,6 +194,9 @@ ssh_kex2(char *host, struct sockaddr *ho
+@@ -197,6 +192,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr 
  	}
  
- #ifdef GSSAPI
+ #if defined(GSSAPI) && defined(WITH_OPENSSL)
 +	char *orig = NULL, *gss = NULL;
 +	char *gss_host = NULL;
 +
  	if (options.gss_keyex) {
  		/* Add the GSSAPI mechanisms currently supported on this
  		 * client to the key exchange algorithm proposal */
+--- readconf.c.orig	2019-07-19 12:13:18.000312000 -0700
++++ readconf.c	2019-07-19 12:13:29.614552000 -0700
+@@ -63,11 +63,11 @@
+ #include "readconf.h"
+ #include "match.h"
+ #include "kex.h"
++#include "ssh-gss.h"
+ #include "mac.h"
+ #include "uidswap.h"
+ #include "myproposal.h"
+ #include "digest.h"
+-#include "ssh-gss.h"
+ 
+ /* Format of the configuration file:
+ 
+--- servconf.c.orig	2019-07-19 12:14:42.078398000 -0700
++++ servconf.c	2019-07-19 12:14:43.543687000 -0700
+@@ -54,6 +54,7 @@
+ #include "sshkey.h"
+ #include "kex.h"
+ #include "mac.h"
++#include "ssh-gss.h"
+ #include "match.h"
+ #include "channels.h"
+ #include "groupaccess.h"
+@@ -64,7 +65,6 @@
+ #include "auth.h"
+ #include "myproposal.h"
+ #include "digest.h"
+-#include "ssh-gss.h"
+ 
+ static void add_listen_addr(ServerOptions *, const char *,
+     const char *, int);