import openssh-4.2p1-gsskex-20050926-2.patch

153 files changed, 6046 insertions, 2719 deletions

diff --git a/CREDITS b/CREDITS
index 2a77b8729..82b9f2210 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3,6 +3,7 @@ Tatu Ylonen <ylo@cs.hut.fi> - Creator of SSH
 Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
 Theo de Raadt, and Dug Song - Creators of OpenSSH
 
+Ahsan Rashid <arms@sco.com> - UnixWare long passwords
 Alain St-Denis <Alain.St-Denis@ec.gc.ca> - Irix fix
 Alexandre Oliva <oliva@lsd.ic.unicamp.br> - AIX fixes
 Andre Lucas <andre@ae-35.com> - new login code, many fixes
@@ -32,6 +33,7 @@ David Del Piero <David.DelPiero@qed.qld.gov.au> - bug fixes
 David Hesprich <darkgrue@gue-tech.org> - Configure fixes
 David Rankin <drankin@bohemians.lexington.ky.us> - libwrap, AIX, NetBSD fixes
 Dag-Erling Smørgrav <des at freebsd.org> - Challenge-Response PAM code.
+Dhiraj Gulati <dgulati@sco.com> - UnixWare long passwords
 Ed Eden <ede370@stl.rural.usda.gov> - configure fixes
 Garrick James <garrick@james.net> - configure fixes
 Gary E. Miller <gem@rellim.com> - SCO support
@@ -98,5 +100,5 @@ Apologies to anyone I have missed.
 
 Damien Miller <djm@mindrot.org>
 
-$Id: CREDITS,v 1.79 2004/05/26 23:59:31 dtucker Exp $
+$Id: CREDITS,v 1.80 2005/08/26 20:15:20 tim Exp $
 
diff --git a/ChangeLog b/ChangeLog
index 046e32e8a..9573f8672 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,671 @@
+20050901
+ - (djm) Update RPM spec file versions
+
+20050831
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2005/08/30 22:08:05
+     [gss-serv.c sshconnect2.c]
+     destroy credentials if krb5_kuserok() call fails. Stops credentials being
+     delegated to users who are not authorised for GSSAPIAuthentication when
+     GSSAPIDeletegateCredentials=yes and another authentication mechanism 
+     succeeds; bz#1073 reported by paul.moore AT centrify.com, fix by 
+     simon AT sxw.org.uk, tested todd@ biorn@ jakob@; ok deraadt@
+   - markus@cvs.openbsd.org 2005/08/31 09:28:42
+     [version.h]
+     4.2
+ - (dtucker) [README] Update release note URL to 4.2
+ - (tim) [configure.ac auth.c defines.h session.c openbsd-compat/port-uw.c
+   openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] libiaf cleanup. Disable
+   libiaf bits for OpenServer6. Free memory allocated by ia_get_logpwd().
+   Feedback and OK dtucker@
+
+20050830
+ - (tim) [configure.ac] Back out last change. It needs to be done differently.
+
+20050829
+ - (tim) [configure.ac] ia_openinfo() seems broken on OSR6. Limit UW long
+   password support to 7.x for now.
+
+20050826
+ - (tim) [CREDITS LICENCE auth.c configure.ac defines.h includes.h session.c
+   openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h
+   openbsd-compat/xcrypt.c] New files [openssh/openbsd-compat/port-uw.c
+   openssh/openbsd-compat/port-uw.h] Support long passwords (> 8-char)
+   on UnixWare 7 from Dhiraj Gulati and Ahsan Rashid. Cleanup and testing
+   by tim@. Feedback and OK dtucker@
+
+20050823
+ - (dtucker) [regress/test-exec.sh] Do not prepend an extra "/" to a fully-
+   qualified sshd pathname since some systems (eg Cygwin) may consider "/foo"
+   and "//foo" to be different.  Spotted by vinschen at redhat.com.
+ - (tim) [configure.ac] Not all gcc's support -Wsign-compare. Enhancements
+   and OK dtucker@
+ - (tim) [defines.h] PATH_MAX bits for OpenServer OK dtucker@
+
+20050821
+ - (dtucker) [configure.ac defines.h includes.h sftp.c] Add support for
+   LynxOS, patch from Olli Savia (ops at iki.fi).  ok djm@
+
+20050816
+ - (djm) [ttymodes.c] bugzilla #1025: Fix encoding of _POSIX_VDISABLE,
+   from Jacob Nevins; ok dtucker@
+
+20050815
+ - (tim) [sftp.c] wrap el_end() in #ifdef USE_LIBEDIT
+ - (tim) [configure.ac] corrections to libedit tests. Report and patches
+   by skeleten AT shillest.net
+
+20050812
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2005/07/28 17:36:22
+     [packet.c]
+     missing packet_init_compression(); from solar
+   - djm@cvs.openbsd.org 2005/07/30 01:26:16
+     [ssh.c]
+     fix -D listen_host initialisation, so it picks up gateway_ports setting
+     correctly
+   - djm@cvs.openbsd.org 2005/07/30 02:03:47
+     [readconf.c]
+     listen_hosts initialisation here too; spotted greg AT y2005.nest.cx
+   - dtucker@cvs.openbsd.org 2005/08/06 10:03:12
+     [servconf.c]
+     Unbreak sshd ListenAddress for bare IPv6 addresses.
+     Report from Janusz Mucka; ok djm@
+   - jaredy@cvs.openbsd.org 2005/08/08 13:22:48
+     [sftp.c]
+     sftp prompt enhancements:
+     - in non-interactive mode, do not print an empty prompt at the end
+       before finishing
+     - print newline after EOF in editline mode
+     - call el_end() in editline mode
+     ok dtucker djm
+
+20050810
+ - (dtucker) [configure.ac] Test libedit library and headers for compatibility.
+   Report from skeleten AT shillest.net, ok djm@
+ - (dtucker) [LICENCE configure.ac defines.h openbsd-compat/realpath.c]
+   Sync current (thread-safe) version of realpath.c from OpenBSD (which is
+   in turn based on FreeBSD's).  ok djm@
+
+20050809
+ - (tim) [configure.ac] Allow --with-audit=no. OK dtucker@
+   Report by skeleten AT shillest.net
+
+20050803
+ - (dtucker) [openbsd-compat/fake-rfc2553.h] Check for EAI_* defines
+   individually and use a value less likely to collide with real values from
+   netdb.h.  Fixes compile warnings on FreeBSD 5.3.  ok djm@
+ - (dtucker) [openbsd-compat/fake-rfc2553.h] MAX_INT -> INT_MAX since the
+   latter is specified in the standard.
+
+20050802
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2005/07/27 10:39:03
+     [scp.c hostfile.c sftp-client.c]
+     Silence bogus -Wuninitialized warnings; ok djm@
+ - (dtucker) [configure.ac] Enable -Wuninitialized by default when compiling
+   with gcc.  ok djm@
+ - (dtucker) [configure.ac] Add a --with-Werror option to configure for
+   adding -Werror to CFLAGS when all of the configure tests are done. ok djm@
+
+20050726
+ - (dtucker) [configure.ac] Update zlib warning message too, pointed out by
+   tim@.
+ - (djm) OpenBSD CVS Sync
+   - otto@cvs.openbsd.org 2005/07/19 15:32:26
+     [auth-passwd.c]
+     auth_usercheck(3) can return NULL, so check for that. Report from
+     mpech@. ok markus@
+   - markus@cvs.openbsd.org 2005/07/25 11:59:40
+     [kex.c kex.h myproposal.h packet.c packet.h servconf.c session.c]
+     [sshconnect2.c sshd.c sshd_config sshd_config.5]
+     add a new compression method that delays compression until the user
+     has been authenticated successfully and set compression to 'delayed'
+     for sshd.
+     this breaks older openssh clients (< 3.5) if they insist on
+     compression, so you have to re-enable compression in sshd_config.
+     ok djm@
+
+20050725
+ - (dtucker) [configure.ac] Update zlib version check for CAN-2005-2096.
+
+20050717
+- OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2005/07/16 01:35:24
+     [auth1.c channels.c cipher.c clientloop.c kex.c session.c ssh.c]
+     [sshconnect.c]
+     spacing
+ - (djm) [acss.c auth-pam.c auth-shadow.c auth-skey.c auth1.c canohost.c]
+   [cipher-acss.c loginrec.c ssh-rand-helper.c sshd.c] Fix whitespace at EOL 
+   in portable too ("perl -p -i -e 's/\s+$/\n/' *.[ch]")
+ - (djm) [auth-pam.c sftp.c] spaces vs. tabs at start of line
+   - djm@cvs.openbsd.org 2005/07/17 06:49:04
+     [channels.c channels.h session.c session.h]
+     Fix a number of X11 forwarding channel leaks:
+     1. Refuse multiple X11 forwarding requests on the same session
+     2. Clean up all listeners after a single_connection X11 forward, not just
+        the one that made the single connection
+     3. Destroy X11 listeners when the session owning them goes away
+     testing and ok dtucker@
+   - djm@cvs.openbsd.org 2005/07/17 07:17:55
+     [auth-rh-rsa.c auth-rhosts.c auth2-chall.c auth2-gss.c channels.c]
+     [cipher-ctr.c gss-genr.c gss-serv.c kex.c moduli.c readconf.c]
+     [serverloop.c session.c sftp-client.c sftp.c ssh-add.c ssh-keygen.c]
+     [sshconnect.c sshconnect2.c]
+     knf says that a 2nd level indent is four (not three or five) spaces
+ -(djm) [audit.c auth1.c auth2.c entropy.c loginrec.c serverloop.c]
+  [ssh-rand-helper.c] fix portable 2nd level indents at 4 spaces too
+ - (djm) [monitor.c monitor_wrap.c] -Wsign-compare for PAM monitor calls
+ 
+20050716
+ - (dtucker) [auth-pam.c] Ensure that only one side of the authentication
+   socketpair stays open on in both the monitor and PAM process.  Patch from
+   Joerg Sonnenberger.
+
+20050714
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2005/07/06 09:33:05
+     [ssh.1]
+     clarify meaning of ssh -b ; with & ok jmc@
+   - dtucker@cvs.openbsd.org 2005/07/08 09:26:18
+     [misc.c]
+     Make comment match code; ok djm@
+   - markus@cvs.openbsd.org 2005/07/08 09:41:33
+     [channels.h]
+     race when efd gets closed while there is still buffered data:
+     change CHANNEL_EFD_OUTPUT_ACTIVE()
+        1) c->efd must always be valid AND
+        2a) no EOF has been seen OR
+        2b) there is buffered data
+     report, initial fix and testing Chuck Cranor
+   - dtucker@cvs.openbsd.org 2005/07/08 10:20:41
+     [ssh_config.5]
+     change BindAddress to match recent ssh -b change; prompted by markus@
+   - jmc@cvs.openbsd.org 2005/07/08 12:53:10
+     [ssh_config.5]
+     new sentence, new line;
+   - dtucker@cvs.openbsd.org 2005/07/14 04:00:43
+     [misc.h]
+     use __sentinel__ attribute; ok deraadt@ djm@ markus@
+ - (dtucker) [configure.ac defines.h] Define __sentinel__ to nothing if the
+   compiler doesn't understand it to prevent warnings.  If any mainstream
+   compiler versions acquire it we can test for those versions.  Based on
+   discussion with djm@.
+
+20050707
+ - dtucker [auth-krb5.c auth.h gss-serv-krb5.c] Move KRB5CCNAME generation for
+   the MIT Kerberos code path into a common function and expand mkstemp
+   template to be consistent with the rest of OpenSSH.  From sxw at
+   inf.ed.ac.uk, ok djm@
+ - (dtucker) [auth-krb5.c] There's no guarantee that snprintf will set errno
+   in the case where the buffer is insufficient, so always return ENOMEM.
+   Also pointed out by sxw at inf.ed.ac.uk.
+ - (dtucker) [acconfig.h auth-krb5.c configure.ac gss-serv-krb5.c] Remove
+   calls to krb5_init_ets, which has not been required since krb-1.1.x and
+   most Kerberos versions no longer export in their public API.  From sxw
+   at inf.ed.ac.uk, ok djm@
+
+20050706
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2005/07/01 13:19:47
+     [channels.c]
+     don't free() if getaddrinfo() fails; report mpech@
+   - djm@cvs.openbsd.org 2005/07/04 00:58:43
+     [channels.c clientloop.c clientloop.h misc.c misc.h ssh.c ssh_config.5]
+     implement support for X11 and agent forwarding over multiplex slave
+     connections. Because of protocol limitations, the slave connections inherit
+     the master's DISPLAY and SSH_AUTH_SOCK rather than distinctly forwarding
+     their own.
+     ok dtucker@ "put it in" deraadt@
+   - jmc@cvs.openbsd.org 2005/07/04 11:29:51
+     [ssh_config.5]
+     fix Xr and a little grammar;
+   - markus@cvs.openbsd.org 2005/07/04 14:04:11
+     [channels.c]
+     don't forget to set x11_saved_display
+
+20050626
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2005/06/17 22:53:47
+     [ssh.c sshconnect.c]
+     Fix ControlPath's %p expanding to "0" for a default port,
+     spotted dwmw2 AT infradead.org; ok markus@
+   - djm@cvs.openbsd.org 2005/06/18 04:30:36
+     [ssh.c ssh_config.5]
+     allow ControlPath=none, patch from dwmw2 AT infradead.org; ok dtucker@
+   - djm@cvs.openbsd.org 2005/06/25 22:47:49
+     [ssh.c]
+     do the default port filling code a few lines earlier, so it really 
+     does fix %p
+
+20050618
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2005/05/20 12:57:01;
+   [auth1.c] split protocol 1 auth methods into separate functions, makes 
+   authloop much more readable; fixes and ok markus@ (portable ok & 
+   polish dtucker@)
+   - djm@cvs.openbsd.org 2005/06/17 02:44:33
+   [auth1.c] make this -Wsign-compare clean; ok avsm@ markus@
+ - (djm) [loginrec.c ssh-rand-helper.c] Fix -Wsign-compare for portable,
+   tested and fixes tim@
+
+20050617
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2005/06/16 03:38:36
+     [channels.c channels.h clientloop.c clientloop.h ssh.c]
+     move x11_get_proto from ssh.c to clientloop.c, to make muliplexed xfwd
+     easier later; ok deraadt@
+   - markus@cvs.openbsd.org 2005/06/16 08:00:00
+     [canohost.c channels.c sshd.c]
+     don't exit if getpeername fails for forwarded ports; bugzilla #1054;
+     ok djm
+   - djm@cvs.openbsd.org 2005/06/17 02:44:33
+     [auth-rsa.c auth.c auth1.c auth2-chall.c auth2-gss.c authfd.c authfile.c]
+     [bufaux.c canohost.c channels.c cipher.c clientloop.c dns.c gss-serv.c]
+     [kex.c kex.h key.c mac.c match.c misc.c packet.c packet.h scp.c]
+     [servconf.c session.c session.h sftp-client.c sftp-server.c sftp.c]
+     [ssh-keyscan.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c sshd.c]
+     make this -Wsign-compare clean; ok avsm@ markus@
+     NB. auth1.c changes not committed yet (conflicts with uncommitted sync)
+     NB2. more work may be needed to make portable Wsign-compare clean
+ - (dtucker) [cipher.c openbsd-compat/openbsd-compat.h
+   openbsd-compat/openssl-compat.c] only include openssl compat stuff where
+   it's needed as it can cause conflicts elsewhere (eg xcrypt.c).  Found by
+   and ok tim@
+
+20050616
+ - (djm) OpenBSD CVS Sync
+   - jaredy@cvs.openbsd.org 2005/06/07 13:25:23
+     [progressmeter.c]
+     catch SIGWINCH and resize progress meter accordingly; ok markus dtucker
+   - djm@cvs.openbsd.org 2005/06/06 11:20:36
+     [auth.c auth.h misc.c misc.h ssh.c ssh_config.5 sshconnect.c]
+     introduce a generic %foo expansion function. replace existing % expansion 
+     and add expansion to ControlPath; ok markus@
+   - djm@cvs.openbsd.org 2005/06/08 03:50:00
+     [ssh-keygen.1 ssh-keygen.c sshd.8]
+     increase default rsa/dsa key length from 1024 to 2048 bits;
+     ok markus@ deraadt@
+   - djm@cvs.openbsd.org 2005/06/08 11:25:09
+     [clientloop.c readconf.c readconf.h ssh.c ssh_config.5]
+     add ControlMaster=auto/autoask options to support opportunistic
+     multiplexing; tested avsm@ and jakob@, ok markus@
+   - dtucker@cvs.openbsd.org 2005/06/09 13:43:49
+     [cipher.c]
+     Correctly initialize end of array sentinel; ok djm@
+     (Id sync only, change already in portable)
+
+20050609
+ - (dtucker) [cipher.c openbsd-compat/Makefile.in
+   openbsd-compat/openbsd-compat.h openbsd-compat/openssl-compat.{c,h}]
+   Move compatibility code for supporting older OpenSSL versions to the
+   compat layer.  Suggested by and "no objection" djm@
+
+20050607
+ - (dtucker) [configure.ac] Continue the hunt for LLONG_MIN and LLONG_MAX:
+   in today's episode we attempt to coax it from limits.h where it may be
+   hiding, failing that we take the DIY approach.  Tested by tim@
+
+20050603
+ - (dtucker) [configure.ac] Only try gcc -std=gnu99 if LLONG_MAX isn't
+   defined, and check that it helps before keeping it in CFLAGS.  Some old
+   gcc's don't set an error code when encountering an unknown value in -std.
+   Found and tested by tim@.
+ - (dtucker) [configure.ac] Point configure's reporting address at the
+   openssh-unix-dev list.  ok tim@ djm@
+
+20050602
+ - (tim) [configure.ac] Some platforms need sys/types.h for arpa/nameser.h.
+   Take AC_CHECK_HEADERS test out of ultrix section. It caused other platforms
+   to skip builtin standard includes tests. (first AC_CHECK_HEADERS test
+   must be run on all platforms) Add missing ;; to case statement. OK dtucker@
+
+20050601
+ - (dtucker) [configure.ac] Look for _getshort and _getlong in
+   arpa/nameser.h.
+ - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoll.c]
+   Add strtoll to the compat library, from OpenBSD.
+ - (dtucker) OpenBSD CVS Sync
+   - avsm@cvs.openbsd.org 2005/05/26 02:08:05
+     [scp.c]
+     If copying multiple files to a target file (which normally fails, as it
+     must be a target directory), kill the spawned ssh child before exiting.
+     This stops it trying to authenticate and spewing lots of output.
+     deraadt@ ok
+   - dtucker@cvs.openbsd.org 2005/05/26 09:08:12
+     [ssh-keygen.c]
+     uint32_t -> u_int32_t for consistency; ok djm@
+   - djm@cvs.openbsd.org 2005/05/27 08:30:37
+     [ssh.c]
+     fix -O for cases where no ControlPath has been specified or socket at
+     ControlPath is not contactable; spotted by and ok avsm@
+ - (tim) [config.guess config.sub] Update to '2005-05-27' version.
+ - (tim) [configure.ac] set TEST_SHELL for OpenServer 6
+
+20050531
+ - (dtucker) [contrib/aix/pam.conf] Correct comments.  From davidl at
+   vintela.com.
+ - (dtucker) [mdoc2man.awk] Teach it to understand .Ox.
+
+20050530
+ - (dtucker) [README] Link to new release notes.  Beter late than never...
+
+20050529
+ - (dtucker) [openbsd-compat/port-aix.c] Bug #1046: AIX 5.3 expects the
+   argument to passwdexpired to be initialized to NULL.  Suggested by tim@
+   While at it, initialize the other arguments to auth functions in case they
+   ever acquire this behaviour.
+ - (dtucker) [openbsd-compat/port-aix.c] Whitespace cleanups while there.
+ - (dtucker) [openbsd-compat/port-aix.c] Minor correction to debug message,
+   spotted by tim@.
+
+20050528
+ - (dtucker) [configure.ac] For AC_CHECK_HEADERS() and AC_CHECK_FUNCS() have
+   one entry per line to make it easier to merge changes.  ok djm@
+ - (dtucker) [configure.ac] strsep() may be defined in string.h, so check
+   for its presence and include it in the strsep check.
+ - (dtucker) [configure.ac] getpgrp may be defined in unistd.h, so check for
+   its presence before doing AC_FUNC_GETPGRP.
+ - (dtucker) [configure.ac] Merge HP-UX blocks into a common block with minor
+   version-specific variations as required.
+ - (dtucker) [openbsd-compat/port-aix.h] Use the HAVE_DECL_* definitions as
+   per the autoconf man page.  Configure should always define them but it
+   doesn't hurt to check.
+
+20050527
+ - (djm) [defines.h] Use our realpath if we have to define PATH_MAX, spotted by
+   David Leach; ok dtucker@
+ - (dtucker) [acconfig.h configure.ac defines.h includes.h sshpty.c
+   openbsd-compat/bsd-misc.c] Add support for Ultrix.  No, that's not a typo.
+   Required changes from Bernhard Simon, integrated by me.  ok djm@
+
+20050525
+ - (djm) [mpaux.c mpaux.h Makefile.in] Remove old mpaux.[ch] code, it has not 
+   been used for a while
+ - (djm) OpenBSD CVS Sync
+   - otto@cvs.openbsd.org 2005/04/05 13:45:31
+     [ssh-keygen.c]
+   - djm@cvs.openbsd.org 2005/04/06 09:43:59
+     [sshd.c]
+     avoid harmless logspam by not performing setsockopt() on non-socket;
+     ok markus@
+   - dtucker@cvs.openbsd.org 2005/04/06 12:26:06
+     [ssh.c]
+     Fix debug call for port forwards; patch from pete at seebeyond.com,
+     ok djm@ (ID sync only - change already in portable)
+   - djm@cvs.openbsd.org 2005/04/09 04:32:54
+     [misc.c misc.h tildexpand.c Makefile.in]
+     replace tilde_expand_filename with a simpler implementation, ahead of
+     more whacking; ok deraadt@
+   - jmc@cvs.openbsd.org 2005/04/14 12:30:30
+     [ssh.1]
+     arg to -b is an address, not if_name;
+     ok markus@
+   - jakob@cvs.openbsd.org 2005/04/20 10:05:45
+     [dns.c]
+     do not try to look up SSHFP for numerical hostname. ok djm@
+   - djm@cvs.openbsd.org 2005/04/21 06:17:50
+     [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8]
+     [sshd_config.5] OpenSSH doesn't ever look at the $HOME environment
+     variable, so don't say that we do (bz #623); ok deraadt@
+   - djm@cvs.openbsd.org 2005/04/21 11:47:19
+     [ssh.c]
+     don't allocate a pty when -n flag (/dev/null stdin) is set, patch from
+     ignasi.roca AT fujitsu-siemens.com (bz #829); ok dtucker@
+   - dtucker@cvs.openbsd.org 2005/04/23 23:43:47
+     [readpass.c]
+     Add debug message if read_passphrase can't open /dev/tty; bz #471;
+     ok djm@
+   - jmc@cvs.openbsd.org 2005/04/26 12:59:02
+     [sftp-client.h]
+     spelling correction in comment from wiz@netbsd;
+   - jakob@cvs.openbsd.org 2005/04/26 13:08:37
+     [ssh.c ssh_config.5]
+     fallback gracefully if client cannot connect to ControlPath. ok djm@
+   - moritz@cvs.openbsd.org 2005/04/28 10:17:56
+     [progressmeter.c ssh-keyscan.c]
+     add snprintf checks. ok djm@ markus@
+   - markus@cvs.openbsd.org 2005/05/02 21:13:22
+     [readpass.c]
+     missing {}
+   - djm@cvs.openbsd.org 2005/05/10 10:28:11
+     [ssh.c]
+     print nice error message for EADDRINUSE as well (ID sync only)
+   - djm@cvs.openbsd.org 2005/05/10 10:30:43
+     [ssh.c]
+     report real errors on fallback from ControlMaster=no to normal connect
+   - markus@cvs.openbsd.org 2005/05/16 15:30:51
+     [readconf.c servconf.c]
+     check return value from strdelim() for NULL (AddressFamily); mpech
+   - djm@cvs.openbsd.org 2005/05/19 02:39:55
+     [sshd_config.5]
+     sort config options, from grunk AT pestilenz.org; ok jmc@
+   - djm@cvs.openbsd.org 2005/05/19 02:40:52
+     [sshd_config]
+     whitespace nit, from grunk AT pestilenz.org
+   - djm@cvs.openbsd.org 2005/05/19 02:42:26
+     [includes.h]
+     fix cast, from grunk AT pestilenz.org
+   - djm@cvs.openbsd.org 2005/05/20 10:50:55
+     [ssh_config.5]
+     give a ProxyCommand example using nc(1), with and ok jmc@
+   - jmc@cvs.openbsd.org 2005/05/20 11:23:32
+     [ssh_config.5]
+     oops - article and spacing;
+   - avsm@cvs.openbsd.org 2005/05/23 22:44:01
+     [moduli.c ssh-keygen.c]
+     - removes signed/unsigned comparisons in moduli generation
+     - use strtonum instead of atoi where its easier
+     - check some strlcpy overflow and fatal instead of truncate
+   - djm@cvs.openbsd.org 2005/05/23 23:32:46
+     [cipher.c myproposal.h ssh.1 ssh_config.5 sshd_config.5]
+     add support for draft-harris-ssh-arcfour-fixes-02 improved arcfour modes;
+     ok markus@
+   - avsm@cvs.openbsd.org 2005/05/24 02:05:09
+     [ssh-keygen.c]
+     some style nits from dmiller@, and use a fatal() instead of a printf()/exit
+   - avsm@cvs.openbsd.org 2005/05/24 17:32:44
+     [atomicio.c atomicio.h authfd.c monitor_wrap.c msg.c scp.c sftp-client.c]
+     [ssh-keyscan.c sshconnect.c]
+     Switch atomicio to use a simpler interface; it now returns a size_t
+     (containing number of bytes read/written), and indicates error by
+     returning 0.  EOF is signalled by errno==EPIPE.
+     Typical use now becomes:
+
+     if (atomicio(read, ..., len) != len)
+             err(1,"read");
+
+     ok deraadt@, cloder@, djm@
+ - (dtucker) [regress/reexec.sh] Add ${EXEEXT} so this test also works on
+   Cygwin.
+ - (dtucker) [auth-pam.c] Bug #1033: Fix warnings building with PAM on Linux:
+   warning: dereferencing type-punned pointer will break strict-aliasing rules
+   warning: passing arg 3 of `pam_get_item' from incompatible pointer type
+   The type-punned pointer fix is based on a patch from SuSE's rpm.  ok djm@
+ - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1033: Provide
+   templates for _getshort and _getlong if missing to prevent compiler warnings
+   on Linux.
+ - (djm) [configure.ac openbsd-compat/Makefile.in]
+         [openbsd-compat/openbsd-compat.h openbsd-compat/strtonum.c]
+         Add strtonum(3) from OpenBSD libc, new code needs it. 
+         Unfortunately Linux forces us to do a bizarre dance with compiler
+         options to get LLONG_MIN/MAX; Spotted by and ok dtucker@ 
+
+20050524
+ - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
+         [contrib/suse/openssh.spec] Update spec file versions to 4.1p1
+ - (dtucker) [auth-pam.c] Since people don't seem to be getting the message
+   that USE_POSIX_THREADS is unsupported, not recommended and generally a bad
+   idea, it is now known as UNSUPPORTED_POSIX_THREADS_HACK.  Attempting to use
+   USE_POSIX_THREADS will now generate an error so we don't silently change
+   behaviour.  ok djm@
+ - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Ensure sufficient memory
+   allocation when retrieving core Windows environment.  Add CYGWIN variable
+   to propagated variables.  Patch from vinschen at redhat.com, ok djm@
+ - Release 4.1p1
+
+20050524
+ - (djm) [openbsd-compat/readpassphrase.c] bz #950: Retry tcsetattr to ensure
+   terminal modes are reset correctly. Fix from peak AT argo.troja.mff.cuni.cz;
+   "looks ok" dtucker@
+
+20050512
+ - (tim) [buildpkg.sh.in] missing ${PKG_INSTALL_ROOT} in init script
+   hard link section. Bug 1038.
+
+20050509
+ - (dtucker) [contrib/cygwin/ssh-host-config] Add a test and warning for a
+   user-mode mounts in Cygwin installation.  Patch from vinschen at redhat.com.
+
+20050504
+ - (djm) [ssh.c] some systems return EADDRINUSE on a bind to an already-used
+   unix domain socket, so catch that too; from jakob@ ok dtucker@
+
+20050503
+ - (dtucker) [canohost.c] normalise socket addresses returned by
+   get_remote_hostname().  This means that IPv4 addresses in log messages
+   on IPv6 enabled machines will no longer be prefixed by "::ffff:" and
+   AllowUsers, DenyUsers, AllowGroups, DenyGroups will match IPv4-style
+   addresses only for 4-in-6 mapped connections, regardless of whether
+   or not the machine is IPv6 enabled.  ok djm@
+
+20050425
+ - (dtucker) [regress/multiplex.sh] Use "kill -0 $pid" to check for the
+   existence of a process since it's more portable.  Found by jbasney at
+   ncsa.uiuc.edu; ok tim@
+ - (dtucker) [regress/multiplex.sh] Remove cleanup call since test-exec.sh
+   will clean up anyway.  From tim@
+ - (dtucker) [regress/multiplex.sh] Put control socket in /tmp so running
+   "make tests" works even if you're building on a filesystem that doesn't
+   support sockets.  From deengert at anl.gov, ok djm@
+
+20050424
+ - (dtucker) [INSTALL configure.ac] Make zlib version check test for 1.1.4 or
+   1.2.1.2 or higher.  With tim@, ok djm@
+
+20050423
+ - (tim) [config.guess] Add support for OpenServer 6.
+
+20050421
+ - (dtucker) [session.c] Bug #1024: Don't check pam_session_is_open if
+   UseLogin is set as PAM is not used to establish credentials in that
+   case.  Found by Michael Selvesteen, ok djm@
+
+20050419
+ - (dtucker) [INSTALL] Reference README.privsep for the privilege separation
+   requirements.  Pointed out by Bengt Svensson.
+ - (dtucker) [INSTALL] Put the s/key text and URL back together.
+ - (dtucker) [INSTALL] Fix s/key text too.
+
+20050411
+ - (tim) [configure.ac] UnixWare needs PASSWD_NEEDS_USERNAME
+
+20050405
+ - (dtucker) [configure.ac] Define HAVE_SO_PEERCRED if we have it.  ok djm@
+ - (dtucker) [auth-sia.c] Constify sys_auth_passwd, fixes build error on
+   Tru64.  Patch from cmadams at hiwaay.net.
+ - (dtucker) [auth-passwd.c auth-sia.h] Remove duplicate definitions of
+   sys_auth_passwd, pointed out by cmadams at hiwaay.net.
+
+20050403
+ - (djm) OpenBSD CVS Sync
+   - deraadt@cvs.openbsd.org 2005/03/31 18:39:21
+     [scp.c]
+     copy argv[] element instead of smashing the one that ps will see; ok otto
+   - djm@cvs.openbsd.org 2005/04/02 12:41:16
+     [scp.c]
+     since ssh has xstrdup, use it instead of strdup+test. unbreaks -Werror
+     build
+ - (dtucker) [monitor.c] Don't free buffers in audit functions, monitor_read
+   will free as needed.  ok tim@ djm@
+
+20050331
+ - (dtucker) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2005/03/16 11:10:38
+     [ssh_config.5]
+     get the syntax right for {Local,Remote}Forward;
+     based on a diff from markus;
+     problem report from ponraj;
+     ok dtucker@ markus@ deraadt@
+   - markus@cvs.openbsd.org 2005/03/16 21:17:39
+     [version.h]
+     4.1
+   - jmc@cvs.openbsd.org 2005/03/18 17:05:00
+     [sshd_config.5]
+     typo;
+ - (dtucker) [auth.h sshd.c openbsd-compat/port-aix.c] Bug #1006: fix bug in
+   handling of password expiry messages returned by AIX's authentication
+   routines, originally reported by robvdwal at sara.nl.
+ - (dtucker) [ssh.c] Prevent null pointer deref in port forwarding debug
+   message on some platforms.  Patch from pete at seebeyond.com via djm.
+ - (dtucker) [monitor.c] Remaining part of fix for bug #1006.
+
+20050329
+ - (dtucker) [contrib/aix/buildbff.sh] Bug #1005: Look up only the user we're
+   interested in which is much faster in large (eg LDAP or NIS) environments.
+   Patch from dleonard at vintela.com.
+
+20050321
+ - (dtucker) [configure.ac] Prevent configure --with-zlib from adding -Iyes
+   and -Lyes to CFLAGS and LIBS.  Pointed out by peter at slagheap.net,
+   with & ok tim@
+ - (dtucker) [configure.ac] Make configure error out if the user specifies
+   --with-libedit but the required libs can't be found, rather than silently
+   ignoring and continuing.  ok tim@
+ - (dtucker) [configure.ac openbsd-compat/port-aix.h] Prevent redefinitions
+   of setauthdb on AIX 5.3, reported by anders.liljegren at its.uu.se.
+
+20050317
+ - (tim) [configure.ac] Bug 998. Make path for --with-opensc optional.
+   Make --without-opensc work.
+ - (tim) [configure.ac] portability changes on test statements. Some shells
+   have problems with -a operator.
+ - (tim) [configure.ac] make some configure options a little more error proof.
+ - (tim) [configure.ac] remove trailing white space.
+
+20050314
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2005/03/10 10:15:02
+     [readconf.c]
+     Check listen addresses for null, prevents xfree from dying during
+     ClearAllForwardings (bz #996).  From  Craig Leres, ok markus@
+   - deraadt@cvs.openbsd.org 2005/03/10 22:01:05
+     [misc.c ssh-keygen.c servconf.c clientloop.c auth-options.c ssh-add.c
+     monitor.c sftp-client.c bufaux.h hostfile.c ssh.c sshconnect.c channels.c
+     readconf.c bufaux.c sftp.c]
+     spacing
+   - deraadt@cvs.openbsd.org 2005/03/10 22:40:38
+     [auth-options.c]
+     spacing
+   - markus@cvs.openbsd.org 2005/03/11 14:59:06
+     [ssh-keygen.c]
+     typo, missing \n; mpech
+   - jmc@cvs.openbsd.org 2005/03/12 11:55:03
+     [ssh_config.5]
+     escape `.' at eol to avoid double spacing issues;
+   - dtucker@cvs.openbsd.org 2005/03/14 10:09:03
+     [ssh-keygen.1]
+     Correct description of -H (bz #997);  ok markus@, punctuation jmc@
+   - dtucker@cvs.openbsd.org 2005/03/14 11:44:42
+     [auth.c]
+     Populate host for log message for logins denied by AllowUsers and
+     DenyUsers (bz #999); ok markus@ (patch by tryponraj at gmail.com)
+   - markus@cvs.openbsd.org 2005/03/14 11:46:56
+     [buffer.c buffer.h channels.c]
+     limit input buffer size for channels; bugzilla #896; with and ok dtucker@
+ - (tim) [contrib/caldera/openssh.spec] links in rc?.d were getting trashed
+   with a rpm -F
+
+20050313
+ - (dtucker) [contrib/cygwin/ssh-host-config] Makes the query for the
+   localized name of the local administrators group more reliable.  From
+   vinschen at redhat.com.
+
+20050312
+ - (dtucker) [regress/test-exec.sh] DEBUG can cause problems where debug
+   output ends up in the client's output, causing regress failures.  Found
+   by Corinna Vinschen.
+
 20050309
  - (dtucker) [regress/test-exec.sh] Set BIN_SH=xpg4 on OSF1/Digital Unix/Tru64
    so that regress tests behave.  From Chris Adams.
@@ -2321,4 +2989,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3707.2.1 2005/03/09 04:52:09 djm Exp $
+$Id: ChangeLog,v 1.3887 2005/09/01 09:10:48 djm Exp $
diff --git a/INSTALL b/INSTALL
index 4fc3744f3..753d2d061 100644
--- a/INSTALL
+++ b/INSTALL
@@ -3,7 +3,7 @@
 
 You will need working installations of Zlib and OpenSSL.
 
-Zlib 1.1.4 or greater:
+Zlib 1.1.4 or 1.2.1.2 or greater (ealier 1.2.x versions have problems):
 http://www.gzip.org/zlib/
 
 OpenSSL 0.9.6 or greater:
@@ -50,20 +50,20 @@ lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
 http://www.lothar.com/tech/crypto/
 
 S/Key Libraries:
+
+If you wish to use --with-skey then you will need the library below
+installed.  No other S/Key library is currently known to be supported.
+
 http://www.sparc.spb.su/solaris/skey/
 
 LibEdit:
-
 sftp now supports command-line editing via NetBSD's libedit.  If your
 platform has it available natively you can use that, alternatively
 you might try these multi-platform ports:
+
 http://www.thrysoee.dk/editline/
 http://sourceforge.net/projects/libedit/
 
-If you wish to use --with-skey then you will need the above library
-installed.  No other current S/Key library is currently known to be
-supported.
-
 2. Building / Installation
 --------------------------
 
@@ -91,6 +91,10 @@ make install
 This will install the binaries in /opt/{bin,lib,sbin}, but will place the
 configuration files in /etc/ssh.
 
+If you are using Privilege Separation (which is enabled by default)
+then you will also need to create the user, group and directory used by
+sshd for privilege separation.  See README.privsep for details.
+
 If you are using PAM, you may need to manually install a PAM control
 file as "/etc/pam.d/sshd" (or wherever your system prefers to keep
 them).  Note that the service name used to start PAM is __progname,
@@ -221,4 +225,4 @@ Please refer to the "reporting bugs" section of the webpage at
 http://www.openssh.com/
 
 
-$Id: INSTALL,v 1.66 2005/01/18 01:05:18 dtucker Exp $
+$Id: INSTALL,v 1.70 2005/04/24 07:52:23 dtucker Exp $
diff --git a/LICENCE b/LICENCE
index ae03eb3a7..ac3634f22 100644
--- a/LICENCE
+++ b/LICENCE
@@ -204,6 +204,7 @@ OpenSSH contains no GPL code.
         William Jones
         Darren Tucker
         Sun Microsystems
+        The SCO Group
 
      * Redistribution and use in source and binary forms, with or without
      * modification, are permitted provided that the following conditions
@@ -255,6 +256,7 @@ OpenSSH contains no GPL code.
         Damien Miller
         Eric P. Allman
         The Regents of the University of California
+        Constantin S. Svintsoff
 
         * Redistribution and use in source and binary forms, with or without
         * modification, are permitted provided that the following conditions
diff --git a/Makefile.in b/Makefile.in
index e0be3d04b..f73219ba6 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.270 2005/02/25 23:12:38 dtucker Exp $
+# $Id: Makefile.in,v 1.273 2005/05/29 07:22:29 dtucker Exp $
 
 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -66,8 +66,8 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o buffer.o \
         canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
         cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
         compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
-        log.o match.o moduli.o mpaux.o nchan.o packet.o \
-        readpass.o rsa.o tildexpand.o ttymodes.o xmalloc.o \
+        log.o match.o moduli.o nchan.o packet.o \
+        readpass.o rsa.o ttymodes.o xmalloc.o \
         atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
         monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \
         kexgex.o kexdhc.o kexgexc.o scard.o msg.o progressmeter.o dns.o \
@@ -190,7 +190,7 @@ ssh_prng_cmds.out:	ssh_prng_cmds
                 $(PERL) $(srcdir)/fixprogs ssh_prng_cmds $(ENT); \
         fi
 
-# fake rule to stop make trying to compile moduli.o into a binary "modulo"
+# fake rule to stop make trying to compile moduli.o into a binary "moduli.o"
 moduli:
         echo
 
diff --git a/README b/README
index 0c5335ff5..51f0ca4fb 100644
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-See http://www.openssh.com/txt/release-4.0 for the release notes.
+See http://www.openssh.com/txt/release-4.2 for the release notes.
 
 - A Japanese translation of this document and of the OpenSSH FAQ is
 - available at http://www.unixuser.org/~haruyama/security/openssh/index.html
@@ -56,9 +56,10 @@ References -
 [2] http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
 [3] http://www.gzip.org/zlib/
 [4] http://www.openssl.org/
-[5] http://www.kernel.org/pub/linux/libs/pam/ (PAM is standard on Solaris
-    and HP-UX 11)
+[5] http://www.openpam.org
+    http://www.kernel.org/pub/linux/libs/pam/ 
+    (PAM also is standard on Solaris and HP-UX 11)
 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
 [7] http://www.openssh.com/faq.html
 
-$Id: README,v 1.56.4.1 2005/03/09 03:12:09 djm Exp $
+$Id: README,v 1.60 2005/08/31 14:05:57 dtucker Exp $
diff --git a/README.privsep b/README.privsep
index ecb9d6914..f565e72da 100644
--- a/README.privsep
+++ b/README.privsep
@@ -38,8 +38,8 @@ privsep user and chroot directory:
 Privsep requires operating system support for file descriptor passing.
 Compression will be disabled on systems without a working mmap MAP_ANON.
 
-PAM-enabled OpenSSH is known to function with privsep on AIX, HP-UX
-(including Trusted Mode), Linux and Solaris.
+PAM-enabled OpenSSH is known to function with privsep on AIX, FreeBSD, 
+HP-UX (including Trusted Mode), Linux, NetBSD and Solaris.
 
 On Cygwin, Tru64 Unix, OpenServer, and Unicos only the pre-authentication
 part of privsep is supported.  Post-authentication privsep is disabled
@@ -60,4 +60,4 @@ process 1005 is the sshd process listening for new connections.
 process 6917 is the privileged monitor process, 6919 is the user owned
 sshd process and 6921 is the shell process.
 
-$Id: README.privsep,v 1.15 2004/10/06 10:09:32 dtucker Exp $
+$Id: README.privsep,v 1.16 2005/06/04 23:21:41 djm Exp $
diff --git a/WARNING.RNG b/WARNING.RNG
index 687891a73..97da74ff7 100644
--- a/WARNING.RNG
+++ b/WARNING.RNG
@@ -57,7 +57,7 @@ disproportionate time to execute.
 
 Tuning the random helper can be done by running ./ssh-random-helper in
 very verbose mode ("-vvv") and identifying the commands that are taking
-accessive amounts of time or hanging altogher.  Any problem commands can
+excessive amounts of time or hanging altogher.  Any problem commands can
 be modified or removed from ssh_prng_cmds.
 
 The default entropy collector will timeout programs which take too long
@@ -92,4 +92,4 @@ If you are forced to use ssh-rand-helper consider still downloading
 prngd/egd and configure OpenSSH using --with-prngd-port=xx or
 --with-prngd-socket=xx (refer to INSTALL for more information).
 
-$Id: WARNING.RNG,v 1.7 2004/12/06 11:40:11 dtucker Exp $
+$Id: WARNING.RNG,v 1.8 2005/05/26 01:47:54 djm Exp $
diff --git a/acconfig.h b/acconfig.h
index 5721f65fb..619c4b801 100644
--- a/acconfig.h
+++ b/acconfig.h
@@ -1,4 +1,4 @@
-/* $Id: acconfig.h,v 1.181 2005/02/25 23:07:38 dtucker Exp $ */
+/* $Id: acconfig.h,v 1.183 2005/07/07 10:33:36 dtucker Exp $ */
 
 /*
  * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -119,9 +119,6 @@
 /* Define if you are on NeXT */
 #undef HAVE_NEXT
 
-/* Define if you are on NEWS-OS */
-#undef HAVE_NEWS4
-
 /* Define if you want to enable PAM support */
 #undef USE_PAM
 
@@ -205,9 +202,6 @@
 /* Define if you don't want to use lastlog in session.c */
 #undef NO_SSH_LASTLOG
 
-/* Define if have krb5_init_ets */
-#undef KRB5_INIT_ETS
-
 /* Define if you don't want to use utmp */
 #undef DISABLE_UTMP
 
@@ -353,6 +347,12 @@
 /* getaddrinfo is broken (if present) */
 #undef BROKEN_GETADDRINFO
 
+/* platform uses an in-memory credentials cache */
+#undef USE_CCAPI
+
+/* platform has a Security Authorization Session API */
+#undef USE_SECURITY_SESSION_API
+
 /* updwtmpx is broken (if present) */
 #undef BROKEN_UPDWTMPX
 
diff --git a/acss.c b/acss.c
index 9364ba9fe..99efde071 100644
--- a/acss.c
+++ b/acss.c
@@ -1,4 +1,4 @@
-/*      $Id: acss.c,v 1.2 2004/02/06 04:22:43 dtucker Exp $ */
+/*      $Id: acss.c,v 1.3 2005/07/17 07:04:47 djm Exp $ */
 /*
  * Copyright (c) 2004 The OpenBSD project
  *
@@ -24,37 +24,37 @@
 
 /* decryption sbox */
 static unsigned char sboxdec[] = {
-        0x33, 0x73, 0x3b, 0x26, 0x63, 0x23, 0x6b, 0x76, 
-        0x3e, 0x7e, 0x36, 0x2b, 0x6e, 0x2e, 0x66, 0x7b, 
-        0xd3, 0x93, 0xdb, 0x06, 0x43, 0x03, 0x4b, 0x96, 
-        0xde, 0x9e, 0xd6, 0x0b, 0x4e, 0x0e, 0x46, 0x9b, 
-        0x57, 0x17, 0x5f, 0x82, 0xc7, 0x87, 0xcf, 0x12, 
-        0x5a, 0x1a, 0x52, 0x8f, 0xca, 0x8a, 0xc2, 0x1f, 
-        0xd9, 0x99, 0xd1, 0x00, 0x49, 0x09, 0x41, 0x90, 
-        0xd8, 0x98, 0xd0, 0x01, 0x48, 0x08, 0x40, 0x91, 
-        0x3d, 0x7d, 0x35, 0x24, 0x6d, 0x2d, 0x65, 0x74, 
-        0x3c, 0x7c, 0x34, 0x25, 0x6c, 0x2c, 0x64, 0x75, 
-        0xdd, 0x9d, 0xd5, 0x04, 0x4d, 0x0d, 0x45, 0x94, 
-        0xdc, 0x9c, 0xd4, 0x05, 0x4c, 0x0c, 0x44, 0x95, 
-        0x59, 0x19, 0x51, 0x80, 0xc9, 0x89, 0xc1, 0x10, 
-        0x58, 0x18, 0x50, 0x81, 0xc8, 0x88, 0xc0, 0x11, 
-        0xd7, 0x97, 0xdf, 0x02, 0x47, 0x07, 0x4f, 0x92, 
-        0xda, 0x9a, 0xd2, 0x0f, 0x4a, 0x0a, 0x42, 0x9f, 
-        0x53, 0x13, 0x5b, 0x86, 0xc3, 0x83, 0xcb, 0x16, 
-        0x5e, 0x1e, 0x56, 0x8b, 0xce, 0x8e, 0xc6, 0x1b, 
-        0xb3, 0xf3, 0xbb, 0xa6, 0xe3, 0xa3, 0xeb, 0xf6, 
-        0xbe, 0xfe, 0xb6, 0xab, 0xee, 0xae, 0xe6, 0xfb, 
-        0x37, 0x77, 0x3f, 0x22, 0x67, 0x27, 0x6f, 0x72, 
-        0x3a, 0x7a, 0x32, 0x2f, 0x6a, 0x2a, 0x62, 0x7f, 
-        0xb9, 0xf9, 0xb1, 0xa0, 0xe9, 0xa9, 0xe1, 0xf0, 
-        0xb8, 0xf8, 0xb0, 0xa1, 0xe8, 0xa8, 0xe0, 0xf1, 
-        0x5d, 0x1d, 0x55, 0x84, 0xcd, 0x8d, 0xc5, 0x14, 
-        0x5c, 0x1c, 0x54, 0x85, 0xcc, 0x8c, 0xc4, 0x15, 
-        0xbd, 0xfd, 0xb5, 0xa4, 0xed, 0xad, 0xe5, 0xf4, 
-        0xbc, 0xfc, 0xb4, 0xa5, 0xec, 0xac, 0xe4, 0xf5, 
-        0x39, 0x79, 0x31, 0x20, 0x69, 0x29, 0x61, 0x70, 
-        0x38, 0x78, 0x30, 0x21, 0x68, 0x28, 0x60, 0x71, 
-        0xb7, 0xf7, 0xbf, 0xa2, 0xe7, 0xa7, 0xef, 0xf2, 
+        0x33, 0x73, 0x3b, 0x26, 0x63, 0x23, 0x6b, 0x76,
+        0x3e, 0x7e, 0x36, 0x2b, 0x6e, 0x2e, 0x66, 0x7b,
+        0xd3, 0x93, 0xdb, 0x06, 0x43, 0x03, 0x4b, 0x96,
+        0xde, 0x9e, 0xd6, 0x0b, 0x4e, 0x0e, 0x46, 0x9b,
+        0x57, 0x17, 0x5f, 0x82, 0xc7, 0x87, 0xcf, 0x12,
+        0x5a, 0x1a, 0x52, 0x8f, 0xca, 0x8a, 0xc2, 0x1f,
+        0xd9, 0x99, 0xd1, 0x00, 0x49, 0x09, 0x41, 0x90,
+        0xd8, 0x98, 0xd0, 0x01, 0x48, 0x08, 0x40, 0x91,
+        0x3d, 0x7d, 0x35, 0x24, 0x6d, 0x2d, 0x65, 0x74,
+        0x3c, 0x7c, 0x34, 0x25, 0x6c, 0x2c, 0x64, 0x75,
+        0xdd, 0x9d, 0xd5, 0x04, 0x4d, 0x0d, 0x45, 0x94,
+        0xdc, 0x9c, 0xd4, 0x05, 0x4c, 0x0c, 0x44, 0x95,
+        0x59, 0x19, 0x51, 0x80, 0xc9, 0x89, 0xc1, 0x10,
+        0x58, 0x18, 0x50, 0x81, 0xc8, 0x88, 0xc0, 0x11,
+        0xd7, 0x97, 0xdf, 0x02, 0x47, 0x07, 0x4f, 0x92,
+        0xda, 0x9a, 0xd2, 0x0f, 0x4a, 0x0a, 0x42, 0x9f,
+        0x53, 0x13, 0x5b, 0x86, 0xc3, 0x83, 0xcb, 0x16,
+        0x5e, 0x1e, 0x56, 0x8b, 0xce, 0x8e, 0xc6, 0x1b,
+        0xb3, 0xf3, 0xbb, 0xa6, 0xe3, 0xa3, 0xeb, 0xf6,
+        0xbe, 0xfe, 0xb6, 0xab, 0xee, 0xae, 0xe6, 0xfb,
+        0x37, 0x77, 0x3f, 0x22, 0x67, 0x27, 0x6f, 0x72,
+        0x3a, 0x7a, 0x32, 0x2f, 0x6a, 0x2a, 0x62, 0x7f,
+        0xb9, 0xf9, 0xb1, 0xa0, 0xe9, 0xa9, 0xe1, 0xf0,
+        0xb8, 0xf8, 0xb0, 0xa1, 0xe8, 0xa8, 0xe0, 0xf1,
+        0x5d, 0x1d, 0x55, 0x84, 0xcd, 0x8d, 0xc5, 0x14,
+        0x5c, 0x1c, 0x54, 0x85, 0xcc, 0x8c, 0xc4, 0x15,
+        0xbd, 0xfd, 0xb5, 0xa4, 0xed, 0xad, 0xe5, 0xf4,
+        0xbc, 0xfc, 0xb4, 0xa5, 0xec, 0xac, 0xe4, 0xf5,
+        0x39, 0x79, 0x31, 0x20, 0x69, 0x29, 0x61, 0x70,
+        0x38, 0x78, 0x30, 0x21, 0x68, 0x28, 0x60, 0x71,
+        0xb7, 0xf7, 0xbf, 0xa2, 0xe7, 0xa7, 0xef, 0xf2,
         0xba, 0xfa, 0xb2, 0xaf, 0xea, 0xaa, 0xe2, 0xff
 };
 
@@ -95,38 +95,38 @@ static unsigned char sboxenc[] = {
 };
 
 static unsigned char reverse[] = {
-        0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0, 
-        0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0, 
-        0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8, 
-        0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8, 
-        0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4, 
-        0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4, 
-        0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec, 
-        0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc, 
-        0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2, 
-        0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2, 
-        0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea, 
-        0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa, 
-        0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6, 
-        0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6, 
-        0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee, 
-        0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe, 
-        0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1, 
-        0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1, 
-        0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9, 
-        0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9, 
-        0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5, 
-        0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5, 
-        0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed, 
-        0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd, 
-        0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3, 
-        0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3, 
-        0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb, 
-        0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb, 
-        0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7, 
-        0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7, 
-        0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef, 
-        0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff 
+        0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
+        0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
+        0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8,
+        0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
+        0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4,
+        0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
+        0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec,
+        0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
+        0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2,
+        0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
+        0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea,
+        0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
+        0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6,
+        0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
+        0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee,
+        0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
+        0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1,
+        0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
+        0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9,
+        0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
+        0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5,
+        0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
+        0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed,
+        0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
+        0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3,
+        0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
+        0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb,
+        0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
+        0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7,
+        0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
+        0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef,
+        0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff
 };
 
 /*
diff --git a/atomicio.c b/atomicio.c
index 7637e1671..12abbda16 100644
--- a/atomicio.c
+++ b/atomicio.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
  * Copyright (c) 1995,1999 Theo de Raadt.  All rights reserved.
  * All rights reserved.
  *
@@ -24,14 +25,14 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: atomicio.c,v 1.12 2003/07/31 15:50:16 avsm Exp $");
+RCSID("$OpenBSD: atomicio.c,v 1.13 2005/05/24 17:32:43 avsm Exp $");
 
 #include "atomicio.h"
 
 /*
  * ensure all of data on socket comes through. f==read || f==vwrite
  */
-ssize_t
+size_t
 atomicio(f, fd, _s, n)
         ssize_t (*f) (int, void *, size_t);
         int fd;
@@ -39,7 +40,8 @@ atomicio(f, fd, _s, n)
         size_t n;
 {
         char *s = _s;
-        ssize_t res, pos = 0;
+        size_t pos = 0;
+        ssize_t res;
 
         while (n > pos) {
                 res = (f) (fd, s + pos, n - pos);
@@ -51,10 +53,12 @@ atomicio(f, fd, _s, n)
                         if (errno == EINTR || errno == EAGAIN)
 #endif
                                 continue;
+                        return 0;
                 case 0:
-                        return (res);
+                        errno = EPIPE;
+                        return pos;
                 default:
-                        pos += res;
+                        pos += (u_int)res;
                 }
         }
         return (pos);
diff --git a/atomicio.h b/atomicio.h
index 5c0f392ef..7eccf206b 100644
--- a/atomicio.h
+++ b/atomicio.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: atomicio.h,v 1.5 2003/06/28 16:23:06 deraadt Exp $    */
+/*      $OpenBSD: atomicio.h,v 1.6 2005/05/24 17:32:43 avsm Exp $       */
 
 /*
  * Copyright (c) 1995,1999 Theo de Raadt.  All rights reserved.
@@ -28,6 +28,6 @@
 /*
  * Ensure all of data on socket comes through. f==read || f==vwrite
  */
-ssize_t atomicio(ssize_t (*)(int, void *, size_t), int, void *, size_t);
+size_t  atomicio(ssize_t (*)(int, void *, size_t), int, void *, size_t);
 
 #define vwrite (ssize_t (*)(int, void *, size_t))write
diff --git a/audit.c b/audit.c
index 18fc41047..c77d0c012 100644
--- a/audit.c
+++ b/audit.c
@@ -1,4 +1,4 @@
-/* $Id: audit.c,v 1.2 2005/02/08 10:52:48 dtucker Exp $ */
+/* $Id: audit.c,v 1.3 2005/07/17 07:26:44 djm Exp $ */
 
 /*
  * Copyright (c) 2004, 2005 Darren Tucker.  All rights reserved.
@@ -120,7 +120,7 @@ void
 audit_connection_from(const char *host, int port)
 {
         debug("audit connection from %s port %d euid %d", host, port,
-           (int)geteuid());
+            (int)geteuid());
 }
 
 /*
@@ -147,7 +147,7 @@ audit_session_open(const char *ttyn)
         const char *t = ttyn ? ttyn : "(no tty)";
 
         debug("audit session open euid %d user %s tty name %s", geteuid(),
-             audit_username(), t);
+            audit_username(), t);
 }
 
 /*
@@ -163,7 +163,7 @@ audit_session_close(const char *ttyn)
         const char *t = ttyn ? ttyn : "(no tty)";
 
         debug("audit session close euid %d user %s tty name %s", geteuid(),
-             audit_username(), t);
+            audit_username(), t);
 }
 
 /*
diff --git a/auth-krb5.c b/auth-krb5.c
index 2f742534a..5f554a66b 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -54,9 +54,6 @@ krb5_init(void *context)
                 problem = krb5_init_context(&authctxt->krb5_ctx);
                 if (problem)
                         return (problem);
-#ifdef KRB5_INIT_ETS
-                krb5_init_ets(authctxt->krb5_ctx);
-#endif
         }
         return (0);
 }
@@ -67,9 +64,6 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
 #ifndef HEIMDAL
         krb5_creds creds;
         krb5_principal server;
-        char ccname[40];
-        int tmpfd;
-        mode_t old_umask;
 #endif
         krb5_error_code problem;
         krb5_ccache ccache = NULL;
@@ -146,26 +140,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
                 goto out;
         }
 
-        snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
-
-        old_umask = umask(0177);
-        tmpfd = mkstemp(ccname + strlen("FILE:"));
-        umask(old_umask);
-        if (tmpfd == -1) {
-                logit("mkstemp(): %.100s", strerror(errno));
-                problem = errno;
-                goto out;
-        }
-
-        if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
-                logit("fchmod(): %.100s", strerror(errno));
-                close(tmpfd);
-                problem = errno;
-                goto out;
-        }
-        close(tmpfd);
-
-        problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
+        problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);
         if (problem)
                 goto out;
 
@@ -184,8 +159,13 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
 
         len = strlen(authctxt->krb5_ticket_file) + 6;
         authctxt->krb5_ccname = xmalloc(len);
+#ifdef USE_CCAPI
+        snprintf(authctxt->krb5_ccname, len, "API:%s",
+            authctxt->krb5_ticket_file);
+#else
         snprintf(authctxt->krb5_ccname, len, "FILE:%s",
             authctxt->krb5_ticket_file);
+#endif
 
 #ifdef USE_PAM
         if (options.use_pam)
@@ -234,4 +214,42 @@ krb5_cleanup_proc(Authctxt *authctxt)
         }
 }
 
+#ifndef HEIMDAL
+krb5_error_code
+ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
+        int ret;
+        char ccname[40];
+        mode_t old_umask;
+#ifdef USE_CCAPI
+        char cctemplate[] = "API:krb5cc_%d";
+#else
+        char cctemplate[] = "FILE:/tmp/krb5cc_%d_XXXXXXXXXX";
+        int tmpfd;
+#endif
+
+        ret = snprintf(ccname, sizeof(ccname),
+            cctemplate, geteuid());
+        if (ret == -1 || ret >= (int) sizeof(ccname))
+                return ENOMEM;
+
+#ifndef USE_CCAPI
+        old_umask = umask(0177);
+        tmpfd = mkstemp(ccname + strlen("FILE:"));
+        umask(old_umask);
+        if (tmpfd == -1) {
+                logit("mkstemp(): %.100s", strerror(errno));
+                return errno;
+        }
+
+        if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
+                logit("fchmod(): %.100s", strerror(errno));
+                close(tmpfd);
+                return errno;
+        }
+        close(tmpfd);
+#endif
+
+        return (krb5_cc_resolve(ctx, ccname, ccache));
+}
+#endif /* !HEIMDAL */
 #endif /* KRB5 */
diff --git a/auth-options.c b/auth-options.c
index 04d12d66e..a85e40835 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-options.c,v 1.29 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: auth-options.c,v 1.31 2005/03/10 22:40:38 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "match.h"
@@ -247,7 +247,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                         host = hpdelim(&p);
                         if (host == NULL || strlen(host) >= NI_MAXHOST) {
                                 debug("%.100s, line %lu: Bad permitopen "
-                                    "specification <%.100s>", file, linenum, 
+                                    "specification <%.100s>", file, linenum,
                                     patterns);
                                 auth_debug_add("%.100s, line %lu: "
                                     "Bad permitopen specification", file,
@@ -255,8 +255,8 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                                 xfree(patterns);
                                 goto bad_option;
                         }
-                        host = cleanhostname(host);
-                        if (p == NULL || (port = a2port(p)) == 0) {
+                        host = cleanhostname(host);
+                        if (p == NULL || (port = a2port(p)) == 0) {
                                 debug("%.100s, line %lu: Bad permitopen port "
                                     "<%.100s>", file, linenum, p ? p : "");
                                 auth_debug_add("%.100s, line %lu: "
diff --git a/auth-pam.c b/auth-pam.c
index 6ce8c429b..0446cd559 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -47,7 +47,7 @@
 
 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
-RCSID("$Id: auth-pam.c,v 1.121 2005/01/20 02:29:51 dtucker Exp $");
+RCSID("$Id: auth-pam.c,v 1.126 2005/07/17 07:18:50 djm Exp $");
 
 #ifdef USE_PAM
 #if defined(HAVE_SECURITY_PAM_APPL_H)
@@ -56,6 +56,13 @@ RCSID("$Id: auth-pam.c,v 1.121 2005/01/20 02:29:51 dtucker Exp $");
 #include <pam/pam_appl.h>
 #endif
 
+/* OpenGroup RFC86.0 and XSSO specify no "const" on arguments */
+#ifdef PAM_SUN_CODEBASE
+# define sshpam_const           /* Solaris, HP-UX, AIX */
+#else
+# define sshpam_const   const   /* LinuxPAM, OpenPAM */
+#endif
+
 #include "auth.h"
 #include "auth-pam.h"
 #include "buffer.h"
@@ -76,7 +83,17 @@ extern Buffer loginmsg;
 extern int compat20;
 extern u_int utmp_len;
 
+/* so we don't silently change behaviour */
 #ifdef USE_POSIX_THREADS
+# error "USE_POSIX_THREADS replaced by UNSUPPORTED_POSIX_THREADS_HACK"
+#endif
+
+/*
+ * Formerly known as USE_POSIX_THREADS, using this is completely unsupported
+ * and generally a bad idea.  Use at own risk and do not expect support if
+ * this breaks.
+ */
+#ifdef UNSUPPORTED_POSIX_THREADS_HACK
 #include <pthread.h>
 /*
  * Avoid namespace clash when *not* using pthreads for systems *with*
@@ -98,7 +115,7 @@ struct pam_ctxt {
 static void sshpam_free_ctx(void *);
 static struct pam_ctxt *cleanup_ctxt;
 
-#ifndef USE_POSIX_THREADS
+#ifndef UNSUPPORTED_POSIX_THREADS_HACK
 /*
  * Simulate threads with processes.
  */
@@ -106,14 +123,14 @@ static struct pam_ctxt *cleanup_ctxt;
 static int sshpam_thread_status = -1;
 static mysig_t sshpam_oldsig;
 
-static void 
+static void
 sshpam_sigchld_handler(int sig)
 {
         signal(SIGCHLD, SIG_DFL);
         if (cleanup_ctxt == NULL)
                 return; /* handler called after PAM cleanup, shouldn't happen */
         if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
-             <= 0) {
+            <= 0) {
                 /* PAM thread has not exitted, privsep slave must have */
                 kill(cleanup_ctxt->pam_thread, SIGTERM);
                 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
@@ -140,6 +157,7 @@ pthread_create(sp_pthread_t *thread, const void *attr __unused,
     void *(*thread_start)(void *), void *arg)
 {
         pid_t pid;
+        struct pam_ctxt *ctx = arg;
 
         sshpam_thread_status = -1;
         switch ((pid = fork())) {
@@ -147,10 +165,14 @@ pthread_create(sp_pthread_t *thread, const void *attr __unused,
                 error("fork(): %s", strerror(errno));
                 return (-1);
         case 0:
+                close(ctx->pam_psock);
+                ctx->pam_psock = -1;
                 thread_start(arg);
                 _exit(1);
         default:
                 *thread = pid;
+                close(ctx->pam_csock);
+                ctx->pam_csock = -1;
                 sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
                 return (0);
         }
@@ -255,7 +277,7 @@ import_environments(Buffer *b)
 
         debug3("PAM: %s entering", __func__);
 
-#ifndef USE_POSIX_THREADS
+#ifndef UNSUPPORTED_POSIX_THREADS_HACK
         /* Import variables set by do_pam_account */
         sshpam_account_status = buffer_get_int(b);
         sshpam_password_change_required(buffer_get_int(b));
@@ -290,7 +312,7 @@ import_environments(Buffer *b)
  * Conversation function for authentication thread.
  */
 static int
-sshpam_thread_conv(int n, struct pam_message **msg,
+sshpam_thread_conv(int n, sshpam_const struct pam_message **msg,
     struct pam_response **resp, void *data)
 {
         Buffer buffer;
@@ -384,13 +406,15 @@ sshpam_thread(void *ctxtp)
         struct pam_conv sshpam_conv;
         int flags = (options.permit_empty_passwd == 0 ?
             PAM_DISALLOW_NULL_AUTHTOK : 0);
-#ifndef USE_POSIX_THREADS
+#ifndef UNSUPPORTED_POSIX_THREADS_HACK
         extern char **environ;
         char **env_from_pam;
         u_int i;
         const char *pam_user;
+        const char **ptr_pam_user = &pam_user;
 
-        pam_get_item(sshpam_handle, PAM_USER, (void **)&pam_user);
+        pam_get_item(sshpam_handle, PAM_USER,
+            (sshpam_const void **)ptr_pam_user);
         environ[0] = NULL;
 
         if (sshpam_authctxt != NULL) {
@@ -428,7 +452,7 @@ sshpam_thread(void *ctxtp)
 
         buffer_put_cstring(&buffer, "OK");
 
-#ifndef USE_POSIX_THREADS
+#ifndef UNSUPPORTED_POSIX_THREADS_HACK
         /* Export variables set by do_pam_account */
         buffer_put_int(&buffer, sshpam_account_status);
         buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
@@ -447,7 +471,7 @@ sshpam_thread(void *ctxtp)
         buffer_put_int(&buffer, i);
         for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
                 buffer_put_cstring(&buffer, env_from_pam[i]);
-#endif /* USE_POSIX_THREADS */
+#endif /* UNSUPPORTED_POSIX_THREADS_HACK */
 
         /* XXX - can't do much about an error here */
         ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
@@ -482,7 +506,7 @@ sshpam_thread_cleanup(void)
 }
 
 static int
-sshpam_null_conv(int n, struct pam_message **msg,
+sshpam_null_conv(int n, sshpam_const struct pam_message **msg,
     struct pam_response **resp, void *data)
 {
         debug3("PAM: %s entering, %d messages", __func__, n);
@@ -492,7 +516,7 @@ sshpam_null_conv(int n, struct pam_message **msg,
 static struct pam_conv null_conv = { sshpam_null_conv, NULL };
 
 static int
-sshpam_store_conv(int n, struct pam_message **msg,
+sshpam_store_conv(int n, sshpam_const struct pam_message **msg,
     struct pam_response **resp, void *data)
 {
         struct pam_response *reply;
@@ -561,11 +585,12 @@ sshpam_init(Authctxt *authctxt)
 {
         extern char *__progname;
         const char *pam_rhost, *pam_user, *user = authctxt->user;
+        const char **ptr_pam_user = &pam_user;
 
         if (sshpam_handle != NULL) {
                 /* We already have a PAM context; check if the user matches */
                 sshpam_err = pam_get_item(sshpam_handle,
-                    PAM_USER, (void **)&pam_user);
+                    PAM_USER, (sshpam_const void **)ptr_pam_user);
                 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
                         return (0);
                 pam_end(sshpam_handle, sshpam_err);
@@ -755,7 +780,7 @@ sshpam_respond(void *ctx, u_int num, char **resp)
         buffer_init(&buffer);
         if (sshpam_authctxt->valid &&
             (sshpam_authctxt->pw->pw_uid != 0 ||
-             options.permit_root_login == PERMIT_YES))
+            options.permit_root_login == PERMIT_YES))
                 buffer_put_cstring(&buffer, *resp);
         else
                 buffer_put_cstring(&buffer, badpw);
@@ -828,7 +853,7 @@ do_pam_account(void)
         sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
         debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
             pam_strerror(sshpam_handle, sshpam_err));
-        
+
         if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
                 sshpam_account_status = 0;
                 return (sshpam_account_status);
@@ -881,7 +906,7 @@ do_pam_setcred(int init)
 }
 
 static int
-sshpam_tty_conv(int n, struct pam_message **msg,
+sshpam_tty_conv(int n, sshpam_const struct pam_message **msg,
     struct pam_response **resp, void *data)
 {
         char input[PAM_MAX_MSG_SIZE];
@@ -1040,7 +1065,7 @@ free_pam_environment(char **env)
  * display.
  */
 static int
-sshpam_passwd_conv(int n, struct pam_message **msg,
+sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
     struct pam_response **resp, void *data)
 {
         struct pam_response *reply;
@@ -1086,7 +1111,7 @@ sshpam_passwd_conv(int n, struct pam_message **msg,
         *resp = reply;
         return (PAM_SUCCESS);
 
- fail: 
+ fail:
         for(i = 0; i < n; i++) {
                 if (reply[i].resp != NULL)
                         xfree(reply[i].resp);
@@ -1119,7 +1144,7 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
          * information via timing (eg if the PAM config has a delay on fail).
          */
         if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
-             options.permit_root_login != PERMIT_YES))
+            options.permit_root_login != PERMIT_YES))
                 sshpam_password = badpw;
 
         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
@@ -1133,7 +1158,7 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
         if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
                 debug("PAM: password authentication accepted for %.100s",
                     authctxt->user);
-               return 1;
+                return 1;
         } else {
                 debug("PAM: password authentication failed for %.100s: %s",
                     authctxt->valid ? authctxt->user : "an illegal user",
diff --git a/auth-passwd.c b/auth-passwd.c
index 27ece3f72..6e6d0d76a 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-passwd.c,v 1.33 2005/01/24 11:47:13 dtucker Exp $");
+RCSID("$OpenBSD: auth-passwd.c,v 1.34 2005/07/19 15:32:26 otto Exp $");
 
 #include "packet.h"
 #include "buffer.h"
@@ -47,7 +47,6 @@ RCSID("$OpenBSD: auth-passwd.c,v 1.33 2005/01/24 11:47:13 dtucker Exp $");
 
 extern Buffer loginmsg;
 extern ServerOptions options;
-int sys_auth_passwd(Authctxt *, const char *);
 
 #ifdef HAVE_LOGIN_CAP
 extern login_cap_t *lc;
@@ -164,6 +163,8 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)
 
         as = auth_usercheck(pw->pw_name, authctxt->style, "auth-ssh",
             (char *)password);
+        if (as == NULL)
+                return (0);
         if (auth_getstate(as) & AUTH_PWEXPIRED) {
                 auth_close(as);
                 disable_forwarding();
diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c
index 29eb538ec..c31f2b97b 100644
--- a/auth-rh-rsa.c
+++ b/auth-rh-rsa.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-rh-rsa.c,v 1.37 2003/11/04 08:54:09 djm Exp $");
+RCSID("$OpenBSD: auth-rh-rsa.c,v 1.38 2005/07/17 07:17:54 djm Exp $");
 
 #include "packet.h"
 #include "uidswap.h"
@@ -86,7 +86,7 @@ auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key)
          */
 
         verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",
-           pw->pw_name, cuser, chost);
+            pw->pw_name, cuser, chost);
         packet_send_debug("Rhosts with RSA host authentication accepted.");
         return 1;
 }
diff --git a/auth-rhosts.c b/auth-rhosts.c
index 585246e82..aaba8557e 100644
--- a/auth-rhosts.c
+++ b/auth-rhosts.c
@@ -14,7 +14,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-rhosts.c,v 1.32 2003/11/04 08:54:09 djm Exp $");
+RCSID("$OpenBSD: auth-rhosts.c,v 1.33 2005/07/17 07:17:54 djm Exp $");
 
 #include "packet.h"
 #include "uidswap.h"
@@ -133,7 +133,7 @@ check_rhosts_file(const char *filename, const char *hostname,
                 /* If the entry was negated, deny access. */
                 if (negated) {
                         auth_debug_add("Matched negative entry in %.100s.",
-                             filename);
+                            filename);
                         return 0;
                 }
                 /* Accept authentication. */
diff --git a/auth-rsa.c b/auth-rsa.c
index 4378008d3..d9c9652dc 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -14,7 +14,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-rsa.c,v 1.62 2004/12/11 01:48:56 dtucker Exp $");
+RCSID("$OpenBSD: auth-rsa.c,v 1.63 2005/06/17 02:44:32 djm Exp $");
 
 #include <openssl/rsa.h>
 #include <openssl/md5.h>
@@ -205,6 +205,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp;
                 char *key_options;
+                int keybits;
 
                 /* Skip leading whitespace, empty and comment lines. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
@@ -243,7 +244,8 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                         continue;
 
                 /* check the real bits  */
-                if (bits != BN_num_bits(key->rsa->n))
+                keybits = BN_num_bits(key->rsa->n);
+                if (keybits < 0 || bits != (u_int)keybits)
                         logit("Warning: %s, line %lu: keysize mismatch: "
                             "actual %d vs. announced %d.",
                             file, linenum, BN_num_bits(key->rsa->n), bits);
diff --git a/auth-shadow.c b/auth-shadow.c
index f6004f68f..59737b93c 100644
--- a/auth-shadow.c
+++ b/auth-shadow.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: auth-shadow.c,v 1.6 2005/02/16 03:20:06 dtucker Exp $");
+RCSID("$Id: auth-shadow.c,v 1.7 2005/07/17 07:04:47 djm Exp $");
 
 #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
 #include <shadow.h>
@@ -101,7 +101,7 @@ auth_shadow_pwexpired(Authctxt *ctxt)
 #if defined(__hpux) && !defined(HAVE_SECUREWARE)
         if (iscomsec()) {
                 struct pr_passwd *pr;
-                       
+
                 pr = getprpwnam((char *)user);
 
                 /* Test for Trusted Mode expiry disabled */
diff --git a/auth-sia.c b/auth-sia.c
index 63f55d07f..af7182b48 100644
--- a/auth-sia.c
+++ b/auth-sia.c
@@ -47,7 +47,7 @@ extern int saved_argc;
 extern char **saved_argv;
 
 int
-sys_auth_passwd(Authctxt *authctxt, char *pass)
+sys_auth_passwd(Authctxt *authctxt, const char *pass)
 {
         int ret;
         SIAENTITY *ent = NULL;
diff --git a/auth-sia.h b/auth-sia.h
index ca55e913e..27cbb93f1 100644
--- a/auth-sia.h
+++ b/auth-sia.h
@@ -26,7 +26,6 @@
 
 #ifdef HAVE_OSF_SIA
 
-int     sys_auth_passwd(Authctxt *, char *);
 void    session_setup_sia(struct passwd *, char *);
 
 #endif /* HAVE_OSF_SIA */
diff --git a/auth-skey.c b/auth-skey.c
index ac1af69ed..f676dbec9 100644
--- a/auth-skey.c
+++ b/auth-skey.c
@@ -47,7 +47,7 @@ skey_query(void *ctx, char **name, char **infotxt,
         int len;
         struct skey skey;
 
-        if (_compat_skeychallenge(&skey, authctxt->user, challenge, 
+        if (_compat_skeychallenge(&skey, authctxt->user, challenge,
             sizeof(challenge)) == -1)
                 return -1;
 
diff --git a/auth.c b/auth.c
index 256807683..2dc5c2be6 100644
--- a/auth.c
+++ b/auth.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth.c,v 1.57 2005/01/22 08:17:59 dtucker Exp $");
+RCSID("$OpenBSD: auth.c,v 1.60 2005/06/17 02:44:32 djm Exp $");
 
 #ifdef HAVE_LOGIN_H
 #include <login.h>
@@ -76,7 +76,7 @@ allowed_user(struct passwd * pw)
         struct stat st;
         const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL;
         char *shell;
-        int i;
+        u_int i;
 #ifdef USE_SHADOW
         struct spwd *spw = NULL;
 #endif
@@ -97,7 +97,11 @@ allowed_user(struct passwd * pw)
         /* grab passwd field for locked account check */
 #ifdef USE_SHADOW
         if (spw != NULL)
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+                passwd = get_iaf_password(pw);
+#else
                 passwd = spw->sp_pwdp;
+#endif /* HAVE_LIBIAF  && !BROKEN_LIBIAF */
 #else
         passwd = pw->pw_passwd;
 #endif
@@ -119,6 +123,9 @@ allowed_user(struct passwd * pw)
                 if (strstr(passwd, LOCKED_PASSWD_SUBSTR))
                         locked = 1;
 #endif
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+                free(passwd);
+#endif /* HAVE_LIBIAF  && !BROKEN_LIBIAF */
                 if (locked) {
                         logit("User %.100s not allowed because account is locked",
                             pw->pw_name);
@@ -145,7 +152,8 @@ allowed_user(struct passwd * pw)
                 return 0;
         }
 
-        if (options.num_deny_users > 0 || options.num_allow_users > 0) {
+        if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
+            options.num_deny_groups > 0 || options.num_allow_groups > 0) {
                 hostname = get_canonical_hostname(options.use_dns);
                 ipaddr = get_remote_ipaddr();
         }
@@ -325,64 +333,41 @@ auth_root_allowed(char *method)
  *
  * This returns a buffer allocated by xmalloc.
  */
-char *
-expand_filename(const char *filename, struct passwd *pw)
+static char *
+expand_authorized_keys(const char *filename, struct passwd *pw)
 {
-        Buffer buffer;
-        char *file;
-        const char *cp;
+        char *file, *ret;
 
-        /*
-         * Build the filename string in the buffer by making the appropriate
-         * substitutions to the given file name.
-         */
-        buffer_init(&buffer);
-        for (cp = filename; *cp; cp++) {
-                if (cp[0] == '%' && cp[1] == '%') {
-                        buffer_append(&buffer, "%", 1);
-                        cp++;
-                        continue;
-                }
-                if (cp[0] == '%' && cp[1] == 'h') {
-                        buffer_append(&buffer, pw->pw_dir, strlen(pw->pw_dir));
-                        cp++;
-                        continue;
-                }
-                if (cp[0] == '%' && cp[1] == 'u') {
-                        buffer_append(&buffer, pw->pw_name,
-                            strlen(pw->pw_name));
-                        cp++;
-                        continue;
-                }
-                buffer_append(&buffer, cp, 1);
-        }
-        buffer_append(&buffer, "\0", 1);
+        file = percent_expand(filename, "h", pw->pw_dir,
+            "u", pw->pw_name, (char *)NULL);
 
         /*
          * Ensure that filename starts anchored. If not, be backward
          * compatible and prepend the '%h/'
          */
-        file = xmalloc(MAXPATHLEN);
-        cp = buffer_ptr(&buffer);
-        if (*cp != '/')
-                snprintf(file, MAXPATHLEN, "%s/%s", pw->pw_dir, cp);
-        else
-                strlcpy(file, cp, MAXPATHLEN);
+        if (*file == '/')
+                return (file);
+
+        ret = xmalloc(MAXPATHLEN);
+        if (strlcpy(ret, pw->pw_dir, MAXPATHLEN) >= MAXPATHLEN ||
+            strlcat(ret, "/", MAXPATHLEN) >= MAXPATHLEN ||
+            strlcat(ret, file, MAXPATHLEN) >= MAXPATHLEN)
+                fatal("expand_authorized_keys: path too long");
 
-        buffer_free(&buffer);
-        return file;
+        xfree(file);
+        return (ret);
 }
 
 char *
 authorized_keys_file(struct passwd *pw)
 {
-        return expand_filename(options.authorized_keys_file, pw);
+        return expand_authorized_keys(options.authorized_keys_file, pw);
 }
 
 char *
 authorized_keys_file2(struct passwd *pw)
 {
-        return expand_filename(options.authorized_keys_file2, pw);
+        return expand_authorized_keys(options.authorized_keys_file2, pw);
 }
 
 /* return ok if key exists in sysfile or userfile */
diff --git a/auth.h b/auth.h
index 8d1f93403..456d28f37 100644
--- a/auth.h
+++ b/auth.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: auth.h,v 1.50 2004/05/23 23:59:53 dtucker Exp $       */
+/*      $OpenBSD: auth.h,v 1.51 2005/06/06 11:20:36 djm Exp $   */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -30,6 +30,7 @@
 
 #include "key.h"
 #include "hostfile.h"
+#include "buffer.h"
 #include <openssl/rsa.h>
 
 #ifdef HAVE_LOGIN_CAP
@@ -52,6 +53,7 @@ struct Authctxt {
         int              valid;         /* user exists and is allowed to login */
         int              attempt;
         int              failures;
+        int              server_caused_failure; 
         int              force_pwchange;
         char            *user;          /* username sent by the client */
         char            *service;
@@ -68,6 +70,7 @@ struct Authctxt {
         char            *krb5_ticket_file;
         char            *krb5_ccname;
 #endif
+        Buffer          *loginmsg;
         void            *methoddata;
 };
 /*
@@ -161,7 +164,6 @@ char	*get_challenge(Authctxt *);
 int     verify_response(Authctxt *, const char *);
 void    abandon_challenge_response(Authctxt *);
 
-char    *expand_filename(const char *, struct passwd *);
 char    *authorized_keys_file(struct passwd *);
 char    *authorized_keys_file2(struct passwd *);
 
@@ -185,7 +187,14 @@ void	 auth_debug_reset(void);
 
 struct passwd *fakepw(void);
 
+int      sys_auth_passwd(Authctxt *, const char *);
+
 #define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
 
 #define SKEY_PROMPT "\nS/Key Password: "
+
+#if defined(KRB5) && !defined(HEIMDAL)
+#include <krb5.h>
+krb5_error_code ssh_krb5_cc_gen(krb5_context, krb5_ccache *);
+#endif
 #endif
diff --git a/auth1.c b/auth1.c
index d08928455..4bc2bf76d 100644
--- a/auth1.c
+++ b/auth1.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth1.c,v 1.59 2004/07/28 09:40:29 markus Exp $");
+RCSID("$OpenBSD: auth1.c,v 1.62 2005/07/16 01:35:24 djm Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
@@ -31,28 +31,182 @@ RCSID("$OpenBSD: auth1.c,v 1.59 2004/07/28 09:40:29 markus Exp $");
 extern ServerOptions options;
 extern Buffer loginmsg;
 
-/*
- * convert ssh auth msg type into description
- */
+static int auth1_process_password(Authctxt *, char *, size_t);
+static int auth1_process_rsa(Authctxt *, char *, size_t);
+static int auth1_process_rhosts_rsa(Authctxt *, char *, size_t);
+static int auth1_process_tis_challenge(Authctxt *, char *, size_t);
+static int auth1_process_tis_response(Authctxt *, char *, size_t);
+
+static char *client_user = NULL;    /* Used to fill in remote user for PAM */
+
+struct AuthMethod1 {
+        int type;
+        char *name;
+        int *enabled;
+        int (*method)(Authctxt *, char *, size_t);
+};
+
+const struct AuthMethod1 auth1_methods[] = {
+        {
+                SSH_CMSG_AUTH_PASSWORD, "password",
+                &options.password_authentication, auth1_process_password
+        },
+        {
+                SSH_CMSG_AUTH_RSA, "rsa",
+                &options.rsa_authentication, auth1_process_rsa
+        },
+        {
+                SSH_CMSG_AUTH_RHOSTS_RSA, "rhosts-rsa",
+                &options.rhosts_rsa_authentication, auth1_process_rhosts_rsa
+        },
+        {
+                SSH_CMSG_AUTH_TIS, "challenge-response",
+                &options.challenge_response_authentication,
+                auth1_process_tis_challenge
+        },
+        {
+                SSH_CMSG_AUTH_TIS_RESPONSE, "challenge-response",
+                &options.challenge_response_authentication,
+                auth1_process_tis_response
+        },
+        { -1, NULL, NULL, NULL}
+};
+
+static const struct AuthMethod1
+*lookup_authmethod1(int type)
+{
+        int i;
+
+        for(i = 0; auth1_methods[i].name != NULL; i++)
+                if (auth1_methods[i].type == type)
+                        return (&(auth1_methods[i]));
+
+        return (NULL);
+}
+
 static char *
 get_authname(int type)
 {
-        static char buf[1024];
-        switch (type) {
-        case SSH_CMSG_AUTH_PASSWORD:
-                return "password";
-        case SSH_CMSG_AUTH_RSA:
-                return "rsa";
-        case SSH_CMSG_AUTH_RHOSTS_RSA:
-                return "rhosts-rsa";
-        case SSH_CMSG_AUTH_RHOSTS:
-                return "rhosts";
-        case SSH_CMSG_AUTH_TIS:
-        case SSH_CMSG_AUTH_TIS_RESPONSE:
-                return "challenge-response";
+        const struct AuthMethod1 *a;
+        static char buf[64];
+
+        if ((a = lookup_authmethod1(type)) != NULL)
+                return (a->name);
+        snprintf(buf, sizeof(buf), "bad-auth-msg-%d", type);
+        return (buf);
+}
+
+static int
+auth1_process_password(Authctxt *authctxt, char *info, size_t infolen)
+{
+        int authenticated = 0;
+        char *password;
+        u_int dlen;
+
+        /*
+         * Read user password.  It is in plain text, but was
+         * transmitted over the encrypted channel so it is
+         * not visible to an outside observer.
+         */
+        password = packet_get_string(&dlen);
+        packet_check_eom();
+
+        /* Try authentication with the password. */
+        authenticated = PRIVSEP(auth_password(authctxt, password));
+
+        memset(password, 0, dlen);
+        xfree(password);
+
+        return (authenticated);
+}
+
+static int
+auth1_process_rsa(Authctxt *authctxt, char *info, size_t infolen)
+{
+        int authenticated = 0;
+        BIGNUM *n;
+
+        /* RSA authentication requested. */
+        if ((n = BN_new()) == NULL)
+                fatal("do_authloop: BN_new failed");
+        packet_get_bignum(n);
+        packet_check_eom();
+        authenticated = auth_rsa(authctxt, n);
+        BN_clear_free(n);
+
+        return (authenticated);
+}
+
+static int
+auth1_process_rhosts_rsa(Authctxt *authctxt, char *info, size_t infolen)
+{
+        int keybits, authenticated = 0;
+        u_int bits;
+        Key *client_host_key;
+        u_int ulen;
+
+        /*
+         * Get client user name.  Note that we just have to
+         * trust the client; root on the client machine can
+         * claim to be any user.
+         */
+        client_user = packet_get_string(&ulen);
+
+        /* Get the client host key. */
+        client_host_key = key_new(KEY_RSA1);
+        bits = packet_get_int();
+        packet_get_bignum(client_host_key->rsa->e);
+        packet_get_bignum(client_host_key->rsa->n);
+
+        keybits = BN_num_bits(client_host_key->rsa->n);
+        if (keybits < 0 || bits != (u_int)keybits) {
+                verbose("Warning: keysize mismatch for client_host_key: "
+                    "actual %d, announced %d",
+                    BN_num_bits(client_host_key->rsa->n), bits);
         }
-        snprintf(buf, sizeof buf, "bad-auth-msg-%d", type);
-        return buf;
+        packet_check_eom();
+
+        authenticated = auth_rhosts_rsa(authctxt, client_user,
+            client_host_key);
+        key_free(client_host_key);
+
+        snprintf(info, infolen, " ruser %.100s", client_user);
+
+        return (authenticated);
+}
+
+static int
+auth1_process_tis_challenge(Authctxt *authctxt, char *info, size_t infolen)
+{
+        char *challenge;
+
+        if ((challenge = get_challenge(authctxt)) == NULL)
+                return (0);
+
+        debug("sending challenge '%s'", challenge);
+        packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
+        packet_put_cstring(challenge);
+        xfree(challenge);
+        packet_send();
+        packet_write_wait();
+
+        return (-1);
+}
+
+static int
+auth1_process_tis_response(Authctxt *authctxt, char *info, size_t infolen)
+{
+        int authenticated = 0;
+        char *response;
+        u_int dlen;
+
+        response = packet_get_string(&dlen);
+        packet_check_eom();
+        authenticated = verify_response(authctxt, response);
+        memset(response, 'r', dlen);
+        xfree(response);
+
+        return (authenticated);
 }
 
 /*
@@ -63,14 +217,9 @@ static void
 do_authloop(Authctxt *authctxt)
 {
         int authenticated = 0;
-        u_int bits;
-        Key *client_host_key;
-        BIGNUM *n;
-        char *client_user, *password;
         char info[1024];
-        u_int dlen;
-        u_int ulen;
-        int prev, type = 0;
+        int prev = 0, type = 0;
+        const struct AuthMethod1 *meth;
 
         debug("Attempting authentication for %s%.100s.",
             authctxt->valid ? "" : "invalid user ", authctxt->user);
@@ -95,8 +244,6 @@ do_authloop(Authctxt *authctxt)
         packet_send();
         packet_write_wait();
 
-        client_user = NULL;
-
         for (;;) {
                 /* default to fail */
                 authenticated = 0;
@@ -118,107 +265,21 @@ do_authloop(Authctxt *authctxt)
                     type != SSH_CMSG_AUTH_TIS_RESPONSE)
                         abandon_challenge_response(authctxt);
 
-                /* Process the packet. */
-                switch (type) {
-                case SSH_CMSG_AUTH_RHOSTS_RSA:
-                        if (!options.rhosts_rsa_authentication) {
-                                verbose("Rhosts with RSA authentication disabled.");
-                                break;
-                        }
-                        /*
-                         * Get client user name.  Note that we just have to
-                         * trust the client; root on the client machine can
-                         * claim to be any user.
-                         */
-                        client_user = packet_get_string(&ulen);
-
-                        /* Get the client host key. */
-                        client_host_key = key_new(KEY_RSA1);
-                        bits = packet_get_int();
-                        packet_get_bignum(client_host_key->rsa->e);
-                        packet_get_bignum(client_host_key->rsa->n);
-
-                        if (bits != BN_num_bits(client_host_key->rsa->n))
-                                verbose("Warning: keysize mismatch for client_host_key: "
-                                    "actual %d, announced %d",
-                                    BN_num_bits(client_host_key->rsa->n), bits);
-                        packet_check_eom();
-
-                        authenticated = auth_rhosts_rsa(authctxt, client_user,
-                            client_host_key);
-                        key_free(client_host_key);
-
-                        snprintf(info, sizeof info, " ruser %.100s", client_user);
-                        break;
-
-                case SSH_CMSG_AUTH_RSA:
-                        if (!options.rsa_authentication) {
-                                verbose("RSA authentication disabled.");
-                                break;
-                        }
-                        /* RSA authentication requested. */
-                        if ((n = BN_new()) == NULL)
-                                fatal("do_authloop: BN_new failed");
-                        packet_get_bignum(n);
-                        packet_check_eom();
-                        authenticated = auth_rsa(authctxt, n);
-                        BN_clear_free(n);
-                        break;
-
-                case SSH_CMSG_AUTH_PASSWORD:
-                        if (!options.password_authentication) {
-                                verbose("Password authentication disabled.");
-                                break;
-                        }
-                        /*
-                         * Read user password.  It is in plain text, but was
-                         * transmitted over the encrypted channel so it is
-                         * not visible to an outside observer.
-                         */
-                        password = packet_get_string(&dlen);
-                        packet_check_eom();
-
-                        /* Try authentication with the password. */
-                        authenticated = PRIVSEP(auth_password(authctxt, password));
-
-                        memset(password, 0, strlen(password));
-                        xfree(password);
-                        break;
-
-                case SSH_CMSG_AUTH_TIS:
-                        debug("rcvd SSH_CMSG_AUTH_TIS");
-                        if (options.challenge_response_authentication == 1) {
-                                char *challenge = get_challenge(authctxt);
-                                if (challenge != NULL) {
-                                        debug("sending challenge '%s'", challenge);
-                                        packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
-                                        packet_put_cstring(challenge);
-                                        xfree(challenge);
-                                        packet_send();
-                                        packet_write_wait();
-                                        continue;
-                                }
-                        }
-                        break;
-                case SSH_CMSG_AUTH_TIS_RESPONSE:
-                        debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");
-                        if (options.challenge_response_authentication == 1) {
-                                char *response = packet_get_string(&dlen);
-                                packet_check_eom();
-                                authenticated = verify_response(authctxt, response);
-                                memset(response, 'r', dlen);
-                                xfree(response);
-                        }
-                        break;
-
-                default:
-                        /*
-                         * Any unknown messages will be ignored (and failure
-                         * returned) during authentication.
-                         */
-                        logit("Unknown message during authentication: type %d", type);
-                        break;
+                if ((meth = lookup_authmethod1(type)) == NULL) {
+                        logit("Unknown message during authentication: "
+                            "type %d", type);
+                        goto skip;
+                }
+
+                if (!*(meth->enabled)) {
+                        verbose("%s authentication disabled.", meth->name);
+                        goto skip;
                 }
+
+                authenticated = meth->method(authctxt, info, sizeof(info));
+                if (authenticated == -1)
+                        continue; /* "postponed" */
+
 #ifdef BSD_AUTH
                 if (authctxt->as) {
                         auth_close(authctxt->as);
@@ -238,7 +299,7 @@ do_authloop(Authctxt *authctxt)
 
 #ifdef HAVE_CYGWIN
                 if (authenticated &&
-                    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, 
+                    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD,
                     authctxt->pw)) {
                         packet_disconnect("Authentication rejected for uid %d.",
                             authctxt->pw == NULL ? -1 : authctxt->pw->pw_uid);
@@ -247,8 +308,8 @@ do_authloop(Authctxt *authctxt)
 #else
                 /* Special handling for root */
                 if (authenticated && authctxt->pw->pw_uid == 0 &&
-                    !auth_root_allowed(get_authname(type))) {
-                        authenticated = 0;
+                    !auth_root_allowed(meth->name)) {
+                        authenticated = 0;
 # ifdef SSH_AUDIT_EVENTS
                         PRIVSEP(audit_event(SSH_LOGIN_ROOT_DENIED));
 # endif
@@ -262,7 +323,7 @@ do_authloop(Authctxt *authctxt)
                         size_t len;
 
                         error("Access denied for user %s by PAM account "
-                           "configuration", authctxt->user);
+                            "configuration", authctxt->user);
                         len = buffer_len(&loginmsg);
                         buffer_append(&loginmsg, "\0", 1);
                         msg = buffer_ptr(&loginmsg);
@@ -276,6 +337,7 @@ do_authloop(Authctxt *authctxt)
                 }
 #endif
 
+ skip:
                 /* Log before sending the reply */
                 auth_log(authctxt, authenticated, get_authname(type), info);
 
@@ -341,7 +403,7 @@ do_authentication(Authctxt *authctxt)
 
         /*
          * If we are not running as root, the user must have the same uid as
-         * the server. (Unless you are running Windows)
+         * the server.
          */
 #ifndef HAVE_CYGWIN
         if (!use_privsep && getuid() != 0 && authctxt->pw &&
diff --git a/auth2-chall.c b/auth2-chall.c
index 384a543ee..b147cadf3 100644
--- a/auth2-chall.c
+++ b/auth2-chall.c
@@ -23,7 +23,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: auth2-chall.c,v 1.22 2005/01/19 13:11:47 dtucker Exp $");
+RCSID("$OpenBSD: auth2-chall.c,v 1.24 2005/07/17 07:17:54 djm Exp $");
 
 #include "ssh2.h"
 #include "auth.h"
@@ -167,7 +167,7 @@ kbdint_next_device(KbdintAuthctxt *kbdintctxt)
                 kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
                 xfree(t);
                 debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
-                   kbdintctxt->devices : "<empty>");
+                    kbdintctxt->devices : "<empty>");
         } while (kbdintctxt->devices && !kbdintctxt->device);
 
         return kbdintctxt->device ? 1 : 0;
@@ -239,8 +239,7 @@ send_userauth_info_request(Authctxt *authctxt)
 {
         KbdintAuthctxt *kbdintctxt;
         char *name, *instr, **prompts;
-        int i;
-        u_int *echo_on;
+        u_int i, *echo_on;
 
         kbdintctxt = authctxt->kbdintctxt;
         if (kbdintctxt->device->query(kbdintctxt->ctxt,
@@ -273,8 +272,8 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
 {
         Authctxt *authctxt = ctxt;
         KbdintAuthctxt *kbdintctxt;
-        int i, authenticated = 0, res, len;
-        u_int nresp;
+        int authenticated = 0, res, len;
+        u_int i, nresp;
         char **response = NULL, *method;
 
         if (authctxt == NULL)
diff --git a/auth2-gss.c b/auth2-gss.c
index 0ac405496..9cbc29605 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: auth2-gss.c,v 1.8 2004/06/21 17:36:31 avsm Exp $      */
+/*      $OpenBSD: auth2-gss.c,v 1.10 2005/07/17 07:17:54 djm Exp $      */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -94,7 +94,7 @@ userauth_gssapi(Authctxt *authctxt)
         int present;
         OM_uint32 ms;
         u_int len;
-        char *doid = NULL;
+        u_char *doid = NULL;
 
         if (!authctxt->valid || authctxt->user == NULL)
                 return (0);
@@ -115,9 +115,8 @@ userauth_gssapi(Authctxt *authctxt)
                 present = 0;
                 doid = packet_get_string(&len);
 
-                if (len > 2 &&
-                   doid[0] == SSH_GSS_OIDTYPE &&
-                   doid[1] == len - 2) {
+                if (len > 2 && doid[0] == SSH_GSS_OIDTYPE &&
+                    doid[1] == len - 2) {
                         goid.elements = doid + 2;
                         goid.length   = len - 2;
                         gss_test_oid_set_member(&ms, &goid, supported,
@@ -131,11 +130,13 @@ userauth_gssapi(Authctxt *authctxt)
 
         if (!present) {
                 xfree(doid);
+                authctxt->server_caused_failure = 1;
                 return (0);
         }
 
         if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
                 xfree(doid);
+                authctxt->server_caused_failure = 1;
                 return (0);
         }
 
@@ -320,7 +321,7 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
 }
 
 Authmethod method_gsskeyex = {
-        "gssapi-keyx",
+        "gssapi-keyex",
         userauth_gsskeyex,
         &options.gss_authentication
 };
diff --git a/auth2.c b/auth2.c
index 46068b285..87f8ad507 100644
--- a/auth2.c
+++ b/auth2.c
@@ -194,6 +194,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 #endif
 
         authctxt->postponed = 0;
+        authctxt->server_caused_failure = 0;
 
         /* try to authenticate user */
         m = authmethod_lookup(method);
@@ -236,7 +237,7 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
                                 packet_write_wait();
                         }
                         fatal("Access denied for user %s by PAM account "
-                           "configuration", authctxt->user);
+                            "configuration", authctxt->user);
                 }
         }
 #endif
@@ -264,7 +265,9 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
                 /* now we can break out */
                 authctxt->success = 1;
         } else {
-                if (authctxt->failures++ > options.max_authtries) {
+                /* Dont count server configuration issues against the client */
+                if (!authctxt->server_caused_failure && 
+                    authctxt->failures++ > options.max_authtries) {
 #ifdef SSH_AUDIT_EVENTS
                         PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES));
 #endif
diff --git a/authfd.c b/authfd.c
index 662350cef..8976616b4 100644
--- a/authfd.c
+++ b/authfd.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: authfd.c,v 1.64 2004/08/11 21:44:31 avsm Exp $");
+RCSID("$OpenBSD: authfd.c,v 1.66 2005/06/17 02:44:32 djm Exp $");
 
 #include <openssl/evp.h>
 
@@ -114,8 +114,7 @@ ssh_get_authentication_socket(void)
 static int
 ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply)
 {
-        int l;
-        u_int len;
+        u_int l, len;
         char buf[1024];
 
         /* Get the length of the message, and format it in the buffer. */
@@ -149,8 +148,7 @@ ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply
                 l = len;
                 if (l > sizeof(buf))
                         l = sizeof(buf);
-                l = atomicio(read, auth->fd, buf, l);
-                if (l <= 0) {
+                if (atomicio(read, auth->fd, buf, l) != l) {
                         error("Error reading response from authentication socket.");
                         return 0;
                 }
@@ -303,6 +301,7 @@ ssh_get_first_identity(AuthenticationConnection *auth, char **comment, int versi
 Key *
 ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int version)
 {
+        int keybits;
         u_int bits;
         u_char *blob;
         u_int blen;
@@ -323,7 +322,8 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
                 buffer_get_bignum(&auth->identities, key->rsa->e);
                 buffer_get_bignum(&auth->identities, key->rsa->n);
                 *comment = buffer_get_string(&auth->identities, NULL);
-                if (bits != BN_num_bits(key->rsa->n))
+                keybits = BN_num_bits(key->rsa->n);
+                if (keybits < 0 || bits != (u_int)keybits)
                         logit("Warning: identity keysize mismatch: actual %d, announced %u",
                             BN_num_bits(key->rsa->n), bits);
                 break;
diff --git a/authfile.c b/authfile.c
index 6a04cd7a9..420813f37 100644
--- a/authfile.c
+++ b/authfile.c
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: authfile.c,v 1.60 2004/12/11 01:48:56 dtucker Exp $");
+RCSID("$OpenBSD: authfile.c,v 1.61 2005/06/17 02:44:32 djm Exp $");
 
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -52,6 +52,7 @@ RCSID("$OpenBSD: authfile.c,v 1.60 2004/12/11 01:48:56 dtucker Exp $");
 #include "authfile.h"
 #include "rsa.h"
 #include "misc.h"
+#include "atomicio.h"
 
 /* Version identification string for SSH v1 identity files. */
 static const char authfile_id_string[] =
@@ -147,8 +148,8 @@ key_save_private_rsa1(Key *key, const char *filename, const char *passphrase,
                 buffer_free(&encrypted);
                 return 0;
         }
-        if (write(fd, buffer_ptr(&encrypted), buffer_len(&encrypted)) !=
-            buffer_len(&encrypted)) {
+        if (atomicio(vwrite, fd, buffer_ptr(&encrypted),
+            buffer_len(&encrypted)) != buffer_len(&encrypted)) {
                 error("write to key file %s failed: %s", filename,
                     strerror(errno));
                 buffer_free(&encrypted);
@@ -236,7 +237,7 @@ key_load_public_rsa1(int fd, const char *filename, char **commentp)
         Key *pub;
         struct stat st;
         char *cp;
-        int i;
+        u_int i;
         size_t len;
 
         if (fstat(fd, &st) < 0) {
@@ -253,7 +254,7 @@ key_load_public_rsa1(int fd, const char *filename, char **commentp)
         buffer_init(&buffer);
         cp = buffer_append_space(&buffer, len);
 
-        if (read(fd, cp, (size_t) len) != (size_t) len) {
+        if (atomicio(read, fd, cp, len) != len) {
                 debug("Read from key file %.200s failed: %.100s", filename,
                     strerror(errno));
                 buffer_free(&buffer);
@@ -322,7 +323,8 @@ static Key *
 key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
     char **commentp)
 {
-        int i, check1, check2, cipher_type;
+        u_int i;
+        int check1, check2, cipher_type;
         size_t len;
         Buffer buffer, decrypted;
         u_char *cp;
@@ -347,7 +349,7 @@ key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
         buffer_init(&buffer);
         cp = buffer_append_space(&buffer, len);
 
-        if (read(fd, cp, (size_t) len) != (size_t) len) {
+        if (atomicio(read, fd, cp, len) != len) {
                 debug("Read from key file %.200s failed: %.100s", filename,
                     strerror(errno));
                 buffer_free(&buffer);
diff --git a/bufaux.c b/bufaux.c
index 4ea6af1b6..8d096a056 100644
--- a/bufaux.c
+++ b/bufaux.c
@@ -37,7 +37,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: bufaux.c,v 1.34 2004/12/06 16:00:43 markus Exp $");
+RCSID("$OpenBSD: bufaux.c,v 1.36 2005/06/17 02:44:32 djm Exp $");
 
 #include <openssl/bn.h>
 #include "bufaux.h"
@@ -154,7 +154,7 @@ buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
         buf[0] = 0x00;
         /* Get the value of in binary */
         oi = BN_bn2bin(value, buf+1);
-        if (oi != bytes-1) {
+        if (oi < 0 || (u_int)oi != bytes - 1) {
                 error("buffer_put_bignum2_ret: BN_bn2bin() failed: "
                     "oi %d != bin_size %d", oi, bytes);
                 xfree(buf);
@@ -179,7 +179,7 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
 {
         u_int len;
         u_char *bin;
-        
+
         if ((bin = buffer_get_string_ret(buffer, &len)) == NULL) {
                 error("buffer_get_bignum2_ret: invalid bignum");
                 return (-1);
diff --git a/bufaux.h b/bufaux.h
index e30911ddc..f5efaed3e 100644
--- a/bufaux.h
+++ b/bufaux.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: bufaux.h,v 1.20 2004/10/29 23:56:17 djm Exp $ */
+/*      $OpenBSD: bufaux.h,v 1.21 2005/03/10 22:01:05 deraadt Exp $     */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -40,7 +40,7 @@ void    buffer_put_string(Buffer *, const void *, u_int);
 void    buffer_put_cstring(Buffer *, const char *);
 
 #define buffer_skip_string(b) \
-    do { u_int l = buffer_get_int(b); buffer_consume(b, l); } while(0)
+    do { u_int l = buffer_get_int(b); buffer_consume(b, l); } while (0)
 
 int     buffer_put_bignum_ret(Buffer *, const BIGNUM *);
 int     buffer_get_bignum_ret(Buffer *, BIGNUM *);
diff --git a/buffer.c b/buffer.c
index 1a25004ba..487e08105 100644
--- a/buffer.c
+++ b/buffer.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: buffer.c,v 1.22 2004/10/29 23:56:17 djm Exp $");
+RCSID("$OpenBSD: buffer.c,v 1.23 2005/03/14 11:46:56 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -78,7 +78,7 @@ buffer_append_space(Buffer *buffer, u_int len)
         u_int newlen;
         void *p;
 
-        if (len > 0x100000)
+        if (len > BUFFER_MAX_CHUNK)
                 fatal("buffer_append_space: len %u not supported", len);
 
         /* If the buffer is empty, start using it from the beginning. */
@@ -97,7 +97,7 @@ restart:
          * If the buffer is quite empty, but all data is at the end, move the
          * data to the beginning and retry.
          */
-        if (buffer->offset > buffer->alloc / 2) {
+        if (buffer->offset > MIN(buffer->alloc, BUFFER_MAX_CHUNK)) {
                 memmove(buffer->buf, buffer->buf + buffer->offset,
                         buffer->end - buffer->offset);
                 buffer->end -= buffer->offset;
@@ -107,7 +107,7 @@ restart:
         /* Increase the size of the buffer and retry. */
 
         newlen = buffer->alloc + len + 32768;
-        if (newlen > 0xa00000)
+        if (newlen > BUFFER_MAX_LEN)
                 fatal("buffer_append_space: alloc %u not supported",
                     newlen);
         buffer->buf = xrealloc(buffer->buf, newlen);
diff --git a/buffer.h b/buffer.h
index 9c09d4f43..2b20eed52 100644
--- a/buffer.h
+++ b/buffer.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: buffer.h,v 1.12 2004/10/29 23:56:17 djm Exp $ */
+/*      $OpenBSD: buffer.h,v 1.13 2005/03/14 11:46:56 markus Exp $      */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -23,6 +23,9 @@ typedef struct {
         u_int    end;           /* Offset of last byte containing data. */
 }       Buffer;
 
+#define BUFFER_MAX_CHUNK        0x100000
+#define BUFFER_MAX_LEN          0xa00000
+
 void     buffer_init(Buffer *);
 void     buffer_clear(Buffer *);
 void     buffer_free(Buffer *);
diff --git a/buildpkg.sh.in b/buildpkg.sh.in
index f243e90bf..f90ae6e81 100644
--- a/buildpkg.sh.in
+++ b/buildpkg.sh.in
@@ -282,11 +282,11 @@ installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SY
         installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
 else
         [ "$RCS_D" = yes ]  &&  \
-installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
         [ "$RC1_D" = no ]  ||  \
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
 fi
 
 # If piddir doesn't exist we add it. (Ie. --with-pid-dir=/var/opt/ssh)
diff --git a/canohost.c b/canohost.c
index 1c22d4770..c27086bfd 100644
--- a/canohost.c
+++ b/canohost.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: canohost.c,v 1.42 2005/02/18 03:05:53 djm Exp $");
+RCSID("$OpenBSD: canohost.c,v 1.44 2005/06/17 02:44:32 djm Exp $");
 
 #include "packet.h"
 #include "xmalloc.h"
@@ -143,7 +143,8 @@ check_ip_options(int sock, char *ipaddr)
         u_char options[200];
         char text[sizeof(options) * 3 + 1];
         socklen_t option_size;
-        int i, ipproto;
+        u_int i;
+        int ipproto;
         struct protoent *ip;
 
         if ((ip = getprotobyname("ip")) != NULL)
@@ -173,7 +174,7 @@ ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
         struct in_addr inaddr;
         u_int16_t port;
 
-        if (addr->ss_family != AF_INET6 || 
+        if (addr->ss_family != AF_INET6 ||
             !IN6_IS_ADDR_V4MAPPED(&a6->sin6_addr))
                 return;
 
@@ -251,6 +252,8 @@ get_socket_address(int sock, int remote, int flags)
         if (addr.ss_family == AF_INET6)
                 addrlen = sizeof(struct sockaddr_in6);
 
+        ipv64_normalise_mapped(&addr, &addrlen);
+
         /* Get the address in ascii. */
         if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop,
             sizeof(ntop), NULL, 0, flags)) != 0) {
@@ -344,7 +347,7 @@ get_sock_port(int sock, int local)
         } else {
                 if (getpeername(sock, (struct sockaddr *)&from, &fromlen) < 0) {
                         debug("getpeername failed: %.100s", strerror(errno));
-                        cleanup_exit(255);
+                        return -1;
                 }
         }
 
diff --git a/channels.c b/channels.c
index 1be213bce..8c7b2b369 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.212 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.223 2005/07/17 07:17:54 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,6 +58,8 @@ RCSID("$OpenBSD: channels.c,v 1.212 2005/03/01 10:09:52 djm Exp $");
 
 /* -- channel core */
 
+#define CHAN_RBUF       16*1024
+
 /*
  * Pointer to an array containing all allocated channels.  The array is
  * dynamically extended as needed.
@@ -109,6 +111,9 @@ static int all_opens_permitted = 0;
 /* Maximum number of fake X11 displays to try. */
 #define MAX_DISPLAYS  1000
 
+/* Saved X11 local (client) display. */
+static char *x11_saved_display = NULL;
+
 /* Saved X11 authentication protocol name. */
 static char *x11_saved_proto = NULL;
 
@@ -712,6 +717,9 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
 {
         u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
 
+        /* check buffer limits */
+        limit = MIN(limit, (BUFFER_MAX_LEN - BUFFER_MAX_CHUNK - CHAN_RBUF));
+
         if (c->istate == CHAN_INPUT_OPEN &&
             limit > 0 &&
             buffer_len(&c->input) < limit)
@@ -722,8 +730,8 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
                         FD_SET(c->wfd, writeset);
                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
                         if (CHANNEL_EFD_OUTPUT_ACTIVE(c))
-                               debug2("channel %d: obuf_empty delayed efd %d/(%d)",
-                                   c->self, c->efd, buffer_len(&c->extended));
+                                debug2("channel %d: obuf_empty delayed efd %d/(%d)",
+                                    c->self, c->efd, buffer_len(&c->extended));
                         else
                                 chan_obuf_empty(c);
                 }
@@ -889,7 +897,7 @@ static int
 channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)
 {
         char *p, *host;
-        int len, have, i, found;
+        u_int len, have, i, found;
         char username[256];
         struct {
                 u_int8_t version;
@@ -974,7 +982,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
         } s5_req, s5_rsp;
         u_int16_t dest_port;
         u_char *p, dest_addr[255+1];
-        int i, have, found, nmethods, addrlen, af;
+        u_int have, i, found, nmethods, addrlen, af;
 
         debug2("channel %d: decode socks5", c->self);
         p = buffer_ptr(&c->input);
@@ -1018,7 +1026,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
                 debug2("channel %d: only socks5 connect supported", c->self);
                 return -1;
         }
-        switch(s5_req.atyp){
+        switch (s5_req.atyp){
         case SSH_SOCKS5_IPV4:
                 addrlen = 4;
                 af = AF_INET;
@@ -1070,7 +1078,8 @@ static void
 channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
 {
         u_char *p;
-        int have, ret;
+        u_int have;
+        int ret;
 
         have = buffer_len(&c->input);
         c->delayed = 0;
@@ -1173,7 +1182,7 @@ port_open_helper(Channel *c, char *rtype)
         int direct;
         char buf[1024];
         char *remote_ipaddr = get_peer_ipaddr(c->sock);
-        u_short remote_port = get_peer_port(c->sock);
+        int remote_port = get_peer_port(c->sock);
 
         direct = (strcmp(rtype, "direct-tcpip") == 0);
 
@@ -1203,7 +1212,7 @@ port_open_helper(Channel *c, char *rtype)
                 }
                 /* originator host and port */
                 packet_put_cstring(remote_ipaddr);
-                packet_put_int(remote_port);
+                packet_put_int((u_int)remote_port);
                 packet_send();
         } else {
                 packet_start(SSH_MSG_PORT_OPEN);
@@ -1360,7 +1369,7 @@ channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-        char buf[16*1024];
+        char buf[CHAN_RBUF];
         int len;
 
         if (c->rfd != -1 &&
@@ -1454,7 +1463,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-        char buf[16*1024];
+        char buf[CHAN_RBUF];
         int len;
 
 /** XXX handle drain efd, too */
@@ -1804,8 +1813,8 @@ channel_output_poll(void)
                          * hack for extended data: delay EOF if EFD still in use.
                          */
                         if (CHANNEL_EFD_INPUT_ACTIVE(c))
-                               debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
-                                   c->self, c->efd, buffer_len(&c->extended));
+                                debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
+                                    c->self, c->efd, buffer_len(&c->extended));
                         else
                                 chan_ibuf_empty(c);
                 }
@@ -2190,20 +2199,20 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
 
         if (host == NULL) {
                 error("No forward host name.");
-                return success;
+                return 0;
         }
         if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {
                 error("Forward host name too long.");
-                return success;
+                return 0;
         }
 
         /*
          * Determine whether or not a port forward listens to loopback,
-         * specified address or wildcard. On the client, a specified bind 
-         * address will always override gateway_ports. On the server, a 
-         * gateway_ports of 1 (``yes'') will override the client's 
-         * specification and force a wildcard bind, whereas a value of 2 
-         * (``clientspecified'') will bind to whatever address the client 
+         * specified address or wildcard. On the client, a specified bind
+         * address will always override gateway_ports. On the server, a
+         * gateway_ports of 1 (``yes'') will override the client's
+         * specification and force a wildcard bind, whereas a value of 2
+         * (``clientspecified'') will bind to whatever address the client
          * asked for.
          *
          * Special-case listen_addrs are:
@@ -2245,12 +2254,10 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
                         packet_disconnect("getaddrinfo: fatal error: %s",
                             gai_strerror(r));
                 } else {
-                        verbose("channel_setup_fwd_listener: "
-                            "getaddrinfo(%.64s): %s", addr, gai_strerror(r));
-                        packet_send_debug("channel_setup_fwd_listener: "
+                        error("channel_setup_fwd_listener: "
                             "getaddrinfo(%.64s): %s", addr, gai_strerror(r));
                 }
-                aitop = NULL;
+                return 0;
         }
 
         for (ai = aitop; ai; ai = ai->ai_next) {
@@ -2317,7 +2324,7 @@ channel_cancel_rport_listener(const char *host, u_short port)
         u_int i;
         int found = 0;
 
-        for(i = 0; i < channels_alloc; i++) {
+        for (i = 0; i < channels_alloc; i++) {
                 Channel *c = channels[i];
 
                 if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER &&
@@ -2629,7 +2636,7 @@ channel_send_window_changes(void)
         struct winsize ws;
 
         for (i = 0; i < channels_alloc; i++) {
-                if (channels[i] == NULL || !channels[i]->client_tty || 
+                if (channels[i] == NULL || !channels[i]->client_tty ||
                     channels[i]->type != SSH_CHANNEL_OPEN)
                         continue;
                 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0)
@@ -2652,7 +2659,7 @@ channel_send_window_changes(void)
  */
 int
 x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
-    int single_connection, u_int *display_numberp)
+    int single_connection, u_int *display_numberp, int **chanids)
 {
         Channel *nc = NULL;
         int display_number, sock;
@@ -2742,6 +2749,8 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
         }
 
         /* Allocate a channel for each socket. */
+        if (chanids != NULL)
+                *chanids = xmalloc(sizeof(**chanids) * (num_socks + 1));
         for (n = 0; n < num_socks; n++) {
                 sock = socks[n];
                 nc = channel_new("x11 listener",
@@ -2749,7 +2758,11 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
                     0, "X11 inet listener", 1);
                 nc->single_connection = single_connection;
+                if (*chanids != NULL)
+                        (*chanids)[n] = nc->self;
         }
+        if (*chanids != NULL)
+                (*chanids)[n] = -1;
 
         /* Return the display number for the DISPLAY environment variable. */
         *display_numberp = display_number;
@@ -2947,19 +2960,27 @@ deny_input_open(int type, u_int32_t seq, void *ctxt)
  * This should be called in the client only.
  */
 void
-x11_request_forwarding_with_spoofing(int client_session_id,
+x11_request_forwarding_with_spoofing(int client_session_id, const char *disp,
     const char *proto, const char *data)
 {
         u_int data_len = (u_int) strlen(data) / 2;
-        u_int i, value, len;
+        u_int i, value;
         char *new_data;
         int screen_number;
         const char *cp;
         u_int32_t rnd = 0;
 
-        cp = getenv("DISPLAY");
-        if (cp)
-                cp = strchr(cp, ':');
+        if (x11_saved_display == NULL)
+                x11_saved_display = xstrdup(disp);
+        else if (strcmp(disp, x11_saved_display) != 0) {
+                error("x11_request_forwarding_with_spoofing: different "
+                    "$DISPLAY already forwarded");
+                return;
+        }
+
+        cp = disp;
+        if (disp)
+                cp = strchr(disp, ':');
         if (cp)
                 cp = strchr(cp, '.');
         if (cp)
@@ -2967,33 +2988,31 @@ x11_request_forwarding_with_spoofing(int client_session_id,
         else
                 screen_number = 0;
 
-        /* Save protocol name. */
-        x11_saved_proto = xstrdup(proto);
-
-        /*
-         * Extract real authentication data and generate fake data of the
-         * same length.
-         */
-        x11_saved_data = xmalloc(data_len);
-        x11_fake_data = xmalloc(data_len);
-        for (i = 0; i < data_len; i++) {
-                if (sscanf(data + 2 * i, "%2x", &value) != 1)
-                        fatal("x11_request_forwarding: bad authentication data: %.100s", data);
-                if (i % 4 == 0)
-                        rnd = arc4random();
-                x11_saved_data[i] = value;
-                x11_fake_data[i] = rnd & 0xff;
-                rnd >>= 8;
-        }
-        x11_saved_data_len = data_len;
-        x11_fake_data_len = data_len;
+        if (x11_saved_proto == NULL) {
+                /* Save protocol name. */
+                x11_saved_proto = xstrdup(proto);
+                /*
+                 * Extract real authentication data and generate fake data
+                 * of the same length.
+                 */
+                x11_saved_data = xmalloc(data_len);
+                x11_fake_data = xmalloc(data_len);
+                for (i = 0; i < data_len; i++) {
+                        if (sscanf(data + 2 * i, "%2x", &value) != 1)
+                                fatal("x11_request_forwarding: bad "
+                                    "authentication data: %.100s", data);
+                        if (i % 4 == 0)
+                                rnd = arc4random();
+                        x11_saved_data[i] = value;
+                        x11_fake_data[i] = rnd & 0xff;
+                        rnd >>= 8;
+                }
+                x11_saved_data_len = data_len;
+                x11_fake_data_len = data_len;
+        }
 
         /* Convert the fake data into hex. */
-        len = 2 * data_len + 1;
-        new_data = xmalloc(len);
-        for (i = 0; i < data_len; i++)
-                snprintf(new_data + 2 * i, len - 2 * i,
-                    "%02x", (u_char) x11_fake_data[i]);
+        new_data = tohex(x11_fake_data, data_len);
 
         /* Send the request packet. */
         if (compat20) {
diff --git a/channels.h b/channels.h
index fc20fb2c3..1cb2c3a34 100644
--- a/channels.h
+++ b/channels.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: channels.h,v 1.76 2005/03/01 10:09:52 djm Exp $       */
+/*      $OpenBSD: channels.h,v 1.79 2005/07/17 06:49:04 djm Exp $       */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -149,7 +149,7 @@ struct Channel {
         buffer_len(&c->extended) > 0))
 #define CHANNEL_EFD_OUTPUT_ACTIVE(c) \
         (compat20 && c->extended_usage == CHAN_EXTENDED_WRITE && \
-        ((c->efd != -1 && !(c->flags & (CHAN_EOF_RCVD|CHAN_CLOSE_RCVD))) || \
+        c->efd != -1 && (!(c->flags & (CHAN_EOF_RCVD|CHAN_CLOSE_RCVD)) || \
         buffer_len(&c->extended) > 0))
 
 /* channel management */
@@ -214,9 +214,10 @@ int	 channel_cancel_rport_listener(const char *, u_short);
 /* x11 forwarding */
 
 int      x11_connect_display(void);
-int      x11_create_display_inet(int, int, int, u_int *);
+int      x11_create_display_inet(int, int, int, u_int *, int **);
 void     x11_input_open(int, u_int32_t, void *);
-void     x11_request_forwarding_with_spoofing(int, const char *, const char *);
+void     x11_request_forwarding_with_spoofing(int, const char *, const char *,
+            const char *);
 void     deny_input_open(int, u_int32_t, void *);
 
 /* agent forwarding */
diff --git a/cipher-acss.c b/cipher-acss.c
index 3a966a74d..a95fa6747 100644
--- a/cipher-acss.c
+++ b/cipher-acss.c
@@ -17,7 +17,7 @@
 #include "includes.h"
 #include <openssl/evp.h>
 
-RCSID("$Id: cipher-acss.c,v 1.2 2004/02/06 04:26:11 dtucker Exp $");
+RCSID("$Id: cipher-acss.c,v 1.3 2005/07/17 07:04:47 djm Exp $");
 
 #if !defined(EVP_CTRL_SET_ACSS_MODE) && (OPENSSL_VERSION_NUMBER >= 0x00907000L)
 
@@ -33,7 +33,7 @@ typedef struct {
 #define EVP_CTRL_SET_ACSS_SUBKEY        0xff07
 
 static int
-acss_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 
+acss_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
     const unsigned char *iv, int enc)
 {
         acss_setkey(&data(ctx)->ks,key,enc,ACSS_DATA);
@@ -41,7 +41,7 @@ acss_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 }
 
 static int
-acss_ciph(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, 
+acss_ciph(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
     unsigned int inl)
 {
         acss(&data(ctx)->ks,inl,in,out);
diff --git a/cipher-ctr.c b/cipher-ctr.c
index 43f1ede57..856177349 100644
--- a/cipher-ctr.c
+++ b/cipher-ctr.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: cipher-ctr.c,v 1.5 2004/12/22 02:13:19 djm Exp $");
+RCSID("$OpenBSD: cipher-ctr.c,v 1.6 2005/07/17 07:17:55 djm Exp $");
 
 #include <openssl/evp.h>
 
@@ -95,7 +95,7 @@ ssh_aes_ctr_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
         }
         if (key != NULL)
                 AES_set_encrypt_key(key, EVP_CIPHER_CTX_key_length(ctx) * 8,
-                     &c->aes_ctx);
+                    &c->aes_ctx);
         if (iv != NULL)
                 memcpy(c->aes_counter, iv, AES_BLOCK_SIZE);
         return (1);
diff --git a/cipher.c b/cipher.c
index beba4618d..0dddf270a 100644
--- a/cipher.c
+++ b/cipher.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: cipher.c,v 1.73 2005/01/23 10:18:12 djm Exp $");
+RCSID("$OpenBSD: cipher.c,v 1.77 2005/07/16 01:35:24 djm Exp $");
 
 #include "xmalloc.h"
 #include "log.h"
@@ -43,25 +43,8 @@ RCSID("$OpenBSD: cipher.c,v 1.73 2005/01/23 10:18:12 djm Exp $");
 
 #include <openssl/md5.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x00906000L
-#define SSH_OLD_EVP
-#define EVP_CIPHER_CTX_get_app_data(e)          ((e)->app_data)
-#endif
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-extern const EVP_CIPHER *evp_rijndael(void);
-extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
-#endif
-
-#if !defined(EVP_CTRL_SET_ACSS_MODE)
-# if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-extern const EVP_CIPHER *evp_acss(void);
-#  define EVP_acss evp_acss
-#  define EVP_CTRL_SET_ACSS_MODE xxx    /* used below */
-# else
-#  define EVP_acss NULL /* Don't try to support ACSS on older OpenSSL */
-# endif /* (OPENSSL_VERSION_NUMBER >= 0x00906000L) */
-#endif /* !defined(EVP_CTRL_SET_ACSS_MODE) */
+/* compatibility with old or broken OpenSSL versions */
+#include "openbsd-compat/openssl-compat.h"
 
 extern const EVP_CIPHER *evp_ssh1_bf(void);
 extern const EVP_CIPHER *evp_ssh1_3des(void);
@@ -74,39 +57,32 @@ struct Cipher {
         int     number;         /* for ssh1 only */
         u_int   block_size;
         u_int   key_len;
+        u_int   discard_len;
         const EVP_CIPHER        *(*evptype)(void);
 } ciphers[] = {
-        { "none",               SSH_CIPHER_NONE, 8, 0, EVP_enc_null },
-        { "des",                SSH_CIPHER_DES, 8, 8, EVP_des_cbc },
-        { "3des",               SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des },
-        { "blowfish",           SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf },
-
-        { "3des-cbc",           SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc },
-        { "blowfish-cbc",       SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc },
-        { "cast128-cbc",        SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc },
-        { "arcfour",            SSH_CIPHER_SSH2, 8, 16, EVP_rc4 },
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-        { "aes128-cbc",         SSH_CIPHER_SSH2, 16, 16, evp_rijndael },
-        { "aes192-cbc",         SSH_CIPHER_SSH2, 16, 24, evp_rijndael },
-        { "aes256-cbc",         SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
+        { "none",               SSH_CIPHER_NONE, 8, 0, 0, EVP_enc_null },
+        { "des",                SSH_CIPHER_DES, 8, 8, 0, EVP_des_cbc },
+        { "3des",               SSH_CIPHER_3DES, 8, 16, 0, evp_ssh1_3des },
+        { "blowfish",           SSH_CIPHER_BLOWFISH, 8, 32, 0, evp_ssh1_bf },
+
+        { "3des-cbc",           SSH_CIPHER_SSH2, 8, 24, 0, EVP_des_ede3_cbc },
+        { "blowfish-cbc",       SSH_CIPHER_SSH2, 8, 16, 0, EVP_bf_cbc },
+        { "cast128-cbc",        SSH_CIPHER_SSH2, 8, 16, 0, EVP_cast5_cbc },
+        { "arcfour",            SSH_CIPHER_SSH2, 8, 16, 0, EVP_rc4 },
+        { "arcfour128",         SSH_CIPHER_SSH2, 8, 16, 1536, EVP_rc4 },
+        { "arcfour256",         SSH_CIPHER_SSH2, 8, 32, 1536, EVP_rc4 },
+        { "aes128-cbc",         SSH_CIPHER_SSH2, 16, 16, 0, EVP_aes_128_cbc },
+        { "aes192-cbc",         SSH_CIPHER_SSH2, 16, 24, 0, EVP_aes_192_cbc },
+        { "aes256-cbc",         SSH_CIPHER_SSH2, 16, 32, 0, EVP_aes_256_cbc },
         { "rijndael-cbc@lysator.liu.se",
-                                SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
-#else
-        { "aes128-cbc",         SSH_CIPHER_SSH2, 16, 16, EVP_aes_128_cbc },
-        { "aes192-cbc",         SSH_CIPHER_SSH2, 16, 24, EVP_aes_192_cbc },
-        { "aes256-cbc",         SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
-        { "rijndael-cbc@lysator.liu.se",
-                                SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
-#endif
-#if OPENSSL_VERSION_NUMBER >= 0x00905000L
-        { "aes128-ctr",         SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr },
-        { "aes192-ctr",         SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr },
-        { "aes256-ctr",         SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr },
+                                SSH_CIPHER_SSH2, 16, 32, 0, EVP_aes_256_cbc },
+        { "aes128-ctr",         SSH_CIPHER_SSH2, 16, 16, 0, evp_aes_128_ctr },
+        { "aes192-ctr",         SSH_CIPHER_SSH2, 16, 24, 0, evp_aes_128_ctr },
+        { "aes256-ctr",         SSH_CIPHER_SSH2, 16, 32, 0, evp_aes_128_ctr },
+#ifdef USE_CIPHER_ACSS
+        { "acss@openssh.org",   SSH_CIPHER_SSH2, 16, 5, 0, EVP_acss },
 #endif
-#if defined(EVP_CTRL_SET_ACSS_MODE)
-        { "acss@openssh.org",   SSH_CIPHER_SSH2, 16, 5, EVP_acss },
-#endif
-        { NULL,                 SSH_CIPHER_INVALID, 0, 0, NULL }
+        { NULL,                 SSH_CIPHER_INVALID, 0, 0, 0, NULL }
 };
 
 /*--*/
@@ -222,8 +198,9 @@ cipher_init(CipherContext *cc, Cipher *cipher,
         EVP_CIPHER *type;
 #else
         const EVP_CIPHER *type;
-#endif
         int klen;
+#endif
+        u_char *junk, *discard;
 
         if (cipher->number == SSH_CIPHER_DES) {
                 if (dowarn) {
@@ -261,7 +238,7 @@ cipher_init(CipherContext *cc, Cipher *cipher,
                 fatal("cipher_init: EVP_CipherInit failed for %s",
                     cipher->name);
         klen = EVP_CIPHER_CTX_key_length(&cc->evp);
-        if (klen > 0 && keylen != klen) {
+        if (klen > 0 && keylen != (u_int)klen) {
                 debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
                 if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0)
                         fatal("cipher_init: set keylen failed (%d -> %d)",
@@ -271,6 +248,17 @@ cipher_init(CipherContext *cc, Cipher *cipher,
                 fatal("cipher_init: EVP_CipherInit: set key failed for %s",
                     cipher->name);
 #endif
+
+        if (cipher->discard_len > 0) {
+                junk = xmalloc(cipher->discard_len);
+                discard = xmalloc(cipher->discard_len);
+                if (EVP_Cipher(&cc->evp, discard, junk,
+                    cipher->discard_len) == 0)
+                        fatal("evp_crypt: EVP_Cipher failed during discard");
+                memset(discard, 0, cipher->discard_len);
+                xfree(junk);
+                xfree(discard);
+        }
 }
 
 void
@@ -278,23 +266,15 @@ cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
 {
         if (len % cc->cipher->block_size)
                 fatal("cipher_encrypt: bad plaintext length %d", len);
-#ifdef SSH_OLD_EVP
-        EVP_Cipher(&cc->evp, dest, (u_char *)src, len);
-#else
         if (EVP_Cipher(&cc->evp, dest, (u_char *)src, len) == 0)
                 fatal("evp_crypt: EVP_Cipher failed");
-#endif
 }
 
 void
 cipher_cleanup(CipherContext *cc)
 {
-#ifdef SSH_OLD_EVP
-        EVP_CIPHER_CTX_cleanup(&cc->evp);
-#else
         if (EVP_CIPHER_CTX_cleanup(&cc->evp) == 0)
                 error("cipher_cleanup: EVP_CIPHER_CTX_cleanup failed");
-#endif
 }
 
 /*
@@ -349,9 +329,9 @@ cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
         case SSH_CIPHER_DES:
         case SSH_CIPHER_BLOWFISH:
                 evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
-                if (evplen == 0)
+                if (evplen <= 0)
                         return;
-                if (evplen != len)
+                if ((u_int)evplen != len)
                         fatal("%s: wrong iv length %d != %d", __func__,
                             evplen, len);
 #if OPENSSL_VERSION_NUMBER < 0x00907000L
diff --git a/clientloop.c b/clientloop.c
index 1e250883f..47f3c7ecd 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -59,7 +59,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.135 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.141 2005/07/16 01:35:24 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -140,6 +140,8 @@ int	session_ident = -1;
 struct confirm_ctx {
         int want_tty;
         int want_subsys;
+        int want_x_fwd;
+        int want_agent_fwd;
         Buffer cmd;
         char *term;
         struct termios tio;
@@ -208,6 +210,109 @@ get_current_time(void)
         return (double) tv.tv_sec + (double) tv.tv_usec / 1000000.0;
 }
 
+#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
+void
+client_x11_get_proto(const char *display, const char *xauth_path,
+    u_int trusted, char **_proto, char **_data)
+{
+        char cmd[1024];
+        char line[512];
+        char xdisplay[512];
+        static char proto[512], data[512];
+        FILE *f;
+        int got_data = 0, generated = 0, do_unlink = 0, i;
+        char *xauthdir, *xauthfile;
+        struct stat st;
+
+        xauthdir = xauthfile = NULL;
+        *_proto = proto;
+        *_data = data;
+        proto[0] = data[0] = '\0';
+
+        if (xauth_path == NULL ||(stat(xauth_path, &st) == -1)) {
+                debug("No xauth program.");
+        } else {
+                if (display == NULL) {
+                        debug("x11_get_proto: DISPLAY not set");
+                        return;
+                }
+                /*
+                 * Handle FamilyLocal case where $DISPLAY does
+                 * not match an authorization entry.  For this we
+                 * just try "xauth list unix:displaynum.screennum".
+                 * XXX: "localhost" match to determine FamilyLocal
+                 *      is not perfect.
+                 */
+                if (strncmp(display, "localhost:", 10) == 0) {
+                        snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
+                            display + 10);
+                        display = xdisplay;
+                }
+                if (trusted == 0) {
+                        xauthdir = xmalloc(MAXPATHLEN);
+                        xauthfile = xmalloc(MAXPATHLEN);
+                        strlcpy(xauthdir, "/tmp/ssh-XXXXXXXXXX", MAXPATHLEN);
+                        if (mkdtemp(xauthdir) != NULL) {
+                                do_unlink = 1;
+                                snprintf(xauthfile, MAXPATHLEN, "%s/xauthfile",
+                                    xauthdir);
+                                snprintf(cmd, sizeof(cmd),
+                                    "%s -f %s generate %s " SSH_X11_PROTO
+                                    " untrusted timeout 1200 2>" _PATH_DEVNULL,
+                                    xauth_path, xauthfile, display);
+                                debug2("x11_get_proto: %s", cmd);
+                                if (system(cmd) == 0)
+                                        generated = 1;
+                        }
+                }
+                snprintf(cmd, sizeof(cmd),
+                    "%s %s%s list %s . 2>" _PATH_DEVNULL,
+                    xauth_path,
+                    generated ? "-f " : "" ,
+                    generated ? xauthfile : "",
+                    display);
+                debug2("x11_get_proto: %s", cmd);
+                f = popen(cmd, "r");
+                if (f && fgets(line, sizeof(line), f) &&
+                    sscanf(line, "%*s %511s %511s", proto, data) == 2)
+                        got_data = 1;
+                if (f)
+                        pclose(f);
+        }
+
+        if (do_unlink) {
+                unlink(xauthfile);
+                rmdir(xauthdir);
+        }
+        if (xauthdir)
+                xfree(xauthdir);
+        if (xauthfile)
+                xfree(xauthfile);
+
+        /*
+         * If we didn't get authentication data, just make up some
+         * data.  The forwarding code will check the validity of the
+         * response anyway, and substitute this data.  The X11
+         * server, however, will ignore this fake data and use
+         * whatever authentication mechanisms it was using otherwise
+         * for the local connection.
+         */
+        if (!got_data) {
+                u_int32_t rnd = 0;
+
+                logit("Warning: No xauth data; "
+                    "using fake authentication data for X11 forwarding.");
+                strlcpy(proto, SSH_X11_PROTO, sizeof proto);
+                for (i = 0; i < 16; i++) {
+                        if (i % 4 == 0)
+                                rnd = arc4random();
+                        snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
+                            rnd & 0xff);
+                        rnd >>= 8;
+                }
+        }
+}
+
 /*
  * This is called when the interactive is entered.  This checks if there is
  * an EOF coming on stdin.  We must check this explicitly, as select() does
@@ -528,6 +633,7 @@ static void
 client_extra_session2_setup(int id, void *arg)
 {
         struct confirm_ctx *cctx = arg;
+        const char *display;
         Channel *c;
         int i;
 
@@ -536,6 +642,24 @@ client_extra_session2_setup(int id, void *arg)
         if ((c = channel_lookup(id)) == NULL)
                 fatal("%s: no channel for id %d", __func__, id);
 
+        display = getenv("DISPLAY");
+        if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
+                char *proto, *data;
+                /* Get reasonable local authentication information. */
+                client_x11_get_proto(display, options.xauth_location,
+                    options.forward_x11_trusted, &proto, &data);
+                /* Request forwarding with authentication spoofing. */
+                debug("Requesting X11 forwarding with authentication spoofing.");
+                x11_request_forwarding_with_spoofing(id, display, proto, data);
+                /* XXX wait for reply */
+        }
+
+        if (cctx->want_agent_fwd && options.forward_agent) {
+                debug("Requesting authentication agent forwarding.");
+                channel_request_start(id, "auth-agent-req@openssh.com", 0);
+                packet_send();
+        }
+
         client_session2_setup(id, cctx->want_tty, cctx->want_subsys,
             cctx->term, &cctx->tio, c->rfd, &cctx->cmd, cctx->env,
             client_subsystem_reply);
@@ -556,12 +680,12 @@ client_process_control(fd_set * readset)
 {
         Buffer m;
         Channel *c;
-        int client_fd, new_fd[3], ver, i, allowed;
+        int client_fd, new_fd[3], ver, allowed;
         socklen_t addrlen;
         struct sockaddr_storage addr;
         struct confirm_ctx *cctx;
         char *cmd;
-        u_int len, env_len, command, flags;
+        u_int i, len, env_len, command, flags;
         uid_t euid;
         gid_t egid;
 
@@ -601,7 +725,7 @@ client_process_control(fd_set * readset)
                 buffer_free(&m);
                 return;
         }
-        if ((ver = buffer_get_char(&m)) != 1) {
+        if ((ver = buffer_get_char(&m)) != SSHMUX_VER) {
                 error("%s: wrong client version %d", __func__, ver);
                 buffer_free(&m);
                 close(client_fd);
@@ -616,24 +740,26 @@ client_process_control(fd_set * readset)
 
         switch (command) {
         case SSHMUX_COMMAND_OPEN:
-                if (options.control_master == 2)
+                if (options.control_master == SSHCTL_MASTER_ASK ||
+                    options.control_master == SSHCTL_MASTER_AUTO_ASK)
                         allowed = ask_permission("Allow shared connection "
                             "to %s? ", host);
                 /* continue below */
                 break;
         case SSHMUX_COMMAND_TERMINATE:
-                if (options.control_master == 2)
+                if (options.control_master == SSHCTL_MASTER_ASK ||
+                    options.control_master == SSHCTL_MASTER_AUTO_ASK)
                         allowed = ask_permission("Terminate shared connection "
                             "to %s? ", host);
                 if (allowed)
                         quit_pending = 1;
-                /* FALLTHROUGH */       
+                /* FALLTHROUGH */
         case SSHMUX_COMMAND_ALIVE_CHECK:
                 /* Reply for SSHMUX_COMMAND_TERMINATE and ALIVE_CHECK */
                 buffer_clear(&m);
                 buffer_put_int(&m, allowed);
                 buffer_put_int(&m, getpid());
-                if (ssh_msg_send(client_fd, /* version */1, &m) == -1) {
+                if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) {
                         error("%s: client msg_send failed", __func__);
                         close(client_fd);
                         buffer_free(&m);
@@ -653,7 +779,7 @@ client_process_control(fd_set * readset)
         buffer_clear(&m);
         buffer_put_int(&m, allowed);
         buffer_put_int(&m, getpid());
-        if (ssh_msg_send(client_fd, /* version */1, &m) == -1) {
+        if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) {
                 error("%s: client msg_send failed", __func__);
                 close(client_fd);
                 buffer_free(&m);
@@ -674,7 +800,7 @@ client_process_control(fd_set * readset)
                 buffer_free(&m);
                 return;
         }
-        if ((ver = buffer_get_char(&m)) != 1) {
+        if ((ver = buffer_get_char(&m)) != SSHMUX_VER) {
                 error("%s: wrong client version %d", __func__, ver);
                 buffer_free(&m);
                 close(client_fd);
@@ -685,6 +811,8 @@ client_process_control(fd_set * readset)
         memset(cctx, 0, sizeof(*cctx));
         cctx->want_tty = (flags & SSHMUX_FLAG_TTY) != 0;
         cctx->want_subsys = (flags & SSHMUX_FLAG_SUBSYS) != 0;
+        cctx->want_x_fwd = (flags & SSHMUX_FLAG_X11_FWD) != 0;
+        cctx->want_agent_fwd = (flags & SSHMUX_FLAG_AGENT_FWD) != 0;
         cctx->term = buffer_get_string(&m, &len);
 
         cmd = buffer_get_string(&m, &len);
@@ -718,7 +846,7 @@ client_process_control(fd_set * readset)
 
         /* This roundtrip is just for synchronisation of ttymodes */
         buffer_clear(&m);
-        if (ssh_msg_send(client_fd, /* version */1, &m) == -1) {
+        if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) {
                 error("%s: client msg_send failed", __func__);
                 close(client_fd);
                 close(new_fd[0]);
@@ -866,7 +994,10 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
         u_char ch;
         char *s;
 
-        for (i = 0; i < len; i++) {
+        if (len <= 0)
+                return (0);
+
+        for (i = 0; i < (u_int)len; i++) {
                 /* Get one character at a time. */
                 ch = buf[i];
 
diff --git a/clientloop.h b/clientloop.h
index b23c111cb..aed2d918b 100644
--- a/clientloop.h
+++ b/clientloop.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: clientloop.h,v 1.12 2004/11/07 00:01:46 djm Exp $     */
+/*      $OpenBSD: clientloop.h,v 1.14 2005/07/04 00:58:43 djm Exp $     */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -37,10 +37,15 @@
 
 /* Client side main loop for the interactive session. */
 int      client_loop(int, int, int);
+void     client_x11_get_proto(const char *, const char *, u_int,
+            char **, char **);
 void     client_global_request_reply_fwd(int, u_int32_t, void *);
 void     client_session2_setup(int, int, int, const char *, struct termios *,
             int, Buffer *, char **, dispatch_fn *);
 
+/* Multiplexing protocol version */
+#define SSHMUX_VER                      1
+
 /* Multiplexing control protocol flags */
 #define SSHMUX_COMMAND_OPEN             1       /* Open new connection */
 #define SSHMUX_COMMAND_ALIVE_CHECK      2       /* Check master is alive */
@@ -48,3 +53,5 @@ void	 client_session2_setup(int, int, int, const char *, struct termios *,
 
 #define SSHMUX_FLAG_TTY                 (1)     /* Request tty on open */
 #define SSHMUX_FLAG_SUBSYS              (1<<1)  /* Subsystem request on open */
+#define SSHMUX_FLAG_X11_FWD             (1<<2)  /* Request X11 forwarding */
+#define SSHMUX_FLAG_AGENT_FWD           (1<<3)  /* Request agent forwarding */
diff --git a/config.guess b/config.guess
index 500ee74b0..6d71f752f 100755
--- a/config.guess
+++ b/config.guess
@@ -1,9 +1,9 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003 Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation, Inc.
 
-timestamp='2003-10-03'
+timestamp='2005-05-27'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -17,13 +17,15 @@ timestamp='2003-10-03'
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
+
 # Originally written by Per Bothner <per@bothner.com>.
 # Please send patches to <config-patches@gnu.org>.  Submit a context
 # diff and a properly formatted ChangeLog entry.
@@ -53,7 +55,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
@@ -66,11 +68,11 @@ Try \`$me --help' for more information."
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - ) # Use stdin as input.
@@ -196,50 +198,64 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
         # contains redundant information, the shorter form:
         # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
         echo "${machine}-${os}${release}"
-        exit 0 ;;
+        exit ;;
+    amd64:OpenBSD:*:*)
+        echo x86_64-unknown-openbsd${UNAME_RELEASE}
+        exit ;;
     amiga:OpenBSD:*:*)
         echo m68k-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
-    arc:OpenBSD:*:*)
-        echo mipsel-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    cats:OpenBSD:*:*)
+        echo arm-unknown-openbsd${UNAME_RELEASE}
+        exit ;;
     hp300:OpenBSD:*:*)
         echo m68k-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    luna88k:OpenBSD:*:*)
+        echo m88k-unknown-openbsd${UNAME_RELEASE}
+        exit ;;
     mac68k:OpenBSD:*:*)
         echo m68k-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     macppc:OpenBSD:*:*)
         echo powerpc-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     mvme68k:OpenBSD:*:*)
         echo m68k-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     mvme88k:OpenBSD:*:*)
         echo m88k-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     mvmeppc:OpenBSD:*:*)
         echo powerpc-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
-    pmax:OpenBSD:*:*)
-        echo mipsel-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     sgi:OpenBSD:*:*)
-        echo mipseb-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        echo mips64-unknown-openbsd${UNAME_RELEASE}
+        exit ;;
     sun3:OpenBSD:*:*)
         echo m68k-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
-    wgrisc:OpenBSD:*:*)
-        echo mipsel-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:OpenBSD:*:*)
         echo ${UNAME_MACHINE}-unknown-openbsd${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    *:ekkoBSD:*:*)
+        echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
+        exit ;;
+    macppc:MirBSD:*:*)
+        echo powerppc-unknown-mirbsd${UNAME_RELEASE}
+        exit ;;
+    *:MirBSD:*:*)
+        echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
+        exit ;;
     alpha:OSF1:*:*)
-        if test $UNAME_RELEASE = "V4.0"; then
+        case $UNAME_RELEASE in
+        *4.0)
                 UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
-        fi
+                ;;
+        *5.*)
+                UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
+                ;;
+        esac
         # According to Compaq, /usr/sbin/psrinfo has been available on
         # OSF/1 and Tru64 systems produced since 1995.  I hope that
         # covers most systems running today.  This code pipes the CPU
@@ -277,42 +293,49 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
             "EV7.9 (21364A)")
                 UNAME_MACHINE="alphaev79" ;;
         esac
+        # A Pn.n version is a patched version.
         # A Vn.n version is a released version.
         # A Tn.n version is a released field test version.
         # A Xn.n version is an unreleased experimental baselevel.
         # 1.2 uses "1.2" for uname -r.
-        echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-        exit 0 ;;
-    Alpha*:OpenVMS:*:*)
-        echo alpha-hp-vms
-        exit 0 ;;
+        echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+        exit ;;
     Alpha\ *:Windows_NT*:*)
         # How do we know it's Interix rather than the generic POSIX subsystem?
         # Should we change UNAME_MACHINE based on the output of uname instead
         # of the specific Alpha model?
         echo alpha-pc-interix
-        exit 0 ;;
+        exit ;;
     21064:Windows_NT:50:3)
         echo alpha-dec-winnt3.5
-        exit 0 ;;
+        exit ;;
     Amiga*:UNIX_System_V:4.0:*)
         echo m68k-unknown-sysv4
-        exit 0;;
+        exit ;;
     *:[Aa]miga[Oo][Ss]:*:*)
         echo ${UNAME_MACHINE}-unknown-amigaos
-        exit 0 ;;
+        exit ;;
     *:[Mm]orph[Oo][Ss]:*:*)
         echo ${UNAME_MACHINE}-unknown-morphos
-        exit 0 ;;
+        exit ;;
     *:OS/390:*:*)
         echo i370-ibm-openedition
-        exit 0 ;;
+        exit ;;
+    *:z/VM:*:*)
+        echo s390-ibm-zvmoe
+        exit ;;
+    *:OS400:*:*)
+        echo powerpc-ibm-os400
+        exit ;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
         echo arm-acorn-riscix${UNAME_RELEASE}
-        exit 0;;
+        exit ;;
+    arm:riscos:*:*|arm:RISCOS:*:*)
+        echo arm-unknown-riscos
+        exit ;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
         echo hppa1.1-hitachi-hiuxmpp
-        exit 0;;
+        exit ;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
         # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
         if test "`(/bin/universe) 2>/dev/null`" = att ; then
@@ -320,32 +343,32 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
         else
                 echo pyramid-pyramid-bsd
         fi
-        exit 0 ;;
+        exit ;;
     NILE*:*:*:dcosx)
         echo pyramid-pyramid-svr4
-        exit 0 ;;
+        exit ;;
     DRS?6000:unix:4.0:6*)
         echo sparc-icl-nx6
-        exit 0 ;;
-    DRS?6000:UNIX_SV:4.2*:7*)
+        exit ;;
+    DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
         case `/usr/bin/uname -p` in
-            sparc) echo sparc-icl-nx7 && exit 0 ;;
+            sparc) echo sparc-icl-nx7; exit ;;
         esac ;;
     sun4H:SunOS:5.*:*)
         echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-        exit 0 ;;
+        exit ;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
         echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-        exit 0 ;;
+        exit ;;
     i86pc:SunOS:5.*:*)
         echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-        exit 0 ;;
+        exit ;;
     sun4*:SunOS:6*:*)
         # According to config.sub, this is the proper way to canonicalize
         # SunOS6.  Hard to guess exactly what SunOS6 will be like, but
         # it's likely to be more like Solaris than SunOS4.
         echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-        exit 0 ;;
+        exit ;;
     sun4*:SunOS:*:*)
         case "`/usr/bin/arch -k`" in
             Series*|S4*)
@@ -354,10 +377,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
         esac
         # Japanese Language versions have a version number like `4.1.3-JL'.
         echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-        exit 0 ;;
+        exit ;;
     sun3*:SunOS:*:*)
         echo m68k-sun-sunos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     sun*:*:4.2BSD:*)
         UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
         test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
@@ -369,10 +392,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
                 echo sparc-sun-sunos${UNAME_RELEASE}
                 ;;
         esac
-        exit 0 ;;
+        exit ;;
     aushp:SunOS:*:*)
         echo sparc-auspex-sunos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
     # "atarist" or "atariste" at least should have a processor
@@ -383,37 +406,40 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
         echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
         echo m68k-milan-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
         echo m68k-hades-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
         echo m68k-unknown-mint${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    m68k:machten:*:*)
+        echo m68k-apple-machten${UNAME_RELEASE}
+        exit ;;
     powerpc:machten:*:*)
         echo powerpc-apple-machten${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     RISC*:Mach:*:*)
         echo mips-dec-mach_bsd4.3
-        exit 0 ;;
+        exit ;;
     RISC*:ULTRIX:*:*)
         echo mips-dec-ultrix${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     VAX*:ULTRIX*:*:*)
         echo vax-dec-ultrix${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
         echo clipper-intergraph-clix${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
         eval $set_cc_for_build
         sed 's/^        //' << EOF >$dummy.c
@@ -437,32 +463,33 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
           exit (-1);
         }
 EOF
-        $CC_FOR_BUILD -o $dummy $dummy.c \
-          && $dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \
-          && exit 0
+        $CC_FOR_BUILD -o $dummy $dummy.c &&
+          dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
+          SYSTEM_NAME=`$dummy $dummyarg` &&
+            { echo "$SYSTEM_NAME"; exit; }
         echo mips-mips-riscos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     Motorola:PowerMAX_OS:*:*)
         echo powerpc-motorola-powermax
-        exit 0 ;;
+        exit ;;
     Motorola:*:4.3:PL8-*)
         echo powerpc-harris-powermax
-        exit 0 ;;
+        exit ;;
     Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
         echo powerpc-harris-powermax
-        exit 0 ;;
+        exit ;;
     Night_Hawk:Power_UNIX:*:*)
         echo powerpc-harris-powerunix
-        exit 0 ;;
+        exit ;;
     m88k:CX/UX:7*:*)
         echo m88k-harris-cxux7
-        exit 0 ;;
+        exit ;;
     m88k:*:4*:R4*)
         echo m88k-motorola-sysv4
-        exit 0 ;;
+        exit ;;
     m88k:*:3*:R3*)
         echo m88k-motorola-sysv3
-        exit 0 ;;
+        exit ;;
     AViiON:dgux:*:*)
         # DG/UX returns AViiON for all architectures
         UNAME_PROCESSOR=`/usr/bin/uname -p`
@@ -478,29 +505,29 @@ EOF
         else
             echo i586-dg-dgux${UNAME_RELEASE}
         fi
-        exit 0 ;;
+        exit ;;
     M88*:DolphinOS:*:*) # DolphinOS (SVR3)
         echo m88k-dolphin-sysv3
-        exit 0 ;;
+        exit ;;
     M88*:*:R3*:*)
         # Delta 88k system running SVR3
         echo m88k-motorola-sysv3
-        exit 0 ;;
+        exit ;;
     XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
         echo m88k-tektronix-sysv3
-        exit 0 ;;
+        exit ;;
     Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
         echo m68k-tektronix-bsd
-        exit 0 ;;
+        exit ;;
     *:IRIX*:*:*)
         echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-        exit 0 ;;
+        exit ;;
     ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-        echo romp-ibm-aix      # uname -m gives an 8 hex-code CPU id
-        exit 0 ;;              # Note that: echo "'`uname -s`'" gives 'AIX '
+        echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
+        exit ;;               # Note that: echo "'`uname -s`'" gives 'AIX '
     i*86:AIX:*:*)
         echo i386-ibm-aix
-        exit 0 ;;
+        exit ;;
     ia64:AIX:*:*)
         if [ -x /usr/bin/oslevel ] ; then
                 IBM_REV=`/usr/bin/oslevel`
@@ -508,7 +535,7 @@ EOF
                 IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
         fi
         echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-        exit 0 ;;
+        exit ;;
     *:AIX:2:3)
         if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
                 eval $set_cc_for_build
@@ -523,14 +550,18 @@ EOF
                         exit(0);
                         }
 EOF
-                $CC_FOR_BUILD -o $dummy $dummy.c && $dummy && exit 0
-                echo rs6000-ibm-aix3.2.5
+                if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
+                then
+                        echo "$SYSTEM_NAME"
+                else
+                        echo rs6000-ibm-aix3.2.5
+                fi
         elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
                 echo rs6000-ibm-aix3.2.4
         else
                 echo rs6000-ibm-aix3.2
         fi
-        exit 0 ;;
+        exit ;;
     *:AIX:*:[45])
         IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
         if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
@@ -544,28 +575,28 @@ EOF
                 IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
         fi
         echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-        exit 0 ;;
+        exit ;;
     *:AIX:*:*)
         echo rs6000-ibm-aix
-        exit 0 ;;
+        exit ;;
     ibmrt:4.4BSD:*|romp-ibm:BSD:*)
         echo romp-ibm-bsd4.4
-        exit 0 ;;
+        exit ;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
         echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
-        exit 0 ;;                           # report: romp-ibm BSD 4.3
+        exit ;;                             # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
         echo rs6000-bull-bosx
-        exit 0 ;;
+        exit ;;
     DPX/2?00:B.O.S.:*:*)
         echo m68k-bull-sysv3
-        exit 0 ;;
+        exit ;;
     9000/[34]??:4.3bsd:1.*:*)
         echo m68k-hp-bsd
-        exit 0 ;;
+        exit ;;
     hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
         echo m68k-hp-bsd4.4
-        exit 0 ;;
+        exit ;;
     9000/[34678]??:HP-UX:*:*)
         HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
         case "${UNAME_MACHINE}" in
@@ -629,7 +660,18 @@ EOF
         then
             # avoid double evaluation of $set_cc_for_build
             test -n "$CC_FOR_BUILD" || eval $set_cc_for_build
-            if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E -) | grep __LP64__ >/dev/null
+
+            # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
+            # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
+            # generating 64-bit code.  GNU and HP use different nomenclature:
+            #
+            # $ CC_FOR_BUILD=cc ./config.guess
+            # => hppa2.0w-hp-hpux11.23
+            # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
+            # => hppa64-hp-hpux11.23
+
+            if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
+                grep __LP64__ >/dev/null
             then
                 HP_ARCH="hppa2.0w"
             else
@@ -637,11 +679,11 @@ EOF
             fi
         fi
         echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-        exit 0 ;;
+        exit ;;
     ia64:HP-UX:*:*)
         HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
         echo ia64-hp-hpux${HPUX_REV}
-        exit 0 ;;
+        exit ;;
     3050*:HI-UX:*:*)
         eval $set_cc_for_build
         sed 's/^        //' << EOF >$dummy.c
@@ -669,153 +711,166 @@ EOF
           exit (0);
         }
 EOF
-        $CC_FOR_BUILD -o $dummy $dummy.c && $dummy && exit 0
+        $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
+                { echo "$SYSTEM_NAME"; exit; }
         echo unknown-hitachi-hiuxwe2
-        exit 0 ;;
+        exit ;;
     9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
         echo hppa1.1-hp-bsd
-        exit 0 ;;
+        exit ;;
     9000/8??:4.3bsd:*:*)
         echo hppa1.0-hp-bsd
-        exit 0 ;;
+        exit ;;
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
         echo hppa1.0-hp-mpeix
-        exit 0 ;;
+        exit ;;
     hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
         echo hppa1.1-hp-osf
-        exit 0 ;;
+        exit ;;
     hp8??:OSF1:*:*)
         echo hppa1.0-hp-osf
-        exit 0 ;;
+        exit ;;
     i*86:OSF1:*:*)
         if [ -x /usr/sbin/sysversion ] ; then
             echo ${UNAME_MACHINE}-unknown-osf1mk
         else
             echo ${UNAME_MACHINE}-unknown-osf1
         fi
-        exit 0 ;;
+        exit ;;
     parisc*:Lites*:*:*)
         echo hppa1.1-hp-lites
-        exit 0 ;;
+        exit ;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
         echo c1-convex-bsd
-        exit 0 ;;
+        exit ;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
         if getsysinfo -f scalar_acc
         then echo c32-convex-bsd
         else echo c2-convex-bsd
         fi
-        exit 0 ;;
+        exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
         echo c34-convex-bsd
-        exit 0 ;;
+        exit ;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
         echo c38-convex-bsd
-        exit 0 ;;
+        exit ;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
         echo c4-convex-bsd
-        exit 0 ;;
+        exit ;;
     CRAY*Y-MP:*:*:*)
         echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-        exit 0 ;;
+        exit ;;
     CRAY*[A-Z]90:*:*:*)
         echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
         | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
               -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
               -e 's/\.[^.]*$/.X/'
-        exit 0 ;;
+        exit ;;
     CRAY*TS:*:*:*)
         echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-        exit 0 ;;
+        exit ;;
     CRAY*T3E:*:*:*)
         echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-        exit 0 ;;
+        exit ;;
     CRAY*SV1:*:*:*)
         echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-        exit 0 ;;
+        exit ;;
     *:UNICOS/mp:*:*)
-        echo nv1-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-        exit 0 ;;
+        echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
+        exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
         FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
         FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
         FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
         echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-        exit 0 ;;
+        exit ;;
+    5000:UNIX_System_V:4.*:*)
+        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+        FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+        echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+        exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
         echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     sparc*:BSD/OS:*:*)
         echo sparc-unknown-bsdi${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:BSD/OS:*:*)
         echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-        exit 0 ;;
-    *:FreeBSD:*:*|*:GNU/FreeBSD:*:*)
-        # Determine whether the default compiler uses glibc.
-        eval $set_cc_for_build
-        sed 's/^        //' << EOF >$dummy.c
-        #include <features.h>
-        #if __GLIBC__ >= 2
-        LIBC=gnu
-        #else
-        LIBC=
-        #endif
-EOF
-        eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^LIBC=`
-        # GNU/FreeBSD systems have a "k" prefix to indicate we are using
-        # FreeBSD's kernel, but not the complete OS.
-        case ${LIBC} in gnu) kernel_only='k' ;; esac
-        echo ${UNAME_MACHINE}-unknown-${kernel_only}freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`${LIBC:+-$LIBC}
-        exit 0 ;;
+        exit ;;
+    *:FreeBSD:*:*)
+        echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
+        exit ;;
     i*:CYGWIN*:*)
         echo ${UNAME_MACHINE}-pc-cygwin
-        exit 0 ;;
+        exit ;;
     i*:MINGW*:*)
         echo ${UNAME_MACHINE}-pc-mingw32
-        exit 0 ;;
+        exit ;;
+    i*:windows32*:*)
+        # uname -m includes "-pc" on this system.
+        echo ${UNAME_MACHINE}-mingw32
+        exit ;;
     i*:PW*:*)
         echo ${UNAME_MACHINE}-pc-pw32
-        exit 0 ;;
+        exit ;;
     x86:Interix*:[34]*)
         echo i586-pc-interix${UNAME_RELEASE}|sed -e 's/\..*//'
-        exit 0 ;;
+        exit ;;
     [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
         echo i${UNAME_MACHINE}-pc-mks
-        exit 0 ;;
+        exit ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
         # How do we know it's Interix rather than the generic POSIX subsystem?
         # It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
         # UNAME_MACHINE based on the output of uname instead of i386?
         echo i586-pc-interix
-        exit 0 ;;
+        exit ;;
     i*:UWIN*:*)
         echo ${UNAME_MACHINE}-pc-uwin
-        exit 0 ;;
+        exit ;;
+    amd64:CYGWIN*:*:*)
+        echo x86_64-unknown-cygwin
+        exit ;;
     p*:CYGWIN*:*)
         echo powerpcle-unknown-cygwin
-        exit 0 ;;
+        exit ;;
     prep*:SunOS:5.*:*)
         echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-        exit 0 ;;
+        exit ;;
     *:GNU:*:*)
+        # the GNU system
         echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-        exit 0 ;;
+        exit ;;
+    *:GNU/*:*:*)
+        # other systems with GNU libc and userland
+        echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-gnu
+        exit ;;
     i*86:Minix:*:*)
         echo ${UNAME_MACHINE}-pc-minix
-        exit 0 ;;
+        exit ;;
     arm*:Linux:*:*)
         echo ${UNAME_MACHINE}-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     cris:Linux:*:*)
         echo cris-axis-linux-gnu
-        exit 0 ;;
+        exit ;;
+    crisv32:Linux:*:*)
+        echo crisv32-axis-linux-gnu
+        exit ;;
+    frv:Linux:*:*)
+        echo frv-unknown-linux-gnu
+        exit ;;
     ia64:Linux:*:*)
         echo ${UNAME_MACHINE}-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
+    m32r*:Linux:*:*)
+        echo ${UNAME_MACHINE}-unknown-linux-gnu
+        exit ;;
     m68*:Linux:*:*)
         echo ${UNAME_MACHINE}-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     mips:Linux:*:*)
         eval $set_cc_for_build
         sed 's/^        //' << EOF >$dummy.c
@@ -833,7 +888,7 @@ EOF
         #endif
 EOF
         eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^CPU=`
-        test x"${CPU}" != x && echo "${CPU}-unknown-linux-gnu" && exit 0
+        test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
         ;;
     mips64:Linux:*:*)
         eval $set_cc_for_build
@@ -852,14 +907,14 @@ EOF
         #endif
 EOF
         eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^CPU=`
-        test x"${CPU}" != x && echo "${CPU}-unknown-linux-gnu" && exit 0
+        test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
         ;;
     ppc:Linux:*:*)
         echo powerpc-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     ppc64:Linux:*:*)
         echo powerpc64-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     alpha:Linux:*:*)
         case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
           EV5)   UNAME_MACHINE=alphaev5 ;;
@@ -873,7 +928,7 @@ EOF
         objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
         if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
         echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-        exit 0 ;;
+        exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
         # Look for CPU level
         case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -881,25 +936,25 @@ EOF
           PA8*) echo hppa2.0-unknown-linux-gnu ;;
           *)    echo hppa-unknown-linux-gnu ;;
         esac
-        exit 0 ;;
+        exit ;;
     parisc64:Linux:*:* | hppa64:Linux:*:*)
         echo hppa64-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
         echo ${UNAME_MACHINE}-ibm-linux
-        exit 0 ;;
+        exit ;;
     sh64*:Linux:*:*)
         echo ${UNAME_MACHINE}-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     sh*:Linux:*:*)
         echo ${UNAME_MACHINE}-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
         echo ${UNAME_MACHINE}-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     x86_64:Linux:*:*)
         echo x86_64-unknown-linux-gnu
-        exit 0 ;;
+        exit ;;
     i*86:Linux:*:*)
         # The BFD linker knows what the default object file format is, so
         # first see if it will tell us. cd to the root directory to prevent
@@ -917,15 +972,15 @@ EOF
                 ;;
           a.out-i386-linux)
                 echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-                exit 0 ;;
+                exit ;;
           coff-i386)
                 echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-                exit 0 ;;
+                exit ;;
           "")
                 # Either a pre-BFD a.out linker (linux-gnuoldld) or
                 # one that does not give us useful --help.
                 echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-                exit 0 ;;
+                exit ;;
         esac
         # Determine whether the default compiler is a.out or elf
         eval $set_cc_for_build
@@ -953,15 +1008,18 @@ EOF
         #endif
 EOF
         eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^LIBC=`
-        test x"${LIBC}" != x && echo "${UNAME_MACHINE}-pc-linux-${LIBC}" && exit 0
-        test x"${TENTATIVE}" != x && echo "${TENTATIVE}" && exit 0
+        test x"${LIBC}" != x && {
+                echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+                exit
+        }
+        test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
         ;;
     i*86:DYNIX/ptx:4*:*)
         # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
         # earlier versions are messed up and put the nodename in both
         # sysname and nodename.
         echo i386-sequent-sysv4
-        exit 0 ;;
+        exit ;;
     i*86:UNIX_SV:4.2MP:2.*)
         # Unixware is an offshoot of SVR4, but it has its own version
         # number series starting with 2...
@@ -969,24 +1027,27 @@ EOF
         # I just have to hope.  -- rms.
         # Use sysv4.2uw... so that sysv4* matches it.
         echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-        exit 0 ;;
+        exit ;;
     i*86:OS/2:*:*)
         # If we were able to find `uname', then EMX Unix compatibility
         # is probably installed.
         echo ${UNAME_MACHINE}-pc-os2-emx
-        exit 0 ;;
+        exit ;;
     i*86:XTS-300:*:STOP)
         echo ${UNAME_MACHINE}-unknown-stop
-        exit 0 ;;
+        exit ;;
     i*86:atheos:*:*)
         echo ${UNAME_MACHINE}-unknown-atheos
-        exit 0 ;;
+        exit ;;
+    i*86:syllable:*:*)
+        echo ${UNAME_MACHINE}-pc-syllable
+        exit ;;
     i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
         echo i386-unknown-lynxos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     i*86:*DOS:*:*)
         echo ${UNAME_MACHINE}-pc-msdosdjgpp
-        exit 0 ;;
+        exit ;;
     i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
         UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
         if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
@@ -994,15 +1055,16 @@ EOF
         else
                 echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
         fi
-        exit 0 ;;
-    i*86:*:5:[78]*)
+        exit ;;
+    i*86:*:5:[678]*)
+        # UnixWare 7.x, OpenUNIX and OpenServer 6.
         case `/bin/uname -X | grep "^Machine"` in
             *486*)           UNAME_MACHINE=i486 ;;
             *Pentium)        UNAME_MACHINE=i586 ;;
             *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
         esac
         echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-        exit 0 ;;
+        exit ;;
     i*86:*:3.2:*)
         if test -f /usr/options/cb.name; then
                 UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
@@ -1020,73 +1082,73 @@ EOF
         else
                 echo ${UNAME_MACHINE}-pc-sysv32
         fi
-        exit 0 ;;
+        exit ;;
     pc:*:*:*)
         # Left here for compatibility:
         # uname -m prints for DJGPP always 'pc', but it prints nothing about
         # the processor, so we play safe by assuming i386.
         echo i386-pc-msdosdjgpp
-        exit 0 ;;
+        exit ;;
     Intel:Mach:3*:*)
         echo i386-pc-mach3
-        exit 0 ;;
+        exit ;;
     paragon:*:*:*)
         echo i860-intel-osf1
-        exit 0 ;;
+        exit ;;
     i860:*:4.*:*) # i860-SVR4
         if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
           echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
         else # Add other i860-SVR4 vendors below as they are discovered.
           echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
         fi
-        exit 0 ;;
+        exit ;;
     mini*:CTIX:SYS*5:*)
         # "miniframe"
         echo m68010-convergent-sysv
-        exit 0 ;;
+        exit ;;
     mc68k:UNIX:SYSTEM5:3.51m)
         echo m68k-convergent-sysv
-        exit 0 ;;
+        exit ;;
     M680?0:D-NIX:5.3:*)
         echo m68k-diab-dnix
-        exit 0 ;;
-    M68*:*:R3V[567]*:*)
-        test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;;
-    3[34]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0)
+        exit ;;
+    M68*:*:R3V[5678]*:*)
+        test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
+    3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
         OS_REL=''
         test -r /etc/.relid \
         && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && echo i486-ncr-sysv4.3${OS_REL} && exit 0
+          && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
         /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-          && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;;
+          && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && echo i486-ncr-sysv4 && exit 0 ;;
+          && { echo i486-ncr-sysv4; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
         echo m68k-unknown-lynxos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     mc68030:UNIX_System_V:4.*:*)
         echo m68k-atari-sysv4
-        exit 0 ;;
+        exit ;;
     TSUNAMI:LynxOS:2.*:*)
         echo sparc-unknown-lynxos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     rs6000:LynxOS:2.*:*)
         echo rs6000-unknown-lynxos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
         echo powerpc-unknown-lynxos${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     SM[BE]S:UNIX_SV:*:*)
         echo mips-dde-sysv${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     RM*:ReliantUNIX-*:*:*)
         echo mips-sni-sysv4
-        exit 0 ;;
+        exit ;;
     RM*:SINIX-*:*:*)
         echo mips-sni-sysv4
-        exit 0 ;;
+        exit ;;
     *:SINIX-*:*:*)
         if uname -p 2>/dev/null >/dev/null ; then
                 UNAME_MACHINE=`(uname -p) 2>/dev/null`
@@ -1094,68 +1156,73 @@ EOF
         else
                 echo ns32k-sni-sysv
         fi
-        exit 0 ;;
+        exit ;;
     PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
                       # says <Richard.M.Bartel@ccMail.Census.GOV>
         echo i586-unisys-sysv4
-        exit 0 ;;
+        exit ;;
     *:UNIX_System_V:4*:FTX*)
         # From Gerald Hewes <hewes@openmarket.com>.
         # How about differentiating between stratus architectures? -djm
         echo hppa1.1-stratus-sysv4
-        exit 0 ;;
+        exit ;;
     *:*:*:FTX*)
         # From seanf@swdc.stratus.com.
         echo i860-stratus-sysv4
-        exit 0 ;;
+        exit ;;
+    i*86:VOS:*:*)
+        # From Paul.Green@stratus.com.
+        echo ${UNAME_MACHINE}-stratus-vos
+        exit ;;
     *:VOS:*:*)
         # From Paul.Green@stratus.com.
         echo hppa1.1-stratus-vos
-        exit 0 ;;
+        exit ;;
     mc68*:A/UX:*:*)
         echo m68k-apple-aux${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     news*:NEWS-OS:6*:*)
         echo mips-sony-newsos6
-        exit 0 ;;
+        exit ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
         if [ -d /usr/nec ]; then
                 echo mips-nec-sysv${UNAME_RELEASE}
         else
                 echo mips-unknown-sysv${UNAME_RELEASE}
         fi
-        exit 0 ;;
+        exit ;;
     BeBox:BeOS:*:*)     # BeOS running on hardware made by Be, PPC only.
         echo powerpc-be-beos
-        exit 0 ;;
+        exit ;;
     BeMac:BeOS:*:*)     # BeOS running on Mac or Mac clone, PPC only.
         echo powerpc-apple-beos
-        exit 0 ;;
+        exit ;;
     BePC:BeOS:*:*)      # BeOS running on Intel PC compatible.
         echo i586-pc-beos
-        exit 0 ;;
+        exit ;;
     SX-4:SUPER-UX:*:*)
         echo sx4-nec-superux${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     SX-5:SUPER-UX:*:*)
         echo sx5-nec-superux${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     SX-6:SUPER-UX:*:*)
         echo sx6-nec-superux${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     Power*:Rhapsody:*:*)
         echo powerpc-apple-rhapsody${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:Rhapsody:*:*)
         echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:Darwin:*:*)
-        case `uname -p` in
+        UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
+        case $UNAME_PROCESSOR in
             *86) UNAME_PROCESSOR=i686 ;;
-            powerpc) UNAME_PROCESSOR=powerpc ;;
+            unknown) UNAME_PROCESSOR=powerpc ;;
         esac
         echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
         UNAME_PROCESSOR=`uname -p`
         if test "$UNAME_PROCESSOR" = "x86"; then
@@ -1163,22 +1230,25 @@ EOF
                 UNAME_MACHINE=pc
         fi
         echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:QNX:*:4*)
         echo i386-pc-qnx
-        exit 0 ;;
-    NSR-[DGKLNPTVWY]:NONSTOP_KERNEL:*:*)
+        exit ;;
+    NSE-?:NONSTOP_KERNEL:*:*)
+        echo nse-tandem-nsk${UNAME_RELEASE}
+        exit ;;
+    NSR-?:NONSTOP_KERNEL:*:*)
         echo nsr-tandem-nsk${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:NonStop-UX:*:*)
         echo mips-compaq-nonstopux
-        exit 0 ;;
+        exit ;;
     BS2000:POSIX*:*:*)
         echo bs2000-siemens-sysv
-        exit 0 ;;
+        exit ;;
     DS/*:UNIX_System_V:*:*)
         echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
     *:Plan9:*:*)
         # "uname -m" is not consistent, so use $cputype instead. 386
         # is converted to i386 for consistency with other x86
@@ -1189,28 +1259,44 @@ EOF
             UNAME_MACHINE="$cputype"
         fi
         echo ${UNAME_MACHINE}-unknown-plan9
-        exit 0 ;;
+        exit ;;
     *:TOPS-10:*:*)
         echo pdp10-unknown-tops10
-        exit 0 ;;
+        exit ;;
     *:TENEX:*:*)
         echo pdp10-unknown-tenex
-        exit 0 ;;
+        exit ;;
     KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
         echo pdp10-dec-tops20
-        exit 0 ;;
+        exit ;;
     XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
         echo pdp10-xkl-tops20
-        exit 0 ;;
+        exit ;;
     *:TOPS-20:*:*)
         echo pdp10-unknown-tops20
-        exit 0 ;;
+        exit ;;
     *:ITS:*:*)
         echo pdp10-unknown-its
-        exit 0 ;;
+        exit ;;
     SEI:*:*:SEIUX)
         echo mips-sei-seiux${UNAME_RELEASE}
-        exit 0 ;;
+        exit ;;
+    *:DragonFly:*:*)
+        echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
+        exit ;;
+    *:*VMS:*:*)
+        UNAME_MACHINE=`(uname -p) 2>/dev/null`
+        case "${UNAME_MACHINE}" in
+            A*) echo alpha-dec-vms ; exit ;;
+            I*) echo ia64-dec-vms ; exit ;;
+            V*) echo vax-dec-vms ; exit ;;
+        esac ;;
+    *:XENIX:*:SysV)
+        echo i386-pc-xenix
+        exit ;;
+    i*86:skyos:*:*)
+        echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
+        exit ;;
 esac
 
 #echo '(No uname command or uname output not recognized.)' 1>&2
@@ -1242,7 +1328,7 @@ main ()
 #endif
 
 #if defined (__arm) && defined (__acorn) && defined (__unix)
-  printf ("arm-acorn-riscix"); exit (0);
+  printf ("arm-acorn-riscix\n"); exit (0);
 #endif
 
 #if defined (hp300) && !defined (hpux)
@@ -1331,11 +1417,12 @@ main ()
 }
 EOF
 
-$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && $dummy && exit 0
+$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
+        { echo "$SYSTEM_NAME"; exit; }
 
 # Apollos put the system type in the environment.
 
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; }
+test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
 
 # Convex versions that predate uname can use getsysinfo(1)
 
@@ -1344,22 +1431,22 @@ then
     case `getsysinfo -f cpu_type` in
     c1*)
         echo c1-convex-bsd
-        exit 0 ;;
+        exit ;;
     c2*)
         if getsysinfo -f scalar_acc
         then echo c32-convex-bsd
         else echo c2-convex-bsd
         fi
-        exit 0 ;;
+        exit ;;
     c34*)
         echo c34-convex-bsd
-        exit 0 ;;
+        exit ;;
     c38*)
         echo c38-convex-bsd
-        exit 0 ;;
+        exit ;;
     c4*)
         echo c4-convex-bsd
-        exit 0 ;;
+        exit ;;
     esac
 fi
 
@@ -1370,7 +1457,9 @@ This script, last modified $timestamp, has failed to recognize
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from
 
-    ftp://ftp.gnu.org/pub/gnu/config/
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.guess
+and
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.sub
 
 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be
diff --git a/config.h.in b/config.h.in
index 70f997323..1b964ee0f 100644
--- a/config.h.in
+++ b/config.h.in
@@ -1,5 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
-/* $Id: acconfig.h,v 1.181 2005/02/25 23:07:38 dtucker Exp $ */
+/* $Id: acconfig.h,v 1.183 2005/07/07 10:33:36 dtucker Exp $ */
 
 /*
  * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -119,9 +119,6 @@
 /* Define if you are on NeXT */
 #undef HAVE_NEXT
 
-/* Define if you are on NEWS-OS */
-#undef HAVE_NEWS4
-
 /* Define if you want to enable PAM support */
 #undef USE_PAM
 
@@ -205,9 +202,6 @@
 /* Define if you don't want to use lastlog in session.c */
 #undef NO_SSH_LASTLOG
 
-/* Define if have krb5_init_ets */
-#undef KRB5_INIT_ETS
-
 /* Define if you don't want to use utmp */
 #undef DISABLE_UTMP
 
@@ -462,6 +456,18 @@
    */
 #undef AIX_GETNAMEINFO_HACK
 
+/* getgroups(0,NULL) will return -1 */
+#undef BROKEN_GETGROUPS
+
+/* ia_uinfo routines not supported by OS yet */
+#undef BROKEN_LIBIAF
+
+/* Ultrix mmap can't map files */
+#undef BROKEN_MMAP
+
+/* LynxOS has broken setvbuf() implementation */
+#undef BROKEN_SETVBUF
+
 /* Define to 1 if the `getpgrp' function requires zero arguments. */
 #undef GETPGRP_VOID
 
@@ -471,6 +477,9 @@
 /* Define to 1 if you have the `arc4random' function. */
 #undef HAVE_ARC4RANDOM
 
+/* OpenBSD's gcc has sentinel */
+#undef HAVE_ATTRIBUTE__SENTINEL__
+
 /* Define to 1 if you have the `b64_ntop' function. */
 #undef HAVE_B64_NTOP
 
@@ -525,6 +534,18 @@
    don't. */
 #undef HAVE_DECL_PASSWDEXPIRED
 
+/* Define to 1 if you have the declaration of `setauthdb', and to 0 if you
+   don't. */
+#undef HAVE_DECL_SETAUTHDB
+
+/* Define to 1 if you have the declaration of `_getlong', and to 0 if you
+   don't. */
+#undef HAVE_DECL__GETLONG
+
+/* Define to 1 if you have the declaration of `_getshort', and to 0 if you
+   don't. */
+#undef HAVE_DECL__GETSHORT
+
 /* Define to 1 if you have the <dirent.h> header file. */
 #undef HAVE_DIRENT_H
 
@@ -543,9 +564,6 @@
 /* Define to 1 if you have the `endutxent' function. */
 #undef HAVE_ENDUTXENT
 
-/* Define to 1 if you have the `fchdir' function. */
-#undef HAVE_FCHDIR
-
 /* Define to 1 if you have the `fchmod' function. */
 #undef HAVE_FCHMOD
 
@@ -654,6 +672,9 @@
 /* Define to 1 if you have the <gssapi_krb5.h> header file. */
 #undef HAVE_GSSAPI_KRB5_H
 
+/* Define to 1 if you have the <iaf.h> header file. */
+#undef HAVE_IAF_H
+
 /* Define to 1 if you have the <ia.h> header file. */
 #undef HAVE_IA_H
 
@@ -690,6 +711,9 @@
 /* Define to 1 if you have the <libgen.h> header file. */
 #undef HAVE_LIBGEN_H
 
+/* Define to 1 if you have the `iaf' library (-liaf). */
+#undef HAVE_LIBIAF
+
 /* Define to 1 if you have the `nsl' library (-lnsl). */
 #undef HAVE_LIBNSL
 
@@ -903,6 +927,9 @@
 /* Define to 1 if you have the `socketpair' function. */
 #undef HAVE_SOCKETPAIR
 
+/* Have PEERCRED socket option */
+#undef HAVE_SO_PEERCRED
+
 /* Define to 1 if you have the <stddef.h> header file. */
 #undef HAVE_STDDEF_H
 
@@ -912,6 +939,9 @@
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
+/* Define to 1 if you have the `strdup' function. */
+#undef HAVE_STRDUP
+
 /* Define to 1 if you have the `strerror' function. */
 #undef HAVE_STRERROR
 
@@ -939,6 +969,12 @@
 /* Define to 1 if you have the `strsep' function. */
 #undef HAVE_STRSEP
 
+/* Define to 1 if you have the `strtoll' function. */
+#undef HAVE_STRTOLL
+
+/* Define to 1 if you have the `strtonum' function. */
+#undef HAVE_STRTONUM
+
 /* Define to 1 if you have the `strtoul' function. */
 #undef HAVE_STRTOUL
 
@@ -996,6 +1032,9 @@
 /* Define to 1 if you have the <sys/strtio.h> header file. */
 #undef HAVE_SYS_STRTIO_H
 
+/* Force use of sys/syslog.h on Ultrix */
+#undef HAVE_SYS_SYSLOG_H
+
 /* Define to 1 if you have the <sys/sysmacros.h> header file. */
 #undef HAVE_SYS_SYSMACROS_H
 
@@ -1095,6 +1134,15 @@
 /* Define to 1 if you have the `__b64_pton' function. */
 #undef HAVE___B64_PTON
 
+/* max value of long long calculated by configure */
+#undef LLONG_MAX
+
+/* min value of long long calculated by configure */
+#undef LLONG_MIN
+
+/* Need setpgrp to acquire controlling tty */
+#undef NEED_SETPRGP
+
 /* Define to the address where bug reports for this package should be sent. */
 #undef PACKAGE_BUGREPORT
 
@@ -1134,6 +1182,9 @@
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
+/* Support passwords > 8 chars */
+#undef UNIXWARE_LONG_PASSWORDS
+
 /* Use BSM audit module */
 #undef USE_BSM_AUDIT
 
diff --git a/config.sub b/config.sub
index 1f31816b9..519f2cd00 100755
--- a/config.sub
+++ b/config.sub
@@ -1,9 +1,9 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003 Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation, Inc.
 
-timestamp='2003-08-18'
+timestamp='2005-05-12'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -21,14 +21,15 @@ timestamp='2003-08-18'
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
+# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
+# 02110-1301, USA.
+#
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
 # the same distribution terms that you use for the rest of that program.
 
+
 # Please send patches to <config-patches@gnu.org>.  Submit a context
 # diff and a properly formatted ChangeLog entry.
 #
@@ -70,7 +71,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
@@ -83,11 +84,11 @@ Try \`$me --help' for more information."
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - ) # Use stdin as input.
@@ -99,7 +100,7 @@ while test $# -gt 0 ; do
     *local*)
        # First pass through any local machine types.
        echo $1
-       exit 0;;
+       exit ;;
 
     * )
        break ;;
@@ -118,7 +119,8 @@ esac
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu* | linux-dietlibc | kfreebsd*-gnu* | netbsd*-gnu* | storm-chaos* | os2-emx* | rtmk-nova*)
+  nto-qnx* | linux-gnu* | linux-dietlibc | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | \
+  kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
@@ -144,7 +146,7 @@ case $os in
         -convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
         -c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
         -harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-        -apple | -axis)
+        -apple | -axis | -knuth | -cray)
                 os=
                 basic_machine=$1
                 ;;
@@ -230,13 +232,14 @@ case $basic_machine in
         | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
         | am33_2.0 \
         | arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr \
+        | bfin \
         | c4x | clipper \
         | d10v | d30v | dlx | dsp16xx \
         | fr30 | frv \
         | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
         | i370 | i860 | i960 | ia64 \
         | ip2k | iq2000 \
-        | m32r | m68000 | m68k | m88k | mcore \
+        | m32r | m32rle | m68000 | m68k | m88k | maxq | mcore \
         | mips | mipsbe | mipseb | mipsel | mipsle \
         | mips16 \
         | mips64 | mips64el \
@@ -261,12 +264,13 @@ case $basic_machine in
         | pyramid \
         | sh | sh[1234] | sh[23]e | sh[34]eb | shbe | shle | sh[1234]le | sh3ele \
         | sh64 | sh64le \
-        | sparc | sparc64 | sparc86x | sparclet | sparclite | sparcv9 | sparcv9b \
+        | sparc | sparc64 | sparc64b | sparc86x | sparclet | sparclite \
+        | sparcv8 | sparcv9 | sparcv9b \
         | strongarm \
         | tahoe | thumb | tic4x | tic80 | tron \
         | v850 | v850e \
         | we32k \
-        | x86 | xscale | xstormy16 | xtensa \
+        | x86 | xscale | xscalee[bl] | xstormy16 | xtensa \
         | z8k)
                 basic_machine=$basic_machine-unknown
                 ;;
@@ -297,9 +301,9 @@ case $basic_machine in
         | alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
         | arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
         | avr-* \
-        | bs2000-* \
+        | bfin-* | bs2000-* \
         | c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* | c55x-* | c6x-* \
-        | clipper-* | cydra-* \
+        | clipper-* | craynv-* | cydra-* \
         | d10v-* | d30v-* | dlx-* \
         | elxsi-* \
         | f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \
@@ -307,9 +311,9 @@ case $basic_machine in
         | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
         | i*86-* | i860-* | i960-* | ia64-* \
         | ip2k-* | iq2000-* \
-        | m32r-* \
+        | m32r-* | m32rle-* \
         | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-        | m88110-* | m88k-* | mcore-* \
+        | m88110-* | m88k-* | maxq-* | mcore-* \
         | mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
         | mips16-* \
         | mips64-* | mips64el-* \
@@ -325,8 +329,9 @@ case $basic_machine in
         | mipsisa64sb1-* | mipsisa64sb1el-* \
         | mipsisa64sr71k-* | mipsisa64sr71kel-* \
         | mipstx39-* | mipstx39el-* \
+        | mmix-* \
         | msp430-* \
-        | none-* | np1-* | nv1-* | ns16k-* | ns32k-* \
+        | none-* | np1-* | ns16k-* | ns32k-* \
         | orion-* \
         | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
         | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
@@ -334,15 +339,16 @@ case $basic_machine in
         | romp-* | rs6000-* \
         | sh-* | sh[1234]-* | sh[23]e-* | sh[34]eb-* | shbe-* \
         | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
-        | sparc-* | sparc64-* | sparc86x-* | sparclet-* | sparclite-* \
-        | sparcv9-* | sparcv9b-* | strongarm-* | sv1-* | sx?-* \
+        | sparc-* | sparc64-* | sparc64b-* | sparc86x-* | sparclet-* \
+        | sparclite-* \
+        | sparcv8-* | sparcv9-* | sparcv9b-* | strongarm-* | sv1-* | sx?-* \
         | tahoe-* | thumb-* \
         | tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
         | tron-* \
         | v850-* | v850e-* | vax-* \
         | we32k-* \
-        | x86-* | x86_64-* | xps100-* | xscale-* | xstormy16-* \
-        | xtensa-* \
+        | x86-* | x86_64-* | xps100-* | xscale-* | xscalee[bl]-* \
+        | xstormy16-* | xtensa-* \
         | ymp-* \
         | z8k-*)
                 ;;
@@ -362,6 +368,9 @@ case $basic_machine in
                 basic_machine=a29k-amd
                 os=-udi
                 ;;
+        abacus)
+                basic_machine=abacus-unknown
+                ;;
         adobe68k)
                 basic_machine=m68010-adobe
                 os=-scout
@@ -379,6 +388,9 @@ case $basic_machine in
         amd64)
                 basic_machine=x86_64-pc
                 ;;
+        amd64-*)
+                basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
+                ;;
         amdahl)
                 basic_machine=580-amdahl
                 os=-sysv
@@ -438,12 +450,27 @@ case $basic_machine in
                 basic_machine=j90-cray
                 os=-unicos
                 ;;
+        craynv)
+                basic_machine=craynv-cray
+                os=-unicosmp
+                ;;
+        cr16c)
+                basic_machine=cr16c-unknown
+                os=-elf
+                ;;
         crds | unos)
                 basic_machine=m68k-crds
                 ;;
+        crisv32 | crisv32-* | etraxfs*)
+                basic_machine=crisv32-axis
+                ;;
         cris | cris-* | etrax*)
                 basic_machine=cris-axis
                 ;;
+        crx)
+                basic_machine=crx-unknown
+                os=-elf
+                ;;
         da30 | da30-*)
                 basic_machine=m68k-da30
                 ;;
@@ -466,6 +493,10 @@ case $basic_machine in
                 basic_machine=m88k-motorola
                 os=-sysv3
                 ;;
+        djgpp)
+                basic_machine=i586-pc
+                os=-msdosdjgpp
+                ;;
         dpx20 | dpx20-*)
                 basic_machine=rs6000-bull
                 os=-bosx
@@ -644,10 +675,6 @@ case $basic_machine in
         mips3*)
                 basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
                 ;;
-        mmix*)
-                basic_machine=mmix-knuth
-                os=-mmixware
-                ;;
         monitor)
                 basic_machine=m68k-rom68k
                 os=-coff
@@ -728,10 +755,6 @@ case $basic_machine in
         np1)
                 basic_machine=np1-gould
                 ;;
-        nv1)
-                basic_machine=nv1-cray
-                os=-unicosmp
-                ;;
         nsr-tandem)
                 basic_machine=nsr-tandem
                 ;;
@@ -743,6 +766,10 @@ case $basic_machine in
                 basic_machine=or32-unknown
                 os=-coff
                 ;;
+        os400)
+                basic_machine=powerpc-ibm
+                os=-os400
+                ;;
         OSE68000 | ose68000)
                 basic_machine=m68000-ericsson
                 os=-ose
@@ -963,6 +990,10 @@ case $basic_machine in
         tower | tower-32)
                 basic_machine=m68k-ncr
                 ;;
+        tpf)
+                basic_machine=s390x-ibm
+                os=-tpf
+                ;;
         udi29k)
                 basic_machine=a29k-amd
                 os=-udi
@@ -1006,6 +1037,10 @@ case $basic_machine in
                 basic_machine=hppa1.1-winbond
                 os=-proelf
                 ;;
+        xbox)
+                basic_machine=i686-pc
+                os=-mingw32
+                ;;
         xps | xps100)
                 basic_machine=xps100-honeywell
                 ;;
@@ -1036,6 +1071,9 @@ case $basic_machine in
         romp)
                 basic_machine=romp-ibm
                 ;;
+        mmix)
+                basic_machine=mmix-knuth
+                ;;
         rs6000)
                 basic_machine=rs6000-ibm
                 ;;
@@ -1058,7 +1096,7 @@ case $basic_machine in
         sh64)
                 basic_machine=sh64-unknown
                 ;;
-        sparc | sparcv9 | sparcv9b)
+        sparc | sparcv8 | sparcv9 | sparcv9b)
                 basic_machine=sparc-sun
                 ;;
         cydra)
@@ -1131,19 +1169,20 @@ case $os in
               | -aos* \
               | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
               | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-              | -hiux* | -386bsd* | -netbsd* | -openbsd* | -kfreebsd* | -freebsd* | -riscix* \
-              | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
+              | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* | -openbsd* \
+              | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
+              | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
               | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
               | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
               | -chorusos* | -chorusrdb* \
               | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-              | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \
+              | -mingw32* | -linux-gnu* | -linux-uclibc* | -uxpv* | -beos* | -mpeix* | -udk* \
               | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
               | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
               | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
               | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
               | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
-              | -powermax* | -dnix* | -nx6 | -nx7 | -sei*)
+              | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* | -skyos*)
         # Remember, each alternative MUST END IN *, to match a version number.
                 ;;
         -qnx*)
@@ -1182,6 +1221,9 @@ case $os in
         -opened*)
                 os=-openedition
                 ;;
+        -os400*)
+                os=-os400
+                ;;
         -wince*)
                 os=-wince
                 ;;
@@ -1203,6 +1245,9 @@ case $os in
         -atheos*)
                 os=-atheos
                 ;;
+        -syllable*)
+                os=-syllable
+                ;;
         -386bsd)
                 os=-bsd
                 ;;
@@ -1225,6 +1270,9 @@ case $os in
         -sinix*)
                 os=-sysv4
                 ;;
+        -tpf*)
+                os=-tpf
+                ;;
         -triton*)
                 os=-sysv3
                 ;;
@@ -1261,6 +1309,9 @@ case $os in
         -kaos*)
                 os=-kaos
                 ;;
+        -zvmoe)
+                os=-zvmoe
+                ;;
         -none)
                 ;;
         *)
@@ -1341,6 +1392,9 @@ case $basic_machine in
         *-ibm)
                 os=-aix
                 ;;
+        *-knuth)
+                os=-mmixware
+                ;;
         *-wec)
                 os=-proelf
                 ;;
@@ -1473,9 +1527,15 @@ case $basic_machine in
                         -mvs* | -opened*)
                                 vendor=ibm
                                 ;;
+                        -os400*)
+                                vendor=ibm
+                                ;;
                         -ptx*)
                                 vendor=sequent
                                 ;;
+                        -tpf*)
+                                vendor=ibm
+                                ;;
                         -vxsim* | -vxworks* | -windiss*)
                                 vendor=wrs
                                 ;;
@@ -1500,7 +1560,7 @@ case $basic_machine in
 esac
 
 echo $basic_machine$os
-exit 0
+exit
 
 # Local variables:
 # eval: (add-hook 'write-file-hooks 'time-stamp)
diff --git a/configure b/configure
index 1bf7b0b0b..362218407 100755
--- a/configure
+++ b/configure
@@ -2,6 +2,8 @@
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.59 for OpenSSH Portable.
 #
+# Report bugs to <openssh-unix-dev@mindrot.org>.
+#
 # Copyright (C) 2003 Free Software Foundation, Inc.
 # This configure script is free software; the Free Software Foundation
 # gives unlimited permission to copy, distribute and modify it.
@@ -269,7 +271,7 @@ PACKAGE_NAME='OpenSSH'
 PACKAGE_TARNAME='openssh'
 PACKAGE_VERSION='Portable'
 PACKAGE_STRING='OpenSSH Portable'
-PACKAGE_BUGREPORT=''
+PACKAGE_BUGREPORT='openssh-unix-dev@mindrot.org'
 
 ac_unique_file="ssh.c"
 # Factoring default headers for most tests.
@@ -867,6 +869,7 @@ Optional Packages:
   --with-cppflags         Specify additional flags to pass to preprocessor
   --with-ldflags          Specify additional flags to pass to linker
   --with-libs             Specify additional libraries to link with
+  --with-Werror           Build main code with -Werror
   --with-zlib=PATH        Use zlib in PATH
   --without-zlib-version-check Disable zlib version check
   --with-skey[=PATH]      Enable S/Key support (optionally in PATH)
@@ -881,7 +884,7 @@ Optional Packages:
   --with-entropy-timeout  Specify entropy gathering command timeout (msec)
   --with-privsep-user=user Specify non-privileged user for privilege separation
   --with-sectok           Enable smartcard support using libsectok
-  --with-opensc=PFX       Enable smartcard support using OpenSC
+--with-opensc[=PFX]       Enable smartcard support using OpenSC (optionally in PATH)
   --with-kerberos5=PATH   Enable Kerberos 5 support
   --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)
   --with-xauth=PATH       Specify path to xauth program
@@ -908,6 +911,7 @@ Some influential environment variables:
 Use these variables to override the choices made by `configure' or to help
 it to find libraries and programs with nonstandard names/locations.
 
+Report bugs to <openssh-unix-dev@mindrot.org>.
 _ACEOF
 fi
 
@@ -4098,8 +4102,253 @@ _ACEOF
     ;;
 esac
 
+
+echo "$as_me:$LINENO: checking whether LLONG_MAX is declared" >&5
+echo $ECHO_N "checking whether LLONG_MAX is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl_LLONG_MAX+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <limits.h>
+
+int
+main ()
+{
+#ifndef LLONG_MAX
+  char *p = (char *) LLONG_MAX;
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_have_decl_LLONG_MAX=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_have_decl_LLONG_MAX=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have_decl_LLONG_MAX" >&5
+echo "${ECHO_T}$ac_cv_have_decl_LLONG_MAX" >&6
+if test $ac_cv_have_decl_LLONG_MAX = yes; then
+  have_llong_max=1
+fi
+
+
 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
-        CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wno-uninitialized"
+        CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
+        GCC_VER=`$CC --version`
+        case $GCC_VER in
+                1.*) ;;
+                2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
+                2.*) ;;
+                *) CFLAGS="$CFLAGS -Wsign-compare" ;;
+        esac
+
+        if test -z "$have_llong_max"; then
+                # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
+                unset ac_cv_have_decl_LLONG_MAX
+                saved_CFLAGS="$CFLAGS"
+                CFLAGS="$CFLAGS -std=gnu99"
+                echo "$as_me:$LINENO: checking whether LLONG_MAX is declared" >&5
+echo $ECHO_N "checking whether LLONG_MAX is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl_LLONG_MAX+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <limits.h>
+
+
+int
+main ()
+{
+#ifndef LLONG_MAX
+  char *p = (char *) LLONG_MAX;
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_have_decl_LLONG_MAX=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_have_decl_LLONG_MAX=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have_decl_LLONG_MAX" >&5
+echo "${ECHO_T}$ac_cv_have_decl_LLONG_MAX" >&6
+if test $ac_cv_have_decl_LLONG_MAX = yes; then
+  have_llong_max=1
+else
+  CFLAGS="$saved_CFLAGS"
+fi
+
+        fi
+fi
+
+if test -z "$have_llong_max"; then
+        echo "$as_me:$LINENO: checking for max value of long long" >&5
+echo $ECHO_N "checking for max value of long long... $ECHO_C" >&6
+        if test "$cross_compiling" = yes; then
+
+                        { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
+echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+
+
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <stdio.h>
+/* Why is this so damn hard? */
+#ifdef __GNUC__
+# undef __GNUC__
+#endif
+#define __USE_ISOC99
+#include <limits.h>
+#define DATA "conftest.llminmax"
+int main(void) {
+        FILE *f;
+        long long i, llmin, llmax = 0;
+
+        if((f = fopen(DATA,"w")) == NULL)
+                exit(1);
+
+#if defined(LLONG_MIN) && defined(LLONG_MAX)
+        fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
+        llmin = LLONG_MIN;
+        llmax = LLONG_MAX;
+#else
+        fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
+        /* This will work on one's complement and two's complement */
+        for (i = 1; i > llmax; i <<= 1, i++)
+                llmax = i;
+        llmin = llmax + 1LL;    /* wrap */
+#endif
+
+        /* Sanity check */
+        if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
+            || llmax - 1 > llmax) {
+                fprintf(f, "unknown unknown\n");
+                exit(2);
+        }
+
+        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
+                exit(3);
+
+        exit(0);
+}
+
+_ACEOF
+rm -f conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+
+                        llong_min=`$AWK '{print $1}' conftest.llminmax`
+                        llong_max=`$AWK '{print $2}' conftest.llminmax`
+                        echo "$as_me:$LINENO: result: $llong_max" >&5
+echo "${ECHO_T}$llong_max" >&6
+
+cat >>confdefs.h <<_ACEOF
+#define LLONG_MAX ${llong_max}LL
+_ACEOF
+
+                        echo "$as_me:$LINENO: checking for min value of long long" >&5
+echo $ECHO_N "checking for min value of long long... $ECHO_C" >&6
+                        echo "$as_me:$LINENO: result: $llong_min" >&5
+echo "${ECHO_T}$llong_min" >&6
+
+cat >>confdefs.h <<_ACEOF
+#define LLONG_MIN ${llong_min}LL
+_ACEOF
+
+
+else
+  echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+
+                        echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6
+
+fi
+rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
 fi
 
 
@@ -4643,6 +4892,77 @@ _ACEOF
 
 
 fi
+echo "$as_me:$LINENO: checking whether setauthdb is declared" >&5
+echo $ECHO_N "checking whether setauthdb is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl_setauthdb+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <usersec.h>
+
+int
+main ()
+{
+#ifndef setauthdb
+  char *p = (char *) setauthdb;
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_have_decl_setauthdb=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_have_decl_setauthdb=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have_decl_setauthdb" >&5
+echo "${ECHO_T}$ac_cv_have_decl_setauthdb" >&6
+if test $ac_cv_have_decl_setauthdb = yes; then
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_SETAUTHDB 1
+_ACEOF
+
+
+else
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_SETAUTHDB 0
+_ACEOF
+
+
+fi
 
 
                 echo "$as_me:$LINENO: checking whether loginfailed is declared" >&5
@@ -5019,121 +5339,8 @@ _ACEOF
 _ACEOF
 
         ;;
-*-*-hpux10.26)
-        if test -z "$GCC"; then
-                CFLAGS="$CFLAGS -Ae"
-        fi
-        CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-        IPADDR_IN_DISPLAY=yes
-        cat >>confdefs.h <<\_ACEOF
-#define HAVE_SECUREWARE 1
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define USE_PIPES 1
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define LOGIN_NO_ENDOPT 1
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define LOGIN_NEEDS_UTMPX 1
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define LOCKED_PASSWD_STRING "*"
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define SPT_TYPE SPT_PSTAT
-_ACEOF
-
-        LIBS="$LIBS -lsec -lsecpw"
-
-echo "$as_me:$LINENO: checking for t_error in -lxnet" >&5
-echo $ECHO_N "checking for t_error in -lxnet... $ECHO_C" >&6
-if test "${ac_cv_lib_xnet_t_error+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lxnet  $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any gcc2 internal prototype to avoid an error.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-/* We use char because int might match the return type of a gcc2
-   builtin and then its argument prototype would still apply.  */
-char t_error ();
-int
-main ()
-{
-t_error ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } &&
-         { ac_try='test -z "$ac_c_werror_flag"
-                         || test ! -s conftest.err'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; } &&
-         { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  ac_cv_lib_xnet_t_error=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-ac_cv_lib_xnet_t_error=no
-fi
-rm -f conftest.err conftest.$ac_objext \
-      conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-echo "$as_me:$LINENO: result: $ac_cv_lib_xnet_t_error" >&5
-echo "${ECHO_T}$ac_cv_lib_xnet_t_error" >&6
-if test $ac_cv_lib_xnet_t_error = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBXNET 1
-_ACEOF
-
-  LIBS="-lxnet $LIBS"
-
-else
-  { { echo "$as_me:$LINENO: error: *** -lxnet needed on HP-UX - check config.log ***" >&5
-echo "$as_me: error: *** -lxnet needed on HP-UX - check config.log ***" >&2;}
-   { (exit 1); exit 1; }; }
-fi
-
-        disable_ptmx_check=yes
-        ;;
-*-*-hpux10*)
-        if test -z "$GCC"; then
-                CFLAGS="$CFLAGS -Ae"
-        fi
+*-*-hpux*)
+        # first we define all of the options common to all HP-UX releases
         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
         IPADDR_IN_DISPLAY=yes
         cat >>confdefs.h <<\_ACEOF
@@ -5235,124 +5442,44 @@ echo "$as_me: error: *** -lxnet needed on HP-UX - check config.log ***" >&2;}
    { (exit 1); exit 1; }; }
 fi
 
-        ;;
-*-*-hpux11*)
-        CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-        IPADDR_IN_DISPLAY=yes
-        cat >>confdefs.h <<\_ACEOF
-#define PAM_SUN_CODEBASE 1
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define USE_PIPES 1
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define LOGIN_NO_ENDOPT 1
-_ACEOF
 
-        cat >>confdefs.h <<\_ACEOF
-#define LOGIN_NEEDS_UTMPX 1
+        # next, we define all of the options specific to major releases
+        case "$host" in
+        *-*-hpux10*)
+                if test -z "$GCC"; then
+                        CFLAGS="$CFLAGS -Ae"
+                fi
+                ;;
+        *-*-hpux11*)
+                cat >>confdefs.h <<\_ACEOF
+#define PAM_SUN_CODEBASE 1
 _ACEOF
 
-        cat >>confdefs.h <<\_ACEOF
+                cat >>confdefs.h <<\_ACEOF
 #define DISABLE_UTMP 1
 _ACEOF
 
-        cat >>confdefs.h <<\_ACEOF
-#define LOCKED_PASSWD_STRING "*"
-_ACEOF
-
-        cat >>confdefs.h <<\_ACEOF
-#define SPT_TYPE SPT_PSTAT
-_ACEOF
-
 
 cat >>confdefs.h <<\_ACEOF
 #define USE_BTMP 1
 _ACEOF
 
-        check_for_hpux_broken_getaddrinfo=1
-        check_for_conflicting_getspnam=1
-        LIBS="$LIBS -lsec"
-
-echo "$as_me:$LINENO: checking for t_error in -lxnet" >&5
-echo $ECHO_N "checking for t_error in -lxnet... $ECHO_C" >&6
-if test "${ac_cv_lib_xnet_t_error+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lxnet  $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any gcc2 internal prototype to avoid an error.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-/* We use char because int might match the return type of a gcc2
-   builtin and then its argument prototype would still apply.  */
-char t_error ();
-int
-main ()
-{
-t_error ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } &&
-         { ac_try='test -z "$ac_c_werror_flag"
-                         || test ! -s conftest.err'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; } &&
-         { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  ac_cv_lib_xnet_t_error=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
+                check_for_hpux_broken_getaddrinfo=1
+                check_for_conflicting_getspnam=1
+                ;;
+        esac
 
-ac_cv_lib_xnet_t_error=no
-fi
-rm -f conftest.err conftest.$ac_objext \
-      conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-echo "$as_me:$LINENO: result: $ac_cv_lib_xnet_t_error" >&5
-echo "${ECHO_T}$ac_cv_lib_xnet_t_error" >&6
-if test $ac_cv_lib_xnet_t_error = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBXNET 1
+        # lastly, we define options specific to minor releases
+        case "$host" in
+        *-*-hpux10.26)
+                cat >>confdefs.h <<\_ACEOF
+#define HAVE_SECUREWARE 1
 _ACEOF
 
-  LIBS="-lxnet $LIBS"
-
-else
-  { { echo "$as_me:$LINENO: error: *** -lxnet needed on HP-UX - check config.log ***" >&5
-echo "$as_me: error: *** -lxnet needed on HP-UX - check config.log ***" >&2;}
-   { (exit 1); exit 1; }; }
-fi
-
+                disable_ptmx_check=yes
+                LIBS="$LIBS -lsecpw"
+                ;;
+        esac
         ;;
 *-*-irix5*)
         PATH="$PATH:/usr/etc"
@@ -5566,8 +5693,9 @@ _ACEOF
         esac
         ;;
 mips-sony-bsd|mips-sony-newsos4)
-        cat >>confdefs.h <<\_ACEOF
-#define HAVE_NEWS4 1
+
+cat >>confdefs.h <<\_ACEOF
+#define NEED_SETPRGP
 _ACEOF
 
         SONY=1
@@ -5617,6 +5745,13 @@ _ACEOF
 _ACEOF
 
         ;;
+*-*-openbsd*)
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ATTRIBUTE__SENTINEL__ 1
+_ACEOF
+
+        ;;
 *-*-solaris*)
         if test "x$withval" != "xno" ; then
                 need_dash_r=1
@@ -6004,9 +6139,20 @@ _ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
 
+
+cat >>confdefs.h <<\_ACEOF
+#define PASSWD_NEEDS_USERNAME 1
+_ACEOF
+
         ;;
 # UnixWare 7.x, OpenUNIX 8
 *-*-sysv5*)
+        check_for_libcrypt_later=1
+
+cat >>confdefs.h <<\_ACEOF
+#define UNIXWARE_LONG_PASSWORDS 1
+_ACEOF
+
         cat >>confdefs.h <<\_ACEOF
 #define USE_PIPES 1
 _ACEOF
@@ -6023,6 +6169,21 @@ _ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
 
+
+cat >>confdefs.h <<\_ACEOF
+#define PASSWD_NEEDS_USERNAME 1
+_ACEOF
+
+        case "$host" in
+        *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
+                TEST_SHELL=/u95/bin/sh
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_LIBIAF 1
+_ACEOF
+
+                ;;
+        esac
         ;;
 *-*-sysv*)
         ;;
@@ -6355,6 +6516,42 @@ _ACEOF
 _ACEOF
 
         ;;
+
+*-*-ultrix*)
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_GETGROUPS
+_ACEOF
+
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_MMAP
+_ACEOF
+
+
+cat >>confdefs.h <<\_ACEOF
+#define NEED_SETPRGP
+_ACEOF
+
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SYS_SYSLOG_H 1
+_ACEOF
+
+        ;;
+
+*-*-lynxos)
+        CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
+        cat >>confdefs.h <<\_ACEOF
+#define MISSING_HOWMANY 1
+_ACEOF
+
+
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SETVBUF 1
+_ACEOF
+
+        ;;
 esac
 
 # Allow user to specify flags
@@ -6363,7 +6560,8 @@ esac
 if test "${with_cflags+set}" = set; then
   withval="$with_cflags"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         CFLAGS="$CFLAGS $withval"
                 fi
 
@@ -6374,7 +6572,8 @@ fi;
 if test "${with_cppflags+set}" = set; then
   withval="$with_cppflags"
 
-                if test "x$withval" != "xno"; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         CPPFLAGS="$CPPFLAGS $withval"
                 fi
 
@@ -6385,7 +6584,8 @@ fi;
 if test "${with_ldflags+set}" = set; then
   withval="$with_ldflags"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         LDFLAGS="$LDFLAGS $withval"
                 fi
 
@@ -6396,13 +6596,28 @@ fi;
 if test "${with_libs+set}" = set; then
   withval="$with_libs"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         LIBS="$LIBS $withval"
                 fi
 
 
 fi;
 
+# Check whether --with-Werror or --without-Werror was given.
+if test "${with_Werror+set}" = set; then
+  withval="$with_Werror"
+
+                if test -n "$withval"  &&  test "x$withval" != "xno"; then
+                        werror_flags="-Werror"
+                        if "x${withval}" != "xyes"; then
+                                werror_flags="$withval"
+                        fi
+                fi
+
+
+fi;
+
 echo "$as_me:$LINENO: checking compiler and flags for sanity" >&5
 echo $ECHO_N "checking compiler and flags for sanity... $ECHO_C" >&6
 if test "$cross_compiling" = yes; then
@@ -6451,7 +6666,6 @@ fi
 rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
 
-# Checks for header files.
 
 echo "$as_me:$LINENO: checking for egrep" >&5
 echo $ECHO_N "checking for egrep... $ECHO_C" >&6
@@ -6761,16 +6975,69 @@ done
 
 
 
-for ac_header in bstring.h crypt.h dirent.h endian.h features.h \
-        floatingpoint.h getopt.h glob.h ia.h lastlog.h limits.h login.h \
-        login_cap.h maillock.h ndir.h netdb.h netgroup.h \
-        netinet/in_systm.h pam/pam_appl.h paths.h pty.h readpassphrase.h \
-        rpc/types.h security/pam_appl.h shadow.h stddef.h stdint.h \
-        strings.h sys/dir.h sys/strtio.h sys/audit.h sys/bitypes.h \
-        sys/bsdtty.h sys/cdefs.h sys/mman.h sys/ndir.h sys/prctl.h \
-        sys/pstat.h sys/select.h sys/stat.h sys/stream.h \
-        sys/stropts.h sys/sysmacros.h sys/time.h sys/timers.h sys/un.h \
-        time.h tmpdir.h ttyent.h usersec.h util.h utime.h utmp.h utmpx.h vis.h
+
+
+
+for ac_header in \
+        bstring.h \
+        crypt.h \
+        dirent.h \
+        endian.h \
+        features.h \
+        floatingpoint.h \
+        getopt.h \
+        glob.h \
+        ia.h \
+        iaf.h \
+        lastlog.h \
+        limits.h \
+        login.h \
+        login_cap.h \
+        maillock.h \
+        ndir.h \
+        netdb.h \
+        netgroup.h \
+        netinet/in_systm.h \
+        pam/pam_appl.h \
+        paths.h \
+        pty.h \
+        readpassphrase.h \
+        rpc/types.h \
+        security/pam_appl.h \
+        shadow.h \
+        stddef.h \
+        stdint.h \
+        string.h \
+        strings.h \
+        sys/audit.h \
+        sys/bitypes.h \
+        sys/bsdtty.h \
+        sys/cdefs.h \
+        sys/dir.h \
+        sys/mman.h \
+        sys/ndir.h \
+        sys/prctl.h \
+        sys/pstat.h \
+        sys/select.h \
+        sys/stat.h \
+        sys/stream.h \
+        sys/stropts.h \
+        sys/strtio.h \
+        sys/sysmacros.h \
+        sys/time.h \
+        sys/timers.h \
+        sys/un.h \
+        time.h \
+        tmpdir.h \
+        ttyent.h \
+        unistd.h \
+        usersec.h \
+        util.h \
+        utime.h \
+        utmp.h \
+        utmpx.h \
+        vis.h \
+
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
 if eval "test \"\${$as_ac_Header+set}\" = set"; then
@@ -6891,9 +7158,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -7547,9 +7814,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -7837,9 +8104,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -8171,12 +8438,11 @@ fi
 # Check whether --with-zlib or --without-zlib was given.
 if test "${with_zlib+set}" = set; then
   withval="$with_zlib"
-
-                if test "x$withval" = "xno" ; then
-                        { { echo "$as_me:$LINENO: error: *** zlib is required ***" >&5
+   if test "x$withval" = "xno" ; then
+                { { echo "$as_me:$LINENO: error: *** zlib is required ***" >&5
 echo "$as_me: error: *** zlib is required ***" >&2;}
    { (exit 1); exit 1; }; }
-                fi
+          elif test "x$withval" != "xyes"; then
                 if test -d "$withval/lib"; then
                         if test -n "${need_dash_r}"; then
                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
@@ -8195,7 +8461,7 @@ echo "$as_me: error: *** zlib is required ***" >&2;}
                 else
                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
                 fi
-
+        fi
 
 fi;
 
@@ -8466,9 +8732,9 @@ echo "$as_me: WARNING: zlib.h: proceeding with the preprocessor's result" >&2;}
 echo "$as_me: WARNING: zlib.h: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -8506,8 +8772,8 @@ if test "${with_zlib_version_check+set}" = set; then
 
 fi;
 
-echo "$as_me:$LINENO: checking for zlib 1.1.4 or greater" >&5
-echo $ECHO_N "checking for zlib 1.1.4 or greater... $ECHO_C" >&6
+echo "$as_me:$LINENO: checking for possibly buggy zlib" >&5
+echo $ECHO_N "checking for possibly buggy zlib... $ECHO_C" >&6
 if test "$cross_compiling" = yes; then
         { echo "$as_me:$LINENO: WARNING: cross compiling: not checking zlib version" >&5
 echo "$as_me: WARNING: cross compiling: not checking zlib version" >&2;}
@@ -8520,15 +8786,25 @@ cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
+#include <stdio.h>
 #include <zlib.h>
 int main()
 {
-        int a, b, c, v;
-        if (sscanf(ZLIB_VERSION, "%d.%d.%d", &a, &b, &c) != 3)
+        int a=0, b=0, c=0, d=0, n, v;
+        n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
+        if (n != 3 && n != 4)
                 exit(1);
-        v = a*1000000 + b*1000 + c;
-        if (v >= 1001004)
+        v = a*1000000 + b*10000 + c*100 + d;
+        fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
+
+        /* 1.1.4 is OK */
+        if (a == 1 && b == 1 && c >= 4)
+                exit(0);
+
+        /* 1.2.3 and up are OK */
+        if (v >= 1020300)
                 exit(0);
+
         exit(2);
 }
 
@@ -8544,29 +8820,31 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
   ac_status=$?
   echo "$as_me:$LINENO: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:$LINENO: result: yes" >&5
-echo "${ECHO_T}yes" >&6
+  echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
 else
   echo "$as_me: program exited with status $ac_status" >&5
 echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
 ( exit $ac_status )
- echo "$as_me:$LINENO: result: no" >&5
-echo "${ECHO_T}no" >&6
+ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
           if test -z "$zlib_check_nonfatal" ; then
                 { { echo "$as_me:$LINENO: error: *** zlib too old - check config.log ***
 Your reported zlib version has known security problems.  It's possible your
 vendor has fixed these problems without changing the version number.  If you
 are sure this is the case, you can disable the check by running
 \"./configure --without-zlib-version-check\".
-If you are in doubt, upgrade zlib to version 1.1.4 or greater." >&5
+If you are in doubt, upgrade zlib to version 1.2.3 or greater.
+See http://www.gzip.org/zlib/ for details." >&5
 echo "$as_me: error: *** zlib too old - check config.log ***
 Your reported zlib version has known security problems.  It's possible your
 vendor has fixed these problems without changing the version number.  If you
 are sure this is the case, you can disable the check by running
 \"./configure --without-zlib-version-check\".
-If you are in doubt, upgrade zlib to version 1.1.4 or greater." >&2;}
+If you are in doubt, upgrade zlib to version 1.2.3 or greater.
+See http://www.gzip.org/zlib/ for details." >&2;}
    { (exit 1); exit 1; }; }
           else
                 { echo "$as_me:$LINENO: WARNING: zlib version may have security problems" >&5
@@ -9032,9 +9310,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -9753,7 +10031,8 @@ if test "${with_tcp_wrappers+set}" = set; then
                         saved_LIBS="$LIBS"
                         saved_LDFLAGS="$LDFLAGS"
                         saved_CPPFLAGS="$CPPFLAGS"
-                        if test -n "${withval}" -a "${withval}" != "yes"; then
+                        if test -n "${withval}" && \
+                            test "x${withval}" != "xyes"; then
                                 if test -d "${withval}/lib"; then
                                         if test -n "${need_dash_r}"; then
                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
@@ -9856,13 +10135,17 @@ LIBEDIT_MSG="no"
 if test "${with_libedit+set}" = set; then
   withval="$with_libedit"
    if test "x$withval" != "xno" ; then
+                if test "x$withval" != "xyes"; then
+                        CPPFLAGS="$CPPFLAGS -I$withval/include"
+                        LDFLAGS="$LDFLAGS -L$withval/lib"
+                fi
                 echo "$as_me:$LINENO: checking for el_init in -ledit" >&5
 echo $ECHO_N "checking for el_init in -ledit... $ECHO_C" >&6
 if test "${ac_cv_lib_edit_el_init+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-ledit -lcurses
+LIBS="-ledit  -lcurses
                  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
@@ -9931,8 +10214,66 @@ _ACEOF
                           LIBEDIT_MSG="yes"
 
 
+else
+   { { echo "$as_me:$LINENO: error: libedit not found" >&5
+echo "$as_me: error: libedit not found" >&2;}
+   { (exit 1); exit 1; }; }
 fi
 
+                echo "$as_me:$LINENO: checking if libedit version is compatible" >&5
+echo $ECHO_N "checking if libedit version is compatible... $ECHO_C" >&6
+                cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <histedit.h>
+int main(void)
+{
+        int i = H_SETSIZE;
+        el_init("", NULL, NULL, NULL);
+        exit(0);
+}
+
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+   echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
+                      { { echo "$as_me:$LINENO: error: libedit version is not compatible" >&5
+echo "$as_me: error: libedit version is not compatible" >&2;}
+   { (exit 1); exit 1; }; }
+
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
         fi
 
 fi;
@@ -10072,9 +10413,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -10407,6 +10748,10 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
 
                 ;;
+          no)
+                echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
+                ;;
           *)
                 { { echo "$as_me:$LINENO: error: Unknown audit module $withval" >&5
 echo "$as_me: error: Unknown audit module $withval" >&2;}
@@ -10494,19 +10839,89 @@ fi;
 
 
 
+
+
 for ac_func in \
-        arc4random __b64_ntop b64_ntop __b64_pton b64_pton bcopy \
-        bindresvport_sa clock closefrom dirfd fchdir fchmod fchown \
-        freeaddrinfo futimes getaddrinfo getcwd getgrouplist getnameinfo \
-        getopt getpeereid _getpty getrlimit getttyent glob inet_aton \
-        inet_ntoa inet_ntop innetgr login_getcapbool md5_crypt memmove \
-        mkdtemp mmap ngetaddrinfo nsleep ogetaddrinfo openlog_r openpty \
-        pstat prctl readpassphrase realpath recvmsg rresvport_af sendmsg \
-        setdtablesize setegid setenv seteuid setgroups setlogin setpcred \
-        setproctitle setregid setreuid setrlimit \
-        setsid setvbuf sigaction sigvec snprintf socketpair strerror \
-        strlcat strlcpy strmode strnvis strtoul sysconf tcgetpgrp \
-        truncate unsetenv updwtmpx utimes vhangup vsnprintf waitpid \
+        arc4random \
+        b64_ntop \
+        __b64_ntop \
+        b64_pton \
+        __b64_pton \
+        bcopy \
+        bindresvport_sa \
+        clock \
+        closefrom \
+        dirfd \
+        fchmod \
+        fchown \
+        freeaddrinfo \
+        futimes \
+        getaddrinfo \
+        getcwd \
+        getgrouplist \
+        getnameinfo \
+        getopt \
+        getpeereid \
+        _getpty \
+        getrlimit \
+        getttyent \
+        glob \
+        inet_aton \
+        inet_ntoa \
+        inet_ntop \
+        innetgr \
+        login_getcapbool \
+        md5_crypt \
+        memmove \
+        mkdtemp \
+        mmap \
+        ngetaddrinfo \
+        nsleep \
+        ogetaddrinfo \
+        openlog_r \
+        openpty \
+        prctl \
+        pstat \
+        readpassphrase \
+        realpath \
+        recvmsg \
+        rresvport_af \
+        sendmsg \
+        setdtablesize \
+        setegid \
+        setenv \
+        seteuid \
+        setgroups \
+        setlogin \
+        setpcred \
+        setproctitle \
+        setregid \
+        setreuid \
+        setrlimit \
+        setsid \
+        setvbuf \
+        sigaction \
+        sigvec \
+        snprintf \
+        socketpair \
+        strdup \
+        strerror \
+        strlcat \
+        strlcpy \
+        strmode \
+        strnvis \
+        strtonum \
+        strtoll \
+        strtoul \
+        sysconf \
+        tcgetpgrp \
+        truncate \
+        unsetenv \
+        updwtmpx \
+        utimes \
+        vhangup \
+        vsnprintf \
+        waitpid \
 
 do
 as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
@@ -10904,9 +11319,9 @@ _ACEOF
 fi
 
 
-echo "$as_me:$LINENO: checking whether strsep is declared" >&5
-echo $ECHO_N "checking whether strsep is declared... $ECHO_C" >&6
-if test "${ac_cv_have_decl_strsep+set}" = set; then
+echo "$as_me:$LINENO: checking whether getrusage is declared" >&5
+echo $ECHO_N "checking whether getrusage is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl_getrusage+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
@@ -10919,8 +11334,8 @@ $ac_includes_default
 int
 main ()
 {
-#ifndef strsep
-  char *p = (char *) strsep;
+#ifndef getrusage
+  char *p = (char *) getrusage;
 #endif
 
   ;
@@ -10949,20 +11364,20 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   ac_status=$?
   echo "$as_me:$LINENO: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  ac_cv_have_decl_strsep=yes
+  ac_cv_have_decl_getrusage=yes
 else
   echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-ac_cv_have_decl_strsep=no
+ac_cv_have_decl_getrusage=no
 fi
 rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
 fi
-echo "$as_me:$LINENO: result: $ac_cv_have_decl_strsep" >&5
-echo "${ECHO_T}$ac_cv_have_decl_strsep" >&6
-if test $ac_cv_have_decl_strsep = yes; then
+echo "$as_me:$LINENO: result: $ac_cv_have_decl_getrusage" >&5
+echo "${ECHO_T}$ac_cv_have_decl_getrusage" >&6
+if test $ac_cv_have_decl_getrusage = yes; then
 
-for ac_func in strsep
+for ac_func in getrusage
 do
 as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
 echo "$as_me:$LINENO: checking for $ac_func" >&5
@@ -11065,9 +11480,9 @@ done
 
 fi
 
-echo "$as_me:$LINENO: checking whether getrusage is declared" >&5
-echo $ECHO_N "checking whether getrusage is declared... $ECHO_C" >&6
-if test "${ac_cv_have_decl_getrusage+set}" = set; then
+echo "$as_me:$LINENO: checking whether strsep is declared" >&5
+echo $ECHO_N "checking whether strsep is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl_strsep+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
@@ -11076,12 +11491,17 @@ _ACEOF
 cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
-$ac_includes_default
+
+#ifdef HAVE_STRING_H
+# include <string.h>
+#endif
+
+
 int
 main ()
 {
-#ifndef getrusage
-  char *p = (char *) getrusage;
+#ifndef strsep
+  char *p = (char *) strsep;
 #endif
 
   ;
@@ -11110,20 +11530,20 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   ac_status=$?
   echo "$as_me:$LINENO: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  ac_cv_have_decl_getrusage=yes
+  ac_cv_have_decl_strsep=yes
 else
   echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-ac_cv_have_decl_getrusage=no
+ac_cv_have_decl_strsep=no
 fi
 rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
 fi
-echo "$as_me:$LINENO: result: $ac_cv_have_decl_getrusage" >&5
-echo "${ECHO_T}$ac_cv_have_decl_getrusage" >&6
-if test $ac_cv_have_decl_getrusage = yes; then
+echo "$as_me:$LINENO: result: $ac_cv_have_decl_strsep" >&5
+echo "${ECHO_T}$ac_cv_have_decl_strsep" >&6
+if test $ac_cv_have_decl_strsep = yes; then
 
-for ac_func in getrusage
+for ac_func in strsep
 do
 as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
 echo "$as_me:$LINENO: checking for $ac_func" >&5
@@ -12733,8 +13153,14 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   ac_status=$?
   echo "$as_me:$LINENO: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:$LINENO: result: yes" >&5
+   echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SO_PEERCRED
+_ACEOF
+
+
 else
   echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
@@ -12895,7 +13321,8 @@ rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftes
 fi
 fi
 
-if test "x$ac_cv_func_getaddrinfo" = "xyes" -a "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
+if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
+    test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
         echo "$as_me:$LINENO: checking if getaddrinfo seems to work" >&5
 echo $ECHO_N "checking if getaddrinfo seems to work... $ECHO_C" >&6
         if test "$cross_compiling" = yes; then
@@ -13002,7 +13429,8 @@ rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftes
 fi
 fi
 
-if test "x$ac_cv_func_getaddrinfo" = "xyes" -a "x$check_for_aix_broken_getaddrinfo" = "x1"; then
+if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
+    test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
         echo "$as_me:$LINENO: checking if getaddrinfo seems to work" >&5
 echo $ECHO_N "checking if getaddrinfo seems to work... $ECHO_C" >&6
         if test "$cross_compiling" = yes; then
@@ -14189,6 +14617,80 @@ fi
 fi
 
 
+echo "$as_me:$LINENO: checking for ia_openinfo in -liaf" >&5
+echo $ECHO_N "checking for ia_openinfo in -liaf... $ECHO_C" >&6
+if test "${ac_cv_lib_iaf_ia_openinfo+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-liaf  $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any gcc2 internal prototype to avoid an error.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+/* We use char because int might match the return type of a gcc2
+   builtin and then its argument prototype would still apply.  */
+char ia_openinfo ();
+int
+main ()
+{
+ia_openinfo ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_lib_iaf_ia_openinfo=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_lib_iaf_ia_openinfo=no
+fi
+rm -f conftest.err conftest.$ac_objext \
+      conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+echo "$as_me:$LINENO: result: $ac_cv_lib_iaf_ia_openinfo" >&5
+echo "${ECHO_T}$ac_cv_lib_iaf_ia_openinfo" >&6
+if test $ac_cv_lib_iaf_ia_openinfo = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_LIBIAF 1
+_ACEOF
+
+  LIBS="-liaf $LIBS"
+
+fi
+
+
 ### Configure cryptographic random number support
 
 # Check wheter OpenSSL seeds itself
@@ -14272,7 +14774,7 @@ echo "$as_me: WARNING: *** Forcing use of OpenSSL's non-self-seeding PRNG" >&2;}
 fi;
 
 # Which randomness source do we use?
-if test ! -z "$OPENSSL_SEEDS_ITSELF" -a -z "$USE_RAND_HELPER" ; then
+if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
         # OpenSSL only
         cat >>confdefs.h <<\_ACEOF
 #define OPENSSL_PRNG_ONLY 1
@@ -14393,7 +14895,8 @@ entropy_timeout=200
 if test "${with_entropy_timeout+set}" = set; then
   withval="$with_entropy_timeout"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         entropy_timeout=$withval
                 fi
 
@@ -14410,7 +14913,8 @@ SSH_PRIVSEP_USER=sshd
 if test "${with_privsep_user+set}" = set; then
   withval="$with_privsep_user"
 
-                if test -n "$withval"; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         SSH_PRIVSEP_USER=$withval
                 fi
 
@@ -19152,9 +19656,9 @@ fi
 
 
 # We need int64_t or else certian parts of the compile will fail.
-if test "x$ac_cv_have_int64_t" = "xno" -a \
-        "x$ac_cv_sizeof_long_int" != "x8" -a \
-        "x$ac_cv_sizeof_long_long_int" = "x0" ; then
+if test "x$ac_cv_have_int64_t" = "xno" && \
+        test "x$ac_cv_sizeof_long_int" != "x8" && \
+        test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
         echo "an alternative compiler (I.E., GCC) before continuing."
         echo ""
@@ -21068,9 +21572,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -21195,17 +21699,17 @@ _ACEOF
 fi;
 
 # Check whether user wants OpenSC support
+OPENSC_CONFIG="no"
 
 # Check whether --with-opensc or --without-opensc was given.
 if test "${with_opensc+set}" = set; then
   withval="$with_opensc"
-  opensc_config_prefix="$withval"
-else
-  opensc_config_prefix=""
-fi;
-if test x$opensc_config_prefix != x ; then
-  OPENSC_CONFIG=$opensc_config_prefix/bin/opensc-config
-  # Extract the first word of "opensc-config", so it can be a program name with args.
+
+            if test "x$withval" != "xno" ; then
+                if test "x$withval" != "xyes" ; then
+                        OPENSC_CONFIG=$withval/bin/opensc-config
+                else
+                        # Extract the first word of "opensc-config", so it can be a program name with args.
 set dummy opensc-config; ac_word=$2
 echo "$as_me:$LINENO: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
@@ -21245,22 +21749,26 @@ else
 echo "${ECHO_T}no" >&6
 fi
 
-  if test "$OPENSC_CONFIG" != "no"; then
-    LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
-    LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
-    CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
-    LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
-    cat >>confdefs.h <<\_ACEOF
+                fi
+                if test "$OPENSC_CONFIG" != "no"; then
+                        LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
+                        LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
+                        CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
+                        LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
+                        cat >>confdefs.h <<\_ACEOF
 #define SMARTCARD 1
 _ACEOF
 
-    cat >>confdefs.h <<\_ACEOF
+                        cat >>confdefs.h <<\_ACEOF
 #define USE_OPENSC 1
 _ACEOF
 
-    SCARD_MSG="yes, using OpenSC"
-  fi
-fi
+                        SCARD_MSG="yes, using OpenSC"
+                fi
+            fi
+
+
+fi;
 
 # Check libraries needed by DNS fingerprint support
 echo "$as_me:$LINENO: checking for library containing getrrsetbyname" >&5
@@ -21855,6 +22363,152 @@ _ACEOF
 fi
 done
 
+                echo "$as_me:$LINENO: checking whether _getshort is declared" >&5
+echo $ECHO_N "checking whether _getshort is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl__getshort+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+                    #include <arpa/nameser.h>
+
+int
+main ()
+{
+#ifndef _getshort
+  char *p = (char *) _getshort;
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_have_decl__getshort=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_have_decl__getshort=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have_decl__getshort" >&5
+echo "${ECHO_T}$ac_cv_have_decl__getshort" >&6
+if test $ac_cv_have_decl__getshort = yes; then
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL__GETSHORT 1
+_ACEOF
+
+
+else
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL__GETSHORT 0
+_ACEOF
+
+
+fi
+echo "$as_me:$LINENO: checking whether _getlong is declared" >&5
+echo $ECHO_N "checking whether _getlong is declared... $ECHO_C" >&6
+if test "${ac_cv_have_decl__getlong+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+                    #include <arpa/nameser.h>
+
+int
+main ()
+{
+#ifndef _getlong
+  char *p = (char *) _getlong;
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"
+                         || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_have_decl__getlong=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_have_decl__getlong=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have_decl__getlong" >&5
+echo "${ECHO_T}$ac_cv_have_decl__getlong" >&6
+if test $ac_cv_have_decl__getlong = yes; then
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL__GETLONG 1
+_ACEOF
+
+
+else
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL__GETLONG 0
+_ACEOF
+
+
+fi
+
+
                 echo "$as_me:$LINENO: checking for HEADER.ad" >&5
 echo $ECHO_N "checking for HEADER.ad... $ECHO_C" >&6
 if test "${ac_cv_member_HEADER_ad+set}" = set; then
@@ -22594,9 +23248,9 @@ echo "$as_me: WARNING: gssapi.h: proceeding with the preprocessor's result" >&2;
 echo "$as_me: WARNING: gssapi.h: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -22740,9 +23394,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -22898,9 +23552,9 @@ echo "$as_me: WARNING: gssapi_krb5.h: proceeding with the preprocessor's result"
 echo "$as_me: WARNING: gssapi_krb5.h: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -23057,9 +23711,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -23208,9 +23862,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -23359,9 +24013,9 @@ echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&
 echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
     (
       cat <<\_ASBOX
-## ---------------------------------- ##
-## Report this to the OpenSSH lists.  ##
-## ---------------------------------- ##
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
 _ASBOX
     ) |
       sed "s/^/$as_me: WARNING:     /" >&2
@@ -23518,135 +24172,6 @@ _ACEOF
 
 fi
 
-        echo "$as_me:$LINENO: checking for library containing krb5_init_ets" >&5
-echo $ECHO_N "checking for library containing krb5_init_ets... $ECHO_C" >&6
-if test "${ac_cv_search_krb5_init_ets+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  ac_func_search_save_LIBS=$LIBS
-ac_cv_search_krb5_init_ets=no
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any gcc2 internal prototype to avoid an error.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-/* We use char because int might match the return type of a gcc2
-   builtin and then its argument prototype would still apply.  */
-char krb5_init_ets ();
-int
-main ()
-{
-krb5_init_ets ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } &&
-         { ac_try='test -z "$ac_c_werror_flag"
-                         || test ! -s conftest.err'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; } &&
-         { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  ac_cv_search_krb5_init_ets="none required"
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-fi
-rm -f conftest.err conftest.$ac_objext \
-      conftest$ac_exeext conftest.$ac_ext
-if test "$ac_cv_search_krb5_init_ets" = no; then
-  for ac_lib in $K5LIBS; do
-    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
-    cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any gcc2 internal prototype to avoid an error.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-/* We use char because int might match the return type of a gcc2
-   builtin and then its argument prototype would still apply.  */
-char krb5_init_ets ();
-int
-main ()
-{
-krb5_init_ets ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } &&
-         { ac_try='test -z "$ac_c_werror_flag"
-                         || test ! -s conftest.err'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; } &&
-         { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  ac_cv_search_krb5_init_ets="-l$ac_lib"
-break
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-fi
-rm -f conftest.err conftest.$ac_objext \
-      conftest$ac_exeext conftest.$ac_ext
-  done
-fi
-LIBS=$ac_func_search_save_LIBS
-fi
-echo "$as_me:$LINENO: result: $ac_cv_search_krb5_init_ets" >&5
-echo "${ECHO_T}$ac_cv_search_krb5_init_ets" >&6
-if test "$ac_cv_search_krb5_init_ets" != no; then
-  test "$ac_cv_search_krb5_init_ets" = "none required" || LIBS="$ac_cv_search_krb5_init_ets $LIBS"
-  cat >>confdefs.h <<\_ACEOF
-#define KRB5_INIT_ETS 1
-_ACEOF
-
-fi
-
 
 
 fi;
@@ -23659,7 +24184,8 @@ PRIVSEP_PATH=/var/empty
 if test "${with_privsep_path+set}" = set; then
   withval="$with_privsep_path"
 
-                if test "x$withval" != "$no" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         PRIVSEP_PATH=$withval
                 fi
 
@@ -23672,7 +24198,8 @@ fi;
 if test "${with_xauth+set}" = set; then
   withval="$with_xauth"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         xauth_path=$withval
                 fi
 
@@ -24095,8 +24622,8 @@ _ACEOF
         fi
 fi
 
-if test $ac_cv_func_login_getcapbool = "yes" -a \
-        $ac_cv_header_login_cap_h = "yes" ; then
+if test $ac_cv_func_login_getcapbool = "yes" && \
+        test $ac_cv_header_login_cap_h = "yes" ; then
         external_path_file=/etc/login.conf
 fi
 
@@ -24240,7 +24767,8 @@ fi
 if test "${with_superuser_path+set}" = set; then
   withval="$with_superuser_path"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         cat >>confdefs.h <<_ACEOF
 #define SUPERUSER_PATH "$withval"
 _ACEOF
@@ -24324,7 +24852,8 @@ fi
 if test "${with_pid_dir+set}" = set; then
   withval="$with_pid_dir"
 
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         piddir=$withval
                         if test ! -d $piddir ; then
                         { echo "$as_me:$LINENO: WARNING: ** no $piddir directory on this system **" >&5
@@ -24455,7 +24984,7 @@ if test "${with_lastlog+set}" = set; then
 #define DISABLE_LASTLOG 1
 _ACEOF
 
-                else
+                elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
                         conf_lastlog_location=$withval
                 fi
 
@@ -24931,6 +25460,8 @@ if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
         LIBS=`echo $LIBS | sed 's/-ldl //'`
 fi
 
+CFLAGS="$CFLAGS $werror_flags"
+
 
                                                                       ac_config_files="$ac_config_files Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile scard/Makefile ssh_prng_cmds survey.sh"
 
diff --git a/configure.ac b/configure.ac
index e48028b7b..6e36aa22b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.250 2005/03/07 09:21:37 tim Exp $
+# $Id: configure.ac,v 1.292 2005/08/31 16:59:49 tim Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -14,7 +14,7 @@
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-AC_INIT(OpenSSH, Portable)
+AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
 AC_CONFIG_SRCDIR([ssh.c])
 
 AC_CONFIG_HEADER(config.h)
@@ -75,16 +75,102 @@ if test -z "$LD" ; then
         LD=$CC
 fi
 AC_SUBST(LD)
-        
+
 AC_C_INLINE
+
+AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
+
 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
-        CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wno-uninitialized"
+        CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
+        GCC_VER=`$CC --version`
+        case $GCC_VER in
+                1.*) ;;
+                2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
+                2.*) ;;
+                *) CFLAGS="$CFLAGS -Wsign-compare" ;;
+        esac
+
+        if test -z "$have_llong_max"; then
+                # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
+                unset ac_cv_have_decl_LLONG_MAX
+                saved_CFLAGS="$CFLAGS"
+                CFLAGS="$CFLAGS -std=gnu99"
+                AC_CHECK_DECL(LLONG_MAX,
+                    [have_llong_max=1],
+                    [CFLAGS="$saved_CFLAGS"],
+                    [#include <limits.h>]
+                )
+        fi
+fi
+
+if test -z "$have_llong_max"; then
+        AC_MSG_CHECKING([for max value of long long])
+        AC_RUN_IFELSE(
+                [AC_LANG_SOURCE([[
+#include <stdio.h>
+/* Why is this so damn hard? */
+#ifdef __GNUC__
+# undef __GNUC__
+#endif
+#define __USE_ISOC99
+#include <limits.h>
+#define DATA "conftest.llminmax"
+int main(void) {
+        FILE *f;
+        long long i, llmin, llmax = 0;
+
+        if((f = fopen(DATA,"w")) == NULL)
+                exit(1);
+
+#if defined(LLONG_MIN) && defined(LLONG_MAX)
+        fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
+        llmin = LLONG_MIN;
+        llmax = LLONG_MAX;
+#else
+        fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
+        /* This will work on one's complement and two's complement */
+        for (i = 1; i > llmax; i <<= 1, i++)
+                llmax = i;
+        llmin = llmax + 1LL;    /* wrap */
+#endif
+
+        /* Sanity check */
+        if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
+            || llmax - 1 > llmax) {
+                fprintf(f, "unknown unknown\n");
+                exit(2);
+        }
+
+        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
+                exit(3);
+
+        exit(0);
+}
+                ]])],
+                [
+                        llong_min=`$AWK '{print $1}' conftest.llminmax`
+                        llong_max=`$AWK '{print $2}' conftest.llminmax`
+                        AC_MSG_RESULT($llong_max)
+                        AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
+                            [max value of long long calculated by configure])
+                        AC_MSG_CHECKING([for min value of long long])
+                        AC_MSG_RESULT($llong_min)
+                        AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
+                            [min value of long long calculated by configure])
+                ],
+                [
+                        AC_MSG_RESULT(not found)
+                ],
+                [
+                        AC_MSG_WARN([cross compiling: not checking])
+                ]
+        )
 fi
 
 AC_ARG_WITH(rpath,
         [  --without-rpath         Disable auto-added -R linker paths],
         [
-                if test "x$withval" = "xno" ; then      
+                if test "x$withval" = "xno" ; then
                         need_dash_r=""
                 fi
                 if test "x$withval" = "xyes" ; then
@@ -123,7 +209,7 @@ case "$host" in
                 ])
         dnl Check for various auth function declarations in headers.
         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
-            passwdexpired], , , [#include <usersec.h>])
+            passwdexpired, setauthdb], , , [#include <usersec.h>])
         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
         AC_CHECK_DECLS(loginfailed,
                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
@@ -180,52 +266,66 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         AC_DEFINE(BROKEN_SETREUID)
         AC_DEFINE(BROKEN_SETREGID)
         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1)
+        AC_MSG_CHECKING(if we have the Security Authorization Session API)
+        AC_TRY_COMPILE([#include <Security/AuthSession.h>],
+                [SessionCreate(0, 0);],
+                [ac_cv_use_security_session_api="yes"
+                 AC_DEFINE(USE_SECURITY_SESSION_API)
+                 LIBS="$LIBS -framework Security"
+                 AC_MSG_RESULT(yes)],
+                [ac_cv_use_security_session_api="no"
+                 AC_MSG_RESULT(no)])
+        AC_MSG_CHECKING(if we have an in-memory credentials cache)
+        AC_TRY_COMPILE(
+                [#include <Kerberos/Kerberos.h>],
+                [cc_context_t c;
+                 (void) cc_initialize (&c, 0, NULL, NULL);],
+                [AC_DEFINE(USE_CCAPI)
+                 LIBS="$LIBS -framework Security"
+                 AC_MSG_RESULT(yes)
+                 if test "x$ac_cv_use_security_session_api" = "xno"; then
+                        AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
+                fi],
+                [AC_MSG_RESULT(no)]
+        )
         ;;
-*-*-hpux10.26)
-        if test -z "$GCC"; then
-                CFLAGS="$CFLAGS -Ae"
-        fi
-        CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-        IPADDR_IN_DISPLAY=yes
-        AC_DEFINE(HAVE_SECUREWARE)
-        AC_DEFINE(USE_PIPES)
-        AC_DEFINE(LOGIN_NO_ENDOPT)
-        AC_DEFINE(LOGIN_NEEDS_UTMPX)
-        AC_DEFINE(LOCKED_PASSWD_STRING, "*")
-        AC_DEFINE(SPT_TYPE,SPT_PSTAT)
-        LIBS="$LIBS -lsec -lsecpw"
-        AC_CHECK_LIB(xnet, t_error, ,AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
-        disable_ptmx_check=yes
-        ;;
-*-*-hpux10*)
-        if test -z "$GCC"; then
-                CFLAGS="$CFLAGS -Ae"
-        fi
-        CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-        IPADDR_IN_DISPLAY=yes
-        AC_DEFINE(USE_PIPES)
-        AC_DEFINE(LOGIN_NO_ENDOPT)
-        AC_DEFINE(LOGIN_NEEDS_UTMPX)
-        AC_DEFINE(LOCKED_PASSWD_STRING, "*")
-        AC_DEFINE(SPT_TYPE,SPT_PSTAT)
-        LIBS="$LIBS -lsec"
-        AC_CHECK_LIB(xnet, t_error, ,AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
-        ;;
-*-*-hpux11*)
+*-*-hpux*)
+        # first we define all of the options common to all HP-UX releases
         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
         IPADDR_IN_DISPLAY=yes
-        AC_DEFINE(PAM_SUN_CODEBASE)
         AC_DEFINE(USE_PIPES)
         AC_DEFINE(LOGIN_NO_ENDOPT)
         AC_DEFINE(LOGIN_NEEDS_UTMPX)
-        AC_DEFINE(DISABLE_UTMP)
         AC_DEFINE(LOCKED_PASSWD_STRING, "*")
         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
-        AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
-        check_for_hpux_broken_getaddrinfo=1
-        check_for_conflicting_getspnam=1
         LIBS="$LIBS -lsec"
-        AC_CHECK_LIB(xnet, t_error, ,AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
+        AC_CHECK_LIB(xnet, t_error, ,
+            AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
+
+        # next, we define all of the options specific to major releases
+        case "$host" in
+        *-*-hpux10*)
+                if test -z "$GCC"; then
+                        CFLAGS="$CFLAGS -Ae"
+                fi
+                ;;
+        *-*-hpux11*)
+                AC_DEFINE(PAM_SUN_CODEBASE)
+                AC_DEFINE(DISABLE_UTMP)
+                AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
+                check_for_hpux_broken_getaddrinfo=1
+                check_for_conflicting_getspnam=1
+                ;;
+        esac
+
+        # lastly, we define options specific to minor releases
+        case "$host" in
+        *-*-hpux10.26)
+                AC_DEFINE(HAVE_SECUREWARE)
+                disable_ptmx_check=yes
+                LIBS="$LIBS -lsecpw"
+                ;;
+        esac
         ;;
 *-*-irix5*)
         PATH="$PATH:/usr/etc"
@@ -269,12 +369,12 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         esac
         ;;
 mips-sony-bsd|mips-sony-newsos4)
-        AC_DEFINE(HAVE_NEWS4)
+        AC_DEFINE(NEED_SETPRGP, [], [Need setpgrp to acquire controlling tty])
         SONY=1
         ;;
 *-*-netbsd*)
         check_for_libcrypt_before=1
-        if test "x$withval" != "xno" ; then     
+        if test "x$withval" != "xno" ; then
                 need_dash_r=1
         fi
         ;;
@@ -296,8 +396,11 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(USE_PIPES)
         AC_DEFINE(BROKEN_SAVED_UIDS)
         ;;
+*-*-openbsd*)
+        AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
+        ;;
 *-*-solaris*)
-        if test "x$withval" != "xno" ; then     
+        if test "x$withval" != "xno" ; then
                 need_dash_r=1
         fi
         AC_DEFINE(PAM_SUN_CODEBASE)
@@ -361,13 +464,23 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(SETEUID_BREAKS_SETUID)
         AC_DEFINE(BROKEN_SETREUID)
         AC_DEFINE(BROKEN_SETREGID)
+        AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
         ;;
 # UnixWare 7.x, OpenUNIX 8
 *-*-sysv5*)
+        check_for_libcrypt_later=1
+        AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
         AC_DEFINE(USE_PIPES)
         AC_DEFINE(SETEUID_BREAKS_SETUID)
         AC_DEFINE(BROKEN_SETREUID)
         AC_DEFINE(BROKEN_SETREGID)
+        AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
+        case "$host" in
+        *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
+                TEST_SHELL=/u95/bin/sh
+                AC_DEFINE(BROKEN_LIBIAF, 1, [ia_uinfo routines not supported by OS yet])
+                ;;
+        esac
         ;;
 *-*-sysv*)
         ;;
@@ -466,21 +579,36 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(MISSING_HOWMANY)
         AC_DEFINE(MISSING_FD_MASK)
         ;;
+
+*-*-ultrix*)
+        AC_DEFINE(BROKEN_GETGROUPS, [], [getgroups(0,NULL) will return -1])
+        AC_DEFINE(BROKEN_MMAP, [], [Ultrix mmap can't map files])
+        AC_DEFINE(NEED_SETPRGP, [], [Need setpgrp to acquire controlling tty])
+        AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
+        ;;
+
+*-*-lynxos)
+        CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
+        AC_DEFINE(MISSING_HOWMANY)
+        AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
+        ;;
 esac
 
 # Allow user to specify flags
 AC_ARG_WITH(cflags,
         [  --with-cflags           Specify additional flags to pass to compiler],
         [
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         CFLAGS="$CFLAGS $withval"
                 fi
-        ]       
+        ]
 )
 AC_ARG_WITH(cppflags,
         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
         [
-                if test "x$withval" != "xno"; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         CPPFLAGS="$CPPFLAGS $withval"
                 fi
         ]
@@ -488,18 +616,31 @@ AC_ARG_WITH(cppflags,
 AC_ARG_WITH(ldflags,
         [  --with-ldflags          Specify additional flags to pass to linker],
         [
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         LDFLAGS="$LDFLAGS $withval"
                 fi
-        ]       
+        ]
 )
 AC_ARG_WITH(libs,
         [  --with-libs             Specify additional libraries to link with],
         [
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         LIBS="$LIBS $withval"
                 fi
-        ]       
+        ]
+)
+AC_ARG_WITH(Werror,
+        [  --with-Werror           Build main code with -Werror],
+        [
+                if test -n "$withval"  &&  test "x$withval" != "xno"; then
+                        werror_flags="-Werror"
+                        if "x${withval}" != "xyes"; then
+                                werror_flags="$withval"
+                        fi
+                fi
+        ]
 )
 
 AC_MSG_CHECKING(compiler and flags for sanity)
@@ -516,17 +657,67 @@ int main(){exit(0);}
         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 )
 
-# Checks for header files.
-AC_CHECK_HEADERS(bstring.h crypt.h dirent.h endian.h features.h \
-        floatingpoint.h getopt.h glob.h ia.h lastlog.h limits.h login.h \
-        login_cap.h maillock.h ndir.h netdb.h netgroup.h \
-        netinet/in_systm.h pam/pam_appl.h paths.h pty.h readpassphrase.h \
-        rpc/types.h security/pam_appl.h shadow.h stddef.h stdint.h \
-        strings.h sys/dir.h sys/strtio.h sys/audit.h sys/bitypes.h \
-        sys/bsdtty.h sys/cdefs.h sys/mman.h sys/ndir.h sys/prctl.h \
-        sys/pstat.h sys/select.h sys/stat.h sys/stream.h \
-        sys/stropts.h sys/sysmacros.h sys/time.h sys/timers.h sys/un.h \
-        time.h tmpdir.h ttyent.h usersec.h util.h utime.h utmp.h utmpx.h vis.h)
+dnl Checks for header files.
+AC_CHECK_HEADERS( \
+        bstring.h \
+        crypt.h \
+        dirent.h \
+        endian.h \
+        features.h \
+        floatingpoint.h \
+        getopt.h \
+        glob.h \
+        ia.h \
+        iaf.h \
+        lastlog.h \
+        limits.h \
+        login.h \
+        login_cap.h \
+        maillock.h \
+        ndir.h \
+        netdb.h \
+        netgroup.h \
+        netinet/in_systm.h \
+        pam/pam_appl.h \
+        paths.h \
+        pty.h \
+        readpassphrase.h \
+        rpc/types.h \
+        security/pam_appl.h \
+        shadow.h \
+        stddef.h \
+        stdint.h \
+        string.h \
+        strings.h \
+        sys/audit.h \
+        sys/bitypes.h \
+        sys/bsdtty.h \
+        sys/cdefs.h \
+        sys/dir.h \
+        sys/mman.h \
+        sys/ndir.h \
+        sys/prctl.h \
+        sys/pstat.h \
+        sys/select.h \
+        sys/stat.h \
+        sys/stream.h \
+        sys/stropts.h \
+        sys/strtio.h \
+        sys/sysmacros.h \
+        sys/time.h \
+        sys/timers.h \
+        sys/un.h \
+        time.h \
+        tmpdir.h \
+        ttyent.h \
+        unistd.h \
+        usersec.h \
+        util.h \
+        utime.h \
+        utmp.h \
+        utmpx.h \
+        vis.h \
+)
 
 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
@@ -583,10 +774,9 @@ AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME))
 dnl zlib is required
 AC_ARG_WITH(zlib,
         [  --with-zlib=PATH        Use zlib in PATH],
-        [
-                if test "x$withval" = "xno" ; then
-                        AC_MSG_ERROR([*** zlib is required ***])
-                fi
+        [ if test "x$withval" = "xno" ; then
+                AC_MSG_ERROR([*** zlib is required ***])
+          elif test "x$withval" != "xyes"; then
                 if test -d "$withval/lib"; then
                         if test -n "${need_dash_r}"; then
                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
@@ -605,7 +795,7 @@ AC_ARG_WITH(zlib,
                 else
                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
                 fi
-        ]
+        fi ]
 )
 
 AC_CHECK_LIB(z, deflate, ,
@@ -638,29 +828,40 @@ AC_ARG_WITH(zlib-version-check,
         ]
 )
 
-AC_MSG_CHECKING(for zlib 1.1.4 or greater)
+AC_MSG_CHECKING(for possibly buggy zlib)
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <stdio.h>
 #include <zlib.h>
 int main()
 {
-        int a, b, c, v;
-        if (sscanf(ZLIB_VERSION, "%d.%d.%d", &a, &b, &c) != 3)
+        int a=0, b=0, c=0, d=0, n, v;
+        n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
+        if (n != 3 && n != 4)
                 exit(1);
-        v = a*1000000 + b*1000 + c;
-        if (v >= 1001004)
+        v = a*1000000 + b*10000 + c*100 + d;
+        fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
+
+        /* 1.1.4 is OK */
+        if (a == 1 && b == 1 && c >= 4)
+                exit(0);
+
+        /* 1.2.3 and up are OK */
+        if (v >= 1020300)
                 exit(0);
+
         exit(2);
 }
         ]])],
-        AC_MSG_RESULT(yes),
-        [ AC_MSG_RESULT(no)
+        AC_MSG_RESULT(no),
+        [ AC_MSG_RESULT(yes)
           if test -z "$zlib_check_nonfatal" ; then
                 AC_MSG_ERROR([*** zlib too old - check config.log ***
 Your reported zlib version has known security problems.  It's possible your
 vendor has fixed these problems without changing the version number.  If you
 are sure this is the case, you can disable the check by running
 "./configure --without-zlib-version-check".
-If you are in doubt, upgrade zlib to version 1.1.4 or greater.])
+If you are in doubt, upgrade zlib to version 1.2.3 or greater.
+See http://www.gzip.org/zlib/ for details.])
           else
                 AC_MSG_WARN([zlib version may have security problems])
           fi
@@ -730,7 +931,7 @@ int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
                 AC_MSG_RESULT(no)
                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
         ],
-        [ 
+        [
                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
         ]
@@ -759,7 +960,7 @@ AC_ARG_WITH(skey,
                         AC_DEFINE(SKEY)
                         LIBS="-lskey $LIBS"
                         SKEY_MSG="yes"
-        
+
                         AC_MSG_CHECKING([for s/key support])
                         AC_TRY_RUN(
                                 [
@@ -794,7 +995,8 @@ AC_ARG_WITH(tcp-wrappers,
                         saved_LIBS="$LIBS"
                         saved_LDFLAGS="$LDFLAGS"
                         saved_CPPFLAGS="$CPPFLAGS"
-                        if test -n "${withval}" -a "${withval}" != "yes"; then
+                        if test -n "${withval}" && \
+                            test "x${withval}" != "xyes"; then
                                 if test -d "${withval}/lib"; then
                                         if test -n "${need_dash_r}"; then
                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
@@ -846,13 +1048,33 @@ LIBEDIT_MSG="no"
 AC_ARG_WITH(libedit,
         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
         [ if test "x$withval" != "xno" ; then
+                if test "x$withval" != "xyes"; then
+                        CPPFLAGS="$CPPFLAGS -I$withval/include"
+                        LDFLAGS="$LDFLAGS -L$withval/lib"
+                fi
                 AC_CHECK_LIB(edit, el_init,
                         [ AC_DEFINE(USE_LIBEDIT, [], [Use libedit for sftp])
                           LIBEDIT="-ledit -lcurses"
                           LIBEDIT_MSG="yes"
                           AC_SUBST(LIBEDIT)
                         ],
-                        [], [-lcurses]
+                        [ AC_MSG_ERROR(libedit not found) ],
+                        [ -lcurses ]
+                )
+                AC_MSG_CHECKING(if libedit version is compatible)
+                AC_COMPILE_IFELSE(
+                    [AC_LANG_SOURCE([[
+#include <histedit.h>
+int main(void)
+{
+        int i = H_SETSIZE;
+        el_init("", NULL, NULL, NULL);
+        exit(0);
+}
+                    ]])],
+                    [ AC_MSG_RESULT(yes) ],
+                    [ AC_MSG_RESULT(no)
+                      AC_MSG_ERROR(libedit version is not compatible) ]
                 )
         fi ]
 )
@@ -882,6 +1104,9 @@ AC_ARG_WITH(audit,
                 AC_MSG_RESULT(debug)
                 AC_DEFINE(SSH_AUDIT_EVENTS, [], Use audit debugging module)
                 ;;
+          no)
+                AC_MSG_RESULT(no)
+                ;;
           *)
                 AC_MSG_ERROR([Unknown audit module $withval])
                 ;;
@@ -889,19 +1114,87 @@ AC_ARG_WITH(audit,
 )
 
 dnl    Checks for library functions. Please keep in alphabetical order
-AC_CHECK_FUNCS(\
-        arc4random __b64_ntop b64_ntop __b64_pton b64_pton bcopy \
-        bindresvport_sa clock closefrom dirfd fchdir fchmod fchown \
-        freeaddrinfo futimes getaddrinfo getcwd getgrouplist getnameinfo \
-        getopt getpeereid _getpty getrlimit getttyent glob inet_aton \
-        inet_ntoa inet_ntop innetgr login_getcapbool md5_crypt memmove \
-        mkdtemp mmap ngetaddrinfo nsleep ogetaddrinfo openlog_r openpty \
-        pstat prctl readpassphrase realpath recvmsg rresvport_af sendmsg \
-        setdtablesize setegid setenv seteuid setgroups setlogin setpcred \
-        setproctitle setregid setreuid setrlimit \
-        setsid setvbuf sigaction sigvec snprintf socketpair strerror \
-        strlcat strlcpy strmode strnvis strtoul sysconf tcgetpgrp \
-        truncate unsetenv updwtmpx utimes vhangup vsnprintf waitpid \
+AC_CHECK_FUNCS( \
+        arc4random \
+        b64_ntop \
+        __b64_ntop \
+        b64_pton \
+        __b64_pton \
+        bcopy \
+        bindresvport_sa \
+        clock \
+        closefrom \
+        dirfd \
+        fchmod \
+        fchown \
+        freeaddrinfo \
+        futimes \
+        getaddrinfo \
+        getcwd \
+        getgrouplist \
+        getnameinfo \
+        getopt \
+        getpeereid \
+        _getpty \
+        getrlimit \
+        getttyent \
+        glob \
+        inet_aton \
+        inet_ntoa \
+        inet_ntop \
+        innetgr \
+        login_getcapbool \
+        md5_crypt \
+        memmove \
+        mkdtemp \
+        mmap \
+        ngetaddrinfo \
+        nsleep \
+        ogetaddrinfo \
+        openlog_r \
+        openpty \
+        prctl \
+        pstat \
+        readpassphrase \
+        realpath \
+        recvmsg \
+        rresvport_af \
+        sendmsg \
+        setdtablesize \
+        setegid \
+        setenv \
+        seteuid \
+        setgroups \
+        setlogin \
+        setpcred \
+        setproctitle \
+        setregid \
+        setreuid \
+        setrlimit \
+        setsid \
+        setvbuf \
+        sigaction \
+        sigvec \
+        snprintf \
+        socketpair \
+        strdup \
+        strerror \
+        strlcat \
+        strlcpy \
+        strmode \
+        strnvis \
+        strtonum \
+        strtoll \
+        strtoul \
+        sysconf \
+        tcgetpgrp \
+        truncate \
+        unsetenv \
+        updwtmpx \
+        utimes \
+        vhangup \
+        vsnprintf \
+        waitpid \
 )
 
 # IRIX has a const char return value for gai_strerror()
@@ -922,8 +1215,15 @@ str = gai_strerror(0);],[
 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP))
 
 dnl Make sure prototypes are defined for these before using them.
-AC_CHECK_DECL(strsep, [AC_CHECK_FUNCS(strsep)])
 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
+AC_CHECK_DECL(strsep,
+        [AC_CHECK_FUNCS(strsep)],
+        [],
+        [
+#ifdef HAVE_STRING_H
+# include <string.h>
+#endif
+        ])
 
 dnl tcsendbreak might be a macro
 AC_CHECK_DECL(tcsendbreak,
@@ -1011,7 +1311,9 @@ if test "x$ac_cv_func_getpeereid" != "xyes" ; then
                 [#include <sys/types.h>
                  #include <sys/socket.h>],
                 [int i = SO_PEERCRED;],
-                [AC_MSG_RESULT(yes)],
+                [ AC_MSG_RESULT(yes)
+                  AC_DEFINE(HAVE_SO_PEERCRED, [], [Have PEERCRED socket option])
+                ],
                 [AC_MSG_RESULT(no)
                 NO_PEERCHECK=1]
         )
@@ -1090,7 +1392,8 @@ main()
         )
 fi
 
-if test "x$ac_cv_func_getaddrinfo" = "xyes" -a "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
+if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
+    test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
         AC_MSG_CHECKING(if getaddrinfo seems to work)
         AC_TRY_RUN(
                 [
@@ -1158,7 +1461,8 @@ main(void)
         )
 fi
 
-if test "x$ac_cv_func_getaddrinfo" = "xyes" -a "x$check_for_aix_broken_getaddrinfo" = "x1"; then
+if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
+    test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
         AC_MSG_CHECKING(if getaddrinfo seems to work)
         AC_TRY_RUN(
                 [
@@ -1443,6 +1747,7 @@ if test "x$check_for_libcrypt_later" = "x1"; then
         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
 fi
 
+AC_CHECK_LIB(iaf, ia_openinfo)
 
 ### Configure cryptographic random number support
 
@@ -1467,7 +1772,7 @@ int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
         [
                 AC_MSG_WARN([cross compiling: assuming yes])
                 # This is safe, since all recent OpenSSL versions will
-                # complain at runtime if not seeded correctly. 
+                # complain at runtime if not seeded correctly.
                 OPENSSL_SEEDS_ITSELF=yes
         ]
 )
@@ -1489,10 +1794,10 @@ AC_ARG_WITH(rand-helper,
                         USE_RAND_HELPER=yes
                 fi
         ],
-)       
+)
 
 # Which randomness source do we use?
-if test ! -z "$OPENSSL_SEEDS_ITSELF" -a -z "$USE_RAND_HELPER" ; then
+if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
         # OpenSSL only
         AC_DEFINE(OPENSSL_PRNG_ONLY)
         RAND_MSG="OpenSSL internal ONLY"
@@ -1582,10 +1887,11 @@ entropy_timeout=200
 AC_ARG_WITH(entropy-timeout,
         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
         [
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         entropy_timeout=$withval
                 fi
-        ]       
+        ]
 )
 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout)
 
@@ -1593,10 +1899,11 @@ SSH_PRIVSEP_USER=sshd
 AC_ARG_WITH(privsep-user,
         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
         [
-                if test -n "$withval"; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         SSH_PRIVSEP_USER=$withval
                 fi
-        ]       
+        ]
 )
 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER")
 AC_SUBST(SSH_PRIVSEP_USER)
@@ -2030,9 +2337,9 @@ fi
 AC_CHECK_TYPES(struct timespec)
 
 # We need int64_t or else certian parts of the compile will fail.
-if test "x$ac_cv_have_int64_t" = "xno" -a \
-        "x$ac_cv_sizeof_long_int" != "x8" -a \
-        "x$ac_cv_sizeof_long_long_int" = "x0" ; then
+if test "x$ac_cv_have_int64_t" = "xno" && \
+        test "x$ac_cv_sizeof_long_int" != "x8" && \
+        test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
         echo "an alternative compiler (I.E., GCC) before continuing."
         echo ""
@@ -2324,23 +2631,28 @@ AC_ARG_WITH(sectok,
 )
 
 # Check whether user wants OpenSC support
+OPENSC_CONFIG="no"
 AC_ARG_WITH(opensc,
-        AC_HELP_STRING([--with-opensc=PFX],
-                       [Enable smartcard support using OpenSC]),
-        opensc_config_prefix="$withval", opensc_config_prefix="")
-if test x$opensc_config_prefix != x ; then
-  OPENSC_CONFIG=$opensc_config_prefix/bin/opensc-config
-  AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
-  if test "$OPENSC_CONFIG" != "no"; then
-    LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
-    LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
-    CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
-    LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
-    AC_DEFINE(SMARTCARD)
-    AC_DEFINE(USE_OPENSC)
-    SCARD_MSG="yes, using OpenSC"
-  fi
-fi
+        [--with-opensc[[=PFX]]       Enable smartcard support using OpenSC (optionally in PATH)],
+        [
+            if test "x$withval" != "xno" ; then
+                if test "x$withval" != "xyes" ; then
+                        OPENSC_CONFIG=$withval/bin/opensc-config
+                else
+                        AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
+                fi
+                if test "$OPENSC_CONFIG" != "no"; then
+                        LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
+                        LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
+                        CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
+                        LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
+                        AC_DEFINE(SMARTCARD)
+                        AC_DEFINE(USE_OPENSC)
+                        SCARD_MSG="yes, using OpenSC"
+                fi
+            fi
+        ]
+)
 
 # Check libraries needed by DNS fingerprint support
 AC_SEARCH_LIBS(getrrsetbyname, resolv,
@@ -2369,6 +2681,9 @@ int main()
                          AC_MSG_RESULT(no)])
                     ])
                 AC_CHECK_FUNCS(_getshort _getlong)
+                AC_CHECK_DECLS([_getshort, _getlong], , ,
+                    [#include <sys/types.h>
+                    #include <arpa/nameser.h>])
                 AC_CHECK_MEMBER(HEADER.ad,
                         [AC_DEFINE(HAVE_HEADER_AD)],,
                         [#include <arpa/nameser.h>])
@@ -2423,7 +2738,7 @@ AC_ARG_WITH(kerberos5,
                                          AC_DEFINE(HEIMDAL)
                                          K5LIBS="-lkrb5 -ldes"
                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
-                                         AC_CHECK_LIB(roken, net_write, 
+                                         AC_CHECK_LIB(roken, net_write,
                                            [K5LIBS="$K5LIBS -lroken"])
                                        ],
                                        [ AC_MSG_RESULT(no)
@@ -2442,7 +2757,7 @@ AC_ARG_WITH(kerberos5,
                                         $K5LIBS)
                                 ],
                                 $K5LIBS)
-                        
+
                         AC_CHECK_HEADER(gssapi.h, ,
                                 [ unset ac_cv_header_gssapi_h
                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
@@ -2472,7 +2787,6 @@ AC_ARG_WITH(kerberos5,
 
         LIBS="$LIBS $K5LIBS"
         AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS))
-        AC_SEARCH_LIBS(krb5_init_ets, $K5LIBS, AC_DEFINE(KRB5_INIT_ETS))
         ]
 )
 
@@ -2482,7 +2796,8 @@ PRIVSEP_PATH=/var/empty
 AC_ARG_WITH(privsep-path,
         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
         [
-                if test "x$withval" != "$no" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         PRIVSEP_PATH=$withval
                 fi
         ]
@@ -2492,7 +2807,8 @@ AC_SUBST(PRIVSEP_PATH)
 AC_ARG_WITH(xauth,
         [  --with-xauth=PATH       Specify path to xauth program ],
         [
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         xauth_path=$withval
                 fi
         ],
@@ -2610,7 +2926,7 @@ AC_ARG_WITH(md5-passwords,
 AC_ARG_WITH(shadow,
         [  --without-shadow        Disable shadow password support],
         [
-                if test "x$withval" = "xno" ; then      
+                if test "x$withval" = "xno" ; then
                         AC_DEFINE(DISABLE_SHADOW)
                         disable_shadow=yes
                 fi
@@ -2645,7 +2961,7 @@ else
         AC_ARG_WITH(ipaddr-display,
                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
                 [
-                        if test "x$withval" != "xno" ; then     
+                        if test "x$withval" != "xno" ; then
                                 AC_DEFINE(IPADDR_IN_DISPLAY)
                                 DISPLAY_HACK_MSG="yes"
                         fi
@@ -2677,8 +2993,8 @@ if test "x$etc_default_login" != "xno"; then
 fi
 
 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
-if test $ac_cv_func_login_getcapbool = "yes" -a \
-        $ac_cv_header_login_cap_h = "yes" ; then
+if test $ac_cv_func_login_getcapbool = "yes" && \
+        test $ac_cv_header_login_cap_h = "yes" ; then
         external_path_file=/etc/login.conf
 fi
 
@@ -2691,7 +3007,7 @@ AC_ARG_WITH(default-path,
                         AC_MSG_WARN([
 --with-default-path=PATH has no effect on this system.
 Edit /etc/login.conf instead.])
-                elif test "x$withval" != "xno" ; then   
+                elif test "x$withval" != "xno" ; then
                         if test ! -z "$external_path_file" ; then
                                 AC_MSG_WARN([
 --with-default-path=PATH will only be used if PATH is not defined in
@@ -2732,11 +3048,11 @@ main()
 {
         FILE *fd;
         int rc;
-        
+
         fd = fopen(DATA,"w");
         if(fd == NULL)
                 exit(1);
-        
+
         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
                 exit(1);
 
@@ -2773,7 +3089,8 @@ fi
 AC_ARG_WITH(superuser-path,
         [  --with-superuser-path=  Specify different path for super-user],
         [
-                if test "x$withval" != "xno" ; then
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval")
                         superuser_path=$withval
                 fi
@@ -2809,7 +3126,7 @@ BSD_AUTH_MSG=no
 AC_ARG_WITH(bsd-auth,
         [  --with-bsd-auth         Enable BSD auth support],
         [
-                if test "x$withval" != "xno" ; then     
+                if test "x$withval" != "xno" ; then
                         AC_DEFINE(BSD_AUTH)
                         BSD_AUTH_MSG=yes
                 fi
@@ -2819,7 +3136,7 @@ AC_ARG_WITH(bsd-auth,
 # Where to place sshd.pid
 piddir=/var/run
 # make sure the directory exists
-if test ! -d $piddir ; then     
+if test ! -d $piddir ; then
         piddir=`eval echo ${sysconfdir}`
         case $piddir in
                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
@@ -2829,9 +3146,10 @@ fi
 AC_ARG_WITH(pid-dir,
         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
         [
-                if test "x$withval" != "xno" ; then     
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
                         piddir=$withval
-                        if test ! -d $piddir ; then     
+                        if test ! -d $piddir ; then
                         AC_MSG_WARN([** no $piddir directory on this system **])
                         fi
                 fi
@@ -2909,9 +3227,9 @@ AC_ARG_ENABLE(pututxline,
 AC_ARG_WITH(lastlog,
   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
         [
-                if test "x$withval" = "xno" ; then      
+                if test "x$withval" = "xno" ; then
                         AC_DEFINE(DISABLE_LASTLOG)
-                else
+                elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
                         conf_lastlog_location=$withval
                 fi
         ]
@@ -2978,7 +3296,7 @@ fi
 
 if test -n "$conf_lastlog_location"; then
         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location")
-fi      
+fi
 
 dnl utmp detection
 AC_MSG_CHECKING([if your system defines UTMP_FILE])
@@ -3008,7 +3326,7 @@ if test -z "$conf_utmp_location"; then
 fi
 if test -n "$conf_utmp_location"; then
         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location")
-fi      
+fi
 
 dnl wtmp detection
 AC_MSG_CHECKING([if your system defines WTMP_FILE])
@@ -3038,7 +3356,7 @@ if test -z "$conf_wtmp_location"; then
 fi
 if test -n "$conf_wtmp_location"; then
         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location")
-fi      
+fi
 
 
 dnl utmpx detection - I don't know any system so perverse as to require
@@ -3066,7 +3384,7 @@ if test -z "$conf_utmpx_location"; then
         fi
 else
         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location")
-fi      
+fi
 
 dnl wtmpx detection
 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
@@ -3091,7 +3409,7 @@ if test -z "$conf_wtmpx_location"; then
         fi
 else
         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location")
-fi      
+fi
 
 
 if test ! -z "$blibpath" ; then
@@ -3107,6 +3425,10 @@ if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
         LIBS=`echo $LIBS | sed 's/-ldl //'`
 fi
 
+dnl Adding -Werror to CFLAGS early prevents configure tests from running.
+dnl Add now.
+CFLAGS="$CFLAGS $werror_flags"
+
 AC_EXEEXT
 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile \
         scard/Makefile ssh_prng_cmds survey.sh])
diff --git a/contrib/aix/buildbff.sh b/contrib/aix/buildbff.sh
index 4a5c32b0e..09b9c118c 100755
--- a/contrib/aix/buildbff.sh
+++ b/contrib/aix/buildbff.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # buildbff.sh: Create AIX SMIT-installable OpenSSH packages
-# $Id: buildbff.sh,v 1.7 2003/11/21 12:48:56 djm Exp $
+# $Id: buildbff.sh,v 1.8 2005/03/29 13:24:12 dtucker Exp $
 #
 # Author: Darren Tucker (dtucker at zip dot com dot au)
 # This file is placed in the public domain and comes with absolutely
@@ -219,7 +219,7 @@ else
         fi
 
         # Create user if required
-        if lsuser ALL | cut -f1 -d: | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null
+        if lsuser "$SSH_PRIVSEP_USER" >/dev/null
         then
                 echo "PrivSep user $SSH_PRIVSEP_USER already exists."
         else
diff --git a/contrib/aix/pam.conf b/contrib/aix/pam.conf
index 1495f43cb..f1528b005 100644
--- a/contrib/aix/pam.conf
+++ b/contrib/aix/pam.conf
@@ -11,10 +11,10 @@ OTHER   auth            required        /usr/lib/security/pam_aix
 sshd    account         required        /usr/lib/security/pam_aix
 OTHER   account         required        /usr/lib/security/pam_aix
 
-# Session Management
+# Password Management
 sshd    password        required        /usr/lib/security/pam_aix
 OTHER   password        required        /usr/lib/security/pam_aix
 
-# Password Management
+# Session Management
 sshd    session         required        /usr/lib/security/pam_aix
 OTHER   session         required        /usr/lib/security/pam_aix
diff --git a/contrib/caldera/openssh.spec b/contrib/caldera/openssh.spec
index 67d8e6ff4..bfde0fefc 100644
--- a/contrib/caldera/openssh.spec
+++ b/contrib/caldera/openssh.spec
@@ -17,12 +17,12 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable      1
 %if %{use_stable}
-  %define version       4.0p1
+  %define version       4.2p1
   %define cvs           %{nil}
   %define release       1
 %else
-  %define version       3.9p1
-  %define cvs           cvs20011009
+  %define version       4.1p1
+  %define cvs           cvs20050315
   %define release       0r1
 %endif
 %define xsa             x11-ssh-askpass         
@@ -297,12 +297,7 @@ fi
 
 %PreUn server
 [ "$1" = 0 ] || exit 0
-
 ! %{SVIdir}/sshd status || %{SVIdir}/sshd stop
-: # to protect the rpm database
-
-
-%PostUn server
 if [ -x %{LSBinit}-remove ]; then
   %{LSBinit}-remove sshd
 else
@@ -310,7 +305,6 @@ else
 fi
 : # to protect the rpm database
 
-
 %Files 
 %defattr(-,root,root)
 %dir %{_sysconfdir}
@@ -363,4 +357,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31
 
-$Id: openssh.spec,v 1.52 2005/03/09 00:02:42 djm Exp $
+$Id: openssh.spec,v 1.55 2005/09/01 09:10:49 djm Exp $
diff --git a/contrib/cygwin/ssh-host-config b/contrib/cygwin/ssh-host-config
index c7164f610..fbfb5c195 100644
--- a/contrib/cygwin/ssh-host-config
+++ b/contrib/cygwin/ssh-host-config
@@ -449,12 +449,10 @@ then
           echo "Should this script create a new local account 'sshd_server' which has"
           if request "the required privileges?"
           then
-            _admingroup=`awk -F: '{if ( $1 != "root" && $2 == "S-1-5-32-544" ) print $1;}' ${SYSCONFDIR}/group`
+            _admingroup=`mkgroup -l | awk -F: '{if ( $2 == "S-1-5-32-544" ) print $1;}' `
             if [ -z "${_admingroup}" ]
             then
-              echo "There's no group with SID S-1-5-32-544 (Local administrators group) in"
-              echo "your ${SYSCONFDIR}/group file.  Please regenerate this entry using 'mkgroup -l'"
-              echo "and restart this script."
+              echo "mkgroup -l produces no group with SID S-1-5-32-544 (Local administrators group)."
               exit 1
             fi
             dos_var_empty=`cygpath -w ${LOCALSTATEDIR}/empty`
@@ -585,6 +583,16 @@ then
         chown "${_user}".544 ${LOCALSTATEDIR}/log/sshd.log
       fi
     fi
+    if ! ( mount | egrep -q 'on /(|usr/(bin|lib)) type system' )
+    then
+      echo
+      echo "Warning: It appears that you have user mode mounts (\"Just me\""
+      echo "chosen during install.)  Any daemons installed as services will"
+      echo "fail to function unless system mounts are used.  To change this,"
+      echo "re-run setup.exe and choose \"All users\"."
+      echo
+      echo "For more information, see http://cygwin.com/faq/faq0.html#TOC33"
+    fi
   fi
 fi
 
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec
index 8fbc4c02a..049b07fe4 100644
--- a/contrib/redhat/openssh.spec
+++ b/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
-%define ver 4.0p1
+%define ver 4.2p1
 %define rel 1
 
 # OpenSSH privilege separation requires a user & group ID
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec
index 449613db6..6ad862fad 100644
--- a/contrib/suse/openssh.spec
+++ b/contrib/suse/openssh.spec
@@ -1,6 +1,6 @@
 Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name: openssh
-Version: 4.0p1
+Version: 4.2p1
 URL: http://www.openssh.com/
 Release: 1
 Source0: openssh-%{version}.tar.gz
diff --git a/defines.h b/defines.h
index 7758bc37a..408b988b5 100644
--- a/defines.h
+++ b/defines.h
@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H
 
-/* $Id: defines.h,v 1.119 2005/02/20 10:01:49 dtucker Exp $ */
+/* $Id: defines.h,v 1.127 2005/08/31 16:59:49 tim Exp $ */
 
 
 /* Constants */
@@ -54,10 +54,24 @@ enum
 # ifdef PATH_MAX
 #  define MAXPATHLEN PATH_MAX
 # else /* PATH_MAX */
-#  define MAXPATHLEN 64 /* Should be safe */
+#  define MAXPATHLEN 64
+/* realpath uses a fixed buffer of size MAXPATHLEN, so force use of ours */
+#  ifndef BROKEN_REALPATH
+#   define BROKEN_REALPATH 1
+#  endif /* BROKEN_REALPATH */
 # endif /* PATH_MAX */
 #endif /* MAXPATHLEN */
 
+#ifndef PATH_MAX
+# ifdef _POSIX_PATH_MAX
+# define PATH_MAX _POSIX_PATH_MAX
+# endif
+#endif
+
+#ifndef MAXSYMLINKS
+# define MAXSYMLINKS 5
+#endif
+
 #ifndef STDIN_FILENO
 # define STDIN_FILENO    0
 #endif
@@ -432,6 +446,10 @@ struct winsize {
 # define __dead __attribute__((noreturn))
 #endif
 
+#if !defined(HAVE_ATTRIBUTE__SENTINEL__) && !defined(__sentinel__)
+# define __sentinel__
+#endif
+
 /* *-*-nto-qnx doesn't define this macro in the system headers */
 #ifdef MISSING_HOWMANY
 # define howmany(x,y)   (((x)+((y)-1))/(y))
@@ -567,6 +585,23 @@ struct winsize {
 # define SSH_SYSFDMAX 10000
 #endif
 
+#if defined(__Lynx__)
+ /*
+  * LynxOS defines these in param.h which we do not want to include since
+  * it will also pull in a bunch of kernel definitions.
+  */
+# define ALIGNBYTES (sizeof(int) - 1)
+# define ALIGN(p) (((unsigned)p + ALIGNBYTES) & ~ALIGNBYTES)
+  /* Missing prototypes on LynxOS */
+  int snprintf (char *, size_t, const char *, ...);
+  int mkstemp (char *);
+  char *crypt (const char *, const char *);
+  int seteuid (uid_t);
+  int setegid (gid_t);
+  char *mkdtemp (char *);
+  int rresvport_af (int *, sa_family_t);
+  int innetgr (const char *, const char *, const char *, const char *);
+#endif
 
 /*
  * Define this to use pipes instead of socketpairs for communicating with the
@@ -653,6 +688,10 @@ struct winsize {
 # define CUSTOM_SYS_AUTH_PASSWD 1
 #endif
 
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+# define CUSTOM_SYS_AUTH_PASSWD 1
+#endif
+
 /* HP-UX 11.11 */
 #ifdef BTMP_FILE
 # define _PATH_BTMP BTMP_FILE
@@ -664,4 +703,12 @@ struct winsize {
 
 /** end of login recorder definitions */
 
+#ifdef BROKEN_GETGROUPS
+# define getgroups(a,b) ((a)==0 && (b)==NULL ? NGROUPS_MAX : getgroups((a),(b)))
+#endif
+
+#if defined(HAVE_MMAP) && defined(BROKEN_MMAP)
+# undef HAVE_MMAP
+#endif
+
 #endif /* _DEFINES_H */
diff --git a/dns.c b/dns.c
index 140ab6042..4487c1aba 100644
--- a/dns.c
+++ b/dns.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: dns.c,v 1.10 2004/06/21 17:36:31 avsm Exp $   */
+/*      $OpenBSD: dns.c,v 1.12 2005/06/17 02:44:32 djm Exp $    */
 
 /*
  * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -43,7 +43,7 @@
 #include "uuencode.h"
 
 extern char *__progname;
-RCSID("$OpenBSD: dns.c,v 1.10 2004/06/21 17:36:31 avsm Exp $");
+RCSID("$OpenBSD: dns.c,v 1.12 2005/06/17 02:44:32 djm Exp $");
 
 #ifndef LWRES
 static const char *errset_text[] = {
@@ -142,6 +142,26 @@ dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
         return success;
 }
 
+/*
+ * Check if hostname is numerical.
+ * Returns -1 if hostname is numeric, 0 otherwise
+ */
+static int
+is_numeric_hostname(const char *hostname)
+{
+        struct addrinfo hints, *ai;
+
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_socktype = SOCK_DGRAM;
+        hints.ai_flags = AI_NUMERICHOST;
+
+        if (getaddrinfo(hostname, "0", &hints, &ai) == 0) {
+                freeaddrinfo(ai);
+                return -1;
+        }
+
+        return 0;
+}
 
 /*
  * Verify the given hostname, address and host key using DNS.
@@ -151,7 +171,7 @@ int
 verify_host_key_dns(const char *hostname, struct sockaddr *address,
     const Key *hostkey, int *flags)
 {
-        int counter;
+        u_int counter;
         int result;
         struct rrsetinfo *fingerprints = NULL;
 
@@ -171,6 +191,11 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
         if (hostkey == NULL)
                 fatal("No key to look up!");
 
+        if (is_numeric_hostname(hostname)) {
+                debug("skipped DNS lookup for numerical hostname");
+                return -1;
+        }
+
         result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
             DNS_RDATATYPE_SSHFP, 0, &fingerprints);
         if (result) {
@@ -249,7 +274,7 @@ export_dns_rr(const char *hostname, const Key *key, FILE *f, int generic)
         u_char *rdata_digest;
         u_int rdata_digest_len;
 
-        int i;
+        u_int i;
         int success = 0;
 
         if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
diff --git a/entropy.c b/entropy.c
index 0997174b6..410bbb927 100644
--- a/entropy.c
+++ b/entropy.c
@@ -45,7 +45,7 @@
  * XXX: we should tell the child how many bytes we need.
  */
 
-RCSID("$Id: entropy.c,v 1.48 2003/11/21 12:56:47 djm Exp $");
+RCSID("$Id: entropy.c,v 1.49 2005/07/17 07:26:44 djm Exp $");
 
 #ifndef OPENSSL_PRNG_ONLY
 #define RANDOM_SEED_SIZE 48
@@ -114,8 +114,8 @@ seed_rng(void)
         close(p[0]);
 
         if (waitpid(pid, &ret, 0) == -1)
-               fatal("Couldn't wait for ssh-rand-helper completion: %s",
-                   strerror(errno));
+                fatal("Couldn't wait for ssh-rand-helper completion: %s",
+                    strerror(errno));
         signal(SIGCHLD, old_sigchld);
 
         /* We don't mind if the child exits upon a SIGPIPE */
diff --git a/gss-genr.c b/gss-genr.c
index 36925df4e..9dec270a3 100644
--- a/gss-genr.c
+++ b/gss-genr.c
@@ -1,7 +1,7 @@
-/*      $OpenBSD: gss-genr.c,v 1.3 2003/11/21 11:57:03 djm Exp $        */
+/*      $OpenBSD: gss-genr.c,v 1.4 2005/07/17 07:17:55 djm Exp $        */
 
 /*
- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
+ * Copyright (c) 2001-2005 Simon Wilkinson. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -55,6 +55,11 @@ Gssctxt *gss_kex_context = NULL;
 
 static ssh_gss_kex_mapping *gss_enc2oid = NULL;
 
+int 
+ssh_gssapi_oid_table_ok() {
+        return (gss_enc2oid != NULL);
+}
+
 /*
  * Return a list of the gss-group1-sha1 mechanisms supported by this program
  *
@@ -64,7 +69,7 @@ static ssh_gss_kex_mapping *gss_enc2oid = NULL;
 
 
 char *
-ssh_gssapi_client_mechanisms(char *host) {
+ssh_gssapi_client_mechanisms(const char *host) {
         gss_OID_set gss_supported;
         OM_uint32 min_status;
 
@@ -85,8 +90,6 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
         const EVP_MD *evp_md = EVP_md5();
         EVP_MD_CTX md;
 
-        evp_md = EVP_md5();
-
         if (gss_enc2oid != NULL) {
                 for (i=0;gss_enc2oid[i].encoded!=NULL;i++)
                         xfree(gss_enc2oid[i].encoded);
@@ -99,12 +102,13 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
         buffer_init(&buf);
 
         oidpos = 0;
-        for (i=0;i<gss_supported->count;i++) {
-                if (gss_supported->elements[i].length<128 &&
+        for (i = 0;i < gss_supported->count;i++) {
+                if (gss_supported->elements[i].length < 128 &&
                     (*check)(&(gss_supported->elements[i]), data)) {
 
                         deroid[0] = SSH_GSS_OIDTYPE;
                         deroid[1] = gss_supported->elements[i].length;
+
                         EVP_DigestInit(&md, evp_md);
                         EVP_DigestUpdate(&md, deroid, 2);
                         EVP_DigestUpdate(&md,
@@ -117,10 +121,14 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
                             encoded, EVP_MD_size(evp_md)*2);
 
                         if (oidpos != 0)
-                            buffer_put_char(&buf,',');
+                            buffer_put_char(&buf, ',');
 
-                        buffer_append(&buf, KEX_GSS_SHA1, 
-                            sizeof(KEX_GSS_SHA1)-1);
+                        buffer_append(&buf, KEX_GSS_GEX_SHA1_ID,
+                            sizeof(KEX_GSS_GEX_SHA1_ID)-1);
+                        buffer_append(&buf, encoded, enclen);
+                        buffer_put_char(&buf,',');
+                        buffer_append(&buf, KEX_GSS_GRP1_SHA1_ID, 
+                            sizeof(KEX_GSS_GRP1_SHA1_ID)-1);
                         buffer_append(&buf, encoded, enclen);
 
                         gss_enc2oid[oidpos].oid = &(gss_supported->elements[i]);
@@ -131,7 +139,7 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
         gss_enc2oid[oidpos].oid = NULL;
         gss_enc2oid[oidpos].encoded = NULL;
 
-        buffer_put_char(&buf,'\0');
+        buffer_put_char(&buf, '\0');
 
         mechs = xmalloc(buffer_len(&buf));
         buffer_get(&buf, mechs, buffer_len(&buf));
@@ -146,21 +154,28 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
 }
 
 gss_OID
-ssh_gssapi_id_kex(Gssctxt *ctx, char *name) {
+ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int *gex) {
         int i = 0;
 
-        if (strncmp(name, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1) != 0) 
+        if (strncmp(name, KEX_GSS_GRP1_SHA1_ID,
+            sizeof(KEX_GSS_GRP1_SHA1_ID)-1) == 0) {
+                name+=sizeof(KEX_GSS_GRP1_SHA1_ID)-1;
+                *gex = 0;
+        } else if (strncmp(name, KEX_GSS_GEX_SHA1_ID,
+            sizeof(KEX_GSS_GEX_SHA1_ID)-1) == 0) {
+                name+=sizeof(KEX_GSS_GEX_SHA1_ID)-1;
+                *gex = 1;
+        } else {
                 return NULL;
-
-        name+=sizeof(KEX_GSS_SHA1)-1; /* Skip ID string */
+        }
 
         while (gss_enc2oid[i].encoded != NULL &&
-            strcmp(name,gss_enc2oid[i].encoded)!=0) {
+            strcmp(name, gss_enc2oid[i].encoded) != 0) {
                 i++;
         }
 
         if (gss_enc2oid[i].oid != NULL && ctx != NULL)
-                ssh_gssapi_set_oid(ctx,gss_enc2oid[i].oid);
+                ssh_gssapi_set_oid(ctx, gss_enc2oid[i].oid);
 
         return gss_enc2oid[i].oid;
 }
@@ -203,8 +218,8 @@ ssh_gssapi_error(Gssctxt *ctxt)
 }
 
 char *
-ssh_gssapi_last_error(Gssctxt *ctxt,
-                      OM_uint32 *major_status, OM_uint32 *minor_status)
+ssh_gssapi_last_error(Gssctxt *ctxt, OM_uint32 *major_status,
+    OM_uint32 *minor_status)
 {
         OM_uint32 lmin;
         gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
@@ -422,7 +437,7 @@ ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) {
 int
 ssh_gssapi_check_mechanism(gss_OID oid, void *host) {
         Gssctxt * ctx = NULL;
-        gss_buffer_desc token;
+        gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
         OM_uint32 major, minor;
         
         ssh_gssapi_build_ctx(&ctx);
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 91d87f798..4f02621dd 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -65,9 +65,6 @@ ssh_gssapi_krb5_init(void)
                 logit("Cannot initialize krb5 context");
                 return 0;
         }
-#ifdef KRB5_INIT_ETS
-        krb5_init_ets(krb_context);
-#endif
 
         return 1;
 }
@@ -131,34 +128,10 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
                 return;
         }
 #else
-        {
-                int tmpfd;
-                char ccname[40];
-                mode_t old_umask;
-
-                snprintf(ccname, sizeof(ccname),
-                    "FILE:/tmp/krb5cc_%d_XXXXXX", geteuid());
-
-                old_umask = umask(0177);
-                tmpfd = mkstemp(ccname + strlen("FILE:"));
-                umask(old_umask);
-                if (tmpfd == -1) {
-                        logit("mkstemp(): %.100s", strerror(errno));
-                        problem = errno;
-                        return;
-                }
-                if (fchmod(tmpfd, S_IRUSR | S_IWUSR) == -1) {
-                        logit("fchmod(): %.100s", strerror(errno));
-                        close(tmpfd);
-                        problem = errno;
-                        return;
-                }
-                close(tmpfd);
-                if ((problem = krb5_cc_resolve(krb_context, ccname, &ccache))) {
-                        logit("krb5_cc_resolve(): %.100s",
-                            krb5_get_err_text(krb_context, problem));
-                        return;
-                }
+        if ((problem = ssh_krb5_cc_gen(krb_context, &ccache))) {
+                logit("ssh_krb5_cc_gen(): %.100s",
+                    krb5_get_err_text(krb_context, problem));
+                return;
         }
 #endif  /* #ifdef HEIMDAL */
 
diff --git a/gss-serv.c b/gss-serv.c
index fad79a1b4..05ae54e97 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: gss-serv.c,v 1.5 2003/11/17 11:06:07 markus Exp $     */
+/*      $OpenBSD: gss-serv.c,v 1.8 2005/08/30 22:08:05 djm Exp $        */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -156,7 +156,7 @@ ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *recv_tok,
 static OM_uint32
 ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
 {
-        char *tok;
+        u_char *tok;
         OM_uint32 offset;
         OM_uint32 oidl;
 
@@ -186,7 +186,7 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
          */
         if (tok[4] != 0x06 || tok[5] != oidl ||
             ename->length < oidl+6 ||
-           !ssh_gssapi_check_oid(ctx,tok+6,oidl))
+            !ssh_gssapi_check_oid(ctx,tok+6,oidl))
                 return GSS_S_FAILURE;
 
         offset = oidl+6;
@@ -289,7 +289,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
                 debug("Setting %s to %s", gssapi_client.store.envvar,
                 gssapi_client.store.envval);
                 child_set_env(envp, envsizep, gssapi_client.store.envvar,
-                     gssapi_client.store.envval);
+                    gssapi_client.store.envval);
         }
 }
 
@@ -297,13 +297,24 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
 int
 ssh_gssapi_userok(char *user)
 {
+        OM_uint32 lmin;
+
         if (gssapi_client.exportedname.length == 0 ||
             gssapi_client.exportedname.value == NULL) {
                 debug("No suitable client data");
                 return 0;
         }
         if (gssapi_client.mech && gssapi_client.mech->userok)
-                return ((*gssapi_client.mech->userok)(&gssapi_client, user));
+                if ((*gssapi_client.mech->userok)(&gssapi_client, user))
+                        return 1;
+                else {
+                        /* Destroy delegated credentials if userok fails */
+                        gss_release_buffer(&lmin, &gssapi_client.displayname);
+                        gss_release_buffer(&lmin, &gssapi_client.exportedname);
+                        gss_release_cred(&lmin, &gssapi_client.creds);
+                        memset(&gssapi_client, 0, sizeof(ssh_gssapi_client));
+                        return 0;
+                }
         else
                 debug("ssh_gssapi_userok: Unknown GSSAPI mechanism");
         return (0);
diff --git a/hostfile.c b/hostfile.c
index 2e1c8bcd0..63550a29d 100644
--- a/hostfile.c
+++ b/hostfile.c
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: hostfile.c,v 1.33 2005/03/01 10:40:26 djm Exp $");
+RCSID("$OpenBSD: hostfile.c,v 1.35 2005/07/27 10:39:03 dtucker Exp $");
 
 #include <resolv.h>
 #include <openssl/hmac.h>
@@ -92,7 +92,7 @@ extract_salt(const char *s, u_int l, char *salt, size_t salt_len)
                     salt_len, ret);
                 return (-1);
         }
-        
+
         return (0);
 }
 
@@ -123,7 +123,7 @@ host_hash(const char *host, const char *name_from_hostfile, u_int src_len)
         HMAC_Final(&mac_ctx, result, NULL);
         HMAC_cleanup(&mac_ctx);
 
-        if (__b64_ntop(salt, len, uu_salt, sizeof(uu_salt)) == -1 || 
+        if (__b64_ntop(salt, len, uu_salt, sizeof(uu_salt)) == -1 ||
             __b64_ntop(result, len, uu_result, sizeof(uu_result)) == -1)
                 fatal("host_hash: __b64_ntop failed");
 
@@ -310,12 +310,12 @@ lookup_key_in_hostfile_by_type(const char *filename, const char *host,
  */
 
 int
-add_host_to_hostfile(const char *filename, const char *host, const Key *key, 
+add_host_to_hostfile(const char *filename, const char *host, const Key *key,
     int store_hash)
 {
         FILE *f;
         int success = 0;
-        char *hashed_host;
+        char *hashed_host = NULL;
 
         if (key == NULL)
                 return 1;       /* XXX ? */
diff --git a/includes.h b/includes.h
index 3d3aa3b21..fa65aa38d 100644
--- a/includes.h
+++ b/includes.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: includes.h,v 1.18 2004/06/13 15:03:02 djm Exp $       */
+/*      $OpenBSD: includes.h,v 1.19 2005/05/19 02:42:26 djm Exp $       */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -17,10 +17,11 @@
 #define INCLUDES_H
 
 #define RCSID(msg) \
-static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
+static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg }
 
 #include "config.h"
 
+#include <stdarg.h>
 #include <stdio.h>
 #include <ctype.h>
 #include <errno.h>
@@ -168,6 +169,10 @@ static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
 # include <ia.h>
 #endif
 
+#ifdef HAVE_IAF_H
+# include <iaf.h>
+#endif
+
 #ifdef HAVE_TMPDIR_H
 # include <tmpdir.h>
 #endif
@@ -181,6 +186,10 @@ static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
 # include <kafs.h>
 #endif
 
+#if defined(HAVE_SYS_SYSLOG_H)
+# include <sys/syslog.h>
+#endif
+
 /*
  * On HP-UX 11.11, shadow.h and prot.h provide conflicting declarations
  * of getspnam when _INCLUDE__STDC__ is defined, so we unset it here.
diff --git a/kex.c b/kex.c
index 3d6f3ab54..8cd851d23 100644
--- a/kex.c
+++ b/kex.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kex.c,v 1.60 2004/06/21 17:36:31 avsm Exp $");
+RCSID("$OpenBSD: kex.c,v 1.64 2005/07/25 11:59:39 markus Exp $");
 
 #include <openssl/crypto.h>
 
@@ -56,7 +56,7 @@ static void kex_choose_conf(Kex *);
 static void
 kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
 {
-        int i;
+        u_int i;
 
         buffer_clear(b);
         /*
@@ -105,7 +105,7 @@ kex_buf2prop(Buffer *raw, int *first_kex_follows)
 static void
 kex_prop_free(char **proposal)
 {
-        int i;
+        u_int i;
 
         for (i = 0; i < PROPOSAL_MAX; i++)
                 xfree(proposal[i]);
@@ -154,7 +154,7 @@ kex_send_kexinit(Kex *kex)
 {
         u_int32_t rnd = 0;
         u_char *cookie;
-        int i;
+        u_int i;
 
         if (kex == NULL) {
                 error("kex_send_kexinit: no kex, cannot rekey");
@@ -187,8 +187,7 @@ void
 kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
 {
         char *ptr;
-        int dlen;
-        int i;
+        u_int i, dlen;
         Kex *kex = (Kex *)ctxt;
 
         debug("SSH2_MSG_KEXINIT received");
@@ -280,10 +279,12 @@ choose_comp(Comp *comp, char *client, char *server)
         char *name = match_list(client, server, NULL);
         if (name == NULL)
                 fatal("no matching comp found: client %s server %s", client, server);
-        if (strcmp(name, "zlib") == 0) {
-                comp->type = 1;
+        if (strcmp(name, "zlib@openssh.com") == 0) {
+                comp->type = COMP_DELAYED;
+        } else if (strcmp(name, "zlib") == 0) {
+                comp->type = COMP_ZLIB;
         } else if (strcmp(name, "none") == 0) {
-                comp->type = 0;
+                comp->type = COMP_NONE;
         } else {
                 fatal("unsupported comp %s", name);
         }
@@ -302,8 +303,11 @@ choose_kex(Kex *k, char *client, char *server)
         } else if (strcmp(k->name, KEX_DHGEX) == 0) {
                 k->kex_type = KEX_DH_GEX_SHA1;
 #ifdef GSSAPI
-        } else if (strncmp(k->name, KEX_GSS_SHA1, 
-            sizeof(KEX_GSS_SHA1)-1) == 0) {
+        } else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,
+            sizeof(KEX_GSS_GEX_SHA1_ID)-1) == 0) {
+                k->kex_type = KEX_GSS_GEX_SHA1;
+        } else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID, 
+            sizeof(KEX_GSS_GRP1_SHA1_ID)-1) == 0) {
                 k->kex_type = KEX_GSS_GRP1_SHA1;
 #endif
         } else
@@ -352,9 +356,7 @@ kex_choose_conf(Kex *kex)
         char **my, **peer;
         char **cprop, **sprop;
         int nenc, nmac, ncomp;
-        int mode;
-        int ctos;                               /* direction: if true client-to-server */
-        int need;
+        u_int mode, ctos, need;
         int first_kex_follows, type;
 
         my   = kex_buf2prop(&kex->my, NULL);
@@ -404,7 +406,7 @@ kex_choose_conf(Kex *kex)
 
         /* ignore the next message if the proposals do not match */
         if (first_kex_follows && !proposals_match(my, peer) &&
-           !(datafellows & SSH_BUG_FIRSTKEX)) {
+            !(datafellows & SSH_BUG_FIRSTKEX)) {
                 type = packet_read();
                 debug2("skipping next packet (type %u)", type);
         }
@@ -414,15 +416,19 @@ kex_choose_conf(Kex *kex)
 }
 
 static u_char *
-derive_key(Kex *kex, int id, int need, u_char *hash, BIGNUM *shared_secret)
+derive_key(Kex *kex, int id, u_int need, u_char *hash, BIGNUM *shared_secret)
 {
         Buffer b;
         const EVP_MD *evp_md = EVP_sha1();
         EVP_MD_CTX md;
         char c = id;
-        int have;
+        u_int have;
         int mdsz = EVP_MD_size(evp_md);
-        u_char *digest = xmalloc(roundup(need, mdsz));
+        u_char *digest;
+
+        if (mdsz < 0)
+                fatal("derive_key: mdsz < 0");
+        digest = xmalloc(roundup(need, mdsz));
 
         buffer_init(&b);
         buffer_put_bignum2(&b, shared_secret);
@@ -464,7 +470,7 @@ void
 kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
 {
         u_char *keys[NKEYS];
-        int i, mode, ctos;
+        u_int i, mode, ctos;
 
         for (i = 0; i < NKEYS; i++)
                 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
@@ -502,13 +508,13 @@ derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
         EVP_DigestInit(&md, evp_md);
 
         len = BN_num_bytes(host_modulus);
-        if (len < (512 / 8) || len > sizeof(nbuf))
+        if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
                 fatal("%s: bad host modulus (len %d)", __func__, len);
         BN_bn2bin(host_modulus, nbuf);
         EVP_DigestUpdate(&md, nbuf, len);
 
         len = BN_num_bytes(server_modulus);
-        if (len < (512 / 8) || len > sizeof(nbuf))
+        if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
                 fatal("%s: bad server modulus (len %d)", __func__, len);
         BN_bn2bin(server_modulus, nbuf);
         EVP_DigestUpdate(&md, nbuf, len);
@@ -527,7 +533,7 @@ derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
 void
 dump_digest(char *msg, u_char *digest, int len)
 {
-        int i;
+        u_int i;
 
         fprintf(stderr, "%s\n", msg);
         for (i = 0; i< len; i++) {
diff --git a/kex.h b/kex.h
index 9536d506c..b458c2d1e 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: kex.h,v 1.35 2004/06/13 12:53:24 djm Exp $    */
+/*      $OpenBSD: kex.h,v 1.37 2005/07/25 11:59:39 markus Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -35,6 +35,10 @@
 #define KEX_DH14        "diffie-hellman-group14-sha1"
 #define KEX_DHGEX       "diffie-hellman-group-exchange-sha1"
 
+#define COMP_NONE       0
+#define COMP_ZLIB       1
+#define COMP_DELAYED    2
+
 enum kex_init_proposals {
         PROPOSAL_KEX_ALGS,
         PROPOSAL_SERVER_HOST_KEY_ALGS,
@@ -60,6 +64,7 @@ enum kex_exchange {
         KEX_DH_GRP14_SHA1,
         KEX_DH_GEX_SHA1,
         KEX_GSS_GRP1_SHA1,
+        KEX_GSS_GEX_SHA1,
         KEX_MAX
 };
 
@@ -84,9 +89,9 @@ struct Mac {
         char    *name;
         int     enabled;
         const EVP_MD    *md;
-        int     mac_len;
+        u_int   mac_len;
         u_char  *key;
-        int     key_len;
+        u_int   key_len;
 };
 struct Comp {
         int     type;
@@ -102,7 +107,7 @@ struct Kex {
         u_char  *session_id;
         u_int   session_id_len;
         Newkeys *newkeys[MODE_MAX];
-        int     we_need;
+        u_int   we_need;
         int     server;
         char    *name;
         int     hostkey_type;
@@ -113,6 +118,8 @@ struct Kex {
         int     flags;
 #ifdef GSSAPI
         int     gss_deleg_creds;
+        int     gss_trust_dns;
+        char    *gss_host;
 #endif
         char    *client_version_string;
         char    *server_version_string;
diff --git a/kexgssc.c b/kexgssc.c
index eee96dd23..1843403b6 100644
--- a/kexgssc.c
+++ b/kexgssc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2001-2004 Simon Wilkinson. All rights reserved.
+ * Copyright (c) 2001-2005 Simon Wilkinson. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,34 +42,68 @@
 
 void
 kexgss_client(Kex *kex) {
-        gss_buffer_desc gssbuf, send_tok, recv_tok, msg_tok, *token_ptr;
+        gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+        gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
         Gssctxt *ctxt;
         OM_uint32 maj_status, min_status, ret_flags;
         unsigned int klen, kout;
         DH *dh; 
-        BIGNUM *dh_server_pub = 0;
-        BIGNUM *shared_secret = 0;      
+        BIGNUM *dh_server_pub = NULL;
+        BIGNUM *shared_secret = NULL;
+        BIGNUM *p = NULL;
+        BIGNUM *g = NULL;       
         unsigned char *kbuf;
         unsigned char *hash;
-        unsigned char *serverhostkey;
+        unsigned char *serverhostkey = NULL;
         char *msg;
         char *lang;
         int type = 0;
         int first = 1;
         int slen = 0;
+        int gex = 0;
+        int nbits, min, max;
         u_int strlen;
-        
+
+        /* Initialise our GSSAPI world */       
         ssh_gssapi_build_ctx(&ctxt);
-        if (ssh_gssapi_id_kex(ctxt,kex->name) == NULL)
+        if (ssh_gssapi_id_kex(ctxt, kex->name, &gex) == NULL)
                 fatal("Couldn't identify host exchange");
 
-        if (ssh_gssapi_import_name(ctxt,get_canonical_hostname(1)))
-                fatal("Couldn't import hostname ");
+        if (ssh_gssapi_import_name(ctxt, kex->gss_host))
+                fatal("Couldn't import hostname");
+        
+        if (gex) {
+                debug("Doing group exchange\n");
+                nbits = dh_estimate(kex->we_need * 8);
+                min = DH_GRP_MIN;
+                max = DH_GRP_MAX;
+                packet_start(SSH2_MSG_KEXGSS_GROUPREQ);
+                packet_put_int(min);
+                packet_put_int(nbits);
+                packet_put_int(max);
+
+                packet_send();
+
+                packet_read_expect(SSH2_MSG_KEXGSS_GROUP);
+
+                if ((p = BN_new()) == NULL)
+                        fatal("BN_new() failed");
+                packet_get_bignum2(p);
+                if ((g = BN_new()) == NULL)
+                        fatal("BN_new() failed");
+                packet_get_bignum2(g);
+                packet_check_eom();
+
+                if (BN_num_bits(p) < min || BN_num_bits(p) > max)
+                        fatal("GSSGRP_GEX group out of range: %d !< %d !< %d",
+                            min, BN_num_bits(p), max);
+
+                dh = dh_new_group(g, p);
+        } else {
+                dh = dh_new_group1();
+        }
         
-        /* This code should match that in ssh_dh1_client */
-                
         /* Step 1 - e is dh->pub_key */
-        dh = dh_new_group1();
         dh_gen_key(dh, kex->we_need * 8);
 
         /* This is f, we initialise it now to make life easier */
@@ -97,7 +131,7 @@ kexgss_client(Kex *kex) {
 
                 /* If we've got an old receive buffer get rid of it */
                 if (token_ptr != GSS_C_NO_BUFFER)
-                        (void) gss_release_buffer(&min_status, &recv_tok);
+                        xfree(recv_tok.value);
 
                 if (maj_status == GSS_S_COMPLETE) {
                         /* If mutual state flag is not true, kex fails */
@@ -126,15 +160,21 @@ kexgss_client(Kex *kex) {
                                     send_tok.length);
                         }
                         packet_send();
+                        gss_release_buffer(&min_status, &send_tok);
 
                         /* If we've sent them data, they should reply */
-                
-                        type = packet_read();
+                        do {    
+                                type = packet_read();
+                                if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
+                                        debug("Received KEXGSS_HOSTKEY");
+                                        if (serverhostkey)
+                                                fatal("Server host key received more than once");
+                                        serverhostkey = 
+                                            packet_get_string(&slen);
+                                }
+                        } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
+
                         switch (type) {
-                        case SSH2_MSG_KEXGSS_HOSTKEY:
-                                debug("Received KEXGSS_HOSTKEY");
-                                serverhostkey = packet_get_string(&slen);
-                                break;
                         case SSH2_MSG_KEXGSS_CONTINUE:
                                 debug("Received GSSAPI_CONTINUE");
                                 if (maj_status == GSS_S_COMPLETE) 
@@ -144,8 +184,8 @@ kexgss_client(Kex *kex) {
                                 break;
                         case SSH2_MSG_KEXGSS_COMPLETE:
                                 debug("Received GSSAPI_COMPLETE");
-                                packet_get_bignum2(dh_server_pub);
-                                msg_tok.value = packet_get_string(&strlen);
+                                packet_get_bignum2(dh_server_pub);
+                                msg_tok.value =  packet_get_string(&strlen);
                                 msg_tok.length = strlen; 
 
                                 /* Is there a token included? */
@@ -156,10 +196,10 @@ kexgss_client(Kex *kex) {
                                         /* If we're already complete - protocol error */
                                         if (maj_status == GSS_S_COMPLETE)
                                                 packet_disconnect("Protocol error: received token when complete");
-                                } else {
-                                        /* No token included */
-                                        if (maj_status != GSS_S_COMPLETE)
-                                                packet_disconnect("Protocol error: did not receive final token");
+                                        } else {
+                                                /* No token included */
+                                                if (maj_status != GSS_S_COMPLETE)
+                                                        packet_disconnect("Protocol error: did not receive final token");
                                 }
                                 break;
                         case SSH2_MSG_KEXGSS_ERROR:
@@ -168,7 +208,7 @@ kexgss_client(Kex *kex) {
                                 min_status = packet_get_int();
                                 msg = packet_get_string(NULL);
                                 lang = packet_get_string(NULL);
-                                fprintf(stderr,"GSSAPI Error: \n%s",msg);
+                                fatal("GSSAPI Error: \n%s",msg);
                         default:
                                 packet_disconnect("Protocol error: didn't expect packet type %d",
                                 type);
@@ -181,12 +221,12 @@ kexgss_client(Kex *kex) {
                 }
         } while (maj_status & GSS_S_CONTINUE_NEEDED);
 
-        /* 
+        /* 
          * We _must_ have received a COMPLETE message in reply from the 
-         * server, which will have set dh_server_pub and msg_tok 
+         * server, which will have set dh_server_pub and msg_tok 
          */
 
-        if (type!=SSH2_MSG_KEXGSS_COMPLETE)
+        if (type != SSH2_MSG_KEXGSS_COMPLETE)
                 fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
 
         /* Check f in range [1, p-1] */
@@ -203,25 +243,45 @@ kexgss_client(Kex *kex) {
         memset(kbuf, 0, klen);
         xfree(kbuf);
 
-        /* The GSS hash is identical to the DH one */
-        hash = kex_dh_hash( kex->client_version_string, 
-            kex->server_version_string,
-            buffer_ptr(&kex->my), buffer_len(&kex->my),
-            buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-            serverhostkey, slen, /* server host key */
-            dh->pub_key,        /* e */
-            dh_server_pub,      /* f */
-            shared_secret       /* K */
-        );
-        
+        if (gex) {
+                hash = kexgex_hash( kex->client_version_string,
+                    kex->server_version_string,
+                    buffer_ptr(&kex->my), buffer_len(&kex->my),
+                    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+                    serverhostkey, slen,
+                    min, nbits, max,
+                    dh->p, dh->g,
+                    dh->pub_key,
+                    dh_server_pub,
+                    shared_secret
+                );
+        } else {
+                /* The GSS hash is identical to the DH one */
+                hash = kex_dh_hash( kex->client_version_string, 
+                    kex->server_version_string,
+                    buffer_ptr(&kex->my), buffer_len(&kex->my),
+                    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+                    serverhostkey, slen, /* server host key */
+                    dh->pub_key,        /* e */
+                    dh_server_pub,      /* f */
+                    shared_secret       /* K */
+                );
+        }
+
         gssbuf.value = hash;
         gssbuf.length = 20;
 
         /* Verify that the hash matches the MIC we just got. */
         if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
                 packet_disconnect("Hash's MIC didn't verify");
-        
+
+        xfree(msg_tok.value);
+
         DH_free(dh);
+        if (serverhostkey)
+                xfree(serverhostkey);
+        BN_clear_free(dh_server_pub);
+
         /* save session id */
         if (kex->session_id == NULL) {
                 kex->session_id_len = 20;
diff --git a/kexgsss.c b/kexgsss.c
index 80c133ac9..268eeccae 100644
--- a/kexgsss.c
+++ b/kexgsss.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2001-2004 Simon Wilkinson. All rights reserved.
+ * Copyright (c) 2001-2005 Simon Wilkinson. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,21 +53,31 @@ kexgss_server(Kex *kex)
          */
 
         OM_uint32 ret_flags = 0;
-        gss_buffer_desc gssbuf, send_tok, recv_tok, msg_tok;
+        gss_buffer_desc gssbuf, recv_tok, msg_tok;
+        gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
         Gssctxt *ctxt = NULL;
         unsigned int klen, kout;
         unsigned char *kbuf, *hash;
         DH *dh;
+        int min = -1, max = -1, nbits = -1;
         BIGNUM *shared_secret = NULL;
         BIGNUM *dh_client_pub = NULL;
-        int type =0;
+        int type = 0;
+        int gex;
         u_int slen;
         gss_OID oid;
         
         /* Initialise GSSAPI */
 
+        /* If we're rekeying, privsep means that some of the private structures
+         * in the GSSAPI code are no longer available. This kludges them back
+         * into life
+         */
+        if (!ssh_gssapi_oid_table_ok()) 
+                ssh_gssapi_server_mechanisms();
+
         debug2("%s: Identifying %s", __func__, kex->name);
-        oid = ssh_gssapi_id_kex(NULL, kex->name);
+        oid = ssh_gssapi_id_kex(NULL, kex->name, &gex);
         if (oid == NULL)
            fatal("Unknown gssapi mechanism");
 
@@ -76,6 +86,34 @@ kexgss_server(Kex *kex)
         if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
                 fatal("Unable to acquire credentials for the server");
 
+        if (gex) {
+                debug("Doing group exchange");
+                packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);
+                min = packet_get_int();
+                nbits = packet_get_int();
+                max = packet_get_int();
+                min = MAX(DH_GRP_MIN, min);
+                max = MIN(DH_GRP_MAX, max);
+                packet_check_eom();
+                if (max < min || nbits < min || max < nbits)
+                        fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
+                            min, nbits, max);
+                dh = PRIVSEP(choose_dh(min, nbits, max));
+                if (dh == NULL)
+                        packet_disconnect("Protocol error: no matching group found");
+
+                packet_start(SSH2_MSG_KEXGSS_GROUP);
+                packet_put_bignum2(dh->p);
+                packet_put_bignum2(dh->g);
+                packet_send();
+
+                packet_write_wait();
+                
+        } else {
+                dh = dh_new_group1();
+        }
+        dh_gen_key(dh, kex->we_need * 8);
+
         do {
                 debug("Wait SSH2_MSG_GSSAPI_INIT");
                 type = packet_read();
@@ -86,10 +124,9 @@ kexgss_server(Kex *kex)
                         recv_tok.value = packet_get_string(&slen);
                         recv_tok.length = slen; 
 
-                        dh_client_pub = BN_new();
-
-                        if (dh_client_pub == NULL)
+                        if ((dh_client_pub = BN_new()) == NULL)
                                 fatal("dh_client_pub == NULL");
+
                         packet_get_bignum2(dh_client_pub);
 
                         /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
@@ -107,8 +144,8 @@ kexgss_server(Kex *kex)
                 maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, 
                     &send_tok, &ret_flags));
 
-                gss_release_buffer(&min_status, &recv_tok);
-                
+                xfree(recv_tok.value);
+
                 if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
                         fatal("Zero length token output when incomplete");
 
@@ -125,7 +162,7 @@ kexgss_server(Kex *kex)
         } while (maj_status & GSS_S_CONTINUE_NEEDED);
 
         if (GSS_ERROR(maj_status)) {
-                if (send_tok.length>0) {
+                if (send_tok.length > 0) {
                         packet_start(SSH2_MSG_KEXGSS_CONTINUE);
                         packet_put_string(send_tok.value, send_tok.length);
                         packet_send();
@@ -139,9 +176,6 @@ kexgss_server(Kex *kex)
         if (!(ret_flags & GSS_C_INTEG_FLAG))
                 fatal("Integrity flag wasn't set");
         
-        dh = dh_new_group1();
-        dh_gen_key(dh, kex->we_need * 8);
-
         if (!dh_pub_is_valid(dh, dh_client_pub))
                 packet_disconnect("bad client public DH value");
 
@@ -154,14 +188,29 @@ kexgss_server(Kex *kex)
         memset(kbuf, 0, klen);
         xfree(kbuf);
 
-        /* The GSSAPI hash is identical to the Diffie Helman one */
-        hash = kex_dh_hash(
-            kex->client_version_string, kex->server_version_string,
-            buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-            buffer_ptr(&kex->my), buffer_len(&kex->my),
-            NULL, 0, /* Change this if we start sending host keys */
-            dh_client_pub, dh->pub_key, shared_secret
-        );
+        if (gex) {
+                hash = kexgex_hash(
+                    kex->client_version_string, kex->server_version_string,
+                    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+                    buffer_ptr(&kex->my), buffer_len(&kex->my),
+                    NULL, 0,
+                    min, nbits, max,
+                    dh->p, dh->g,
+                    dh_client_pub,
+                    dh->pub_key,
+                    shared_secret
+                );
+        }
+        else {  
+                /* The GSSAPI hash is identical to the Diffie Helman one */
+                hash = kex_dh_hash(
+                    kex->client_version_string, kex->server_version_string,
+                    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
+                    buffer_ptr(&kex->my), buffer_len(&kex->my),
+                    NULL, 0, /* Change this if we start sending host keys */
+                    dh_client_pub, dh->pub_key, shared_secret
+                );
+        }
         BN_free(dh_client_pub);
 
         if (kex->session_id == NULL) {
@@ -180,7 +229,7 @@ kexgss_server(Kex *kex)
         packet_put_bignum2(dh->pub_key);
         packet_put_string((char *)msg_tok.value,msg_tok.length);
 
-        if (send_tok.length!=0) {
+        if (send_tok.length != 0) {
                 packet_put_char(1); /* true */
                 packet_put_string((char *)send_tok.value, send_tok.length);
         } else {
@@ -188,7 +237,8 @@ kexgss_server(Kex *kex)
         }
         packet_send();
 
-        gss_release_buffer(&min_status, &send_tok);     
+        gss_release_buffer(&min_status, &send_tok);
+        gss_release_buffer(&min_status, &msg_tok);
 
         if (gss_kex_context == NULL)
                 gss_kex_context = ctxt;
diff --git a/key.c b/key.c
index db401cb12..239a35919 100644
--- a/key.c
+++ b/key.c
@@ -32,7 +32,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: key.c,v 1.57 2004/10/29 23:57:05 djm Exp $");
+RCSID("$OpenBSD: key.c,v 1.58 2005/06/17 02:44:32 djm Exp $");
 
 #include <openssl/evp.h>
 
@@ -231,7 +231,7 @@ static char *
 key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len)
 {
         char *retval;
-        int i;
+        u_int i;
 
         retval = xmalloc(dgst_raw_len * 3 + 1);
         retval[0] = '\0';
diff --git a/log.c b/log.c
index e55a54f16..96ab24b04 100644
--- a/log.c
+++ b/log.c
@@ -196,6 +196,7 @@ log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
 #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
         struct syslog_data sdata = SYSLOG_DATA_INIT;
 #endif
+
         argv0 = av0;
 
         switch (level) {
diff --git a/loginrec.c b/loginrec.c
index 361ac4cb7..c3783c991 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -165,7 +165,7 @@
 # include <libutil.h>
 #endif
 
-RCSID("$Id: loginrec.c,v 1.67 2005/02/15 11:19:28 dtucker Exp $");
+RCSID("$Id: loginrec.c,v 1.70 2005/07/17 07:26:44 djm Exp $");
 
 /**
  ** prototypes for helper functions in this file
@@ -362,7 +362,7 @@ login_init_entry(struct logininfo *li, int pid, const char *username,
                 strlcpy(li->username, username, sizeof(li->username));
                 pw = getpwnam(li->username);
                 if (pw == NULL) {
-                        fatal("%s: Cannot find user \"%s\"", __func__, 
+                        fatal("%s: Cannot find user \"%s\"", __func__,
                             li->username);
                 }
                 li->uid = pw->pw_uid;
@@ -374,7 +374,7 @@ login_init_entry(struct logininfo *li, int pid, const char *username,
         return (1);
 }
 
-/* 
+/*
  * login_set_current_time(struct logininfo *)    - set the current time
  *
  * Set the current time in a logininfo structure. This function is
@@ -443,8 +443,9 @@ login_write(struct logininfo *li)
         wtmpx_write_entry(li);
 #endif
 #ifdef CUSTOM_SYS_AUTH_RECORD_LOGIN
-        if (li->type == LTYPE_LOGIN && 
-           !sys_auth_record_login(li->username,li->hostname,li->line, &loginmsg))
+        if (li->type == LTYPE_LOGIN &&
+            !sys_auth_record_login(li->username,li->hostname,li->line,
+            &loginmsg))
                 logit("Writing login record failed for %s", li->username);
 #endif
 #ifdef SSH_AUDIT_EVENTS
@@ -534,7 +535,7 @@ getlast_entry(struct logininfo *li)
  * sure dst has enough space, if not just copy src (ugh)
  */
 char *
-line_fullname(char *dst, const char *src, int dstsize)
+line_fullname(char *dst, const char *src, u_int dstsize)
 {
         memset(dst, '\0', dstsize);
         if ((strncmp(src, "/dev/", 5) == 0) || (dstsize < (strlen(src) + 5)))
@@ -558,7 +559,7 @@ line_stripname(char *dst, const char *src, int dstsize)
         return (dst);
 }
 
-/* 
+/*
  * line_abbrevname(): Return the abbreviated (usually four-character)
  * form of the line (Just use the last <dstsize> characters of the
  * full name.)
@@ -808,7 +809,7 @@ utmp_write_library(struct logininfo *li, struct utmp *ut)
 }
 # else /* UTMP_USE_LIBRARY */
 
-/* 
+/*
  * Write a utmp entry direct to the file
  * This is a slightly modification of code in OpenBSD's login.c
  */
@@ -852,7 +853,7 @@ utmp_write_direct(struct logininfo *li, struct utmp *ut)
                         return (0);
                 }
                 if (ret != pos) {
-                        logit("%s: Couldn't seek to tty %d slot in %s", 
+                        logit("%s: Couldn't seek to tty %d slot in %s",
                             __func__, tty, UTMP_FILE);
                         return (0);
                 }
@@ -1052,7 +1053,7 @@ utmpx_write_entry(struct logininfo *li)
 
 #ifdef USE_WTMP
 
-/* 
+/*
  * Write a wtmp entry direct to the end of the file
  * This is a slight modification of code in OpenBSD's logwtmp.c
  */
@@ -1113,7 +1114,7 @@ wtmp_write_entry(struct logininfo *li)
 }
 
 
-/* 
+/*
  * Notes on fetching login data from wtmp/wtmpx
  *
  * Logouts are usually recorded with (amongst other things) a blank
@@ -1157,12 +1158,12 @@ wtmp_get_entry(struct logininfo *li)
         li->tv_sec = li->tv_usec = 0;
 
         if ((fd = open(WTMP_FILE, O_RDONLY)) < 0) {
-                logit("%s: problem opening %s: %s", __func__, 
+                logit("%s: problem opening %s: %s", __func__,
                     WTMP_FILE, strerror(errno));
                 return (0);
         }
         if (fstat(fd, &st) != 0) {
-                logit("%s: couldn't stat %s: %s", __func__, 
+                logit("%s: couldn't stat %s: %s", __func__,
                     WTMP_FILE, strerror(errno));
                 close(fd);
                 return (0);
@@ -1177,7 +1178,7 @@ wtmp_get_entry(struct logininfo *li)
 
         while (!found) {
                 if (atomicio(read, fd, &ut, sizeof(ut)) != sizeof(ut)) {
-                        logit("%s: read of %s failed: %s", __func__, 
+                        logit("%s: read of %s failed: %s", __func__,
                             WTMP_FILE, strerror(errno));
                         close (fd);
                         return (0);
@@ -1235,7 +1236,7 @@ wtmpx_write(struct logininfo *li, struct utmpx *utx)
         int fd, ret = 1;
 
         if ((fd = open(WTMPX_FILE, O_WRONLY|O_APPEND, 0)) < 0) {
-                logit("%s: problem opening %s: %s", __func__, 
+                logit("%s: problem opening %s: %s", __func__,
                     WTMPX_FILE, strerror(errno));
                 return (0);
         }
@@ -1322,12 +1323,12 @@ wtmpx_get_entry(struct logininfo *li)
         li->tv_sec = li->tv_usec = 0;
 
         if ((fd = open(WTMPX_FILE, O_RDONLY)) < 0) {
-                logit("%s: problem opening %s: %s", __func__, 
+                logit("%s: problem opening %s: %s", __func__,
                     WTMPX_FILE, strerror(errno));
                 return (0);
         }
         if (fstat(fd, &st) != 0) {
-                logit("%s: couldn't stat %s: %s", __func__, 
+                logit("%s: couldn't stat %s: %s", __func__,
                     WTMPX_FILE, strerror(errno));
                 close(fd);
                 return (0);
@@ -1342,13 +1343,13 @@ wtmpx_get_entry(struct logininfo *li)
 
         while (!found) {
                 if (atomicio(read, fd, &utx, sizeof(utx)) != sizeof(utx)) {
-                        logit("%s: read of %s failed: %s", __func__, 
+                        logit("%s: read of %s failed: %s", __func__,
                             WTMPX_FILE, strerror(errno));
                         close (fd);
                         return (0);
                 }
                 /*
-                 * Logouts are recorded as a blank username on a particular 
+                 * Logouts are recorded as a blank username on a particular
                  * line. So, we just need to find the username in struct utmpx
                  */
                 if (wtmpx_islogin(li, &utx)) {
diff --git a/loginrec.h b/loginrec.h
index d1a12a853..8e3390178 100644
--- a/loginrec.h
+++ b/loginrec.h
@@ -35,7 +35,7 @@
 #include <netinet/in.h>
 #include <sys/socket.h>
 
-/* RCSID("$Id: loginrec.h,v 1.9 2005/02/02 06:10:11 dtucker Exp $"); */
+/* RCSID("$Id: loginrec.h,v 1.10 2005/06/19 00:19:44 djm Exp $"); */
 
 /**
  ** you should use the login_* calls to work around platform dependencies
@@ -128,7 +128,7 @@ struct logininfo *login_get_lastlog(struct logininfo *li, const int uid);
 unsigned int login_get_lastlog_time(const int uid);
 
 /* produce various forms of the line filename */
-char *line_fullname(char *dst, const char *src, int dstsize);
+char *line_fullname(char *dst, const char *src, u_int dstsize);
 char *line_stripname(char *dst, const char *src, int dstsize);
 char *line_abbrevname(char *dst, const char *src, int dstsize);
 
diff --git a/mac.c b/mac.c
index 097f0b93b..2bda5a1b9 100644
--- a/mac.c
+++ b/mac.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: mac.c,v 1.6 2003/09/18 13:02:21 miod Exp $");
+RCSID("$OpenBSD: mac.c,v 1.7 2005/06/17 02:44:32 djm Exp $");
 
 #include <openssl/hmac.h>
 
@@ -51,12 +51,15 @@ struct {
 int
 mac_init(Mac *mac, char *name)
 {
-        int i;
+        int i, evp_len;
+
         for (i = 0; macs[i].name; i++) {
                 if (strcmp(name, macs[i].name) == 0) {
                         if (mac != NULL) {
                                 mac->md = (*macs[i].mdfunc)();
-                                mac->key_len = mac->mac_len = EVP_MD_size(mac->md);
+                                if ((evp_len = EVP_MD_size(mac->md)) <= 0)
+                                        fatal("mac %s len %d", name, evp_len);
+                                mac->key_len = mac->mac_len = (u_int)evp_len;
                                 if (macs[i].truncatebits != 0)
                                         mac->mac_len = macs[i].truncatebits/8;
                         }
@@ -77,7 +80,7 @@ mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
 
         if (mac->key == NULL)
                 fatal("mac_compute: no key");
-        if ((u_int)mac->mac_len > sizeof(m))
+        if (mac->mac_len > sizeof(m))
                 fatal("mac_compute: mac too long");
         HMAC_Init(&c, mac->key, mac->key_len, mac->md);
         PUT_32BIT(b, seqno);
diff --git a/match.c b/match.c
index 3ddb62730..29fb7dab9 100644
--- a/match.c
+++ b/match.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: match.c,v 1.19 2002/03/01 13:12:10 markus Exp $");
+RCSID("$OpenBSD: match.c,v 1.20 2005/06/17 02:44:32 djm Exp $");
 
 #include "match.h"
 #include "xmalloc.h"
@@ -254,7 +254,7 @@ match_list(const char *client, const char *server, u_int *next)
                                 ret = xstrdup(p);
                                 if (next != NULL)
                                         *next = (cp == NULL) ?
-                                            strlen(c) : cp - c;
+                                            strlen(c) : (u_int)(cp - c);
                                 xfree(c);
                                 xfree(s);
                                 return ret;
diff --git a/mdoc2man.awk b/mdoc2man.awk
index 4e72cdc1c..d6eaf4601 100644
--- a/mdoc2man.awk
+++ b/mdoc2man.awk
@@ -140,6 +140,9 @@ function add(str) {
     } else if(match(words[w],"^Dt$")) {
       id=wtail()
       next
+    } else if(match(words[w],"^Ox$")) {
+      add("OpenBSD")
+      skip=1
     } else if(match(words[w],"^Os$")) {
       add(".TH " id " \"" date "\" \"" wtail() "\"")
     } else if(match(words[w],"^Sh$")) {
diff --git a/misc.c b/misc.c
index 2e366f81b..2dd8ae6e3 100644
--- a/misc.c
+++ b/misc.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ * Copyright (c) 2005 Damien Miller.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,7 +24,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: misc.c,v 1.28 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: misc.c,v 1.34 2005/07/08 09:26:18 dtucker Exp $");
 
 #include "misc.h"
 #include "log.h"
@@ -303,13 +304,13 @@ hpdelim(char **cp)
         case '\0':
                 *cp = NULL;     /* no more fields*/
                 break;
-        
+
         case ':':
         case '/':
                 *s = '\0';      /* terminate */
                 *cp = s + 1;
                 break;
-        
+
         default:
                 return NULL;
         }
@@ -376,6 +377,114 @@ addargs(arglist *args, char *fmt, ...)
 }
 
 /*
+ * Expands tildes in the file name.  Returns data allocated by xmalloc.
+ * Warning: this calls getpw*.
+ */
+char *
+tilde_expand_filename(const char *filename, uid_t uid)
+{
+        const char *path;
+        char user[128], ret[MAXPATHLEN];
+        struct passwd *pw;
+        u_int len, slash;
+
+        if (*filename != '~')
+                return (xstrdup(filename));
+        filename++;
+
+        path = strchr(filename, '/');
+        if (path != NULL && path > filename) {          /* ~user/path */
+                slash = path - filename;
+                if (slash > sizeof(user) - 1)
+                        fatal("tilde_expand_filename: ~username too long");
+                memcpy(user, filename, slash);
+                user[slash] = '\0';
+                if ((pw = getpwnam(user)) == NULL)
+                        fatal("tilde_expand_filename: No such user %s", user);
+        } else if ((pw = getpwuid(uid)) == NULL)        /* ~/path */
+                fatal("tilde_expand_filename: No such uid %d", uid);
+
+        if (strlcpy(ret, pw->pw_dir, sizeof(ret)) >= sizeof(ret))
+                fatal("tilde_expand_filename: Path too long");
+
+        /* Make sure directory has a trailing '/' */
+        len = strlen(pw->pw_dir);
+        if ((len == 0 || pw->pw_dir[len - 1] != '/') &&
+            strlcat(ret, "/", sizeof(ret)) >= sizeof(ret))
+                fatal("tilde_expand_filename: Path too long");
+
+        /* Skip leading '/' from specified path */
+        if (path != NULL)
+                filename = path + 1;
+        if (strlcat(ret, filename, sizeof(ret)) >= sizeof(ret))
+                fatal("tilde_expand_filename: Path too long");
+
+        return (xstrdup(ret));
+}
+
+/*
+ * Expand a string with a set of %[char] escapes. A number of escapes may be
+ * specified as (char *escape_chars, char *replacement) pairs. The list must
+ * be terminated by a NULL escape_char. Returns replaced string in memory
+ * allocated by xmalloc.
+ */
+char *
+percent_expand(const char *string, ...)
+{
+#define EXPAND_MAX_KEYS 16
+        struct {
+                const char *key;
+                const char *repl;
+        } keys[EXPAND_MAX_KEYS];
+        u_int num_keys, i, j;
+        char buf[4096];
+        va_list ap;
+
+        /* Gather keys */
+        va_start(ap, string);
+        for (num_keys = 0; num_keys < EXPAND_MAX_KEYS; num_keys++) {
+                keys[num_keys].key = va_arg(ap, char *);
+                if (keys[num_keys].key == NULL)
+                        break;
+                keys[num_keys].repl = va_arg(ap, char *);
+                if (keys[num_keys].repl == NULL)
+                        fatal("percent_expand: NULL replacement");
+        }
+        va_end(ap);
+
+        if (num_keys >= EXPAND_MAX_KEYS)
+                fatal("percent_expand: too many keys");
+
+        /* Expand string */
+        *buf = '\0';
+        for (i = 0; *string != '\0'; string++) {
+                if (*string != '%') {
+ append:
+                        buf[i++] = *string;
+                        if (i >= sizeof(buf))
+                                fatal("percent_expand: string too long");
+                        buf[i] = '\0';
+                        continue;
+                }
+                string++;
+                if (*string == '%')
+                        goto append;
+                for (j = 0; j < num_keys; j++) {
+                        if (strchr(keys[j].key, *string) != NULL) {
+                                i = strlcat(buf, keys[j].repl, sizeof(buf));
+                                if (i >= sizeof(buf))
+                                        fatal("percent_expand: string too long");
+                                break;
+                        }
+                }
+                if (j >= num_keys)
+                        fatal("percent_expand: unknown key %%%c", *string);
+        }
+        return (xstrdup(buf));
+#undef EXPAND_MAX_KEYS
+}
+
+/*
  * Read an entire line from a public key file into a static buffer, discarding
  * lines that exceed the buffer size.  Returns 0 on success, -1 on failure.
  */
@@ -391,9 +500,26 @@ read_keyfile_line(FILE *f, const char *filename, char *buf, size_t bufsz,
                         debug("%s: %s line %lu exceeds size limit", __func__,
                             filename, *lineno);
                         /* discard remainder of line */
-                        while(fgetc(f) != '\n' && !feof(f))
+                        while (fgetc(f) != '\n' && !feof(f))
                                 ;       /* nothing */
                 }
         }
         return -1;
 }
+
+char *
+tohex(const u_char *d, u_int l)
+{
+        char b[3], *r;
+        u_int i, hl;
+
+        hl = l * 2 + 1;
+        r = xmalloc(hl);
+        *r = '\0';
+        for (i = 0; i < l; i++) {
+                snprintf(b, sizeof(b), "%02x", d[i]);
+                strlcat(r, b, hl);
+        }
+        return (r);
+}
+
diff --git a/misc.h b/misc.h
index 8bbc87f0d..2d630feb5 100644
--- a/misc.h
+++ b/misc.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: misc.h,v 1.21 2005/03/01 10:09:52 djm Exp $   */
+/*      $OpenBSD: misc.h,v 1.25 2005/07/14 04:00:43 dtucker Exp $       */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -24,6 +24,9 @@ char	*hpdelim(char **);
 char    *cleanhostname(char *);
 char    *colon(char *);
 long     convtime(const char *);
+char    *tilde_expand_filename(const char *, uid_t);
+char    *percent_expand(const char *, ...) __attribute__((__sentinel__));
+char    *tohex(const u_char *, u_int);
 
 struct passwd *pwcopy(struct passwd *);
 
@@ -35,10 +38,6 @@ struct arglist {
 };
 void     addargs(arglist *, char *, ...) __attribute__((format(printf, 2, 3)));
 
-/* tildexpand.c */
-
-char    *tilde_expand_filename(const char *, uid_t);
-
 /* readpass.c */
 
 #define RP_ECHO                 0x0001
diff --git a/moduli.c b/moduli.c
index 8b05248e2..d53806ea6 100644
--- a/moduli.c
+++ b/moduli.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: moduli.c,v 1.10 2005/01/17 03:25:46 dtucker Exp $ */
+/* $OpenBSD: moduli.c,v 1.12 2005/07/17 07:17:55 djm Exp $ */
 /*
  * Copyright 1994 Phil Karn <karn@qualcomm.com>
  * Copyright 1996-1998, 2003 William Allen Simpson <wsimpson@greendragon.com>
@@ -112,22 +112,22 @@
 #define TINY_NUMBER     (1UL<<16)
 
 /* Ensure enough bit space for testing 2*q. */
-#define TEST_MAXIMUM    (1UL<<16)
-#define TEST_MINIMUM    (QSIZE_MINIMUM + 1)
-/* real TEST_MINIMUM    (1UL << (SHIFT_WORD - TEST_POWER)) */
-#define TEST_POWER      (3)     /* 2**n, n < SHIFT_WORD */
+#define TEST_MAXIMUM    (1UL<<16)
+#define TEST_MINIMUM    (QSIZE_MINIMUM + 1)
+/* real TEST_MINIMUM    (1UL << (SHIFT_WORD - TEST_POWER)) */
+#define TEST_POWER      (3)     /* 2**n, n < SHIFT_WORD */
 
 /* bit operations on 32-bit words */
-#define BIT_CLEAR(a,n)  ((a)[(n)>>SHIFT_WORD] &= ~(1L << ((n) & 31)))
-#define BIT_SET(a,n)    ((a)[(n)>>SHIFT_WORD] |= (1L << ((n) & 31)))
-#define BIT_TEST(a,n)   ((a)[(n)>>SHIFT_WORD] & (1L << ((n) & 31)))
+#define BIT_CLEAR(a,n)  ((a)[(n)>>SHIFT_WORD] &= ~(1L << ((n) & 31)))
+#define BIT_SET(a,n)    ((a)[(n)>>SHIFT_WORD] |= (1L << ((n) & 31)))
+#define BIT_TEST(a,n)   ((a)[(n)>>SHIFT_WORD] & (1L << ((n) & 31)))
 
 /*
  * Prime testing defines
  */
 
 /* Minimum number of primality tests to perform */
-#define TRIAL_MINIMUM           (4)
+#define TRIAL_MINIMUM   (4)
 
 /*
  * Sieving data (XXX - move to struct)
@@ -144,7 +144,7 @@ static u_int32_t *LargeSieve, largewords, largetries, largenumbers;
 static u_int32_t largebits, largememory;        /* megabytes */
 static BIGNUM *largebase;
 
-int gen_candidates(FILE *, int, int, BIGNUM *);
+int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
 int prime_test(FILE *, FILE *, u_int32_t, u_int32_t);
 
 /*
@@ -241,19 +241,20 @@ sieve_large(u_int32_t s)
  * The list is checked against small known primes (less than 2**30).
  */
 int
-gen_candidates(FILE *out, int memory, int power, BIGNUM *start)
+gen_candidates(FILE *out, u_int32_t memory, u_int32_t power, BIGNUM *start)
 {
         BIGNUM *q;
         u_int32_t j, r, s, t;
         u_int32_t smallwords = TINY_NUMBER >> 6;
         u_int32_t tinywords = TINY_NUMBER >> 6;
         time_t time_start, time_stop;
-        int i, ret = 0;
+        u_int32_t i;
+        int ret = 0;
 
         largememory = memory;
 
         if (memory != 0 &&
-           (memory < LARGE_MINIMUM || memory > LARGE_MAXIMUM)) {
+            (memory < LARGE_MINIMUM || memory > LARGE_MAXIMUM)) {
                 error("Invalid memory amount (min %ld, max %ld)",
                     LARGE_MINIMUM, LARGE_MAXIMUM);
                 return (-1);
@@ -371,8 +372,8 @@ gen_candidates(FILE *out, int memory, int power, BIGNUM *start)
          * fencepost errors, the last pass is skipped.
          */
         for (smallbase = TINY_NUMBER + 3;
-             smallbase < (SMALL_MAXIMUM - TINY_NUMBER);
-             smallbase += TINY_NUMBER) {
+            smallbase < (SMALL_MAXIMUM - TINY_NUMBER);
+            smallbase += TINY_NUMBER) {
                 for (i = 0; i < tinybits; i++) {
                         if (BIT_TEST(TinySieve, i))
                                 continue; /* 2*i+3 is composite */
@@ -548,7 +549,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                  * due to earlier inconsistencies in interpretation, check
                  * the proposed bit size.
                  */
-                if (BN_num_bits(p) != (in_size + 1)) {
+                if ((u_int32_t)BN_num_bits(p) != (in_size + 1)) {
                         debug2("%10u: bit size %u mismatch", count_in, in_size);
                         continue;
                 }
diff --git a/monitor.c b/monitor.c
index b57b53f21..86fe23931 100644
--- a/monitor.c
+++ b/monitor.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.62 2005/01/30 11:18:08 dtucker Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.63 2005/03/10 22:01:05 deraadt Exp $");
 
 #include <openssl/dh.h>
 
@@ -317,6 +317,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
         authctxt = _authctxt;
         memset(authctxt, 0, sizeof(*authctxt));
 
+        authctxt->loginmsg = &loginmsg;
+
         if (compat20) {
                 mon_dispatch = mon_dispatch_proto20;
 
@@ -882,8 +884,8 @@ int
 mm_answer_pam_query(int sock, Buffer *m)
 {
         char *name, *info, **prompts;
-        u_int num, *echo_on;
-        int i, ret;
+        u_int i, num, *echo_on;
+        int ret;
 
         debug3("%s", __func__);
         sshpam_authok = NULL;
@@ -916,8 +918,8 @@ int
 mm_answer_pam_respond(int sock, Buffer *m)
 {
         char **resp;
-        u_int num;
-        int i, ret;
+        u_int i, num;
+        int ret;
 
         debug3("%s", __func__);
         sshpam_authok = NULL;
@@ -991,7 +993,7 @@ mm_answer_keyallowed(int sock, Buffer *m)
         debug3("%s: key_from_blob: %p", __func__, key);
 
         if (key != NULL && authctxt->valid) {
-                switch(type) {
+                switch (type) {
                 case MM_USERKEY:
                         allowed = options.pubkey_authentication &&
                             user_key_allowed(authctxt->pw, key);
@@ -1538,7 +1540,6 @@ mm_answer_audit_event(int socket, Buffer *m)
         debug3("%s entering", __func__);
 
         event = buffer_get_int(m);
-        buffer_free(m);
         switch(event) {
         case SSH_AUTH_FAIL_PUBKEY:
         case SSH_AUTH_FAIL_HOSTBASED:
@@ -1567,7 +1568,6 @@ mm_answer_audit_command(int socket, Buffer *m)
         /* sanity check command, if so how? */
         audit_run_command(cmd);
         xfree(cmd);
-        buffer_free(m);
         return (0);
 }
 #endif /* SSH_AUDIT_EVENTS */
@@ -1640,6 +1640,7 @@ mm_get_kex(Buffer *m)
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
 #ifdef GSSAPI
         kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
+        kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
 #endif
         kex->server = 1;
         kex->hostkey_type = buffer_get_int(m);
@@ -1938,10 +1939,13 @@ mm_answer_gss_userok(int sock, Buffer *m)
 int 
 mm_answer_gss_sign(int socket, Buffer *m)
 {
-        gss_buffer_desc data, hash;
+        gss_buffer_desc data;
+        gss_buffer_desc hash = GSS_C_EMPTY_BUFFER;
         OM_uint32 major, minor;
+        u_int len;
 
-        data.value = buffer_get_string(m, &data.length);
+        data.value = buffer_get_string(m, &len);
+        data.length = len;
         if (data.length != 20) 
                 fatal("%s: data length incorrect: %d", __func__, data.length);
 
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 482ff5bc3..72b75d50a 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor_wrap.c,v 1.39 2004/07/17 05:31:41 dtucker Exp $");
+RCSID("$OpenBSD: monitor_wrap.c,v 1.40 2005/05/24 17:32:43 avsm Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/dh.h>
@@ -95,9 +95,9 @@ mm_request_send(int sock, enum monitor_reqtype type, Buffer *m)
         PUT_32BIT(buf, mlen + 1);
         buf[4] = (u_char) type;         /* 1st byte of payload is mesg-type */
         if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf))
-                fatal("%s: write", __func__);
+                fatal("%s: write: %s", __func__, strerror(errno));
         if (atomicio(vwrite, sock, buffer_ptr(m), mlen) != mlen)
-                fatal("%s: write", __func__);
+                fatal("%s: write: %s", __func__, strerror(errno));
 }
 
 void
@@ -105,24 +105,21 @@ mm_request_receive(int sock, Buffer *m)
 {
         u_char buf[4];
         u_int msg_len;
-        ssize_t res;
 
         debug3("%s entering", __func__);
 
-        res = atomicio(read, sock, buf, sizeof(buf));
-        if (res != sizeof(buf)) {
-                if (res == 0)
+        if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) {
+                if (errno == EPIPE)
                         cleanup_exit(255);
-                fatal("%s: read: %ld", __func__, (long)res);
+                fatal("%s: read: %s", __func__, strerror(errno));
         }
         msg_len = GET_32BIT(buf);
         if (msg_len > 256 * 1024)
                 fatal("%s: read: bad msg_len %d", __func__, msg_len);
         buffer_clear(m);
         buffer_append_space(m, msg_len);
-        res = atomicio(read, sock, buffer_ptr(m), msg_len);
-        if (res != msg_len)
-                fatal("%s: read: %ld != msg_len", __func__, (long)res);
+        if (atomicio(read, sock, buffer_ptr(m), msg_len) != msg_len)
+                fatal("%s: read: %s", __func__, strerror(errno));
 }
 
 void
@@ -767,7 +764,8 @@ mm_sshpam_query(void *ctx, char **name, char **info,
     u_int *num, char ***prompts, u_int **echo_on)
 {
         Buffer m;
-        int i, ret;
+        u_int i;
+        int ret;
 
         debug3("%s", __func__);
         buffer_init(&m);
@@ -793,7 +791,8 @@ int
 mm_sshpam_respond(void *ctx, u_int num, char **resp)
 {
         Buffer m;
-        int i, ret;
+        u_int i;
+        int ret;
 
         debug3("%s", __func__);
         buffer_init(&m);
@@ -1223,6 +1222,7 @@ mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
 {
         Buffer m;
         OM_uint32 major;
+        u_int len;
 
         buffer_init(&m);
         buffer_put_string(&m, data->value, data->length);
@@ -1231,7 +1231,8 @@ mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
         mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
 
         major = buffer_get_int(&m);
-        hash->value = buffer_get_string(&m, &hash->length);
+        hash->value = buffer_get_string(&m, &len);
+        hash->length = len;
 
         buffer_free(&m);
 
diff --git a/msg.c b/msg.c
index 30bc3f107..3e4c2882c 100644
--- a/msg.c
+++ b/msg.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: msg.c,v 1.7 2003/11/17 09:45:39 djm Exp $");
+RCSID("$OpenBSD: msg.c,v 1.8 2005/05/24 17:32:43 avsm Exp $");
 
 #include "buffer.h"
 #include "getput.h"
@@ -55,15 +55,13 @@ int
 ssh_msg_recv(int fd, Buffer *m)
 {
         u_char buf[4];
-        ssize_t res;
         u_int msg_len;
 
         debug3("ssh_msg_recv entering");
 
-        res = atomicio(read, fd, buf, sizeof(buf));
-        if (res != sizeof(buf)) {
-                if (res != 0)
-                        error("ssh_msg_recv: read: header %ld", (long)res);
+        if (atomicio(read, fd, buf, sizeof(buf)) != sizeof(buf)) {
+                if (errno != EPIPE)
+                        error("ssh_msg_recv: read: header");
                 return (-1);
         }
         msg_len = GET_32BIT(buf);
@@ -73,9 +71,8 @@ ssh_msg_recv(int fd, Buffer *m)
         }
         buffer_clear(m);
         buffer_append_space(m, msg_len);
-        res = atomicio(read, fd, buffer_ptr(m), msg_len);
-        if (res != msg_len) {
-                error("ssh_msg_recv: read: %ld != msg_len", (long)res);
+        if (atomicio(read, fd, buffer_ptr(m), msg_len) != msg_len) {
+                error("ssh_msg_recv: read: %s", strerror(errno));
                 return (-1);
         }
         return (0);
diff --git a/myproposal.h b/myproposal.h
index 228ed6882..d8cba1caf 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: myproposal.h,v 1.16 2004/06/13 12:53:24 djm Exp $     */
+/*      $OpenBSD: myproposal.h,v 1.18 2005/07/25 11:59:39 markus Exp $  */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -28,14 +28,15 @@
         "diffie-hellman-group1-sha1"
 #define KEX_DEFAULT_PK_ALG      "ssh-rsa,ssh-dss"
 #define KEX_DEFAULT_ENCRYPT \
-        "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour," \
+        "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
+        "arcfour128,arcfour256,arcfour," \
         "aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se," \
         "aes128-ctr,aes192-ctr,aes256-ctr"
 #define KEX_DEFAULT_MAC \
         "hmac-md5,hmac-sha1,hmac-ripemd160," \
         "hmac-ripemd160@openssh.com," \
         "hmac-sha1-96,hmac-md5-96"
-#define KEX_DEFAULT_COMP        "none,zlib"
+#define KEX_DEFAULT_COMP        "none,zlib@openssh.com,zlib"
 #define KEX_DEFAULT_LANG        ""
 
 
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index 0f34f2240..6f5ee2845 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.31 2004/08/15 08:41:00 djm Exp $
+# $Id: Makefile.in,v 1.35 2005/08/26 20:15:20 tim Exp $
 
 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -16,11 +16,11 @@ RANLIB=@RANLIB@
 INSTALL=@INSTALL@
 LDFLAGS=-L. @LDFLAGS@
 
-OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtoul.o vis.o
+OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o
 
-COMPAT=bsd-arc4random.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o xmmap.o xcrypt.o
+COMPAT=bsd-arc4random.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
 
-PORTS=port-irix.o port-aix.o
+PORTS=port-irix.o port-aix.o port-uw.o
 
 .c.o:
         $(CC) $(CFLAGS) $(CPPFLAGS) -c $<
diff --git a/openbsd-compat/bsd-cygwin_util.c b/openbsd-compat/bsd-cygwin_util.c
index f53abb6e2..b5e3cc52b 100644
--- a/openbsd-compat/bsd-cygwin_util.c
+++ b/openbsd-compat/bsd-cygwin_util.c
@@ -29,7 +29,7 @@
 
 #include "includes.h"
 
-RCSID("$Id: bsd-cygwin_util.c,v 1.13 2004/08/30 10:42:08 dtucker Exp $");
+RCSID("$Id: bsd-cygwin_util.c,v 1.14 2005/05/25 09:42:11 dtucker Exp $");
 
 #ifdef HAVE_CYGWIN
 
@@ -247,6 +247,7 @@ static struct wenv {
         { NL("COMMONPROGRAMFILES=") },
         { NL("COMPUTERNAME=") },
         { NL("COMSPEC=") },
+        { NL("CYGWIN=") },
         { NL("NUMBER_OF_PROCESSORS=") },
         { NL("OS=") },
         { NL("PATH=") },
@@ -260,7 +261,7 @@ static struct wenv {
         { NL("SYSTEMROOT=") },
         { NL("TMP=") },
         { NL("TEMP=") },
-        { NL("WINDIR=") },
+        { NL("WINDIR=") }
 };
 
 char **
@@ -269,7 +270,7 @@ fetch_windows_environment(void)
         char **e, **p;
         int i, idx = 0;
 
-        p = xmalloc(WENV_SIZ * sizeof(char *));
+        p = xmalloc((WENV_SIZ + 1) * sizeof(char *));
         for (e = environ; *e != NULL; ++e) {
                 for (i = 0; i < WENV_SIZ; ++i) {
                         if (!strncmp(*e, wenv_arr[i].name, wenv_arr[i].namelen))
diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
index 41f92cce9..6ba9bd986 100644
--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -18,7 +18,7 @@
 #include "includes.h"
 #include "xmalloc.h"
 
-RCSID("$Id: bsd-misc.c,v 1.26 2005/02/25 23:07:38 dtucker Exp $");
+RCSID("$Id: bsd-misc.c,v 1.27 2005/05/27 11:13:41 dtucker Exp $");
 
 #ifndef HAVE___PROGNAME
 char *__progname;
@@ -212,3 +212,21 @@ mysignal(int sig, mysig_t act)
         return (signal(sig, act));
 #endif
 }
+
+#ifndef HAVE_STRDUP
+char *
+strdup(const char *str)
+{
+        size_t len;
+        char *cp;
+
+        len = strlen(str) + 1;
+        cp = malloc(len);
+        if (cp != NULL)
+                if (strlcpy(cp, str, len) != len) {
+                        free(cp);
+                        return NULL;
+                }
+        return cp;
+}
+#endif
diff --git a/openbsd-compat/fake-rfc2553.h b/openbsd-compat/fake-rfc2553.h
index 636792ed7..cbcf7f727 100644
--- a/openbsd-compat/fake-rfc2553.h
+++ b/openbsd-compat/fake-rfc2553.h
@@ -1,4 +1,4 @@
-/* $Id: fake-rfc2553.h,v 1.10 2005/02/11 07:32:13 dtucker Exp $ */
+/* $Id: fake-rfc2553.h,v 1.12 2005/08/03 05:36:21 dtucker Exp $ */
 
 /*
  * Copyright (C) 2000-2003 Damien Miller.  All rights reserved.
@@ -114,10 +114,16 @@ struct sockaddr_in6 {
 #endif /* !NI_MAXHOST */
 
 #ifndef EAI_NODATA
-# define EAI_NODATA     1
-# define EAI_MEMORY     2
-# define EAI_NONAME     3
-# define EAI_SYSTEM     4
+# define EAI_NODATA     (INT_MAX - 1)
+#endif
+#ifndef EAI_MEMORY
+# define EAI_MEMORY     (INT_MAX - 2)
+#endif
+#ifndef EAI_NONAME
+# define EAI_NONAME     (INT_MAX - 3)
+#endif
+#ifndef EAI_SYSTEM
+# define EAI_SYSTEM     (INT_MAX - 4)
 #endif
 
 #ifndef HAVE_STRUCT_ADDRINFO
diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c
index 4e869c4df..2016ffe31 100644
--- a/openbsd-compat/getrrsetbyname.c
+++ b/openbsd-compat/getrrsetbyname.c
@@ -144,6 +144,8 @@ _getshort(msgp)
         GETSHORT(u, msgp);
         return (u);
 }
+#elif defined(HAVE_DECL__GETSHORT) && (HAVE_DECL__GETSHORT == 0)
+u_int16_t _getshort(register const u_char *);
 #endif
 
 #ifndef HAVE__GETLONG
@@ -156,6 +158,8 @@ _getlong(msgp)
         GETLONG(u, msgp);
         return (u);
 }
+#elif defined(HAVE_DECL__GETLONG) && (HAVE_DECL__GETLONG == 0)
+u_int32_t _getlong(register const u_char *);
 #endif
 
 int
diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h
index 89d1454e0..ba68bc27e 100644
--- a/openbsd-compat/openbsd-compat.h
+++ b/openbsd-compat/openbsd-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.26 2004/08/15 08:41:00 djm Exp $ */
+/* $Id: openbsd-compat.h,v 1.30 2005/08/26 20:15:20 tim Exp $ */
 
 /*
  * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -152,6 +152,10 @@ int openpty(int *, int *, char *, struct termios *, struct winsize *);
 int snprintf(char *, size_t, const char *, ...);
 #endif 
 
+#ifndef HAVE_STRTONUM
+long long strtonum(const char *, long long, long long, const char **);
+#endif
+
 #ifndef HAVE_VSNPRINTF
 int vsnprintf(char *, size_t, const char *, va_list);
 #endif
@@ -169,5 +173,6 @@ char *shadow_pw(struct passwd *pw);
 #include "bsd-cygwin_util.h"
 #include "port-irix.h"
 #include "port-aix.h"
+#include "port-uw.h"
 
 #endif /* _OPENBSD_COMPAT_H */
diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
new file mode 100644
index 000000000..b690e8fe6
--- /dev/null
+++ b/openbsd-compat/openssl-compat.c
@@ -0,0 +1,46 @@
+/* $Id: openssl-compat.c,v 1.2 2005/06/17 11:15:21 dtucker Exp $ */
+
+/*
+ * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
+ * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#define SSH_DONT_REDEF_EVP
+#include "openssl-compat.h"
+
+#ifdef SSH_OLD_EVP
+int
+ssh_EVP_CipherInit(EVP_CIPHER_CTX *evp, const EVP_CIPHER *type,
+    unsigned char *key, unsigned char *iv, int enc)
+{
+        EVP_CipherInit(evp, type, key, iv, enc);
+        return 1;
+}
+
+int
+ssh_EVP_Cipher(EVP_CIPHER_CTX *evp, char *dst, char *src, int len)
+{
+        EVP_Cipher(evp, dst, src, len);
+        return 1;
+}
+
+int
+ssh_EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *evp)
+{
+        EVP_CIPHER_CTX_cleanup(evp);
+        return 1;
+}
+#endif
diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h
new file mode 100644
index 000000000..d9b2fa55f
--- /dev/null
+++ b/openbsd-compat/openssl-compat.h
@@ -0,0 +1,65 @@
+/* $Id: openssl-compat.h,v 1.1 2005/06/09 11:45:11 dtucker Exp $ */
+
+/*
+ * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
+ * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+#include <openssl/evp.h>
+
+#if OPENSSL_VERSION_NUMBER < 0x00906000L
+# define SSH_OLD_EVP
+# define EVP_CIPHER_CTX_get_app_data(e)         ((e)->app_data)
+#endif
+
+#if OPENSSL_VERSION_NUMBER < 0x00907000L
+# define EVP_aes_128_cbc evp_rijndael
+# define EVP_aes_192_cbc evp_rijndael
+# define EVP_aes_256_cbc evp_rijndael
+extern const EVP_CIPHER *evp_rijndael(void);
+extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+#endif
+
+#if !defined(EVP_CTRL_SET_ACSS_MODE)
+# if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+#  define USE_CIPHER_ACSS 1
+extern const EVP_CIPHER *evp_acss(void);
+#  define EVP_acss evp_acss
+# else
+#  define EVP_acss NULL
+# endif
+#endif
+
+/*
+ * insert comment here
+ */
+#ifdef SSH_OLD_EVP
+
+# ifndef SSH_DONT_REDEF_EVP
+
+#  ifdef EVP_Cipher
+#   undef EVP_Cipher
+#  endif
+
+#  define EVP_CipherInit(a,b,c,d,e)     ssh_EVP_CipherInit((a),(b),(c),(d),(e))
+#  define EVP_Cipher(a,b,c,d)           ssh_EVP_Cipher((a),(b),(c),(d))
+#  define EVP_CIPHER_CTX_cleanup(a)     ssh_EVP_CIPHER_CTX_cleanup((a))
+# endif
+
+int ssh_EVP_CipherInit(EVP_CIPHER_CTX *, const EVP_CIPHER *, unsigned char *,
+    unsigned char *, int);
+int ssh_EVP_Cipher(EVP_CIPHER_CTX *, char *, char *, int);
+int ssh_EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *);
+#endif
diff --git a/openbsd-compat/port-aix.c b/openbsd-compat/port-aix.c
index fa6a4ff7b..81d8124e0 100644
--- a/openbsd-compat/port-aix.c
+++ b/openbsd-compat/port-aix.c
@@ -1,7 +1,7 @@
 /*
  *
  * Copyright (c) 2001 Gert Doering.  All rights reserved.
- * Copyright (c) 2003,2004 Darren Tucker.  All rights reserved.
+ * Copyright (c) 2003,2004,2005 Darren Tucker.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,14 +42,12 @@ static char old_registry[REGISTRY_SIZE] = "";
 # endif
 
 /*
- * AIX has a "usrinfo" area where logname and other stuff is stored - 
+ * AIX has a "usrinfo" area where logname and other stuff is stored -
  * a few applications actually use this and die if it's not set
  *
  * NOTE: TTY= should be set, but since no one uses it and it's hard to
  * acquire due to privsep code.  We will just drop support.
  */
-
-
 void
 aix_usrinfo(struct passwd *pw)
 {
@@ -60,7 +58,7 @@ aix_usrinfo(struct passwd *pw)
         len = sizeof("LOGNAME= NAME= ") + (2 * strlen(pw->pw_name));
         cp = xmalloc(len);
 
-        i = snprintf(cp, len, "LOGNAME=%s%cNAME=%s%c", pw->pw_name, '\0', 
+        i = snprintf(cp, len, "LOGNAME=%s%cNAME=%s%c", pw->pw_name, '\0',
             pw->pw_name, '\0');
         if (usrinfo(SETUINFO, cp, i) == -1)
                 fatal("Couldn't set usrinfo: %s", strerror(errno));
@@ -151,16 +149,16 @@ aix_valid_authentications(const char *user)
  * returns 0.
  */
 int
-sys_auth_passwd(Authctxt *ctxt, const char *password, Buffer *loginmsg)
+sys_auth_passwd(Authctxt *ctxt, const char *password)
 {
-        char *authmsg = NULL, *msg, *name = ctxt->pw->pw_name;
+        char *authmsg = NULL, *msg = NULL, *name = ctxt->pw->pw_name;
         int authsuccess = 0, expired, reenter, result;
 
         do {
                 result = authenticate((char *)name, (char *)password, &reenter,
                     &authmsg);
                 aix_remove_embedded_newlines(authmsg);  
-                debug3("AIX/authenticate result %d, msg %.100s", result,
+                debug3("AIX/authenticate result %d, authmsg %.100s", result,
                     authmsg);
         } while (reenter);
 
@@ -170,7 +168,7 @@ sys_auth_passwd(Authctxt *ctxt, const char *password, Buffer *loginmsg)
         if (result == 0) {
                 authsuccess = 1;
 
-                /*
+                /*
                  * Record successful login.  We don't have a pty yet, so just
                  * label the line as "ssh"
                  */
@@ -181,7 +179,7 @@ sys_auth_passwd(Authctxt *ctxt, const char *password, Buffer *loginmsg)
                  */
                 expired = passwdexpired(name, &msg);
                 if (msg && *msg) {
-                        buffer_append(loginmsg, msg, strlen(msg));
+                        buffer_append(ctxt->loginmsg, msg, strlen(msg));
                         aix_remove_embedded_newlines(msg);
                 }
                 debug3("AIX/passwdexpired returned %d msg %.100s", expired, msg);
@@ -257,7 +255,7 @@ int
 sys_auth_record_login(const char *user, const char *host, const char *ttynm,
     Buffer *loginmsg)
 {
-        char *msg;
+        char *msg = NULL;
         int success = 0;
 
         aix_setauthdb(user);
diff --git a/openbsd-compat/port-aix.h b/openbsd-compat/port-aix.h
index a05ce9703..37b2c12b0 100644
--- a/openbsd-compat/port-aix.h
+++ b/openbsd-compat/port-aix.h
@@ -1,8 +1,9 @@
-/* $Id: port-aix.h,v 1.24 2005/02/16 11:49:31 dtucker Exp $ */
+/* $Id: port-aix.h,v 1.26 2005/05/28 10:28:40 dtucker Exp $ */
 
 /*
  *
  * Copyright (c) 2001 Gert Doering.  All rights reserved.
+ * Copyright (c) 2004, 2005 Darren Tucker.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,21 +48,23 @@
 
 /* These should be in the system headers but are not. */
 int usrinfo(int, char *, int);
+#if defined(HAVE_DECL_SETAUTHDB) && (HAVE_DECL_SETAUTHDB == 0)
 int setauthdb(const char *, char *);
+#endif
 /* these may or may not be in the headers depending on the version */
-#if (HAVE_DECL_AUTHENTICATE == 0)
+#if defined(HAVE_DECL_AUTHENTICATE) && (HAVE_DECL_AUTHENTICATE == 0)
 int authenticate(char *, char *, int *, char **);
 #endif
-#if (HAVE_DECL_LOGINFAILED == 0)
+#if defined(HAVE_DECL_LOGINFAILED) && (HAVE_DECL_LOGINFAILED == 0)
 int loginfailed(char *, char *, char *);
 #endif
-#if (HAVE_DECL_LOGINRESTRICTIONS == 0)
+#if defined(HAVE_DECL_LOGINRESTRICTIONS) && (HAVE_DECL_LOGINRESTRICTIONS == 0)
 int loginrestrictions(char *, int, char *, char **);
 #endif
-#if (HAVE_DECL_LOGINSUCCESS == 0)
+#if defined(HAVE_DECL_LOGINSUCCESS) && (HAVE_DECL_LOGINSUCCESS == 0)
 int loginsuccess(char *, char *, char *, char **);
 #endif
-#if (HAVE_DECL_PASSWDEXPIRED == 0)
+#if defined(HAVE_DECL_PASSWDEXPIRED) && (HAVE_DECL_PASSWDEXPIRED == 0)
 int passwdexpired(char *, char **);
 #endif
 
diff --git a/openbsd-compat/port-uw.c b/openbsd-compat/port-uw.c
new file mode 100644
index 000000000..d881ff028
--- /dev/null
+++ b/openbsd-compat/port-uw.c
@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2005 The SCO Group. All rights reserved.
+ * Copyright (c) 2005 Tim Rice. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+#ifdef HAVE_CRYPT_H
+#include <crypt.h>
+#endif
+#include "packet.h"
+#include "buffer.h"
+#include "log.h"
+#include "servconf.h"
+#include "auth.h"
+#include "auth-options.h"
+
+int nischeck(char *);
+
+int
+sys_auth_passwd(Authctxt *authctxt, const char *password)
+{
+        struct passwd *pw = authctxt->pw;
+        char *encrypted_password;
+        char *salt;
+        int result;
+
+        /* Just use the supplied fake password if authctxt is invalid */
+        char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd;
+
+        /* Check for users with no password. */
+        if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0)
+                return (1);
+
+        /* Encrypt the candidate password using the proper salt. */
+        salt = (pw_password[0] && pw_password[1]) ? pw_password : "xx";
+#ifdef UNIXWARE_LONG_PASSWORDS
+        if (!nischeck(pw->pw_name))
+                encrypted_password = bigcrypt(password, salt);
+        else
+#endif /* UNIXWARE_LONG_PASSWORDS */
+                encrypted_password = xcrypt(password, salt);
+
+        /*
+         * Authentication is accepted if the encrypted passwords
+         * are identical.
+         */
+        result = (strcmp(encrypted_password, pw_password) == 0);
+
+        if (authctxt->valid)
+                free(pw_password);
+        return(result);
+}
+
+#ifdef UNIXWARE_LONG_PASSWORDS
+int
+nischeck(char *namep)
+{
+        char password_file[] = "/etc/passwd";
+        FILE *fd;
+        struct passwd *ent = NULL;
+
+        if ((fd = fopen (password_file, "r")) == NULL) {
+                /*
+                 * If the passwd file has dissapeared we are in a bad state.
+                 * However, returning 0 will send us back through the
+                 * authentication scheme that has checked the ia database for
+                 * passwords earlier.
+                 */
+                return(0);
+        }
+
+        /*
+         * fgetpwent() only reads from password file, so we know for certain
+         * that the user is local.
+         */
+        while (ent = fgetpwent(fd)) {
+                if (strcmp (ent->pw_name, namep) == 0) {
+                        /* Local user */
+                        fclose (fd);
+                        return(0);
+                }
+        }
+
+        fclose (fd);
+        return (1);
+}
+
+#endif /* UNIXWARE_LONG_PASSWORDS */
+
+/*
+        NOTE: ia_get_logpwd() allocates memory for arg 2
+        functions that call shadow_pw() will need to free
+ */
+
+char *
+get_iaf_password(struct passwd *pw)
+{
+        char *pw_password = NULL;
+
+        uinfo_t uinfo;
+        if (!ia_openinfo(pw->pw_name,&uinfo)) {
+                ia_get_logpwd(uinfo, &pw_password);
+                if (pw_password == NULL)
+                        fatal("ia_get_logpwd: Unable to get the shadow passwd");
+                ia_closeinfo(uinfo);
+                return pw_password;
+        }
+        else
+                fatal("ia_openinfo: Unable to open the shadow passwd file");
+}
+#endif /* HAVE_LIBIAF  && !BROKEN_LIBIAF */
+
diff --git a/openbsd-compat/port-uw.h b/openbsd-compat/port-uw.h
new file mode 100644
index 000000000..3589b2e44
--- /dev/null
+++ b/openbsd-compat/port-uw.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2005 Tim Rice.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "includes.h"
+
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+char * get_iaf_password(struct passwd *pw);
+#endif
+
diff --git a/openbsd-compat/readpassphrase.c b/openbsd-compat/readpassphrase.c
index 4ee1be5de..eb060bdbf 100644
--- a/openbsd-compat/readpassphrase.c
+++ b/openbsd-compat/readpassphrase.c
@@ -137,8 +137,11 @@ restart:
                 (void)write(output, "\n", 1);
 
         /* Restore old terminal settings and signals. */
-        if (memcmp(&term, &oterm, sizeof(term)) != 0)
-                (void)tcsetattr(input, _T_FLUSH, &oterm);
+        if (memcmp(&term, &oterm, sizeof(term)) != 0) {
+                while (tcsetattr(input, _T_FLUSH, &oterm) == -1 &&
+                    errno == EINTR)
+                        continue;
+        }
         (void)sigaction(SIGALRM, &savealrm, NULL);
         (void)sigaction(SIGHUP, &savehup, NULL);
         (void)sigaction(SIGINT, &saveint, NULL);
diff --git a/openbsd-compat/realpath.c b/openbsd-compat/realpath.c
index 7f73bd998..8430bec24 100644
--- a/openbsd-compat/realpath.c
+++ b/openbsd-compat/realpath.c
@@ -1,11 +1,7 @@
 /* OPENBSD ORIGINAL: lib/libc/stdlib/realpath.c */
 
 /*
- * Copyright (c) 1994
- *      The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Jan-Simon Pendry.
+ * Copyright (c) 2003 Constantin S. Svintsoff <kostik@iclub.nsu.ru>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -15,14 +11,14 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
+ * 3. The names of the authors may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
  *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
@@ -36,169 +32,165 @@
 
 #if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
 
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: realpath.c,v 1.11 2004/11/30 15:12:59 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <sys/stat.h>
 
 #include <errno.h>
-#include <fcntl.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
 /*
- * MAXSYMLINKS
- */
-#ifndef MAXSYMLINKS
-#define MAXSYMLINKS 5
-#endif
-
-/*
- * char *realpath(const char *path, char resolved_path[MAXPATHLEN]);
+ * char *realpath(const char *path, char resolved[PATH_MAX]);
  *
  * Find the real name of path, by removing all ".", ".." and symlink
  * components.  Returns (resolved) on success, or (NULL) on failure,
  * in which case the path which caused trouble is left in (resolved).
  */
 char *
-realpath(const char *path, char *resolved)
+realpath(const char *path, char resolved[PATH_MAX])
 {
         struct stat sb;
-        int fd, n, needslash, serrno;
-        char *p, *q, wbuf[MAXPATHLEN];
-        int symlinks = 0;
-
-        /* Save the starting point. */
-#ifndef HAVE_FCHDIR
-        char start[MAXPATHLEN];
-        /* this is potentially racy but without fchdir we have no option */
-        if (getcwd(start, sizeof(start)) == NULL) {
-                resolved[0] = '.';
+        char *p, *q, *s;
+        size_t left_len, resolved_len;
+        unsigned symlinks;
+        int serrno, slen;
+        char left[PATH_MAX], next_token[PATH_MAX], symlink[PATH_MAX];
+
+        serrno = errno;
+        symlinks = 0;
+        if (path[0] == '/') {
+                resolved[0] = '/';
                 resolved[1] = '\0';
-                return (NULL);
+                if (path[1] == '\0')
+                        return (resolved);
+                resolved_len = 1;
+                left_len = strlcpy(left, path + 1, sizeof(left));
+        } else {
+                if (getcwd(resolved, PATH_MAX) == NULL) {
+                        strlcpy(resolved, ".", PATH_MAX);
+                        return (NULL);
+                }
+                resolved_len = strlen(resolved);
+                left_len = strlcpy(left, path, sizeof(left));
         }
-#endif
-        if ((fd = open(".", O_RDONLY)) < 0) {
-                resolved[0] = '.';
-                resolved[1] = '\0';
+        if (left_len >= sizeof(left) || resolved_len >= PATH_MAX) {
+                errno = ENAMETOOLONG;
                 return (NULL);
         }
 
-        /* Convert "." -> "" to optimize away a needless lstat() and chdir() */
-        if (path[0] == '.' && path[1] == '\0')
-                path = "";
-
         /*
-         * Find the dirname and basename from the path to be resolved.
-         * Change directory to the dirname component.
-         * lstat the basename part.
-         *     if it is a symlink, read in the value and loop.
-         *     if it is a directory, then change to that directory.
-         * get the current directory name and append the basename.
+         * Iterate over path components in `left'.
          */
-        if (strlcpy(resolved, path, MAXPATHLEN) >= MAXPATHLEN) {
-                serrno = ENAMETOOLONG;
-                goto err2;
-        }
-loop:
-        q = strrchr(resolved, '/');
-        if (q != NULL) {
-                p = q + 1;
-                if (q == resolved)
-                        q = "/";
-                else {
-                        do {
-                                --q;
-                        } while (q > resolved && *q == '/');
-                        q[1] = '\0';
-                        q = resolved;
+        while (left_len != 0) {
+                /*
+                 * Extract the next path component and adjust `left'
+                 * and its length.
+                 */
+                p = strchr(left, '/');
+                s = p ? p : left + left_len;
+                if (s - left >= sizeof(next_token)) {
+                        errno = ENAMETOOLONG;
+                        return (NULL);
                 }
-                if (chdir(q) < 0)
-                        goto err1;
-        } else
-                p = resolved;
-
-        /* Deal with the last component. */
-        if (*p != '\0' && lstat(p, &sb) == 0) {
-                if (S_ISLNK(sb.st_mode)) {
-                        if (++symlinks > MAXSYMLINKS) {
-                                errno = ELOOP;
-                                goto err1;
+                memcpy(next_token, left, s - left);
+                next_token[s - left] = '\0';
+                left_len -= s - left;
+                if (p != NULL)
+                        memmove(left, s + 1, left_len + 1);
+                if (resolved[resolved_len - 1] != '/') {
+                        if (resolved_len + 1 >= PATH_MAX) {
+                                errno = ENAMETOOLONG;
+                                return (NULL);
                         }
-                        if ((n = readlink(p, resolved, MAXPATHLEN-1)) < 0)
-                                goto err1;
-                        resolved[n] = '\0';
-                        goto loop;
+                        resolved[resolved_len++] = '/';
+                        resolved[resolved_len] = '\0';
                 }
-                if (S_ISDIR(sb.st_mode)) {
-                        if (chdir(p) < 0)
-                                goto err1;
-                        p = "";
+                if (next_token[0] == '\0')
+                        continue;
+                else if (strcmp(next_token, ".") == 0)
+                        continue;
+                else if (strcmp(next_token, "..") == 0) {
+                        /*
+                         * Strip the last path component except when we have
+                         * single "/"
+                         */
+                        if (resolved_len > 1) {
+                                resolved[resolved_len - 1] = '\0';
+                                q = strrchr(resolved, '/') + 1;
+                                *q = '\0';
+                                resolved_len = q - resolved;
+                        }
+                        continue;
                 }
-        }
-
-        /*
-         * Save the last component name and get the full pathname of
-         * the current directory.
-         */
-        if (strlcpy(wbuf, p, sizeof(wbuf)) >= sizeof(wbuf)) {
-                errno = ENAMETOOLONG;
-                goto err1;
-        }
-        if (getcwd(resolved, MAXPATHLEN) == NULL)
-                goto err1;
-
-        /*
-         * Join the two strings together, ensuring that the right thing
-         * happens if the last component is empty, or the dirname is root.
-         */
-        if (resolved[0] == '/' && resolved[1] == '\0')
-                needslash = 0;
-        else
-                needslash = 1;
 
-        if (*wbuf) {
-                if (strlen(resolved) + strlen(wbuf) + needslash >= MAXPATHLEN) {
+                /*
+                 * Append the next path component and lstat() it. If
+                 * lstat() fails we still can return successfully if
+                 * there are no more path components left.
+                 */
+                resolved_len = strlcat(resolved, next_token, PATH_MAX);
+                if (resolved_len >= PATH_MAX) {
                         errno = ENAMETOOLONG;
-                        goto err1;
+                        return (NULL);
                 }
-                if (needslash) {
-                        if (strlcat(resolved, "/", MAXPATHLEN) >= MAXPATHLEN) {
-                                errno = ENAMETOOLONG;
-                                goto err1;
+                if (lstat(resolved, &sb) != 0) {
+                        if (errno == ENOENT && p == NULL) {
+                                errno = serrno;
+                                return (resolved);
                         }
+                        return (NULL);
                 }
-                if (strlcat(resolved, wbuf, MAXPATHLEN) >= MAXPATHLEN) {
-                        errno = ENAMETOOLONG;
-                        goto err1;
-                }
-        }
+                if (S_ISLNK(sb.st_mode)) {
+                        if (symlinks++ > MAXSYMLINKS) {
+                                errno = ELOOP;
+                                return (NULL);
+                        }
+                        slen = readlink(resolved, symlink, sizeof(symlink) - 1);
+                        if (slen < 0)
+                                return (NULL);
+                        symlink[slen] = '\0';
+                        if (symlink[0] == '/') {
+                                resolved[1] = 0;
+                                resolved_len = 1;
+                        } else if (resolved_len > 1) {
+                                /* Strip the last path component. */
+                                resolved[resolved_len - 1] = '\0';
+                                q = strrchr(resolved, '/') + 1;
+                                *q = '\0';
+                                resolved_len = q - resolved;
+                        }
 
-        /* Go back to where we came from. */
-#ifdef HAVE_FCHDIR
-        if (fchdir(fd) < 0) {
-#else
-        if (chdir(start) < 0) {
-#endif
-                serrno = errno;
-                goto err2;
+                        /*
+                         * If there are any path components left, then
+                         * append them to symlink. The result is placed
+                         * in `left'.
+                         */
+                        if (p != NULL) {
+                                if (symlink[slen - 1] != '/') {
+                                        if (slen + 1 >= sizeof(symlink)) {
+                                                errno = ENAMETOOLONG;
+                                                return (NULL);
+                                        }
+                                        symlink[slen] = '/';
+                                        symlink[slen + 1] = 0;
+                                }
+                                left_len = strlcat(symlink, left, sizeof(left));
+                                if (left_len >= sizeof(left)) {
+                                        errno = ENAMETOOLONG;
+                                        return (NULL);
+                                }
+                        }
+                        left_len = strlcpy(left, symlink, sizeof(left));
+                }
         }
 
-        /* It's okay if the close fails, what's an fd more or less? */
-        (void)close(fd);
+        /*
+         * Remove trailing slash except when the resolved pathname
+         * is a single "/".
+         */
+        if (resolved_len > 1 && resolved[resolved_len - 1] == '/')
+                resolved[resolved_len - 1] = '\0';
         return (resolved);
-
-err1:   serrno = errno;
-#ifdef HAVE_FCHDIR
-        (void)fchdir(fd);
-#else
-        chdir(start);
-#endif
-err2:   (void)close(fd);
-        errno = serrno;
-        return (NULL);
 }
 #endif /* !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH) */
diff --git a/openbsd-compat/strtoll.c b/openbsd-compat/strtoll.c
new file mode 100644
index 000000000..60c276f8a
--- /dev/null
+++ b/openbsd-compat/strtoll.c
@@ -0,0 +1,151 @@
+/* OPENBSD ORIGINAL: lib/libc/stdlib/strtoll.c */
+
+/*-
+ * Copyright (c) 1992 The Regents of the University of California.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "includes.h"
+#ifndef HAVE_STRTOLL
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char rcsid[] = "$OpenBSD: strtoll.c,v 1.4 2005/03/30 18:51:49 pat Exp $";
+#endif /* LIBC_SCCS and not lint */
+
+#include <sys/types.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+
+/*
+ * Convert a string to a long long.
+ *
+ * Ignores `locale' stuff.  Assumes that the upper and lower case
+ * alphabets and digits are each contiguous.
+ */
+long long
+strtoll(const char *nptr, char **endptr, int base)
+{
+        const char *s;
+        long long acc, cutoff;
+        int c;
+        int neg, any, cutlim;
+
+        /*
+         * Skip white space and pick up leading +/- sign if any.
+         * If base is 0, allow 0x for hex and 0 for octal, else
+         * assume decimal; if base is already 16, allow 0x.
+         */
+        s = nptr;
+        do {
+                c = (unsigned char) *s++;
+        } while (isspace(c));
+        if (c == '-') {
+                neg = 1;
+                c = *s++;
+        } else {
+                neg = 0;
+                if (c == '+')
+                        c = *s++;
+        }
+        if ((base == 0 || base == 16) &&
+            c == '0' && (*s == 'x' || *s == 'X')) {
+                c = s[1];
+                s += 2;
+                base = 16;
+        }
+        if (base == 0)
+                base = c == '0' ? 8 : 10;
+
+        /*
+         * Compute the cutoff value between legal numbers and illegal
+         * numbers.  That is the largest legal value, divided by the
+         * base.  An input number that is greater than this value, if
+         * followed by a legal input character, is too big.  One that
+         * is equal to this value may be valid or not; the limit
+         * between valid and invalid numbers is then based on the last
+         * digit.  For instance, if the range for long longs is
+         * [-9223372036854775808..9223372036854775807] and the input base
+         * is 10, cutoff will be set to 922337203685477580 and cutlim to
+         * either 7 (neg==0) or 8 (neg==1), meaning that if we have
+         * accumulated a value > 922337203685477580, or equal but the
+         * next digit is > 7 (or 8), the number is too big, and we will
+         * return a range error.
+         *
+         * Set any if any `digits' consumed; make it negative to indicate
+         * overflow.
+         */
+        cutoff = neg ? LLONG_MIN : LLONG_MAX;
+        cutlim = cutoff % base;
+        cutoff /= base;
+        if (neg) {
+                if (cutlim > 0) {
+                        cutlim -= base;
+                        cutoff += 1;
+                }
+                cutlim = -cutlim;
+        }
+        for (acc = 0, any = 0;; c = (unsigned char) *s++) {
+                if (isdigit(c))
+                        c -= '0';
+                else if (isalpha(c))
+                        c -= isupper(c) ? 'A' - 10 : 'a' - 10;
+                else
+                        break;
+                if (c >= base)
+                        break;
+                if (any < 0)
+                        continue;
+                if (neg) {
+                        if (acc < cutoff || (acc == cutoff && c > cutlim)) {
+                                any = -1;
+                                acc = LLONG_MIN;
+                                errno = ERANGE;
+                        } else {
+                                any = 1;
+                                acc *= base;
+                                acc -= c;
+                        }
+                } else {
+                        if (acc > cutoff || (acc == cutoff && c > cutlim)) {
+                                any = -1;
+                                acc = LLONG_MAX;
+                                errno = ERANGE;
+                        } else {
+                                any = 1;
+                                acc *= base;
+                                acc += c;
+                        }
+                }
+        }
+        if (endptr != 0)
+                *endptr = (char *) (any ? s - 1 : nptr);
+        return (acc);
+}
+#endif /* HAVE_STRTOLL */
diff --git a/openbsd-compat/strtonum.c b/openbsd-compat/strtonum.c
new file mode 100644
index 000000000..b681ed83b
--- /dev/null
+++ b/openbsd-compat/strtonum.c
@@ -0,0 +1,69 @@
+/* OPENBSD ORIGINAL: lib/libc/stdlib/strtonum.c */
+
+/*      $OpenBSD: strtonum.c,v 1.6 2004/08/03 19:38:01 millert Exp $    */
+
+/*
+ * Copyright (c) 2004 Ted Unangst and Todd Miller
+ * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+#ifndef HAVE_STRTONUM
+#include <limits.h>
+
+#define INVALID         1
+#define TOOSMALL        2
+#define TOOLARGE        3
+
+long long
+strtonum(const char *numstr, long long minval, long long maxval,
+    const char **errstrp)
+{
+        long long ll = 0;
+        char *ep;
+        int error = 0;
+        struct errval {
+                const char *errstr;
+                int err;
+        } ev[4] = {
+                { NULL,         0 },
+                { "invalid",    EINVAL },
+                { "too small",  ERANGE },
+                { "too large",  ERANGE },
+        };
+
+        ev[0].err = errno;
+        errno = 0;
+        if (minval > maxval)
+                error = INVALID;
+        else {
+                ll = strtoll(numstr, &ep, 10);
+                if (numstr == ep || *ep != '\0')
+                        error = INVALID;
+                else if ((ll == LLONG_MIN && errno == ERANGE) || ll < minval)
+                        error = TOOSMALL;
+                else if ((ll == LLONG_MAX && errno == ERANGE) || ll > maxval)
+                        error = TOOLARGE;
+        }
+        if (errstrp != NULL)
+                *errstrp = ev[error].errstr;
+        errno = ev[error].err;
+        if (error)
+                ll = 0;
+
+        return (ll);
+}
+
+#endif /* HAVE_STRTONUM */
diff --git a/openbsd-compat/xcrypt.c b/openbsd-compat/xcrypt.c
index c3cea3c86..9afa0b9f2 100644
--- a/openbsd-compat/xcrypt.c
+++ b/openbsd-compat/xcrypt.c
@@ -93,6 +93,11 @@ shadow_pw(struct passwd *pw)
         if (spw != NULL)
                 pw_password = spw->sp_pwdp;
 # endif
+
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+        return(get_iaf_password(pw));
+#endif
+
 # if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
         struct passwd_adjunct *spw;
         if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL)
diff --git a/packet.c b/packet.c
index 7c150fde7..70e0110cb 100644
--- a/packet.c
+++ b/packet.c
@@ -37,7 +37,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.116 2004/10/20 11:48:53 markus Exp $");
+RCSID("$OpenBSD: packet.c,v 1.119 2005/07/28 17:36:22 markus Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -116,6 +116,12 @@ static int initialized = 0;
 /* Set to true if the connection is interactive. */
 static int interactive_mode = 0;
 
+/* Set to true if we are the server side. */
+static int server_side = 0;
+
+/* Set to true if we are authenticated. */
+static int after_authentication = 0;
+
 /* Session key information for Encryption and MAC */
 Newkeys *newkeys[MODE_MAX];
 static struct packet_state {
@@ -624,7 +630,9 @@ set_newkeys(int mode)
         /* Deleting the keys does not gain extra security */
         /* memset(enc->iv,  0, enc->block_size);
            memset(enc->key, 0, enc->key_len); */
-        if (comp->type != 0 && comp->enabled == 0) {
+        if ((comp->type == COMP_ZLIB ||
+            (comp->type == COMP_DELAYED && after_authentication)) &&
+            comp->enabled == 0) {
                 packet_init_compression();
                 if (mode == MODE_OUT)
                         buffer_compress_init_send(6);
@@ -645,6 +653,35 @@ set_newkeys(int mode)
 }
 
 /*
+ * Delayed compression for SSH2 is enabled after authentication:
+ * This happans on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
+ * and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received.
+ */
+static void
+packet_enable_delayed_compress(void)
+{
+        Comp *comp = NULL;
+        int mode;
+
+        /*
+         * Remember that we are past the authentication step, so rekeying
+         * with COMP_DELAYED will turn on compression immediately.
+         */
+        after_authentication = 1;
+        for (mode = 0; mode < MODE_MAX; mode++) {
+                comp = &newkeys[mode]->comp;
+                if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
+                        packet_init_compression();
+                        if (mode == MODE_OUT)
+                                buffer_compress_init_send(6);
+                        else
+                                buffer_compress_init_recv();
+                        comp->enabled = 1;
+                }
+        }
+}
+
+/*
  * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
  */
 static void
@@ -757,6 +794,8 @@ packet_send2_wrapped(void)
 
         if (type == SSH2_MSG_NEWKEYS)
                 set_newkeys(MODE_OUT);
+        else if (type == SSH2_MSG_USERAUTH_SUCCESS && server_side)
+                packet_enable_delayed_compress();
 }
 
 static void
@@ -992,7 +1031,7 @@ packet_read_poll2(u_int32_t *seqnr_p)
         static u_int packet_length = 0;
         u_int padlen, need;
         u_char *macbuf, *cp, type;
-        int maclen, block_size;
+        u_int maclen, block_size;
         Enc *enc   = NULL;
         Mac *mac   = NULL;
         Comp *comp = NULL;
@@ -1099,6 +1138,8 @@ packet_read_poll2(u_int32_t *seqnr_p)
                 packet_disconnect("Invalid ssh2 packet type: %d", type);
         if (type == SSH2_MSG_NEWKEYS)
                 set_newkeys(MODE_IN);
+        else if (type == SSH2_MSG_USERAUTH_SUCCESS && !server_side)
+                packet_enable_delayed_compress();
 #ifdef PACKET_DEBUG
         fprintf(stderr, "read/plain[%d]:\r\n", type);
         buffer_dump(&incoming_packet);
@@ -1229,9 +1270,9 @@ packet_get_bignum2(BIGNUM * value)
 }
 
 void *
-packet_get_raw(int *length_ptr)
+packet_get_raw(u_int *length_ptr)
 {
-        int bytes = buffer_len(&incoming_packet);
+        u_int bytes = buffer_len(&incoming_packet);
 
         if (length_ptr != NULL)
                 *length_ptr = bytes;
@@ -1524,3 +1565,15 @@ packet_set_rekey_limit(u_int32_t bytes)
 {
         rekey_limit = bytes;
 }
+
+void
+packet_set_server(void)
+{
+        server_side = 1;
+}
+
+void
+packet_set_authenticated(void)
+{
+        after_authentication = 1;
+}
diff --git a/packet.h b/packet.h
index 37f82f2f6..8c23646aa 100644
--- a/packet.h
+++ b/packet.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: packet.h,v 1.41 2004/05/11 19:01:43 deraadt Exp $     */
+/*      $OpenBSD: packet.h,v 1.43 2005/07/25 11:59:40 markus Exp $      */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -30,6 +30,8 @@ u_int	 packet_get_protocol_flags(void);
 void     packet_start_compression(int);
 void     packet_set_interactive(int);
 int      packet_is_interactive(void);
+void     packet_set_server(void);
+void     packet_set_authenticated(void);
 
 void     packet_start(u_char);
 void     packet_put_char(int ch);
@@ -52,7 +54,7 @@ u_int	 packet_get_char(void);
 u_int    packet_get_int(void);
 void     packet_get_bignum(BIGNUM * value);
 void     packet_get_bignum2(BIGNUM * value);
-void    *packet_get_raw(int *length_ptr);
+void    *packet_get_raw(u_int *length_ptr);
 void    *packet_get_string(u_int *length_ptr);
 void     packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2)));
 void     packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2)));
diff --git a/progressmeter.c b/progressmeter.c
index 93f5a3e62..3cda09061 100644
--- a/progressmeter.c
+++ b/progressmeter.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: progressmeter.c,v 1.22 2004/07/11 17:48:47 deraadt Exp $");
+RCSID("$OpenBSD: progressmeter.c,v 1.24 2005/06/07 13:25:23 jaredy Exp $");
 
 #include "progressmeter.h"
 #include "atomicio.h"
@@ -42,6 +42,10 @@ static int can_output(void);
 static void format_size(char *, int, off_t);
 static void format_rate(char *, int, off_t);
 
+/* window resizing */
+static void sig_winch(int);
+static void setscreensize(void);
+
 /* updates the progressmeter to reflect the current state of the transfer */
 void refresh_progress_meter(void);
 
@@ -57,6 +61,7 @@ static volatile off_t *counter;	/* progress counter */
 static long stalled;            /* how long we have been stalled */
 static int bytes_per_second;    /* current speed in bytes per second */
 static int win_size;            /* terminal window size */
+static volatile sig_atomic_t win_resized; /* for window resizing */
 
 /* units for format_size */
 static const char unit[] = " KMGT";
@@ -147,6 +152,8 @@ refresh_progress_meter(void)
                 len = snprintf(buf, file_len + 1, "\r%s", file);
                 if (len < 0)
                         len = 0;
+                if (len >= file_len + 1)
+                        len = file_len;
                 for (i = len;  i < file_len; i++ )
                         buf[i] = ' ';
                 buf[file_len] = '\0';
@@ -215,6 +222,10 @@ update_progress_meter(int ignore)
 
         save_errno = errno;
 
+        if (win_resized) {
+                setscreensize();
+                win_resized = 0;
+        }
         if (can_output())
                 refresh_progress_meter();
 
@@ -226,8 +237,6 @@ update_progress_meter(int ignore)
 void
 start_progress_meter(char *f, off_t filesize, off_t *ctr)
 {
-        struct winsize winsize;
-
         start = last_update = time(NULL);
         file = f;
         end_pos = filesize;
@@ -236,20 +245,12 @@ start_progress_meter(char *f, off_t filesize, off_t *ctr)
         stalled = 0;
         bytes_per_second = 0;
 
-        if (ioctl(STDOUT_FILENO, TIOCGWINSZ, &winsize) != -1 &&
-            winsize.ws_col != 0) {
-                if (winsize.ws_col > MAX_WINSIZE)
-                        win_size = MAX_WINSIZE;
-                else
-                        win_size = winsize.ws_col;
-        } else
-                win_size = DEFAULT_WINSIZE;
-        win_size += 1;                                  /* trailing \0 */
-
+        setscreensize();
         if (can_output())
                 refresh_progress_meter();
 
         signal(SIGALRM, update_progress_meter);
+        signal(SIGWINCH, sig_winch);
         alarm(UPDATE_INTERVAL);
 }
 
@@ -267,3 +268,25 @@ stop_progress_meter(void)
 
         atomicio(vwrite, STDOUT_FILENO, "\n", 1);
 }
+
+static void
+sig_winch(int sig)
+{
+        win_resized = 1;
+}
+
+static void
+setscreensize(void)
+{
+        struct winsize winsize;
+
+        if (ioctl(STDOUT_FILENO, TIOCGWINSZ, &winsize) != -1 &&
+            winsize.ws_col != 0) {
+                if (winsize.ws_col > MAX_WINSIZE)
+                        win_size = MAX_WINSIZE;
+                else
+                        win_size = winsize.ws_col;
+        } else
+                win_size = DEFAULT_WINSIZE;
+        win_size += 1;                                  /* trailing \0 */
+}
diff --git a/readconf.c b/readconf.c
index 7173a8c23..345df9c25 100644
--- a/readconf.c
+++ b/readconf.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: readconf.c,v 1.137 2005/03/04 08:48:06 djm Exp $");
+RCSID("$OpenBSD: readconf.c,v 1.143 2005/07/30 02:03:47 djm Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
@@ -105,6 +105,7 @@ typedef enum {
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
+        oGssTrustDns,
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
         oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
         oDeprecated, oUnsupported
@@ -140,9 +141,11 @@ static struct {
 #if defined(GSSAPI)
         { "gssapiauthentication", oGssAuthentication },
         { "gssapidelegatecredentials", oGssDelegateCreds },
+        { "gssapitrustdns", oGssTrustDns },
 #else
         { "gssapiauthentication", oUnsupported },
         { "gssapidelegatecredentials", oUnsupported },
+        { "gssapitrustdns", oUnsupported },
 #endif
         { "fallbacktorsh", oDeprecated },
         { "usersh", oDeprecated },
@@ -253,12 +256,14 @@ clear_forwardings(Options *options)
         int i;
 
         for (i = 0; i < options->num_local_forwards; i++) {
-                xfree(options->local_forwards[i].listen_host);
+                if (options->local_forwards[i].listen_host != NULL)
+                        xfree(options->local_forwards[i].listen_host);
                 xfree(options->local_forwards[i].connect_host);
         }
         options->num_local_forwards = 0;
         for (i = 0; i < options->num_remote_forwards; i++) {
-                xfree(options->remote_forwards[i].listen_host);
+                if (options->remote_forwards[i].listen_host != NULL)
+                        xfree(options->remote_forwards[i].listen_host);
                 xfree(options->remote_forwards[i].connect_host);
         }
         options->num_remote_forwards = 0;
@@ -299,7 +304,7 @@ process_config_line(Options *options, const char *host,
         Forward fwd;
 
         /* Strip trailing whitespace */
-        for(len = strlen(line) - 1; len > 0; len--) {
+        for (len = strlen(line) - 1; len > 0; len--) {
                 if (strchr(WHITESPACE, line[len]) == NULL)
                         break;
                 line[len] = '\0';
@@ -408,6 +413,10 @@ parse_flag:
                 intptr = &options->gss_deleg_creds;
                 goto parse_flag;
 
+        case oGssTrustDns:
+                intptr = &options->gss_trust_dns;
+                goto parse_flag;
+
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
@@ -693,7 +702,7 @@ parse_int:
                         fwd.listen_host = cleanhostname(fwd.listen_host);
                 } else {
                         fwd.listen_port = a2port(fwd.listen_host);
-                        fwd.listen_host = "";
+                        fwd.listen_host = NULL;
                 }
                 if (fwd.listen_port == 0)
                         fatal("%.200s line %d: Badly formatted port number.",
@@ -741,6 +750,9 @@ parse_int:
 
         case oAddressFamily:
                 arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing address family.",
+                            filename, linenum);
                 intptr = &options->address_family;
                 if (strcasecmp(arg, "inet") == 0)
                         value = AF_INET;
@@ -791,7 +803,27 @@ parse_int:
 
         case oControlMaster:
                 intptr = &options->control_master;
-                goto parse_yesnoask;
+                arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%.200s line %d: Missing ControlMaster argument.",
+                            filename, linenum);
+                value = 0;      /* To avoid compiler warning... */
+                if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
+                        value = SSHCTL_MASTER_YES;
+                else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
+                        value = SSHCTL_MASTER_NO;
+                else if (strcmp(arg, "auto") == 0)
+                        value = SSHCTL_MASTER_AUTO;
+                else if (strcmp(arg, "ask") == 0)
+                        value = SSHCTL_MASTER_ASK;
+                else if (strcmp(arg, "autoask") == 0)
+                        value = SSHCTL_MASTER_AUTO_ASK;
+                else
+                        fatal("%.200s line %d: Bad ControlMaster argument.",
+                            filename, linenum);
+                if (*activep && *intptr == -1)
+                        *intptr = value;
+                break;
 
         case oHashKnownHosts:
                 intptr = &options->hash_known_hosts;
@@ -814,7 +846,7 @@ parse_int:
         /* Check that there is no garbage at end of line. */
         if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
                 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
-                     filename, linenum, arg);
+                    filename, linenum, arg);
         }
         return 0;
 }
@@ -892,6 +924,7 @@ initialize_options(Options * options)
         options->challenge_response_authentication = -1;
         options->gss_authentication = -1;
         options->gss_deleg_creds = -1;
+        options->gss_trust_dns = -1;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
@@ -975,6 +1008,8 @@ fill_default_options(Options * options)
                 options->gss_authentication = 0;
         if (options->gss_deleg_creds == -1)
                 options->gss_deleg_creds = 0;
+        if (options->gss_trust_dns == -1)
+                options->gss_trust_dns = 0;
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
diff --git a/readconf.h b/readconf.h
index de4b4cb27..b403c10ec 100644
--- a/readconf.h
+++ b/readconf.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: readconf.h,v 1.66 2005/03/01 10:40:27 djm Exp $       */
+/*      $OpenBSD: readconf.h,v 1.67 2005/06/08 11:25:09 djm Exp $       */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -46,6 +46,7 @@ typedef struct {
                                         /* Try S/Key or TIS, authentication. */
         int     gss_authentication;     /* Try GSS authentication */
         int     gss_deleg_creds;        /* Delegate GSS credentials */
+        int     gss_trust_dns;          /* Trust DNS for GSS canonicalization */
         int     password_authentication;        /* Try password
                                                  * authentication. */
         int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
@@ -116,6 +117,11 @@ typedef struct {
         int     hash_known_hosts;
 }       Options;
 
+#define SSHCTL_MASTER_NO        0
+#define SSHCTL_MASTER_YES       1
+#define SSHCTL_MASTER_AUTO      2
+#define SSHCTL_MASTER_ASK       3
+#define SSHCTL_MASTER_AUTO_ASK  4
 
 void     initialize_options(Options *);
 void     fill_default_options(Options *);
diff --git a/readpass.c b/readpass.c
index c2bacdcd4..7914799a4 100644
--- a/readpass.c
+++ b/readpass.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: readpass.c,v 1.31 2004/10/29 22:53:56 djm Exp $");
+RCSID("$OpenBSD: readpass.c,v 1.33 2005/05/02 21:13:22 markus Exp $");
 
 #include "xmalloc.h"
 #include "misc.h"
@@ -106,15 +106,20 @@ read_passphrase(const char *prompt, int flags)
         if (flags & RP_USE_ASKPASS)
                 use_askpass = 1;
         else if (flags & RP_ALLOW_STDIN) {
-                if (!isatty(STDIN_FILENO))
+                if (!isatty(STDIN_FILENO)) {
+                        debug("read_passphrase: stdin is not a tty");
                         use_askpass = 1;
+                }
         } else {
                 rppflags |= RPP_REQUIRE_TTY;
                 ttyfd = open(_PATH_TTY, O_RDWR);
                 if (ttyfd >= 0)
                         close(ttyfd);
-                else
+                else {
+                        debug("read_passphrase: can't open %s: %s", _PATH_TTY,
+                            strerror(errno));
                         use_askpass = 1;
+                }
         }
 
         if ((flags & RP_USE_ASKPASS) && getenv("DISPLAY") == NULL)
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index e8cc1ac53..a172e5790 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,7 +1,7 @@
 #       $OpenBSD: multiplex.sh,v 1.10 2005/02/27 11:33:30 dtucker Exp $
 #       Placed in the Public Domain.
 
-CTL=$OBJ/ctl-sock
+CTL=/tmp/openssh.regress.ctl-sock.$$
 
 tid="connection multiplexing"
 
@@ -89,6 +89,4 @@ ${SSH} -S $CTL -Oexit otherhost || fail "send exit command failed"
 # Wait for master to exit
 sleep 2
 
-ps -p $MASTER_PID >/dev/null && fail "exit command failed" 
-
-cleanup
+kill -0 $MASTER_PID >/dev/null 2>&1 && fail "exit command failed" 
diff --git a/regress/reexec.sh b/regress/reexec.sh
index d69b8c577..4f824a31d 100644
--- a/regress/reexec.sh
+++ b/regress/reexec.sh
@@ -3,10 +3,10 @@
 
 tid="reexec tests"
 
-DATA=/bin/ls
+DATA=/bin/ls${EXEEXT}
 COPY=${OBJ}/copy
-SSHD_ORIG=$SSHD
-SSHD_COPY=$OBJ/sshd
+SSHD_ORIG=$SSHD${EXEEXT}
+SSHD_COPY=$OBJ/sshd${EXEEXT}
 
 # Start a sshd and then delete it
 start_sshd_copy ()
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 4e53449be..4b3a70eb3 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -96,9 +96,10 @@ if [ "x$TEST_SSH_SCP" != "x" ]; then
 fi
 
 # Path to sshd must be absolute for rexec
-if [ ! -x /$SSHD ]; then
-        SSHD=`which sshd`
-fi
+case "$SSHD" in
+/*) ;;
+*) SSHD=`which sshd` ;;
+esac
 
 if [ "x$TEST_SSH_LOGFILE" = "x" ]; then
         TEST_SSH_LOGFILE=/dev/null
@@ -197,7 +198,7 @@ cat << EOF > $OBJ/sshd_config
         #ListenAddress          ::1
         PidFile                 $PIDFILE
         AuthorizedKeysFile      $OBJ/authorized_keys_%u
-        LogLevel                DEBUG
+        LogLevel                VERBOSE
         AcceptEnv               _XXX_TEST_*
         AcceptEnv               _XXX_TEST
         Subsystem       sftp    $SFTPSERVER
diff --git a/scp.0 b/scp.0
index f9368e71b..aa54dda3f 100644
--- a/scp.0
+++ b/scp.0
@@ -141,4 +141,4 @@ AUTHORS
      Timo Rinne <tri@iki.fi>
      Tatu Ylonen <ylo@cs.hut.fi>
 
-OpenBSD 3.6                   September 25, 1999                             3
+OpenBSD 3.8                   September 25, 1999                             3
diff --git a/scp.c b/scp.c
index f69fd05fc..1407aa71d 100644
--- a/scp.c
+++ b/scp.c
@@ -71,7 +71,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: scp.c,v 1.119 2005/01/24 10:22:06 dtucker Exp $");
+RCSID("$OpenBSD: scp.c,v 1.125 2005/07/27 10:39:03 dtucker Exp $");
 
 #include "xmalloc.h"
 #include "atomicio.h"
@@ -109,11 +109,13 @@ static void
 killchild(int signo)
 {
         if (do_cmd_pid > 1) {
-                kill(do_cmd_pid, signo);
+                kill(do_cmd_pid, signo ? signo : SIGTERM);
                 waitpid(do_cmd_pid, NULL, 0);
         }
 
-        _exit(1);
+        if (signo)
+                _exit(1);
+        exit(1);
 }
 
 /*
@@ -184,7 +186,7 @@ do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout, int argc)
 }
 
 typedef struct {
-        int cnt;
+        size_t cnt;
         char *buf;
 } BUF;
 
@@ -361,20 +363,21 @@ void
 toremote(char *targ, int argc, char **argv)
 {
         int i, len;
-        char *bp, *host, *src, *suser, *thost, *tuser;
+        char *bp, *host, *src, *suser, *thost, *tuser, *arg;
 
         *targ++ = 0;
         if (*targ == 0)
                 targ = ".";
 
-        if ((thost = strrchr(argv[argc - 1], '@'))) {
+        arg = xstrdup(argv[argc - 1]);
+        if ((thost = strrchr(arg, '@'))) {
                 /* user@host */
                 *thost++ = 0;
-                tuser = argv[argc - 1];
+                tuser = arg;
                 if (*tuser == '\0')
                         tuser = NULL;
         } else {
-                thost = argv[argc - 1];
+                thost = arg;
                 tuser = NULL;
         }
 
@@ -501,8 +504,9 @@ source(int argc, char **argv)
         struct stat stb;
         static BUF buffer;
         BUF *bp;
-        off_t i, amt, result, statbytes;
-        int fd, haderr, indx;
+        off_t i, amt, statbytes;
+        size_t result;
+        int fd = -1, haderr, indx;
         char *last, *name, buf[2048];
         int len;
 
@@ -577,14 +581,14 @@ next:			(void) close(fd);
                         if (!haderr) {
                                 result = atomicio(read, fd, bp->buf, amt);
                                 if (result != amt)
-                                        haderr = result >= 0 ? EIO : errno;
+                                        haderr = errno;
                         }
                         if (haderr)
                                 (void) atomicio(vwrite, remout, bp->buf, amt);
                         else {
                                 result = atomicio(vwrite, remout, bp->buf, amt);
                                 if (result != amt)
-                                        haderr = result >= 0 ? EIO : errno;
+                                        haderr = errno;
                                 statbytes += result;
                         }
                         if (limit_rate)
@@ -719,8 +723,9 @@ sink(int argc, char **argv)
                 YES, NO, DISPLAYED
         } wrerr;
         BUF *bp;
-        off_t i, j;
-        int amt, count, exists, first, mask, mode, ofd, omode;
+        off_t i;
+        size_t j, count;
+        int amt, exists, first, mask, mode, ofd, omode;
         off_t size, statbytes;
         int setimes, targisdir, wrerrno = 0;
         char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
@@ -747,7 +752,7 @@ sink(int argc, char **argv)
                 targisdir = 1;
         for (first = 1;; first = 0) {
                 cp = buf;
-                if (atomicio(read, remin, cp, 1) <= 0)
+                if (atomicio(read, remin, cp, 1) != 1)
                         return;
                 if (*cp++ == '\n')
                         SCREWUP("unexpected <newline>");
@@ -828,7 +833,7 @@ sink(int argc, char **argv)
                 }
                 if (targisdir) {
                         static char *namebuf;
-                        static int cursize;
+                        static size_t cursize;
                         size_t need;
 
                         need = strlen(targ) + strlen(cp) + 250;
@@ -901,7 +906,7 @@ bad:			run_err("%s: %s", np, strerror(errno));
                         count += amt;
                         do {
                                 j = atomicio(read, remin, cp, amt);
-                                if (j <= 0) {
+                                if (j == 0) {
                                         run_err("%s", j ? strerror(errno) :
                                             "dropped connection");
                                         exit(1);
@@ -917,10 +922,10 @@ bad:			run_err("%s: %s", np, strerror(errno));
                         if (count == bp->cnt) {
                                 /* Keep reading so we stay sync'd up. */
                                 if (wrerr == NO) {
-                                        j = atomicio(vwrite, ofd, bp->buf, count);
-                                        if (j != count) {
+                                        if (atomicio(vwrite, ofd, bp->buf,
+                                            count) != count) {
                                                 wrerr = YES;
-                                                wrerrno = j >= 0 ? EIO : errno;
+                                                wrerrno = errno;
                                         }
                                 }
                                 count = 0;
@@ -930,9 +935,9 @@ bad:			run_err("%s: %s", np, strerror(errno));
                 if (showprogress)
                         stop_progress_meter();
                 if (count != 0 && wrerr == NO &&
-                    (j = atomicio(vwrite, ofd, bp->buf, count)) != count) {
+                    atomicio(vwrite, ofd, bp->buf, count) != count) {
                         wrerr = YES;
-                        wrerrno = j >= 0 ? EIO : errno;
+                        wrerrno = errno;
                 }
                 if (wrerr == NO && ftruncate(ofd, size) != 0) {
                         run_err("%s: truncate: %s", np, strerror(errno));
@@ -1069,7 +1074,7 @@ verifydir(char *cp)
                 errno = ENOTDIR;
         }
         run_err("%s: %s", cp, strerror(errno));
-        exit(1);
+        killchild(0);
 }
 
 int
diff --git a/servconf.c b/servconf.c
index 2d1a0c362..becd5b7c5 100644
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.139 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.144 2005/08/06 10:03:12 dtucker Exp $");
 
 #include "ssh.h"
 #include "log.h"
@@ -72,6 +72,7 @@ initialize_server_options(ServerOptions *options)
         options->kerberos_ticket_cleanup = -1;
         options->kerberos_get_afs_token = -1;
         options->gss_authentication=-1;
+        options->gss_keyex = -1;
         options->gss_cleanup_creds = -1;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
@@ -186,6 +187,8 @@ fill_default_server_options(ServerOptions *options)
                 options->kerberos_get_afs_token = 0;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
+        if (options->gss_keyex == -1)
+                options->gss_keyex = 0;
         if (options->gss_cleanup_creds == -1)
                 options->gss_cleanup_creds = 1;
         if (options->password_authentication == -1)
@@ -201,7 +204,7 @@ fill_default_server_options(ServerOptions *options)
         if (options->use_login == -1)
                 options->use_login = 0;
         if (options->compression == -1)
-                options->compression = 1;
+                options->compression = COMP_DELAYED;
         if (options->allow_tcp_forwarding == -1)
                 options->allow_tcp_forwarding = 1;
         if (options->gateway_ports == -1)
@@ -270,7 +273,7 @@ typedef enum {
         sBanner, sUseDNS, sHostbasedAuthentication,
         sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
         sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
-        sGssAuthentication, sGssCleanupCreds, sAcceptEnv,
+        sGssAuthentication, sGssKeyEx, sGssCleanupCreds, sAcceptEnv,
         sUsePrivilegeSeparation,
         sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -324,9 +327,11 @@ static struct {
         { "afstokenpassing", sUnsupported },
 #ifdef GSSAPI
         { "gssapiauthentication", sGssAuthentication },
+        { "gssapikeyexchange", sGssKeyEx },
         { "gssapicleanupcredentials", sGssCleanupCreds },
 #else
         { "gssapiauthentication", sUnsupported },
+        { "gssapikeyexchange", sUnsupported },
         { "gssapicleanupcredentials", sUnsupported },
 #endif
         { "passwordauthentication", sPasswordAuthentication },
@@ -398,7 +403,7 @@ parse_token(const char *cp, const char *filename,
 static void
 add_listen_addr(ServerOptions *options, char *addr, u_short port)
 {
-        int i;
+        u_int i;
 
         if (options->num_ports == 0)
                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
@@ -438,9 +443,10 @@ process_server_config_line(ServerOptions *options, char *line,
     const char *filename, int linenum)
 {
         char *cp, **charptr, *arg, *p;
-        int *intptr, value, i, n;
+        int *intptr, value, n;
         ServerOpCodes opcode;
         u_short port;
+        u_int i;
 
         cp = line;
         arg = strdelim(&cp);
@@ -516,6 +522,12 @@ parse_time:
                 if (arg == NULL || *arg == '\0')
                         fatal("%s line %d: missing address",
                             filename, linenum);
+                /* check for bare IPv6 address: no "[]" and 2 or more ":" */
+                if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
+                    && strchr(p+1, ':') != NULL) {
+                        add_listen_addr(options, arg, 0);
+                        break;
+                }
                 p = hpdelim(&arg);
                 if (p == NULL)
                         fatal("%s line %d: bad address:port usage",
@@ -532,6 +544,9 @@ parse_time:
 
         case sAddressFamily:
                 arg = strdelim(&cp);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing address family.",
+                            filename, linenum);
                 intptr = &options->address_family;
                 if (options->listen_addrs != NULL)
                         fatal("%s line %d: address family must be specified before "
@@ -659,6 +674,10 @@ parse_flag:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
 
+        case sGssKeyEx:
+                intptr = &options->gss_keyex;
+                goto parse_flag;
+
         case sGssCleanupCreds:
                 intptr = &options->gss_cleanup_creds;
                 goto parse_flag;
@@ -721,7 +740,23 @@ parse_flag:
 
         case sCompression:
                 intptr = &options->compression;
-                goto parse_flag;
+                arg = strdelim(&cp);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing yes/no/delayed "
+                            "argument.", filename, linenum);
+                value = 0;      /* silence compiler */
+                if (strcmp(arg, "delayed") == 0)
+                        value = COMP_DELAYED;
+                else if (strcmp(arg, "yes") == 0)
+                        value = COMP_ZLIB;
+                else if (strcmp(arg, "no") == 0)
+                        value = COMP_NONE;
+                else
+                        fatal("%s line %d: Bad yes/no/delayed "
+                            "argument: %s", filename, linenum, arg);
+                if (*intptr == -1)
+                        *intptr = value;
+                break;
 
         case sGatewayPorts:
                 intptr = &options->gateway_ports;
@@ -1001,7 +1036,7 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf)
 
         obuf = cbuf = xstrdup(buffer_ptr(conf));
         linenum = 1;
-        while((cp = strsep(&cbuf, "\n")) != NULL) {
+        while ((cp = strsep(&cbuf, "\n")) != NULL) {
                 if (process_server_config_line(options, cp, filename,
                     linenum++) != 0)
                         bad_options++;
diff --git a/servconf.h b/servconf.h
index f7e56d521..3e4e07e08 100644
--- a/servconf.h
+++ b/servconf.h
@@ -88,6 +88,7 @@ typedef struct {
         int     kerberos_get_afs_token;         /* If true, try to get AFS token if
                                                  * authenticated with Kerberos. */
         int     gss_authentication;     /* If true, permit GSSAPI authentication */
+        int     gss_keyex;              /* If true, permit GSSAPI key exchange */
         int     gss_cleanup_creds;      /* If true, destroy cred cache on logout */
         int     password_authentication;        /* If true, permit password
                                                  * authentication. */
diff --git a/serverloop.c b/serverloop.c
index eee1e7959..d2eff170a 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: serverloop.c,v 1.117 2004/08/11 21:43:05 avsm Exp $");
+RCSID("$OpenBSD: serverloop.c,v 1.118 2005/07/17 07:17:55 djm Exp $");
 
 #include "xmalloc.h"
 #include "packet.h"
@@ -865,7 +865,7 @@ server_request_direct_tcpip(void)
         packet_check_eom();
 
         debug("server_request_direct_tcpip: originator %s port %d, target %s port %d",
-           originator, originator_port, target, target_port);
+            originator, originator_port, target, target_port);
 
         /* XXX check permission */
         sock = channel_connect_to(target, target_port);
@@ -983,7 +983,7 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
 #ifndef NO_IPPORT_RESERVED_CONCEPT
                     || (listen_port < IPPORT_RESERVED && pw->pw_uid != 0)
 #endif
-                   ) {
+                    ) {
                         success = 0;
                         packet_send_debug("Server has disabled port forwarding.");
                 } else {
diff --git a/session.c b/session.c
index b32c9e2ca..db8722f47 100644
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.181 2004/12/23 17:35:48 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.186 2005/07/25 11:59:40 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -56,6 +56,7 @@ RCSID("$OpenBSD: session.c,v 1.181 2004/12/23 17:35:48 markus Exp $");
 #include "serverloop.h"
 #include "canohost.h"
 #include "session.h"
+#include "kex.h"
 #include "monitor_wrap.h"
 
 #if defined(KRB5) && defined(USE_AFS)
@@ -196,11 +197,11 @@ auth_input_request_forwarding(struct passwd * pw)
 static void
 display_loginmsg(void)
 {
-        if (buffer_len(&loginmsg) > 0) {
-                buffer_append(&loginmsg, "\0", 1);
-                printf("%s", (char *)buffer_ptr(&loginmsg));
-                buffer_clear(&loginmsg);
-        }
+        if (buffer_len(&loginmsg) > 0) {
+                buffer_append(&loginmsg, "\0", 1);
+                printf("%s", (char *)buffer_ptr(&loginmsg));
+                buffer_clear(&loginmsg);
+        }
 }
 
 void
@@ -272,7 +273,7 @@ do_authenticated1(Authctxt *authctxt)
                                     compression_level);
                                 break;
                         }
-                        if (!options.compression) {
+                        if (options.compression == COMP_NONE) {
                                 debug2("compression disabled");
                                 break;
                         }
@@ -946,7 +947,8 @@ read_etc_default_login(char ***env, u_int *envsize, uid_t uid)
 }
 #endif /* HAVE_ETC_DEFAULT_LOGIN */
 
-void copy_environment(char **source, char ***env, u_int *envsize)
+void
+copy_environment(char **source, char ***env, u_int *envsize)
 {
         char *var_name, *var_val;
         int i;
@@ -1332,6 +1334,11 @@ do_setusercontext(struct passwd *pw)
 # ifdef _AIX
                 aix_usrinfo(pw);
 # endif /* _AIX */
+#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+                if (set_id(pw->pw_name) != 0) {
+                        exit(1);
+                }
+#endif /* HAVE_LIBIAF  && !BROKEN_LIBIAF */
                 /* Permanently switch to the desired uid. */
                 permanently_set_uid(pw);
 #endif
@@ -1477,7 +1484,8 @@ do_child(Session *s, const char *command)
         }
 
 #ifdef USE_PAM
-        if (options.use_pam && !is_pam_session_open()) {
+        if (options.use_pam && !options.use_login && !is_pam_session_open()) {
+                debug3("PAM session not opened, exiting");
                 display_loginmsg();
                 exit(254);
         }
@@ -1528,7 +1536,7 @@ do_child(Session *s, const char *command)
          */
 
         if (options.kerberos_get_afs_token && k_hasafs() &&
-             (s->authctxt->krb5_ctx != NULL)) {
+            (s->authctxt->krb5_ctx != NULL)) {
                 char cell[64];
 
                 debug("Getting AFS token");
@@ -1632,6 +1640,7 @@ session_new(void)
                         s->ttyfd = -1;
                         s->used = 1;
                         s->self = i;
+                        s->x11_chanids = NULL;
                         debug("session_new: session %d", i);
                         return s;
                 }
@@ -1705,6 +1714,29 @@ session_by_channel(int id)
 }
 
 static Session *
+session_by_x11_channel(int id)
+{
+        int i, j;
+
+        for (i = 0; i < MAX_SESSIONS; i++) {
+                Session *s = &sessions[i];
+
+                if (s->x11_chanids == NULL || !s->used)
+                        continue;
+                for (j = 0; s->x11_chanids[j] != -1; j++) {
+                        if (s->x11_chanids[j] == id) {
+                                debug("session_by_x11_channel: session %d "
+                                    "channel %d", s->self, id);
+                                return s;
+                        }
+                }
+        }
+        debug("session_by_x11_channel: unknown channel %d", id);
+        session_dump();
+        return NULL;
+}
+
+static Session *
 session_by_pid(pid_t pid)
 {
         int i;
@@ -1799,7 +1831,7 @@ session_subsystem_req(Session *s)
         u_int len;
         int success = 0;
         char *cmd, *subsys = packet_get_string(&len);
-        int i;
+        u_int i;
 
         packet_check_eom();
         logit("subsystem request for %.100s", subsys);
@@ -1833,6 +1865,11 @@ session_x11_req(Session *s)
 {
         int success;
 
+        if (s->auth_proto != NULL || s->auth_data != NULL) {
+                error("session_x11_req: session %d: "
+                    "x11 fowarding already active", s->self);
+                return 0;
+        }
         s->single_connection = packet_get_char();
         s->auth_proto = packet_get_string(NULL);
         s->auth_data = packet_get_string(NULL);
@@ -2058,9 +2095,66 @@ sig2name(int sig)
 }
 
 static void
+session_close_x11(int id)
+{
+        Channel *c;
+
+        if ((c = channel_lookup(id)) == NULL) {
+                debug("session_close_x11: x11 channel %d missing", id);
+        } else {
+                /* Detach X11 listener */
+                debug("session_close_x11: detach x11 channel %d", id);
+                channel_cancel_cleanup(id);
+                if (c->ostate != CHAN_OUTPUT_CLOSED)
+                        chan_mark_dead(c);
+        }
+}
+
+static void
+session_close_single_x11(int id, void *arg)
+{
+        Session *s;
+        u_int i;
+
+        debug3("session_close_single_x11: channel %d", id);
+        channel_cancel_cleanup(id);
+        if ((s  = session_by_x11_channel(id)) == NULL)
+                fatal("session_close_single_x11: no x11 channel %d", id);
+        for (i = 0; s->x11_chanids[i] != -1; i++) {
+                debug("session_close_single_x11: session %d: "
+                    "closing channel %d", s->self, s->x11_chanids[i]);
+                /*
+                 * The channel "id" is already closing, but make sure we
+                 * close all of its siblings.
+                 */
+                if (s->x11_chanids[i] != id)
+                        session_close_x11(s->x11_chanids[i]);
+        }
+        xfree(s->x11_chanids);
+        s->x11_chanids = NULL;
+        if (s->display) {
+                xfree(s->display);
+                s->display = NULL;
+        }
+        if (s->auth_proto) {
+                xfree(s->auth_proto);
+                s->auth_proto = NULL;
+        }
+        if (s->auth_data) {
+                xfree(s->auth_data);
+                s->auth_data = NULL;
+        }
+        if (s->auth_display) {
+                xfree(s->auth_display);
+                s->auth_display = NULL;
+        }
+}
+
+static void
 session_exit_message(Session *s, int status)
 {
         Channel *c;
+        u_int i;
 
         if ((c = channel_lookup(s->chanid)) == NULL)
                 fatal("session_exit_message: session %d: no channel %d",
@@ -2100,12 +2194,20 @@ session_exit_message(Session *s, int status)
         if (c->ostate != CHAN_OUTPUT_CLOSED)
                 chan_write_failed(c);
         s->chanid = -1;
+
+        /* Close any X11 listeners associated with this session */
+        if (s->x11_chanids != NULL) {
+                for (i = 0; s->x11_chanids[i] != -1; i++) {
+                        session_close_x11(s->x11_chanids[i]);
+                        s->x11_chanids[i] = -1;
+                }
+        }
 }
 
 void
 session_close(Session *s)
 {
-        int i;
+        u_int i;
 
         debug("session_close: session %d pid %ld", s->self, (long)s->pid);
         if (s->ttyfd != -1)
@@ -2114,6 +2216,8 @@ session_close(Session *s)
                 xfree(s->term);
         if (s->display)
                 xfree(s->display);
+        if (s->x11_chanids)
+                xfree(s->x11_chanids);
         if (s->auth_display)
                 xfree(s->auth_display);
         if (s->auth_data)
@@ -2152,6 +2256,7 @@ void
 session_close_by_channel(int id, void *arg)
 {
         Session *s = session_by_channel(id);
+
         if (s == NULL) {
                 debug("session_close_by_channel: no session for id %d", id);
                 return;
@@ -2232,6 +2337,7 @@ session_setup_x11fwd(Session *s)
         struct stat st;
         char display[512], auth_display[512];
         char hostname[MAXHOSTNAMELEN];
+        u_int i;
 
         if (no_x11_forwarding_flag) {
                 packet_send_debug("X11 forwarding disabled in user configuration file.");
@@ -2257,10 +2363,14 @@ session_setup_x11fwd(Session *s)
         }
         if (x11_create_display_inet(options.x11_display_offset,
             options.x11_use_localhost, s->single_connection,
-            &s->display_number) == -1) {
+            &s->display_number, &s->x11_chanids) == -1) {
                 debug("x11_create_display_inet failed.");
                 return 0;
         }
+        for (i = 0; s->x11_chanids[i] != -1; i++) {
+                channel_register_cleanup(s->x11_chanids[i],
+                    session_close_single_x11);
+        }
 
         /* Set up a suitable value for the DISPLAY variable. */
         if (gethostname(hostname, sizeof(hostname)) < 0)
diff --git a/session.h b/session.h
index 48be5070c..a2598a99c 100644
--- a/session.h
+++ b/session.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: session.h,v 1.23 2004/07/17 05:31:41 dtucker Exp $    */
+/*      $OpenBSD: session.h,v 1.25 2005/07/17 06:49:04 djm Exp $        */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -49,8 +49,9 @@ struct Session {
         int     single_connection;
         /* proto 2 */
         int     chanid;
+        int     *x11_chanids;
         int     is_subsystem;
-        int     num_env;
+        u_int   num_env;
         struct {
                 char    *name;
                 char    *val;
diff --git a/sftp-client.c b/sftp-client.c
index d894a11f2..afbd1e6f3 100644
--- a/sftp-client.c
+++ b/sftp-client.c
@@ -20,7 +20,7 @@
 /* XXX: copy between two remote sites */
 
 #include "includes.h"
-RCSID("$OpenBSD: sftp-client.c,v 1.52 2004/11/25 22:22:14 markus Exp $");
+RCSID("$OpenBSD: sftp-client.c,v 1.57 2005/07/27 10:39:03 dtucker Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -64,10 +64,10 @@ send_msg(int fd, Buffer *m)
 
         /* Send length first */
         PUT_32BIT(mlen, buffer_len(m));
-        if (atomicio(vwrite, fd, mlen, sizeof(mlen)) <= 0)
+        if (atomicio(vwrite, fd, mlen, sizeof(mlen)) != sizeof(mlen))
                 fatal("Couldn't send packet: %s", strerror(errno));
 
-        if (atomicio(vwrite, fd, buffer_ptr(m), buffer_len(m)) <= 0)
+        if (atomicio(vwrite, fd, buffer_ptr(m), buffer_len(m)) != buffer_len(m))
                 fatal("Couldn't send packet: %s", strerror(errno));
 
         buffer_clear(m);
@@ -76,26 +76,27 @@ send_msg(int fd, Buffer *m)
 static void
 get_msg(int fd, Buffer *m)
 {
-        ssize_t len;
         u_int msg_len;
 
         buffer_append_space(m, 4);
-        len = atomicio(read, fd, buffer_ptr(m), 4);
-        if (len == 0)
-                fatal("Connection closed");
-        else if (len == -1)
-                fatal("Couldn't read packet: %s", strerror(errno));
+        if (atomicio(read, fd, buffer_ptr(m), 4) != 4) {
+                if (errno == EPIPE)
+                        fatal("Connection closed");
+                else
+                        fatal("Couldn't read packet: %s", strerror(errno));
+        }
 
         msg_len = buffer_get_int(m);
         if (msg_len > MAX_MSG_LENGTH)
                 fatal("Received message too long %u", msg_len);
 
         buffer_append_space(m, msg_len);
-        len = atomicio(read, fd, buffer_ptr(m), msg_len);
-        if (len == 0)
-                fatal("Connection closed");
-        else if (len == -1)
-                fatal("Read packet: %s", strerror(errno));
+        if (atomicio(read, fd, buffer_ptr(m), msg_len) != msg_len) {
+                if (errno == EPIPE)
+                        fatal("Connection closed");
+                else
+                        fatal("Read packet: %s", strerror(errno));
+        }
 }
 
 static void
@@ -310,7 +311,7 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
     SFTP_DIRENT ***dir)
 {
         Buffer msg;
-        u_int type, id, handle_len, i, expected_id, ents = 0;
+        u_int count, type, id, handle_len, i, expected_id, ents = 0;
         char *handle;
 
         id = conn->msg_id++;
@@ -334,8 +335,6 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
         }
 
         for (; !interrupted;) {
-                int count;
-
                 id = expected_id = conn->msg_id++;
 
                 debug3("Sending SSH2_FXP_READDIR I:%u", id);
@@ -743,10 +742,10 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
         Attrib junk, *a;
         Buffer msg;
         char *handle;
-        int local_fd, status, num_req, max_req, write_error;
+        int local_fd, status = 0, write_error;
         int read_error, write_errno;
         u_int64_t offset, size;
-        u_int handle_len, mode, type, id, buflen;
+        u_int handle_len, mode, type, id, buflen, num_req, max_req;
         off_t progress_counter;
         struct request {
                 u_int id;
@@ -856,7 +855,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                 debug3("Received reply T:%u I:%u R:%d", type, id, max_req);
 
                 /* Find the request in our queue */
-                for(req = TAILQ_FIRST(&requests);
+                for (req = TAILQ_FIRST(&requests);
                     req != NULL && req->id != id;
                     req = TAILQ_NEXT(req, tq))
                         ;
@@ -1109,7 +1108,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
                         debug3("SSH2_FXP_STATUS %d", status);
 
                         /* Find the request in our queue */
-                        for(ack = TAILQ_FIRST(&acks);
+                        for (ack = TAILQ_FIRST(&acks);
                             ack != NULL && ack->id != r_id;
                             ack = TAILQ_NEXT(ack, tq))
                                 ;
@@ -1127,7 +1126,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
                                 goto done;
                         }
                         debug3("In write loop, ack for %u %u bytes at %llu",
-                           ack->id, ack->len, (unsigned long long)ack->offset);
+                            ack->id, ack->len, (unsigned long long)ack->offset);
                         ++ackid;
                         xfree(ack);
                 }
diff --git a/sftp-client.h b/sftp-client.h
index 991e05d33..c8a41f377 100644
--- a/sftp-client.h
+++ b/sftp-client.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-client.h,v 1.13 2004/11/29 07:41:24 djm Exp $ */
+/* $OpenBSD: sftp-client.h,v 1.14 2005/04/26 12:59:02 jmc Exp $ */
 
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
@@ -30,7 +30,7 @@ struct SFTP_DIRENT {
 };
 
 /*
- * Initialiase a SSH filexfer connection. Returns NULL on error or
+ * Initialise a SSH filexfer connection. Returns NULL on error or
  * a pointer to a initialized sftp_conn struct on success.
  */
 struct sftp_conn *do_init(int, int, u_int, u_int);
diff --git a/sftp-server.0 b/sftp-server.0
index 995e48ecd..285ff706e 100644
--- a/sftp-server.0
+++ b/sftp-server.0
@@ -24,4 +24,4 @@ AUTHORS
 HISTORY
      sftp-server first appeared in OpenBSD 2.8 .
 
-OpenBSD 3.6                     August 30, 2000                              1
+OpenBSD 3.8                     August 30, 2000                              1
diff --git a/sftp-server.c b/sftp-server.c
index e82280057..6870e7732 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.47 2004/06/25 05:38:48 dtucker Exp $");
+RCSID("$OpenBSD: sftp-server.c,v 1.48 2005/06/17 02:44:33 djm Exp $");
 
 #include "buffer.h"
 #include "bufaux.h"
@@ -130,7 +130,7 @@ Handle	handles[100];
 static void
 handle_init(void)
 {
-        int i;
+        u_int i;
 
         for (i = 0; i < sizeof(handles)/sizeof(Handle); i++)
                 handles[i].use = HANDLE_UNUSED;
@@ -139,7 +139,7 @@ handle_init(void)
 static int
 handle_new(int use, const char *name, int fd, DIR *dirp)
 {
-        int i;
+        u_int i;
 
         for (i = 0; i < sizeof(handles)/sizeof(Handle); i++) {
                 if (handles[i].use == HANDLE_UNUSED) {
@@ -156,7 +156,7 @@ handle_new(int use, const char *name, int fd, DIR *dirp)
 static int
 handle_is_ok(int i, int type)
 {
-        return i >= 0 && i < sizeof(handles)/sizeof(Handle) &&
+        return i >= 0 && (u_int)i < sizeof(handles)/sizeof(Handle) &&
             handles[i].use == type;
 }
 
@@ -477,10 +477,10 @@ process_write(void)
                 } else {
 /* XXX ATOMICIO ? */
                         ret = write(fd, data, len);
-                        if (ret == -1) {
+                        if (ret < 0) {
                                 error("process_write: write failed");
                                 status = errno_to_portable(errno);
-                        } else if (ret == len) {
+                        } else if ((size_t)ret == len) {
                                 status = SSH2_FX_OK;
                         } else {
                                 logit("nothing at all written");
diff --git a/sftp.0 b/sftp.0
index 5b1a2fc69..1205c437b 100644
--- a/sftp.0
+++ b/sftp.0
@@ -262,4 +262,4 @@ SEE ALSO
      T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh-
      filexfer-00.txt, January 2001, work in progress material.
 
-OpenBSD 3.6                    February 4, 2001                              4
+OpenBSD 3.8                    February 4, 2001                              4
diff --git a/sftp.c b/sftp.c
index f8553ed82..f98ed7d27 100644
--- a/sftp.c
+++ b/sftp.c
@@ -16,7 +16,7 @@
 
 #include "includes.h"
 
-RCSID("$OpenBSD: sftp.c,v 1.62 2005/02/20 22:59:06 djm Exp $");
+RCSID("$OpenBSD: sftp.c,v 1.66 2005/08/08 13:22:48 jaredy Exp $");
 
 #ifdef USE_LIBEDIT
 #include <histedit.h>
@@ -357,7 +357,7 @@ parse_ls_flags(const char **cpp, int *lflag)
 
         /* Check for flags */
         if (cp++[0] == '-') {
-                for(; strchr(WHITESPACE, *cp) == NULL; cp++) {
+                for (; strchr(WHITESPACE, *cp) == NULL; cp++) {
                         switch (*cp) {
                         case 'l':
                                 *lflag &= ~VIEW_FLAGS;
@@ -404,7 +404,7 @@ get_pathname(const char **cpp, char **path)
 {
         const char *cp = *cpp, *end;
         char quot;
-        int i, j;
+        u_int i, j;
 
         cp += strspn(cp, WHITESPACE);
         if (!*cp) {
@@ -664,14 +664,15 @@ sdirent_comp(const void *aa, const void *bb)
 static int
 do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 {
-        int n, c = 1, colspace = 0, columns = 1;
+        int n;
+        u_int c = 1, colspace = 0, columns = 1;
         SFTP_DIRENT **d;
 
         if ((n = do_readdir(conn, path, &d)) != 0)
                 return (n);
 
         if (!(lflag & LS_SHORT_VIEW)) {
-                int m = 0, width = 80;
+                u_int m = 0, width = 80;
                 struct winsize ws;
                 char *tmp;
 
@@ -747,7 +748,7 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
     int lflag)
 {
         glob_t g;
-        int i, c = 1, colspace = 0, columns = 1;
+        u_int i, c = 1, colspace = 0, columns = 1;
         Attrib *a = NULL;
 
         memset(&g, 0, sizeof(g));
@@ -783,7 +784,7 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
         }
 
         if (!(lflag & LS_SHORT_VIEW)) {
-                int m = 0, width = 80;
+                u_int m = 0, width = 80;
                 struct winsize ws;
 
                 /* Count entries for sort and find longest filename */
@@ -1236,7 +1237,7 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
         char *dir = NULL;
         char cmd[2048];
         struct sftp_conn *conn;
-        int err;
+        int err, interactive;
         EditLine *el = NULL;
 #ifdef USE_LIBEDIT
         History *hl = NULL;
@@ -1294,14 +1295,15 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
                 xfree(dir);
         }
 
-#if HAVE_SETVBUF
+#if defined(HAVE_SETVBUF) && !defined(BROKEN_SETVBUF)
         setvbuf(stdout, NULL, _IOLBF, 0);
         setvbuf(infile, NULL, _IOLBF, 0);
 #else
-       setlinebuf(stdout);
-       setlinebuf(infile);
+        setlinebuf(stdout);
+        setlinebuf(infile);
 #endif
 
+        interactive = !batchmode && isatty(STDIN_FILENO);
         err = 0;
         for (;;) {
                 char *cp;
@@ -1309,20 +1311,28 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
                 signal(SIGINT, SIG_IGN);
 
                 if (el == NULL) {
-                        printf("sftp> ");
+                        if (interactive)
+                                printf("sftp> ");
                         if (fgets(cmd, sizeof(cmd), infile) == NULL) {
-                                printf("\n");
+                                if (interactive)
+                                        printf("\n");
                                 break;
                         }
-                        if (batchmode) /* Echo command */
-                                printf("%s", cmd);
+                        if (!interactive) { /* Echo command */
+                                printf("sftp> %s", cmd);
+                                if (strlen(cmd) > 0 &&
+                                    cmd[strlen(cmd) - 1] != '\n')
+                                        printf("\n");
+                        }
                 } else {
 #ifdef USE_LIBEDIT
                         const char *line;
                         int count = 0;
 
-                        if ((line = el_gets(el, &count)) == NULL || count <= 0)
-                                break;
+                        if ((line = el_gets(el, &count)) == NULL || count <= 0) {
+                                printf("\n");
+                                break;
+                        }
                         history(hl, &hev, H_ENTER, line);
                         if (strlcpy(cmd, line, sizeof(cmd)) >= sizeof(cmd)) {
                                 fprintf(stderr, "Error: input line too long\n");
@@ -1345,6 +1355,11 @@ interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
         }
         xfree(pwd);
 
+#ifdef USE_LIBEDIT
+        if (el != NULL)
+                el_end(el);
+#endif /* USE_LIBEDIT */
+
         /* err == 1 signifies normal "quit" exit */
         return (err >= 0 ? 0 : -1);
 }
@@ -1475,7 +1490,7 @@ main(int argc, char **argv)
 
                         /* Allow "-" as stdin */
                         if (strcmp(optarg, "-") != 0 &&
-                           (infile = fopen(optarg, "r")) == NULL)
+                            (infile = fopen(optarg, "r")) == NULL)
                                 fatal("%s (%s).", strerror(errno), optarg);
                         showprogress = 0;
                         batchmode = 1;
@@ -1561,8 +1576,8 @@ main(int argc, char **argv)
         err = interactive_loop(in, out, file1, file2);
 
 #if !defined(USE_PIPES)
-       shutdown(in, SHUT_RDWR);
-       shutdown(out, SHUT_RDWR);
+        shutdown(in, SHUT_RDWR);
+        shutdown(out, SHUT_RDWR);
 #endif
 
         close(in);
diff --git a/ssh-add.0 b/ssh-add.0
index 28a2ad222..1c2455f9b 100644
--- a/ssh-add.0
+++ b/ssh-add.0
@@ -11,11 +11,11 @@ SYNOPSIS
 DESCRIPTION
      ssh-add adds RSA or DSA identities to the authentication agent,
      ssh-agent(1).  When run without arguments, it adds the files
-     $HOME/.ssh/id_rsa, $HOME/.ssh/id_dsa and $HOME/.ssh/identity.  Alterna-
-     tive file names can be given on the command line.  If any file requires a
-     passphrase, ssh-add asks for the passphrase from the user.  The
-     passphrase is read from the user's tty.  ssh-add retries the last
-     passphrase if multiple identity files are given.
+     ~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity.  Alternative file names
+     can be given on the command line.  If any file requires a passphrase,
+     ssh-add asks for the passphrase from the user.  The passphrase is read
+     from the user's tty.  ssh-add retries the last passphrase if multiple
+     identity files are given.
 
      The authentication agent must be running and the SSH_AUTH_SOCK environ-
      ment variable must contain the name of its socket for ssh-add to work.
@@ -70,15 +70,15 @@ ENVIRONMENT
              with the agent.
 
 FILES
-     $HOME/.ssh/identity
+     ~/.ssh/identity
              Contains the protocol version 1 RSA authentication identity of
              the user.
 
-     $HOME/.ssh/id_dsa
+     ~/.ssh/id_dsa
              Contains the protocol version 2 DSA authentication identity of
              the user.
 
-     $HOME/.ssh/id_rsa
+     ~/.ssh/id_rsa
              Contains the protocol version 2 RSA authentication identity of
              the user.
 
@@ -99,4 +99,4 @@ AUTHORS
      ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.6                   September 25, 1999                             2
+OpenBSD 3.8                   September 25, 1999                             2
diff --git a/ssh-add.1 b/ssh-add.1
index 1f3df5bec..327fcddae 100644
--- a/ssh-add.1
+++ b/ssh-add.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: ssh-add.1,v 1.42 2005/03/01 17:32:19 jmc Exp $
+.\"     $OpenBSD: ssh-add.1,v 1.43 2005/04/21 06:17:50 djm Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -57,10 +57,10 @@
 adds RSA or DSA identities to the authentication agent,
 .Xr ssh-agent 1 .
 When run without arguments, it adds the files
-.Pa $HOME/.ssh/id_rsa ,
-.Pa $HOME/.ssh/id_dsa
+.Pa ~/.ssh/id_rsa ,
+.Pa ~/.ssh/id_dsa
 and
-.Pa $HOME/.ssh/identity .
+.Pa ~/.ssh/identity .
 Alternative file names can be given on the command line.
 If any file requires a passphrase,
 .Nm
@@ -142,11 +142,11 @@ agent.
 .El
 .Sh FILES
 .Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
+.It Pa ~/.ssh/identity
 Contains the protocol version 1 RSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_dsa
+.It Pa ~/.ssh/id_dsa
 Contains the protocol version 2 DSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_rsa
+.It Pa ~/.ssh/id_rsa
 Contains the protocol version 2 RSA authentication identity of the user.
 .El
 .Pp
diff --git a/ssh-add.c b/ssh-add.c
index 06a52464e..a3428769c 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-add.c,v 1.70 2004/05/08 00:21:31 djm Exp $");
+RCSID("$OpenBSD: ssh-add.c,v 1.72 2005/07/17 07:17:55 djm Exp $");
 
 #include <openssl/evp.h>
 
@@ -145,7 +145,7 @@ add_file(AuthenticationConnection *ac, const char *filename)
                 /* clear passphrase since it did not work */
                 clear_pass();
                 snprintf(msg, sizeof msg, "Enter passphrase for %.200s: ",
-                   comment);
+                    comment);
                 for (;;) {
                         pass = read_passphrase(msg, RP_ALLOW_STDIN);
                         if (strcmp(pass, "") == 0) {
@@ -389,7 +389,7 @@ main(int argc, char **argv)
                         goto done;
                 }
 
-                for(i = 0; default_files[i]; i++) {
+                for (i = 0; default_files[i]; i++) {
                         snprintf(buf, sizeof(buf), "%s/%s", pw->pw_dir,
                             default_files[i]);
                         if (stat(buf, &st) < 0)
@@ -402,7 +402,7 @@ main(int argc, char **argv)
                 if (count == 0)
                         ret = 1;
         } else {
-                for(i = 0; i < argc; i++) {
+                for (i = 0; i < argc; i++) {
                         if (do_file(ac, deleting, argv[i]) == -1)
                                 ret = 1;
                 }
diff --git a/ssh-agent.0 b/ssh-agent.0
index c2d7efa57..8490a9da8 100644
--- a/ssh-agent.0
+++ b/ssh-agent.0
@@ -45,13 +45,12 @@ DESCRIPTION
 
      The agent initially does not have any private keys.  Keys are added using
      ssh-add(1).  When executed without arguments, ssh-add(1) adds the files
-     $HOME/.ssh/id_rsa, $HOME/.ssh/id_dsa and $HOME/.ssh/identity.  If the
-     identity has a passphrase, ssh-add(1) asks for the passphrase (using a
-     small X11 application if running under X11, or from the terminal if run-
-     ning without X).  It then sends the identity to the agent.  Several iden-
-     tities can be stored in the agent; the agent can automatically use any of
-     these identities.  ssh-add -l displays the identities currently held by
-     the agent.
+     ~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity.  If the identity has a
+     passphrase, ssh-add(1) asks for the passphrase (using a small X11 appli-
+     cation if running under X11, or from the terminal if running without X).
+     It then sends the identity to the agent.  Several identities can be
+     stored in the agent; the agent can automatically use any of these identi-
+     ties.  ssh-add -l displays the identities currently held by the agent.
 
      The idea is that the agent is run in the user's local PC, laptop, or ter-
      minal.  Authentication data need not be stored on any other machine, and
@@ -87,15 +86,15 @@ DESCRIPTION
      terminates.
 
 FILES
-     $HOME/.ssh/identity
+     ~/.ssh/identity
              Contains the protocol version 1 RSA authentication identity of
              the user.
 
-     $HOME/.ssh/id_dsa
+     ~/.ssh/id_dsa
              Contains the protocol version 2 DSA authentication identity of
              the user.
 
-     $HOME/.ssh/id_rsa
+     ~/.ssh/id_rsa
              Contains the protocol version 2 RSA authentication identity of
              the user.
 
@@ -115,4 +114,4 @@ AUTHORS
      ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.6                   September 25, 1999                             2
+OpenBSD 3.8                   September 25, 1999                             2
diff --git a/ssh-agent.1 b/ssh-agent.1
index 226804e5f..741cf4bd1 100644
--- a/ssh-agent.1
+++ b/ssh-agent.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-agent.1,v 1.41 2004/07/11 17:48:47 deraadt Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.42 2005/04/21 06:17:50 djm Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -111,10 +111,10 @@ Keys are added using
 When executed without arguments,
 .Xr ssh-add 1
 adds the files
-.Pa $HOME/.ssh/id_rsa ,
-.Pa $HOME/.ssh/id_dsa
+.Pa ~/.ssh/id_rsa ,
+.Pa ~/.ssh/id_dsa
 and
-.Pa $HOME/.ssh/identity .
+.Pa ~/.ssh/identity .
 If the identity has a passphrase,
 .Xr ssh-add 1
 asks for the passphrase (using a small X11 application if running
@@ -179,11 +179,11 @@ The agent exits automatically when the command given on the command
 line terminates.
 .Sh FILES
 .Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
+.It Pa ~/.ssh/identity
 Contains the protocol version 1 RSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_dsa
+.It Pa ~/.ssh/id_dsa
 Contains the protocol version 2 DSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_rsa
+.It Pa ~/.ssh/id_rsa
 Contains the protocol version 2 RSA authentication identity of the user.
 .It Pa /tmp/ssh-XXXXXXXX/agent.<ppid>
 Unix-domain sockets used to contain the connection to the
diff --git a/ssh-gss.h b/ssh-gss.h
index 74ce6f8bc..213930103 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -67,7 +67,10 @@
 #define SSH2_MSG_KEXGSS_COMPLETE                       32
 #define SSH2_MSG_KEXGSS_HOSTKEY                                33
 #define SSH2_MSG_KEXGSS_ERROR                          34
-#define KEX_GSS_SHA1                                   "gss-group1-sha1-"
+#define SSH2_MSG_KEXGSS_GROUPREQ                        40
+#define SSH2_MSG_KEXGSS_GROUP                           41
+#define KEX_GSS_GRP1_SHA1_ID                            "gss-group1-sha1-"
+#define KEX_GSS_GEX_SHA1_ID                             "gss-gex-sha1-"
 
 typedef struct {
         char *filename;
@@ -130,10 +133,10 @@ OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
 void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
 
 typedef int ssh_gssapi_check_fn(gss_OID, void *);
-char *ssh_gssapi_client_mechanisms(char *host);
+char *ssh_gssapi_client_mechanisms(const char *host);
 char *ssh_gssapi_kex_mechs(gss_OID_set, ssh_gssapi_check_fn *, void *);
 int ssh_gssapi_check_mechanism(gss_OID, void *);
-gss_OID ssh_gssapi_id_kex(Gssctxt *, char *);
+gss_OID ssh_gssapi_id_kex(Gssctxt *, char *, int *);
 
 int ssh_gssapi_server_check_mech(gss_OID, void *);
 int ssh_gssapi_userok(char *name);
@@ -141,7 +144,8 @@ OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
 void ssh_gssapi_do_child(char ***, u_int *);
 void ssh_gssapi_cleanup_creds(void);
 void ssh_gssapi_storecreds(void);
-
+char * ssh_gssapi_server_mechanisms(void);
+int ssh_gssapi_oid_table_ok();
 #endif /* GSSAPI */
 
 #endif /* _SSH_GSS_H */
diff --git a/ssh-keygen.0 b/ssh-keygen.0
index 998b6f1e0..de651e9c4 100644
--- a/ssh-keygen.0
+++ b/ssh-keygen.0
@@ -33,9 +33,9 @@ DESCRIPTION
      group exchange (DH-GEX).  See the MODULI GENERATION section for details.
 
      Normally each user wishing to use SSH with RSA or DSA authentication runs
-     this once to create the authentication key in $HOME/.ssh/identity,
-     $HOME/.ssh/id_dsa or $HOME/.ssh/id_rsa.  Additionally, the system admin-
-     istrator may use this to generate host keys, as seen in /etc/rc.
+     this once to create the authentication key in ~/.ssh/identity,
+     ~/.ssh/id_dsa or ~/.ssh/id_rsa.  Additionally, the system administrator
+     may use this to generate host keys, as seen in /etc/rc.
 
      Normally this program generates the key and asks for a file in which to
      store the private key.  The public key is stored in a file with the same
@@ -75,8 +75,8 @@ DESCRIPTION
 
      -b bits
              Specifies the number of bits in the key to create.  Minimum is
-             512 bits.  Generally, 1024 bits is considered sufficient.  The
-             default is 1024 bits.
+             512 bits.  Generally, 2048 bits is considered sufficient.  The
+             default is 2048 bits.
 
      -C comment
              Provides a new comment.
@@ -110,13 +110,14 @@ DESCRIPTION
      -g      Use generic DNS format when printing fingerprint resource records
              using the -r command.
 
-     -H      Hash a known_hosts file, printing the result to standard output.
-             This replaces all hostnames and addresses with hashed representa-
-             tions.  These hashes may be used normally by ssh and sshd, but
-             they do not reveal identifying information should the file's con-
-             tents be disclosed.  This option will not modify existing hashed
-             hostnames and is therefore safe to use on files that mix hashed
-             and non-hashed names.
+     -H      Hash a known_hosts file.  This replaces all hostnames and ad-
+             dresses with hashed representations within the specified file;
+             the original content is moved to a file with a .old suffix.
+             These hashes may be used normally by ssh and sshd, but they do
+             not reveal identifying information should the file's contents be
+             disclosed.  This option will not modify existing hashed hostnames
+             and is therefore safe to use on files that mix hashed and non-
+             hashed names.
 
      -i      This option will read an unencrypted private (or public) key file
              in SSH2-compatible format and print an OpenSSH compatible private
@@ -216,7 +217,7 @@ MODULI GENERATION
      a connection share common moduli.
 
 FILES
-     $HOME/.ssh/identity
+     ~/.ssh/identity
              Contains the protocol version 1 RSA authentication identity of
              the user.  This file should not be readable by anyone but the us-
              er.  It is possible to specify a passphrase when generating the
@@ -225,14 +226,14 @@ FILES
              ssh-keygen but it is offered as the default file for the private
              key.  ssh(1) will read this file when a login attempt is made.
 
-     $HOME/.ssh/identity.pub
+     ~/.ssh/identity.pub
              Contains the protocol version 1 RSA public key for authentica-
              tion.  The contents of this file should be added to
-             $HOME/.ssh/authorized_keys on all machines where the user wishes
-             to log in using RSA authentication.  There is no need to keep the
+             ~/.ssh/authorized_keys on all machines where the user wishes to
+             log in using RSA authentication.  There is no need to keep the
              contents of this file secret.
 
-     $HOME/.ssh/id_dsa
+     ~/.ssh/id_dsa
              Contains the protocol version 2 DSA authentication identity of
              the user.  This file should not be readable by anyone but the us-
              er.  It is possible to specify a passphrase when generating the
@@ -241,14 +242,14 @@ FILES
              ssh-keygen but it is offered as the default file for the private
              key.  ssh(1) will read this file when a login attempt is made.
 
-     $HOME/.ssh/id_dsa.pub
+     ~/.ssh/id_dsa.pub
              Contains the protocol version 2 DSA public key for authentica-
              tion.  The contents of this file should be added to
-             $HOME/.ssh/authorized_keys on all machines where the user wishes
-             to log in using public key authentication.  There is no need to
-             keep the contents of this file secret.
+             ~/.ssh/authorized_keys on all machines where the user wishes to
+             log in using public key authentication.  There is no need to keep
+             the contents of this file secret.
 
-     $HOME/.ssh/id_rsa
+     ~/.ssh/id_rsa
              Contains the protocol version 2 RSA authentication identity of
              the user.  This file should not be readable by anyone but the us-
              er.  It is possible to specify a passphrase when generating the
@@ -257,12 +258,12 @@ FILES
              ssh-keygen but it is offered as the default file for the private
              key.  ssh(1) will read this file when a login attempt is made.
 
-     $HOME/.ssh/id_rsa.pub
+     ~/.ssh/id_rsa.pub
              Contains the protocol version 2 RSA public key for authentica-
              tion.  The contents of this file should be added to
-             $HOME/.ssh/authorized_keys on all machines where the user wishes
-             to log in using public key authentication.  There is no need to
-             keep the contents of this file secret.
+             ~/.ssh/authorized_keys on all machines where the user wishes to
+             log in using public key authentication.  There is no need to keep
+             the contents of this file secret.
 
      /etc/moduli
              Contains Diffie-Hellman groups used for DH-GEX.  The file format
@@ -281,4 +282,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.6                   September 25, 1999                             5
+OpenBSD 3.8                   September 25, 1999                             5
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 3987b1e66..5454d00ce 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: ssh-keygen.1,v 1.66 2005/03/01 18:15:56 jmc Exp $
+.\"     $OpenBSD: ssh-keygen.1,v 1.69 2005/06/08 03:50:00 djm Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -129,10 +129,10 @@ section for details.
 Normally each user wishing to use SSH
 with RSA or DSA authentication runs this once to create the authentication
 key in
-.Pa $HOME/.ssh/identity ,
-.Pa $HOME/.ssh/id_dsa
+.Pa ~/.ssh/identity ,
+.Pa ~/.ssh/id_dsa
 or
-.Pa $HOME/.ssh/id_rsa .
+.Pa ~/.ssh/id_rsa .
 Additionally, the system administrator may use this to generate host keys,
 as seen in
 .Pa /etc/rc .
@@ -188,8 +188,8 @@ Show the bubblebabble digest of specified private or public key file.
 .It Fl b Ar bits
 Specifies the number of bits in the key to create.
 Minimum is 512 bits.
-Generally, 1024 bits is considered sufficient.
-The default is 1024 bits.
+Generally, 2048 bits is considered sufficient.
+The default is 2048 bits.
 .It Fl C Ar comment
 Provides a new comment.
 .It Fl c
@@ -232,8 +232,10 @@ command.
 .It Fl H
 Hash a
 .Pa known_hosts
-file, printing the result to standard output.
-This replaces all hostnames and addresses with hashed representations.
+file.
+This replaces all hostnames and addresses with hashed representations
+within the specified file; the original content is moved to a file with
+a .old suffix.
 These hashes may be used normally by
 .Nm ssh
 and
@@ -379,7 +381,7 @@ It is important that this file contains moduli of a range of bit lengths and
 that both ends of a connection share common moduli.
 .Sh FILES
 .Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
+.It Pa ~/.ssh/identity
 Contains the protocol version 1 RSA authentication identity of the user.
 This file should not be readable by anyone but the user.
 It is possible to
@@ -390,14 +392,14 @@ This file is not automatically accessed by
 but it is offered as the default file for the private key.
 .Xr ssh 1
 will read this file when a login attempt is made.
-.It Pa $HOME/.ssh/identity.pub
+.It Pa ~/.ssh/identity.pub
 Contains the protocol version 1 RSA public key for authentication.
 The contents of this file should be added to
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 on all machines
 where the user wishes to log in using RSA authentication.
 There is no need to keep the contents of this file secret.
-.It Pa $HOME/.ssh/id_dsa
+.It Pa ~/.ssh/id_dsa
 Contains the protocol version 2 DSA authentication identity of the user.
 This file should not be readable by anyone but the user.
 It is possible to
@@ -408,14 +410,14 @@ This file is not automatically accessed by
 but it is offered as the default file for the private key.
 .Xr ssh 1
 will read this file when a login attempt is made.
-.It Pa $HOME/.ssh/id_dsa.pub
+.It Pa ~/.ssh/id_dsa.pub
 Contains the protocol version 2 DSA public key for authentication.
 The contents of this file should be added to
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 on all machines
 where the user wishes to log in using public key authentication.
 There is no need to keep the contents of this file secret.
-.It Pa $HOME/.ssh/id_rsa
+.It Pa ~/.ssh/id_rsa
 Contains the protocol version 2 RSA authentication identity of the user.
 This file should not be readable by anyone but the user.
 It is possible to
@@ -426,10 +428,10 @@ This file is not automatically accessed by
 but it is offered as the default file for the private key.
 .Xr ssh 1
 will read this file when a login attempt is made.
-.It Pa $HOME/.ssh/id_rsa.pub
+.It Pa ~/.ssh/id_rsa.pub
 Contains the protocol version 2 RSA public key for authentication.
 The contents of this file should be added to
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 on all machines
 where the user wishes to log in using public key authentication.
 There is no need to keep the contents of this file secret.
diff --git a/ssh-keygen.c b/ssh-keygen.c
index a9931d4d8..b17851946 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.120 2005/03/02 01:27:41 djm Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.128 2005/07/17 07:17:55 djm Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -36,7 +36,7 @@ RCSID("$OpenBSD: ssh-keygen.c,v 1.120 2005/03/02 01:27:41 djm Exp $");
 #include "dns.h"
 
 /* Number of bits in the RSA/DSA key.  This value can be changed on the command line. */
-int bits = 1024;
+u_int32_t bits = 2048;
 
 /*
  * Flag indicating that we just want to change the passphrase.  This can be
@@ -90,7 +90,7 @@ extern char *__progname;
 char hostname[MAXHOSTNAMELEN];
 
 /* moduli.c */
-int gen_candidates(FILE *, int, int, BIGNUM *);
+int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
 int prime_test(FILE *, FILE *, u_int32_t, u_int32_t);
 
 static void
@@ -684,7 +684,7 @@ do_known_hosts(struct passwd *pw, const char *name)
                                 if (delete_host && !c)
                                         print_host(out, cp, public, 0);
                         } else if (hash_hosts) {
-                                for(cp2 = strsep(&cp, ",");
+                                for (cp2 = strsep(&cp, ",");
                                     cp2 != NULL && *cp2 != '\0';
                                     cp2 = strsep(&cp, ",")) {
                                         if (strcspn(cp2, "*?!") != strlen(cp2))
@@ -707,7 +707,7 @@ do_known_hosts(struct passwd *pw, const char *name)
                     identity_file);
                 if (inplace) {
                         fprintf(stderr, "Not replacing existing known_hosts "
-                            "file beacuse of errors");
+                            "file because of errors\n");
                         fclose(out);
                         unlink(tmp);
                 }
@@ -738,7 +738,7 @@ do_known_hosts(struct passwd *pw, const char *name)
                         fprintf(stderr, "WARNING: %s contains unhashed "
                             "entries\n", old);
                         fprintf(stderr, "Delete this file to ensure privacy "
-                             "of hostnames\n");
+                            "of hostnames\n");
                 }
         }
 
@@ -959,31 +959,38 @@ usage(void)
 {
         fprintf(stderr, "Usage: %s [options]\n", __progname);
         fprintf(stderr, "Options:\n");
+        fprintf(stderr, "  -a trials   Number of trials for screening DH-GEX moduli.\n");
+        fprintf(stderr, "  -B          Show bubblebabble digest of key file.\n");
         fprintf(stderr, "  -b bits     Number of bits in the key to create.\n");
+        fprintf(stderr, "  -C comment  Provide new comment.\n");
         fprintf(stderr, "  -c          Change comment in private and public key files.\n");
+#ifdef SMARTCARD
+        fprintf(stderr, "  -D reader   Download public key from smartcard.\n");
+#endif /* SMARTCARD */
         fprintf(stderr, "  -e          Convert OpenSSH to IETF SECSH key file.\n");
+        fprintf(stderr, "  -F hostname Find hostname in known hosts file.\n");
         fprintf(stderr, "  -f filename Filename of the key file.\n");
+        fprintf(stderr, "  -G file     Generate candidates for DH-GEX moduli.\n");
         fprintf(stderr, "  -g          Use generic DNS resource record format.\n");
+        fprintf(stderr, "  -H          Hash names in known_hosts file.\n");
         fprintf(stderr, "  -i          Convert IETF SECSH to OpenSSH key file.\n");
         fprintf(stderr, "  -l          Show fingerprint of key file.\n");
-        fprintf(stderr, "  -p          Change passphrase of private key file.\n");
-        fprintf(stderr, "  -q          Quiet.\n");
-        fprintf(stderr, "  -y          Read private key file and print public key.\n");
-        fprintf(stderr, "  -t type     Specify type of key to create.\n");
-        fprintf(stderr, "  -B          Show bubblebabble digest of key file.\n");
-        fprintf(stderr, "  -H          Hash names in known_hosts file\n");
-        fprintf(stderr, "  -F hostname Find hostname in known hosts file\n");
-        fprintf(stderr, "  -C comment  Provide new comment.\n");
+        fprintf(stderr, "  -M memory   Amount of memory (MB) to use for generating DH-GEX moduli.\n");
         fprintf(stderr, "  -N phrase   Provide new passphrase.\n");
         fprintf(stderr, "  -P phrase   Provide old passphrase.\n");
+        fprintf(stderr, "  -p          Change passphrase of private key file.\n");
+        fprintf(stderr, "  -q          Quiet.\n");
+        fprintf(stderr, "  -R hostname Remove host from known_hosts file.\n");
         fprintf(stderr, "  -r hostname Print DNS resource record.\n");
+        fprintf(stderr, "  -S start    Start point (hex) for generating DH-GEX moduli.\n");
+        fprintf(stderr, "  -T file     Screen candidates for DH-GEX moduli.\n");
+        fprintf(stderr, "  -t type     Specify type of key to create.\n");
 #ifdef SMARTCARD
-        fprintf(stderr, "  -D reader   Download public key from smartcard.\n");
         fprintf(stderr, "  -U reader   Upload private key to smartcard.\n");
 #endif /* SMARTCARD */
-
-        fprintf(stderr, "  -G file     Generate candidates for DH-GEX moduli\n");
-        fprintf(stderr, "  -T file     Screen candidates for DH-GEX moduli\n");
+        fprintf(stderr, "  -v          Verbose.\n");
+        fprintf(stderr, "  -W gen      Generator to use for generating DH-GEX moduli.\n");
+        fprintf(stderr, "  -y          Read private key file and print public key.\n");
 
         exit(1);
 }
@@ -1000,12 +1007,13 @@ main(int ac, char **av)
         Key *private, *public;
         struct passwd *pw;
         struct stat st;
-        int opt, type, fd, download = 0, memory = 0;
-        int generator_wanted = 0, trials = 100;
+        int opt, type, fd, download = 0;
+        u_int32_t memory = 0, generator_wanted = 0, trials = 100;
         int do_gen_candidates = 0, do_screen_candidates = 0;
         int log_level = SYSLOG_LEVEL_INFO;
         BIGNUM *start = NULL;
         FILE *f;
+        const char *errstr;
 
         extern int optind;
         extern char *optarg;
@@ -1033,11 +1041,10 @@ main(int ac, char **av)
             "degiqpclBHvxXyF:b:f:t:U:D:P:N:C:r:g:R:T:G:M:S:a:W:")) != -1) {
                 switch (opt) {
                 case 'b':
-                        bits = atoi(optarg);
-                        if (bits < 512 || bits > 32768) {
-                                printf("Bits has bad value.\n");
-                                exit(1);
-                        }
+                        bits = strtonum(optarg, 512, 32768, &errstr);
+                        if (errstr)
+                                fatal("Bits has bad value %s (%s)",
+                                        optarg, errstr);
                         break;
                 case 'F':
                         find_host = 1;
@@ -1063,7 +1070,9 @@ main(int ac, char **av)
                         change_comment = 1;
                         break;
                 case 'f':
-                        strlcpy(identity_file, optarg, sizeof(identity_file));
+                        if (strlcpy(identity_file, optarg, sizeof(identity_file)) >=
+                            sizeof(identity_file))
+                                fatal("Identity filename too long");
                         have_identity = 1;
                         break;
                 case 'g':
@@ -1118,23 +1127,34 @@ main(int ac, char **av)
                         rr_hostname = optarg;
                         break;
                 case 'W':
-                        generator_wanted = atoi(optarg);
-                        if (generator_wanted < 1)
-                                fatal("Desired generator has bad value.");
+                        generator_wanted = strtonum(optarg, 1, UINT_MAX, &errstr);
+                        if (errstr)
+                                fatal("Desired generator has bad value: %s (%s)",
+                                        optarg, errstr);
                         break;
                 case 'a':
-                        trials = atoi(optarg);
+                        trials = strtonum(optarg, 1, UINT_MAX, &errstr);
+                        if (errstr)
+                                fatal("Invalid number of trials: %s (%s)",
+                                        optarg, errstr);
                         break;
                 case 'M':
-                        memory = atoi(optarg);
+                        memory = strtonum(optarg, 1, UINT_MAX, &errstr);
+                        if (errstr) {
+                                fatal("Memory limit is %s: %s", errstr, optarg);
+                        }
                         break;
                 case 'G':
                         do_gen_candidates = 1;
-                        strlcpy(out_file, optarg, sizeof(out_file));
+                        if (strlcpy(out_file, optarg, sizeof(out_file)) >=
+                            sizeof(out_file))
+                                fatal("Output filename too long");
                         break;
                 case 'T':
                         do_screen_candidates = 1;
-                        strlcpy(out_file, optarg, sizeof(out_file));
+                        if (strlcpy(out_file, optarg, sizeof(out_file)) >=
+                            sizeof(out_file))
+                                fatal("Output filename too long");
                         break;
                 case 'S':
                         /* XXX - also compare length against bits */
diff --git a/ssh-keyscan.0 b/ssh-keyscan.0
index 4bbfd1483..b365148e4 100644
--- a/ssh-keyscan.0
+++ b/ssh-keyscan.0
@@ -104,4 +104,4 @@ BUGS
      This is because it opens a connection to the ssh port, reads the public
      key, and drops the connection as soon as it gets the key.
 
-OpenBSD 3.6                     January 1, 1996                              2
+OpenBSD 3.8                     January 1, 1996                              2
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index bc2c3b728..46f063687 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -7,7 +7,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keyscan.c,v 1.52 2005/03/01 15:47:14 jmc Exp $");
+RCSID("$OpenBSD: ssh-keyscan.c,v 1.55 2005/06/17 02:44:33 djm Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -166,7 +166,7 @@ Linebuf_lineno(Linebuf * lb)
 static char *
 Linebuf_getline(Linebuf * lb)
 {
-        int n = 0;
+        size_t n = 0;
         void *p;
 
         lb->lineno++;
@@ -493,7 +493,7 @@ conrecycle(int s)
 static void
 congreet(int s)
 {
-        int remote_major = 0, remote_minor = 0, n = 0;
+        int n = 0, remote_major = 0, remote_minor = 0;
         char buf[256], *cp;
         char remote_version[sizeof buf];
         size_t bufsiz;
@@ -506,14 +506,17 @@ congreet(int s)
                         *cp = '\n';
                 cp++;
         }
-        if (n < 0) {
-                if (errno != ECONNREFUSED)
-                        error("read (%s): %s", c->c_name, strerror(errno));
-                conrecycle(s);
-                return;
-        }
         if (n == 0) {
-                error("%s: Connection closed by remote host", c->c_name);
+                switch (errno) {
+                case EPIPE:
+                        error("%s: Connection closed by remote host", c->c_name);
+                        break;
+                case ECONNREFUSED:
+                        break;
+                default:
+                        error("read (%s): %s", c->c_name, strerror(errno));
+                        break;
+                }
                 conrecycle(s);
                 return;
         }
@@ -543,7 +546,12 @@ congreet(int s)
         n = snprintf(buf, sizeof buf, "SSH-%d.%d-OpenSSH-keyscan\r\n",
             c->c_keytype == KT_RSA1? PROTOCOL_MAJOR_1 : PROTOCOL_MAJOR_2,
             c->c_keytype == KT_RSA1? PROTOCOL_MINOR_1 : PROTOCOL_MINOR_2);
-        if (atomicio(vwrite, s, buf, n) != n) {
+        if (n < 0 || (size_t)n >= sizeof(buf)) {
+                error("snprintf: buffer too small");
+                confree(s);
+                return;
+        }
+        if (atomicio(vwrite, s, buf, n) != (size_t)n) {
                 error("write (%s): %s", c->c_name, strerror(errno));
                 confree(s);
                 return;
@@ -561,14 +569,14 @@ static void
 conread(int s)
 {
         con *c = &fdcon[s];
-        int n;
+        size_t n;
 
         if (c->c_status == CS_CON) {
                 congreet(s);
                 return;
         }
         n = atomicio(read, s, c->c_data + c->c_off, c->c_len - c->c_off);
-        if (n < 0) {
+        if (n == 0) {
                 error("read (%s): %s", c->c_name, strerror(errno));
                 confree(s);
                 return;
diff --git a/ssh-keysign.0 b/ssh-keysign.0
index e10b8ac45..ea944a6fe 100644
--- a/ssh-keysign.0
+++ b/ssh-keysign.0
@@ -39,4 +39,4 @@ HISTORY
 AUTHORS
      Markus Friedl <markus@openbsd.org>
 
-OpenBSD 3.6                      May 24, 2002                                1
+OpenBSD 3.8                      May 24, 2002                                1
diff --git a/ssh-rand-helper.0 b/ssh-rand-helper.0
index 9af5fdd8f..35a7a7ce5 100644
--- a/ssh-rand-helper.0
+++ b/ssh-rand-helper.0
@@ -46,4 +46,4 @@ AUTHORS
 SEE ALSO
      ssh(1), ssh-add(1), ssh-keygen(1), sshd(8)
 
-OpenBSD 3.6                     April 14, 2002                               1
+OpenBSD 3.8                     April 14, 2002                               1
diff --git a/ssh-rand-helper.c b/ssh-rand-helper.c
index d7d8d0f3b..87e52cf75 100644
--- a/ssh-rand-helper.c
+++ b/ssh-rand-helper.c
@@ -39,7 +39,7 @@
 #include "pathnames.h"
 #include "log.h"
 
-RCSID("$Id: ssh-rand-helper.c,v 1.23 2005/02/16 02:32:30 dtucker Exp $");
+RCSID("$Id: ssh-rand-helper.c,v 1.26 2005/07/17 07:26:44 djm Exp $");
 
 /* Number of bytes we write out */
 #define OUTPUT_SEED_SIZE        48
@@ -123,7 +123,7 @@ get_random_bytes_prngd(unsigned char *buf, int len,
     unsigned short tcp_port, char *socket_path)
 {
         int fd, addr_len, rval, errors;
-        char msg[2];
+        u_char msg[2];
         struct sockaddr_storage addr;
         struct sockaddr_in *addr_in = (struct sockaddr_in *)&addr;
         struct sockaddr_un *addr_un = (struct sockaddr_un *)&addr;
@@ -135,8 +135,8 @@ get_random_bytes_prngd(unsigned char *buf, int len,
         if (socket_path != NULL &&
             strlen(socket_path) >= sizeof(addr_un->sun_path))
                 fatal("Random pool path is too long");
-        if (len > 255)
-                fatal("Too many bytes to read from PRNGD");
+        if (len <= 0 || len > 255)
+                fatal("Too many bytes (%d) to read from PRNGD", len);
 
         memset(&addr, '\0', sizeof(addr));
 
@@ -190,7 +190,7 @@ reopen:
                 goto done;
         }
 
-        if (atomicio(read, fd, buf, len) != len) {
+        if (atomicio(read, fd, buf, len) != (size_t)len) {
                 if (errno == EPIPE && errors < 10) {
                         close(fd);
                         errors++;
@@ -398,8 +398,8 @@ hash_command_output(entropy_cmd_t *src, unsigned char *hash)
         debug3("Time elapsed: %d msec", msec_elapsed);
 
         if (waitpid(pid, &status, 0) == -1) {
-               error("Couldn't wait for child '%s' completion: %s",
-                   src->cmdstring, strerror(errno));
+                error("Couldn't wait for child '%s' completion: %s",
+                    src->cmdstring, strerror(errno));
                 return 0.0;
         }
 
@@ -600,7 +600,7 @@ prng_write_seedfile(void)
                         save_errno = errno;
                         unlink(tmpseed);
                         fatal("problem renaming PRNG seedfile from %.100s "
-                            "to %.100s (%.100s)", tmpseed, filename, 
+                            "to %.100s (%.100s)", tmpseed, filename,
                             strerror(save_errno));
                 }
         }
diff --git a/ssh-rsa.c b/ssh-rsa.c
index 6e3be0a7e..eb422d07e 100644
--- a/ssh-rsa.c
+++ b/ssh-rsa.c
@@ -14,7 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-rsa.c,v 1.31 2003/11/10 16:23:41 jakob Exp $");
+RCSID("$OpenBSD: ssh-rsa.c,v 1.32 2005/06/17 02:44:33 djm Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -238,7 +238,7 @@ openssh_RSA_verify(int type, u_char *hash, u_int hashlen,
                     ERR_error_string(ERR_get_error(), NULL));
                 goto done;
         }
-        if (len != hlen + oidlen) {
+        if (len < 0 || (u_int)len != hlen + oidlen) {
                 error("bad decrypted len: %d != %d + %d", len, hlen, oidlen);
                 goto done;
         }
diff --git a/ssh.0 b/ssh.0
index 7ef493013..274fab8b5 100644
--- a/ssh.0
+++ b/ssh.0
@@ -30,16 +30,16 @@ DESCRIPTION
      bined with RSA-based host authentication.  If the machine the user logs
      in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
      machine, and the user names are the same on both sides, or if the files
-     $HOME/.rhosts or $HOME/.shosts exist in the user's home directory on the
-     remote machine and contain a line containing the name of the client ma-
-     chine and the name of the user on that machine, the user is considered
-     for log in.  Additionally, if the server can verify the client's host key
-     (see /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts in the FILES
-     section), only then is login permitted.  This authentication method clos-
-     es security holes due to IP spoofing, DNS spoofing and routing spoofing.
-     [Note to the administrator: /etc/hosts.equiv, $HOME/.rhosts, and the
-     rlogin/rsh protocol in general, are inherently insecure and should be
-     disabled if security is desired.]
+     ~/.rhosts or ~/.shosts exist in the user's home directory on the remote
+     machine and contain a line containing the name of the client machine and
+     the name of the user on that machine, the user is considered for log in.
+     Additionally, if the server can verify the client's host key (see
+     /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts in the FILES section),
+     only then is login permitted.  This authentication method closes security
+     holes due to IP spoofing, DNS spoofing and routing spoofing.  [Note to
+     the administrator: /etc/hosts.equiv, ~/.rhosts, and the rlogin/rsh proto-
+     col in general, are inherently insecure and should be disabled if securi-
+     ty is desired.]
 
      As a second authentication method, ssh supports RSA based authentication.
      The scheme is based on public-key cryptography: there are cryptosystems
@@ -49,25 +49,25 @@ DESCRIPTION
      key pair for authentication purposes.  The server knows the public key,
      and only the user knows the private key.
 
-     The file $HOME/.ssh/authorized_keys lists the public keys that are per-
-     mitted for logging in.  When the user logs in, the ssh program tells the
-     server which key pair it would like to use for authentication.  The serv-
-     er checks if this key is permitted, and if so, sends the user (actually
-     the ssh program running on behalf of the user) a challenge, a random num-
-     ber, encrypted by the user's public key.  The challenge can only be de-
-     crypted using the proper private key.  The user's client then decrypts
-     the challenge using the private key, proving that he/she knows the pri-
-     vate key but without disclosing it to the server.
+     The file ~/.ssh/authorized_keys lists the public keys that are permitted
+     for logging in.  When the user logs in, the ssh program tells the server
+     which key pair it would like to use for authentication.  The server
+     checks if this key is permitted, and if so, sends the user (actually the
+     ssh program running on behalf of the user) a challenge, a random number,
+     encrypted by the user's public key.  The challenge can only be decrypted
+     using the proper private key.  The user's client then decrypts the chal-
+     lenge using the private key, proving that he/she knows the private key
+     but without disclosing it to the server.
 
      ssh implements the RSA authentication protocol automatically.  The user
      creates his/her RSA key pair by running ssh-keygen(1).  This stores the
-     private key in $HOME/.ssh/identity and stores the public key in
-     $HOME/.ssh/identity.pub in the user's home directory.  The user should
-     then copy the identity.pub to $HOME/.ssh/authorized_keys in his/her home
-     directory on the remote machine (the authorized_keys file corresponds to
-     the conventional $HOME/.rhosts file, and has one key per line, though the
-     lines can be very long).  After this, the user can log in without giving
-     the password.
+     private key in ~/.ssh/identity and stores the public key in
+     ~/.ssh/identity.pub in the user's home directory.  The user should then
+     copy the identity.pub to ~/.ssh/authorized_keys in his/her home directory
+     on the remote machine (the authorized_keys file corresponds to the con-
+     ventional ~/.rhosts file, and has one key per line, though the lines can
+     be very long).  After this, the user can log in without giving the pass-
+     word.
 
      The most convenient way to use RSA authentication may be with an authen-
      tication agent.  See ssh-agent(1) for more information.
@@ -87,13 +87,12 @@ DESCRIPTION
 
      The public key method is similar to RSA authentication described in the
      previous section and allows the RSA or DSA algorithm to be used: The
-     client uses his private key, $HOME/.ssh/id_dsa or $HOME/.ssh/id_rsa, to
-     sign the session identifier and sends the result to the server.  The
-     server checks whether the matching public key is listed in
-     $HOME/.ssh/authorized_keys and grants access if both the key is found and
-     the signature is correct.  The session identifier is derived from a
-     shared Diffie-Hellman value and is only known to the client and the serv-
-     er.
+     client uses his private key, ~/.ssh/id_dsa or ~/.ssh/id_rsa, to sign the
+     session identifier and sends the result to the server.  The server checks
+     whether the matching public key is listed in ~/.ssh/authorized_keys and
+     grants access if both the key is found and the signature is correct.  The
+     session identifier is derived from a shared Diffie-Hellman value and is
+     only known to the client and the server.
 
      If public key authentication fails or is not available, a password can be
      sent encrypted to the remote host to prove the user's identity.
@@ -194,13 +193,13 @@ DESCRIPTION
    Server authentication
      ssh automatically maintains and checks a database containing identifica-
      tions for all hosts it has ever been used with.  Host keys are stored in
-     $HOME/.ssh/known_hosts in the user's home directory.  Additionally, the
-     file /etc/ssh/ssh_known_hosts is automatically checked for known hosts.
-     Any new hosts are automatically added to the user's file.  If a host's
-     identification ever changes, ssh warns about this and disables password
-     authentication to prevent a trojan horse from getting the user's pass-
-     word.  Another purpose of this mechanism is to prevent man-in-the-middle
-     attacks which could otherwise be used to circumvent the encryption.  The
+     ~/.ssh/known_hosts in the user's home directory.  Additionally, the file
+     /etc/ssh/ssh_known_hosts is automatically checked for known hosts.  Any
+     new hosts are automatically added to the user's file.  If a host's iden-
+     tification ever changes, ssh warns about this and disables password au-
+     thentication to prevent a trojan horse from getting the user's password.
+     Another purpose of this mechanism is to prevent man-in-the-middle attacks
+     which could otherwise be used to circumvent the encryption.  The
      StrictHostKeyChecking option can be used to prevent logins to machines
      whose host key is not known or has changed.
 
@@ -234,8 +233,9 @@ DESCRIPTION
      -a      Disables forwarding of the authentication agent connection.
 
      -b bind_address
-             Specify the interface to transmit from on machines with multiple
-             interfaces or aliased addresses.
+             Use bind_address on the local machine as the source address of
+             the connection.  Only useful on systems with more than one ad-
+             dress.
 
      -C      Requests compression of all data (including stdin, stdout,
              stderr, and data for forwarded X11 and TCP/IP connections).  The
@@ -262,11 +262,13 @@ DESCRIPTION
              For protocol version 2 cipher_spec is a comma-separated list of
              ciphers listed in order of preference.  The supported ciphers are
              ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
-             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour'',
-             ``blowfish-cbc'', and ``cast128-cbc''.  The default is
+             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
+             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
+             ``cast128-cbc''.  The default is
 
-               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-                 aes192-cbc,aes256-cbc''
+               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+                 aes192-ctr,aes256-ctr''
 
      -D port
              Specifies a local ``dynamic'' application-level port forwarding.
@@ -292,7 +294,7 @@ DESCRIPTION
              Specifies an alternative per-user configuration file.  If a con-
              figuration file is given on the command line, the system-wide
              configuration file (/etc/ssh/ssh_config) will be ignored.  The
-             default for the per-user configuration file is $HOME/.ssh/config.
+             default for the per-user configuration file is ~/.ssh/config.
 
      -f      Requests ssh to go to background just before command execution.
              This is useful if ssh is going to ask for passwords or passphras-
@@ -309,12 +311,12 @@ DESCRIPTION
 
      -i identity_file
              Selects a file from which the identity (private key) for RSA or
-             DSA authentication is read.  The default is $HOME/.ssh/identity
-             for protocol version 1, and $HOME/.ssh/id_rsa and
-             $HOME/.ssh/id_dsa for protocol version 2.  Identity files may al-
-             so be specified on a per-host basis in the configuration file.
-             It is possible to have multiple -i options (and multiple identi-
-             ties specified in configuration files).
+             DSA authentication is read.  The default is ~/.ssh/identity for
+             protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for pro-
+             tocol version 2.  Identity files may also be specified on a per-
+             host basis in the configuration file.  It is possible to have
+             multiple -i options (and multiple identities specified in config-
+             uration files).
 
      -k      Disables forwarding (delegation) of GSSAPI credentials to the
              server.
@@ -567,17 +569,17 @@ ENVIRONMENT
 
      USER     Set to the name of the user logging in.
 
-     Additionally, ssh reads $HOME/.ssh/environment, and adds lines of the
-     format ``VARNAME=value'' to the environment if the file exists and if
-     users are allowed to change their environment.  For more information, see
-     the PermitUserEnvironment option in sshd_config(5).
+     Additionally, ssh reads ~/.ssh/environment, and adds lines of the format
+     ``VARNAME=value'' to the environment if the file exists and if users are
+     allowed to change their environment.  For more information, see the
+     PermitUserEnvironment option in sshd_config(5).
 
 FILES
-     $HOME/.ssh/known_hosts
+     ~/.ssh/known_hosts
              Records host keys for all hosts the user has logged into that are
              not in /etc/ssh/ssh_known_hosts.  See sshd(8).
 
-     $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa
+     ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_rsa
              Contains the authentication identity of the user.  They are for
              protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
              These files contain sensitive data and should be readable by the
@@ -587,27 +589,27 @@ FILES
              key; the passphrase will be used to encrypt the sensitive part of
              this file using 3DES.
 
-     $HOME/.ssh/identity.pub, $HOME/.ssh/id_dsa.pub, $HOME/.ssh/id_rsa.pub
+     ~/.ssh/identity.pub, ~/.ssh/id_dsa.pub, ~/.ssh/id_rsa.pub
              Contains the public key for authentication (public part of the
              identity file in human-readable form).  The contents of the
-             $HOME/.ssh/identity.pub file should be added to the file
-             $HOME/.ssh/authorized_keys on all machines where the user wishes
-             to log in using protocol version 1 RSA authentication.  The con-
-             tents of the $HOME/.ssh/id_dsa.pub and $HOME/.ssh/id_rsa.pub file
-             should be added to $HOME/.ssh/authorized_keys on all machines
-             where the user wishes to log in using protocol version 2 DSA/RSA
-             authentication.  These files are not sensitive and can (but need
-             not) be readable by anyone.  These files are never used automati-
-             cally and are not necessary; they are only provided for the con-
-             venience of the user.
-
-     $HOME/.ssh/config
+             ~/.ssh/identity.pub file should be added to the file
+             ~/.ssh/authorized_keys on all machines where the user wishes to
+             log in using protocol version 1 RSA authentication.  The contents
+             of the ~/.ssh/id_dsa.pub and ~/.ssh/id_rsa.pub file should be
+             added to ~/.ssh/authorized_keys on all machines where the user
+             wishes to log in using protocol version 2 DSA/RSA authentication.
+             These files are not sensitive and can (but need not) be readable
+             by anyone.  These files are never used automatically and are not
+             necessary; they are only provided for the convenience of the us-
+             er.
+
+     ~/.ssh/config
              This is the per-user configuration file.  The file format and
              configuration options are described in ssh_config(5).  Because of
              the potential for abuse, this file must have strict permissions:
              read/write for the user, and not accessible by others.
 
-     $HOME/.ssh/authorized_keys
+     ~/.ssh/authorized_keys
              Lists the public keys (RSA/DSA) that can be used for logging in
              as this user.  The format of this file is described in the
              sshd(8) manual page.  In the simplest form the format is the same
@@ -648,7 +650,7 @@ FILES
              requirement that ssh be setuid root when that authentication
              method is used.  By default ssh is not setuid root.
 
-     $HOME/.rhosts
+     ~/.rhosts
              This file is used in RhostsRSAAuthentication and
              HostbasedAuthentication authentication to list the host/user
              pairs that are permitted to log in.  (Note that this file is also
@@ -665,12 +667,12 @@ FILES
              Note that sshd(8) allows authentication only in combination with
              client host key authentication before permitting log in.  If the
              server machine does not have the client's host key in
-             /etc/ssh/ssh_known_hosts, it can be stored in
-             $HOME/.ssh/known_hosts.  The easiest way to do this is to connect
-             back to the client from the server machine using ssh; this will
-             automatically add the host key to $HOME/.ssh/known_hosts.
+             /etc/ssh/ssh_known_hosts, it can be stored in ~/.ssh/known_hosts.
+             The easiest way to do this is to connect back to the client from
+             the server machine using ssh; this will automatically add the
+             host key to ~/.ssh/known_hosts.
 
-     $HOME/.shosts
+     ~/.shosts
              This file is used exactly the same way as .rhosts.  The purpose
              for having this file is to be able to use RhostsRSAAuthentication
              and HostbasedAuthentication authentication without permitting lo-
@@ -696,12 +698,12 @@ FILES
              just before the user's shell (or command) is started.  See the
              sshd(8) manual page for more information.
 
-     $HOME/.ssh/rc
+     ~/.ssh/rc
              Commands in this file are executed by ssh when the user logs in
              just before the user's shell (or command) is started.  See the
              sshd(8) manual page for more information.
 
-     $HOME/.ssh/environment
+     ~/.ssh/environment
              Contains additional definitions for environment variables, see
              section ENVIRONMENT above.
 
@@ -725,4 +727,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.6                   September 25, 1999                            11
+OpenBSD 3.8                   September 25, 1999                            12
diff --git a/ssh.1 b/ssh.1
index e6f4b4a54..b0749763b 100644
--- a/ssh.1
+++ b/ssh.1
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.205 2005/03/07 23:41:54 jmc Exp $
+.\" $OpenBSD: ssh.1,v 1.209 2005/07/06 09:33:05 dtucker Exp $
 .Dd September 25, 1999
 .Dt SSH 1
 .Os
@@ -109,9 +109,9 @@ or
 .Pa /etc/shosts.equiv
 on the remote machine, and the user names are
 the same on both sides, or if the files
-.Pa $HOME/.rhosts
+.Pa ~/.rhosts
 or
-.Pa $HOME/.shosts
+.Pa ~/.shosts
 exist in the user's home directory on the
 remote machine and contain a line containing the name of the client
 machine and the name of the user on that machine, the user is
@@ -120,7 +120,7 @@ Additionally, if the server can verify the client's
 host key (see
 .Pa /etc/ssh/ssh_known_hosts
 and
-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts
 in the
 .Sx FILES
 section), only then is login permitted.
@@ -128,7 +128,7 @@ This authentication method closes security holes due to IP
 spoofing, DNS spoofing and routing spoofing.
 [Note to the administrator:
 .Pa /etc/hosts.equiv ,
-.Pa $HOME/.rhosts ,
+.Pa ~/.rhosts ,
 and the rlogin/rsh protocol in general, are inherently insecure and should be
 disabled if security is desired.]
 .Pp
@@ -144,7 +144,7 @@ key pair for authentication purposes.
 The server knows the public key, and only the user knows the private key.
 .Pp
 The file
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 lists the public keys that are permitted for logging in.
 When the user logs in, the
 .Nm
@@ -165,18 +165,18 @@ implements the RSA authentication protocol automatically.
 The user creates his/her RSA key pair by running
 .Xr ssh-keygen 1 .
 This stores the private key in
-.Pa $HOME/.ssh/identity
+.Pa ~/.ssh/identity
 and stores the public key in
-.Pa $HOME/.ssh/identity.pub
+.Pa ~/.ssh/identity.pub
 in the user's home directory.
 The user should then copy the
 .Pa identity.pub
 to
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 in his/her home directory on the remote machine (the
 .Pa authorized_keys
 file corresponds to the conventional
-.Pa $HOME/.rhosts
+.Pa ~/.rhosts
 file, and has one key
 per line, though the lines can be very long).
 After this, the user can log in without giving the password.
@@ -206,12 +206,12 @@ password authentication are tried.
 The public key method is similar to RSA authentication described
 in the previous section and allows the RSA or DSA algorithm to be used:
 The client uses his private key,
-.Pa $HOME/.ssh/id_dsa
+.Pa ~/.ssh/id_dsa
 or
-.Pa $HOME/.ssh/id_rsa ,
+.Pa ~/.ssh/id_rsa ,
 to sign the session identifier and sends the result to the server.
 The server checks whether the matching public key is listed in
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 and grants access if both the key is found and the signature is correct.
 The session identifier is derived from a shared Diffie-Hellman value
 and is only known to the client and the server.
@@ -365,7 +365,7 @@ electronic purse; another is going through firewalls.
 automatically maintains and checks a database containing
 identifications for all hosts it has ever been used with.
 Host keys are stored in
-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts
 in the user's home directory.
 Additionally, the file
 .Pa /etc/ssh/ssh_known_hosts
@@ -423,8 +423,11 @@ authenticate using the identities loaded into the agent.
 .It Fl a
 Disables forwarding of the authentication agent connection.
 .It Fl b Ar bind_address
-Specify the interface to transmit from on machines with multiple
-interfaces or aliased addresses.
+Use
+.Ar bind_address
+on the local machine as the source address
+of the connection.
+Only useful on systems with more than one address.
 .It Fl C
 Requests compression of all data (including stdin, stdout, stderr, and
 data for forwarded X11 and TCP/IP connections).
@@ -479,14 +482,17 @@ The supported ciphers are
 .Dq aes128-ctr ,
 .Dq aes192-ctr ,
 .Dq aes256-ctr ,
+.Dq arcfour128 ,
+.Dq arcfour256 ,
 .Dq arcfour ,
 .Dq blowfish-cbc ,
 and
 .Dq cast128-cbc .
 The default is
 .Bd -literal
-  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-    aes192-cbc,aes256-cbc''
+  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+    arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+    aes192-ctr,aes256-ctr''
 .Ed
 .It Fl D Ar port
 Specifies a local
@@ -522,7 +528,7 @@ the system-wide configuration file
 .Pq Pa /etc/ssh/ssh_config
 will be ignored.
 The default for the per-user configuration file is
-.Pa $HOME/.ssh/config .
+.Pa ~/.ssh/config .
 .It Fl f
 Requests
 .Nm
@@ -548,11 +554,11 @@ private RSA key.
 Selects a file from which the identity (private key) for
 RSA or DSA authentication is read.
 The default is
-.Pa $HOME/.ssh/identity
+.Pa ~/.ssh/identity
 for protocol version 1, and
-.Pa $HOME/.ssh/id_rsa
+.Pa ~/.ssh/id_rsa
 and
-.Pa $HOME/.ssh/id_dsa
+.Pa ~/.ssh/id_dsa
 for protocol version 2.
 Identity files may also be specified on
 a per-host basis in the configuration file.
@@ -941,7 +947,7 @@ Set to the name of the user logging in.
 Additionally,
 .Nm
 reads
-.Pa $HOME/.ssh/environment ,
+.Pa ~/.ssh/environment ,
 and adds lines of the format
 .Dq VARNAME=value
 to the environment if the file exists and if users are allowed to
@@ -952,13 +958,13 @@ option in
 .Xr sshd_config 5 .
 .Sh FILES
 .Bl -tag -width Ds
-.It Pa $HOME/.ssh/known_hosts
+.It Pa ~/.ssh/known_hosts
 Records host keys for all hosts the user has logged into that are not
 in
 .Pa /etc/ssh/ssh_known_hosts .
 See
 .Xr sshd 8 .
-.It Pa $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa
+.It Pa ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_rsa
 Contains the authentication identity of the user.
 They are for protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
 These files
@@ -970,21 +976,21 @@ ignores a private key file if it is accessible by others.
 It is possible to specify a passphrase when
 generating the key; the passphrase will be used to encrypt the
 sensitive part of this file using 3DES.
-.It Pa $HOME/.ssh/identity.pub, $HOME/.ssh/id_dsa.pub, $HOME/.ssh/id_rsa.pub
+.It Pa ~/.ssh/identity.pub, ~/.ssh/id_dsa.pub, ~/.ssh/id_rsa.pub
 Contains the public key for authentication (public part of the
 identity file in human-readable form).
 The contents of the
-.Pa $HOME/.ssh/identity.pub
+.Pa ~/.ssh/identity.pub
 file should be added to the file
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 on all machines
 where the user wishes to log in using protocol version 1 RSA authentication.
 The contents of the
-.Pa $HOME/.ssh/id_dsa.pub
+.Pa ~/.ssh/id_dsa.pub
 and
-.Pa $HOME/.ssh/id_rsa.pub
+.Pa ~/.ssh/id_rsa.pub
 file should be added to
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 on all machines
 where the user wishes to log in using protocol version 2 DSA/RSA authentication.
 These files are not
@@ -992,13 +998,13 @@ sensitive and can (but need not) be readable by anyone.
 These files are
 never used automatically and are not necessary; they are only provided for
 the convenience of the user.
-.It Pa $HOME/.ssh/config
+.It Pa ~/.ssh/config
 This is the per-user configuration file.
 The file format and configuration options are described in
 .Xr ssh_config 5 .
 Because of the potential for abuse, this file must have strict permissions:
 read/write for the user, and not accessible by others.
-.It Pa $HOME/.ssh/authorized_keys
+.It Pa ~/.ssh/authorized_keys
 Lists the public keys (RSA/DSA) that can be used for logging in as this user.
 The format of this file is described in the
 .Xr sshd 8
@@ -1058,7 +1064,7 @@ be setuid root when that authentication method is used.
 By default
 .Nm
 is not setuid root.
-.It Pa $HOME/.rhosts
+.It Pa ~/.rhosts
 This file is used in
 .Cm RhostsRSAAuthentication
 and
@@ -1088,12 +1094,12 @@ authentication before permitting log in.
 If the server machine does not have the client's host key in
 .Pa /etc/ssh/ssh_known_hosts ,
 it can be stored in
-.Pa $HOME/.ssh/known_hosts .
+.Pa ~/.ssh/known_hosts .
 The easiest way to do this is to
 connect back to the client from the server machine using ssh; this
 will automatically add the host key to
-.Pa $HOME/.ssh/known_hosts .
-.It Pa $HOME/.shosts
+.Pa ~/.ssh/known_hosts .
+.It Pa ~/.shosts
 This file is used exactly the same way as
 .Pa .rhosts .
 The purpose for
@@ -1133,7 +1139,7 @@ when the user logs in just before the user's shell (or command) is started.
 See the
 .Xr sshd 8
 manual page for more information.
-.It Pa $HOME/.ssh/rc
+.It Pa ~/.ssh/rc
 Commands in this file are executed by
 .Nm
 when the user logs in just before the user's shell (or command) is
@@ -1141,7 +1147,7 @@ started.
 See the
 .Xr sshd 8
 manual page for more information.
-.It Pa $HOME/.ssh/environment
+.It Pa ~/.ssh/environment
 Contains additional definitions for environment variables, see section
 .Sx ENVIRONMENT
 above.
diff --git a/ssh.c b/ssh.c
index 9acec3082..c9e5aac7a 100644
--- a/ssh.c
+++ b/ssh.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.233 2005/03/01 17:22:06 jmc Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.249 2005/07/30 01:26:16 djm Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -145,7 +145,7 @@ pid_t proxy_command_pid = 0;
 int control_fd = -1;
 
 /* Multiplexing control command */
-static u_int mux_command = SSHMUX_COMMAND_OPEN;
+static u_int mux_command = 0;
 
 /* Only used in control client mode */
 volatile sig_atomic_t control_client_terminate = 0;
@@ -185,6 +185,7 @@ main(int ac, char **av)
         int dummy;
         extern int optind, optreset;
         extern char *optarg;
+        struct servent *sp;
         Forward fwd;
 
         __progname = ssh_get_progname(av[0]);
@@ -386,8 +387,10 @@ again:
                         }
                         break;
                 case 'M':
-                        options.control_master =
-                            (options.control_master >= 1) ? 2 : 1;
+                        if (options.control_master == SSHCTL_MASTER_YES)
+                                options.control_master = SSHCTL_MASTER_ASK;
+                        else
+                                options.control_master = SSHCTL_MASTER_YES;
                         break;
                 case 'p':
                         options.port = a2port(optarg);
@@ -436,7 +439,7 @@ again:
                                 fwd.listen_host = cleanhostname(fwd.listen_host);
                         } else {
                                 fwd.listen_port = a2port(fwd.listen_host);
-                                fwd.listen_host = "";
+                                fwd.listen_host = NULL;
                         }
 
                         if (fwd.listen_port == 0) {
@@ -550,7 +553,7 @@ again:
         if (no_tty_flag)
                 tty_flag = 0;
         /* Do not allocate a tty if stdin is not a tty. */
-        if (!isatty(fileno(stdin)) && !force_tty_flag) {
+        if ((!isatty(fileno(stdin)) || stdin_null_flag) && !force_tty_flag) {
                 if (tty_flag)
                         logit("Pseudo-terminal will not be allocated because stdin is not a terminal.");
                 tty_flag = 0;
@@ -604,16 +607,31 @@ again:
                                 *p = tolower(*p);
         }
 
+        /* Get default port if port has not been set. */
+        if (options.port == 0) {
+                sp = getservbyname(SSH_SERVICE_NAME, "tcp");
+                options.port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT;
+        }
+
         if (options.proxy_command != NULL &&
             strcmp(options.proxy_command, "none") == 0)
                 options.proxy_command = NULL;
+        if (options.control_path != NULL &&
+            strcmp(options.control_path, "none") == 0)
+                options.control_path = NULL;
 
         if (options.control_path != NULL) {
-                options.control_path = tilde_expand_filename(
-                   options.control_path, original_real_uid);
+                snprintf(buf, sizeof(buf), "%d", options.port);
+                cp = tilde_expand_filename(options.control_path,
+                    original_real_uid);
+                options.control_path = percent_expand(cp, "p", buf, "h", host,
+                    "r", options.user, (char *)NULL);
+                xfree(cp);
         }
-        if (options.control_path != NULL && options.control_master == 0)
-                control_client(options.control_path); /* This doesn't return */
+        if (mux_command != 0 && options.control_path == NULL)
+                fatal("No ControlPath specified for \"-O\" command");
+        if (options.control_path != NULL)
+                control_client(options.control_path);
 
         /* Open a connection to the remote host. */
         if (ssh_connect(host, &hostaddr, options.port,
@@ -742,110 +760,6 @@ again:
         return exit_status;
 }
 
-#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
-
-static void
-x11_get_proto(char **_proto, char **_data)
-{
-        char cmd[1024];
-        char line[512];
-        char xdisplay[512];
-        static char proto[512], data[512];
-        FILE *f;
-        int got_data = 0, generated = 0, do_unlink = 0, i;
-        char *display, *xauthdir, *xauthfile;
-        struct stat st;
-
-        xauthdir = xauthfile = NULL;
-        *_proto = proto;
-        *_data = data;
-        proto[0] = data[0] = '\0';
-
-        if (!options.xauth_location ||
-            (stat(options.xauth_location, &st) == -1)) {
-                debug("No xauth program.");
-        } else {
-                if ((display = getenv("DISPLAY")) == NULL) {
-                        debug("x11_get_proto: DISPLAY not set");
-                        return;
-                }
-                /*
-                 * Handle FamilyLocal case where $DISPLAY does
-                 * not match an authorization entry.  For this we
-                 * just try "xauth list unix:displaynum.screennum".
-                 * XXX: "localhost" match to determine FamilyLocal
-                 *      is not perfect.
-                 */
-                if (strncmp(display, "localhost:", 10) == 0) {
-                        snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
-                            display + 10);
-                        display = xdisplay;
-                }
-                if (options.forward_x11_trusted == 0) {
-                        xauthdir = xmalloc(MAXPATHLEN);
-                        xauthfile = xmalloc(MAXPATHLEN);
-                        strlcpy(xauthdir, "/tmp/ssh-XXXXXXXXXX", MAXPATHLEN);
-                        if (mkdtemp(xauthdir) != NULL) {
-                                do_unlink = 1;
-                                snprintf(xauthfile, MAXPATHLEN, "%s/xauthfile",
-                                    xauthdir);
-                                snprintf(cmd, sizeof(cmd),
-                                    "%s -f %s generate %s " SSH_X11_PROTO
-                                    " untrusted timeout 1200 2>" _PATH_DEVNULL,
-                                    options.xauth_location, xauthfile, display);
-                                debug2("x11_get_proto: %s", cmd);
-                                if (system(cmd) == 0)
-                                        generated = 1;
-                        }
-                }
-                snprintf(cmd, sizeof(cmd),
-                    "%s %s%s list %s . 2>" _PATH_DEVNULL,
-                    options.xauth_location,
-                    generated ? "-f " : "" ,
-                    generated ? xauthfile : "",
-                    display);
-                debug2("x11_get_proto: %s", cmd);
-                f = popen(cmd, "r");
-                if (f && fgets(line, sizeof(line), f) &&
-                    sscanf(line, "%*s %511s %511s", proto, data) == 2)
-                        got_data = 1;
-                if (f)
-                        pclose(f);
-        }
-
-        if (do_unlink) {
-                unlink(xauthfile);
-                rmdir(xauthdir);
-        }
-        if (xauthdir)
-                xfree(xauthdir);
-        if (xauthfile)
-                xfree(xauthfile);
-
-        /*
-         * If we didn't get authentication data, just make up some
-         * data.  The forwarding code will check the validity of the
-         * response anyway, and substitute this data.  The X11
-         * server, however, will ignore this fake data and use
-         * whatever authentication mechanisms it was using otherwise
-         * for the local connection.
-         */
-        if (!got_data) {
-                u_int32_t rnd = 0;
-
-                logit("Warning: No xauth data; "
-                    "using fake authentication data for X11 forwarding.");
-                strlcpy(proto, SSH_X11_PROTO, sizeof proto);
-                for (i = 0; i < 16; i++) {
-                        if (i % 4 == 0)
-                                rnd = arc4random();
-                        snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
-                            rnd & 0xff);
-                        rnd >>= 8;
-                }
-        }
-}
-
 static void
 ssh_init_forwarding(void)
 {
@@ -856,8 +770,8 @@ ssh_init_forwarding(void)
         for (i = 0; i < options.num_local_forwards; i++) {
                 debug("Local connections to %.200s:%d forwarded to remote "
                     "address %.200s:%d",
-                    (options.local_forwards[i].listen_host == NULL) ? 
-                    (options.gateway_ports ? "*" : "LOCALHOST") : 
+                    (options.local_forwards[i].listen_host == NULL) ?
+                    (options.gateway_ports ? "*" : "LOCALHOST") :
                     options.local_forwards[i].listen_host,
                     options.local_forwards[i].listen_port,
                     options.local_forwards[i].connect_host,
@@ -876,6 +790,8 @@ ssh_init_forwarding(void)
         for (i = 0; i < options.num_remote_forwards; i++) {
                 debug("Remote connections from %.200s:%d forwarded to "
                     "local address %.200s:%d",
+                    (options.remote_forwards[i].listen_host == NULL) ?
+                    (options.gateway_ports ? "*" : "LOCALHOST") :
                     options.remote_forwards[i].listen_host,
                     options.remote_forwards[i].listen_port,
                     options.remote_forwards[i].connect_host,
@@ -906,6 +822,7 @@ ssh_session(void)
         int have_tty = 0;
         struct winsize ws;
         char *cp;
+        const char *display;
 
         /* Enable compression if requested. */
         if (options.compression) {
@@ -967,13 +884,15 @@ ssh_session(void)
                         packet_disconnect("Protocol error waiting for pty request response.");
         }
         /* Request X11 forwarding if enabled and DISPLAY is set. */
-        if (options.forward_x11 && getenv("DISPLAY") != NULL) {
+        display = getenv("DISPLAY");
+        if (options.forward_x11 && display != NULL) {
                 char *proto, *data;
                 /* Get reasonable local authentication information. */
-                x11_get_proto(&proto, &data);
+                client_x11_get_proto(display, options.xauth_location,
+                    options.forward_x11_trusted, &proto, &data);
                 /* Request forwarding with authentication spoofing. */
                 debug("Requesting X11 forwarding with authentication spoofing.");
-                x11_request_forwarding_with_spoofing(0, proto, data);
+                x11_request_forwarding_with_spoofing(0, display, proto, data);
 
                 /* Read response from the server. */
                 type = packet_read();
@@ -1075,9 +994,12 @@ ssh_control_listener(void)
         mode_t old_umask;
         int addr_len;
 
-        if (options.control_path == NULL || options.control_master <= 0)
+        if (options.control_path == NULL ||
+            options.control_master == SSHCTL_MASTER_NO)
                 return;
 
+        debug("setting up multiplex master socket");
+
         memset(&addr, '\0', sizeof(addr));
         addr.sun_family = AF_UNIX;
         addr_len = offsetof(struct sockaddr_un, sun_path) +
@@ -1093,7 +1015,7 @@ ssh_control_listener(void)
         old_umask = umask(0177);
         if (bind(control_fd, (struct sockaddr*)&addr, addr_len) == -1) {
                 control_fd = -1;
-                if (errno == EINVAL)
+                if (errno == EINVAL || errno == EADDRINUSE)
                         fatal("ControlSocket %s already exists",
                             options.control_path);
                 else
@@ -1112,15 +1034,18 @@ static void
 ssh_session2_setup(int id, void *arg)
 {
         extern char **environ;
-
+        const char *display;
         int interactive = tty_flag;
-        if (options.forward_x11 && getenv("DISPLAY") != NULL) {
+
+        display = getenv("DISPLAY");
+        if (options.forward_x11 && display != NULL) {
                 char *proto, *data;
                 /* Get reasonable local authentication information. */
-                x11_get_proto(&proto, &data);
+                client_x11_get_proto(display, options.xauth_location,
+                    options.forward_x11_trusted, &proto, &data);
                 /* Request forwarding with authentication spoofing. */
                 debug("Requesting X11 forwarding with authentication spoofing.");
-                x11_request_forwarding_with_spoofing(id, proto, data);
+                x11_request_forwarding_with_spoofing(id, display, proto, data);
                 interactive = 1;
                 /* XXX wait for reply */
         }
@@ -1288,13 +1213,18 @@ control_client(const char *path)
         extern char **environ;
         u_int  flags;
 
-        if (stdin_null_flag) {
-                if ((fd = open(_PATH_DEVNULL, O_RDONLY)) == -1)
-                        fatal("open(/dev/null): %s", strerror(errno));
-                if (dup2(fd, STDIN_FILENO) == -1)
-                        fatal("dup2: %s", strerror(errno));
-                if (fd > STDERR_FILENO)
-                        close(fd);
+        if (mux_command == 0)
+                mux_command = SSHMUX_COMMAND_OPEN;
+
+        switch (options.control_master) {
+        case SSHCTL_MASTER_AUTO:
+        case SSHCTL_MASTER_AUTO_ASK:
+                debug("auto-mux: Trying existing master");
+                /* FALLTHROUGH */
+        case SSHCTL_MASTER_NO:
+                break;
+        default:
+                return;
         }
 
         memset(&addr, '\0', sizeof(addr));
@@ -1309,31 +1239,55 @@ control_client(const char *path)
         if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
                 fatal("%s socket(): %s", __func__, strerror(errno));
 
-        if (connect(sock, (struct sockaddr*)&addr, addr_len) == -1)
-                fatal("Couldn't connect to %s: %s", path, strerror(errno));
+        if (connect(sock, (struct sockaddr*)&addr, addr_len) == -1) {
+                if (mux_command != SSHMUX_COMMAND_OPEN) {
+                        fatal("Control socket connect(%.100s): %s", path,
+                            strerror(errno));
+                }
+                if (errno == ENOENT)
+                        debug("Control socket \"%.100s\" does not exist", path);
+                else {
+                        error("Control socket connect(%.100s): %s", path,
+                            strerror(errno));
+                }
+                close(sock);
+                return;
+        }
+
+        if (stdin_null_flag) {
+                if ((fd = open(_PATH_DEVNULL, O_RDONLY)) == -1)
+                        fatal("open(/dev/null): %s", strerror(errno));
+                if (dup2(fd, STDIN_FILENO) == -1)
+                        fatal("dup2: %s", strerror(errno));
+                if (fd > STDERR_FILENO)
+                        close(fd);
+        }
 
-        if ((term = getenv("TERM")) == NULL)
-                term = "";
+        term = getenv("TERM");
 
         flags = 0;
         if (tty_flag)
                 flags |= SSHMUX_FLAG_TTY;
         if (subsystem_flag)
                 flags |= SSHMUX_FLAG_SUBSYS;
+        if (options.forward_x11)
+                flags |= SSHMUX_FLAG_X11_FWD;
+        if (options.forward_agent)
+                flags |= SSHMUX_FLAG_AGENT_FWD;
 
         buffer_init(&m);
 
         /* Send our command to server */
         buffer_put_int(&m, mux_command);
         buffer_put_int(&m, flags);
-        if (ssh_msg_send(sock, /* version */1, &m) == -1)
+        if (ssh_msg_send(sock, SSHMUX_VER, &m) == -1)
                 fatal("%s: msg_send", __func__);
         buffer_clear(&m);
 
         /* Get authorisation status and PID of controlee */
         if (ssh_msg_recv(sock, &m) == -1)
                 fatal("%s: msg_recv", __func__);
-        if (buffer_get_char(&m) != 1)
+        if (buffer_get_char(&m) != SSHMUX_VER)
                 fatal("%s: wrong version", __func__);
         if (buffer_get_int(&m) != 1)
                 fatal("Connection to master denied");
@@ -1343,7 +1297,7 @@ control_client(const char *path)
 
         switch (mux_command) {
         case SSHMUX_COMMAND_ALIVE_CHECK:
-                fprintf(stderr, "Master running (pid=%d)\r\n", 
+                fprintf(stderr, "Master running (pid=%d)\r\n",
                     control_server_pid);
                 exit(0);
         case SSHMUX_COMMAND_TERMINATE:
@@ -1357,7 +1311,7 @@ control_client(const char *path)
         }
 
         /* SSHMUX_COMMAND_OPEN */
-        buffer_put_cstring(&m, term);
+        buffer_put_cstring(&m, term ? term : "");
         buffer_append(&command, "\0", 1);
         buffer_put_cstring(&m, buffer_ptr(&command));
 
@@ -1379,7 +1333,7 @@ control_client(const char *path)
                         }
         }
 
-        if (ssh_msg_send(sock, /* version */1, &m) == -1)
+        if (ssh_msg_send(sock, SSHMUX_VER, &m) == -1)
                 fatal("%s: msg_send", __func__);
 
         mm_send_fd(sock, STDIN_FILENO);
@@ -1390,7 +1344,7 @@ control_client(const char *path)
         buffer_clear(&m);
         if (ssh_msg_recv(sock, &m) == -1)
                 fatal("%s: msg_recv", __func__);
-        if (buffer_get_char(&m) != 1)
+        if (buffer_get_char(&m) != SSHMUX_VER)
                 fatal("%s: wrong version", __func__);
         buffer_free(&m);
 
diff --git a/ssh_config.0 b/ssh_config.0
index 9577abc48..a2706b69c 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -4,14 +4,14 @@ NAME
      ssh_config - OpenSSH SSH client configuration files
 
 SYNOPSIS
-     $HOME/.ssh/config
+     ~/.ssh/config
      /etc/ssh/ssh_config
 
 DESCRIPTION
      ssh obtains configuration data from the following sources in the follow-
      ing order:
            1.   command-line options
-           2.   user's configuration file ($HOME/.ssh/config)
+           2.   user's configuration file (~/.ssh/config)
            3.   system-wide configuration file (/etc/ssh/ssh_config)
 
      For each parameter, the first obtained value will be used.  The configu-
@@ -57,9 +57,10 @@ DESCRIPTION
              ``yes'' or ``no''.  The default is ``no''.
 
      BindAddress
-             Specify the interface to transmit from on machines with multiple
-             interfaces or aliased addresses.  Note that this option does not
-             work if UsePrivilegedPort is set to ``yes''.
+             Use the specified address on the local machine as the source ad-
+             dress of the connection.  Only useful on systems with more than
+             one address.  Note that this option does not work if
+             UsePrivilegedPort is set to ``yes''.
 
      ChallengeResponseAuthentication
              Specifies whether to use challenge response authentication.  The
@@ -85,11 +86,12 @@ DESCRIPTION
              preference.  Multiple ciphers must be comma-separated.  The sup-
              ported ciphers are ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'',
              ``aes256-cbc'', ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'',
-             ``arcfour'', ``blowfish-cbc'', and ``cast128-cbc''.  The default
-             is
+             ``arcfour128'', ``arcfour256'', ``arcfour'', ``blowfish-cbc'',
+             and ``cast128-cbc''.  The default is
 
-               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-                 aes192-cbc,aes256-cbc''
+               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+                 aes192-ctr,aes256-ctr''
 
      ClearAllForwardings
              Specifies that all local, remote and dynamic port forwardings
@@ -131,11 +133,30 @@ DESCRIPTION
              tion rather than initiating new ones.  Setting this to ``ask''
              will cause ssh to listen for control connections, but require
              confirmation using the SSH_ASKPASS program before they are ac-
-             cepted (see ssh-add(1) for details).
+             cepted (see ssh-add(1) for details).  If the ControlPath can not
+             be opened, ssh will continue without connecting to a master in-
+             stance.
+
+             X11 and ssh-agent(1) forwarding is supported over these multi-
+             plexed connections, however the display and agent fowarded will
+             be the one belonging to the master connection i.e. it is not pos-
+             sible to forward multiple displays or agents.
+
+             Two additional options allow for opportunistic multiplexing: try
+             to use a master connection but fall back to creating a new one if
+             one does not already exist.  These options are: ``auto'' and
+             ``autoask''.  The latter requires confirmation like the ``ask''
+             option.
 
      ControlPath
              Specify the path to the control socket used for connection shar-
-             ing.  See ControlMaster above.
+             ing as described in the ControlMaster section above or the string
+             ``none'' to disable connection sharing.  In the path, `%h' will
+             be substituted by the target host name, `%p' the port and `%r' by
+             the remote login username.  It is recommended that any
+             ControlPath used for opportunistic connection sharing include all
+             three of these escape sequences.  This ensures that shared con-
+             nections are uniquely identified.
 
      DynamicForward
              Specifies that a TCP/IP port on the local machine be forwarded
@@ -228,9 +249,9 @@ DESCRIPTION
 
      HashKnownHosts
              Indicates that ssh should hash host names and addresses when they
-             are added to $HOME/.ssh/known_hosts.  These hashed names may be
-             used normally by ssh and sshd, but they do not reveal identifying
-             information should the file's contents be disclosed.  The default
+             are added to ~/.ssh/known_hosts.  These hashed names may be used
+             normally by ssh and sshd, but they do not reveal identifying in-
+             formation should the file's contents be disclosed.  The default
              is ``no''.  Note that hashing of names and addresses will not be
              retrospectively applied to existing known hosts files, but these
              may be manually hashed using ssh-keygen(1).
@@ -261,14 +282,13 @@ DESCRIPTION
 
      IdentityFile
              Specifies a file from which the user's RSA or DSA authentication
-             identity is read.  The default is $HOME/.ssh/identity for proto-
-             col version 1, and $HOME/.ssh/id_rsa and $HOME/.ssh/id_dsa for
-             protocol version 2.  Additionally, any identities represented by
-             the authentication agent will be used for authentication.  The
-             file name may use the tilde syntax to refer to a user's home di-
-             rectory.  It is possible to have multiple identity files speci-
-             fied in configuration files; all these identities will be tried
-             in sequence.
+             identity is read.  The default is ~/.ssh/identity for protocol
+             version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol ver-
+             sion 2.  Additionally, any identities represented by the authen-
+             tication agent will be used for authentication.  The file name
+             may use the tilde syntax to refer to a user's home directory.  It
+             is possible to have multiple identity files specified in configu-
+             ration files; all these identities will be tried in sequence.
 
      IdentitiesOnly
              Specifies that ssh should only use the authentication identity
@@ -286,18 +306,19 @@ DESCRIPTION
      LocalForward
              Specifies that a TCP/IP port on the local machine be forwarded
              over the secure channel to the specified host and port from the
-             remote machine.  The first argument must be a port number, and
-             the second must be [bind_address:]host:port.  IPv6 addresses can
-             be specified by enclosing addresses in square brackets or by us-
-             ing an alternative syntax: [bind_address/]host/port.  Multiple
-             forwardings may be specified, and additional forwardings can be
-             given on the command line.  Only the superuser can forward privi-
-             leged ports.  By default, the local port is bound in accordance
-             with the GatewayPorts setting.  However, an explicit bind_address
-             may be used to bind the connection to a specific address.  The
-             bind_address of ``localhost'' indicates that the listening port
-             be bound for local use only, while an empty address or `*' indi-
-             cates that the port should be available from all interfaces.
+             remote machine.  The first argument must be [bind_address:]port
+             and the second argument must be host:hostport.  IPv6 addresses
+             can be specified by enclosing addresses in square brackets or by
+             using an alternative syntax: [bind_address/]port and
+             host/hostport.  Multiple forwardings may be specified, and addi-
+             tional forwardings can be given on the command line.  Only the
+             superuser can forward privileged ports.  By default, the local
+             port is bound in accordance with the GatewayPorts setting.  How-
+             ever, an explicit bind_address may be used to bind the connection
+             to a specific address.  The bind_address of ``localhost'' indi-
+             cates that the listening port be bound for local use only, while
+             an empty address or `*' indicates that the port should be avail-
+             able from all interfaces.
 
      LogLevel
              Gives the verbosity level that is used when logging messages from
@@ -336,7 +357,7 @@ DESCRIPTION
      PreferredAuthentications
              Specifies the order in which the client should try protocol 2 au-
              thentication methods.  This allows a client to prefer one method
-             (e.g.  keyboard-interactive) over another method (e.g.  password)
+             (e.g. keyboard-interactive) over another method (e.g. password)
              The default for this option is: ``hostbased,publickey,keyboard-
              interactive,password''.
 
@@ -361,6 +382,12 @@ DESCRIPTION
              tirely.  Note that CheckHostIP is not available for connects with
              a proxy command.
 
+             This directive is useful in conjunction with nc(1) and its proxy
+             support.  For example, the following directive would connect via
+             an HTTP proxy at 192.0.2.0:
+
+                ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
+
      PubkeyAuthentication
              Specifies whether to try public key authentication.  The argument
              to this keyword must be ``yes'' or ``no''.  The default is
@@ -369,13 +396,13 @@ DESCRIPTION
      RemoteForward
              Specifies that a TCP/IP port on the remote machine be forwarded
              over the secure channel to the specified host and port from the
-             local machine.  The first argument must be a port number, and the
-             second must be [bind_address:]host:port.  IPv6 addresses can be
-             specified by enclosing any addresses in square brackets or by us-
-             ing the alternative syntax: [bind_address/]host/port.  Multiple
-             forwardings may be specified, and additional forwardings can be
-             given on the command line.  Only the superuser can forward privi-
-             leged ports.
+             local machine.  The first argument must be [bind_address:]port
+             and the second argument must be host:hostport.  IPv6 addresses
+             can be specified by enclosing addresses in square brackets or by
+             using an alternative syntax: [bind_address/]port and
+             host/hostport.  Multiple forwardings may be specified, and addi-
+             tional forwardings can be given on the command line.  Only the
+             superuser can forward privileged ports.
 
              If the bind_address is not specified, the default is to only bind
              to loopback addresses.  If the bind_address is `*' or an empty
@@ -440,9 +467,9 @@ DESCRIPTION
 
      StrictHostKeyChecking
              If this flag is set to ``yes'', ssh will never automatically add
-             host keys to the $HOME/.ssh/known_hosts file, and refuses to con-
-             nect to hosts whose host key has changed.  This provides maximum
-             protection against trojan horse attacks, however, can be annoying
+             host keys to the ~/.ssh/known_hosts file, and refuses to connect
+             to hosts whose host key has changed.  This provides maximum pro-
+             tection against trojan horse attacks, however, can be annoying
              when the /etc/ssh/ssh_known_hosts file is poorly maintained, or
              connections to new hosts are frequently made.  This option forces
              the user to manually add all new hosts.  If this flag is set to
@@ -483,7 +510,7 @@ DESCRIPTION
 
      UserKnownHostsFile
              Specifies a file to use for the user host key database instead of
-             $HOME/.ssh/known_hosts.
+             ~/.ssh/known_hosts.
 
      VerifyHostKeyDNS
              Specifies whether to verify the remote key using DNS and SSHFP
@@ -502,7 +529,7 @@ DESCRIPTION
              is /usr/X11R6/bin/xauth.
 
 FILES
-     $HOME/.ssh/config
+     ~/.ssh/config
              This is the per-user configuration file.  The format of this file
              is described above.  This file is used by the ssh client.  Be-
              cause of the potential for abuse, this file must have strict per-
@@ -524,4 +551,4 @@ AUTHORS
      ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.6                   September 25, 1999                             8
+OpenBSD 3.8                   September 25, 1999                             9
diff --git a/ssh_config.5 b/ssh_config.5
index 06db04c27..9033185b1 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.47 2005/03/07 23:41:54 jmc Exp $
+.\" $OpenBSD: ssh_config.5,v 1.61 2005/07/08 12:53:10 jmc Exp $
 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
@@ -43,7 +43,7 @@
 .Nd OpenSSH SSH client configuration files
 .Sh SYNOPSIS
 .Bl -tag -width Ds -compact
-.It Pa $HOME/.ssh/config
+.It Pa ~/.ssh/config
 .It Pa /etc/ssh/ssh_config
 .El
 .Sh DESCRIPTION
@@ -55,7 +55,7 @@ the following order:
 command-line options
 .It
 user's configuration file
-.Pq Pa $HOME/.ssh/config
+.Pq Pa ~/.ssh/config
 .It
 system-wide configuration file
 .Pq Pa /etc/ssh/ssh_config
@@ -136,8 +136,9 @@ or
 The default is
 .Dq no .
 .It Cm BindAddress
-Specify the interface to transmit from on machines with multiple
-interfaces or aliased addresses.
+Use the specified address on the local machine as the source address of
+the connection.
+Only useful on systems with more than one address.
 Note that this option does not work if
 .Cm UsePrivilegedPort
 is set to
@@ -193,14 +194,17 @@ The supported ciphers are
 .Dq aes128-ctr ,
 .Dq aes192-ctr ,
 .Dq aes256-ctr ,
+.Dq arcfour128 ,
+.Dq arcfour256 ,
 .Dq arcfour ,
 .Dq blowfish-cbc ,
 and
 .Dq cast128-cbc .
 The default is
 .Bd -literal
-  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-    aes192-cbc,aes256-cbc''
+  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+    arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+    aes192-ctr,aes256-ctr''
 .Ed
 .It Cm ClearAllForwardings
 Specifies that all local, remote and dynamic port forwardings
@@ -270,11 +274,47 @@ to listen for control connections, but require confirmation using the
 program before they are accepted (see
 .Xr ssh-add 1
 for details).
+If the
+.Cm ControlPath
+can not be opened,
+.Nm ssh
+will continue without connecting to a master instance.
+.Pp
+X11 and
+.Xr ssh-agent 1
+forwarding is supported over these multiplexed connections, however the
+display and agent fowarded will be the one belonging to the master
+connection i.e. it is not possible to forward multiple displays or agents.
+.Pp
+Two additional options allow for opportunistic multiplexing: try to use a
+master connection but fall back to creating a new one if one does not already
+exist.
+These options are:
+.Dq auto
+and
+.Dq autoask .
+The latter requires confirmation like the
+.Dq ask
+option.
 .It Cm ControlPath
-Specify the path to the control socket used for connection sharing.
-See
+Specify the path to the control socket used for connection sharing as described
+in the
 .Cm ControlMaster
-above.
+section above or the string
+.Dq none
+to disable connection sharing.
+In the path,
+.Ql %h
+will be substituted by the target host name,
+.Ql %p
+the port and
+.Ql %r
+by the remote login username.
+It is recommended that any
+.Cm ControlPath
+used for opportunistic connection sharing include
+all three of these escape sequences.
+This ensures that shared connections are uniquely identified.
 .It Cm DynamicForward
 Specifies that a TCP/IP port on the local machine be forwarded
 over the secure channel, and the application
@@ -407,11 +447,21 @@ Forward (delegate) credentials to the server.
 The default is
 .Dq no .
 Note that this option applies to protocol version 2 only.
+.It Cm GSSAPITrustDns
+Set to 
+.Dq yes to indicate that the DNS is trusted to securely canonicalize
+the name of the host being connected to. If 
+.Dq no, the hostname entered on the
+command line will be passed untouched to the GSSAPI library.
+The default is
+.Dq no .
+This option only applies to protocol version 2 connections using GSSAPI 
+key exchange.
 .It Cm HashKnownHosts
 Indicates that
 .Nm ssh
 should hash host names and addresses when they are added to
-.Pa $HOME/.ssh/known_hosts .
+.Pa ~/.ssh/known_hosts .
 These hashed names may be used normally by
 .Nm ssh
 and
@@ -457,11 +507,11 @@ specifications).
 Specifies a file from which the user's RSA or DSA authentication identity
 is read.
 The default is
-.Pa $HOME/.ssh/identity
+.Pa ~/.ssh/identity
 for protocol version 1, and
-.Pa $HOME/.ssh/id_rsa
+.Pa ~/.ssh/id_rsa
 and
-.Pa $HOME/.ssh/id_dsa
+.Pa ~/.ssh/id_dsa
 for protocol version 2.
 Additionally, any identities represented by the authentication agent
 will be used for authentication.
@@ -495,21 +545,17 @@ The default is to use the server specified list.
 .It Cm LocalForward
 Specifies that a TCP/IP port on the local machine be forwarded over
 the secure channel to the specified host and port from the remote machine.
-The first argument must be a port number, and the second must be
-.Xo
+The first argument must be
 .Sm off
-.Oo Ar bind_address : Oc
-.Ar host : port
+.Oo Ar bind_address : Oc Ar port
 .Sm on
-.Xc .
+and the second argument must be
+.Ar host : Ns Ar hostport .
 IPv6 addresses can be specified by enclosing addresses in square brackets or
 by using an alternative syntax:
-.Sm off
-.Xo
-.Op Ar bind_address No /
-.Ar host No / Ar port
-.Xc .
-.Sm on
+.Oo Ar bind_address Ns / Oc Ns Ar port
+and
+.Ar host Ns / Ns Ar hostport .
 Multiple forwardings may be specified, and additional forwardings can be
 given on the command line.
 Only the superuser can forward privileged ports.
@@ -571,9 +617,9 @@ Default is 22.
 .It Cm PreferredAuthentications
 Specifies the order in which the client should try protocol 2
 authentication methods.
-This allows a client to prefer one method (e.g.
+This allows a client to prefer one method (e.g.\&
 .Cm keyboard-interactive )
-over another method (e.g.
+over another method (e.g.\&
 .Cm password )
 The default for this option is:
 .Dq hostbased,publickey,keyboard-interactive,password .
@@ -620,6 +666,14 @@ Note that
 .Cm CheckHostIP
 is not available for connects with a proxy command.
 .Pp
+This directive is useful in conjunction with
+.Xr nc 1
+and its proxy support.
+For example, the following directive would connect via an HTTP proxy at
+192.0.2.0:
+.Bd -literal -offset 3n
+ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
+.Ed
 .It Cm PubkeyAuthentication
 Specifies whether to try public key authentication.
 The argument to this keyword must be
@@ -632,21 +686,17 @@ This option applies to protocol version 2 only.
 .It Cm RemoteForward
 Specifies that a TCP/IP port on the remote machine be forwarded over
 the secure channel to the specified host and port from the local machine.
-The first argument must be a port number, and the second must be
-.Xo
+The first argument must be
 .Sm off
-.Oo Ar bind_address : Oc
-.Ar host : port
-.Sm on
-.Xc .
-IPv6 addresses can be specified by enclosing any addresses in square brackets
-or by using the alternative syntax:
-.Sm off
-.Xo
-.Op Ar bind_address No /
-.Ar host No / Ar port
-.Xc .
+.Oo Ar bind_address : Oc Ar port
 .Sm on
+and the second argument must be
+.Ar host : Ns Ar hostport .
+IPv6 addresses can be specified by enclosing addresses in square brackets
+or by using an alternative syntax:
+.Oo Ar bind_address Ns / Oc Ns Ar port
+and
+.Ar host Ns / Ns Ar hostport .
 Multiple forwardings may be specified, and additional
 forwardings can be given on the command line.
 Only the superuser can forward privileged ports.
@@ -759,7 +809,7 @@ If this flag is set to
 .Dq yes ,
 .Nm ssh
 will never automatically add host keys to the
-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts
 file, and refuses to connect to hosts whose host key has changed.
 This provides maximum protection against trojan horse attacks,
 however, can be annoying when the
@@ -831,7 +881,7 @@ having to remember to give the user name on the command line.
 .It Cm UserKnownHostsFile
 Specifies a file to use for the user
 host key database instead of
-.Pa $HOME/.ssh/known_hosts .
+.Pa ~/.ssh/known_hosts .
 .It Cm VerifyHostKeyDNS
 Specifies whether to verify the remote key using DNS and SSHFP resource
 records.
@@ -864,7 +914,7 @@ The default is
 .El
 .Sh FILES
 .Bl -tag -width Ds
-.It Pa $HOME/.ssh/config
+.It Pa ~/.ssh/config
 This is the per-user configuration file.
 The format of this file is described above.
 This file is used by the
diff --git a/sshconnect.c b/sshconnect.c
index 49190560d..ba7b9b71e 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.161 2005/03/02 01:00:06 djm Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.168 2005/07/17 07:17:55 djm Exp $");
 
 #include <openssl/bn.h>
 
@@ -59,12 +59,11 @@ static void warn_changed_key(Key *);
 static int
 ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
 {
-        Buffer command;
-        const char *cp;
-        char *command_string;
+        char *command_string, *tmp;
         int pin[2], pout[2];
         pid_t pid;
         char strport[NI_MAXSERV];
+        size_t len;
 
         /* Convert the port number into a string. */
         snprintf(strport, sizeof strport, "%hu", port);
@@ -76,31 +75,13 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
          * Use "exec" to avoid "sh -c" processes on some platforms
          * (e.g. Solaris)
          */
-        buffer_init(&command);
-        buffer_append(&command, "exec ", 5);
-
-        for (cp = proxy_command; *cp; cp++) {
-                if (cp[0] == '%' && cp[1] == '%') {
-                        buffer_append(&command, "%", 1);
-                        cp++;
-                        continue;
-                }
-                if (cp[0] == '%' && cp[1] == 'h') {
-                        buffer_append(&command, host, strlen(host));
-                        cp++;
-                        continue;
-                }
-                if (cp[0] == '%' && cp[1] == 'p') {
-                        buffer_append(&command, strport, strlen(strport));
-                        cp++;
-                        continue;
-                }
-                buffer_append(&command, cp, 1);
-        }
-        buffer_append(&command, "\0", 1);
-
-        /* Get the final command string. */
-        command_string = buffer_ptr(&command);
+        len = strlen(proxy_command) + 6;
+        tmp = xmalloc(len);
+        strlcpy(tmp, "exec ", len);
+        strlcat(tmp, proxy_command, len);
+        command_string = percent_expand(tmp, "h", host,
+            "p", strport, (char *)NULL);
+        xfree(tmp);
 
         /* Create pipes for communicating with the proxy. */
         if (pipe(pin) < 0 || pipe(pout) < 0)
@@ -154,7 +135,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
         close(pout[1]);
 
         /* Free the command name. */
-        buffer_free(&command);
+        xfree(command_string);
 
         /* Set the connection file descriptors. */
         packet_set_connection(pout[0], pin[1]);
@@ -247,13 +228,13 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
         tv.tv_sec = timeout;
         tv.tv_usec = 0;
 
-        for(;;) {
+        for (;;) {
                 rc = select(sockfd + 1, NULL, fdset, NULL, &tv);
                 if (rc != -1 || errno != EINTR)
                         break;
         }
 
-        switch(rc) {
+        switch (rc) {
         case 0:
                 /* Timed out */
                 errno = ETIMEDOUT;
@@ -308,18 +289,9 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
         int sock = -1, attempt;
         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
         struct addrinfo hints, *ai, *aitop;
-        struct servent *sp;
 
         debug2("ssh_connect: needpriv %d", needpriv);
 
-        /* Get default port if port has not been set. */
-        if (port == 0) {
-                sp = getservbyname(SSH_SERVICE_NAME, "tcp");
-                if (sp)
-                        port = ntohs(sp->s_port);
-                else
-                        port = SSH_DEFAULT_PORT;
-        }
         /* If a proxy command is given, connect using it. */
         if (proxy_command != NULL)
                 return ssh_proxy_connect(host, port, proxy_command);
@@ -421,19 +393,21 @@ static void
 ssh_exchange_identification(void)
 {
         char buf[256], remote_version[256];     /* must be same size! */
-        int remote_major, remote_minor, i, mismatch;
+        int remote_major, remote_minor, mismatch;
         int connection_in = packet_get_connection_in();
         int connection_out = packet_get_connection_out();
         int minor1 = PROTOCOL_MINOR_1;
+        u_int i;
 
-        /* Read other side\'s version identification. */
+        /* Read other side's version identification. */
         for (;;) {
                 for (i = 0; i < sizeof(buf) - 1; i++) {
-                        int len = atomicio(read, connection_in, &buf[i], 1);
-                        if (len < 0)
-                                fatal("ssh_exchange_identification: read: %.100s", strerror(errno));
-                        if (len != 1)
+                        size_t len = atomicio(read, connection_in, &buf[i], 1);
+
+                        if (len != 1 && errno == EPIPE)
                                 fatal("ssh_exchange_identification: Connection closed by remote host");
+                        else if (len != 1)
+                                fatal("ssh_exchange_identification: read: %.100s", strerror(errno));
                         if (buf[i] == '\r') {
                                 buf[i] = '\n';
                                 buf[i + 1] = 0;
@@ -573,7 +547,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
         switch (hostaddr->sa_family) {
         case AF_INET:
                 local = (ntohl(((struct sockaddr_in *)hostaddr)->
-                   sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
+                    sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
                 salen = sizeof(struct sockaddr_in);
                 break;
         case AF_INET6:
@@ -706,8 +680,8 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 
                         if (show_other_keys(host, host_key))
                                 snprintf(msg1, sizeof(msg1),
-                                   "\nbut keys of different type are already"
-                                   " known for this host.");
+                                    "\nbut keys of different type are already"
+                                    " known for this host.");
                         else
                                 snprintf(msg1, sizeof(msg1), ".");
                         /* The default */
diff --git a/sshconnect1.c b/sshconnect1.c
index 6e2e31c02..bd05723c7 100644
--- a/sshconnect1.c
+++ b/sshconnect1.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect1.c,v 1.60 2004/07/28 09:40:29 markus Exp $");
+RCSID("$OpenBSD: sshconnect1.c,v 1.61 2005/06/17 02:44:33 djm Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/md5.h>
@@ -162,7 +162,7 @@ respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
         /* Compute the response. */
         /* The response is MD5 of decrypted challenge plus session id. */
         len = BN_num_bytes(challenge);
-        if (len <= 0 || len > sizeof(buf))
+        if (len <= 0 || (u_int)len > sizeof(buf))
                 packet_disconnect(
                     "respond_to_rsa_challenge: bad challenge length %d", len);
 
diff --git a/sshconnect2.c b/sshconnect2.c
index b69602c0c..aa0b6ec59 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.138 2004/06/13 12:53:24 djm Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.142 2005/08/30 22:08:05 djm Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -87,16 +87,24 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 #ifdef GSSAPI
         char *orig, *gss;
         int len;
+        char *gss_host;
 #endif
 
         xxx_host = host;
         xxx_hostaddr = hostaddr;
 
 #ifdef GSSAPI
+        /* Add the GSSAPI mechanisms currently supported on this client to
+         * the key exchange algorithm proposal */
         orig = myproposal[PROPOSAL_KEX_ALGS];
-        gss = ssh_gssapi_client_mechanisms(get_canonical_hostname(1));
-        debug("Offering GSSAPI proposal: %s",gss);
+        if (options.gss_trust_dns)
+                gss_host = (char *)get_canonical_hostname(1);
+        else
+                gss_host = host;
+
+        gss = ssh_gssapi_client_mechanisms(gss_host);
         if (gss) {
+                debug("Offering GSSAPI proposal: %s", gss);
                 len = strlen(orig) + strlen(gss) + 2;
                 myproposal[PROPOSAL_KEX_ALGS] = xmalloc(len);
                 snprintf(myproposal[PROPOSAL_KEX_ALGS], len, "%s,%s", gss, 
@@ -118,10 +126,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
             compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
         if (options.compression) {
                 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-                myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib,none";
+                myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib@openssh.com,zlib,none";
         } else {
                 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-                myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib";
+                myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com,zlib";
         }
         if (options.macs != NULL) {
                 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
@@ -132,6 +140,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
                     options.hostkeyalgorithms;
 
 #ifdef GSSAPI
+        /* If we've got GSSAPI algorithms, then we also support the
+         * 'null' hostkey, as a last resort */
         if (gss) {
                 orig = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS];
                 len = strlen(orig) + sizeof(",null");
@@ -151,6 +161,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
 #ifdef GSSAPI
         kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
+        kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
 #endif
         kex->client_version_string=client_version_string;
         kex->server_version_string=server_version_string;
@@ -158,6 +169,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 
 #ifdef GSSAPI
         kex->gss_deleg_creds = options.gss_deleg_creds;
+        kex->gss_trust_dns = options.gss_trust_dns;
+        kex->gss_host = gss_host;
 #endif
 
         xxx_kex = kex;
@@ -242,7 +255,7 @@ void	input_gssapi_token(int type, u_int32_t, void *);
 void    input_gssapi_hash(int type, u_int32_t, void *);
 void    input_gssapi_error(int, u_int32_t, void *);
 void    input_gssapi_errtok(int, u_int32_t, void *);
-int     userauth_gsskeyx(Authctxt *authctxt);
+int     userauth_gsskeyex(Authctxt *authctxt);
 #endif
 
 void    userauth(Authctxt *, char *);
@@ -258,8 +271,8 @@ static char *authmethods_get(void);
 
 Authmethod authmethods[] = {
 #ifdef GSSAPI
-        {"gssapi-keyx",
-                userauth_gsskeyx,
+        {"gssapi-keyex",
+                userauth_gsskeyex,
                 &options.gss_authentication,
                 NULL},
         {"gssapi-with-mic",
@@ -391,7 +404,7 @@ void
 input_userauth_error(int type, u_int32_t seq, void *ctxt)
 {
         fatal("input_userauth_error: bad message during authentication: "
-           "type %d", type);
+            "type %d", type);
 }
 
 void
@@ -521,7 +534,7 @@ userauth_gssapi(Authctxt *authctxt)
 {
         Gssctxt *gssctxt = NULL;
         static gss_OID_set gss_supported = NULL;
-        static int mech = 0;
+        static u_int mech = 0;
         OM_uint32 min;
         int ok = 0;
 
@@ -548,7 +561,8 @@ userauth_gssapi(Authctxt *authctxt)
                 }
         }
 
-        if (!ok) return 0;
+        if (!ok)
+                return 0;
 
         authctxt->methoddata=(void *)gssctxt;
 
@@ -583,7 +597,8 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
         Authctxt *authctxt = ctxt;
         Gssctxt *gssctxt = authctxt->methoddata;
         gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-        gss_buffer_desc gssbuf, mic;
+        gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
+        gss_buffer_desc gssbuf;
         OM_uint32 status, ms, flags;
         Buffer b;
 
@@ -717,7 +732,7 @@ input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
 
         /* Stick it into GSSAPI and see what it says */
         status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
-                                     &recv_tok, &send_tok, NULL);
+            &recv_tok, &send_tok, NULL);
 
         xfree(recv_tok.value);
         gss_release_buffer(&ms, &send_tok);
@@ -745,10 +760,11 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
 }
 
 int
-userauth_gsskeyx(Authctxt *authctxt)
+userauth_gsskeyex(Authctxt *authctxt)
 {
         Buffer b;
-        gss_buffer_desc gssbuf, mic;
+        gss_buffer_desc gssbuf;
+        gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
         OM_uint32 ms;
 
         static int attempt = 0;
diff --git a/sshd.0 b/sshd.0
index fe4d29e54..9a9613b54 100644
--- a/sshd.0
+++ b/sshd.0
@@ -21,7 +21,7 @@ DESCRIPTION
      sshd works as follows:
 
    SSH protocol version 1
-     Each host has a host-specific RSA key (normally 1024 bits) used to iden-
+     Each host has a host-specific RSA key (normally 2048 bits) used to iden-
      tify the host.  Additionally, when the daemon starts, it generates a
      server RSA key (normally 768 bits).  This key is normally regenerated ev-
      ery hour if it has been used, and is never stored on disk.
@@ -200,8 +200,7 @@ LOGIN PROCESS
 
            1.   If the login is on a tty, and no command has been specified,
                 prints last login time and /etc/motd (unless prevented in the
-                configuration file or by $HOME/.hushlogin; see the FILES sec-
-                tion).
+                configuration file or by ~/.hushlogin; see the FILES section).
 
            2.   If the login is on a tty, records login time.
 
@@ -212,21 +211,20 @@ LOGIN PROCESS
 
            5.   Sets up basic environment.
 
-           6.   Reads the file $HOME/.ssh/environment, if it exists, and users
-                are allowed to change their environment.  See the
+           6.   Reads the file ~/.ssh/environment, if it exists, and users are
+                allowed to change their environment.  See the
                 PermitUserEnvironment option in sshd_config(5).
 
            7.   Changes to user's home directory.
 
-           8.   If $HOME/.ssh/rc exists, runs it; else if /etc/ssh/sshrc ex-
-                ists, runs it; otherwise runs xauth.  The ``rc'' files are
-                given the X11 authentication protocol and cookie in standard
-                input.
+           8.   If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists,
+                runs it; otherwise runs xauth.  The ``rc'' files are given the
+                X11 authentication protocol and cookie in standard input.
 
            9.   Runs user's shell or command.
 
 AUTHORIZED_KEYS FILE FORMAT
-     $HOME/.ssh/authorized_keys is the default file that lists the public keys
+     ~/.ssh/authorized_keys is the default file that lists the public keys
      that are permitted for RSA authentication in protocol version 1 and for
      public key authentication (PubkeyAuthentication) in protocol version 2.
      AuthorizedKeysFile may be used to specify an alternative file.
@@ -329,10 +327,10 @@ AUTHORIZED_KEYS FILE FORMAT
      permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
 
 SSH_KNOWN_HOSTS FILE FORMAT
-     The /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts files contain
-     host public keys for all known hosts.  The global file should be prepared
-     by the administrator (optional), and the per-user file is maintained au-
-     tomatically: whenever the user connects from an unknown host its key is
+     The /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts files contain host
+     public keys for all known hosts.  The global file should be prepared by
+     the administrator (optional), and the per-user file is maintained auto-
+     matically: whenever the user connects from an unknown host its key is
      added to the per-user file.
 
      Each line in these files contains the following fields: hostnames, bits,
@@ -417,7 +415,7 @@ FILES
              The content of this file is not sensitive; it can be world-read-
              able.
 
-     $HOME/.ssh/authorized_keys
+     ~/.ssh/authorized_keys
              Lists the public keys (RSA or DSA) that can be used to log into
              the user's account.  This file must be readable by root (which
              may on some machines imply it being world-readable if the user's
@@ -427,7 +425,7 @@ FILES
              identity.pub, id_dsa.pub and/or id_rsa.pub files into this file,
              as described in ssh-keygen(1).
 
-     /etc/ssh/ssh_known_hosts, $HOME/.ssh/known_hosts
+     /etc/ssh/ssh_known_hosts, ~/.ssh/known_hosts
              These files are consulted when using rhosts with RSA host authen-
              tication or protocol version 2 hostbased authentication to check
              the public key of the host.  The key must be listed in one of
@@ -435,12 +433,12 @@ FILES
              verify that it is connecting to the correct remote host.  These
              files should be writable only by root/the owner.
              /etc/ssh/ssh_known_hosts should be world-readable, and
-             $HOME/.ssh/known_hosts can, but need not be, world-readable.
+             ~/.ssh/known_hosts can, but need not be, world-readable.
 
      /etc/motd
              See motd(5).
 
-     $HOME/.hushlogin
+     ~/.hushlogin
              This file is used to suppress printing the last login time and
              /etc/motd, if PrintLastLog and PrintMotd, respectively, are en-
              abled.  It does not suppress printing of the banner specified by
@@ -456,7 +454,7 @@ FILES
              Access controls that should be enforced by tcp-wrappers are de-
              fined here.  Further details are described in hosts_access(5).
 
-     $HOME/.rhosts
+     ~/.rhosts
              This file is used during RhostsRSAAuthentication and
              HostbasedAuthentication and contains host-username pairs, sepa-
              rated by a space, one per line.  The given user on the corre-
@@ -469,7 +467,7 @@ FILES
              user name may be of the form +@groupname to specify all hosts or
              all users in the group.
 
-     $HOME/.shosts
+     ~/.shosts
              For ssh, this file is exactly the same as for .rhosts.  However,
              this file is not used by rlogin and rshd, so using this permits
              access using SSH only.
@@ -505,7 +503,7 @@ FILES
              file may be useful in environments that want to run both
              rsh/rlogin and ssh.
 
-     $HOME/.ssh/environment
+     ~/.ssh/environment
              This file is read into the environment at login (if it exists).
              It can only contain empty lines, comment lines (that start with
              `#'), and assignment lines of the form name=value.  The file
@@ -513,7 +511,7 @@ FILES
              anyone else.  Environment processing is disabled by default and
              is controlled via the PermitUserEnvironment option.
 
-     $HOME/.ssh/rc
+     ~/.ssh/rc
              If this file exists, it is run with /bin/sh after reading the en-
              vironment files but before starting the user's shell or command.
              It must not produce any output on stdout; stderr must be used in-
@@ -548,9 +546,9 @@ FILES
              readable by anyone else.
 
      /etc/ssh/sshrc
-             Like $HOME/.ssh/rc.  This can be used to specify machine-specific
-             login-time initializations globally.  This file should be
-             writable only by root, and should be world-readable.
+             Like ~/.ssh/rc.  This can be used to specify machine-specific lo-
+             gin-time initializations globally.  This file should be writable
+             only by root, and should be world-readable.
 
 SEE ALSO
      scp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1),
@@ -573,4 +571,4 @@ AUTHORS
      versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
      for privilege separation.
 
-OpenBSD 3.6                   September 25, 1999                             9
+OpenBSD 3.8                   September 25, 1999                             9
diff --git a/sshd.8 b/sshd.8
index ac3bf96cf..fdff4ac91 100644
--- a/sshd.8
+++ b/sshd.8
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.206 2005/03/01 14:59:49 jmc Exp $
+.\" $OpenBSD: sshd.8,v 1.208 2005/06/08 03:50:00 djm Exp $
 .Dd September 25, 1999
 .Dt SSHD 8
 .Os
@@ -80,7 +80,7 @@ supports both SSH protocol version 1 and 2 simultaneously.
 works as follows:
 .Ss SSH protocol version 1
 Each host has a host-specific RSA key
-(normally 1024 bits) used to identify the host.
+(normally 2048 bits) used to identify the host.
 Additionally, when
 the daemon starts, it generates a server RSA key (normally 768 bits).
 This key is normally regenerated every hour if it has been used, and
@@ -350,7 +350,7 @@ If the login is on a tty, and no command has been specified,
 prints last login time and
 .Pa /etc/motd
 (unless prevented in the configuration file or by
-.Pa $HOME/.hushlogin ;
+.Pa ~/.hushlogin ;
 see the
 .Sx FILES
 section).
@@ -367,7 +367,7 @@ Changes to run with normal user privileges.
 Sets up basic environment.
 .It
 Reads the file
-.Pa $HOME/.ssh/environment ,
+.Pa ~/.ssh/environment ,
 if it exists, and users are allowed to change their environment.
 See the
 .Cm PermitUserEnvironment
@@ -377,7 +377,7 @@ option in
 Changes to user's home directory.
 .It
 If
-.Pa $HOME/.ssh/rc
+.Pa ~/.ssh/rc
 exists, runs it; else if
 .Pa /etc/ssh/sshrc
 exists, runs
@@ -390,7 +390,7 @@ authentication protocol and cookie in standard input.
 Runs user's shell or command.
 .El
 .Sh AUTHORIZED_KEYS FILE FORMAT
-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys
 is the default file that lists the public keys that are
 permitted for RSA authentication in protocol version 1
 and for public key authentication (PubkeyAuthentication)
@@ -528,7 +528,7 @@ permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
 The
 .Pa /etc/ssh/ssh_known_hosts
 and
-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts
 files contain host public keys for all known hosts.
 The global file should
 be prepared by the administrator (optional), and the per-user file is
@@ -639,7 +639,7 @@ listening for connections (if there are several daemons running
 concurrently for different ports, this contains the process ID of the one
 started last).
 The content of this file is not sensitive; it can be world-readable.
-.It Pa $HOME/.ssh/authorized_keys
+.It Pa ~/.ssh/authorized_keys
 Lists the public keys (RSA or DSA) that can be used to log into the user's account.
 This file must be readable by root (which may on some machines imply
 it being world-readable if the user's home directory resides on an NFS
@@ -653,7 +653,7 @@ and/or
 .Pa id_rsa.pub
 files into this file, as described in
 .Xr ssh-keygen 1 .
-.It Pa "/etc/ssh/ssh_known_hosts", "$HOME/.ssh/known_hosts"
+.It Pa "/etc/ssh/ssh_known_hosts", "~/.ssh/known_hosts"
 These files are consulted when using rhosts with RSA host
 authentication or protocol version 2 hostbased authentication
 to check the public key of the host.
@@ -663,12 +663,12 @@ to verify that it is connecting to the correct remote host.
 These files should be writable only by root/the owner.
 .Pa /etc/ssh/ssh_known_hosts
 should be world-readable, and
-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts
 can, but need not be, world-readable.
 .It Pa /etc/motd
 See
 .Xr motd 5 .
-.It Pa $HOME/.hushlogin
+.It Pa ~/.hushlogin
 This file is used to suppress printing the last login time and
 .Pa /etc/motd ,
 if
@@ -691,7 +691,7 @@ The file should be world-readable.
 Access controls that should be enforced by tcp-wrappers are defined here.
 Further details are described in
 .Xr hosts_access 5 .
-.It Pa $HOME/.rhosts
+.It Pa ~/.rhosts
 This file is used during
 .Cm RhostsRSAAuthentication
 and
@@ -709,7 +709,7 @@ It is also possible to use netgroups in the file.
 Either host or user
 name may be of the form +@groupname to specify all hosts or all users
 in the group.
-.It Pa $HOME/.shosts
+.It Pa ~/.shosts
 For ssh,
 this file is exactly the same as for
 .Pa .rhosts .
@@ -758,7 +758,7 @@ This is processed exactly as
 .Pa /etc/hosts.equiv .
 However, this file may be useful in environments that want to run both
 rsh/rlogin and ssh.
-.It Pa $HOME/.ssh/environment
+.It Pa ~/.ssh/environment
 This file is read into the environment at login (if it exists).
 It can only contain empty lines, comment lines (that start with
 .Ql # ) ,
@@ -769,7 +769,7 @@ Environment processing is disabled by default and is
 controlled via the
 .Cm PermitUserEnvironment
 option.
-.It Pa $HOME/.ssh/rc
+.It Pa ~/.ssh/rc
 If this file exists, it is run with
 .Pa /bin/sh
 after reading the
@@ -814,7 +814,7 @@ This file should be writable only by the user, and need not be
 readable by anyone else.
 .It Pa /etc/ssh/sshrc
 Like
-.Pa $HOME/.ssh/rc .
+.Pa ~/.ssh/rc .
 This can be used to specify
 machine-specific login-time initializations globally.
 This file should be writable only by root, and should be world-readable.
diff --git a/sshd.c b/sshd.c
index 51b476778..da0b26587 100644
--- a/sshd.c
+++ b/sshd.c
@@ -42,7 +42,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.308 2005/02/08 22:24:57 dtucker Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -86,6 +86,10 @@ RCSID("$OpenBSD: sshd.c,v 1.308 2005/02/08 22:24:57 dtucker Exp $");
 #include "monitor_wrap.h"
 #include "monitor_fdpass.h"
 
+#ifdef USE_SECURITY_SESSION_API
+#include <Security/AuthSession.h>
+#endif
+
 #ifdef LIBWRAP
 #include <tcpd.h>
 #include <syslog.h>
@@ -358,7 +362,8 @@ key_regeneration_alarm(int sig)
 static void
 sshd_exchange_identification(int sock_in, int sock_out)
 {
-        int i, mismatch;
+        u_int i;
+        int mismatch;
         int remote_major, remote_minor;
         int major, minor;
         char *s;
@@ -670,6 +675,12 @@ privsep_postauth(Authctxt *authctxt)
 
         /* It is safe now to apply the key state */
         monitor_apply_keystate(pmonitor);
+
+        /*
+         * Tell the packet layer that authentication was successful, since
+         * this information is not part of the key state.
+         */
+        packet_set_authenticated();
 }
 
 static char *
@@ -1033,7 +1044,7 @@ main(int ac, char **av)
         /*
          * Unset KRB5CCNAME, otherwise the user's session may inherit it from
          * root's environment
-         */ 
+         */
         if (getenv("KRB5CCNAME") != NULL)
                 unsetenv("KRB5CCNAME");
 
@@ -1111,6 +1122,7 @@ main(int ac, char **av)
                 options.protocol &= ~SSH_PROTO_1;
         }
 #ifndef GSSAPI
+        /* The GSSAPI key exchange can run without a host key */
         if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) {
                 logit("Disabling protocol version 2. Could not load host key");
                 options.protocol &= ~SSH_PROTO_2;
@@ -1617,19 +1629,22 @@ main(int ac, char **av)
         signal(SIGCHLD, SIG_DFL);
         signal(SIGINT, SIG_DFL);
 
-        /* Set SO_KEEPALIVE if requested. */
-        if (options.tcp_keep_alive &&
-            setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on,
-            sizeof(on)) < 0)
-                error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
-
         /*
          * Register our connection.  This turns encryption off because we do
          * not have a key.
          */
         packet_set_connection(sock_in, sock_out);
+        packet_set_server();
+
+        /* Set SO_KEEPALIVE if requested. */
+        if (options.tcp_keep_alive && packet_connection_is_on_socket() &&
+            setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0)
+                error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
 
-        remote_port = get_remote_port();
+        if ((remote_port = get_remote_port()) < 0) {
+                debug("get_remote_port failed");
+                cleanup_exit(255);
+        }
         remote_ip = get_remote_ipaddr();
 
 #ifdef SSH_AUDIT_EVENTS
@@ -1655,6 +1670,62 @@ main(int ac, char **av)
         /* Log the connection. */
         verbose("Connection from %.500s port %d", remote_ip, remote_port);
 
+#ifdef USE_SECURITY_SESSION_API
+        /*
+         * Create a new security session for use by the new user login if
+         * the current session is the root session or we are not launched
+         * by inetd (eg: debugging mode or server mode).  We do not
+         * necessarily need to create a session if we are launched from
+         * inetd because Panther xinetd will create a session for us.
+         *
+         * The only case where this logic will fail is if there is an
+         * inetd running in a non-root session which is not creating
+         * new sessions for us.  Then all the users will end up in the
+         * same session (bad).
+         *
+         * When the client exits, the session will be destroyed for us
+         * automatically.
+         *
+         * We must create the session before any credentials are stored
+         * (including AFS pags, which happens a few lines below).
+         */
+        {
+                OSStatus err = 0;
+                SecuritySessionId sid = 0;
+                SessionAttributeBits sattrs = 0;
+
+                err = SessionGetInfo(callerSecuritySession, &sid, &sattrs);
+                if (err)
+                        error("SessionGetInfo() failed with error %.8X",
+                            (unsigned) err);
+                else
+                        debug("Current Session ID is %.8X / Session Attributes a
+re %.8X",
+                            (unsigned) sid, (unsigned) sattrs);
+
+                if (inetd_flag && !(sattrs & sessionIsRoot))
+                        debug("Running in inetd mode in a non-root session... "
+                            "assuming inetd created the session for us.");
+                else {
+                        debug("Creating new security session...");
+                        err = SessionCreate(0, sessionHasTTY | sessionIsRemote);
+                        if (err)
+                                error("SessionCreate() failed with error %.8X",
+                                    (unsigned) err);
+
+                        err = SessionGetInfo(callerSecuritySession, &sid, 
+                            &sattrs);
+                        if (err)
+                                error("SessionGetInfo() failed with error %.8X",
+                                    (unsigned) err);
+                        else
+                                debug("New Session ID is %.8X / Session Attribut
+es are %.8X",
+                                    (unsigned) sid, (unsigned) sattrs);
+                }
+        }
+#endif
+
         /*
          * We don\'t want to listen forever unless the other side
          * successfully authenticates itself.  So we set up an alarm which is
@@ -1675,6 +1746,8 @@ main(int ac, char **av)
         authctxt = xmalloc(sizeof(*authctxt));
         memset(authctxt, 0, sizeof(*authctxt));
 
+        authctxt->loginmsg = &loginmsg;
+
         /* XXX global for cleanup, access from other modules */
         the_authctxt = authctxt;
 
@@ -1898,7 +1971,7 @@ do_ssh1_kex(void)
         if (!rsafail) {
                 BN_mask_bits(session_key_int, sizeof(session_key) * 8);
                 len = BN_num_bytes(session_key_int);
-                if (len < 0 || len > sizeof(session_key)) {
+                if (len < 0 || (u_int)len > sizeof(session_key)) {
                         error("do_connection: bad session key len from %s: "
                             "session_key_int %d > sizeof(session_key) %lu",
                             get_remote_ipaddr(), len, (u_long)sizeof(session_key));
@@ -1985,10 +2058,14 @@ do_ssh2_kex(void)
                 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
                 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
         }
-        if (!options.compression) {
+        if (options.compression == COMP_NONE) {
                 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
                 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
+        } else if (options.compression == COMP_DELAYED) {
+                myproposal[PROPOSAL_COMP_ALGS_CTOS] =
+                myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com";
         }
+        
         myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
 
         /* start key exchange */
@@ -2008,7 +2085,10 @@ do_ssh2_kex(void)
         if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0)
                 orig = NULL;
 
-        gss = ssh_gssapi_server_mechanisms();
+        if (options.gss_keyex)
+                gss = ssh_gssapi_server_mechanisms();
+        else
+                gss = NULL;
 
         if (gss && orig) {
                 int len = strlen(orig) + strlen(gss) + 2;
@@ -2041,6 +2121,7 @@ do_ssh2_kex(void)
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
 #ifdef GSSAPI
         kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
+        kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
 #endif
         kex->server = 1;
         kex->client_version_string=client_version_string;
diff --git a/sshd_config b/sshd_config
index 53ae9942e..1440c05ff 100644
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#       $OpenBSD: sshd_config,v 1.70 2004/12/23 23:11:00 djm Exp $
+#       $OpenBSD: sshd_config,v 1.72 2005/07/25 11:59:40 markus Exp $
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -27,7 +27,7 @@
 #ServerKeyBits 768
 
 # Logging
-#obsoletes QuietMode and FascistLogging
+# obsoletes QuietMode and FascistLogging
 #SyslogFacility AUTH
 #LogLevel INFO
 
@@ -90,7 +90,7 @@
 #UseLogin no
 #UsePrivilegeSeparation yes
 #PermitUserEnvironment no
-#Compression yes
+#Compression delayed
 #ClientAliveInterval 0
 #ClientAliveCountMax 3
 #UseDNS yes
diff --git a/sshd_config.0 b/sshd_config.0
index 1f8763faf..d821a84b6 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -83,18 +83,13 @@ DESCRIPTION
              Specifies the ciphers allowed for protocol version 2.  Multiple
              ciphers must be comma-separated.  The supported ciphers are
              ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
-             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour'',
-             ``blowfish-cbc'', and ``cast128-cbc''.  The default is
+             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
+             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
+             ``cast128-cbc''.  The default is
 
-               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-                 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''
-
-     ClientAliveInterval
-             Sets a timeout interval in seconds after which if no data has
-             been received from the client, sshd will send a message through
-             the encrypted channel to request a response from the client.  The
-             default is 0, indicating that these messages will not be sent to
-             the client.  This option applies to protocol version 2 only.
+               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+                 aes192-ctr,aes256-ctr''
 
      ClientAliveCountMax
              Sets the number of client alive messages (see above) which may be
@@ -113,9 +108,17 @@ DESCRIPTION
              15, and ClientAliveCountMax is left at the default, unresponsive
              ssh clients will be disconnected after approximately 45 seconds.
 
+     ClientAliveInterval
+             Sets a timeout interval in seconds after which if no data has
+             been received from the client, sshd will send a message through
+             the encrypted channel to request a response from the client.  The
+             default is 0, indicating that these messages will not be sent to
+             the client.  This option applies to protocol version 2 only.
+
      Compression
-             Specifies whether compression is allowed.  The argument must be
-             ``yes'' or ``no''.  The default is ``yes''.
+             Specifies whether compression is allowed, or delayed until the
+             user has authenticated successfully.  The argument must be
+             ``yes'', ``delayed'', or ``no''.  The default is ``delayed''.
 
      DenyGroups
              This keyword can be followed by a list of group name patterns,
@@ -183,7 +186,7 @@ DESCRIPTION
 
      IgnoreUserKnownHosts
              Specifies whether sshd should ignore the user's
-             $HOME/.ssh/known_hosts during RhostsRSAAuthentication or
+             ~/.ssh/known_hosts during RhostsRSAAuthentication or
              HostbasedAuthentication.  The default is ``no''.
 
      KerberosAuthentication
@@ -383,7 +386,7 @@ DESCRIPTION
              To disable TCP keepalive messages, the value should be set to
              ``no''.
 
-     UseDNS  Specifies whether sshd should lookup the remote host name and
+     UseDNS  Specifies whether sshd should look up the remote host name and
              check that the resolved host name for the remote IP address maps
              back to the very same IP address.  The default is ``yes''.
 
@@ -498,4 +501,4 @@ AUTHORS
      versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
      for privilege separation.
 
-OpenBSD 3.6                   September 25, 1999                             8
+OpenBSD 3.8                   September 25, 1999                             8
diff --git a/sshd_config.5 b/sshd_config.5
index 8d291e61d..5af4b1b27 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.39 2005/03/01 10:09:52 djm Exp $
+.\" $OpenBSD: sshd_config.5,v 1.44 2005/07/25 11:59:40 markus Exp $
 .Dd September 25, 1999
 .Dt SSHD_CONFIG 5
 .Os
@@ -168,24 +168,18 @@ The supported ciphers are
 .Dq aes128-ctr ,
 .Dq aes192-ctr ,
 .Dq aes256-ctr ,
+.Dq arcfour128 ,
+.Dq arcfour256 ,
 .Dq arcfour ,
 .Dq blowfish-cbc ,
 and
 .Dq cast128-cbc .
 The default is
 .Bd -literal
-  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-    aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''
+  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+    arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+    aes192-ctr,aes256-ctr''
 .Ed
-.It Cm ClientAliveInterval
-Sets a timeout interval in seconds after which if no data has been received
-from the client,
-.Nm sshd
-will send a message through the encrypted
-channel to request a response from the client.
-The default
-is 0, indicating that these messages will not be sent to the client.
-This option applies to protocol version 2 only.
 .It Cm ClientAliveCountMax
 Sets the number of client alive messages (see above) which may be
 sent without
@@ -213,14 +207,25 @@ If
 .Cm ClientAliveCountMax
 is left at the default, unresponsive ssh clients
 will be disconnected after approximately 45 seconds.
+.It Cm ClientAliveInterval
+Sets a timeout interval in seconds after which if no data has been received
+from the client,
+.Nm sshd
+will send a message through the encrypted
+channel to request a response from the client.
+The default
+is 0, indicating that these messages will not be sent to the client.
+This option applies to protocol version 2 only.
 .It Cm Compression
-Specifies whether compression is allowed.
+Specifies whether compression is allowed, or delayed until
+the user has authenticated successfully.
 The argument must be
-.Dq yes
+.Dq yes ,
+.Dq delayed ,
 or
 .Dq no .
 The default is
-.Dq yes .
+.Dq delayed .
 .It Cm DenyGroups
 This keyword can be followed by a list of group name patterns, separated
 by spaces.
@@ -272,6 +277,12 @@ Specifies whether user authentication based on GSSAPI is allowed.
 The default is
 .Dq no .
 Note that this option applies to protocol version 2 only.
+.It Cm GSSAPIKeyExchange
+Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange 
+doesn't rely on ssh keys to verify host identity.
+The default is
+.Dq no .
+Note that this option applies to protocol version 2 only.
 .It Cm GSSAPICleanupCredentials
 Specifies whether to automatically destroy the user's credentials cache
 on logout.
@@ -327,7 +338,7 @@ The default is
 Specifies whether
 .Nm sshd
 should ignore the user's
-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts
 during
 .Cm RhostsRSAAuthentication
 or
@@ -630,7 +641,7 @@ To disable TCP keepalive messages, the value should be set to
 .It Cm UseDNS
 Specifies whether
 .Nm sshd
-should lookup the remote host name and check that
+should look up the remote host name and check that
 the resolved host name for the remote IP address maps back to the
 very same IP address.
 The default is
diff --git a/sshpty.c b/sshpty.c
index efd1dfefa..36788c4d7 100644
--- a/sshpty.c
+++ b/sshpty.c
@@ -128,10 +128,10 @@ pty_make_controlling_tty(int *ttyfd, const char *tty)
         if (ioctl(*ttyfd, TIOCSCTTY, NULL) < 0)
                 error("ioctl(TIOCSCTTY): %.100s", strerror(errno));
 #endif /* TIOCSCTTY */
-#ifdef HAVE_NEWS4
+#ifdef NEED_SETPGRP
         if (setpgrp(0,0) < 0)
                 error("SETPGRP %s",strerror(errno));
-#endif /* HAVE_NEWS4 */
+#endif /* NEED_SETPGRP */
 #ifdef USE_VHANGUP
         old = signal(SIGHUP, SIG_IGN);
         vhangup();
diff --git a/ttymodes.c b/ttymodes.c
index c32e213a4..cf4c7d5c6 100644
--- a/ttymodes.c
+++ b/ttymodes.c
@@ -241,6 +241,32 @@ baud_to_speed(int baud)
 }
 
 /*
+ * Encode a special character into SSH line format.
+ */
+static u_int
+special_char_encode(cc_t c)
+{
+#ifdef _POSIX_VDISABLE
+        if (c == _POSIX_VDISABLE)
+                return 255;
+#endif /* _POSIX_VDISABLE */
+        return c;
+}
+
+/*
+ * Decode a special character from SSH line format.
+ */
+static cc_t
+special_char_decode(u_int c)
+{
+#ifdef _POSIX_VDISABLE
+        if (c == 255)
+                return _POSIX_VDISABLE;
+#endif /* _POSIX_VDISABLE */
+        return c;
+}
+
+/*
  * Encodes terminal modes for the terminal referenced by fd
  * or tiop in a portable manner, and appends the modes to a packet
  * being constructed.
@@ -287,7 +313,7 @@ tty_make_modes(int fd, struct termios *tiop)
 #define TTYCHAR(NAME, OP) \
         debug3("tty_make_modes: %d %d", OP, tio.c_cc[NAME]); \
         buffer_put_char(&buf, OP); \
-        put_arg(&buf, tio.c_cc[NAME]);
+        put_arg(&buf, special_char_encode(tio.c_cc[NAME]));
 
 #define TTYMODE(NAME, FIELD, OP) \
         debug3("tty_make_modes: %d %d", OP, ((tio.FIELD & NAME) != 0)); \
@@ -375,7 +401,7 @@ tty_parse_modes(int fd, int *n_bytes_ptr)
 #define TTYCHAR(NAME, OP) \
         case OP: \
           n_bytes += arg_size; \
-          tio.c_cc[NAME] = get_arg(); \
+          tio.c_cc[NAME] = special_char_decode(get_arg()); \
           debug3("tty_parse_modes: %d %d", OP, tio.c_cc[NAME]); \
           break;
 #define TTYMODE(NAME, FIELD, OP) \
diff --git a/version.h b/version.h
index 1a7f23bba..b9c87e2fb 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.43 2005/03/08 23:49:48 djm Exp $ */
+/* $OpenBSD: version.h,v 1.45 2005/08/31 09:28:42 markus Exp $ */
 
-#define SSH_VERSION     "OpenSSH_4.0"
+#define SSH_VERSION     "OpenSSH_4.2"
 
 #define SSH_PORTABLE    "p1"
 #define SSH_RELEASE     SSH_VERSION SSH_PORTABLE