This commit was generated by cvs2svn to compensate for changes in r65668,

which included commits to RCS files with non-trunk default branches.

80 files changed, 3146 insertions, 806 deletions

diff --git a/crypto/openssh/LICENCE b/crypto/openssh/LICENCE
new file mode 100644
index 0000000..e8ab01b
--- /dev/null
+++ b/crypto/openssh/LICENCE
@@ -0,0 +1,136 @@
+This file is part of the ssh software.
+
+The licences which components of this software falls under are as
+follows.  First, we will summarize and say that that all components
+are under a BSD licence, or a licence more free than that.
+
+OpenSSH contains no GPL code.
+
+1)
+     * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+     *                    All rights reserved
+     *
+     * As far as I am concerned, the code I have written for this software
+     * can be used freely for any purpose.  Any derived versions of this
+     * software must be clearly marked as such, and if the derived work is
+     * incompatible with the protocol description in the RFC file, it must be
+     * called by a name other than "ssh" or "Secure Shell".
+
+    [Tatu continues]
+     *  However, I am not implying to give any licenses to any patents or
+     * copyrights held by third parties, and the software includes parts that
+     * are not under my direct control.  As far as I know, all included
+     * source code is used in accordance with the relevant license agreements
+     * and can be used freely for any purpose (the GNU license being the most
+     * restrictive); see below for details.
+
+    [However, none of that term is relevant at this point in time.  All of
+    these restrictively licenced software components which he talks about
+    have been removed from OpenSSH, ie.
+
+     - RSA is no longer included, found in the OpenSSL library
+     - IDEA is no longer included, it's use is depricated
+     - DES is now external, in the OpenSSL library
+     - GMP is no longer used, and instead we call BN code from OpenSSL
+     - Zlib is now external, in a library
+     - The make-ssh-known-hosts script is no longer included
+     - TSS has been removed
+     - MD5 is now external, in the OpenSSL library
+     - RC4 support has been removed
+     - Blowfish is now external, in the OpenSSL library
+
+    [The licence continues]
+
+    Note that any information and cryptographic algorithms used in this
+    software are publicly available on the Internet and at any major
+    bookstore, scientific library, and patent office worldwide.  More
+    information can be found e.g. at "http://www.cs.hut.fi/crypto".
+    
+    The legal status of this program is some combination of all these
+    permissions and restrictions.  Use only at your own responsibility.
+    You will be responsible for any legal consequences yourself; I am not
+    making any claims whether possessing or using this is legal or not in
+    your country, and I am not taking any responsibility on your behalf.
+    
+    
+    			    NO WARRANTY
+    
+    BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+    FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+    OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+    PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+    OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+    TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+    PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+    REPAIR OR CORRECTION.
+    
+    IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+    WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+    REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+    INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+    OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+    TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+    YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+    PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGES.
+
+2)
+    The 32-bit CRC implementation in crc32.c is due to Gary S. Brown.
+    Comments in the file indicate it may be used for any purpose without
+    restrictions:
+
+     * COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
+     * code or tables extracted from it, as desired without restriction.
+
+3)
+    The 32-bit CRC compensation attack detector in deattack.c was
+    contributed by CORE SDI S.A. under a BSD-style license. See
+    http://www.core-sdi.com/english/ssh/ for details.
+
+     * Cryptographic attack detector for ssh - source code
+     *
+     * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
+     *
+     * All rights reserved. Redistribution and use in source and binary
+     * forms, with or without modification, are permitted provided that
+     * this copyright notice is retained.
+     *
+     * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+     * WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
+     * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
+     * CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
+     * SOFTWARE.
+     *
+     * Ariel Futoransky <futo@core-sdi.com>
+     * <http://www.core-sdi.com>
+    
+4)
+    Remaining components of the software are provided under a standard
+    2-term BSD licence with the following names as copyright holders:
+
+	Markus Friedl
+	Theo de Raadt
+	Niels Provos
+	Dug Song
+	Aaron Campbell
+
+     * Redistribution and use in source and binary forms, with or without
+     * modification, are permitted provided that the following conditions
+     * are met:
+     * 1. Redistributions of source code must retain the above copyright
+     *    notice, this list of conditions and the following disclaimer.
+     * 2. Redistributions in binary form must reproduce the above copyright
+     *    notice, this list of conditions and the following disclaimer in the
+     *    documentation and/or other materials provided with the distribution.
+     *
+     * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+     * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+     * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+     * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+     * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+     * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+     * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+     * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+     * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+     * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/crypto/openssh/Makefile b/crypto/openssh/Makefile
index 668900c..299d349 100644
--- a/crypto/openssh/Makefile
+++ b/crypto/openssh/Makefile
@@ -1,8 +1,8 @@
-#	$OpenBSD: Makefile,v 1.5 1999/10/25 20:27:26 markus Exp $
+#	$OpenBSD: Makefile,v 1.6 2000/08/31 21:52:23 markus Exp $
 
 .include <bsd.own.mk>
 
-SUBDIR=	lib ssh sshd ssh-add ssh-keygen ssh-agent scp
+SUBDIR=	lib ssh sshd ssh-add ssh-keygen ssh-agent scp sftp-server
 
 distribution:
 	install -C -o root -g wheel -m 0644 ${.CURDIR}/ssh_config \
diff --git a/crypto/openssh/atomicio.c b/crypto/openssh/atomicio.c
index 668d490..019eda8 100644
--- a/crypto/openssh/atomicio.c
+++ b/crypto/openssh/atomicio.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999 Theo de Raadt
+ * Copyright (c) 1995,1999 Theo de Raadt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -24,7 +24,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: atomicio.c,v 1.3 2000/03/16 20:56:13 markus Exp $");
+RCSID("$OpenBSD: atomicio.c,v 1.5 2000/09/07 20:27:49 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
diff --git a/crypto/openssh/auth-options.c b/crypto/openssh/auth-options.c
new file mode 100644
index 0000000..da69652
--- /dev/null
+++ b/crypto/openssh/auth-options.c
@@ -0,0 +1,223 @@
+/*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ * RSA-based authentication.  This code determines whether to admit a login
+ * based on RSA authentication.  This file also contains functions to check
+ * validity of the host key.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: auth-options.c,v 1.4 2000/09/07 21:13:36 markus Exp $");
+
+#include "ssh.h"
+#include "packet.h"
+#include "xmalloc.h"
+#include "match.h"
+
+/* Flags set authorized_keys flags */
+int no_port_forwarding_flag = 0;
+int no_agent_forwarding_flag = 0;
+int no_x11_forwarding_flag = 0;
+int no_pty_flag = 0;
+
+/* "command=" option. */
+char *forced_command = NULL;
+
+/* "environment=" options. */
+struct envstring *custom_environment = NULL;
+
+/* return 1 if access is granted, 0 if not. side effect: sets key option flags */
+int
+auth_parse_options(struct passwd *pw, char *options, unsigned long linenum)
+{
+	const char *cp;
+	if (!options)
+		return 1;
+	while (*options && *options != ' ' && *options != '\t') {
+		cp = "no-port-forwarding";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			packet_send_debug("Port forwarding disabled.");
+			no_port_forwarding_flag = 1;
+			options += strlen(cp);
+			goto next_option;
+		}
+		cp = "no-agent-forwarding";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			packet_send_debug("Agent forwarding disabled.");
+			no_agent_forwarding_flag = 1;
+			options += strlen(cp);
+			goto next_option;
+		}
+		cp = "no-X11-forwarding";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			packet_send_debug("X11 forwarding disabled.");
+			no_x11_forwarding_flag = 1;
+			options += strlen(cp);
+			goto next_option;
+		}
+		cp = "no-pty";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			packet_send_debug("Pty allocation disabled.");
+			no_pty_flag = 1;
+			options += strlen(cp);
+			goto next_option;
+		}
+		cp = "command=\"";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			int i;
+			options += strlen(cp);
+			forced_command = xmalloc(strlen(options) + 1);
+			i = 0;
+			while (*options) {
+				if (*options == '"')
+					break;
+				if (*options == '\\' && options[1] == '"') {
+					options += 2;
+					forced_command[i++] = '"';
+					continue;
+				}
+				forced_command[i++] = *options++;
+			}
+			if (!*options) {
+				debug("%.100s, line %lu: missing end quote",
+				      SSH_USER_PERMITTED_KEYS, linenum);
+				packet_send_debug("%.100s, line %lu: missing end quote",
+						  SSH_USER_PERMITTED_KEYS, linenum);
+				continue;
+			}
+			forced_command[i] = 0;
+			packet_send_debug("Forced command: %.900s", forced_command);
+			options++;
+			goto next_option;
+		}
+		cp = "environment=\"";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			int i;
+			char *s;
+			struct envstring *new_envstring;
+			options += strlen(cp);
+			s = xmalloc(strlen(options) + 1);
+			i = 0;
+			while (*options) {
+				if (*options == '"')
+					break;
+				if (*options == '\\' && options[1] == '"') {
+					options += 2;
+					s[i++] = '"';
+					continue;
+				}
+				s[i++] = *options++;
+			}
+			if (!*options) {
+				debug("%.100s, line %lu: missing end quote",
+				      SSH_USER_PERMITTED_KEYS, linenum);
+				packet_send_debug("%.100s, line %lu: missing end quote",
+						  SSH_USER_PERMITTED_KEYS, linenum);
+				continue;
+			}
+			s[i] = 0;
+			packet_send_debug("Adding to environment: %.900s", s);
+			debug("Adding to environment: %.900s", s);
+			options++;
+			new_envstring = xmalloc(sizeof(struct envstring));
+			new_envstring->s = s;
+			new_envstring->next = custom_environment;
+			custom_environment = new_envstring;
+			goto next_option;
+		}
+		cp = "from=\"";
+		if (strncmp(options, cp, strlen(cp)) == 0) {
+			int mname, mip;
+			char *patterns = xmalloc(strlen(options) + 1);
+			int i;
+			options += strlen(cp);
+			i = 0;
+			while (*options) {
+				if (*options == '"')
+					break;
+				if (*options == '\\' && options[1] == '"') {
+					options += 2;
+					patterns[i++] = '"';
+					continue;
+				}
+				patterns[i++] = *options++;
+			}
+			if (!*options) {
+				debug("%.100s, line %lu: missing end quote",
+				    SSH_USER_PERMITTED_KEYS, linenum);
+				packet_send_debug("%.100s, line %lu: missing end quote",
+				    SSH_USER_PERMITTED_KEYS, linenum);
+				continue;
+			}
+			patterns[i] = 0;
+			options++;
+			/*
+			 * Deny access if we get a negative
+			 * match for the hostname or the ip
+			 * or if we get not match at all
+			 */
+			mname = match_hostname(get_canonical_hostname(),
+			    patterns, strlen(patterns));
+			mip = match_hostname(get_remote_ipaddr(),
+			    patterns, strlen(patterns));
+			xfree(patterns);
+			if (mname == -1 || mip == -1 ||
+			    (mname != 1 && mip != 1)) {
+				log("Authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s).",
+				    pw->pw_name, get_canonical_hostname(),
+				    get_remote_ipaddr());
+				packet_send_debug("Your host '%.200s' is not permitted to use this key for login.",
+				get_canonical_hostname());
+				/* key invalid for this host, reset flags */
+				no_agent_forwarding_flag = 0;
+				no_port_forwarding_flag = 0;
+				no_pty_flag = 0;
+				no_x11_forwarding_flag = 0;
+				while (custom_environment) {
+					struct envstring *ce = custom_environment;
+					custom_environment = ce->next;
+					xfree(ce->s);
+					xfree(ce);
+				}
+				if (forced_command) {
+					xfree(forced_command);
+					forced_command = NULL;
+				}
+				/* deny access */
+				return 0;
+			}
+			/* Host name matches. */
+			goto next_option;
+		}
+next_option:
+		/*
+		 * Skip the comma, and move to the next option
+		 * (or break out if there are no more).
+		 */
+		if (!*options)
+			fatal("Bugs in auth-options.c option processing.");
+		if (*options == ' ' || *options == '\t')
+			break;		/* End of options. */
+		if (*options != ',')
+			goto bad_option;
+		options++;
+		/* Process the next option. */
+	}
+	/* grant access */
+	return 1;
+
+bad_option:
+	log("Bad options in %.100s file, line %lu: %.50s",
+	    SSH_USER_PERMITTED_KEYS, linenum, options);
+	packet_send_debug("Bad options in %.100s file, line %lu: %.50s",
+	    SSH_USER_PERMITTED_KEYS, linenum, options);
+	/* deny access */
+	return 0;
+}
diff --git a/crypto/openssh/auth-options.h b/crypto/openssh/auth-options.h
new file mode 100644
index 0000000..9044d98
--- /dev/null
+++ b/crypto/openssh/auth-options.h
@@ -0,0 +1,25 @@
+/*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ * Functions to interface with the SSH_AUTHENTICATION_FD socket.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
+#ifndef AUTH_OPTIONS_H
+#define AUTH_OPTIONS_H
+/* Flags that may be set in authorized_keys options. */
+extern int no_port_forwarding_flag;
+extern int no_agent_forwarding_flag;
+extern int no_x11_forwarding_flag;
+extern int no_pty_flag;
+extern char *forced_command;
+extern struct envstring *custom_environment;
+
+/* return 1 if access is granted, 0 if not. side effect: sets key option flags */
+int	auth_parse_options(struct passwd *pw, char *options, unsigned long linenum);
+#endif
diff --git a/crypto/openssh/auth-rhosts.c b/crypto/openssh/auth-rhosts.c
index 3393b86..901c8d1 100644
--- a/crypto/openssh/auth-rhosts.c
+++ b/crypto/openssh/auth-rhosts.c
@@ -1,22 +1,20 @@
 /*
- *
- * auth-rhosts.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Fri Mar 17 05:12:18 1995 ylo
- *
  * Rhosts authentication.  This file contains code to check whether to admit
  * the login based on rhosts authentication.  This file also processes
  * /etc/hosts.equiv.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: auth-rhosts.c,v 1.13 2000/04/14 10:30:29 markus Exp $");
+RCSID("$OpenBSD: auth-rhosts.c,v 1.15 2000/09/07 20:27:49 deraadt Exp $");
 
 #include "packet.h"
 #include "ssh.h"
diff --git a/crypto/openssh/auth.h b/crypto/openssh/auth.h
index 72126e0..65bf7ae 100644
--- a/crypto/openssh/auth.h
+++ b/crypto/openssh/auth.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #ifndef AUTH_H
 #define AUTH_H
 
@@ -7,7 +30,7 @@ void	do_authentication2(void);
 struct passwd *
 auth_get_user(void);
 
-int allowed_user(struct passwd * pw);;
+int allowed_user(struct passwd * pw);
 
 #define AUTH_FAIL_MAX 6
 #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
diff --git a/crypto/openssh/authfd.h b/crypto/openssh/authfd.h
index fbeea23..b7a137d 100644
--- a/crypto/openssh/authfd.h
+++ b/crypto/openssh/authfd.h
@@ -1,19 +1,17 @@
 /*
- *
- * authfd.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Wed Mar 29 01:17:41 1995 ylo
- *
  * Functions to interface with the SSH_AUTHENTICATION_FD socket.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: authfd.h,v 1.7 2000/04/14 10:30:30 markus Exp $"); */
+/* RCSID("$OpenBSD: authfd.h,v 1.11 2000/09/07 20:27:49 deraadt Exp $"); */
 
 #ifndef AUTHFD_H
 #define AUTHFD_H
@@ -31,12 +29,20 @@
 #define SSH_AGENTC_REMOVE_RSA_IDENTITY		8
 #define SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES	9
 
+#define SSH2_AGENTC_REQUEST_IDENTITIES		11
+#define SSH2_AGENT_IDENTITIES_ANSWER		12
+#define SSH2_AGENTC_SIGN_REQUEST		13
+#define SSH2_AGENT_SIGN_RESPONSE		14
+#define SSH2_AGENTC_ADD_IDENTITY		17
+#define SSH2_AGENTC_REMOVE_IDENTITY		18
+#define SSH2_AGENTC_REMOVE_ALL_IDENTITIES	19
+
 typedef struct {
 	int     fd;
-	Buffer  packet;
 	Buffer  identities;
 	int     howmany;
 }       AuthenticationConnection;
+
 /* Returns the number of the authentication fd, or -1 if there is none. */
 int     ssh_get_authentication_socket();
 
@@ -59,44 +65,48 @@ AuthenticationConnection *ssh_get_authentication_connection();
  * Closes the connection to the authentication agent and frees any associated
  * memory.
  */
-void    ssh_close_authentication_connection(AuthenticationConnection * ac);
+void    ssh_close_authentication_connection(AuthenticationConnection *auth);
 
 /*
- * Returns the first authentication identity held by the agent. Returns true
- * if an identity is available, 0 otherwise. The caller must initialize the
- * integers before the call, and free the comment after a successful call
- * (before calling ssh_get_next_identity).
+ * Returns the first authentication identity held by the agent or NULL if
+ * no identies are available. Caller must free comment and key.
+ * Note that you cannot mix calls with different versions.
  */
-int
-ssh_get_first_identity(AuthenticationConnection * connection,
-    BIGNUM * e, BIGNUM * n, char **comment);
+Key	*ssh_get_first_identity(AuthenticationConnection *auth, char **comment, int version);
 
 /*
  * Returns the next authentication identity for the agent.  Other functions
  * can be called between this and ssh_get_first_identity or two calls of this
- * function.  This returns 0 if there are no more identities.  The caller
- * must free comment after a successful return.
+ * function.  This returns NULL if there are no more identities.  The caller
+ * must free key and comment after a successful return.
  */
-int
-ssh_get_next_identity(AuthenticationConnection * connection,
-    BIGNUM * e, BIGNUM * n, char **comment);
+Key	*ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int version);
 
-/* Requests the agent to decrypt the given challenge.  Returns true if
-   the agent claims it was able to decrypt it. */
+/*
+ * Requests the agent to decrypt the given challenge.  Returns true if the
+ * agent claims it was able to decrypt it.
+ */
 int
-ssh_decrypt_challenge(AuthenticationConnection * auth,
-    BIGNUM * e, BIGNUM * n, BIGNUM * challenge,
+ssh_decrypt_challenge(AuthenticationConnection *auth,
+    Key *key, BIGNUM * challenge,
     unsigned char session_id[16],
     unsigned int response_type,
     unsigned char response[16]);
 
+/* Requests the agent to sign data using key */
+int
+ssh_agent_sign(AuthenticationConnection *auth,
+    Key *key,
+    unsigned char **sigp, int *lenp,
+    unsigned char *data, int datalen);
+
 /*
  * Adds an identity to the authentication server.  This call is not meant to
  * be used by normal applications.  This returns true if the identity was
  * successfully added.
  */
 int
-ssh_add_identity(AuthenticationConnection * connection, RSA * key,
+ssh_add_identity(AuthenticationConnection *auth, Key *key,
     const char *comment);
 
 /*
@@ -104,16 +114,13 @@ ssh_add_identity(AuthenticationConnection * connection, RSA * key,
  * meant to be used by normal applications.  This returns true if the
  * identity was successfully added.
  */
-int     ssh_remove_identity(AuthenticationConnection * connection, RSA * key);
+int     ssh_remove_identity(AuthenticationConnection *auth, Key *key);
 
 /*
  * Removes all identities from the authentication agent.  This call is not
  * meant to be used by normal applications.  This returns true if the
  * operation was successful.
  */
-int     ssh_remove_all_identities(AuthenticationConnection * connection);
-
-/* Closes the connection to the authentication agent. */
-void    ssh_close_authentication(AuthenticationConnection * connection);
+int     ssh_remove_all_identities(AuthenticationConnection *auth, int version);
 
 #endif				/* AUTHFD_H */
diff --git a/crypto/openssh/authfile.h b/crypto/openssh/authfile.h
index afec27d..4283d93 100644
--- a/crypto/openssh/authfile.h
+++ b/crypto/openssh/authfile.h
@@ -1,3 +1,15 @@
+/*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ * Functions to interface with the SSH_AUTHENTICATION_FD socket.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
 #ifndef AUTHFILE_H
 #define AUTHFILE_H
 
@@ -18,9 +30,8 @@ save_private_key(const char *filename, const char *passphrase,
  * comment of the key is returned in comment_return if it is non-NULL; the
  * caller must free the value with xfree.
  */
-int
-load_public_key(const char *filename, Key * pub,
-    char **comment_return);
+int load_public_key(const char *filename, Key * pub, char **comment_return);
+int try_load_public_key(const char *filename, Key * pub, char **comment_return);
 
 /*
  * Loads the private key from the file.  Returns 0 if an error is encountered
diff --git a/crypto/openssh/bufaux.h b/crypto/openssh/bufaux.h
index 8ba92f8..4f53858 100644
--- a/crypto/openssh/bufaux.h
+++ b/crypto/openssh/bufaux.h
@@ -1,17 +1,16 @@
 /*
- *
- * bufaux.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
  *
- * Created: Wed Mar 29 02:18:23 1995 ylo
- *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: bufaux.h,v 1.6 2000/04/14 10:30:30 markus Exp $"); */
+/* RCSID("$OpenBSD: bufaux.h,v 1.8 2000/09/07 20:27:50 deraadt Exp $"); */
 
 #ifndef BUFAUX_H
 #define BUFAUX_H
diff --git a/crypto/openssh/buffer.c b/crypto/openssh/buffer.c
index 4d83433..d993c8b 100644
--- a/crypto/openssh/buffer.c
+++ b/crypto/openssh/buffer.c
@@ -1,20 +1,18 @@
 /*
- *
- * buffer.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Sat Mar 18 04:15:33 1995 ylo
- *
  * Functions for manipulating fifo buffers (that can grow if needed).
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: buffer.c,v 1.6 2000/04/14 10:30:30 markus Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.8 2000/09/07 20:27:50 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
diff --git a/crypto/openssh/buffer.h b/crypto/openssh/buffer.h
index be4fdc3..522036a 100644
--- a/crypto/openssh/buffer.h
+++ b/crypto/openssh/buffer.h
@@ -1,19 +1,17 @@
 /*
- *
- * buffer.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Sat Mar 18 04:12:25 1995 ylo
- *
  * Code for manipulating FIFO buffers.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: buffer.h,v 1.4 2000/04/14 10:30:30 markus Exp $"); */
+/* RCSID("$OpenBSD: buffer.h,v 1.6 2000/09/07 20:27:50 deraadt Exp $"); */
 
 #ifndef BUFFER_H
 #define BUFFER_H
diff --git a/crypto/openssh/channels.c b/crypto/openssh/channels.c
index 871dcb8..e9a64d9 100644
--- a/crypto/openssh/channels.c
+++ b/crypto/openssh/channels.c
@@ -1,29 +1,51 @@
 /*
- *
- * channels.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Fri Mar 24 16:35:24 1995 ylo
- *
  * This file contains functions for generic socket connection forwarding.
  * There is also code for initiating connection forwarding for X11 connections,
  * arbitrary tcp/ip connections, and the authentication agent connection.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ *
+ *
  * SSH2 support added by Markus Friedl.
+ * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
+ * Copyright (c) 1999 Dug Song.  All rights reserved.
+ * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$Id: channels.c,v 1.59 2000/05/30 17:23:36 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.68 2000/09/07 20:40:29 markus Exp $");
 
 #include "ssh.h"
 #include "packet.h"
 #include "xmalloc.h"
 #include "buffer.h"
-#include "authfd.h"
 #include "uidswap.h"
 #include "readconf.h"
 #include "servconf.h"
@@ -34,18 +56,17 @@ RCSID("$Id: channels.c,v 1.59 2000/05/30 17:23:36 markus Exp $");
 
 #include "ssh2.h"
 
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include "key.h"
+#include "authfd.h"
+
 /* Maximum number of fake X11 displays to try. */
 #define MAX_DISPLAYS  1000
 
 /* Max len of agent socket */
 #define MAX_SOCKET_NAME 100
 
-/* default window/packet sizes for tcp/x11-fwd-channel */
-#define CHAN_TCP_WINDOW_DEFAULT	(8*1024)
-#define CHAN_TCP_PACKET_DEFAULT	(CHAN_TCP_WINDOW_DEFAULT/2)
-#define CHAN_X11_WINDOW_DEFAULT	(4*1024)
-#define CHAN_X11_PACKET_DEFAULT	(CHAN_X11_WINDOW_DEFAULT/2)
-
 /*
  * Pointer to an array containing all allocated channels.  The array is
  * dynamically extended as needed.
@@ -135,7 +156,7 @@ Channel *
 channel_lookup(int id)
 {
 	Channel *c;
-	if (id < 0 && id > channels_alloc) {
+	if (id < 0 || id > channels_alloc) {
 		log("channel_lookup: %d: bad id", id);
 		return NULL;
 	}
@@ -240,6 +261,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	c->cb_arg = NULL;
 	c->cb_event = 0;
 	c->dettach_user = NULL;
+	c->input_filter = NULL;
 	debug("channel %d: new [%s]", found, remote_name);
 	return found;
 }
@@ -661,7 +683,14 @@ channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 			}
 			return -1;
 		}
-		buffer_append(&c->input, buf, len);
+		if(c->input_filter != NULL) {
+			if (c->input_filter(c, buf, len) == -1) {
+				debug("filter stops channel %d", c->self);
+				chan_read_failed(c);
+			}
+		} else {
+			buffer_append(&c->input, buf, len);
+		}
 	}
 	return 1;
 }
@@ -932,7 +961,6 @@ channel_output_poll()
 				packet_send();
 				buffer_consume(&c->input, len);
 				c->remote_window -= len;
-				debug("channel %d: send data len %d", c->self, len);
 			}
 		} else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
 			if (compat13)
@@ -2250,6 +2278,16 @@ channel_cancel_cleanup(int id)
 	}
 	c->dettach_user = NULL;
 }
+void   
+channel_register_filter(int id, channel_filter_fn *fn)
+{
+	Channel *c = channel_lookup(id);
+	if (c == NULL) {
+		log("channel_register_filter: %d: bad id", id);
+		return;
+	}
+	c->input_filter = fn;
+}
 
 void
 channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
@@ -2261,7 +2299,7 @@ channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
 	channel_register_fds(c, rfd, wfd, efd, extusage);
 	c->type = SSH_CHANNEL_OPEN;
 	/* XXX window size? */
-	c->local_window = c->local_window_max = c->local_maxpacket/2;
+	c->local_window = c->local_window_max = c->local_maxpacket * 2;
 	packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 	packet_put_int(c->remote_id);
 	packet_put_int(c->local_window);
diff --git a/crypto/openssh/channels.h b/crypto/openssh/channels.h
index 4cafdb9..c0d6019 100644
--- a/crypto/openssh/channels.h
+++ b/crypto/openssh/channels.h
@@ -1,4 +1,38 @@
-/* RCSID("$Id: channels.h,v 1.13 2000/05/30 17:23:37 markus Exp $"); */
+/*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/* RCSID("$OpenBSD: channels.h,v 1.19 2000/09/07 21:13:37 markus Exp $"); */
 
 #ifndef CHANNELS_H
 #define CHANNELS_H
@@ -21,9 +55,13 @@
  * Data structure for channel data.  This is iniailized in channel_allocate
  * and cleared in channel_free.
  */
+struct Channel;
+typedef struct Channel Channel;
+
 typedef void channel_callback_fn(int id, void *arg);
+typedef int channel_filter_fn(struct Channel *c, char *buf, int len);
 
-typedef struct Channel {
+struct Channel {
 	int     type;		/* channel type/state */
 	int     self;		/* my own channel identifier */
 	int     remote_id;	/* channel identifier for remote peer */
@@ -61,18 +99,31 @@ typedef struct Channel {
 	void	*cb_arg;
 	int	cb_event;
 	channel_callback_fn	*dettach_user;
-}       Channel;
+
+	/* filter */
+	channel_filter_fn	*input_filter;
+};
 
 #define CHAN_EXTENDED_IGNORE		0
 #define CHAN_EXTENDED_READ		1
 #define CHAN_EXTENDED_WRITE		2
 
+/* default window/packet sizes for tcp/x11-fwd-channel */
+#define CHAN_SES_WINDOW_DEFAULT	(32*1024)
+#define CHAN_SES_PACKET_DEFAULT	(CHAN_SES_WINDOW_DEFAULT/2)
+#define CHAN_TCP_WINDOW_DEFAULT	(32*1024)
+#define CHAN_TCP_PACKET_DEFAULT	(CHAN_TCP_WINDOW_DEFAULT/2)
+#define CHAN_X11_WINDOW_DEFAULT	(4*1024)
+#define CHAN_X11_PACKET_DEFAULT	(CHAN_X11_WINDOW_DEFAULT/2)
+
+
 void	channel_set_fds(int id, int rfd, int wfd, int efd, int extusage);
 void	channel_open(int id);
 void	channel_request(int id, char *service, int wantconfirm);
 void	channel_request_start(int id, char *service, int wantconfirm);
 void	channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg);
 void	channel_register_cleanup(int id, channel_callback_fn *fn);
+void	channel_register_filter(int id, channel_filter_fn *fn);
 void	channel_cancel_cleanup(int id);
 Channel	*channel_lookup(int id);
 
diff --git a/crypto/openssh/clientloop.c b/crypto/openssh/clientloop.c
index b4c7b28..4f5c39c 100644
--- a/crypto/openssh/clientloop.c
+++ b/crypto/openssh/clientloop.c
@@ -1,28 +1,70 @@
 /*
- *
- * clientloop.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
+ * The main loop for the interactive session (client side).
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  *
- * Created: Sat Sep 23 12:23:57 1995 ylo
  *
- * The main loop for the interactive session (client side).
+ * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
  *
  * SSH2 support added by Markus Friedl.
+ * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$Id: clientloop.c,v 1.26 2000/05/08 17:42:24 markus Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.34 2000/09/07 20:40:30 markus Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
 #include "packet.h"
 #include "buffer.h"
-#include "authfd.h"
 #include "readconf.h"
 
 #include "ssh2.h"
@@ -30,6 +72,8 @@ RCSID("$Id: clientloop.c,v 1.26 2000/05/08 17:42:24 markus Exp $");
 #include "channels.h"
 #include "dispatch.h"
 
+#include "buffer.h"
+#include "bufaux.h"
 
 /* Flag indicating that stdin should be redirected from /dev/null. */
 extern int stdin_null_flag;
@@ -62,6 +106,8 @@ static int in_raw_mode = 0;
 static int in_non_blocking_mode = 0;
 
 /* Common data for the client loop code. */
+static int quit_pending;	/* Set to non-zero to quit the client loop. */
+static int escape_char;		/* Escape character. */
 static int escape_pending;	/* Last character was the escape character */
 static int last_was_cr;		/* Last character was a newline. */
 static int exit_status;		/* Used to store the exit status of the command. */
@@ -69,13 +115,11 @@ static int stdin_eof;		/* EOF has been encountered on standard error. */
 static Buffer stdin_buffer;	/* Buffer for stdin data. */
 static Buffer stdout_buffer;	/* Buffer for stdout data. */
 static Buffer stderr_buffer;	/* Buffer for stderr data. */
+static unsigned long stdin_bytes, stdout_bytes, stderr_bytes;
 static unsigned int buffer_high;/* Soft max buffer size. */
 static int max_fd;		/* Maximum file descriptor number in select(). */
 static int connection_in;	/* Connection to server (input). */
 static int connection_out;	/* Connection to server (output). */
-static unsigned long stdin_bytes, stdout_bytes, stderr_bytes;
-static int quit_pending;	/* Set to non-zero to quit the client loop. */
-static int escape_char;		/* Escape character. */
 
 
 void	client_init_dispatch(void);
@@ -381,17 +425,15 @@ client_wait_until_can_do_something(fd_set * readset, fd_set * writeset)
 }
 
 void
-client_suspend_self()
+client_suspend_self(Buffer *bin, Buffer *bout, Buffer *berr)
 {
 	struct winsize oldws, newws;
 
 	/* Flush stdout and stderr buffers. */
-	if (buffer_len(&stdout_buffer) > 0)
-		atomicio(write, fileno(stdout), buffer_ptr(&stdout_buffer),
-		    buffer_len(&stdout_buffer));
-	if (buffer_len(&stderr_buffer) > 0)
-		atomicio(write, fileno(stderr), buffer_ptr(&stderr_buffer),
-		    buffer_len(&stderr_buffer));
+	if (buffer_len(bout) > 0)
+		atomicio(write, fileno(stdout), buffer_ptr(bout), buffer_len(bout));
+	if (buffer_len(berr) > 0)
+		atomicio(write, fileno(stderr), buffer_ptr(berr), buffer_len(berr));
 
 	leave_raw_mode();
 
@@ -399,9 +441,9 @@ client_suspend_self()
 	 * Free (and clear) the buffer to reduce the amount of data that gets
 	 * written to swap.
 	 */
-	buffer_free(&stdin_buffer);
-	buffer_free(&stdout_buffer);
-	buffer_free(&stderr_buffer);
+	buffer_free(bin);
+	buffer_free(bout);
+	buffer_free(berr);
 
 	/* Save old window size. */
 	ioctl(fileno(stdin), TIOCGWINSZ, &oldws);
@@ -418,9 +460,9 @@ client_suspend_self()
 		received_window_change_signal = 1;
 
 	/* OK, we have been continued by the user. Reinitialize buffers. */
-	buffer_init(&stdin_buffer);
-	buffer_init(&stdout_buffer);
-	buffer_init(&stderr_buffer);
+	buffer_init(bin);
+	buffer_init(bout);
+	buffer_init(berr);
 
 	enter_raw_mode();
 }
@@ -468,12 +510,155 @@ client_process_net_input(fd_set * readset)
 	}
 }
 
+/* process the characters one by one */
+int
+process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
+{
+	char string[1024];
+	pid_t pid;
+	int bytes = 0;
+	unsigned int i;
+	unsigned char ch;
+	char *s;
+
+	for (i = 0; i < len; i++) {
+		/* Get one character at a time. */
+		ch = buf[i];
+
+		if (escape_pending) {
+			/* We have previously seen an escape character. */
+			/* Clear the flag now. */
+			escape_pending = 0;
+
+			/* Process the escaped character. */
+			switch (ch) {
+			case '.':
+				/* Terminate the connection. */
+				snprintf(string, sizeof string, "%c.\r\n", escape_char);
+				buffer_append(berr, string, strlen(string));
+				/*stderr_bytes += strlen(string); XXX*/
+
+				quit_pending = 1;
+				return -1;
+
+			case 'Z' - 64:
+				/* Suspend the program. */
+				/* Print a message to that effect to the user. */
+				snprintf(string, sizeof string, "%c^Z [suspend ssh]\r\n", escape_char);
+				buffer_append(berr, string, strlen(string));
+				/*stderr_bytes += strlen(string); XXX*/
+
+				/* Restore terminal modes and suspend. */
+				client_suspend_self(bin, bout, berr);
+
+				/* We have been continued. */
+				continue;
+
+			case '&':
+				/* XXX does not work yet with proto 2 */
+				if (compat20)
+					continue;
+				/*
+				 * Detach the program (continue to serve connections,
+				 * but put in background and no more new connections).
+				 */
+				if (!stdin_eof) {
+					/*
+					 * Sending SSH_CMSG_EOF alone does not always appear
+					 * to be enough.  So we try to send an EOF character
+					 * first.
+					 */
+					packet_start(SSH_CMSG_STDIN_DATA);
+					packet_put_string("\004", 1);
+					packet_send();
+					/* Close stdin. */
+					stdin_eof = 1;
+					if (buffer_len(bin) == 0) {
+						packet_start(SSH_CMSG_EOF);
+						packet_send();
+					}
+				}
+				/* Restore tty modes. */
+				leave_raw_mode();
+
+				/* Stop listening for new connections. */
+				channel_stop_listening();
+
+				printf("%c& [backgrounded]\n", escape_char);
+
+				/* Fork into background. */
+				pid = fork();
+				if (pid < 0) {
+					error("fork: %.100s", strerror(errno));
+					continue;
+				}
+				if (pid != 0) {	/* This is the parent. */
+					/* The parent just exits. */
+					exit(0);
+				}
+				/* The child continues serving connections. */
+				continue; /*XXX ? */
+
+			case '?':
+				snprintf(string, sizeof string,
+"%c?\r\n\
+Supported escape sequences:\r\n\
+~.  - terminate connection\r\n\
+~^Z - suspend ssh\r\n\
+~#  - list forwarded connections\r\n\
+~&  - background ssh (when waiting for connections to terminate)\r\n\
+~?  - this message\r\n\
+~~  - send the escape character by typing it twice\r\n\
+(Note that escapes are only recognized immediately after newline.)\r\n",
+					 escape_char);
+				buffer_append(berr, string, strlen(string));
+				continue;
+
+			case '#':
+				snprintf(string, sizeof string, "%c#\r\n", escape_char);
+				buffer_append(berr, string, strlen(string));
+				s = channel_open_message();
+				buffer_append(berr, s, strlen(s));
+				xfree(s);
+				continue;
+
+			default:
+				if (ch != escape_char) {
+					buffer_put_char(bin, escape_char);
+					bytes++;
+				}
+				/* Escaped characters fall through here */
+				break;
+			}
+		} else {
+			/*
+			 * The previous character was not an escape char. Check if this
+			 * is an escape.
+			 */
+			if (last_was_cr && ch == escape_char) {
+				/* It is. Set the flag and continue to next character. */
+				escape_pending = 1;
+				continue;
+			}
+		}
+
+		/*
+		 * Normal character.  Record whether it was a newline,
+		 * and append it to the buffer.
+		 */
+		last_was_cr = (ch == '\r' || ch == '\n');
+		buffer_put_char(bin, ch);
+		bytes++;
+	}
+	return bytes;
+}
+
 void
 client_process_input(fd_set * readset)
 {
+	int ret;
 	int len;
-	pid_t pid;
-	char buf[8192], *s;
+	char buf[8192];
 
 	/* Read input from stdin. */
 	if (FD_ISSET(fileno(stdin), readset)) {
@@ -515,145 +700,10 @@ client_process_input(fd_set * readset)
 			 * Normal, successful read.  But we have an escape character
 			 * and have to process the characters one by one.
 			 */
-			unsigned int i;
-			for (i = 0; i < len; i++) {
-				unsigned char ch;
-				/* Get one character at a time. */
-				ch = buf[i];
-
-				if (escape_pending) {
-					/* We have previously seen an escape character. */
-					/* Clear the flag now. */
-					escape_pending = 0;
-					/* Process the escaped character. */
-					switch (ch) {
-					case '.':
-						/* Terminate the connection. */
-						snprintf(buf, sizeof buf, "%c.\r\n", escape_char);
-						buffer_append(&stderr_buffer, buf, strlen(buf));
-						stderr_bytes += strlen(buf);
-						quit_pending = 1;
-						return;
-
-					case 'Z' - 64:
-						/* Suspend the program. */
-						/* Print a message to that effect to the user. */
-						snprintf(buf, sizeof buf, "%c^Z\r\n", escape_char);
-						buffer_append(&stderr_buffer, buf, strlen(buf));
-						stderr_bytes += strlen(buf);
-
-						/* Restore terminal modes and suspend. */
-						client_suspend_self();
-
-						/* We have been continued. */
-						continue;
-
-					case '&':
-						/*
-						 * Detach the program (continue to serve connections,
-						 * but put in background and no more new connections).
-						 */
-						if (!stdin_eof) {
-							/*
-							 * Sending SSH_CMSG_EOF alone does not always appear
-							 * to be enough.  So we try to send an EOF character
-							 * first.
-							 */
-							packet_start(SSH_CMSG_STDIN_DATA);
-							packet_put_string("\004", 1);
-							packet_send();
-							/* Close stdin. */
-							stdin_eof = 1;
-							if (buffer_len(&stdin_buffer) == 0) {
-								packet_start(SSH_CMSG_EOF);
-								packet_send();
-							}
-						}
-						/* Restore tty modes. */
-						leave_raw_mode();
-
-						/* Stop listening for new connections. */
-						channel_stop_listening();
-
-						printf("%c& [backgrounded]\n", escape_char);
-
-						/* Fork into background. */
-						pid = fork();
-						if (pid < 0) {
-							error("fork: %.100s", strerror(errno));
-							continue;
-						}
-						if (pid != 0) {	/* This is the parent. */
-							/* The parent just exits. */
-							exit(0);
-						}
-						/* The child continues serving connections. */
-						continue;
-
-					case '?':
-						snprintf(buf, sizeof buf,
-"%c?\r\n\
-Supported escape sequences:\r\n\
-~.  - terminate connection\r\n\
-~^Z - suspend ssh\r\n\
-~#  - list forwarded connections\r\n\
-~&  - background ssh (when waiting for connections to terminate)\r\n\
-~?  - this message\r\n\
-~~  - send the escape character by typing it twice\r\n\
-(Note that escapes are only recognized immediately after newline.)\r\n",
-							 escape_char);
-						buffer_append(&stderr_buffer, buf, strlen(buf));
-						continue;
-
-					case '#':
-						snprintf(buf, sizeof buf, "%c#\r\n", escape_char);
-						buffer_append(&stderr_buffer, buf, strlen(buf));
-						s = channel_open_message();
-						buffer_append(&stderr_buffer, s, strlen(s));
-						xfree(s);
-						continue;
-
-					default:
-						if (ch != escape_char) {
-							/*
-							 * Escape character followed by non-special character.
-							 * Append both to the input buffer.
-							 */
-							buf[0] = escape_char;
-							buf[1] = ch;
-							buffer_append(&stdin_buffer, buf, 2);
-							stdin_bytes += 2;
-							continue;
-						}
-						/*
-						 * Note that escape character typed twice
-						 * falls through here; the latter gets processed
-						 * as a normal character below.
-						 */
-						break;
-					}
-				} else {
-					/*
-					 * The previous character was not an escape char. Check if this
-					 * is an escape.
-					 */
-					if (last_was_cr && ch == escape_char) {
-						/* It is. Set the flag and continue to next character. */
-						escape_pending = 1;
-						continue;
-					}
-				}
-
-				/*
-				 * Normal character.  Record whether it was a newline,
-				 * and append it to the buffer.
-				 */
-				last_was_cr = (ch == '\r' || ch == '\n');
-				buf[0] = ch;
-				buffer_append(&stdin_buffer, buf, 1);
-				stdin_bytes += 1;
-				continue;
-			}
+			ret = process_escapes(&stdin_buffer, &stdout_buffer, &stderr_buffer, buf, len);
+			if (ret == -1)
+				return;
+			stdout_bytes += ret;
 		}
 	}
 }
@@ -724,6 +774,15 @@ client_process_buffered_input_packets()
 	dispatch_run(DISPATCH_NONBLOCK, &quit_pending);
 }
 
+/* scan buf[] for '~' before sending data to the peer */
+
+int
+simple_escape_filter(Channel *c, char *buf, int len)
+{
+	/* XXX we assume c->extended is writeable */
+	return process_escapes(&c->input, &c->output, &c->extended, buf, len);
+}
+
 /*
  * Implements the interactive session with the server.  This is called after
  * the user has been authenticated, and a command has been started on the
@@ -732,7 +791,7 @@ client_process_buffered_input_packets()
  */
 
 int
-client_loop(int have_pty, int escape_char_arg)
+client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 {
 	extern Options options;
 	double start_time, total_time;
@@ -778,10 +837,13 @@ client_loop(int have_pty, int escape_char_arg)
 	if (have_pty)
 		enter_raw_mode();
 
-	/* Check if we should immediately send of on stdin. */
+	/* Check if we should immediately send eof on stdin. */
 	if (!compat20)
 		client_check_initial_eof_on_stdin();
 
+	if (compat20 && escape_char != -1)
+		channel_register_filter(ssh2_chan_id, simple_escape_filter);
+
 	/* Main loop of the client for the interactive session mode. */
 	while (!quit_pending) {
 		fd_set readset, writeset;
@@ -992,8 +1054,8 @@ client_input_channel_open(int type, int plen)
 		sock = x11_connect_display();
 		if (sock >= 0) {
 			id = channel_new("x11", SSH_CHANNEL_X11_OPEN,
-			    sock, sock, -1, 4*1024, 32*1024, 0,
-			    xstrdup("x11"));
+			    sock, sock, -1, CHAN_X11_WINDOW_DEFAULT,
+			    CHAN_X11_PACKET_DEFAULT, 0, xstrdup("x11"));
 			c = channel_lookup(id);
 		}
 	}
diff --git a/crypto/openssh/compat.c b/crypto/openssh/compat.c
index 1dd0c39..eeb6e2e 100644
--- a/crypto/openssh/compat.c
+++ b/crypto/openssh/compat.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999 Markus Friedl.  All rights reserved.
+ * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -28,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: compat.c,v 1.14 2000/05/22 18:42:01 markus Exp $");
+RCSID("$OpenBSD: compat.c,v 1.23 2000/09/07 21:13:37 markus Exp $");
 
 #include "ssh.h"
 #include "packet.h"
@@ -63,8 +58,10 @@ compat_datafellows(const char *version)
 	} check[] = {
 		{"2.1.0",	SSH_BUG_SIGBLOB|SSH_BUG_HMAC},
 		{"2.0.1",	SSH_BUG_SIGBLOB|SSH_BUG_HMAC|SSH_BUG_PUBKEYAUTH|SSH_BUG_X11FWD},
+		{"2.",		SSH_BUG_HMAC|SSH_COMPAT_SESSIONID_ENCODING},
 		{NULL,		0}
 	};
+	/* process table, return first match */
 	for (i = 0; check[i].version; i++) {
 		len = strlen(check[i].version);
 		if (strlen(version) >= len &&
@@ -80,13 +77,13 @@ compat_datafellows(const char *version)
 int
 proto_spec(const char *spec)
 {
-	char *s, *p;
+	char *s, *p, *q;
 	int ret = SSH_PROTO_UNKNOWN;
 
 	if (spec == NULL)
 		return ret;
-	s = xstrdup(spec);
-	for ((p = strtok(s, SEP)); p; (p = strtok(NULL, SEP))) {
+	q = s = xstrdup(spec);
+	for ((p = strsep(&q, SEP)); p && *p != '\0'; (p = strsep(&q, SEP))) {
 		switch(atoi(p)) {
 		case 1:
 			if (ret == SSH_PROTO_UNKNOWN)
diff --git a/crypto/openssh/compat.h b/crypto/openssh/compat.h
index 9308a6d..5be188b 100644
--- a/crypto/openssh/compat.h
+++ b/crypto/openssh/compat.h
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -26,7 +21,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-/* RCSID("$Id: compat.h,v 1.7 2000/05/08 17:42:24 markus Exp $"); */
+/* RCSID("$OpenBSD: compat.h,v 1.10 2000/09/07 20:27:50 deraadt Exp $"); */
 
 #ifndef COMPAT_H
 #define COMPAT_H
@@ -40,6 +35,7 @@
 #define SSH_BUG_PUBKEYAUTH	0x02
 #define SSH_BUG_HMAC		0x04
 #define SSH_BUG_X11FWD		0x08
+#define SSH_COMPAT_SESSIONID_ENCODING		0x10
 
 void    enable_compat13(void);
 void    enable_compat20(void);
diff --git a/crypto/openssh/compress.c b/crypto/openssh/compress.c
index 86ccaa2..93266ed 100644
--- a/crypto/openssh/compress.c
+++ b/crypto/openssh/compress.c
@@ -1,20 +1,18 @@
 /*
- *
- * compress.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Wed Oct 25 22:12:46 1995 ylo
- *
  * Interface to packet compression for ssh.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: compress.c,v 1.7 2000/04/14 10:30:31 markus Exp $");
+RCSID("$OpenBSD: compress.c,v 1.9 2000/09/07 20:27:50 deraadt Exp $");
 
 #include "ssh.h"
 #include "buffer.h"
diff --git a/crypto/openssh/compress.h b/crypto/openssh/compress.h
index f975613..5757164 100644
--- a/crypto/openssh/compress.h
+++ b/crypto/openssh/compress.h
@@ -1,19 +1,17 @@
 /*
- *
- * compress.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Wed Oct 25 22:12:46 1995 ylo
- *
  * Interface to packet compression for ssh.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: compress.h,v 1.4 2000/04/14 10:30:31 markus Exp $"); */
+/* RCSID("$OpenBSD: compress.h,v 1.6 2000/09/07 20:27:50 deraadt Exp $"); */
 
 #ifndef COMPRESS_H
 #define COMPRESS_H
diff --git a/crypto/openssh/crc32.c b/crypto/openssh/crc32.c
index 42c99da..a4e1f27 100644
--- a/crypto/openssh/crc32.c
+++ b/crypto/openssh/crc32.c
@@ -1,55 +1,48 @@
 /*
- * The implementation here was originally done by Gary S. Brown.
- * I have borrowed the tables directly, and made some minor changes
- * to the crc32-function (including changing the interface).
- * //ylo
+ *  COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
+ *  code or tables extracted from it, as desired without restriction.
+ *
+ *  First, the polynomial itself and its table of feedback terms.  The
+ *  polynomial is
+ *  X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0
+ *
+ *  Note that we take it "backwards" and put the highest-order term in
+ *  the lowest-order bit.  The X^32 term is "implied"; the LSB is the
+ *  X^31 term, etc.  The X^0 term (usually shown as "+1") results in
+ *  the MSB being 1
+ *
+ *  Note that the usual hardware shift register implementation, which
+ *  is what we're using (we're merely optimizing it by doing eight-bit
+ *  chunks at a time) shifts bits into the lowest-order term.  In our
+ *  implementation, that means shifting towards the right.  Why do we
+ *  do it this way?  Because the calculated CRC must be transmitted in
+ *  order from highest-order term to lowest-order term.  UARTs transmit
+ *  characters in order from LSB to MSB.  By storing the CRC this way
+ *  we hand it to the UART in the order low-byte to high-byte; the UART
+ *  sends each low-bit to hight-bit; and the result is transmission bit
+ *  by bit from highest- to lowest-order term without requiring any bit
+ *  shuffling on our part.  Reception works similarly
+ *
+ *  The feedback terms table consists of 256, 32-bit entries.  Notes
+ *
+ *      The table can be generated at runtime if desired; code to do so
+ *      is shown later.  It might not be obvious, but the feedback
+ *      terms simply represent the results of eight shift/xor opera
+ *      tions for all combinations of data and CRC register values
+ *
+ *      The values must be right-shifted by eight bits by the "updcrc
+ *      logic; the shift must be unsigned (bring in zeroes).  On some
+ *      hardware you could probably optimize the shift in assembler by
+ *      using byte-swap instructions
+ *      polynomial $edb88320
  */
 
+
 #include "includes.h"
-RCSID("$Id: crc32.c,v 1.4 1999/11/24 00:26:01 deraadt Exp $");
+RCSID("$OpenBSD: crc32.c,v 1.7 2000/09/07 20:27:51 deraadt Exp $");
 
 #include "crc32.h"
 
-  /* ============================================================= */
-  /*  COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or       */
-  /*  code or tables extracted from it, as desired without restriction.     */
-  /*                                                                        */
-  /*  First, the polynomial itself and its table of feedback terms.  The    */
-  /*  polynomial is                                                         */
-  /*  X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0   */
-  /*                                                                        */
-  /*  Note that we take it "backwards" and put the highest-order term in    */
-  /*  the lowest-order bit.  The X^32 term is "implied"; the LSB is the     */
-  /*  X^31 term, etc.  The X^0 term (usually shown as "+1") results in      */
-  /*  the MSB being 1.                                                      */
-  /*                                                                        */
-  /*  Note that the usual hardware shift register implementation, which     */
-  /*  is what we're using (we're merely optimizing it by doing eight-bit    */
-  /*  chunks at a time) shifts bits into the lowest-order term.  In our     */
-  /*  implementation, that means shifting towards the right.  Why do we     */
-  /*  do it this way?  Because the calculated CRC must be transmitted in    */
-  /*  order from highest-order term to lowest-order term.  UARTs transmit   */
-  /*  characters in order from LSB to MSB.  By storing the CRC this way,    */
-  /*  we hand it to the UART in the order low-byte to high-byte; the UART   */
-  /*  sends each low-bit to hight-bit; and the result is transmission bit   */
-  /*  by bit from highest- to lowest-order term without requiring any bit   */
-  /*  shuffling on our part.  Reception works similarly.                    */
-  /*                                                                        */
-  /*  The feedback terms table consists of 256, 32-bit entries.  Notes:     */
-  /*                                                                        */
-  /*      The table can be generated at runtime if desired; code to do so   */
-  /*      is shown later.  It might not be obvious, but the feedback        */
-  /*      terms simply represent the results of eight shift/xor opera-      */
-  /*      tions for all combinations of data and CRC register values.       */
-  /*                                                                        */
-  /*      The values must be right-shifted by eight bits by the "updcrc"    */
-  /*      logic; the shift must be unsigned (bring in zeroes).  On some     */
-  /*      hardware you could probably optimize the shift in assembler by    */
-  /*      using byte-swap instructions.                                     */
-  /*      polynomial $edb88320                                              */
-  /*                                                                        */
-  /*  --------------------------------------------------------------------  */
-
 static unsigned int crc32_tab[] = {
 	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
 	0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
@@ -108,7 +101,7 @@ static unsigned int crc32_tab[] = {
 /* Return a 32-bit CRC of the contents of the buffer. */
 
 unsigned int
-crc32(const unsigned char *s, unsigned int len)
+ssh_crc32(const unsigned char *s, unsigned int len)
 {
 	unsigned int i;
 	unsigned int crc32val;
diff --git a/crypto/openssh/crc32.h b/crypto/openssh/crc32.h
index 4176e8a..58c4fba 100644
--- a/crypto/openssh/crc32.h
+++ b/crypto/openssh/crc32.h
@@ -1,19 +1,17 @@
 /*
- *
- * crc32.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1992 Tatu Ylonen, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Tue Feb 11 14:37:27 1992 ylo
- *
  * Functions for computing 32-bit CRC.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: crc32.h,v 1.5 2000/04/14 10:30:31 markus Exp $"); */
+/* RCSID("$OpenBSD: crc32.h,v 1.8 2000/09/07 20:27:51 deraadt Exp $"); */
 
 #ifndef CRC32_H
 #define CRC32_H
@@ -22,6 +20,6 @@
  * This computes a 32 bit CRC of the data in the buffer, and returns the CRC.
  * The polynomial used is 0xedb88320.
  */
-unsigned int crc32(const unsigned char *buf, unsigned int len);
+unsigned int ssh_crc32(const unsigned char *buf, unsigned int len);
 
 #endif				/* CRC32_H */
diff --git a/crypto/openssh/deattack.c b/crypto/openssh/deattack.c
index 263e039..74a46c0 100644
--- a/crypto/openssh/deattack.c
+++ b/crypto/openssh/deattack.c
@@ -1,5 +1,6 @@
+/*	$OpenBSD: deattack.c,v 1.9 2000/09/07 20:27:51 deraadt Exp $	*/
+
 /*
- * $Id: deattack.c,v 1.6 1999/11/24 00:26:01 deraadt Exp $
  * Cryptographic attack detector for ssh - source code
  *
  * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
@@ -50,7 +51,7 @@ void
 crc_update(u_int32_t *a, u_int32_t b)
 {
 	b ^= *a;
-	*a = crc32((unsigned char *) &b, sizeof(b));
+	*a = ssh_crc32((unsigned char *) &b, sizeof(b));
 }
 
 /* detect if a block is used in a particular pattern */
diff --git a/crypto/openssh/dispatch.c b/crypto/openssh/dispatch.c
index 9b7def7..3daac20 100644
--- a/crypto/openssh/dispatch.c
+++ b/crypto/openssh/dispatch.c
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -27,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$Id: dispatch.c,v 1.2 2000/04/14 10:30:31 markus Exp $");
+RCSID("$OpenBSD: dispatch.c,v 1.4 2000/09/07 20:27:51 deraadt Exp $");
 #include "ssh.h"
 #include "dispatch.h"
 #include "packet.h"
diff --git a/crypto/openssh/dispatch.h b/crypto/openssh/dispatch.h
index 12084aa..dc9d3dd 100644
--- a/crypto/openssh/dispatch.h
+++ b/crypto/openssh/dispatch.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 enum {
 	DISPATCH_BLOCK,
 	DISPATCH_NONBLOCK
diff --git a/crypto/openssh/dsa.c b/crypto/openssh/dsa.c
index 51d7ff2..4ff4b58 100644
--- a/crypto/openssh/dsa.c
+++ b/crypto/openssh/dsa.c
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -28,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: dsa.c,v 1.7 2000/05/08 17:42:24 markus Exp $");
+RCSID("$OpenBSD: dsa.c,v 1.11 2000/09/07 20:27:51 deraadt Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
@@ -53,8 +48,7 @@ RCSID("$Id: dsa.c,v 1.7 2000/05/08 17:42:24 markus Exp $");
 #define SIGBLOB_LEN	(2*INTBLOB_LEN)
 
 Key *
-dsa_key_from_blob(
-    char *blob, int blen)
+dsa_key_from_blob(char *blob, int blen)
 {
 	Buffer b;
 	char *ktype;
@@ -66,16 +60,17 @@ dsa_key_from_blob(
 	dump_base64(stderr, blob, blen);
 #endif
 	/* fetch & parse DSA/DSS pubkey */
-	key = key_new(KEY_DSA);
-	dsa = key->dsa;
 	buffer_init(&b);
 	buffer_append(&b, blob, blen);
 	ktype = buffer_get_string(&b, NULL);
 	if (strcmp(KEX_DSS, ktype) != 0) {
-		error("dsa_key_from_blob: cannot handle type  %s", ktype);
-		key_free(key);
+		error("dsa_key_from_blob: cannot handle type %s", ktype);
+		buffer_free(&b);
+		xfree(ktype);
 		return NULL;
 	}
+	key = key_new(KEY_DSA);
+	dsa = key->dsa;
 	buffer_get_bignum2(&b, dsa->p);
 	buffer_get_bignum2(&b, dsa->q);
 	buffer_get_bignum2(&b, dsa->g);
@@ -84,8 +79,8 @@ dsa_key_from_blob(
 	if(rlen != 0)
 		error("dsa_key_from_blob: remaining bytes in key blob %d", rlen);
 	buffer_free(&b);
+	xfree(ktype);
 
-	debug("keytype %s", ktype);
 #ifdef DEBUG_DSS
 	DSA_print_fp(stderr, dsa, 8);
 #endif
@@ -197,7 +192,6 @@ dsa_verify(
 	DSA_SIG *sig;
 	EVP_MD *evp_md = EVP_sha1();
 	EVP_MD_CTX md;
-	char *ktype;
 	unsigned char *sigblob;
 	char *txt;
 	unsigned int len;
@@ -227,14 +221,24 @@ dsa_verify(
 		len = signaturelen;
 	} else {
 		/* ietf-drafts */
+		char *ktype;
 		buffer_init(&b);
 		buffer_append(&b, (char *) signature, signaturelen);
 		ktype = buffer_get_string(&b, NULL);
+		if (strcmp(KEX_DSS, ktype) != 0) {
+			error("dsa_verify: cannot handle type %s", ktype);
+			buffer_free(&b);
+			return -1;
+		}
 		sigblob = (unsigned char *)buffer_get_string(&b, &len);
 		rlen = buffer_len(&b);
-		if(rlen != 0)
+		if(rlen != 0) {
 			error("remaining bytes in signature %d", rlen);
+			buffer_free(&b);
+			return -1;
+		}
 		buffer_free(&b);
+		xfree(ktype);
 	}
 
 	if (len != SIGBLOB_LEN) {
diff --git a/crypto/openssh/dsa.h b/crypto/openssh/dsa.h
index 3cece7c..252e788 100644
--- a/crypto/openssh/dsa.h
+++ b/crypto/openssh/dsa.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #ifndef DSA_H
 #define DSA_H
 
diff --git a/crypto/openssh/getput.h b/crypto/openssh/getput.h
index e1aa9bb..19ff5e1 100644
--- a/crypto/openssh/getput.h
+++ b/crypto/openssh/getput.h
@@ -1,19 +1,17 @@
 /*
- *
- * getput.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Wed Jun 28 22:36:30 1995 ylo
- *
  * Macros for storing and retrieving data in msb first and lsb first order.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: getput.h,v 1.3 2000/04/14 10:30:31 markus Exp $"); */
+/* RCSID("$OpenBSD: getput.h,v 1.5 2000/09/07 20:27:51 deraadt Exp $"); */
 
 #ifndef GETPUT_H
 #define GETPUT_H
diff --git a/crypto/openssh/hmac.c b/crypto/openssh/hmac.c
index fe53aa4..48a1763 100644
--- a/crypto/openssh/hmac.c
+++ b/crypto/openssh/hmac.c
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -28,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: hmac.c,v 1.2 2000/04/12 09:39:10 markus Exp $");
+RCSID("$OpenBSD: hmac.c,v 1.4 2000/09/07 20:27:51 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
diff --git a/crypto/openssh/hmac.h b/crypto/openssh/hmac.h
index fb68029..281300e 100644
--- a/crypto/openssh/hmac.h
+++ b/crypto/openssh/hmac.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #ifndef HMAC_H
 #define HMAC_H
 
diff --git a/crypto/openssh/hostfile.h b/crypto/openssh/hostfile.h
index c9bdd7f..9c2353b 100644
--- a/crypto/openssh/hostfile.h
+++ b/crypto/openssh/hostfile.h
@@ -1,3 +1,14 @@
+/*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
 #ifndef HOSTFILE_H
 #define HOSTFILE_H
 
diff --git a/crypto/openssh/kex.c b/crypto/openssh/kex.c
index a6c8174..8a83db4 100644
--- a/crypto/openssh/kex.c
+++ b/crypto/openssh/kex.c
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -28,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: kex.c,v 1.7 2000/05/25 20:45:20 markus Exp $");
+RCSID("$OpenBSD: kex.c,v 1.10 2000/09/07 20:27:51 deraadt Exp $");
 
 #include "ssh.h"
 #include "ssh2.h"
@@ -287,13 +282,14 @@ char *
 get_match(char *client, char *server)
 {
 	char *sproposals[MAX_PROP];
-	char *c, *s, *p, *ret;
+	char *c, *s, *p, *ret, *cp, *sp;
 	int i, j, nproposals;
 
-	c = xstrdup(client);
-	s = xstrdup(server);
+	c = cp = xstrdup(client);
+	s = sp = xstrdup(server);
 
-	for ((p = strtok(s, SEP)), i=0; p; (p = strtok(NULL, SEP)), i++) {
+	for ((p = strsep(&sp, SEP)), i=0; p && *p != '\0'; 
+	     (p = strsep(&sp, SEP)), i++) {
 		if (i < MAX_PROP)
 			sproposals[i] = p;
 		else
@@ -301,7 +297,8 @@ get_match(char *client, char *server)
 	}
 	nproposals = i;
 
-	for ((p = strtok(c, SEP)), i=0; p; (p = strtok(NULL, SEP)), i++) {
+	for ((p = strsep(&cp, SEP)), i=0; p && *p != '\0'; 
+	     (p = strsep(&cp, SEP)), i++) {
 		for (j = 0; j < nproposals; j++) {
 			if (strcmp(p, sproposals[j]) == 0) {
 				ret = xstrdup(p);
diff --git a/crypto/openssh/kex.h b/crypto/openssh/kex.h
index 7e5c670..8c89687 100644
--- a/crypto/openssh/kex.h
+++ b/crypto/openssh/kex.h
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
diff --git a/crypto/openssh/key.h b/crypto/openssh/key.h
index ed3f770..8e1e0a9 100644
--- a/crypto/openssh/key.h
+++ b/crypto/openssh/key.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #ifndef KEY_H
 #define KEY_H
 
@@ -19,7 +42,7 @@ int	key_equal(Key *a, Key *b);
 char	*key_fingerprint(Key *k);
 char	*key_type(Key *k);
 int	key_write(Key *key, FILE *f);
-unsigned int
-key_read(Key *key, char **cpp);
+unsigned int	key_read(Key *key, char **cpp);
+unsigned int	key_size(Key *k);
 
 #endif
diff --git a/crypto/openssh/lib/Makefile b/crypto/openssh/lib/Makefile
index aae1677..4bbe222 100644
--- a/crypto/openssh/lib/Makefile
+++ b/crypto/openssh/lib/Makefile
@@ -2,10 +2,10 @@
 
 LIB=	ssh
 SRCS=   authfd.c authfile.c bufaux.c buffer.c canohost.c channels.c \
-	cipher.c compat.c compress.c crc32.c deattack.c fingerprint.c \
+	cipher.c compat.c compress.c crc32.c deattack.c \
 	hostfile.c log.c match.c mpaux.c nchan.c packet.c readpass.c \
 	rsa.c tildexpand.c ttymodes.c uidswap.c xmalloc.c atomicio.c \
-	key.c dispatch.c dsa.c kex.c hmac.c uuencode.c aux.c
+	key.c dispatch.c dsa.c kex.c hmac.c uuencode.c util.c
 
 NOPROFILE= yes
 NOPIC=	yes
@@ -15,9 +15,9 @@ install:
 
 .include <bsd.own.mk>
 
-.if (${KERBEROS} == "yes")
+.if (${KERBEROS:L} == "yes")
 CFLAGS+= -DKRB4 -I${DESTDIR}/usr/include/kerberosIV
-.if (${AFS} == "yes")
+.if (${AFS:L} == "yes")
 CFLAGS+= -DAFS
 SRCS+=  radix.c
 .endif # AFS
diff --git a/crypto/openssh/log-client.c b/crypto/openssh/log-client.c
index 1e3c162..616d3d0 100644
--- a/crypto/openssh/log-client.c
+++ b/crypto/openssh/log-client.c
@@ -1,21 +1,42 @@
 /*
- *
- * log-client.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Mon Mar 20 21:13:40 1995 ylo
- *
  * Client-side versions of debug(), log(), etc.  These print to stderr.
  * This is a stripped down version of log-server.c.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ *
+ *
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$Id: log-client.c,v 1.8 2000/04/14 10:30:31 markus Exp $");
+RCSID("$OpenBSD: log-client.c,v 1.11 2000/09/07 20:27:51 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
@@ -57,6 +78,5 @@ do_log(LogLevel level, const char *fmt, va_list args)
 	if (level == SYSLOG_LEVEL_DEBUG)
 		fprintf(stderr, "debug: ");
 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
-	fprintf(stderr, "%s", msgbuf);
-	fprintf(stderr, "\r\n");
+	fprintf(stderr, "%s\r\n", msgbuf);
 }
diff --git a/crypto/openssh/log-server.c b/crypto/openssh/log-server.c
index 81ba673..11d650b 100644
--- a/crypto/openssh/log-server.c
+++ b/crypto/openssh/log-server.c
@@ -1,21 +1,42 @@
 /*
- *
- * log-server.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Mon Mar 20 21:19:30 1995 ylo
- *
  * Server-side versions of debug(), log(), etc.  These normally send the output
  * to the system log.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ *
+ *
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$Id: log-server.c,v 1.14 2000/04/14 10:30:31 markus Exp $");
+RCSID("$OpenBSD: log-server.c,v 1.16 2000/09/07 20:27:52 deraadt Exp $");
 
 #include <syslog.h>
 #include "packet.h"
diff --git a/crypto/openssh/log.c b/crypto/openssh/log.c
index 03038b2..a6d9e05 100644
--- a/crypto/openssh/log.c
+++ b/crypto/openssh/log.c
@@ -1,9 +1,42 @@
 /*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
+/*
  * Shared versions of debug(), log(), etc.
+ *
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: log.c,v 1.7 2000/01/04 00:07:59 markus Exp $");
+RCSID("$OpenBSD: log.c,v 1.9 2000/09/07 21:13:37 markus Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
diff --git a/crypto/openssh/match.c b/crypto/openssh/match.c
index 00dff8a..c373129 100644
--- a/crypto/openssh/match.c
+++ b/crypto/openssh/match.c
@@ -1,20 +1,18 @@
 /*
- *
- * match.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Thu Jun 22 01:17:50 1995 ylo
- *
  * Simple pattern matching, with '*' and '?' as wildcards.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: match.c,v 1.6 2000/04/14 10:30:31 markus Exp $");
+RCSID("$OpenBSD: match.c,v 1.9 2000/09/07 20:27:52 deraadt Exp $");
 
 #include "ssh.h"
 
@@ -84,8 +82,8 @@ match_pattern(const char *s, const char *pattern)
 /*
  * Tries to match the host name (which must be in all lowercase) against the
  * comma-separated sequence of subpatterns (each possibly preceded by ! to
- * indicate negation).  Returns true if there is a positive match; zero
- * otherwise.
+ * indicate negation).  Returns -1 if negation matches, 1 if there is
+ * a positive match, 0 if there is no match at all.
  */
 
 int
@@ -127,15 +125,15 @@ match_hostname(const char *host, const char *pattern, unsigned int len)
 		/* Try to match the subpattern against the host name. */
 		if (match_pattern(host, sub)) {
 			if (negated)
-				return 0;	/* Fail */
+				return -1;		/* Negative */
 			else
-				got_positive = 1;
+				got_positive = 1;	/* Positive */
 		}
 	}
 
 	/*
 	 * Return success if got a positive match.  If there was a negative
-	 * match, we have already returned zero and never get here.
+	 * match, we have already returned -1 and never get here.
 	 */
 	return got_positive;
 }
diff --git a/crypto/openssh/match.h b/crypto/openssh/match.h
index 4625d97..564f5ab 100644
--- a/crypto/openssh/match.h
+++ b/crypto/openssh/match.h
@@ -1,3 +1,16 @@
+/*
+ * Author: Tatu Ylonen <ylo@cs.hut.fi>
+ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+ *                    All rights reserved
+ * This file contains various auxiliary functions related to multiple
+ * precision integers.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
 #ifndef MATCH_H
 #define MATCH_H
 
@@ -10,8 +23,8 @@ int     match_pattern(const char *s, const char *pattern);
 /*
  * Tries to match the host name (which must be in all lowercase) against the
  * comma-separated sequence of subpatterns (each possibly preceded by ! to
- * indicate negation).  Returns true if there is a positive match; zero
- * otherwise.
+ * indicate negation).  Returns -1 if negation matches, 1 if there is
+ * a positive match, 0 if there is no match at all.
  */
 int     match_hostname(const char *host, const char *pattern, unsigned int len);
 
diff --git a/crypto/openssh/mpaux.h b/crypto/openssh/mpaux.h
index 671fc51..9de1727 100644
--- a/crypto/openssh/mpaux.h
+++ b/crypto/openssh/mpaux.h
@@ -1,19 +1,18 @@
 /*
- *
- * mpaux.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Sun Jul 16 04:29:30 1995 ylo
- *
  * This file contains various auxiliary functions related to multiple
  * precision integers.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: mpaux.h,v 1.6 2000/04/14 10:30:32 markus Exp $"); */
+/* RCSID("$OpenBSD: mpaux.h,v 1.8 2000/09/07 20:27:52 deraadt Exp $"); */
 
 #ifndef MPAUX_H
 #define MPAUX_H
diff --git a/crypto/openssh/myproposal.h b/crypto/openssh/myproposal.h
index 9611d89..18db954 100644
--- a/crypto/openssh/myproposal.h
+++ b/crypto/openssh/myproposal.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #define KEX_DEFAULT_KEX		"diffie-hellman-group1-sha1"
 #define	KEX_DEFAULT_PK_ALG	"ssh-dss"
 #define	KEX_DEFAULT_ENCRYPT	"3des-cbc,blowfish-cbc,arcfour,cast128-cbc"
diff --git a/crypto/openssh/nchan.c b/crypto/openssh/nchan.c
index fd92fe8..30c90b3 100644
--- a/crypto/openssh/nchan.c
+++ b/crypto/openssh/nchan.c
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -28,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: nchan.c,v 1.17 2000/05/08 17:44:54 markus Exp $");
+RCSID("$OpenBSD: nchan.c,v 1.19 2000/09/07 20:27:52 deraadt Exp $");
 
 #include "ssh.h"
 
diff --git a/crypto/openssh/nchan.h b/crypto/openssh/nchan.h
index 0a2cf35..366b894 100644
--- a/crypto/openssh/nchan.h
+++ b/crypto/openssh/nchan.h
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -27,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* RCSID("$Id: nchan.h,v 1.7 2000/04/03 07:07:15 markus Exp $"); */
+/* RCSID("$OpenBSD: nchan.h,v 1.9 2000/09/07 20:27:52 deraadt Exp $"); */
 
 #ifndef NCHAN_H
 #define NCHAN_H
diff --git a/crypto/openssh/nchan.ms b/crypto/openssh/nchan.ms
index eb49cd3..1679d39 100644
--- a/crypto/openssh/nchan.ms
+++ b/crypto/openssh/nchan.ms
@@ -9,11 +9,6 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"      This product includes software developed by Markus Friedl.
-.\" 4. The name of the author may not be used to endorse or promote products
-.\"    derived from this software without specific prior written permission.
 .\" 
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
diff --git a/crypto/openssh/packet.c b/crypto/openssh/packet.c
index 5fa76a3..670c0ed 100644
--- a/crypto/openssh/packet.c
+++ b/crypto/openssh/packet.c
@@ -1,23 +1,43 @@
 /*
- *
- * packet.c
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Sat Mar 18 02:40:40 1995 ylo
- *
  * This file contains code implementing the packet protocol and communication
  * with the other side.  This same code is used both on client and server side.
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ *
+ *
  * SSH2 packet format added by Markus Friedl.
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$Id: packet.c,v 1.32 2000/05/04 22:22:43 markus Exp $");
+RCSID("$OpenBSD: packet.c,v 1.35 2000/09/07 20:27:52 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -479,8 +499,8 @@ packet_send1()
 	buffer_consume(&outgoing_packet, 8 - padding);
 
 	/* Add check bytes. */
-	checksum = crc32((unsigned char *) buffer_ptr(&outgoing_packet),
-			 buffer_len(&outgoing_packet));
+	checksum = ssh_crc32((unsigned char *) buffer_ptr(&outgoing_packet),
+	    buffer_len(&outgoing_packet));
 	PUT_32BIT(buf, checksum);
 	buffer_append(&outgoing_packet, buf, 4);
 
@@ -764,7 +784,7 @@ packet_read_poll1(int *payload_len_ptr)
 #endif
 
 	/* Compute packet checksum. */
-	checksum = crc32((unsigned char *) buffer_ptr(&incoming_packet),
+	checksum = ssh_crc32((unsigned char *) buffer_ptr(&incoming_packet),
 	    buffer_len(&incoming_packet) - 4);
 
 	/* Skip padding. */
diff --git a/crypto/openssh/pty.h b/crypto/openssh/pty.h
index a5f9cb2..13d8e60 100644
--- a/crypto/openssh/pty.h
+++ b/crypto/openssh/pty.h
@@ -1,19 +1,18 @@
 /*
- *
- * pty.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
- * Created: Fri Mar 17 05:03:28 1995 ylo
- *
  * Functions for allocating a pseudo-terminal and making it the controlling
  * tty.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: pty.h,v 1.6 2000/04/14 10:30:32 markus Exp $"); */
+/* RCSID("$OpenBSD: pty.h,v 1.8 2000/09/07 20:27:52 deraadt Exp $"); */
 
 #ifndef PTY_H
 #define PTY_H
diff --git a/crypto/openssh/radix.c b/crypto/openssh/radix.c
index 0337733..8429204 100644
--- a/crypto/openssh/radix.c
+++ b/crypto/openssh/radix.c
@@ -1,12 +1,32 @@
 /*
- *   radix.c
+ * Copyright (c) 1999 Dug Song.  All rights reserved.
  *
- *   Dug Song <dugsong@UMICH.EDU>
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
 #include "uuencode.h"
 
+RCSID("$OpenBSD: radix.c,v 1.13 2000/09/07 20:27:52 deraadt Exp $");
+
 #ifdef AFS
 #include <krb.h>
 
diff --git a/crypto/openssh/readpass.c b/crypto/openssh/readpass.c
index 85d88f8..c38292f 100644
--- a/crypto/openssh/readpass.c
+++ b/crypto/openssh/readpass.c
@@ -32,7 +32,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: readpass.c,v 1.10 2000/04/14 10:30:32 markus Exp $");
+RCSID("$OpenBSD: readpass.c,v 1.11 2000/06/20 01:39:44 markus Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
diff --git a/crypto/openssh/scp.1 b/crypto/openssh/scp.1
index 51de6c5..4ef3fe5 100644
--- a/crypto/openssh/scp.1
+++ b/crypto/openssh/scp.1
@@ -9,7 +9,7 @@
 .\"
 .\" Created: Sun May  7 00:14:37 1995 ylo
 .\"
-.\" $Id: scp.1,v 1.7 2000/04/12 21:47:50 aaron Exp $
+.\" $Id: scp.1,v 1.10 2000/09/01 15:25:13 deraadt Exp $
 .\"
 .Dd September 25, 1999
 .Dt SCP 1
@@ -20,6 +20,7 @@
 .Sh SYNOPSIS
 .Nm scp
 .Op Fl pqrvC46
+.Op Fl S Ar program
 .Op Fl P Ar port
 .Op Fl c Ar cipher
 .Op Fl i Ar identity_file
@@ -98,6 +99,12 @@ because
 .Fl p
 is already reserved for preserving the times and modes of the file in
 .Xr rcp 1 .
+.It Fl S Ar program
+Name of
+.Ar program
+to use for the encrypted connection. The program must understand
+.Xr ssh 1
+options.
 .It Fl 4
 Forces
 .Nm
@@ -106,6 +113,7 @@ to use IPv4 addresses only.
 Forces
 .Nm
 to use IPv6 addresses only.
+.El
 .Sh AUTHORS
 Timo Rinne <tri@iki.fi> and Tatu Ylonen <ylo@cs.hut.fi>
 .Sh HISTORY
diff --git a/crypto/openssh/scp.c b/crypto/openssh/scp.c
index 491a789..ec1f3d1 100644
--- a/crypto/openssh/scp.c
+++ b/crypto/openssh/scp.c
@@ -1,16 +1,46 @@
 /*
+ * scp - secure remote copy.  This is basically patched BSD rcp which
+ * uses ssh to do the data transfer (instead of using rcmd).
  *
- * scp - secure remote copy.  This is basically patched BSD rcp which uses ssh
- * to do the data transfer (instead of using rcmd).
- *
- * NOTE: This version should NOT be suid root.  (This uses ssh to do the transfer
- * and ssh has the necessary privileges.)
+ * NOTE: This version should NOT be suid root.  (This uses ssh to
+ * do the transfer and ssh has the necessary privileges.)
  *
  * 1995 Timo Rinne <tri@iki.fi>, Tatu Ylonen <ylo@cs.hut.fi>
  *
-*/
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ */
+/*
+ * Copyright (c) 1999 Theo de Raadt. All rights reserved.
+ * Copyright (c) 1999 Aaron Campbell. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 
 /*
+ * Parts from:
+ *
  * Copyright (c) 1983, 1990, 1992, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
@@ -45,7 +75,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: scp.c,v 1.30 2000/05/02 18:21:48 deraadt Exp $");
+RCSID("$OpenBSD: scp.c,v 1.39 2000/09/07 20:53:00 markus Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
@@ -61,6 +91,7 @@ void progressmeter(int);
 
 /* Returns width of the terminal (for progress meter calculations). */
 int getttywidth(void);
+int do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout, int argc);
 
 /* Time a transfer started. */
 static struct timeval start;
@@ -103,6 +134,9 @@ char *identity = NULL;
 /* This is the port to use in contacting the remote site (is non-NULL). */
 char *port = NULL;
 
+/* This is the program to execute for the secured connection. ("ssh" or -S) */
+char *ssh_program = SSH_PROGRAM;
+
 /*
  * This function executes the given command as the specified user on the
  * given host.  This returns < 0 if execution fails, and >= 0 otherwise. This
@@ -110,13 +144,13 @@ char *port = NULL;
  */
 
 int
-do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout)
+do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout, int argc)
 {
 	int pin[2], pout[2], reserved[2];
 
 	if (verbose_mode)
 		fprintf(stderr, "Executing: host %s, user %s, command %s\n",
-			host, remuser ? remuser : "(unspecified)", cmd);
+		    host, remuser ? remuser : "(unspecified)", cmd);
 
 	/*
 	 * Reserve two descriptors so that the real pipes won't get
@@ -136,7 +170,7 @@ do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout)
 
 	/* For a child to execute the command on the remote host using ssh. */
 	if (fork() == 0) {
-		char *args[100];
+		char *args[100];	/* XXX careful */
 		unsigned int i;
 
 		/* Child. */
@@ -148,14 +182,13 @@ do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout)
 		close(pout[1]);
 
 		i = 0;
-		args[i++] = SSH_PROGRAM;
+		args[i++] = ssh_program;
 		args[i++] = "-x";
 		args[i++] = "-oFallBackToRsh no";
 		if (IPv4)
 			args[i++] = "-4";
 		if (IPv6)
 			args[i++] = "-6";
-		args[i++] = "-oFallBackToRsh no";
 		if (verbose_mode)
 			args[i++] = "-v";
 		if (compress)
@@ -182,8 +215,8 @@ do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout)
 		args[i++] = cmd;
 		args[i++] = NULL;
 
-		execvp(SSH_PROGRAM, args);
-		perror(SSH_PROGRAM);
+		execvp(ssh_program, args);
+		perror(ssh_program);
 		exit(1);
 	}
 	/* Parent.  Close the other side, and return the local side. */
@@ -207,8 +240,6 @@ fatal(const char *fmt,...)
 	exit(255);
 }
 
-/* This stuff used to be in BSD rcp extern.h. */
-
 typedef struct {
 	int cnt;
 	char *buf;
@@ -224,8 +255,6 @@ int okname(char *);
 void run_err(const char *,...);
 void verifydir(char *);
 
-/* Stuff from BSD rcp.c continues. */
-
 struct passwd *pwd;
 uid_t userid;
 int errs, remin, remout;
@@ -253,7 +282,7 @@ main(argc, argv)
 	extern int optind;
 
 	fflag = tflag = 0;
-	while ((ch = getopt(argc, argv, "dfprtvBCc:i:P:q46")) != EOF)
+	while ((ch = getopt(argc, argv, "dfprtvBCc:i:P:q46S:")) != EOF)
 		switch (ch) {
 		/* User-visible flags. */
 		case '4':
@@ -271,6 +300,10 @@ main(argc, argv)
 		case 'r':
 			iamrecursive = 1;
 			break;
+		case 'S':
+			ssh_program = optarg;
+			break;
+
 		/* Server options. */
 		case 'd':
 			targetshouldbedirectory = 1;
@@ -336,8 +369,8 @@ main(argc, argv)
 	remin = remout = -1;
 	/* Command to be executed on remote system using "ssh". */
 	(void) sprintf(cmd, "scp%s%s%s%s", verbose_mode ? " -v" : "",
-		       iamrecursive ? " -r" : "", pflag ? " -p" : "",
-		       targetshouldbedirectory ? " -d" : "");
+	    iamrecursive ? " -r" : "", pflag ? " -p" : "",
+	    targetshouldbedirectory ? " -d" : "");
 
 	(void) signal(SIGPIPE, lostconn);
 
@@ -394,9 +427,9 @@ toremote(targ, argc, argv)
 			if (*src == 0)
 				src = ".";
 			host = strchr(argv[i], '@');
-			len = strlen(SSH_PROGRAM) + strlen(argv[i]) +
-				strlen(src) + (tuser ? strlen(tuser) : 0) +
-				strlen(thost) + strlen(targ) + CMDNEEDS + 32;
+			len = strlen(ssh_program) + strlen(argv[i]) +
+			    strlen(src) + (tuser ? strlen(tuser) : 0) +
+			    strlen(thost) + strlen(targ) + CMDNEEDS + 32;
 			bp = xmalloc(len);
 			if (host) {
 				*host++ = 0;
@@ -407,19 +440,19 @@ toremote(targ, argc, argv)
 				else if (!okname(suser))
 					continue;
 				(void) sprintf(bp,
-					       "%s%s -x -o'FallBackToRsh no' -n -l %s %s %s %s '%s%s%s:%s'",
-					       SSH_PROGRAM, verbose_mode ? " -v" : "",
-					       suser, host, cmd, src,
-					       tuser ? tuser : "", tuser ? "@" : "",
-					       thost, targ);
+				    "%s%s -x -o'FallBackToRsh no' -n -l %s %s %s %s '%s%s%s:%s'",
+				     ssh_program, verbose_mode ? " -v" : "",
+				     suser, host, cmd, src,
+				     tuser ? tuser : "", tuser ? "@" : "",
+				     thost, targ);
 			} else {
 				host = cleanhostname(argv[i]);
 				(void) sprintf(bp,
-					       "exec %s%s -x -o'FallBackToRsh no' -n %s %s %s '%s%s%s:%s'",
-					       SSH_PROGRAM, verbose_mode ? " -v" : "",
-					       host, cmd, src,
-					       tuser ? tuser : "", tuser ? "@" : "",
-					       thost, targ);
+				    "exec %s%s -x -o'FallBackToRsh no' -n %s %s %s '%s%s%s:%s'",
+				     ssh_program, verbose_mode ? " -v" : "",
+				     host, cmd, src,
+				     tuser ? tuser : "", tuser ? "@" : "",
+				     thost, targ);
 			}
 			if (verbose_mode)
 				fprintf(stderr, "Executing: %s\n", bp);
@@ -431,8 +464,8 @@ toremote(targ, argc, argv)
 				bp = xmalloc(len);
 				(void) sprintf(bp, "%s -t %s", cmd, targ);
 				host = cleanhostname(thost);
-				if (do_cmd(host, tuser,
-					   bp, &remin, &remout) < 0)
+				if (do_cmd(host, tuser, bp, &remin,
+				    &remout, argc) < 0)
 					exit(1);
 				if (response() < 0)
 					exit(1);
@@ -454,11 +487,11 @@ tolocal(argc, argv)
 	for (i = 0; i < argc - 1; i++) {
 		if (!(src = colon(argv[i]))) {	/* Local to local. */
 			len = strlen(_PATH_CP) + strlen(argv[i]) +
-				     strlen(argv[argc - 1]) + 20;
+			    strlen(argv[argc - 1]) + 20;
 			bp = xmalloc(len);
 			(void) sprintf(bp, "exec %s%s%s %s %s", _PATH_CP,
-				       iamrecursive ? " -r" : "", pflag ? " -p" : "",
-				       argv[i], argv[argc - 1]);
+			    iamrecursive ? " -r" : "", pflag ? " -p" : "",
+			    argv[i], argv[argc - 1]);
 			if (verbose_mode)
 				fprintf(stderr, "Executing: %s\n", bp);
 			if (system(bp))
@@ -484,7 +517,7 @@ tolocal(argc, argv)
 		len = strlen(src) + CMDNEEDS + 20;
 		bp = xmalloc(len);
 		(void) sprintf(bp, "%s -f %s", cmd, src);
-		if (do_cmd(host, suser, bp, &remin, &remout) < 0) {
+		if (do_cmd(host, suser, bp, &remin, &remout, argc) < 0) {
 			(void) xfree(bp);
 			++errs;
 			continue;
@@ -541,8 +574,8 @@ syserr:			run_err("%s: %s", name, strerror(errno));
 			 * versions expecting microseconds.
 			 */
 			(void) sprintf(buf, "T%lu 0 %lu 0\n",
-				       (unsigned long) stb.st_mtime,
-				       (unsigned long) stb.st_atime);
+			    (unsigned long) stb.st_mtime,
+			    (unsigned long) stb.st_atime);
 			(void) atomicio(write, remout, buf, strlen(buf));
 			if (response() < 0)
 				goto next;
@@ -619,8 +652,8 @@ rsource(name, statp)
 		last++;
 	if (pflag) {
 		(void) sprintf(path, "T%lu 0 %lu 0\n",
-			       (unsigned long) statp->st_mtime,
-			       (unsigned long) statp->st_atime);
+		    (unsigned long) statp->st_mtime,
+		    (unsigned long) statp->st_atime);
 		(void) atomicio(write, remout, path, strlen(path));
 		if (response() < 0) {
 			closedir(dirp);
@@ -628,8 +661,7 @@ rsource(name, statp)
 		}
 	}
 	(void) sprintf(path, "D%04o %d %.1024s\n",
-		       (unsigned int) (statp->st_mode & FILEMODEMASK),
-		       0, last);
+	    (unsigned int) (statp->st_mode & FILEMODEMASK), 0, last);
 	if (verbose_mode)
 		fprintf(stderr, "Entering directory: %s", path);
 	(void) atomicio(write, remout, path, strlen(path));
@@ -668,7 +700,8 @@ sink(argc, argv)
 	BUF *bp;
 	off_t i, j;
 	int amt, count, exists, first, mask, mode, ofd, omode;
-	int setimes, size, targisdir, wrerrno = 0;
+	off_t size;
+	int setimes, targisdir, wrerrno = 0;
 	char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
 	struct utimbuf ut;
 	int dummy_usec;
@@ -776,7 +809,7 @@ sink(argc, argv)
 			if (need > cursize)
 				namebuf = xmalloc(need);
 			(void) sprintf(namebuf, "%s%s%s", targ,
-				       *targ ? "/" : "", cp);
+			    *targ ? "/" : "", cp);
 			np = namebuf;
 		} else
 			np = targ;
@@ -882,7 +915,10 @@ bad:			run_err("%s: %s", np, strerror(errno));
 					run_err("%s: set mode: %s",
 						np, strerror(errno));
 		}
-		(void) close(ofd);
+		if (close(ofd) == -1) {
+			wrerr = YES;
+			wrerrno = errno;
+		}
 		(void) response();
 		if (setimes && wrerr == NO) {
 			setimes = 0;
@@ -944,8 +980,9 @@ response()
 void
 usage()
 {
-	(void) fprintf(stderr,
-		       "usage: scp [-pqrvC46] [-P port] [-c cipher] [-i identity] f1 f2; or:\n       scp [options] f1 ... fn directory\n");
+	(void) fprintf(stderr, "usage: scp "
+	    "[-pqrvC46] [-S ssh] [-P port] [-c cipher] [-i identity] f1 f2; or:\n"
+	    "       scp [options] f1 ... fn directory\n");
 	exit(1);
 }
 
@@ -972,43 +1009,6 @@ run_err(const char *fmt,...)
 	va_end(ap);
 }
 
-/* Stuff below is from BSD rcp util.c. */
-
-/*-
- * Copyright (c) 1992, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	$Id: scp.c,v 1.30 2000/05/02 18:21:48 deraadt Exp $
- */
-
 char *
 colon(cp)
 	char *cp;
@@ -1085,7 +1085,7 @@ allocbuf(bp, fd, blksize)
 		size = blksize;
 	else
 		size = blksize + (stb.st_blksize - blksize % stb.st_blksize) %
-			stb.st_blksize;
+		    stb.st_blksize;
 	if (bp->cnt >= size)
 		return (bp);
 	if (bp->buf == NULL)
@@ -1174,10 +1174,10 @@ progressmeter(int flag)
 	if (barlength > 0) {
 		i = barlength * ratio / 100;
 		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-			 "|%.*s%*s|", i,
-			 "*****************************************************************************"
-			 "*****************************************************************************",
-			 barlength - i, "");
+		    "|%.*s%*s|", i,
+		    "*****************************************************************************"
+		    "*****************************************************************************",
+		    barlength - i, "");
 	}
 	i = 0;
 	abbrevsize = cursize;
@@ -1218,14 +1218,14 @@ progressmeter(int flag)
 		i = remaining / 3600;
 		if (i)
 			snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-				 "%2d:", i);
+			    "%2d:", i);
 		else
 			snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-				 "   ");
+			    "   ");
 		i = remaining % 3600;
 		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-			 "%02d:%02d%s", i / 60, i % 60,
-			 (flag != 1) ? " ETA" : "    ");
+		    "%02d:%02d%s", i / 60, i % 60,
+		    (flag != 1) ? " ETA" : "    ");
 	}
 	atomicio(write, fileno(stdout), buf, strlen(buf));
 
diff --git a/crypto/openssh/scp/Makefile b/crypto/openssh/scp/Makefile
index 3f59a9f..fc45dfd 100644
--- a/crypto/openssh/scp/Makefile
+++ b/crypto/openssh/scp/Makefile
@@ -3,12 +3,7 @@
 PROG=	scp
 BINOWN=	root
 
-.if (${MACHINE_ARCH} == "alpha" || ${MACHINE_ARCH} == "powerpc" || \
-	${MACHINE_ARCH} == "hppa")
-BINMODE=0000
-.else
 BINMODE?=555
-.endif
 
 BINDIR=	/usr/bin
 MAN=	scp.1
diff --git a/crypto/openssh/serverloop.c b/crypto/openssh/serverloop.c
index 74a800b..ed2886a 100644
--- a/crypto/openssh/serverloop.c
+++ b/crypto/openssh/serverloop.c
@@ -2,12 +2,36 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Sun Sep 10 00:30:37 1995 ylo
  * Server main loop for handling the interactive session.
- */
-/*
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ *
  * SSH2 support by Markus Friedl.
  * Copyright (c) 2000 Markus Friedl. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
@@ -23,6 +47,7 @@
 #include "ssh2.h"
 #include "session.h"
 #include "dispatch.h"
+#include "auth-options.h"
 
 static Buffer stdin_buffer;	/* Buffer for stdin data. */
 static Buffer stdout_buffer;	/* Buffer for stdout data. */
@@ -706,14 +731,21 @@ input_direct_tcpip(void)
 
 	debug("open direct-tcpip: from %s port %d to %s port %d",
 	   originator, originator_port, target, target_port);
+
 	/* XXX check permission */
+	if (no_port_forwarding_flag) {
+		xfree(target);
+		xfree(originator);
+		return -1;
+	}
 	sock = channel_connect_to(target, target_port);
 	xfree(target);
 	xfree(originator);
 	if (sock < 0)
 		return -1;
 	return channel_new("direct-tcpip", SSH_CHANNEL_OPEN,
-	    sock, sock, -1, 4*1024, 32*1024, 0, xstrdup("direct-tcpip"));
+	    sock, sock, -1, CHAN_TCP_WINDOW_DEFAULT,
+	    CHAN_TCP_PACKET_DEFAULT, 0, xstrdup("direct-tcpip"));
 }
 
 void
@@ -746,7 +778,8 @@ server_input_channel_open(int type, int plen)
 		 * CHANNEL_REQUEST messages is registered.
 		 */
 		id = channel_new(ctype, SSH_CHANNEL_LARVAL,
-		    -1, -1, -1, 0, 32*1024, 0, xstrdup("server-session"));
+		    -1, -1, -1, 0, CHAN_SES_PACKET_DEFAULT,
+		    0, xstrdup("server-session"));
 		if (session_open(id) == 1) {
 			channel_register_callback(id, SSH2_MSG_CHANNEL_REQUEST,
 			    session_input_channel_req, (void *)0);
diff --git a/crypto/openssh/session.h b/crypto/openssh/session.h
index a3427bc..bce99f7 100644
--- a/crypto/openssh/session.h
+++ b/crypto/openssh/session.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #ifndef SESSION_H
 #define SESSION_H
 
diff --git a/crypto/openssh/sftp-server.8 b/crypto/openssh/sftp-server.8
new file mode 100644
index 0000000..9811a3b
--- /dev/null
+++ b/crypto/openssh/sftp-server.8
@@ -0,0 +1,56 @@
+.\" $OpenBSD: sftp-server.8,v 1.2 2000/09/07 20:27:53 deraadt Exp $
+.\"
+.\" Copyright (c) 2000 Markus Friedl. All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd August 30, 2000
+.Dt SFTP-SERVER 8
+.Os
+.Sh NAME
+.Nm sftp-server
+.Nd SFTP server subsystem
+.Sh SYNOPSIS
+.Nm sftp-server
+.Sh DESCRIPTION
+.Nm
+is a program that speaks the server side of SFTP protocol
+to stdout and expects client requests from stdin.
+.Nm
+is not intended to be called directly, but from
+.Xr sshd 8 
+using the
+.Cm Subsystem
+option.
+See
+.Xr sshd 8 
+for more information.
+.Sh HISTORY
+.Nm
+first appeared in
+.Ox 2.8 .
+.Sh AUTHOR
+Markus Friedl <markus@openbsd.org>
+.Sh SEE ALSO
+.Xr ssh 1 ,
+.Xr ssh-add 1 ,
+.Xr ssh-keygen 1 ,
+.Xr sshd 8 ,
diff --git a/crypto/openssh/sftp-server.c b/crypto/openssh/sftp-server.c
new file mode 100644
index 0000000..018a03c
--- /dev/null
+++ b/crypto/openssh/sftp-server.c
@@ -0,0 +1,1068 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "includes.h"
+RCSID("$OpenBSD: sftp-server.c,v 1.6 2000/09/07 20:27:53 deraadt Exp $");
+
+#include "ssh.h"
+#include "buffer.h"
+#include "bufaux.h"
+#include "getput.h"
+#include "xmalloc.h"
+
+/* version */
+#define	SSH_FILEXFER_VERSION		2
+
+/* client to server */
+#define	SSH_FXP_INIT			1
+#define	SSH_FXP_OPEN			3
+#define	SSH_FXP_CLOSE			4
+#define	SSH_FXP_READ			5
+#define	SSH_FXP_WRITE			6
+#define	SSH_FXP_LSTAT			7
+#define	SSH_FXP_FSTAT			8
+#define	SSH_FXP_SETSTAT			9
+#define	SSH_FXP_FSETSTAT		10
+#define	SSH_FXP_OPENDIR			11
+#define	SSH_FXP_READDIR			12
+#define	SSH_FXP_REMOVE			13
+#define	SSH_FXP_MKDIR			14
+#define	SSH_FXP_RMDIR			15
+#define	SSH_FXP_REALPATH		16
+#define	SSH_FXP_STAT			17
+#define	SSH_FXP_RENAME			18
+
+/* server to client */
+#define	SSH_FXP_VERSION			2
+#define	SSH_FXP_STATUS			101
+#define	SSH_FXP_HANDLE			102
+#define	SSH_FXP_DATA			103
+#define	SSH_FXP_NAME			104
+#define	SSH_FXP_ATTRS			105
+
+/* portable open modes */
+#define	SSH_FXF_READ			0x01
+#define	SSH_FXF_WRITE			0x02
+#define	SSH_FXF_APPEND			0x04
+#define	SSH_FXF_CREAT			0x08
+#define	SSH_FXF_TRUNC			0x10
+#define	SSH_FXF_EXCL			0x20
+
+/* attributes */
+#define	SSH_FXA_HAVE_SIZE		0x01
+#define	SSH_FXA_HAVE_UGID		0x02
+#define	SSH_FXA_HAVE_PERM		0x04
+#define	SSH_FXA_HAVE_TIME		0x08
+
+/* status messages */
+#define	SSH_FX_OK			0x00
+#define	SSH_FX_EOF			0x01
+#define	SSH_FX_NO_SUCH_FILE		0x02
+#define	SSH_FX_PERMISSION_DENIED	0x03
+#define	SSH_FX_FAILURE			0x04
+#define	SSH_FX_BAD_MESSAGE		0x05
+#define	SSH_FX_NO_CONNECTION		0x06
+#define	SSH_FX_CONNECTION_LOST		0x07
+
+
+/* helper */
+#define get_int()			buffer_get_int(&iqueue);
+#define get_string(lenp)		buffer_get_string(&iqueue, lenp);
+#define TRACE				log
+
+/* input and output queue */
+Buffer iqueue;
+Buffer oqueue;
+
+/* portable attibutes, etc. */
+
+typedef struct Attrib Attrib;
+typedef struct Stat Stat;
+
+struct Attrib
+{
+	u_int32_t	flags;
+	u_int32_t	size_high;
+	u_int32_t	size_low;
+	u_int64_t	size;
+	u_int32_t	uid;
+	u_int32_t	gid;
+	u_int32_t	perm;
+	u_int32_t	atime;
+	u_int32_t	mtime;
+};
+
+struct Stat
+{
+	char *name;
+	char *long_name;
+	Attrib attrib;
+};
+
+int
+errno_to_portable(int unixerrno)
+{
+	int ret = 0;
+	switch (unixerrno) {
+	case 0:
+		ret = SSH_FX_OK;
+		break;
+	case ENOENT:
+	case ENOTDIR:
+	case EBADF:
+	case ELOOP:
+		ret = SSH_FX_NO_SUCH_FILE;
+		break;
+	case EPERM:
+	case EACCES:
+	case EFAULT:
+		ret = SSH_FX_PERMISSION_DENIED;
+		break;
+	case ENAMETOOLONG:
+	case EINVAL:
+		ret = SSH_FX_BAD_MESSAGE;
+		break;
+	default:
+		ret = SSH_FX_FAILURE;
+		break;
+	}
+	return ret;
+}
+
+int
+flags_from_portable(int pflags)
+{
+	int flags = 0;
+	if (pflags & SSH_FXF_READ &&
+	    pflags & SSH_FXF_WRITE) {
+		flags = O_RDWR;
+	} else if (pflags & SSH_FXF_READ) {
+		flags = O_RDONLY;
+	} else if (pflags & SSH_FXF_WRITE) {
+		flags = O_WRONLY;
+	}
+	if (pflags & SSH_FXF_CREAT)
+		flags |= O_CREAT;
+	if (pflags & SSH_FXF_TRUNC)
+		flags |= O_TRUNC;
+	if (pflags & SSH_FXF_EXCL)
+		flags |= O_EXCL;
+	return flags;
+}
+
+void
+attrib_clear(Attrib *a)
+{
+	a->flags = 0;
+	a->size_low = 0;
+	a->size_high = 0;
+	a->size = 0;
+	a->uid = 0;
+	a->gid = 0;
+	a->perm = 0;
+	a->atime = 0;
+	a->mtime = 0;
+}
+
+Attrib *
+decode_attrib(Buffer *b)
+{
+	static Attrib a;
+	attrib_clear(&a);
+	a.flags = buffer_get_int(b);
+	if (a.flags & SSH_FXA_HAVE_SIZE) {
+		a.size_high = buffer_get_int(b);
+		a.size_low = buffer_get_int(b);
+		a.size = (((u_int64_t) a.size_high) << 32) + a.size_low;
+	}
+	if (a.flags & SSH_FXA_HAVE_UGID) {
+		a.uid = buffer_get_int(b);
+		a.gid = buffer_get_int(b);
+	}
+	if (a.flags & SSH_FXA_HAVE_PERM) {
+		a.perm = buffer_get_int(b);
+	}
+	if (a.flags & SSH_FXA_HAVE_TIME) {
+		a.atime = buffer_get_int(b);
+		a.mtime = buffer_get_int(b);
+	}
+	return &a;
+}
+
+void
+encode_attrib(Buffer *b, Attrib *a)
+{
+	buffer_put_int(b, a->flags);
+	if (a->flags & SSH_FXA_HAVE_SIZE) {
+		buffer_put_int(b, a->size_high);
+		buffer_put_int(b, a->size_low);
+	}
+	if (a->flags & SSH_FXA_HAVE_UGID) {
+		buffer_put_int(b, a->uid);
+		buffer_put_int(b, a->gid);
+	}
+	if (a->flags & SSH_FXA_HAVE_PERM) {
+		buffer_put_int(b, a->perm);
+	}
+	if (a->flags & SSH_FXA_HAVE_TIME) {
+		buffer_put_int(b, a->atime);
+		buffer_put_int(b, a->mtime);
+	}
+}
+
+Attrib *
+stat_to_attrib(struct stat *st)
+{
+	static Attrib a;
+	attrib_clear(&a);
+	a.flags = 0;
+	a.flags |= SSH_FXA_HAVE_SIZE;
+	a.size = st->st_size;
+	a.size_low = a.size;
+	a.size_high = (u_int32_t) (a.size >> 32);
+	a.flags |= SSH_FXA_HAVE_UGID;
+	a.uid = st->st_uid;
+	a.gid = st->st_gid;
+	a.flags |= SSH_FXA_HAVE_PERM;
+	a.perm = st->st_mode;
+	a.flags |= SSH_FXA_HAVE_TIME;
+	a.atime = st->st_atime;
+	a.mtime = st->st_mtime;
+	return &a;
+}
+
+Attrib *
+get_attrib(void)
+{
+	return decode_attrib(&iqueue);
+}
+
+/* handle handles */
+
+typedef struct Handle Handle;
+struct Handle {
+	int use;
+	DIR *dirp;
+	int fd;
+	char *name;
+};
+enum {
+	HANDLE_UNUSED,
+	HANDLE_DIR,
+	HANDLE_FILE
+};
+Handle	handles[100];
+
+void
+handle_init(void)
+{
+	int i;
+	for(i = 0; i < sizeof(handles)/sizeof(Handle); i++)
+		handles[i].use = HANDLE_UNUSED;
+}
+
+int
+handle_new(int use, char *name, int fd, DIR *dirp)
+{
+	int i;
+	for(i = 0; i < sizeof(handles)/sizeof(Handle); i++) {
+		if (handles[i].use == HANDLE_UNUSED) {
+			handles[i].use = use;
+			handles[i].dirp = dirp;
+			handles[i].fd = fd;
+			handles[i].name = name;
+			return i;
+		}
+	}
+	return -1;
+}
+
+int
+handle_is_ok(int i, int type)
+{
+	return i >= 0 && i < sizeof(handles)/sizeof(Handle) && handles[i].use == type;
+}
+
+int
+handle_to_string(int handle, char **stringp, int *hlenp)
+{
+	char buf[1024];
+	if (stringp == NULL || hlenp == NULL)
+		return -1;
+	snprintf(buf, sizeof buf, "%d", handle);
+	*stringp = xstrdup(buf);
+	*hlenp = strlen(*stringp);
+	return 0;
+}
+
+int
+handle_from_string(char *handle, u_int hlen)
+{
+/* XXX OVERFLOW ? */
+	char *ep;
+	long lval = strtol(handle, &ep, 10);
+	int val = lval;
+	if (*ep != '\0')
+		return -1;
+	if (handle_is_ok(val, HANDLE_FILE) ||
+	    handle_is_ok(val, HANDLE_DIR))
+		return val;
+	return -1;
+}
+
+char *
+handle_to_name(int handle)
+{
+	if (handle_is_ok(handle, HANDLE_DIR)||
+	    handle_is_ok(handle, HANDLE_FILE))
+		return handles[handle].name;
+	return NULL;
+}
+
+DIR *
+handle_to_dir(int handle)
+{
+	if (handle_is_ok(handle, HANDLE_DIR))
+		return handles[handle].dirp;
+	return NULL;
+}
+
+int
+handle_to_fd(int handle)
+{
+	if (handle_is_ok(handle, HANDLE_FILE)) 
+		return handles[handle].fd;
+	return -1;
+}
+
+int
+handle_close(int handle)
+{
+	int ret = -1;
+	if (handle_is_ok(handle, HANDLE_FILE)) {
+		ret = close(handles[handle].fd);
+		handles[handle].use = HANDLE_UNUSED;
+	} else if (handle_is_ok(handle, HANDLE_DIR)) {
+		ret = closedir(handles[handle].dirp);
+		handles[handle].use = HANDLE_UNUSED;
+	} else {
+		errno = ENOENT;
+	}
+	return ret;
+}
+
+int
+get_handle(void)
+{
+	char *handle;
+	int val;
+	u_int hlen;
+	handle = get_string(&hlen);
+	val = handle_from_string(handle, hlen);
+	xfree(handle);
+	return val;
+}
+
+/* send replies */
+
+void
+send_msg(Buffer *m)
+{
+	int mlen = buffer_len(m);
+	buffer_put_int(&oqueue, mlen);
+	buffer_append(&oqueue, buffer_ptr(m), mlen);
+	buffer_consume(m, mlen);
+}
+
+void
+send_status(u_int32_t id, u_int32_t error)
+{
+	Buffer msg;
+	TRACE("sent status id %d error %d", id, error);
+	buffer_init(&msg);
+	buffer_put_char(&msg, SSH_FXP_STATUS);
+	buffer_put_int(&msg, id);
+	buffer_put_int(&msg, error);
+	send_msg(&msg);
+	buffer_free(&msg);
+}
+void
+send_data_or_handle(char type, u_int32_t id, char *data, int dlen)
+{
+	Buffer msg;
+	buffer_init(&msg);
+	buffer_put_char(&msg, type);
+	buffer_put_int(&msg, id);
+	buffer_put_string(&msg, data, dlen);
+	send_msg(&msg);
+	buffer_free(&msg);
+}
+
+void
+send_data(u_int32_t id, char *data, int dlen)
+{
+	TRACE("sent data id %d len %d", id, dlen);
+	send_data_or_handle(SSH_FXP_DATA, id, data, dlen);
+}
+
+void
+send_handle(u_int32_t id, int handle)
+{
+	char *string;
+	int hlen;
+	handle_to_string(handle, &string, &hlen);
+	TRACE("sent handle id %d handle %d", id, handle);
+	send_data_or_handle(SSH_FXP_HANDLE, id, string, hlen);
+	xfree(string);
+}
+
+void
+send_names(u_int32_t id, int count, Stat *stats)
+{
+	Buffer msg;
+	int i;
+	buffer_init(&msg);
+	buffer_put_char(&msg, SSH_FXP_NAME);
+	buffer_put_int(&msg, id);
+	buffer_put_int(&msg, count);
+	TRACE("sent names id %d count %d", id, count);
+	for (i = 0; i < count; i++) {
+		buffer_put_cstring(&msg, stats[i].name);
+		buffer_put_cstring(&msg, stats[i].long_name);
+		encode_attrib(&msg, &stats[i].attrib);
+	}
+	send_msg(&msg);
+	buffer_free(&msg);
+}
+
+void
+send_attrib(u_int32_t id, Attrib *a)
+{
+	Buffer msg;
+	TRACE("sent attrib id %d have 0x%x", id, a->flags);
+	buffer_init(&msg);
+	buffer_put_char(&msg, SSH_FXP_ATTRS);
+	buffer_put_int(&msg, id);
+	encode_attrib(&msg, a);
+	send_msg(&msg);
+	buffer_free(&msg);
+}
+
+/* parse incoming */
+
+void
+process_init(void)
+{
+	Buffer msg;
+	int version = buffer_get_int(&iqueue);
+
+	TRACE("client version %d", version);
+	buffer_init(&msg);
+	buffer_put_char(&msg, SSH_FXP_VERSION);
+	buffer_put_int(&msg, SSH_FILEXFER_VERSION);
+	send_msg(&msg);
+	buffer_free(&msg);
+}
+
+void
+process_open(void)
+{
+	u_int32_t id, pflags;
+	Attrib *a;
+	char *name;
+	int handle, fd, flags, mode, status = SSH_FX_FAILURE;
+
+	id = get_int();
+	name = get_string(NULL);
+	pflags = get_int();
+	a = get_attrib();
+	flags = flags_from_portable(pflags);
+	mode = (a->flags & SSH_FXA_HAVE_PERM) ? a->perm : 0666;
+	TRACE("open id %d name %s flags %d mode 0%o", id, name, pflags, mode);
+	fd = open(name, flags, mode);
+	if (fd < 0) {
+		status = errno_to_portable(errno);
+	} else {
+		handle = handle_new(HANDLE_FILE, xstrdup(name), fd, NULL);
+		if (handle < 0) {
+			close(fd);
+		} else {
+			send_handle(id, handle);
+			status = SSH_FX_OK;
+		}
+	}
+	if (status != SSH_FX_OK)
+		send_status(id, status);
+	xfree(name);
+}
+
+void
+process_close(void)
+{
+	u_int32_t id;
+	int handle, ret, status = SSH_FX_FAILURE;
+
+	id = get_int();
+	handle = get_handle();
+	TRACE("close id %d handle %d", id, handle);
+	ret = handle_close(handle);
+	status = (ret == -1) ? errno_to_portable(errno) : SSH_FX_OK;
+	send_status(id, status);
+}
+
+void
+process_read(void)
+{
+	char buf[64*1024];
+	u_int32_t id, off_high, off_low, len;
+	int handle, fd, ret, status = SSH_FX_FAILURE;
+	u_int64_t off;
+
+	id = get_int();
+	handle = get_handle();
+	off_high = get_int();
+	off_low = get_int();
+	len = get_int();
+
+	off = (((u_int64_t) off_high) << 32) + off_low;
+	TRACE("read id %d handle %d off %qd len %d", id, handle, off, len);
+	if (len > sizeof buf) {
+		len = sizeof buf;
+		log("read change len %d", len);
+	}
+	fd = handle_to_fd(handle);
+	if (fd >= 0) {
+		if (lseek(fd, off, SEEK_SET) < 0) {
+			error("process_read: seek failed");
+			status = errno_to_portable(errno);
+		} else {
+			ret = read(fd, buf, len);
+			if (ret < 0) {
+				status = errno_to_portable(errno);
+			} else if (ret == 0) {
+				status = SSH_FX_EOF;
+			} else {
+				send_data(id, buf, ret);
+				status = SSH_FX_OK;
+			}
+		}
+	}
+	if (status != SSH_FX_OK)
+		send_status(id, status);
+}
+
+void
+process_write(void)
+{
+	u_int32_t id, off_high, off_low;
+	u_int64_t off;
+	u_int len;
+	int handle, fd, ret, status = SSH_FX_FAILURE;
+	char *data;
+
+	id = get_int();
+	handle = get_handle();
+	off_high = get_int();
+	off_low = get_int();
+	data = get_string(&len);
+
+	off = (((u_int64_t) off_high) << 32) + off_low;
+	TRACE("write id %d handle %d off %qd len %d", id, handle, off, len);
+	fd = handle_to_fd(handle);
+	if (fd >= 0) {
+		if (lseek(fd, off, SEEK_SET) < 0) {
+			status = errno_to_portable(errno);
+			error("process_write: seek failed");
+		} else {
+/* XXX ATOMICIO ? */
+			ret = write(fd, data, len);
+			if (ret == -1) {
+				error("process_write: write failed");
+				status = errno_to_portable(errno);
+			} else if (ret == len) {
+				status = SSH_FX_OK;
+			} else {
+				log("nothing at all written");
+			}
+		}
+	}
+	send_status(id, status);
+	xfree(data);
+}
+
+void
+process_do_stat(int do_lstat)
+{
+	Attrib *a;
+	struct stat st;
+	u_int32_t id;
+	char *name;
+	int ret, status = SSH_FX_FAILURE;
+
+	id = get_int();
+	name = get_string(NULL);
+	TRACE("%sstat id %d name %s", do_lstat ? "l" : "", id, name);
+	ret = do_lstat ? lstat(name, &st) : stat(name, &st);
+	if (ret < 0) {
+		status = errno_to_portable(errno);
+	} else {
+		a = stat_to_attrib(&st);
+		send_attrib(id, a);
+		status = SSH_FX_OK;
+	}
+	if (status != SSH_FX_OK)
+		send_status(id, status);
+	xfree(name);
+}
+
+void
+process_stat(void)
+{
+	process_do_stat(0);
+}
+
+void
+process_lstat(void)
+{
+	process_do_stat(1);
+}
+
+void
+process_fstat(void)
+{
+	Attrib *a;
+	struct stat st;
+	u_int32_t id;
+	int fd, ret, handle, status = SSH_FX_FAILURE;
+
+	id = get_int();
+	handle = get_handle();
+	TRACE("fstat id %d handle %d", id, handle);
+	fd = handle_to_fd(handle);
+	if (fd  >= 0) {
+		ret = fstat(fd, &st);
+		if (ret < 0) {
+			status = errno_to_portable(errno);
+		} else {
+			a = stat_to_attrib(&st);
+			send_attrib(id, a);
+			status = SSH_FX_OK;
+		}
+	}
+	if (status != SSH_FX_OK)
+		send_status(id, status);
+}
+
+struct timeval *
+attrib_to_tv(Attrib *a)
+{
+	static struct timeval tv[2];
+	tv[0].tv_sec = a->atime;
+	tv[0].tv_usec = 0;
+	tv[1].tv_sec = a->mtime;
+	tv[1].tv_usec = 0;
+	return tv;
+}
+
+void
+process_setstat(void)
+{
+	Attrib *a;
+	u_int32_t id;
+	char *name;
+	int ret;
+	int status = SSH_FX_OK;
+
+	id = get_int();
+	name = get_string(NULL);
+	a = get_attrib();
+	TRACE("setstat id %d name %s", id, name);
+	if (a->flags & SSH_FXA_HAVE_PERM) {
+		ret = chmod(name, a->perm & 0777);
+		if (ret == -1)
+			status = errno_to_portable(errno);
+	}
+	if (a->flags & SSH_FXA_HAVE_TIME) {
+		ret = utimes(name, attrib_to_tv(a));
+		if (ret == -1)
+			status = errno_to_portable(errno);
+	}
+	send_status(id, status);
+	xfree(name);
+}
+
+void
+process_fsetstat(void)
+{
+	Attrib *a;
+	u_int32_t id;
+	int handle, fd, ret;
+	int status = SSH_FX_OK;
+
+	id = get_int();
+	handle = get_handle();
+	a = get_attrib();
+	TRACE("fsetstat id %d handle %d", id, handle);
+	fd = handle_to_fd(handle);
+	if (fd < 0) {
+		status = SSH_FX_FAILURE;
+	} else {
+		if (a->flags & SSH_FXA_HAVE_PERM) {
+			ret = fchmod(fd, a->perm & 0777);
+			if (ret == -1)
+				status = errno_to_portable(errno);
+		}
+		if (a->flags & SSH_FXA_HAVE_TIME) {
+			ret = futimes(fd, attrib_to_tv(a));
+			if (ret == -1)
+				status = errno_to_portable(errno);
+		}
+	}
+	send_status(id, status);
+}
+
+void
+process_opendir(void)
+{
+	DIR *dirp = NULL;
+	char *path;
+	int handle, status = SSH_FX_FAILURE;
+	u_int32_t id;
+
+	id = get_int();
+	path = get_string(NULL);
+	TRACE("opendir id %d path %s", id, path);
+	dirp = opendir(path); 
+	if (dirp == NULL) {
+		status = errno_to_portable(errno);
+	} else {
+		handle = handle_new(HANDLE_DIR, xstrdup(path), 0, dirp);
+		if (handle < 0) {
+			closedir(dirp);
+		} else {
+			send_handle(id, handle);
+			status = SSH_FX_OK;
+		}
+		
+	}
+	if (status != SSH_FX_OK)
+		send_status(id, status);
+	xfree(path);
+}
+
+char *
+ls_file(char *name, struct stat *st)
+{
+	char buf[1024];
+	snprintf(buf, sizeof buf, "0%o %d %d %qd %d %s",
+	    st->st_mode, st->st_uid, st->st_gid, (long long)st->st_size,(int) st->st_mtime,
+	    name);
+	return xstrdup(buf);
+}
+
+void
+process_readdir(void)
+{
+	DIR *dirp;
+	struct dirent *dp;
+	char *path;
+	int handle;
+	u_int32_t id;
+
+	id = get_int();
+	handle = get_handle();
+	TRACE("readdir id %d handle %d", id, handle);
+	dirp = handle_to_dir(handle);
+	path = handle_to_name(handle);
+	if (dirp == NULL || path == NULL) {
+		send_status(id, SSH_FX_FAILURE);
+	} else {
+		Attrib *a;
+		struct stat st;
+		char pathname[1024];
+		Stat *stats;
+		int nstats = 10, count = 0, i;
+		stats = xmalloc(nstats * sizeof(Stat));
+		while ((dp = readdir(dirp)) != NULL) {
+			if (count >= nstats) {
+				nstats *= 2;
+				stats = xrealloc(stats, nstats * sizeof(Stat));
+			}
+/* XXX OVERFLOW ? */
+			snprintf(pathname, sizeof pathname,
+			    "%s/%s", path, dp->d_name);
+			if (lstat(pathname, &st) < 0)
+				continue;
+			a = stat_to_attrib(&st);
+			stats[count].attrib = *a;
+			stats[count].name = xstrdup(dp->d_name);
+			stats[count].long_name = ls_file(dp->d_name, &st);
+			count++;
+			/* send up to 100 entries in one message */
+			if (count == 100)
+				break;
+		}
+		send_names(id, count, stats);
+		for(i = 0; i < count; i++) {
+			xfree(stats[i].name);
+			xfree(stats[i].long_name);
+		}
+		xfree(stats);
+	}
+}
+
+void
+process_remove(void)
+{
+	char *name;
+	u_int32_t id;
+	int status = SSH_FX_FAILURE;
+	int ret;
+
+	id = get_int();
+	name = get_string(NULL);
+	TRACE("remove id %d name %s", id, name);
+	ret = remove(name);
+	status = (ret == -1) ? errno_to_portable(errno) : SSH_FX_OK;
+	send_status(id, status);
+	xfree(name);
+}
+
+void
+process_mkdir(void)
+{
+	Attrib *a;
+	u_int32_t id;
+	char *name;
+	int ret, mode, status = SSH_FX_FAILURE;
+
+	id = get_int();
+	name = get_string(NULL);
+	a = get_attrib();
+	mode = (a->flags & SSH_FXA_HAVE_PERM) ? a->perm & 0777 : 0777;
+	TRACE("mkdir id %d name %s mode 0%o", id, name, mode);
+	ret = mkdir(name, mode);
+	status = (ret == -1) ? errno_to_portable(errno) : SSH_FX_OK;
+	send_status(id, status);
+	xfree(name);
+}
+
+void
+process_rmdir(void)
+{
+	u_int32_t id;
+	char *name;
+	int ret, status;
+
+	id = get_int();
+	name = get_string(NULL);
+	TRACE("rmdir id %d name %s", id, name);
+	ret = rmdir(name);
+	status = (ret == -1) ? errno_to_portable(errno) : SSH_FX_OK;
+	send_status(id, status);
+	xfree(name);
+}
+
+void
+process_realpath(void)
+{
+	char resolvedname[MAXPATHLEN];
+	u_int32_t id;
+	char *path;
+
+	id = get_int();
+	path = get_string(NULL);
+	TRACE("realpath id %d path %s", id, path);
+	if (realpath(path, resolvedname) == NULL) {
+		send_status(id, errno_to_portable(errno));
+	} else {
+		Stat s;
+		attrib_clear(&s.attrib);
+		s.name = s.long_name = resolvedname;
+		send_names(id, 1, &s);
+	}
+	xfree(path);
+}
+
+void
+process_rename(void)
+{
+	u_int32_t id;
+	char *oldpath, *newpath;
+	int ret, status;
+
+	id = get_int();
+	oldpath = get_string(NULL);
+	newpath = get_string(NULL);
+	TRACE("rename id %d old %s new %s", id, oldpath, newpath);
+	ret = rename(oldpath, newpath);
+	status = (ret == -1) ? errno_to_portable(errno) : SSH_FX_OK;
+	send_status(id, status);
+	xfree(oldpath);
+	xfree(newpath);
+}
+
+
+/* stolen from ssh-agent */
+
+void
+process(void)
+{
+	unsigned int msg_len;
+	unsigned int type;
+	unsigned char *cp;
+
+	if (buffer_len(&iqueue) < 5)
+		return;		/* Incomplete message. */
+	cp = (unsigned char *) buffer_ptr(&iqueue);
+	msg_len = GET_32BIT(cp);
+	if (msg_len > 256 * 1024) {
+		error("bad message ");
+		exit(11);
+	}
+	if (buffer_len(&iqueue) < msg_len + 4)
+		return;
+	buffer_consume(&iqueue, 4);
+	type = buffer_get_char(&iqueue);
+	switch (type) {
+	case SSH_FXP_INIT:
+		process_init();
+		break;
+	case SSH_FXP_OPEN:
+		process_open();
+		break;
+	case SSH_FXP_CLOSE:
+		process_close();
+		break;
+	case SSH_FXP_READ:
+		process_read();
+		break;
+	case SSH_FXP_WRITE:
+		process_write();
+		break;
+	case SSH_FXP_LSTAT:
+		process_lstat();
+		break;
+	case SSH_FXP_FSTAT:
+		process_fstat();
+		break;
+	case SSH_FXP_SETSTAT:
+		process_setstat();
+		break;
+	case SSH_FXP_FSETSTAT:
+		process_fsetstat();
+		break;
+	case SSH_FXP_OPENDIR:
+		process_opendir();
+		break;
+	case SSH_FXP_READDIR:
+		process_readdir();
+		break;
+	case SSH_FXP_REMOVE:
+		process_remove();
+		break;
+	case SSH_FXP_MKDIR:
+		process_mkdir();
+		break;
+	case SSH_FXP_RMDIR:
+		process_rmdir();
+		break;
+	case SSH_FXP_REALPATH:
+		process_realpath();
+		break;
+	case SSH_FXP_STAT:
+		process_stat();
+		break;
+	case SSH_FXP_RENAME:
+		process_rename();
+		break;
+	default:
+		error("Unknown message %d", type);
+		break;
+	}
+}
+
+int
+main(int ac, char **av)
+{
+	fd_set rset, wset;
+	int in, out, max;
+	ssize_t len, olen;
+
+	handle_init();
+
+	in = dup(STDIN_FILENO);
+	out = dup(STDOUT_FILENO);
+
+	max = 0;
+	if (in > max)
+		max = in;
+	if (out > max)
+		max = out;
+
+	buffer_init(&iqueue);
+	buffer_init(&oqueue);
+
+	for (;;) {
+		FD_ZERO(&rset);
+		FD_ZERO(&wset);
+
+		FD_SET(in, &rset);
+		olen = buffer_len(&oqueue);
+		if (olen > 0)
+			FD_SET(out, &wset);
+
+		if (select(max+1, &rset, &wset, NULL, NULL) < 0) {
+			if (errno == EINTR)
+				continue;
+			exit(2);
+		}
+
+		/* copy stdin to iqueue */
+		if (FD_ISSET(in, &rset)) {
+			char buf[4*4096];
+			len = read(in, buf, sizeof buf);
+			if (len == 0) {
+				debug("read eof");
+				exit(0);
+			} else if (len < 0) {
+				error("read error");
+				exit(1);
+			} else {
+				buffer_append(&iqueue, buf, len);
+			}
+		}
+		/* send oqueue to stdout */
+		if (FD_ISSET(out, &wset)) {
+			len = write(out, buffer_ptr(&oqueue), olen);
+			if (len < 0) {
+				error("write error");
+				exit(1);
+			} else {
+				buffer_consume(&oqueue, len);
+			}
+		}
+		/* process requests from client */
+		process();
+	}
+}
diff --git a/crypto/openssh/sftp-server/Makefile b/crypto/openssh/sftp-server/Makefile
new file mode 100644
index 0000000..1999fec
--- /dev/null
+++ b/crypto/openssh/sftp-server/Makefile
@@ -0,0 +1,16 @@
+.PATH:		${.CURDIR}/..
+
+PROG=	sftp-server
+BINOWN=	root
+
+BINMODE?=555
+
+BINDIR=	/usr/libexec
+MAN=	sftp-server.8
+
+SRCS=	sftp-server.c log-server.c
+
+.include <bsd.prog.mk>
+
+LDADD+=	-lcrypto # -lutil -lz
+DPADD+=	${LIBCRYPTO} # ${LIBDES} ${LIBUTIL} ${LIBZ}
diff --git a/crypto/openssh/ssh-add.1 b/crypto/openssh/ssh-add.1
index 1036395..d453fa2 100644
--- a/crypto/openssh/ssh-add.1
+++ b/crypto/openssh/ssh-add.1
@@ -1,29 +1,53 @@
 .\"  -*- nroff -*-
 .\"
-.\" ssh-add.1
-.\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 .\"                    All rights reserved
 .\"
-.\" Created: Sat Apr 22 23:55:14 1995 ylo
+.\" As far as I am concerned, the code I have written for this software
+.\" can be used freely for any purpose.  Any derived versions of this
+.\" software must be clearly marked as such, and if the derived work is
+.\" incompatible with the protocol description in the RFC file, it must be
+.\" called by a name other than "ssh" or "Secure Shell".
+.\"
+.\"
+.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
+.\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
+.\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
 .\"
-.\" $Id: ssh-add.1,v 1.13 2000/05/03 18:04:38 markus Exp $
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .Dd September 25, 1999
 .Dt SSH-ADD 1
 .Os
 .Sh NAME
 .Nm ssh-add
-.Nd adds RSA identities for the authentication agent
+.Nd adds RSA or DSA identities for the authentication agent
 .Sh SYNOPSIS
 .Nm ssh-add
 .Op Fl lLdD
 .Op Ar
 .Sh DESCRIPTION
 .Nm
-adds RSA identities to the authentication agent,
+adds RSA or DSA identities to the authentication agent,
 .Xr ssh-agent 1 .
 When run without arguments, it adds the file
 .Pa $HOME/.ssh/identity .
@@ -63,7 +87,9 @@ used to encrypt the private part of this file.
 This is the default file added by
 .Nm
 when no other files have been specified.
-.Pp
+.It Pa $HOME/.ssh/id_dsa
+Contains the DSA authentication identity of the user.
+.El
 .Sh ENVIRONMENT
 .Bl -tag -width Ds
 .It Ev "DISPLAY" and "SSH_ASKPASS"
@@ -89,6 +115,7 @@ or related script.
 may be necessary to redirect the input from
 .Pa /dev/null
 to make this work.)
+.El
 .Sh AUTHOR
 Tatu Ylonen <ylo@cs.hut.fi>
 .Pp
@@ -115,10 +142,6 @@ authentication and ticket passing.
 supports one-time password authentication with
 .Xr skey 1 .
 .El
-.Pp
-The libraries described in
-.Xr ssl 8
-are required for proper operation.
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-agent 1 ,
diff --git a/crypto/openssh/ssh-add.c b/crypto/openssh/ssh-add.c
index b7a385c..4b33f96 100644
--- a/crypto/openssh/ssh-add.c
+++ b/crypto/openssh/ssh-add.c
@@ -2,22 +2,50 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Thu Apr  6 00:52:24 1995 ylo
  * Adds an identity to the authentication server, or removes an identity.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
+ *
+ * SSH2 implementation,
+ * Copyright (c) 2000 Markus Friedl. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "includes.h"
-RCSID("$Id: ssh-add.c,v 1.16 2000/04/26 20:56:29 markus Exp $");
+RCSID("$OpenBSD: ssh-add.c,v 1.22 2000/09/07 20:27:54 deraadt Exp $");
 
+#include <openssl/evp.h>
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
 
 #include "rsa.h"
 #include "ssh.h"
 #include "xmalloc.h"
-#include "authfd.h"
-#include "fingerprint.h"
 #include "key.h"
+#include "authfd.h"
 #include "authfile.h"
 
 void
@@ -28,10 +56,14 @@ delete_file(AuthenticationConnection *ac, const char *filename)
 
 	public = key_new(KEY_RSA);
 	if (!load_public_key(filename, public, &comment)) {
-		printf("Bad key file %s: %s\n", filename, strerror(errno));
-		return;
+		key_free(public);
+		public = key_new(KEY_DSA);
+		if (!try_load_public_key(filename, public, &comment)) {
+			printf("Bad key file %s\n", filename);
+			return;
+		}
 	}
-	if (ssh_remove_identity(ac, public->rsa))
+	if (ssh_remove_identity(ac, public))
 		fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
 	else
 		fprintf(stderr, "Could not remove identity: %s\n", filename);
@@ -39,11 +71,18 @@ delete_file(AuthenticationConnection *ac, const char *filename)
 	xfree(comment);
 }
 
+/* Send a request to remove all identities. */
 void
 delete_all(AuthenticationConnection *ac)
 {
-	/* Send a request to remove all identities. */
-	if (ssh_remove_all_identities(ac))
+	int success = 1;
+
+	if (!ssh_remove_all_identities(ac, 1))
+		success = 0;
+	/* ignore error-code for ssh2 */
+	ssh_remove_all_identities(ac, 2);
+
+	if (success)
 		fprintf(stderr, "All identities removed.\n");
 	else
 		fprintf(stderr, "Failed to remove all identitities.\n");
@@ -90,17 +129,28 @@ ssh_askpass(char *askpass, char *msg)
 void
 add_file(AuthenticationConnection *ac, const char *filename)
 {
+	struct stat st;
 	Key *public;
 	Key *private;
 	char *saved_comment, *comment, *askpass = NULL;
 	char buf[1024], msg[1024];
 	int success;
 	int interactive = isatty(STDIN_FILENO);
+	int type = KEY_RSA;
 
+	if (stat(filename, &st) < 0) {
+		perror(filename);
+		exit(1);
+	}
+	/*
+	 * try to load the public key. right now this only works for RSA,
+	 * since DSA keys are fully encrypted
+	 */
 	public = key_new(KEY_RSA);
 	if (!load_public_key(filename, public, &saved_comment)) {
-		printf("Bad key file %s: %s\n", filename, strerror(errno));
-		return;
+		/* ok, so we will asume this is a DSA key */
+		type = KEY_DSA;
+		saved_comment = xstrdup(filename);
 	}
 	key_free(public);
 
@@ -112,7 +162,7 @@ add_file(AuthenticationConnection *ac, const char *filename)
 	}
 
 	/* At first, try empty passphrase */
-	private = key_new(KEY_RSA);
+	private = key_new(type);
 	success = load_private_key(filename, "", private, &comment);
 	if (!success) {
 		printf("Need passphrase for %.200s\n", filename);
@@ -142,54 +192,40 @@ add_file(AuthenticationConnection *ac, const char *filename)
 			strlcpy(msg, "Bad passphrase, try again", sizeof msg);
 		}
 	}
-	xfree(saved_comment);
-
-	if (ssh_add_identity(ac, private->rsa, comment))
-		fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
+	xfree(comment);
+	if (ssh_add_identity(ac, private, saved_comment))
+		fprintf(stderr, "Identity added: %s (%s)\n", filename, saved_comment);
 	else
 		fprintf(stderr, "Could not add identity: %s\n", filename);
 	key_free(private);
-	xfree(comment);
+	xfree(saved_comment);
 }
 
 void
 list_identities(AuthenticationConnection *ac, int fp)
 {
-	BIGNUM *e, *n;
-	int status;
+	Key *key;
 	char *comment;
-	int had_identities;
+	int had_identities = 0;
+	int version;
 
-	e = BN_new();
-	n = BN_new();
-	had_identities = 0;
-	for (status = ssh_get_first_identity(ac, e, n, &comment);
-	     status;
-	     status = ssh_get_next_identity(ac, e, n, &comment)) {
-		unsigned int bits = BN_num_bits(n);
-		had_identities = 1;
-		if (fp) {
-			printf("%d %s %s\n", bits, fingerprint(e, n), comment);
-		} else {
-			char *ebuf, *nbuf;
-			ebuf = BN_bn2dec(e);
-			if (ebuf == NULL) {
-				error("list_identities: BN_bn2dec(e) failed.");
+	for (version = 1; version <= 2; version++) {
+		for (key = ssh_get_first_identity(ac, &comment, version);
+		     key != NULL;
+		     key = ssh_get_next_identity(ac, &comment, version)) {
+			had_identities = 1;
+			if (fp) {
+				printf("%d %s %s\n",
+				    key_size(key), key_fingerprint(key), comment);
 			} else {
-				nbuf = BN_bn2dec(n);
-				if (nbuf == NULL) {
-					error("list_identities: BN_bn2dec(n) failed.");
-				} else {
-					printf("%d %s %s %s\n", bits, ebuf, nbuf, comment);
-					free(nbuf);
-				}
-				free(ebuf);
+				if (!key_write(key, stdout))
+					fprintf(stderr, "key_write failed");
+				fprintf(stdout, " %s\n", comment);
 			}
+			key_free(key);
+			xfree(comment);
 		}
-		xfree(comment);
 	}
-	BN_clear_free(e);
-	BN_clear_free(n);
 	if (!had_identities)
 		printf("The agent has no identities.\n");
 }
@@ -213,6 +249,8 @@ main(int argc, char **argv)
 			__progname);
 		exit(1);
 	}
+        SSLeay_add_all_algorithms();
+
 	/* At first, get a connection to the authentication agent. */
 	ac = ssh_get_authentication_connection();
 	if (ac == NULL) {
@@ -245,7 +283,8 @@ main(int argc, char **argv)
 	if (no_files) {
 		pw = getpwuid(getuid());
 		if (!pw) {
-			fprintf(stderr, "No user found with uid %d\n", (int) getuid());
+			fprintf(stderr, "No user found with uid %u\n",
+			    (u_int)getuid());
 			ssh_close_authentication_connection(ac);
 			exit(1);
 		}
diff --git a/crypto/openssh/ssh-add/Makefile b/crypto/openssh/ssh-add/Makefile
index 5451e7d..d6dd175 100644
--- a/crypto/openssh/ssh-add/Makefile
+++ b/crypto/openssh/ssh-add/Makefile
@@ -3,12 +3,7 @@
 PROG=	ssh-add
 BINOWN=	root
 
-.if (${MACHINE_ARCH} == "alpha" || ${MACHINE_ARCH} == "powerpc" || \
-	${MACHINE_ARCH} == "hppa")
-BINMODE=0000
-.else
 BINMODE?=555
-.endif
 
 BINDIR=	/usr/bin
 MAN=	ssh-add.1
diff --git a/crypto/openssh/ssh-agent.1 b/crypto/openssh/ssh-agent.1
index 9f7299d..23c699d 100644
--- a/crypto/openssh/ssh-agent.1
+++ b/crypto/openssh/ssh-agent.1
@@ -1,15 +1,38 @@
-.\" $OpenBSD: ssh-agent.1,v 1.12 2000/05/03 18:04:39 markus Exp $
-.\"
-.\"  -*- nroff -*-
-.\"
-.\" ssh-agent.1
+.\" $OpenBSD: ssh-agent.1,v 1.16 2000/09/07 20:27:54 deraadt Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 .\"                    All rights reserved
 .\"
-.\" Created: Sat Apr 23 20:10:43 1995 ylo
+.\" As far as I am concerned, the code I have written for this software
+.\" can be used freely for any purpose.  Any derived versions of this
+.\" software must be clearly marked as such, and if the derived work is
+.\" incompatible with the protocol description in the RFC file, it must be
+.\" called by a name other than "ssh" or "Secure Shell".
+.\"
+.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
+.\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
+.\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .Dd September 25, 1999
 .Dt SSH-AGENT 1
@@ -27,14 +50,15 @@
 .Oc
 .Sh DESCRIPTION
 .Nm
-is a program to hold private keys used for RSA authentication.
+is a program to hold private keys used for public key authentication
+(RSA, DSA).
 The idea is that
 .Nm
 is started in the beginning of an X-session or a login session, and
 all other windows or programs are started as clients to the ssh-agent
 program.
 Through use of environment variables the agent can be located
-and automatically used for RSA authentication when logging in to other
+and automatically used for authentication when logging in to other
 machines using
 .Xr ssh 1 .
 .Pp
@@ -128,11 +152,14 @@ This file is not used by
 but is normally added to the agent using
 .Xr ssh-add 1
 at login time.
-.It Pa /tmp/ssh-XXXX/agent.<pid> ,
+.It Pa $HOME/.ssh/id_dsa
+Contains the DSA authentication identity of the user.
+.Pq Pa /tmp/ssh-XXXXXXXX/agent.<pid> ,
 Unix-domain sockets used to contain the connection to the
 authentication agent.
 These sockets should only be readable by the owner.
 The sockets should get automatically removed when the agent exits.
+.El
 .Sh AUTHOR
 Tatu Ylonen <ylo@cs.hut.fi>
 .Pp
@@ -159,10 +186,6 @@ authentication and ticket passing.
 supports one-time password authentication with
 .Xr skey 1 .
 .El
-.Pp
-The libraries described in
-.Xr ssl 8
-are required for proper operation.
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-add 1 ,
diff --git a/crypto/openssh/ssh-agent/Makefile b/crypto/openssh/ssh-agent/Makefile
index ba78521..9301aef 100644
--- a/crypto/openssh/ssh-agent/Makefile
+++ b/crypto/openssh/ssh-agent/Makefile
@@ -3,12 +3,7 @@
 PROG=	ssh-agent
 BINOWN=	root
 
-.if (${MACHINE_ARCH} == "alpha" || ${MACHINE_ARCH} == "powerpc" || \
-	${MACHINE_ARCH} == "hppa")
-BINMODE=0000
-.else
 BINMODE?=555
-.endif
 
 BINDIR=	/usr/bin
 MAN=	ssh-agent.1
diff --git a/crypto/openssh/ssh-keygen.1 b/crypto/openssh/ssh-keygen.1
index ea81532..b328ce0 100644
--- a/crypto/openssh/ssh-keygen.1
+++ b/crypto/openssh/ssh-keygen.1
@@ -1,15 +1,39 @@
 .\"  -*- nroff -*-
 .\"
-.\" ssh-keygen.1
-.\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 .\"                    All rights reserved
 .\"
-.\" Created: Sat Apr 22 23:55:14 1995 ylo
+.\" As far as I am concerned, the code I have written for this software
+.\" can be used freely for any purpose.  Any derived versions of this
+.\" software must be clearly marked as such, and if the derived work is
+.\" incompatible with the protocol description in the RFC file, it must be
+.\" called by a name other than "ssh" or "Secure Shell".
+.\"
+.\"
+.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
+.\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
+.\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
 .\"
-.\" $Id: ssh-keygen.1,v 1.18 2000/05/08 17:26:04 hugh Exp $
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .Dd September 25, 1999
 .Dt SSH-KEYGEN 1
@@ -23,7 +47,7 @@
 .Op Fl b Ar bits
 .Op Fl N Ar new_passphrase
 .Op Fl C Ar comment
-.Op Fl f Ar keyfile
+.Op Fl f Ar output_keyfile
 .Nm ssh-keygen
 .Fl p
 .Op Fl P Ar old_passphrase
@@ -31,13 +55,13 @@
 .Op Fl f Ar keyfile
 .Nm ssh-keygen
 .Fl x
-.Op Fl f Ar keyfile
+.Op Fl f Ar input_keyfile
 .Nm ssh-keygen
 .Fl X
-.Op Fl f Ar keyfile
+.Op Fl f Ar input_keyfile
 .Nm ssh-keygen
 .Fl y
-.Op Fl f Ar keyfile
+.Op Fl f Ar input_keyfile
 .Nm ssh-keygen
 .Fl c
 .Op Fl P Ar passphrase
@@ -45,7 +69,7 @@
 .Op Fl f Ar keyfile
 .Nm ssh-keygen
 .Fl l
-.Op Fl f Ar keyfile
+.Op Fl f Ar input_keyfile
 .Nm ssh-keygen
 .Fl R
 .Sh DESCRIPTION
@@ -188,6 +212,7 @@ The contents of this file should be added to
 on all machines
 where you wish to log in using DSA authentication.
 There is no need to keep the contents of this file secret.
+.El
 .Sh AUTHOR
 Tatu Ylonen <ylo@cs.hut.fi>
 .Pp
@@ -214,10 +239,6 @@ authentication and ticket passing.
 supports one-time password authentication with
 .Xr skey 1 .
 .El
-.Pp
-The libraries described in
-.Xr ssl 8
-are required for proper operation.
 .Sh SEE ALSO
 .Xr ssh 1 ,
 .Xr ssh-add 1 ,
diff --git a/crypto/openssh/ssh-keygen.c b/crypto/openssh/ssh-keygen.c
index 874acfe..29ee62d 100644
--- a/crypto/openssh/ssh-keygen.c
+++ b/crypto/openssh/ssh-keygen.c
@@ -2,12 +2,17 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Mon Mar 27 02:26:40 1995 ylo
  * Identity and host key generation and maintenance.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: ssh-keygen.c,v 1.26 2000/05/30 17:32:06 markus Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.31 2000/09/07 20:27:54 deraadt Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -16,7 +21,6 @@ RCSID("$Id: ssh-keygen.c,v 1.26 2000/05/30 17:32:06 markus Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
-#include "fingerprint.h"
 #include "key.h"
 #include "rsa.h"
 #include "dsa.h"
@@ -123,13 +127,13 @@ do_convert_to_ssh2(struct passwd *pw)
 		exit(1);
 	}
 	dsa_make_key_blob(k, &blob, &len);
-	fprintf(stdout, SSH_COM_MAGIC_BEGIN "\n");
+	fprintf(stdout, "%s\n", SSH_COM_MAGIC_BEGIN);
 	fprintf(stdout,
 	    "Comment: \"%d-bit DSA, converted from openssh by %s@%s\"\n",
 	    BN_num_bits(k->dsa->p),
 	    pw->pw_name, hostname);
 	dump_base64(stdout, blob, len);
-	fprintf(stdout, SSH_COM_MAGIC_END "\n");
+	fprintf(stdout, "%s\n", SSH_COM_MAGIC_END);
 	key_free(k);
 	xfree(blob);
 	exit(0);
@@ -224,8 +228,9 @@ do_print_public(struct passwd *pw)
 void
 do_fingerprint(struct passwd *pw)
 {
+	/* XXX RSA1 only */
+
 	FILE *f;
-	BIGNUM *e, *n;
 	Key *public;
 	char *comment = NULL, *cp, *ep, line[16*1024];
 	int i, skip = 0, num = 1, invalid = 1;
@@ -245,13 +250,9 @@ do_fingerprint(struct passwd *pw)
 		key_free(public);
 		exit(0);
 	}
-	key_free(public);
 
-	/* XXX */
 	f = fopen(identity_file, "r");
 	if (f != NULL) {
-		n = BN_new();
-		e = BN_new();
 		while (fgets(line, sizeof(line), f)) {
 			i = strlen(line) - 1;
 			if (line[i] != '\n') {
@@ -286,18 +287,17 @@ do_fingerprint(struct passwd *pw)
 				*cp++ = '\0';
 			}
 			ep = cp;
-			if (auth_rsa_read_key(&cp, &ignore, e, n)) {
+			if (auth_rsa_read_key(&cp, &ignore, public->rsa->e, public->rsa->n)) {
 				invalid = 0;
 				comment = *cp ? cp : comment;
-				printf("%d %s %s\n", BN_num_bits(n),
-				    fingerprint(e, n),
+				printf("%d %s %s\n", key_size(public),
+				    key_fingerprint(public),
 				    comment ? comment : "no comment");
 			}
 		}
-		BN_free(e);
-		BN_free(n);
 		fclose(f);
 	}
+	key_free(public);
 	if (invalid) {
 		printf("%s is not a valid key file.\n", identity_file);
 		exit(1);
@@ -654,7 +654,7 @@ main(int ac, char **av)
 	snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, SSH_USER_DIR);
 	if (strstr(identity_file, dotsshdir) != NULL &&
 	    stat(dotsshdir, &st) < 0) {
-		if (mkdir(dotsshdir, 0755) < 0)
+		if (mkdir(dotsshdir, 0700) < 0)
 			error("Could not create directory '%s'.", dotsshdir);
 		else if (!quiet)
 			printf("Created directory '%s'.\n", dotsshdir);
diff --git a/crypto/openssh/ssh-keygen/Makefile b/crypto/openssh/ssh-keygen/Makefile
index 1f92059..f03f56b 100644
--- a/crypto/openssh/ssh-keygen/Makefile
+++ b/crypto/openssh/ssh-keygen/Makefile
@@ -3,12 +3,7 @@
 PROG=	ssh-keygen
 BINOWN=	root
 
-.if (${MACHINE_ARCH} == "alpha" || ${MACHINE_ARCH} == "powerpc" || \
-	${MACHINE_ARCH} == "hppa")
-BINMODE=0000
-.else
 BINMODE?=555
-.endif
 
 BINDIR=	/usr/bin
 MAN=	ssh-keygen.1
diff --git a/crypto/openssh/ssh/Makefile b/crypto/openssh/ssh/Makefile
index a87d5dc..bd41531 100644
--- a/crypto/openssh/ssh/Makefile
+++ b/crypto/openssh/ssh/Makefile
@@ -3,12 +3,7 @@
 PROG=	ssh
 BINOWN=	root
 
-.if (${MACHINE_ARCH} == "alpha" || ${MACHINE_ARCH} == "powerpc" || \
-	${MACHINE_ARCH} == "hppa")
-BINMODE=0000
-.else
 BINMODE?=4555
-.endif
 
 BINDIR=	/usr/bin
 MAN=	ssh.1
@@ -20,11 +15,11 @@ SRCS=	ssh.c log-client.c readconf.c clientloop.c \
 
 .include <bsd.own.mk> # for AFS
 
-.if (${KERBEROS} == "yes")
+.if (${KERBEROS:L} == "yes")
 CFLAGS+= -DKRB4 -I${DESTDIR}/usr/include/kerberosIV
 LDADD+=	 -lkrb
 DPADD+=	 ${LIBKRB}
-.if (${AFS} == "yes")
+.if (${AFS:L} == "yes")
 CFLAGS+= -DAFS
 LDADD+=  -lkafs
 DPADD+=  ${LIBKRBAFS}
diff --git a/crypto/openssh/ssh2.h b/crypto/openssh/ssh2.h
index 1fa4c0a..47628dd 100644
--- a/crypto/openssh/ssh2.h
+++ b/crypto/openssh/ssh2.h
@@ -1,4 +1,28 @@
 /*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
  * draft-ietf-secsh-architecture-05.txt
  *
  *   Transport layer protocol:
@@ -28,7 +52,7 @@
  *
  *     192-255  Local extensions
  */
-/* RCSID("$OpenBSD: ssh2.h,v 1.3 2000/05/15 07:03:12 markus Exp $"); */
+/* RCSID("$OpenBSD: ssh2.h,v 1.4 2000/09/07 20:27:54 deraadt Exp $"); */
 
 /* transport layer: generic */
 
diff --git a/crypto/openssh/sshconnect.h b/crypto/openssh/sshconnect.h
index 13d395f..146a65b 100644
--- a/crypto/openssh/sshconnect.h
+++ b/crypto/openssh/sshconnect.h
@@ -1,3 +1,26 @@
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
 #ifndef SSHCONNECT_H
 #define SSHCONNECT_H
 
diff --git a/crypto/openssh/sshconnect2.c b/crypto/openssh/sshconnect2.c
index 0abcf89..d225359 100644
--- a/crypto/openssh/sshconnect2.c
+++ b/crypto/openssh/sshconnect2.c
@@ -9,11 +9,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
@@ -28,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.11 2000/05/25 20:45:20 markus Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.18 2000/09/07 20:27:55 deraadt Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
@@ -54,6 +49,7 @@ RCSID("$OpenBSD: sshconnect2.c,v 1.11 2000/05/25 20:45:20 markus Exp $");
 #include "dsa.h"
 #include "sshconnect.h"
 #include "authfile.h"
+#include "authfd.h"
 
 /* import */
 extern char *client_version_string;
@@ -71,7 +67,6 @@ void
 ssh_kex_dh(Kex *kex, char *host, struct sockaddr *hostaddr,
     Buffer *client_kexinit, Buffer *server_kexinit)
 {
-	int i;
 	int plen, dlen;
 	unsigned int klen, kout;
 	char *signature = NULL;
@@ -265,9 +260,12 @@ ssh2_try_passwd(const char *server_user, const char *host, const char *service)
 	char prompt[80];
 	char *password;
 
-	if (attempt++ > options.number_of_password_prompts)
+	if (attempt++ >= options.number_of_password_prompts)
 		return 0;
 
+	if(attempt != 1)
+		error("Permission denied, please try again.");
+
 	snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
 	    server_user, host);
 	password = read_passphrase(prompt, 0);
@@ -284,42 +282,32 @@ ssh2_try_passwd(const char *server_user, const char *host, const char *service)
 	return 1;
 }
 
+typedef int sign_fn(
+    Key *key,
+    unsigned char **sigp, int *lenp,
+    unsigned char *data, int datalen);
+
 int
-ssh2_try_pubkey(char *filename,
+ssh2_sign_and_send_pubkey(Key *k, sign_fn *do_sign,
     const char *server_user, const char *host, const char *service)
 {
 	Buffer b;
-	Key *k;
 	unsigned char *blob, *signature;
 	int bloblen, slen;
-	struct stat st;
-
-	if (stat(filename, &st) != 0) {
-		debug("key does not exist: %s", filename);
-		return 0;
-	}
-	debug("try pubkey: %s", filename);
+	int skip = 0;
+	int ret = -1;
 
-	k = key_new(KEY_DSA);
-	if (!load_private_key(filename, "", k, NULL)) {
-		int success = 0;
-		char *passphrase;
-		char prompt[300];
-		snprintf(prompt, sizeof prompt,
-		     "Enter passphrase for DSA key '%.100s': ",
-		     filename);
-		passphrase = read_passphrase(prompt, 0);
-		success = load_private_key(filename, passphrase, k, NULL);
-		memset(passphrase, 0, strlen(passphrase));
-		xfree(passphrase);
-		if (!success)
-			return 0;
-	}
 	dsa_make_key_blob(k, &blob, &bloblen);
 
 	/* data to be signed */
 	buffer_init(&b);
-	buffer_append(&b, session_id2, session_id2_len);
+	if (datafellows & SSH_COMPAT_SESSIONID_ENCODING) {
+		buffer_put_string(&b, session_id2, session_id2_len);
+		skip = buffer_len(&b);
+	} else {
+		buffer_append(&b, session_id2, session_id2_len);
+		skip = session_id2_len; 
+	}
 	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
 	buffer_put_cstring(&b, server_user);
 	buffer_put_cstring(&b,
@@ -332,13 +320,16 @@ ssh2_try_pubkey(char *filename,
 	buffer_put_string(&b, blob, bloblen);
 
 	/* generate signature */
-	dsa_sign(k, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
-	key_free(k);
+	ret = do_sign(k, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
+	if (ret == -1) {
+		xfree(blob);
+		buffer_free(&b);
+		return 0;
+	}
 #ifdef DEBUG_DSS
 	buffer_dump(&b);
 #endif
 	if (datafellows & SSH_BUG_PUBKEYAUTH) {
-		/* e.g. ssh-2.0.13: data-to-be-signed != data-on-the-wire */
 		buffer_clear(&b);
 		buffer_append(&b, session_id2, session_id2_len);
 		buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
@@ -355,9 +346,9 @@ ssh2_try_pubkey(char *filename,
 	xfree(signature);
 
 	/* skip session id and packet type */
-	if (buffer_len(&b) < session_id2_len + 1)
+	if (buffer_len(&b) < skip + 1)
 		fatal("ssh2_try_pubkey: internal error");
-	buffer_consume(&b, session_id2_len + 1);
+	buffer_consume(&b, skip + 1);
 
 	/* put remaining data from buffer into packet */
 	packet_start(SSH2_MSG_USERAUTH_REQUEST);
@@ -367,12 +358,88 @@ ssh2_try_pubkey(char *filename,
 	/* send */
 	packet_send();
 	packet_write_wait();
+
 	return 1;
 }
 
+int
+ssh2_try_pubkey(char *filename,
+    const char *server_user, const char *host, const char *service)
+{
+	Key *k;
+	int ret = 0;
+	struct stat st;
+
+	if (stat(filename, &st) != 0) {
+		debug("key does not exist: %s", filename);
+		return 0;
+	}
+	debug("try pubkey: %s", filename);
+
+	k = key_new(KEY_DSA);
+	if (!load_private_key(filename, "", k, NULL)) {
+		int success = 0;
+		char *passphrase;
+		char prompt[300];
+		snprintf(prompt, sizeof prompt,
+		     "Enter passphrase for DSA key '%.100s': ",
+		     filename);
+		passphrase = read_passphrase(prompt, 0);
+		success = load_private_key(filename, passphrase, k, NULL);
+		memset(passphrase, 0, strlen(passphrase));
+		xfree(passphrase);
+		if (!success) {
+			key_free(k);
+			return 0;
+		}
+	}
+	ret = ssh2_sign_and_send_pubkey(k, dsa_sign, server_user, host, service);
+	key_free(k);
+	return ret;
+}
+
+int agent_sign(
+    Key *key,
+    unsigned char **sigp, int *lenp,
+    unsigned char *data, int datalen)
+{
+	int ret = -1;
+	AuthenticationConnection *ac = ssh_get_authentication_connection();
+	if (ac != NULL) {
+		ret = ssh_agent_sign(ac, key, sigp, lenp, data, datalen);
+		ssh_close_authentication_connection(ac);
+	}
+	return ret;
+}
+
+int
+ssh2_try_agent(AuthenticationConnection *ac,
+    const char *server_user, const char *host, const char *service)
+{
+	static int called = 0;
+	char *comment;
+	Key *k;
+	int ret;
+
+	if (called == 0) {
+		k = ssh_get_first_identity(ac, &comment, 2);
+		called ++;
+	} else {
+		k = ssh_get_next_identity(ac, &comment, 2);
+	}
+	if (k == NULL)
+		return 0;
+	debug("trying DSA agent key %s", comment);
+	xfree(comment);
+	ret = ssh2_sign_and_send_pubkey(k, agent_sign, server_user, host, service);
+	key_free(k);
+	return ret;
+}
+
 void
 ssh_userauth2(const char *server_user, char *host)
 {
+	AuthenticationConnection *ac = ssh_get_authentication_connection();
 	int type;
 	int plen;
 	int sent;
@@ -427,12 +494,17 @@ ssh_userauth2(const char *server_user, char *host)
 			debug("partial success");
 		if (options.dsa_authentication &&
 		    strstr(auths, "publickey") != NULL) {
-			while (i < options.num_identity_files2) {
-				sent = ssh2_try_pubkey(
-				    options.identity_files2[i++],
+			if (ac != NULL)
+				sent = ssh2_try_agent(ac,
 				    server_user, host, service);
-				if (sent)
-					break;
+			if (!sent) {
+				while (i < options.num_identity_files2) {
+					sent = ssh2_try_pubkey(
+					    options.identity_files2[i++],
+					    server_user, host, service);
+					if (sent)
+						break;
+				}
 			}
 		}
 		if (!sent) {
@@ -446,6 +518,8 @@ ssh_userauth2(const char *server_user, char *host)
 			fatal("Permission denied (%s).", auths);
 		xfree(auths);
 	}
+	if (ac != NULL)
+		ssh_close_authentication_connection(ac);
 	packet_done();
 	debug("ssh-userauth2 successfull");
 }
diff --git a/crypto/openssh/sshd/Makefile b/crypto/openssh/sshd/Makefile
index f74a032..0adfcd6 100644
--- a/crypto/openssh/sshd/Makefile
+++ b/crypto/openssh/sshd/Makefile
@@ -5,15 +5,16 @@ BINOWN=	root
 BINMODE=555
 BINDIR=	/usr/sbin
 MAN=	sshd.8
+CFLAGS+=-DHAVE_LOGIN_CAP
 
 SRCS=	sshd.c auth-rhosts.c auth-passwd.c auth-rsa.c auth-rh-rsa.c \
 	pty.c log-server.c login.c servconf.c serverloop.c \
-	auth.c auth1.c auth2.c session.c
+	auth.c auth1.c auth2.c auth-options.c session.c
 
 .include <bsd.own.mk> # for KERBEROS and AFS
 
-.if (${KERBEROS} == "yes")
-.if (${AFS} == "yes")
+.if (${KERBEROS:L} == "yes")
+.if (${AFS:L} == "yes")
 CFLAGS+= -DAFS
 LDADD+=  -lkafs
 DPADD+=  ${LIBKRBAFS}
@@ -24,7 +25,7 @@ LDADD+=	 -lkrb
 DPADD+=	 ${LIBKRB}
 .endif # KERBEROS
 
-.if (${SKEY} == "yes")
+.if (${SKEY:L} == "yes")
 SRCS+=	auth-skey.c
 .endif
 
@@ -33,13 +34,13 @@ SRCS+=	auth-skey.c
 LDADD+=	-lcrypto -lutil -lz
 DPADD+=	${LIBCRYPTO} ${LIBUTIL} ${LIBZ}
 
-.if (${TCP_WRAPPERS} == "yes")
+.if (${TCP_WRAPPERS:L} == "yes")
 CFLAGS+= -DLIBWRAP
 LDADD+= -lwrap
 DPADD+= ${LIBWRAP}
 .endif
 
-.if (${SKEY} == "yes")
+.if (${SKEY:L} == "yes")
 CFLAGS+= -DSKEY
 LDADD+= -lskey
 DPADD+= ${SKEY}
diff --git a/crypto/openssh/tildexpand.c b/crypto/openssh/tildexpand.c
index 4ecb785..f25f7d9 100644
--- a/crypto/openssh/tildexpand.c
+++ b/crypto/openssh/tildexpand.c
@@ -2,11 +2,16 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Wed Jul 12 01:07:36 1995 ylo
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: tildexpand.c,v 1.6 1999/12/06 19:10:38 deraadt Exp $");
+RCSID("$OpenBSD: tildexpand.c,v 1.8 2000/09/07 20:27:55 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
diff --git a/crypto/openssh/ttymodes.c b/crypto/openssh/ttymodes.c
index 25f5013..a7a3e93 100644
--- a/crypto/openssh/ttymodes.c
+++ b/crypto/openssh/ttymodes.c
@@ -2,15 +2,20 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Tue Mar 21 15:59:15 1995 ylo
  * Encoding and decoding of terminal modes in a portable way.
  * Much of the format is defined in ttymodes.h; it is included multiple times
  * into this file with the appropriate macro definitions to generate the
  * suitable code.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: ttymodes.c,v 1.6 2000/04/14 10:30:34 markus Exp $");
+RCSID("$OpenBSD: ttymodes.c,v 1.8 2000/09/07 20:27:55 deraadt Exp $");
 
 #include "packet.h"
 #include "ssh.h"
diff --git a/crypto/openssh/ttymodes.h b/crypto/openssh/ttymodes.h
index f8243f6..a26e4fa 100644
--- a/crypto/openssh/ttymodes.h
+++ b/crypto/openssh/ttymodes.h
@@ -1,18 +1,17 @@
 /*
- *
- * ttymodes.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * 	SGTTY stuff contributed by Janne Snabb <snabb@niksula.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
  *
- * Created: Tue Mar 21 15:42:09 1995 ylo
- *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: ttymodes.h,v 1.7 2000/04/14 10:30:34 markus Exp $"); */
+/* RCSID("$OpenBSD: ttymodes.h,v 1.9 2000/09/07 20:27:55 deraadt Exp $"); */
 
 /* The tty mode description is a stream of bytes.  The stream consists of
  * opcode-arguments pairs.  It is terminated by opcode TTY_OP_END (0).
diff --git a/crypto/openssh/uidswap.c b/crypto/openssh/uidswap.c
index 20f04cf..8e7c479 100644
--- a/crypto/openssh/uidswap.c
+++ b/crypto/openssh/uidswap.c
@@ -2,12 +2,17 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Sat Sep  9 01:56:14 1995 ylo
  * Code for uid-swapping.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: uidswap.c,v 1.6 2000/04/14 10:30:34 markus Exp $");
+RCSID("$OpenBSD: uidswap.c,v 1.9 2000/09/07 20:27:55 deraadt Exp $");
 
 #include "ssh.h"
 #include "uidswap.h"
@@ -43,15 +48,15 @@ temporarily_use_uid(uid_t uid)
 
 	/* Set the effective uid to the given (unprivileged) uid. */
 	if (seteuid(uid) == -1)
-		debug("seteuid %d: %.100s", (int) uid, strerror(errno));
+		debug("seteuid %u: %.100s", (u_int) uid, strerror(errno));
 #else /* SAVED_IDS_WORK_WITH_SETUID */
 	/* Propagate the privileged uid to all of our uids. */
 	if (setuid(geteuid()) < 0)
-		debug("setuid %d: %.100s", (int) geteuid(), strerror(errno));
+		debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno));
 
 	/* Set the effective uid to the given (unprivileged) uid. */
 	if (seteuid(uid) == -1)
-		debug("seteuid %d: %.100s", (int) uid, strerror(errno));
+		debug("seteuid %u: %.100s", (u_int) uid, strerror(errno));
 #endif /* SAVED_IDS_WORK_WITH_SETEUID */
 }
 
@@ -64,7 +69,7 @@ restore_uid()
 #ifdef SAVED_IDS_WORK_WITH_SETEUID
 	/* Set the effective uid back to the saved uid. */
 	if (seteuid(saved_euid) < 0)
-		debug("seteuid %d: %.100s", (int) saved_euid, strerror(errno));
+		debug("seteuid %u: %.100s", (u_int) saved_euid, strerror(errno));
 #else /* SAVED_IDS_WORK_WITH_SETEUID */
 	/*
 	 * We are unable to restore the real uid to its unprivileged value.
@@ -83,5 +88,5 @@ void
 permanently_set_uid(uid_t uid)
 {
 	if (setuid(uid) < 0)
-		debug("setuid %d: %.100s", (int) uid, strerror(errno));
+		debug("setuid %u: %.100s", (u_int) uid, strerror(errno));
 }
diff --git a/crypto/openssh/uidswap.h b/crypto/openssh/uidswap.h
index c08a370..ff6fad4 100644
--- a/crypto/openssh/uidswap.h
+++ b/crypto/openssh/uidswap.h
@@ -1,15 +1,13 @@
 /*
- *
- * uidswap.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
  *
- * Created: Sat Sep  9 01:43:15 1995 ylo
- * Last modified: Sat Sep  9 02:34:04 1995 ylo
- *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #ifndef UIDSWAP_H
diff --git a/crypto/openssh/util.c b/crypto/openssh/util.c
new file mode 100644
index 0000000..71808f1
--- /dev/null
+++ b/crypto/openssh/util.c
@@ -0,0 +1,99 @@
+/*	$OpenBSD: util.c,v 1.5 2000/09/07 20:27:55 deraadt Exp $	*/
+
+/*
+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+RCSID("$OpenBSD: util.c,v 1.5 2000/09/07 20:27:55 deraadt Exp $");
+
+#include "ssh.h"
+
+char *
+chop(char *s)
+{
+	char *t = s;
+	while (*t) {
+		if(*t == '\n' || *t == '\r') {
+			*t = '\0';
+			return s;
+		}
+		t++;
+	}
+	return s;
+
+}
+
+void
+set_nonblock(int fd)
+{
+	int val;
+	if (isatty(fd)) {
+		/* do not mess with tty's */
+		debug("no set_nonblock for tty fd %d", fd);
+		return;
+	}
+	val = fcntl(fd, F_GETFL, 0);
+	if (val < 0) {
+		error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
+		return;
+	}
+	if (val & O_NONBLOCK)
+		return;
+	debug("fd %d setting O_NONBLOCK", fd);
+	val |= O_NONBLOCK;
+	if (fcntl(fd, F_SETFL, val) == -1)
+		if (errno != ENODEV)
+			error("fcntl(%d, F_SETFL, O_NONBLOCK): %s",
+			    fd, strerror(errno));
+}
+
+/* Characters considered whitespace in strsep calls. */
+#define WHITESPACE " \t\r\n"
+
+char *
+strdelim(char **s)
+{
+	char *old;
+	int wspace = 0;
+
+	if (*s == NULL)
+		return NULL;
+
+	old = *s;
+
+	*s = strpbrk(*s, WHITESPACE "=");
+	if (*s == NULL)
+		return (old);
+
+	/* Allow only one '=' to be skipped */
+	if (*s[0] == '=')
+		wspace = 1;
+	*s[0] = '\0';
+
+	*s += strspn(*s + 1, WHITESPACE) + 1;
+	if (*s[0] == '=' && !wspace)
+		*s += strspn(*s + 1, WHITESPACE) + 1;
+
+	return (old);
+}
diff --git a/crypto/openssh/uuencode.c b/crypto/openssh/uuencode.c
index fc84d5a..38de418 100644
--- a/crypto/openssh/uuencode.c
+++ b/crypto/openssh/uuencode.c
@@ -1,11 +1,36 @@
+/*	$OpenBSD: uuencode.c,v 1.7 2000/09/07 20:27:55 deraadt Exp $	*/
+
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #include "includes.h"
 #include "xmalloc.h"
 
 #include <resolv.h>
 
+RCSID("$OpenBSD: uuencode.c,v 1.7 2000/09/07 20:27:55 deraadt Exp $");
+
 int
 uuencode(unsigned char *src, unsigned int srclength,
     char *target, size_t targsize)
diff --git a/crypto/openssh/uuencode.h b/crypto/openssh/uuencode.h
index c92c627..dca80ec 100644
--- a/crypto/openssh/uuencode.h
+++ b/crypto/openssh/uuencode.h
@@ -1,3 +1,27 @@
+/*
+ * Copyright (c) 1999 Markus Friedl.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
 #ifndef UUENCODE_H
 #define UUENCODE_H
 int	uuencode(unsigned char *src, unsigned int srclength, char *target, size_t targsize);
diff --git a/crypto/openssh/version.h b/crypto/openssh/version.h
index d577644..bfd4327 100644
--- a/crypto/openssh/version.h
+++ b/crypto/openssh/version.h
@@ -1 +1 @@
-#define SSH_VERSION	"OpenSSH-2.1"
+#define SSH_VERSION	"OpenSSH_2.2.0"
diff --git a/crypto/openssh/xmalloc.c b/crypto/openssh/xmalloc.c
index 3155099..738c9cd 100644
--- a/crypto/openssh/xmalloc.c
+++ b/crypto/openssh/xmalloc.c
@@ -2,13 +2,18 @@
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- * Created: Mon Mar 20 21:23:10 1995 ylo
  * Versions of malloc and friends that check their results, and never return
  * failure (they call fatal if they encounter an error).
+ * 
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
 #include "includes.h"
-RCSID("$Id: xmalloc.c,v 1.6 2000/04/14 10:30:34 markus Exp $");
+RCSID("$OpenBSD: xmalloc.c,v 1.8 2000/09/07 20:27:55 deraadt Exp $");
 
 #include "ssh.h"
 
diff --git a/crypto/openssh/xmalloc.h b/crypto/openssh/xmalloc.h
index 31291ea..59a598e 100644
--- a/crypto/openssh/xmalloc.h
+++ b/crypto/openssh/xmalloc.h
@@ -1,20 +1,20 @@
 /*
- *
- * xmalloc.h
- *
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
- *
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
- *
  * Created: Mon Mar 20 22:09:17 1995 ylo
  *
  * Versions of malloc and friends that check their results, and never return
  * failure (they call fatal if they encounter an error).
  *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose.  Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$Id: xmalloc.h,v 1.3 2000/04/14 10:30:34 markus Exp $"); */
+/* RCSID("$OpenBSD: xmalloc.h,v 1.5 2000/09/07 20:27:56 deraadt Exp $"); */
 
 #ifndef XMALLOC_H
 #define XMALLOC_H