This commit was generated by cvs2svn to compensate for changes in r113908,

which included commits to RCS files with non-trunk default branches.

90 files changed, 3375 insertions, 1208 deletions

diff --git a/crypto/openssh/ChangeLog b/crypto/openssh/ChangeLog
index 8760466..ebde747 100644
--- a/crypto/openssh/ChangeLog
+++ b/crypto/openssh/ChangeLog
@@ -1,3 +1,541 @@
+20030401
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2003/03/28 10:11:43
+     [scp.1 sftp.1 ssh.1 ssh-add.1 ssh-agent.1 ssh_config.5 sshd_config.5]
+     [ssh-keygen.1 ssh-keyscan.1 ssh-keysign.8]
+     - killed whitespace
+     - new sentence new line
+     - .Bk for arguments
+     ok markus@
+   - markus@cvs.openbsd.org 2003/04/01 10:10:23
+     [clientloop.c monitor.c monitor_wrap.c packet.c packet.h readconf.c]
+     [readconf.h serverloop.c sshconnect2.c]
+     rekeying bugfixes and automatic rekeying:
+     * both client and server rekey _automatically_
+           (a) after 2^31 packets, because after 2^32 packets
+               the sequence number for packets wraps
+           (b) after 2^(blocksize_in_bits/4) blocks
+       (see: draft-ietf-secsh-newmodes-00.txt)
+       (a) and (b) are _enabled_ by default, and only disabled for known
+       openssh versions, that don't support rekeying properly.
+     * client option 'RekeyLimit'
+     * do not reply to requests during rekeying
+   - markus@cvs.openbsd.org 2003/04/01 10:22:21
+     [clientloop.c monitor.c monitor_wrap.c packet.c packet.h readconf.c]
+     [readconf.h serverloop.c sshconnect2.c]
+     backout rekeying changes (for 3.6.1)
+   - markus@cvs.openbsd.org 2003/04/01 10:31:26
+     [compat.c compat.h kex.c]
+     bugfix causes stalled connections for ssh.com < 3.0; noticed by ho@; 
+     tested by ho@ and myself
+   - markus@cvs.openbsd.org 2003/04/01 10:56:46
+     [version.h]
+     3.6.1
+ - (djm) Crank spec file versions
+ - (djm) Release 3.6.1p1
+
+20030326
+ - (djm) OpenBSD CVS Sync
+   - deraadt@cvs.openbsd.org 2003/03/26 04:02:51
+     [sftp-server.c]
+     one last fix to the tree: race fix broke stuff; pr 3169; 
+     srp@srparish.net, help from djm
+
+20030325
+ - (djm) Fix getpeerid support for 64 bit BE systems. From 
+    Arnd Bergmann <arndb@de.ibm.com>
+
+20030324
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/03/23 19:02:00
+     [monitor.c]
+     unbreak rekeying for privsep; ok millert@
+ - Release 3.6p1
+ - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
+   Report from murple@murple.net, diagnosis from dtucker@zip.com.au
+
+20030320
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/03/17 10:38:38
+     [progressmeter.c]
+     don't print \n if backgrounded; from ho@
+   - markus@cvs.openbsd.org 2003/03/17 11:43:47
+     [version.h]
+     enter 3.6
+ - (bal) The days of lack of int64_t support are over.  Sorry kids.
+ - (bal) scp.c 'limit' conflicts with Cray.  Rename to 'limitbw'
+ - (bal) Collection of Cray patches (bsd-cray.h fix for CRAYT3E and improved
+   guessing rules)
+ - (bal) Disable Privsep for Tru64 after pre-authentication due to issues
+   with SIA.  Also, clean up of tru64 support patch by Chris Adams
+   <cmadams@hiwaay.net>
+ - (tim) [contrib/caldera/openssh.spec] workaround RPM quirk. Fix %files
+
+20030318
+ - (tim) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
+   add nanosleep(). testing/corrections by Darren Tucker <dtucker@zip.com.au>
+
+20030317
+ - (djm) Fix return value checks for RAND_bytes. Report from 
+   Steve G <linux_4ever@yahoo.com>
+
+20030315
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/03/13 11:42:19
+     [authfile.c ssh-keysign.c]
+     move RSA_blinding_on to generic key load method
+   - markus@cvs.openbsd.org 2003/03/13 11:44:50
+     [ssh-agent.c]
+     ssh-agent is similar to ssh-keysign (allows other processes to use
+     private rsa keys). however, it gets key over socket and not from
+     a file, so we have to do blinding here as well.
+
+20030310
+- (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/03/05 22:33:43
+     [channels.c monitor.c scp.c session.c sftp-client.c sftp-int.c]
+     [sftp-server.c ssh-add.c sshconnect2.c]
+     fix memory leaks; from dlheine@suif.Stanford.EDU/CLOUSEAU; ok djm@
+ - (djm) One more portable-specific one from dlheine@suif.Stanford.EDU/
+   CLOUSEAU
+ - (djm) Bug #245: TTY problems on Solaris. Fix by stevesk@ and 
+   dtucker@zip.com.au
+ - (djm) AIX package builder update from dtucker@zip.com.au
+
+20030225
+ - (djm) Fix some compile errors spotted by dtucker and his fabulous 
+   tinderbox
+
+20030224
+ - (djm) Tweak gnome-ssh-askpass2:
+   - Retry kb and mouse grab a couple of times, so passphrase dialog doesn't 
+     immediately fail if you are doing something else when it appears (e.g. 
+     dragging a window)
+   - Perform server grab after we have the keyboard and/or pointer to avoid 
+     races.
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/01/27 17:06:31
+     [sshd.c]
+     more specific error message when /var/empty has wrong permissions;
+     bug #46, map@appgate.com; ok henning@, provos@, stevesk@
+   - markus@cvs.openbsd.org 2003/01/28 16:11:52
+     [scp.1]
+     document -l; pekkas@netcore.fi
+   - stevesk@cvs.openbsd.org 2003/01/28 17:24:51
+     [scp.1]
+     remove example not pertinent with -1 addition; ok markus@
+   - jmc@cvs.openbsd.org 2003/01/31 21:54:40
+     [sshd.8]
+     typos; sshd(8): help and ok markus@
+     help and ok millert@
+   - markus@cvs.openbsd.org 2003/02/02 10:51:13
+     [scp.c]
+     call okname() only when using system(3) for remote-remote copy;
+     fixes bugs #483, #472; ok deraadt@, mouring@
+   - markus@cvs.openbsd.org 2003/02/02 10:56:08
+     [kex.c]
+     add support for key exchange guesses; based on work by
+     avraham.fraenkel@commatch.com; fixes bug #148; ok deraadt@
+   - markus@cvs.openbsd.org 2003/02/03 08:56:16
+     [sshpty.c]
+     don't call error() for readonly /dev; from soekris list; ok mcbride,
+     henning, deraadt.
+   - markus@cvs.openbsd.org 2003/02/04 09:32:08
+     [key.c]
+     better debug3 message
+   - markus@cvs.openbsd.org 2003/02/04 09:33:22
+     [monitor.c monitor_wrap.c]
+     skey/bsdauth: use 0 to indicate failure instead of -1, because
+     the buffer API only supports unsigned ints.
+   - markus@cvs.openbsd.org 2003/02/05 09:02:28
+     [readconf.c]
+     simplify ProxyCommand parsing, remove strcat/xrealloc; ok henning@, djm@
+   - markus@cvs.openbsd.org 2003/02/06 09:26:23
+     [session.c]
+     missing call to setproctitle() after authentication; ok provos@
+   - markus@cvs.openbsd.org 2003/02/06 09:27:29
+     [ssh.c ssh_config.5]
+     support 'ProxyCommand none'; bugzilla #433; binder@arago.de; ok djm@
+   - markus@cvs.openbsd.org 2003/02/06 09:29:18
+     [sftp-server.c]
+     fix races in rename/symlink; from Tony Finch; ok djm@
+   - markus@cvs.openbsd.org 2003/02/06 21:22:43
+     [auth1.c auth2.c]
+     undo broken fix for #387, fixes #486
+   - markus@cvs.openbsd.org 2003/02/10 11:51:47
+     [ssh-add.1]
+     xref sshd_config.5 (not sshd.8); mark@summersault.com; bug #490
+   - markus@cvs.openbsd.org 2003/02/12 09:33:04
+     [key.c key.h ssh-dss.c ssh-rsa.c]
+     merge ssh-dss.h ssh-rsa.h into key.h; ok deraadt@
+   - markus@cvs.openbsd.org 2003/02/12 21:39:50
+     [crc32.c crc32.h]
+     replace crc32.c with a BSD licensed version; noted by David Turner
+   - markus@cvs.openbsd.org 2003/02/16 17:09:57
+     [kex.c kexdh.c kexgex.c kex.h sshconnect2.c sshd.c ssh-keyscan.c]
+     split kex into client and server code, no need to link
+     server code into the client; ok provos@
+   - markus@cvs.openbsd.org 2003/02/16 17:30:33
+     [monitor.c monitor_wrap.c]
+     fix permitrootlogin forced-commands-only for privsep; bux #387; 
+     ok provos@
+   - markus@cvs.openbsd.org 2003/02/21 09:05:53
+     [servconf.c]
+     print sshd_config filename in debug2 mode.
+   - mpech@cvs.openbsd.org 2003/02/21 10:34:48
+     [auth-krb4.c]
+     ...sizeof(&adat.session) is not good here.
+     henning@, deraadt@, millert@
+ - (djm) Add new object files to Makefile and reorder
+ - (djm) Bug #501: gai_strerror should return char*; 
+   fix from dtucker@zip.com.au
+ - (djm) Most of Bug #499: Cygwin compile fixes for new progressmeter;
+   From vinschen@redhat.com
+ - (djm) Rest of Bug #499: Import a basename() function from OpenBSD libc
+ - (djm) Bug #494: Allow multiple accounts on Windows 9x/Me; 
+   From vinschen@redhat.com
+ - (djm) Bug #456: Support for NEC SX6 with Unicos; from wendyp@cray.com
+
+20030211
+ - (djm) Cygwin needs libcrypt too. Patch from vinschen@redhat.com
+
+20030206
+ - (djm) Teach fake-getaddrinfo to use getservbyname() when provided a 
+   string service name. Suggested by markus@, review by itojun@
+
+20030131
+ - (bal) AIX 4.2.1 lacks nanosleep().  Patch to use nsleep() provided by
+   dtucker@zip.com.au
+
+20030130
+ - (djm) Unbreak root password auth. Spotted by dtucker@zip.com.au
+
+200301028
+ - (djm) Search libposix4 and librt for nanosleep. From dtucker@zip.com.au 
+   and openssh-unix-dev@thewrittenword.com 
+
+200301027
+ - (bal) Bugzilla 477 patch by wendyp@cray.com.  Define TIOCGPGRP for
+   cray.  Also removed test for tcgetpgrp in configure.ac since it
+   is no longer used.
+
+20030124
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2003/01/23 08:58:47
+     [sshd_config.5]
+     typos; ok millert@
+   - markus@cvs.openbsd.org 2003/01/23 13:50:27
+     [authfd.c authfd.h readpass.c ssh-add.1 ssh-add.c ssh-agent.c]
+     ssh-add -c, prompt user for confirmation (using ssh-askpass) when
+     private agent key is used; with djm@; test by dugsong@, djm@; 
+     ok deraadt@
+   - markus@cvs.openbsd.org 2003/01/23 14:01:53
+     [scp.c]
+     bandwidth limitation patch (scp -l) from niels@; ok todd@, deraadt@
+   - markus@cvs.openbsd.org 2003/01/23 14:06:15
+     [scp.1 scp.c]
+     scp -12; Sam Smith and others; ok provos@, deraadt@
+ - (djm) Add TIMEVAL_TO_TIMESPEC macros
+
+20030123
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2003/01/23 00:03:00
+     [auth1.c]
+     Don't log TIS auth response; "get rid of it" - markus@
+
+20030122
+ - (djm) OpenBSD CVS Sync
+   - marc@cvs.openbsd.org 2003/01/21 18:14:36
+     [ssh-agent.1 ssh-agent.c]
+     Add a -t life option to ssh-agent that set the default lifetime.
+     The default can still be overriden by using -t in ssh-add.
+     OK markus@
+ - (djm) Reorganise PAM & SIA password handling to eliminate some common code
+ - (djm) Sync regress with OpenBSD -current
+
+20030120
+ - (djm) Fix compilation for NetBSD from dtucker@zip.com.au
+ - (tim) [progressmeter.c] make compilers without long long happy.
+ - (tim) [configure.ac] Add -belf to build ELF binaries on OpenServer 5 when
+   using cc. (gcc already did)
+
+20030118
+ - (djm) Revert fix for Bug #442 for now.
+
+20030117
+ - (djm) Bug #470: Detect strnvis, not strvis in configure.
+    From d_wllms@lanl.gov
+
+20030116
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2003/01/16 03:41:55
+     [sftp-int.c]
+     explicitly use first glob result
+
+20030114
+ - (djm) OpenBSD CVS Sync
+   - fgsch@cvs.openbsd.org 2003/01/10 23:23:24
+     [sftp-int.c]
+     typo; from Nils Nordman <nino at nforced dot com>.
+   - markus@cvs.openbsd.org 2003/01/11 18:29:43
+     [log.c]
+     set fatal_cleanups to NULL in fatal_remove_all_cleanups(); 
+     dtucker@zip.com.au
+   - markus@cvs.openbsd.org 2003/01/12 16:57:02
+     [progressmeter.c]
+     allow WARNINGS=yes; ok djm@
+   - djm@cvs.openbsd.org 2003/01/13 11:04:04
+     [sftp-int.c]
+     make cmds[] array static to avoid conflict with BSDI libc.
+     mindrot bug #466. Fix from mdev@idg.nl; ok markus@
+   - djm@cvs.openbsd.org 2003/01/14 10:58:00
+     [sftp-client.c sftp-int.c]
+     Don't try to upload or download non-regular files. Report from
+     apoloval@pantuflo.escet.urjc.es; ok markus@
+
+20030113
+ - (djm) Rework openbsd-compat/setproctitle.c a bit: move emulation type
+   detection to configure.ac. Prompted by stevesk@
+ - (djm) Bug #467: Add a --disable-strip option to turn off stripping of 
+   installed binaries. From mdev@idg.nl
+
+20030110
+ - (djm) Enable new setproctitle emulation for Linux, AIX and HP/UX. More 
+   systems may be added later.
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2003/01/08 23:53:26
+     [sftp.1 sftp.c sftp-int.c sftp-int.h]
+     Cleanup error handling for batchmode
+     Allow blank lines and comments in input
+     Ability to suppress abort on error in batchmode ("-put blah")
+     Fixes mindrot bug #452; markus@ ok
+   - fgsch@cvs.openbsd.org 2003/01/10 08:19:07
+     [scp.c sftp.1 sftp.c sftp-client.c sftp-int.c  progressmeter.c]
+     [progressmeter.h]
+     sftp progress meter support.
+     original diffs by Nils Nordman <nino at nforced dot com> via 
+     markus@, merged to -current by me, djm@ ok.
+   - djm@cvs.openbsd.org 2003/01/10 08:48:15
+     [sftp-client.c]
+     Simplify and avoid redundancy in packet send and receive 
+     functions; ok fgs@
+   - djm@cvs.openbsd.org 2003/01/10 10:29:35
+     [scp.c]
+     Don't ftruncate after write error, creating sparse files of 
+     incorrect length
+     mindrot bug #403, reported by rusr@cup.hp.com; ok markus@
+   - djm@cvs.openbsd.org 2003/01/10 10:32:54
+     [channels.c]
+     hush socket() errors, except last. Fixes mindrot bug #408; ok markus@
+
+20030108
+ - (djm) Sync openbsd-compat/ with OpenBSD -current
+ - (djm) Avoid redundant xstrdup/xfree in auth2-pam.c. From Solar via markus@
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2003/01/01 18:08:52
+     [channels.c]
+     move big output buffer messages to debug2
+   - djm@cvs.openbsd.org 2003/01/06 23:51:22
+     [sftp-client.c]
+     Fix "get -p" download to not add user-write perm. mindrot bug #426
+     reported by gfernandez@livevault.com; ok markus@
+   - fgsch@cvs.openbsd.org 2003/01/07 23:42:54
+     [sftp.1]
+     add version; from Nils Nordman <nino at nforced dot com> via markus@.
+     markus@ ok
+ - (djm) Update README to reflect AIX's status as a well supported platform.
+   From dtucker@zip.com.au
+ - (tim) [Makefile.in configure.ac] replace fixpath with sed script. Patch
+   by Mo DeJong.
+ - (tim) [auth.c] declare today at top of allowed_user() to keep
+   older compilers happy.
+ - (tim) [scp.c] make compilers without long long happy.
+
+20030107
+ - (djm) Bug #401: Work around Linux breakage with IPv6 mapped addresses. 
+   Based on fix from yoshfuji@linux-ipv6.org
+ - (djm) Bug #442: Check for and deny access to accounts with locked 
+   passwords. Patch from dtucker@zip.com.au
+ - (djm) Bug #44: Use local mkstemp() rather than glibc's silly one. Fixes
+   Can't pass KRB4 TGT passing. Fix from: jan.iven@cern.ch
+ - (djm) Fix Bug #442 for PAM case
+ - (djm) Bug #110: bogus error messages in lastlog_get_entry(). Fix based
+   on one by peak@argo.troja.mff.cuni.cz
+ - (djm) Bug #111: Run syslog and stderr logging through strnvis to eliminate
+   nasties. Report from peak@argo.troja.mff.cuni.cz
+ - (djm) Bug #178: On AIX /etc/nologin wasnt't shown to users. Fix from 
+   Ralf.Wenk@fh-karlsruhe.de and dtucker@zip.com.au
+ - (djm) Fix my fix of the fix for the Bug #442 for PAM case. Spotted by 
+   dtucker@zip.com.au. Reorder for clarity too.
+
+20030103
+ - (djm) Bug #461: ssh-copy-id fails with no arguments. Patch from 
+   cjwatson@debian.org
+ - (djm) Bug #460: Filling utmp[x]->ut_addr_v6 if present. Patch from 
+   cjwatson@debian.org
+ - (djm) Bug #446: Set LOGIN env var to pw_name on AIX. Patch from 
+   mii@ornl.gov 
+
+20030101
+  - (stevesk) [session.c sshlogin.c sshlogin.h] complete portable
+    parts of pass addrlen with sockaddr * fix.
+    from Hajimu UMEMOTO <ume@FreeBSD.org>
+
+20021222
+ - (bal) OpenBSD CVS Sync
+   - fgsch@cvs.openbsd.org 2002/11/15 10:03:09
+     [authfile.c]
+     lseek(2) may return -1 when getting the public/private key lenght.
+     Simplify the code and check for errors using fstat(2).
+
+     Problem reported by Mauricio Sanchez, markus@ ok.
+   - markus@cvs.openbsd.org 2002/11/18 16:43:44
+     [clientloop.c]
+     don't overwrite SIG{INT,QUIT,TERM} handler if set to SIG_IGN;
+     e.g. if ssh is used for backup; report Joerg Schilling; ok millert@
+   - markus@cvs.openbsd.org 2002/11/21 22:22:50
+     [dh.c]
+     debug->debug2
+   - markus@cvs.openbsd.org 2002/11/21 22:45:31
+     [cipher.c kex.c packet.c sshconnect.c sshconnect2.c]
+     debug->debug2, unify debug messages
+   - deraadt@cvs.openbsd.org 2002/11/21 23:03:51
+     [auth-krb5.c auth1.c hostfile.h monitor_wrap.c sftp-client.c sftp-int.c ssh-add.c ssh-rsa.c 
+      sshconnect.c]
+     KNF
+   - markus@cvs.openbsd.org 2002/11/21 23:04:33
+     [ssh.c]
+     debug->debug2
+   - stevesk@cvs.openbsd.org 2002/11/24 21:46:24
+     [ssh-keysign.8]
+     typo: "the the"
+   - wcobb@cvs.openbsd.org 2002/11/26 00:45:03
+     [scp.c ssh-keygen.c]
+     Remove unnecessary fflush(stderr) calls, stderr is unbuffered by default.
+     ok markus@
+   - stevesk@cvs.openbsd.org 2002/11/26 02:35:30
+     [ssh-keygen.1]
+     remove outdated statement; ok markus@ deraadt@
+   - stevesk@cvs.openbsd.org 2002/11/26 02:38:54
+     [canohost.c]
+     KNF, comment and error message repair; ok markus@
+   - markus@cvs.openbsd.org 2002/11/27 17:53:35
+     [scp.c sftp.c ssh.c]
+     allow usernames with embedded '@', e.g. scp user@vhost@realhost:file /tmp;
+     http://bugzilla.mindrot.org/show_bug.cgi?id=447; ok mouring@, millert@
+   - stevesk@cvs.openbsd.org 2002/12/04 04:36:47
+     [session.c]
+     remove xauth entries before add; PR 2994 from janjaap@stack.nl.
+     ok markus@
+   - markus@cvs.openbsd.org 2002/12/05 11:08:35
+     [scp.c]
+     use roundup() similar to rcp/util.c and avoid problems with strange
+     filesystem block sizes, noted by tjr@freebsd.org; ok djm@
+   - djm@cvs.openbsd.org 2002/12/06 05:20:02
+     [sftp.1]
+     Fix cut'n'paste error, spotted by matthias.riese@b-novative.de; ok deraadt@
+   - millert@cvs.openbsd.org 2002/12/09 16:50:30
+     [ssh.c]
+     Avoid setting optind to 0 as GNU getopt treats that like we do optreset.
+     markus@ OK
+   - markus@cvs.openbsd.org 2002/12/10 08:56:00
+     [session.c]
+     Make sure $SHELL points to the shell from the password file, even if shell
+     is overridden from login.conf; bug#453; semen at online.sinor.ru; ok millert@
+   - markus@cvs.openbsd.org 2002/12/10 19:26:50
+     [packet.c]
+     move tos handling to packet_set_tos; ok provos/henning/deraadt
+   - markus@cvs.openbsd.org 2002/12/10 19:47:14
+     [packet.c]
+     static
+   - markus@cvs.openbsd.org 2002/12/13 10:03:15
+     [channels.c misc.c sshconnect2.c]
+     cleanup debug messages, more useful information for the client user.
+   - markus@cvs.openbsd.org 2002/12/13 15:20:52
+     [scp.c]
+     1) include stalling time in total time
+     2) truncate filenames to 45 instead of 20 characters
+     3) print rate instead of progress bar, no more stars
+     4) scale output to tty width
+     based on a patch from Niels; ok fries@ lebel@ fgs@ millert@
+ - (bal) [msg.c msg.h scp.c ssh-keysign.c sshconnect2.c]  Resync CVS IDs since 
+   we already did s/msg_send/ssh_msg_send/
+
+20021205
+ - (djm) PERL-free fixpaths from stuge-openssh-unix-dev@cdy.org
+
+20021122
+ - (tim) [configure.ac] fix STDPATH test for IRIX. First reported by
+   advax@triumf.ca. This type of solution tested by <herb@sgi.com>
+
+20021113
+ - (tim) [configure.ac] remove unused variables no_libsocket and no_libnsl
+
+20021111
+ - (tim) [contrib/solaris/opensshd.in] add umask 022 so sshd.pid is
+   not world writable.
+
+20021109
+ - (bal) OpenBSD CVS Sync
+   - itojun@cvs.openbsd.org 2002/10/16 14:31:48
+     [sftp-common.c]
+     64bit pedant.  %llu is "unsigned long long".  markus ok
+   - markus@cvs.openbsd.org 2002/10/23 10:32:13
+     [packet.c]
+     use %u for u_int
+   - markus@cvs.openbsd.org 2002/10/23 10:40:16
+     [bufaux.c]
+     %u for u_int
+   - markus@cvs.openbsd.org 2002/11/04 10:07:53
+     [auth.c]
+     don't compare against pw_home if realpath fails for pw_home (seen 
+     on AFS); ok djm@
+   - markus@cvs.openbsd.org 2002/11/04 10:09:51
+     [packet.c]
+     log before send disconnect; ok djm@
+   - markus@cvs.openbsd.org 2002/11/05 19:45:20
+     [monitor.c]
+     handle overflows for size_t larger than u_int; siw@goneko.de, bug #425
+   - markus@cvs.openbsd.org 2002/11/05 20:10:37
+     [sftp-client.c]
+     typo; GaryF@livevault.com
+   - markus@cvs.openbsd.org 2002/11/07 16:28:47
+     [sshd.c]
+     log to stderr if -ie is given, bug #414, prj@po.cwru.edu
+   - markus@cvs.openbsd.org 2002/11/07 22:08:07
+     [readconf.c readconf.h ssh-keysign.8 ssh-keysign.c]
+     we cannot use HostbasedAuthentication for enabling ssh-keysign(8),
+     because HostbasedAuthentication might be enabled based on the
+     target host and ssh-keysign(8) does not know the remote hostname
+     and not trust ssh(1) about the hostname, so we add a new option
+     EnableSSHKeysign; ok djm@, report from zierke@informatik.uni-hamburg.de
+   - markus@cvs.openbsd.org 2002/11/07 22:35:38
+     [scp.c]
+     check exit status from ssh, and exit(1) if ssh fails; bug#369; 
+     binder@arago.de
+ - (bal) Update ssh-host-config and minor rewrite of bsd-cygwin_util.c
+   ntsec now default if cygwin version beginning w/ version 56.  Patch
+   by Corinna Vinschen <vinschen@redhat.com> 
+ - (bal) AIX does not log login attempts for unknown users (bug #432).
+   patch by dtucker@zip.com.au
+
+20021021
+ - (djm) Bug #400: Kill ssh-rand-helper children on timeout, patch from 
+   dtucker@zip.com.au
+ - (djm) Bug #317: FreeBSD needs libutil.h for openpty() Report from 
+   dirk.meyer@dinoex.sub.org
+
+20021015
+ - (bal) Fix bug id 383 and only call loginrestrict for AIX if not root.
+ - (bal) More advanced strsep test by Darren Tucker <dtucker@zip.com.au>
+
+20021015
+ - (tim) [contrib/caldera/openssh.spec] make ssh-agent setgid nobody
+
+20021004
+ - (bal) Disable post-authentication Privsep for OSF/1.  It conflicts with
+   SIA.
+
 20021003
  - (djm) OpenBSD CVS Sync
    - markus@cvs.openbsd.org 2002/10/01 20:34:12
@@ -7,7 +545,7 @@
      [version.h]
      OpenSSH 3.5
  - (djm) Bump RPM spec version numbers
- - (djm) Bug #406 s/msg_send/ssh_msh_send/ for Mac OS X 1.2
+ - (djm) Bug #406: s/msg_send/ssh_msg_send/ for Mac OS X 1.2
 
 20020930
  - (djm) Tidy contrib/, add Makefile for GNOME passphrase dialogs, 
@@ -757,4 +1295,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2491.2.1 2002/10/03 05:45:53 djm Exp $
+$Id: ChangeLog,v 1.2648 2003/04/01 11:47:16 djm Exp $
diff --git a/crypto/openssh/Makefile.in b/crypto/openssh/Makefile.in
index 89d02c9..6702eb9 100644
--- a/crypto/openssh/Makefile.in
+++ b/crypto/openssh/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.222 2002/07/14 17:02:21 tim Exp $
+# $Id: Makefile.in,v 1.228 2003/03/21 00:34:34 mouring Exp $
 
 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -27,6 +27,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 RAND_HELPER=$(libexecdir)/ssh-rand-helper
 PRIVSEP_PATH=@PRIVSEP_PATH@
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
+STRIP_OPT=@STRIP_OPT@
 
 PATHS= -DSSHDIR=\"$(sysconfdir)\" \
 	-D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \
@@ -48,6 +49,7 @@ AR=@AR@
 RANLIB=@RANLIB@
 INSTALL=@INSTALL@
 PERL=@PERL@
+SED=@SED@
 ENT=@ENT@
 XAUTH_PATH=@XAUTH_PATH@
 LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
@@ -56,15 +58,30 @@ EXEEXT=@EXEEXT@
 INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
 INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
 
-@NO_SFTP@SFTP_PROGS=sftp-server$(EXEEXT) sftp$(EXEEXT)
-
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} $(SFTP_PROGS)
-
-LIBSSH_OBJS=atomicio.o authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o compat.o compress.o crc32.o deattack.o dh.o dispatch.o fatal.o mac.o msg.o hostfile.o key.o kex.o kexdh.o kexgex.o log.o match.o misc.o mpaux.o nchan.o packet.o radix.o rijndael.o entropy.o readpass.o rsa.o scard.o scard-opensc.o ssh-dss.o ssh-rsa.o tildexpand.o ttymodes.o uidswap.o uuencode.o xmalloc.o monitor_wrap.o monitor_fdpass.o
-
-SSHOBJS= ssh.o sshconnect.o sshconnect1.o sshconnect2.o sshtty.o readconf.o clientloop.o
-
-SSHDOBJS= sshd.o auth.o auth1.o auth2.o auth2-hostbased.o auth2-kbdint.o auth2-none.o auth2-passwd.o auth2-pubkey.o auth-chall.o auth2-chall.o auth-rhosts.o auth-options.o auth-krb4.o auth-krb5.o auth-pam.o auth2-pam.o auth-passwd.o auth-rsa.o auth-rh-rsa.o auth-sia.o sshpty.o sshlogin.o loginrec.o servconf.o serverloop.o md5crypt.o session.o groupaccess.o auth-skey.o auth-bsdauth.o monitor_mm.o monitor.o
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
+
+LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \
+	cipher.o compat.o compress.o crc32.o deattack.o fatal.o \
+	hostfile.o log.o match.o mpaux.o nchan.o packet.o readpass.o \
+	rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \
+	key.o dispatch.o kex.o mac.o uuencode.o misc.o \
+	rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o kexgex.o \
+	kexdhc.o kexgexc.o scard.o msg.o progressmeter.o \
+	entropy.o
+
+SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+	sshconnect.o sshconnect1.o sshconnect2.o
+
+SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
+	sshpty.o sshlogin.o servconf.o serverloop.o uidswap.o \
+	auth.o auth1.o auth2.o auth-options.o session.o \
+	auth-chall.o auth2-chall.o groupaccess.o \
+	auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
+	auth2-none.o auth2-passwd.o auth2-pubkey.o \
+	monitor_mm.o monitor.o monitor_wrap.o monitor_fdpass.o \
+	kexdhs.o kexgexs.o \
+	auth-krb5.o auth-krb4.o \
+	loginrec.o auth-pam.o auth2-pam.o auth-sia.o md5crypt.o
 
 MANPAGES	= scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
 MANPAGES_IN	= scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
@@ -74,23 +91,23 @@ CONFIGFILES=sshd_config.out ssh_config.out moduli.out
 CONFIGFILES_IN=sshd_config ssh_config moduli
 
 PATHSUBS	= \
-	-D/etc/ssh/ssh_prng_cmds=$(sysconfdir)/ssh_prng_cmds \
-	-D/etc/ssh/ssh_config=$(sysconfdir)/ssh_config \
-	-D/etc/ssh/ssh_known_hosts=$(sysconfdir)/ssh_known_hosts \
-	-D/etc/ssh/sshd_config=$(sysconfdir)/sshd_config \
-	-D/usr/libexec=$(libexecdir) \
-	-D/etc/shosts.equiv=$(sysconfdir)/shosts.equiv \
-	-D/etc/ssh/ssh_host_key=$(sysconfdir)/ssh_host_key \
-	-D/etc/ssh/ssh_host_dsa_key=$(sysconfdir)/ssh_host_dsa_key \
-	-D/etc/ssh/ssh_host_rsa_key=$(sysconfdir)/ssh_host_rsa_key \
-	-D/var/run/sshd.pid=$(piddir)/sshd.pid \
-	-D/etc/ssh/moduli=$(sysconfdir)/moduli \
-	-D/etc/ssh/sshrc=$(sysconfdir)/sshrc \
-	-D/usr/X11R6/bin/xauth=$(XAUTH_PATH) \
-	-D/var/empty=$(PRIVSEP_PATH) \
-	-D/usr/bin:/bin:/usr/sbin:/sbin=@user_path@
-
-FIXPATHSCMD	= $(PERL) $(srcdir)/fixpaths $(PATHSUBS)
+	-e 's|/etc/ssh/ssh_prng_cmds|$(sysconfdir)/ssh_prng_cmds|g' \
+	-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
+	-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
+	-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
+	-e 's|/usr/libexec|$(libexecdir)|g' \
+	-e 's|/etc/shosts.equiv|$(sysconfdir)/shosts.equiv|g' \
+	-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
+	-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
+	-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
+	-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
+	-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \
+	-e 's|/etc/sshrc|$(sysconfdir)/sshrc|g' \
+	-e 's|/usr/X11R6/bin/xauth|$(XAUTH_PATH)|g' \
+	-e 's|/var/empty|$(PRIVSEP_PATH)|g' \
+	-e 's|/usr/bin:/bin:/usr/sbin:/sbin|@user_path@|g'
+
+FIXPATHSCMD	= $(SED) $(PATHSUBS)
 
 all: $(CONFIGFILES) $(MANPAGES) $(TARGETS)
 
@@ -116,8 +133,8 @@ ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
 sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
 	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBS)
 
-scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o
-	$(LD) -o $@ scp.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
+	$(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
 ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
 	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
@@ -137,8 +154,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
 sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o
 	$(LD) -o $@ sftp-server.o sftp-common.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
 
-sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-int.o sftp-common.o sftp-glob.o
-	$(LD) -o $@ sftp.o sftp-client.o sftp-common.o sftp-int.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-int.o sftp-common.o sftp-glob.o progressmeter.o
+	$(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-int.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
 ssh-rand-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-rand-helper.o
 	$(LD) -o $@ ssh-rand-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -217,19 +234,19 @@ install-files: scard-install
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)8
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(libexecdir)
 	(umask 022 ; $(srcdir)/mkinstalldirs $(DESTDIR)$(PRIVSEP_PATH))
-	$(INSTALL) -m 0755 -s ssh $(DESTDIR)$(bindir)/ssh
-	$(INSTALL) -m 0755 -s scp $(DESTDIR)$(bindir)/scp
-	$(INSTALL) -m 0755 -s ssh-add $(DESTDIR)$(bindir)/ssh-add
-	$(INSTALL) -m 0755 -s ssh-agent $(DESTDIR)$(bindir)/ssh-agent
-	$(INSTALL) -m 0755 -s ssh-keygen $(DESTDIR)$(bindir)/ssh-keygen
-	$(INSTALL) -m 0755 -s ssh-keyscan $(DESTDIR)$(bindir)/ssh-keyscan
-	$(INSTALL) -m 0755 -s sshd $(DESTDIR)$(sbindir)/sshd
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh $(DESTDIR)$(bindir)/ssh
+	$(INSTALL) -m 0755 $(STRIP_OPT) scp $(DESTDIR)$(bindir)/scp
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-add $(DESTDIR)$(bindir)/ssh-add
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent $(DESTDIR)$(bindir)/ssh-agent
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen $(DESTDIR)$(bindir)/ssh-keygen
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan $(DESTDIR)$(bindir)/ssh-keyscan
+	$(INSTALL) -m 0755 $(STRIP_OPT) sshd $(DESTDIR)$(sbindir)/sshd
 	if test ! -z "$(INSTALL_SSH_RAND_HELPER)" ; then \
-		$(INSTALL) -m 0755 -s ssh-rand-helper $(DESTDIR)$(libexecdir)/ssh-rand-helper ; \
+		$(INSTALL) -m 0755 $(STRIP_OPT) ssh-rand-helper $(DESTDIR)$(libexecdir)/ssh-rand-helper ; \
 	fi
-	$(INSTALL) -m 4711 -s ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
-	@NO_SFTP@$(INSTALL) -m 0755 -s sftp $(DESTDIR)$(bindir)/sftp
-	@NO_SFTP@$(INSTALL) -m 0755 -s sftp-server $(DESTDIR)$(SFTP_SERVER)
+	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
+	$(INSTALL) -m 0755 $(STRIP_OPT) sftp $(DESTDIR)$(bindir)/sftp
+	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server $(DESTDIR)$(SFTP_SERVER)
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
@@ -242,8 +259,8 @@ install-files: scard-install
 	if [ ! -z "$(INSTALL_SSH_RAND_HELPER)" ]; then \
 		$(INSTALL) -m 644 ssh-rand-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8 ; \
 	fi
-	@NO_SFTP@$(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
-	@NO_SFTP@$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
+	$(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
+	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
 	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
 	-rm -f $(DESTDIR)$(bindir)/slogin
 	ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
diff --git a/crypto/openssh/README b/crypto/openssh/README
index 3c54c47..5709fbe 100644
--- a/crypto/openssh/README
+++ b/crypto/openssh/README
@@ -15,8 +15,8 @@ and Dug Song. It has a homepage at http://www.openssh.com/
 This port consists of the re-introduction of autoconf support, PAM
 support (for Linux and Solaris), EGD[1]/PRNGD[2] support and replacements 
 for OpenBSD library functions that are (regrettably) absent from other 
-unices. This port has been best tested on Linux, Solaris, HP-UX, NetBSD 
-and Irix. Support for AIX, SCO, NeXT and other Unices is underway. 
+unices. This port has been best tested on Linux, Solaris, HP-UX, NetBSD, 
+Irix and AIX. Support for SCO, NeXT and other Unices is underway. 
 This version actively tracks changes in the OpenBSD CVS repository.
 
 The PAM support is now more functional than the popular packages of
@@ -63,4 +63,4 @@ References -
 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
 [7] http://www.openssh.com/faq.html
 
-$Id: README,v 1.50 2001/12/24 03:17:21 djm Exp $
+$Id: README,v 1.51 2003/01/08 12:28:40 djm Exp $
diff --git a/crypto/openssh/README.privsep b/crypto/openssh/README.privsep
index ced943f..e8bf1db 100644
--- a/crypto/openssh/README.privsep
+++ b/crypto/openssh/README.privsep
@@ -43,6 +43,10 @@ It does not function on HP-UX with a trusted system
 configuration.  PAMAuthenticationViaKbdInt does not function with
 privsep.
 
+On Compaq Tru64 Unix, only the pre-authentication part of privsep is
+supported.  Post-authentication privsep is disabled automatically (so
+you won't see the additional process mentioned below).
+
 Note that for a normal interactive login with a shell, enabling privsep
 will require 1 additional process per login session.
 
@@ -58,4 +62,4 @@ process 1005 is the sshd process listening for new connections.
 process 6917 is the privileged monitor process, 6919 is the user owned
 sshd process and 6921 is the shell process.
 
-$Id: README.privsep,v 1.10 2002/06/26 00:43:57 stevesk Exp $
+$Id: README.privsep,v 1.11 2003/03/21 01:18:09 mouring Exp $
diff --git a/crypto/openssh/TODO b/crypto/openssh/TODO
index f667d59..de83000 100644
--- a/crypto/openssh/TODO
+++ b/crypto/openssh/TODO
@@ -13,7 +13,7 @@ Programming:
 - Write a test program that calls stat() to search for EGD/PRNGd socket
   rather than use the (non-portable) "test -S". 
 
-- Replacement for setproctitle() - HP-UX support only currently
+- More platforms for for setproctitle() emulation (testing needed)
 
 - Handle changing passwords for the non-PAM expired password case
 
@@ -101,6 +101,7 @@ Clean up configure/makefiles:
   (vinschen@redhat.com)
 
 - Replace the whole u_intXX_t evilness in acconfig.h with something better???
+ - Do it in configure.ac
 
 - Consider splitting the u_intXX_t test for sys/bitype.h  into seperate test
   to allow people to (right/wrongfully) link against Bind directly.
@@ -133,4 +134,4 @@ PrivSep Issues:
 - Cygwin
   + Privsep for Pre-auth only (no fd passing)
 
-$Id: TODO,v 1.51 2002/09/05 06:32:03 djm Exp $
+$Id: TODO,v 1.53 2003/01/12 23:00:34 djm Exp $
diff --git a/crypto/openssh/auth-sia.c b/crypto/openssh/auth-sia.c
index 58b17c1..5c9b3f5 100644
--- a/crypto/openssh/auth-sia.c
+++ b/crypto/openssh/auth-sia.c
@@ -45,27 +45,25 @@ extern ServerOptions options;
 extern int saved_argc;
 extern char **saved_argv;
 
-extern int errno;
-
 int
 auth_sia_password(Authctxt *authctxt, char *pass)
 {
 	int ret;
 	SIAENTITY *ent = NULL;
 	const char *host;
-	char *user = authctxt->user;
 
 	host = get_canonical_hostname(options.verify_reverse_mapping);
 
-	if (!user || !pass || pass[0] == '\0')
+	if (!authctxt->user || !pass || pass[0] == '\0')
 		return(0);
 
-	if (sia_ses_init(&ent, saved_argc, saved_argv, host, user, NULL, 0,
-	    NULL) != SIASUCCESS)
+	if (sia_ses_init(&ent, saved_argc, saved_argv, host, authctxt->user,
+	    NULL, 0, NULL) != SIASUCCESS)
 		return(0);
 
 	if ((ret = sia_ses_authent(NULL, pass, ent)) != SIASUCCESS) {
-		error("Couldn't authenticate %s from %s", user, host);
+		error("Couldn't authenticate %s from %s", authctxt->user,
+		    host);
 		if (ret & SIASTOP)
 			sia_ses_release(&ent);
 		return(0);
@@ -77,48 +75,35 @@ auth_sia_password(Authctxt *authctxt, char *pass)
 }
 
 void
-session_setup_sia(char *user, char *tty)
+session_setup_sia(struct passwd *pw, char *tty)
 {
-	struct passwd *pw;
 	SIAENTITY *ent = NULL;
 	const char *host;
 
-	host = get_canonical_hostname (options.verify_reverse_mapping);
+	host = get_canonical_hostname(options.verify_reverse_mapping);
 
-	if (sia_ses_init(&ent, saved_argc, saved_argv, host, user, tty, 0,
-	    NULL) != SIASUCCESS) {
+	if (sia_ses_init(&ent, saved_argc, saved_argv, host, pw->pw_name, tty,
+	    0, NULL) != SIASUCCESS)
 		fatal("sia_ses_init failed");
-	}
 
-	if ((pw = getpwnam(user)) == NULL) {
-		sia_ses_release(&ent);
-		fatal("getpwnam: no user: %s", user);
-	}
 	if (sia_make_entity_pwd(pw, ent) != SIASUCCESS) {
 		sia_ses_release(&ent);
 		fatal("sia_make_entity_pwd failed");
 	}
 
 	ent->authtype = SIA_A_NONE;
-	if (sia_ses_estab(sia_collect_trm, ent) != SIASUCCESS) {
-		fatal("Couldn't establish session for %s from %s", user,
-		    host);
-	}
-
-	if (setpriority(PRIO_PROCESS, 0, 0) == -1) {
-		sia_ses_release(&ent);
-		fatal("setpriority: %s", strerror (errno));
-	}
+	if (sia_ses_estab(sia_collect_trm, ent) != SIASUCCESS)
+		fatal("Couldn't establish session for %s from %s",
+		    pw->pw_name, host);
 
-	if (sia_ses_launch(sia_collect_trm, ent) != SIASUCCESS) {
-		fatal("Couldn't launch session for %s from %s", user, host);
-	}
+	if (sia_ses_launch(sia_collect_trm, ent) != SIASUCCESS)
+		fatal("Couldn't launch session for %s from %s", pw->pw_name,
+		    host);
 	
 	sia_ses_release(&ent);
 
-	if (setreuid(geteuid(), geteuid()) < 0) {
+	if (setreuid(geteuid(), geteuid()) < 0)
 		fatal("setreuid: %s", strerror(errno));
-	}
 }
 
 #endif /* HAVE_OSF_SIA */
diff --git a/crypto/openssh/auth-sia.h b/crypto/openssh/auth-sia.h
index caa5841..7aecce9 100644
--- a/crypto/openssh/auth-sia.h
+++ b/crypto/openssh/auth-sia.h
@@ -27,6 +27,6 @@
 #ifdef HAVE_OSF_SIA
 
 int	auth_sia_password(Authctxt *authctxt, char *pass);
-void	session_setup_sia(char *user, char *tty);
+void	session_setup_sia(struct passwd *pw, char *tty);
 
 #endif /* HAVE_OSF_SIA */
diff --git a/crypto/openssh/authfd.h b/crypto/openssh/authfd.h
index 38ee49e..2a8751e 100644
--- a/crypto/openssh/authfd.h
+++ b/crypto/openssh/authfd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: authfd.h,v 1.31 2002/09/11 18:27:25 stevesk Exp $	*/
+/*	$OpenBSD: authfd.h,v 1.32 2003/01/23 13:50:27 markus Exp $	*/
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -51,6 +51,7 @@
 #define SSH2_AGENTC_ADD_ID_CONSTRAINED		25
 
 #define	SSH_AGENT_CONSTRAIN_LIFETIME		1
+#define	SSH_AGENT_CONSTRAIN_CONFIRM		2
 
 /* extended failure messages */
 #define SSH2_AGENT_FAILURE			30
@@ -76,7 +77,8 @@ int	 ssh_get_num_identities(AuthenticationConnection *, int);
 Key	*ssh_get_first_identity(AuthenticationConnection *, char **, int);
 Key	*ssh_get_next_identity(AuthenticationConnection *, char **, int);
 int	 ssh_add_identity(AuthenticationConnection *, Key *, const char *);
-int	 ssh_add_identity_constrained(AuthenticationConnection *, Key *, const char *, u_int);
+int	 ssh_add_identity_constrained(AuthenticationConnection *, Key *,
+    const char *, u_int, u_int);
 int	 ssh_remove_identity(AuthenticationConnection *, Key *);
 int	 ssh_remove_all_identities(AuthenticationConnection *, int);
 int	 ssh_lock_agent(AuthenticationConnection *, int, const char *);
diff --git a/crypto/openssh/clientloop.c b/crypto/openssh/clientloop.c
index 2c030e7..af207c0 100644
--- a/crypto/openssh/clientloop.c
+++ b/crypto/openssh/clientloop.c
@@ -59,7 +59,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.104 2002/08/22 19:38:42 stevesk Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.107 2003/04/01 10:22:21 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -888,10 +888,16 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 
 	client_init_dispatch();
 
-	/* Set signal handlers to restore non-blocking mode.  */
-	signal(SIGINT, signal_handler);
-	signal(SIGQUIT, signal_handler);
-	signal(SIGTERM, signal_handler);
+	/*
+	 * Set signal handlers, (e.g. to restore non-blocking mode)
+	 * but don't overwrite SIG_IGN, matches behaviour from rsh(1)
+	 */
+	if (signal(SIGINT, SIG_IGN) != SIG_IGN)
+		signal(SIGINT, signal_handler);
+	if (signal(SIGQUIT, SIG_IGN) != SIG_IGN)
+		signal(SIGQUIT, signal_handler);
+	if (signal(SIGTERM, SIG_IGN) != SIG_IGN)
+		signal(SIGTERM, signal_handler);
 	if (have_pty)
 		signal(SIGWINCH, window_change_handler);
 
diff --git a/crypto/openssh/config.guess b/crypto/openssh/config.guess
index fd30ab0..e8f2061 100755
--- a/crypto/openssh/config.guess
+++ b/crypto/openssh/config.guess
@@ -726,6 +726,9 @@ EOF
     CRAY*SV1:*:*:*)
 	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit 0 ;;
+    *:UNICOS/mp:*:*)
+	echo nv1-cray-unicosmp | sed -e 's/\.[^.]*$/.X/'
+	exit 0 ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
         FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
diff --git a/crypto/openssh/config.sub b/crypto/openssh/config.sub
index 9ff085e..a0b7bb9 100755
--- a/crypto/openssh/config.sub
+++ b/crypto/openssh/config.sub
@@ -315,7 +315,7 @@ case $basic_machine in
 	| mipsisa64-* | mipsisa64el-* \
 	| mipsisa64sb1-* | mipsisa64sb1el-* \
 	| mipstx39 | mipstx39el \
-	| none-* | np1-* | ns16k-* | ns32k-* \
+	| none-* | np1-* | ns16k-* | ns32k-* | nv1-* \
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
@@ -715,6 +715,9 @@ case $basic_machine in
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
+	nv1)
+		basic_machine=nv1-cray
+		;;
 	op50n-* | op60c-*)
 		basic_machine=hppa1.1-oki
 		os=-proelf
@@ -887,6 +890,10 @@ case $basic_machine in
 		basic_machine=sv1-cray
 		os=-unicos
 		;;
+        sx*-nec)
+		basic_machine=sx6-nec
+		os=-sysv
+		;;
 	symmetry)
 		basic_machine=i386-sequent
 		os=-dynix
diff --git a/crypto/openssh/crc32.c b/crypto/openssh/crc32.c
index 4774c8b..ac627b5 100644
--- a/crypto/openssh/crc32.c
+++ b/crypto/openssh/crc32.c
@@ -1,114 +1,105 @@
+/*	$OpenBSD: crc32.c,v 1.9 2003/02/12 21:39:50 markus Exp $	*/
+
 /*
- *  COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
- *  code or tables extracted from it, as desired without restriction.
- *
- *  First, the polynomial itself and its table of feedback terms.  The
- *  polynomial is
- *  X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0
- *
- *  Note that we take it "backwards" and put the highest-order term in
- *  the lowest-order bit.  The X^32 term is "implied"; the LSB is the
- *  X^31 term, etc.  The X^0 term (usually shown as "+1") results in
- *  the MSB being 1
- *
- *  Note that the usual hardware shift register implementation, which
- *  is what we're using (we're merely optimizing it by doing eight-bit
- *  chunks at a time) shifts bits into the lowest-order term.  In our
- *  implementation, that means shifting towards the right.  Why do we
- *  do it this way?  Because the calculated CRC must be transmitted in
- *  order from highest-order term to lowest-order term.  UARTs transmit
- *  characters in order from LSB to MSB.  By storing the CRC this way
- *  we hand it to the UART in the order low-byte to high-byte; the UART
- *  sends each low-bit to hight-bit; and the result is transmission bit
- *  by bit from highest- to lowest-order term without requiring any bit
- *  shuffling on our part.  Reception works similarly
- *
- *  The feedback terms table consists of 256, 32-bit entries.  Notes
+ * Copyright (c) 2003 Markus Friedl.  All rights reserved.
  *
- *      The table can be generated at runtime if desired; code to do so
- *      is shown later.  It might not be obvious, but the feedback
- *      terms simply represent the results of eight shift/xor opera
- *      tions for all combinations of data and CRC register values
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- *      The values must be right-shifted by eight bits by the "updcrc
- *      logic; the shift must be u_(bring in zeroes).  On some
- *      hardware you could probably optimize the shift in assembler by
- *      using byte-swap instructions
- *      polynomial $edb88320
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-
-
 #include "includes.h"
-RCSID("$OpenBSD: crc32.c,v 1.8 2000/12/19 23:17:56 markus Exp $");
-
 #include "crc32.h"
 
-static u_int crc32_tab[] = {
-	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
-	0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
-	0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
-	0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
-	0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
-	0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
-	0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
-	0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
-	0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
-	0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
-	0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
-	0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
-	0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
-	0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
-	0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
-	0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
-	0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
-	0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
-	0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
-	0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
-	0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
-	0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
-	0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
-	0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
-	0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
-	0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
-	0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
-	0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
-	0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
-	0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
-	0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
-	0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
-	0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
-	0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
-	0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
-	0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
-	0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
-	0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
-	0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
-	0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
-	0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
-	0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
-	0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
-	0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
-	0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
-	0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
-	0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
-	0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
-	0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
-	0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
-	0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
-	0x2d02ef8dL
+static const u_int32_t crc32tab[] = {
+	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL,
+	0x076dc419L, 0x706af48fL, 0xe963a535L, 0x9e6495a3L,
+	0x0edb8832L, 0x79dcb8a4L, 0xe0d5e91eL, 0x97d2d988L,
+	0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 0x90bf1d91L,
+	0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
+	0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L,
+	0x136c9856L, 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL,
+	0x14015c4fL, 0x63066cd9L, 0xfa0f3d63L, 0x8d080df5L,
+	0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 0xa2677172L,
+	0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
+	0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L,
+	0x32d86ce3L, 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L,
+	0x26d930acL, 0x51de003aL, 0xc8d75180L, 0xbfd06116L,
+	0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 0xb8bda50fL,
+	0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
+	0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL,
+	0x76dc4190L, 0x01db7106L, 0x98d220bcL, 0xefd5102aL,
+	0x71b18589L, 0x06b6b51fL, 0x9fbfe4a5L, 0xe8b8d433L,
+	0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 0xe10e9818L,
+	0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
+	0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL,
+	0x6c0695edL, 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L,
+	0x65b0d9c6L, 0x12b7e950L, 0x8bbeb8eaL, 0xfcb9887cL,
+	0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 0xfbd44c65L,
+	0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
+	0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL,
+	0x4369e96aL, 0x346ed9fcL, 0xad678846L, 0xda60b8d0L,
+	0x44042d73L, 0x33031de5L, 0xaa0a4c5fL, 0xdd0d7cc9L,
+	0x5005713cL, 0x270241aaL, 0xbe0b1010L, 0xc90c2086L,
+	0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
+	0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L,
+	0x59b33d17L, 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL,
+	0xedb88320L, 0x9abfb3b6L, 0x03b6e20cL, 0x74b1d29aL,
+	0xead54739L, 0x9dd277afL, 0x04db2615L, 0x73dc1683L,
+	0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
+	0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L,
+	0xf00f9344L, 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL,
+	0xf762575dL, 0x806567cbL, 0x196c3671L, 0x6e6b06e7L,
+	0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 0x67dd4accL,
+	0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
+	0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L,
+	0xd1bb67f1L, 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL,
+	0xd80d2bdaL, 0xaf0a1b4cL, 0x36034af6L, 0x41047a60L,
+	0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 0x4669be79L,
+	0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
+	0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL,
+	0xc5ba3bbeL, 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L,
+	0xc2d7ffa7L, 0xb5d0cf31L, 0x2cd99e8bL, 0x5bdeae1dL,
+	0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 0x026d930aL,
+	0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
+	0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L,
+	0x92d28e9bL, 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L,
+	0x86d3d2d4L, 0xf1d4e242L, 0x68ddb3f8L, 0x1fda836eL,
+	0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 0x18b74777L,
+	0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
+	0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L,
+	0xa00ae278L, 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L,
+	0xa7672661L, 0xd06016f7L, 0x4969474dL, 0x3e6e77dbL,
+	0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 0x37d83bf0L,
+	0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
+	0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L,
+	0xbad03605L, 0xcdd70693L, 0x54de5729L, 0x23d967bfL,
+	0xb3667a2eL, 0xc4614ab8L, 0x5d681b02L, 0x2a6f2b94L,
+	0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 0x2d02ef8dL
 };
 
-/* Return a 32-bit CRC of the contents of the buffer. */
-
-u_int
-ssh_crc32(const u_char *s, u_int len)
+u_int32_t
+ssh_crc32(const u_char *buf, u_int32_t size)
 {
-	u_int i;
-	u_int crc32val;
+	u_int32_t i, crc;
 
-	crc32val = 0;
-	for (i = 0;  i < len;  i ++) {
-		crc32val = crc32_tab[(crc32val ^ s[i]) & 0xff] ^ (crc32val >> 8);
-	}
-	return crc32val;
+	crc = 0;
+	for (i = 0;  i < size;  i++)
+		crc = crc32tab[(crc ^ buf[i]) & 0xff] ^ (crc >> 8);
+	return crc;
 }
diff --git a/crypto/openssh/crc32.h b/crypto/openssh/crc32.h
index cd1832f..a2fb584 100644
--- a/crypto/openssh/crc32.h
+++ b/crypto/openssh/crc32.h
@@ -1,21 +1,30 @@
-/*	$OpenBSD: crc32.h,v 1.13 2002/03/04 17:27:39 stevesk Exp $	*/
+/*	$OpenBSD: crc32.h,v 1.14 2003/02/12 21:39:50 markus Exp $	*/
 
 /*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1992 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for computing 32-bit CRC.
+ * Copyright (c) 2003 Markus Friedl.  All rights reserved.
  *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef CRC32_H
-#define CRC32_H
-
-u_int	 ssh_crc32(const u_char *, u_int);
-
-#endif				/* CRC32_H */
+#ifndef SSH_CRC32_H
+#define SSH_CRC32_H
+u_int32_t	 ssh_crc32(const u_char *, u_int32_t);
+#endif
diff --git a/crypto/openssh/defines.h b/crypto/openssh/defines.h
index ab19a07..73fbe07 100644
--- a/crypto/openssh/defines.h
+++ b/crypto/openssh/defines.h
@@ -1,7 +1,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H
 
-/* $Id: defines.h,v 1.96 2002/09/26 00:38:48 tim Exp $ */
+/* $Id: defines.h,v 1.97 2003/01/24 00:50:32 djm Exp $ */
 
 
 /* Constants */
@@ -370,6 +370,20 @@ struct winsize {
    } while (0)
 #endif
 
+#ifndef TIMEVAL_TO_TIMESPEC
+#define	TIMEVAL_TO_TIMESPEC(tv, ts) {					\
+	(ts)->tv_sec = (tv)->tv_sec;					\
+	(ts)->tv_nsec = (tv)->tv_usec * 1000;				\
+}
+#endif
+
+#ifndef TIMESPEC_TO_TIMEVAL
+#define	TIMESPEC_TO_TIMEVAL(tv, ts) {					\
+	(tv)->tv_sec = (ts)->tv_sec;					\
+	(tv)->tv_usec = (ts)->tv_nsec / 1000;				\
+}
+#endif
+
 #ifndef __P
 # define __P(x) x
 #endif
diff --git a/crypto/openssh/dh.c b/crypto/openssh/dh.c
index 6ec3786..1be5195 100644
--- a/crypto/openssh/dh.c
+++ b/crypto/openssh/dh.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: dh.c,v 1.22 2002/06/27 08:49:44 markus Exp $");
+RCSID("$OpenBSD: dh.c,v 1.23 2002/11/21 22:22:50 markus Exp $");
 
 #include "xmalloc.h"
 
@@ -182,7 +182,7 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)
 	for (i = 0; i <= n; i++)
 		if (BN_is_bit_set(dh_pub, i))
 			bits_set++;
-	debug("bits set: %d/%d", bits_set, BN_num_bits(dh->p));
+	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));
 
 	/* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
 	if (bits_set > 1 && (BN_cmp(dh_pub, dh->p) == -1))
@@ -214,7 +214,7 @@ dh_gen_key(DH *dh, int need)
 		for (i = 0; i <= BN_num_bits(dh->priv_key); i++)
 			if (BN_is_bit_set(dh->priv_key, i))
 				bits_set++;
-		debug("dh_gen_key: priv key bits set: %d/%d",
+		debug2("dh_gen_key: priv key bits set: %d/%d",
 		    bits_set, BN_num_bits(dh->priv_key));
 		if (tries++ > 10)
 			fatal("dh_gen_key: too many bad keys: giving up");
diff --git a/crypto/openssh/fixpaths b/crypto/openssh/fixpaths
index 7e4178e..60a6799 100755
--- a/crypto/openssh/fixpaths
+++ b/crypto/openssh/fixpaths
@@ -1,43 +1,22 @@
-#!/usr/bin/perl -w
+#!/bin/sh
 #
 # fixpaths  - substitute makefile variables into text files
+# Usage: fixpaths -Dsomething=somethingelse ...
 
-
-$usage = "Usage: $0 [-Dstring=replacement] [[infile] ...]\n";
-
-if (!defined(@ARGV)) { die ("$usage"); }
-
-# read in the command line and get some definitions
-while ($_=$ARGV[0], /^-/) {
-  if (/^-D/) {
-    # definition
-    shift(@ARGV);
-    if ( /-D(.*)=(.*)/ ) {
-      $def{"$1"}=$2;
-    } else {
-      die ("$usage$0: error in command line arguments.\n");
-    }
-  } else {
-    @cmd = split(//, $ARGV[0]); $opt = $cmd[1];
-    die ("$usage$0: unknown option '-$opt'\n");
-  }
-} # while parsing arguments
-
-if (!defined(%def)) {
-  die ("$0: nothing to do - no substitutions listed!\n");
+die() {
+	echo $*
+	exit -1
 }
 
-for $f (@ARGV) {
+test -n "`echo $1|grep -- -D`" || \
+	die $0: nothing to do - no substitutions listed!
+
+test -n "`echo $1|grep -- '-D[^=]\+=[^ ]\+'`" || \
+	die $0: error in command line arguments.
 
-  $f =~ /(.*\/)*(.*)$/;
+test -n "`echo $*|grep -- ' [^-]'`" || \
+	die Usage: $0 '[-Dstring=replacement] [[infile] ...]'
 
-  open(IN, "<$f")          || die ("$0: input file $f missing!\n");
-  while (<IN>) {
-    for $s (keys(%def)) {
-      s#$s#$def{$s}#;
-    } # for $s
-    print;
-  } # while <IN>
-} # for $f
+sed `echo $*|sed -e 's/-D\([^=]\+\)=\([^ ]*\)/-e s=\1=\2=g/g'`
 
-exit 0;
+exit 0
diff --git a/crypto/openssh/hostfile.h b/crypto/openssh/hostfile.h
index 1df7a22..e3d1165 100644
--- a/crypto/openssh/hostfile.h
+++ b/crypto/openssh/hostfile.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hostfile.h,v 1.12 2002/09/08 20:24:08 markus Exp $	*/
+/*	$OpenBSD: hostfile.h,v 1.13 2002/11/21 23:03:51 deraadt Exp $	*/
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -19,10 +19,10 @@ typedef enum {
 }       HostStatus;
 
 int	 hostfile_read_key(char **, u_int *, Key *);
-HostStatus
-check_host_in_hostfile(const char *, const char *, Key *, Key *, int *);
-int	 add_host_to_hostfile(const char *, const char *, Key *);
-int	
-lookup_key_in_hostfile_by_type(const char *, const char *, int , Key *, int *);
+HostStatus check_host_in_hostfile(const char *, const char *,
+	    Key *, Key *, int *);
+int	add_host_to_hostfile(const char *, const char *, Key *);
+int	lookup_key_in_hostfile_by_type(const char *, const char *,
+	    int, Key *, int *);
 
 #endif
diff --git a/crypto/openssh/kex.c b/crypto/openssh/kex.c
index bdbf388..b070ccf 100644
--- a/crypto/openssh/kex.c
+++ b/crypto/openssh/kex.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kex.c,v 1.51 2002/06/24 14:55:38 markus Exp $");
+RCSID("$OpenBSD: kex.c,v 1.55 2003/04/01 10:31:26 markus Exp $");
 
 #include <openssl/crypto.h>
 
@@ -44,11 +44,6 @@ RCSID("$OpenBSD: kex.c,v 1.51 2002/06/24 14:55:38 markus Exp $");
 
 #define KEX_COOKIE_LEN	16
 
-/* Use privilege separation for sshd */
-int use_privsep;
-struct monitor *pmonitor;
-
-
 /* prototype */
 static void kex_kexinit_finish(Kex *);
 static void kex_choose_conf(Kex *);
@@ -74,7 +69,7 @@ kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
 
 /* parse buffer and return algorithm proposal */
 static char **
-kex_buf2prop(Buffer *raw)
+kex_buf2prop(Buffer *raw, int *first_kex_follows)
 {
 	Buffer b;
 	int i;
@@ -94,6 +89,8 @@ kex_buf2prop(Buffer *raw)
 	}
 	/* first kex follows / reserved */
 	i = buffer_get_char(&b);
+	if (first_kex_follows != NULL)
+		*first_kex_follows = i;
 	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
 	i = buffer_get_int(&b);
 	debug2("kex_parse_kexinit: reserved %d ", i);
@@ -135,7 +132,7 @@ kex_finish(Kex *kex)
 	/* packet_write_wait(); */
 	debug("SSH2_MSG_NEWKEYS sent");
 
-	debug("waiting for SSH2_MSG_NEWKEYS");
+	debug("expecting SSH2_MSG_NEWKEYS");
 	packet_read_expect(SSH2_MSG_NEWKEYS);
 	packet_check_eom();
 	debug("SSH2_MSG_NEWKEYS received");
@@ -235,14 +232,10 @@ kex_kexinit_finish(Kex *kex)
 
 	kex_choose_conf(kex);
 
-	switch (kex->kex_type) {
-	case DH_GRP1_SHA1:
-		kexdh(kex);
-		break;
-	case DH_GEX_SHA1:
-		kexgex(kex);
-		break;
-	default:
+	if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
+	    kex->kex[kex->kex_type] != NULL) {
+		(kex->kex[kex->kex_type])(kex);
+	} else {
 		fatal("Unsupported key exchange %d", kex->kex_type);
 	}
 }
@@ -299,9 +292,9 @@ choose_kex(Kex *k, char *client, char *server)
 	if (k->name == NULL)
 		fatal("no kex alg");
 	if (strcmp(k->name, KEX_DH1) == 0) {
-		k->kex_type = DH_GRP1_SHA1;
+		k->kex_type = KEX_DH_GRP1_SHA1;
 	} else if (strcmp(k->name, KEX_DHGEX) == 0) {
-		k->kex_type = DH_GEX_SHA1;
+		k->kex_type = KEX_DH_GEX_SHA1;
 	} else
 		fatal("bad kex alg %s", k->name);
 }
@@ -317,6 +310,30 @@ choose_hostkeyalg(Kex *k, char *client, char *server)
 	xfree(hostkeyalg);
 }
 
+static int 
+proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
+{
+	static int check[] = {
+		PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
+	};
+	int *idx;
+	char *p;
+
+	for (idx = &check[0]; *idx != -1; idx++) {
+		if ((p = strchr(my[*idx], ',')) != NULL)
+			*p = '\0';
+		if ((p = strchr(peer[*idx], ',')) != NULL)
+			*p = '\0';
+		if (strcmp(my[*idx], peer[*idx]) != 0) {
+			debug2("proposal mismatch: my %s peer %s",
+			    my[*idx], peer[*idx]);
+			return (0);
+		}
+	}
+	debug2("proposals match");
+	return (1);
+}
+
 static void
 kex_choose_conf(Kex *kex)
 {
@@ -327,9 +344,10 @@ kex_choose_conf(Kex *kex)
 	int mode;
 	int ctos;				/* direction: if true client-to-server */
 	int need;
+	int first_kex_follows, type;
 
-	my   = kex_buf2prop(&kex->my);
-	peer = kex_buf2prop(&kex->peer);
+	my   = kex_buf2prop(&kex->my, NULL);
+	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
 
 	if (kex->server) {
 		cprop=peer;
@@ -373,6 +391,13 @@ kex_choose_conf(Kex *kex)
 	/* XXX need runden? */
 	kex->we_need = need;
 
+	/* ignore the next message if the proposals do not match */
+	if (first_kex_follows && !proposals_match(my, peer) && 
+	   !(datafellows & SSH_BUG_FIRSTKEX)) {
+		type = packet_read();
+		debug2("skipping next packet (type %u)", type);
+	}
+
 	kex_prop_free(my);
 	kex_prop_free(peer);
 }
@@ -433,7 +458,7 @@ kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
 	for (i = 0; i < NKEYS; i++)
 		keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
 
-	debug("kex_derive_keys");
+	debug2("kex_derive_keys");
 	for (mode = 0; mode < MODE_MAX; mode++) {
 		current_keys[mode] = kex->newkeys[mode];
 		kex->newkeys[mode] = NULL;
diff --git a/crypto/openssh/kex.h b/crypto/openssh/kex.h
index 93a529e..52d442e 100644
--- a/crypto/openssh/kex.h
+++ b/crypto/openssh/kex.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kex.h,v 1.32 2002/09/09 14:54:14 markus Exp $	*/
+/*	$OpenBSD: kex.h,v 1.33 2003/02/16 17:09:57 markus Exp $	*/
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -55,8 +55,9 @@ enum kex_modes {
 };
 
 enum kex_exchange {
-	DH_GRP1_SHA1,
-	DH_GEX_SHA1
+	KEX_DH_GRP1_SHA1,
+	KEX_DH_GEX_SHA1,
+	KEX_MAX
 };
 
 #define KEX_INIT_SENT	0x0001
@@ -112,6 +113,7 @@ struct Kex {
 	int	(*verify_host_key)(Key *);
 	Key	*(*load_host_key)(int);
 	int	(*host_key_index)(Key *);
+	void	(*kex[KEX_MAX])(Kex *);
 };
 
 Kex	*kex_setup(char *[PROPOSAL_MAX]);
@@ -121,11 +123,20 @@ void	 kex_send_kexinit(Kex *);
 void	 kex_input_kexinit(int, u_int32_t, void *);
 void	 kex_derive_keys(Kex *, u_char *, BIGNUM *);
 
-void	 kexdh(Kex *);
-void	 kexgex(Kex *);
-
 Newkeys *kex_get_newkeys(int);
 
+void	 kexdh_client(Kex *);
+void	 kexdh_server(Kex *);
+void	 kexgex_client(Kex *);
+void	 kexgex_server(Kex *);
+
+u_char *
+kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
+    BIGNUM *, BIGNUM *, BIGNUM *);
+u_char *
+kexgex_hash(char *, char *, char *, int, char *, int, u_char *, int,
+    int, int, int, BIGNUM *, BIGNUM *, BIGNUM *, BIGNUM *, BIGNUM *);
+
 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
 void	dump_digest(char *, u_char *, int);
 #endif
diff --git a/crypto/openssh/kexdh.c b/crypto/openssh/kexdh.c
index 1e91e25..4bbb7d1 100644
--- a/crypto/openssh/kexdh.c
+++ b/crypto/openssh/kexdh.c
@@ -23,23 +23,16 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kexdh.c,v 1.18 2002/03/18 17:50:31 provos Exp $");
+RCSID("$OpenBSD: kexdh.c,v 1.19 2003/02/16 17:09:57 markus Exp $");
 
-#include <openssl/crypto.h>
-#include <openssl/bn.h>
+#include <openssl/evp.h>
 
-#include "xmalloc.h"
 #include "buffer.h"
 #include "bufaux.h"
-#include "key.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "dh.h"
 #include "ssh2.h"
-#include "monitor_wrap.h"
+#include "kex.h"
 
-static u_char *
+u_char *
 kex_dh_hash(
     char *client_version_string,
     char *server_version_string,
@@ -86,222 +79,3 @@ kex_dh_hash(
 #endif
 	return digest;
 }
-
-/* client */
-
-static void
-kexdh_client(Kex *kex)
-{
-	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
-	DH *dh;
-	Key *server_host_key;
-	u_char *server_host_key_blob = NULL, *signature = NULL;
-	u_char *kbuf, *hash;
-	u_int klen, kout, slen, sbloblen;
-
-	/* generate and send 'e', client DH public key */
-	dh = dh_new_group1();
-	dh_gen_key(dh, kex->we_need * 8);
-	packet_start(SSH2_MSG_KEXDH_INIT);
-	packet_put_bignum2(dh->pub_key);
-	packet_send();
-
-	debug("sending SSH2_MSG_KEXDH_INIT");
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-
-	debug("expecting SSH2_MSG_KEXDH_REPLY");
-	packet_read_expect(SSH2_MSG_KEXDH_REPLY);
-
-	/* key, cert */
-	server_host_key_blob = packet_get_string(&sbloblen);
-	server_host_key = key_from_blob(server_host_key_blob, sbloblen);
-	if (server_host_key == NULL)
-		fatal("cannot decode server_host_key_blob");
-	if (server_host_key->type != kex->hostkey_type)
-		fatal("type mismatch for decoded server_host_key_blob");
-	if (kex->verify_host_key == NULL)
-		fatal("cannot verify server_host_key");
-	if (kex->verify_host_key(server_host_key) == -1)
-		fatal("server_host_key verification failed");
-
-	/* DH paramter f, server public DH key */
-	if ((dh_server_pub = BN_new()) == NULL)
-		fatal("dh_server_pub == NULL");
-	packet_get_bignum2(dh_server_pub);
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_server_pub= ");
-	BN_print_fp(stderr, dh_server_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_server_pub));
-#endif
-
-	/* signed H */
-	signature = packet_get_string(&slen);
-	packet_check_eom();
-
-	if (!dh_pub_is_valid(dh, dh_server_pub))
-		packet_disconnect("bad server public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_server_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexdh_client: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	/* calc and verify H */
-	hash = kex_dh_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    server_host_key_blob, sbloblen,
-	    dh->pub_key,
-	    dh_server_pub,
-	    shared_secret
-	);
-	xfree(server_host_key_blob);
-	BN_clear_free(dh_server_pub);
-	DH_free(dh);
-
-	if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
-		fatal("key_verify failed for server_host_key");
-	key_free(server_host_key);
-	xfree(signature);
-
-	/* save session id */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-	kex_finish(kex);
-}
-
-/* server */
-
-static void
-kexdh_server(Kex *kex)
-{
-	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
-	DH *dh;
-	Key *server_host_key;
-	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-	u_int sbloblen, klen, kout;
-	u_int slen;
-
-	/* generate server DH public key */
-	dh = dh_new_group1();
-	dh_gen_key(dh, kex->we_need * 8);
-
-	debug("expecting SSH2_MSG_KEXDH_INIT");
-	packet_read_expect(SSH2_MSG_KEXDH_INIT);
-
-	if (kex->load_host_key == NULL)
-		fatal("Cannot load hostkey");
-	server_host_key = kex->load_host_key(kex->hostkey_type);
-	if (server_host_key == NULL)
-		fatal("Unsupported hostkey type %d", kex->hostkey_type);
-
-	/* key, cert */
-	if ((dh_client_pub = BN_new()) == NULL)
-		fatal("dh_client_pub == NULL");
-	packet_get_bignum2(dh_client_pub);
-	packet_check_eom();
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_client_pub= ");
-	BN_print_fp(stderr, dh_client_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_client_pub));
-#endif
-
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-	if (!dh_pub_is_valid(dh, dh_client_pub))
-		packet_disconnect("bad client public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_client_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexdh_server: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
-
-	/* calc H */
-	hash = kex_dh_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    server_host_key_blob, sbloblen,
-	    dh_client_pub,
-	    dh->pub_key,
-	    shared_secret
-	);
-	BN_clear_free(dh_client_pub);
-
-	/* save session id := H */
-	/* XXX hashlen depends on KEX */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-
-	/* sign H */
-	/* XXX hashlen depends on KEX */
-	PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
-
-	/* destroy_sensitive_data(); */
-
-	/* send server hostkey, DH pubkey 'f' and singed H */
-	packet_start(SSH2_MSG_KEXDH_REPLY);
-	packet_put_string(server_host_key_blob, sbloblen);
-	packet_put_bignum2(dh->pub_key);	/* f */
-	packet_put_string(signature, slen);
-	packet_send();
-
-	xfree(signature);
-	xfree(server_host_key_blob);
-	/* have keys, free DH */
-	DH_free(dh);
-
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-	kex_finish(kex);
-}
-
-void
-kexdh(Kex *kex)
-{
-	if (kex->server)
-		kexdh_server(kex);
-	else
-		kexdh_client(kex);
-}
diff --git a/crypto/openssh/kexdhc.c b/crypto/openssh/kexdhc.c
new file mode 100644
index 0000000..fe6dc53
--- /dev/null
+++ b/crypto/openssh/kexdhc.c
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: kexdhc.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
+
+#include "xmalloc.h"
+#include "key.h"
+#include "kex.h"
+#include "log.h"
+#include "packet.h"
+#include "dh.h"
+#include "ssh2.h"
+
+void
+kexdh_client(Kex *kex)
+{
+	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
+	DH *dh;
+	Key *server_host_key;
+	u_char *server_host_key_blob = NULL, *signature = NULL;
+	u_char *kbuf, *hash;
+	u_int klen, kout, slen, sbloblen;
+
+	/* generate and send 'e', client DH public key */
+	dh = dh_new_group1();
+	dh_gen_key(dh, kex->we_need * 8);
+	packet_start(SSH2_MSG_KEXDH_INIT);
+	packet_put_bignum2(dh->pub_key);
+	packet_send();
+
+	debug("sending SSH2_MSG_KEXDH_INIT");
+#ifdef DEBUG_KEXDH
+	DHparams_print_fp(stderr, dh);
+	fprintf(stderr, "pub= ");
+	BN_print_fp(stderr, dh->pub_key);
+	fprintf(stderr, "\n");
+#endif
+
+	debug("expecting SSH2_MSG_KEXDH_REPLY");
+	packet_read_expect(SSH2_MSG_KEXDH_REPLY);
+
+	/* key, cert */
+	server_host_key_blob = packet_get_string(&sbloblen);
+	server_host_key = key_from_blob(server_host_key_blob, sbloblen);
+	if (server_host_key == NULL)
+		fatal("cannot decode server_host_key_blob");
+	if (server_host_key->type != kex->hostkey_type)
+		fatal("type mismatch for decoded server_host_key_blob");
+	if (kex->verify_host_key == NULL)
+		fatal("cannot verify server_host_key");
+	if (kex->verify_host_key(server_host_key) == -1)
+		fatal("server_host_key verification failed");
+
+	/* DH paramter f, server public DH key */
+	if ((dh_server_pub = BN_new()) == NULL)
+		fatal("dh_server_pub == NULL");
+	packet_get_bignum2(dh_server_pub);
+
+#ifdef DEBUG_KEXDH
+	fprintf(stderr, "dh_server_pub= ");
+	BN_print_fp(stderr, dh_server_pub);
+	fprintf(stderr, "\n");
+	debug("bits %d", BN_num_bits(dh_server_pub));
+#endif
+
+	/* signed H */
+	signature = packet_get_string(&slen);
+	packet_check_eom();
+
+	if (!dh_pub_is_valid(dh, dh_server_pub))
+		packet_disconnect("bad server public DH value");
+
+	klen = DH_size(dh);
+	kbuf = xmalloc(klen);
+	kout = DH_compute_key(kbuf, dh_server_pub, dh);
+#ifdef DEBUG_KEXDH
+	dump_digest("shared secret", kbuf, kout);
+#endif
+	if ((shared_secret = BN_new()) == NULL)
+		fatal("kexdh_client: BN_new failed");
+	BN_bin2bn(kbuf, kout, shared_secret);
+	memset(kbuf, 0, klen);
+	xfree(kbuf);
+
+	/* calc and verify H */
+	hash = kex_dh_hash(
+	    kex->client_version_string,
+	    kex->server_version_string,
+	    buffer_ptr(&kex->my), buffer_len(&kex->my),
+	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+	    server_host_key_blob, sbloblen,
+	    dh->pub_key,
+	    dh_server_pub,
+	    shared_secret
+	);
+	xfree(server_host_key_blob);
+	BN_clear_free(dh_server_pub);
+	DH_free(dh);
+
+	if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
+		fatal("key_verify failed for server_host_key");
+	key_free(server_host_key);
+	xfree(signature);
+
+	/* save session id */
+	if (kex->session_id == NULL) {
+		kex->session_id_len = 20;
+		kex->session_id = xmalloc(kex->session_id_len);
+		memcpy(kex->session_id, hash, kex->session_id_len);
+	}
+
+	kex_derive_keys(kex, hash, shared_secret);
+	BN_clear_free(shared_secret);
+	kex_finish(kex);
+}
diff --git a/crypto/openssh/kexdhs.c b/crypto/openssh/kexdhs.c
new file mode 100644
index 0000000..f04bce8
--- /dev/null
+++ b/crypto/openssh/kexdhs.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: kexdhs.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
+
+#include "xmalloc.h"
+#include "key.h"
+#include "kex.h"
+#include "log.h"
+#include "packet.h"
+#include "dh.h"
+#include "ssh2.h"
+#include "monitor_wrap.h"
+
+void
+kexdh_server(Kex *kex)
+{
+	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
+	DH *dh;
+	Key *server_host_key;
+	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
+	u_int sbloblen, klen, kout;
+	u_int slen;
+
+	/* generate server DH public key */
+	dh = dh_new_group1();
+	dh_gen_key(dh, kex->we_need * 8);
+
+	debug("expecting SSH2_MSG_KEXDH_INIT");
+	packet_read_expect(SSH2_MSG_KEXDH_INIT);
+
+	if (kex->load_host_key == NULL)
+		fatal("Cannot load hostkey");
+	server_host_key = kex->load_host_key(kex->hostkey_type);
+	if (server_host_key == NULL)
+		fatal("Unsupported hostkey type %d", kex->hostkey_type);
+
+	/* key, cert */
+	if ((dh_client_pub = BN_new()) == NULL)
+		fatal("dh_client_pub == NULL");
+	packet_get_bignum2(dh_client_pub);
+	packet_check_eom();
+
+#ifdef DEBUG_KEXDH
+	fprintf(stderr, "dh_client_pub= ");
+	BN_print_fp(stderr, dh_client_pub);
+	fprintf(stderr, "\n");
+	debug("bits %d", BN_num_bits(dh_client_pub));
+#endif
+
+#ifdef DEBUG_KEXDH
+	DHparams_print_fp(stderr, dh);
+	fprintf(stderr, "pub= ");
+	BN_print_fp(stderr, dh->pub_key);
+	fprintf(stderr, "\n");
+#endif
+	if (!dh_pub_is_valid(dh, dh_client_pub))
+		packet_disconnect("bad client public DH value");
+
+	klen = DH_size(dh);
+	kbuf = xmalloc(klen);
+	kout = DH_compute_key(kbuf, dh_client_pub, dh);
+#ifdef DEBUG_KEXDH
+	dump_digest("shared secret", kbuf, kout);
+#endif
+	if ((shared_secret = BN_new()) == NULL)
+		fatal("kexdh_server: BN_new failed");
+	BN_bin2bn(kbuf, kout, shared_secret);
+	memset(kbuf, 0, klen);
+	xfree(kbuf);
+
+	key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
+
+	/* calc H */
+	hash = kex_dh_hash(
+	    kex->client_version_string,
+	    kex->server_version_string,
+	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+	    buffer_ptr(&kex->my), buffer_len(&kex->my),
+	    server_host_key_blob, sbloblen,
+	    dh_client_pub,
+	    dh->pub_key,
+	    shared_secret
+	);
+	BN_clear_free(dh_client_pub);
+
+	/* save session id := H */
+	/* XXX hashlen depends on KEX */
+	if (kex->session_id == NULL) {
+		kex->session_id_len = 20;
+		kex->session_id = xmalloc(kex->session_id_len);
+		memcpy(kex->session_id, hash, kex->session_id_len);
+	}
+
+	/* sign H */
+	/* XXX hashlen depends on KEX */
+	PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
+
+	/* destroy_sensitive_data(); */
+
+	/* send server hostkey, DH pubkey 'f' and singed H */
+	packet_start(SSH2_MSG_KEXDH_REPLY);
+	packet_put_string(server_host_key_blob, sbloblen);
+	packet_put_bignum2(dh->pub_key);	/* f */
+	packet_put_string(signature, slen);
+	packet_send();
+
+	xfree(signature);
+	xfree(server_host_key_blob);
+	/* have keys, free DH */
+	DH_free(dh);
+
+	kex_derive_keys(kex, hash, shared_secret);
+	BN_clear_free(shared_secret);
+	kex_finish(kex);
+}
diff --git a/crypto/openssh/kexgex.c b/crypto/openssh/kexgex.c
index 2d4a581..b0c39c8 100644
--- a/crypto/openssh/kexgex.c
+++ b/crypto/openssh/kexgex.c
@@ -24,23 +24,16 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kexgex.c,v 1.22 2002/03/24 17:27:03 stevesk Exp $");
+RCSID("$OpenBSD: kexgex.c,v 1.23 2003/02/16 17:09:57 markus Exp $");
 
-#include <openssl/bn.h>
+#include <openssl/evp.h>
 
-#include "xmalloc.h"
 #include "buffer.h"
 #include "bufaux.h"
-#include "key.h"
 #include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "dh.h"
 #include "ssh2.h"
-#include "compat.h"
-#include "monitor_wrap.h"
 
-static u_char *
+u_char *
 kexgex_hash(
     char *client_version_string,
     char *server_version_string,
@@ -97,318 +90,3 @@ kexgex_hash(
 #endif
 	return digest;
 }
-
-/* client */
-
-static void
-kexgex_client(Kex *kex)
-{
-	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
-	BIGNUM *p = NULL, *g = NULL;
-	Key *server_host_key;
-	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-	u_int klen, kout, slen, sbloblen;
-	int min, max, nbits;
-	DH *dh;
-
-	nbits = dh_estimate(kex->we_need * 8);
-
-	if (datafellows & SSH_OLD_DHGEX) {
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD sent");
-
-		/* Old GEX request */
-		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
-		packet_put_int(nbits);
-		min = DH_GRP_MIN;
-		max = DH_GRP_MAX;
-	} else {
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST sent");
-
-		/* New GEX request */
-		min = DH_GRP_MIN;
-		max = DH_GRP_MAX;
-		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
-		packet_put_int(min);
-		packet_put_int(nbits);
-		packet_put_int(max);
-	}
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
-	    min, nbits, max);
-#endif
-	packet_send();
-
-	debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP");
-	packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP);
-
-	if ((p = BN_new()) == NULL)
-		fatal("BN_new");
-	packet_get_bignum2(p);
-	if ((g = BN_new()) == NULL)
-		fatal("BN_new");
-	packet_get_bignum2(g);
-	packet_check_eom();
-
-	if (BN_num_bits(p) < min || BN_num_bits(p) > max)
-		fatal("DH_GEX group out of range: %d !< %d !< %d",
-		    min, BN_num_bits(p), max);
-
-	dh = dh_new_group(g, p);
-	dh_gen_key(dh, kex->we_need * 8);
-
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-
-	debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
-	/* generate and send 'e', client DH public key */
-	packet_start(SSH2_MSG_KEX_DH_GEX_INIT);
-	packet_put_bignum2(dh->pub_key);
-	packet_send();
-
-	debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY");
-	packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY);
-
-	/* key, cert */
-	server_host_key_blob = packet_get_string(&sbloblen);
-	server_host_key = key_from_blob(server_host_key_blob, sbloblen);
-	if (server_host_key == NULL)
-		fatal("cannot decode server_host_key_blob");
-	if (server_host_key->type != kex->hostkey_type)
-		fatal("type mismatch for decoded server_host_key_blob");
-	if (kex->verify_host_key == NULL)
-		fatal("cannot verify server_host_key");
-	if (kex->verify_host_key(server_host_key) == -1)
-		fatal("server_host_key verification failed");
-
-	/* DH paramter f, server public DH key */
-	if ((dh_server_pub = BN_new()) == NULL)
-		fatal("dh_server_pub == NULL");
-	packet_get_bignum2(dh_server_pub);
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_server_pub= ");
-	BN_print_fp(stderr, dh_server_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_server_pub));
-#endif
-
-	/* signed H */
-	signature = packet_get_string(&slen);
-	packet_check_eom();
-
-	if (!dh_pub_is_valid(dh, dh_server_pub))
-		packet_disconnect("bad server public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_server_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexgex_client: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	if (datafellows & SSH_OLD_DHGEX)
-		min = max = -1;
-
-	/* calc and verify H */
-	hash = kexgex_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    server_host_key_blob, sbloblen,
-	    min, nbits, max,
-	    dh->p, dh->g,
-	    dh->pub_key,
-	    dh_server_pub,
-	    shared_secret
-	);
-	/* have keys, free DH */
-	DH_free(dh);
-	xfree(server_host_key_blob);
-	BN_clear_free(dh_server_pub);
-
-	if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
-		fatal("key_verify failed for server_host_key");
-	key_free(server_host_key);
-	xfree(signature);
-
-	/* save session id */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-
-	kex_finish(kex);
-}
-
-/* server */
-
-static void
-kexgex_server(Kex *kex)
-{
-	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
-	Key *server_host_key;
-	DH *dh;
-	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-	u_int sbloblen, klen, kout, slen;
-	int min = -1, max = -1, nbits = -1, type;
-
-	if (kex->load_host_key == NULL)
-		fatal("Cannot load hostkey");
-	server_host_key = kex->load_host_key(kex->hostkey_type);
-	if (server_host_key == NULL)
-		fatal("Unsupported hostkey type %d", kex->hostkey_type);
-
-	type = packet_read();
-	switch (type) {
-	case SSH2_MSG_KEX_DH_GEX_REQUEST:
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
-		min = packet_get_int();
-		nbits = packet_get_int();
-		max = packet_get_int();
-		min = MAX(DH_GRP_MIN, min);
-		max = MIN(DH_GRP_MAX, max);
-		break;
-	case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
-		nbits = packet_get_int();
-		min = DH_GRP_MIN;
-		max = DH_GRP_MAX;
-		/* unused for old GEX */
-		break;
-	default:
-		fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type);
-	}
-	packet_check_eom();
-
-	if (max < min || nbits < min || max < nbits)
-		fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d",
-		    min, nbits, max);
-
-	/* Contact privileged parent */
-	dh = PRIVSEP(choose_dh(min, nbits, max));
-	if (dh == NULL)
-		packet_disconnect("Protocol error: no matching DH grp found");
-
-	debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
-	packet_start(SSH2_MSG_KEX_DH_GEX_GROUP);
-	packet_put_bignum2(dh->p);
-	packet_put_bignum2(dh->g);
-	packet_send();
-
-	/* flush */
-	packet_write_wait();
-
-	/* Compute our exchange value in parallel with the client */
-	dh_gen_key(dh, kex->we_need * 8);
-
-	debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
-	packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT);
-
-	/* key, cert */
-	if ((dh_client_pub = BN_new()) == NULL)
-		fatal("dh_client_pub == NULL");
-	packet_get_bignum2(dh_client_pub);
-	packet_check_eom();
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_client_pub= ");
-	BN_print_fp(stderr, dh_client_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_client_pub));
-#endif
-
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-	if (!dh_pub_is_valid(dh, dh_client_pub))
-		packet_disconnect("bad client public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_client_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexgex_server: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
-
-	if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
-		min = max = -1;
-
-	/* calc H */			/* XXX depends on 'kex' */
-	hash = kexgex_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    server_host_key_blob, sbloblen,
-	    min, nbits, max,
-	    dh->p, dh->g,
-	    dh_client_pub,
-	    dh->pub_key,
-	    shared_secret
-	);
-	BN_clear_free(dh_client_pub);
-
-	/* save session id := H */
-	/* XXX hashlen depends on KEX */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-
-	/* sign H */
-	/* XXX hashlen depends on KEX */
-	PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
-
-	/* destroy_sensitive_data(); */
-
-	/* send server hostkey, DH pubkey 'f' and singed H */
-	debug("SSH2_MSG_KEX_DH_GEX_REPLY sent");
-	packet_start(SSH2_MSG_KEX_DH_GEX_REPLY);
-	packet_put_string(server_host_key_blob, sbloblen);
-	packet_put_bignum2(dh->pub_key);	/* f */
-	packet_put_string(signature, slen);
-	packet_send();
-
-	xfree(signature);
-	xfree(server_host_key_blob);
-	/* have keys, free DH */
-	DH_free(dh);
-
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-
-	kex_finish(kex);
-}
-
-void
-kexgex(Kex *kex)
-{
-	if (kex->server)
-		kexgex_server(kex);
-	else
-		kexgex_client(kex);
-}
diff --git a/crypto/openssh/kexgexc.c b/crypto/openssh/kexgexc.c
new file mode 100644
index 0000000..f14ac44
--- /dev/null
+++ b/crypto/openssh/kexgexc.c
@@ -0,0 +1,189 @@
+/*
+ * Copyright (c) 2000 Niels Provos.  All rights reserved.
+ * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: kexgexc.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
+
+#include "xmalloc.h"
+#include "key.h"
+#include "kex.h"
+#include "log.h"
+#include "packet.h"
+#include "dh.h"
+#include "ssh2.h"
+#include "compat.h"
+
+void
+kexgex_client(Kex *kex)
+{
+	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
+	BIGNUM *p = NULL, *g = NULL;
+	Key *server_host_key;
+	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
+	u_int klen, kout, slen, sbloblen;
+	int min, max, nbits;
+	DH *dh;
+
+	nbits = dh_estimate(kex->we_need * 8);
+
+	if (datafellows & SSH_OLD_DHGEX) {
+		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD sent");
+
+		/* Old GEX request */
+		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
+		packet_put_int(nbits);
+		min = DH_GRP_MIN;
+		max = DH_GRP_MAX;
+	} else {
+		debug("SSH2_MSG_KEX_DH_GEX_REQUEST sent");
+
+		/* New GEX request */
+		min = DH_GRP_MIN;
+		max = DH_GRP_MAX;
+		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
+		packet_put_int(min);
+		packet_put_int(nbits);
+		packet_put_int(max);
+	}
+#ifdef DEBUG_KEXDH
+	fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
+	    min, nbits, max);
+#endif
+	packet_send();
+
+	debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP");
+	packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP);
+
+	if ((p = BN_new()) == NULL)
+		fatal("BN_new");
+	packet_get_bignum2(p);
+	if ((g = BN_new()) == NULL)
+		fatal("BN_new");
+	packet_get_bignum2(g);
+	packet_check_eom();
+
+	if (BN_num_bits(p) < min || BN_num_bits(p) > max)
+		fatal("DH_GEX group out of range: %d !< %d !< %d",
+		    min, BN_num_bits(p), max);
+
+	dh = dh_new_group(g, p);
+	dh_gen_key(dh, kex->we_need * 8);
+
+#ifdef DEBUG_KEXDH
+	DHparams_print_fp(stderr, dh);
+	fprintf(stderr, "pub= ");
+	BN_print_fp(stderr, dh->pub_key);
+	fprintf(stderr, "\n");
+#endif
+
+	debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
+	/* generate and send 'e', client DH public key */
+	packet_start(SSH2_MSG_KEX_DH_GEX_INIT);
+	packet_put_bignum2(dh->pub_key);
+	packet_send();
+
+	debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY");
+	packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY);
+
+	/* key, cert */
+	server_host_key_blob = packet_get_string(&sbloblen);
+	server_host_key = key_from_blob(server_host_key_blob, sbloblen);
+	if (server_host_key == NULL)
+		fatal("cannot decode server_host_key_blob");
+	if (server_host_key->type != kex->hostkey_type)
+		fatal("type mismatch for decoded server_host_key_blob");
+	if (kex->verify_host_key == NULL)
+		fatal("cannot verify server_host_key");
+	if (kex->verify_host_key(server_host_key) == -1)
+		fatal("server_host_key verification failed");
+
+	/* DH paramter f, server public DH key */
+	if ((dh_server_pub = BN_new()) == NULL)
+		fatal("dh_server_pub == NULL");
+	packet_get_bignum2(dh_server_pub);
+
+#ifdef DEBUG_KEXDH
+	fprintf(stderr, "dh_server_pub= ");
+	BN_print_fp(stderr, dh_server_pub);
+	fprintf(stderr, "\n");
+	debug("bits %d", BN_num_bits(dh_server_pub));
+#endif
+
+	/* signed H */
+	signature = packet_get_string(&slen);
+	packet_check_eom();
+
+	if (!dh_pub_is_valid(dh, dh_server_pub))
+		packet_disconnect("bad server public DH value");
+
+	klen = DH_size(dh);
+	kbuf = xmalloc(klen);
+	kout = DH_compute_key(kbuf, dh_server_pub, dh);
+#ifdef DEBUG_KEXDH
+	dump_digest("shared secret", kbuf, kout);
+#endif
+	if ((shared_secret = BN_new()) == NULL)
+		fatal("kexgex_client: BN_new failed");
+	BN_bin2bn(kbuf, kout, shared_secret);
+	memset(kbuf, 0, klen);
+	xfree(kbuf);
+
+	if (datafellows & SSH_OLD_DHGEX)
+		min = max = -1;
+
+	/* calc and verify H */
+	hash = kexgex_hash(
+	    kex->client_version_string,
+	    kex->server_version_string,
+	    buffer_ptr(&kex->my), buffer_len(&kex->my),
+	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+	    server_host_key_blob, sbloblen,
+	    min, nbits, max,
+	    dh->p, dh->g,
+	    dh->pub_key,
+	    dh_server_pub,
+	    shared_secret
+	);
+	/* have keys, free DH */
+	DH_free(dh);
+	xfree(server_host_key_blob);
+	BN_clear_free(dh_server_pub);
+
+	if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
+		fatal("key_verify failed for server_host_key");
+	key_free(server_host_key);
+	xfree(signature);
+
+	/* save session id */
+	if (kex->session_id == NULL) {
+		kex->session_id_len = 20;
+		kex->session_id = xmalloc(kex->session_id_len);
+		memcpy(kex->session_id, hash, kex->session_id_len);
+	}
+	kex_derive_keys(kex, hash, shared_secret);
+	BN_clear_free(shared_secret);
+
+	kex_finish(kex);
+}
diff --git a/crypto/openssh/kexgexs.c b/crypto/openssh/kexgexs.c
new file mode 100644
index 0000000..baebfcf
--- /dev/null
+++ b/crypto/openssh/kexgexs.c
@@ -0,0 +1,186 @@
+/*
+ * Copyright (c) 2000 Niels Provos.  All rights reserved.
+ * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: kexgexs.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
+
+#include "xmalloc.h"
+#include "key.h"
+#include "kex.h"
+#include "log.h"
+#include "packet.h"
+#include "dh.h"
+#include "ssh2.h"
+#include "compat.h"
+#include "monitor_wrap.h"
+
+void
+kexgex_server(Kex *kex)
+{
+	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
+	Key *server_host_key;
+	DH *dh;
+	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
+	u_int sbloblen, klen, kout, slen;
+	int min = -1, max = -1, nbits = -1, type;
+
+	if (kex->load_host_key == NULL)
+		fatal("Cannot load hostkey");
+	server_host_key = kex->load_host_key(kex->hostkey_type);
+	if (server_host_key == NULL)
+		fatal("Unsupported hostkey type %d", kex->hostkey_type);
+
+	type = packet_read();
+	switch (type) {
+	case SSH2_MSG_KEX_DH_GEX_REQUEST:
+		debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
+		min = packet_get_int();
+		nbits = packet_get_int();
+		max = packet_get_int();
+		min = MAX(DH_GRP_MIN, min);
+		max = MIN(DH_GRP_MAX, max);
+		break;
+	case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
+		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
+		nbits = packet_get_int();
+		min = DH_GRP_MIN;
+		max = DH_GRP_MAX;
+		/* unused for old GEX */
+		break;
+	default:
+		fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type);
+	}
+	packet_check_eom();
+
+	if (max < min || nbits < min || max < nbits)
+		fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d",
+		    min, nbits, max);
+
+	/* Contact privileged parent */
+	dh = PRIVSEP(choose_dh(min, nbits, max));
+	if (dh == NULL)
+		packet_disconnect("Protocol error: no matching DH grp found");
+
+	debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
+	packet_start(SSH2_MSG_KEX_DH_GEX_GROUP);
+	packet_put_bignum2(dh->p);
+	packet_put_bignum2(dh->g);
+	packet_send();
+
+	/* flush */
+	packet_write_wait();
+
+	/* Compute our exchange value in parallel with the client */
+	dh_gen_key(dh, kex->we_need * 8);
+
+	debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
+	packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT);
+
+	/* key, cert */
+	if ((dh_client_pub = BN_new()) == NULL)
+		fatal("dh_client_pub == NULL");
+	packet_get_bignum2(dh_client_pub);
+	packet_check_eom();
+
+#ifdef DEBUG_KEXDH
+	fprintf(stderr, "dh_client_pub= ");
+	BN_print_fp(stderr, dh_client_pub);
+	fprintf(stderr, "\n");
+	debug("bits %d", BN_num_bits(dh_client_pub));
+#endif
+
+#ifdef DEBUG_KEXDH
+	DHparams_print_fp(stderr, dh);
+	fprintf(stderr, "pub= ");
+	BN_print_fp(stderr, dh->pub_key);
+	fprintf(stderr, "\n");
+#endif
+	if (!dh_pub_is_valid(dh, dh_client_pub))
+		packet_disconnect("bad client public DH value");
+
+	klen = DH_size(dh);
+	kbuf = xmalloc(klen);
+	kout = DH_compute_key(kbuf, dh_client_pub, dh);
+#ifdef DEBUG_KEXDH
+	dump_digest("shared secret", kbuf, kout);
+#endif
+	if ((shared_secret = BN_new()) == NULL)
+		fatal("kexgex_server: BN_new failed");
+	BN_bin2bn(kbuf, kout, shared_secret);
+	memset(kbuf, 0, klen);
+	xfree(kbuf);
+
+	key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
+
+	if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
+		min = max = -1;
+
+	/* calc H */			/* XXX depends on 'kex' */
+	hash = kexgex_hash(
+	    kex->client_version_string,
+	    kex->server_version_string,
+	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+	    buffer_ptr(&kex->my), buffer_len(&kex->my),
+	    server_host_key_blob, sbloblen,
+	    min, nbits, max,
+	    dh->p, dh->g,
+	    dh_client_pub,
+	    dh->pub_key,
+	    shared_secret
+	);
+	BN_clear_free(dh_client_pub);
+
+	/* save session id := H */
+	/* XXX hashlen depends on KEX */
+	if (kex->session_id == NULL) {
+		kex->session_id_len = 20;
+		kex->session_id = xmalloc(kex->session_id_len);
+		memcpy(kex->session_id, hash, kex->session_id_len);
+	}
+
+	/* sign H */
+	/* XXX hashlen depends on KEX */
+	PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
+
+	/* destroy_sensitive_data(); */
+
+	/* send server hostkey, DH pubkey 'f' and singed H */
+	debug("SSH2_MSG_KEX_DH_GEX_REPLY sent");
+	packet_start(SSH2_MSG_KEX_DH_GEX_REPLY);
+	packet_put_string(server_host_key_blob, sbloblen);
+	packet_put_bignum2(dh->pub_key);	/* f */
+	packet_put_string(signature, slen);
+	packet_send();
+
+	xfree(signature);
+	xfree(server_host_key_blob);
+	/* have keys, free DH */
+	DH_free(dh);
+
+	kex_derive_keys(kex, hash, shared_secret);
+	BN_clear_free(shared_secret);
+
+	kex_finish(kex);
+}
diff --git a/crypto/openssh/key.h b/crypto/openssh/key.h
index 8d1fa41..725c7a0 100644
--- a/crypto/openssh/key.h
+++ b/crypto/openssh/key.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: key.h,v 1.19 2002/03/18 17:23:31 markus Exp $	*/
+/*	$OpenBSD: key.h,v 1.20 2003/02/12 09:33:04 markus Exp $	*/
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -78,4 +78,9 @@ int	 key_names_valid2(const char *);
 int	 key_sign(Key *, u_char **, u_int *, u_char *, u_int);
 int	 key_verify(Key *, u_char *, u_int, u_char *, u_int);
 
+int	 ssh_dss_sign(Key *, u_char **, u_int *, u_char *, u_int);
+int	 ssh_dss_verify(Key *, u_char *, u_int, u_char *, u_int);
+int	 ssh_rsa_sign(Key *, u_char **, u_int *, u_char *, u_int);
+int	 ssh_rsa_verify(Key *, u_char *, u_int, u_char *, u_int);
+
 #endif
diff --git a/crypto/openssh/log.c b/crypto/openssh/log.c
index 96626d7..84e4ce0 100644
--- a/crypto/openssh/log.c
+++ b/crypto/openssh/log.c
@@ -34,7 +34,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: log.c,v 1.24 2002/07/19 15:43:33 markus Exp $");
+RCSID("$OpenBSD: log.c,v 1.25 2003/01/11 18:29:43 markus Exp $");
 
 #include "log.h"
 #include "xmalloc.h"
@@ -233,6 +233,7 @@ fatal_remove_all_cleanups(void)
 		next_cu = cu->next;
 		xfree(cu);
 	}
+	fatal_cleanups = NULL;
 }
 
 /* Cleanup and exit */
@@ -386,11 +387,14 @@ do_log(LogLevel level, const char *fmt, va_list args)
 	} else {
 		vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
 	}
+	/* Escape magic chars in output. */
+	strnvis(fmtbuf, msgbuf, sizeof(fmtbuf), VIS_OCTAL);
+	
 	if (log_on_stderr) {
-		fprintf(stderr, "%s\r\n", msgbuf);
+		fprintf(stderr, "%s\r\n", fmtbuf);
 	} else {
 		openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility);
-		syslog(pri, "%.500s", msgbuf);
+		syslog(pri, "%.500s", fmtbuf);
 		closelog();
 	}
 }
diff --git a/crypto/openssh/misc.c b/crypto/openssh/misc.c
index e9fcef6..512fb22 100644
--- a/crypto/openssh/misc.c
+++ b/crypto/openssh/misc.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: misc.c,v 1.19 2002/03/04 17:27:39 stevesk Exp $");
+RCSID("$OpenBSD: misc.c,v 1.20 2002/12/13 10:03:15 markus Exp $");
 
 #include "misc.h"
 #include "log.h"
@@ -105,7 +105,7 @@ set_nodelay(int fd)
 		return;
 	}
 	opt = 1;
-	debug("fd %d setting TCP_NODELAY", fd);
+	debug2("fd %d setting TCP_NODELAY", fd);
 	if (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &opt, sizeof opt) == -1)
 		error("setsockopt TCP_NODELAY: %.100s", strerror(errno));
 }
diff --git a/crypto/openssh/msg.c b/crypto/openssh/msg.c
index 107a376..5d266c2 100644
--- a/crypto/openssh/msg.c
+++ b/crypto/openssh/msg.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: msg.c,v 1.4 2002/07/01 16:15:25 deraadt Exp $");
+RCSID("$OpenBSD: msg.c,v 1.5 2002/12/19 00:07:02 djm Exp $");
 
 #include "buffer.h"
 #include "getput.h"
diff --git a/crypto/openssh/msg.h b/crypto/openssh/msg.h
index 8980e25..c07df88 100644
--- a/crypto/openssh/msg.h
+++ b/crypto/openssh/msg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: msg.h,v 1.1 2002/05/23 19:24:30 markus Exp $	*/
+/*	$OpenBSD: msg.h,v 1.2 2002/12/19 00:07:02 djm Exp $	*/
 /*
  * Copyright (c) 2002 Markus Friedl.  All rights reserved.
  *
diff --git a/crypto/openssh/openbsd-compat/Makefile.in b/crypto/openssh/openbsd-compat/Makefile.in
index 5229e7e..8615e36 100644
--- a/crypto/openssh/openbsd-compat/Makefile.in
+++ b/crypto/openssh/openbsd-compat/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.23 2002/09/12 00:33:02 djm Exp $
+# $Id: Makefile.in,v 1.25 2003/02/24 01:55:56 djm Exp $
 
 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -16,7 +16,7 @@ RANLIB=@RANLIB@
 INSTALL=@INSTALL@
 LDFLAGS=-L. @LDFLAGS@
 
-OPENBSD=base64.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o
+OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o vis.o
 
 COMPAT=bsd-arc4random.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-snprintf.o bsd-waitpid.o fake-getaddrinfo.o fake-getnameinfo.o xmmap.o
 
diff --git a/crypto/openssh/openbsd-compat/base64.c b/crypto/openssh/openbsd-compat/base64.c
index 005170b..91a5ab0 100644
--- a/crypto/openssh/openbsd-compat/base64.c
+++ b/crypto/openssh/openbsd-compat/base64.c
@@ -44,7 +44,7 @@
 
 #include "includes.h"
 
-#if !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP)
+#if (!defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP)) || (!defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON))
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -130,6 +130,7 @@ static const char Pad64 = '=';
 	   characters followed by one "=" padding character.
    */
 
+#if !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) 
 int
 b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
 {
@@ -190,6 +191,9 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
 	target[datalength] = '\0';	/* Returned value doesn't count \0. */
 	return (datalength);
 }
+#endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
+
+#if !defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON)
 
 /* skips all whitespace anywhere.
    converts characters, four at a time, starting at (or after)
@@ -314,4 +318,5 @@ b64_pton(char const *src, u_char *target, size_t targsize)
 	return (tarindex);
 }
 
-#endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
+#endif /* !defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON) */
+#endif 
diff --git a/crypto/openssh/openbsd-compat/base64.h b/crypto/openssh/openbsd-compat/base64.h
index c92e70e..72db3ff 100644
--- a/crypto/openssh/openbsd-compat/base64.h
+++ b/crypto/openssh/openbsd-compat/base64.h
@@ -1,4 +1,4 @@
-/* $Id: base64.h,v 1.3 2002/02/26 16:59:59 stevesk Exp $ */
+/* $Id: base64.h,v 1.4 2003/02/24 04:45:43 djm Exp $ */
 
 #ifndef _BSD_BASE64_H
 #define _BSD_BASE64_H
@@ -9,10 +9,15 @@
 # ifndef HAVE_B64_NTOP
 int b64_ntop(u_char const *src, size_t srclength, char *target, 
     size_t targsize);
-int b64_pton(char const *src, u_char *target, size_t targsize);
 # endif /* !HAVE_B64_NTOP */
 # define __b64_ntop b64_ntop
-# define __b64_pton b64_pton
 #endif /* HAVE___B64_NTOP */
 
+#ifndef HAVE___B64_PTON
+# ifndef HAVE_B64_PTON
+int b64_pton(char const *src, u_char *target, size_t targsize);
+# endif /* !HAVE_B64_PTON */
+# define __b64_pton b64_pton
+#endif /* HAVE___B64_PTON */
+
 #endif /* _BSD_BASE64_H */
diff --git a/crypto/openssh/openbsd-compat/basename.c b/crypto/openssh/openbsd-compat/basename.c
new file mode 100644
index 0000000..5a3823b
--- /dev/null
+++ b/crypto/openssh/openbsd-compat/basename.c
@@ -0,0 +1,73 @@
+/*	$OpenBSD: basename.c,v 1.8 2002/06/09 05:03:59 deraadt Exp $	*/
+
+/*
+ * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "includes.h"
+
+#if !defined(HAVE_BASENAME)
+
+#ifndef lint
+static char rcsid[] = "$OpenBSD: basename.c,v 1.8 2002/06/09 05:03:59 deraadt Exp $";
+#endif /* not lint */
+
+char *
+basename(const char *path)
+{
+	static char bname[MAXPATHLEN];
+	register const char *endp, *startp;
+
+	/* Empty or NULL string gets treated as "." */
+	if (path == NULL || *path == '\0') {
+		(void)strlcpy(bname, ".", sizeof bname);
+		return(bname);
+	}
+
+	/* Strip trailing slashes */
+	endp = path + strlen(path) - 1;
+	while (endp > path && *endp == '/')
+		endp--;
+
+	/* All slashes become "/" */
+	if (endp == path && *endp == '/') {
+		(void)strlcpy(bname, "/", sizeof bname);
+		return(bname);
+	}
+
+	/* Find the start of the base */
+	startp = endp;
+	while (startp > path && *(startp - 1) != '/')
+		startp--;
+
+	if (endp - startp + 2 > sizeof(bname)) {
+		errno = ENAMETOOLONG;
+		return(NULL);
+	}
+	strlcpy(bname, startp, endp - startp + 2);
+	return(bname);
+}
+
+#endif /* !defined(HAVE_BASENAME) */
diff --git a/crypto/openssh/openbsd-compat/basename.h b/crypto/openssh/openbsd-compat/basename.h
new file mode 100644
index 0000000..a8bd6c1
--- /dev/null
+++ b/crypto/openssh/openbsd-compat/basename.h
@@ -0,0 +1,12 @@
+/* $Id: basename.h,v 1.3 2003/02/25 03:32:16 djm Exp $ */
+
+#ifndef _BASENAME_H 
+#define _BASENAME_H
+#include "config.h"
+
+#if !defined(HAVE_BASENAME)
+
+char *basename(const char *path);
+
+#endif /* !defined(HAVE_BASENAME) */
+#endif /* _BASENAME_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-arc4random.c b/crypto/openssh/openbsd-compat/bsd-arc4random.c
index ab4e143..dd08130 100644
--- a/crypto/openssh/openbsd-compat/bsd-arc4random.c
+++ b/crypto/openssh/openbsd-compat/bsd-arc4random.c
@@ -25,7 +25,7 @@
 #include "includes.h"
 #include "log.h"
 
-RCSID("$Id: bsd-arc4random.c,v 1.5 2002/05/08 22:57:18 tim Exp $");
+RCSID("$Id: bsd-arc4random.c,v 1.6 2003/03/17 05:13:53 djm Exp $");
 
 #ifndef HAVE_ARC4RANDOM
 
@@ -66,7 +66,7 @@ void arc4random_stir(void)
 	unsigned char rand_buf[SEED_SIZE];
 
 	memset(&rc4, 0, sizeof(rc4));
-	if (!RAND_bytes(rand_buf, sizeof(rand_buf)))
+	if (RAND_bytes(rand_buf, sizeof(rand_buf)) <= 0)
 		fatal("Couldn't obtain random bytes (error %ld)",
 		    ERR_get_error());
 	RC4_set_key(&rc4, sizeof(rand_buf), rand_buf);
diff --git a/crypto/openssh/openbsd-compat/bsd-cray.h b/crypto/openssh/openbsd-compat/bsd-cray.h
index 8868b43..a09954f 100644
--- a/crypto/openssh/openbsd-compat/bsd-cray.h
+++ b/crypto/openssh/openbsd-compat/bsd-cray.h
@@ -1,5 +1,5 @@
 /* 
- * $Id: bsd-cray.h,v 1.5 2002/09/26 00:38:51 tim Exp $
+ * $Id: bsd-cray.h,v 1.7 2003/03/21 01:05:38 mouring Exp $
  *
  * bsd-cray.h
  *
@@ -49,6 +49,10 @@ extern	char   cray_tmpdir[];			/* cray tmpdir */
 #ifndef MAXHOSTNAMELEN
 #define MAXHOSTNAMELEN  64
 #endif
+#ifndef _CRAYT3E
+#include <sys/ttold.h>
+#define TIOCGPGRP (tIOC|20)
+#endif
 #endif
 
 #endif /* _BSD_CRAY_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-cygwin_util.c b/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
index 2396a6e..0fa5964 100644
--- a/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
+++ b/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
@@ -31,7 +31,7 @@
 
 #include "includes.h"
 
-RCSID("$Id: bsd-cygwin_util.c,v 1.8 2002/04/15 22:00:52 stevesk Exp $");
+RCSID("$Id: bsd-cygwin_util.c,v 1.9 2002/11/09 15:59:29 mouring Exp $");
 
 #ifdef HAVE_CYGWIN
 
@@ -43,6 +43,7 @@ RCSID("$Id: bsd-cygwin_util.c,v 1.8 2002/04/15 22:00:52 stevesk Exp $");
 #define is_winnt       (GetVersion() < 0x80000000)
 
 #define ntsec_on(c)	((c) && strstr((c),"ntsec") && !strstr((c),"nontsec"))
+#define ntsec_off(c)	((c) && strstr((c),"nontsec"))
 #define ntea_on(c)	((c) && strstr((c),"ntea") && !strstr((c),"nontea"))
 
 #if defined(open) && open == binary_open
@@ -74,6 +75,56 @@ int binary_pipe(int fd[2])
 	return ret;
 }
 
+#define HAS_CREATE_TOKEN 1
+#define HAS_NTSEC_BY_DEFAULT 2
+
+static int has_capability(int what)
+{
+	/* has_capability() basically calls uname() and checks if
+	   specific capabilities of Cygwin can be evaluated from that.
+	   This simplifies the calling functions which only have to ask
+	   for a capability using has_capability() instead of having
+	   to figure that out by themselves. */
+	static int inited;
+	static int has_create_token;
+	static int has_ntsec_by_default;
+
+	if (!inited) {
+		struct utsname uts;
+		char *c;
+		
+		if (!uname(&uts)) {
+			int major_high = 0;
+			int major_low = 0;
+			int minor = 0;
+			int api_major_version = 0;
+			int api_minor_version = 0;
+			char *c;
+
+			sscanf(uts.release, "%d.%d.%d", &major_high,
+			       &major_low, &minor);
+			c = strchr(uts.release, '(');
+			if (c)
+				sscanf(c + 1, "%d.%d", &api_major_version,
+				       &api_minor_version);
+			if (major_high > 1 ||
+			    (major_high == 1 && (major_low > 3 ||
+			     (major_low == 3 && minor >= 2))))
+				has_create_token = 1;
+			if (api_major_version > 0 || api_minor_version >= 56)
+				has_ntsec_by_default = 1;
+			inited = 1;
+		}
+	}
+	switch (what) {
+	case HAS_CREATE_TOKEN:
+		return has_create_token;
+	case HAS_NTSEC_BY_DEFAULT:
+		return has_ntsec_by_default;
+	}
+	return 0;
+}
+
 int check_nt_auth(int pwd_authenticated, struct passwd *pw)
 {
 	/*
@@ -93,19 +144,14 @@ int check_nt_auth(int pwd_authenticated, struct passwd *pw)
 		return 0;
 	if (is_winnt) {
 		if (has_create_token < 0) {
-			struct utsname uts;
-		        int major_high = 0, major_low = 0, minor = 0;
 			char *cygwin = getenv("CYGWIN");
 
 			has_create_token = 0;
-			if (ntsec_on(cygwin) && !uname(&uts)) {
-				sscanf(uts.release, "%d.%d.%d",
-				       &major_high, &major_low, &minor);
-				if (major_high > 1 ||
-				    (major_high == 1 && (major_low > 3 ||
-				     (major_low == 3 && minor >= 2))))
-					has_create_token = 1;
-			}
+			if (has_capability(HAS_CREATE_TOKEN) &&
+			    (ntsec_on(cygwin) ||
+			     (has_capability(HAS_NTSEC_BY_DEFAULT) &&
+			      !ntsec_off(cygwin))))
+				has_create_token = 1;
 		}
 		if (has_create_token < 1 &&
 		    !pwd_authenticated && geteuid() != pw->pw_uid)
@@ -128,7 +174,9 @@ int check_ntsec(const char *filename)
 	/* Evaluate current CYGWIN settings. */
 	cygwin = getenv("CYGWIN");
 	allow_ntea = ntea_on(cygwin);
-	allow_ntsec = ntsec_on(cygwin);
+	allow_ntsec = ntsec_on(cygwin) ||
+		      (has_capability(HAS_NTSEC_BY_DEFAULT) &&
+		       !ntsec_off(cygwin));
 
 	/*
 	 * `ntea' is an emulation of POSIX attributes. It doesn't support
diff --git a/crypto/openssh/openbsd-compat/bsd-getpeereid.c b/crypto/openssh/openbsd-compat/bsd-getpeereid.c
index c787682..bcda2c1 100644
--- a/crypto/openssh/openbsd-compat/bsd-getpeereid.c
+++ b/crypto/openssh/openbsd-compat/bsd-getpeereid.c
@@ -24,7 +24,7 @@
 
 #include "includes.h"
 
-RCSID("$Id: bsd-getpeereid.c,v 1.1 2002/09/12 00:33:02 djm Exp $");
+RCSID("$Id: bsd-getpeereid.c,v 1.2 2003/03/24 22:07:52 djm Exp $");
 
 #if !defined(HAVE_GETPEEREID)
 
@@ -33,7 +33,7 @@ int
 getpeereid(int s, uid_t *euid, gid_t *gid)
 {
 	struct ucred cred;
-	size_t len = sizeof(cred);
+	socklen_t len = sizeof(cred);
 
 	if (getsockopt(s, SOL_SOCKET, SO_PEERCRED, &cred, &len) < 0)
 		return (-1);
diff --git a/crypto/openssh/openbsd-compat/bsd-misc.c b/crypto/openssh/openbsd-compat/bsd-misc.c
index 1c1e43a..b8e9996 100644
--- a/crypto/openssh/openbsd-compat/bsd-misc.c
+++ b/crypto/openssh/openbsd-compat/bsd-misc.c
@@ -23,15 +23,20 @@
  */
 
 #include "includes.h"
+#include "xmalloc.h"
 
-RCSID("$Id: bsd-misc.c,v 1.10 2002/07/08 21:09:41 mouring Exp $");
+RCSID("$Id: bsd-misc.c,v 1.12 2003/03/18 18:21:41 tim Exp $");
 
+/*
+ * NB. duplicate __progname in case it is an alias for argv[0]
+ * Otherwise it may get clobbered by setproctitle()
+ */
 char *get_progname(char *argv0)
 {
 #ifdef HAVE___PROGNAME
 	extern char *__progname;
 
-	return __progname;
+	return xstrdup(__progname);
 #else
 	char *p;
 
@@ -42,7 +47,8 @@ char *get_progname(char *argv0)
 		p = argv0;
 	else
 		p++;
-	return p;
+
+	return xstrdup(p);
 #endif
 }
 
@@ -129,3 +135,34 @@ setgroups(size_t size, const gid_t *list)
 }
 #endif 
 
+#if !defined(HAVE_NANOSLEEP) && !defined(HAVE_NSLEEP)
+int nanosleep(const struct timespec *req, struct timespec *rem)
+{
+	int rc, saverrno;
+	extern int errno;
+	struct timeval tstart, tstop, tremain, time2wait;
+
+	TIMESPEC_TO_TIMEVAL(&time2wait, req)
+	(void) gettimeofday(&tstart, NULL);
+	rc = select(0, NULL, NULL, NULL, &time2wait);
+	if (rc == -1) {
+		saverrno = errno;
+		(void) gettimeofday (&tstop, NULL);
+		errno = saverrno;
+		tremain.tv_sec = time2wait.tv_sec - 
+			(tstop.tv_sec - tstart.tv_sec);
+		tremain.tv_usec = time2wait.tv_usec - 
+			(tstop.tv_usec - tstart.tv_usec);
+		tremain.tv_sec += tremain.tv_usec / 1000000L;
+		tremain.tv_usec %= 1000000L;
+	} else {
+		tremain.tv_sec = 0;
+		tremain.tv_usec = 0;
+	}
+	TIMEVAL_TO_TIMESPEC(&tremain, rem)
+
+	return(rc);
+}
+
+#endif
+
diff --git a/crypto/openssh/openbsd-compat/bsd-misc.h b/crypto/openssh/openbsd-compat/bsd-misc.h
index 9811960..78d9ccd 100644
--- a/crypto/openssh/openbsd-compat/bsd-misc.h
+++ b/crypto/openssh/openbsd-compat/bsd-misc.h
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* $Id: bsd-misc.h,v 1.6 2002/06/13 21:34:58 mouring Exp $ */
+/* $Id: bsd-misc.h,v 1.7 2003/03/18 18:21:41 tim Exp $ */
 
 #ifndef _BSD_MISC_H
 #define _BSD_MISC_H
@@ -80,5 +80,14 @@ int truncate (const char *path, off_t length);
 int setgroups(size_t size, const gid_t *list);
 #endif
 
+#if !defined(HAVE_NANOSLEEP) && !defined(HAVE_NSLEEP)
+#ifndef HAVE_STRUCT_TIMESPEC
+struct timespec {
+	time_t	tv_sec;
+	long	tv_nsec;
+};
+#endif
+int nanosleep(const struct timespec *req, struct timespec *rem);
+#endif
 
 #endif /* _BSD_MISC_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-snprintf.c b/crypto/openssh/openbsd-compat/bsd-snprintf.c
index 1c72ea6..2f82180 100644
--- a/crypto/openssh/openbsd-compat/bsd-snprintf.c
+++ b/crypto/openssh/openbsd-compat/bsd-snprintf.c
@@ -1,3 +1,10 @@
+/*
+ * Copyright Patrick Powell 1995
+ * This code is based on code written by Patrick Powell (papowell@astart.com)
+ * It may be used for any purpose as long as this notice remains intact
+ * on all source code distributions
+ */
+
 /**************************************************************
  * Original:
  * Patrick Powell Tue Apr 11 09:48:21 PDT 1995
@@ -51,7 +58,7 @@
 
 #include "includes.h"
 
-RCSID("$Id: bsd-snprintf.c,v 1.5 2001/02/25 23:20:41 mouring Exp $");
+RCSID("$Id: bsd-snprintf.c,v 1.6 2003/04/01 11:31:56 djm Exp $");
 
 #if defined(BROKEN_SNPRINTF)		/* For those with broken snprintf() */
 # undef HAVE_SNPRINTF
diff --git a/crypto/openssh/openbsd-compat/fake-getaddrinfo.c b/crypto/openssh/openbsd-compat/fake-getaddrinfo.c
index 67e9eb7..e63bda9 100644
--- a/crypto/openssh/openbsd-compat/fake-getaddrinfo.c
+++ b/crypto/openssh/openbsd-compat/fake-getaddrinfo.c
@@ -12,7 +12,7 @@
 #include "includes.h"
 #include "ssh.h"
 
-RCSID("$Id: fake-getaddrinfo.c,v 1.2 2001/02/09 01:55:36 djm Exp $");
+RCSID("$Id: fake-getaddrinfo.c,v 1.5 2003/03/24 02:35:59 djm Exp $");
 
 #ifndef HAVE_GAI_STRERROR
 char *gai_strerror(int ecode)
@@ -67,16 +67,30 @@ int getaddrinfo(const char *hostname, const char *servname,
 {
 	struct addrinfo *cur, *prev = NULL;
 	struct hostent *hp;
+	struct servent *sp;
 	struct in_addr in;
-	int i, port;
+	int i;
+	long int port;
+	u_long addr;
 
-	if (servname)
-		port = htons(atoi(servname));
-	else
-		port = 0;
+	port = 0;
+	if (servname != NULL) {
+		char *cp;
+
+		port = strtol(servname, &cp, 10);
+		if (port > 0 && port <= 65535 && *cp == '\0')
+			port = htons(port);
+		else if ((sp = getservbyname(servname, NULL)) != NULL)
+			port = sp->s_port;
+		else
+			port = 0;
+	}
 
 	if (hints && hints->ai_flags & AI_PASSIVE) {
-		if (NULL != (*res = malloc_ai(port, htonl(0x00000000))))
+		addr = htonl(0x00000000);
+		if (hostname && inet_aton(hostname, &in) != 0)
+			addr = in.s_addr;
+		if (NULL != (*res = malloc_ai(port, addr)))
 			return 0;
 		else
 			return EAI_MEMORY;
diff --git a/crypto/openssh/openbsd-compat/fake-getaddrinfo.h b/crypto/openssh/openbsd-compat/fake-getaddrinfo.h
index afd0226..6943378 100644
--- a/crypto/openssh/openbsd-compat/fake-getaddrinfo.h
+++ b/crypto/openssh/openbsd-compat/fake-getaddrinfo.h
@@ -1,4 +1,4 @@
-/* $Id: fake-getaddrinfo.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
+/* $Id: fake-getaddrinfo.h,v 1.4 2003/02/24 01:35:09 djm Exp $ */
 
 #ifndef _FAKE_GETADDRINFO_H
 #define _FAKE_GETADDRINFO_H
diff --git a/crypto/openssh/openbsd-compat/getcwd.c b/crypto/openssh/openbsd-compat/getcwd.c
index 6fd8543..f4b98e8 100644
--- a/crypto/openssh/openbsd-compat/getcwd.c
+++ b/crypto/openssh/openbsd-compat/getcwd.c
@@ -29,7 +29,7 @@
 #if !defined(HAVE_GETCWD)
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getcwd.c,v 1.6 2000/07/19 15:25:13 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: getcwd.c,v 1.7 2002/11/24 01:52:27 cloder Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -127,7 +127,7 @@ getcwd(char *pt,size_t size)
 		/*
 		 * Build pointer to the parent directory, allocating memory
 		 * as necessary.  Max length is 3 for "../", the largest
-		 * possible component name, plus a trailing NULL.
+		 * possible component name, plus a trailing NUL.
 		 */
 		if (bup + 3  + MAXNAMLEN + 1 >= eup) {
 			char *nup;
diff --git a/crypto/openssh/openbsd-compat/getopt.c b/crypto/openssh/openbsd-compat/getopt.c
index 4a5cfe5..a3fe807 100644
--- a/crypto/openssh/openbsd-compat/getopt.c
+++ b/crypto/openssh/openbsd-compat/getopt.c
@@ -35,7 +35,7 @@
 #if !defined(HAVE_GETOPT) || !defined(HAVE_GETOPT_OPTRESET)
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: getopt.c,v 1.2 1996/08/19 08:33:32 tholo Exp $";
+static char *rcsid = "$OpenBSD: getopt.c,v 1.4 2002/12/08 22:57:14 millert Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <stdio.h>
@@ -66,6 +66,9 @@ BSDgetopt(nargc, nargv, ostr)
 	static char *place = EMSG;		/* option letter processing */
 	char *oli;				/* option letter list index */
 
+	if (ostr == NULL)
+		return (-1);
+
 	if (BSDoptreset || !*place) {		/* update scanning pointer */
 		BSDoptreset = 0;
 		if (BSDoptind >= nargc || *(place = nargv[BSDoptind]) != '-') {
diff --git a/crypto/openssh/openbsd-compat/mktemp.c b/crypto/openssh/openbsd-compat/mktemp.c
index d256ee4..c951050 100644
--- a/crypto/openssh/openbsd-compat/mktemp.c
+++ b/crypto/openssh/openbsd-compat/mktemp.c
@@ -36,7 +36,7 @@
 
 #include "includes.h"
 
-#ifndef HAVE_MKDTEMP
+#if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP)
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char rcsid[] = "$OpenBSD: mktemp.c,v 1.16 2002/05/27 18:20:45 millert Exp $";
@@ -181,4 +181,4 @@ _gettemp(path, doopen, domkdir, slen)
 	/*NOTREACHED*/
 }
 
-#endif /* !HAVE_MKDTEMP */
+#endif /* !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP) */
diff --git a/crypto/openssh/openbsd-compat/mktemp.h b/crypto/openssh/openbsd-compat/mktemp.h
index 6a96f6f..505ca6a 100644
--- a/crypto/openssh/openbsd-compat/mktemp.h
+++ b/crypto/openssh/openbsd-compat/mktemp.h
@@ -1,13 +1,13 @@
-/* $Id: mktemp.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
+/* $Id: mktemp.h,v 1.3 2003/01/07 04:18:33 djm Exp $ */
 
 #ifndef _BSD_MKTEMP_H
 #define _BSD_MKTEMP_H
 
 #include "config.h"
-#ifndef HAVE_MKDTEMP
+#if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP)
 int mkstemps(char *path, int slen);
 int mkstemp(char *path);
 char *mkdtemp(char *path);
-#endif /* !HAVE_MKDTEMP */
+#endif /* !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP) */
 
 #endif /* _BSD_MKTEMP_H */
diff --git a/crypto/openssh/openbsd-compat/openbsd-compat.h b/crypto/openssh/openbsd-compat/openbsd-compat.h
index ae18afd..c3e19b9 100644
--- a/crypto/openssh/openbsd-compat/openbsd-compat.h
+++ b/crypto/openssh/openbsd-compat/openbsd-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.17 2002/09/12 00:33:02 djm Exp $ */
+/* $Id: openbsd-compat.h,v 1.19 2003/02/24 01:55:56 djm Exp $ */
 
 #ifndef _OPENBSD_H
 #define _OPENBSD_H
@@ -6,6 +6,7 @@
 #include "config.h"
 
 /* OpenBSD function replacements */
+#include "basename.h"
 #include "bindresvport.h"
 #include "getcwd.h"
 #include "realpath.h"
@@ -26,6 +27,7 @@
 #include "glob.h"
 #include "readpassphrase.h"
 #include "getopt.h"
+#include "vis.h"
 
 /* Home grown routines */
 #include "bsd-arc4random.h"
diff --git a/crypto/openssh/openbsd-compat/port-aix.h b/crypto/openssh/openbsd-compat/port-aix.h
index 79570a2..4abe003 100644
--- a/crypto/openssh/openbsd-compat/port-aix.h
+++ b/crypto/openssh/openbsd-compat/port-aix.h
@@ -25,5 +25,16 @@
  */
 
 #ifdef _AIX
+
+/* AIX 4.2.x doesn't have nanosleep but does have nsleep which is equivalent */
+#if !defined(HAVE_NANOSLEEP) && defined(HAVE_NSLEEP)
+# define nanosleep(a,b) nsleep(a,b)
+#endif
+
+/* For struct timespec on AIX 4.2.x */
+#ifdef HAVE_SYS_TIMERS_H
+# include <sys/timers.h>
+#endif
+
 void aix_usrinfo(struct passwd *pw);
 #endif /* _AIX */
diff --git a/crypto/openssh/openbsd-compat/setenv.c b/crypto/openssh/openbsd-compat/setenv.c
index 1dff15c..e5c5de6 100644
--- a/crypto/openssh/openbsd-compat/setenv.c
+++ b/crypto/openssh/openbsd-compat/setenv.c
@@ -35,12 +35,14 @@
 #ifndef HAVE_SETENV
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: setenv.c,v 1.4 2001/07/09 06:57:45 deraadt Exp $";
+static char *rcsid = "$OpenBSD: setenv.c,v 1.5 2002/12/10 22:44:13 mickey Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <stdlib.h>
 #include <string.h>
 
+char *__findenv(const char *name, int *offset);
+
 /*
  * __findenv --
  *	Returns pointer to value associated with name, if any, else NULL.
@@ -92,7 +94,6 @@ setenv(name, value, rewrite)
 	static int alloced;			/* if allocated space before */
 	register char *C;
 	int l_value, offset;
-	char *__findenv();
 
 	if (*value == '=')			/* no `=' in value */
 		++value;
diff --git a/crypto/openssh/openbsd-compat/setproctitle.c b/crypto/openssh/openbsd-compat/setproctitle.c
index e165dd1..07af7e9 100644
--- a/crypto/openssh/openbsd-compat/setproctitle.c
+++ b/crypto/openssh/openbsd-compat/setproctitle.c
@@ -1,102 +1,243 @@
 /*
- * Modified for OpenSSH by Kevin Steves
- * October 2000
+ * Based on src/backend/utils/misc/pg_status.c from 
+ * PostgreSQL Database Management System
+ * 
+ * Portions Copyright (c) 1996-2001, The PostgreSQL Global Development Group
+ * 
+ * Portions Copyright (c) 1994, The Regents of the University of California
+ * 
+ * Permission to use, copy, modify, and distribute this software and its
+ * documentation for any purpose, without fee, and without a written agreement
+ * is hereby granted, provided that the above copyright notice and this
+ * paragraph and the following two paragraphs appear in all copies.
+ * 
+ * IN NO EVENT SHALL THE UNIVERSITY OF CALIFORNIA BE LIABLE TO ANY PARTY FOR
+ * DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
+ * LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
+ * DOCUMENTATION, EVEN IF THE UNIVERSITY OF CALIFORNIA HAS BEEN ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ * 
+ * THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ * ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO
+ * PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
  */
 
-/*
- * Copyright (c) 1994, 1995 Christopher G. Demetriou
- * All rights reserved.
+/*--------------------------------------------------------------------
+ * ps_status.c
+ *
+ * Routines to support changing the ps display of PostgreSQL backends
+ * to contain some useful information. Mechanism differs wildly across
+ * platforms.
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Christopher G. Demetriou
- *	for the NetBSD Project.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission
+ * $Header: /var/cvs/openssh/openbsd-compat/setproctitle.c,v 1.5 2003/01/20 02:15:11 djm Exp $
  *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * Copyright 2000 by PostgreSQL Global Development Group
+ * various details abducted from various places
+ *--------------------------------------------------------------------
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: setproctitle.c,v 1.8 2001/11/06 19:21:40 art Exp $";
-#endif /* LIBC_SCCS and not lint */
-
 #include "includes.h"
 
 #ifndef HAVE_SETPROCTITLE
 
-#define SPT_NONE	0
-#define SPT_PSTAT	1
+#include <unistd.h>
+#ifdef HAVE_SYS_PSTAT_H
+#include <sys/pstat.h>		/* for HP-UX */
+#endif
+#ifdef HAVE_PS_STRINGS
+#include <machine/vmparam.h>	/* for old BSD */
+#include <sys/exec.h>
+#endif
+
+/*------
+ * Alternative ways of updating ps display:
+ *
+ * SETPROCTITLE_STRATEGY == PS_USE_PSTAT
+ *	   use the pstat(PSTAT_SETCMD, )
+ *	   (HPUX)
+ * SETPROCTITLE_STRATEGY == PS_USE_PS_STRINGS
+ *	   assign PS_STRINGS->ps_argvstr = "string"
+ *	   (some BSD systems)
+ * SETPROCTITLE_STRATEGY == PS_USE_CHANGE_ARGV
+ *	   assign argv[0] = "string"
+ *	   (some other BSD systems)
+ * SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
+ *	   write over the argv and environment area
+ *	   (most SysV-like systems)
+ * SETPROCTITLE_STRATEGY == PS_USE_NONE
+ *	   don't update ps display
+ *	   (This is the default, as it is safest.)
+ */
+
+#define PS_USE_NONE			0
+#define PS_USE_PSTAT			1
+#define PS_USE_PS_STRINGS		2
+#define PS_USE_CHANGE_ARGV		3
+#define PS_USE_CLOBBER_ARGV		4
 
-#ifndef SPT_TYPE
-#define SPT_TYPE	SPT_NONE
+#ifndef SETPROCTITLE_STRATEGY
+# define SETPROCTITLE_STRATEGY	PS_USE_NONE 
 #endif
 
-#if SPT_TYPE == SPT_PSTAT
-#include <sys/param.h>
-#include <sys/pstat.h>
-#endif /* SPT_TYPE == SPT_PSTAT */
+#ifndef SETPROCTITLE_PS_PADDING
+# define SETPROCTITLE_PS_PADDING	' '
+#endif
+#endif /* HAVE_SETPROCTITLE */
 
-#define	MAX_PROCTITLE	2048
+extern char **environ;
+
+/*
+ * argv clobbering uses existing argv space, all other methods need a buffer
+ */
+#if SETPROCTITLE_STRATEGY != PS_USE_CLOBBER_ARGV
+static char ps_buffer[256];
+static const size_t ps_buffer_size = sizeof(ps_buffer);
+#else
+static char *ps_buffer;			/* will point to argv area */
+static size_t ps_buffer_size;		/* space determined at run time */
+#endif
+
+/* save the original argv[] location here */
+static int	save_argc;
+static char **save_argv;
 
 extern char *__progname;
 
+#ifndef HAVE_SETPROCTITLE
 /*
- * Set Process Title (SPT) defines.  Modeled after sendmail's
- * SPT type definition strategy.
- *
- * SPT_TYPE:
- *
- * SPT_NONE:	Don't set the process title.  Default.
- * SPT_PSTAT:	Use pstat(PSTAT_SETCMD).  HP-UX specific.
+ * Call this to update the ps status display to a fixed prefix plus an
+ * indication of what you're currently doing passed in the argument.
  */
-
 void
 setproctitle(const char *fmt, ...)
 {
-#if SPT_TYPE != SPT_NONE
+#if SETPROCTITLE_STRATEGY == PS_USE_PSTAT
+	union pstun pst;
+#endif
+#if SETPROCTITLE_STRATEGY != PS_USE_NONE
+	ssize_t used;
 	va_list ap;
-	
-	char buf[MAX_PROCTITLE];
-	size_t used;
 
-#if SPT_TYPE == SPT_PSTAT
-	union pstun pst;
-#endif /* SPT_TYPE == SPT_PSTAT */
+	/* no ps display if you didn't call save_ps_display_args() */
+	if (save_argv == NULL)
+		return;
+#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
+	/* If ps_buffer is a pointer, it might still be null */
+	if (ps_buffer == NULL)
+		return;
+#endif /* PS_USE_CLOBBER_ARGV */
+
+	/*
+	 * Overwrite argv[] to point at appropriate space, if needed
+	 */
+#if SETPROCTITLE_STRATEGY == PS_USE_CHANGE_ARGV
+	save_argv[0] = ps_buffer;
+	save_argv[1] = NULL;
+#endif /* PS_USE_CHANGE_ARGV */
+
+#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
+	save_argv[1] = NULL;
+#endif /* PS_USE_CLOBBER_ARGV */
+
+	/*
+	 * Make fixed prefix of ps display.
+	 */
 
 	va_start(ap, fmt);
-	if (fmt != NULL) {
-		used = snprintf(buf, MAX_PROCTITLE, "%s: ", __progname);
-		if (used >= MAX_PROCTITLE)
-			used = MAX_PROCTITLE - 1;
-		(void)vsnprintf(buf + used, MAX_PROCTITLE - used, fmt, ap);
-	} else
-		(void)snprintf(buf, MAX_PROCTITLE, "%s", __progname);
+	if (fmt == NULL)
+		snprintf(ps_buffer, ps_buffer_size, "%s", __progname);
+	else {
+		used = snprintf(ps_buffer, ps_buffer_size, "%s: ", __progname);
+		if (used == -1 || used >= ps_buffer_size)
+			used = ps_buffer_size;
+		vsnprintf(ps_buffer + used, ps_buffer_size - used, fmt, ap);
+	}
 	va_end(ap);
-	used = strlen(buf);
 
-#if SPT_TYPE == SPT_PSTAT
-	pst.pst_command = buf;
-	pstat(PSTAT_SETCMD, pst, used, 0, 0);
-#endif /* SPT_TYPE == SPT_PSTAT */
+#if SETPROCTITLE_STRATEGY == PS_USE_PSTAT
+	pst.pst_command = ps_buffer;
+	pstat(PSTAT_SETCMD, pst, strlen(ps_buffer), 0, 0);
+#endif   /* PS_USE_PSTAT */
 
-#endif /* SPT_TYPE != SPT_NONE */
+#if SETPROCTITLE_STRATEGY == PS_USE_PS_STRINGS
+	PS_STRINGS->ps_nargvstr = 1;
+	PS_STRINGS->ps_argvstr = ps_buffer;
+#endif   /* PS_USE_PS_STRINGS */
+
+#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
+	/* pad unused memory */
+	used = strlen(ps_buffer);
+	memset(ps_buffer + used, SETPROCTITLE_PS_PADDING, 
+	    ps_buffer_size - used);
+#endif   /* PS_USE_CLOBBER_ARGV */
+
+#endif /* PS_USE_NONE */
 }
+
 #endif /* HAVE_SETPROCTITLE */
+
+/*
+ * Call this early in startup to save the original argc/argv values.
+ *
+ * argv[] will not be overwritten by this routine, but may be overwritten
+ * during setproctitle. Also, the physical location of the environment
+ * strings may be moved, so this should be called before any code that
+ * might try to hang onto a getenv() result.
+ */
+void
+compat_init_setproctitle(int argc, char *argv[])
+{
+#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
+	char *end_of_area = NULL;
+	char **new_environ;
+	int i;
+#endif
+
+	save_argc = argc;
+	save_argv = argv;
+
+#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
+	/*
+	 * If we're going to overwrite the argv area, count the available
+	 * space.  Also move the environment to make additional room.
+	 */
+
+	/*
+	 * check for contiguous argv strings
+	 */
+	for (i = 0; i < argc; i++) {
+		if (i == 0 || end_of_area + 1 == argv[i])
+			end_of_area = argv[i] + strlen(argv[i]);
+	}
+
+	/* probably can't happen? */
+	if (end_of_area == NULL) {
+		ps_buffer = NULL;
+		ps_buffer_size = 0;
+		return;
+	}
+
+	/*
+	 * check for contiguous environ strings following argv
+	 */
+	for (i = 0; environ[i] != NULL; i++) {
+		if (end_of_area + 1 == environ[i])
+			end_of_area = environ[i] + strlen(environ[i]);
+	}
+
+	ps_buffer = argv[0];
+	ps_buffer_size = end_of_area - argv[0] - 1;
+
+	/*
+	 * Duplicate and move the environment out of the way
+	 */
+	new_environ = malloc(sizeof(char *) * (i + 1));
+	for (i = 0; environ[i] != NULL; i++)
+		new_environ[i] = strdup(environ[i]);
+	new_environ[i] = NULL;
+	environ = new_environ;
+#endif /* PS_USE_CLOBBER_ARGV */
+}
+
diff --git a/crypto/openssh/openbsd-compat/setproctitle.h b/crypto/openssh/openbsd-compat/setproctitle.h
index 8261bd0..48d26c6 100644
--- a/crypto/openssh/openbsd-compat/setproctitle.h
+++ b/crypto/openssh/openbsd-compat/setproctitle.h
@@ -1,4 +1,4 @@
-/* $Id: setproctitle.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
+/* $Id: setproctitle.h,v 1.3 2003/01/09 22:53:13 djm Exp $ */
 
 #ifndef _BSD_SETPROCTITLE_H
 #define _BSD_SETPROCTITLE_H
@@ -7,6 +7,7 @@
 
 #ifndef HAVE_SETPROCTITLE
 void setproctitle(const char *fmt, ...);
+void compat_init_setproctitle(int argc, char *argv[]);
 #endif
 
 #endif /* _BSD_SETPROCTITLE_H */
diff --git a/crypto/openssh/openbsd-compat/sys-tree.h b/crypto/openssh/openbsd-compat/sys-tree.h
index 0a58710..927ca04 100644
--- a/crypto/openssh/openbsd-compat/sys-tree.h
+++ b/crypto/openssh/openbsd-compat/sys-tree.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tree.h,v 1.6 2002/06/11 22:09:52 provos Exp $	*/
+/*	$OpenBSD: tree.h,v 1.7 2002/10/17 21:51:54 art Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -343,12 +343,13 @@ struct {								\
 			RB_LEFT(RB_PARENT(elm, field), field) = (tmp);	\
 		else							\
 			RB_RIGHT(RB_PARENT(elm, field), field) = (tmp);	\
-		RB_AUGMENT(RB_PARENT(elm, field));			\
 	} else								\
 		(head)->rbh_root = (tmp);				\
 	RB_LEFT(tmp, field) = (elm);					\
 	RB_PARENT(elm, field) = (tmp);					\
 	RB_AUGMENT(tmp);						\
+	if ((RB_PARENT(tmp, field)))					\
+		RB_AUGMENT(RB_PARENT(tmp, field));			\
 } while (0)
 
 #define RB_ROTATE_RIGHT(head, elm, tmp, field) do {			\
@@ -362,12 +363,13 @@ struct {								\
 			RB_LEFT(RB_PARENT(elm, field), field) = (tmp);	\
 		else							\
 			RB_RIGHT(RB_PARENT(elm, field), field) = (tmp);	\
-		RB_AUGMENT(RB_PARENT(elm, field));			\
 	} else								\
 		(head)->rbh_root = (tmp);				\
 	RB_RIGHT(tmp, field) = (elm);					\
 	RB_PARENT(elm, field) = (tmp);					\
 	RB_AUGMENT(tmp);						\
+	if ((RB_PARENT(tmp, field)))					\
+		RB_AUGMENT(RB_PARENT(tmp, field));			\
 } while (0)
 
 /* Generates prototypes and inline functions */
diff --git a/crypto/openssh/openbsd-compat/vis.c b/crypto/openssh/openbsd-compat/vis.c
new file mode 100644
index 0000000..fc57413
--- /dev/null
+++ b/crypto/openssh/openbsd-compat/vis.c
@@ -0,0 +1,232 @@
+/*-
+ * Copyright (c) 1989, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include "config.h"
+#if !defined(HAVE_STRNVIS)
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static char rcsid[] = "$OpenBSD: vis.c,v 1.8 2002/02/19 19:39:36 millert Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <ctype.h>
+
+#include "vis.h"
+
+#define	isoctal(c)	(((u_char)(c)) >= '0' && ((u_char)(c)) <= '7')
+#define isvisible(c)	(((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \
+				isgraph((u_char)(c))) ||		     \
+				((flag & VIS_SP) == 0 && (c) == ' ') ||	     \
+				((flag & VIS_TAB) == 0 && (c) == '\t') ||    \
+				((flag & VIS_NL) == 0 && (c) == '\n') ||     \
+				((flag & VIS_SAFE) &&			     \
+				((c) == '\b' || (c) == '\007' || (c) == '\r')))
+
+/*
+ * vis - visually encode characters
+ */
+char *
+vis(dst, c, flag, nextc)
+	register char *dst;
+	int c, nextc;
+	register int flag;
+{
+	if (isvisible(c)) {
+		*dst++ = c;
+		if (c == '\\' && (flag & VIS_NOSLASH) == 0)
+			*dst++ = '\\';
+		*dst = '\0';
+		return (dst);
+	}
+
+	if (flag & VIS_CSTYLE) {
+		switch(c) {
+		case '\n':
+			*dst++ = '\\';
+			*dst++ = 'n';
+			goto done;
+		case '\r':
+			*dst++ = '\\';
+			*dst++ = 'r';
+			goto done;
+		case '\b':
+			*dst++ = '\\';
+			*dst++ = 'b';
+			goto done;
+		case '\a':
+			*dst++ = '\\';
+			*dst++ = 'a';
+			goto done;
+		case '\v':
+			*dst++ = '\\';
+			*dst++ = 'v';
+			goto done;
+		case '\t':
+			*dst++ = '\\';
+			*dst++ = 't';
+			goto done;
+		case '\f':
+			*dst++ = '\\';
+			*dst++ = 'f';
+			goto done;
+		case ' ':
+			*dst++ = '\\';
+			*dst++ = 's';
+			goto done;
+		case '\0':
+			*dst++ = '\\';
+			*dst++ = '0';
+			if (isoctal(nextc)) {
+				*dst++ = '0';
+				*dst++ = '0';
+			}
+			goto done;
+		}
+	}
+	if (((c & 0177) == ' ') || (flag & VIS_OCTAL)) {	
+		*dst++ = '\\';
+		*dst++ = ((u_char)c >> 6 & 07) + '0';
+		*dst++ = ((u_char)c >> 3 & 07) + '0';
+		*dst++ = ((u_char)c & 07) + '0';
+		goto done;
+	}
+	if ((flag & VIS_NOSLASH) == 0)
+		*dst++ = '\\';
+	if (c & 0200) {
+		c &= 0177;
+		*dst++ = 'M';
+	}
+	if (iscntrl(c)) {
+		*dst++ = '^';
+		if (c == 0177)
+			*dst++ = '?';
+		else
+			*dst++ = c + '@';
+	} else {
+		*dst++ = '-';
+		*dst++ = c;
+	}
+done:
+	*dst = '\0';
+	return (dst);
+}
+
+/*
+ * strvis, strnvis, strvisx - visually encode characters from src into dst
+ *	
+ *	Dst must be 4 times the size of src to account for possible
+ *	expansion.  The length of dst, not including the trailing NULL,
+ *	is returned. 
+ *
+ *	Strnvis will write no more than siz-1 bytes (and will NULL terminate).
+ *	The number of bytes needed to fully encode the string is returned.
+ *
+ *	Strvisx encodes exactly len bytes from src into dst.
+ *	This is useful for encoding a block of data.
+ */
+int
+strvis(dst, src, flag)
+	register char *dst;
+	register const char *src;
+	int flag;
+{
+	register char c;
+	char *start;
+
+	for (start = dst; (c = *src);)
+		dst = vis(dst, c, flag, *++src);
+	*dst = '\0';
+	return (dst - start);
+}
+
+int
+strnvis(dst, src, siz, flag)
+	register char *dst;
+	register const char *src;
+	size_t siz;
+	int flag;
+{
+	register char c;
+	char *start, *end;
+
+	for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) {
+		if (isvisible(c)) {
+			*dst++ = c;
+			if (c == '\\' && (flag & VIS_NOSLASH) == 0) {
+				/* need space for the extra '\\' */
+				if (dst < end)
+					*dst++ = '\\';
+				else {
+					dst--;
+					break;
+				}
+			}
+			src++;
+		} else {
+			/* vis(3) requires up to 4 chars */
+			if (dst + 3 < end)
+				dst = vis(dst, c, flag, *++src);
+			else
+				break;
+		}
+	}
+	*dst = '\0';
+	if (dst >= end) {
+		char tbuf[5];
+
+		/* adjust return value for truncation */
+		while ((c = *src))
+			dst += vis(tbuf, c, flag, *++src) - tbuf;
+	}
+	return (dst - start);
+}
+
+int
+strvisx(dst, src, len, flag)
+	register char *dst;
+	register const char *src;
+	register size_t len;
+	int flag;
+{
+	register char c;
+	char *start;
+
+	for (start = dst; len > 1; len--) {
+		c = *src;
+		dst = vis(dst, c, flag, *++src);
+	}
+	if (len)
+		dst = vis(dst, *src, flag, '\0');
+	*dst = '\0';
+	return (dst - start);
+}
+
+#endif
diff --git a/crypto/openssh/openbsd-compat/vis.h b/crypto/openssh/openbsd-compat/vis.h
new file mode 100644
index 0000000..5df6f36
--- /dev/null
+++ b/crypto/openssh/openbsd-compat/vis.h
@@ -0,0 +1,91 @@
+/*	$OpenBSD: vis.h,v 1.5 2002/02/16 21:27:17 millert Exp $	*/
+/*	$NetBSD: vis.h,v 1.4 1994/10/26 00:56:41 cgd Exp $	*/
+
+/*-
+ * Copyright (c) 1990 The Regents of the University of California.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)vis.h	5.9 (Berkeley) 4/3/91
+ */
+#include "config.h"
+#if !defined(HAVE_STRNVIS)
+
+#ifndef _VIS_H_
+#define	_VIS_H_
+
+#include <sys/types.h>
+#include <limits.h>
+
+/*
+ * to select alternate encoding format
+ */
+#define	VIS_OCTAL	0x01	/* use octal \ddd format */
+#define	VIS_CSTYLE	0x02	/* use \[nrft0..] where appropriate */
+
+/*
+ * to alter set of characters encoded (default is to encode all
+ * non-graphic except space, tab, and newline).
+ */
+#define	VIS_SP		0x04	/* also encode space */
+#define	VIS_TAB		0x08	/* also encode tab */
+#define	VIS_NL		0x10	/* also encode newline */
+#define	VIS_WHITE	(VIS_SP | VIS_TAB | VIS_NL)
+#define	VIS_SAFE	0x20	/* only encode "unsafe" characters */
+
+/*
+ * other
+ */
+#define	VIS_NOSLASH	0x40	/* inhibit printing '\' */
+
+/*
+ * unvis return codes
+ */
+#define	UNVIS_VALID	 1	/* character valid */
+#define	UNVIS_VALIDPUSH	 2	/* character valid, push back passed char */
+#define	UNVIS_NOCHAR	 3	/* valid sequence, no character produced */
+#define	UNVIS_SYNBAD	-1	/* unrecognized escape sequence */
+#define	UNVIS_ERROR	-2	/* decoder in unknown state (unrecoverable) */
+
+/*
+ * unvis flags
+ */
+#define	UNVIS_END	1	/* no more characters */
+
+char	*vis(char *, int, int, int);
+int	strvis(char *, const char *, int);
+int	strnvis(char *, const char *, size_t, int);
+int	strvisx(char *, const char *, size_t, int);
+int	strunvis(char *, const char *);
+int	unvis(char *, char, int *, int);
+
+#endif /* !_VIS_H_ */
+
+#endif /* !HAVE_STRNVIS */
diff --git a/crypto/openssh/packet.c b/crypto/openssh/packet.c
index bd347ef..3e21df7 100644
--- a/crypto/openssh/packet.c
+++ b/crypto/openssh/packet.c
@@ -37,7 +37,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.97 2002/07/04 08:12:15 deraadt Exp $");
+RCSID("$OpenBSD: packet.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -564,7 +564,7 @@ set_newkeys(int mode)
 	CipherContext *cc;
 	int encrypt;
 
-	debug("newkeys: mode %d", mode);
+	debug2("set_newkeys: mode %d", mode);
 
 	if (mode == MODE_OUT) {
 		cc = &send_context;
@@ -574,7 +574,7 @@ set_newkeys(int mode)
 		encrypt = CIPHER_DECRYPT;
 	}
 	if (newkeys[mode] != NULL) {
-		debug("newkeys: rekeying");
+		debug("set_newkeys: rekeying");
 		cipher_cleanup(cc);
 		enc  = &newkeys[mode]->enc;
 		mac  = &newkeys[mode]->mac;
@@ -840,7 +840,7 @@ packet_read_poll1(void)
 	cp = buffer_ptr(&input);
 	len = GET_32BIT(cp);
 	if (len < 1 + 2 + 2 || len > 256 * 1024)
-		packet_disconnect("Bad packet length %d.", len);
+		packet_disconnect("Bad packet length %u.", len);
 	padded_len = (len + 8) & ~7;
 
 	/* Check if the packet has been entirely received. */
@@ -936,9 +936,9 @@ packet_read_poll2(u_int32_t *seqnr_p)
 		packet_length = GET_32BIT(cp);
 		if (packet_length < 1 + 4 || packet_length > 256 * 1024) {
 			buffer_dump(&incoming_packet);
-			packet_disconnect("Bad packet length %d.", packet_length);
+			packet_disconnect("Bad packet length %u.", packet_length);
 		}
-		DBG(debug("input: packet len %d", packet_length+4));
+		DBG(debug("input: packet len %u", packet_length+4));
 		buffer_consume(&input, block_size);
 	}
 	/* we have a partial packet of block_size bytes */
@@ -1226,6 +1226,9 @@ packet_disconnect(const char *fmt,...)
 	vsnprintf(buf, sizeof(buf), fmt, args);
 	va_end(args);
 
+	/* Display the error locally */
+	log("Disconnecting: %.100s", buf);
+
 	/* Send the disconnect message to the other side, and wait for it to get sent. */
 	if (compat20) {
 		packet_start(SSH2_MSG_DISCONNECT);
@@ -1245,8 +1248,6 @@ packet_disconnect(const char *fmt,...)
 	/* Close the connection. */
 	packet_close();
 
-	/* Display the error locally and exit. */
-	log("Disconnecting: %.100s", buf);
 	fatal_cleanup();
 }
 
@@ -1313,16 +1314,26 @@ packet_not_very_much_data_to_write(void)
 		return buffer_len(&output) < 128 * 1024;
 }
 
+static void
+packet_set_tos(int interactive)
+{
+	int tos = interactive ? IPTOS_LOWDELAY : IPTOS_THROUGHPUT;
+
+	if (!packet_connection_is_on_socket() ||
+	    !packet_connection_is_ipv4())
+		return;
+	if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, &tos,
+	    sizeof(tos)) < 0)
+		error("setsockopt IP_TOS %d: %.100s:",
+		    tos, strerror(errno));
+}
+
 /* Informs that the current session is interactive.  Sets IP flags for that. */
 
 void
 packet_set_interactive(int interactive)
 {
 	static int called = 0;
-#if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
-	int lowdelay = IPTOS_LOWDELAY;
-	int throughput = IPTOS_THROUGHPUT;
-#endif
 
 	if (called)
 		return;
@@ -1333,35 +1344,12 @@ packet_set_interactive(int interactive)
 
 	/* Only set socket options if using a socket.  */
 	if (!packet_connection_is_on_socket())
-		return;
-	/*
-	 * IPTOS_LOWDELAY and IPTOS_THROUGHPUT are IPv4 only
-	 */
-	if (interactive) {
-		/*
-		 * Set IP options for an interactive connection.  Use
-		 * IPTOS_LOWDELAY and TCP_NODELAY.
-		 */
-#if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
-		if (packet_connection_is_ipv4()) {
-			if (setsockopt(connection_in, IPPROTO_IP, IP_TOS,
-			    &lowdelay, sizeof(lowdelay)) < 0)
-				error("setsockopt IPTOS_LOWDELAY: %.100s",
-				    strerror(errno));
-		}
-#endif
+	if (interactive)
 		set_nodelay(connection_in);
-	} else if (packet_connection_is_ipv4()) {
-		/*
-		 * Set IP options for a non-interactive connection.  Use
-		 * IPTOS_THROUGHPUT.
-		 */
 #if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
-		if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, &throughput,
-		    sizeof(throughput)) < 0)
-			error("setsockopt IPTOS_THROUGHPUT: %.100s", strerror(errno));
+	packet_set_tos(interactive);
 #endif
-	}
+
 }
 
 /* Returns true if the current connection is interactive. */
diff --git a/crypto/openssh/progressmeter.c b/crypto/openssh/progressmeter.c
new file mode 100644
index 0000000..90eb97f
--- /dev/null
+++ b/crypto/openssh/progressmeter.c
@@ -0,0 +1,282 @@
+/*
+ * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
+ * Copyright (c) 1999 Aaron Campbell.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Parts from:
+ *
+ * Copyright (c) 1983, 1990, 1992, 1993, 1995
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: progressmeter.c,v 1.3 2003/03/17 10:38:38 markus Exp $");
+
+#ifdef HAVE_LIBGEN_H
+#include <libgen.h>
+#endif
+
+#include "atomicio.h"
+#include "progressmeter.h"
+
+/* Number of seconds before xfer considered "stalled". */
+#define STALLTIME	5
+/* alarm() interval for updating progress meter. */
+#define PROGRESSTIME	1
+
+/* Signal handler used for updating the progress meter. */
+static void update_progress_meter(int);
+
+/* Returns non-zero if we are the foreground process. */
+static int foregroundproc(void);
+
+/* Returns width of the terminal (for progress meter calculations). */
+static int get_tty_width(void);
+
+/* Visual statistics about files as they are transferred. */
+static void draw_progress_meter(void);
+
+/* Time a transfer started. */
+static struct timeval start;
+
+/* Number of bytes of current file transferred so far. */
+static volatile off_t *statbytes;
+
+/* Total size of current file. */
+static off_t totalbytes;
+
+/* Name of current file being transferred. */
+static char *curfile;
+
+/* Time of last update. */
+static struct timeval lastupdate;
+
+/* Size at the time of the last update. */
+static off_t lastsize;
+
+void
+start_progress_meter(char *file, off_t filesize, off_t *counter)
+{
+	if ((curfile = basename(file)) == NULL)
+		curfile = file;
+
+	totalbytes = filesize;
+	statbytes = counter;
+	(void) gettimeofday(&start, (struct timezone *) 0);
+	lastupdate = start;
+	lastsize = 0;
+
+	draw_progress_meter();
+	signal(SIGALRM, update_progress_meter);
+	alarm(PROGRESSTIME);
+}
+
+void
+stop_progress_meter()
+{
+	alarm(0);
+	draw_progress_meter();
+	if (foregroundproc() != 0)
+		atomicio(write, fileno(stdout), "\n", 1);
+}
+
+static void
+update_progress_meter(int ignore)
+{
+	int save_errno = errno;
+
+	draw_progress_meter();
+	signal(SIGALRM, update_progress_meter);
+	alarm(PROGRESSTIME);
+	errno = save_errno;
+}
+
+static int
+foregroundproc(void)
+{
+	static pid_t pgrp = -1;
+	int ctty_pgrp;
+
+	if (pgrp == -1)
+		pgrp = getpgrp();
+
+#ifdef HAVE_TCGETPGRP
+        return ((ctty_pgrp = tcgetpgrp(STDOUT_FILENO)) != -1 &&
+	                ctty_pgrp == pgrp);
+#else
+	return ((ioctl(STDOUT_FILENO, TIOCGPGRP, &ctty_pgrp) != -1 &&
+		 ctty_pgrp == pgrp));
+#endif
+}
+
+static void
+draw_progress_meter()
+{
+	static const char spaces[] = "                          "
+	    "                                                   "
+	    "                                                   "
+	    "                                                   "
+	    "                                                   "
+	    "                                                   ";
+	static const char prefixes[] = " KMGTP";
+	struct timeval now, td, wait;
+	off_t cursize, abbrevsize, bytespersec;
+	double elapsed;
+	int ratio, remaining, i, ai, bi, nspaces;
+	char buf[512];
+
+	if (foregroundproc() == 0)
+		return;
+
+	(void) gettimeofday(&now, (struct timezone *) 0);
+	cursize = *statbytes;
+	if (totalbytes != 0) {
+		ratio = 100.0 * cursize / totalbytes;
+		ratio = MAX(ratio, 0);
+		ratio = MIN(ratio, 100);
+	} else
+		ratio = 100;
+
+	abbrevsize = cursize;
+	for (ai = 0; abbrevsize >= 10000 && ai < sizeof(prefixes); ai++)
+		abbrevsize >>= 10;
+
+	timersub(&now, &lastupdate, &wait);
+	if (cursize > lastsize) {
+		lastupdate = now;
+		lastsize = cursize;
+		wait.tv_sec = 0;
+	}
+	timersub(&now, &start, &td);
+	elapsed = td.tv_sec + (td.tv_usec / 1000000.0);
+
+	bytespersec = 0;
+	if (cursize > 0) {
+		bytespersec = cursize;
+		if (elapsed > 0.0)
+			bytespersec /= elapsed;
+	}
+	for (bi = 1; bytespersec >= 1024000 && bi < sizeof(prefixes); bi++)
+		bytespersec >>= 10;
+
+    	nspaces = MIN(get_tty_width() - 79, sizeof(spaces) - 1);
+
+#ifdef HAVE_LONG_LONG_INT
+	snprintf(buf, sizeof(buf),
+	    "\r%-45.45s%.*s%3d%% %4lld%c%c %3lld.%01d%cB/s",
+	    curfile,
+	    nspaces,
+	    spaces,
+	    ratio,
+	    (long long)abbrevsize,
+	    prefixes[ai],
+	    ai == 0 ? ' ' : 'B',
+	    (long long)(bytespersec / 1024),
+	    (int)((bytespersec % 1024) * 10 / 1024),
+	    prefixes[bi]
+	);
+#else
+		/* XXX: Handle integer overflow? */
+	snprintf(buf, sizeof(buf),
+	    "\r%-45.45s%.*s%3d%% %4lu%c%c %3lu.%01d%cB/s",
+	    curfile,
+	    nspaces,
+	    spaces,
+	    ratio,
+	    (u_long)abbrevsize,
+	    prefixes[ai],
+	    ai == 0 ? ' ' : 'B',
+	    (u_long)(bytespersec / 1024),
+	    (int)((bytespersec % 1024) * 10 / 1024),
+	    prefixes[bi]
+	);
+#endif
+
+	if (cursize <= 0 || elapsed <= 0.0 || cursize > totalbytes) {
+		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
+		    "   --:-- ETA");
+	} else if (wait.tv_sec >= STALLTIME) {
+		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
+		    " - stalled -");
+	} else {
+		if (cursize != totalbytes)
+			remaining = (int)(totalbytes / (cursize / elapsed) -
+			    elapsed);
+		else
+			remaining = elapsed;
+
+		i = remaining / 3600;
+		if (i)
+			snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
+			    "%2d:", i);
+		else
+			snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
+			    "   ");
+		i = remaining % 3600;
+		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
+		    "%02d:%02d%s", i / 60, i % 60,
+		    (cursize != totalbytes) ? " ETA" : "    ");
+	}
+	atomicio(write, fileno(stdout), buf, strlen(buf));
+}
+
+static int
+get_tty_width(void)
+{
+	struct winsize winsize;
+
+	if (ioctl(fileno(stdout), TIOCGWINSZ, &winsize) != -1)
+		return (winsize.ws_col ? winsize.ws_col : 80);
+	else
+		return (80);
+}
diff --git a/crypto/openssh/progressmeter.h b/crypto/openssh/progressmeter.h
new file mode 100644
index 0000000..bfb9a0b
--- /dev/null
+++ b/crypto/openssh/progressmeter.h
@@ -0,0 +1,27 @@
+/*	$OpenBSD: progressmeter.h,v 1.1 2003/01/10 08:19:07 fgsch Exp $	*/
+/*
+ * Copyright (c) 2002 Nils Nordman.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+void	start_progress_meter(char *, off_t, off_t *);
+void	stop_progress_meter(void);
diff --git a/crypto/openssh/readpass.c b/crypto/openssh/readpass.c
index 96b7e84..95ec5d8 100644
--- a/crypto/openssh/readpass.c
+++ b/crypto/openssh/readpass.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: readpass.c,v 1.27 2002/03/26 15:58:46 markus Exp $");
+RCSID("$OpenBSD: readpass.c,v 1.28 2003/01/23 13:50:27 markus Exp $");
 
 #include "xmalloc.h"
 #include "readpass.h"
@@ -46,11 +46,11 @@ ssh_askpass(char *askpass, const char *msg)
 		fatal("internal error: askpass undefined");
 	if (pipe(p) < 0) {
 		error("ssh_askpass: pipe: %s", strerror(errno));
-		return xstrdup("");
+		return NULL;
 	}
 	if ((pid = fork()) < 0) {
 		error("ssh_askpass: fork: %s", strerror(errno));
-		return xstrdup("");
+		return NULL;
 	}
 	if (pid == 0) {
 		seteuid(getuid());
@@ -79,6 +79,11 @@ ssh_askpass(char *askpass, const char *msg)
 		if (errno != EINTR)
 			break;
 
+	if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
+		memset(buf, 0, sizeof(buf));
+		return NULL;
+	}
+
 	buf[strcspn(buf, "\r\n")] = '\0';
 	pass = xstrdup(buf);
 	memset(buf, 0, sizeof(buf));
@@ -115,7 +120,10 @@ read_passphrase(const char *prompt, int flags)
 			askpass = getenv(SSH_ASKPASS_ENV);
 		else
 			askpass = _PATH_SSH_ASKPASS_DEFAULT;
-		return ssh_askpass(askpass, prompt);
+		if ((ret = ssh_askpass(askpass, prompt)) == NULL)
+			if (!(flags & RP_ALLOW_EOF))
+				return xstrdup("");
+		return ret;
 	}
 
 	if (readpassphrase(prompt, buf, sizeof buf, rppflags) == NULL) {
diff --git a/crypto/openssh/regress/Makefile b/crypto/openssh/regress/Makefile
index 26224cd..6e20293 100644
--- a/crypto/openssh/regress/Makefile
+++ b/crypto/openssh/regress/Makefile
@@ -1,8 +1,8 @@
-#	$OpenBSD: Makefile,v 1.13 2002/04/01 22:15:08 markus Exp $
+#	$OpenBSD: Makefile,v 1.20 2003/01/08 23:54:22 djm Exp $
 
-REGRESSTARGETS=	t1 t2 t3 t4 t5 t6 t7
+REGRESS_TARGETS=	t1 t2 t3 t4 t5 t6 t7
 
-CLEANFILES+=	t2.out t6.out1 t6.out2 t7.out t7.out.pub 
+CLEANFILES+=	t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2
 
 LTESTS= 	connect \
 		proxy-connect \
@@ -17,8 +17,14 @@ LTESTS= 	connect \
 		try-ciphers \
 		yes-head \
 		agent \
+		agent-getpeereid \
+		agent-timeout \
+		agent-ptrace \
 		keyscan \
+		keygen-change \
 		sftp \
+		sftp-cmds \
+		sftp-batch \
 		forwarding
 
 USER!=		id -un
@@ -65,7 +71,7 @@ t7: t7.out
 	ssh-keygen -Bf t7.out > /dev/null
 
 .for t in ${LTESTS}
-REGRESSTARGETS+=t-${t}
+REGRESS_TARGETS+=t-${t}
 t-${t}:
 	sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/${t}.sh
 .endfor
diff --git a/crypto/openssh/regress/agent-getpeereid.sh b/crypto/openssh/regress/agent-getpeereid.sh
new file mode 100644
index 0000000..0889fe8
--- /dev/null
+++ b/crypto/openssh/regress/agent-getpeereid.sh
@@ -0,0 +1,34 @@
+#	$OpenBSD: agent-getpeereid.sh,v 1.1 2002/12/09 16:05:02 markus Exp $
+#	Placed in the Public Domain.
+
+tid="disallow agent attach from other uid"
+
+UNPRIV=nobody
+ASOCK=${OBJ}/agent
+SSH_AUTH_SOCK=/nonexistant
+
+trace "start agent"
+eval `${SSHAGENT} -s -a ${ASOCK}` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+	fail "could not start ssh-agent: exit code $r"
+else
+	chmod 644 ${SSH_AUTH_SOCK}
+
+	ssh-add -l > /dev/null 2>&1
+	r=$?
+	if [ $r -ne 1 ]; then
+		fail "ssh-add failed with $r != 1"
+	fi
+
+	< /dev/null sudo -S -u ${UNPRIV} ssh-add -l > /dev/null 2>&1
+	r=$?
+	if [ $r -lt 2 ]; then
+		fail "ssh-add did not fail for ${UNPRIV}: $r < 2"
+	fi
+
+	trace "kill agent"
+	${SSHAGENT} -k > /dev/null
+fi
+
+rm -f ${OBJ}/agent
diff --git a/crypto/openssh/regress/agent-ptrace.sh b/crypto/openssh/regress/agent-ptrace.sh
new file mode 100644
index 0000000..9f9c999
--- /dev/null
+++ b/crypto/openssh/regress/agent-ptrace.sh
@@ -0,0 +1,28 @@
+#	$OpenBSD: agent-ptrace.sh,v 1.1 2002/12/09 15:38:30 markus Exp $
+#	Placed in the Public Domain.
+
+tid="disallow agent ptrace attach"
+
+trace "start agent"
+eval `${SSHAGENT} -s` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+	fail "could not start ssh-agent: exit code $r"
+else
+	# ls -l ${SSH_AUTH_SOCK}
+	gdb ${SSHAGENT} ${SSH_AGENT_PID} > ${OBJ}/gdb.out 2>&1 << EOF
+		quit
+EOF
+	if [ $? -ne 0 ]; then
+		fail "gdb failed: exit code $?"
+	fi
+	grep -q 'ptrace: Operation not permitted.' ${OBJ}/gdb.out
+	r=$?
+	rm -f ${OBJ}/gdb.out
+	if [ $r -ne 0 ]; then
+		fail "ptrace succeeded?: exit code $r"
+	fi
+
+	trace "kill agent"
+	${SSHAGENT} -k > /dev/null
+fi
diff --git a/crypto/openssh/regress/agent-timeout.sh b/crypto/openssh/regress/agent-timeout.sh
new file mode 100644
index 0000000..28b1be0
--- /dev/null
+++ b/crypto/openssh/regress/agent-timeout.sh
@@ -0,0 +1,36 @@
+#	$OpenBSD: agent-timeout.sh,v 1.1 2002/06/06 00:38:40 markus Exp $
+#	Placed in the Public Domain.
+
+tid="agent timeout test"
+
+TIMEOUT=5
+
+trace "start agent"
+eval `${SSHAGENT} -s` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+	fail "could not start ssh-agent: exit code $r"
+else
+	trace "add keys with timeout"
+	for t in rsa rsa1; do
+		${SSHADD} -t ${TIMEOUT} $OBJ/$t > /dev/null 2>&1
+		if [ $? -ne 0 ]; then
+			fail "ssh-add did succeed exit code 0"
+		fi
+	done
+	n=`${SSHADD} -l 2> /dev/null | wc -l`
+	trace "agent has $n keys"
+	if [ $n -ne 2 ]; then
+		fail "ssh-add -l did not return 2 keys: $n"
+	fi
+	trace "sleeping 2*${TIMEOUT} seconds"
+	sleep ${TIMEOUT}
+	sleep ${TIMEOUT}
+	${SSHADD} -l 2> /dev/null | grep -q 'The agent has no identities.'
+	if [ $? -ne 0 ]; then
+		fail "ssh-add -l still returns keys after timeout"
+	fi
+
+	trace "kill agent"
+	${SSHAGENT} -k > /dev/null
+fi
diff --git a/crypto/openssh/regress/keygen-change.sh b/crypto/openssh/regress/keygen-change.sh
new file mode 100644
index 0000000..08d3590
--- /dev/null
+++ b/crypto/openssh/regress/keygen-change.sh
@@ -0,0 +1,23 @@
+#	$OpenBSD: keygen-change.sh,v 1.2 2002/07/16 09:15:55 markus Exp $
+#	Placed in the Public Domain.
+
+tid="change passphrase for key"
+
+S1="secret1"
+S2="2secret"
+
+for t in rsa dsa rsa1; do
+	# generate user key for agent
+	trace "generating $t key"
+	rm -f $OBJ/$t-key
+	${SSHKEYGEN} -q -N ${S1} -t $t -f $OBJ/$t-key
+	if [ $? -eq 0 ]; then
+		${SSHKEYGEN} -p -P ${S1} -N ${S2} -f $OBJ/$t-key > /dev/null
+		if [ $? -ne 0 ]; then
+			fail "ssh-keygen -p failed for $t-key"
+		fi
+	else
+		fail "ssh-keygen for $t-key failed"
+	fi
+	rm -f $OBJ/$t-key $OBJ/$t-key.pub
+done
diff --git a/crypto/openssh/regress/proxy-connect.sh b/crypto/openssh/regress/proxy-connect.sh
index bf1940f..6a36b25 100644
--- a/crypto/openssh/regress/proxy-connect.sh
+++ b/crypto/openssh/regress/proxy-connect.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: proxy-connect.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
+#	$OpenBSD: proxy-connect.sh,v 1.5 2002/12/09 15:28:46 markus Exp $
 #	Placed in the Public Domain.
 
 tid="proxy connect"
@@ -8,4 +8,11 @@ for p in 1 2; do
 	if [ $? -ne 0 ]; then
 		fail "ssh proxyconnect protocol $p failed"
 	fi
+	SSH_CONNECTION=`${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 'echo $SSH_CONNECTION'`
+	if [ $? -ne 0 ]; then
+		fail "ssh proxyconnect protocol $p failed"
+	fi
+	if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
+		fail "bad SSH_CONNECTION"
+	fi
 done
diff --git a/crypto/openssh/regress/sftp-batch.sh b/crypto/openssh/regress/sftp-batch.sh
new file mode 100644
index 0000000..cffacb6
--- /dev/null
+++ b/crypto/openssh/regress/sftp-batch.sh
@@ -0,0 +1,57 @@
+#	$OpenBSD: sftp-batch.sh,v 1.2 2003/01/10 07:52:41 djm Exp $
+#	Placed in the Public Domain.
+
+tid="sftp batchfile"
+
+DATA=/bin/ls
+COPY=${OBJ}/copy
+BATCH=${OBJ}/sftp-batch
+
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
+
+cat << EOF > ${BATCH}.pass.1
+	get $DATA $COPY
+	put ${COPY} ${COPY}.1
+	rm ${COPY}
+	-put ${COPY} ${COPY}.2
+EOF
+
+cat << EOF > ${BATCH}.pass.2
+	# This is a comment
+
+	# That was a blank line
+	ls
+EOF
+
+cat << EOF > ${BATCH}.fail.1
+	get $DATA $COPY
+	put ${COPY} ${COPY}.3
+	rm ${COPY}.*
+	# The next command should fail
+	put ${COPY}.3 ${COPY}.4
+EOF
+
+cat << EOF > ${BATCH}.fail.2
+	# The next command should fail
+	jajajajaja
+EOF
+
+verbose "$tid: good commands"
+${SFTP} -b ${BATCH}.pass.1 -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "good commands failed"
+
+verbose "$tid: bad commands"
+${SFTP} -b ${BATCH}.fail.1 -P ${SFTPSERVER} >/dev/null 2>&1 \
+	&& fail "bad commands succeeded"
+
+verbose "$tid: comments and blanks"
+${SFTP} -b ${BATCH}.pass.2 -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "comments & blanks failed"
+
+verbose "$tid: junk command"
+${SFTP} -b ${BATCH}.fail.2 -P ${SFTPSERVER} >/dev/null 2>&1 \
+	&& fail "junk command succeeded"
+
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
+
+
diff --git a/crypto/openssh/regress/sftp-cmds.sh b/crypto/openssh/regress/sftp-cmds.sh
new file mode 100644
index 0000000..462c680
--- /dev/null
+++ b/crypto/openssh/regress/sftp-cmds.sh
@@ -0,0 +1,100 @@
+#	$OpenBSD: sftp-cmds.sh,v 1.2 2003/01/10 07:52:41 djm Exp $
+#	Placed in the Public Domain.
+
+# XXX - TODO: 
+# - globbed operations
+# - chmod / chown / chgrp
+# - -p flag for get & put
+
+tid="sftp commands"
+
+DATA=/bin/ls
+COPY=${OBJ}/copy
+
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
+
+verbose "$tid: lls"
+echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "lls failed"
+# XXX always successful
+
+verbose "$tid: ls"
+echo "ls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "ls failed"
+# XXX always successful
+
+verbose "$tid: shell"
+echo "!echo hi there" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "shell failed"
+# XXX always successful
+
+verbose "$tid: pwd"
+echo "pwd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "pwd failed"
+# XXX always successful
+
+verbose "$tid: lpwd"
+echo "lpwd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "lpwd failed"
+# XXX always successful
+
+verbose "$tid: quit"
+echo "quit" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "quit failed"
+# XXX always successful
+
+verbose "$tid: help"
+echo "help" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "help failed"
+# XXX always successful
+
+rm -f ${COPY}
+verbose "$tid: get"
+echo "get $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "get failed"
+cmp $DATA ${COPY} || fail "corrupted copy after get"
+
+rm -f ${COPY}
+verbose "$tid: put"
+echo "put $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "put failed"
+cmp $DATA ${COPY} || fail "corrupted copy after put"
+
+verbose "$tid: rename"
+echo "rename $COPY ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "rename failed"
+test -f ${COPY}.1 || fail "missing file after rename"
+cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename"
+
+verbose "$tid: ln"
+echo "ln ${COPY}.1 ${COPY}.2" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "ln failed"
+test -L ${COPY}.2 || fail "missing file after ln"
+
+verbose "$tid: mkdir"
+echo "mkdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "mkdir failed"
+test -d ${COPY}.dd || fail "missing directory after mkdir"
+
+# XXX do more here
+verbose "$tid: chdir"
+echo "chdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "chdir failed"
+
+verbose "$tid: rmdir"
+echo "rmdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "rmdir failed"
+test -d ${COPY}.1 && fail "present directory after rmdir"
+
+verbose "$tid: lmkdir"
+echo "lmkdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "lmkdir failed"
+test -d ${COPY}.dd || fail "missing directory after lmkdir"
+
+# XXX do more here
+verbose "$tid: lchdir"
+echo "lchdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+	|| fail "lchdir failed"
+
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
+
+
diff --git a/crypto/openssh/regress/ssh-com-client.sh b/crypto/openssh/regress/ssh-com-client.sh
index 84b0b47..015ebbb 100644
--- a/crypto/openssh/regress/ssh-com-client.sh
+++ b/crypto/openssh/regress/ssh-com-client.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com-client.sh,v 1.3 2002/04/10 08:45:30 markus Exp $
+#	$OpenBSD: ssh-com-client.sh,v 1.4 2002/07/16 08:58:16 markus Exp $
 #	Placed in the Public Domain.
 
 tid="connect with ssh.com client"
@@ -15,7 +15,9 @@ VERSIONS="
 	2.3.1
 	2.4.0
 	3.0.0
-	3.1.0"
+	3.1.0
+	3.2.0
+	3.3.0"
 
 # 2.0.10 2.0.12 2.0.13 don't like the test setup
 
diff --git a/crypto/openssh/regress/ssh-com-keygen.sh b/crypto/openssh/regress/ssh-com-keygen.sh
index 90ba2fc..e93dc78 100644
--- a/crypto/openssh/regress/ssh-com-keygen.sh
+++ b/crypto/openssh/regress/ssh-com-keygen.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com-keygen.sh,v 1.1 2002/03/27 22:40:27 markus Exp $
+#	$OpenBSD: ssh-com-keygen.sh,v 1.2 2002/07/16 08:58:16 markus Exp $
 #	Placed in the Public Domain.
 
 tid="ssh.com key import"
@@ -18,7 +18,9 @@ VERSIONS="
 	2.3.1
 	2.4.0
 	3.0.0
-	3.1.0"
+	3.1.0
+	3.2.0
+	3.3.0"
 
 COMPRV=${OBJ}/comkey
 COMPUB=${COMPRV}.pub
diff --git a/crypto/openssh/regress/ssh-com-sftp.sh b/crypto/openssh/regress/ssh-com-sftp.sh
index 231efa1..f08018b 100644
--- a/crypto/openssh/regress/ssh-com-sftp.sh
+++ b/crypto/openssh/regress/ssh-com-sftp.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com-sftp.sh,v 1.2 2002/04/10 08:45:30 markus Exp $
+#	$OpenBSD: ssh-com-sftp.sh,v 1.3 2002/07/16 08:58:16 markus Exp $
 #	Placed in the Public Domain.
 
 tid="basic sftp put/get with ssh.com server"
@@ -24,7 +24,9 @@ VERSIONS="
 	2.3.1
 	2.4.0
 	3.0.0
-	3.1.0"
+	3.1.0
+	3.2.0
+	3.3.0"
 
 # go for it
 for v in ${VERSIONS}; do
diff --git a/crypto/openssh/regress/ssh-com.sh b/crypto/openssh/regress/ssh-com.sh
index 6a199fa..c2bd153 100644
--- a/crypto/openssh/regress/ssh-com.sh
+++ b/crypto/openssh/regress/ssh-com.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
+#	$OpenBSD: ssh-com.sh,v 1.4 2002/07/16 08:58:16 markus Exp $
 #	Placed in the Public Domain.
 
 tid="connect to ssh.com server"
@@ -14,17 +14,19 @@ VERSIONS="
 	2.1.0
 	2.2.0
 	2.3.0
-	2.3.1
 	2.4.0
 	3.0.0
-	3.1.0"
+	3.1.0
+	3.2.0
+	3.3.0"
 # 2.0.10 does not support UserConfigDirectory
+# 2.3.1 requires a config in $HOME/.ssh2
 
 SRC=`dirname ${SCRIPT}`
 
 # ssh.com
 cat << EOF > $OBJ/sshd2_config
-*:
+#*:
 	# Port and ListenAdress are not used.
 	QuietMode			yes
 	Port				4343
diff --git a/crypto/openssh/scp.1 b/crypto/openssh/scp.1
index 396ab64..a3ec2e0 100644
--- a/crypto/openssh/scp.1
+++ b/crypto/openssh/scp.1
@@ -9,7 +9,7 @@
 .\"
 .\" Created: Sun May  7 00:14:37 1995 ylo
 .\"
-.\" $OpenBSD: scp.1,v 1.23 2002/06/22 16:41:57 stevesk Exp $
+.\" $OpenBSD: scp.1,v 1.27 2003/03/28 10:11:43 jmc Exp $
 .\"
 .Dd September 25, 1999
 .Dt SCP 1
@@ -19,12 +19,14 @@
 .Nd secure copy (remote file copy program)
 .Sh SYNOPSIS
 .Nm scp
-.Op Fl pqrvBC46
+.Bk -words
+.Op Fl pqrvBC1246
 .Op Fl F Ar ssh_config
 .Op Fl S Ar program
 .Op Fl P Ar port
 .Op Fl c Ar cipher
 .Op Fl i Ar identity_file
+.Op Fl l Ar limit
 .Op Fl o Ar ssh_option
 .Sm off
 .Oo
@@ -39,6 +41,7 @@
 .Ar host2 No :
 .Oc Ar file2
 .Sm on
+.Ek
 .Sh DESCRIPTION
 .Nm
 copies files between hosts on a network.
@@ -68,6 +71,8 @@ Selects the file from which the identity (private key) for RSA
 authentication is read.
 This option is directly passed to
 .Xr ssh 1 .
+.It Fl l Ar limit
+Limits the used bandwidth, specified in Kbit/s.
 .It Fl p
 Preserves modification times, access times, and modes from the
 original file.
@@ -122,9 +127,15 @@ in the format used in
 This is useful for specifying options
 for which there is no separate
 .Nm scp
-command-line flag.  For example, forcing the use of protocol
-version 1 is specified using
-.Ic scp -oProtocol=1 .
+command-line flag.
+.It Fl 1
+Forces
+.Nm
+to use protocol 1.
+.It Fl 2
+Forces
+.Nm
+to use protocol 2.
 .It Fl 4
 Forces
 .Nm
diff --git a/crypto/openssh/sftp-client.c b/crypto/openssh/sftp-client.c
index f6a73f3..3b3279e 100644
--- a/crypto/openssh/sftp-client.c
+++ b/crypto/openssh/sftp-client.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
+ * Copyright (c) 2001-2003 Damien Miller.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,7 @@
 /* XXX: copy between two remote sites */
 
 #include "includes.h"
-RCSID("$OpenBSD: sftp-client.c,v 1.35 2002/09/11 22:41:49 djm Exp $");
+RCSID("$OpenBSD: sftp-client.c,v 1.42 2003/03/05 22:33:43 markus Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -38,14 +38,20 @@ RCSID("$OpenBSD: sftp-client.c,v 1.35 2002/09/11 22:41:49 djm Exp $");
 #include "xmalloc.h"
 #include "log.h"
 #include "atomicio.h"
+#include "progressmeter.h"
 
 #include "sftp.h"
 #include "sftp-common.h"
 #include "sftp-client.h"
 
+extern int showprogress;
+
 /* Minimum amount of data to read at at time */
 #define MIN_READ_SIZE	512
 
+/* Maximum packet size */
+#define MAX_MSG_LENGTH	(256 * 1024)
+
 struct sftp_conn {
 	int fd_in;
 	int fd_out;
@@ -58,48 +64,45 @@ struct sftp_conn {
 static void
 send_msg(int fd, Buffer *m)
 {
-	int mlen = buffer_len(m);
-	int len;
-	Buffer oqueue;
+	u_char mlen[4];
+
+	if (buffer_len(m) > MAX_MSG_LENGTH)
+		fatal("Outbound message too long %u", buffer_len(m));
 
-	buffer_init(&oqueue);
-	buffer_put_int(&oqueue, mlen);
-	buffer_append(&oqueue, buffer_ptr(m), mlen);
-	buffer_consume(m, mlen);
+	/* Send length first */
+	PUT_32BIT(mlen, buffer_len(m));
+	if (atomicio(write, fd, mlen, sizeof(mlen)) <= 0)
+		fatal("Couldn't send packet: %s", strerror(errno));
 
-	len = atomicio(write, fd, buffer_ptr(&oqueue), buffer_len(&oqueue));
-	if (len <= 0)
+	if (atomicio(write, fd, buffer_ptr(m), buffer_len(m)) <= 0)
 		fatal("Couldn't send packet: %s", strerror(errno));
 
-	buffer_free(&oqueue);
+	buffer_clear(m);
 }
 
 static void
 get_msg(int fd, Buffer *m)
 {
-	u_int len, msg_len;
-	unsigned char buf[4096];
+	ssize_t len;
+	u_int msg_len;
 
-	len = atomicio(read, fd, buf, 4);
+	buffer_append_space(m, 4);
+	len = atomicio(read, fd, buffer_ptr(m), 4);
 	if (len == 0)
 		fatal("Connection closed");
 	else if (len == -1)
 		fatal("Couldn't read packet: %s", strerror(errno));
 
-	msg_len = GET_32BIT(buf);
-	if (msg_len > 256 * 1024)
+	msg_len = buffer_get_int(m);
+	if (msg_len > MAX_MSG_LENGTH)
 		fatal("Received message too long %u", msg_len);
 
-	while (msg_len) {
-		len = atomicio(read, fd, buf, MIN(msg_len, sizeof(buf)));
-		if (len == 0)
-			fatal("Connection closed");
-		else if (len == -1)
-			fatal("Couldn't read packet: %s", strerror(errno));
-
-		msg_len -= len;
-		buffer_append(m, buf, len);
-	}
+	buffer_append_space(m, msg_len);
+	len = atomicio(read, fd, buffer_ptr(m), msg_len);
+	if (len == 0)
+		fatal("Connection closed");
+	else if (len == -1)
+		fatal("Read packet: %s", strerror(errno));
 }
 
 static void
@@ -371,6 +374,7 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
 				error("Couldn't read directory: %s",
 				    fx2txt(status));
 				do_close(conn, handle, handle_len);
+				xfree(handle);
 				return(status);
 			}
 		} else if (type != SSH2_FXP_NAME)
@@ -660,7 +664,7 @@ do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath)
 
 	status = get_status(conn->fd_in, id);
 	if (status != SSH2_FX_OK)
-		error("Couldn't rename file \"%s\" to \"%s\": %s", oldpath,
+		error("Couldn't symlink file \"%s\" to \"%s\": %s", oldpath,
 		    newpath, fx2txt(status));
 
 	return(status);
@@ -741,6 +745,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 	int read_error, write_errno;
 	u_int64_t offset, size;
 	u_int handle_len, mode, type, id, buflen;
+	off_t progress_counter;
 	struct request {
 		u_int id;
 		u_int len;
@@ -758,13 +763,13 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 
 	/* XXX: should we preserve set[ug]id? */
 	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
-		mode = S_IWRITE | (a->perm & 0777);
+		mode = a->perm & 0777;
 	else
 		mode = 0666;
 
 	if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
-	    (a->perm & S_IFDIR)) {
-		error("Cannot download a directory: %s", remote_path);
+	    (!S_ISREG(a->perm))) {
+		error("Cannot download non-regular file: %s", remote_path);
 		return(-1);
 	}
 
@@ -793,7 +798,8 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 		return(-1);
 	}
 
-	local_fd = open(local_path, O_WRONLY | O_CREAT | O_TRUNC, mode);
+	local_fd = open(local_path, O_WRONLY | O_CREAT | O_TRUNC, 
+	    mode | S_IWRITE);
 	if (local_fd == -1) {
 		error("Couldn't open local file \"%s\" for writing: %s",
 		    local_path, strerror(errno));
@@ -805,6 +811,16 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 	/* Read from remote and write to local */
 	write_error = read_error = write_errno = num_req = offset = 0;
 	max_req = 1;
+	progress_counter = 0;
+
+	if (showprogress) {
+		if (size)
+			start_progress_meter(remote_path, size,
+			    &progress_counter);
+		else
+			printf("Fetching %s to %s\n", remote_path, local_path);
+	}
+
 	while (num_req > 0 || max_req > 0) {
 		char *data;
 		u_int len;
@@ -857,14 +873,15 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 			    (unsigned long long)req->offset + len - 1);
 			if (len > req->len)
 				fatal("Received more data than asked for "
-				      "%u > %u", len, req->len);
+				    "%u > %u", len, req->len);
 			if ((lseek(local_fd, req->offset, SEEK_SET) == -1 ||
-			     atomicio(write, local_fd, data, len) != len) &&
+			    atomicio(write, local_fd, data, len) != len) &&
 			    !write_error) {
 				write_errno = errno;
 				write_error = 1;
 				max_req = 0;
 			}
+			progress_counter += len;
 			xfree(data);
 
 			if (len == req->len) {
@@ -907,6 +924,9 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 		}
 	}
 
+	if (showprogress && size)
+		stop_progress_meter();
+
 	/* Sanity check */
 	if (TAILQ_FIRST(&requests) != NULL)
 		fatal("Transfer complete, but requests still in queue");
@@ -930,7 +950,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 		if (pflag && chmod(local_path, mode) == -1)
 #endif /* HAVE_FCHMOD */
 			error("Couldn't set mode on \"%s\": %s", local_path,
-			      strerror(errno));
+			    strerror(errno));
 		if (pflag && (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME)) {
 			struct timeval tv[2];
 			tv[0].tv_sec = a->atime;
@@ -938,7 +958,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 			tv[0].tv_usec = tv[1].tv_usec = 0;
 			if (utimes(local_path, tv) == -1)
 				error("Can't set times on \"%s\": %s",
-				      local_path, strerror(errno));
+				    local_path, strerror(errno));
 		}
 	}
 	close(local_fd);
@@ -983,6 +1003,11 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 		close(local_fd);
 		return(-1);
 	}
+	if (!S_ISREG(sb.st_mode)) {
+		error("%s is not a regular file", local_path);
+		close(local_fd);
+		return(-1);
+	}
 	stat_to_attrib(&sb, &a);
 
 	a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
@@ -1017,6 +1042,11 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 
 	/* Read from local and write to remote */
 	offset = 0;
+	if (showprogress)
+		start_progress_meter(local_path, sb.st_size, &offset);
+	else
+		printf("Uploading %s to %s\n", local_path, remote_path);
+
 	for (;;) {
 		int len;
 
@@ -1047,7 +1077,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 			buffer_put_string(&msg, data, len);
 			send_msg(conn->fd_out, &msg);
 			debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%u",
-			       id, (unsigned long long)offset, len);
+			    id, (unsigned long long)offset, len);
 		} else if (TAILQ_FIRST(&acks) == NULL)
 			break;
 
@@ -1081,9 +1111,11 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 
 			if (status != SSH2_FX_OK) {
 				error("Couldn't write to remote file \"%s\": %s",
-				      remote_path, fx2txt(status));
+				    remote_path, fx2txt(status));
 				do_close(conn, handle, handle_len);
 				close(local_fd);
+				xfree(data);
+				xfree(ack);
 				goto done;
 			}
 			debug3("In write loop, ack for %u %u bytes at %llu",
@@ -1093,6 +1125,8 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 		}
 		offset += len;
 	}
+	if (showprogress)
+		stop_progress_meter();
 	xfree(data);
 
 	if (close(local_fd) == -1) {
diff --git a/crypto/openssh/sftp-common.c b/crypto/openssh/sftp-common.c
index 0823454..31d4138 100644
--- a/crypto/openssh/sftp-common.c
+++ b/crypto/openssh/sftp-common.c
@@ -24,7 +24,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sftp-common.c,v 1.7 2002/09/11 22:41:50 djm Exp $");
+RCSID("$OpenBSD: sftp-common.c,v 1.8 2002/10/16 14:31:48 itojun Exp $");
 
 #include "buffer.h"
 #include "bufaux.h"
@@ -208,6 +208,6 @@ ls_file(char *name, struct stat *st, int remote)
 	glen = MAX(strlen(group), 8);
 	snprintf(buf, sizeof buf, "%s %3d %-*s %-*s %8llu %s %s", mode,
 	    st->st_nlink, ulen, user, glen, group,
-	    (u_int64_t)st->st_size, tbuf, name);
+	    (unsigned long long)st->st_size, tbuf, name);
 	return xstrdup(buf);
 }
diff --git a/crypto/openssh/sftp-int.c b/crypto/openssh/sftp-int.c
index 6a20129..6987de9 100644
--- a/crypto/openssh/sftp-int.c
+++ b/crypto/openssh/sftp-int.c
@@ -25,7 +25,7 @@
 /* XXX: recursive operations */
 
 #include "includes.h"
-RCSID("$OpenBSD: sftp-int.c,v 1.49 2002/09/12 00:13:06 djm Exp $");
+RCSID("$OpenBSD: sftp-int.c,v 1.57 2003/03/05 22:33:43 markus Exp $");
 
 #include "buffer.h"
 #include "xmalloc.h"
@@ -47,6 +47,9 @@ extern size_t copy_buffer_len;
 /* Number of concurrent outstanding requests */
 extern int num_requests;
 
+/* This is set to 0 if the progressmeter is not desired. */
+int showprogress = 1;
+
 /* Seperators for interactive commands */
 #define WHITESPACE " \t\r\n"
 
@@ -73,13 +76,14 @@ extern int num_requests;
 #define I_SHELL		20
 #define I_SYMLINK	21
 #define I_VERSION	22
+#define I_PROGRESS	23
 
 struct CMD {
 	const char *c;
 	const int n;
 };
 
-const struct CMD cmds[] = {
+static const struct CMD cmds[] = {
 	{ "bye",	I_QUIT },
 	{ "cd",		I_CHDIR },
 	{ "chdir",	I_CHDIR },
@@ -100,6 +104,7 @@ const struct CMD cmds[] = {
 	{ "ls",		I_LS },
 	{ "lumask",	I_LUMASK },
 	{ "mkdir",	I_MKDIR },
+	{ "progress",	I_PROGRESS },
 	{ "put",	I_PUT },
 	{ "mput",	I_PUT },
 	{ "pwd",	I_PWD },
@@ -132,6 +137,7 @@ help(void)
 	printf("ls [path]                     Display remote directory listing\n");
 	printf("lumask umask                  Set local umask to 'umask'\n");
 	printf("mkdir path                    Create remote directory\n");
+	printf("progress                      Toggle display of progress meter\n");
 	printf("put local-path [remote-path]  Upload file\n");
 	printf("pwd                           Display remote working directory\n");
 	printf("exit                          Quit sftp\n");
@@ -375,6 +381,17 @@ is_dir(char *path)
 }
 
 static int
+is_reg(char *path)
+{
+	struct stat sb;
+
+	if (stat(path, &sb) == -1)
+		fatal("stat %s: %s", path, strerror(errno));
+
+	return(S_ISREG(sb.st_mode));
+}
+
+static int
 remote_is_dir(struct sftp_conn *conn, char *path)
 {
 	Attrib *a;
@@ -425,7 +442,6 @@ process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag)
 			err = -1;
 			goto out;
 		}
-		printf("Fetching %s to %s\n", g.gl_pathv[0], abs_dst);
 		err = do_download(conn, g.gl_pathv[0], abs_dst, pflag);
 		goto out;
 	}
@@ -489,6 +505,12 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag)
 
 	/* Only one match, dst may be file, directory or unspecified */
 	if (g.gl_pathv[0] && g.gl_matchc == 1) {
+		if (!is_reg(g.gl_pathv[0])) {
+			error("Can't upload %s: not a regular file",
+			    g.gl_pathv[0]);
+			err = 1;
+			goto out;
+		}
 		if (tmp_dst) {
 			/* If directory specified, append filename */
 			if (remote_is_dir(conn, tmp_dst)) {
@@ -507,7 +529,6 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag)
 			}
 			abs_dst = make_absolute(abs_dst, pwd);
 		}
-		printf("Uploading %s to %s\n", g.gl_pathv[0], abs_dst);
 		err = do_upload(conn, g.gl_pathv[0], abs_dst, pflag);
 		goto out;
 	}
@@ -521,6 +542,11 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag)
 	}
 
 	for (i = 0; g.gl_pathv[i]; i++) {
+		if (!is_reg(g.gl_pathv[i])) {
+			error("skipping non-regular file %s", 
+			    g.gl_pathv[i]);
+			continue;
+		}
 		if (infer_path(g.gl_pathv[i], &tmp)) {
 			err = -1;
 			goto out;
@@ -550,7 +576,7 @@ sdirent_comp(const void *aa, const void *bb)
 	SFTP_DIRENT *a = *(SFTP_DIRENT **)aa;
 	SFTP_DIRENT *b = *(SFTP_DIRENT **)bb;
 
-	return (strcmp(a->filename, b->filename));	
+	return (strcmp(a->filename, b->filename));
 }
 
 /* sftp ls.1 replacement for directories */
@@ -563,7 +589,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 	if ((n = do_readdir(conn, path, &d)) != 0)
 		return (n);
 
-	/* Count entries for sort */	
+	/* Count entries for sort */
 	for (n = 0; d[n] != NULL; n++)
 		;
 
@@ -571,7 +597,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 
 	for (n = 0; d[n] != NULL; n++) {
 		char *tmp, *fname;
-		
+
 		tmp = path_append(path, d[n]->filename);
 		fname = path_strip(tmp, strip_path);
 		xfree(tmp);
@@ -589,7 +615,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 			/* XXX - multicolumn display would be nice here */
 			printf("%s\n", fname);
 		}
-		
+
 		xfree(fname);
 	}
 
@@ -599,7 +625,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 
 /* sftp ls.1 replacement which handles path globs */
 static int
-do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path, 
+do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
     int lflag)
 {
 	glob_t g;
@@ -609,23 +635,23 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
 
 	memset(&g, 0, sizeof(g));
 
-	if (remote_glob(conn, path, GLOB_MARK|GLOB_NOCHECK|GLOB_BRACE, 
+	if (remote_glob(conn, path, GLOB_MARK|GLOB_NOCHECK|GLOB_BRACE,
 	    NULL, &g)) {
 		error("Can't ls: \"%s\" not found", path);
 		return (-1);
 	}
 
 	/*
-	 * If the glob returns a single match, which is the same as the 
+	 * If the glob returns a single match, which is the same as the
 	 * input glob, and it is a directory, then just list its contents
 	 */
-	if (g.gl_pathc == 1 && 
+	if (g.gl_pathc == 1 &&
 	    strncmp(path, g.gl_pathv[0], strlen(g.gl_pathv[0]) - 1) == 0) {
 		if ((a = do_lstat(conn, path, 1)) == NULL) {
 			globfree(&g);
 	    		return (-1);
 		}
-		if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) && 
+		if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
 		    S_ISDIR(a->perm)) {
 			globfree(&g);
 			return (do_ls_dir(conn, path, strip_path, lflag));
@@ -640,8 +666,8 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
 		if (lflag) {
 			/*
 			 * XXX: this is slow - 1 roundtrip per path
-			 * A solution to this is to fork glob() and 
-			 * build a sftp specific version which keeps the 
+			 * A solution to this is to fork glob() and
+			 * build a sftp specific version which keeps the
 			 * attribs (which currently get thrown away)
 			 * that the server returns as well as the filenames.
 			 */
@@ -666,7 +692,7 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
 }
 
 static int
-parse_args(const char **cpp, int *pflag, int *lflag, 
+parse_args(const char **cpp, int *pflag, int *lflag, int *iflag,
     unsigned long *n_arg, char **path1, char **path2)
 {
 	const char *cmd, *cp = *cpp;
@@ -678,10 +704,17 @@ parse_args(const char **cpp, int *pflag, int *lflag,
 	/* Skip leading whitespace */
 	cp = cp + strspn(cp, WHITESPACE);
 
-	/* Ignore blank lines */
-	if (!*cp)
-		return(-1);
+	/* Ignore blank lines and lines which begin with comment '#' char */
+	if (*cp == '\0' || *cp == '#')
+		return (0);
 
+	/* Check for leading '-' (disable error processing) */
+	*iflag = 0;
+	if (*cp == '-') {
+		*iflag = 1;
+		cp++;
+	}
+		
 	/* Figure out which command we have */
 	for (i = 0; cmds[i].c; i++) {
 		int cmdlen = strlen(cmds[i].c);
@@ -703,7 +736,7 @@ parse_args(const char **cpp, int *pflag, int *lflag,
 		cmdnum = I_SHELL;
 	} else if (cmdnum == -1) {
 		error("Invalid command.");
-		return(-1);
+		return (-1);
 	}
 
 	/* Get arguments and parse flags */
@@ -803,6 +836,7 @@ parse_args(const char **cpp, int *pflag, int *lflag,
 	case I_LPWD:
 	case I_HELP:
 	case I_VERSION:
+	case I_PROGRESS:
 		break;
 	default:
 		fatal("Command not implemented");
@@ -813,10 +847,11 @@ parse_args(const char **cpp, int *pflag, int *lflag,
 }
 
 static int
-parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd)
+parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
+    int err_abort)
 {
 	char *path1, *path2, *tmp;
-	int pflag, lflag, cmdnum, i;
+	int pflag, lflag, iflag, cmdnum, i;
 	unsigned long n_arg;
 	Attrib a, *aa;
 	char path_buf[MAXPATHLEN];
@@ -824,14 +859,22 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd)
 	glob_t g;
 
 	path1 = path2 = NULL;
-	cmdnum = parse_args(&cmd, &pflag, &lflag, &n_arg,
+	cmdnum = parse_args(&cmd, &pflag, &lflag, &iflag, &n_arg,
 	    &path1, &path2);
 
+	if (iflag != 0)
+		err_abort = 0;
+
 	memset(&g, 0, sizeof(g));
 
 	/* Perform command */
 	switch (cmdnum) {
+	case 0:
+		/* Blank line */
+		break;
 	case -1:
+		/* Unrecognized command */
+		err = -1;
 		break;
 	case I_GET:
 		err = process_get(conn, path1, path2, *pwd, pflag);
@@ -853,8 +896,9 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd)
 		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
 		for (i = 0; g.gl_pathv[i]; i++) {
 			printf("Removing %s\n", g.gl_pathv[i]);
-			if (do_rm(conn, g.gl_pathv[i]) == -1)
-				err = -1;
+			err = do_rm(conn, g.gl_pathv[i]);
+			if (err != 0 && err_abort)
+				break;
 		}
 		break;
 	case I_MKDIR:
@@ -900,15 +944,14 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd)
 			do_globbed_ls(conn, *pwd, *pwd, lflag);
 			break;
 		}
-		
+
 		/* Strip pwd off beginning of non-absolute paths */
 		tmp = NULL;
 		if (*path1 != '/')
 			tmp = *pwd;
 
 		path1 = make_absolute(path1, *pwd);
-
-		do_globbed_ls(conn, path1, tmp, lflag);
+		err = do_globbed_ls(conn, path1, tmp, lflag);
 		break;
 	case I_LCHDIR:
 		if (chdir(path1) == -1) {
@@ -942,62 +985,70 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd)
 		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
 		for (i = 0; g.gl_pathv[i]; i++) {
 			printf("Changing mode on %s\n", g.gl_pathv[i]);
-			do_setstat(conn, g.gl_pathv[i], &a);
+			err = do_setstat(conn, g.gl_pathv[i], &a);
+			if (err != 0 && err_abort)
+				break;
 		}
 		break;
 	case I_CHOWN:
-		path1 = make_absolute(path1, *pwd);
-		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
-		for (i = 0; g.gl_pathv[i]; i++) {
-			if (!(aa = do_stat(conn, g.gl_pathv[i], 0)))
-				continue;
-			if (!(aa->flags & SSH2_FILEXFER_ATTR_UIDGID)) {
-				error("Can't get current ownership of "
-				    "remote file \"%s\"", g.gl_pathv[i]);
-				continue;
-			}
-			printf("Changing owner on %s\n", g.gl_pathv[i]);
-			aa->flags &= SSH2_FILEXFER_ATTR_UIDGID;
-			aa->uid = n_arg;
-			do_setstat(conn, g.gl_pathv[i], aa);
-		}
-		break;
 	case I_CHGRP:
 		path1 = make_absolute(path1, *pwd);
 		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
 		for (i = 0; g.gl_pathv[i]; i++) {
-			if (!(aa = do_stat(conn, g.gl_pathv[i], 0)))
-				continue;
+			if (!(aa = do_stat(conn, g.gl_pathv[i], 0))) {
+				if (err != 0 && err_abort)
+					break;
+				else
+					continue;
+			}
 			if (!(aa->flags & SSH2_FILEXFER_ATTR_UIDGID)) {
 				error("Can't get current ownership of "
 				    "remote file \"%s\"", g.gl_pathv[i]);
-				continue;
+				if (err != 0 && err_abort)
+					break;
+				else
+					continue;
 			}
-			printf("Changing group on %s\n", g.gl_pathv[i]);
 			aa->flags &= SSH2_FILEXFER_ATTR_UIDGID;
-			aa->gid = n_arg;
-			do_setstat(conn, g.gl_pathv[i], aa);
+			if (cmdnum == I_CHOWN) {
+				printf("Changing owner on %s\n", g.gl_pathv[i]);
+				aa->uid = n_arg;
+			} else {
+				printf("Changing group on %s\n", g.gl_pathv[i]);
+				aa->gid = n_arg;
+			}
+			err = do_setstat(conn, g.gl_pathv[i], aa);
+			if (err != 0 && err_abort)
+				break;
 		}
 		break;
 	case I_PWD:
 		printf("Remote working directory: %s\n", *pwd);
 		break;
 	case I_LPWD:
-		if (!getcwd(path_buf, sizeof(path_buf)))
-			error("Couldn't get local cwd: %s",
-			    strerror(errno));
-		else
-			printf("Local working directory: %s\n",
-			    path_buf);
+		if (!getcwd(path_buf, sizeof(path_buf))) {
+			error("Couldn't get local cwd: %s", strerror(errno));
+			err = -1;
+			break;
+		}
+		printf("Local working directory: %s\n", path_buf);
 		break;
 	case I_QUIT:
-		return(-1);
+		/* Processed below */
+		break;
 	case I_HELP:
 		help();
 		break;
 	case I_VERSION:
 		printf("SFTP protocol version %u\n", sftp_proto_version(conn));
 		break;
+	case I_PROGRESS:
+		showprogress = !showprogress;
+		if (showprogress)
+			printf("Progress meter enabled\n");
+		else
+			printf("Progress meter disabled\n");
+		break;
 	default:
 		fatal("%d is not implemented", cmdnum);
 	}
@@ -1009,20 +1060,23 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd)
 	if (path2)
 		xfree(path2);
 
-	/* If an error occurs in batch mode we should abort. */
-	if (infile != stdin && err > 0)
-		return -1;
+	/* If an unignored error occurs in batch mode we should abort. */
+	if (err_abort && err != 0)
+		return (-1);
+	else if (cmdnum == I_QUIT)
+		return (1);
 
-	return(0);
+	return (0);
 }
 
-void
+int
 interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
 {
 	char *pwd;
 	char *dir = NULL;
 	char cmd[2048];
 	struct sftp_conn *conn;
+	int err;
 
 	conn = do_init(fd_in, fd_out, copy_buffer_len, num_requests);
 	if (conn == NULL)
@@ -1039,7 +1093,8 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
 		if (remote_is_dir(conn, dir) && file2 == NULL) {
 			printf("Changing to: %s\n", dir);
 			snprintf(cmd, sizeof cmd, "cd \"%s\"", dir);
-			parse_dispatch_command(conn, cmd, &pwd);
+			if (parse_dispatch_command(conn, cmd, &pwd, 1) != 0)
+				return (-1);
 		} else {
 			if (file2 == NULL)
 				snprintf(cmd, sizeof cmd, "get %s", dir);
@@ -1047,12 +1102,14 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
 				snprintf(cmd, sizeof cmd, "get %s %s", dir,
 				    file2);
 
-			parse_dispatch_command(conn, cmd, &pwd);
+			err = parse_dispatch_command(conn, cmd, &pwd, 1);
 			xfree(dir);
-			return;
+			xfree(pwd);
+			return (err);
 		}
 		xfree(dir);
 	}
+
 #if HAVE_SETVBUF
 	setvbuf(stdout, NULL, _IOLBF, 0);
 	setvbuf(infile, NULL, _IOLBF, 0);
@@ -1061,6 +1118,7 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
 	setlinebuf(infile);
 #endif
 
+	err = 0;
 	for (;;) {
 		char *cp;
 
@@ -1077,8 +1135,13 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
 		if (cp)
 			*cp = '\0';
 
-		if (parse_dispatch_command(conn, cmd, &pwd))
+		err = parse_dispatch_command(conn, cmd, &pwd, infile != stdin);
+		if (err != 0)
 			break;
 	}
 	xfree(pwd);
+
+	/* err == 1 signifies normal "quit" exit */
+	return (err >= 0 ? 0 : -1);
 }
+
diff --git a/crypto/openssh/sftp-int.h b/crypto/openssh/sftp-int.h
index 9768758..8a04a03 100644
--- a/crypto/openssh/sftp-int.h
+++ b/crypto/openssh/sftp-int.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-int.h,v 1.5 2002/02/13 00:59:23 djm Exp $ */
+/* $OpenBSD: sftp-int.h,v 1.6 2003/01/08 23:53:26 djm Exp $ */
 
 /*
  * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
@@ -24,4 +24,4 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-void	 interactive_loop(int, int, char *, char *);
+int	 interactive_loop(int, int, char *, char *);
diff --git a/crypto/openssh/sftp-server.c b/crypto/openssh/sftp-server.c
index 8426469..9a66b4d 100644
--- a/crypto/openssh/sftp-server.c
+++ b/crypto/openssh/sftp-server.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.38 2002/09/11 22:41:50 djm Exp $");
+RCSID("$OpenBSD: sftp-server.c,v 1.41 2003/03/26 04:02:51 deraadt Exp $");
 
 #include "buffer.h"
 #include "bufaux.h"
@@ -158,7 +158,7 @@ handle_new(int use, char *name, int fd, DIR *dirp)
 			handles[i].use = use;
 			handles[i].dirp = dirp;
 			handles[i].fd = fd;
-			handles[i].name = name;
+			handles[i].name = xstrdup(name);
 			return i;
 		}
 	}
@@ -230,9 +230,11 @@ handle_close(int handle)
 	if (handle_is_ok(handle, HANDLE_FILE)) {
 		ret = close(handles[handle].fd);
 		handles[handle].use = HANDLE_UNUSED;
+		xfree(handles[handle].name);
 	} else if (handle_is_ok(handle, HANDLE_DIR)) {
 		ret = closedir(handles[handle].dirp);
 		handles[handle].use = HANDLE_UNUSED;
+		xfree(handles[handle].name);
 	} else {
 		errno = ENOENT;
 	}
@@ -396,7 +398,7 @@ process_open(void)
 	if (fd < 0) {
 		status = errno_to_portable(errno);
 	} else {
-		handle = handle_new(HANDLE_FILE, xstrdup(name), fd, NULL);
+		handle = handle_new(HANDLE_FILE, name, fd, NULL);
 		if (handle < 0) {
 			close(fd);
 		} else {
@@ -681,7 +683,7 @@ process_opendir(void)
 	if (dirp == NULL) {
 		status = errno_to_portable(errno);
 	} else {
-		handle = handle_new(HANDLE_DIR, xstrdup(path), 0, dirp);
+		handle = handle_new(HANDLE_DIR, path, 0, dirp);
 		if (handle < 0) {
 			closedir(dirp);
 		} else {
@@ -832,18 +834,32 @@ static void
 process_rename(void)
 {
 	u_int32_t id;
-	struct stat st;
 	char *oldpath, *newpath;
-	int ret, status = SSH2_FX_FAILURE;
+	int status;
+	struct stat sb;
 
 	id = get_int();
 	oldpath = get_string(NULL);
 	newpath = get_string(NULL);
 	TRACE("rename id %u old %s new %s", id, oldpath, newpath);
-	/* fail if 'newpath' exists */
-	if (stat(newpath, &st) == -1) {
-		ret = rename(oldpath, newpath);
-		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	status = SSH2_FX_FAILURE;
+	if (lstat(oldpath, &sb) == -1)
+		status = errno_to_portable(errno);
+	else if (S_ISREG(sb.st_mode)) {
+		/* Race-free rename of regular files */
+		if (link(oldpath, newpath) == -1)
+			status = errno_to_portable(errno);
+		else if (unlink(oldpath) == -1) {
+			status = errno_to_portable(errno);
+			/* clean spare link */
+			unlink(newpath);
+		} else
+			status = SSH2_FX_OK;
+	} else if (stat(newpath, &sb) == -1) {
+		if (rename(oldpath, newpath) == -1)
+			status = errno_to_portable(errno);
+		else
+			status = SSH2_FX_OK;
 	}
 	send_status(id, status);
 	xfree(oldpath);
@@ -878,19 +894,16 @@ static void
 process_symlink(void)
 {
 	u_int32_t id;
-	struct stat st;
 	char *oldpath, *newpath;
-	int ret, status = SSH2_FX_FAILURE;
+	int ret, status;
 
 	id = get_int();
 	oldpath = get_string(NULL);
 	newpath = get_string(NULL);
 	TRACE("symlink id %u old %s new %s", id, oldpath, newpath);
-	/* fail if 'newpath' exists */
-	if (stat(newpath, &st) == -1) {
-		ret = symlink(oldpath, newpath);
-		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
-	}
+	/* this will fail if 'newpath' exists */
+	ret = symlink(oldpath, newpath);
+	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	send_status(id, status);
 	xfree(oldpath);
 	xfree(newpath);
diff --git a/crypto/openssh/sftp.1 b/crypto/openssh/sftp.1
index 33ceb65..02d2c27 100644
--- a/crypto/openssh/sftp.1
+++ b/crypto/openssh/sftp.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp.1,v 1.36 2002/09/11 22:41:50 djm Exp $
+.\" $OpenBSD: sftp.1,v 1.41 2003/03/28 10:11:43 jmc Exp $
 .\"
 .\" Copyright (c) 2001 Damien Miller.  All rights reserved.
 .\"
@@ -30,6 +30,7 @@
 .Nd Secure file transfer program
 .Sh SYNOPSIS
 .Nm sftp
+.Bk -words
 .Op Fl vC1
 .Op Fl b Ar batchfile
 .Op Fl o Ar ssh_option
@@ -40,10 +41,15 @@
 .Op Fl R Ar num_requests
 .Op Fl S Ar program
 .Ar host
+.Ek
 .Nm sftp
-.Op [\fIuser\fR@]\fIhost\fR[:\fIfile\fR [\fIfile\fR]]
+.Oo Oo Ar user Ns No @ Oc Ns
+.Ar host Ns Oo : Ns Ar file Oo
+.Ar file Oc Oc Oc
 .Nm sftp
-.Op [\fIuser\fR@]\fIhost\fR[:\fIdir\fR[\fI/\fR]]
+.Oo Oo Ar user Ns No @ Oc Ns
+.Ar host Ns Oo : Ns Ar dir Ns
+.Oo Ar / Oc Oc Oc
 .Sh DESCRIPTION
 .Nm
 is an interactive file transfer program, similar to
@@ -77,9 +83,16 @@ non-interactive authentication.
 will abort if any of the following
 commands fail:
 .Ic get , put , rename , ln ,
-.Ic rm , mkdir , chdir , lchdir
+.Ic rm , mkdir , chdir , ls ,
+.Ic lchdir , chmod , chown , chgrp , lpwd
 and
 .Ic lmkdir .
+Termination on error can be suppressed on a command by command basis by
+prefixing the command with a
+.Ic '-'
+character (For example,
+.Ic -rm /tmp/blah*
+).
 .It Fl o Ar ssh_option
 Can be used to pass options to
 .Nm ssh
@@ -88,19 +101,19 @@ in the format used in
 This is useful for specifying options
 for which there is no separate
 .Nm sftp
-command-line flag.  For example, to specify an alternate
+command-line flag. For example, to specify an alternate
 port use:
 .Ic sftp -oPort=24 .
 .It Fl s Ar subsystem | sftp_server
 Specifies the SSH2 subsystem or the path for an sftp server
-on the remote host.  A path is useful for using sftp over
+on the remote host. A path is useful for using sftp over
 protocol version 1, or when the remote
 .Nm sshd
 does not have an sftp subsystem configured.
 .It Fl v
 Raise logging level. This option is also passed to ssh.
 .It Fl B Ar buffer_size
-Specify  the size of the buffer that
+Specify the size of the buffer that
 .Nm
 uses when transferring files. Larger buffers require fewer round trips at
 the cost of higher memory consumption. The default is 32768 bytes.
@@ -221,10 +234,12 @@ Set local umask to
 .It Ic mkdir Ar path
 Create remote directory specified by
 .Ar path .
+.It Ic progress
+Toggle display of progress meter.
 .It Xo Ic put
 .Op Ar flags
 .Ar local-path
-.Op Ar local-path
+.Op Ar remote-path
 .Xc
 Upload
 .Ar local-path
@@ -253,6 +268,10 @@ Create a symbolic link from
 .Ar oldpath
 to
 .Ar newpath .
+.It Ic version
+Display the
+.Nm
+protocol version.
 .It Ic ! Ar command
 Execute
 .Ar command
diff --git a/crypto/openssh/sftp.c b/crypto/openssh/sftp.c
index c4055b9..e8adcba 100644
--- a/crypto/openssh/sftp.c
+++ b/crypto/openssh/sftp.c
@@ -24,7 +24,7 @@
 
 #include "includes.h"
 
-RCSID("$OpenBSD: sftp.c,v 1.31 2002/07/25 01:16:59 mouring Exp $");
+RCSID("$OpenBSD: sftp.c,v 1.34 2003/01/10 08:19:07 fgsch Exp $");
 
 /* XXX: short-form remote directory listings (like 'ls -C') */
 
@@ -49,6 +49,8 @@ FILE* infile;
 size_t copy_buffer_len = 32768;
 size_t num_requests = 16;
 
+extern int showprogress;
+
 static void
 connect_to_server(char *path, char **args, int *in, int *out, pid_t *sshpid)
 {
@@ -108,7 +110,7 @@ usage(void)
 int
 main(int argc, char **argv)
 {
-	int in, out, ch;
+	int in, out, ch, err;
 	pid_t sshpid;
 	char *host, *userhost, *cp, *file2;
 	int debug_level = 0, sshver = 2;
@@ -162,6 +164,7 @@ main(int argc, char **argv)
 					fatal("%s (%s).", strerror(errno), optarg);
 			} else
 				fatal("Filename already specified.");
+			showprogress = 0;
 			break;
 		case 'P':
 			sftp_direct = optarg;
@@ -197,7 +200,7 @@ main(int argc, char **argv)
 			file1 = cp;
 		}
 
-		if ((host = strchr(userhost, '@')) == NULL)
+		if ((host = strrchr(userhost, '@')) == NULL)
 			host = userhost;
 		else {
 			*host++ = '\0';
@@ -237,7 +240,7 @@ main(int argc, char **argv)
 		    &sshpid);
 	}
 
-	interactive_loop(in, out, file1, file2);
+	err = interactive_loop(in, out, file1, file2);
 
 #if !defined(USE_PIPES)
 	shutdown(in, SHUT_RDWR);
@@ -254,5 +257,5 @@ main(int argc, char **argv)
 			fatal("Couldn't wait for ssh process: %s",
 			    strerror(errno));
 
-	exit(0);
+	exit(err == 0 ? 0 : 1);
 }
diff --git a/crypto/openssh/ssh-add.1 b/crypto/openssh/ssh-add.1
index 2a34a51..bcdb8e7 100644
--- a/crypto/openssh/ssh-add.1
+++ b/crypto/openssh/ssh-add.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-add.1,v 1.35 2002/06/19 00:27:55 deraadt Exp $
+.\"	$OpenBSD: ssh-add.1,v 1.38 2003/03/28 10:11:43 jmc Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -45,7 +45,7 @@
 .Nd adds RSA or DSA identities to the authentication agent
 .Sh SYNOPSIS
 .Nm ssh-add
-.Op Fl lLdDxX
+.Op Fl lLdDxXc
 .Op Fl t Ar life
 .Op Ar
 .Nm ssh-add
@@ -92,7 +92,16 @@ Unlock the agent.
 Set a maximum lifetime when adding identities to an agent.
 The lifetime may be specified in seconds or in a time format
 specified in
-.Xr sshd 8 .
+.Xr sshd_config 5 .
+.It Fl c
+Indicates that added identities should be subject to confirmation before
+being used for authentication.
+Confirmation is performed by the
+.Ev SSH_ASKPASS
+program mentioned below.
+Successful confirmation is signaled by a zero exit status from the
+.Ev SSH_ASKPASS
+program, rather than text entered into the requester.
 .It Fl s Ar reader
 Add key in smartcard
 .Ar reader .
diff --git a/crypto/openssh/ssh-agent.1 b/crypto/openssh/ssh-agent.1
index 0227436..fde4608 100644
--- a/crypto/openssh/ssh-agent.1
+++ b/crypto/openssh/ssh-agent.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-agent.1,v 1.35 2002/06/24 13:12:23 markus Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.37 2003/03/28 10:11:43 jmc Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -44,6 +44,7 @@
 .Nm ssh-agent
 .Op Fl a Ar bind_address
 .Op Fl c Li | Fl s
+.Op Fl t Ar life
 .Op Fl d
 .Op Ar command Op Ar args ...
 .Nm ssh-agent
@@ -86,8 +87,17 @@ does not look like it's a csh style of shell.
 Kill the current agent (given by the
 .Ev SSH_AGENT_PID
 environment variable).
+.It Fl t Ar life
+Set a default value for the maximum lifetime of identities added to the agent.
+The lifetime may be specified in seconds or in a time format specified in
+.Xr sshd 8 .
+A lifetime specified for an identity with
+.Xr ssh-add 1
+overrides this value.
+Without this option the default maximum lifetime is forever.
 .It Fl d
-Debug mode.  When this option is specified
+Debug mode.
+When this option is specified
 .Nm
 will not fork.
 .El
diff --git a/crypto/openssh/ssh-dss.c b/crypto/openssh/ssh-dss.c
index 9ba2584..6cedcc4 100644
--- a/crypto/openssh/ssh-dss.c
+++ b/crypto/openssh/ssh-dss.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-dss.c,v 1.17 2002/07/04 10:41:47 markus Exp $");
+RCSID("$OpenBSD: ssh-dss.c,v 1.18 2003/02/12 09:33:04 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/evp.h>
@@ -34,7 +34,6 @@ RCSID("$OpenBSD: ssh-dss.c,v 1.17 2002/07/04 10:41:47 markus Exp $");
 #include "compat.h"
 #include "log.h"
 #include "key.h"
-#include "ssh-dss.h"
 
 #define INTBLOB_LEN	20
 #define SIGBLOB_LEN	(2*INTBLOB_LEN)
diff --git a/crypto/openssh/ssh-keygen.1 b/crypto/openssh/ssh-keygen.1
index 35b0bb9..000e8ff 100644
--- a/crypto/openssh/ssh-keygen.1
+++ b/crypto/openssh/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keygen.1,v 1.54 2002/06/19 00:27:55 deraadt Exp $
+.\"	$OpenBSD: ssh-keygen.1,v 1.56 2003/03/28 10:11:43 jmc Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -45,12 +45,14 @@
 .Nd authentication key generation, management and conversion
 .Sh SYNOPSIS
 .Nm ssh-keygen
+.Bk -words
 .Op Fl q
 .Op Fl b Ar bits
 .Fl t Ar type
 .Op Fl N Ar new_passphrase
 .Op Fl C Ar comment
 .Op Fl f Ar output_keyfile
+.Ek
 .Nm ssh-keygen
 .Fl p
 .Op Fl P Ar old_passphrase
@@ -147,8 +149,7 @@ The options are as follows:
 .It Fl b Ar bits
 Specifies the number of bits in the key to create.
 Minimum is 512 bits.
-Generally 1024 bits is considered sufficient, and key sizes
-above that no longer improve security but make things slower.
+Generally, 1024 bits is considered sufficient.
 The default is 1024 bits.
 .It Fl c
 Requests changing the comment in the private and public key files.
diff --git a/crypto/openssh/ssh-keygen.c b/crypto/openssh/ssh-keygen.c
index 3478e37..6a872bc 100644
--- a/crypto/openssh/ssh-keygen.c
+++ b/crypto/openssh/ssh-keygen.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.101 2002/06/23 09:39:55 deraadt Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.102 2002/11/26 00:45:03 wcobb Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -109,7 +109,6 @@ ask_filename(struct passwd *pw, const char *prompt)
 
 	snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);
 	fprintf(stderr, "%s (%s): ", prompt, identity_file);
-	fflush(stderr);
 	if (fgets(buf, sizeof(buf), stdin) == NULL)
 		exit(1);
 	if (strchr(buf, '\n'))
diff --git a/crypto/openssh/ssh-keyscan.1 b/crypto/openssh/ssh-keyscan.1
index 2f33ddf..f6596c4 100644
--- a/crypto/openssh/ssh-keyscan.1
+++ b/crypto/openssh/ssh-keyscan.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keyscan.1,v 1.14 2002/02/13 08:33:47 mpech Exp $
+.\"	$OpenBSD: ssh-keyscan.1,v 1.15 2003/03/28 10:11:43 jmc Exp $
 .\"
 .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
 .\"
@@ -14,6 +14,7 @@
 .Nd gather ssh public keys
 .Sh SYNOPSIS
 .Nm ssh-keyscan
+.Bk -words
 .Op Fl v46
 .Op Fl p Ar port
 .Op Fl T Ar timeout
@@ -21,10 +22,12 @@
 .Op Fl f Ar file
 .Op Ar host | addrlist namelist
 .Op Ar ...
+.Ek
 .Sh DESCRIPTION
 .Nm
 is a utility for gathering the public ssh host keys of a number of
-hosts.  It was designed to aid in building and verifying
+hosts.
+It was designed to aid in building and verifying
 .Pa ssh_known_hosts
 files.
 .Nm
@@ -33,9 +36,11 @@ scripts.
 .Pp
 .Nm
 uses non-blocking socket I/O to contact as many hosts as possible in
-parallel, so it is very efficient.  The keys from a domain of 1,000
+parallel, so it is very efficient.
+The keys from a domain of 1,000
 hosts can be collected in tens of seconds, even when some of those
-hosts are down or do not run ssh.  For scanning, one does not need
+hosts are down or do not run ssh.
+For scanning, one does not need
 login access to the machines that are being scanned, nor does the
 scanning process involve any encryption.
 .Pp
@@ -44,12 +49,13 @@ The options are as follows:
 .It Fl p Ar port
 Port to connect to on the remote host.
 .It Fl T Ar timeout
-Set the timeout for connection attempts.  If
+Set the timeout for connection attempts.
+If
 .Pa timeout
 seconds have elapsed since a connection was initiated to a host or since the
 last time anything was read from that host, then the connection is
-closed and the host in question considered unavailable.  Default is 5
-seconds.
+closed and the host in question considered unavailable.
+Default is 5 seconds.
 .It Fl t Ar type
 Specifies the type of the key to fetch from the scanned hosts.
 The possible values are
diff --git a/crypto/openssh/ssh-keysign.8 b/crypto/openssh/ssh-keysign.8
index cea4a82..2e3f8ff 100644
--- a/crypto/openssh/ssh-keysign.8
+++ b/crypto/openssh/ssh-keysign.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.3 2002/07/03 14:21:05 markus Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.6 2003/03/28 10:11:43 jmc Exp $
 .\"
 .\" Copyright (c) 2002 Markus Friedl.  All rights reserved.
 .\"
@@ -39,10 +39,10 @@ required during hostbased authentication with SSH protocol version 2.
 .Pp
 .Nm
 is disabled by default and can only be enabled in the
-the global client configuration file
+global client configuration file
 .Pa /etc/ssh/ssh_config
 by setting
-.Cm HostbasedAuthentication
+.Cm EnableSSHKeysign
 to
 .Dq yes .
 .Pp
@@ -62,8 +62,8 @@ Controls whether
 is enabled.
 .It Pa /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
 These files contain the private parts of the host keys used to
-generate the digital signature.  They
-should be owned by root, readable only by root, and not
+generate the digital signature.
+They should be owned by root, readable only by root, and not
 accessible to others.
 Since they are readable only by root,
 .Nm
diff --git a/crypto/openssh/ssh-keysign.c b/crypto/openssh/ssh-keysign.c
index 79aee17..26c8faa 100644
--- a/crypto/openssh/ssh-keysign.c
+++ b/crypto/openssh/ssh-keysign.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keysign.c,v 1.7 2002/07/03 14:21:05 markus Exp $");
+RCSID("$OpenBSD: ssh-keysign.c,v 1.10 2003/03/13 11:42:19 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/rand.h>
@@ -168,8 +168,8 @@ main(int argc, char **argv)
 	initialize_options(&options);
 	(void)read_config_file(_PATH_HOST_CONFIG_FILE, "", &options);
 	fill_default_options(&options);
-	if (options.hostbased_authentication != 1)
-		fatal("Hostbased authentication not enabled in %s",
+	if (options.enable_ssh_keysign != 1)
+		fatal("ssh-keysign not enabled in %s",
 		    _PATH_HOST_CONFIG_FILE);
 
 	if (key_fd[0] == -1 && key_fd[1] == -1)
@@ -192,13 +192,6 @@ main(int argc, char **argv)
 		keys[i] = key_load_private_pem(key_fd[i], KEY_UNSPEC,
 		    NULL, NULL);
 		close(key_fd[i]);
-		if (keys[i] != NULL && keys[i]->type == KEY_RSA) {
-			if (RSA_blinding_on(keys[i]->rsa, NULL) != 1) {
-				error("RSA_blinding_on failed");
-				key_free(keys[i]);
-				keys[i] = NULL;
-			}
-		}
 		if (keys[i] != NULL)
 			found = 1;
 	}
diff --git a/crypto/openssh/ssh-rand-helper.c b/crypto/openssh/ssh-rand-helper.c
index e6c52b5..68b77b2 100644
--- a/crypto/openssh/ssh-rand-helper.c
+++ b/crypto/openssh/ssh-rand-helper.c
@@ -39,7 +39,7 @@
 #include "pathnames.h"
 #include "log.h"
 
-RCSID("$Id: ssh-rand-helper.c,v 1.8 2002/07/28 20:42:24 stevesk Exp $");
+RCSID("$Id: ssh-rand-helper.c,v 1.10 2003/03/17 05:13:53 djm Exp $");
 
 /* Number of bytes we write out */
 #define OUTPUT_SEED_SIZE	48
@@ -355,6 +355,7 @@ hash_command_output(entropy_cmd_t *src, unsigned char *hash)
 		case 0:
 			/* timer expired */
 			error_abort = 1;
+			kill(pid, SIGINT);
 			break;
 		case 1:
 			/* command input */
@@ -561,7 +562,8 @@ prng_write_seedfile(void)
 
 	debug("writing PRNG seed to file %.100s", filename);
 
-	RAND_bytes(seed, sizeof(seed));
+	if (RAND_bytes(seed, sizeof(seed)) <= 0)
+		fatal("PRNG seed extration failed");
 
 	/* Don't care if the seed doesn't exist */
 	prng_check_seedfile(filename);
@@ -848,7 +850,8 @@ main(int argc, char **argv)
 	if (!RAND_status())
 		fatal("Not enough entropy in RNG");
 
-	RAND_bytes(buf, bytes);
+	if (RAND_bytes(buf, bytes) <= 0)
+		fatal("Couldn't extract entropy from PRNG");
 
 	if (output_hex) {
 		for(ret = 0; ret < bytes; ret++)
diff --git a/crypto/openssh/ssh-rsa.c b/crypto/openssh/ssh-rsa.c
index d7b2918..efbc9e6 100644
--- a/crypto/openssh/ssh-rsa.c
+++ b/crypto/openssh/ssh-rsa.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-rsa.c,v 1.26 2002/08/27 17:13:56 stevesk Exp $");
+RCSID("$OpenBSD: ssh-rsa.c,v 1.28 2003/02/12 09:33:04 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -33,11 +33,10 @@ RCSID("$OpenBSD: ssh-rsa.c,v 1.26 2002/08/27 17:13:56 stevesk Exp $");
 #include "buffer.h"
 #include "bufaux.h"
 #include "key.h"
-#include "ssh-rsa.h"
 #include "compat.h"
 #include "ssh.h"
 
-static int openssh_RSA_verify(int, u_char *, u_int, u_char *, u_int , RSA *);
+static int openssh_RSA_verify(int, u_char *, u_int, u_char *, u_int, RSA *);
 
 /* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
 int